forked from EduCraft/curriculum-project-hub
feat(hub): add org project explorer admin APIs
Expose folder/project tree, create/move/rename/archive, and Feishu binding archive under /api/org/:orgSlug for OWNER/ADMIN sessions.
This commit is contained in:
@@ -0,0 +1,224 @@
|
||||
/**
|
||||
* Org explorer API integration tests (ADR-0021).
|
||||
*/
|
||||
import { mkdtemp, rm, stat } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import Fastify from "fastify";
|
||||
import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
|
||||
import { registerAdminPlugin } from "../../src/admin/plugin.js";
|
||||
import {
|
||||
mintSessionToken,
|
||||
sessionCookieHeader,
|
||||
} from "../../src/admin/routes/authRoutes.js";
|
||||
import { DEFAULT_ORG_ID, prisma, resetDb } from "./helpers.js";
|
||||
|
||||
const SESSION_SECRET = "integration-test-session-secret";
|
||||
const workspaceRoots: string[] = [];
|
||||
|
||||
async function buildApp(workspaceRoot: string) {
|
||||
const app = Fastify({ logger: false });
|
||||
await registerAdminPlugin(app, {
|
||||
prisma,
|
||||
sessionSecret: SESSION_SECRET,
|
||||
publicBaseUrl: "http://127.0.0.1:8788",
|
||||
feishuAppId: "cli_test",
|
||||
feishuAppSecret: "secret_test",
|
||||
projectWorkspaceRoot: workspaceRoot,
|
||||
cookieSecure: false,
|
||||
});
|
||||
await app.ready();
|
||||
return app;
|
||||
}
|
||||
|
||||
async function seedAdmin(): Promise<string> {
|
||||
await prisma.user.create({
|
||||
data: { id: "u-admin", feishuOpenId: "ou_admin", displayName: "Admin" },
|
||||
});
|
||||
await prisma.organizationMembership.create({
|
||||
data: { organizationId: DEFAULT_ORG_ID, userId: "u-admin", role: "ADMIN" },
|
||||
});
|
||||
return mintSessionToken({ userId: "u-admin", feishuOpenId: "ou_admin" }, SESSION_SECRET);
|
||||
}
|
||||
|
||||
async function tempWorkspaceRoot(): Promise<string> {
|
||||
const root = await mkdtemp(join(tmpdir(), "cph-admin-explorer-"));
|
||||
workspaceRoots.push(root);
|
||||
return root;
|
||||
}
|
||||
|
||||
describe("admin explorer API", () => {
|
||||
beforeEach(async () => {
|
||||
await resetDb();
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
while (workspaceRoots.length > 0) {
|
||||
const root = workspaceRoots.pop();
|
||||
if (root !== undefined) await rm(root, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
it("creates folder + project and lists them in explorer", async () => {
|
||||
const token = await seedAdmin();
|
||||
const workspaceRoot = await tempWorkspaceRoot();
|
||||
const app = await buildApp(workspaceRoot);
|
||||
try {
|
||||
const folderRes = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/folders",
|
||||
headers: {
|
||||
cookie: sessionCookieHeader(token),
|
||||
"content-type": "application/json",
|
||||
},
|
||||
payload: { name: "Grade 7", sortKey: "010000" },
|
||||
});
|
||||
expect(folderRes.statusCode).toBe(201);
|
||||
const folder = folderRes.json() as { id: string };
|
||||
|
||||
const projectRes = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/projects",
|
||||
headers: {
|
||||
cookie: sessionCookieHeader(token),
|
||||
"content-type": "application/json",
|
||||
},
|
||||
payload: { name: "Newton", folderId: folder.id },
|
||||
});
|
||||
expect(projectRes.statusCode).toBe(201);
|
||||
const project = projectRes.json() as {
|
||||
projectId: string;
|
||||
folderId: string;
|
||||
workspaceDir: string;
|
||||
};
|
||||
expect(project.folderId).toBe(folder.id);
|
||||
expect((await stat(project.workspaceDir)).isDirectory()).toBe(true);
|
||||
|
||||
const explorerRes = await app.inject({
|
||||
method: "GET",
|
||||
url: "/api/org/test-default/explorer",
|
||||
headers: { cookie: sessionCookieHeader(token) },
|
||||
});
|
||||
expect(explorerRes.statusCode).toBe(200);
|
||||
const explorer = explorerRes.json() as {
|
||||
folders: Array<{ id: string; name: string; projectCount: number }>;
|
||||
projects: Array<{ id: string; name: string; folderId: string | null }>;
|
||||
};
|
||||
expect(explorer.folders.some((f) => f.id === folder.id && f.projectCount === 1)).toBe(true);
|
||||
expect(explorer.projects).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
id: project.projectId,
|
||||
name: "Newton",
|
||||
folderId: folder.id,
|
||||
}),
|
||||
]),
|
||||
);
|
||||
} finally {
|
||||
await app.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("moves project between folders and refuses archive of non-empty folder", async () => {
|
||||
const token = await seedAdmin();
|
||||
const workspaceRoot = await tempWorkspaceRoot();
|
||||
const app = await buildApp(workspaceRoot);
|
||||
try {
|
||||
const cookie = sessionCookieHeader(token);
|
||||
const a = (
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/folders",
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { name: "A" },
|
||||
})
|
||||
).json() as { id: string };
|
||||
const b = (
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/folders",
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { name: "B" },
|
||||
})
|
||||
).json() as { id: string };
|
||||
const project = (
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/projects",
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { name: "P", folderId: a.id },
|
||||
})
|
||||
).json() as { projectId: string };
|
||||
|
||||
const moveRes = await app.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/org/test-default/projects/${project.projectId}/folder`,
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { folderId: b.id },
|
||||
});
|
||||
expect(moveRes.statusCode).toBe(200);
|
||||
expect(moveRes.json()).toEqual({
|
||||
projectId: project.projectId,
|
||||
folderId: b.id,
|
||||
});
|
||||
|
||||
const refuse = await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/org/test-default/folders/${b.id}/archive`,
|
||||
headers: { cookie },
|
||||
});
|
||||
expect({ status: refuse.statusCode, body: refuse.json() }).toEqual({
|
||||
status: 403,
|
||||
body: expect.objectContaining({
|
||||
error: expect.objectContaining({ code: "forbidden" }),
|
||||
}),
|
||||
});
|
||||
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/org/test-default/projects/${project.projectId}/archive`,
|
||||
headers: { cookie },
|
||||
});
|
||||
const ok = await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/org/test-default/folders/${b.id}/archive`,
|
||||
headers: { cookie },
|
||||
});
|
||||
expect(ok.statusCode).toBe(200);
|
||||
expect(ok.json()).toEqual({ archived: true, folderId: b.id });
|
||||
} finally {
|
||||
await app.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("blocks cross-org project access by id", async () => {
|
||||
const token = await seedAdmin();
|
||||
await prisma.organization.create({
|
||||
data: { id: "org_other", slug: "other", name: "Other" },
|
||||
});
|
||||
await prisma.project.create({
|
||||
data: {
|
||||
id: "p-other",
|
||||
organizationId: "org_other",
|
||||
name: "Other project",
|
||||
workspaceDir: "/tmp/other",
|
||||
},
|
||||
});
|
||||
const workspaceRoot = await tempWorkspaceRoot();
|
||||
const app = await buildApp(workspaceRoot);
|
||||
try {
|
||||
const res = await app.inject({
|
||||
method: "GET",
|
||||
url: "/api/org/test-default/projects/p-other",
|
||||
headers: { cookie: sessionCookieHeader(token) },
|
||||
});
|
||||
expect(res.statusCode).toBe(404);
|
||||
} finally {
|
||||
await app.close();
|
||||
}
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user