forked from EduCraft/curriculum-project-hub
feat(hub): add org project explorer admin APIs
Expose folder/project tree, create/move/rename/archive, and Feishu binding archive under /api/org/:orgSlug for OWNER/ADMIN sessions.
This commit is contained in:
@@ -0,0 +1,228 @@
|
||||
/**
|
||||
* Org explorer HTTP routes under `/api/org/:orgSlug`.
|
||||
*/
|
||||
import type { PrismaClient } from "@prisma/client";
|
||||
import type { FastifyInstance } from "fastify";
|
||||
import {
|
||||
archiveFolder,
|
||||
archiveOrgProjectChatBinding,
|
||||
archiveProject,
|
||||
createOrgFolder,
|
||||
createOrgProject,
|
||||
getOrgProjectDetail,
|
||||
listOrgExplorer,
|
||||
moveOrgProjectToFolder,
|
||||
renameFolder,
|
||||
renameProject,
|
||||
} from "../../org/explorer.js";
|
||||
import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
|
||||
import { handleRouteError } from "../errors.js";
|
||||
|
||||
export interface ExplorerRouteConfig {
|
||||
readonly prisma: PrismaClient;
|
||||
readonly sessionSecret: string;
|
||||
readonly projectWorkspaceRoot: string;
|
||||
}
|
||||
|
||||
export async function registerExplorerRoutes(
|
||||
app: FastifyInstance,
|
||||
config: ExplorerRouteConfig,
|
||||
): Promise<void> {
|
||||
const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
|
||||
|
||||
app.get("/api/org/:orgSlug/explorer", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
return await listOrgExplorer(config.prisma, auth.organization.id);
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.post("/api/org/:orgSlug/folders", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
const body = request.body as {
|
||||
name?: unknown;
|
||||
parentId?: unknown;
|
||||
sortKey?: unknown;
|
||||
};
|
||||
if (typeof body.name !== "string") {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: "name is required" },
|
||||
});
|
||||
}
|
||||
const folder = await createOrgFolder(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
name: body.name,
|
||||
...(typeof body.parentId === "string" ? { parentId: body.parentId } : {}),
|
||||
...(typeof body.sortKey === "string" ? { sortKey: body.sortKey } : {}),
|
||||
});
|
||||
return reply.status(201).send({
|
||||
id: folder.id,
|
||||
name: folder.name,
|
||||
parentId: folder.parentId,
|
||||
sortKey: folder.sortKey,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.patch("/api/org/:orgSlug/folders/:folderId", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
const body = request.body as {
|
||||
name?: unknown;
|
||||
sortKey?: unknown;
|
||||
parentId?: unknown;
|
||||
};
|
||||
const folder = await renameFolder(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
folderId,
|
||||
...(typeof body.name === "string" ? { name: body.name } : {}),
|
||||
...(typeof body.sortKey === "string" ? { sortKey: body.sortKey } : {}),
|
||||
...(body.parentId === null || typeof body.parentId === "string"
|
||||
? { parentId: body.parentId as string | null }
|
||||
: {}),
|
||||
});
|
||||
return {
|
||||
id: folder.id,
|
||||
name: folder.name,
|
||||
parentId: folder.parentId,
|
||||
sortKey: folder.sortKey,
|
||||
};
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.post("/api/org/:orgSlug/folders/:folderId/archive", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
return await archiveFolder(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
folderId,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.post("/api/org/:orgSlug/projects", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
const body = request.body as { name?: unknown; folderId?: unknown };
|
||||
if (typeof body.name !== "string") {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: "name is required" },
|
||||
});
|
||||
}
|
||||
const result = await createOrgProject(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
actorFeishuOpenId: auth.user.feishuOpenId,
|
||||
name: body.name,
|
||||
workspaceRoot: config.projectWorkspaceRoot,
|
||||
...(typeof body.folderId === "string" ? { folderId: body.folderId } : {}),
|
||||
});
|
||||
return reply.status(201).send(result);
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.get("/api/org/:orgSlug/projects/:projectId", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
return await getOrgProjectDetail(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
projectId,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.patch("/api/org/:orgSlug/projects/:projectId", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
const body = request.body as { name?: unknown };
|
||||
if (typeof body.name !== "string") {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: "name is required" },
|
||||
});
|
||||
}
|
||||
return await renameProject(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
projectId,
|
||||
name: body.name,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.patch("/api/org/:orgSlug/projects/:projectId/folder", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
const body = request.body as { folderId?: unknown };
|
||||
if (body.folderId !== null && typeof body.folderId !== "string") {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: "folderId must be string or null" },
|
||||
});
|
||||
}
|
||||
return await moveOrgProjectToFolder(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
projectId,
|
||||
folderId: body.folderId as string | null,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.post("/api/org/:orgSlug/projects/:projectId/archive", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
return await archiveProject(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
projectId,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.post("/api/org/:orgSlug/projects/:projectId/binding/archive", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
return await archiveOrgProjectChatBinding(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
projectId,
|
||||
actorFeishuOpenId: auth.user.feishuOpenId,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
}
|
||||
@@ -9,6 +9,7 @@ import {
|
||||
ensureOrganizationProjectSettings,
|
||||
setMembersCanCreateProjects,
|
||||
} from "../../projectOnboarding.js";
|
||||
import { registerExplorerRoutes } from "./explorerRoutes.js";
|
||||
|
||||
export interface OrgRouteConfig {
|
||||
readonly prisma: PrismaClient;
|
||||
@@ -74,4 +75,10 @@ export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteCo
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
await registerExplorerRoutes(app, {
|
||||
prisma: config.prisma,
|
||||
sessionSecret: config.sessionSecret,
|
||||
projectWorkspaceRoot: config.projectWorkspaceRoot,
|
||||
});
|
||||
}
|
||||
|
||||
@@ -0,0 +1,350 @@
|
||||
/**
|
||||
* Org project explorer (ADR-0021).
|
||||
*
|
||||
* Folders are transparent navigation nodes (not ACL resources). Project grants
|
||||
* stay on PROJECT. Archive folder refuses when active children/projects remain.
|
||||
*/
|
||||
import type { Prisma, PrismaClient } from "@prisma/client";
|
||||
import {
|
||||
archiveFeishuChatBinding,
|
||||
createFolder,
|
||||
createProjectFromOrgAdmin,
|
||||
moveProjectToFolder,
|
||||
} from "../projectOnboarding.js";
|
||||
|
||||
export interface ExplorerFolderNode {
|
||||
readonly id: string;
|
||||
readonly name: string;
|
||||
readonly parentId: string | null;
|
||||
readonly sortKey: string;
|
||||
readonly projectCount: number;
|
||||
readonly childFolderCount: number;
|
||||
}
|
||||
|
||||
export interface ExplorerProjectNode {
|
||||
readonly id: string;
|
||||
readonly name: string;
|
||||
readonly folderId: string | null;
|
||||
readonly createdAt: string;
|
||||
readonly binding: { readonly chatId: string; readonly createdAt: string } | null;
|
||||
}
|
||||
|
||||
export interface OrgExplorer {
|
||||
readonly folders: readonly ExplorerFolderNode[];
|
||||
readonly projects: readonly ExplorerProjectNode[];
|
||||
}
|
||||
|
||||
export async function listOrgExplorer(
|
||||
prisma: PrismaClient,
|
||||
organizationId: string,
|
||||
): Promise<OrgExplorer> {
|
||||
const [folders, projects] = await Promise.all([
|
||||
prisma.folder.findMany({
|
||||
where: { organizationId, archivedAt: null },
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
parentId: true,
|
||||
sortKey: true,
|
||||
_count: {
|
||||
select: {
|
||||
children: { where: { archivedAt: null } },
|
||||
projects: { where: { archivedAt: null } },
|
||||
},
|
||||
},
|
||||
},
|
||||
orderBy: [{ sortKey: "asc" }, { name: "asc" }],
|
||||
}),
|
||||
prisma.project.findMany({
|
||||
where: { organizationId, archivedAt: null },
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
folderId: true,
|
||||
createdAt: true,
|
||||
groupBindings: {
|
||||
where: { archivedAt: null },
|
||||
select: { chatId: true, createdAt: true },
|
||||
take: 1,
|
||||
},
|
||||
},
|
||||
orderBy: [{ name: "asc" }],
|
||||
}),
|
||||
]);
|
||||
|
||||
return {
|
||||
folders: folders.map((f) => ({
|
||||
id: f.id,
|
||||
name: f.name,
|
||||
parentId: f.parentId,
|
||||
sortKey: f.sortKey,
|
||||
projectCount: f._count.projects,
|
||||
childFolderCount: f._count.children,
|
||||
})),
|
||||
projects: projects.map((p) => {
|
||||
const binding = p.groupBindings[0];
|
||||
return {
|
||||
id: p.id,
|
||||
name: p.name,
|
||||
folderId: p.folderId,
|
||||
createdAt: p.createdAt.toISOString(),
|
||||
binding:
|
||||
binding === undefined
|
||||
? null
|
||||
: { chatId: binding.chatId, createdAt: binding.createdAt.toISOString() },
|
||||
};
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
export async function createOrgFolder(
|
||||
prisma: PrismaClient,
|
||||
input: {
|
||||
readonly organizationId: string;
|
||||
readonly name: string;
|
||||
readonly parentId?: string | undefined;
|
||||
readonly sortKey?: string | undefined;
|
||||
},
|
||||
) {
|
||||
return createFolder(prisma, input);
|
||||
}
|
||||
|
||||
export async function renameFolder(
|
||||
prisma: PrismaClient,
|
||||
input: {
|
||||
readonly organizationId: string;
|
||||
readonly folderId: string;
|
||||
readonly name?: string | undefined;
|
||||
readonly sortKey?: string | undefined;
|
||||
readonly parentId?: string | null | undefined;
|
||||
},
|
||||
) {
|
||||
return prisma.$transaction(async (tx) => {
|
||||
const folder = await requireActiveFolder(tx, input.folderId, input.organizationId);
|
||||
if (input.parentId !== undefined && input.parentId !== null) {
|
||||
if (input.parentId === folder.id) {
|
||||
throw new Error("folder cannot be its own parent");
|
||||
}
|
||||
await requireActiveFolder(tx, input.parentId, input.organizationId);
|
||||
}
|
||||
const name =
|
||||
input.name !== undefined ? requireNonEmpty(input.name, "folder name") : undefined;
|
||||
return tx.folder.update({
|
||||
where: { id: folder.id },
|
||||
data: {
|
||||
...(name !== undefined ? { name } : {}),
|
||||
...(input.sortKey !== undefined ? { sortKey: input.sortKey } : {}),
|
||||
...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
|
||||
},
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Soft-archive a folder. Refuses if it still has active child folders or projects.
|
||||
*/
|
||||
export async function archiveFolder(
|
||||
prisma: PrismaClient,
|
||||
input: { readonly organizationId: string; readonly folderId: string },
|
||||
): Promise<{ readonly archived: true; readonly folderId: string }> {
|
||||
return prisma.$transaction(async (tx) => {
|
||||
const folder = await requireActiveFolder(tx, input.folderId, input.organizationId);
|
||||
const childFolders = await tx.folder.count({
|
||||
where: { parentId: folder.id, archivedAt: null },
|
||||
});
|
||||
if (childFolders > 0) {
|
||||
throw new Error(
|
||||
`cannot archive folder ${folder.id}: still has ${childFolders} active child folder(s)`,
|
||||
);
|
||||
}
|
||||
const projects = await tx.project.count({
|
||||
where: { folderId: folder.id, archivedAt: null },
|
||||
});
|
||||
if (projects > 0) {
|
||||
throw new Error(
|
||||
`cannot archive folder ${folder.id}: still has ${projects} active project(s)`,
|
||||
);
|
||||
}
|
||||
await tx.folder.update({
|
||||
where: { id: folder.id },
|
||||
data: { archivedAt: new Date() },
|
||||
});
|
||||
return { archived: true as const, folderId: folder.id };
|
||||
});
|
||||
}
|
||||
|
||||
export async function createOrgProject(
|
||||
prisma: PrismaClient,
|
||||
input: {
|
||||
readonly organizationId: string;
|
||||
readonly actorFeishuOpenId: string;
|
||||
readonly name: string;
|
||||
readonly workspaceRoot: string;
|
||||
readonly folderId?: string | undefined;
|
||||
},
|
||||
) {
|
||||
return createProjectFromOrgAdmin(prisma, input);
|
||||
}
|
||||
|
||||
export async function renameProject(
|
||||
prisma: PrismaClient,
|
||||
input: {
|
||||
readonly organizationId: string;
|
||||
readonly projectId: string;
|
||||
readonly name: string;
|
||||
},
|
||||
) {
|
||||
const name = requireNonEmpty(input.name, "project name");
|
||||
const project = await requireActiveProject(prisma, input.projectId, input.organizationId);
|
||||
return prisma.project.update({
|
||||
where: { id: project.id },
|
||||
data: { name },
|
||||
select: { id: true, name: true, folderId: true },
|
||||
});
|
||||
}
|
||||
|
||||
export async function moveOrgProjectToFolder(
|
||||
prisma: PrismaClient,
|
||||
input: {
|
||||
readonly organizationId: string;
|
||||
readonly projectId: string;
|
||||
readonly folderId: string | null;
|
||||
},
|
||||
) {
|
||||
await requireActiveProject(prisma, input.projectId, input.organizationId);
|
||||
return moveProjectToFolder(prisma, {
|
||||
projectId: input.projectId,
|
||||
folderId: input.folderId,
|
||||
});
|
||||
}
|
||||
|
||||
export async function archiveProject(
|
||||
prisma: PrismaClient,
|
||||
input: { readonly organizationId: string; readonly projectId: string },
|
||||
): Promise<{ readonly archived: true; readonly projectId: string }> {
|
||||
return prisma.$transaction(async (tx) => {
|
||||
const project = await requireActiveProject(tx, input.projectId, input.organizationId);
|
||||
const activeBinding = await tx.projectGroupBinding.findFirst({
|
||||
where: { projectId: project.id, archivedAt: null },
|
||||
select: { id: true, chatId: true },
|
||||
});
|
||||
const now = new Date();
|
||||
if (activeBinding !== null) {
|
||||
await tx.projectGroupBinding.update({
|
||||
where: { id: activeBinding.id },
|
||||
data: { archivedAt: now },
|
||||
});
|
||||
await tx.permissionGrant.updateMany({
|
||||
where: {
|
||||
resourceType: "PROJECT",
|
||||
resourceId: project.id,
|
||||
principalType: "FEISHU_CHAT",
|
||||
principalId: activeBinding.chatId,
|
||||
revokedAt: null,
|
||||
},
|
||||
data: { revokedAt: now },
|
||||
});
|
||||
}
|
||||
await tx.project.update({
|
||||
where: { id: project.id },
|
||||
data: { archivedAt: now },
|
||||
});
|
||||
return { archived: true as const, projectId: project.id };
|
||||
});
|
||||
}
|
||||
|
||||
export async function getOrgProjectDetail(
|
||||
prisma: PrismaClient,
|
||||
input: { readonly organizationId: string; readonly projectId: string },
|
||||
) {
|
||||
const project = await prisma.project.findFirst({
|
||||
where: {
|
||||
id: input.projectId,
|
||||
organizationId: input.organizationId,
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
folderId: true,
|
||||
workspaceDir: true,
|
||||
createdAt: true,
|
||||
archivedAt: true,
|
||||
createdBy: { select: { id: true, displayName: true, feishuOpenId: true } },
|
||||
folder: { select: { id: true, name: true } },
|
||||
groupBindings: {
|
||||
where: { archivedAt: null },
|
||||
select: { chatId: true, createdAt: true },
|
||||
take: 1,
|
||||
},
|
||||
},
|
||||
});
|
||||
if (project === null) {
|
||||
throw new Error(`project not found: ${input.projectId}`);
|
||||
}
|
||||
const binding = project.groupBindings[0];
|
||||
return {
|
||||
id: project.id,
|
||||
name: project.name,
|
||||
folderId: project.folderId,
|
||||
folder: project.folder,
|
||||
workspaceDir: project.workspaceDir,
|
||||
createdAt: project.createdAt.toISOString(),
|
||||
archivedAt: project.archivedAt?.toISOString() ?? null,
|
||||
createdBy: project.createdBy,
|
||||
binding:
|
||||
binding === undefined
|
||||
? null
|
||||
: { chatId: binding.chatId, createdAt: binding.createdAt.toISOString() },
|
||||
};
|
||||
}
|
||||
|
||||
export async function archiveOrgProjectChatBinding(
|
||||
prisma: PrismaClient,
|
||||
input: {
|
||||
readonly organizationId: string;
|
||||
readonly projectId: string;
|
||||
readonly actorFeishuOpenId: string;
|
||||
},
|
||||
) {
|
||||
await requireActiveProject(prisma, input.projectId, input.organizationId);
|
||||
return archiveFeishuChatBinding(prisma, {
|
||||
projectId: input.projectId,
|
||||
actorFeishuOpenId: input.actorFeishuOpenId,
|
||||
});
|
||||
}
|
||||
|
||||
async function requireActiveFolder(
|
||||
prisma: PrismaClient | Prisma.TransactionClient,
|
||||
folderId: string,
|
||||
organizationId: string,
|
||||
): Promise<{ readonly id: string; readonly organizationId: string }> {
|
||||
const folder = await prisma.folder.findUnique({
|
||||
where: { id: folderId },
|
||||
select: { id: true, organizationId: true, archivedAt: true },
|
||||
});
|
||||
if (folder === null || folder.archivedAt !== null || folder.organizationId !== organizationId) {
|
||||
throw new Error(`active folder not found: ${folderId}`);
|
||||
}
|
||||
return folder;
|
||||
}
|
||||
|
||||
async function requireActiveProject(
|
||||
prisma: PrismaClient | Prisma.TransactionClient,
|
||||
projectId: string,
|
||||
organizationId: string,
|
||||
): Promise<{ readonly id: string; readonly organizationId: string }> {
|
||||
const project = await prisma.project.findUnique({
|
||||
where: { id: projectId },
|
||||
select: { id: true, organizationId: true, archivedAt: true },
|
||||
});
|
||||
if (project === null || project.archivedAt !== null || project.organizationId !== organizationId) {
|
||||
throw new Error(`active project not found: ${projectId}`);
|
||||
}
|
||||
return project;
|
||||
}
|
||||
|
||||
function requireNonEmpty(value: string, label: string): string {
|
||||
const trimmed = value.trim();
|
||||
if (trimmed === "") throw new Error(`${label} is required`);
|
||||
return trimmed;
|
||||
}
|
||||
@@ -0,0 +1,224 @@
|
||||
/**
|
||||
* Org explorer API integration tests (ADR-0021).
|
||||
*/
|
||||
import { mkdtemp, rm, stat } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import Fastify from "fastify";
|
||||
import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
|
||||
import { registerAdminPlugin } from "../../src/admin/plugin.js";
|
||||
import {
|
||||
mintSessionToken,
|
||||
sessionCookieHeader,
|
||||
} from "../../src/admin/routes/authRoutes.js";
|
||||
import { DEFAULT_ORG_ID, prisma, resetDb } from "./helpers.js";
|
||||
|
||||
const SESSION_SECRET = "integration-test-session-secret";
|
||||
const workspaceRoots: string[] = [];
|
||||
|
||||
async function buildApp(workspaceRoot: string) {
|
||||
const app = Fastify({ logger: false });
|
||||
await registerAdminPlugin(app, {
|
||||
prisma,
|
||||
sessionSecret: SESSION_SECRET,
|
||||
publicBaseUrl: "http://127.0.0.1:8788",
|
||||
feishuAppId: "cli_test",
|
||||
feishuAppSecret: "secret_test",
|
||||
projectWorkspaceRoot: workspaceRoot,
|
||||
cookieSecure: false,
|
||||
});
|
||||
await app.ready();
|
||||
return app;
|
||||
}
|
||||
|
||||
async function seedAdmin(): Promise<string> {
|
||||
await prisma.user.create({
|
||||
data: { id: "u-admin", feishuOpenId: "ou_admin", displayName: "Admin" },
|
||||
});
|
||||
await prisma.organizationMembership.create({
|
||||
data: { organizationId: DEFAULT_ORG_ID, userId: "u-admin", role: "ADMIN" },
|
||||
});
|
||||
return mintSessionToken({ userId: "u-admin", feishuOpenId: "ou_admin" }, SESSION_SECRET);
|
||||
}
|
||||
|
||||
async function tempWorkspaceRoot(): Promise<string> {
|
||||
const root = await mkdtemp(join(tmpdir(), "cph-admin-explorer-"));
|
||||
workspaceRoots.push(root);
|
||||
return root;
|
||||
}
|
||||
|
||||
describe("admin explorer API", () => {
|
||||
beforeEach(async () => {
|
||||
await resetDb();
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
while (workspaceRoots.length > 0) {
|
||||
const root = workspaceRoots.pop();
|
||||
if (root !== undefined) await rm(root, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
it("creates folder + project and lists them in explorer", async () => {
|
||||
const token = await seedAdmin();
|
||||
const workspaceRoot = await tempWorkspaceRoot();
|
||||
const app = await buildApp(workspaceRoot);
|
||||
try {
|
||||
const folderRes = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/folders",
|
||||
headers: {
|
||||
cookie: sessionCookieHeader(token),
|
||||
"content-type": "application/json",
|
||||
},
|
||||
payload: { name: "Grade 7", sortKey: "010000" },
|
||||
});
|
||||
expect(folderRes.statusCode).toBe(201);
|
||||
const folder = folderRes.json() as { id: string };
|
||||
|
||||
const projectRes = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/projects",
|
||||
headers: {
|
||||
cookie: sessionCookieHeader(token),
|
||||
"content-type": "application/json",
|
||||
},
|
||||
payload: { name: "Newton", folderId: folder.id },
|
||||
});
|
||||
expect(projectRes.statusCode).toBe(201);
|
||||
const project = projectRes.json() as {
|
||||
projectId: string;
|
||||
folderId: string;
|
||||
workspaceDir: string;
|
||||
};
|
||||
expect(project.folderId).toBe(folder.id);
|
||||
expect((await stat(project.workspaceDir)).isDirectory()).toBe(true);
|
||||
|
||||
const explorerRes = await app.inject({
|
||||
method: "GET",
|
||||
url: "/api/org/test-default/explorer",
|
||||
headers: { cookie: sessionCookieHeader(token) },
|
||||
});
|
||||
expect(explorerRes.statusCode).toBe(200);
|
||||
const explorer = explorerRes.json() as {
|
||||
folders: Array<{ id: string; name: string; projectCount: number }>;
|
||||
projects: Array<{ id: string; name: string; folderId: string | null }>;
|
||||
};
|
||||
expect(explorer.folders.some((f) => f.id === folder.id && f.projectCount === 1)).toBe(true);
|
||||
expect(explorer.projects).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
id: project.projectId,
|
||||
name: "Newton",
|
||||
folderId: folder.id,
|
||||
}),
|
||||
]),
|
||||
);
|
||||
} finally {
|
||||
await app.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("moves project between folders and refuses archive of non-empty folder", async () => {
|
||||
const token = await seedAdmin();
|
||||
const workspaceRoot = await tempWorkspaceRoot();
|
||||
const app = await buildApp(workspaceRoot);
|
||||
try {
|
||||
const cookie = sessionCookieHeader(token);
|
||||
const a = (
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/folders",
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { name: "A" },
|
||||
})
|
||||
).json() as { id: string };
|
||||
const b = (
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/folders",
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { name: "B" },
|
||||
})
|
||||
).json() as { id: string };
|
||||
const project = (
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/org/test-default/projects",
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { name: "P", folderId: a.id },
|
||||
})
|
||||
).json() as { projectId: string };
|
||||
|
||||
const moveRes = await app.inject({
|
||||
method: "PATCH",
|
||||
url: `/api/org/test-default/projects/${project.projectId}/folder`,
|
||||
headers: { cookie, "content-type": "application/json" },
|
||||
payload: { folderId: b.id },
|
||||
});
|
||||
expect(moveRes.statusCode).toBe(200);
|
||||
expect(moveRes.json()).toEqual({
|
||||
projectId: project.projectId,
|
||||
folderId: b.id,
|
||||
});
|
||||
|
||||
const refuse = await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/org/test-default/folders/${b.id}/archive`,
|
||||
headers: { cookie },
|
||||
});
|
||||
expect({ status: refuse.statusCode, body: refuse.json() }).toEqual({
|
||||
status: 403,
|
||||
body: expect.objectContaining({
|
||||
error: expect.objectContaining({ code: "forbidden" }),
|
||||
}),
|
||||
});
|
||||
|
||||
await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/org/test-default/projects/${project.projectId}/archive`,
|
||||
headers: { cookie },
|
||||
});
|
||||
const ok = await app.inject({
|
||||
method: "POST",
|
||||
url: `/api/org/test-default/folders/${b.id}/archive`,
|
||||
headers: { cookie },
|
||||
});
|
||||
expect(ok.statusCode).toBe(200);
|
||||
expect(ok.json()).toEqual({ archived: true, folderId: b.id });
|
||||
} finally {
|
||||
await app.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("blocks cross-org project access by id", async () => {
|
||||
const token = await seedAdmin();
|
||||
await prisma.organization.create({
|
||||
data: { id: "org_other", slug: "other", name: "Other" },
|
||||
});
|
||||
await prisma.project.create({
|
||||
data: {
|
||||
id: "p-other",
|
||||
organizationId: "org_other",
|
||||
name: "Other project",
|
||||
workspaceDir: "/tmp/other",
|
||||
},
|
||||
});
|
||||
const workspaceRoot = await tempWorkspaceRoot();
|
||||
const app = await buildApp(workspaceRoot);
|
||||
try {
|
||||
const res = await app.inject({
|
||||
method: "GET",
|
||||
url: "/api/org/test-default/projects/p-other",
|
||||
headers: { cookie: sessionCookieHeader(token) },
|
||||
});
|
||||
expect(res.statusCode).toBe(404);
|
||||
} finally {
|
||||
await app.close();
|
||||
}
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user