feat(hub): add org members, teams, and project team-access APIs

Manage memberships with last-OWNER protection, team lifecycle (archive revokes TEAM grants), and TEAM→PROJECT access under org admin auth.
2026-07-10 00:55:34 +08:00
parent 1f8510a47f
commit 683d5674d1
7 changed files with 1008 additions and 0 deletions
@@ -0,0 +1,161 @@
+/**
+ * Org members + teams + team-access API tests.
+ */
+import Fastify from "fastify";
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { registerAdminPlugin } from "../../src/admin/plugin.js";
+import {
+  mintSessionToken,
+  sessionCookieHeader,
+} from "../../src/admin/routes/authRoutes.js";
+import { DEFAULT_ORG_ID, prisma, resetDb } from "./helpers.js";
+
+const SESSION_SECRET = "integration-test-session-secret";
+
+async function buildApp() {
+  const app = Fastify({ logger: false });
+  await registerAdminPlugin(app, {
+    prisma,
+    sessionSecret: SESSION_SECRET,
+    publicBaseUrl: "http://127.0.0.1:8788",
+    feishuAppId: "cli_test",
+    feishuAppSecret: "secret_test",
+    projectWorkspaceRoot: "/tmp/cph-test-ws",
+    cookieSecure: false,
+  });
+  await app.ready();
+  return app;
+}
+
+async function seedOwner(): Promise<string> {
+  await prisma.user.create({
+    data: { id: "u-owner", feishuOpenId: "ou_owner", displayName: "Owner" },
+  });
+  await prisma.organizationMembership.create({
+    data: { organizationId: DEFAULT_ORG_ID, userId: "u-owner", role: "OWNER" },
+  });
+  return mintSessionToken({ userId: "u-owner", feishuOpenId: "ou_owner" }, SESSION_SECRET);
+}
+
+describe("admin members + teams API", () => {
+  beforeEach(async () => {
+    await resetDb();
+  });
+
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("adds members and enforces last-OWNER protection", async () => {
+    const token = await seedOwner();
+    const app = await buildApp();
+    try {
+      const cookie = sessionCookieHeader(token);
+
+      const add = await app.inject({
+        method: "POST",
+        url: "/api/org/test-default/members",
+        headers: { cookie, "content-type": "application/json" },
+        payload: { feishuOpenId: "ou_teacher", displayName: "Teacher", role: "ADMIN" },
+      });
+      expect(add.statusCode).toBe(201);
+      const teacher = add.json() as { userId: string; role: string };
+      expect(teacher.role).toBe("ADMIN");
+
+      const list = await app.inject({
+        method: "GET",
+        url: "/api/org/test-default/members",
+        headers: { cookie },
+      });
+      expect(list.statusCode).toBe(200);
+      expect((list.json() as { members: unknown[] }).members).toHaveLength(2);
+
+      const refuse = await app.inject({
+        method: "POST",
+        url: "/api/org/test-default/members/u-owner/revoke",
+        headers: { cookie },
+      });
+      expect(refuse.statusCode).toBe(403);
+      expect(JSON.stringify(refuse.json())).toContain("last OWNER");
+    } finally {
+      await app.close();
+    }
+  });
+
+  it("creates team, adds member, grants project access, archives team", async () => {
+    const token = await seedOwner();
+    await prisma.user.create({
+      data: { id: "u-m", feishuOpenId: "ou_m", displayName: "M" },
+    });
+    await prisma.organizationMembership.create({
+      data: { organizationId: DEFAULT_ORG_ID, userId: "u-m", role: "MEMBER" },
+    });
+    await prisma.project.create({
+      data: {
+        id: "p1",
+        organizationId: DEFAULT_ORG_ID,
+        name: "P1",
+        workspaceDir: "/tmp/p1",
+      },
+    });
+
+    const app = await buildApp();
+    try {
+      const cookie = sessionCookieHeader(token);
+
+      const teamRes = await app.inject({
+        method: "POST",
+        url: "/api/org/test-default/teams",
+        headers: { cookie, "content-type": "application/json" },
+        payload: { slug: "math", name: "Math Team" },
+      });
+      expect(teamRes.statusCode).toBe(201);
+      const team = teamRes.json() as { id: string };
+
+      const memberRes = await app.inject({
+        method: "POST",
+        url: `/api/org/test-default/teams/${team.id}/members`,
+        headers: { cookie, "content-type": "application/json" },
+        payload: { userId: "u-m" },
+      });
+      expect(memberRes.statusCode).toBe(201);
+
+      const grantRes = await app.inject({
+        method: "PUT",
+        url: "/api/org/test-default/projects/p1/team-access",
+        headers: { cookie, "content-type": "application/json" },
+        payload: { teamId: team.id, role: "EDIT" },
+      });
+      expect(grantRes.statusCode).toBe(200);
+      expect(grantRes.json()).toEqual(
+        expect.objectContaining({ teamId: team.id, role: "EDIT" }),
+      );
+
+      const listAccess = await app.inject({
+        method: "GET",
+        url: "/api/org/test-default/projects/p1/team-access",
+        headers: { cookie },
+      });
+      expect((listAccess.json() as { access: unknown[] }).access).toHaveLength(1);
+
+      const archive = await app.inject({
+        method: "POST",
+        url: `/api/org/test-default/teams/${team.id}/archive`,
+        headers: { cookie },
+      });
+      expect(archive.statusCode).toBe(200);
+      expect(archive.json()).toEqual(
+        expect.objectContaining({ archived: true, revokedGrants: 1 }),
+      );
+
+      const after = await app.inject({
+        method: "GET",
+        url: "/api/org/test-default/projects/p1/team-access",
+        headers: { cookie },
+      });
+      expect((after.json() as { access: unknown[] }).access).toHaveLength(0);
+    } finally {
+      await app.close();
+    }
+  });
+});