1
9import { beforeEach, describe, expect, it, vi } from "vitest";
10import { resolveEnforcedSsoOrgs } from "../enforcement.js";
11
12interface PrismaMock {
13 user: { findUnique: ReturnType<typeof vi.fn> };
14 ssoProvider: { findMany: ReturnType<typeof vi.fn> };
15}
16const mockPrisma = (): PrismaMock => ({
17 user: { findUnique: vi.fn() },
18 ssoProvider: { findMany: vi.fn() }
19});
20
21beforeEach(() => vi.clearAllMocks());
22
23describe("TASK-0131 resolveEnforcedSsoOrgs", () => {
24 it("returns [] for an unknown email (no user)", async () => {
25 const prisma = mockPrisma();
26 prisma.user.findUnique.mockResolvedValue(null);
27 expect(await resolveEnforcedSsoOrgs(prisma as never, "ghost@nowhere.test")).toEqual([]);
28 expect(prisma.ssoProvider.findMany).not.toHaveBeenCalled();
29 });
30
31 it("returns [] for a user with NO org memberships", async () => {
32 const prisma = mockPrisma();
33 prisma.user.findUnique.mockResolvedValue({ orgMemberships: [] });
34 expect(await resolveEnforcedSsoOrgs(prisma as never, "solo@nowhere.test")).toEqual([]);
35 expect(prisma.ssoProvider.findMany).not.toHaveBeenCalled();
36 });
37
38 it("returns the orgs with ENFORCED providers (enforce=true only)", async () => {
39 const prisma = mockPrisma();
40 prisma.user.findUnique.mockResolvedValue({
41 orgMemberships: [{ organizationId: "org_a" }, { organizationId: "org_b" }, { organizationId: "org_c" }]
42 });
43 prisma.ssoProvider.findMany.mockResolvedValue([
44 { organizationId: "org_a", type: "SAML", organization: { slug: "acme" } },
45 { organizationId: "org_c", type: "OIDC", organization: { slug: "globex" } }
46 ]);
47 const res = await resolveEnforcedSsoOrgs(prisma as never, "alice@acme.test");
48 expect(res).toEqual([
49 { orgId: "org_a", slug: "acme", type: "SAML" },
50 { orgId: "org_c", slug: "globex", type: "OIDC" }
51 ]);
52
53 expect(prisma.ssoProvider.findMany).toHaveBeenCalledWith({
54 where: { organizationId: { in: ["org_a", "org_b", "org_c"] }, enforce: true },
55 select: { organizationId: true, type: true, organization: { select: { slug: true } } }
56 });
57 });
58
59 it("returns [] when none of the user's orgs enforce SSO", async () => {
60 const prisma = mockPrisma();
61 prisma.user.findUnique.mockResolvedValue({ orgMemberships: [{ organizationId: "org_a" }] });
62 prisma.ssoProvider.findMany.mockResolvedValue([]);
63 expect(await resolveEnforcedSsoOrgs(prisma as never, "alice@acme.test")).toEqual([]);
64 });
65
66 it("lowercases the email before the user lookup", async () => {
67 const prisma = mockPrisma();
68 prisma.user.findUnique.mockResolvedValue({ orgMemberships: [] });
69 await resolveEnforcedSsoOrgs(prisma as never, "ALICE@acme.test");
70 expect(prisma.user.findUnique).toHaveBeenCalledWith({
71 where: { email: "alice@acme.test" },
72 select: { orgMemberships: { select: { organizationId: true } } }
73 });
74 });
75});
76
