seed.ts · Source

seed.tstests/integration/helpers/seed.tsraw ← helpers8,130 B← Back to the app
1/**
2 * AI Software Factory — Integration seed helpers.
3 *
4 * Data fixtures for integration specs. Two rules keep these specs honest:
5 *
6 *   1. Prefer going THROUGH THE API (register → login → create workspace)
7 *      so the spec exercises the real authorization layer. `createUser` /
8 *      `createWorkspace` below do exactly that via the app's HTTP surface.
9 *
10 *   2. Use direct Prisma writes only for state the API cannot (or should
11 *      not) create on demand — e.g. forcing a WebhookDelivery row to
12 *      `PENDING`, backdating an audit log, or bulk-seeding 10k records for
13 *      a query test. Those helpers are clearly marked and must never be
14 *      used to bypass authorization (the spec's job is to prove the API
15 *      enforces it).
16 */
17import type { PrismaClient } from "@prisma/client";
18 
19export interface ApiRequest {
20  (
21    method: string,
22    urlPath: string,
23    opts?: { body?: unknown; headers?: Record<string, string> },
24  ): Promise<Response>;
25}
26 
27/** Random unique email (collision-safe across shared-container runs). */
28export function uniqueEmail(prefix = "integ"): string {
29  return `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@factory.local`;
30}
31 
32export function randomPassword(): string {
33  return `pw-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
34}
35 
36/**
37 * Register + log a user in through the API. Returns the user id and the
38 * access token (specs that need to call as this user pass it as a Bearer
39 * header; cookie-based flows use the response Set-Cookie via fetch's
40 * `credentials: "include"`).
41 */
42export async function createUser(
43  request: ApiRequest,
44  opts?: { name?: string },
45): Promise<{ userId: string; email: string; password: string; accessToken?: string }> {
46  const email = uniqueEmail();
47  const password = randomPassword();
48  const reg = await request("POST", "/api/v1/auth/register", {
49    body: { email, password, name: opts?.name ?? "Integration User" },
50  });
51  if (reg.status !== 201 && reg.status !== 200) {
52    throw new Error(`register failed (${reg.status}): ${await reg.text()}`);
53  }
54  const login = await request("POST", "/api/v1/auth/login", {
55    body: { email, password },
56  });
57  if (login.status !== 200) {
58    throw new Error(`login failed (${login.status}): ${await login.text()}`);
59  }
60  const body = (await login.json()) as {
61    user?: { id: string };
62    accessToken?: string;
63  };
64  return {
65    userId: body.user?.id ?? "",
66    email,
67    password,
68    accessToken: body.accessToken,
69  };
70}
71 
72/** Bearer header for a user created by createUser(). */
73export function authHeaders(accessToken: string): Record<string, string> {
74  return { Authorization: `Bearer ${accessToken}` };
75}
76 
77/**
78 * Create a workspace through the API (the caller becomes OWNER). Returns
79 * the workspace id + slug.
80 */
81export async function createWorkspace(
82  request: ApiRequest,
83  headers: Record<string, string>,
84  name = `Integ WS ${Date.now()}`,
85): Promise<{ workspaceId: string; slug: string }> {
86  const res = await request("POST", "/api/v1/workspaces", {
87    headers,
88    body: { name },
89  });
90  if (res.status !== 201 && res.status !== 200) {
91    throw new Error(`createWorkspace failed (${res.status}): ${await res.text()}`);
92  }
93  // The API returns the BARE workspace + role (workspaces.service.ts
94  // `create` → `{ ...workspace, role: "OWNER" }`) — no wrapper. (D4 repair,
95  // TASK-0095 S9: this helper parsed a `{ workspace }` wrapper the API never
96  // emits.)
97  const body = (await res.json()) as { id: string; slug: string };
98  return { workspaceId: body.id, slug: body.slug };
99}
100 
101/**
102 * Add a registered user to a workspace through the internal test seam
103 * (TASK-0095 S9 — the D3 unblock). `createTestApp` configures
104 * `INTERNAL_SERVICE_TOKEN` + `INTERNAL_TEST_SEAM=1`, so the in-process app
105 * opens `POST /internal/workspaces/:id/members` (service-token guard,
106 * fail-closed in production). Authorization is DB-driven, so the membership
107 * takes effect immediately — no re-login of `member` needed.
108 *
109 * The public invite flow (D3) hashes the token and mails it, so an automated
110 * test cannot complete it without a mail server; this seam is the recorded
111 * test-only alternative (never reachable in production — see the seam's
112 * module docs).
113 */
114export async function addMemberViaSeam(
115  request: ApiRequest,
116  internalServiceToken: string,
117  workspaceId: string,
118  email: string,
119  role: "ADMIN" | "MEMBER" | "GUEST" = "MEMBER",
120): Promise<void> {
121  const res = await request("POST", `/internal/workspaces/${workspaceId}/members`, {
122    headers: { Authorization: `Bearer ${internalServiceToken}` },
123    body: { email, role },
124  });
125  if (res.status !== 201 && res.status !== 200) {
126    throw new Error(`addMemberViaSeam failed (${res.status}): ${await res.text()}`);
127  }
128}
129 
130// ---------------------------------------------------------------------------
131// Direct-DB helpers (state the API cannot create on demand)
132// ---------------------------------------------------------------------------
133 
134/**
135 * Bulk-seed records into a database (bypasses the API on purpose — this is
136 * a performance/fixture helper; the 10k-row test needs a seed the API loop
137 * would take minutes to produce). Idempotency is NOT provided; call once.
138 *
139 * Each seeded record gets one RecordProperty (the database's TITLE property,
140 * which always exists) with a stable, unique title. Records created this way
141 * have pageId = null — specs that need record-backed pages create those
142 * records through the API instead.
143 */
144export async function seedRecords(
145  prisma: PrismaClient,
146  databaseId: string,
147  workspaceId: string,
148  count: number,
149  batchSize = 500,
150): Promise<number> {
151  const titleProp = await prisma.databaseProperty.findFirst({
152    where: { databaseId, type: "TITLE" },
153  });
154  if (!titleProp) {
155    throw new Error(
156      `seedRecords: database ${databaseId} has no TITLE property — create the ` +
157        "database via the API first (it always adds the title property).",
158    );
159  }
160 
161  let inserted = 0;
162  for (let offset = 0; offset < count; offset += batchSize) {
163    const n = Math.min(batchSize, count - offset);
164    // Positions are unique per database by construction, so they double as a
165    // safe join key to pair the freshly-created records (ids are generated
166    // by createMany and not returned) with their title property rows.
167    const positions = Array.from({ length: n }, (_, i) =>
168      `a${String(offset + i).padStart(12, "0")}`,
169    );
170    await prisma.databaseRecord.createMany({
171      data: positions.map((position) => ({ workspaceId, databaseId, position })),
172    });
173 
174    const created = await prisma.databaseRecord.findMany({
175      where: { databaseId, position: { in: positions } },
176      select: { id: true, position: true },
177    });
178    const props = created.map((rec) => ({
179      recordId: rec.id,
180      propertyId: titleProp.id,
181      value: { title: `Seeded record ${rec.position.slice(1)}` },
182    }));
183    if (props.length) {
184      await prisma.recordProperty.createMany({ data: props });
185    }
186    inserted += n;
187  }
188  return inserted;
189}
190 
191/**
192 * Force a webhook delivery row to a terminal state (the API only advances
193 * deliveries through the worker; specs verify the worker's effect by
194 * inspecting the row it leaves behind).
195 */
196export async function markDelivery(
197  prisma: PrismaClient,
198  deliveryId: string,
199  status: "DELIVERED" | "FAILED",
200): Promise<void> {
201  await prisma.webhookDelivery.update({
202    where: { id: deliveryId },
203    data: { status, attemptedAt: new Date() },
204  });
205}
206 
207/**
208 * Count audit events for an actor+action (spec asserts security-sensitive
209 * operations were audited).
210 */
211export async function countAuditEvents(
212  prisma: PrismaClient,
213  where: { actorId?: string; action?: string; actionPrefix?: string },
214): Promise<number> {
215  return prisma.auditLog.count({
216    where: {
217      ...(where.actorId ? { actorId: where.actorId } : {}),
218      ...(where.action
219        ? { action: where.action }
220        : where.actionPrefix
221          ? { action: { startsWith: where.actionPrefix } }
222          : {}),
223    },
224  });
225}
226