ERP/tests/identity.test.ts

import { describe, expect, it } from "vitest";
import bcrypt from "bcryptjs";
import { User } from "@/lib/server/models/User";
import * as users from "@/app/api/users/route";
import * as login from "@/app/api/auth/login/route";
import * as me from "@/app/api/auth/me/route";
import * as platformBusinesses from "@/app/api/platform/businesses/route";
import { ACCESS_COOKIE } from "@/lib/server/auth";
import { json, makeTenant, req, uuid, type Actor, type Tenant } from "./helpers";

const PERSON = { name: "Wanjiru", email: "wanjiru@aquaflow.test", phoneNumber: "0722000111" };
const OPERATOR = "operator@aquaflow.test"; // listed in PLATFORM_ADMIN_EMAILS by tests/setup.ts

async function hire(t: Tenant, as: Actor, person = PERSON) {
  return users.POST(
    req("POST", "/api/users", { as, body: { ...person, role: "DELIVERY", branchId: t.branchA, password: "password-123" } })
  );
}

const signIn = (email: string, password: string, businessId?: string) =>
  login.POST(req("POST", "/api/auth/login", { body: { email, password, deviceId: uuid(), businessId } }));

async function setPassword(email: string, businessId: string, password: string) {
  await User.updateOne({ email, businessId }, { passwordHash: await bcrypt.hash(password, 4) });
}

function accessCookie(res: Response): string {
  const cookie = res.headers.get("set-cookie") ?? "";
  return cookie.match(new RegExp(`${ACCESS_COOKIE}=([^;]+)`))![1];
}

describe("email and phone are unique per business", () => {
  it("lets one person work for two businesses with the same email and phone", async () => {
    const a = await makeTenant("Alpha");
    const b = await makeTenant("Beta");
    expect((await hire(a, a.owner)).status).toBe(201);
    expect((await hire(b, b.owner)).status).toBe(201);
    expect(await User.countDocuments({ email: PERSON.email })).toBe(2);
  });

  it("still refuses a duplicate inside the same business", async () => {
    const a = await makeTenant("Alpha");
    await hire(a, a.owner);
    const sameEmail = await hire(a, a.owner, { ...PERSON, phoneNumber: "0733000222" });
    const samePhone = await hire(a, a.owner, { ...PERSON, email: "other@aquaflow.test" });
    expect([sameEmail.status, samePhone.status]).toEqual([409, 409]);
  });
});

describe("login when an email exists in several businesses", () => {
  it("signs straight in when only one account's password matches", async () => {
    const a = await makeTenant("Alpha");
    const b = await makeTenant("Beta");
    await hire(a, a.owner);
    await hire(b, b.owner);
    await setPassword(PERSON.email, a.businessId, "alpha-secret");
    await setPassword(PERSON.email, b.businessId, "beta-secret");

    const res = await json(await signIn(PERSON.email, "beta-secret"));
    expect(res.status).toBe(200);
    expect(res.body.user.businessId).toBe(b.businessId);
  });

  it("asks which business when the same password opens both, then signs in to the one chosen", async () => {
    const a = await makeTenant("Alpha");
    const b = await makeTenant("Beta");
    await hire(a, a.owner);
    await hire(b, b.owner);
    await setPassword(PERSON.email, a.businessId, "same-secret");
    await setPassword(PERSON.email, b.businessId, "same-secret");

    const ask = await json(await signIn(PERSON.email, "same-secret"));
    expect(ask.status).toBe(300);
    expect(ask.body.chooseBusiness.map((c: any) => c.businessName).sort()).toEqual(["Alpha", "Beta"]);

    const chosen = await json(await signIn(PERSON.email, "same-secret", a.businessId));
    expect(chosen.status).toBe(200);
    expect(chosen.body.user.businessId).toBe(a.businessId);
  });

  it("reveals nothing about other businesses to a wrong password", async () => {
    const a = await makeTenant("Alpha");
    const b = await makeTenant("Beta");
    await hire(a, a.owner);
    await hire(b, b.owner);
    const res = await json(await signIn(PERSON.email, "wrong-password"));
    expect(res.status).toBe(401);
    expect(res.body.chooseBusiness).toBeUndefined();
    expect(res.body.error).toBe("Incorrect email or password");
  });

  it("does not let a wrong guess at one business unlock or reset the other", async () => {
    const a = await makeTenant("Alpha");
    const b = await makeTenant("Beta");
    await hire(a, a.owner);
    await hire(b, b.owner);
    await setPassword(PERSON.email, a.businessId, "alpha-secret");
    await setPassword(PERSON.email, b.businessId, "beta-secret");
    for (let i = 0; i < 2; i++) await signIn(PERSON.email, "wrong");
    await signIn(PERSON.email, "alpha-secret"); // resets Alpha's counter only
    const [alpha, beta] = await Promise.all([
      User.findOne({ email: PERSON.email, businessId: a.businessId }),
      User.findOne({ email: PERSON.email, businessId: b.businessId }),
    ]);
    expect([alpha!.failedLoginAttempts, beta!.failedLoginAttempts]).toEqual([0, 2]);
  });
});

describe("platform operator access", () => {
  it("is not granted by an email match alone: another business cannot mint an operator", async () => {
    const mallory = await makeTenant("Mallory Water");
    await hire(mallory, mallory.owner, { name: "Fake operator", email: OPERATOR, phoneNumber: "0744000333" });
    await setPassword(OPERATOR, mallory.businessId, "i-am-the-operator");

    const res = await signIn(OPERATOR, "i-am-the-operator");
    expect(res.status).toBe(200);
    expect((await res.clone().json()).isPlatformAdmin).toBe(false);

    const consoleRes = await platformBusinesses.GET(
      req("GET", "/api/platform/businesses", { cookies: { [ACCESS_COOKIE]: accessCookie(res) } })
    );
    expect(consoleRes.status).toBe(403);
  });

  it("is granted to the flagged account whose email is listed", async () => {
    const home = await makeTenant("Operator Co");
    await hire(home, home.owner, { name: "Operator", email: OPERATOR, phoneNumber: "0755000444" });
    await User.updateOne({ email: OPERATOR, businessId: home.businessId }, { platformAdmin: true });
    await setPassword(OPERATOR, home.businessId, "real-operator");

    const res = await signIn(OPERATOR, "real-operator");
    const cookies = { [ACCESS_COOKIE]: accessCookie(res) };
    expect((await platformBusinesses.GET(req("GET", "/x", { cookies }))).status).toBe(200);
    expect((await json(await me.GET(req("GET", "/x", { cookies })))).body.user.isPlatformAdmin).toBe(true);
  });

  it("is revoked by removing the email from PLATFORM_ADMIN_EMAILS, even with the flag", async () => {
    const home = await makeTenant("Operator Co");
    await hire(home, home.owner, { name: "Operator", email: OPERATOR, phoneNumber: "0755000444" });
    await User.updateOne({ email: OPERATOR, businessId: home.businessId }, { platformAdmin: true });
    await setPassword(OPERATOR, home.businessId, "real-operator");
    const cookies = { [ACCESS_COOKIE]: accessCookie(await signIn(OPERATOR, "real-operator")) };

    const listed = process.env.PLATFORM_ADMIN_EMAILS;
    process.env.PLATFORM_ADMIN_EMAILS = "";
    try {
      expect((await platformBusinesses.GET(req("GET", "/x", { cookies }))).status).toBe(403);
    } finally {
      process.env.PLATFORM_ADMIN_EMAILS = listed;
    }
  });
});