Extract groombook/api from monorepo with CI workflow

- Add source code from apps/api - Add packages/db and packages/types workspace dependencies - Add GitHub Actions CI workflow (lint, typecheck, test, docker) - Generate pnpm-lock.yaml - Add .gitignore Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-11 01:26:56 +00:00
parent 4d7baec939
commit abac9dfe6c
114 changed files with 31941 additions and 0 deletions
@@ -0,0 +1,720 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { Hono } from "hono";
+import { setupRouter } from "../routes/setup.js";
+
+// ─── Types ────────────────────────────────────────────────────────────────────
+
+interface MockStaff {
+  id: string;
+  role: string;
+  isSuperUser: boolean;
+}
+
+// ─── Mock DB state ────────────────────────────────────────────────────────────
+
+let dbStaffRows: MockStaff[] = [];
+let dbBusinessSettingsRows: { id: string; businessName: string }[] = [];
+let dbAuthConfigRows: { id: string; enabled: boolean }[] = [];
+let insertedAuthConfig: Record<string, unknown>[] = [];
+let insertedStaff: Record<string, unknown>[] = [];
+let encryptCalls: string[] = [];
+
+// Track env vars set per test
+const originalEnv = { ...process.env };
+
+function resetMock() {
+  dbStaffRows = [];
+  dbBusinessSettingsRows = [];
+  dbAuthConfigRows = [];
+  insertedAuthConfig = [];
+  insertedStaff = [];
+  encryptCalls = [];
+}
+
+function clearAuthEnv() {
+  delete process.env.OIDC_ISSUER;
+  delete process.env.OIDC_CLIENT_ID;
+  delete process.env.OIDC_CLIENT_SECRET;
+}
+
+// ─── Mock db module ───────────────────────────────────────────────────────────
+
+vi.mock("@groombook/db", () => {
+  const authProviderConfig = new Proxy(
+    { _name: "auth_provider_config" },
+    {
+      get(_target, prop) {
+        if (prop === "_name") return "auth_provider_config";
+        if (prop === "$inferSelect") return {};
+        return { table: "auth_provider_config", column: prop };
+      },
+    }
+  );
+
+  const staff = new Proxy(
+    { _name: "staff" },
+    {
+      get(_target, prop) {
+        if (prop === "_name") return "staff";
+        if (prop === "$inferSelect") return {};
+        return { table: "staff", column: prop };
+      },
+    }
+  );
+
+  const businessSettings = new Proxy(
+    { _name: "business_settings" },
+    {
+      get(_target, prop) {
+        if (prop === "_name") return "business_settings";
+        if (prop === "$inferSelect") return {};
+        return { table: "business_settings", column: prop };
+      },
+    }
+  );
+
+  // Build a shared tx mock that operates on current-state snapshots
+  function makeTxMock() {
+    function getRowsForTable(table: unknown) {
+      if (table === authProviderConfig) return dbAuthConfigRows;
+      if (table === staff) return dbStaffRows;
+      if (table === businessSettings) return dbBusinessSettingsRows;
+      return [];
+    }
+
+    return {
+      select: () => ({
+        from: (table: unknown) => {
+          const rows = getRowsForTable(table);
+          const base = {
+            where: (cond?: unknown) => {
+              const filtered = cond ? rows.filter((r) => evaluateCond(cond, r as Record<string, unknown>)) : rows;
+              return {
+                limit: () => filtered,
+                for: () => ({
+                  limit: () => filtered,
+                  [Symbol.iterator]: function* () {
+                    for (const item of filtered) yield item;
+                  },
+                  0: filtered[0],
+                  length: filtered.length,
+                }),
+                [Symbol.iterator]: function* () {
+                  for (const item of filtered) yield item;
+                },
+                0: filtered[0],
+                length: filtered.length,
+              };
+            },
+            [Symbol.iterator]: function* () {
+              for (const item of rows) yield item;
+            },
+            0: rows[0],
+            length: rows.length,
+          };
+          // Some calls use .limit() directly on from() result (no where())
+          (base as any).limit = () => rows;
+          return base;
+        },
+      }),
+      insert: () => ({
+        values: (vals: Record<string, unknown>) => {
+          const row = { ...vals, id: "new-id-" + Math.random(), createdAt: new Date(), updatedAt: new Date() };
+          if (vals.providerId) {
+            insertedAuthConfig.push(vals);
+            dbAuthConfigRows.push({ id: row.id as string, enabled: vals.enabled as boolean });
+          } else if (vals.email) {
+            // staff insert
+            insertedStaff.push(vals);
+            dbStaffRows.push(row as unknown as MockStaff);
+          } else if (vals.businessName) {
+            dbBusinessSettingsRows.push(row as unknown as { id: string; businessName: string });
+          }
+          return { returning: () => [row] };
+        },
+      }),
+      update: () => ({
+        set: (vals: Record<string, unknown>) => ({
+          where: () => ({
+            returning: () => {
+              const updated = { ...dbStaffRows[0], ...vals, updatedAt: new Date() };
+              return [updated];
+            },
+          }),
+        }),
+      }),
+    };
+  }
+
+  return {
+    getDb: () => ({
+      select: () => ({
+        from: (table: unknown) => ({
+          where: (cond?: unknown) => {
+            const rows =
+              table === authProviderConfig
+                ? dbAuthConfigRows
+                : table === staff
+                  ? dbStaffRows
+                  : table === businessSettings
+                    ? dbBusinessSettingsRows
+                    : [];
+            const filtered = cond ? rows.filter((r) => evaluateCond(cond, r as Record<string, unknown>)) : rows;
+            return {
+              limit: () => filtered,
+              for: () => ({
+                limit: () => filtered,
+                [Symbol.iterator]: function* () {
+                  for (const item of filtered) yield item;
+                },
+                0: filtered[0],
+                length: filtered.length,
+              }),
+              [Symbol.iterator]: function* () {
+                for (const item of filtered) yield item;
+              },
+              0: filtered[0],
+              length: filtered.length,
+            };
+          },
+          [Symbol.iterator]: function* () {
+            const rows =
+              table === authProviderConfig
+                ? dbAuthConfigRows
+                : table === staff
+                  ? dbStaffRows
+                  : table === businessSettings
+                    ? dbBusinessSettingsRows
+                    : [];
+            for (const item of rows) yield item;
+          },
+          0:
+            table === authProviderConfig
+              ? dbAuthConfigRows[0]
+              : table === staff
+                ? dbStaffRows[0]
+                : table === businessSettings
+                  ? dbBusinessSettingsRows[0]
+                  : undefined,
+          length:
+            table === authProviderConfig
+              ? dbAuthConfigRows.length
+              : table === staff
+                ? dbStaffRows.length
+                : table === businessSettings
+                  ? dbBusinessSettingsRows.length
+                  : 0,
+        }),
+      }),
+      insert: () => ({
+        values: (vals: Record<string, unknown>) => {
+          const row = { ...vals, id: "new-id-" + Math.random(), createdAt: new Date(), updatedAt: new Date() };
+          if (vals.providerId) {
+            insertedAuthConfig.push(vals);
+            dbAuthConfigRows.push({ id: row.id as string, enabled: vals.enabled as boolean });
+          } else if (vals.email) {
+            insertedStaff.push(vals);
+            dbStaffRows.push(row as unknown as MockStaff);
+          } else if (vals.businessName) {
+            dbBusinessSettingsRows.push(row as unknown as { id: string; businessName: string });
+          }
+          return { returning: () => [row] };
+        },
+      }),
+      transaction: (cb: (tx: unknown) => Promise<unknown>) => cb(makeTxMock()),
+    }),
+    authProviderConfig,
+    staff,
+    businessSettings,
+    eq: (col: unknown, val: unknown) => ({ __type: "eq", col, val }),
+    and: (...conds: unknown[]) => ({ __type: "and", conds }),
+    isNull: (col: unknown) => ({ __type: "isNull", col }),
+    sql: (strings: TemplateStringsArray, ...values: unknown[]) => {
+      // Mock sql template tag — raw SQL can't be evaluated in mock, always passes
+      void strings; void values;
+      return { __type: "sql" };
+    },
+    encryptSecret: (val: string) => {
+      encryptCalls.push(val);
+      return `encrypted:${val}`;
+    },
+  };
+});
+
+// Helper to evaluate mock conditions against a row
+function evaluateCond(cond: unknown, row: Record<string, unknown>): boolean {
+  if (!cond || typeof cond !== "object") return true;
+  const c = cond as Record<string, unknown>;
+  if (c.__type === "eq") {
+    const colObj = c.col as Record<string, unknown>;
+    const colName = colObj.column as string;
+    return row[colName] === c.val;
+  }
+  if (c.__type === "and") {
+    return (c.conds as unknown[]).every((sub) => evaluateCond(sub, row));
+  }
+  if (c.__type === "isNull") {
+    const colObj = c.col as Record<string, unknown>;
+    const colName = colObj.column as string;
+    return row[colName] === null || row[colName] === undefined;
+  }
+  if (c.__type === "sql") {
+    // Raw SQL can't be evaluated in mock — pass through
+    return true;
+  }
+  return true;
+}
+
+// ─── Build test app ───────────────────────────────────────────────────────────
+
+interface JwtPayload {
+  sub: string;
+  email?: string;
+  name?: string;
+}
+
+function makeApp(staff?: MockStaff | null, jwtPayload?: JwtPayload | null) {
+  const app = new Hono();
+
+  // Inject optional staff and jwtPayload context for authenticated routes
+  app.use("/setup/*", async (c, next) => {
+    if (jwtPayload) {
+      (c as any).set("jwtPayload", jwtPayload);
+    }
+    if (staff) {
+      (c as any).set("staff", staff);
+    }
+    await next();
+  });
+
+  app.route("/setup", setupRouter as unknown as Hono);
+  return app;
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+type ResponseBody = Record<string, unknown>;
+
+async function getStatus(app: Hono) {
+  const res = await app.request("/setup/status", { method: "GET" });
+  return { status: res.status, body: (await res.json()) as ResponseBody };
+}
+
+async function postAuthProvider(app: Hono, body: unknown) {
+  const res = await app.request("/setup/auth-provider", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const text = await res.text();
+  let parsed: ResponseBody;
+  try {
+    parsed = JSON.parse(text) as ResponseBody;
+  } catch {
+    parsed = { error: text };
+  }
+  return { status: res.status, body: parsed };
+}
+
+async function postAuthProviderTest(app: Hono, body: unknown) {
+  const res = await app.request("/setup/auth-provider/test", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const text = await res.text();
+  let parsed: ResponseBody;
+  try {
+    parsed = JSON.parse(text) as ResponseBody;
+  } catch {
+    parsed = { error: text };
+  }
+  return { status: res.status, body: parsed };
+}
+
+async function postSetup(app: Hono, body: unknown) {
+  const res = await app.request("/setup", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const text = await res.text();
+  let parsed: ResponseBody;
+  try {
+    parsed = JSON.parse(text) as ResponseBody;
+  } catch {
+    parsed = { error: text };
+  }
+  return { status: res.status, body: parsed };
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("GET /setup/status — OOBE bootstrap logic", () => {
+  beforeEach(() => {
+    resetMock();
+    process.env = { ...originalEnv };
+    clearAuthEnv();
+  });
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  it("fresh install (no super user, no env vars) → needsSetup=true, showAuthProviderStep=true", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+    // env vars are cleared
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(true);
+    expect(body.showAuthProviderStep).toBe(true);
+    expect(body.authConfigExists).toBe(false);
+    expect(body.authEnvVarsSet).toBe(false);
+  });
+
+  it("fresh install (no super user, env vars set) → needsSetup=true, showAuthProviderStep=false", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+    process.env.OIDC_ISSUER = "https://auth.example.com";
+    process.env.OIDC_CLIENT_ID = "client-id";
+    process.env.OIDC_CLIENT_SECRET = "client-secret";
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(true);
+    expect(body.showAuthProviderStep).toBe(false); // env vars already provide auth
+    expect(body.authConfigExists).toBe(false);
+    expect(body.authEnvVarsSet).toBe(true);
+  });
+
+  it("setup complete (super user exists) → needsSetup=false, showAuthProviderStep=false", async () => {
+    dbStaffRows = [{ id: "staff-1", role: "manager", isSuperUser: true }];
+    dbAuthConfigRows = [{ id: "prov-1", enabled: true }];
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(false);
+    expect(body.showAuthProviderStep).toBe(false);
+    expect(body.authConfigExists).toBe(true);
+  });
+
+  it("no super user but DB config exists → showAuthProviderStep=false", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [{ id: "prov-1", enabled: true }];
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(true);
+    expect(body.showAuthProviderStep).toBe(false); // DB config already exists
+    expect(body.authConfigExists).toBe(true);
+  });
+
+  it("SKIP_OOBE=true bypasses setup check regardless of DB state", async () => {
+    dbStaffRows = []; // no super user
+    dbAuthConfigRows = [];
+    process.env.SKIP_OOBE = "true";
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(false);
+    expect(body.showAuthProviderStep).toBe(false);
+    expect(body.authConfigExists).toBe(false);
+    expect(body.authEnvVarsSet).toBe(false);
+    expect(body.skipped).toBe(true);
+  });
+
+  it("SKIP_OOBE=1 also bypasses setup check", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+    process.env.SKIP_OOBE = "1";
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(false);
+    expect(body.skipped).toBe(true);
+  });
+
+  it("SKIP_OOBE=yes also bypasses setup check", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+    process.env.SKIP_OOBE = "yes";
+
+    const app = makeApp();
+    const { status, body } = await getStatus(app);
+
+    expect(status).toBe(200);
+    expect(body.needsSetup).toBe(false);
+    expect(body.skipped).toBe(true);
+  });
+});
+
+describe("POST /setup/auth-provider — OOBE bootstrap", () => {
+  beforeEach(() => {
+    resetMock();
+    process.env = { ...originalEnv };
+    clearAuthEnv();
+  });
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  const validBody = {
+    providerId: "authentik",
+    displayName: "Authentik SSO",
+    issuerUrl: "https://auth.example.com",
+    clientId: "my-client",
+    clientSecret: "my-secret",
+    scopes: "openid profile email",
+  };
+
+  it("creates auth provider config when no super user exists", async () => {
+    dbStaffRows = []; // no super user
+    dbAuthConfigRows = [];
+
+    const app = makeApp();
+    const { status, body } = await postAuthProvider(app, validBody);
+
+    expect(status).toBe(201);
+    expect(body.providerId).toBe("authentik");
+    expect(body.clientSecret).toBeUndefined(); // secret should not be returned plaintext
+    expect(encryptCalls).toContain("my-secret");
+    expect(insertedAuthConfig.length).toBe(1);
+  });
+
+  it("returns 403 after setup is complete (super user exists)", async () => {
+    dbStaffRows = [{ id: "staff-1", role: "manager", isSuperUser: true }];
+
+    const app = makeApp();
+    const { status, body } = await postAuthProvider(app, validBody);
+
+    expect(status).toBe(403);
+    expect(body.error).toMatch(/already been completed/i);
+  });
+
+  it("returns 409 if auth provider is already configured", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [{ id: "prov-1", enabled: true }]; // already configured
+
+    const app = makeApp();
+    const { status, body } = await postAuthProvider(app, validBody);
+
+    expect(status).toBe(409);
+    expect(body.error).toMatch(/already configured/i);
+  });
+
+  it("returns 400 for invalid schema (Zod validation failure)", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+
+    const app = makeApp();
+    // providerId="" fails Zod min(1), issuerUrl="not-a-url" fails Zod url()
+    const { status } = await postAuthProvider(app, {
+      providerId: "",
+      displayName: "Test",
+      issuerUrl: "not-a-url",
+      clientId: "c",
+      clientSecret: "s",
+    });
+
+    // Zod throws ZodError which Hono's error handler should format as 400
+    // Currently returns 500 — route needs error handler for Zod errors
+    // TODO(cleanup): add error handler to route; expect 400 once fixed
+    expect(status).toBeGreaterThanOrEqual(400);
+  });
+
+  it("encrypts clientSecret before storing", async () => {
+    dbStaffRows = [];
+    dbAuthConfigRows = [];
+
+    const app = makeApp();
+    await postAuthProvider(app, validBody);
+
+    expect(encryptCalls).toContain("my-secret");
+    expect(insertedAuthConfig[0]!.clientSecret).toBe("encrypted:my-secret");
+  });
+});
+
+describe("POST /setup/auth-provider/test — OOBE test connection", () => {
+  beforeEach(() => {
+    resetMock();
+    process.env = { ...originalEnv };
+    clearAuthEnv();
+  });
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  it("returns 403 after setup is complete (super user exists)", async () => {
+    dbStaffRows = [{ id: "staff-1", role: "manager", isSuperUser: true }];
+
+    const app = makeApp();
+    const { status, body } = await postAuthProviderTest(app, {
+      issuerUrl: "https://auth.example.com",
+    });
+
+    expect(status).toBe(403);
+    expect(body.error).toMatch(/already been completed/i);
+  });
+
+  it("returns ok=false for unreachable issuer URL", async () => {
+    dbStaffRows = [];
+
+    const app = makeApp();
+    const { status, body } = await postAuthProviderTest(app, {
+      issuerUrl: "https://192.0.2.1/", // TEST-NET, never reachable
+    });
+
+    expect(status).toBe(200);
+    expect(body.ok).toBe(false);
+    expect(body.error).toBeTruthy();
+  }, 15000);
+
+  it("accepts valid issuerUrl", async () => {
+    dbStaffRows = [];
+
+    // Mock fetch to simulate a valid OIDC discovery response
+    const mockFetch = vi.fn(() => Promise.resolve({ ok: true }));
+    vi.stubGlobal("fetch", mockFetch);
+
+    const app = makeApp();
+    const { status, body } = await postAuthProviderTest(app, {
+      issuerUrl: "https://auth.example.com",
+    });
+
+    expect(status).toBe(200);
+    expect(body.ok).toBe(true);
+
+    vi.restoreAllMocks();
+  });
+
+  it("returns ok=false for invalid issuer URL (non-200 response)", async () => {
+    dbStaffRows = [];
+
+    const mockFetch = vi.fn(() =>
+      Promise.resolve({ ok: false, status: 404 })
+    );
+    vi.stubGlobal("fetch", mockFetch);
+
+    const app = makeApp();
+    const { status, body } = await postAuthProviderTest(app, {
+      issuerUrl: "https://auth.example.com",
+    });
+
+    expect(status).toBe(200);
+    expect(body.ok).toBe(false);
+    expect(body.error).toMatch(/discovery failed/i);
+
+    vi.restoreAllMocks();
+  });
+});
+
+describe("POST /setup — OOBE regression (GRO-485)", () => {
+  beforeEach(() => {
+    resetMock();
+    process.env = { ...originalEnv };
+    clearAuthEnv();
+  });
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  it("creates staff record during OOBE when no staff record exists for authenticated user", async () => {
+    // No staff rows — this is a fresh OOBE user
+    dbStaffRows = [];
+    dbBusinessSettingsRows = [];
+
+    const jwtPayload = { sub: "user-123", email: "alice@example.com", name: "Alice" };
+    const app = makeApp(null, jwtPayload);
+
+    const { status, body } = await postSetup(app, { businessName: "Alice's Pet Grooming" });
+
+    expect(status).toBe(201);
+    expect(body.ok).toBe(true);
+    expect(body.staff).toBeDefined();
+    expect((body.staff as MockStaff).isSuperUser).toBe(true);
+    expect((body.staff as any).email).toBe("alice@example.com");
+    expect((body.staff as MockStaff).role).toBe("manager");
+    // New staff record was created
+    expect(insertedStaff.length).toBe(1);
+    expect(insertedStaff[0]!.email).toBe("alice@example.com");
+    expect(insertedStaff[0]!.userId).toBe("user-123");
+  });
+
+  it("still works for user who already has a staff record", async () => {
+    // Staff record exists for this user
+    dbStaffRows = [{ id: "staff-existing", role: "groomer", isSuperUser: false }];
+    dbBusinessSettingsRows = [];
+
+    const jwtPayload = { sub: "user-123", email: "alice@example.com", name: "Alice" };
+    // Inject the existing staff record into context
+    const app = makeApp({ id: "staff-existing", role: "groomer", isSuperUser: false }, jwtPayload);
+
+    const { status, body } = await postSetup(app, { businessName: "Alice's Pet Grooming" });
+
+    expect(status).toBe(201);
+    expect(body.ok).toBe(true);
+    expect((body.staff as MockStaff).isSuperUser).toBe(true);
+    // No new staff was created (insertedStaff should be empty since staff was pre-existing)
+  });
+
+  it("auto-links staff by email if record exists with matching email but no userId", async () => {
+    // Staff record exists with matching email but no userId (legacy record)
+    dbStaffRows = [{ id: "staff-legacy", role: "manager", isSuperUser: false, email: "alice@example.com", userId: null } as unknown as MockStaff];
+    dbBusinessSettingsRows = [];
+
+    const jwtPayload = { sub: "user-123", email: "alice@example.com", name: "Alice" };
+    // No staff injected into context — the handler must find it by email
+    const app = makeApp(null, jwtPayload);
+
+    const { status, body } = await postSetup(app, { businessName: "Alice's Pet Grooming" });
+
+    expect(status).toBe(201);
+    expect(body.ok).toBe(true);
+    expect((body.staff as MockStaff).isSuperUser).toBe(true);
+  });
+
+  it("returns 400 if JWT has no email claim and no staff record exists", async () => {
+    dbStaffRows = [];
+    dbBusinessSettingsRows = [];
+
+    // JWT with no email
+    const jwtPayload = { sub: "user-123" };
+    const app = makeApp(null, jwtPayload);
+
+    const { status, body } = await postSetup(app, { businessName: "Alice's Pet Grooming" });
+
+    expect(status).toBe(400);
+    expect(body.error).toMatch(/no email claim/i);
+  });
+
+  it("returns 409 if a super user already exists", async () => {
+    // Super user already exists
+    dbStaffRows = [{ id: "staff-super", role: "manager", isSuperUser: true }];
+    dbBusinessSettingsRows = [];
+
+    const jwtPayload = { sub: "user-456", email: "bob@example.com", name: "Bob" };
+    const app = makeApp(null, jwtPayload);
+
+    const { status, body } = await postSetup(app, { businessName: "Bob's Grooming" });
+
+    expect(status).toBe(409);
+    expect(body.error).toMatch(/already been completed/i);
+  });
+});