api/apps/api/src/__tests__/rbac.test.ts

import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
import { Hono } from "hono";
import type { Context, MiddlewareHandler } from "hono";
import type { AppEnv, StaffRow } from "../middleware/rbac.js";

// ─── Mock staff data ──────────────────────────────────────────────────────────

const MANAGER: StaffRow = {
  id: "staff-manager-id",
  oidcSub: "oidc-manager-sub",
  userId: "ba-user-manager",
  role: "manager",
  isSuperUser: true,
  name: "Manager McManager",
  email: "manager@example.com",
  active: true,
  icalToken: null,
  createdAt: new Date(),
  updatedAt: new Date(),
};

const RECEPTIONIST: StaffRow = {
  ...MANAGER,
  id: "staff-receptionist-id",
  oidcSub: "oidc-receptionist-sub",
  userId: "ba-user-receptionist",
  role: "receptionist",
  isSuperUser: false,
  name: "Receptionist Rita",
  email: "receptionist@example.com",
};

const GROOMER: StaffRow = {
  ...MANAGER,
  id: "staff-groomer-id",
  oidcSub: "oidc-groomer-sub",
  userId: "ba-user-groomer",
  role: "groomer",
  isSuperUser: false,
  name: "Groomer Gary",
  email: "groomer@example.com",
};

// ─── Mock DB ──────────────────────────────────────────────────────────────────

let staffLookupResult: StaffRow | null = null;
let managerFallbackResult: StaffRow | null = MANAGER;
let userLookupResult: { id: string; name: string | null; email: string | null } | null = null;
let _insertedStaff: StaffRow | null = null;

vi.mock("../db", () => {
  const makeTableProxy = (name: string) =>
    new Proxy(
      { _name: name },
      {
        get(target, prop) {
          if (prop === "_name") return name;
          if (prop === "$inferSelect") return {};
          return { table: name, column: prop };
        },
      }
    );

  const staff = makeTableProxy("staff");
  const user = makeTableProxy("user");

  const buildQuery = (result: unknown, fallback: unknown) => ({
    [Symbol.iterator]: function* () {
      if (result) yield result;
    },
    limit: (_n: number) => {
      const item = result ?? fallback;
      return {
        [Symbol.iterator]: function* () { if (item) yield item; },
        0: item,
        length: item ? 1 : 0,
      };
    },
  });

  return {
    getDb: () => ({
      select: () => ({
        from: (table: unknown) => ({
          where: () => buildQuery(
            table === staff ? staffLookupResult : userLookupResult,
            table === staff ? managerFallbackResult : null
          ),
        }),
      }),
      insert: (_table: unknown) => ({
        values: (vals: Record<string, unknown>) => ({
          returning: () => {
            const newStaff: StaffRow = {
              id: "new-staff-id",
              oidcSub: null,
              userId: vals.userId as string,
              role: vals.role as StaffRow["role"],
              isSuperUser: false,
              name: vals.name as string,
              email: vals.email as string,
              active: true,
              icalToken: null,
              createdAt: new Date(),
              updatedAt: new Date(),
            };
            _insertedStaff = newStaff;
            return [newStaff];
          },
        }),
      }),
    }),
    staff,
    user,
    eq: vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val })),
    and: vi.fn((..._clauses: unknown[]) => ({})),
    sql: vi.fn((..._args: unknown[]) => ({})),
  };
});

// ─── Helpers ──────────────────────────────────────────────────────────────────

function resetMocks() {
  staffLookupResult = null;
  managerFallbackResult = MANAGER;
  userLookupResult = null;
  _insertedStaff = null;
}

/** Build a minimal Hono app with jwtPayload pre-set, then apply a middleware. */
function buildApp(
  middleware: MiddlewareHandler<AppEnv>,
  handler?: (c: Context<AppEnv>) => Response | Promise<Response>
) {
  const app = new Hono<AppEnv>();
  app.use("*", async (c, next) => {
    c.set("jwtPayload", {
      sub: userLookupResult?.id ?? staffLookupResult?.userId ?? "unknown-sub",
      email: userLookupResult?.email,
    });
    await next();
  });
  app.use("*", middleware);
  const h = handler ?? ((c: Context<AppEnv>) => c.json({ ok: true }));
  app.get("/test", h);
  app.post("/test", h);
  return app;
}

/** Build app with staff pre-set in context (skips resolveStaffMiddleware). */
function buildWithStaff(
  staffRow: StaffRow,
  guard: MiddlewareHandler<AppEnv>
) {
  const app = new Hono<AppEnv>();
  app.use("*", async (c, next) => {
    c.set("jwtPayload", { sub: staffRow.userId ?? "" });
    c.set("staff", staffRow);
    await next();
  });
  app.use("*", guard);
  app.get("/test", (c) => c.json({ ok: true }));
  app.post("/test", (c) => c.json({ ok: true }));
  return app;
}

// ─── Import middleware ────────────────────────────────────────────────────────

const { resolveStaffMiddleware, requireRole, requireSuperUser, requireRoleOrSuperUser } = await import(
  "../middleware/rbac.js"
);

beforeEach(() => resetMocks());

afterEach(() => {
  delete process.env.AUTH_DISABLED;
});

// ─── resolveStaffMiddleware tests ─────────────────────────────────────────────

describe("resolveStaffMiddleware", () => {
  it("resolves staff from DB and sets it on context", async () => {
    staffLookupResult = MANAGER;
    let capturedStaff: StaffRow | null = null;
    const app = buildApp(resolveStaffMiddleware, (c) => {
      capturedStaff = c.get("staff");
      return c.json({ ok: true });
    });

    const res = await app.request("/test");
    expect(res.status).toBe(200);
    expect(capturedStaff).not.toBeNull();
    expect(capturedStaff!.id).toBe(MANAGER.id);
  });

  it("returns 403 when no staff record found for the OIDC sub", async () => {
    staffLookupResult = null;
    const app = buildApp(resolveStaffMiddleware);

    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/no staff record/i);
  });

  it("dev mode: resolves staff by X-Dev-User-Id header", async () => {
    process.env.AUTH_DISABLED = "true";
    staffLookupResult = GROOMER;
    let capturedStaff: StaffRow | null = null;
    const app = buildApp(resolveStaffMiddleware, (c) => {
      capturedStaff = c.get("staff");
      return c.json({ ok: true });
    });

    const res = await app.request("/test", {
      headers: { "X-Dev-User-Id": GROOMER.id },
    });
    expect(res.status).toBe(200);
    expect(capturedStaff!.role).toBe("groomer");
  });

  it("dev mode: falls back to first manager when no X-Dev-User-Id header", async () => {
    process.env.AUTH_DISABLED = "true";
    managerFallbackResult = MANAGER;
    let capturedStaff: StaffRow | null = null;
    const app = buildApp(resolveStaffMiddleware, (c) => {
      capturedStaff = c.get("staff");
      return c.json({ ok: true });
    });

    const res = await app.request("/test");
    expect(res.status).toBe(200);
    expect(capturedStaff!.role).toBe("manager");
  });

  it("dev mode: returns 403 when no manager exists and no header provided", async () => {
    process.env.AUTH_DISABLED = "true";
    managerFallbackResult = null;
    const app = buildApp(resolveStaffMiddleware);

    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/no staff records found/i);
  });

  it("auto-provision: creates groomer staff record on first login when Better-Auth user exists", async () => {
    staffLookupResult = null;
    userLookupResult = { id: "ba-user-new", name: "New User", email: "newuser@example.com" };
    let capturedStaff: StaffRow | null = null;
    const app = buildApp(resolveStaffMiddleware, (c) => {
      capturedStaff = c.get("staff");
      return c.json({ ok: true });
    });

    const res = await app.request("/test");
    expect(res.status).toBe(200);
    expect(capturedStaff).not.toBeNull();
    expect(capturedStaff!.role).toBe("groomer");
    expect(capturedStaff!.userId).toBe("ba-user-new");
    expect(capturedStaff!.name).toBe("New User");
    expect(capturedStaff!.email).toBe("newuser@example.com");
    expect(capturedStaff!.isSuperUser).toBe(false);
  });

  it("auto-provision: falls back to email prefix when user has no name", async () => {
    staffLookupResult = null;
    userLookupResult = { id: "ba-user-noname", name: null, email: "firstlogin@example.com" };
    let capturedStaff: StaffRow | null = null;
    const app = buildApp(resolveStaffMiddleware, (c) => {
      capturedStaff = c.get("staff");
      return c.json({ ok: true });
    });

    const res = await app.request("/test");
    expect(res.status).toBe(200);
    expect(capturedStaff!.name).toBe("firstlogin");
  });

  it("auto-provision: returns 403 when no staff record and no Better-Auth user exists", async () => {
    staffLookupResult = null;
    userLookupResult = null;
    const app = buildApp(resolveStaffMiddleware);

    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/no staff record found for authenticated user/i);
  });
});

// ─── requireRole tests ────────────────────────────────────────────────────────

describe("requireRole", () => {
  it("allows access when staff role matches the only allowed role", async () => {
    const app = buildWithStaff(MANAGER, requireRole("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("allows access when staff role is one of multiple allowed roles", async () => {
    const app = buildWithStaff(RECEPTIONIST, requireRole("manager", "receptionist"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("returns 403 for an unauthorized role", async () => {
    const app = buildWithStaff(GROOMER, requireRole("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/forbidden/i);
    expect(body.error).toContain("groomer");
  });

  it("includes the role name in the 403 error message", async () => {
    const app = buildWithStaff(RECEPTIONIST, requireRole("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toContain("receptionist");
  });

  it("groomer is blocked from manager+receptionist-only routes", async () => {
    const app = buildWithStaff(GROOMER, requireRole("manager", "receptionist"));
    const res = await app.request("/test", { method: "POST" });
    expect(res.status).toBe(403);
  });

  it("manager passes all-role checks", async () => {
    const app = buildWithStaff(MANAGER, requireRole("manager", "receptionist", "groomer"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("returns 403 with JSON body (not plain text)", async () => {
    const app = buildWithStaff(GROOMER, requireRole("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const contentType = res.headers.get("content-type") ?? "";
    expect(contentType).toContain("application/json");
  });
});

// ─── requireSuperUser tests ─────────────────────────────────────────────────

describe("requireSuperUser", () => {
  it("allows access when staff is a super user", async () => {
    const app = buildWithStaff(MANAGER, requireSuperUser());
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("allows access when manager is also a super user", async () => {
    // MANAGER has isSuperUser: true
    const app = buildWithStaff(MANAGER, requireSuperUser());
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("returns 403 for a non-super-user receptionist", async () => {
    // RECEPTIONIST has isSuperUser: false
    const app = buildWithStaff(RECEPTIONIST, requireSuperUser());
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/super user privileges required/i);
  });

  it("returns 403 for a non-super-user groomer", async () => {
    // GROOMER has isSuperUser: false
    const app = buildWithStaff(GROOMER, requireSuperUser());
    const res = await app.request("/test");
    expect(res.status).toBe(403);
  });

  it("returns 403 when staff record is not resolved", async () => {
    // Manually remove staff from context to simulate unresolved staff
    const testApp = new Hono<AppEnv>();
    testApp.use("*", async (c, next) => {
      c.set("jwtPayload", { sub: "test-sub" });
      // Do NOT set staff - simulate unresolved staff
      await next();
    });
    testApp.use("*", requireSuperUser());
    testApp.get("/test", (c) => c.json({ ok: true }));
    const res = await testApp.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/staff record not resolved/i);
  });

  it("receptionist cannot grant super user status on staff PATCH", async () => {
    // This tests the inline guard in staff.ts handler, not the middleware itself,
    // but we test requireSuperUser to verify the middleware correctly blocks
    const app = buildWithStaff(RECEPTIONIST, requireSuperUser());
    const res = await app.request("/test", {
      method: "PATCH",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ isSuperUser: true }),
    });
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/super user privileges required/i);
  });

  it("returns 403 with JSON body for super user violation", async () => {
    const app = buildWithStaff(RECEPTIONIST, requireSuperUser());
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const contentType = res.headers.get("content-type") ?? "";
    expect(contentType).toContain("application/json");
  });
});

// ─── requireRoleOrSuperUser tests ─────────────────────────────────────────────

describe("requireRoleOrSuperUser", () => {
  it("allows a manager to access manager-only routes", async () => {
    const app = buildWithStaff(MANAGER, requireRoleOrSuperUser("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("allows a super user with receptionist role to access manager-only routes (GRO-412 bug fix)", async () => {
    // GRO-412: a receptionist granted super user via Staff UI should access admin routes
    const superReceptionist: StaffRow = {
      ...RECEPTIONIST,
      isSuperUser: true,
    };
    const app = buildWithStaff(superReceptionist, requireRoleOrSuperUser("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("allows a super user with groomer role to access manager-only routes", async () => {
    const superGroomer: StaffRow = {
      ...GROOMER,
      isSuperUser: true,
    };
    const app = buildWithStaff(superGroomer, requireRoleOrSuperUser("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("blocks a non-super-user receptionist from manager-only routes", async () => {
    const app = buildWithStaff(RECEPTIONIST, requireRoleOrSuperUser("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/role.*not permitted/i);
  });

  it("blocks a non-super-user groomer from manager-only routes", async () => {
    const app = buildWithStaff(GROOMER, requireRoleOrSuperUser("manager"));
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
    expect(body.error).toMatch(/role.*not permitted/i);
  });

  it("allows a manager with multiple allowed roles", async () => {
    const app = buildWithStaff(MANAGER, requireRoleOrSuperUser("manager", "receptionist"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });

  it("allows a super user with disallowed role to access route with multiple allowed roles", async () => {
    const superGroomer: StaffRow = {
      ...GROOMER,
      isSuperUser: true,
    };
    const app = buildWithStaff(superGroomer, requireRoleOrSuperUser("manager", "receptionist"));
    const res = await app.request("/test");
    expect(res.status).toBe(200);
  });
});