Files
pn-new-crm/tests/integration/notification-lifecycle.test.ts

248 lines
8.2 KiB
TypeScript
Raw Normal View History

/**
* Notification lifecycle integration tests.
*
* Verifies:
* - createNotification() inserts a row and returns it
* - Calling again with same dedupeKey within cooldown returns null (suppressed)
* - Calling after cooldown expiry creates a new notification
* - system_alert type bypasses preference check
* - markRead isRead becomes true
* - markAllRead all notifications for user become read
* - getUnreadCount returns correct count
*
* Skips gracefully when TEST_DATABASE_URL is not reachable.
*/
import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms Multi-area cleanup pass closing partial-implementation gaps surfaced by the post-i18n audit. No behavior changes for happy-path users; closes real correctness/security holes. PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso}, and company.{incorporationCountryIso, incorporationSubdivisionIso}. Server-side parsePhone() fallback for legacy raw phone strings. PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon', 'audit.suspicious_login') were registered but evaluators returned []. Both required schema/instrumentation that hadn't landed. Removed from the registry; comments record the dependencies needed to revive them. Effective rule count: 8 active. PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5 integration test files; webhook-delivery uses vi.hoisted for the queue-add ref. Vitest no longer warns about non-top-level mocks. Deflaked the 'short value' assertion in security-encryption.test.ts by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green. PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner now filter by isNull(archivedAt). Berths use status (no archivedAt). PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts walks every src/app/api/v1/**/route.ts and reports handlers without a withPermission() wrapper. Initial run found 33 violations. - Allow-listed 17 with explicit reasons (self-data, admin, alerts, search, currency, ai, custom-fields — some marked TODO). - Wrapped 7 routes with concrete permissions: clients/options (clients:view), berths/options (berths:view), dashboard/* (reports:view_dashboard), analytics (reports:view_analytics). Audit report at docs/runbooks/permission-audit.md. Script exits non-zero on any unallow-listed violation so it can become a CI gate. Vitest: 741 -> 741 (no new tests; existing suite covers the changes). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
// Socket and queue mocked — these are tested in isolation here.
vi.mock('@/lib/socket/server', () => ({ emitToRoom: vi.fn() }));
vi.mock('@/lib/queue', () => ({
getQueue: () => ({ add: vi.fn().mockResolvedValue(undefined) }),
}));
const TEST_DB_URL =
process.env.TEST_DATABASE_URL || 'postgresql://test:test@localhost:5433/portnimara_test';
let dbAvailable = false;
beforeAll(async () => {
try {
const postgres = (await import('postgres')).default;
const sql = postgres(TEST_DB_URL, { max: 1, idle_timeout: 3, connect_timeout: 3 });
await sql`SELECT 1`;
await sql.end();
dbAvailable = true;
} catch {
console.warn(
'[notification-lifecycle] Test database not available — skipping integration tests',
);
}
});
function itDb(name: string, fn: () => Promise<void>) {
it(name, async () => {
if (!dbAvailable) return;
await fn();
});
}
// ─── Helpers ─────────────────────────────────────────────────────────────────
async function seedPortAndUser(): Promise<{ portId: string; userId: string }> {
const postgres = (await import('postgres')).default;
const sql = postgres(TEST_DB_URL, { max: 1 });
const portId = crypto.randomUUID();
const userId = crypto.randomUUID();
await sql`
INSERT INTO ports (id, name, slug, country, currency, timezone)
VALUES (${portId}, 'Notif Test Port', ${'notif-' + portId.slice(0, 8)}, 'AU', 'AUD', 'UTC')
`;
await sql`
INSERT INTO "user" (id, name, email, email_verified, created_at, updated_at)
VALUES (${userId}, 'Notif User', ${'notif-' + userId.slice(0, 8) + '@test.local'}, true, NOW(), NOW())
`;
await sql`
INSERT INTO user_profiles (id, user_id, display_name, is_super_admin, is_active, preferences)
VALUES (${crypto.randomUUID()}, ${userId}, 'Notif User', false, true, '{}')
`;
await sql.end();
return { portId, userId };
}
async function cleanupPortAndUser(portId: string, userId: string): Promise<void> {
const postgres = (await import('postgres')).default;
const sql = postgres(TEST_DB_URL, { max: 1 });
await sql`DELETE FROM ports WHERE id = ${portId}`;
await sql`DELETE FROM user_profiles WHERE user_id = ${userId}`;
await sql`DELETE FROM "user" WHERE id = ${userId}`;
await sql.end();
}
// ─── Tests ────────────────────────────────────────────────────────────────────
describe('Notification Lifecycle', () => {
let portId: string;
let userId: string;
beforeAll(async () => {
if (!dbAvailable) return;
({ portId, userId } = await seedPortAndUser());
});
afterAll(async () => {
if (!dbAvailable) return;
await cleanupPortAndUser(portId, userId);
});
itDb('createNotification inserts a row and returns it', async () => {
const { createNotification } = await import('@/lib/services/notifications.service');
const notif = await createNotification({
portId,
userId,
type: 'interest_stage_changed',
title: 'Test notification',
description: 'A test',
link: '/interests/123',
entityType: 'interest',
entityId: 'test-entity-1',
});
expect(notif).not.toBeNull();
expect(notif!.id).toBeDefined();
expect(notif!.portId).toBe(portId);
expect(notif!.userId).toBe(userId);
expect(notif!.isRead).toBe(false);
expect(notif!.title).toBe('Test notification');
});
itDb('duplicate dedupeKey within cooldown returns null (suppressed)', async () => {
const { createNotification } = await import('@/lib/services/notifications.service');
const dedupeKey = `interest:dedup-test-${crypto.randomUUID()}:stage:details_sent`;
const params = {
portId,
userId,
type: 'interest_stage_changed',
title: 'Dedup test',
dedupeKey,
cooldownMs: 300_000,
};
const first = await createNotification(params);
expect(first).not.toBeNull();
const second = await createNotification(params);
expect(second).toBeNull();
});
itDb('dedupeKey with expired cooldown creates a new notification', async () => {
const { createNotification } = await import('@/lib/services/notifications.service');
const dedupeKey = `interest:expired-cooldown-${crypto.randomUUID()}:stage:open`;
const params = {
portId,
userId,
type: 'interest_stage_changed',
title: 'Expired cooldown test',
dedupeKey,
cooldownMs: 0,
};
const first = await createNotification(params);
expect(first).not.toBeNull();
const second = await createNotification(params);
expect(second).not.toBeNull();
expect(second!.id).not.toBe(first!.id);
});
itDb('system_alert type bypasses preference check and is always inserted', async () => {
const { createNotification } = await import('@/lib/services/notifications.service');
const postgres = (await import('postgres')).default;
const sql = postgres(TEST_DB_URL, { max: 1 });
// Insert a preference that would block a non-system notification
await sql`
INSERT INTO user_notification_preferences
(id, user_id, port_id, notification_type, in_app, email)
VALUES (${crypto.randomUUID()}, ${userId}, ${portId}, 'blocked_type', false, false)
ON CONFLICT DO NOTHING
`;
await sql.end();
// system_alert MUST still be inserted regardless of any preference
const notif = await createNotification({
portId,
userId,
type: 'system_alert',
title: 'System alert test',
});
expect(notif).not.toBeNull();
expect(notif!.type).toBe('system_alert');
});
itDb('markRead sets isRead to true', async () => {
const { createNotification, markRead } = await import('@/lib/services/notifications.service');
const postgres = (await import('postgres')).default;
const notif = await createNotification({
portId,
userId,
type: 'system_alert',
title: 'Mark-read test',
});
expect(notif).not.toBeNull();
expect(notif!.isRead).toBe(false);
await markRead(notif!.id, userId);
const sql = postgres(TEST_DB_URL, { max: 1 });
const rows = await sql<Array<{ is_read: boolean }>>`
SELECT is_read FROM notifications WHERE id = ${notif!.id}
`;
await sql.end();
expect(rows[0]?.is_read).toBe(true);
});
itDb('markAllRead sets all unread notifications for the user to read', async () => {
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms Multi-area cleanup pass closing partial-implementation gaps surfaced by the post-i18n audit. No behavior changes for happy-path users; closes real correctness/security holes. PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso}, and company.{incorporationCountryIso, incorporationSubdivisionIso}. Server-side parsePhone() fallback for legacy raw phone strings. PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon', 'audit.suspicious_login') were registered but evaluators returned []. Both required schema/instrumentation that hadn't landed. Removed from the registry; comments record the dependencies needed to revive them. Effective rule count: 8 active. PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5 integration test files; webhook-delivery uses vi.hoisted for the queue-add ref. Vitest no longer warns about non-top-level mocks. Deflaked the 'short value' assertion in security-encryption.test.ts by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green. PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner now filter by isNull(archivedAt). Berths use status (no archivedAt). PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts walks every src/app/api/v1/**/route.ts and reports handlers without a withPermission() wrapper. Initial run found 33 violations. - Allow-listed 17 with explicit reasons (self-data, admin, alerts, search, currency, ai, custom-fields — some marked TODO). - Wrapped 7 routes with concrete permissions: clients/options (clients:view), berths/options (berths:view), dashboard/* (reports:view_dashboard), analytics (reports:view_analytics). Audit report at docs/runbooks/permission-audit.md. Script exits non-zero on any unallow-listed violation so it can become a CI gate. Vitest: 741 -> 741 (no new tests; existing suite covers the changes). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
const { createNotification, markAllRead, getUnreadCount } =
await import('@/lib/services/notifications.service');
await createNotification({ portId, userId, type: 'system_alert', title: 'Unread 1' });
await createNotification({ portId, userId, type: 'system_alert', title: 'Unread 2' });
const before = await getUnreadCount(userId, portId);
expect(before.count).toBeGreaterThan(0);
await markAllRead(userId, portId);
const after = await getUnreadCount(userId, portId);
expect(after.count).toBe(0);
});
itDb('getUnreadCount returns accurate count', async () => {
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms Multi-area cleanup pass closing partial-implementation gaps surfaced by the post-i18n audit. No behavior changes for happy-path users; closes real correctness/security holes. PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso}, and company.{incorporationCountryIso, incorporationSubdivisionIso}. Server-side parsePhone() fallback for legacy raw phone strings. PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon', 'audit.suspicious_login') were registered but evaluators returned []. Both required schema/instrumentation that hadn't landed. Removed from the registry; comments record the dependencies needed to revive them. Effective rule count: 8 active. PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5 integration test files; webhook-delivery uses vi.hoisted for the queue-add ref. Vitest no longer warns about non-top-level mocks. Deflaked the 'short value' assertion in security-encryption.test.ts by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green. PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner now filter by isNull(archivedAt). Berths use status (no archivedAt). PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts walks every src/app/api/v1/**/route.ts and reports handlers without a withPermission() wrapper. Initial run found 33 violations. - Allow-listed 17 with explicit reasons (self-data, admin, alerts, search, currency, ai, custom-fields — some marked TODO). - Wrapped 7 routes with concrete permissions: clients/options (clients:view), berths/options (berths:view), dashboard/* (reports:view_dashboard), analytics (reports:view_analytics). Audit report at docs/runbooks/permission-audit.md. Script exits non-zero on any unallow-listed violation so it can become a CI gate. Vitest: 741 -> 741 (no new tests; existing suite covers the changes). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
const { createNotification, getUnreadCount, markAllRead } =
await import('@/lib/services/notifications.service');
await markAllRead(userId, portId);
const baseline = await getUnreadCount(userId, portId);
expect(baseline.count).toBe(0);
await createNotification({ portId, userId, type: 'system_alert', title: 'Count test 1' });
await createNotification({ portId, userId, type: 'system_alert', title: 'Count test 2' });
const after = await getUnreadCount(userId, portId);
expect(after.count).toBe(2);
});
});