Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
/**
|
|
|
|
|
* Custom field integration tests.
|
|
|
|
|
*
|
|
|
|
|
* Verifies:
|
|
|
|
|
* - Create a custom field definition (type: text)
|
|
|
|
|
* - Attempt to update fieldType → ValidationError thrown
|
|
|
|
|
* - Update fieldLabel → succeeds
|
|
|
|
|
* - Set a value for an entity → value stored
|
|
|
|
|
* - Get values for entity → returns value with definition
|
|
|
|
|
* - Delete definition → values cascade deleted
|
|
|
|
|
*
|
|
|
|
|
* Skips gracefully when TEST_DATABASE_URL is not reachable.
|
|
|
|
|
*/
|
|
|
|
|
import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
|
|
|
|
|
|
|
|
|
|
import { makeAuditMeta } from '../helpers/factories';
|
|
|
|
|
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
vi.mock('@/lib/audit', () => ({
|
|
|
|
|
createAuditLog: vi.fn().mockResolvedValue(undefined),
|
|
|
|
|
}));
|
|
|
|
|
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
const TEST_DB_URL =
|
|
|
|
|
process.env.TEST_DATABASE_URL || 'postgresql://test:test@localhost:5433/portnimara_test';
|
|
|
|
|
|
|
|
|
|
let dbAvailable = false;
|
|
|
|
|
|
|
|
|
|
beforeAll(async () => {
|
|
|
|
|
try {
|
|
|
|
|
const postgres = (await import('postgres')).default;
|
|
|
|
|
const sql = postgres(TEST_DB_URL, { max: 1, idle_timeout: 3, connect_timeout: 3 });
|
|
|
|
|
await sql`SELECT 1`;
|
|
|
|
|
await sql.end();
|
|
|
|
|
dbAvailable = true;
|
|
|
|
|
} catch {
|
|
|
|
|
console.warn('[custom-fields] Test database not available — skipping integration tests');
|
|
|
|
|
}
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
function itDb(name: string, fn: () => Promise<void>) {
|
|
|
|
|
it(name, async () => {
|
|
|
|
|
if (!dbAvailable) return;
|
|
|
|
|
await fn();
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ─── Helpers ─────────────────────────────────────────────────────────────────
|
|
|
|
|
|
|
|
|
|
async function seedPort(): Promise<string> {
|
|
|
|
|
const postgres = (await import('postgres')).default;
|
|
|
|
|
const sql = postgres(TEST_DB_URL, { max: 1 });
|
|
|
|
|
const portId = crypto.randomUUID();
|
|
|
|
|
await sql`
|
|
|
|
|
INSERT INTO ports (id, name, slug, country, currency, timezone)
|
|
|
|
|
VALUES (${portId}, 'Custom Fields Test Port', ${'cf-' + portId.slice(0, 8)}, 'AU', 'AUD', 'UTC')
|
|
|
|
|
`;
|
|
|
|
|
await sql.end();
|
|
|
|
|
return portId;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
async function cleanupPort(portId: string): Promise<void> {
|
|
|
|
|
const postgres = (await import('postgres')).default;
|
|
|
|
|
const sql = postgres(TEST_DB_URL, { max: 1 });
|
|
|
|
|
await sql`DELETE FROM ports WHERE id = ${portId}`;
|
|
|
|
|
await sql.end();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ─── Definitions Tests ────────────────────────────────────────────────────────
|
|
|
|
|
|
|
|
|
|
describe('Custom Fields — Definitions', () => {
|
|
|
|
|
let portId: string;
|
|
|
|
|
const userId = crypto.randomUUID();
|
|
|
|
|
|
|
|
|
|
beforeAll(async () => {
|
|
|
|
|
if (!dbAvailable) return;
|
|
|
|
|
portId = await seedPort();
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
afterAll(async () => {
|
|
|
|
|
if (!dbAvailable) return;
|
|
|
|
|
await cleanupPort(portId);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
itDb('creates a custom field definition', async () => {
|
|
|
|
|
const { createDefinition } = await import('@/lib/services/custom-fields.service');
|
|
|
|
|
const meta = makeAuditMeta({ portId, userId });
|
|
|
|
|
|
|
|
|
|
const def = await createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'client',
|
|
|
|
|
fieldName: 'vessel_registration',
|
|
|
|
|
fieldLabel: 'Vessel Registration',
|
|
|
|
|
fieldType: 'text',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 0,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
expect(def.id).toBeDefined();
|
|
|
|
|
expect(def.portId).toBe(portId);
|
|
|
|
|
expect(def.fieldName).toBe('vessel_registration');
|
|
|
|
|
expect(def.fieldType).toBe('text');
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
itDb('creating duplicate fieldName for same entityType throws ConflictError', async () => {
|
|
|
|
|
const { createDefinition } = await import('@/lib/services/custom-fields.service');
|
|
|
|
|
const { ConflictError } = await import('@/lib/errors');
|
|
|
|
|
const meta = makeAuditMeta({ portId, userId });
|
|
|
|
|
|
|
|
|
|
await createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'interest',
|
|
|
|
|
fieldName: 'preferred_berth_area',
|
|
|
|
|
fieldLabel: 'Preferred Berth Area',
|
|
|
|
|
fieldType: 'text',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 0,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
await expect(
|
|
|
|
|
createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'interest',
|
|
|
|
|
fieldName: 'preferred_berth_area',
|
|
|
|
|
fieldLabel: 'Duplicate Label',
|
|
|
|
|
fieldType: 'text',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 1,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
),
|
|
|
|
|
).rejects.toThrow(ConflictError);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
itDb('updateDefinition with fieldType property throws ValidationError', async () => {
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
const { createDefinition, updateDefinition } =
|
|
|
|
|
await import('@/lib/services/custom-fields.service');
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
const { ValidationError } = await import('@/lib/errors');
|
|
|
|
|
const meta = makeAuditMeta({ portId, userId });
|
|
|
|
|
|
|
|
|
|
const def = await createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'client',
|
|
|
|
|
fieldName: 'immutable_type_field',
|
|
|
|
|
fieldLabel: 'Immutable',
|
|
|
|
|
fieldType: 'text',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 0,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
// Cast bypasses TS — the service should guard against this at runtime.
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
await expect(
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
updateDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
def.id,
|
|
|
|
|
userId,
|
|
|
|
|
{ fieldType: 'number' } as unknown as Parameters<typeof updateDefinition>[3],
|
|
|
|
|
meta,
|
|
|
|
|
),
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
).rejects.toThrow(ValidationError);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
itDb('updateDefinition can change fieldLabel without error', async () => {
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
const { createDefinition, updateDefinition } =
|
|
|
|
|
await import('@/lib/services/custom-fields.service');
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
const meta = makeAuditMeta({ portId, userId });
|
|
|
|
|
|
|
|
|
|
const def = await createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'berth',
|
|
|
|
|
fieldName: 'special_notes',
|
|
|
|
|
fieldLabel: 'Notes',
|
|
|
|
|
fieldType: 'text',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 0,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
const updated = await updateDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
def.id,
|
|
|
|
|
userId,
|
|
|
|
|
{ fieldLabel: 'Special Notes' },
|
|
|
|
|
meta,
|
|
|
|
|
);
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
expect(updated.fieldLabel).toBe('Special Notes');
|
|
|
|
|
expect(updated.fieldType).toBe('text');
|
|
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
// ─── Values Tests ─────────────────────────────────────────────────────────────
|
|
|
|
|
|
|
|
|
|
describe('Custom Fields — Values', () => {
|
|
|
|
|
let portId: string;
|
|
|
|
|
const userId = crypto.randomUUID();
|
|
|
|
|
const entityId = crypto.randomUUID();
|
|
|
|
|
|
|
|
|
|
beforeAll(async () => {
|
|
|
|
|
if (!dbAvailable) return;
|
|
|
|
|
portId = await seedPort();
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
afterAll(async () => {
|
|
|
|
|
if (!dbAvailable) return;
|
|
|
|
|
await cleanupPort(portId);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
itDb('setValues stores a text value and getValues returns it with definition', async () => {
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
const { createDefinition, setValues, getValues } =
|
|
|
|
|
await import('@/lib/services/custom-fields.service');
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
const meta = makeAuditMeta({ portId, userId });
|
|
|
|
|
|
|
|
|
|
const def = await createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'client',
|
|
|
|
|
fieldName: 'marina_membership',
|
|
|
|
|
fieldLabel: 'Marina Membership',
|
|
|
|
|
fieldType: 'text',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 0,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
await setValues(entityId, portId, userId, [{ fieldId: def.id, value: 'GOLD-2024' }], meta);
|
|
|
|
|
|
|
|
|
|
const result = await getValues(entityId, portId);
|
|
|
|
|
const entry = result.find((r) => r.definition.id === def.id);
|
|
|
|
|
|
|
|
|
|
expect(entry).toBeDefined();
|
|
|
|
|
expect(entry!.value).not.toBeNull();
|
|
|
|
|
// value is stored as jsonb — the raw stored value
|
|
|
|
|
expect((entry!.value as Record<string, unknown>).value).toBe('GOLD-2024');
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
itDb('setValues with wrong type throws ValidationError', async () => {
|
|
|
|
|
const { createDefinition, setValues } = await import('@/lib/services/custom-fields.service');
|
|
|
|
|
const { ValidationError } = await import('@/lib/errors');
|
|
|
|
|
const meta = makeAuditMeta({ portId, userId });
|
|
|
|
|
|
|
|
|
|
const def = await createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'client',
|
|
|
|
|
fieldName: 'year_joined',
|
|
|
|
|
fieldLabel: 'Year Joined',
|
|
|
|
|
fieldType: 'number',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 0,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
await expect(
|
|
|
|
|
setValues(entityId, portId, userId, [{ fieldId: def.id, value: 'not-a-number' }], meta),
|
|
|
|
|
).rejects.toThrow(ValidationError);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
itDb('deleteDefinition cascades to remove associated values', async () => {
|
chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.
PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
and company.{incorporationCountryIso, incorporationSubdivisionIso}.
Server-side parsePhone() fallback for legacy raw phone strings.
PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
'audit.suspicious_login') were registered but evaluators returned [].
Both required schema/instrumentation that hadn't landed. Removed from
the registry; comments record the dependencies needed to revive them.
Effective rule count: 8 active.
PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
integration test files; webhook-delivery uses vi.hoisted for the
queue-add ref. Vitest no longer warns about non-top-level mocks.
Deflaked the 'short value' assertion in security-encryption.test.ts
by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.
PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
now filter by isNull(archivedAt). Berths use status (no archivedAt).
PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
walks every src/app/api/v1/**/route.ts and reports handlers without a
withPermission() wrapper. Initial run found 33 violations.
- Allow-listed 17 with explicit reasons (self-data, admin, alerts,
search, currency, ai, custom-fields — some marked TODO).
- Wrapped 7 routes with concrete permissions: clients/options
(clients:view), berths/options (berths:view), dashboard/*
(reports:view_dashboard), analytics (reports:view_analytics).
Audit report at docs/runbooks/permission-audit.md. Script exits
non-zero on any unallow-listed violation so it can become a CI gate.
Vitest: 741 -> 741 (no new tests; existing suite covers the changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 18:48:22 +02:00
|
|
|
const { createDefinition, setValues, deleteDefinition, getValues } =
|
|
|
|
|
await import('@/lib/services/custom-fields.service');
|
Initial commit: Port Nimara CRM (Layers 0-4)
Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 11:52:51 +01:00
|
|
|
const meta = makeAuditMeta({ portId, userId });
|
|
|
|
|
|
|
|
|
|
const cascadeEntityId = crypto.randomUUID();
|
|
|
|
|
|
|
|
|
|
const def = await createDefinition(
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
{
|
|
|
|
|
entityType: 'client',
|
|
|
|
|
fieldName: 'cascade_test_field',
|
|
|
|
|
fieldLabel: 'Cascade Test',
|
|
|
|
|
fieldType: 'text',
|
|
|
|
|
isRequired: false,
|
|
|
|
|
sortOrder: 0,
|
|
|
|
|
},
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
await setValues(
|
|
|
|
|
cascadeEntityId,
|
|
|
|
|
portId,
|
|
|
|
|
userId,
|
|
|
|
|
[{ fieldId: def.id, value: 'will-be-deleted' }],
|
|
|
|
|
meta,
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
// Verify the value exists
|
|
|
|
|
const before = await getValues(cascadeEntityId, portId);
|
|
|
|
|
expect(before.find((r) => r.definition.id === def.id)?.value).not.toBeNull();
|
|
|
|
|
|
|
|
|
|
const result = await deleteDefinition(portId, def.id, userId, meta);
|
|
|
|
|
expect(result.deletedValueCount).toBeGreaterThanOrEqual(1);
|
|
|
|
|
|
|
|
|
|
// Definition should no longer appear in getValues results
|
|
|
|
|
const after = await getValues(cascadeEntityId, portId);
|
|
|
|
|
expect(after.find((r) => r.definition.id === def.id)).toBeUndefined();
|
|
|
|
|
});
|
|
|
|
|
});
|