letsbe/pn-new-crm
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore(cleanup): Phase 1 — gap closure across audit, alerts, soft-delete, perms

Browse Source 
Multi-area cleanup pass closing partial-implementation gaps surfaced by the
post-i18n audit. No behavior changes for happy-path users; closes real
correctness/security holes.

PR1a Public yacht-interest endpoint i18n. /api/public/interests now accepts
     phoneE164/phoneCountry, nationalityIso, address.{countryIso, subdivisionIso},
     and company.{incorporationCountryIso, incorporationSubdivisionIso}.
     Server-side parsePhone() fallback for legacy raw phone strings.

PR1b Alert rule registry trim. Two rule slots ('document.expiring_soon',
     'audit.suspicious_login') were registered but evaluators returned [].
     Both required schema/instrumentation that hadn't landed. Removed from
     the registry; comments record the dependencies needed to revive them.
     Effective rule count: 8 active.

PR1c vi.mock hoist + flake fix. Hoisted vi.mock calls to top-level in 5
     integration test files; webhook-delivery uses vi.hoisted for the
     queue-add ref. Vitest no longer warns about non-top-level mocks.
     Deflaked the 'short value' assertion in security-encryption.test.ts
     by switching plaintext from 'ab' to 'XY' (non-hex chars). 5/5 runs green.

PR1d Soft-delete reference audit. listClientOptions and listYachtsForOwner
     now filter by isNull(archivedAt). Berths use status (no archivedAt).

PR1e Permission-matrix audit script + report. scripts/audit-permissions.ts
     walks every src/app/api/v1/**/route.ts and reports handlers without a
     withPermission() wrapper. Initial run found 33 violations.
     - Allow-listed 17 with explicit reasons (self-data, admin, alerts,
       search, currency, ai, custom-fields — some marked TODO).
     - Wrapped 7 routes with concrete permissions: clients/options
       (clients:view), berths/options (berths:view), dashboard/*
       (reports:view_dashboard), analytics (reports:view_analytics).
     Audit report at docs/runbooks/permission-audit.md. Script exits
     non-zero on any unallow-listed violation so it can become a CI gate.

Vitest: 741 -> 741 (no new tests; existing suite covers the changes).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matt Ciaccio
2026-04-28 18:48:22 +02:00
parent 16d98d630e
commit 31fa3d08ec
21 changed files with 560 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
tests/integration/crud-audit.test.ts
View File

@@ -11,7 +11,16 @@
*/
import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
import { makeAuditMeta, makeCreateClientInput, makeCreateInterestInput } from '../helpers/factories';
import {
makeAuditMeta,
makeCreateClientInput,
makeCreateInterestInput,
} from '../helpers/factories';
vi.mock('@/lib/socket/server', () => ({ emitToRoom: vi.fn() }));
vi.mock('@/lib/queue', () => ({
getQueue: () => ({ add: vi.fn().mockResolvedValue(undefined) }),
}));
const TEST_DB_URL =
process.env.TEST_DATABASE_URL || 'postgresql://test:test@localhost:5433/portnimara_test';
@@ -93,11 +102,6 @@ async function getAuditEntries(
describe('CRUD Audit — Clients', () => {
let portId: string;
vi.mock('@/lib/socket/server', () => ({ emitToRoom: vi.fn() }));
vi.mock('@/lib/queue', () => ({
getQueue: () => ({ add: vi.fn().mockResolvedValue(undefined) }),
}));
beforeAll(async () => {
if (!dbAvailable) return;
portId = await seedPort();
@@ -112,7 +116,11 @@ describe('CRUD Audit — Clients', () => {
const { createClient } = await import('@/lib/services/clients.service');
const meta = makeAuditMeta({ portId });
const client = await createClient(portId, makeCreateClientInput({ fullName: 'Audit Create Client' }), meta);
const client = await createClient(
portId,
makeCreateClientInput({ fullName: 'Audit Create Client' }),
meta,
);
await new Promise((r) => setTimeout(r, 100));
@@ -130,7 +138,11 @@ describe('CRUD Audit — Clients', () => {
const { createClient, updateClient } = await import('@/lib/services/clients.service');
const meta = makeAuditMeta({ portId });
const client = await createClient(portId, makeCreateClientInput({ fullName: 'Before Update' }), meta);
const client = await createClient(
portId,
makeCreateClientInput({ fullName: 'Before Update' }),
meta,
);
await updateClient(client.id, portId, { fullName: 'After Update' }, meta);
@@ -149,7 +161,11 @@ describe('CRUD Audit — Clients', () => {
const { createClient, archiveClient } = await import('@/lib/services/clients.service');
const meta = makeAuditMeta({ portId });
const client = await createClient(portId, makeCreateClientInput({ fullName: 'Audit Archive Client' }), meta);
const client = await createClient(
portId,
makeCreateClientInput({ fullName: 'Audit Archive Client' }),
meta,
);
await archiveClient(client.id, portId, meta);
@@ -161,10 +177,15 @@ describe('CRUD Audit — Clients', () => {
});
itDb('restore generates an audit log entry with action=restore', async () => {
const { createClient, archiveClient, restoreClient } = await import('@/lib/services/clients.service');
const { createClient, archiveClient, restoreClient } =
await import('@/lib/services/clients.service');
const meta = makeAuditMeta({ portId });
const client = await createClient(portId, makeCreateClientInput({ fullName: 'Audit Restore Client' }), meta);
const client = await createClient(
portId,
makeCreateClientInput({ fullName: 'Audit Restore Client' }),
meta,
);
await archiveClient(client.id, portId, meta);
await restoreClient(client.id, portId, meta);
@@ -183,17 +204,16 @@ describe('CRUD Audit — Interests', () => {
let portId: string;
let clientId: string;
vi.mock('@/lib/socket/server', () => ({ emitToRoom: vi.fn() }));
vi.mock('@/lib/queue', () => ({
getQueue: () => ({ add: vi.fn().mockResolvedValue(undefined) }),
}));
beforeAll(async () => {
if (!dbAvailable) return;
portId = await seedPort();
const { createClient } = await import('@/lib/services/clients.service');
const client = await createClient(portId, makeCreateClientInput({ fullName: 'Interest Audit Client' }), makeAuditMeta({ portId }));
const client = await createClient(
portId,
makeCreateClientInput({ fullName: 'Interest Audit Client' }),
makeAuditMeta({ portId }),
);
clientId = client.id;
});
@@ -223,7 +243,11 @@ describe('CRUD Audit — Interests', () => {
const { createInterest, updateInterest } = await import('@/lib/services/interests.service');
const meta = makeAuditMeta({ portId });
const interest = await createInterest(portId, { ...makeCreateInterestInput({ clientId }), notes: 'initial' }, meta);
const interest = await createInterest(
portId,
{ ...makeCreateInterestInput({ clientId }), notes: 'initial' },
meta,
);
await updateInterest(interest.id, portId, { notes: 'updated notes' }, meta);
@@ -249,7 +273,8 @@ describe('CRUD Audit — Interests', () => {
});
itDb('restore generates audit log with action=restore', async () => {
const { createInterest, archiveInterest, restoreInterest } = await import('@/lib/services/interests.service');
const { createInterest, archiveInterest, restoreInterest } =
await import('@/lib/services/interests.service');
const meta = makeAuditMeta({ portId });
const interest = await createInterest(portId, makeCreateInterestInput({ clientId }), meta);
@@ -270,11 +295,6 @@ describe('CRUD Audit — Berths', () => {
let portId: string;
let berthId: string;
vi.mock('@/lib/socket/server', () => ({ emitToRoom: vi.fn() }));
vi.mock('@/lib/queue', () => ({
getQueue: () => ({ add: vi.fn().mockResolvedValue(undefined) }),
}));
beforeAll(async () => {
if (!dbAvailable) return;
portId = await seedPort();
@@ -313,8 +333,8 @@ describe('CRUD Audit — Berths', () => {
const wrongPortId = crypto.randomUUID();
const meta = makeAuditMeta({ portId: wrongPortId });
await expect(
updateBerth(berthId, wrongPortId, { area: 'Should fail' }, meta),
).rejects.toThrow(NotFoundError);
await expect(updateBerth(berthId, wrongPortId, { area: 'Should fail' }, meta)).rejects.toThrow(
NotFoundError,
);
});
});