@@ -0,0 +1,262 @@
|
||||
/**
|
||||
* The API against a real, migrated database (DATABASE_URL): the terminal protocol, the dashboard and the superadmin
|
||||
* page as they are used together. Wipes the database first.
|
||||
*/
|
||||
import { Test } from '@nestjs/testing';
|
||||
import { NestExpressApplication } from '@nestjs/platform-express';
|
||||
import { randomUUID } from 'crypto';
|
||||
import request from 'supertest';
|
||||
import { APP_VERSION_HEADER, SyncResponse } from '@kooltap/shared';
|
||||
import { AppModule } from '../src/app.module';
|
||||
import { configure } from '../src/main';
|
||||
import { PrismaService } from '../src/prisma/prisma.service';
|
||||
import { hashPassword } from '../src/auth/auth.service';
|
||||
|
||||
const API = '/api/v1';
|
||||
const APP_VERSION = { [APP_VERSION_HEADER]: '2.0.0' };
|
||||
|
||||
let app: NestExpressApplication;
|
||||
let prisma: PrismaService;
|
||||
let venueId: string;
|
||||
let otherVenueId: string;
|
||||
|
||||
beforeAll(async () => {
|
||||
const module = await Test.createTestingModule({ imports: [AppModule] }).compile();
|
||||
app = configure(module.createNestApplication<NestExpressApplication>({ logger: ['error'] }));
|
||||
await app.init();
|
||||
prisma = app.get(PrismaService);
|
||||
|
||||
await prisma.productImage.deleteMany();
|
||||
await prisma.auditLog.deleteMany();
|
||||
// Superadmins belong to no venue, so deleting the venues leaves them
|
||||
await prisma.user.deleteMany();
|
||||
await prisma.venue.deleteMany();
|
||||
venueId = (await prisma.venue.create({ data: { name: 'Café De Kroon' } })).id;
|
||||
otherVenueId = (await prisma.venue.create({ data: { name: 'Elsewhere' } })).id;
|
||||
const passwordHash = await hashPassword('Secret123!');
|
||||
await prisma.user.createMany({
|
||||
data: [
|
||||
{ venueId, email: 'admin@kroon.be', name: 'Owner', role: 'admin', passwordHash },
|
||||
{ venueId: null, email: 'root@kooltap.be', name: 'KoolTap', role: 'superadmin', passwordHash },
|
||||
],
|
||||
});
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await app.close();
|
||||
});
|
||||
|
||||
const server = () => app.getHttpServer();
|
||||
|
||||
// Signed in once per user: logins are rate limited
|
||||
const agents = new Map<string, ReturnType<typeof request.agent>>();
|
||||
|
||||
async function signIn(email: string) {
|
||||
let agent = agents.get(email);
|
||||
if (!agent) {
|
||||
agent = request.agent(server());
|
||||
await agent.post(`${API}/auth/login`).send({ email, password: 'Secret123!' }).expect(200);
|
||||
agents.set(email, agent);
|
||||
}
|
||||
return agent;
|
||||
}
|
||||
|
||||
describe('auth', () => {
|
||||
it('signs in with httpOnly cookies, refreshes and signs out', async () => {
|
||||
const login = await request(server()).post(`${API}/auth/login`).send({ email: ' ADMIN@kroon.be ', password: 'Secret123!' }).expect(200);
|
||||
expect(login.body).toMatchObject({ email: 'admin@kroon.be', role: 'admin', venueId, venueName: 'Café De Kroon' });
|
||||
const cookies = ([] as string[]).concat(login.headers['set-cookie'] ?? []);
|
||||
expect(cookies.every((cookie) => /HttpOnly/i.test(cookie))).toBe(true);
|
||||
|
||||
const agent = request.agent(server());
|
||||
await agent.post(`${API}/auth/login`).send({ email: 'admin@kroon.be', password: 'Secret123!' }).expect(200);
|
||||
await agent.get(`${API}/auth/me`).expect(200);
|
||||
await agent.post(`${API}/auth/refresh`).expect(200);
|
||||
await agent.post(`${API}/auth/logout`).expect(200);
|
||||
await agent.post(`${API}/auth/refresh`).expect(401);
|
||||
});
|
||||
|
||||
it('refuses a wrong password and requests without a session', async () => {
|
||||
await request(server()).post(`${API}/auth/login`).send({ email: 'admin@kroon.be', password: 'nope' }).expect(401);
|
||||
await request(server()).get(`${API}/venues/${venueId}/tabs`).expect(401);
|
||||
});
|
||||
|
||||
it("keeps users out of other venues, but not a superadmin, who belongs to none", async () => {
|
||||
await (await signIn('admin@kroon.be')).get(`${API}/venues/${otherVenueId}/tabs`).expect(403);
|
||||
const root = await signIn('root@kooltap.be');
|
||||
expect((await root.get(`${API}/auth/me`).expect(200)).body).toMatchObject({ role: 'superadmin', venueId: null, venueName: null });
|
||||
await root.get(`${API}/venues/${otherVenueId}/tabs`).expect(200);
|
||||
// As the venue's admin
|
||||
await root.get(`${API}/venues/${otherVenueId}/users`).expect(200);
|
||||
});
|
||||
});
|
||||
|
||||
describe('terminal and dashboard', () => {
|
||||
const productId = randomUUID();
|
||||
const tabId = randomUUID();
|
||||
const lineId = randomUUID();
|
||||
let token: string;
|
||||
let sync: (body: object) => Promise<SyncResponse>;
|
||||
// In the past: a terminal clock ahead of the server is capped at its time
|
||||
let at = Date.now() - 60 * 60 * 1000;
|
||||
const event = (type: string, fields: object) => ({ id: randomUUID(), type, occurredAt: new Date((at += 1000)).toISOString(), ...fields });
|
||||
|
||||
it('pairs a terminal with a registration code, once, and refuses an outdated app', async () => {
|
||||
const admin = await signIn('admin@kroon.be');
|
||||
const { body: { code } } = await admin.post(`${API}/venues/${venueId}/registration-codes`).expect(201);
|
||||
|
||||
await request(server()).post(`${API}/terminal/register`).send({ registrationCode: code, name: 'Bar' }).expect(426);
|
||||
const registered = await request(server()).post(`${API}/terminal/register`).set(APP_VERSION)
|
||||
.send({ registrationCode: code.toLowerCase(), name: 'Bar' }).expect(201);
|
||||
expect(registered.body).toMatchObject({ venueId, venueName: 'Café De Kroon' });
|
||||
await request(server()).post(`${API}/terminal/register`).set(APP_VERSION).send({ registrationCode: code, name: 'Bar 2' }).expect(401);
|
||||
|
||||
// A 1.x app still on the old protocol is told to update, so it keeps its outbox
|
||||
for (const path of ['/devices/register', `/devices/${registered.body.deviceId}/sync`]) {
|
||||
const old = await request(server()).post(`${API}${path}`).set('x-app-version', '1.4.4+0').send({}).expect(426);
|
||||
expect(old.body.error.code).toBe('app_update_required');
|
||||
}
|
||||
await request(server()).get(`${API}/venues/`).set('x-app-version', '1.4.4+0').expect(426);
|
||||
|
||||
token = registered.body.token;
|
||||
sync = async (body) => (await request(server()).post(`${API}/terminal/sync`).set(APP_VERSION)
|
||||
.set('Authorization', `Bearer ${token}`).send(body).expect(200)).body;
|
||||
});
|
||||
|
||||
it('applies events once and returns the venue state', async () => {
|
||||
const events = [
|
||||
event('product_created', { productId, product: { name: 'Cola', priceInCents: 250 } }),
|
||||
event('stock_set', { productId, quantity: 24 }),
|
||||
event('tab_opened', { tabId, customerName: 'Jan', email: 'Jan@Example.com' }),
|
||||
event('line_added', { tabId, customerName: 'Jan', lineId, orderId: 'o1', productId, productName: 'Cola', unitPriceInCents: 250, quantity: 3 }),
|
||||
event('line_removed', { tabId, lineId, orderId: 'o1', quantity: 1 }),
|
||||
{ id: 'broken', type: 'tab_opened' },
|
||||
];
|
||||
|
||||
const first = await sync({ events });
|
||||
expect(first.acknowledgedEventIds).toHaveLength(5);
|
||||
expect(first.rejectedEvents).toMatchObject([{ id: 'broken' }]);
|
||||
expect(first.tabs).toMatchObject([{ id: tabId, customerName: 'Jan', email: 'jan@example.com', lines: [{ id: lineId, quantity: 2 }] }]);
|
||||
expect(first.stock).toEqual([{ productId, stock: 22, countedAt: expect.any(String) }]);
|
||||
expect(first.catalog).toMatchObject([{ id: productId, name: 'Cola', archived: false }]);
|
||||
|
||||
// Sent again, as a terminal does until it gets the acknowledgement: nothing changes, and the catalog isn't resent
|
||||
const again = await sync({ events, catalogVersion: first.catalogVersion, settlementsCursor: first.settlementsCursor });
|
||||
expect(again.tabs).toEqual(first.tabs);
|
||||
expect(again.stock).toEqual(first.stock);
|
||||
expect(again.catalog).toBeNull();
|
||||
expect(await prisma.tabUnit.count({ where: { tabId } })).toBe(3);
|
||||
});
|
||||
|
||||
it('settles on a terminal and feeds the settlement to every terminal', async () => {
|
||||
const settled = event('settled', {
|
||||
tabId, customerName: 'Jan', amountInCents: 250, paymentMethod: 'cash',
|
||||
items: [{ lineId, productId, productName: 'Cola', unitPriceInCents: 250, quantity: 1 }],
|
||||
});
|
||||
const result = await sync({ events: [settled], settlementsCursor: '0' });
|
||||
|
||||
expect(result.tabs[0].lines).toMatchObject([{ quantity: 1 }]);
|
||||
expect(result.settlements).toMatchObject([{ id: settled.id, amountInCents: 250, lines: [{ quantity: 1, units: [{}, { removedAt: expect.any(String) }] }] }]);
|
||||
expect((await sync({ settlementsCursor: result.settlementsCursor })).settlements).toEqual([]);
|
||||
});
|
||||
|
||||
it('shows the tab on the dashboard and settles it there, refusing a stale version', async () => {
|
||||
const admin = await signIn('admin@kroon.be');
|
||||
const [tab] = (await admin.get(`${API}/venues/${venueId}/tabs`).expect(200)).body;
|
||||
expect(tab).toMatchObject({ id: tabId, totalInCents: 250, itemCount: 1 });
|
||||
|
||||
await admin.post(`${API}/venues/${venueId}/tabs/${tabId}/settle`).send({ expectedVersion: tab.version - 1, paymentMethod: 'cash' }).expect(409);
|
||||
await admin.post(`${API}/venues/${venueId}/tabs/${tabId}/settle`).send({ expectedVersion: tab.version }).expect(400);
|
||||
const settled = await admin.post(`${API}/venues/${venueId}/tabs/${tabId}/settle`).send({ expectedVersion: tab.version, paymentMethod: 'payconiq' }).expect(200);
|
||||
expect(settled.body.amountInCents).toBe(250);
|
||||
|
||||
await admin.post(`${API}/venues/${venueId}/tabs/${tabId}/settle`).send({ expectedVersion: tab.version, paymentMethod: 'payment_pending' }).expect(400);
|
||||
const history = (await admin.get(`${API}/venues/${venueId}/settlements?limit=10`).expect(200)).body;
|
||||
expect(history).toMatchObject({ total: 2, totalAmountInCents: 500 });
|
||||
expect(history.settlements[0]).toMatchObject({ paymentMethod: 'payconiq', settledBy: 'Owner', onDashboard: true });
|
||||
expect(history.settlements[1]).toMatchObject({ paymentMethod: 'cash', settledBy: 'Bar', items: [{ quantity: 1, removed: 1 }] });
|
||||
});
|
||||
|
||||
it('opens a tab for a new customer on the next sync', async () => {
|
||||
const admin = await signIn('admin@kroon.be');
|
||||
await admin.post(`${API}/venues/${venueId}/customers`).send({ name: ' Marie Peeters ', email: 'marie@example.com' }).expect(201);
|
||||
await admin.post(`${API}/venues/${venueId}/customers`).send({ name: 'marie peeters' }).expect(409);
|
||||
|
||||
const result = await sync({});
|
||||
expect(result.tabs.map((t) => t.customerName)).toContain('Marie Peeters');
|
||||
// Jan was added by the terminal that opened his tab with an email
|
||||
expect((await admin.get(`${API}/venues/${venueId}/customers`).expect(200)).body).toMatchObject([
|
||||
{ name: 'Jan', email: 'jan@example.com' },
|
||||
{ name: 'Marie Peeters', tabOpenedAt: expect.any(String) },
|
||||
]);
|
||||
});
|
||||
|
||||
it('records stock movements and refuses adding to an untracked product', async () => {
|
||||
const admin = await signIn('admin@kroon.be');
|
||||
const { body: chips } = await admin.post(`${API}/venues/${venueId}/stock/products`).send({ name: 'Chips', priceInCents: 200 }).expect(201);
|
||||
|
||||
await admin.post(`${API}/venues/${venueId}/stock/movements`).send({ movements: [{ productId: chips.id, type: 'add', quantity: 5 }] }).expect(400);
|
||||
const { body } = await admin.post(`${API}/venues/${venueId}/stock/movements`).send({
|
||||
movements: [{ productId: chips.id, type: 'count', quantity: 10 }, { productId: chips.id, type: 'add', quantity: -2, note: 'Broken' }],
|
||||
}).expect(201);
|
||||
expect(body.movements.map((m: { stockAfter: number }) => m.stockAfter).sort()).toEqual([10, 8]);
|
||||
|
||||
const products = (await admin.get(`${API}/venues/${venueId}/stock/products`).expect(200)).body;
|
||||
expect(products.find((p: { id: string }) => p.id === chips.id)).toMatchObject({ stock: 8 });
|
||||
await admin.post(`${API}/venues/${venueId}/stock/products`).send({ name: 'chips', priceInCents: 100 }).expect(409);
|
||||
});
|
||||
|
||||
it('unpairs the terminal, which then cannot sync', async () => {
|
||||
const admin = await signIn('admin@kroon.be');
|
||||
const [device] = (await admin.get(`${API}/venues/${venueId}/devices`).expect(200)).body;
|
||||
await admin.delete(`${API}/venues/${venueId}/devices/${device.id}`).expect(200);
|
||||
|
||||
await request(server()).post(`${API}/terminal/sync`).set(APP_VERSION).set('Authorization', `Bearer ${token}`).send({}).expect(401);
|
||||
});
|
||||
});
|
||||
|
||||
describe('superadmin', () => {
|
||||
it('is the only one who reaches the admin page', async () => {
|
||||
await (await signIn('admin@kroon.be')).get(`${API}/admin/venues`).expect(403);
|
||||
const venues = (await (await signIn('root@kooltap.be')).get(`${API}/admin/venues`).expect(200)).body;
|
||||
expect(venues.map((v: { name: string }) => v.name)).toEqual(['Café De Kroon', 'Elsewhere']);
|
||||
});
|
||||
|
||||
it('resets the tabs, which brings the Free Drinks customer back', async () => {
|
||||
const root = await signIn('root@kooltap.be');
|
||||
const dryRun = (await root.post(`${API}/admin/venues/${venueId}/reset`).send({ scopes: ['tabs'], dryRun: true }).expect(200)).body;
|
||||
expect(dryRun.counts.tabs).toBeGreaterThan(0);
|
||||
|
||||
await root.post(`${API}/admin/venues/${venueId}/reset`).send({ scopes: ['tabs'] }).expect(200);
|
||||
expect(await prisma.tab.count({ where: { venueId } })).toBe(0);
|
||||
expect(await prisma.customer.findMany({ where: { venueId }, select: { name: true } })).toContainEqual({ name: 'Free Drinks' });
|
||||
});
|
||||
|
||||
it('checks a venue and the system', async () => {
|
||||
const root = await signIn('root@kooltap.be');
|
||||
const consistency = (await root.get(`${API}/admin/venues/${venueId}/consistency`).expect(200)).body;
|
||||
expect(consistency.findings.filter((f: { code: string }) => f.code === 'settlement_amount_mismatch')).toEqual([]);
|
||||
|
||||
const health = (await root.get(`${API}/admin/health`).expect(200)).body;
|
||||
expect(health.migrations).toMatchObject({ applied: 1, failed: [] });
|
||||
});
|
||||
|
||||
it('moves a user between a venue and above the venues', async () => {
|
||||
const root = await signIn('root@kooltap.be');
|
||||
const { body: users } = await root.get(`${API}/admin/users`).expect(200);
|
||||
const owner = users.find((u: { email: string }) => u.email === 'admin@kroon.be');
|
||||
|
||||
await root.patch(`${API}/admin/users/${owner.id}/role`).send({ role: 'superadmin' }).expect(200);
|
||||
expect(await prisma.user.findUnique({ where: { id: owner.id } })).toMatchObject({ role: 'superadmin', venueId: null });
|
||||
await root.patch(`${API}/admin/users/${owner.id}/role`).send({ role: 'admin' }).expect(400);
|
||||
await root.patch(`${API}/admin/users/${owner.id}/role`).send({ role: 'admin', venueId }).expect(200);
|
||||
expect(await prisma.user.findUnique({ where: { id: owner.id } })).toMatchObject({ role: 'admin', venueId });
|
||||
});
|
||||
|
||||
it('deletes a venue with everything in it', async () => {
|
||||
const root = await signIn('root@kooltap.be');
|
||||
await root.delete(`${API}/admin/venues/${otherVenueId}?confirmName=Wrong`).expect(400);
|
||||
await root.delete(`${API}/admin/venues/${otherVenueId}?confirmName=Elsewhere`).expect(200);
|
||||
expect(await prisma.venue.count({ where: { id: otherVenueId } })).toBe(0);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user