140 lines
7.5 KiB
JavaScript
140 lines
7.5 KiB
JavaScript
import { mkdtemp, mkdir, writeFile } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import { failureCount, gates, tenantAuthInventoryScanRoots, renderReport, reportPath, runTenantAuthInventory } from "./verify-tenant-auth-baseline.mjs";
|
|
|
|
const focusedSmokeTargets = [
|
|
"apps/web/app/routes/app.$tenant.host-aware.test.ts",
|
|
"apps/web/app/routes/app.$tenant.test.tsx",
|
|
"apps/web/app/routes/admin/settings/authentication.test.tsx",
|
|
"apps/web/app/utils/data/.server/auth-boundary-imports.test.ts",
|
|
"packages/db/src/index.test.ts",
|
|
"packages/entitlements/src/index.test.ts",
|
|
];
|
|
|
|
describe("Tenant Auth baseline runner configuration", () => {
|
|
it("defines the required non-E2E gates and report path", () => {
|
|
expect(reportPath).toMatch(/\.tc\/baselines\/tenant-auth\/baseline-health\.md$/);
|
|
expect(gates.map((gate) => gate.id)).toEqual(["typecheck", "lint", "ci-baseline", "vitest-tenantAuth-tenant-auth-smoke", "tenantAuth-tenant-auth-inventory"]);
|
|
expect(gates.some((gate) => gate.args?.some((arg) => /playwright|cypress|browser|e2e/i.test(arg)))).toBe(false);
|
|
expect(tenantAuthInventoryScanRoots).toEqual(["apps/web/app/routes", "apps/web/app/utils", "apps/web/app/modules", "packages/db/src", "packages/entitlements/src", "prisma"]);
|
|
});
|
|
|
|
it("keeps focused tenant/auth smoke tests in the Vitest gate", () => {
|
|
const vitestGate = gates.find((gate) => gate.id === "vitest-tenantAuth-tenant-auth-smoke");
|
|
|
|
expect(vitestGate?.args).toEqual(["exec", "vitest", "run", ...focusedSmokeTargets]);
|
|
});
|
|
});
|
|
|
|
describe("Tenant Auth baseline runner failure counting", () => {
|
|
it("counts failed typecheck diagnostics conservatively", () => {
|
|
expect(failureCount("typecheck", "src/a.ts(1,1): error TS2307: Cannot find module\nsrc/b.ts(2,2): error TS2322: Type mismatch", "", 1)).toBe(2);
|
|
expect(failureCount("typecheck", "Build failed", "", 1)).toBe(1);
|
|
});
|
|
|
|
it("counts failed ESLint diagnostics conservatively", () => {
|
|
expect(failureCount("lint", "✖ 4 problems (3 errors, 1 warning)", "", 1)).toBe(3);
|
|
expect(failureCount("lint", "2 errors and 0 warnings", "", 1)).toBe(2);
|
|
expect(failureCount("lint", "Lint crashed", "", 1)).toBe(1);
|
|
});
|
|
|
|
it("counts failed CI and Vitest diagnostics conservatively", () => {
|
|
expect(failureCount("ci-baseline", "FAIL package.json: missing script\nFAIL .eslintrc: missing rule", "", 1)).toBe(2);
|
|
expect(failureCount("vitest-tenantAuth-tenant-auth-smoke", "Tests 2 failed | 8 passed", "", 1)).toBe(2);
|
|
expect(failureCount("vitest-tenantAuth-tenant-auth-smoke", "Test Files 1 failed | 2 passed", "", 1)).toBe(1);
|
|
});
|
|
|
|
it("returns zero for clean exits and read-only inventory gates", () => {
|
|
expect(failureCount("lint", "warning only", "", 0)).toBe(0);
|
|
expect(failureCount("tenantAuth-tenant-auth-inventory", "total matches: 12", "", 1)).toBe(0);
|
|
});
|
|
});
|
|
|
|
describe("Tenant Auth inventory scan", () => {
|
|
it("scans existing roots, records missing roots, and ignores generated dependency and TC paths", async () => {
|
|
const root = await mkdtemp(join(tmpdir(), "tenantAuth-baseline-inventory-"));
|
|
await mkdir(join(root, "apps", "web", "app", "routes"), { recursive: true });
|
|
await mkdir(join(root, "apps", "web", "app", "utils"), { recursive: true });
|
|
await mkdir(join(root, "packages", "db", "src"), { recursive: true });
|
|
await mkdir(join(root, ".tc"), { recursive: true });
|
|
await mkdir(join(root, "apps", "web", "app", "routes", "generated"), { recursive: true });
|
|
await mkdir(join(root, "node_modules", "ignored"), { recursive: true });
|
|
|
|
const signal = [
|
|
"const tenant = 'workspace tenant orgId tenantId workspaceId';",
|
|
"const invite = 'invite invitation invited inviter invitee';",
|
|
"const lifecycle = 'expiresAt expired revoke revoked accept accepted';",
|
|
"const oauth = 'OAuth Google Apple provider strategy';",
|
|
"const magic = 'magicLink passwordless oneTime token';",
|
|
"const callback = 'callback redirectTo hostAware hostname origin';",
|
|
"const context = 'contextSwitch switchTenant currentWorkspace';",
|
|
"const access = 'role permission featureFlag entitlement plan revalidate';",
|
|
"const enterprise = 'SSO SAML OIDC OpenID IdP';",
|
|
].join("\n");
|
|
const ignoredSignal = "tenant invite expiresAt OAuth magicLink callback contextSwitch entitlement SAML";
|
|
|
|
await writeFile(join(root, "apps", "web", "app", "routes", "auth.tsx"), signal, "utf8");
|
|
await writeFile(join(root, "apps", "web", "app", "utils", "auth.ts"), "export const redirectTo = 'host-aware callback';", "utf8");
|
|
await writeFile(join(root, "packages", "db", "src", "tenant.ts"), "export const tenantId = 'workspace';", "utf8");
|
|
await writeFile(join(root, ".tc", "ignored.tsx"), ignoredSignal, "utf8");
|
|
await writeFile(join(root, "apps", "web", "app", "routes", "generated", "ignored.tsx"), ignoredSignal, "utf8");
|
|
await writeFile(join(root, "node_modules", "ignored", "ignored.tsx"), ignoredSignal, "utf8");
|
|
|
|
const inventory = await runTenantAuthInventory(root);
|
|
const allMatches = inventory.matches.join("\n");
|
|
|
|
expect(inventory.roots).toEqual(["apps/web/app/routes", "apps/web/app/utils", "packages/db/src"]);
|
|
expect(inventory.missingRoots).toEqual(["apps/web/app/modules", "packages/entitlements/src", "prisma"]);
|
|
expect(inventory.counts).toMatchObject({
|
|
"tenant-workspace": 8,
|
|
invite: 6,
|
|
"expiry-revocation-accept": 6,
|
|
"oauth-google-apple": 6,
|
|
"magic-link": 4,
|
|
"callback-redirect-host-aware": 9,
|
|
"context-switch": 3,
|
|
"role-feature-plan-revalidation": 6,
|
|
"sso-saml-oidc": 5,
|
|
});
|
|
expect(allMatches).toContain("apps/web/app/routes/auth.tsx");
|
|
expect(allMatches).toContain("apps/web/app/utils/auth.ts");
|
|
expect(allMatches).toContain("packages/db/src/tenant.ts");
|
|
expect(allMatches).not.toContain(".tc/ignored.tsx");
|
|
expect(allMatches).not.toContain("generated/ignored.tsx");
|
|
expect(allMatches).not.toContain("node_modules/ignored/ignored.tsx");
|
|
});
|
|
});
|
|
|
|
describe("Tenant Auth report rendering", () => {
|
|
it("renders gate metadata, fingerprints, and inventory counts", () => {
|
|
const report = renderReport([
|
|
{ id: "typecheck", command: "pnpm run typecheck", exitCode: 2, durationMs: 1500, failureCount: 7, fingerprint: { hash: "abc123def456", excerpt: "error TS2322" } },
|
|
{
|
|
id: "tenantAuth-tenant-auth-inventory",
|
|
command: "read-only Tenant Auth tenant/auth/OAuth/invite inventory",
|
|
exitCode: 0,
|
|
durationMs: 42,
|
|
failureCount: 0,
|
|
inventory: { roots: ["apps/web/app/routes"], missingRoots: ["prisma"], filesScanned: 3, counts: { "tenant-workspace": 1, invite: 2 }, totalMatches: 3, matches: [] },
|
|
fingerprint: { hash: "fed456abc123", excerpt: "tenant-workspace: 1" },
|
|
},
|
|
]);
|
|
|
|
expect(report).toContain("# Tenant Auth Baseline Health");
|
|
expect(report).toContain("non-E2E baseline gates for Tenant Auth baseline");
|
|
expect(report).toContain("tenant/workspace, invite");
|
|
expect(report).toContain("## typecheck");
|
|
expect(report).toContain("## tenantAuth-tenant-auth-inventory");
|
|
expect(report).toContain("- Exitcode: 2");
|
|
expect(report).toContain("- Failure Count: 7");
|
|
expect(report).toContain("- Output Fingerprint: abc123def456");
|
|
expect(report).toContain("- Inventory Roots: apps/web/app/routes");
|
|
expect(report).toContain("- Missing Roots Skipped: prisma");
|
|
expect(report).toContain(" - tenant-workspace: 1");
|
|
expect(report).toContain("- Total Inventory Matches: 3");
|
|
});
|
|
});
|