Paddy
7aac07a013
Introduces src/models/admin/, a dedicated identity and permissions module on its own nachklang_admin database, and the shared authenticator that feedback and tickets will move onto in the cutover step. Nothing swaps over yet: feedback.auth.ts and tickets.auth.ts still authenticate against the legacy calendar sessions, so production behaviour is unchanged. - better-auth 1.7 mounted at /admin/auth/*, sessions as httpOnly cookies scoped to .nachklang.art so one sign-in covers every *.nachklang.art app. - Accounts are invite-only: public sign-up is disabled, and the invitations plugin is the only code that creates users. Tokens are stored as SHA-256 hashes and travel in the request body, never in a URL. - Per-app permissions in user_app_permissions; requireAppAccess(app) queries the database on every request (no cookie cache) so disabling a user or revoking a session takes effect immediately. - ADMIN_BOOTSTRAP_EMAIL guarantees a way in on an empty database, idempotently and without crashing the API if the database is unreachable at boot. - Guards prevent an admin from removing their own admin permission, disabling themselves, or stripping the last active admin. The admin pool uses the callback-style mysql2, not mysql2/promise: Kysely's MysqlDialect drives the pool with callbacks, and the promise wrapper ignores them, so every query hangs silently. Only the integration tests caught this. Schema in sql/admin/001_init.sql, derived from getAuthTables() on the installed better-auth rather than the published CLI, which lags the library and omits account.issuer. app.ts is split into src/app.factory.ts so the integration tests drive the real middleware order rather than a copy of it. Tests: 131 unit, plus 41 integration tests against a throwaway MariaDB started by test/integration/setup.ts (docker or podman). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
39 lines
1.2 KiB
TypeScript
39 lines
1.2 KiB
TypeScript
import {defineConfig} from 'vitest/config';
|
|
|
|
/**
|
|
* The admin module's integration tests. Separate from vitest.config.ts because
|
|
* these need Docker: they run against a real MariaDB (see
|
|
* docker-compose.test.yml) rather than mocks, which is the only way to catch
|
|
* the Kysely/MariaDB dialect and cookie-attribute problems this module can have.
|
|
*
|
|
* Run with: npm run test:integration
|
|
*/
|
|
export default defineConfig({
|
|
test: {
|
|
include: ['test/integration/**/*.test.ts'],
|
|
environment: 'node',
|
|
globalSetup: ['test/integration/setup.ts'],
|
|
// One database, shared state: parallel files would fight over the same
|
|
// user and invitation rows.
|
|
fileParallelism: false,
|
|
testTimeout: 30_000,
|
|
hookTimeout: 180_000,
|
|
env: {
|
|
NODE_ENV: 'test',
|
|
FEEDBACK_IP_SALT: 'vitest-salt',
|
|
DB_HOST: '127.0.0.1',
|
|
DB_PORT: '3307',
|
|
DB_USER: 'nachklang',
|
|
DB_PASSWORD: 'testpassword',
|
|
ADMIN_DB: 'nachklang_admin',
|
|
API_BASE_URL: 'http://localhost:3000',
|
|
ADMIN_APP_URL: 'http://localhost:3002',
|
|
APP_ORIGINS: 'http://localhost:3001',
|
|
BETTER_AUTH_SECRET: 'integration-test-secret-not-used-anywhere-else',
|
|
PASSKEY_RP_ID: 'localhost',
|
|
ADMIN_BOOTSTRAP_EMAIL: 'boot@nachklang.art',
|
|
SALESFORCE_ENABLED: 'false'
|
|
}
|
|
}
|
|
});
|