|
| 1 | +/** @vitest-environment node */ |
| 2 | +import { queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing' |
| 3 | +import { beforeEach, describe, expect, it, vi } from 'vitest' |
| 4 | + |
| 5 | +const mocks = vi.hoisted(() => ({ group: vi.fn(), policy: vi.fn() })) |
| 6 | +vi.mock('@/lib/credential-groups/application/context', () => ({ |
| 7 | + resolveCredentialGroupWorkspaceContext: async () => ({ |
| 8 | + workspaceId: 'workspace-1', |
| 9 | + workspaceOrganizationId: 'org-1', |
| 10 | + allowPersonalApiKeys: true, |
| 11 | + }), |
| 12 | +})) |
| 13 | +vi.mock('@sim/platform-authz/workspace', () => ({ |
| 14 | + resolveEffectiveWorkspacePermission: vi.fn().mockResolvedValue('read'), |
| 15 | + permissionSatisfies: (permission: string, required: string) => permission === required, |
| 16 | +})) |
| 17 | +vi.mock('@/lib/credential-groups/credentials', () => ({ |
| 18 | + loadScopedAccountsCredentialListContext: mocks.group, |
| 19 | +})) |
| 20 | +vi.mock('@/lib/credential-groups/scoped-availability', () => ({ |
| 21 | + isScopedCredentialGroupsAvailable: vi.fn().mockResolvedValue(true), |
| 22 | +})) |
| 23 | +vi.mock('@/lib/resource-policies/repository', () => ({ requireResourcePolicy: mocks.policy })) |
| 24 | + |
| 25 | +import { buildOrganizationAccountAccessPolicy } from '@/lib/credential-groups/application/workspace-access-policy' |
| 26 | +import { getWorkspaceOrganizationAccounts } from '@/lib/credential-groups/application/workspace-organization-accounts' |
| 27 | + |
| 28 | +function read() { |
| 29 | + return getWorkspaceOrganizationAccounts.execute({ |
| 30 | + principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' }, |
| 31 | + input: { workspaceId: 'workspace-1' }, |
| 32 | + }) |
| 33 | +} |
| 34 | + |
| 35 | +describe('workspace organization provider projection', () => { |
| 36 | + beforeEach(() => { |
| 37 | + vi.clearAllMocks() |
| 38 | + resetDbChainMock() |
| 39 | + queueTableRows(schemaMock.organization, [{ name: 'Organization' }]) |
| 40 | + queueTableRows(schemaMock.member, [{ role: 'member' }]) |
| 41 | + queueTableRows(schemaMock.mcpServers, [{ connectorId: 'fireflies' }]) |
| 42 | + mocks.group.mockResolvedValue({ |
| 43 | + credentialGroupId: 'group-1', |
| 44 | + status: 'active', |
| 45 | + options: [ |
| 46 | + { provider: 'gmail', status: 'active' }, |
| 47 | + { provider: 'google-calendar', status: 'active' }, |
| 48 | + { provider: 'retired-provider', status: 'disabled' }, |
| 49 | + ], |
| 50 | + }) |
| 51 | + mocks.policy.mockResolvedValue({ |
| 52 | + document: buildOrganizationAccountAccessPolicy('group-1', [ |
| 53 | + { workspaceId: 'workspace-1', access: { mode: 'all' } }, |
| 54 | + ]), |
| 55 | + }) |
| 56 | + }) |
| 57 | + |
| 58 | + it('ignores disabled legacy options before validating active providers', async () => { |
| 59 | + const result = await read() |
| 60 | + expect(result.providers.map(({ id }) => id)).toEqual(['google-email', 'google-calendar']) |
| 61 | + expect(result.mcpProviders.map(({ id }) => id)).toEqual(['fireflies']) |
| 62 | + }) |
| 63 | + |
| 64 | + it('projects only credential types allowed for the current workspace', async () => { |
| 65 | + mocks.policy.mockResolvedValue({ |
| 66 | + document: buildOrganizationAccountAccessPolicy('group-1', [ |
| 67 | + { |
| 68 | + workspaceId: 'workspace-1', |
| 69 | + access: { mode: 'selected', credentialTypes: ['oauth:gmail'] }, |
| 70 | + }, |
| 71 | + ]), |
| 72 | + }) |
| 73 | + const result = await read() |
| 74 | + expect(result.allowed).toBe(true) |
| 75 | + expect(result.providers.map(({ id }) => id)).toEqual(['google-email']) |
| 76 | + expect(result.mcpProviders).toEqual([]) |
| 77 | + }) |
| 78 | + |
| 79 | + it('fails fast for an unregistered active provider', async () => { |
| 80 | + mocks.group.mockResolvedValue({ |
| 81 | + credentialGroupId: 'group-1', |
| 82 | + status: 'active', |
| 83 | + options: [{ provider: 'unknown', status: 'active' }], |
| 84 | + }) |
| 85 | + await expect(read()).rejects.toThrow('Unsupported organization provider: unknown') |
| 86 | + }) |
| 87 | +}) |
0 commit comments