You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
68 lines
4.1 KiB
TypeScript
68 lines
4.1 KiB
TypeScript
// apps/hq/test/settings-template.test.ts
|
|
import { describe, it, expect, beforeAll, afterAll } from 'vitest'
|
|
import express from 'express'
|
|
import { openDb } from '../src/db'
|
|
import { seedIfEmpty } from '../src/seed'
|
|
import { createStaff } from '../src/auth'
|
|
import { getSetting } from '../src/repos-reminders'
|
|
import { apiRouter } from '../src/api'
|
|
|
|
async function appWith() {
|
|
const db = openDb(':memory:'); await seedIfEmpty(db)
|
|
await createStaff(db, { email: 'owner@test.in', displayName: 'Owner', role: 'owner', password: 'owner-password' })
|
|
await createStaff(db, { email: 'staff@test.in', displayName: 'Staff', role: 'staff', password: 'staff-password' })
|
|
const app = express(); app.use(express.json({ limit: '2mb' })); app.locals['db'] = db; app.use('/api', apiRouter(db))
|
|
const server = app.listen(0)
|
|
const base = `http://localhost:${(server.address() as { port: number }).port}/api`
|
|
return { db, server, base }
|
|
}
|
|
|
|
describe('template settings', () => {
|
|
let ctx: Awaited<ReturnType<typeof appWith>>
|
|
beforeAll(async () => { ctx = await appWith() })
|
|
afterAll(() => ctx.server.close())
|
|
const login = async (email: string, password: string) =>
|
|
(await (await fetch(`${ctx.base}/auth/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email, password }) })).json() as any).token
|
|
const call = async (token: string, method: string, path: string, body?: unknown) => {
|
|
const res = await fetch(ctx.base + path, { method, headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` }, ...(body ? { body: JSON.stringify(body) } : {}) })
|
|
return { status: res.status, json: await res.json() as any }
|
|
}
|
|
|
|
it('owner GET returns company.* + template.*; PUT writes template fields + a title, each audited', async () => {
|
|
const token = await login('owner@test.in', 'owner-password')
|
|
const before = await call(token, 'GET', '/settings/template')
|
|
expect(before.json.settings['company.name']).toBe('Tecnostac')
|
|
const put = await call(token, 'PUT', '/settings/template', {
|
|
template: { footerNote: 'Thank you!', declaration: 'We declare…', signatoryLabel: 'Proprietor' },
|
|
titles: { INVOICE: 'GST INVOICE' },
|
|
})
|
|
expect(put.status).toBe(200)
|
|
expect(await getSetting(ctx.db, 'template.footer_note')).toBe('Thank you!')
|
|
expect(await getSetting(ctx.db, 'template.signatory_label')).toBe('Proprietor')
|
|
expect(await getSetting(ctx.db, 'template.title_INVOICE')).toBe('GST INVOICE')
|
|
const audits = (await ctx.db.get<{ n: number }>(`SELECT COUNT(*) AS n FROM audit_log WHERE entity='setting' AND entity_id LIKE 'template.%'`))!
|
|
expect(audits.n).toBeGreaterThanOrEqual(4)
|
|
})
|
|
it('rejects a staff PUT (owner only) and an invalid GSTIN', async () => {
|
|
const staff = await login('staff@test.in', 'staff-password')
|
|
expect((await call(staff, 'PUT', '/settings/template', { template: { terms: 'x' } })).status).toBe(403)
|
|
const owner = await login('owner@test.in', 'owner-password')
|
|
expect((await call(owner, 'PUT', '/settings/template', { company: { gstin: 'NOTAGSTIN' } })).status).toBe(400)
|
|
})
|
|
|
|
it('logo: accepts a small image data URI (owner, audited), rejects non-image, oversize, and staff', async () => {
|
|
const owner = await login('owner@test.in', 'owner-password')
|
|
const tiny = 'data:image/png;base64,' + 'A'.repeat(200)
|
|
expect((await call(owner, 'POST', '/settings/template/logo', { dataUri: tiny })).status).toBe(200)
|
|
expect(await getSetting(ctx.db, 'template.logo')).toBe(tiny)
|
|
expect((await call(owner, 'POST', '/settings/template/logo', { dataUri: 'data:text/html;base64,AAAA' })).status).toBe(400)
|
|
const huge = 'data:image/png;base64,' + 'A'.repeat(400_000) // ~300 KB decoded > 200 KB cap
|
|
expect((await call(owner, 'POST', '/settings/template/logo', { dataUri: huge })).status).toBe(400)
|
|
const staff = await login('staff@test.in', 'staff-password')
|
|
expect((await call(staff, 'POST', '/settings/template/logo', { dataUri: tiny })).status).toBe(403)
|
|
// clearing is allowed
|
|
expect((await call(owner, 'POST', '/settings/template/logo', { dataUri: '' })).status).toBe(200)
|
|
expect(await getSetting(ctx.db, 'template.logo')).toBe('')
|
|
})
|
|
})
|