Todo/lib/__tests__/permissions.test.ts

/**
 * Tests for permission utility functions
 */

import { describe, it, expect, beforeEach, afterEach } from 'vitest'
import { prisma } from '../db'
import {
  canAccessList,
  canEditList,
  canDeleteList,
  getPermission,
} from '../permissions'
import bcrypt from 'bcryptjs'

describe('Permission Utilities', () => {
  let testUser1Id: string
  let testUser2Id: string
  let testListId: string

  beforeEach(async () => {
    // Create test users
    const passwordHash = await bcrypt.hash('password123', 10)
    
    const user1 = await prisma.user.create({
      data: {
        email: `test-perm-user1-${Date.now()}@example.com`,
        passwordHash,
        name: 'Test User 1',
      },
    })
    testUser1Id = user1.id

    const user2 = await prisma.user.create({
      data: {
        email: `test-perm-user2-${Date.now()}@example.com`,
        passwordHash,
        name: 'Test User 2',
      },
    })
    testUser2Id = user2.id

    // Create a test list owned by user1
    const list = await prisma.list.create({
      data: {
        title: 'Test List',
        color: '#3B82F6',
        ownerId: testUser1Id,
      },
    })
    testListId = list.id
  })

  afterEach(async () => {
    // Clean up test data
    await prisma.list.deleteMany({
      where: {
        id: testListId,
      },
    })
    await prisma.user.deleteMany({
      where: {
        id: {
          in: [testUser1Id, testUser2Id],
        },
      },
    })
  })

  describe('canAccessList', () => {
    it('should return true for list owner', async () => {
      const result = await canAccessList(testUser1Id, testListId)
      expect(result).toBe(true)
    })

    it('should return false for non-owner without collaboration', async () => {
      const result = await canAccessList(testUser2Id, testListId)
      expect(result).toBe(false)
    })

    it('should return true for editor collaborator', async () => {
      // Add user2 as editor
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'editor',
        },
      })

      const result = await canAccessList(testUser2Id, testListId)
      expect(result).toBe(true)
    })

    it('should return true for viewer collaborator', async () => {
      // Add user2 as viewer
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'viewer',
        },
      })

      const result = await canAccessList(testUser2Id, testListId)
      expect(result).toBe(true)
    })

    it('should return false for invalid user ID', async () => {
      const result = await canAccessList('', testListId)
      expect(result).toBe(false)
    })

    it('should return false for invalid list ID', async () => {
      const result = await canAccessList(testUser1Id, '')
      expect(result).toBe(false)
    })
  })

  describe('canEditList', () => {
    it('should return true for list owner', async () => {
      const result = await canEditList(testUser1Id, testListId)
      expect(result).toBe(true)
    })

    it('should return false for non-owner without collaboration', async () => {
      const result = await canEditList(testUser2Id, testListId)
      expect(result).toBe(false)
    })

    it('should return true for editor collaborator', async () => {
      // Add user2 as editor
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'editor',
        },
      })

      const result = await canEditList(testUser2Id, testListId)
      expect(result).toBe(true)
    })

    it('should return false for viewer collaborator', async () => {
      // Add user2 as viewer
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'viewer',
        },
      })

      const result = await canEditList(testUser2Id, testListId)
      expect(result).toBe(false)
    })

    it('should return false for invalid user ID', async () => {
      const result = await canEditList('', testListId)
      expect(result).toBe(false)
    })

    it('should return false for invalid list ID', async () => {
      const result = await canEditList(testUser1Id, '')
      expect(result).toBe(false)
    })
  })

  describe('canDeleteList', () => {
    it('should return true for list owner', async () => {
      const result = await canDeleteList(testUser1Id, testListId)
      expect(result).toBe(true)
    })

    it('should return false for non-owner', async () => {
      const result = await canDeleteList(testUser2Id, testListId)
      expect(result).toBe(false)
    })

    it('should return false for editor collaborator', async () => {
      // Add user2 as editor
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'editor',
        },
      })

      const result = await canDeleteList(testUser2Id, testListId)
      expect(result).toBe(false)
    })

    it('should return false for viewer collaborator', async () => {
      // Add user2 as viewer
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'viewer',
        },
      })

      const result = await canDeleteList(testUser2Id, testListId)
      expect(result).toBe(false)
    })

    it('should return false for invalid user ID', async () => {
      const result = await canDeleteList('', testListId)
      expect(result).toBe(false)
    })

    it('should return false for invalid list ID', async () => {
      const result = await canDeleteList(testUser1Id, '')
      expect(result).toBe(false)
    })
  })

  describe('getPermission', () => {
    it('should return "owner" for list owner', async () => {
      const result = await getPermission(testUser1Id, testListId)
      expect(result).toBe('owner')
    })

    it('should return null for non-owner without collaboration', async () => {
      const result = await getPermission(testUser2Id, testListId)
      expect(result).toBeNull()
    })

    it('should return "editor" for editor collaborator', async () => {
      // Add user2 as editor
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'editor',
        },
      })

      const result = await getPermission(testUser2Id, testListId)
      expect(result).toBe('editor')
    })

    it('should return "viewer" for viewer collaborator', async () => {
      // Add user2 as viewer
      await prisma.collaborator.create({
        data: {
          userId: testUser2Id,
          listId: testListId,
          permission: 'viewer',
        },
      })

      const result = await getPermission(testUser2Id, testListId)
      expect(result).toBe('viewer')
    })

    it('should return null for invalid user ID', async () => {
      const result = await getPermission('', testListId)
      expect(result).toBeNull()
    })

    it('should return null for invalid list ID', async () => {
      const result = await getPermission(testUser1Id, '')
      expect(result).toBeNull()
    })
  })
})