Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-16 10:11:54 +03:00
commit 016910ffb7
447 changed files with 73972 additions and 0 deletions
@@ -0,0 +1,85 @@
+import { expect, test } from "@playwright/test";
+import { API_URL, adminLogin, loginViaUi, registerVerifyLogin, uniqueEmail } from "../helpers/api";
+
+test.describe("§15.7 scenarios 5 & 9: Admin users", () => {
+  test("blocked user access token rejected immediately after block", async ({ request }) => {
+    const email = uniqueEmail("e2e-block-jwt");
+    const session = await registerVerifyLogin(request, email);
+    const admin = await adminLogin(request);
+    const adminToken = (await admin.json()).access_token;
+
+    const patch = await request.patch(`${API_URL}/api/v1/admin/users/${session.user.id}`, {
+      headers: { Authorization: `Bearer ${adminToken}` },
+      data: { status: "blocked" }
+    });
+    expect(patch.ok()).toBeTruthy();
+
+    const me = await request.get(`${API_URL}/api/v1/users/me`, {
+      headers: { Authorization: `Bearer ${session.accessToken}` }
+    });
+    expect(me.status()).toBe(401);
+    expect((await me.json()).detail).toBe("TOKEN_REVOKED");
+  });
+
+  test("admin blocks user → blocked user cannot login", async ({ page, request }) => {
+    const email = uniqueEmail("e2e-block");
+    const session = await registerVerifyLogin(request, email);
+    const admin = await adminLogin(request);
+    const adminToken = (await admin.json()).access_token;
+
+    const patch = await request.patch(`${API_URL}/api/v1/admin/users/${session.user.id}`, {
+      headers: { Authorization: `Bearer ${adminToken}` },
+      data: { status: "blocked" }
+    });
+    expect(patch.ok()).toBeTruthy();
+
+    await loginViaUi(page, email, "Valid1234");
+    await expect(page).toHaveURL(/\/login$/);
+  });
+
+  test("admin can open platform users page", async ({ page }) => {
+    await loginViaUi(page, "admin@compton.example", "Admin1234");
+    await expect(page).toHaveURL(/\/recipes$/);
+    await page.goto("/platform");
+    await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
+  });
+
+  test("admin session survives reload on /platform", async ({ page }) => {
+    await loginViaUi(page, "admin@compton.example", "Admin1234");
+    await page.goto("/platform");
+    await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
+    await page.goto("/platform");
+    await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
+  });
+
+  test("non-admin cannot open platform page", async ({ page, request }) => {
+    const email = uniqueEmail("e2e-nonadmin");
+    await registerVerifyLogin(request, email);
+    await loginViaUi(page, email, "Valid1234");
+    await expect(page).toHaveURL(/\/profile$/);
+    await page.goto("/platform");
+    await expect(page).toHaveURL(/\/$/);
+  });
+
+  test("admin cannot block self", async ({ request }) => {
+    const admin = await adminLogin(request);
+    const body = await admin.json();
+    const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
+      headers: { Authorization: `Bearer ${body.access_token}` },
+      data: { status: "blocked" }
+    });
+    expect(response.status()).toBe(400);
+    expect((await response.json()).detail).toBe("SELF_BLOCK_FORBIDDEN");
+  });
+
+  test("admin cannot demote self", async ({ request }) => {
+    const admin = await adminLogin(request);
+    const body = await admin.json();
+    const response = await request.patch(`${API_URL}/api/v1/admin/users/${body.user.id}`, {
+      headers: { Authorization: `Bearer ${body.access_token}` },
+      data: { role: "user" }
+    });
+    expect(response.status()).toBe(400);
+    expect((await response.json()).detail).toBe("SELF_DEMOTION_FORBIDDEN");
+  });
+});