Files
site/apps/web/src/modules/admin/api/adminApi.test.ts
T
влад 12c983c0fc Шхуна не тонет: security, infra и доки на русском.
Безопасность довёл до ума — Cursor-генерацию переписал руками.
IDOR закрыл, CSRF задушил, refresh rotation теперь как надо.
HSTS на staging, ENABLE_DOCS=false, install.env recovery протестил.

Backend:
- jwt_denylist + auth_epoch: мгновенный revoke access JWT (logout/block/reset)
- auth/admin/users: bump epoch, logout с Bearer, forgot_password skip для blocked
- install_secrets: путь всегда apps/api/data/secrets/ (bootstrap из корня не ломает Docker)
- seed: SEED_DEMO_USERS=false на prod/staging
- тесты: jwt revoke, integration, coverage gate 90%

Frontend:
- logout шлёт Bearer, обработка TOKEN_REVOKED
- guards TypeScript fix
- E2E: blocked user → 401 сразу после block

Infra:
- staging/prod compose, TLS nginx, deploy-скрипты
- k6 §17.2, backup/health/smoke scripts

Docs:
- docs/ на русском: project, security, deploy, release (старые md слили)
- README короткий + план ТЗ + стандартные логины dev

Код готов к плаванию. Капитан может идти писать фронт.
2026-07-15 00:06:13 +03:00

119 lines
4.1 KiB
TypeScript

import { describe, expect, it, vi } from "vitest";
import {
createAdminUser,
deleteAdminUser,
getAdminActivityFeed,
getAdminDiagnostics,
getAdminServerLog,
getAdminSettings,
getAdminStats,
getAdminSummary,
getAdminUsers,
getInstallSecrets,
patchAdminSettings,
patchAdminUser,
postAdminUiActivity,
resetAdminUserPassword,
revealInstallSecret
} from "./adminApi";
vi.mock("@shared/api/client", () => ({
apiClient: {
get: vi.fn(async (url: string) => {
if (url === "/api/v1/admin/summary") {
return { data: { users_count: 5, registrations_day: 2, admins_count: 1, superusers_count: 1 } };
}
if (url === "/api/v1/admin/stats") {
return { data: { users_count: 5, registrations_day: 2 } };
}
if (url === "/api/v1/admin/settings") {
return { data: { values: {}, locks: {}, settings_path: "data/compton_settings.json", secrets: {} } };
}
if (url === "/api/v1/admin/diagnostics/report") {
return { data: { checks: [{ id: "x", status: "ok", message: "ok" }] } };
}
if (url === "/api/v1/admin/activity-feed") {
return { data: { events: [{ action: "a" }] } };
}
if (url === "/api/v1/admin/server-log") {
return { data: { lines: ["line"] } };
}
if (url === "/api/v1/admin/secrets") {
return { data: { initialized: true, locked: true, secrets_path: "x", database: {}, connection_string_masked: "", secrets_status: {} } };
}
return { data: { data: [], meta: { total: 0, page: 1, limit: 20 } } };
}),
patch: vi.fn(async (url: string) => {
if (url === "/api/v1/admin/settings") {
return {
data: {
values: { enable_docs: false },
locks: {},
settings_path: "data/compton_settings.json",
secrets: {}
}
};
}
return {
data: { id: "1", email: "u@example.com", role: "user", is_superuser: false, status: "blocked" }
};
}),
post: vi.fn(async (url: string) => {
if (url === "/api/v1/admin/users") {
return { data: { id: "1", email: "new@example.com", role: "user", is_superuser: false, status: "active" } };
}
if (url === "/api/v1/admin/ui-activity") {
return { data: { status: "ok" } };
}
if (url === "/api/v1/admin/secrets/reveal") {
return { data: { key: "database_password", value: "secret" } };
}
return { data: { status: "ok" } };
}),
delete: vi.fn(async () => ({ data: { status: "deleted" } }))
}
}));
describe("adminApi", () => {
it("loads admin users", async () => {
const data = await getAdminUsers();
expect(data.data).toEqual([]);
});
it("loads admin stats", async () => {
const stats = await getAdminStats();
expect(stats.users_count).toBe(5);
expect(stats.registrations_day).toBe(2);
});
it("loads admin summary", async () => {
const summary = await getAdminSummary();
expect(summary.superusers_count).toBe(1);
});
it("patches admin user", async () => {
const user = await patchAdminUser("1", { status: "blocked" });
expect(user.status).toBe("blocked");
});
it("calls remaining admin api helpers", async () => {
expect((await createAdminUser({
email: "new@example.com",
password: "Valid123A",
role: "user",
is_superuser: false,
status: "active"
})).email).toBe("new@example.com");
expect((await resetAdminUserPassword("1", "Valid123A")).status).toBe("blocked");
expect((await deleteAdminUser("1")).status).toBe("deleted");
expect((await getAdminSettings()).settings_path).toBe("data/compton_settings.json");
expect((await patchAdminSettings({ enable_docs: false })).settings_path).toBe("data/compton_settings.json");
expect((await getAdminDiagnostics()).checks[0].status).toBe("ok");
expect((await getAdminActivityFeed()).events.length).toBe(1);
expect((await postAdminUiActivity("click")).status).toBe("ok");
expect((await getAdminServerLog()).lines[0]).toBe("line");
expect((await getInstallSecrets()).initialized).toBe(true);
expect((await revealInstallSecret("database_password")).value).toBe("secret");
});
});