test: add enterprise feature test coverage

Tests for SCIM, GDPR lifecycle, legal hold, audit export/archival, encryption, SIEM forwarding, MFA endpoints, IP allowlist, config export/import, webhook management, and license validation.
2026-08-03 07:46:42 +02:00 · 2026-06-14 16:50:35 +08:00
parent 8403222d08
commit 112df13957
22 changed files with 3352 additions and 4 deletions
@@ -89,3 +89,119 @@ describe("legal hold", () => {
    expect(res.statusCode).toBe(403);
  });
 });
+
+describe("legal hold PUT validation", () => {
+  it("rejects missing targetType field", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { targetId: "some-id", hold: true },
+    });
+    expect([400, 403]).toContain(res.statusCode);
+  });
+
+  it("rejects invalid targetType value", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { targetType: "organization", targetId: "some-id", hold: true },
+    });
+    expect([400, 403]).toContain(res.statusCode);
+  });
+
+  it("rejects missing targetId field", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { targetType: "user", hold: true },
+    });
+    expect([400, 403]).toContain(res.statusCode);
+  });
+
+  it("rejects empty targetId string", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { targetType: "user", targetId: "", hold: true },
+    });
+    expect([400, 403]).toContain(res.statusCode);
+  });
+
+  it("rejects missing hold field", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { targetType: "user", targetId: "some-id" },
+    });
+    expect([400, 403]).toContain(res.statusCode);
+  });
+});
+
+describe("legal hold GET response structure", () => {
+  it("returns error object with enterprise message on 403", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    expect(res.statusCode).toBe(403);
+    const body = JSON.parse(res.body);
+    expect(body).toHaveProperty("error");
+    expect(typeof body.error).toBe("string");
+  });
+});
+
+describe("legal hold permission enforcement", () => {
+  it("returns 403 for editor role on PUT", async () => {
+    await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: {
+        username: "legalholdeditor",
+        password: "TestPass1",
+        role: "editor",
+      },
+    });
+    await db
+      .update(schema.users)
+      .set({ mustChangePassword: false })
+      .where(eq(schema.users.username, "legalholdeditor"));
+
+    const loginRes = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "legalholdeditor", password: "TestPass1" },
+    });
+    const editorToken = JSON.parse(loginRes.body).token;
+
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${editorToken}` },
+      payload: { targetType: "user", targetId: "some-id", hold: true },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("returns 403 for editor role on GET", async () => {
+    const loginRes = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "legalholdeditor", password: "TestPass1" },
+    });
+    const editorToken = JSON.parse(loginRes.body).token;
+
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/enterprise/legal-hold",
+      headers: { authorization: `Bearer ${editorToken}` },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+});