knowledge/tests/test-user-admin.ts

import { eq } from 'drizzle-orm';
import { db } from '../src/db';
import { groups, roles, userGroups, userRoles, users } from '../src/db/schema/auth';
import { hashPassword, verifyPassword } from '../src/lib/auth/password';

async function runTest() {
  console.log('👤 Testing user administration data flow...');

  const email = `admin-flow-${Date.now()}@ekb.com`;
  const [createdUser] = await db.insert(users).values({
    email,
    name: 'Admin Flow User',
    passwordHash: await hashPassword('initial-password'),
  }).returning();

  const [viewerRole] = await db.select().from(roles).where(eq(roles.name, 'viewer')).limit(1);
  const [engGroup] = await db.select().from(groups).where(eq(groups.name, 'Engineering Department')).limit(1);

  if (!viewerRole || !engGroup) {
    console.error('❌ Required seed role/group missing. Run npx tsx src/db/seed.ts first.');
    process.exit(1);
  }

  await db.insert(userRoles).values({
    userId: createdUser.id,
    roleId: viewerRole.id,
  }).onConflictDoNothing();

  await db.insert(userGroups).values({
    userId: createdUser.id,
    groupId: engGroup.id,
  }).onConflictDoNothing();

  const newPasswordHash = await hashPassword('reset-password');
  await db.update(users)
    .set({ passwordHash: newPasswordHash, updatedAt: new Date() })
    .where(eq(users.id, createdUser.id));

  const [updatedUser] = await db.select().from(users).where(eq(users.id, createdUser.id)).limit(1);
  const [assignedRole] = await db.select().from(userRoles).where(eq(userRoles.userId, createdUser.id)).limit(1);
  const [assignedGroup] = await db.select().from(userGroups).where(eq(userGroups.userId, createdUser.id)).limit(1);

  if (!updatedUser || !assignedRole || !assignedGroup) {
    console.error('❌ User admin write flow did not persist expected rows.');
    process.exit(1);
  }

  const resetPasswordWorks = await verifyPassword('reset-password', updatedUser.passwordHash);
  const oldPasswordWorks = await verifyPassword('initial-password', updatedUser.passwordHash);

  if (!resetPasswordWorks || oldPasswordWorks) {
    console.error('❌ Password reset verification failed.');
    process.exit(1);
  }

  console.log('✅ User administration data flow passed.');
  process.exit(0);
}

runTest().catch((error) => {
  console.error('❌ Test failed with error:', error);
  process.exit(1);
});