import { mkdtempSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest"; import { mintInviteCode } from "../testing/mint-invite"; // The self-host admin users plane (`/api/admin/users*`), over the REAL booted// app: Better Auth, the libSQL store, and the mounted route layer.//// Self-host has no organization-owned api key (Better Auth keys always belong// to the user who made one), so the credential here is the operator's own// owner/admin session — the same gate the invite-code admin API uses. What this// pins is that the mount is live, that the owner/admin gate actually refuses a// plain member, and that a member who has used the instance shows up in the// owner's view without their credential coming with them. process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-admin-users-"));process.env.BETTER_AUTH_SECRET = "admin-users-test-secret-0123456789-abcdefghij";process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@admin-users.test";process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456"; const { makeSelfHostApiHandler } = await import("../app");const { handler, dispose } = await makeSelfHostApiHandler();afterAll(() => dispose()); const BASE = "http://localhost:4788"; const signIn = async (email: string, password: string): Promise<string> => { const response = await handler( new Request(`${BASE}/api/auth/sign-in/email`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email, password }), }), ); return response.headers.get("set-auth-token") ?? "";}; const adminUsers = (token?: string, path = "/api/admin/users") => handler( new Request(`${BASE}${path}`, { headers: token ? { authorization: `Bearer ${token}` } : {}, }), ); test("the owner sees who uses the instance; a plain member cannot look", async () => { const adminToken = await signIn( process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL!, process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD!, ); expect(adminToken).not.toBe(""); // A second person joins through the real invite flow and uses the instance. const inviteCode = await mintInviteCode(handler); const signUp = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email: "member@admin-users.test", password: "password-12345678", name: "Member", inviteCode, }), }), ); expect(signUp.status).toBe(200); const memberToken = signUp.headers.get("set-auth-token") ?? ""; expect(memberToken).not.toBe(""); // A user earns their row the first time they touch the EXECUTOR plane, so // have both make one product read before looking at the admin view. for (const token of [adminToken, memberToken]) { const integrations = await handler( new Request(`${BASE}/api/integrations`, { headers: { authorization: `Bearer ${token}` } }), ); expect(integrations.status).toBe(200); } // The owner's view reports both people. const response = await adminUsers(adminToken); expect(response.status).toBe(200); const body = (await response.json()) as { users: ReadonlyArray<{ externalId: string; lastSeenAt: number | null; email: string | null; displayName: string | null; }>; }; expect(body.users.length, "both the owner and the invited member are reported").toBe(2); expect(typeof body.users[0]?.lastSeenAt, "last-seen crosses the wire as a number").toBe("number"); // THE JOIN KEY, proven against real Better Auth rather than assumed. // // `auth/identity.ts` binds `session.user.id` as the accountId, so that is what // the subject table records in `external_id` — and it is the member list's // `userId`, NOT its `id` (the organization `member` ROW id). The two look // alike and only one joins, so this asserts the actual emails land on the // actual rows: a mismatch would leave every user unnamed while the counts // above still passed. const byEmail = new Map(body.users.map((user) => [user.email, user.externalId])); expect( [...byEmail.keys()].sort(), "each user carries the email Better Auth holds for them", ).toEqual(["admin@admin-users.test", "member@admin-users.test"]); expect( body.users.every((user) => user.externalId.length > 0), "and the id space still lines up — nobody was named by matching nothing", ).toBe(true); expect( body.users.find((user) => user.email === "member@admin-users.test")?.displayName, "the sign-up name comes through as the display name", ).toBe("Member"); // The joined view is mounted too, and carries the same identity. const joined = await adminUsers(adminToken, "/api/admin/users/with-connections"); expect(joined.status).toBe(200); const joinedBody = (await joined.json()) as { users: ReadonlyArray<{ externalId: string; email: string | null; connections: readonly unknown[]; }>; }; expect(joinedBody.users.length).toBe(2); expect( joinedBody.users.every((user) => Array.isArray(user.connections)), "every user carries a connections array", ).toBe(true); expect( joinedBody.users.map((user) => [user.externalId, user.email]).sort(), "the joined view reports the same identities, keyed the same way", ).toEqual(body.users.map((user) => [user.externalId, user.email]).sort()); // ------------------------------------------------------------------------- // The single-user read, by opaque id and by email. // ------------------------------------------------------------------------- const memberId = byEmail.get("member@admin-users.test")!; type UserBody = { user: { externalId: string; email: string | null; displayName: string | null; connections: readonly unknown[]; }; }; const single = await adminUsers(adminToken, `/api/admin/users/${memberId}`); expect(single.status).toBe(200); const singleBody = (await single.json()) as UserBody; expect(singleBody.user.externalId).toBe(memberId); expect(singleBody.user.email).toBe("member@admin-users.test"); expect(singleBody.user.displayName).toBe("Member"); expect( Array.isArray(singleBody.user.connections), "identity and connections arrive in ONE call", ).toBe(true); // The same person by email, in three casings. Better Auth stores emails // lower-cased, so this proves the QUERY side is normalized against a real // directory rather than against a fixture that happens to agree. for (const spelling of [ "member@admin-users.test", "Member@Admin-Users.Test", "MEMBER@ADMIN-USERS.TEST", ]) { const byEmailResponse = await adminUsers( adminToken, `/api/admin/users/${encodeURIComponent(spelling)}`, ); expect(byEmailResponse.status, `${spelling} resolves`).toBe(200); expect(((await byEmailResponse.json()) as UserBody).user.externalId).toBe(memberId); } // An email nobody in the directory holds. const unknownEmail = await adminUsers( adminToken, `/api/admin/users/${encodeURIComponent("nobody@admin-users.test")}`, ); expect(unknownEmail.status, "unknown email → 404").toBe(404); // Asserted on the encoded body — the distinct error is what lets a caller // tell "no footprint" from "bad credential" without parsing a message. expect(await unknownEmail.text()).toContain("AdminUserNotFound"); // An id that names no subject row. const unknownId = await adminUsers(adminToken, "/api/admin/users/user_does_not_exist"); expect(unknownId.status, "unknown id → 404").toBe(404); // The bulk `?email=` filter, over the same real directory. const filtered = await adminUsers( adminToken, `/api/admin/users?email=${encodeURIComponent("MEMBER@admin-users.test")}`, ); expect(filtered.status).toBe(200); const filteredBody = (await filtered.json()) as { users: ReadonlyArray<{ externalId: string }> }; expect( filteredBody.users.map((user) => user.externalId), "the filter selects exactly the one member, case-insensitively", ).toEqual([memberId]); const filteredUnknown = await adminUsers( adminToken, `/api/admin/users?email=${encodeURIComponent("nobody@admin-users.test")}`, ); expect( ((await filteredUnknown.json()) as { users: readonly unknown[] }).users, "an unknown email is an EMPTY page, never the unfiltered tenant", ).toEqual([]); // The router-ordering invariant against the real mount: the static segment // must still beat `/:identifier`. const stillTheList = await adminUsers(adminToken, "/api/admin/users/with-connections"); expect(stillTheList.status).toBe(200); expect(((await stillTheList.json()) as { users: readonly unknown[] }).users.length).toBe(2); // The gate: a plain member may not read the instance-wide view. const asMember = await adminUsers(memberToken); expect(asMember.status, "a member is refused").toBe(403); // And an anonymous caller has no session at all. const anonymous = await adminUsers(); expect(anonymous.status, "no session → unauthorized").toBe(401); // The single-user read refuses on the same terms — and refuses BEFORE // looking, so a refused caller cannot probe which users exist. expect((await adminUsers(memberToken, `/api/admin/users/${memberId}`)).status).toBe(403); expect((await adminUsers(memberToken, "/api/admin/users/user_nobody")).status).toBe(403); expect((await adminUsers(undefined, `/api/admin/users/${memberId}`)).status).toBe(401);});
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterAll, expect, test } from "@effect/vitest";
import { mintInviteCode } from "../testing/mint-invite";
// The self-host admin users plane (`/api/admin/users*`), over the REAL booted
// app: Better Auth, the libSQL store, and the mounted route layer.
//
// Self-host has no organization-owned api key (Better Auth keys always belong
// to the user who made one), so the credential here is the operator's own
// owner/admin session — the same gate the invite-code admin API uses. What this
// pins is that the mount is live, that the owner/admin gate actually refuses a
// plain member, and that a member who has used the instance shows up in the
// owner's view without their credential coming with them.
process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-admin-users-"));
process.env.BETTER_AUTH_SECRET = "admin-users-test-secret-0123456789-abcdefghij";
process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@admin-users.test";
process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456";
const { makeSelfHostApiHandler } = await import("../app");
const { handler, dispose } = await makeSelfHostApiHandler();
afterAll(() => dispose());
const BASE = "http://localhost:4788";
const signIn = async (email: string, password: string): Promise<string> => {
const response = await handler(
new Request(`${BASE}/api/auth/sign-in/email`, {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({ email, password }),
}),
);
return response.headers.get("set-auth-token") ?? "";
};
const adminUsers = (token?: string, path = "/api/admin/users") =>
handler(
new Request(`${BASE}${path}`, {
headers: token ? { authorization: `Bearer ${token}` } : {},
}),
);
test("the owner sees who uses the instance; a plain member cannot look", async () => {
const adminToken = await signIn(
process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL!,
process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD!,
);
expect(adminToken).not.toBe("");
// A second person joins through the real invite flow and uses the instance.
const inviteCode = await mintInviteCode(handler);
const signUp = await handler(
new Request(`${BASE}/api/auth/sign-up/email`, {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
email: "member@admin-users.test",
password: "password-12345678",
name: "Member",
inviteCode,
}),
}),
);
expect(signUp.status).toBe(200);
const memberToken = signUp.headers.get("set-auth-token") ?? "";
expect(memberToken).not.toBe("");
// A user earns their row the first time they touch the EXECUTOR plane, so
// have both make one product read before looking at the admin view.
for (const token of [adminToken, memberToken]) {
const integrations = await handler(
new Request(`${BASE}/api/integrations`, { headers: { authorization: `Bearer ${token}` } }),
);
expect(integrations.status).toBe(200);
}
// The owner's view reports both people.
const response = await adminUsers(adminToken);
expect(response.status).toBe(200);
const body = (await response.json()) as {
users: ReadonlyArray<{
externalId: string;
lastSeenAt: number | null;
email: string | null;
displayName: string | null;
}>;
};
expect(body.users.length, "both the owner and the invited member are reported").toBe(2);
expect(typeof body.users[0]?.lastSeenAt, "last-seen crosses the wire as a number").toBe("number");
// THE JOIN KEY, proven against real Better Auth rather than assumed.
//
// `auth/identity.ts` binds `session.user.id` as the accountId, so that is what
// the subject table records in `external_id` — and it is the member list's
// `userId`, NOT its `id` (the organization `member` ROW id). The two look
// alike and only one joins, so this asserts the actual emails land on the
// actual rows: a mismatch would leave every user unnamed while the counts
// above still passed.
const byEmail = new Map(body.users.map((user) => [user.email, user.externalId]));
expect(
[...byEmail.keys()].sort(),
"each user carries the email Better Auth holds for them",
).toEqual(["admin@admin-users.test", "member@admin-users.test"]);
expect(
body.users.every((user) => user.externalId.length > 0),
"and the id space still lines up — nobody was named by matching nothing",
).toBe(true);
expect(
body.users.find((user) => user.email === "member@admin-users.test")?.displayName,
"the sign-up name comes through as the display name",
).toBe("Member");
// The joined view is mounted too, and carries the same identity.
const joined = await adminUsers(adminToken, "/api/admin/users/with-connections");
expect(joined.status).toBe(200);
const joinedBody = (await joined.json()) as {
users: ReadonlyArray<{
externalId: string;
email: string | null;
connections: readonly unknown[];
}>;
};
expect(joinedBody.users.length).toBe(2);
expect(
joinedBody.users.every((user) => Array.isArray(user.connections)),
"every user carries a connections array",
).toBe(true);
expect(
joinedBody.users.map((user) => [user.externalId, user.email]).sort(),
"the joined view reports the same identities, keyed the same way",
).toEqual(body.users.map((user) => [user.externalId, user.email]).sort());
// -------------------------------------------------------------------------
// The single-user read, by opaque id and by email.
// -------------------------------------------------------------------------
const memberId = byEmail.get("member@admin-users.test")!;
type UserBody = {
user: {
externalId: string;
email: string | null;
displayName: string | null;
connections: readonly unknown[];
};
};
const single = await adminUsers(adminToken, `/api/admin/users/${memberId}`);
expect(single.status).toBe(200);
const singleBody = (await single.json()) as UserBody;
expect(singleBody.user.externalId).toBe(memberId);
expect(singleBody.user.email).toBe("member@admin-users.test");
expect(singleBody.user.displayName).toBe("Member");
expect(
Array.isArray(singleBody.user.connections),
"identity and connections arrive in ONE call",
).toBe(true);
// The same person by email, in three casings. Better Auth stores emails
// lower-cased, so this proves the QUERY side is normalized against a real
// directory rather than against a fixture that happens to agree.
for (const spelling of [
"member@admin-users.test",
"Member@Admin-Users.Test",
"MEMBER@ADMIN-USERS.TEST",
]) {
const byEmailResponse = await adminUsers(
adminToken,
`/api/admin/users/${encodeURIComponent(spelling)}`,
);
expect(byEmailResponse.status, `${spelling} resolves`).toBe(200);
expect(((await byEmailResponse.json()) as UserBody).user.externalId).toBe(memberId);
}
// An email nobody in the directory holds.
const unknownEmail = await adminUsers(
adminToken,
`/api/admin/users/${encodeURIComponent("nobody@admin-users.test")}`,
);
expect(unknownEmail.status, "unknown email → 404").toBe(404);
// Asserted on the encoded body — the distinct error is what lets a caller
// tell "no footprint" from "bad credential" without parsing a message.
expect(await unknownEmail.text()).toContain("AdminUserNotFound");
// An id that names no subject row.
const unknownId = await adminUsers(adminToken, "/api/admin/users/user_does_not_exist");
expect(unknownId.status, "unknown id → 404").toBe(404);
// The bulk `?email=` filter, over the same real directory.
const filtered = await adminUsers(
adminToken,
`/api/admin/users?email=${encodeURIComponent("MEMBER@admin-users.test")}`,
);
expect(filtered.status).toBe(200);
const filteredBody = (await filtered.json()) as { users: ReadonlyArray<{ externalId: string }> };
expect(
filteredBody.users.map((user) => user.externalId),
"the filter selects exactly the one member, case-insensitively",
).toEqual([memberId]);
const filteredUnknown = await adminUsers(
adminToken,
`/api/admin/users?email=${encodeURIComponent("nobody@admin-users.test")}`,
);
expect(
((await filteredUnknown.json()) as { users: readonly unknown[] }).users,
"an unknown email is an EMPTY page, never the unfiltered tenant",
).toEqual([]);
// The router-ordering invariant against the real mount: the static segment
// must still beat `/:identifier`.
const stillTheList = await adminUsers(adminToken, "/api/admin/users/with-connections");
expect(stillTheList.status).toBe(200);
expect(((await stillTheList.json()) as { users: readonly unknown[] }).users.length).toBe(2);
// The gate: a plain member may not read the instance-wide view.
const asMember = await adminUsers(memberToken);
expect(asMember.status, "a member is refused").toBe(403);
// And an anonymous caller has no session at all.
const anonymous = await adminUsers();
expect(anonymous.status, "no session → unauthorized").toBe(401);
// The single-user read refuses on the same terms — and refuses BEFORE
// looking, so a refused caller cannot probe which users exist.
expect((await adminUsers(memberToken, `/api/admin/users/${memberId}`)).status).toBe(403);
expect((await adminUsers(memberToken, "/api/admin/users/user_nobody")).status).toBe(403);
expect((await adminUsers(undefined, `/api/admin/users/${memberId}`)).status).toBe(401);
});