feat(db+auth): add pg pool, admin_users email/provider migration, refactor auth lookup

- Create src/lib/db.ts (shared pg.Pool, query/withTx helpers, server-only) - Add @types/pg devDep - Migration 204: add email, auth_provider, auth_subject columns to admin_users; backfill from auth.users; new upsert_admin_user accepts multi-provider args; new get_admin_user_for_session RPC resolves Auth.js session id (UUID or Google sub) to an admin row - Refactor getAdminUser() to use pg + new RPC; auto-provisions on first Google sign-in using session.user.email - Refactor updatePasswordAction to call update_user_password via pg (drops the Supabase REST hop) - Delete orphaned src/actions/login.ts (replaced by auth-actions.ts) - Drop remaining DEV_FORCE_UID references in users.ts; dev path now uses dev_session cookie (the only cookie the dev flow can set) - Update AdminUser type: user_id is now string | null (Google users have no Supabase auth id); add email + auth_provider fields - Fix downstream type errors: StopProductAssignment.callerUid accepts null; pickup.ts performedBy widens to string | null - Bump vitest config, tests/, and other earlier cleanup changes
2026-06-06 23:41:41 +00:00
parent 9374e63ae6
commit f96dcd01f2
53 changed files with 1837 additions and 1656 deletions
@@ -0,0 +1,107 @@
+/**
+ * Unit tests for the auth server actions in src/actions/auth-actions.ts.
+ *
+ * Mocks `@/lib/auth` and `next-auth` to test the action wrappers in
+ * isolation from the network and the Auth.js runtime.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const signInMock = vi.fn();
+const signOutMock = vi.fn();
+
+vi.mock("@/lib/auth", () => ({
+  signIn: signInMock,
+  signOut: signOutMock,
+}));
+
+const authErrors: Array<{ name: string; message?: string }> = [];
+vi.mock("next-auth", () => ({
+  AuthError: class AuthError extends Error {
+    override name = "AuthError";
+    constructor(message?: string) {
+      super(message);
+      authErrors.push({ name: this.name, message });
+    }
+  },
+}));
+
+// Import after mocks.
+const { signInWithPassword, signInWithGoogle, signOutAction } = await import(
+  "@/actions/auth-actions"
+);
+
+beforeEach(() => {
+  signInMock.mockReset();
+  signOutMock.mockReset();
+});
+
+describe("signInWithPassword", () => {
+  it("returns ok:false when email is missing", async () => {
+    const fd = new FormData();
+    fd.set("password", "x");
+    const result = await signInWithPassword(null, fd);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toMatch(/email/i);
+    expect(signInMock).not.toHaveBeenCalled();
+  });
+
+  it("returns ok:false when password is missing", async () => {
+    const fd = new FormData();
+    fd.set("email", "a@b.com");
+    const result = await signInWithPassword(null, fd);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toMatch(/password/i);
+    expect(signInMock).not.toHaveBeenCalled();
+  });
+
+  it("trims email and passes credentials to signIn", async () => {
+    signInMock.mockResolvedValue(undefined);
+    const fd = new FormData();
+    fd.set("email", "  admin@brand.test  ");
+    fd.set("password", "secret");
+    const result = await signInWithPassword(null, fd);
+    expect(result).toEqual({ ok: true });
+    expect(signInMock).toHaveBeenCalledWith("supabase-password", {
+      email: "admin@brand.test",
+      password: "secret",
+      redirect: false,
+    });
+  });
+
+  it("returns ok:false with a friendly message on AuthError", async () => {
+    signInMock.mockRejectedValue(new Error("auth failed")); // not an AuthError
+    const fd = new FormData();
+    fd.set("email", "a@b.com");
+    fd.set("password", "wrong");
+    await expect(signInWithPassword(null, fd)).rejects.toThrow("auth failed");
+  });
+
+  it("catches AuthError and returns ok:false", async () => {
+    // The mocked AuthError is registered as a real class via the mock
+    // factory above, so we can construct one here.
+    const { AuthError } = await import("next-auth");
+    signInMock.mockRejectedValue(new AuthError("invalid credentials"));
+    const fd = new FormData();
+    fd.set("email", "a@b.com");
+    fd.set("password", "wrong");
+    const result = await signInWithPassword(null, fd);
+    expect(result).toEqual({ ok: false, error: "Invalid email or password." });
+  });
+});
+
+describe("signInWithGoogle", () => {
+  it("calls signIn with the google provider and /admin redirect", async () => {
+    signInMock.mockResolvedValue(undefined);
+    await signInWithGoogle();
+    expect(signInMock).toHaveBeenCalledWith("google", { redirectTo: "/admin" });
+  });
+});
+
+describe("signOutAction", () => {
+  it("calls signOut with the login redirect", async () => {
+    signOutMock.mockResolvedValue(undefined);
+    await signOutAction();
+    expect(signOutMock).toHaveBeenCalledWith({ redirectTo: "/login" });
+  });
+});