invites.node.test.ts

import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { afterAll, expect, test } from "@effect/vitest";

import { mintInviteCode } from "../testing/mint-invite";

// Real Better Auth path: signup must be invite-gated.
process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-invite-"));
process.env.BETTER_AUTH_SECRET = "invite-test-secret-0123456789-abcdefghij-klmn";
process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@invite.test";
process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456";

const { makeSelfHostApiHandler } = await import("../app");
const { handler, dispose } = await makeSelfHostApiHandler();
afterAll(() => dispose());

const BASE = "http://localhost:4788";

const signUp = (body: Record<string, unknown>) =>
  handler(
    new Request(`${BASE}/api/auth/sign-up/email`, {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify(body),
    }),
  );

const inviteStatus = async (code: string): Promise<boolean> => {
  const response = await handler(
    new Request(`${BASE}/api/invite-status/${encodeURIComponent(code)}`),
  );
  expect(response.status).toBe(200);
  const body = (await response.json()) as { valid?: boolean };
  return body.valid === true;
};

test("open signup is closed: a signup without a valid invite code is rejected", async () => {
  const res = await signUp({
    email: "intruder@invite.test",
    password: "password-12345678",
    name: "Intruder",
  });
  expect(res.status).not.toBe(200);

  const badCode = await signUp({
    email: "intruder2@invite.test",
    password: "password-12345678",
    name: "Intruder",
    inviteCode: "AAAA-BBBB-CCCC",
  });
  expect(badCode.status).not.toBe(200);
});

test("a code minted via the admin API redeems into a real org membership", async () => {
  // Minted through the TYPED admin HttpApi client (see mint-invite.ts).
  const inviteCode = await mintInviteCode(handler);
  expect(await inviteStatus("AAAA-BBBB-CCCC")).toBe(false);
  expect(await inviteStatus(inviteCode)).toBe(true);

  const res = await signUp({
    email: "member@invite.test",
    password: "password-12345678",
    name: "Member",
    inviteCode,
  });
  expect(res.status).toBe(200);
  const token = res.headers.get("set-auth-token") ?? "";
  expect(token).not.toBe("");

  // The new user resolves to a real org membership (the bound tenant).
  const me = await handler(
    new Request(`${BASE}/api/account/me`, {
      headers: { authorization: `Bearer ${token}` },
    }),
  );
  expect(me.status).toBe(200);
  const meBody = (await me.json()) as { organization: { id: string } | null };
  expect(meBody.organization?.id).toBeTruthy();

  // The single-use code is now spent: reusing it is rejected.
  const reuse = await signUp({
    email: "second@invite.test",
    password: "password-12345678",
    name: "Second",
    inviteCode,
  });
  expect(reuse.status).not.toBe(200);
  expect(await inviteStatus(inviteCode)).toBe(false);
});