Files
outline/server/queues/tasks/CleanupDemotedUserTask.test.ts
T
Tom Moor 4883071059 Allow viewers to create and access API keys (#12278)
* Allow viewers to create and access API keys

Still guarded by their view permissions

* Drop Member role gate from apiKeys routes

Lets viewers reach the createApiKey/listApiKeys/delete policy checks now
that the policy itself permits them. Updates CleanupDemotedUserTask to
retain viewer keys and adds coverage for viewer create + guest reject.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* Tighten apiKeys test assertions and broaden viewer coverage

- Use not.toBeNull() instead of toBeTruthy() for retention check
- Add viewer coverage for apiKeys.list and apiKeys.delete

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-06 19:35:59 -04:00

100 lines
2.7 KiB
TypeScript

import { ApiKey } from "@server/models";
import {
buildUser,
buildApiKey,
buildAdmin,
buildWebhookSubscription,
buildViewer,
} from "@server/test/factories";
import CleanupDemotedUserTask from "./CleanupDemotedUserTask";
describe("CleanupDemotedUserTask", () => {
it("should delete api keys for suspended user", async () => {
const admin = await buildAdmin();
const user = await buildUser({
teamId: admin.teamId,
suspendedAt: new Date(),
suspendedById: admin.id,
});
const apiKey = await buildApiKey({
userId: user.id,
});
const task = new CleanupDemotedUserTask();
await task.perform({ userId: user.id });
expect(await ApiKey.findByPk(apiKey.id)).toBeNull();
});
it("should retain api keys for viewer", async () => {
const user = await buildViewer();
const apiKey = await buildApiKey({
userId: user.id,
});
const task = new CleanupDemotedUserTask();
await task.perform({ userId: user.id });
expect(await ApiKey.findByPk(apiKey.id)).not.toBeNull();
});
it("should retain api keys for member", async () => {
const user = await buildUser();
const apiKey = await buildApiKey({
userId: user.id,
});
const task = new CleanupDemotedUserTask();
await task.perform({ userId: user.id });
expect(await ApiKey.findByPk(apiKey.id)).toBeTruthy();
});
it("should disable webhooks for suspended user", async () => {
const admin = await buildAdmin();
const user = await buildUser({
teamId: admin.teamId,
suspendedAt: new Date(),
suspendedById: admin.id,
});
const webhook = await buildWebhookSubscription({
teamId: user.teamId,
createdById: user.id,
});
const task = new CleanupDemotedUserTask();
await task.perform({ userId: user.id });
await webhook.reload();
expect(webhook.enabled).toEqual(false);
});
it("should disable webhooks for member", async () => {
const admin = await buildAdmin();
const user = await buildUser({
teamId: admin.teamId,
});
const webhook = await buildWebhookSubscription({
teamId: user.teamId,
createdById: user.id,
});
const task = new CleanupDemotedUserTask();
await task.perform({ userId: user.id });
await webhook.reload();
expect(webhook.enabled).toEqual(false);
});
it("should retain webhooks for admin", async () => {
const user = await buildAdmin();
const webhook = await buildWebhookSubscription({
teamId: user.teamId,
createdById: user.id,
});
const task = new CleanupDemotedUserTask();
await task.perform({ userId: user.id });
await webhook.reload();
expect(webhook.enabled).toEqual(true);
});
});