chore: Новый черновик DRAFT, удалить старые docs-v

examples/demo-backend/test/complex.e2e-spec.ts

@@ -0,0 +1,288 @@
+import type { AddressInfo } from "node:net";
+import type { INestApplication } from "@nestjs/common";
+import { io, type Socket } from "socket.io-client";
+import request from "supertest";
+import { createComplexApplication } from "../src/apps/complex/bootstrap";
+
+interface AuthenticatedAgent {
+  agent: ReturnType<typeof request.agent>;
+  csrfToken: string;
+  cookieHeader: string;
+}
+
+describe("Complex API", () => {
+  let app: INestApplication;
+  let baseUrl: string;
+
+  beforeAll(async () => {
+    const created = await createComplexApplication(false);
+    app = created.app;
+    await app.listen(0, "127.0.0.1");
+    const address = app.getHttpServer().address() as AddressInfo;
+    baseUrl = `http://127.0.0.1:${address.port}`;
+  });
+
+  beforeEach(async () => {
+    await request(app.getHttpServer())
+      .post("/api/v1/testing/reset")
+      .expect(200);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  async function login(
+    email = "admin@complex.demo",
+  ): Promise<AuthenticatedAgent> {
+    const agent = request.agent(app.getHttpServer());
+    const response = await agent
+      .post("/api/v1/auth/login")
+      .send({ email, password: "demo1234" })
+      .expect(200);
+    const setCookies = response.headers["set-cookie"] as unknown as string[];
+    return {
+      agent,
+      csrfToken: response.body.data.csrfToken as string,
+      cookieHeader: setCookies
+        .map((cookie) => cookie.split(";", 1)[0])
+        .join("; "),
+    };
+  }
+
+  it("serves an isolated cookie-auth OpenAPI document", async () => {
+    const contract = await request(app.getHttpServer())
+      .get("/openapi.json")
+      .expect(200);
+    expect(contract.body.info.title).toBe("Demo Complex API");
+    expect(
+      contract.body.components.securitySchemes.cookieSession,
+    ).toBeDefined();
+    expect(contract.body.components.securitySchemes.csrf).toBeDefined();
+    expect(contract.body.paths["/api/v1/organizations"]).toBeDefined();
+  });
+
+  it("establishes a cookie session and enforces tenant context", async () => {
+    await request(app.getHttpServer()).get("/api/v1/users/me").expect(401);
+    const authenticated = await login();
+
+    const me = await authenticated.agent.get("/api/v1/users/me").expect(200);
+    expect(me.body.data.email).toBe("admin@complex.demo");
+
+    const missingTenant = await authenticated.agent
+      .get("/api/v1/products")
+      .expect(400);
+    expect(missingTenant.body.code).toBe("ORGANIZATION_REQUIRED");
+
+    const products = await authenticated.agent
+      .get("/api/v1/products")
+      .set("X-Organization-Id", "org-acme")
+      .expect(200);
+    expect(products.body.data[0].organizationId).toBe("org-acme");
+
+    await authenticated.agent
+      .get("/api/v1/products")
+      .set("X-Organization-Id", "org-unknown")
+      .expect(403);
+  });
+
+  it("enforces CSRF and optimistic product versions", async () => {
+    const authenticated = await login();
+    const url = "/api/v1/products/complex-product-keyboard";
+
+    await authenticated.agent
+      .patch(url)
+      .set("X-Organization-Id", "org-acme")
+      .send({ version: 3, name: "No CSRF" })
+      .expect(403);
+
+    const updated = await authenticated.agent
+      .patch(url)
+      .set("X-Organization-Id", "org-acme")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .send({ version: 3, name: "Keyboard Enterprise" })
+      .expect(200);
+    expect(updated.body.data.version).toBe(4);
+
+    const stale = await authenticated.agent
+      .patch(url)
+      .set("X-Organization-Id", "org-acme")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .send({ version: 3, name: "Stale Keyboard" })
+      .expect(409);
+    expect(stale.body.code).toBe("PRODUCT_VERSION_CONFLICT");
+  });
+
+  it("creates orders idempotently", async () => {
+    const authenticated = await login();
+    const body = {
+      customerId: "customer-ada",
+      items: [
+        {
+          productId: "complex-product-keyboard",
+          variantId: "variant-complex-product-keyboard-default",
+          quantity: 1,
+        },
+      ],
+      promotionCode: "WELCOME10",
+    };
+    const create = () =>
+      authenticated.agent
+        .post("/api/v1/orders")
+        .set("X-Organization-Id", "org-acme")
+        .set("X-CSRF-Token", authenticated.csrfToken)
+        .set("Idempotency-Key", "checkout-test-001")
+        .send(body)
+        .expect(201);
+
+    const first = await create();
+    const second = await create();
+    expect(second.body.data.id).toBe(first.body.data.id);
+    expect(first.body.data.total.amount).toBe("116.91");
+  });
+
+  it("supports role changes without recreating the session", async () => {
+    const authenticated = await login("viewer@complex.demo");
+    await authenticated.agent
+      .post("/api/v1/products")
+      .set("X-Organization-Id", "org-acme")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .send({})
+      .expect(403);
+
+    await request(app.getHttpServer())
+      .post("/api/v1/testing/users/complex-user-viewer/role")
+      .send({ role: "manager" })
+      .expect(200);
+
+    const allowedToReachValidation = await authenticated.agent
+      .post("/api/v1/products")
+      .set("X-Organization-Id", "org-acme")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .send({})
+      .expect(400);
+    expect(allowedToReachValidation.body.code).toBe("BAD_REQUEST");
+  });
+
+  it("expires an active session on demand", async () => {
+    const authenticated = await login();
+    await authenticated.agent
+      .post("/api/v1/testing/session/expire")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .expect(200);
+    await authenticated.agent.get("/api/v1/users/me").expect(401);
+  });
+
+  it("runs a 202 background export and exposes the completed result", async () => {
+    const authenticated = await login();
+    const started = await authenticated.agent
+      .post("/api/v1/exports/orders")
+      .set("X-Organization-Id", "org-acme")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .expect(202);
+    const jobId = started.body.data.id as string;
+
+    await authenticated.agent
+      .get(`/api/v1/jobs/${jobId}/result`)
+      .set("X-Organization-Id", "org-acme")
+      .expect(409);
+
+    await new Promise((resolve) => setTimeout(resolve, 850));
+    const completed = await authenticated.agent
+      .get(`/api/v1/jobs/${jobId}`)
+      .set("X-Organization-Id", "org-acme")
+      .expect(200);
+    expect(completed.body.data).toMatchObject({
+      status: "completed",
+      progress: 100,
+    });
+
+    const result = await authenticated.agent
+      .get(`/api/v1/jobs/${jobId}/result`)
+      .set("X-Organization-Id", "org-acme")
+      .expect(200);
+    expect(result.headers["content-type"]).toMatch(/text\/csv/);
+  });
+
+  it("uploads and downloads a multipart file", async () => {
+    const authenticated = await login();
+    const uploaded = await authenticated.agent
+      .post("/api/v1/files")
+      .set("X-Organization-Id", "org-acme")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .attach("file", Buffer.from("sku,stock\nABC,10\n"), "inventory.csv")
+      .expect(201);
+    expect(uploaded.body.data.name).toBe("inventory.csv");
+
+    const downloaded = await authenticated.agent
+      .get(`/api/v1/files/${uploaded.body.data.id as string}/download`)
+      .set("X-Organization-Id", "org-acme")
+      .expect(200);
+    expect(downloaded.headers["content-disposition"]).toContain(
+      "inventory.csv",
+    );
+
+    const tooLarge = await authenticated.agent
+      .post("/api/v1/files")
+      .set("X-Organization-Id", "org-acme")
+      .set("X-CSRF-Token", authenticated.csrfToken)
+      .attach("file", Buffer.alloc(5 * 1024 * 1024 + 1), "too-large.bin")
+      .expect(413);
+    expect(tooLarge.body.code).toBe("FILE_TOO_LARGE");
+  });
+
+  it("authenticates Socket.IO with the session cookie and deduplicates messages", async () => {
+    const authenticated = await login();
+    const socket = io(`${baseUrl}/chat`, {
+      transports: ["websocket"],
+      reconnection: false,
+      forceNew: true,
+      extraHeaders: { Cookie: authenticated.cookieHeader },
+    });
+
+    await waitForSocketEvent(socket, "connect");
+    const joined = waitForSocketEvent<{ conversationId: string }>(
+      socket,
+      "chat:joined",
+    );
+    socket.emit("chat:join", {
+      organizationId: "org-acme",
+      conversationId: "conversation-support",
+    });
+    expect((await joined).conversationId).toBe("conversation-support");
+
+    const messagePayload = {
+      organizationId: "org-acme",
+      conversationId: "conversation-support",
+      text: "Socket E2E message",
+      clientMessageId: "socket-e2e-001",
+    };
+    const firstAck = waitForSocketEvent<{ id: string }>(socket, "message:ack");
+    socket.emit("message:send", messagePayload);
+    const first = await firstAck;
+
+    const secondAck = waitForSocketEvent<{ id: string }>(socket, "message:ack");
+    socket.emit("message:send", messagePayload);
+    const second = await secondAck;
+    expect(second.id).toBe(first.id);
+    socket.disconnect();
+  }, 10_000);
+});
+
+function waitForSocketEvent<T = void>(
+  socket: Socket,
+  event: string,
+  timeoutMs = 3000,
+): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(() => {
+      socket.off(event, handler);
+      reject(new Error(`Timed out waiting for Socket.IO event ${event}.`));
+    }, timeoutMs);
+    const handler = (payload: T) => {
+      clearTimeout(timer);
+      resolve(payload);
+    };
+    socket.once(event, handler);
+  });
+}