* Grant sitewide admins commissioner-level access in leagues - `isCommissioner()` now returns true for site admins, covering all commissioner-gated loaders (league home, settings, sport season detail) and draft API routes (start, pause, resume, rollback, replace-pick, force-autopick, force-manual-pick, adjust-time-bank, make-pick) - Added `hasCommissionerRecord()` (DB-only, no admin bypass) for the "already a commissioner" duplicate-entry check in the settings action, preventing a false positive when adding a site admin as commissioner - `isCommissioner()` now runs the admin check and DB query in parallel via Promise.all to avoid a serial roundtrip on every check - Added "admin" to the `picked_by_type` enum (migration 0049) so picks forced by a site admin are recorded accurately in the audit log rather than as "commissioner" - 8 unit tests covering both isCommissioner and hasCommissionerRecord Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix draft.force-manual-pick tests broken by isUserAdminByClerkId The route now calls isUserAdminByClerkId which hits database().query.users, but the test's mock DB had no query.users entry. Add a vi.mock for ~/models/user and default isUserAdminByClerkId to false in beforeEach. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
115 lines
3.6 KiB
TypeScript
115 lines
3.6 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from "vitest";
|
|
|
|
vi.mock("~/models/user", () => ({
|
|
isUserAdminByClerkId: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("~/database/context", () => ({
|
|
database: vi.fn(),
|
|
}));
|
|
|
|
import { isCommissioner, hasCommissionerRecord } from "../commissioner";
|
|
import { isUserAdminByClerkId } from "~/models/user";
|
|
import { database } from "~/database/context";
|
|
|
|
const LEAGUE_ID = "league-1";
|
|
const USER_ID = "user-clerk-1";
|
|
|
|
function makeMockDb(commissionerRow: object | null) {
|
|
return {
|
|
query: {
|
|
commissioners: {
|
|
findFirst: vi.fn().mockResolvedValue(commissionerRow),
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
});
|
|
|
|
describe("isCommissioner", () => {
|
|
it("returns true for a site admin without a commissioner record", async () => {
|
|
vi.mocked(isUserAdminByClerkId).mockResolvedValue(true);
|
|
vi.mocked(database).mockReturnValue(makeMockDb(null) as never);
|
|
|
|
const result = await isCommissioner(LEAGUE_ID, USER_ID);
|
|
expect(result).toBe(true);
|
|
});
|
|
|
|
it("returns true for a user with a commissioner record", async () => {
|
|
vi.mocked(isUserAdminByClerkId).mockResolvedValue(false);
|
|
vi.mocked(database).mockReturnValue(
|
|
makeMockDb({ id: "comm-1", leagueId: LEAGUE_ID, userId: USER_ID }) as never
|
|
);
|
|
|
|
const result = await isCommissioner(LEAGUE_ID, USER_ID);
|
|
expect(result).toBe(true);
|
|
});
|
|
|
|
it("returns true for a site admin who also has a commissioner record", async () => {
|
|
vi.mocked(isUserAdminByClerkId).mockResolvedValue(true);
|
|
vi.mocked(database).mockReturnValue(
|
|
makeMockDb({ id: "comm-1", leagueId: LEAGUE_ID, userId: USER_ID }) as never
|
|
);
|
|
|
|
const result = await isCommissioner(LEAGUE_ID, USER_ID);
|
|
expect(result).toBe(true);
|
|
});
|
|
|
|
it("returns false for a non-admin user without a commissioner record", async () => {
|
|
vi.mocked(isUserAdminByClerkId).mockResolvedValue(false);
|
|
vi.mocked(database).mockReturnValue(makeMockDb(null) as never);
|
|
|
|
const result = await isCommissioner(LEAGUE_ID, USER_ID);
|
|
expect(result).toBe(false);
|
|
});
|
|
|
|
it("runs the admin check and DB query in parallel", async () => {
|
|
const order: string[] = [];
|
|
vi.mocked(isUserAdminByClerkId).mockImplementation(async () => {
|
|
order.push("admin");
|
|
return false;
|
|
});
|
|
const db = makeMockDb(null);
|
|
db.query.commissioners.findFirst = vi.fn().mockImplementation(async () => {
|
|
order.push("db");
|
|
return null;
|
|
});
|
|
vi.mocked(database).mockReturnValue(db as never);
|
|
|
|
await isCommissioner(LEAGUE_ID, USER_ID);
|
|
|
|
// Both should have been called; order is non-deterministic for parallel calls
|
|
expect(order).toContain("admin");
|
|
expect(order).toContain("db");
|
|
});
|
|
});
|
|
|
|
describe("hasCommissionerRecord", () => {
|
|
it("returns true when a commissioner record exists", async () => {
|
|
vi.mocked(database).mockReturnValue(
|
|
makeMockDb({ id: "comm-1", leagueId: LEAGUE_ID, userId: USER_ID }) as never
|
|
);
|
|
|
|
const result = await hasCommissionerRecord(LEAGUE_ID, USER_ID);
|
|
expect(result).toBe(true);
|
|
});
|
|
|
|
it("returns false when no commissioner record exists", async () => {
|
|
vi.mocked(database).mockReturnValue(makeMockDb(null) as never);
|
|
|
|
const result = await hasCommissionerRecord(LEAGUE_ID, USER_ID);
|
|
expect(result).toBe(false);
|
|
});
|
|
|
|
it("returns false for a site admin without a commissioner record", async () => {
|
|
// hasCommissionerRecord must NOT consult the admin flag
|
|
vi.mocked(database).mockReturnValue(makeMockDb(null) as never);
|
|
|
|
const result = await hasCommissionerRecord(LEAGUE_ID, USER_ID);
|
|
expect(result).toBe(false);
|
|
expect(isUserAdminByClerkId).not.toHaveBeenCalled();
|
|
});
|
|
});
|