Files
accounted/app/api/transactions/__tests__/route.test.ts
T
1a27b5bd4a fix(auth): route document integrity, transaction delete/list and agent categorize through withRouteContext (#1926)
Two handlers hand-rolled supabase.auth.getUser() and therefore skipped the
MFA (AAL2) gate on hosted: DELETE /api/transactions/[id] and
GET /api/transactions. Both sat next to a sibling handler that was already
wrapped, and the raw-route-auth ratchet exempted a file as soon as any
withRouteContext call appeared in it, so they were never flagged.

GET /api/documents/[id]/integrity and POST /api/agent/categorize called
requireAuth() directly (MFA enforced, but no request id, no completion log,
no canonical error envelope). All four are now withRouteContext handlers
with identical company scoping and responses; the transaction delete keeps
its viewer rejection via requireWrite.

The guard now judges each top-level export segment of a route file on its
own, so a wrapped handler no longer exempts a hand-rolled sibling. Baseline
is unchanged (mcp-oauth/authorize remains the one grandfathered file).

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-26 13:34:31 +02:00

209 lines
7.4 KiB
TypeScript

import { describe, it, expect, vi, beforeEach } from 'vitest'
import {
createMockRequest,
createMockRouteParams,
parseJsonResponse,
createQueuedMockSupabase,
makeTransaction,
} from '@/tests/helpers'
const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
vi.mock('@/lib/supabase/server', () => ({
createClient: () => Promise.resolve(mockSupabase),
}))
vi.mock('@/lib/company/context', () => ({
requireCompanyId: vi.fn().mockResolvedValue('company-1'),
getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
}))
// GET goes through withRouteContext, which resolves the session via requireAuth.
vi.mock('@/lib/auth/require-auth', () => ({
requireAuth: vi.fn(),
}))
import { GET } from '../route'
import { requireAuth } from '@/lib/auth/require-auth'
import { NextResponse } from 'next/server'
describe('GET /api/transactions', () => {
const mockUser = { id: 'user-1', email: 'test@test.se' }
const originalFrom = mockSupabase.from
beforeEach(() => {
vi.clearAllMocks()
reset()
mockSupabase.from = originalFrom
vi.mocked(requireAuth).mockResolvedValue({
user: mockUser as never,
supabase: mockSupabase as never,
error: null,
})
})
it('returns 401 when not authenticated', async () => {
vi.mocked(requireAuth).mockResolvedValue({
user: null as never,
supabase: mockSupabase as never,
error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
})
const request = createMockRequest('/api/transactions')
const response = await GET(request, createMockRouteParams({}))
const { status, body } = await parseJsonResponse(response)
expect(status).toBe(401)
expect(body).toEqual({ error: 'Unauthorized' })
})
it('returns transactions for the active company with has_more=false when below the cap', async () => {
const txs = [
makeTransaction({ id: 'tx-1', amount: -100 }),
makeTransaction({ id: 'tx-2', amount: 250 }),
]
enqueue({ data: txs, error: null })
const request = createMockRequest('/api/transactions')
const response = await GET(request, createMockRouteParams({}))
const { status, body } = await parseJsonResponse<{
data: typeof txs
has_more: boolean
limit: number
}>(response)
expect(status).toBe(200)
expect(body.data).toHaveLength(2)
expect(body.data[0].id).toBe('tx-1')
expect(body.has_more).toBe(false)
expect(body.limit).toBe(500)
})
it('signals has_more=true and truncates to the cap when more rows exist', async () => {
// Server requests MAX_ROWS+1 = 501 rows; if the DB returns 501 we know there's more.
const txs = Array.from({ length: 501 }, (_, i) =>
makeTransaction({ id: `tx-${i}`, amount: i }),
)
enqueue({ data: txs, error: null })
const request = createMockRequest('/api/transactions')
const response = await GET(request, createMockRouteParams({}))
const { status, body } = await parseJsonResponse<{
data: typeof txs
has_more: boolean
limit: number
}>(response)
expect(status).toBe(200)
expect(body.data).toHaveLength(500)
expect(body.has_more).toBe(true)
expect(body.limit).toBe(500)
})
it('filters by unmatched=true', async () => {
const fromSpy = vi.fn(() => {
const chain: Record<string, unknown> = {}
const methods = ['select', 'eq', 'is', 'not', 'gte', 'lte', 'order', 'limit']
const calls: { method: string; args: unknown[] }[] = []
for (const m of methods) {
chain[m] = vi.fn((...args: unknown[]) => {
calls.push({ method: m, args })
return chain
})
}
;(chain as { then: unknown }).then = (resolve: (v: unknown) => void) =>
resolve({ data: [], error: null })
;(chain as { __calls: typeof calls }).__calls = calls
return chain
})
mockSupabase.from = fromSpy as unknown as typeof mockSupabase.from
const request = createMockRequest('/api/transactions?unmatched=true')
await GET(request, createMockRouteParams({}))
expect(fromSpy).toHaveBeenCalledWith('transactions')
const chain = fromSpy.mock.results[0].value as { __calls: { method: string; args: unknown[] }[] }
const isCall = chain.__calls.find((c) => c.method === 'is')
expect(isCall).toEqual({ method: 'is', args: ['journal_entry_id', null] })
})
it('filters by reconciled=true', async () => {
const fromSpy = vi.fn(() => {
const chain: Record<string, unknown> = {}
const methods = ['select', 'eq', 'is', 'not', 'gte', 'lte', 'order', 'limit']
const calls: { method: string; args: unknown[] }[] = []
for (const m of methods) {
chain[m] = vi.fn((...args: unknown[]) => {
calls.push({ method: m, args })
return chain
})
}
;(chain as { then: unknown }).then = (resolve: (v: unknown) => void) =>
resolve({ data: [], error: null })
;(chain as { __calls: typeof calls }).__calls = calls
return chain
})
mockSupabase.from = fromSpy as unknown as typeof mockSupabase.from
const request = createMockRequest('/api/transactions?reconciled=true')
await GET(request, createMockRouteParams({}))
const chain = fromSpy.mock.results[0].value as { __calls: { method: string; args: unknown[] }[] }
const notCall = chain.__calls.find((c) => c.method === 'not')
expect(notCall).toEqual({ method: 'not', args: ['journal_entry_id', 'is', null] })
// unmatched and reconciled are mutually exclusive: when reconciled is set, no .is() filter
const isCall = chain.__calls.find((c) => c.method === 'is')
expect(isCall).toBeUndefined()
})
it('applies currency, date_from, and date_to filters', async () => {
const fromSpy = vi.fn(() => {
const chain: Record<string, unknown> = {}
const methods = ['select', 'eq', 'is', 'not', 'gte', 'lte', 'order', 'limit']
const calls: { method: string; args: unknown[] }[] = []
for (const m of methods) {
chain[m] = vi.fn((...args: unknown[]) => {
calls.push({ method: m, args })
return chain
})
}
;(chain as { then: unknown }).then = (resolve: (v: unknown) => void) =>
resolve({ data: [], error: null })
;(chain as { __calls: typeof calls }).__calls = calls
return chain
})
mockSupabase.from = fromSpy as unknown as typeof mockSupabase.from
const request = createMockRequest(
'/api/transactions?currency=SEK&date_from=2024-01-01&date_to=2024-12-31'
)
await GET(request, createMockRouteParams({}))
const chain = fromSpy.mock.results[0].value as { __calls: { method: string; args: unknown[] }[] }
const eqCalls = chain.__calls.filter((c) => c.method === 'eq')
// company_id and currency
expect(eqCalls).toEqual(
expect.arrayContaining([
{ method: 'eq', args: ['company_id', 'company-1'] },
{ method: 'eq', args: ['currency', 'SEK'] },
])
)
expect(chain.__calls).toEqual(
expect.arrayContaining([
{ method: 'gte', args: ['date', '2024-01-01'] },
{ method: 'lte', args: ['date', '2024-12-31'] },
])
)
})
it('returns 500 when the query errors', async () => {
enqueue({ data: null, error: { message: 'boom' } })
const request = createMockRequest('/api/transactions')
const response = await GET(request, createMockRouteParams({}))
const { status, body } = await parseJsonResponse<{ error: string }>(response)
expect(status).toBe(500)
expect(body.error).toBe('Något gick fel. Försök igen.')
})
})