feat(r1.1): socle backend du référentiel — modèle, contrat, API, seed, tests

- migration r1_referentiel : Category (EQUIPMENT/COMPONENT_TYPE), Location
  (site → zone, lat/lng + colonne PostGIS générée geography(Point,4326)
  + index GIST), Asset (statut d'équipement), AssetComponent (organe sans
  emplacement PAR CONSTRUCTION), Team, invitation sur User ; migration
  autosuffisante (CREATE EXTENSION IF NOT EXISTS postgis)
- contrat : 21 nouvelles opérations (26 total), générateur OpenAPI étendu
  aux paramètres de chemin ; spec + client web régénérés dans ce commit
- API : modules categories/locations/assets/teams + gestion des personnes
  (liste, rôles, invitation lien 7 j à usage unique, activation publique
  qui connecte directement, mise à jour rôle/équipes) — tout sous
  @RequirePermission ; invariants en service (profondeur 2, kinds,
  catégorie jamais supprimée)
- seed : parc de la maquette validée (5 sites + 8 zones, 8 appareils,
  organes A1/B2, 9 catégories, 2 équipes) — idempotent
- 36 tests verts (couverture 96 % stmts / 85 % branches) : recette
  site→zone→appareil→organes, matrice vivante, invitation→activation ;
  smoke test sur build de prod
- CI : postgres → postgis/postgis:18-3.6 (la migration R1 l'exige)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
pr-daaif
2026-07-16 12:27:48 +01:00
parent 6d9aafdab4
commit 266ffaaf1b
36 changed files with 6016 additions and 13 deletions

View File

@@ -0,0 +1,221 @@
/**
* E2E R1 — administration du référentiel : équipes, renommages, mises à jour
* et TOUS les refus (conflits 409, inconnus 404, invalides 400) — le contrat
* d'erreur fait partie du contrat.
*/
process.env.DEMO_MODE = 'true';
import { INestApplication } from '@nestjs/common';
import { Test } from '@nestjs/testing';
import { PrismaClient } from '@prisma/client';
import request from 'supertest';
import { seed } from '../prisma/seed';
import { AppModule } from '../src/app.module';
const GHOST = '00000000-0000-4000-8000-000000000000';
describe('Administration du référentiel (e2e)', () => {
let app: INestApplication;
let admin: string;
const prisma = new PrismaClient();
const http = () => request(app.getHttpServer());
const suffix = `adm-${Date.now().toString(36)}`;
beforeAll(async () => {
await seed(prisma);
const moduleRef = await Test.createTestingModule({
imports: [AppModule.forRoot()],
}).compile();
app = moduleRef.createNestApplication();
await app.init();
const { body } = await http().get('/auth/demo-accounts');
const compte = body.accounts.find(
(a: { roleName: string }) => a.roleName === 'Administrateur',
);
admin = (await http().post('/auth/demo-login').send({ userId: compte.id })).body
.accessToken;
});
afterAll(async () => {
await prisma.team.deleteMany({ where: { name: { contains: suffix } } });
await prisma.category.deleteMany({ where: { name: { contains: suffix } } });
await prisma.location.deleteMany({ where: { name: { contains: suffix } } });
await app?.close();
await prisma.$disconnect();
});
const auth = () => ({ Authorization: `Bearer ${admin}` });
it('équipes : création, doublon 409, membres, 404', async () => {
const { body: users } = await http().get('/users').set(auth());
const ahmed = users.users.find(
(u: { email: string }) => u.email === 'technicien@demo.siop.ma',
);
const team = await http()
.post('/teams')
.set(auth())
.send({ name: `Équipe ${suffix}`, description: 'Zone de test' })
.expect(201);
expect(team.body.members).toHaveLength(0);
await http()
.post('/teams')
.set(auth())
.send({ name: `Équipe ${suffix}` })
.expect(409);
const updated = await http()
.patch(`/teams/${team.body.id}`)
.set(auth())
.send({ memberIds: [ahmed.id], description: 'Zone mise à jour' })
.expect(200);
expect(updated.body.members.map((m: { id: string }) => m.id)).toEqual([ahmed.id]);
const { body: teams } = await http().get('/teams').set(auth()).expect(200);
expect(teams.teams.some((t: { id: string }) => t.id === team.body.id)).toBe(true);
await http().patch(`/teams/${GHOST}`).set(auth()).send({ name: 'X' }).expect(404);
await http()
.patch(`/teams/${team.body.id}`)
.set(auth())
.send({ name: 'Casablanca Centre' })
.expect(409);
});
it('catégories : création, doublon 409, renommage, 404', async () => {
const created = await http()
.post('/categories')
.set(auth())
.send({ kind: 'EQUIPMENT', name: `Catégorie ${suffix}` })
.expect(201);
await http()
.post('/categories')
.set(auth())
.send({ kind: 'EQUIPMENT', name: `Catégorie ${suffix}` })
.expect(409);
const renamed = await http()
.patch(`/categories/${created.body.id}`)
.set(auth())
.send({ name: `Catégorie ${suffix} v2` })
.expect(200);
expect(renamed.body.name).toBe(`Catégorie ${suffix} v2`);
await http()
.patch(`/categories/${GHOST}`)
.set(auth())
.send({ name: 'X' })
.expect(404);
});
it('emplacements : renommage, parent inconnu, auto-parent, site avec zones, 404', async () => {
const site = await http()
.post('/locations')
.set(auth())
.send({ name: `Site ${suffix}` })
.expect(201);
const zone = await http()
.post('/locations')
.set(auth())
.send({ name: `Zone ${suffix}`, parentId: site.body.id })
.expect(201);
await http()
.patch(`/locations/${zone.body.id}`)
.set(auth())
.send({ guardianName: 'Gardien Test', guardianPhone: '06 00 00 00 00' })
.expect(200);
await http()
.post('/locations')
.set(auth())
.send({ name: `Orphelin ${suffix}`, parentId: GHOST })
.expect(400);
await http()
.patch(`/locations/${zone.body.id}`)
.set(auth())
.send({ parentId: zone.body.id })
.expect(400);
// Le site a une zone : il ne peut pas devenir zone lui-même
await http()
.patch(`/locations/${site.body.id}`)
.set(auth())
.send({ parentId: zone.body.id })
.expect(400);
await http().patch(`/locations/${GHOST}`).set(auth()).send({ name: 'X' }).expect(404);
});
it('appareils : statut, référence en conflit, emplacement inconnu, 404', async () => {
const { body } = await http().get('/assets').set(auth());
const a1 = body.assets.find((a: { reference: string }) => a.reference === 'A1');
const b1 = body.assets.find((a: { reference: string }) => a.reference === 'B1');
const updated = await http()
.patch(`/assets/${b1.id}`)
.set(auth())
.send({ status: 'UNDER_MAINTENANCE' })
.expect(200);
expect(updated.body.status).toBe('UNDER_MAINTENANCE');
await http()
.patch(`/assets/${b1.id}`)
.set(auth())
.send({ status: 'IN_SERVICE' })
.expect(200);
await http()
.patch(`/assets/${b1.id}`)
.set(auth())
.send({ reference: a1.reference })
.expect(409);
await http()
.patch(`/assets/${b1.id}`)
.set(auth())
.send({ locationId: GHOST })
.expect(400);
await http().get(`/assets/${GHOST}`).set(auth()).expect(404);
await http()
.patch(`/assets/${GHOST}`)
.set(auth())
.send({ brand: 'X' })
.expect(404);
await http()
.post(`/assets/${GHOST}/components`)
.set(auth())
.send({ typeId: GHOST })
.expect(404);
await http()
.delete(`/assets/${b1.id}/components/${GHOST}`)
.set(auth())
.expect(404);
});
it('personnes : mise à jour rôle/équipes, invitation sur rôle inconnu, 404', async () => {
const { body: users } = await http().get('/users').set(auth());
const youssef = users.users.find(
(u: { email: string }) => u.email === 'technicien-limite@demo.siop.ma',
);
const { body: teams } = await http().get('/teams').set(auth());
const mohammedia = teams.teams.find((t: { name: string }) => t.name === 'Mohammedia');
const updated = await http()
.patch(`/users/${youssef.id}`)
.set(auth())
.send({ phone: '06 12 34 56 78', teamIds: [mohammedia.id] })
.expect(200);
expect(updated.body.teams.map((t: { name: string }) => t.name)).toContain('Mohammedia');
// remise en l'état (seed idempotent : les équipes ne sont pas réécrites)
const casa = teams.teams.find((t: { name: string }) => t.name === 'Casablanca Centre');
await http()
.patch(`/users/${youssef.id}`)
.set(auth())
.send({ teamIds: [casa.id] })
.expect(200);
await http().patch(`/users/${GHOST}`).set(auth()).send({ phone: '0' }).expect(404);
await http()
.post('/users/invitations')
.set(auth())
.send({ email: `x-${suffix}@spelev.ma`, displayName: 'X', roleId: GHOST })
.expect(404);
await http().post(`/users/${GHOST}/invitation`).set(auth()).expect(404);
});
});

View File

@@ -0,0 +1,128 @@
/**
* E2E R1 — invitation & activation : lien 7 jours, usage unique,
* aucun compte actif avant activation (décision maquettes R1).
*/
process.env.DEMO_MODE = 'true';
import { INestApplication } from '@nestjs/common';
import { Test } from '@nestjs/testing';
import { PrismaClient } from '@prisma/client';
import request from 'supertest';
import { seed } from '../prisma/seed';
import { AppModule } from '../src/app.module';
describe('Invitation → activation (e2e)', () => {
let app: INestApplication;
let admin: string;
const prisma = new PrismaClient();
const http = () => request(app.getHttpServer());
const email = `invite-${Date.now().toString(36)}@spelev.ma`;
beforeAll(async () => {
await seed(prisma);
const moduleRef = await Test.createTestingModule({
imports: [AppModule.forRoot()],
}).compile();
app = moduleRef.createNestApplication();
await app.init();
const { body } = await http().get('/auth/demo-accounts');
const compte = body.accounts.find(
(a: { roleName: string }) => a.roleName === 'Administrateur',
);
admin = (await http().post('/auth/demo-login').send({ userId: compte.id })).body
.accessToken;
});
afterAll(async () => {
await prisma.user.deleteMany({ where: { email } });
await app?.close();
await prisma.$disconnect();
});
it('invite, empêche la connexion avant activation, active, connecte', async () => {
const { body: roles } = await http()
.get('/roles')
.set('Authorization', `Bearer ${admin}`)
.expect(200);
const technicien = roles.roles.find(
(r: { name: string }) => r.name === 'Technicien',
);
// 1. Invitation → compte « invited », lien émis
const invitation = await http()
.post('/users/invitations')
.set('Authorization', `Bearer ${admin}`)
.send({ email, displayName: 'Recrue Test', roleId: technicien.id })
.expect(201);
expect(invitation.body.activationToken).toBeTruthy();
const { body: users } = await http()
.get('/users')
.set('Authorization', `Bearer ${admin}`);
const invited = users.users.find((u: { email: string }) => u.email === email);
expect(invited.status).toBe('invited');
// 2. Pas de connexion possible avant activation
await http()
.post('/auth/login')
.send({ email, password: 'MotDePasse!123' })
.expect(401);
// 3. Renvoi du lien : l'ancien devient invalide (usage unique)
const renvoi = await http()
.post(`/users/${invitation.body.userId}/invitation`)
.set('Authorization', `Bearer ${admin}`)
.expect(201);
await http()
.post('/auth/activate')
.send({ token: invitation.body.activationToken, password: 'MotDePasse!123' })
.expect(400);
// 4. Activation → connecté directement, statut « active »
const activation = await http()
.post('/auth/activate')
.send({ token: renvoi.body.activationToken, password: 'MotDePasse!123' })
.expect(200);
expect(activation.body.user.role.name).toBe('Technicien');
await http()
.get('/users/me')
.set('Authorization', `Bearer ${activation.body.accessToken}`)
.expect(200);
// 5. Le lien est consommé ; la connexion classique fonctionne désormais
await http()
.post('/auth/activate')
.send({ token: renvoi.body.activationToken, password: 'Autre!12345' })
.expect(400);
await http()
.post('/auth/login')
.send({ email, password: 'MotDePasse!123' })
.expect(200);
// 6. Renvoyer un lien sur un compte activé → refus
await http()
.post(`/users/${invitation.body.userId}/invitation`)
.set('Authorization', `Bearer ${admin}`)
.expect(409);
});
it('refuse un email déjà connu (409) et un lien fantaisiste (400)', async () => {
const { body: roles } = await http()
.get('/roles')
.set('Authorization', `Bearer ${admin}`);
await http()
.post('/users/invitations')
.set('Authorization', `Bearer ${admin}`)
.send({
email: 'dispatcher@demo.siop.ma',
displayName: 'Doublon',
roleId: roles.roles[0].id,
})
.expect(409);
await http()
.post('/auth/activate')
.send({ token: 'jeton-inexistant-123', password: 'MotDePasse!123' })
.expect(400);
});
});

View File

@@ -0,0 +1,185 @@
/**
* E2E R1 — référentiel : parcours de recette (site → zone → appareil → organes)
* + invariants (profondeur 2, types d'organes, matrice de permissions vivante).
*/
process.env.DEMO_MODE = 'true';
import { INestApplication } from '@nestjs/common';
import { Test } from '@nestjs/testing';
import { PrismaClient } from '@prisma/client';
import request from 'supertest';
import { seed } from '../prisma/seed';
import { AppModule } from '../src/app.module';
describe('Référentiel (e2e)', () => {
let app: INestApplication;
let admin: string; // jetons
let technicien: string;
const prisma = new PrismaClient();
const http = () => request(app.getHttpServer());
const suffix = Date.now().toString(36); // données de test uniques et repérables
beforeAll(async () => {
await seed(prisma);
const moduleRef = await Test.createTestingModule({
imports: [AppModule.forRoot()],
}).compile();
app = moduleRef.createNestApplication();
await app.init();
const { body } = await http().get('/auth/demo-accounts');
const login = async (roleName: string) => {
const compte = body.accounts.find((a: { roleName: string }) => a.roleName === roleName);
const res = await http().post('/auth/demo-login').send({ userId: compte.id });
return res.body.accessToken as string;
};
admin = await login('Administrateur');
technicien = await login('Technicien');
});
afterAll(async () => {
await prisma.asset.deleteMany({ where: { reference: { contains: suffix } } });
await prisma.location.deleteMany({ where: { name: { contains: suffix } } });
await app?.close();
await prisma.$disconnect();
});
it('parcours de recette : site → zone → appareil avec organes', async () => {
const site = await http()
.post('/locations')
.set('Authorization', `Bearer ${admin}`)
.send({
name: `Site Recette ${suffix}`,
city: 'Casablanca',
latitude: 33.59,
longitude: -7.61,
})
.expect(201);
expect(site.body.parentId).toBeNull();
const zone = await http()
.post('/locations')
.set('Authorization', `Bearer ${admin}`)
.send({ name: `Hall Recette ${suffix}`, parentId: site.body.id })
.expect(201);
const { body: cats } = await http()
.get('/categories')
.set('Authorization', `Bearer ${admin}`);
const equipement = cats.categories.find(
(c: { kind: string }) => c.kind === 'EQUIPMENT',
);
const typeOrgane = cats.categories.find(
(c: { kind: string; isActive: boolean }) => c.kind === 'COMPONENT_TYPE' && c.isActive,
);
const asset = await http()
.post('/assets')
.set('Authorization', `Bearer ${admin}`)
.send({
reference: `T-${suffix}`,
brand: 'Otis',
model: 'Gen2',
categoryId: equipement.id,
locationId: zone.body.id,
components: [{ typeId: typeOrgane.id, designation: 'Organe de test' }],
})
.expect(201);
expect(asset.body.components).toHaveLength(1);
expect(asset.body.siteName).toBe(`Site Recette ${suffix}`);
// Ajout puis retrait d'un organe
const organe = await http()
.post(`/assets/${asset.body.id}/components`)
.set('Authorization', `Bearer ${admin}`)
.send({ typeId: typeOrgane.id })
.expect(201);
await http()
.delete(`/assets/${asset.body.id}/components/${organe.body.id}`)
.set('Authorization', `Bearer ${admin}`)
.expect(204);
});
it('refuse une hiérarchie de profondeur 3 (site → zone → ?)', async () => {
const site = await http()
.post('/locations')
.set('Authorization', `Bearer ${admin}`)
.send({ name: `Site Profond ${suffix}` })
.expect(201);
const zone = await http()
.post('/locations')
.set('Authorization', `Bearer ${admin}`)
.send({ name: `Zone Profonde ${suffix}`, parentId: site.body.id })
.expect(201);
await http()
.post('/locations')
.set('Authorization', `Bearer ${admin}`)
.send({ name: `Sous-zone ${suffix}`, parentId: zone.body.id })
.expect(400);
});
it('refuse un appareil dont la catégorie nest pas un équipement', async () => {
const { body: cats } = await http()
.get('/categories')
.set('Authorization', `Bearer ${admin}`);
const typeOrgane = cats.categories.find((c: { kind: string }) => c.kind === 'COMPONENT_TYPE');
const { body: locs } = await http()
.get('/locations')
.set('Authorization', `Bearer ${admin}`);
await http()
.post('/assets')
.set('Authorization', `Bearer ${admin}`)
.send({
reference: `KO-${suffix}`,
brand: 'Test',
categoryId: typeOrgane.id, // kind COMPONENT_TYPE → refus
locationId: locs.locations[0].id,
})
.expect(400);
});
it('la matrice vit : un Technicien lit le parc mais ne crée rien', async () => {
await http().get('/assets').set('Authorization', `Bearer ${technicien}`).expect(200);
await http().get('/locations').set('Authorization', `Bearer ${technicien}`).expect(200);
await http()
.post('/locations')
.set('Authorization', `Bearer ${technicien}`)
.send({ name: `Interdit ${suffix}` })
.expect(403);
await http().get('/users').set('Authorization', `Bearer ${technicien}`).expect(403);
});
it('le seed de la maquette est en place (A1 et ses organes, statuts)', async () => {
const { body } = await http()
.get('/assets')
.set('Authorization', `Bearer ${admin}`)
.expect(200);
const a1 = body.assets.find((a: { reference: string }) => a.reference === 'A1');
expect(a1.siteName).toBe('Résidence Al Manar');
expect(a1.componentCount).toBe(4);
const b2 = body.assets.find((a: { reference: string }) => a.reference === 'B2');
expect(b2.status).toBe('OUT_OF_SERVICE');
});
it('catégorie utilisée : désactivable, jamais supprimable (la route nexiste pas)', async () => {
const { body: cats } = await http()
.get('/categories')
.set('Authorization', `Bearer ${admin}`);
const used = cats.categories.find((c: { usageCount: number }) => c.usageCount > 0);
await http()
.delete(`/categories/${used.id}`)
.set('Authorization', `Bearer ${admin}`)
.expect(404); // pas de DELETE dans le contrat
const off = await http()
.patch(`/categories/${used.id}`)
.set('Authorization', `Bearer ${admin}`)
.send({ isActive: false })
.expect(200);
expect(off.body.isActive).toBe(false);
await http()
.patch(`/categories/${used.id}`)
.set('Authorization', `Bearer ${admin}`)
.send({ isActive: true })
.expect(200);
});
});