multiple groups per user

server-be/test/clientApi.test.ts

@@ -1,6 +1,6 @@
 import type { FastifyInstance } from 'fastify';
 import { describe, expect, it } from 'vitest';
-import type { AccessKeyView, Card, Group } from '@cardy/shared';
+import type { AccessKeyView, ApiAuthResponse, Card, Group } from '@cardy/shared';
 import { SUPERADMIN, multipart, testApp } from './helpers.js';
 
 const adminHeaders = { 'remote-email': SUPERADMIN, 'x-cardy-admin': '1' };
@@ -179,6 +179,42 @@ describe('client API', () => {
     expect((patched.json() as Card).tags).toEqual(['a', 'b', 'c']);
   });
 
+  it('serves each of the owner\'s groups and keeps /cards on the first one', async () => {
+    const { app, key } = await setup();
+    const api = client(app, key);
+    const other = (
+      await app.inject({ method: 'POST', url: '/admin/groups', headers: adminHeaders, payload: { name: 'Other' } })
+    ).json() as Group;
+    const stranger = (
+      await app.inject({ method: 'POST', url: '/admin/groups', headers: adminHeaders, payload: { name: 'Stranger' } })
+    ).json() as Group;
+    await app.inject({
+      method: 'POST',
+      url: '/admin/users',
+      headers: { ...adminHeaders, cookie: `cardy_group=${other.id}` },
+      payload: { email: SUPERADMIN },
+    });
+
+    const auth = (await api('GET', '/auth')).json() as ApiAuthResponse;
+    expect(auth.groups.map((g) => g.name)).toEqual(['default', 'Other']);
+    expect(auth.group.name).toBe('default');
+
+    const inOther = (await api('POST', `/groups/${other.id}/cards`, cardParts({ name: 'In other' }))).json() as Card;
+    const inDefault = (await api('POST', `/groups/${auth.groups[0]!.id}/cards`, cardParts({ name: 'In default' }))).json() as Card;
+    expect(((await api('GET', `/groups/${other.id}/cards`)).json() as Card[]).map((c) => c.name)).toEqual(['In other']);
+    // The group-less routes (apps from before multi-group) use the first group.
+    expect(((await api('GET', '/cards')).json() as Card[]).map((c) => c.name)).toEqual(['In default']);
+
+    // Cards are addressed within their group only.
+    expect((await api('DELETE', `/groups/${other.id}/cards/${inDefault.id}`)).statusCode).toBe(404);
+    expect((await api('PUT', `/groups/${other.id}/cards/${inOther.id}`, [{ name: 'name', value: 'Renamed' }])).json()).toMatchObject({
+      name: 'Renamed',
+    });
+    // Groups the owner is not a member of do not exist for the key.
+    expect((await api('GET', `/groups/${stranger.id}/cards`)).statusCode).toBe(404);
+    expect((await api('POST', `/groups/${stranger.id}/cards`, cardParts())).statusCode).toBe(404);
+  });
+
   it('returns JSON 404 for unknown API routes', async () => {
     const { app, key } = await setup();
     const res = await client(app, key)('GET', '/nope');