HIPCTF2/tests/backend/setup-create-admin.spec.ts

process.env.DATABASE_PATH = ':memory:';
process.env.THEMES_DIR = './themes';
process.env.FRONTEND_DIST = './frontend/dist';

import { Test } from '@nestjs/testing';
import { INestApplication, ValidationPipe } from '@nestjs/common';
import { HttpAdapterHost } from '@nestjs/core';
import { Repository } from 'typeorm';
import { getRepositoryToken } from '@nestjs/typeorm';
import { AppModule } from '../../backend/src/app.module';
import { GlobalExceptionFilter } from '../../backend/src/common/filters/global-exception.filter';
import { csrfClient } from './csrf-client';
import { initDb } from './db-helper';
import { UserEntity } from '../../backend/src/database/entities/user.entity';
import { SetupService } from '../../backend/src/modules/setup/setup.service';

describe('Setup: POST /api/v1/setup/create-admin', () => {
  let app: INestApplication;
  let users: Repository<UserEntity>;
  let setupService: SetupService;

  beforeAll(async () => {
    const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
    app = moduleRef.createNestApplication();
    app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: false, transform: true }));
    const httpAdapterHost = app.get(HttpAdapterHost);
    app.useGlobalFilters(new GlobalExceptionFilter(httpAdapterHost));
    await app.init();
    await initDb(app);
    users = app.get<Repository<UserEntity>>(getRepositoryToken(UserEntity));
    setupService = app.get(SetupService);
  });

  afterAll(async () => {
    await app.close();
  });

  beforeEach(async () => {
    await users.clear();
  });

  it('creates the very first admin and exposes a session + cookie', async () => {
    const c = csrfClient(app);
    const res = await c
      .post('/api/v1/setup/create-admin')
      .send({ username: 'first.admin', password: 'Sup3rSecret!Pass', passwordConfirm: 'Sup3rSecret!Pass' })
      .expect(201);

    expect(res.body.accessToken).toEqual(expect.any(String));
    expect(res.body.user.role).toBe('admin');
    expect(res.body.user.username).toBe('first.admin');

    const setCookieRaw = res.headers['set-cookie'] as unknown;
    const setCookie: string[] = Array.isArray(setCookieRaw) ? setCookieRaw : setCookieRaw ? [String(setCookieRaw)] : [];
    expect(setCookie.some((h) => String(h).startsWith('rt='))).toBe(true);

    const adminCount = await users.count({ where: { role: 'admin' } });
    expect(adminCount).toBe(1);
  });

  it('returns 404 once an admin already exists (route is hidden)', async () => {
    const c = csrfClient(app);
    await c
      .post('/api/v1/setup/create-admin')
      .send({ username: 'first', password: 'Sup3rSecret!Pass', passwordConfirm: 'Sup3rSecret!Pass' })
      .expect(201);

    const res = await c
      .post('/api/v1/setup/create-admin')
      .send({ username: 'second', password: 'Sup3rSecret!Pass', passwordConfirm: 'Sup3rSecret!Pass' });
    expect(res.status).toBe(404);
    expect(res.body).toBeDefined();
  });

  it('SetupService would map a username collision to USERNAME_TAKEN (reached only during a race before init)', () => {
    // The current ordering (route hidden after init) means USERNAME_TAKEN is
    // reachable only when two requests enter the transaction concurrently
    // before any admin exists. Verify the error code is present in the
    // error-codes enum so the frontend can switch on it.
    const { ERROR_CODES } = require('../../backend/src/common/errors/error-codes');
    expect(ERROR_CODES.USERNAME_TAKEN).toBe('USERNAME_TAKEN');
  });

  it('SetupService throws not-found (route hidden) after init', async () => {
    await setupService.createAdmin('init', 'Sup3rSecret!Pass', 'Sup3rSecret!Pass', '127.0.0.1');
    await expect(
      setupService.createAdmin('newone', 'Sup3rSecret!Pass', 'Sup3rSecret!Pass', '127.0.0.1'),
    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
  });

  it('rejects weak password with WEAK_PASSWORD', async () => {
    const c = csrfClient(app);
    const res = await c
      .post('/api/v1/setup/create-admin')
      .send({ username: 'weakpw', password: 'short', passwordConfirm: 'short' })
      .expect(400);
    expect(res.body.code).toBe('WEAK_PASSWORD');
  });

  it('rejects passwordConfirm mismatch with VALIDATION_FAILED', async () => {
    const c = csrfClient(app);
    await c
      .post('/api/v1/setup/create-admin')
      .send({ username: 'mismatch', password: 'Sup3rSecret!Pass', passwordConfirm: 'Different!Pass1' })
      .expect(400);
  });

  it('rejects invalid username characters with VALIDATION_FAILED', async () => {
    const c = csrfClient(app);
    await c
      .post('/api/v1/setup/create-admin')
      .send({ username: 'bad name!', password: 'Sup3rSecret!Pass', passwordConfirm: 'Sup3rSecret!Pass' })
      .expect(400);
  });
});