QA: unit tests for API logic, Playwright smoke tests, pre-push check, manual QA checklist

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/test/record-scope.test.ts

@@ -0,0 +1,69 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  noteAccessWhere,
+  normalizeDataVisibility,
+  ownerWhere,
+  parseVisibilityScopes,
+  resolveOwnerId,
+  scopedOwnerIds,
+  seesAllRecords,
+} from '../src/common/record-scope';
+
+const sales = { userId: 'u1', role: 'sales' };
+
+describe('سطح دسترسی به پرونده‌ها', () => {
+  it('مدیر و مالک همه را می‌بینند', () => {
+    assert.ok(seesAllRecords({ role: 'owner' }));
+    assert.ok(seesAllRecords({ role: 'admin' }));
+    assert.deepEqual(ownerWhere({ userId: 'a', role: 'admin' }), {});
+  });
+
+  it('کارشناس فروش فقط پرونده‌های خودش را می‌بیند', () => {
+    assert.ok(!seesAllRecords(sales));
+    assert.deepEqual(scopedOwnerIds(sales), ['u1']);
+    assert.deepEqual(ownerWhere(sales), { ownerId: 'u1' });
+  });
+
+  it('دید تیمی', () => {
+    const actor = { ...sales, dataVisibility: 'team' as const, visibleUserIds: ['u1', 'u2', 'u2'] };
+    assert.deepEqual(ownerWhere(actor), { ownerId: { in: ['u1', 'u2'] } });
+  });
+
+  it('دید سازمانی یا visibleUserIds=null یعنی همه', () => {
+    assert.deepEqual(ownerWhere({ ...sales, dataVisibility: 'org' as const }), {});
+    assert.deepEqual(ownerWhere({ ...sales, visibleUserIds: null }), {});
+  });
+
+  it('سطح دید تفکیکی هر بخش بر پیش‌فرض اولویت دارد', () => {
+    const actor = {
+      ...sales,
+      dataVisibility: 'org' as const,
+      scopes: { finance: { dataVisibility: 'own' as const, visibleUserIds: ['u1'] } },
+    };
+    assert.deepEqual(ownerWhere(actor, 'contacts'), {});
+    assert.deepEqual(ownerWhere(actor, 'finance'), { ownerId: 'u1' });
+  });
+
+  it('یادداشت شخصی فقط برای نویسنده', () => {
+    const where = noteAccessWhere({ userId: 'a', role: 'admin' });
+    assert.deepEqual(where, {
+      OR: [
+        { visibility: { not: 'personal' } },
+        { visibility: 'personal', authorId: 'a' },
+      ],
+    });
+  });
+
+  it('فقط مدیر می‌تواند مالک را عوض کند', () => {
+    assert.equal(resolveOwnerId(sales, 'u9'), 'u1');
+    assert.equal(resolveOwnerId({ userId: 'a', role: 'admin' }, ' u9 '), 'u9');
+    assert.equal(resolveOwnerId({ userId: 'a', role: 'admin' }, ''), 'a');
+  });
+
+  it('پارس تنظیمات دید', () => {
+    assert.deepEqual(parseVisibilityScopes({ contacts: 'team', finance: 'bad' }), { contacts: 'team' });
+    assert.deepEqual(parseVisibilityScopes(null), {});
+    assert.equal(normalizeDataVisibility('weird'), 'own');
+  });
+});