pushActions.cy.js

/**
 * Copyright 2026 GitProxy Contributors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

describe('Push Actions (Approve, Reject, Cancel)', () => {
  const testUser = {
    username: 'testuser',
    password: 'user123',
    email: 'testuser@example.com',
    gitAccount: 'testuser',
  };

  const approverUser = {
    username: 'approver',
    password: 'approver123',
    email: 'approver@example.com',
    gitAccount: 'approver',
  };

  before(() => {
    // Setup: login as admin, create test users, assign permissions
    cy.login('admin', 'admin');

    cy.createUser(testUser.username, testUser.password, testUser.email, testUser.gitAccount);
    cy.createUser(
      approverUser.username,
      approverUser.password,
      approverUser.email,
      approverUser.gitAccount,
    );

    cy.getTestRepoId().then((repoId) => {
      cy.addUserPushPermission(repoId, testUser.username);
      cy.addUserAuthorisePermission(repoId, approverUser.username);
    });

    cy.logout();
  });

  afterEach(() => {
    cy.logout();
  });

  describe('Approve flow', () => {
    beforeEach(() => {
      const suffix = `approve-${Date.now()}`;
      cy.createPush(testUser.username, testUser.password, testUser.email, suffix).as('pushId');
    });

    it('should approve a pending push via attestation dialog', function () {
      cy.login(approverUser.username, approverUser.password);
      cy.visit(`/dashboard/push/${this.pushId}`);

      // Verify push is Pending
      cy.get('[data-testid="push-status"]').should('contain', 'Pending');

      // Action buttons should be visible
      cy.get('[data-testid="push-cancel-btn"]').should('be.visible');
      cy.get('[data-testid="push-reject-btn"]').should('be.visible');
      cy.get('[data-testid="attestation-open-btn"]').should('be.visible');

      // Open attestation dialog
      cy.get('[data-testid="attestation-open-btn"]').click();
      cy.get('[data-testid="attestation-dialog"]').should('be.visible');

      // Confirm button should be disabled until all checkboxes are checked
      cy.get('[data-testid="attestation-confirm-btn"]').should('be.disabled');

      // Check all attestation checkboxes
      cy.get('[data-testid="attestation-dialog"]')
        .find('input[type="checkbox"]')
        .each(($checkbox) => {
          cy.wrap($checkbox).check({ force: true });
        });

      // Confirm button should now be enabled
      cy.get('[data-testid="attestation-confirm-btn"]').should('not.be.disabled');

      // Click confirm to approve
      cy.get('[data-testid="attestation-confirm-btn"]').click();

      // Should navigate back to push list
      cy.url().should('include', '/dashboard/push');
      cy.url().should('not.include', this.pushId);

      // Verify push is now Approved by revisiting its detail page
      cy.visit(`/dashboard/push/${this.pushId}`);
      cy.get('[data-testid="push-status"]').should('contain', 'Approved');

      // Action buttons should no longer be visible for an approved push
      cy.get('[data-testid="push-cancel-btn"]').should('not.exist');
      cy.get('[data-testid="push-reject-btn"]').should('not.exist');
      cy.get('[data-testid="attestation-open-btn"]').should('not.exist');
    });
  });

  describe('Reject flow', () => {
    beforeEach(() => {
      const suffix = `reject-${Date.now()}`;
      cy.createPush(testUser.username, testUser.password, testUser.email, suffix).as('pushId');
    });

    it('should reject a pending push', function () {
      cy.login(approverUser.username, approverUser.password);
      cy.visit(`/dashboard/push/${this.pushId}`);

      // Verify push is Pending
      cy.get('[data-testid="push-status"]').should('contain', 'Pending');

      // Open reject dialog
      cy.get('[data-testid="push-reject-btn"]').click();

      // Confirm button should be disabled until reason is provided
      cy.get('[data-testid="push-reject-confirm-btn"]').should('be.disabled');

      // Fill in rejection reason
      cy.get('#reason').type('Rejecting for test purposes');

      // Confirm button should now be enabled
      cy.get('[data-testid="push-reject-confirm-btn"]').should('not.be.disabled');

      // Confirm rejection
      cy.get('[data-testid="push-reject-confirm-btn"]').click();

      // Should navigate back to push list
      cy.url().should('include', '/dashboard/push');
      cy.url().should('not.include', this.pushId);

      // Verify push is now Rejected
      cy.visit(`/dashboard/push/${this.pushId}`);
      cy.get('[data-testid="push-status"]').should('contain', 'Rejected');

      // Action buttons should no longer be visible
      cy.get('[data-testid="push-cancel-btn"]').should('not.exist');
      cy.get('[data-testid="push-reject-btn"]').should('not.exist');
      cy.get('[data-testid="attestation-open-btn"]').should('not.exist');
    });
  });

  describe('Cancel flow', () => {
    beforeEach(() => {
      const suffix = `cancel-${Date.now()}`;
      cy.createPush(testUser.username, testUser.password, testUser.email, suffix).as('pushId');
    });

    it('should cancel a pending push', function () {
      // Cancel can be done by the push author
      cy.login(testUser.username, testUser.password);
      cy.visit(`/dashboard/push/${this.pushId}`);

      // Verify push is Pending
      cy.get('[data-testid="push-status"]').should('contain', 'Pending');

      // Click Cancel
      cy.get('[data-testid="push-cancel-btn"]').click();

      // Should navigate back to push list
      cy.url().should('include', '/dashboard/push');

      // Verify push is now Canceled
      cy.visit(`/dashboard/push/${this.pushId}`);
      cy.get('[data-testid="push-status"]').should('contain', 'Canceled');

      // Action buttons should no longer be visible
      cy.get('[data-testid="push-cancel-btn"]').should('not.exist');
      cy.get('[data-testid="push-reject-btn"]').should('not.exist');
      cy.get('[data-testid="attestation-open-btn"]').should('not.exist');
    });
  });

  describe('Negative: unauthorized approve', () => {
    beforeEach(() => {
      const suffix = `neg-approve-${Date.now()}`;
      cy.createPush(testUser.username, testUser.password, testUser.email, suffix).as('pushId');
    });

    it('should not change push state when user lacks canAuthorise permission', function () {
      // Login as testuser (has canPush but NOT canAuthorise)
      cy.login(testUser.username, testUser.password);
      cy.visit(`/dashboard/push/${this.pushId}`);

      cy.get('[data-testid="push-status"]').should('contain', 'Pending');

      // Open attestation dialog and attempt to approve
      cy.get('[data-testid="attestation-open-btn"]').click();
      cy.get('[data-testid="attestation-dialog"]').should('be.visible');

      // Check all checkboxes
      cy.get('[data-testid="attestation-dialog"]')
        .find('input[type="checkbox"]')
        .each(($checkbox) => {
          cy.wrap($checkbox).check({ force: true });
        });

      cy.get('[data-testid="attestation-confirm-btn"]').click();

      // TODO: The server correctly returns 403 but the UI (src/ui/services/git-push.ts)
      // only handles 401 errors in authorisePush/rejectPush. The 403 is silently
      // ignored and the user is navigated away without feedback. Once the UI properly
      // handles 403, this test should assert a snackbar error message is shown.
      cy.visit(`/dashboard/push/${this.pushId}`);
      cy.get('[data-testid="push-status"]').should('contain', 'Pending');
    });
  });

  describe('Negative: unauthorized reject', () => {
    beforeEach(() => {
      const suffix = `neg-reject-${Date.now()}`;
      cy.createPush(testUser.username, testUser.password, testUser.email, suffix).as('pushId');
    });

    it('should not change push state when user lacks canAuthorise permission', function () {
      // Login as testuser
      cy.login(testUser.username, testUser.password);
      cy.visit(`/dashboard/push/${this.pushId}`);

      cy.get('[data-testid="push-status"]').should('contain', 'Pending');

      // Click Reject
      cy.get('[data-testid="push-reject-btn"]').click();

      // TODO: Same issue as unauthorized approve — UI ignores 403 from server.
      // Once fixed, assert snackbar error message is shown.
      cy.visit(`/dashboard/push/${this.pushId}`);
      cy.get('[data-testid="push-status"]').should('contain', 'Pending');
    });
  });

  describe('Attestation dialog cancel does not cancel the push', () => {
    beforeEach(() => {
      const suffix = `dialog-cancel-${Date.now()}`;
      cy.createPush(testUser.username, testUser.password, testUser.email, suffix).as('pushId');
    });

    it('should close attestation dialog without affecting push status', function () {
      cy.login(approverUser.username, approverUser.password);
      cy.visit(`/dashboard/push/${this.pushId}`);

      cy.get('[data-testid="push-status"]').should('contain', 'Pending');

      // Open attestation dialog
      cy.get('[data-testid="attestation-open-btn"]').click();
      cy.get('[data-testid="attestation-dialog"]').should('be.visible');

      // Click the dialog's Cancel button (NOT the push cancel button)
      cy.get('[data-testid="attestation-cancel-btn"]').click();

      // Dialog should close, push should still be pending
      cy.get('[data-testid="attestation-dialog"]').should('not.exist');
      cy.get('[data-testid="push-status"]').should('contain', 'Pending');

      // Action buttons should still be visible (push is still pending)
      cy.get('[data-testid="push-cancel-btn"]').should('be.visible');
      cy.get('[data-testid="push-reject-btn"]').should('be.visible');
      cy.get('[data-testid="attestation-open-btn"]').should('be.visible');
    });
  });
});