test(mvp1): add owner invariants and media form coverage

TODO.md

@@ -187,14 +187,48 @@ This file is the single source of truth for roadmap and delivery progress.
 ### Testing
 
 - [x] [P1] Unit tests for content schemas and service logic
-- [ ] [P1] Component tests for admin forms (pages/media/navigation)
+- [~] [P1] Component tests for admin forms (pages/media/navigation)
-- [ ] [P1] Integration tests for owner invariant and hidden support-user protection
+- [x] [P1] Integration tests for owner invariant and hidden support-user protection
 - [x] [P1] Integration tests for registration allow/deny behavior
 - [ ] [P1] Integration tests for translated content CRUD and locale-specific validation
 - [~] [P1] E2E happy paths: create page, publish, see on public app
 - [~] [P1] E2E happy paths: media upload + artwork refinement display
 - [~] [P1] E2E happy paths: commissions kanban transitions
 
+### Code Documentation And Handover
+
+- [ ] [P1] Create architecture map per package/app (`what exists`, `why`, `how to extend`) for `@cms/db`, `@cms/content`, `@cms/crud`, `@cms/ui`, `apps/admin`, `apps/web`
+- [ ] [P1] Add module-level ownership docs for auth, media, pages/navigation, commissions, announcements/news flows
+- [ ] [P1] Document critical invariants (single owner rule, protected support user, registration policy gates, media storage key contract)
+- [ ] [P1] Add “request lifecycle” docs for key flows (auth sign-in/up, media upload, page publish, commission status change)
+- [ ] [P1] Add coding handover playbook: local setup, migration workflow, test strategy, branch/release process, common failure recovery
+- [ ] [P2] Add code-level diagrams (Mermaid) for service boundaries and data relationships
+- [ ] [P2] Add route/action inventory for admin and public apps with linked source files
+
+## MVP 1.5: UX/UI And Theming
+
+### MVP1.5 Suggested Branch Order
+
+- [ ] [P1] `todo/mvp15-design-tokens-foundation`:
+  establish shared design tokens (color, spacing, radius, typography scale, motion) in `@cms/ui` and app-level theme contracts
+- [ ] [P1] `todo/mvp15-admin-layout-polish`:
+  refine admin shell, navigation hierarchy, spacing rhythm, table/form visual consistency, empty/loading/error states
+- [ ] [P1] `todo/mvp15-public-layout-and-templates`:
+  define public visual direction (hero/header/footer/content widths), page templates for home/content/news/portfolio
+- [ ] [P2] `todo/mvp15-component-library-pass`:
+  align shadcn-based primitives with CMS brand system (buttons, inputs, cards, badges, tabs, dialogs, toasts)
+- [ ] [P2] `todo/mvp15-responsive-and-a11y-pass`:
+  mobile/tablet breakpoints, keyboard flow, focus states, contrast checks, reduced-motion support
+- [ ] [P2] `todo/mvp15-visual-regression-baseline`:
+  add screenshot baselines for critical admin/public routes to guard layout regressions
+
+### Deliverables
+
+- [ ] [P1] Admin UI baseline feels production-ready for daily editorial use
+- [ ] [P1] Public UI baseline is template-ready for artist branding and portfolio storytelling
+- [ ] [P2] Shared UI primitives are consistent across admin and public apps
+- [ ] [P2] Core routes have visual-regression coverage for the new layout baseline
+
 ## MVP 2: Production Readiness
 
 ### Admin App
@@ -283,6 +317,8 @@ This file is the single source of truth for roadmap and delivery progress.
 - [2026-02-12] Expanded unit coverage for content/domain schemas and post service behavior (`packages/content/src/domain-schemas.test.ts`, `packages/db/src/posts.test.ts`).
 - [2026-02-12] Added auth flow integration tests for `/login`, `/register`, `/welcome` to validate registration allow/deny and owner bootstrap redirects.
 - [2026-02-12] Admin settings now manage public header banner (enabled/message/CTA), backed by `system_setting` and consumed by public layout rendering.
+- [2026-02-12] Added owner/support invariant integration tests for auth guards (`apps/admin/src/lib/auth/server.test.ts`), covering protected-user deletion blocking and one-owner repair/promotion rules.
+- [2026-02-12] Started admin form component tests with media upload behavior coverage (`apps/admin/src/components/media/media-upload-form.test.tsx`).
 
 ## How We Use This File
 

apps/admin/src/components/media/media-upload-form.test.tsx

@@ -0,0 +1,84 @@
+/* @vitest-environment jsdom */
+
+import { fireEvent, render, screen, waitFor } from "@testing-library/react"
+import { afterEach, describe, expect, it, vi } from "vitest"
+
+import { MediaUploadForm } from "./media-upload-form"
+
+describe("MediaUploadForm", () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it("updates accepted MIME list based on selected media type", () => {
+    render(<MediaUploadForm />)
+
+    const fileInput = screen.getByLabelText("File") as HTMLInputElement
+    const typeSelect = screen.getByLabelText("Type") as HTMLSelectElement
+
+    expect(fileInput.accept).toContain("image/jpeg")
+
+    fireEvent.change(typeSelect, { target: { value: "video" } })
+
+    expect(fileInput.accept).toContain("video/mp4")
+    expect(fileInput.accept).not.toContain("image/jpeg")
+  })
+
+  it("shows API error message when upload fails", async () => {
+    const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue({
+      ok: false,
+      json: async () => ({ message: "Invalid file type" }),
+    } as Response)
+
+    render(<MediaUploadForm />)
+
+    const form = screen.getByRole("button", { name: "Upload media" }).closest("form")
+
+    if (!form) {
+      throw new Error("Upload form not found")
+    }
+
+    const fileInput = screen.getByLabelText("File") as HTMLInputElement
+    fireEvent.change(fileInput, {
+      target: {
+        files: [new File(["x"], "demo.png", { type: "image/png" })],
+      },
+    })
+
+    fireEvent.submit(form)
+
+    await waitFor(() => {
+      expect(screen.queryByText("Invalid file type")).not.toBeNull()
+    })
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/media/upload",
+      expect.objectContaining({ method: "POST" }),
+    )
+  })
+
+  it("shows network error message when request throws", async () => {
+    vi.spyOn(globalThis, "fetch").mockRejectedValue(new Error("network down"))
+
+    render(<MediaUploadForm />)
+
+    const form = screen.getByRole("button", { name: "Upload media" }).closest("form")
+
+    if (!form) {
+      throw new Error("Upload form not found")
+    }
+
+    const fileInput = screen.getByLabelText("File") as HTMLInputElement
+    fireEvent.change(fileInput, {
+      target: {
+        files: [new File(["x"], "demo.png", { type: "image/png" })],
+      },
+    })
+
+    fireEvent.submit(form)
+
+    await waitFor(() => {
+      expect(screen.queryByText("Upload request failed. Please retry.")).not.toBeNull()
+    })
+  })
+})

apps/admin/src/lib/auth/server.test.ts

@@ -0,0 +1,238 @@
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const { mockDb, mockIsAdminSelfRegistrationEnabled, mockAuth, mockAuthRouteHandlers } = vi.hoisted(
+  () => {
+    const mockDb = {
+      user: {
+        count: vi.fn(),
+        findUnique: vi.fn(),
+        findMany: vi.fn(),
+        findFirst: vi.fn(),
+        update: vi.fn(),
+        updateMany: vi.fn(),
+      },
+      $transaction: vi.fn(),
+    }
+
+    return {
+      mockDb,
+      mockIsAdminSelfRegistrationEnabled: vi.fn(),
+      mockAuth: {
+        api: {
+          getSession: vi.fn(),
+        },
+        $context: Promise.resolve({
+          internalAdapter: {
+            findUserByEmail: vi.fn(),
+            linkAccount: vi.fn(),
+            createUser: vi.fn(),
+          },
+          password: {
+            hash: vi.fn(async (value: string) => `hashed:${value}`),
+          },
+        }),
+      },
+      mockAuthRouteHandlers: {
+        GET: vi.fn(),
+        POST: vi.fn(),
+        PATCH: vi.fn(),
+        PUT: vi.fn(),
+        DELETE: vi.fn(),
+      },
+    }
+  },
+)
+
+vi.mock("@cms/db", () => ({
+  db: mockDb,
+  isAdminSelfRegistrationEnabled: mockIsAdminSelfRegistrationEnabled,
+}))
+
+vi.mock("better-auth", () => ({
+  betterAuth: vi.fn(() => mockAuth),
+}))
+
+vi.mock("better-auth/adapters/prisma", () => ({
+  prismaAdapter: vi.fn(() => ({})),
+}))
+
+vi.mock("better-auth/next-js", () => ({
+  toNextJsHandler: vi.fn(() => mockAuthRouteHandlers),
+}))
+
+import {
+  canDeleteUserAccount,
+  enforceOwnerInvariant,
+  promoteFirstRegisteredUserToOwner,
+} from "./server"
+
+describe("auth owner/support invariants", () => {
+  beforeEach(() => {
+    mockIsAdminSelfRegistrationEnabled.mockReset()
+    mockDb.user.count.mockReset()
+    mockDb.user.findUnique.mockReset()
+    mockDb.user.findMany.mockReset()
+    mockDb.user.findFirst.mockReset()
+    mockDb.user.update.mockReset()
+    mockDb.user.updateMany.mockReset()
+    mockDb.$transaction.mockReset()
+  })
+
+  it("blocks deletion of protected users", async () => {
+    mockDb.user.findUnique.mockResolvedValue({
+      role: "support",
+      isProtected: true,
+    })
+
+    const allowed = await canDeleteUserAccount("user-protected")
+
+    expect(allowed).toBe(false)
+  })
+
+  it("allows deletion of non-owner non-protected users", async () => {
+    mockDb.user.findUnique.mockResolvedValue({
+      role: "editor",
+      isProtected: false,
+    })
+
+    const allowed = await canDeleteUserAccount("user-editor")
+
+    expect(allowed).toBe(true)
+  })
+
+  it("keeps sole owner non-deletable", async () => {
+    mockDb.user.findUnique.mockResolvedValue({
+      role: "owner",
+      isProtected: false,
+    })
+    mockDb.user.count.mockResolvedValue(1)
+
+    const allowed = await canDeleteUserAccount("owner-1")
+
+    expect(allowed).toBe(false)
+  })
+
+  it("promotes earliest non-support user when no owner exists", async () => {
+    const tx = {
+      user: {
+        findMany: vi.fn().mockResolvedValue([]),
+        findFirst: vi.fn().mockResolvedValue({ id: "candidate-1" }),
+        update: vi.fn().mockResolvedValue({ id: "candidate-1" }),
+        updateMany: vi.fn(),
+      },
+    }
+
+    mockDb.$transaction.mockImplementation(async (callback: (trx: typeof tx) => unknown) =>
+      callback(tx),
+    )
+
+    const result = await enforceOwnerInvariant()
+
+    expect(result).toEqual({
+      ownerId: "candidate-1",
+      ownerCount: 1,
+      repaired: true,
+    })
+    expect(tx.user.update).toHaveBeenCalledTimes(1)
+  })
+
+  it("demotes extra owners and repairs canonical owner protection", async () => {
+    const tx = {
+      user: {
+        findMany: vi.fn().mockResolvedValue([
+          { id: "owner-a", isProtected: false, isBanned: true },
+          { id: "owner-b", isProtected: true, isBanned: false },
+        ]),
+        findFirst: vi.fn(),
+        update: vi.fn().mockResolvedValue({ id: "owner-a" }),
+        updateMany: vi.fn().mockResolvedValue({ count: 1 }),
+      },
+    }
+
+    mockDb.$transaction.mockImplementation(async (callback: (trx: typeof tx) => unknown) =>
+      callback(tx),
+    )
+
+    const result = await enforceOwnerInvariant()
+
+    expect(result).toEqual({
+      ownerId: "owner-a",
+      ownerCount: 1,
+      repaired: true,
+    })
+    expect(tx.user.updateMany).toHaveBeenCalledWith({
+      where: { id: { in: ["owner-b"] } },
+      data: { role: "admin", isProtected: false },
+    })
+    expect(tx.user.update).toHaveBeenCalledWith({
+      where: { id: "owner-a" },
+      data: { isProtected: true, isBanned: false },
+    })
+  })
+
+  it("does not promote first registration when an owner already exists", async () => {
+    mockDb.$transaction.mockImplementationOnce(
+      async (
+        callback: (tx: {
+          user: { findFirst: () => Promise<{ id: string }>; update: () => void }
+        }) => unknown,
+      ) =>
+        callback({
+          user: {
+            findFirst: vi.fn().mockResolvedValue({ id: "owner-existing" }),
+            update: vi.fn(),
+          },
+        }),
+    )
+
+    const promoted = await promoteFirstRegisteredUserToOwner("candidate")
+
+    expect(promoted).toBe(false)
+  })
+
+  it("promotes first registration and re-enforces owner invariant", async () => {
+    mockDb.$transaction
+      .mockImplementationOnce(
+        async (
+          callback: (tx: {
+            user: { findFirst: () => Promise<null>; update: () => Promise<{ id: string }> }
+          }) => unknown,
+        ) =>
+          callback({
+            user: {
+              findFirst: vi.fn().mockResolvedValue(null),
+              update: vi.fn().mockResolvedValue({ id: "candidate" }),
+            },
+          }),
+      )
+      .mockImplementationOnce(
+        async (
+          callback: (tx: {
+            user: {
+              findMany: () => Promise<
+                Array<{ id: string; isProtected: boolean; isBanned: boolean }>
+              >
+              findFirst: () => void
+              update: () => void
+              updateMany: () => void
+            }
+          }) => unknown,
+        ) =>
+          callback({
+            user: {
+              findMany: vi
+                .fn()
+                .mockResolvedValue([{ id: "candidate", isProtected: true, isBanned: false }]),
+              findFirst: vi.fn(),
+              update: vi.fn(),
+              updateMany: vi.fn(),
+            },
+          }),
+      )
+
+    const promoted = await promoteFirstRegisteredUserToOwner("candidate")
+
+    expect(promoted).toBe(true)
+    expect(mockDb.$transaction).toHaveBeenCalledTimes(2)
+  })
+})