contacts: my book, the company book, vCard/CSV import, sharing with Accept/Deny

C1 (spec 11): /api/me/contacts and /api/contacts (admin), our own vCard 2.1/3.0/4.0 and CSV
readers with a preview, contact_shares (migration 0009) for offers, and contact names in call
history, voicemail, Home, the softphone and the call report email. Admin → Contacts.

apps/api/test/contacts.test.ts

@@ -0,0 +1,204 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// C1: my contacts, the company's, imports and shares (spec 11).
+import type { LightMyRequestResponse } from 'fastify';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { contactNames } from '../src/contacts/book.ts';
+import { hasTestDb } from './db.ts';
+import { ADMIN, H, createTestApp } from './app.ts';
+
+type Req = (method: string, url: string, payload?: unknown) => Promise<LightMyRequestResponse>;
+
+describe.skipIf(!hasTestDb)('contacts', () => {
+  let t: Awaited<ReturnType<typeof createTestApp>>;
+  let admin: Req;
+  let dan: Req;
+  let sue: Req;
+  let danId: string;
+  const vcf = (name: string, tel: string) =>
+    `BEGIN:VCARD\r\nVERSION:3.0\r\nFN:${name}\r\nTEL;TYPE=CELL:${tel}\r\nEND:VCARD\r\n`;
+
+  beforeAll(async () => {
+    t = await createTestApp();
+    await t.clearMustChange(ADMIN.email);
+    const as =
+      (cookie: string): Req =>
+      (method, url, payload) =>
+        t.app.inject({
+          method: method as 'GET',
+          url,
+          payload: payload as object,
+          headers: { ...H, cookie },
+        });
+    admin = as(await t.login(ADMIN.email, ADMIN.password));
+    danId = (await t.addUser('dan@example.com', 'dan-password-123')).id;
+    const sueId = (await t.addUser('sue@example.com', 'sue-password-123')).id;
+    await admin('POST', '/api/extensions', { number: '101', name: 'Dan Doe', userId: danId });
+    await admin('POST', '/api/extensions', { number: '102', name: 'Sue Smith', userId: sueId });
+    dan = as(await t.login('dan@example.com', 'dan-password-123'));
+    sue = as(await t.login('sue@example.com', 'sue-password-123'));
+  });
+  afterAll(() => t?.close());
+
+  it('my book and the company book: numbers normalized, users only edit their own', async () => {
+    const mine = await dan('POST', '/api/me/contacts', {
+      name: 'Jane Doe',
+      company: 'Acme',
+      email: '',
+      numbers: [{ label: 'mobile', number: '(312) 555-1234' }],
+    });
+    expect(mine.statusCode, mine.body).toBe(201);
+    expect(mine.json()).toMatchObject({
+      book: 'mine',
+      email: null,
+      numbers: [{ label: 'mobile', number: '13125551234' }],
+    });
+    expect(
+      (
+        await dan('POST', '/api/me/contacts', { name: 'X', numbers: [{ number: 'call me' }] })
+      ).json().error.message,
+    ).toMatch(/isn't a phone number/);
+
+    const co = await admin('POST', '/api/contacts', {
+      name: 'Pizza Place',
+      numbers: [{ label: 'main', number: '312-555-0000' }],
+    });
+    expect(co.statusCode, co.body).toBe(201);
+    expect((await dan('GET', '/api/contacts')).statusCode).toBe(403);
+    // Dan sees the company contact but can't change it.
+    const list = (await dan('GET', '/api/me/contacts')).json().items;
+    expect(list.map((c: { name: string; book: string }) => [c.name, c.book])).toEqual([
+      ['Jane Doe', 'mine'],
+      ['Pizza Place', 'company'],
+    ]);
+    expect((await dan('DELETE', `/api/me/contacts/${co.json().id}`)).statusCode).toBe(404);
+    expect(
+      (await sue('PATCH', `/api/me/contacts/${mine.json().id}`, { name: 'Mine now' })).statusCode,
+    ).toBe(404);
+    expect((await sue('GET', '/api/me/contacts')).json().items).toHaveLength(1); // company only
+  });
+
+  it('import: preview first, then save; what is already there is skipped', async () => {
+    const files = [
+      {
+        name: 'phone.vcf',
+        text:
+          vcf('Jane Doe', '+1 312 555 1234') + // already in Dan's book
+          vcf('Bob Smith', '312.555.9999') +
+          'BEGIN:VCARD\r\nVERSION:3.0\r\nFN:Nobody Home\r\nEMAIL:n@example.com\r\nEND:VCARD\r\n',
+      },
+      { name: 'more.csv', text: 'name,number1\nBob Smith,3125559999\nCarl,12ab\n' },
+    ];
+    const preview = await dan('POST', '/api/me/contacts/import', { files });
+    expect(preview.json()).toEqual({
+      committed: false,
+      added: 3,
+      duplicates: 2,
+      noNumber: 2,
+      errors: ['Carl: "12ab" isn\'t a phone number, left out'],
+    });
+    expect((await dan('GET', '/api/me/contacts')).json().items).toHaveLength(2);
+    const saved = await dan('POST', '/api/me/contacts/import?commit=1', { files });
+    expect(saved.json()).toMatchObject({ committed: true, added: 3, duplicates: 2 });
+    expect((await dan('POST', '/api/me/contacts/import?commit=1', { files })).json()).toMatchObject(
+      {
+        added: 0,
+        duplicates: 5,
+      },
+    );
+    // An admin imports into the company book.
+    const co = await admin('POST', '/api/contacts/import?commit=1', {
+      files: [{ name: 'co.vcf', text: vcf('Plumber', '3125557777') }],
+    });
+    expect(co.json()).toMatchObject({ added: 1 });
+    expect(
+      (await sue('GET', '/api/me/contacts')).json().items.map((c: { name: string }) => c.name),
+    ).toEqual(['Pizza Place', 'Plumber']);
+  });
+
+  it('sharing offers a copy; nothing lands until Accept, Deny adds nothing', async () => {
+    const book = (await dan('GET', '/api/me/contacts')).json().items as {
+      id: string;
+      name: string;
+      book: string;
+    }[];
+    const jane = book.find((c) => c.name === 'Jane Doe')!;
+    const bob = book.find((c) => c.name === 'Bob Smith')!;
+    expect(
+      (
+        await dan('POST', '/api/me/contacts/share', {
+          contactIds: [book.find((c) => c.book === 'company')!.id],
+          everyone: true,
+        })
+      ).statusCode,
+    ).toBe(404); // not Dan's to share
+    const r = await dan('POST', '/api/me/contacts/share', {
+      contactIds: [jane.id, bob.id],
+      extensions: ['102'],
+    });
+    expect(r.json()).toEqual({ offers: 2, people: 1 });
+    // Shared again: still one offer per contact.
+    await dan('POST', '/api/me/contacts/share', { contactIds: [jane.id, bob.id], everyone: true });
+
+    const before = (await sue('GET', '/api/me/contacts')).json().items.length;
+    const offers = (await sue('GET', '/api/me/contacts/shares')).json().items as {
+      id: string;
+      from: { name: string };
+      contact: { name: string };
+    }[];
+    expect(offers.map((o) => [o.from.name, o.contact.name]).sort()).toEqual([
+      ['dan@example.com', 'Bob Smith'],
+      ['dan@example.com', 'Jane Doe'],
+    ]);
+    expect((await sue('GET', '/api/me/contacts')).json().items).toHaveLength(before);
+
+    const janeOffer = offers.find((o) => o.contact.name === 'Jane Doe')!;
+    const bobOffer = offers.find((o) => o.contact.name === 'Bob Smith')!;
+    expect(
+      (await sue('POST', '/api/me/contacts/shares/deny', { ids: [bobOffer.id] })).json(),
+    ).toEqual({ denied: 1 });
+    expect(
+      (await sue('POST', '/api/me/contacts/shares/accept', { ids: [janeOffer.id] })).json(),
+    ).toEqual({
+      added: 1,
+      duplicates: 0,
+    });
+    // Decided offers can't be decided again, or by someone else.
+    expect(
+      (await sue('POST', '/api/me/contacts/shares/accept', { ids: [bobOffer.id] })).json(),
+    ).toEqual({
+      added: 0,
+      duplicates: 0,
+    });
+    const names = (await sue('GET', '/api/me/contacts'))
+      .json()
+      .items.map((c: { name: string }) => c.name);
+    expect(names).toContain('Jane Doe');
+    expect(names).not.toContain('Bob Smith');
+    expect((await sue('GET', '/api/me/contacts/shares')).json().items).toEqual([]);
+    // The copy is Sue's own: Dan editing his doesn't change it.
+    await dan('PATCH', `/api/me/contacts/${jane.id}`, { name: 'Jane D.', numbers: [] });
+    expect(
+      (await sue('GET', '/api/me/contacts')).json().items.map((c: { name: string }) => c.name),
+    ).toContain('Jane Doe');
+  });
+
+  it('looks up names: my book first, then the company', async () => {
+    await admin('POST', '/api/contacts', {
+      name: 'Front desk',
+      numbers: [{ number: '3125551234' }],
+    });
+    await dan('POST', '/api/me/contacts', { name: 'My Jane', numbers: [{ number: '3125551234' }] });
+    const names = await contactNames(t.db, danId, [
+      '13125551234',
+      '13125550000',
+      '19995550000',
+      null,
+    ]);
+    expect(Object.fromEntries(names)).toEqual({
+      '13125551234': 'My Jane',
+      '13125550000': 'Pizza Place',
+    });
+    const company = await contactNames(t.db, null, ['13125551234']);
+    expect(company.get('13125551234')).toBe('Front desk');
+  });
+});

apps/api/test/schema.test.ts

@@ -111,11 +111,11 @@ describe.skipIf(!hasTestDb)('schema matches spec 02', () => {
   beforeAll(async () => ({ db, drop } = await createTestDb()));
   afterAll(() => drop?.());
 
-  it('creates all 41 tables', async () => {
+  it('creates all 42 tables', async () => {
     const r = await db.execute(
       sql`select count(*)::int as n from information_schema.tables where table_schema = 'public'`,
     );
-    expect(r.rows[0]).toEqual({ n: 41 });
+    expect(r.rows[0]).toEqual({ n: 42 });
   });
 
   it.each(Object.keys(EXPECTED))('%s columns', async (table) => {