Merge branch 'develop' into feat/expand-idb-coverage

spec/controllers/api/v1/accounts/microsoft/authorization_controller_spec.rb

@@ -43,6 +43,7 @@ RSpec.describe 'Microsoft Authorization API', type: :request do
         ]
         expect(params['scope']).to eq(expected_scope)
         expect(params['redirect_uri']).to eq(["#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/microsoft/callback"])
+        expect(url).not_to match(/(?:\?|&)prompt=/)
 
         # Validate state parameter exists and can be decoded back to the account
         expect(params['state']).to be_present

spec/controllers/api/v1/accounts/onboardings_controller_spec.rb

@@ -0,0 +1,114 @@
+require 'rails_helper'
+
+RSpec.describe 'Onboarding API', type: :request do
+  let(:account) { create(:account, domain: 'example.com') }
+  let(:admin) { create(:user, account: account, role: :administrator) }
+
+  describe 'PATCH /api/v1/accounts/{account.id}/onboarding' do
+    context 'when unauthenticated' do
+      it 'returns unauthorized' do
+        patch "/api/v1/accounts/#{account.id}/onboarding", params: { website: 'acme.com' }, as: :json
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when authenticated as an agent (non-admin)' do
+      let(:agent) { create(:user, account: account, role: :agent) }
+
+      it 'returns unauthorized and does not change the account' do
+        patch "/api/v1/accounts/#{account.id}/onboarding",
+              params: { name: 'Hijacked', website: 'attacker.com' },
+              headers: agent.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(account.reload.name).not_to eq('Hijacked')
+      end
+
+      it 'does not create a help center portal' do
+        account.update!(custom_attributes: { 'onboarding_step' => 'account_details' })
+
+        expect do
+          patch "/api/v1/accounts/#{account.id}/onboarding",
+                params: { website: 'attacker.com' },
+                headers: agent.create_new_auth_token, as: :json
+        end.not_to change(account.portals, :count)
+      end
+    end
+
+    context 'when finalizing account_details' do
+      before { account.update!(custom_attributes: { 'onboarding_step' => 'account_details' }) }
+
+      it 'saves name and locale' do
+        patch "/api/v1/accounts/#{account.id}/onboarding",
+              params: { name: 'Acme Inc', locale: 'fr' },
+              headers: admin.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(account.reload.name).to eq('Acme Inc')
+        expect(account.locale).to eq('fr')
+      end
+
+      it 'merges custom_attributes' do
+        patch "/api/v1/accounts/#{account.id}/onboarding",
+              params: { website: 'acme.com', industry: 'tech', company_size: '10-50' },
+              headers: admin.create_new_auth_token, as: :json
+
+        attrs = account.reload.custom_attributes
+        expect(attrs['website']).to eq('acme.com')
+        expect(attrs['industry']).to eq('tech')
+        expect(attrs['company_size']).to eq('10-50')
+      end
+
+      it 'clears onboarding_step' do
+        patch "/api/v1/accounts/#{account.id}/onboarding",
+              params: { website: 'acme.com' },
+              headers: admin.create_new_auth_token, as: :json
+
+        expect(account.reload.custom_attributes).not_to have_key('onboarding_step')
+      end
+
+      it 'invokes HelpCenterCreationService when website is present', skip: 'help center generation wiring disabled until UI is ready' do
+        service = instance_double(Onboarding::HelpCenterCreationService, perform: nil)
+        allow(Onboarding::HelpCenterCreationService).to receive(:new).and_return(service)
+
+        patch "/api/v1/accounts/#{account.id}/onboarding",
+              params: { website: 'acme.com' },
+              headers: admin.create_new_auth_token, as: :json
+
+        expect(Onboarding::HelpCenterCreationService).to have_received(:new) do |arg_account, arg_user|
+          expect(arg_account.id).to eq(account.id)
+          expect(arg_user.id).to eq(admin.id)
+        end
+        expect(service).to have_received(:perform)
+      end
+
+      it 'does not create a help center portal when website is blank' do
+        expect do
+          patch "/api/v1/accounts/#{account.id}/onboarding",
+                params: { name: 'Acme Inc' },
+                headers: admin.create_new_auth_token, as: :json
+        end.not_to change(account.portals, :count)
+      end
+    end
+
+    context 'when onboarding_step is not account_details' do
+      before { account.update!(custom_attributes: { 'onboarding_step' => 'invite_team' }) }
+
+      it 'does not clear onboarding_step' do
+        patch "/api/v1/accounts/#{account.id}/onboarding",
+              params: { website: 'acme.com' },
+              headers: admin.create_new_auth_token, as: :json
+
+        expect(account.reload.custom_attributes['onboarding_step']).to eq('invite_team')
+      end
+
+      it 'does not create a help center portal' do
+        expect do
+          patch "/api/v1/accounts/#{account.id}/onboarding",
+                params: { website: 'acme.com' },
+                headers: admin.create_new_auth_token, as: :json
+        end.not_to change(account.portals, :count)
+      end
+    end
+  end
+end

spec/controllers/api/v1/accounts/portals_controller_spec.rb

@@ -173,7 +173,8 @@ RSpec.describe 'Api::V1::Accounts::Portals', type: :request do
             ],
             'default_locale' => 'en',
             'layout' => 'classic',
-            'social_profiles' => {}
+            'social_profiles' => {},
+            'locale_translations' => {}
           }
         )
       end

spec/controllers/api/v1/accounts_controller_spec.rb

@@ -302,16 +302,6 @@ RSpec.describe 'Accounts API', type: :request do
         expect(account.reload.custom_attributes['onboarding_step']).to eq('invite_team')
       end
 
-      it 'clears onboarding step when current value is account_details' do
-        account.update(custom_attributes: { onboarding_step: 'account_details' })
-        patch "/api/v1/accounts/#{account.id}",
-              params: params,
-              headers: admin.create_new_auth_token,
-              as: :json
-
-        expect(account.reload.custom_attributes).not_to have_key('onboarding_step')
-      end
-
       it 'will not update onboarding step if onboarding step is not present in account custom attributes' do
         patch "/api/v1/accounts/#{account.id}",
               params: params,

spec/controllers/microsoft/callbacks_controller_spec.rb

@@ -34,6 +34,25 @@ RSpec.describe 'Microsoft::CallbacksController', type: :request do
       expect(inbox.channel.imap_address).to eq 'outlook.office365.com'
     end
 
+    it 'sets imap_login from preferred_username when the id_token carries a UPN that differs from email' do
+      upn = 'testaccount@primary-domain.example'
+      mailbox = 'TestAccount@mailbox-domain.example'
+      response_body = {
+        id_token: JWT.encode({ email: mailbox, preferred_username: upn, name: 'test' }, nil, 'none'),
+        access_token: SecureRandom.hex(10), token_type: 'Bearer', refresh_token: SecureRandom.hex(10)
+      }
+      stub_request(:post, 'https://login.microsoftonline.com/common/oauth2/v2.0/token')
+        .with(body: { 'code' => code, 'grant_type' => 'authorization_code',
+                      'redirect_uri' => "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/microsoft/callback" })
+        .to_return(status: 200, body: response_body.to_json, headers: { 'Content-Type' => 'application/json' })
+
+      get microsoft_callback_url, params: { code: code, state: state }
+
+      channel = account.inboxes.last.channel
+      expect(channel.imap_login).to eq upn
+      expect(channel.email).to eq mailbox
+    end
+
     it 'creates updates inbox channel config if inbox exists and authentication is successful' do
       inbox = create(:channel_email, account: account, email: email)&.inbox
       expect(inbox.channel.provider_config).to eq({})