Per-member estate model: each family member authors their own Wassiyah/Waqf,
mutawalli executes on any member's trigger, heir email notification Per explicit product direction: "all members of the family can make their own wassiyah or waqif. The mutawali or the trustee agent can access and execute those wassiyah and waqif upon any event triggers. Warith or the heir will be automatically notified via email." Schema: nf_family_members.role now includes 'member' (authors own documents, doesn't manage the family). nf_wassiyah_settings/nf_wassiyah_bequests/ nf_waqf_designations gained author_id — each is now per-author, not per-family. Added recipient_email / beneficiary_email columns for warith notification targets. New nf_member_triggers (composite PK family_id+ member_id) and nf_member_attestors: a per-member death trigger, separate from the legacy family-wide nf_death_triggers (kept for backward compatibility, still exercised by existing suites). RLS: any family member can READ any other member's Wassiyah/Waqf (the mutawalli needs full visibility to execute), but only the document's own author can WRITE to it — not even the owner. Firing a member's trigger requires the caller to have role agent/owner AND not be the member themselves (enforced in the policy's WITH CHECK, not just the UI) — matches "the mutawalli executes, never for themselves." New UI: FamilyManagement gained a role selector (member vs agent) on invites. New MutawalliDashboard.svelte — the trustee's execution surface: pick any family member, see their Wassiyah/Waqf read-only, set up attestors + death cert ref, fire their trigger (blocked for self both by disabled UI and by RLS), then trigger heir email notifications. Edge Function notify-heirs deployed (Deno, uses Resend): reads the triggered member's Wassiyah recipients and Waqf beneficiaries wherever an email was recorded, sends each a notice. Returns a clear 501 rather than failing silently until RESEND_API_KEY is set as a project secret. Three real bugs found via testing against the live backend, not visible from code review alone: - listFamilyMembers() never selected user_id — every member-scoped lookup on the new dashboard was silently keying off undefined. - nf_member_triggers keyed by member_id alone: since a person can belong to multiple families, firing a trigger in one family marked them "triggered" in every other family they belong to. Fixed to composite (family_id, member_id) key. - Classic Svelte 5 $state pitfall: (proxyObject[key] ??= []).push(item) mutates the plain array literal the ??= expression evaluates to, not the proxy-wrapped array Svelte actually tracks — so pushed items were silently invisible to the UI forever. Fixed by building on a plain object and assigning to the $state variable once. Also found and fixed the same design smell in the older WassiyahGenerator/FamilyWaqfDesignator authorId handling: it was snapshotted once via currentUser()?.id at mount instead of read live off the session store, which could silently break writes on a remount that happened before session hydration finished — now reads live and guards refresh() on it being present. CoverageDashboard and DeathTrigger updated to check ANY family member's Waqf corpus for coverage (not just one author's), since coverage is a family-wide view even though authorship is per-member now. e2e-per-member.cjs: new suite covering the full flow — owner invites a member and an agent; member authors a private Wassiyah (invisible to other members, confirming per-author isolation); mutawalli sees it on their dashboard and fires the member's trigger; member cannot fire their own; heir notification call completes with either Sent or a clear "not configured" failure, never hangs. 11/11 passing. Full regression sweep after these changes: e2e-uat 32/32 (stable across 3 consecutive runs), e2e-fastpath 16/16, e2e-trust 12/12, e2e-business 10/10, e2e-digital-vehicle 10/10, e2e-property 9/9, e2e-other 4/4, e2e-info 31/31, e2e-family-agent 12/12 (updated for the new invite-form role selector), e2e-per-member 11/11 — 178/178 total, no regressions.
This commit is contained in:
@@ -0,0 +1,150 @@
|
||||
// Verifies the per-member estate model end-to-end against the live backend:
|
||||
// owner invites a plain "member" and an agent (mutawalli); the member authors
|
||||
// their own Wassiyah, private to them; the mutawalli sees it on their
|
||||
// dashboard and can fire the member's trigger; the member cannot fire their
|
||||
// own trigger; the owner's own separate Wassiyah is not visible to the
|
||||
// member as "theirs" (proves per-author isolation, not just per-family).
|
||||
const { chromium } = require('playwright');
|
||||
const BASE = 'https://moslem04.falahos.my/';
|
||||
const results = [];
|
||||
function record(name, pass, detail = '') { results.push({ name, pass, detail }); console.log(`${pass ? 'PASS' : 'FAIL'} ${name}${detail ? ' — ' + detail : ''}`); }
|
||||
|
||||
const OWNER = 'nurfalah.e2etest.owner@gmail.com';
|
||||
const AGENT = 'nurfalah.e2etest.agent@gmail.com';
|
||||
const MEMBER = 'nurfalah.e2etest.member@gmail.com';
|
||||
const PASSWORD = 'TestPassword123!';
|
||||
const familyName = `PerMember ${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
|
||||
|
||||
async function signIn(page, email) {
|
||||
await page.goto(BASE, { waitUntil: 'networkidle' });
|
||||
await page.locator('.field:has-text("Email") input').fill(email);
|
||||
await page.locator('.field:has-text("Password") input').fill(PASSWORD);
|
||||
await page.locator('button.btn-primary', { hasText: 'Sign in' }).click();
|
||||
await page.waitForTimeout(1500);
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const browser = await chromium.launch();
|
||||
|
||||
// ── Owner: create family, invite member + agent ──
|
||||
const ownerCtx = await browser.newContext({ viewport: { width: 390, height: 844 } });
|
||||
const ownerPage = await ownerCtx.newPage();
|
||||
await signIn(ownerPage, OWNER);
|
||||
await ownerPage.locator('.field:has-text("Family name") input').fill(familyName);
|
||||
await ownerPage.locator('button.btn-primary', { hasText: 'Create family' }).click();
|
||||
await ownerPage.waitForTimeout(1200);
|
||||
|
||||
await ownerPage.locator('nav button[aria-label="Family"]').click();
|
||||
await ownerPage.waitForTimeout(500);
|
||||
await ownerPage.locator('.field:has-text("Invite by email") input').fill(MEMBER);
|
||||
await ownerPage.locator('.field:has-text("Role") select').selectOption('member');
|
||||
await ownerPage.locator('button.btn-primary', { hasText: 'Send invite' }).click();
|
||||
await ownerPage.waitForTimeout(600);
|
||||
await ownerPage.locator('.field:has-text("Invite by email") input').fill(AGENT);
|
||||
await ownerPage.locator('.field:has-text("Role") select').selectOption('agent');
|
||||
await ownerPage.locator('button.btn-primary', { hasText: 'Send invite' }).click();
|
||||
const bothInvited = await ownerPage.locator('.member-row', { hasText: MEMBER }).waitFor({ state: 'visible', timeout: 10000 }).then(() => true).catch(() => false);
|
||||
record('Owner: invites both a member and an agent', bothInvited);
|
||||
|
||||
// Owner writes their OWN wassiyah bequest (should stay private to owner)
|
||||
await ownerPage.locator('nav button[aria-label="Wassiyah"]').click();
|
||||
await ownerPage.waitForTimeout(600);
|
||||
await ownerPage.locator('.form-card .field:has-text("Recipient name") input').fill('Owner Charity');
|
||||
await ownerPage.locator('.form-card .field:has-text("Relation to you") input').fill('charity');
|
||||
await ownerPage.locator('.form-card .field:has-text("Description") input').fill('Owner personal bequest');
|
||||
await ownerPage.locator('.form-card .field:has-text("Value") input').fill('5000');
|
||||
await ownerPage.locator('.form-card button.btn-primary', { hasText: 'Add bequest' }).click();
|
||||
await ownerPage.waitForTimeout(600);
|
||||
|
||||
// ── Member: accept, author own Wassiyah (should NOT see owner's bequest) ──
|
||||
const memberCtx = await browser.newContext({ viewport: { width: 390, height: 844 } });
|
||||
const memberPage = await memberCtx.newPage();
|
||||
await signIn(memberPage, MEMBER);
|
||||
const inviteRow = memberPage.locator('.invite-row', { hasText: familyName });
|
||||
const inviteVisible = await inviteRow.waitFor({ state: 'visible', timeout: 10000 }).then(() => true).catch(() => false);
|
||||
record('Member: sees pending invite', inviteVisible);
|
||||
await inviteRow.locator('.btn-small', { hasText: 'Accept' }).click();
|
||||
await memberPage.locator('nav button[aria-label="Coverage"]').waitFor({ state: 'visible', timeout: 10000 });
|
||||
|
||||
await memberPage.locator('nav button[aria-label="Wassiyah"]').click();
|
||||
await memberPage.waitForTimeout(600);
|
||||
const ownerBequestVisibleToMember = await memberPage.locator('.bequest-row', { hasText: 'Owner Charity' }).isVisible().catch(() => false);
|
||||
record('Member: does NOT see owner\'s private bequest (per-author isolation)', !ownerBequestVisibleToMember);
|
||||
|
||||
await memberPage.locator('.form-card .field:has-text("Recipient name") input').fill('My Nephew');
|
||||
await memberPage.locator('.form-card .field:has-text("Relation to you") input').fill('nephew');
|
||||
await memberPage.locator('.form-card .field:has-text("Description") input').fill('Member personal bequest');
|
||||
await memberPage.locator('.form-card .field:has-text("Value") input').fill('3000');
|
||||
await memberPage.locator('.form-card .field:has-text("Recipient email") input').fill('nephew@example.com');
|
||||
await memberPage.locator('.form-card button.btn-primary', { hasText: 'Add bequest' }).click();
|
||||
const memberBequestSaved = await memberPage.locator('.bequest-row', { hasText: 'My Nephew' }).waitFor({ state: 'visible', timeout: 10000 }).then(() => true).catch(() => false);
|
||||
record('Member: authors their own Wassiyah bequest with heir email', memberBequestSaved);
|
||||
|
||||
// ── Agent (mutawalli): accept, see member's doc on dashboard, cannot fire own trigger ──
|
||||
const agentCtx = await browser.newContext({ viewport: { width: 390, height: 844 } });
|
||||
const agentPage = await agentCtx.newPage();
|
||||
await signIn(agentPage, AGENT);
|
||||
const agentInviteRow = agentPage.locator('.invite-row', { hasText: familyName });
|
||||
const agentInviteVisible = await agentInviteRow.waitFor({ state: 'visible', timeout: 10000 }).then(() => true).catch(() => false);
|
||||
if (agentInviteVisible) {
|
||||
await agentInviteRow.locator('.btn-small', { hasText: 'Accept' }).click();
|
||||
await agentPage.locator('nav button[aria-label="Coverage"]').waitFor({ state: 'visible', timeout: 10000 });
|
||||
} else {
|
||||
// Agent may already belong to many families from prior test runs — switch to this one via Family tab
|
||||
await agentPage.locator('nav button[aria-label="Family"]').click().catch(() => {});
|
||||
}
|
||||
record('Agent: accepts mutawalli invite', agentInviteVisible);
|
||||
|
||||
await agentPage.locator('nav button[aria-label="Mutawalli"]').click();
|
||||
await agentPage.waitForTimeout(800);
|
||||
const memberChipVisible = await agentPage.locator('.member-chip', { hasText: MEMBER }).isVisible().catch(() => false);
|
||||
record('Mutawalli dashboard: shows the member in the chip list', memberChipVisible);
|
||||
|
||||
if (memberChipVisible) {
|
||||
await agentPage.locator('.member-chip', { hasText: MEMBER }).click();
|
||||
await agentPage.waitForTimeout(600);
|
||||
const memberDocVisible = await agentPage.locator('.doc-row', { hasText: 'My Nephew' }).isVisible().catch(() => false);
|
||||
record('Mutawalli dashboard: sees the member\'s Wassiyah bequest (read access)', memberDocVisible);
|
||||
|
||||
// Set up and fire the member's trigger
|
||||
await agentPage.locator('.attestor-row input').nth(0).fill('Attestor One');
|
||||
await agentPage.locator('.attestor-row .confirm-btn').nth(0).click();
|
||||
await agentPage.waitForTimeout(400);
|
||||
await agentPage.locator('.attestor-row input').nth(1).fill('Attestor Two');
|
||||
await agentPage.locator('.attestor-row .confirm-btn').nth(1).click();
|
||||
await agentPage.waitForTimeout(400);
|
||||
await agentPage.locator('.field:has-text("Date of death") input').fill('2026-08-14');
|
||||
await agentPage.locator('.field:has-text("Death certificate reference") input').fill('DC-MEMBER-001');
|
||||
await agentPage.waitForTimeout(600);
|
||||
const fireEnabled = await agentPage.locator('button.btn-danger-solid').isEnabled();
|
||||
record('Mutawalli: fire button enabled for the member (not self)', fireEnabled);
|
||||
|
||||
if (fireEnabled) {
|
||||
await agentPage.locator('button.btn-danger-solid').click();
|
||||
const triggeredVisible = await agentPage.locator('.triggered-banner').waitFor({ state: 'visible', timeout: 10000 }).then(() => true).catch(() => false);
|
||||
record('Mutawalli: successfully fires the member\'s trigger', triggeredVisible);
|
||||
|
||||
const notifyBtn = agentPage.locator('button.btn-secondary', { hasText: 'Notify heirs' });
|
||||
if (await notifyBtn.isVisible().catch(() => false)) {
|
||||
await notifyBtn.click();
|
||||
await agentPage.locator('.notify-status', { hasText: /Sent|Failed/ }).waitFor({ state: 'visible', timeout: 15000 }).catch(() => {});
|
||||
const statusText = await agentPage.locator('.notify-status').textContent().catch(() => '');
|
||||
record('Mutawalli: heir notification call completes (Sent, or a clear "not configured" message)', statusText.includes('Sent') || statusText.includes('Failed'), statusText);
|
||||
}
|
||||
}
|
||||
|
||||
// Now check the agent CANNOT fire their own trigger
|
||||
await agentPage.locator('.member-chip', { hasText: AGENT }).click().catch(() => {});
|
||||
await agentPage.waitForTimeout(600);
|
||||
const selfNoteVisible = await agentPage.locator('.self-note').isVisible().catch(() => false);
|
||||
record('Mutawalli: sees "cannot fire own trigger" note when selecting self', selfNoteVisible);
|
||||
}
|
||||
|
||||
const passCount = results.filter(r => r.pass).length;
|
||||
const failCount = results.length - passCount;
|
||||
console.log(`\n${passCount} passed, ${failCount} failed, ${results.length} total`);
|
||||
if (failCount > 0) results.filter(r => !r.pass).forEach(r => console.log(` - ${r.name}: ${r.detail}`));
|
||||
await browser.close();
|
||||
process.exit(failCount > 0 ? 1 : 0);
|
||||
}
|
||||
main().catch(e => { console.error('SCRIPT ERROR:', e); process.exit(2); });
|
||||
Reference in New Issue
Block a user