feat: enforce organization-only access for all recordings

apps/web/__tests__/unit/mobile-cap-summary.test.ts

@@ -0,0 +1,87 @@
+import { User, Video } from "@cap/web-domain";
+import { describe, expect, it } from "vitest";
+import {
+	type MobileCapRow,
+	toMobileCapSummary,
+} from "@/lib/mobile-cap-summary";
+
+const row: MobileCapRow = {
+	id: Video.VideoId.make("example-video"),
+	ownerId: User.UserId.make("example-owner"),
+	ownerPreferences: null,
+	name: "Team update",
+	createdAt: new Date("2024-01-01"),
+	updatedAt: new Date("2024-01-02"),
+	ownerName: "Example Owner",
+	duration: 12,
+	folderId: null,
+	public: true,
+	videoSharingRestrictedToOrg: false,
+	hasPassword: false,
+	hasInheritedPassword: false,
+	commentCount: 0,
+	reactionCount: 0,
+	uploadVideoId: null,
+	uploadUploaded: null,
+	uploadTotal: null,
+	uploadPhase: null,
+	processingProgress: null,
+	processingMessage: null,
+	processingError: null,
+	metadata: null,
+	transcriptionStatus: "COMPLETE",
+};
+const member = User.UserId.make("example-member");
+const summarize = (overrides: Partial<MobileCapRow>, viewer = member) =>
+	toMobileCapSummary(
+		{ ...row, ...overrides },
+		0,
+		"https://example.invalid",
+		viewer,
+	);
+
+describe("mobile recording sharing indicators", () => {
+	it.each([
+		{ hasPassword: true },
+		{ hasInheritedPassword: true },
+		{ hasPassword: true, hasInheritedPassword: true },
+	])(
+		"overrides saved password flags for organization-only recordings",
+		(saved) => {
+			const summary = summarize({
+				...saved,
+				videoSharingRestrictedToOrg: true,
+			});
+			expect(summary.public).toBe(false);
+			expect(summary.protected).toBe(false);
+			expect(summary.thumbnailUrl).toContain(`/caps/${row.id}/thumbnail`);
+			expect(summary.thumbnailCacheKey).not.toBeNull();
+		},
+	);
+
+	it.each([{ hasPassword: true }, { hasInheritedPassword: true }])(
+		"restores saved protection when organization-only access is disabled",
+		(saved) => {
+			const summary = summarize(saved);
+			expect(summary.public).toBe(true);
+			expect(summary.protected).toBe(true);
+			expect(summary.thumbnailUrl).toBeNull();
+		},
+	);
+
+	it("preserves owner thumbnails for normal password-protected recordings", () => {
+		expect(
+			summarize({ hasPassword: true }, row.ownerId).thumbnailUrl,
+		).not.toBeNull();
+	});
+
+	it("keeps in-progress upload thumbnails hidden under the organization policy", () => {
+		const summary = summarize({
+			videoSharingRestrictedToOrg: true,
+			uploadVideoId: row.id,
+			uploadPhase: "uploading",
+		});
+		expect(summary.thumbnailUrl).toBeNull();
+		expect(summary.upload?.phase).toBe("uploading");
+	});
+});

apps/web/__tests__/unit/og-images.test.ts

@@ -85,19 +85,17 @@ describe("/api/og", () => {
 });
 
 describe("video og", () => {
-	it("renders the video layout with caching headers", async () => {
+	it("renders video previews without caching access-sensitive content", async () => {
 		const res = await renderVideoOg({
 			kind: "video",
 			video: {
 				title: "Cap walkthrough",
-				ownerName: "Richie",
+				ownerName: "Example Owner",
 				duration: 204,
 			},
 		});
 		expect(res.status).toBe(200);
-		expect(res.headers.get("cache-control")).toContain(
-			"stale-while-revalidate",
-		);
+		expect(res.headers.get("cache-control")).toContain("no-store");
 		const { width, height } = pngSize(Buffer.from(await res.arrayBuffer()));
 		expect(width).toBe(1200);
 		expect(height).toBe(630);

apps/web/__tests__/unit/organization-video-sharing.test.ts

@@ -0,0 +1,131 @@
+import { Organisation, User } from "@cap/web-domain";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { updateOrganizationVideoSharing } from "@/actions/organization/default-video-visibility";
+
+const mocks = vi.hoisted(() => ({
+	user: vi.fn(),
+	access: vi.fn(),
+	set: vi.fn(),
+	where: vi.fn(),
+	revalidate: vi.fn(),
+}));
+
+vi.mock("@cap/database/auth/session", () => ({ getCurrentUser: mocks.user }));
+vi.mock("next/cache", () => ({ revalidatePath: mocks.revalidate }));
+vi.mock("@cap/database", () => ({
+	db: () => ({
+		select: () => ({
+			from: () => ({
+				leftJoin: () => ({ where: () => ({ limit: mocks.access }) }),
+			}),
+		}),
+		update: () => ({ set: mocks.set }),
+	}),
+}));
+
+const userId = User.UserId.make("fixture-user");
+const organizationId = Organisation.OrganisationId.make("fixture-org");
+
+describe("organization-only sharing settings", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		mocks.user.mockResolvedValue({
+			id: userId,
+			activeOrganizationId: organizationId,
+		});
+		mocks.access.mockResolvedValue([
+			{
+				id: organizationId,
+				ownerId: userId,
+				memberId: "fixture-member",
+				memberRole: "owner",
+			},
+		]);
+		mocks.set.mockReturnValue({ where: mocks.where });
+		mocks.where.mockResolvedValue(undefined);
+	});
+
+	it.each([true, false])(
+		"lets the owner set the lock to %s without rewriting videos",
+		async (restricted) => {
+			await expect(
+				updateOrganizationVideoSharing(organizationId, restricted),
+			).resolves.toEqual({ success: true });
+			expect(mocks.set).toHaveBeenCalledExactlyOnceWith({
+				videoSharingRestrictedToOrg: restricted,
+			});
+			expect(mocks.revalidate).toHaveBeenCalledWith("/s/[videoId]", "page");
+			expect(mocks.revalidate).toHaveBeenCalledWith("/embed/[videoId]", "page");
+		},
+	);
+
+	it("lets organization admins manage the lock", async () => {
+		mocks.access.mockResolvedValue([
+			{
+				id: organizationId,
+				ownerId: "other-owner",
+				memberId: "fixture-member",
+				memberRole: "admin",
+			},
+		]);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, true),
+		).resolves.toEqual({
+			success: true,
+		});
+	});
+
+	it("keeps the displayed organization when another tab switches context", async () => {
+		mocks.user.mockResolvedValue({
+			id: userId,
+			activeOrganizationId: "other-org",
+		});
+		await expect(
+			updateOrganizationVideoSharing(organizationId, true),
+		).resolves.toEqual({ success: true });
+		expect(mocks.set).toHaveBeenCalledExactlyOnceWith({
+			videoSharingRestrictedToOrg: true,
+		});
+	});
+
+	it("denies ordinary members", async () => {
+		mocks.access.mockResolvedValue([
+			{
+				id: organizationId,
+				ownerId: "other-owner",
+				memberId: "fixture-member",
+				memberRole: "member",
+			},
+		]);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, false),
+		).rejects.toThrow("only available to admins and owners");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+
+	it("denies users without organization access", async () => {
+		mocks.access.mockResolvedValue([]);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, false),
+		).rejects.toThrow("Forbidden");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+
+	it("requires sign-in", async () => {
+		mocks.user.mockResolvedValue(null);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, true),
+		).rejects.toThrow("Unauthorized");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+
+	it("validates direct action inputs", async () => {
+		await expect(
+			updateOrganizationVideoSharing(
+				organizationId,
+				"true" as unknown as boolean,
+			),
+		).rejects.toThrow("Invalid sharing setting");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+});