Add user and employee management enhancements with database schema updates

- Introduced new columns `status`, `created_by`, and `updated_by` in the `users` table to track user status and ownership.
- Updated the `employees` table to include a foreign key reference to the `users` table via `user_id`.
- Created migration script `0012_users_primary.sql` to apply these changes to the database schema.
- Enhanced the `EmployeesService` and `EmployeesRepository` to support user assignments and related data retrieval.
- Updated DTOs and service methods to reflect the new user and employee relationships.
- Added unit tests to validate the new functionality and ensure data integrity.
- Modified existing controllers to accommodate the new fields and relationships in user and employee management.

test/auth.e2e-spec.ts

@@ -4,9 +4,12 @@ import request from 'supertest';
 import { App } from 'supertest/types';
 import { AppModule } from '../src/app.module';
 import { configureApp } from '../src/common/configure-app';
+import { DRIZZLE, type DrizzleDB } from '../src/database/database.module';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Auth (e2e)', () => {
   let app: INestApplication<App>;
+  let db: DrizzleDB;
 
   const username = `user_${Date.now()}`;
   const password = 'password123';
@@ -22,6 +25,7 @@ describe('Auth (e2e)', () => {
       SWAGGER_ENABLED: 'false',
     });
     await app.init();
+    db = app.get(DRIZZLE);
   });
 
   afterAll(async () => {
@@ -39,30 +43,37 @@ describe('Auth (e2e)', () => {
     await request(app.getHttpServer()).get('/auth/me').expect(401);
   });
 
-  it('register → me → refresh → revoke → me 401', async () => {
+  it('register creates a draft user without tokens; login works after activate', async () => {
     const register = await request(app.getHttpServer())
       .post('/auth/register')
       .send({ username, password })
       .expect(201);
 
-    const { accessToken, refreshToken } = register.body as {
-      accessToken: string;
-      refreshToken: string;
-    };
-    expect(accessToken).toBeDefined();
-    expect(refreshToken).toHaveLength(64);
-    expect(Object.keys(register.body).sort()).toEqual([
-      'accessToken',
-      'refreshToken',
-    ]);
+    expect(register.body).toMatchObject({
+      username: username.toLowerCase(),
+      status: 'draft',
+    });
+    expect(register.body).not.toHaveProperty('accessToken');
+
+    await request(app.getHttpServer())
+      .post('/auth/login')
+      .send({ username, password })
+      .expect(401);
+
+    const activated = await registerAndActivate(
+      app,
+      db,
+      `${username}_active`,
+      password,
+    );
 
     const me = await request(app.getHttpServer())
       .get('/auth/me')
-      .set('Authorization', `Bearer ${accessToken}`)
+      .set('Authorization', `Bearer ${activated.accessToken}`)
       .expect(200);
 
     expect(me.body).toMatchObject({
-      username: username.toLowerCase(),
+      username: `${username}_active`.toLowerCase(),
       isSuperadmin: false,
       privilege: null,
       permissions: {},
@@ -70,7 +81,7 @@ describe('Auth (e2e)', () => {
 
     const refreshed = await request(app.getHttpServer())
       .post('/auth/refresh')
-      .send({ refreshToken })
+      .send({ refreshToken: activated.refreshToken })
       .expect(200);
 
     const { accessToken: nextAccess, refreshToken: nextRefresh } =

test/branches.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Branches (e2e)', () => {
   let app: INestApplication<App>;
@@ -53,23 +54,12 @@ describe('Branches (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/company-settings.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Company settings (e2e)', () => {
   let app: INestApplication<App>;
@@ -39,23 +40,12 @@ describe('Company settings (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/customers.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Customers (e2e)', () => {
   let app: INestApplication<App>;
@@ -46,23 +47,12 @@ describe('Customers (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/cycles.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Cycles (e2e)', () => {
   let app: INestApplication<App>;
@@ -43,23 +44,12 @@ describe('Cycles (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/divisions.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Divisions (e2e)', () => {
   let app: INestApplication<App>;
@@ -39,23 +40,12 @@ describe('Divisions (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/employees.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Employees (e2e)', () => {
   let app: INestApplication<App>;
@@ -46,23 +47,12 @@ describe('Employees (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/helpers/activate-user.ts

@@ -0,0 +1,40 @@
+import { INestApplication } from '@nestjs/common';
+import { eq } from 'drizzle-orm';
+import request from 'supertest';
+import { users } from '../../src/database/schema';
+import type { DrizzleDB } from '../../src/database/database.module';
+
+export async function registerAndActivate(
+  app: INestApplication,
+  db: DrizzleDB,
+  username: string,
+  password: string,
+): Promise<{ accessToken: string; refreshToken: string; userId: string }> {
+  const register = await request(app.getHttpServer())
+    .post('/auth/register')
+    .send({ username, password });
+  if (register.status !== 201) {
+    throw new Error(
+      `register failed ${register.status} ${JSON.stringify(register.body)}`,
+    );
+  }
+  const userId = (register.body as { id: string }).id;
+  await db
+    .update(users)
+    .set({ status: 'active' })
+    .where(eq(users.id, userId));
+  const login = await request(app.getHttpServer())
+    .post('/auth/login')
+    .send({ username, password });
+  if (login.status !== 200) {
+    throw new Error(
+      `login failed ${login.status} ${JSON.stringify(login.body)}`,
+    );
+  }
+  const tokens = login.body as { accessToken: string; refreshToken: string };
+  return {
+    userId,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+  };
+}

test/packing-slips.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Packing slips (e2e)', () => {
   let app: INestApplication<App>;
@@ -34,21 +35,21 @@ describe('Packing slips (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: `ps_admin_${suffix}`, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    const adminUserId = (adminMe.body as { id: string }).id;
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: `ps_other_${suffix}`, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(
+      app,
+      db,
+      `ps_admin_${suffix}`,
+      password,
+    );
+    adminAccessToken = admin.accessToken;
+    const adminUserId = admin.userId;
+    const other = await registerAndActivate(
+      app,
+      db,
+      `ps_other_${suffix}`,
+      password,
+    );
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/plans.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Plans (e2e)', () => {
   let app: INestApplication<App>;
@@ -45,23 +46,12 @@ describe('Plans (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/privileges.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   privileges,
   users,
 } from '../src/database/schema';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Privileges (e2e)', () => {
   let app: INestApplication<App>;
@@ -41,27 +42,20 @@ describe('Privileges (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
-
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
     const adminMe = await request(app.getHttpServer())
       .get('/auth/me')
       .set('Authorization', `Bearer ${adminAccessToken}`)
       .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
     expect(adminMe.body).toMatchObject({
       privilege: null,
       permissions: {},
     });
 
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
     const otherMe = await request(app.getHttpServer())
       .get('/auth/me')
       .set('Authorization', `Bearer ${otherAccessToken}`)

test/products.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Products (e2e)', () => {
   let app: INestApplication<App>;
@@ -47,23 +48,12 @@ describe('Products (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: adminUsername, password })
-      .expect(201);
-    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
 
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${adminAccessToken}`)
-      .expect(200);
-    adminUserId = (adminMe.body as { id: string }).id;
-
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: otherUsername, password })
-      .expect(201);
-    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/sales-invoices.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Sales invoices (e2e)', () => {
   let app: INestApplication<App>;
@@ -37,21 +38,21 @@ describe('Sales invoices (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: `si_admin_${suffix}`, password })
-      .expect(201);
-    token = (adminReg.body as { accessToken: string }).accessToken;
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${token}`)
-      .expect(200);
-    const adminUserId = (adminMe.body as { id: string }).id;
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: `si_other_${suffix}`, password })
-      .expect(201);
-    otherToken = (otherReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(
+      app,
+      db,
+      `si_admin_${suffix}`,
+      password,
+    );
+    token = admin.accessToken;
+    const adminUserId = admin.userId;
+    const other = await registerAndActivate(
+      app,
+      db,
+      `si_other_${suffix}`,
+      password,
+    );
+    otherToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/sales-payments.e2e-spec.ts

@@ -13,6 +13,7 @@ import {
   users,
 } from '../src/database/schema';
 import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
 
 describe('Sales payments (e2e)', () => {
   let app: INestApplication<App>;
@@ -33,21 +34,21 @@ describe('Sales payments (e2e)', () => {
     await app.init();
     db = app.get(DRIZZLE);
 
-    const adminReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: `sp_admin_${suffix}`, password })
-      .expect(201);
-    token = (adminReg.body as { accessToken: string }).accessToken;
-    const adminMe = await request(app.getHttpServer())
-      .get('/auth/me')
-      .set('Authorization', `Bearer ${token}`)
-      .expect(200);
-    const adminUserId = (adminMe.body as { id: string }).id;
-    const otherReg = await request(app.getHttpServer())
-      .post('/auth/register')
-      .send({ username: `sp_other_${suffix}`, password })
-      .expect(201);
-    otherToken = (otherReg.body as { accessToken: string }).accessToken;
+    const admin = await registerAndActivate(
+      app,
+      db,
+      `sp_admin_${suffix}`,
+      password,
+    );
+    token = admin.accessToken;
+    const adminUserId = admin.userId;
+    const other = await registerAndActivate(
+      app,
+      db,
+      `sp_other_${suffix}`,
+      password,
+    );
+    otherToken = other.accessToken;
 
     const now = Date.now();
     const [priv] = await db

test/users.e2e-spec.ts

@@ -0,0 +1,158 @@
+import { INestApplication } from '@nestjs/common';
+import { Test, TestingModule } from '@nestjs/testing';
+import { eq } from 'drizzle-orm';
+import request from 'supertest';
+import { App } from 'supertest/types';
+import { AppModule } from '../src/app.module';
+import { configureApp } from '../src/common/configure-app';
+import { DRIZZLE, type DrizzleDB } from '../src/database/database.module';
+import {
+  privilegeDetails,
+  privilegeKeys,
+  privileges,
+  users,
+} from '../src/database/schema';
+import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
+
+describe('Users (e2e)', () => {
+  let app: INestApplication<App>;
+  let db: DrizzleDB;
+
+  const password = 'password123';
+  const adminUsername = `usr_admin_${Date.now()}`;
+  const otherUsername = `usr_other_${Date.now()}`;
+
+  let adminAccessToken: string;
+  let adminUserId: string;
+  let otherAccessToken: string;
+
+  beforeAll(async () => {
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    configureApp(app, {
+      NODE_ENV: 'test',
+      SWAGGER_ENABLED: 'false',
+    });
+    await app.init();
+    db = app.get(DRIZZLE);
+
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
+
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
+
+    const now = Date.now();
+    const [priv] = await db
+      .insert(privileges)
+      .values({
+        name: 'User Admin',
+        code: `USR_ADMIN_${now}`,
+        status: 'active',
+        createdAt: now,
+        updatedAt: now,
+        createdBy: adminUserId,
+        updatedBy: adminUserId,
+      })
+      .returning();
+
+    const keys = await db.select().from(privilegeKeys);
+    const detailRows = keys.flatMap((key) =>
+      PRIVILEGE_ACTIONS.map((action) => ({
+        privilegeId: priv.id,
+        privilegeKeyId: key.id,
+        action,
+        value: true,
+      })),
+    );
+    await db.insert(privilegeDetails).values(detailRows);
+
+    await db
+      .update(users)
+      .set({ privilegeId: priv.id, updatedAt: Date.now() })
+      .where(eq(users.id, adminUserId));
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('forbids users list without permission', async () => {
+    await request(app.getHttpServer())
+      .get('/users')
+      .set('Authorization', `Bearer ${otherAccessToken}`)
+      .expect(403);
+  });
+
+  it('rejects unauthenticated access', async () => {
+    await request(app.getHttpServer()).get('/users').expect(401);
+  });
+
+  it('CRUD users with status, privilege, search, bulk, and import', async () => {
+    const created = await request(app.getHttpServer())
+      .post('/users')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({
+        username: `usr_${Date.now().toString().slice(-6)}`,
+        password: 'password123',
+      })
+      .expect(201);
+
+    expect(created.body).toMatchObject({
+      status: 'draft',
+      privilege: null,
+      employee: null,
+    });
+    expect(created.body).not.toHaveProperty('passwordHash');
+    const id = (created.body as { id: string }).id;
+
+    await request(app.getHttpServer())
+      .get(`/users/${id}`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .expect(200);
+
+    const listed = await request(app.getHttpServer())
+      .get('/users')
+      .query({ search: 'usr_' })
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .expect(200);
+    expect(listed.body.data.length).toBeGreaterThan(0);
+    expect(listed.body.meta).toBeDefined();
+
+    await request(app.getHttpServer())
+      .patch(`/users/${id}`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ status: 'active' })
+      .expect(400);
+
+    await request(app.getHttpServer())
+      .patch(`/users/${id}/status`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ status: 'active' })
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post('/users/bulk-status')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ ids: [id], status: 'archived' })
+      .expect(200);
+
+    const csv = `username,password\nusr_imp_${Date.now().toString().slice(-5)},password123\n`;
+    await request(app.getHttpServer())
+      .post('/users/import')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .attach('file', Buffer.from(csv, 'utf8'), 'users.csv')
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post('/users/bulk-delete')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ ids: [id] })
+      .expect(200);
+  });
+});