From b7611475b882e8580cdff4c779837014a4008867 Mon Sep 17 00:00:00 2001
From: Francisco de Guzman <17106076+franciszver@users.noreply.github.com>
Date: Fri, 24 Jul 2026 06:07:48 -0700
Subject: [PATCH 1/2] =?UTF-8?q?test(security):=20red=20=E2=80=94=20demo=20?=
 =?UTF-8?q?seed=20account=20is=20admin=20(#50)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Assisted-by: Claude Code (Haiku)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/prisma/seed.test.js            | 20 +++++++++++++++++++-
 server/test-utils/fakePrismaClient.js |  8 ++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/server/prisma/seed.test.js b/server/prisma/seed.test.js
index 1db208d..c7fbb5c 100644
--- a/server/prisma/seed.test.js
+++ b/server/prisma/seed.test.js
@@ -1,8 +1,10 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, beforeEach } from 'vitest';
 import { readFileSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createFakePrismaClient } from '../test-utils/fakePrismaClient.js';
+import { seed } from './seed.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const seedFilePath = path.join(__dirname, 'seed.js');
@@ -40,3 +42,19 @@ describe('seed.js guard clause', () => {
     expect(error).toBeDefined();
   });
 });
+
+describe('seed function', () => {
+  let prisma;
+
+  beforeEach(() => {
+    prisma = createFakePrismaClient();
+  });
+
+  it('should create a demo user with role "user"', async () => {
+    const { user } = await seed(prisma);
+
+    expect(user).toBeDefined();
+    expect(user.email).toBe('demo@lexforge.app');
+    expect(user.role).toBe('user');
+  });
+});
diff --git a/server/test-utils/fakePrismaClient.js b/server/test-utils/fakePrismaClient.js
index f369a4d..18de772 100644
--- a/server/test-utils/fakePrismaClient.js
+++ b/server/test-utils/fakePrismaClient.js
@@ -118,6 +118,14 @@ function createFakeModel({ uniqueFields = [] } = {}) {
       for (const record of matches) rows.delete(record.id);
       return { count: matches.length };
     },
+
+    async upsert({ where, create, update }) {
+      const existing = await this.findUnique({ where });
+      if (existing) {
+        return this.update({ where, data: update || {} });
+      }
+      return this.create({ data: create });
+    },
   };
 }
 

From 03b2d88578fe142e893b2efa90f3831a4073c8f6 Mon Sep 17 00:00:00 2001
From: Francisco de Guzman <17106076+franciszver@users.noreply.github.com>
Date: Fri, 24 Jul 2026 06:08:14 -0700
Subject: [PATCH 2/2] fix(security): seed demo account as user, not admin (#50)

Assisted-by: Claude Code (Haiku)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/prisma/seed.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/prisma/seed.js b/server/prisma/seed.js
index 5d0aadb..a019edb 100644
--- a/server/prisma/seed.js
+++ b/server/prisma/seed.js
@@ -357,7 +357,7 @@ export async function seed(prisma) {
       email: DEMO_USER_EMAIL,
       passwordHash,
       name: 'Demo User',
-      role: 'admin',
+      role: 'user',
     },
   });