@aiquants/auth-react-router 0.4.0 → 0.5.0

package/src/admin/labels.ts

@@ -0,0 +1,274 @@
+/**
+ * Labels and i18n strings for the user administration UI.
+ * ユーザー管理 UI で使用するラベルと i18n 文字列の定義。
+ *
+ * パッケージ既定は **英語** ([defaultUserAdminLabels])。日本語で使う場合はアプリ側が
+ * [jaUserAdminLabels] を明示的に注入する (認可管理 `@aiquants/authz-react-router` と同じ規約)。
+ * UI 文字列はすべて本モジュールに集約し、コンポーネント側へ直書きしないこと — 直書きすると
+ * 日本語以外の利用者がその箇所を差し替えられなくなる。
+ */
+
+export type UserAdminLabels = {
+    title: string
+    /** シェル (タブ枠) の見出し。 */
+    heading: string
+    tabs: {
+        users: string
+        groups: string
+        groupMembers: string
+        allowlist: string
+    }
+    usersView: {
+        title: string
+        searchPlaceholder: string
+        addUser: string
+        editUser: string
+        id: string
+        displayName: string
+        email: string
+        status: string
+        active: string
+        inactive: string
+        actions: string
+        edit: string
+        activate: string
+        deactivate: string
+        empty: string
+        save: string
+        cancel: string
+    }
+    groupsView: {
+        title: string
+        searchPlaceholder: string
+        addGroup: string
+        editGroup: string
+        id: string
+        groupKey: string
+        name: string
+        description: string
+        memberCount: string
+        status: string
+        actions: string
+        edit: string
+        delete: string
+        confirmDelete: string
+        noDescription: string
+        groupKeyPlaceholder: string
+        namePlaceholder: string
+        empty: string
+        save: string
+        cancel: string
+    }
+    groupMembersView: {
+        selectGroup: string
+        selectPrompt: string
+        actionAdd: string
+        actionRemove: string
+    }
+    allowlistView: {
+        title: string
+        addEntry: string
+        pattern: string
+        type: string
+        emailType: string
+        domainType: string
+        /** 一覧のバッジ表示 (短縮形)。 */
+        emailTypeShort: string
+        domainTypeShort: string
+        description: string
+        actions: string
+        /** 変更不能な供給元 (環境変数など) 由来の行に出す表示。 */
+        readOnly: string
+        delete: string
+        empty: string
+        save: string
+        cancel: string
+    }
+}
+
+/**
+ * Package default labels (English).
+ * パッケージ既定ラベル (英語)。
+ */
+export const defaultUserAdminLabels: UserAdminLabels = {
+    title: "Users & Groups",
+    heading: "👤 User administration",
+    tabs: {
+        users: "👤 Users",
+        groups: "👥 Groups",
+        groupMembers: "🔗 Members",
+        allowlist: "✉️ Allowlist",
+    },
+    usersView: {
+        title: "Users",
+        searchPlaceholder: "Search by name or email...",
+        addUser: "＋ Add user",
+        editUser: "Edit user",
+        id: "ID",
+        displayName: "Name",
+        email: "Email",
+        status: "Status",
+        active: "Active",
+        inactive: "Inactive",
+        actions: "Actions",
+        edit: "Edit",
+        activate: "Activate",
+        deactivate: "Deactivate",
+        empty: "No matching users",
+        save: "Save",
+        cancel: "Cancel",
+    },
+    groupsView: {
+        title: "Groups",
+        searchPlaceholder: "Search by group name or key...",
+        addGroup: "＋ Add group",
+        editGroup: "Edit group",
+        id: "ID",
+        groupKey: "Group key",
+        name: "Name",
+        description: "Description",
+        memberCount: "Members",
+        status: "Status",
+        actions: "Actions",
+        edit: "Edit",
+        delete: "Delete",
+        confirmDelete: "Delete this group?",
+        noDescription: "No description",
+        groupKeyPlaceholder: "e.g. dev-team",
+        namePlaceholder: "e.g. Development team",
+        empty: "No groups registered",
+        save: "Save",
+        cancel: "Cancel",
+    },
+    groupMembersView: {
+        selectGroup: "Select a group",
+        selectPrompt: "Select a group to manage its members",
+        actionAdd: "Add",
+        actionRemove: "Remove",
+    },
+    allowlistView: {
+        title: "Sign-in allowlist",
+        addEntry: "＋ Add pattern",
+        pattern: "Pattern (e.g. @example.com or user@example.com)",
+        type: "Type",
+        emailType: "Exact email match",
+        domainType: "Domain match",
+        emailTypeShort: "Email",
+        domainTypeShort: "Domain",
+        description: "Description",
+        actions: "Actions",
+        readOnly: "Read-only",
+        delete: "Delete",
+        empty: "No allowlist entries registered",
+        save: "Add",
+        cancel: "Cancel",
+    },
+}
+
+/**
+ * Standard Japanese labels for user administration (opt-in).
+ * ユーザー管理の標準日本語ラベル (アプリ側で明示注入して使う)。
+ */
+export const jaUserAdminLabels: UserAdminLabels = {
+    title: "ユーザー・グループ管理",
+    heading: "👤 ユーザー管理",
+    tabs: {
+        users: "👤 ユーザー一覧",
+        groups: "👥 ユーザーグループ",
+        groupMembers: "🔗 グループメンバー",
+        allowlist: "✉️ アクセス許可リスト",
+    },
+    usersView: {
+        title: "ユーザー管理",
+        searchPlaceholder: "表示名や Email で検索...",
+        addUser: "＋ ユーザー追加",
+        editUser: "ユーザーの編集",
+        id: "ID",
+        displayName: "表示名",
+        email: "メールアドレス",
+        status: "ステータス",
+        active: "有効",
+        inactive: "無効",
+        actions: "操作",
+        edit: "編集",
+        activate: "有効化",
+        deactivate: "無効化",
+        empty: "該当するユーザーが見つかりません",
+        save: "保存",
+        cancel: "キャンセル",
+    },
+    groupsView: {
+        title: "ユーザーグループ管理",
+        searchPlaceholder: "グループ名やキーで検索...",
+        addGroup: "＋ グループ作成",
+        editGroup: "グループの編集",
+        id: "ID",
+        groupKey: "グループキー",
+        name: "グループ名",
+        description: "説明",
+        memberCount: "メンバー数",
+        status: "ステータス",
+        actions: "操作",
+        edit: "編集",
+        delete: "削除",
+        confirmDelete: "このグループを削除してもよろしいですか？",
+        noDescription: "説明なし",
+        groupKeyPlaceholder: "例: dev-team",
+        namePlaceholder: "例: 開発チーム",
+        empty: "グループが登録されていません",
+        save: "保存",
+        cancel: "キャンセル",
+    },
+    groupMembersView: {
+        selectGroup: "グループ選択",
+        selectPrompt: "グループを選択してください",
+        actionAdd: "追加",
+        actionRemove: "除外",
+    },
+    allowlistView: {
+        title: "アクセス許可リスト (Allowlist)",
+        addEntry: "＋ 許可パターン追加",
+        pattern: "パターン (例: @example.com または user@example.com)",
+        type: "種別",
+        emailType: "メールアドレス完全一致",
+        domainType: "ドメイン一致",
+        emailTypeShort: "Email 完全一致",
+        domainTypeShort: "ドメイン一致",
+        description: "説明 / 備考",
+        actions: "操作",
+        readOnly: "変更不可",
+        delete: "削除",
+        empty: "アロワリストエントリが登録されていません",
+        save: "登録",
+        cancel: "キャンセル",
+    },
+}
+
+/** セクション単位の部分上書き。 */
+export type PartialUserAdminLabels = {
+    title?: string
+    heading?: string
+    tabs?: Partial<UserAdminLabels["tabs"]>
+    usersView?: Partial<UserAdminLabels["usersView"]>
+    groupsView?: Partial<UserAdminLabels["groupsView"]>
+    groupMembersView?: Partial<UserAdminLabels["groupMembersView"]>
+    allowlistView?: Partial<UserAdminLabels["allowlistView"]>
+}
+
+/**
+ * Shallow per-section merge over the English defaults.
+ * 英語既定に対してセクション単位で浅くマージする処理。
+ */
+export function resolveUserAdminLabels(over?: PartialUserAdminLabels): UserAdminLabels {
+    const d = defaultUserAdminLabels
+    if (!over) return d
+    return {
+        title: over.title ?? d.title,
+        heading: over.heading ?? d.heading,
+        tabs: { ...d.tabs, ...over.tabs },
+        usersView: { ...d.usersView, ...over.usersView },
+        groupsView: { ...d.groupsView, ...over.groupsView },
+        groupMembersView: { ...d.groupMembersView, ...over.groupMembersView },
+        allowlistView: { ...d.allowlistView, ...over.allowlistView },
+    }
+}

package/src/admin/server.spec.ts

@@ -0,0 +1,300 @@
+import { describe, expect, it } from "vitest"
+import { createInMemoryUserAdminStore, createUserAdminApp, type UserAdminGuards } from "./server"
+
+/** テスト用の常時許可ガード(ガード自体の検証は専用ケースで行う)。 */
+const allowAll = (): UserAdminGuards => ({ requireAccess: () => {} })
+
+/** intent + フィールドを FormData に載せて action を叩くヘルパ。 */
+function runActionOn(app: ReturnType<typeof createUserAdminApp>) {
+    return (intent: string, fields: Record<string, string>) => {
+        const formData = new FormData()
+        formData.append("intent", intent)
+        for (const [key, val] of Object.entries(fields)) formData.append(key, val)
+        return app.action({
+            request: new Request("http://localhost/users", { method: "POST", body: formData }),
+            params: {},
+            context: {},
+        } as never)
+    }
+}
+
+describe("UserAdminStore & createUserAdminApp", () => {
+    it("manages users correctly in memory store and throws on non-existent ids", async () => {
+        const store = createInMemoryUserAdminStore({ users: [] })
+
+        const created = await store.createUser({ displayName: "テスト 太郎", email: "test@example.com" })
+        expect(created.id).toBe(1)
+        expect(created.displayName).toBe("テスト 太郎")
+        expect(created.isActive).toBe(true)
+
+        const updated = await store.updateUser(1, { displayName: "テスト 次郎", email: "updated@example.com" })
+        expect(updated.displayName).toBe("テスト 次郎")
+        expect(updated.email).toBe("updated@example.com")
+
+        const toggled = await store.toggleUserActive(1, false)
+        expect(toggled.isActive).toBe(false)
+
+        await expect(store.updateUser(999, { displayName: "a", email: "b" })).rejects.toThrow("User not found: 999")
+        await expect(store.toggleUserActive(999, true)).rejects.toThrow("User not found: 999")
+
+        const list = await store.listUsers()
+        expect(list).toHaveLength(1)
+    })
+
+    it("manages groups and memberships correctly and throws on non-existent group ids", async () => {
+        const store = createInMemoryUserAdminStore({ users: [{ id: 10, displayName: "U10", email: "u10@ex.com", isActive: true }], groups: [], groupMembers: [] })
+
+        const group = await store.createGroup({ groupKey: "qa-team", name: "QAチーム", description: "品質保証" })
+        expect(group.id).toBe(1)
+        expect(group.groupKey).toBe("qa-team")
+
+        const updatedGroup = await store.updateGroup(1, { name: "QA・テストチーム", description: "品質管理全般" })
+        expect(updatedGroup.name).toBe("QA・テストチーム")
+
+        await expect(store.updateGroup(999, { name: "x" })).rejects.toThrow("Group not found: 999")
+
+        const member1 = await store.addGroupMember(1, 10)
+        expect(member1.groupId).toBe(1)
+        expect(member1.userId).toBe(10)
+
+        // Idempotent duplicate add
+        const member2 = await store.addGroupMember(1, 10)
+        expect(member2).toEqual(member1)
+
+        const members = await store.listGroupMembers()
+        expect(members).toHaveLength(1)
+
+        await store.removeGroupMember(1, 10)
+        expect(await store.listGroupMembers()).toHaveLength(0)
+
+        await store.deleteGroup(1)
+        expect(await store.listGroups()).toHaveLength(0)
+    })
+
+    it("manages allowlist entries correctly in memory store", async () => {
+        const store = createInMemoryUserAdminStore({ allowlist: [] })
+
+        const entry = await store.addAllowlistEntry({ pattern: "@domain.com", type: "domain", description: "許可ドメイン" })
+        expect(entry.id).toBe(1)
+        expect(entry.pattern).toBe("@domain.com")
+
+        expect(await store.listAllowlist()).toHaveLength(1)
+
+        await store.removeAllowlistEntry(1)
+        expect(await store.listAllowlist()).toHaveLength(0)
+    })
+
+    it("handles all loader route segments via createUserAdminApp", async () => {
+        const store = createInMemoryUserAdminStore()
+        const app = createUserAdminApp({ store, guards: allowAll() })
+
+        const segments = ["users", "groups", "group_members", "allowlist", "unknown_path"]
+        for (const seg of segments) {
+            const loaderRes = await app.loader({
+                request: new Request(`http://localhost/users/${seg}`),
+                params: {},
+                context: {},
+            })
+            if (seg === "unknown_path") {
+                expect(loaderRes.segment).toBe("users")
+            } else {
+                expect(loaderRes.segment).toBe(seg)
+            }
+        }
+    })
+
+    it("handles all action intents and PERSISTS each mutation to the store", async () => {
+        const store = createInMemoryUserAdminStore()
+        const app = createUserAdminApp({ store, guards: allowAll() })
+        const run = runActionOn(app)
+
+        // createUser — 戻り値だけでなく実際の永続結果を検証する
+        expect(await run("createUser", { displayName: "John", email: "john@example.com" })).toEqual({ ok: true })
+        const created = (await store.listUsers()).find((u) => u.email === "john@example.com")
+        expect(created).toMatchObject({ displayName: "John", isActive: true })
+
+        expect(await run("updateUser", { userId: String(created?.id), displayName: "John Updated", email: "john.updated@example.com" })).toEqual({ ok: true })
+        expect((await store.listUsers()).find((u) => u.id === created?.id)).toMatchObject({ displayName: "John Updated", email: "john.updated@example.com" })
+
+        expect(await run("toggleUserActive", { userId: String(created?.id), isActive: "false" })).toEqual({ ok: true })
+        expect((await store.listUsers()).find((u) => u.id === created?.id)?.isActive).toBe(false)
+
+        expect(await run("createGroup", { groupKey: "sec-team", name: "Security", description: "SecOps" })).toEqual({ ok: true })
+        const group = (await store.listGroups()).find((g) => g.groupKey === "sec-team")
+        expect(group).toMatchObject({ name: "Security", description: "SecOps" })
+
+        expect(await run("updateGroup", { groupId: String(group?.id), name: "Security Team", description: "Updated" })).toEqual({ ok: true })
+        expect((await store.listGroups()).find((g) => g.id === group?.id)).toMatchObject({ name: "Security Team", description: "Updated" })
+
+        expect(await run("addGroupMember", { groupId: String(group?.id), userId: String(created?.id) })).toEqual({ ok: true })
+        expect((await store.listGroupMembers()).some((m) => m.groupId === group?.id && m.userId === created?.id)).toBe(true)
+
+        expect(await run("removeGroupMember", { groupId: String(group?.id), userId: String(created?.id) })).toEqual({ ok: true })
+        expect((await store.listGroupMembers()).some((m) => m.groupId === group?.id && m.userId === created?.id)).toBe(false)
+
+        expect(await run("addAllowlistEntry", { pattern: "@sec.com", type: "domain", description: "Sec" })).toEqual({ ok: true })
+        expect(await run("addAllowlistEntry", { pattern: "user@sec.com", type: "email" })).toEqual({ ok: true })
+        const allowlist = await store.listAllowlist()
+        expect(allowlist.find((a) => a.pattern === "@sec.com")?.type).toBe("domain")
+        expect(allowlist.find((a) => a.pattern === "user@sec.com")?.type).toBe("email")
+
+        const removable = allowlist.find((a) => a.pattern === "@sec.com")
+        expect(await run("removeAllowlistEntry", { entryId: String(removable?.id) })).toEqual({ ok: true })
+        expect((await store.listAllowlist()).some((a) => a.pattern === "@sec.com")).toBe(false)
+
+        // unknown intent
+        expect(await run("unknownIntent", {})).toEqual({ ok: false, error: "Unknown intent: unknownIntent" })
+    })
+
+    it("deleteGroup cascades: the group's memberships are removed too (no orphan rows)", async () => {
+        const store = createInMemoryUserAdminStore({
+            users: [{ id: 10, displayName: "U10", email: "u10@ex.com", isActive: true }],
+            groups: [{ id: 5, groupKey: "g5", name: "G5", isActive: true }],
+            groupMembers: [{ id: 1, groupId: 5, userId: 10 }],
+        })
+        const app = createUserAdminApp({ store, guards: allowAll() })
+
+        expect(await runActionOn(app)("deleteGroup", { groupId: "5" })).toEqual({ ok: true })
+        expect((await store.listGroups()).some((g) => g.id === 5)).toBe(false)
+        // 参照整合性: グループ削除で所属行も消えること (孤立行ゼロ)
+        expect((await store.listGroupMembers()).some((m) => m.groupId === 5)).toEqual(false)
+    })
+
+    it("denies every read and write when the guards throw (fail-closed mount)", async () => {
+        const store = createInMemoryUserAdminStore()
+        const denied = new Error("403")
+        const app = createUserAdminApp({
+            store,
+            guards: {
+                requireAccess: () => {
+                    throw denied
+                },
+            },
+        })
+
+        await expect(app.loader({ request: new Request("http://localhost/users"), params: {}, context: {} } as never)).rejects.toThrow("403")
+
+        const before = await store.listUsers()
+        // ガード拒否はそのまま伝播する ({ok:false} に握り潰さない)
+        await expect(runActionOn(app)("createUser", { displayName: "Attacker", email: "attacker@evil.example" })).rejects.toThrow("403")
+        // 拒否時にストアが一切変化しないこと
+        expect(await store.listUsers()).toEqual(before)
+    })
+
+    it("guards run BEFORE the body is read, and receive the incoming request", async () => {
+        const store = createInMemoryUserAdminStore()
+        const seen: string[] = []
+        const app = createUserAdminApp({
+            store,
+            guards: {
+                requireAccess: (request, ctx) => {
+                    seen.push(`${ctx.action}:${ctx.intent}:${new URL(request.url).pathname}`)
+                },
+            },
+        })
+
+        await app.loader({ request: new Request("http://localhost/users/groups"), params: {}, context: {} } as never)
+        await runActionOn(app)("createUser", { displayName: "A", email: "a@ex.com" })
+        expect(seen).toEqual(["read:loader:/users/groups", "create:createUser:/users"])
+    })
+
+    it("requires the CRUD verb each intent actually performs (delete is not covered by update)", async () => {
+        const store = createInMemoryUserAdminStore()
+        const asked: Array<{ action: string; intent: string }> = []
+        const app = createUserAdminApp({ store, guards: { requireAccess: (_r, ctx) => void asked.push({ ...ctx }) } })
+        const run = runActionOn(app)
+
+        await run("createUser", { displayName: "A", email: "a@ex.com" })
+        await run("updateGroup", { groupId: "1", name: "N" })
+        await run("deleteGroup", { groupId: "1" })
+        await run("addGroupMember", { groupId: "2", userId: "1" })
+        await run("removeGroupMember", { groupId: "2", userId: "1" })
+        await run("addAllowlistEntry", { pattern: "@x.com", type: "domain" })
+        await run("removeAllowlistEntry", { entryId: "1" })
+
+        expect(asked).toEqual([
+            { action: "create", intent: "createUser" },
+            { action: "update", intent: "updateGroup" },
+            { action: "delete", intent: "deleteGroup" },
+            { action: "create", intent: "addGroupMember" },
+            { action: "delete", intent: "removeGroupMember" },
+            { action: "create", intent: "addAllowlistEntry" },
+            { action: "delete", intent: "removeAllowlistEntry" },
+        ])
+    })
+
+    it("an update-only principal cannot delete (destructive intents are blocked, update ones pass)", async () => {
+        const store = createInMemoryUserAdminStore({ groups: [{ id: 1, groupKey: "g", name: "G", isActive: true }], users: [], groupMembers: [], allowlist: [] })
+        // update だけを許す主体を模す
+        const app = createUserAdminApp({
+            store,
+            guards: {
+                requireAccess: (_r, { action }) => {
+                    if (action !== "update" && action !== "read") throw new Error(`forbidden: ${action}`)
+                },
+            },
+        })
+        const run = runActionOn(app)
+
+        await expect(run("deleteGroup", { groupId: "1" })).rejects.toThrow("forbidden: delete")
+        expect((await store.listGroups()).some((g) => g.id === 1)).toBe(true) // 削除されていない
+        await expect(run("createUser", { displayName: "A", email: "a@ex.com" })).rejects.toThrow("forbidden: create")
+        // update 相当は通る
+        expect(await run("updateGroup", { groupId: "1", name: "G2" })).toEqual({ ok: true })
+    })
+
+    it("an unknown intent never reaches the guard nor the store", async () => {
+        const store = createInMemoryUserAdminStore()
+        let called = 0
+        const app = createUserAdminApp({ store, guards: { requireAccess: () => void called++ } })
+        expect(await runActionOn(app)("__proto__", {})).toEqual({ ok: false, error: "Unknown intent: __proto__" })
+        expect(await runActionOn(app)("constructor", {})).toEqual({ ok: false, error: "Unknown intent: constructor" })
+        expect(called).toBe(0)
+    })
+
+    it("rejects malformed ids and blank required fields instead of writing garbage", async () => {
+        const store = createInMemoryUserAdminStore({ users: [], groups: [], groupMembers: [], allowlist: [] })
+        const run = runActionOn(createUserAdminApp({ store, guards: allowAll() }))
+
+        // 欠落 / 非数値 / 0 以下の ID は書き込む前に弾き、理由を UI へ返す
+        expect(await run("updateUser", { displayName: "x", email: "y" })).toMatchObject({ ok: false, error: expect.stringMatching(/userId/) })
+        expect(await run("deleteGroup", { groupId: "abc" })).toMatchObject({ ok: false, error: expect.stringMatching(/groupId/) })
+        expect(await run("addGroupMember", { groupId: "1", userId: "0" })).toMatchObject({ ok: false, error: expect.stringMatching(/userId/) })
+        expect(await run("removeAllowlistEntry", { entryId: "-1" })).toMatchObject({ ok: false, error: expect.stringMatching(/entryId/) })
+        // 必須文字列の空送信も弾く
+        expect(await run("createUser", { displayName: "  ", email: "a@ex.com" })).toMatchObject({ ok: false, error: expect.stringMatching(/displayName/) })
+        expect(await run("createGroup", { groupKey: "k", name: "" })).toMatchObject({ ok: false, error: expect.stringMatching(/name/) })
+        // 明示的な true/false 以外の isActive も拒否 (破壊側を既定にしない)
+        expect(await run("toggleUserActive", { userId: "1" })).toMatchObject({ ok: false, error: expect.stringMatching(/isActive/) })
+
+        expect(await store.listUsers()).toHaveLength(0)
+        expect(await store.listGroups()).toHaveLength(0)
+        expect(await store.listGroupMembers()).toHaveLength(0)
+        expect(await store.listAllowlist()).toHaveLength(0)
+    })
+})
+
+describe("createUserAdminApp — ストア由来のエラーを UI へ届ける", () => {
+    it("ストアが投げた業務エラー (ロックアウト理由など) を {ok:false,error} で返す", async () => {
+        const store = createInMemoryUserAdminStore()
+        store.deleteGroup = async () => {
+            throw new Error("グループの削除は実行できません: 最後の管理者を失うためです")
+        }
+        const app = createUserAdminApp({ store, guards: { requireAccess: () => {} } })
+        expect(await runActionOn(app)("deleteGroup", { groupId: "1" })).toEqual({ ok: false, error: "グループの削除は実行できません: 最後の管理者を失うためです" })
+    })
+
+    it("ガードの拒否 (Response) は握り潰さずそのまま伝播する", async () => {
+        const store = createInMemoryUserAdminStore()
+        const denied = new Response("Forbidden", { status: 403 })
+        const app = createUserAdminApp({
+            store,
+            guards: {
+                requireAccess: () => {
+                    throw denied
+                },
+            },
+        })
+        await expect(runActionOn(app)("deleteGroup", { groupId: "1" })).rejects.toBe(denied)
+    })
+})