@aiquants/daily-report 0.1.1

package/src/server/schema.ts

@@ -0,0 +1,266 @@
+/**
+ * Structural table types + drizzle (mssql) schema factory for the daily-report tables.
+ * 日報テーブル群の構造的テーブル型と drizzle (mssql) スキーマファクトリ。
+ *
+ * 既存アプリは自前のモデル定義をそのまま `DailyReportTables` として注入できる (構造互換)。
+ * 新規プロジェクトは `defineDailyReportSchema()` で同一構造のテーブル定義を生成できる。
+ */
+import { desc, sql } from "drizzle-orm"
+import { type AnyMsSqlColumn, bigint, bit, date, datetime2, foreignKey, index, int, mssqlSchema, nvarchar, primaryKey } from "drizzle-orm/mssql-core"
+
+/** 注入する外部ユーザーテーブルの最小形 (id / display_name)。 */
+export type DailyReportUserTable = { id: AnyMsSqlColumn; displayName: AnyMsSqlColumn }
+
+/** DailyReportHub テーブルの構造形。 */
+export type DailyReportHubTable = {
+    id: AnyMsSqlColumn
+    sourceType: AnyMsSqlColumn
+    sourceId: AnyMsSqlColumn
+    sourceIdNum: AnyMsSqlColumn
+    businessDate: AnyMsSqlColumn
+    userId: AnyMsSqlColumn
+    title: AnyMsSqlColumn
+    summary: AnyMsSqlColumn
+    createdAt: AnyMsSqlColumn
+    createdBy: AnyMsSqlColumn
+    updatedAt: AnyMsSqlColumn
+    updatedBy: AnyMsSqlColumn
+    deletedAt: AnyMsSqlColumn
+    deletedBy: AnyMsSqlColumn
+}
+
+/** DailyReportInternal テーブルの構造形。 */
+export type DailyReportInternalTable = {
+    hubId: AnyMsSqlColumn
+    body: AnyMsSqlColumn
+    metadata: AnyMsSqlColumn
+    createdAt: AnyMsSqlColumn
+    createdBy: AnyMsSqlColumn
+    updatedAt: AnyMsSqlColumn
+    updatedBy: AnyMsSqlColumn
+}
+
+/** DailyReportComment テーブルの構造形。 */
+export type DailyReportCommentTable = {
+    id: AnyMsSqlColumn
+    hubId: AnyMsSqlColumn
+    userId: AnyMsSqlColumn
+    body: AnyMsSqlColumn
+    createdAt: AnyMsSqlColumn
+    createdBy: AnyMsSqlColumn
+    updatedAt: AnyMsSqlColumn
+    updatedBy: AnyMsSqlColumn
+}
+
+/** DailyReportLabel テーブルの構造形。 */
+export type DailyReportLabelTable = {
+    id: AnyMsSqlColumn
+    userId: AnyMsSqlColumn
+    name: AnyMsSqlColumn
+    color: AnyMsSqlColumn
+    sortOrder: AnyMsSqlColumn
+    createdAt: AnyMsSqlColumn
+    createdBy: AnyMsSqlColumn
+    updatedAt: AnyMsSqlColumn
+    updatedBy: AnyMsSqlColumn
+}
+
+/** DailyReportHub_Label 中間テーブルの構造形。 */
+export type DailyReportHubLabelTable = {
+    hubId: AnyMsSqlColumn
+    labelId: AnyMsSqlColumn
+    createdAt: AnyMsSqlColumn
+    createdBy: AnyMsSqlColumn
+}
+
+/** DailyReportUserStatus テーブルの構造形。 */
+export type DailyReportUserStatusTable = {
+    hubId: AnyMsSqlColumn
+    userId: AnyMsSqlColumn
+    isRead: AnyMsSqlColumn
+    isStarred: AnyMsSqlColumn
+    createdAt: AnyMsSqlColumn
+    createdBy: AnyMsSqlColumn
+    updatedAt: AnyMsSqlColumn
+    updatedBy: AnyMsSqlColumn
+}
+
+/** サービスへ注入するテーブル一式 (アプリ既存モデルまたは本ファクトリ生成物)。 */
+export type DailyReportTables = {
+    hub: DailyReportHubTable
+    internal: DailyReportInternalTable
+    comment: DailyReportCommentTable
+    label: DailyReportLabelTable
+    hubLabel: DailyReportHubLabelTable
+    userStatus: DailyReportUserStatusTable
+}
+
+/**
+ * Generic factory: build the six daily-report tables under an arbitrary schema name.
+ * 任意のスキーマ名の下に日報 6 テーブルを生成する汎用ファクトリ。
+ *
+ * 制約・索引名は `${schemaName}_<Table>_...` 規約で生成する。
+ * ユーザーテーブルへの FK は注入された `userTable` を参照する。
+ */
+export function defineDailyReportSchema<S extends string>(schemaName: S, opts: { userTable: DailyReportUserTable }) {
+    const s = mssqlSchema(schemaName)
+    const users = opts.userTable
+
+    const hub = s.table(
+        "DailyReportHub",
+        {
+            id: bigint("id", { mode: "number" }).identity().notNull(),
+            sourceType: nvarchar("source_type", { length: 20 }).notNull(),
+            sourceId: nvarchar("source_id", { length: 100 }).notNull(),
+            sourceIdNum: bigint("source_id_num", { mode: "number" }).generatedAlwaysAs(sql`TRY_CAST(source_id AS BIGINT)`),
+            businessDate: date("business_date"),
+            userId: bigint("user_id", { mode: "number" }),
+            title: nvarchar("title", { length: 200 }),
+            summary: nvarchar("summary", { length: "max" }),
+            createdAt: datetime2("created_at").notNull(),
+            createdBy: nvarchar("created_by", { length: 50 }).notNull(),
+            updatedAt: datetime2("updated_at").notNull(),
+            updatedBy: nvarchar("updated_by", { length: 50 }).notNull(),
+            deletedAt: datetime2("deleted_at"),
+            deletedBy: nvarchar("deleted_by", { length: 50 }),
+        },
+        (table) => [
+            primaryKey({ name: `${schemaName}_DailyReportHub_pk`, columns: [table.id] }),
+            foreignKey({
+                name: `${schemaName}_DailyReportHub_user_id_fk`,
+                columns: [table.userId],
+                foreignColumns: [users.id],
+            }),
+            index(`${schemaName}_DailyReportHub_business_date_index`).on(table.businessDate),
+            index(`${schemaName}_DailyReportHub_updated_at_index`).on(table.updatedAt),
+            index(`${schemaName}_DailyReportHub_source_index`).on(table.sourceType, table.sourceId),
+            index(`${schemaName}_DailyReportHub_user_id_index`).on(table.userId),
+            index(`${schemaName}_DailyReportHub_business_date_id_index`).on(desc(table.businessDate), desc(table.id)),
+            index(`${schemaName}_DailyReportHub_deleted_at_index`).on(table.deletedAt),
+        ],
+    )
+
+    const internal = s.table(
+        "DailyReportInternal",
+        {
+            hubId: bigint("hub_id", { mode: "number" }).notNull(),
+            body: nvarchar("body", { length: "max" }),
+            metadata: nvarchar("metadata", { length: "max" }),
+            createdAt: datetime2("created_at").notNull(),
+            createdBy: nvarchar("created_by", { length: 50 }).notNull(),
+            updatedAt: datetime2("updated_at").notNull(),
+            updatedBy: nvarchar("updated_by", { length: 50 }).notNull(),
+        },
+        (table) => [
+            primaryKey({ name: `${schemaName}_DailyReportInternal_pk`, columns: [table.hubId] }),
+            foreignKey({
+                name: `${schemaName}_DailyReportInternal_hub_id_fk`,
+                columns: [table.hubId],
+                foreignColumns: [hub.id],
+            }),
+        ],
+    )
+
+    const comment = s.table(
+        "DailyReportComment",
+        {
+            id: bigint("id", { mode: "number" }).identity().notNull(),
+            hubId: bigint("hub_id", { mode: "number" }).notNull(),
+            userId: bigint("user_id", { mode: "number" }).notNull(),
+            body: nvarchar("body", { length: "max" }).notNull(),
+            createdAt: datetime2("created_at").notNull(),
+            createdBy: nvarchar("created_by", { length: 50 }).notNull(),
+            updatedAt: datetime2("updated_at").notNull(),
+            updatedBy: nvarchar("updated_by", { length: 50 }).notNull(),
+        },
+        (table) => [
+            primaryKey({ name: `${schemaName}_DailyReportComment_pk`, columns: [table.id] }),
+            foreignKey({
+                name: `${schemaName}_DailyReportComment_hub_id_fk`,
+                columns: [table.hubId],
+                foreignColumns: [hub.id],
+            }),
+            foreignKey({
+                name: `${schemaName}_DailyReportComment_user_id_fk`,
+                columns: [table.userId],
+                foreignColumns: [users.id],
+            }),
+            index(`${schemaName}_DailyReportComment_hub_id_index`).on(table.hubId),
+        ],
+    )
+
+    const label = s.table(
+        "DailyReportLabel",
+        {
+            id: bigint("id", { mode: "number" }).identity().notNull(),
+            userId: bigint("user_id", { mode: "number" }),
+            name: nvarchar("name", { length: 50 }).notNull(),
+            color: nvarchar("color", { length: 20 }),
+            sortOrder: int("sort_order"),
+            createdAt: datetime2("created_at").notNull(),
+            createdBy: nvarchar("created_by", { length: 50 }).notNull(),
+            updatedAt: datetime2("updated_at").notNull(),
+            updatedBy: nvarchar("updated_by", { length: 50 }).notNull(),
+        },
+        (table) => [
+            primaryKey({ name: `${schemaName}_DailyReportLabel_pk`, columns: [table.id] }),
+            foreignKey({
+                name: `${schemaName}_DailyReportLabel_user_id_fk`,
+                columns: [table.userId],
+                foreignColumns: [users.id],
+            }),
+        ],
+    )
+
+    const hubLabel = s.table(
+        "DailyReportHub_Label",
+        {
+            hubId: bigint("hub_id", { mode: "number" }).notNull(),
+            labelId: bigint("label_id", { mode: "number" }).notNull(),
+            createdAt: datetime2("created_at").notNull(),
+            createdBy: nvarchar("created_by", { length: 50 }).notNull(),
+        },
+        (table) => [
+            primaryKey({ name: `${schemaName}_DailyReportHub_Label_pk`, columns: [table.hubId, table.labelId] }),
+            foreignKey({
+                name: `${schemaName}_DailyReportHub_Label_hub_id_fk`,
+                columns: [table.hubId],
+                foreignColumns: [hub.id],
+            }),
+            foreignKey({
+                name: `${schemaName}_DailyReportHub_Label_label_id_fk`,
+                columns: [table.labelId],
+                foreignColumns: [label.id],
+            }),
+        ],
+    )
+
+    const userStatus = s.table(
+        "DailyReportUserStatus",
+        {
+            hubId: bigint("hub_id", { mode: "number" }).notNull(),
+            userId: bigint("user_id", { mode: "number" }).notNull(),
+            isRead: bit("is_read").default(false).notNull(),
+            isStarred: bit("is_starred").default(false).notNull(),
+            createdAt: datetime2("created_at").notNull(),
+            createdBy: nvarchar("created_by", { length: 50 }).notNull(),
+            updatedAt: datetime2("updated_at").notNull(),
+            updatedBy: nvarchar("updated_by", { length: 50 }).notNull(),
+        },
+        (table) => [
+            primaryKey({ name: `${schemaName}_DailyReportUserStatus_pk`, columns: [table.hubId, table.userId] }),
+            foreignKey({
+                name: `${schemaName}_DailyReportUserStatus_hub_id_fk`,
+                columns: [table.hubId],
+                foreignColumns: [hub.id],
+            }),
+            foreignKey({
+                name: `${schemaName}_DailyReportUserStatus_user_id_fk`,
+                columns: [table.userId],
+                foreignColumns: [users.id],
+            }),
+        ],
+    )
+
+    return { hub, internal, comment, label, hubLabel, userStatus } satisfies DailyReportTables
+}

package/src/server/service.spec.ts

@@ -0,0 +1,97 @@
+import { bigint, mssqlSchema, nvarchar, primaryKey } from "drizzle-orm/mssql-core"
+import { describe, expect, it } from "vitest"
+import { createEpochStore, SqlResultCache } from "./cache"
+import { defineDailyReportSchema } from "./schema"
+import { createDailyReportService, type DailyReportDb, type DailyReportHubRow } from "./service"
+
+/**
+ * Security regression tests for audit-actor masking in mapHubRecord.
+ * mapHubRecord の監査アクターマスク (生内部 ID 漏洩防止) のセキュリティ回帰テスト。
+ */
+
+// 実テーブル (getColumns / eq / desc が実カラムを要求するため mock 不可)
+const testUsers = mssqlSchema("test").table("Users", { id: bigint("id", { mode: "number" }).notNull(), displayName: nvarchar("display_name", { length: 100 }) }, (t) => [primaryKey({ columns: [t.id] })])
+const tables = defineDailyReportSchema("test", { userTable: testUsers })
+
+/** getDailyReportsByBusinessDate 経路 (select→from→leftJoin→leftJoin→where→orderBy) だけを満たす最小モック。 */
+const makeDb = (rows: unknown[]): DailyReportDb => {
+    const chain = {
+        from: () => chain,
+        innerJoin: () => chain,
+        leftJoin: () => chain,
+        where: () => chain,
+        top: () => chain,
+        orderBy: () => Promise.resolve(rows),
+    }
+    return { select: () => chain } as unknown as DailyReportDb
+}
+
+const baseHub = (over: Partial<DailyReportHubRow>): DailyReportHubRow => ({
+    id: 1,
+    sourceType: "Internal",
+    sourceId: "1",
+    sourceIdNum: 1,
+    businessDate: "2099-01-05",
+    userId: 8,
+    title: "t",
+    summary: "s",
+    createdAt: "2099-01-05 00:00:00",
+    createdBy: "8",
+    updatedAt: "2099-01-05 00:00:00",
+    updatedBy: "8",
+    deletedAt: null,
+    deletedBy: null,
+    ...over,
+})
+
+const makeService = (rows: unknown[]) => {
+    const epochs = createEpochStore(undefined)
+    const cache = new SqlResultCache({ defaultTtlMs: 60_000 }, epochs)
+    return createDailyReportService({
+        db: makeDb(rows),
+        tables,
+        userTable: testUsers,
+        resolveUserId: async () => 8,
+        encodeUserId: (id) => `ENC${id}`, // テスト用の識別可能な難読化
+        cache,
+        epochs,
+        draftLabelName: "draft", // 必須注入 (ドラフト可視性フィルタ用のラベル名。テストは中立値で十分)
+    })
+}
+
+describe("mapHubRecord audit-actor masking (security)", () => {
+    it("数値の updatedBy / createdBy (= 生内部 ID) は encodeUserId で難読化される", async () => {
+        const svc = makeService([{ hub: baseHub({ createdBy: "8", updatedBy: "8" }), internal: null, creatorName: null }])
+        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        // 生 ID "8" がそのまま出ないこと (漏洩防止の核心)
+        expect(r.updatedBy).toBe("ENC8")
+        expect(r.updatedBy).not.toBe("8")
+        expect(r.author).toBe("ENC8") // creatorName(null) → createdBy をマスク
+        expect(r.employeeName).toBe("ENC8")
+        // userId フィールドは従来どおり難読化
+        expect(r.userId).toBe("ENC8")
+    })
+
+    it("表示名 (creatorName) がある場合はマスクせず表示名を優先する", async () => {
+        const svc = makeService([{ hub: baseHub({ createdBy: "8", updatedBy: "8" }), internal: null, creatorName: "山田太郎" }])
+        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        expect(r.author).toBe("山田太郎")
+        expect(r.employeeName).toBe("山田太郎")
+        // updatedBy は表示名解決を持たないため常にマスク
+        expect(r.updatedBy).toBe("ENC8")
+    })
+
+    it("非数値の監査値 (レガシー氏名/システム文字列) はそのまま通す", async () => {
+        const svc = makeService([{ hub: baseHub({ createdBy: "system-import", updatedBy: "batch" }), internal: null, creatorName: null }])
+        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        expect(r.author).toBe("system-import")
+        expect(r.updatedBy).toBe("batch")
+    })
+
+    it("空 / null の監査値は null になる (生値の漏れなし)", async () => {
+        const svc = makeService([{ hub: baseHub({ createdBy: "", updatedBy: "" }), internal: null, creatorName: null }])
+        const [r] = await svc.getDailyReportsByBusinessDate("2099-01-05", { forceRefresh: true })
+        expect(r.updatedBy).toBeNull()
+        expect(r.author).toBe("") // author は非 null 契約のため空文字
+    })
+})