@application-kit/authorization 0.4.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @application-kit/authorization
 
+## 0.5.1
+
+### Patch Changes
+
+- 8e10f98: Peer-зависимости принимают Nest 12, `@nestjs/graphql` и `@nestjs/mercurius` 14, `@nestjs/cqrs` 12 и `nestjs-pino` 5. `PinoLoggerConfig` задаёт `forRoutes` явно: с маршрутом nestjs-pino 5 по умолчанию запросы на Fastify не логировались.
+
+## 0.5.0
+
+### Minor Changes
+
+- e9411eb: Спеки-гейты продукта переехали в пакеты: спека теперь — вызов помощника с параметрами продукта, а нарушение приходит ошибкой со списком.
+
+  `ui/testing`: `assertTokensDeclared`. `kafka/testing` (новый вход): `assertConsumerTopicsConsistent`. `authorization/testing` (новый вход): `assertAbilityRegistryConsistent`. `nestjs-vite/static-assets-gate` (новый вход, отдельно от `/testing`, чтобы спеки с фейком рендерера не грузили `vite`): `assertStaticAssetsLayout`. `lint-config` разрешает импорт нового входа `nestjs-vite/static-assets-gate`.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -21,6 +21,7 @@ Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`,
 | `@application-kit/authorization` | сервер и браузер: реестры, `buildAbilityFor`, `composeAbilityGrants` | только `@casl/ability` |
 | `@application-kit/authorization/nest` | сервер: guard, декораторы, фабрика, логгер | `@nestjs/*`, `nestjs-pino` |
 | `@application-kit/authorization/vue` | клиент и SSR: ability на приложение, `<Can>`, гвард маршрутов по `meta.can` | `vue`, `vue-router`, `@casl/vue` |
+| `@application-kit/authorization/testing` | спека продукта: гейт реестра abilities | `node:fs`, `@casl/ability` |
 
 Корневой вход не импортирует Nest — его можно собирать в браузерный бандл.
 
@@ -96,3 +97,18 @@ export class AppModule {}
 
 `AuthorizationLogger` — pino-логгер пакета с контекстом `AuthorizationLogger`; собирается из глобального
 `LoggerModule` `nestjs-pino`.
+
+## Гейт реестра
+
+Реестр subject'ов живёт только в типах: забытая регистрация не падает в рантайме. `assertAbilityRegistryConsistent` из
+входа `@application-kit/authorization/testing` читает блоки `declare module` файлов грантов и падает, если запись не
+выдана грантом продукта или её subject не проверяется в prod-коде:
+
+```ts
+await assertAbilityRegistryConsistent({
+  grants: abilityGrants,
+  grantsFiles: 'modules/*/module.grants.ts',
+  roles: Object.values(ROLE_VALUE),
+  sourceRoot: path.resolve(import.meta.dirname, '..'),
+})
+```

package/dist/cjs/testing/assert-ability-registry-consistent.d.ts

@@ -0,0 +1,9 @@
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+import type { Role } from '../types/roles.js';
+export interface AbilityRegistryOptionsInterface {
+    readonly grants: AbilityGrantMap;
+    readonly grantsFiles: string;
+    readonly roles: readonly Role[];
+    readonly sourceRoot: string;
+}
+export declare const assertAbilityRegistryConsistent: (options: AbilityRegistryOptionsInterface) => Promise<void>;

package/dist/cjs/testing/assert-ability-registry-consistent.js

@@ -0,0 +1,64 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertAbilityRegistryConsistent = void 0;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const build_ability_js_1 = require("../build-ability.js");
+const REGISTRY_MARKER = 'interface SubjectRegistryInterface {';
+const PRODUCTION_EXTENSIONS = new Set(['.ts', '.vue']);
+const actionsOf = (declaration) => declaration
+    .split('|')
+    .map((action) => action.replaceAll(/[^\w-]/gu, ''))
+    .filter((action) => action.length > 0 && action !== 'never');
+const withoutComments = (source) => source
+    .split('\n')
+    .filter((line) => !(/^\s*(?:\/\/|\*|\/\*)/u).test(line))
+    .join('\n');
+const registryEntries = (code) => {
+    const start = code.indexOf(REGISTRY_MARKER) + REGISTRY_MARKER.length;
+    return code.slice(start, code.indexOf('}', start))
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.includes(':'))
+        .map((line) => [line.slice(0, line.indexOf(':')).trim(), actionsOf(line.slice(line.indexOf(':') + 1))]);
+};
+const grantedPairs = (roles, grants) => {
+    const rules = roles.flatMap((role) => (0, build_ability_js_1.buildAbilityFor)({ role }, grants).rules);
+    return new Set(rules.flatMap((rule) => [rule.action].flat().flatMap((action) => [rule.subject].flat().map((subject) => `${action} ${subject}`))));
+};
+const productionSources = async (sourceRoot, producers) => {
+    const files = await (0, promises_1.readdir)(sourceRoot, { recursive: true });
+    const sources = files.filter((file) => PRODUCTION_EXTENSIONS.has(node_path_1.default.extname(file))
+        && !file.endsWith('.spec.ts')
+        && !file.split(node_path_1.default.sep).includes('tests')
+        && !producers.includes(file));
+    return Promise.all(sources.map(async (file) => (0, promises_1.readFile)(node_path_1.default.join(sourceRoot, file), 'utf8')));
+};
+const assertAbilityRegistryConsistent = async (options) => {
+    const { grants, grantsFiles, roles, sourceRoot } = options;
+    const producers = await Array.fromAsync((0, promises_1.glob)(grantsFiles, { cwd: sourceRoot }));
+    const [codes, sources] = await Promise.all([
+        Promise.all(producers.map(async (file) => withoutComments(await (0, promises_1.readFile)(node_path_1.default.join(sourceRoot, file), 'utf8')))),
+        productionSources(sourceRoot, producers),
+    ]);
+    const entries = codes.filter((code) => code.includes(REGISTRY_MARKER)).flatMap((code) => registryEntries(code));
+    const granted = grantedPairs(roles, grants);
+    const violations = [
+        ...entries.length === 0 ? [`шаблон ${grantsFiles} не нашёл записей реестра`] : [],
+        ...entries.flatMap(([subject, actions]) => actions
+            .map((action) => `${action} ${subject}`)
+            .filter((pair) => !granted.has(pair))
+            .map((pair) => `запись реестра «${pair}» не выдана ни одним грантом`)),
+        ...entries
+            .map(([subject]) => subject)
+            .filter((subject) => sources.every((source) => !source.includes(`'${subject}'`)))
+            .map((subject) => `subject ${subject} не проверяется в prod-коде`),
+    ];
+    if (violations.length > 0) {
+        throw new Error(`Гейт реестра abilities:\n${violations.join('\n')}`);
+    }
+};
+exports.assertAbilityRegistryConsistent = assertAbilityRegistryConsistent;

package/dist/cjs/testing/index.d.ts

@@ -0,0 +1 @@
+export * from './assert-ability-registry-consistent.js';

package/dist/cjs/testing/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./assert-ability-registry-consistent.js"), exports);

package/dist/esm/testing/assert-ability-registry-consistent.d.ts

@@ -0,0 +1,9 @@
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+import type { Role } from '../types/roles.js';
+export interface AbilityRegistryOptionsInterface {
+    readonly grants: AbilityGrantMap;
+    readonly grantsFiles: string;
+    readonly roles: readonly Role[];
+    readonly sourceRoot: string;
+}
+export declare const assertAbilityRegistryConsistent: (options: AbilityRegistryOptionsInterface) => Promise<void>;

package/dist/esm/testing/assert-ability-registry-consistent.js

@@ -0,0 +1,57 @@
+import { glob, readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { buildAbilityFor } from '../build-ability.js';
+const REGISTRY_MARKER = 'interface SubjectRegistryInterface {';
+const PRODUCTION_EXTENSIONS = new Set(['.ts', '.vue']);
+const actionsOf = (declaration) => declaration
+    .split('|')
+    .map((action) => action.replaceAll(/[^\w-]/gu, ''))
+    .filter((action) => action.length > 0 && action !== 'never');
+const withoutComments = (source) => source
+    .split('\n')
+    .filter((line) => !(/^\s*(?:\/\/|\*|\/\*)/u).test(line))
+    .join('\n');
+const registryEntries = (code) => {
+    const start = code.indexOf(REGISTRY_MARKER) + REGISTRY_MARKER.length;
+    return code.slice(start, code.indexOf('}', start))
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.includes(':'))
+        .map((line) => [line.slice(0, line.indexOf(':')).trim(), actionsOf(line.slice(line.indexOf(':') + 1))]);
+};
+const grantedPairs = (roles, grants) => {
+    const rules = roles.flatMap((role) => buildAbilityFor({ role }, grants).rules);
+    return new Set(rules.flatMap((rule) => [rule.action].flat().flatMap((action) => [rule.subject].flat().map((subject) => `${action} ${subject}`))));
+};
+const productionSources = async (sourceRoot, producers) => {
+    const files = await readdir(sourceRoot, { recursive: true });
+    const sources = files.filter((file) => PRODUCTION_EXTENSIONS.has(path.extname(file))
+        && !file.endsWith('.spec.ts')
+        && !file.split(path.sep).includes('tests')
+        && !producers.includes(file));
+    return Promise.all(sources.map(async (file) => readFile(path.join(sourceRoot, file), 'utf8')));
+};
+export const assertAbilityRegistryConsistent = async (options) => {
+    const { grants, grantsFiles, roles, sourceRoot } = options;
+    const producers = await Array.fromAsync(glob(grantsFiles, { cwd: sourceRoot }));
+    const [codes, sources] = await Promise.all([
+        Promise.all(producers.map(async (file) => withoutComments(await readFile(path.join(sourceRoot, file), 'utf8')))),
+        productionSources(sourceRoot, producers),
+    ]);
+    const entries = codes.filter((code) => code.includes(REGISTRY_MARKER)).flatMap((code) => registryEntries(code));
+    const granted = grantedPairs(roles, grants);
+    const violations = [
+        ...entries.length === 0 ? [`шаблон ${grantsFiles} не нашёл записей реестра`] : [],
+        ...entries.flatMap(([subject, actions]) => actions
+            .map((action) => `${action} ${subject}`)
+            .filter((pair) => !granted.has(pair))
+            .map((pair) => `запись реестра «${pair}» не выдана ни одним грантом`)),
+        ...entries
+            .map(([subject]) => subject)
+            .filter((subject) => sources.every((source) => !source.includes(`'${subject}'`)))
+            .map((subject) => `subject ${subject} не проверяется в prod-коде`),
+    ];
+    if (violations.length > 0) {
+        throw new Error(`Гейт реестра abilities:\n${violations.join('\n')}`);
+    }
+};

package/dist/esm/testing/index.d.ts

@@ -0,0 +1 @@
+export * from './assert-ability-registry-consistent.js';

package/dist/esm/testing/index.js

@@ -0,0 +1 @@
+export * from './assert-ability-registry-consistent.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@application-kit/authorization",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик, гвард маршрутов Vue",
   "keywords": [
     "authorization",
@@ -44,6 +44,16 @@
       }
     },
     "./package.json": "./package.json",
+    "./testing": {
+      "import": {
+        "types": "./dist/esm/testing/index.d.ts",
+        "default": "./dist/esm/testing/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/testing/index.d.ts",
+        "default": "./dist/cjs/testing/index.js"
+      }
+    },
     "./vue": {
       "import": {
         "types": "./dist/esm/vue/index.d.ts",
@@ -62,7 +72,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal,vue && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal,testing,vue && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
     "lint:tsc": "tsc --noEmit --pretty --project .",
     "test:mutation": "stryker run",
     "test:unit": "vitest run"
@@ -70,28 +80,28 @@
   "devDependencies": {
     "@casl/ability": "^7.0.1",
     "@casl/vue": "^3.0.1",
-    "@nestjs/common": "^11.2.7",
-    "@nestjs/core": "^11.2.7",
-    "@nestjs/testing": "^11.2.7",
+    "@nestjs/common": "^12.0.0",
+    "@nestjs/core": "^12.0.0",
+    "@nestjs/testing": "^12.0.0",
     "@stryker-mutator/core": "^10.0.0",
     "@stryker-mutator/vitest-runner": "^10.0.0",
     "@types/node": "^26.2.0",
-    "nestjs-pino": "^4.6.1",
+    "nestjs-pino": "^5.0.0",
     "pino": "^10.3.1",
     "pino-http": "^11.0.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11",
+    "vitest": "^5.0.0",
     "vue": "^3.5.41",
     "vue-router": "^5.2.0"
   },
   "peerDependencies": {
     "@casl/ability": "^7.0.0",
     "@casl/vue": "^3.0.0",
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
-    "nestjs-pino": "^4.6.1",
+    "@nestjs/common": "^11.0.0 || ^12.0.0",
+    "@nestjs/core": "^11.0.0 || ^12.0.0",
+    "nestjs-pino": "^4.6.1 || ^5.0.0",
     "vue": "^3.5.0",
     "vue-router": "^5.0.0"
   },