@aurorajs.dev/catalyst-cli 1.0.2 → 1.1.3

package/dist/templates/backend/packages/hub/src/@app/hub/app/application/create/hub-create-app.handler.spec.ts

@@ -0,0 +1,504 @@
+// TDD — RED/GREEN phases for HubCreateAppHandler (transactional provisioning)
+//
+// Tests the hand-written transaction + provisioning + IAM logic added to the
+// generated handler (design D3 + D-collision, tasks 3.1/3.2 of H2.5).
+//
+// Design constraints respected:
+//   - Testing the HANDLER directly (not the @Auth-decorated resolver/controller).
+//     The Auth module drags ESM into ts-jest; see Jest+@Auth ESM limitation.
+//   - @EmitEvent and @ApplySchema fire inside TestingModule; provide EventEmitter2 mock.
+//   - Sequelize.transaction is mocked to run the callback synchronously.
+//   - Both writer ports injected via Symbol tokens (IAM_PERMISSION_WRITER / IAM_BOUNDED_CONTEXT_WRITER).
+//
+// ESM cascade: @app/hub/app → @app/hub/app/domain → hub-app.field-schema.ts →
+//   @app/o-auth/application (field-schema) → @aurorajs.dev/core-back → core-back ESM.
+
+jest.mock('@api/graphql', () => ({}));
+// The handler deep-imports its services (cycle-proofing — see the handler's
+// import comment), so the DEEP paths carry the canonical stub classes; the
+// barrel mock ALIASES them (same class identity) because the spec's DI
+// providers reference the classes via the barrel — two distinct classes would
+// break Nest's paramtype-token matching ("can't resolve dependencies").
+jest.mock('@app/hub/app/application/create/hub-create-app.service', () => ({
+  HubCreateAppService: class HubCreateAppService {},
+}));
+jest.mock('@app/hub/app/application/find/hub-find-app-by-id.service', () => ({
+  HubFindAppByIdService: class HubFindAppByIdService {},
+}));
+jest.mock('@app/hub/app', () => ({
+  HubCreateAppService: jest.requireMock('@app/hub/app/application/create/hub-create-app.service')
+    .HubCreateAppService,
+  HubFindAppByIdService: jest.requireMock(
+    '@app/hub/app/application/find/hub-find-app-by-id.service',
+  ).HubFindAppByIdService,
+}));
+// Prevent the field-schema cascade, but expose domain helpers the handler needs
+jest.mock('@app/hub/app/domain', () => ({
+  hubAppAccessPermissionName: (code: string) => `hub.app.${code}.access`,
+}));
+jest.mock('@aurorajs.dev/core-back', () => ({
+  ApplySchema: () => (_t: unknown, _k: unknown, d: unknown) => d,
+  EmitEvent: () => (_t: unknown, _k: unknown, d: unknown) => d,
+  HandlerMeta: class {},
+  DRIZZLE_CONNECTION: 'AURORA_DRIZZLE_CONNECTION',
+}));
+// Mock writer ports tokens (Symbol constants) to avoid import resolution issues
+jest.mock('@bridges/iam/permission', () => ({
+  IAM_PERMISSION_WRITER: 'IAM_PERMISSION_WRITER',
+}));
+jest.mock('@bridges/iam/bounded-context', () => ({
+  IAM_BOUNDED_CONTEXT_WRITER: 'IAM_BOUNDED_CONTEXT_WRITER',
+}));
+
+import { HubCreateAppInput } from '@api/graphql';
+import { HubCreateAppService, HubFindAppByIdService } from '@app/hub/app';
+import { DRIZZLE_CONNECTION } from '@aurorajs.dev/core-back';
+import { IAM_BOUNDED_CONTEXT_WRITER } from '@bridges/iam/bounded-context';
+import { IAM_PERMISSION_WRITER } from '@bridges/iam/permission';
+import { OAUTH_APPLICATION_PROVISIONER } from '@bridges/o-auth/application';
+import {
+  BadRequestException,
+  ConflictException,
+  InternalServerErrorException,
+} from '@nestjs/common';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { Test, TestingModule } from '@nestjs/testing';
+import { HubCreateAppHandler } from './hub-create-app.handler';
+
+// ——— Test data ———————————————————————————————————————————————————————————————
+
+const APP_ID = 'aaaaaaaa-0000-4000-8000-aaaaaaaaaaaa';
+const APP_APPLICATION_ID = 'bbbbbbbb-0000-4000-8000-bbbbbbbbbbbb';
+const ISSUER_URL = 'http://localhost:9080';
+const FIXED_SECRET = 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef';
+
+const buildPayload = (overrides: Partial<HubCreateAppInput> = {}): HubCreateAppInput => ({
+  id: APP_ID,
+  code: 'my-app',
+  name: 'My App',
+  description: null,
+  url: 'https://my-app.example.com',
+  icon: null,
+  color: null,
+  sort: null,
+  applicationId: APP_APPLICATION_ID,
+  redirectUri: 'https://my-app.example.com/auth/callback',
+  isActive: true,
+  ...overrides,
+});
+
+// ——— Suite ———————————————————————————————————————————————————————————————————
+
+describe('HubCreateAppHandler', () => {
+  let handler: HubCreateAppHandler;
+  let createService: { main: jest.Mock };
+  let findByIdService: { main: jest.Mock };
+  let provisioner: { provision: jest.Mock };
+  let eventEmitter: { emit: jest.Mock };
+  let db: { transaction: jest.Mock };
+  let permissionWriter: {
+    createForBoundedContext: jest.Mock;
+    findIdByName: jest.Mock;
+    deleteByName: jest.Mock;
+    attachToBootstrapAdminRole: jest.Mock;
+  };
+  let boundedContextWriter: {
+    createForApp: jest.Mock;
+    findIdByName: jest.Mock;
+    deleteByName: jest.Mock;
+  };
+
+  const fakeTransaction = Symbol('t') as any;
+
+  beforeEach(async () => {
+    // Run the callback immediately with a fake Drizzle tx handle (callback-scoped)
+    db = {
+      transaction: jest.fn().mockImplementation(async (cb: (t: unknown) => Promise<unknown>) => {
+        return cb(fakeTransaction);
+      }),
+    };
+
+    createService = { main: jest.fn().mockResolvedValue(undefined) };
+
+    // Return a FAKE SEQUELIZE MODEL: data lives in `dataValues`; `toJSON()` returns only that.
+    const fakeAppDataValues = {
+      id: APP_ID,
+      code: 'my-app',
+      name: 'My App',
+      applicationId: APP_APPLICATION_ID,
+      isActive: true,
+    };
+    const fakeAppModel = {
+      dataValues: fakeAppDataValues,
+      toJSON() {
+        return this.dataValues;
+      },
+    };
+    findByIdService = {
+      main: jest.fn().mockResolvedValue(fakeAppModel),
+    };
+    provisioner = {
+      provision: jest.fn().mockResolvedValue({
+        applicationId: APP_APPLICATION_ID,
+        code: 'my-app',
+        secret: FIXED_SECRET,
+        redirectUri: 'https://my-app.example.com/auth/callback',
+      }),
+    };
+    eventEmitter = { emit: jest.fn() };
+
+    // Writer ports — by default no collision (findIdByName returns null)
+    permissionWriter = {
+      createForBoundedContext: jest.fn().mockResolvedValue(undefined),
+      findIdByName: jest.fn().mockResolvedValue(null),
+      deleteByName: jest.fn().mockResolvedValue(undefined),
+      attachToBootstrapAdminRole: jest.fn().mockResolvedValue(undefined),
+    };
+    boundedContextWriter = {
+      createForApp: jest.fn().mockResolvedValue(undefined),
+      findIdByName: jest.fn().mockResolvedValue(null),
+      deleteByName: jest.fn().mockResolvedValue(undefined),
+    };
+
+    // Set APP_URL for hubServerUrl resolution
+    process.env.APP_URL = ISSUER_URL;
+
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        HubCreateAppHandler,
+        { provide: EventEmitter2, useValue: eventEmitter },
+        { provide: HubCreateAppService, useValue: createService },
+        { provide: HubFindAppByIdService, useValue: findByIdService },
+        { provide: OAUTH_APPLICATION_PROVISIONER, useValue: provisioner },
+        { provide: DRIZZLE_CONNECTION, useValue: db },
+        { provide: IAM_PERMISSION_WRITER, useValue: permissionWriter },
+        { provide: IAM_BOUNDED_CONTEXT_WRITER, useValue: boundedContextWriter },
+      ],
+    }).compile();
+
+    handler = module.get(HubCreateAppHandler);
+  });
+
+  afterEach(() => {
+    delete process.env.APP_URL;
+  });
+
+  it('(a0) post-commit read loads the application relation via the Aurora Query DSL (not Sequelize include)', async () => {
+    await handler.main(buildPayload());
+
+    const [, constraintArg] = findByIdService.main.mock.calls[0];
+    expect(constraintArg).not.toHaveProperty('include');
+    expect(constraintArg.relations).toEqual({ application: true });
+  });
+
+  // Regression pin for the corrected comment semantics: the Drizzle engine CAN thread
+  // repositoryOptions.transaction through reads (guard reads DO — see the (e) tests),
+  // but the post-commit read deliberately stays OUTSIDE the tx: it must receive the
+  // caller's meta untouched, never a (stale, already-closed) tx handle.
+  it('(a0-tx) post-commit read stays outside the tx: caller meta forwarded without a transaction handle', async () => {
+    const callerMeta = { timezone: 'UTC', repositoryOptions: { auditing: null } } as any;
+
+    await handler.main(buildPayload(), callerMeta);
+
+    const [, , metaArg] = findByIdService.main.mock.calls[0];
+    expect(metaArg).toBe(callerMeta);
+    expect(metaArg.repositoryOptions.transaction).toBeUndefined();
+  });
+
+  it('(a) persists HubApp and calls provisioner inside the same transaction', async () => {
+    await handler.main(buildPayload());
+
+    // Both writes must happen inside the transaction
+    expect(db.transaction).toHaveBeenCalledTimes(1);
+    expect(createService.main).toHaveBeenCalledWith(
+      expect.objectContaining({ id: APP_ID }),
+      expect.objectContaining({
+        repositoryOptions: expect.objectContaining({ transaction: fakeTransaction }),
+      }),
+    );
+    expect(provisioner.provision).toHaveBeenCalledWith(
+      expect.objectContaining({
+        applicationId: APP_APPLICATION_ID,
+        code: 'my-app',
+        redirectUri: 'https://my-app.example.com/auth/callback',
+      }),
+      expect.objectContaining({ transaction: fakeTransaction }),
+    );
+  });
+
+  it('(b) rolls back when provisioner throws — HubApp NOT persisted after rollback', async () => {
+    const provisionError = new Error('o-auth DB error');
+    provisioner.provision.mockRejectedValueOnce(provisionError);
+
+    // db.transaction propagates the error so the whole operation rejects (rollback)
+    await expect(handler.main(buildPayload())).rejects.toThrow('o-auth DB error');
+
+    // createService was called inside the transaction callback
+    expect(createService.main).toHaveBeenCalledTimes(1);
+    // The transaction itself propagated the rejection (Drizzle rolls back on throw)
+    expect(db.transaction).toHaveBeenCalledTimes(1);
+  });
+
+  it('(c) rejects a non-absolute redirectUri before opening the transaction', async () => {
+    await expect(
+      handler.main(buildPayload({ redirectUri: '/relative/path' })),
+    ).rejects.toBeInstanceOf(BadRequestException);
+
+    // Transaction must NOT be opened on validation failure
+    expect(db.transaction).not.toHaveBeenCalled();
+    expect(provisioner.provision).not.toHaveBeenCalled();
+  });
+
+  it('(c) rejects a redirectUri with a fragment before opening the transaction', async () => {
+    await expect(
+      handler.main(buildPayload({ redirectUri: 'https://app.example.com/callback#token' })),
+    ).rejects.toBeInstanceOf(BadRequestException);
+
+    expect(db.transaction).not.toHaveBeenCalled();
+    expect(provisioner.provision).not.toHaveBeenCalled();
+  });
+
+  it('(c) throws InternalServerErrorException when APP_URL is missing before opening the transaction', async () => {
+    delete process.env.APP_URL;
+
+    await expect(handler.main(buildPayload())).rejects.toBeInstanceOf(InternalServerErrorException);
+
+    // Transaction must NOT be opened when APP_URL is absent
+    expect(db.transaction).not.toHaveBeenCalled();
+    expect(provisioner.provision).not.toHaveBeenCalled();
+
+    // Restore for subsequent tests
+    process.env.APP_URL = ISSUER_URL;
+  });
+
+  // ── charset validation (FIX 1) ────────────────────────────────────────────
+
+  describe('charset guard — code must match ^[a-z0-9-]+$', () => {
+    const invalidCodes = [
+      { label: 'dot', code: 'my.app' },
+      { label: 'uppercase', code: 'MyApp' },
+      { label: 'space', code: 'my app' },
+      { label: 'unicode', code: 'mé-app' },
+      { label: 'underscore', code: 'my_app' },
+      { label: 'slash', code: 'my/app' },
+    ];
+
+    for (const { label, code } of invalidCodes) {
+      it(`(charset) rejects code with ${label} — throws BadRequestException BEFORE opening TX`, async () => {
+        await expect(handler.main(buildPayload({ code }))).rejects.toBeInstanceOf(
+          BadRequestException,
+        );
+
+        // Transaction must NOT be opened on charset validation failure
+        expect(db.transaction).not.toHaveBeenCalled();
+        expect(provisioner.provision).not.toHaveBeenCalled();
+      });
+    }
+
+    it('(charset) accepts a valid lowercase-hyphen code', async () => {
+      await expect(handler.main(buildPayload({ code: 'my-valid-app' }))).resolves.toBeDefined();
+
+      expect(db.transaction).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  it('(d) returns the HubApp with one-time credentials bundle', async () => {
+    const result = await handler.main(buildPayload());
+
+    expect(result.credentials).toEqual({
+      hubServerUrl: ISSUER_URL,
+      code: 'my-app',
+      secret: FIXED_SECRET,
+      redirectUri: 'https://my-app.example.com/auth/callback',
+    });
+  });
+
+  it('(d) credentials.hubServerUrl uses APP_URL env var (satellite consumes it as OAUTH_HUB_SERVER_URL)', async () => {
+    process.env.APP_URL = 'https://hub.custom-domain.com';
+    const result = await handler.main(buildPayload());
+
+    expect(result.credentials?.hubServerUrl).toBe('https://hub.custom-domain.com');
+  });
+
+  /**
+   * Serialization-survival guard — this test would have caught the original bug.
+   *
+   * Root cause: the handler was assigning `credentials` as a runtime property on
+   * a Sequelize model instance. @Format calls JSON.parse(JSON.stringify(record))
+   * which triggers .toJSON() → .get({ plain: true }) → only dataValues survive.
+   * Runtime-assigned properties outside dataValues are stripped.
+   *
+   * This test simulates what @Format does by re-serializing the handler result
+   * the same way the decorator does. Even with @ApplySchema mocked to a no-op,
+   * this assertion fails if credentials is a runtime instance property rather
+   * than a plain-object field — the regression cannot hide behind the mock.
+   */
+  it('(d) credentials bundle survives JSON serialization (guard against @Format stripping)', async () => {
+    const result = await handler.main(buildPayload());
+
+    // Simulate the JSON.parse(JSON.stringify()) pass that @Format applies
+    const serialized = JSON.parse(JSON.stringify(result));
+
+    expect(serialized.credentials).toBeDefined();
+    expect(serialized.credentials.code).toBe('my-app');
+    expect(serialized.credentials.secret).toBe(FIXED_SECRET);
+    expect(serialized.credentials.redirectUri).toBe('https://my-app.example.com/auth/callback');
+    expect(serialized.credentials.hubServerUrl).toBe(ISSUER_URL);
+  });
+
+  it('provisioner receives applicationId from the payload', async () => {
+    await handler.main(buildPayload({ applicationId: APP_APPLICATION_ID }));
+
+    expect(provisioner.provision).toHaveBeenCalledWith(
+      expect.objectContaining({ applicationId: APP_APPLICATION_ID }),
+      expect.anything(),
+    );
+  });
+
+  it('provisioner also receives clientId derived from payload', async () => {
+    await handler.main(buildPayload());
+
+    expect(provisioner.provision).toHaveBeenCalledWith(
+      expect.objectContaining({ clientId: expect.any(String) }),
+      expect.anything(),
+    );
+  });
+
+  // ─── IAM writes (D3 + D-collision, H2.5 tasks 3.1/3.2) ──────────────────────
+
+  describe('IAM per-app bounded-context + permission + admin attach (D3)', () => {
+    it('(e) calls collision guard — findIdByName on BC writer with the app code', async () => {
+      await handler.main(buildPayload());
+
+      expect(boundedContextWriter.findIdByName).toHaveBeenCalledWith(
+        'my-app',
+        expect.objectContaining({ transaction: fakeTransaction }),
+      );
+    });
+
+    it('(e) calls collision guard — findIdByName on permission writer with hub.app.<code>.access', async () => {
+      await handler.main(buildPayload());
+
+      expect(permissionWriter.findIdByName).toHaveBeenCalledWith(
+        'hub.app.my-app.access',
+        expect.objectContaining({ transaction: fakeTransaction }),
+      );
+    });
+
+    it('(e) creates the per-app IamBoundedContext (write 5) with name=root=code inside the transaction', async () => {
+      await handler.main(buildPayload());
+
+      expect(boundedContextWriter.createForApp).toHaveBeenCalledWith(
+        expect.objectContaining({ name: 'my-app', root: 'my-app', isActive: true }),
+        expect.objectContaining({ transaction: fakeTransaction }),
+      );
+    });
+
+    it('(e) creates the permission hub.app.<code>.access (write 6) tied to the new BC id, inside the transaction', async () => {
+      await handler.main(buildPayload());
+
+      // The permission name must be derived deterministically from the app code
+      expect(permissionWriter.createForBoundedContext).toHaveBeenCalledWith(
+        expect.objectContaining({ name: 'hub.app.my-app.access' }),
+        expect.objectContaining({ transaction: fakeTransaction }),
+      );
+    });
+
+    it('(e) attaches the permission to the bootstrap Administrator role (write 7) inside the transaction', async () => {
+      await handler.main(buildPayload());
+
+      // The handler no longer knows the bootstrap role id — that's IAM's own
+      // concern, resolved supplier-side by IamPermissionWriterAdapter.
+      expect(permissionWriter.attachToBootstrapAdminRole).toHaveBeenCalledWith(
+        expect.any(String), // permissionId (fresh UUID)
+        expect.objectContaining({ transaction: fakeTransaction }),
+      );
+    });
+
+    it('(e) IAM writes happen in the correct order: guard → createBC → createPerm → attachToBootstrapAdminRole', async () => {
+      const callOrder: string[] = [];
+
+      boundedContextWriter.findIdByName.mockImplementation(async () => {
+        callOrder.push('bcFindIdByName');
+        return null;
+      });
+      permissionWriter.findIdByName.mockImplementation(async () => {
+        callOrder.push('permFindIdByName');
+        return null;
+      });
+      boundedContextWriter.createForApp.mockImplementation(async () => {
+        callOrder.push('createBC');
+      });
+      permissionWriter.createForBoundedContext.mockImplementation(async () => {
+        callOrder.push('createPerm');
+      });
+      permissionWriter.attachToBootstrapAdminRole.mockImplementation(async () => {
+        callOrder.push('attachToBootstrapAdminRole');
+      });
+
+      await handler.main(buildPayload());
+
+      expect(callOrder).toEqual([
+        'bcFindIdByName',
+        'permFindIdByName',
+        'createBC',
+        'createPerm',
+        'attachToBootstrapAdminRole',
+      ]);
+    });
+  });
+
+  describe('namespace-collision guard (D-collision)', () => {
+    it('(f) throws ConflictException and does NOT persist HubApp when BC name is taken', async () => {
+      boundedContextWriter.findIdByName.mockResolvedValue('existing-bc-id');
+
+      await expect(handler.main(buildPayload())).rejects.toBeInstanceOf(ConflictException);
+
+      // HubApp must NOT have been persisted (thrown during transaction → rolled back)
+      expect(createService.main).toHaveBeenCalledTimes(1); // called before guard
+      // No IAM writes
+      expect(boundedContextWriter.createForApp).not.toHaveBeenCalled();
+      expect(permissionWriter.createForBoundedContext).not.toHaveBeenCalled();
+      expect(permissionWriter.attachToBootstrapAdminRole).not.toHaveBeenCalled();
+    });
+
+    it('(f) throws ConflictException and does NOT persist HubApp when permission name is taken', async () => {
+      permissionWriter.findIdByName.mockResolvedValue('existing-perm-id');
+
+      await expect(handler.main(buildPayload())).rejects.toBeInstanceOf(ConflictException);
+
+      expect(boundedContextWriter.createForApp).not.toHaveBeenCalled();
+      expect(permissionWriter.createForBoundedContext).not.toHaveBeenCalled();
+    });
+
+    it('(f) rollback: throws ConflictException on BC collision — transaction was opened but rolled back', async () => {
+      boundedContextWriter.findIdByName.mockResolvedValue('existing-bc-id');
+
+      await expect(handler.main(buildPayload())).rejects.toBeInstanceOf(ConflictException);
+
+      // The transaction was opened (the guard runs inside the TX)
+      expect(db.transaction).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('rollback: any IAM writer throw leaves no HubApp (D3 atomicity)', () => {
+    it('(g) rolls back when boundedContextWriter.createForApp throws', async () => {
+      boundedContextWriter.createForApp.mockRejectedValue(new Error('BC write failed'));
+
+      await expect(handler.main(buildPayload())).rejects.toThrow('BC write failed');
+
+      // Transaction was opened
+      expect(db.transaction).toHaveBeenCalledTimes(1);
+      // No further IAM writes happened
+      expect(permissionWriter.createForBoundedContext).not.toHaveBeenCalled();
+    });
+
+    it('(g) rolls back when permissionWriter.createForBoundedContext throws', async () => {
+      permissionWriter.createForBoundedContext.mockRejectedValue(new Error('Perm write failed'));
+
+      await expect(handler.main(buildPayload())).rejects.toThrow('Perm write failed');
+
+      expect(permissionWriter.attachToBootstrapAdminRole).not.toHaveBeenCalled();
+    });
+  });
+});