@autofleet/zehut 3.1.2-beta.1 → 3.1.2-beta.11

package/lib/user/ApiUser.js

@@ -7,7 +7,6 @@ exports.CONTEXTS_IDS_HEADER = exports.ELEVATED_PERMISSIONS_HEADER = void 0;
 /* eslint-disable consistent-return */
 const node_cache_1 = __importDefault(require("node-cache"));
 const object_hash_1 = __importDefault(require("object-hash"));
-const merge_deep_1 = __importDefault(require("merge-deep"));
 const uuid_1 = require("uuid");
 const outbreak_1 = require("@autofleet/outbreak");
 const services_1 = require("../services");
@@ -82,13 +81,21 @@ class ApiUser {
         return Object.keys(this.privatePermissions[key] || {});
     }
     get elevatedPermissions() {
-        let permissions = {
+        const permissions = {
             fleets: {},
             businessModels: {},
             demandSources: {},
         };
         [...this.privateElevatedPermissionsHash.values()].forEach((p) => {
-            permissions = (0, merge_deep_1.default)(permissions, p);
+            Object.keys(p).forEach((topLevelKey) => {
+                if (!permissions[topLevelKey]) {
+                    permissions[topLevelKey] = {};
+                }
+                // Merge each [entityId => string[]]
+                Object.entries(p[topLevelKey]).forEach(([entityId, perms]) => {
+                    permissions[topLevelKey][entityId] = (permissions[topLevelKey][entityId] || []).concat(perms);
+                });
+            });
         });
         return permissions;
     }
@@ -96,8 +103,17 @@ class ApiUser {
         if (!this.privatePermissions) {
             throw new Error('Cannot get permissions without calling (async) getUserPermissions before');
         }
-        const permissions = (0, merge_deep_1.default)(this.privatePermissions, this.elevatedPermissions);
-        return permissions;
+        const base = JSON.parse(JSON.stringify(this.privatePermissions));
+        Object.keys(this.elevatedPermissions).forEach((topLevelKey) => {
+            if (!base[topLevelKey]) {
+                base[topLevelKey] = {};
+            }
+            // Merge each [entityId => string[]]
+            Object.entries(this.elevatedPermissions[topLevelKey]).forEach(([entityId, perms]) => {
+                base[topLevelKey][entityId] = (base[topLevelKey][entityId] || []).concat(perms);
+            });
+        });
+        return base;
     }
     elevatePermissions(addedPermissions) {
         const elevationId = (0, uuid_1.v4)();

package/lib/user/api-user-flows.test.js

@@ -8,6 +8,20 @@ const express_1 = __importDefault(require("express"));
 const axios_1 = __importDefault(require("axios"));
 const index_1 = require("../index");
 const index_2 = require("./index");
+const services_1 = require("../services");
+jest.spyOn(services_1.IdentityNetwork, 'get').mockImplementation(async (url) => {
+    if (url.includes('/api/v1/users/')) {
+        return {
+            data: {
+                accountType: 'user',
+                fleets: {},
+                businessModels: {},
+                demandSources: {},
+            },
+        };
+    }
+    return { data: {} };
+});
 const generateApp = async (addEndpoints, port) => {
     const app = (0, express_1.default)();
     addEndpoints(app);
@@ -122,4 +136,169 @@ describe('E2E', () => {
         closeServer1();
         expect(error.message).toEqual('Entity id on elevatePermissions is not a valid UUID, provided: nnn');
     });
+    it('should correctly handle elevation of permissions and their reversion', async () => {
+        let capturedError = null;
+        // Snapshots to capture state after each step
+        let afterFirstElevationElevated = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        let afterFirstElevationCombined = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        let afterSecondElevationElevated = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        let afterSecondElevationCombined = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        let afterCloseSecondElevated = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        let afterCloseSecondCombined = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        let afterCloseFirstElevated = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        let afterCloseFirstCombined = {
+            fleets: {},
+            businessModels: {},
+            demandSources: {},
+        };
+        // Enable tracing if necessary (adjust based on your implementation)
+        (0, index_1.enableTracing)({
+            outbreakOptions: {
+                headersPrefix: 'x-af-',
+            },
+        });
+        const userId = (0, uuid_1.v4)();
+        // Generate UUIDs for test entities
+        const fleetUUID1 = (0, uuid_1.v4)();
+        const fleetUUID2 = (0, uuid_1.v4)();
+        const bmUUID1 = (0, uuid_1.v4)();
+        const dsUUID1 = (0, uuid_1.v4)();
+        const dsUUID2 = (0, uuid_1.v4)();
+        // Spin up a test server
+        const closeServer = await generateApp((app) => {
+            app.use((0, index_2.middleware)());
+            app.get('/', async (req, res) => {
+                try {
+                    const user = (0, index_1.getUser)();
+                    // Load base permissions (mocked)
+                    await user.getUserPermissions();
+                    // Now user.privatePermissions is set
+                    // 1. First Elevation
+                    const closeElevation1 = user.elevatePermissions({
+                        fleets: {
+                            [fleetUUID1]: ['readF1'],
+                        },
+                        businessModels: {
+                            [bmUUID1]: ['writeBM1'],
+                        },
+                        demandSources: {
+                            [dsUUID1]: ['readDS1'],
+                        },
+                    });
+                    // Capture elevated and combined permissions after first elevation
+                    afterFirstElevationElevated = user.elevatedPermissions;
+                    afterFirstElevationCombined = user.permissions; // Non-null assertion since privatePermissions is set
+                    // 2. Second Elevation
+                    const closeElevation2 = user.elevatePermissions({
+                        fleets: {
+                            [fleetUUID1]: ['manageF1'],
+                            [fleetUUID2]: ['createF2'], // New fleet
+                        },
+                        businessModels: {
+                            [bmUUID1]: ['writeBM2'], // Additional permission to existing business model
+                        },
+                        demandSources: {
+                            [dsUUID2]: ['readDS2', 'readDS2'], // New demand source with duplicate permissions
+                        },
+                    });
+                    // Capture elevated and combined permissions after second elevation
+                    afterSecondElevationElevated = user.elevatedPermissions;
+                    afterSecondElevationCombined = user.permissions;
+                    // 3. Close Second Elevation
+                    closeElevation2();
+                    afterCloseSecondElevated = user.elevatedPermissions;
+                    afterCloseSecondCombined = user.permissions;
+                    // 4. Close First Elevation
+                    closeElevation1();
+                    afterCloseFirstElevated = user.elevatedPermissions;
+                    afterCloseFirstCombined = user.permissions;
+                }
+                catch (e) {
+                    capturedError = e;
+                }
+                res.json({ status: 'ok' });
+            });
+        }, 8089);
+        // Trigger the test route
+        const response = await axios_1.default.get('http://localhost:8089', {
+            headers: {
+                'x-af-user-id': userId,
+            },
+        });
+        closeServer();
+        // Basic assertions
+        expect(response.status).toEqual(200);
+        expect(capturedError).toBeNull();
+        console.log('afterFirstElevationElevated', afterFirstElevationElevated);
+        // ---------------------
+        // Assertions After First Elevation
+        // ---------------------
+        expect(afterFirstElevationElevated.fleets?.[fleetUUID1]).toEqual(expect.arrayContaining(['readF1']));
+        expect(afterFirstElevationElevated.businessModels?.[bmUUID1]).toEqual(expect.arrayContaining(['writeBM1']));
+        expect(afterFirstElevationElevated.demandSources?.[dsUUID1]).toEqual(expect.arrayContaining(['readDS1']));
+        expect(afterFirstElevationCombined.fleets?.[fleetUUID1]).toEqual(expect.arrayContaining(['readF1']));
+        expect(afterFirstElevationCombined.businessModels?.[bmUUID1]).toEqual(expect.arrayContaining(['writeBM1']));
+        expect(afterFirstElevationCombined.demandSources?.[dsUUID1]).toEqual(expect.arrayContaining(['readDS1']));
+        // ---------------------
+        // Assertions After Second Elevation
+        // ---------------------
+        expect(afterSecondElevationElevated.fleets?.[fleetUUID1]).toEqual(expect.arrayContaining(['readF1', 'manageF1']));
+        expect(afterSecondElevationElevated.fleets?.[fleetUUID2]).toEqual(expect.arrayContaining(['createF2']));
+        expect(afterSecondElevationElevated.businessModels?.[bmUUID1]).toEqual(expect.arrayContaining(['writeBM1', 'writeBM2']));
+        expect(afterSecondElevationElevated.demandSources?.[dsUUID2]).toEqual(expect.arrayContaining(['readDS2', 'readDS2']));
+        expect(afterSecondElevationCombined.fleets?.[fleetUUID1]).toEqual(expect.arrayContaining(['readF1', 'manageF1']));
+        expect(afterSecondElevationCombined.fleets?.[fleetUUID2]).toEqual(expect.arrayContaining(['createF2']));
+        expect(afterSecondElevationCombined.businessModels?.[bmUUID1]).toEqual(expect.arrayContaining(['writeBM1', 'writeBM2']));
+        expect(afterSecondElevationCombined.demandSources?.[dsUUID2]).toEqual(expect.arrayContaining(['readDS2', 'readDS2']));
+        // ---------------------
+        // Assertions After Closing Second Elevation
+        // ---------------------
+        expect(afterCloseSecondElevated.fleets?.[fleetUUID1]).toEqual(expect.arrayContaining(['readF1']));
+        expect(afterCloseSecondElevated.fleets?.[fleetUUID2]).toBeUndefined();
+        expect(afterCloseSecondElevated.businessModels?.[bmUUID1]).toEqual(expect.arrayContaining(['writeBM1']));
+        expect(afterCloseSecondElevated.demandSources?.[dsUUID1]).toEqual(expect.arrayContaining(['readDS1']));
+        expect(afterCloseSecondElevated.demandSources?.[dsUUID2]).toBeUndefined();
+        expect(afterCloseSecondCombined.fleets?.[fleetUUID1]).toEqual(expect.arrayContaining(['readF1']));
+        expect(afterCloseSecondCombined.fleets?.[fleetUUID2]).toBeUndefined();
+        expect(afterCloseSecondCombined.businessModels?.[bmUUID1]).toEqual(expect.arrayContaining(['writeBM1']));
+        expect(afterCloseSecondCombined.demandSources?.[dsUUID1]).toEqual(expect.arrayContaining(['readDS1']));
+        expect(afterCloseSecondCombined.demandSources?.[dsUUID2]).toBeUndefined();
+        // ---------------------
+        // Assertions After Closing First Elevation
+        // ---------------------
+        expect(afterCloseFirstElevated.fleets).toEqual({});
+        expect(afterCloseFirstElevated.businessModels).toEqual({});
+        expect(afterCloseFirstElevated.demandSources).toEqual({});
+        expect(afterCloseFirstCombined.fleets).toEqual({});
+        expect(afterCloseFirstCombined.businessModels).toEqual({});
+        expect(afterCloseFirstCombined.demandSources).toEqual({});
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autofleet/zehut",
-  "version": "3.1.2-beta.1",
+  "version": "3.1.2-beta.11",
   "description": "manage user's identity",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -28,7 +28,6 @@
     "axios": "^0.27.2",
     "express": "^4.18.1",
     "jsonwebtoken": "^8.5.1",
-    "merge-deep": "^3.0.3",
     "methods": "^1.1.2",
     "moment": "^2.29.1",
     "nock": "^13.2.9",
@@ -50,7 +49,7 @@
     "typescript": "^4.9.5"
   },
   "peerDependencies": {
-    "@autofleet/shtinker": "1.2.3-beta"
+    "@autofleet/shtinker": "^1.2.0"
   },
   "peerDependenciesMeta": {
     "@autofleet/shtinker": {