@byline/core 6.7.1 → 6.7.2

package/dist/services/review-probes.test.node.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};

package/dist/services/review-probes.test.node.js

@@ -0,0 +1,349 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { AdminAuth, AuthError, AuthErrorCodes, createRequestContext, createSuperAdminContext, } from '@byline/auth';
+import { describe, expect, it, vi } from 'vitest';
+import { BylineError, DbErrorCodes, ERR_DOCUMENT_STALE, ERR_NOT_FOUND, ErrorCodes, } from '../lib/errors.js';
+import { runReadSnapshot } from '../storage/read-snapshot.js';
+import { unusedRevisionStore } from '../storage/revision-store.test-helper.js';
+import { cancelDocumentScheduledPublish, changeDocumentStatus, confirmDocumentScheduledPublish, copyToLocale, createDocument, deleteDocument, deleteLocale, duplicateDocument, listDocumentPublishSchedules, restoreDocumentVersion, scheduleDocumentPublish, unpublishDocument, updateDocument, updateDocumentSystemFields, updateDocumentWithPatches, } from './document-lifecycle/index.js';
+// ---------------------------------------------------------------------------
+// Fixtures / Helpers
+// ---------------------------------------------------------------------------
+const minimalCollection = {
+    path: 'articles',
+    labels: { singular: 'Article', plural: 'Articles' },
+    fields: [{ name: 'title', type: 'text', label: 'Title' }],
+    workflow: {
+        statuses: [
+            { name: 'draft', label: 'Draft' },
+            { name: 'published', label: 'Published' },
+            { name: 'archived', label: 'Archived' },
+        ],
+    },
+};
+const numericCollection = {
+    ...minimalCollection,
+    fields: [
+        { name: 'quantity', type: 'integer' },
+        { name: 'score', type: 'float' },
+        { name: 'price', type: 'decimal' },
+    ],
+};
+function publishScheduleRow(overrides = {}) {
+    const now = new Date('2026-08-22T12:00:00.000Z');
+    return {
+        documentId: 'doc-1',
+        collectionId: 'col-1',
+        targetVersionId: 'ver-1',
+        authorizedRevision: 1,
+        publishAt: new Date('2026-08-23T12:00:00.000Z'),
+        state: 'armed',
+        suspendedAt: null,
+        suspendedReason: null,
+        scheduledBy: TEST_ACTOR_ID,
+        lastAuthorizedBy: TEST_ACTOR_ID,
+        lastAuthorizedAt: now,
+        scheduledAt: now,
+        updatedAt: now,
+        executionToken: null,
+        executionExpiresAt: null,
+        lastAttemptAt: null,
+        nextAttemptAt: new Date('2026-08-23T12:00:00.000Z'),
+        attemptCount: 0,
+        lastError: null,
+        ...overrides,
+    };
+}
+/** Build a mock IDbAdapter. Returns the adapter plus individual mock fns. */
+function createMockDb() {
+    const createDocumentVersion = vi.fn().mockResolvedValue({
+        document: { id: 'ver-1', document_id: 'doc-1' },
+        fieldCount: 3,
+    });
+    const setDocumentStatus = vi.fn().mockResolvedValue(undefined);
+    const archivePublishedVersions = vi.fn().mockResolvedValue(0);
+    const softDeleteDocument = vi.fn().mockResolvedValue(1);
+    const deleteDocumentLocale = vi.fn().mockResolvedValue({ newVersionId: 'ver-2' });
+    const getDocumentById = vi.fn().mockImplementation(async () => {
+        const metadata = await getCurrentVersionMetadata();
+        return metadata == null ? null : { ...metadata, fields: {}, path: await getCurrentPath() };
+    });
+    const getDocumentSystemFieldsForUpdate = vi.fn().mockResolvedValue(null);
+    const getCurrentVersionMetadata = vi.fn().mockResolvedValue(null);
+    const getCurrentPath = vi.fn().mockResolvedValue('current-path');
+    const publishSchedule = vi.fn().mockResolvedValue({ status: 'document_not_found' });
+    const confirmPublishSchedule = vi.fn().mockResolvedValue({ status: 'schedule_not_found' });
+    const cancelPublishSchedule = vi.fn().mockResolvedValue(null);
+    const suspendPublishSchedule = vi.fn().mockResolvedValue({ status: 'schedule_not_found' });
+    const claimDuePublishSchedules = vi.fn().mockResolvedValue([]);
+    const lockPublishScheduleClaim = vi.fn().mockResolvedValue(null);
+    const deletePublishScheduleClaim = vi.fn().mockResolvedValue(false);
+    const suspendPublishScheduleClaim = vi.fn().mockResolvedValue(false);
+    const releasePublishScheduleClaim = vi.fn().mockResolvedValue(false);
+    const getPublishSchedule = vi.fn().mockResolvedValue(null);
+    const listPublishSchedules = vi.fn().mockResolvedValue({ schedules: [], total: 0 });
+    // Audit capability (docs/07-auth-and-security/02-auditability.md — W2). `withTransaction` is a passthrough
+    // in unit tests (runs the unit of work immediately, no real tx); `append`
+    // records the calls so write-point tests can assert the audit rows emitted.
+    const auditAppend = vi.fn().mockResolvedValue({ id: 'audit-1' });
+    let transactionDepth = 0;
+    const revisions = new Map();
+    const transaction = {
+        run: async (fn) => {
+            transactionDepth++;
+            try {
+                return await fn();
+            }
+            finally {
+                transactionDepth--;
+            }
+        },
+    };
+    const withTransaction = vi.spyOn(transaction, 'run');
+    const fail = () => {
+        throw new Error('unexpected singleton mapping call');
+    };
+    // Fake classifier mirroring db-postgres's real one closely enough for
+    // rethrowPathConflict's consumption of the seam: a pg-shaped 23505 with a
+    // constraint name classifies as a unique violation; anything else is
+    // unknown. Individual tests inject pg-shaped errors on `createDocumentVersion`
+    // (see `translates a Postgres unique-constraint violation...` below).
+    const classifyError = vi.fn((err) => {
+        const e = err;
+        if (e?.code === '23505') {
+            return { code: DbErrorCodes.UNIQUE_VIOLATION, constraint: e.constraint };
+        }
+        return { code: DbErrorCodes.UNKNOWN };
+    });
+    const db = {
+        classifyError,
+        revisions: {
+            ...unusedRevisionStore,
+            isInTransaction: () => transactionDepth > 0,
+            lock: vi.fn(async (targets) => {
+                const observations = [];
+                for (const target of targets) {
+                    const revision = revisions.get(target.documentId) ?? 1;
+                    if (target.expectedRevision !== revision)
+                        throw ERR_DOCUMENT_STALE({
+                            message: 'stale',
+                            details: {
+                                reason: 'revision_mismatch',
+                                documentId: target.documentId,
+                                expectedRevision: target.expectedRevision,
+                                currentRevision: revision,
+                            },
+                        });
+                    const system = await getDocumentSystemFieldsForUpdate({
+                        collection_id: target.collectionId,
+                        document_id: target.documentId,
+                    });
+                    const source = await getDocumentById.mock.results.at(-1)?.value;
+                    if (!system && !source)
+                        throw ERR_NOT_FOUND({ message: 'document not found' });
+                    observations.push({
+                        documentId: target.documentId,
+                        collectionId: target.collectionId,
+                        revision,
+                        currentVersionId: source?.document_version_id ?? 'ver-1',
+                        status: source?.status ?? 'draft',
+                        sourceLocale: system?.source_locale ?? source?.source_locale ?? 'en',
+                        path: system?.path ?? source?.path ?? null,
+                        availableLocales: system?.availableLocales ?? source?.availableLocales ?? [],
+                    });
+                }
+                return observations;
+            }),
+            advance: vi.fn(async (locked) => {
+                const revision = locked.revision + 1;
+                revisions.set(locked.documentId, revision);
+                return { documentId: locked.documentId, revision };
+            }),
+        },
+        withReadSnapshot: (fn) => runReadSnapshot(db.queries, fn),
+        commands: {
+            collections: {
+                lockCollectionRegistration: vi.fn(async () => { }),
+                create: vi.fn(),
+                update: vi.fn(),
+                delete: vi.fn(),
+            },
+            documents: {
+                publishSchedules: {
+                    lockDocuments: vi.fn(async () => { }),
+                    schedule: publishSchedule,
+                    confirm: confirmPublishSchedule,
+                    cancel: cancelPublishSchedule,
+                    suspendForContentEdit: suspendPublishSchedule,
+                    claimDue: claimDuePublishSchedules,
+                    lockClaim: lockPublishScheduleClaim,
+                    deleteClaim: deletePublishScheduleClaim,
+                    suspendClaimForContentEdit: suspendPublishScheduleClaim,
+                    releaseClaim: releasePublishScheduleClaim,
+                },
+                createDocumentVersion,
+                updateDocumentPath: vi.fn().mockResolvedValue(undefined),
+                setDocumentAvailableLocales: vi.fn().mockResolvedValue(undefined),
+                setDocumentStatus,
+                archivePublishedVersions,
+                softDeleteDocument,
+                restoreSoftDeletedDocument: vi.fn(),
+                deleteDocumentLocale: deleteDocumentLocale,
+                setOrderKey: vi.fn(),
+                placeTreeNode: vi.fn(),
+                removeFromTree: vi.fn(),
+                promoteChildrenAndRemoveFromTree: vi.fn(async () => ({
+                    removed: {
+                        changed: false,
+                        before: { placed: false, parentDocumentId: null, orderKey: null, index: null },
+                        after: { placed: false, parentDocumentId: null, orderKey: null, index: null },
+                        beforeSiblingDocumentIds: [],
+                        beforeSubtreeDocumentIds: [],
+                    },
+                    promoted: [],
+                })),
+            },
+            counters: {
+                ensureCounterGroup: vi.fn(),
+                nextCounterValue: vi.fn(),
+                nextScopedCounterValue: vi.fn(),
+            },
+            audit: { append: auditAppend },
+            singletons: {
+                lockSlot: vi.fn(async () => { }),
+                setMapping: vi.fn(fail),
+                clearMapping: vi.fn(fail),
+            },
+        },
+        withTransaction: transaction.run,
+        queries: {
+            collections: {
+                getAllCollections: vi.fn(),
+                getCollectionByPath: vi.fn(),
+                getCollectionById: vi.fn(),
+            },
+            documents: {
+                publishSchedules: {
+                    get: getPublishSchedule,
+                    list: listPublishSchedules,
+                },
+                getDocumentRevision: async ({ document_id }) => revisions.get(document_id) ?? 1,
+                getDocumentSystemFieldsForUpdate,
+                getDocumentById,
+                getCurrentVersionMetadata,
+                getCurrentPath,
+                getDocumentByPath: vi.fn(),
+                getDocumentByVersion: vi.fn(),
+                getDocumentsByVersionIds: vi.fn(),
+                getDocumentsByDocumentIds: vi.fn(),
+                getDocumentHistory: vi.fn(),
+                getPublishedVersion: vi.fn(),
+                getPublishedDocumentIds: vi.fn(),
+                getDocumentCountsByStatus: vi.fn(),
+                findDocuments: vi.fn(),
+                getLastOrderKey: vi.fn(),
+                getNeighborOrderKeys: vi.fn(),
+                getCanonicalDocumentOrder: vi.fn(),
+                getTreeAncestors: vi.fn(),
+                getTreeChildren: vi.fn(),
+                getTreeParent: vi.fn(),
+                getTreeSubtree: vi.fn(),
+            },
+            audit: {
+                getDocumentAuditLog: vi.fn(async () => ({
+                    entries: [],
+                    meta: { total: 0, page: 1, pageSize: 20, totalPages: 0 },
+                })),
+                findAuditLog: vi.fn(async () => ({
+                    entries: [],
+                    meta: { total: 0, page: 1, pageSize: 20, totalPages: 0 },
+                })),
+            },
+            singletons: { getMappedDocumentId: vi.fn(fail) },
+        },
+    };
+    return {
+        db,
+        createDocumentVersion,
+        setDocumentStatus,
+        archivePublishedVersions,
+        softDeleteDocument,
+        deleteDocumentLocale,
+        getDocumentById,
+        getDocumentSystemFieldsForUpdate,
+        getCurrentVersionMetadata,
+        getCurrentPath,
+        publishSchedule,
+        confirmPublishSchedule,
+        cancelPublishSchedule,
+        suspendPublishSchedule,
+        claimDuePublishSchedules,
+        lockPublishScheduleClaim,
+        deletePublishScheduleClaim,
+        suspendPublishScheduleClaim,
+        releasePublishScheduleClaim,
+        getPublishSchedule,
+        listPublishSchedules,
+        auditAppend,
+        withTransaction,
+    };
+}
+function pathUniqueViolation() {
+    return Object.assign(new Error('duplicate key value violates unique constraint'), {
+        code: '23505',
+        constraint: 'idx_document_paths_collection_locale_path',
+    });
+}
+const noopLogger = {
+    log: vi.fn(),
+    fatal: vi.fn(),
+    error: vi.fn(),
+    warn: vi.fn(),
+    info: vi.fn(),
+    debug: vi.fn(),
+    trace: vi.fn(),
+    silent: vi.fn(),
+};
+// A real persisted-user id is a UUID; `actorId()` only attributes UUIDs (see
+// the regression note below). Use a valid UUID so the default context's
+// writes are attributed.
+const TEST_ACTOR_ID = '01901234-0000-7000-8000-000000000001';
+function buildCtx(db, definition = minimalCollection) {
+    return {
+        db,
+        definition,
+        collectionId: 'col-1',
+        collectionVersion: 1,
+        collectionPath: definition.path,
+        logger: noopLogger,
+        defaultLocale: 'en',
+        // Inject a super-admin context by default so the bulk of existing
+        // tests do not have to care about ability enforcement. The dedicated
+        // "enforcement" block below covers the missing-context / missing-ability
+        // negative cases.
+        requestContext: createSuperAdminContext({ id: TEST_ACTOR_ID }),
+    };
+}
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+describe('review probes', () => {
+    it('rejects caller-selected published status for a create-only actor', async () => {
+        const { db } = createMockDb();
+        const ctx = buildCtx(db);
+        ctx.requestContext = createRequestContext({ actor: new AdminAuth({
+                id: 'editor', abilities: ['collections.articles.create'],
+            }) });
+        await expect(createDocument(ctx, { data: { title: 'Direct publish' }, status: 'published' })).rejects.toMatchObject({ code: AuthErrorCodes.FORBIDDEN });
+    });
+    it('rejects an undeclared initial workflow status', async () => {
+        const { db } = createMockDb();
+        const ctx = buildCtx(db);
+        await expect(createDocument(ctx, { data: { title: 'Invalid status' }, status: 'not-a-status' })).rejects.toBeDefined();
+    });
+});

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/core",
   "private": false,
   "license": "MPL-2.0",
-  "version": "6.7.1",
+  "version": "6.7.2",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -82,23 +82,23 @@
     "dist"
   ],
   "dependencies": {
-    "dotenv": "^18.0.1",
-    "pino": "^10.3.1",
-    "sharp": "^0.35.4",
-    "uuid": "^14.0.2",
-    "zod": "^4.6.5",
-    "@byline/auth": "6.7.1"
+    "@byline/auth": "6.7.2",
+    "dotenv": "^18.0.8",
+    "pino": "^10.4.0",
+    "sharp": "^0.35.5",
+    "uuid": "^14.0.3",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.14",
-    "@types/node": "^26.6.2",
+    "@biomejs/biome": "2.5.15",
+    "@types/node": "^26.6.5",
     "chokidar": "^5.0.0",
     "chokidar-cli": "^3.0.0",
     "npm-run-all": "^4.1.5",
-    "tsc-alias": "^1.9.5",
-    "tsx": "^4.23.13",
+    "tsc-alias": "^1.9.7",
+    "tsx": "^4.23.15",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.4"
   },
   "publishConfig": {
     "access": "public",

package/dist/config/resolve-item-view-columns.test.node.js

@@ -1,30 +0,0 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-import { describe, expect, it } from 'vitest';
-import { resolveItemViewColumns } from './config.js';
-const itemViewCols = [{ fieldName: 'title', label: 'Title' }];
-const pickerCols = [{ fieldName: 'name', label: 'Name' }];
-const cfg = (over) => ({ slug: 'x', ...over });
-describe('resolveItemViewColumns', () => {
-    it('returns itemView when present', () => {
-        expect(resolveItemViewColumns(cfg({ itemView: itemViewCols }))).toBe(itemViewCols);
-    });
-    it('falls back to the deprecated picker alias', () => {
-        expect(resolveItemViewColumns(cfg({ picker: pickerCols }))).toBe(pickerCols);
-    });
-    it('prefers itemView over picker when both are present', () => {
-        expect(resolveItemViewColumns(cfg({ itemView: itemViewCols, picker: pickerCols }))).toBe(itemViewCols);
-    });
-    it('returns undefined when neither is set', () => {
-        expect(resolveItemViewColumns(cfg({}))).toBeUndefined();
-    });
-    it('tolerates null / undefined config', () => {
-        expect(resolveItemViewColumns(null)).toBeUndefined();
-        expect(resolveItemViewColumns(undefined)).toBeUndefined();
-    });
-});