@classytic/arc 2.25.0 → 2.30.0

package/dist/testing/index.mjs

@@ -1,5 +1,10 @@
 import { t as CRUD_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { i as createApp, n as preloadResourcesAsync, p as getModuleExports, t as preloadResources } from "../preloadResources-DfyngIN9.mjs";
+import { t as BaseController } from "../BaseController-B5DwufbB.mjs";
+import { t as defineResource } from "../defineResource-CxWqDCAy.mjs";
+import { t as defineAggregation } from "../defineAggregation-ufWjUwml.mjs";
+import { n as createApp } from "../createApp-CXrKFciH.mjs";
+import { n as getModuleExports } from "../module-_-M7C5ES.mjs";
+import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-DSY5HGpS.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -123,6 +128,314 @@ function expectArc(response) {
 	return assertion;
 }
 //#endregion
+//#region src/testing/mocks.ts
+/**
+* Create a mock repository for testing
+*
+* @example
+* const mockRepo = createMockRepository<Product>({
+*   getById: vi.fn().mockResolvedValue({ id: '1', name: 'Test' }),
+*   create: vi.fn().mockImplementation(data => Promise.resolve({ id: '1', ...data })),
+* });
+*
+* await mockRepo.getById('1'); // Returns mocked product
+*/
+function createMockRepository(overrides = {}) {
+	return {
+		getAll: vi.fn().mockResolvedValue({
+			method: "offset",
+			data: [],
+			total: 0,
+			page: 1,
+			limit: 20,
+			pages: 0,
+			hasNext: false,
+			hasPrev: false
+		}),
+		getById: vi.fn().mockResolvedValue(null),
+		create: vi.fn().mockImplementation((data) => Promise.resolve({
+			_id: "mock-id",
+			...data
+		})),
+		update: vi.fn().mockImplementation((_id, data) => Promise.resolve({
+			_id: "mock-id",
+			...data
+		})),
+		delete: vi.fn().mockResolvedValue({
+			success: true,
+			message: "Deleted"
+		}),
+		updateMany: vi.fn().mockResolvedValue({
+			acknowledged: true,
+			matchedCount: 0,
+			modifiedCount: 0
+		}),
+		deleteMany: vi.fn().mockResolvedValue({
+			acknowledged: true,
+			deletedCount: 0
+		}),
+		claim: vi.fn().mockResolvedValue(null),
+		claimVersion: vi.fn().mockResolvedValue(null),
+		capabilities: {
+			transactions: false,
+			nestedTransactions: false,
+			upsert: false,
+			duplicateKeyError: false,
+			distinct: false,
+			aggregate: false,
+			getOrCreate: false,
+			countAndExists: false
+		},
+		getBySlug: vi.fn().mockResolvedValue(null),
+		getDeleted: vi.fn().mockResolvedValue([]),
+		restore: vi.fn().mockResolvedValue(null),
+		getTree: vi.fn().mockResolvedValue([]),
+		getChildren: vi.fn().mockResolvedValue([]),
+		...overrides
+	};
+}
+/**
+* Create a mock user for authentication testing
+*/
+function createMockUser(overrides = {}) {
+	return {
+		_id: "mock-user-id",
+		id: "mock-user-id",
+		email: "test@example.com",
+		roles: ["user"],
+		organizationId: null,
+		...overrides
+	};
+}
+/**
+* Create a mock Fastify request
+*/
+function createMockRequest(overrides = {}) {
+	return {
+		body: {},
+		params: {},
+		query: {},
+		headers: {},
+		user: createMockUser(),
+		context: {},
+		log: {
+			info: vi.fn(),
+			warn: vi.fn(),
+			error: vi.fn(),
+			debug: vi.fn()
+		},
+		...overrides
+	};
+}
+/**
+* Create a mock Fastify reply
+*/
+function createMockReply() {
+	return {
+		code: vi.fn().mockReturnThis(),
+		send: vi.fn().mockReturnThis(),
+		header: vi.fn().mockReturnThis(),
+		headers: vi.fn().mockReturnThis(),
+		status: vi.fn().mockReturnThis(),
+		type: vi.fn().mockReturnThis(),
+		redirect: vi.fn().mockReturnThis(),
+		callNotFound: vi.fn().mockReturnThis(),
+		sent: false
+	};
+}
+/**
+* Create a mock controller for testing
+*/
+function createMockController(repository) {
+	return {
+		repository,
+		list: vi.fn(),
+		get: vi.fn(),
+		create: vi.fn(),
+		update: vi.fn(),
+		delete: vi.fn()
+	};
+}
+/**
+* Create mock data factory
+*
+* @example
+* const productFactory = createDataFactory<Product>({
+*   name: () => faker.commerce.productName(),
+*   price: () => faker.number.int({ min: 10, max: 1000 }),
+*   sku: (i) => `SKU-${i}`,
+* });
+*
+* const product = productFactory.build();
+* const products = productFactory.buildMany(10);
+*/
+function createDataFactory(template) {
+	let counter = 0;
+	return {
+		build(overrides = {}) {
+			const index = counter++;
+			const data = {};
+			for (const [key, generator] of Object.entries(template)) data[key] = generator(index);
+			return {
+				...data,
+				...overrides
+			};
+		},
+		buildMany(count, overrides = {}) {
+			return Array.from({ length: count }, () => this.build(overrides));
+		},
+		reset() {
+			counter = 0;
+		}
+	};
+}
+/**
+* Create a spy that tracks function calls
+*
+* Useful for testing side effects without full mocking
+*/
+function createSpy(_name = "spy") {
+	const calls = [];
+	const spy = vi.fn((...args) => {
+		calls.push(args);
+	});
+	spy.getCalls = () => calls;
+	spy.getLastCall = () => calls[calls.length - 1] || [];
+	return spy;
+}
+/**
+* Wait for a condition to be true
+*
+* Useful for async testing
+*/
+async function waitFor(condition, options = {}) {
+	const { timeout = 5e3, interval = 100 } = options;
+	const startTime = Date.now();
+	while (Date.now() - startTime < timeout) {
+		if (await condition()) return;
+		await new Promise((resolve) => setTimeout(resolve, interval));
+	}
+	throw new Error(`Timeout waiting for condition after ${timeout}ms`);
+}
+/**
+* Create a test timer that can be controlled
+*/
+function createTestTimer() {
+	let time = Date.now();
+	return {
+		now: () => time,
+		advance: (ms) => {
+			time += ms;
+		},
+		set: (timestamp) => {
+			time = timestamp;
+		},
+		reset: () => {
+			time = Date.now();
+		}
+	};
+}
+//#endregion
+//#region src/testing/authorizationConformance.ts
+/**
+* Cross-surface authorization conformance (arc 2.30).
+*
+* The regression wall that keeps "partial enforcement" from ever coming back:
+* run the SAME permission through more than one arc surface and prove it enforces
+* identically. Reviews kept finding aggregation (and MCP) drifting from CRUD —
+* this makes that a one-call assertion for arc AND for host resources.
+*
+* `runAuthorizationConformance` boots a throwaway Fastify app with one resource
+* whose `list` op AND an `aggregation` share the given permission, backed by a
+* capturing mock repo (no DB). It returns, per surface, the HTTP status and the
+* exact filter arc handed the repository — so the caller asserts:
+*   - deny → both surfaces fail closed with the SAME status;
+*   - allow + `policy` → the row policy reaches BOTH the list query and the
+*     aggregation `$match`, identically.
+*
+* Runner-agnostic: it returns data, it does not assert. Pair with your test
+* framework's expectations (see `tests/core/authorization-conformance.test.ts`).
+*/
+/**
+* Boot a one-resource app gated by `permission` on both list + an aggregation,
+* hit both surfaces anonymously, and report what arc enforced on each.
+*/
+async function runAuthorizationConformance(opts) {
+	const rows = opts.rows ?? [{ _id: "1" }];
+	let listFilter;
+	let aggFilter;
+	const repo = createMockRepository({
+		getAll: (async (params = {}) => {
+			listFilter = params.filters;
+			return {
+				method: "offset",
+				data: rows,
+				total: rows.length,
+				page: 1,
+				limit: 20,
+				pages: 1,
+				hasNext: false,
+				hasPrev: false
+			};
+		}),
+		aggregate: (async (req = {}) => {
+			aggFilter = req.filter;
+			return { rows: [{ tally: rows.length }] };
+		}),
+		capabilities: {
+			count: false,
+			exists: false,
+			distinct: false,
+			aggregate: true,
+			transactions: false,
+			lookup: false,
+			softDelete: false
+		}
+	});
+	const resource = defineResource({
+		name: "conf",
+		prefix: "/confs",
+		adapter: { repository: repo },
+		controller: new BaseController(repo, {
+			resourceName: "conf",
+			tenantField: false
+		}),
+		permissions: {
+			list: opts.permission,
+			get: opts.permission,
+			create: opts.permission,
+			update: opts.permission,
+			delete: opts.permission
+		},
+		aggregations: { tally: defineAggregation({
+			measures: { tally: { op: "count" } },
+			permissions: opts.permission
+		}) }
+	});
+	const app = Fastify({ logger: false });
+	await app.register(resource.toPlugin());
+	await app.ready();
+	const list = await app.inject({
+		method: "GET",
+		url: "/confs"
+	});
+	const aggregation = await app.inject({
+		method: "GET",
+		url: "/confs/aggregations/tally"
+	});
+	return {
+		list: {
+			status: list.statusCode,
+			filter: listFilter
+		},
+		aggregation: {
+			status: aggregation.statusCode,
+			filter: aggFilter
+		},
+		close: () => app.close()
+	};
+}
+//#endregion
 //#region src/testing/authSession.ts
 function buildHeaders(token, orgId, extra) {
 	const headers = { authorization: `Bearer ${token}` };
@@ -843,214 +1156,6 @@ function createHttpTestHarness(resource, optionsOrGetter) {
 	return new HttpTestHarness(resource, optionsOrGetter);
 }
 //#endregion
-//#region src/testing/mocks.ts
-/**
-* Create a mock repository for testing
-*
-* @example
-* const mockRepo = createMockRepository<Product>({
-*   getById: vi.fn().mockResolvedValue({ id: '1', name: 'Test' }),
-*   create: vi.fn().mockImplementation(data => Promise.resolve({ id: '1', ...data })),
-* });
-*
-* await mockRepo.getById('1'); // Returns mocked product
-*/
-function createMockRepository(overrides = {}) {
-	return {
-		getAll: vi.fn().mockResolvedValue({
-			method: "offset",
-			data: [],
-			total: 0,
-			page: 1,
-			limit: 20,
-			pages: 0,
-			hasNext: false,
-			hasPrev: false
-		}),
-		getById: vi.fn().mockResolvedValue(null),
-		create: vi.fn().mockImplementation((data) => Promise.resolve({
-			_id: "mock-id",
-			...data
-		})),
-		update: vi.fn().mockImplementation((_id, data) => Promise.resolve({
-			_id: "mock-id",
-			...data
-		})),
-		delete: vi.fn().mockResolvedValue({
-			success: true,
-			message: "Deleted"
-		}),
-		updateMany: vi.fn().mockResolvedValue({
-			acknowledged: true,
-			matchedCount: 0,
-			modifiedCount: 0
-		}),
-		deleteMany: vi.fn().mockResolvedValue({
-			acknowledged: true,
-			deletedCount: 0
-		}),
-		claim: vi.fn().mockResolvedValue(null),
-		claimVersion: vi.fn().mockResolvedValue(null),
-		capabilities: {
-			transactions: false,
-			nestedTransactions: false,
-			upsert: false,
-			duplicateKeyError: false,
-			distinct: false,
-			aggregate: false,
-			getOrCreate: false,
-			countAndExists: false
-		},
-		getBySlug: vi.fn().mockResolvedValue(null),
-		getDeleted: vi.fn().mockResolvedValue([]),
-		restore: vi.fn().mockResolvedValue(null),
-		getTree: vi.fn().mockResolvedValue([]),
-		getChildren: vi.fn().mockResolvedValue([]),
-		...overrides
-	};
-}
-/**
-* Create a mock user for authentication testing
-*/
-function createMockUser(overrides = {}) {
-	return {
-		_id: "mock-user-id",
-		id: "mock-user-id",
-		email: "test@example.com",
-		roles: ["user"],
-		organizationId: null,
-		...overrides
-	};
-}
-/**
-* Create a mock Fastify request
-*/
-function createMockRequest(overrides = {}) {
-	return {
-		body: {},
-		params: {},
-		query: {},
-		headers: {},
-		user: createMockUser(),
-		context: {},
-		log: {
-			info: vi.fn(),
-			warn: vi.fn(),
-			error: vi.fn(),
-			debug: vi.fn()
-		},
-		...overrides
-	};
-}
-/**
-* Create a mock Fastify reply
-*/
-function createMockReply() {
-	return {
-		code: vi.fn().mockReturnThis(),
-		send: vi.fn().mockReturnThis(),
-		header: vi.fn().mockReturnThis(),
-		headers: vi.fn().mockReturnThis(),
-		status: vi.fn().mockReturnThis(),
-		type: vi.fn().mockReturnThis(),
-		redirect: vi.fn().mockReturnThis(),
-		callNotFound: vi.fn().mockReturnThis(),
-		sent: false
-	};
-}
-/**
-* Create a mock controller for testing
-*/
-function createMockController(repository) {
-	return {
-		repository,
-		list: vi.fn(),
-		get: vi.fn(),
-		create: vi.fn(),
-		update: vi.fn(),
-		delete: vi.fn()
-	};
-}
-/**
-* Create mock data factory
-*
-* @example
-* const productFactory = createDataFactory<Product>({
-*   name: () => faker.commerce.productName(),
-*   price: () => faker.number.int({ min: 10, max: 1000 }),
-*   sku: (i) => `SKU-${i}`,
-* });
-*
-* const product = productFactory.build();
-* const products = productFactory.buildMany(10);
-*/
-function createDataFactory(template) {
-	let counter = 0;
-	return {
-		build(overrides = {}) {
-			const index = counter++;
-			const data = {};
-			for (const [key, generator] of Object.entries(template)) data[key] = generator(index);
-			return {
-				...data,
-				...overrides
-			};
-		},
-		buildMany(count, overrides = {}) {
-			return Array.from({ length: count }, () => this.build(overrides));
-		},
-		reset() {
-			counter = 0;
-		}
-	};
-}
-/**
-* Create a spy that tracks function calls
-*
-* Useful for testing side effects without full mocking
-*/
-function createSpy(_name = "spy") {
-	const calls = [];
-	const spy = vi.fn((...args) => {
-		calls.push(args);
-	});
-	spy.getCalls = () => calls;
-	spy.getLastCall = () => calls[calls.length - 1] || [];
-	return spy;
-}
-/**
-* Wait for a condition to be true
-*
-* Useful for async testing
-*/
-async function waitFor(condition, options = {}) {
-	const { timeout = 5e3, interval = 100 } = options;
-	const startTime = Date.now();
-	while (Date.now() - startTime < timeout) {
-		if (await condition()) return;
-		await new Promise((resolve) => setTimeout(resolve, interval));
-	}
-	throw new Error(`Timeout waiting for condition after ${timeout}ms`);
-}
-/**
-* Create a test timer that can be controlled
-*/
-function createTestTimer() {
-	let time = Date.now();
-	return {
-		now: () => time,
-		advance: (ms) => {
-			time += ms;
-		},
-		set: (timestamp) => {
-			time = timestamp;
-		},
-		reset: () => {
-			time = Date.now();
-		}
-	};
-}
-//#endregion
 //#region src/testing/testApp.ts
 /**
 * createTestApp — test app factory for arc
@@ -1116,7 +1221,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../preloadResources-DfyngIN9.mjs").then((n) => n.a);
+	const { createApp } = await import("../createApp-CXrKFciH.mjs").then((n) => n.r);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;
@@ -1186,4 +1291,4 @@ function createMinimalTestApp(options = {}) {
 	});
 }
 //#endregion
-export { HttpTestHarness, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };
+export { HttpTestHarness, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };

package/dist/testing/outboxStoreContract.d.mts

@@ -0,0 +1,13 @@
+import { OutboxStore } from "@classytic/primitives/outbox";
+//#region src/testing/outboxStoreContract.d.ts
+interface OutboxStoreContractSetupResult {
+  store: OutboxStore;
+  /** Called once after the suite. */
+  teardown?: () => Promise<void>;
+  /** Empty the store between tests. Strongly recommended for isolation. */
+  reset?: () => Promise<void>;
+}
+type OutboxStoreContractSetup = () => Promise<OutboxStoreContractSetupResult>;
+declare function runOutboxStoreContract(name: string, setup: OutboxStoreContractSetup): void;
+//#endregion
+export { OutboxStoreContractSetup, OutboxStoreContractSetupResult, runOutboxStoreContract };