@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/tests/cases/unit/panelAccessResolver.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, PanelAccessResolver, Providers } from '../../../src/index.js'
+import { getConfigSql } from '../integration/mocked/sql/getConfigSql.js'
+
+const identityId = '123e4567-e89b-12d3-a456-000000000001'
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => new Date('2026-08-06T12:00:00.000Z'),
+	randomBytes: length => Promise.resolve(Buffer.alloc(length)),
+	uuid: () => 'uuid',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: value => Buffer.from(value.toString()),
+}
+
+const resolve = async (queries: ExpectedQuery[], globalRoles: readonly string[]) => {
+	const connection = createConnectionMock(queries)
+	const db = new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+	const result = await new PanelAccessResolver(providers).isAllowed(db, identityId, globalRoles)
+	expect(queries).toHaveLength(0)
+	return result
+}
+
+const projectRolesSql = (roles: string[]): ExpectedQuery => ({
+	sql: 'select "project_id", "role" from "tenant"."project_membership" where "identity_id" = ?',
+	parameters: [identityId],
+	response: { rows: roles.map((role, index) => ({ project_id: `project-${index}`, role })) },
+})
+
+describe('PanelAccessResolver', () => {
+	test('allows project_admin through the default global policy without reading memberships', async () => {
+		expect(await resolve([getConfigSql()], ['project_admin'])).toBe(true)
+	})
+
+	test('allows a configured custom global role', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: ['project_creator'], panel_project_roles: [] })], ['project_creator'])).toBe(true)
+	})
+
+	test('denies everyone when both policy lists are empty', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: [] })], ['super_admin'])).toBe(false)
+	})
+
+	test('allows a matching project role and denies a non-matching role', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: ['admin'] }), projectRolesSql(['editor', 'admin'])], [])).toBe(
+			true,
+		)
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: ['admin'] }), projectRolesSql(['editor'])], [])).toBe(false)
+	})
+})

package/tests/cases/unit/updateConfigurationCommand.test.ts

@@ -0,0 +1,63 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, type ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, type Providers, Schema, UpdateConfigurationCommand } from '../../../src/index.js'
+
+const createProviders = (encrypt: Providers['encrypt'] = async value => ({ value, version: 1 })): Providers => ({
+	bcrypt: async value => value,
+	bcryptCompare: async () => true,
+	now: () => new Date('2026-08-11T00:00:00Z'),
+	randomBytes: async length => Buffer.alloc(length),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: async value => ({ value, needsReEncrypt: false }),
+	encrypt,
+	encryptionEnabled: true,
+	hash: value => Buffer.from(value.toString()),
+})
+
+const execute = async (
+	configuration: Schema.ConfigInput,
+	expectedQuery: ExpectedQuery,
+	providers: Providers = createProviders(),
+): Promise<void> => {
+	const expectedQueries = [expectedQuery]
+	const connection = createConnectionMock(expectedQueries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, providers)
+
+	await db.commandBus.execute(new UpdateConfigurationCommand(configuration))
+
+	expect(expectedQueries).toHaveLength(0)
+}
+
+test('captcha secret null preserves the stored secret and version while provider null disables captcha', async () => {
+	let encryptCalls = 0
+	const providers = createProviders(async value => {
+		encryptCalls++
+		return { value, version: 99 }
+	})
+
+	await execute({ captcha: { provider: null, secret: null } }, {
+		sql: 'update "tenant"."config" set "captcha_provider" = ? where "id" = ?',
+		parameters: [null, 'singleton'],
+		response: { rowCount: 1 },
+	}, providers)
+
+	// The partial UPDATE omits both stored columns, so their existing bytes/version survive.
+	expect(encryptCalls).toBe(0)
+})
+
+test('omitting captcha secret preserves the stored secret and version', async () => {
+	await execute({ captcha: { threshold: null } }, {
+		sql: 'update "tenant"."config" set "captcha_threshold" = ? where "id" = ?',
+		parameters: [null, 'singleton'],
+		response: { rowCount: 1 },
+	})
+})
+
+test('an empty captcha secret explicitly clears both stored secret columns', async () => {
+	await execute({ captcha: { secret: '' } }, {
+		sql: 'update "tenant"."config" set "captcha_secret" = ?, "captcha_secret_version" = ? where "id" = ?',
+		parameters: [null, null, 'singleton'],
+		response: { rowCount: 1 },
+	})
+})

package/tests/src/IdPMock.ts

@@ -13,6 +13,10 @@ export class IdPMock implements IdentityProviderHandler<any> {
 			externalIdentifier: configuration.externalIdentifier,
 			email: configuration.email,
 			emailVerified: configuration.emailVerified,
+			// Surface any extra claims configured on the mock (e.g. `groups`, `department`) verbatim,
+			// mirroring how real providers spread raw OIDC claims into the IDPResponse — lets tests
+			// drive claim-mapping (A09). `claimMapping` itself lives on the IdP config, not here.
+			...(configuration.claims ?? {}),
 		})
 	}
 

package/tests/src/testTenant.ts

@@ -45,6 +45,12 @@ export interface Test {
 	 * to exercise forbidden / partially-allowed (e.g. per-role) ACL branches.
 	 */
 	authorizator?: Authorizator<Identity>
+	/**
+	 * Override the project schema resolver (default: a fixed schema defining roles `editor` / `reviewer`).
+	 * Pass `{ getSchema: () => Promise.resolve(undefined) }` to exercise the unresolvable-schema branch of
+	 * the A09 apply-time backstop.
+	 */
+	projectSchemaResolver?: ProjectSchemaResolver
 }
 
 export const createUuidGenerator = () => {
@@ -65,13 +71,37 @@ const schema: Schema = {
 						type: Acl.VariableType.entity,
 						entityName: 'Language',
 					},
+					// A condition variable for the claim-mapping config-validation tests. It carries a `fallback`
+					// so it is OPTIONAL — a membership that doesn't set it (e.g. createApiKey's editor grant)
+					// stays valid instead of failing with VARIABLE_EMPTY.
+					siteFilter: {
+						type: Acl.VariableType.condition,
+						fallback: { never: true },
+					},
+					// An entity variable used by the claim-mapping apply tests (a claim mapped to locale ids).
+					// Carries a `fallback` so it stays OPTIONAL on the direct add-member path, while A09's
+					// apply-time backstop now drops a grant naming a role/variable absent from the live ACL — so
+					// the variable must exist here for the happy-path apply tests to validate and be applied.
+					locale: {
+						type: Acl.VariableType.entity,
+						entityName: 'Locale',
+						fallback: { never: true },
+					},
 				},
 			},
+			// A second project role for the claim-mapping reconciliation tests (unmatched: remove grants and
+			// strips both `editor` and `reviewer`). Must exist in the live ACL or A09's apply-time backstop
+			// drops the grant for it.
+			reviewer: {
+				stages: '*',
+				entities: {},
+				variables: {},
+			},
 		},
 	},
 }
 
-const projectSchemaResolver: ProjectSchemaResolver = {
+const defaultProjectSchemaResolver: ProjectSchemaResolver = {
 	getSchema: project => Promise.resolve(schema),
 }
 
@@ -80,6 +110,7 @@ export const authenticatedApiKeyId = testUuid(998)
 
 export const executeTenantTest = async (test: Test) => {
 	const mailer = createMockedMailer()
+	const projectSchemaResolver = test.projectSchemaResolver ?? defaultProjectSchemaResolver
 	const providers: Providers = {
 		bcrypt: (value: string) => Promise.resolve('BCRYPTED-' + value),
 		bcryptCompare: (data: string, hash: string) => Promise.resolve('BCRYPTED-' + data === hash),

package/dist/development/src/model/commands/membership/RemoveProjectMembershipsCommand.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/membership/RemoveProjectMembershipsCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/membership/RemoveProjectMembershipsCommand.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/membership/RemoveProjectMembershipsCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/types/model/commands/membership/RemoveProjectMembershipsCommand.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,qBAAa,8BAA+B,YAAW,OAAO,CAAC,IAAI,CAAC;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAA7E,SAAS,EAAE,MAAM,EAAmB,UAAU,EAAE,MAAM,EAAmB,IAAI,EAAE,MAAM;IAE5G,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}