@dismissible/nestjs-dismissible 0.0.2-canary.8976e84.0 → 0.0.2-canary.d2f56d7.0

package/src/core/dismissible.service.spec.ts

@@ -4,16 +4,17 @@ import { DismissibleService } from './dismissible.service';
 import { DismissibleCoreService } from './dismissible-core.service';
 import { HookRunner, IHookRunResult } from './hook-runner.service';
 import { IDismissibleLogger } from '@dismissible/nestjs-logger';
+import { ValidationService } from '@dismissible/nestjs-validation';
 import { DismissibleEvents } from '../events';
-import { BaseMetadata } from '@dismissible/nestjs-dismissible-item';
 import { createTestItem, createTestContext } from '../testing/factories';
 
 describe('DismissibleService', () => {
-  let service: DismissibleService<BaseMetadata>;
-  let mockCoreService: jest.Mocked<DismissibleCoreService<BaseMetadata>>;
-  let mockHookRunner: jest.Mocked<HookRunner<BaseMetadata>>;
+  let service: DismissibleService;
+  let mockCoreService: jest.Mocked<DismissibleCoreService>;
+  let mockHookRunner: jest.Mocked<HookRunner>;
   let mockEventEmitter: jest.Mocked<EventEmitter2>;
   let mockLogger: jest.Mocked<IDismissibleLogger>;
+  let mockValidationService: jest.Mocked<ValidationService>;
 
   const testUserId = 'test-user-id';
 
@@ -29,27 +30,43 @@ describe('DismissibleService', () => {
     mockHookRunner = mock(HookRunner, { failIfMockNotProvided: false });
     mockEventEmitter = mock(EventEmitter2, { failIfMockNotProvided: false });
     mockLogger = mock<IDismissibleLogger>({ failIfMockNotProvided: false });
-
-    service = new DismissibleService(mockCoreService, mockHookRunner, mockEventEmitter, mockLogger);
+    mockValidationService = mock(ValidationService, { failIfMockNotProvided: false });
+
+    // Mock validateDto to resolve successfully by default
+    mockValidationService.validateDto.mockResolvedValue({} as never);
+
+    service = new DismissibleService(
+      mockCoreService,
+      mockHookRunner,
+      mockEventEmitter,
+      mockLogger,
+      mockValidationService,
+    );
   });
 
   describe('getOrCreate', () => {
-    it('should run hooks, call core service, and emit ITEM_RETRIEVED event for existing item', async () => {
+    it('should run request and get hooks for existing item', async () => {
       const item = createTestItem({ id: 'existing-item' });
       const context = createTestContext();
 
-      mockHookRunner.runPreGetOrCreate.mockResolvedValue(createHookResult('existing-item'));
-      mockCoreService.getOrCreate.mockResolvedValue({ item, created: false });
+      mockHookRunner.runPreRequest.mockResolvedValue(createHookResult('existing-item'));
+      mockHookRunner.runPreGet.mockResolvedValue(createHookResult('existing-item'));
+      mockCoreService.get.mockResolvedValue(item);
 
-      const result = await service.getOrCreate('existing-item', testUserId, undefined, context);
+      const result = await service.getOrCreate('existing-item', testUserId, context);
 
-      expect(mockHookRunner.runPreGetOrCreate).toHaveBeenCalled();
-      expect(mockCoreService.getOrCreate).toHaveBeenCalledWith(
+      expect(mockHookRunner.runPreRequest).toHaveBeenCalled();
+      expect(mockCoreService.get).toHaveBeenCalledWith('existing-item', testUserId);
+      expect(mockHookRunner.runPreGet).toHaveBeenCalledWith(
         'existing-item',
+        item,
         testUserId,
-        undefined,
+        expect.anything(),
       );
-      expect(mockHookRunner.runPostGetOrCreate).toHaveBeenCalled();
+      expect(mockHookRunner.runPostGet).toHaveBeenCalled();
+      expect(mockHookRunner.runPostRequest).toHaveBeenCalled();
+      expect(mockCoreService.create).not.toHaveBeenCalled();
+      expect(mockHookRunner.runPreCreate).not.toHaveBeenCalled();
       expect(mockEventEmitter.emit).toHaveBeenCalledWith(
         DismissibleEvents.ITEM_RETRIEVED,
         expect.anything(),
@@ -57,24 +74,86 @@ describe('DismissibleService', () => {
       expect(result.created).toBe(false);
     });
 
-    it('should run create hooks and emit ITEM_CREATED event for new item', async () => {
+    it('should run pre-create hooks BEFORE creating for new item', async () => {
       const item = createTestItem({ id: 'new-item' });
       const context = createTestContext();
-
-      mockHookRunner.runPreGetOrCreate.mockResolvedValue(createHookResult('new-item'));
-      mockHookRunner.runPreCreate.mockResolvedValue(createHookResult('new-item'));
-      mockCoreService.getOrCreate.mockResolvedValue({ item, created: true });
-
-      const result = await service.getOrCreate('new-item', testUserId, undefined, context);
-
+      const callOrder: string[] = [];
+
+      mockHookRunner.runPreRequest.mockResolvedValue(createHookResult('new-item'));
+      mockCoreService.get.mockResolvedValue(null);
+      mockHookRunner.runPreCreate.mockImplementation(async () => {
+        callOrder.push('runPreCreate');
+        return createHookResult('new-item');
+      });
+      mockCoreService.create.mockImplementation(async () => {
+        callOrder.push('create');
+        return item;
+      });
+
+      const result = await service.getOrCreate('new-item', testUserId, context);
+
+      // Verify pre-create hooks run BEFORE create
+      expect(callOrder).toEqual(['runPreCreate', 'create']);
+      expect(mockHookRunner.runPreRequest).toHaveBeenCalled();
       expect(mockHookRunner.runPreCreate).toHaveBeenCalled();
+      expect(mockCoreService.create).toHaveBeenCalledWith('new-item', testUserId);
       expect(mockHookRunner.runPostCreate).toHaveBeenCalled();
+      expect(mockHookRunner.runPostRequest).toHaveBeenCalled();
       expect(mockEventEmitter.emit).toHaveBeenCalledWith(
         DismissibleEvents.ITEM_CREATED,
         expect.anything(),
       );
       expect(result.created).toBe(true);
     });
+
+    it('should NOT create item when pre-create hook blocks the operation', async () => {
+      const context = createTestContext();
+
+      mockHookRunner.runPreRequest.mockResolvedValue(createHookResult('new-item'));
+      mockCoreService.get.mockResolvedValue(null);
+      mockHookRunner.runPreCreate.mockResolvedValue({
+        proceed: false,
+        reason: 'Plan limit reached',
+        id: 'new-item',
+        userId: testUserId,
+        context: createTestContext(),
+      });
+
+      await expect(service.getOrCreate('new-item', testUserId, context)).rejects.toThrow();
+
+      // Verify create was NOT called because pre-create hook blocked it
+      expect(mockCoreService.create).not.toHaveBeenCalled();
+      expect(mockHookRunner.runPostCreate).not.toHaveBeenCalled();
+      expect(mockEventEmitter.emit).not.toHaveBeenCalledWith(
+        DismissibleEvents.ITEM_CREATED,
+        expect.anything(),
+      );
+    });
+
+    it('should NOT return existing item when pre-get hook blocks the operation', async () => {
+      const item = createTestItem({ id: 'existing-item' });
+      const context = createTestContext();
+
+      mockHookRunner.runPreRequest.mockResolvedValue(createHookResult('existing-item'));
+      mockCoreService.get.mockResolvedValue(item);
+      mockHookRunner.runPreGet.mockResolvedValue({
+        proceed: false,
+        reason: 'Item access denied',
+        id: 'existing-item',
+        userId: testUserId,
+        context: createTestContext(),
+      });
+
+      await expect(service.getOrCreate('existing-item', testUserId, context)).rejects.toThrow();
+
+      // Verify post-get hooks were NOT called because pre-get hook blocked
+      expect(mockHookRunner.runPostGet).not.toHaveBeenCalled();
+      expect(mockHookRunner.runPostRequest).not.toHaveBeenCalled();
+      expect(mockEventEmitter.emit).not.toHaveBeenCalledWith(
+        DismissibleEvents.ITEM_RETRIEVED,
+        expect.anything(),
+      );
+    });
   });
 
   describe('dismiss', () => {
@@ -83,14 +162,17 @@ describe('DismissibleService', () => {
       const previousItem = createTestItem({ id: 'test-item' });
       const context = createTestContext();
 
+      mockHookRunner.runPreRequest.mockResolvedValue(createHookResult('test-item'));
       mockHookRunner.runPreDismiss.mockResolvedValue(createHookResult('test-item'));
       mockCoreService.dismiss.mockResolvedValue({ item, previousItem });
 
       const result = await service.dismiss('test-item', testUserId, context);
 
+      expect(mockHookRunner.runPreRequest).toHaveBeenCalled();
       expect(mockHookRunner.runPreDismiss).toHaveBeenCalled();
       expect(mockCoreService.dismiss).toHaveBeenCalledWith('test-item', testUserId);
       expect(mockHookRunner.runPostDismiss).toHaveBeenCalled();
+      expect(mockHookRunner.runPostRequest).toHaveBeenCalled();
       expect(mockEventEmitter.emit).toHaveBeenCalledWith(
         DismissibleEvents.ITEM_DISMISSED,
         expect.anything(),
@@ -105,14 +187,17 @@ describe('DismissibleService', () => {
       const previousItem = createTestItem({ id: 'test-item' });
       const context = createTestContext();
 
+      mockHookRunner.runPreRequest.mockResolvedValue(createHookResult('test-item'));
       mockHookRunner.runPreRestore.mockResolvedValue(createHookResult('test-item'));
       mockCoreService.restore.mockResolvedValue({ item, previousItem });
 
       const result = await service.restore('test-item', testUserId, context);
 
+      expect(mockHookRunner.runPreRequest).toHaveBeenCalled();
       expect(mockHookRunner.runPreRestore).toHaveBeenCalled();
       expect(mockCoreService.restore).toHaveBeenCalledWith('test-item', testUserId);
       expect(mockHookRunner.runPostRestore).toHaveBeenCalled();
+      expect(mockHookRunner.runPostRequest).toHaveBeenCalled();
       expect(mockEventEmitter.emit).toHaveBeenCalledWith(
         DismissibleEvents.ITEM_RESTORED,
         expect.anything(),
@@ -126,10 +211,11 @@ describe('DismissibleService', () => {
       const item = createTestItem({ id: 'test-item' });
       const context = createTestContext();
 
-      mockHookRunner.runPreGetOrCreate.mockResolvedValue(createHookResult('test-item'));
-      mockCoreService.getOrCreate.mockResolvedValue({ item, created: false });
+      mockHookRunner.runPreRequest.mockResolvedValue(createHookResult('test-item'));
+      mockHookRunner.runPreGet.mockResolvedValue(createHookResult('test-item'));
+      mockCoreService.get.mockResolvedValue(item);
 
-      await service.getOrCreate('test-item', testUserId, undefined, context);
+      await service.getOrCreate('test-item', testUserId, context);
 
       expect(mockLogger.debug).toHaveBeenCalledWith(
         expect.stringContaining('getOrCreate called'),

package/src/core/dismissible.service.ts

@@ -8,8 +8,6 @@ import {
   IDismissServiceResponse,
   IRestoreServiceResponse,
 } from './service-responses.interface';
-import { BaseMetadata } from '@dismissible/nestjs-dismissible-item';
-import { ICreateItemOptions } from './create-options';
 import { IRequestContext } from '../request/request-context.interface';
 import { DismissibleEvents } from '../events';
 import {
@@ -18,84 +16,124 @@ import {
   ItemDismissedEvent,
   ItemRestoredEvent,
 } from '../events';
+import { ValidationService } from '@dismissible/nestjs-validation';
+import { DismissibleInputDto } from '../validation';
 
 /**
  * Main orchestration service for dismissible operations.
  * Coordinates core logic, hooks, and events.
  */
 @Injectable()
-export class DismissibleService<TMetadata extends BaseMetadata = BaseMetadata> {
+export class DismissibleService {
   constructor(
-    private readonly coreService: DismissibleCoreService<TMetadata>,
-    private readonly hookRunner: HookRunner<TMetadata>,
+    private readonly coreService: DismissibleCoreService,
+    private readonly hookRunner: HookRunner,
     private readonly eventEmitter: EventEmitter2,
     @Inject(DISMISSIBLE_LOGGER)
     private readonly logger: IDismissibleLogger,
+    private readonly validationService: ValidationService,
   ) {}
 
+  /**
+   * Validates input parameters for all service methods.
+   * Provides defense in depth when the service is used directly without controllers.
+   */
+  private async validateInput(itemId: string, userId: string): Promise<void> {
+    // Validate itemId and userId
+    await this.validationService.validateDto(DismissibleInputDto, { itemId, userId });
+  }
+
   /**
    * Get an existing item or create a new one.
    * @param itemId The item identifier
    * @param userId The user identifier (required)
-   * @param options Optional creation options (metadata)
    * @param context Optional request context for tracing
    */
   async getOrCreate(
     itemId: string,
     userId: string,
-    options?: ICreateItemOptions<TMetadata>,
     context?: IRequestContext,
-  ): Promise<IGetOrCreateServiceResponse<TMetadata>> {
+  ): Promise<IGetOrCreateServiceResponse> {
     this.logger.debug(`getOrCreate called`, { itemId, userId });
 
-    // Run pre-getOrCreate hooks
-    const preResult = await this.hookRunner.runPreGetOrCreate(itemId, userId, context);
+    // Validate input parameters
+    await this.validateInput(itemId, userId);
+
+    // Run global pre-request hooks (auth, rate limiting, validation)
+    const preResult = await this.hookRunner.runPreRequest(itemId, userId, context);
     HookRunner.throwIfBlocked(preResult);
 
     const resolvedId = preResult.id;
     const resolvedUserId = preResult.userId;
     const resolvedContext = preResult.context;
 
-    // Check if we need to run create hooks (for potential new item)
-    const result = await this.coreService.getOrCreate(resolvedId, resolvedUserId, options);
+    // Check if item already exists
+    const existingItem = await this.coreService.get(resolvedId, resolvedUserId);
 
-    // If item was created, run create-specific hooks
-    if (result.created) {
-      // Run pre-create hooks
-      const preCreateResult = await this.hookRunner.runPreCreate(
+    if (existingItem) {
+      // Item exists - run pre-get hooks (access control based on item state)
+      const preGetResult = await this.hookRunner.runPreGet(
         resolvedId,
+        existingItem,
         resolvedUserId,
         resolvedContext,
       );
-      HookRunner.throwIfBlocked(preCreateResult);
-
-      // Run post-create hooks
-      await this.hookRunner.runPostCreate(resolvedId, result.item, resolvedUserId, resolvedContext);
+      HookRunner.throwIfBlocked(preGetResult);
 
-      // Emit created event (async)
-      this.eventEmitter.emit(
-        DismissibleEvents.ITEM_CREATED,
-        new ItemCreatedEvent(resolvedId, result.item, resolvedUserId, resolvedContext),
-      );
-    } else {
-      // Emit retrieved event (async)
+      // Emit retrieved event
       this.eventEmitter.emit(
         DismissibleEvents.ITEM_RETRIEVED,
-        new ItemRetrievedEvent(resolvedId, result.item, resolvedUserId, resolvedContext),
+        new ItemRetrievedEvent(resolvedId, existingItem, resolvedUserId, resolvedContext),
       );
+
+      // Run post-get hooks
+      await this.hookRunner.runPostGet(resolvedId, existingItem, resolvedUserId, resolvedContext);
+
+      // Run global post-request hooks
+      await this.hookRunner.runPostRequest(
+        resolvedId,
+        existingItem,
+        resolvedUserId,
+        resolvedContext,
+      );
+
+      this.logger.debug(`getOrCreate completed`, { itemId, created: false });
+
+      return {
+        item: existingItem,
+        created: false,
+      };
     }
 
-    // Run post-getOrCreate hooks
-    await this.hookRunner.runPostGetOrCreate(
+    // Item doesn't exist - run pre-create hooks BEFORE creating
+    const preCreateResult = await this.hookRunner.runPreCreate(
       resolvedId,
-      result.item,
       resolvedUserId,
       resolvedContext,
     );
+    HookRunner.throwIfBlocked(preCreateResult);
 
-    this.logger.debug(`getOrCreate completed`, { itemId, created: result.created });
+    // Now create the item
+    const createdItem = await this.coreService.create(resolvedId, resolvedUserId);
 
-    return result;
+    // Run post-create hooks
+    await this.hookRunner.runPostCreate(resolvedId, createdItem, resolvedUserId, resolvedContext);
+
+    // Emit created event
+    this.eventEmitter.emit(
+      DismissibleEvents.ITEM_CREATED,
+      new ItemCreatedEvent(resolvedId, createdItem, resolvedUserId, resolvedContext),
+    );
+
+    // Run global post-request hooks
+    await this.hookRunner.runPostRequest(resolvedId, createdItem, resolvedUserId, resolvedContext);
+
+    this.logger.debug(`getOrCreate completed`, { itemId, created: true });
+
+    return {
+      item: createdItem,
+      created: true,
+    };
   }
 
   /**
@@ -108,16 +146,27 @@ export class DismissibleService<TMetadata extends BaseMetadata = BaseMetadata> {
     itemId: string,
     userId: string,
     context?: IRequestContext,
-  ): Promise<IDismissServiceResponse<TMetadata>> {
+  ): Promise<IDismissServiceResponse> {
     this.logger.debug(`dismiss called`, { itemId, userId });
 
-    // Run pre-dismiss hooks
-    const preResult = await this.hookRunner.runPreDismiss(itemId, userId, context);
-    HookRunner.throwIfBlocked(preResult);
+    // Validate input parameters
+    await this.validateInput(itemId, userId);
 
-    const resolvedId = preResult.id;
-    const resolvedUserId = preResult.userId;
-    const resolvedContext = preResult.context;
+    // Run global pre-request hooks (auth, rate limiting, validation)
+    const preRequestResult = await this.hookRunner.runPreRequest(itemId, userId, context);
+    HookRunner.throwIfBlocked(preRequestResult);
+
+    const resolvedId = preRequestResult.id;
+    const resolvedUserId = preRequestResult.userId;
+    const resolvedContext = preRequestResult.context;
+
+    // Run pre-dismiss hooks
+    const preDismissResult = await this.hookRunner.runPreDismiss(
+      resolvedId,
+      resolvedUserId,
+      resolvedContext,
+    );
+    HookRunner.throwIfBlocked(preDismissResult);
 
     // Execute core dismiss operation
     const result = await this.coreService.dismiss(resolvedId, resolvedUserId);
@@ -125,7 +174,7 @@ export class DismissibleService<TMetadata extends BaseMetadata = BaseMetadata> {
     // Run post-dismiss hooks
     await this.hookRunner.runPostDismiss(resolvedId, result.item, resolvedUserId, resolvedContext);
 
-    // Emit dismissed event (async)
+    // Emit dismissed event
     this.eventEmitter.emit(
       DismissibleEvents.ITEM_DISMISSED,
       new ItemDismissedEvent(
@@ -137,6 +186,9 @@ export class DismissibleService<TMetadata extends BaseMetadata = BaseMetadata> {
       ),
     );
 
+    // Run global post-request hooks
+    await this.hookRunner.runPostRequest(resolvedId, result.item, resolvedUserId, resolvedContext);
+
     this.logger.debug(`dismiss completed`, { itemId });
 
     return result;
@@ -152,16 +204,27 @@ export class DismissibleService<TMetadata extends BaseMetadata = BaseMetadata> {
     itemId: string,
     userId: string,
     context?: IRequestContext,
-  ): Promise<IRestoreServiceResponse<TMetadata>> {
+  ): Promise<IRestoreServiceResponse> {
     this.logger.debug(`restore called`, { itemId, userId });
 
-    // Run pre-restore hooks
-    const preResult = await this.hookRunner.runPreRestore(itemId, userId, context);
-    HookRunner.throwIfBlocked(preResult);
+    // Validate input parameters
+    await this.validateInput(itemId, userId);
 
-    const resolvedId = preResult.id;
-    const resolvedUserId = preResult.userId;
-    const resolvedContext = preResult.context;
+    // Run global pre-request hooks (auth, rate limiting, validation)
+    const preRequestResult = await this.hookRunner.runPreRequest(itemId, userId, context);
+    HookRunner.throwIfBlocked(preRequestResult);
+
+    const resolvedId = preRequestResult.id;
+    const resolvedUserId = preRequestResult.userId;
+    const resolvedContext = preRequestResult.context;
+
+    // Run pre-restore hooks
+    const preRestoreResult = await this.hookRunner.runPreRestore(
+      resolvedId,
+      resolvedUserId,
+      resolvedContext,
+    );
+    HookRunner.throwIfBlocked(preRestoreResult);
 
     // Execute core restore operation
     const result = await this.coreService.restore(resolvedId, resolvedUserId);
@@ -169,7 +232,7 @@ export class DismissibleService<TMetadata extends BaseMetadata = BaseMetadata> {
     // Run post-restore hooks
     await this.hookRunner.runPostRestore(resolvedId, result.item, resolvedUserId, resolvedContext);
 
-    // Emit restored event (async)
+    // Emit restored event
     this.eventEmitter.emit(
       DismissibleEvents.ITEM_RESTORED,
       new ItemRestoredEvent(
@@ -181,6 +244,9 @@ export class DismissibleService<TMetadata extends BaseMetadata = BaseMetadata> {
       ),
     );
 
+    // Run global post-request hooks
+    await this.hookRunner.runPostRequest(resolvedId, result.item, resolvedUserId, resolvedContext);
+
     this.logger.debug(`restore completed`, { itemId });
 
     return result;