@flusys/nestjs-auth 6.0.1 → 6.1.0

package/fesm/services/user-permission.service.spec.js

@@ -0,0 +1,198 @@
+import { ConflictException, NotFoundException } from '@nestjs/common';
+import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { UserPermissionService } from './user-permission.service';
+import { PermissionType } from '../entities/user-company-permission.entity';
+function buildPermission(overrides = {}) {
+    return {
+        id: 'perm-uuid-1',
+        userId: 'user-1',
+        permissionType: PermissionType.COMPANY,
+        targetId: 'company-1',
+        isActive: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        ...overrides
+    };
+}
+describe('UserPermissionService', ()=>{
+    let service;
+    let mockRepo;
+    let mockPermissionSyncAdapter;
+    beforeEach(()=>{
+        mockRepo = createMockRepository();
+        // The shared query builder mock does not include join helpers used by this service.
+        Object.assign(mockRepo.createQueryBuilder(), {
+            innerJoin: jest.fn().mockReturnThis(),
+            leftJoinAndSelect: jest.fn().mockReturnThis()
+        });
+        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
+        mockPermissionSyncAdapter = {
+            onCompanyDeleted: jest.fn(),
+            onBranchDeleted: jest.fn(),
+            onUserCompanyAccessRevoked: jest.fn(),
+            onUserBranchAccessRevoked: jest.fn()
+        };
+        service = new UserPermissionService(mockDataSourceProvider, mockPermissionSyncAdapter);
+    });
+    describe('findUserPermissions', ()=>{
+        it('finds company permissions with the company relation', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildPermission()
+            ]);
+            const result = await service.findUserPermissions('user-1', PermissionType.COMPANY);
+            expect(result).toHaveLength(1);
+            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
+                where: {
+                    userId: 'user-1',
+                    permissionType: PermissionType.COMPANY
+                },
+                relations: [
+                    'company'
+                ]
+            }));
+        });
+        it('finds branch permissions with the branch relation', async ()=>{
+            mockRepo.find.mockResolvedValue([]);
+            await service.findUserPermissions('user-1', PermissionType.BRANCH);
+            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
+                relations: [
+                    'branch'
+                ]
+            }));
+        });
+    });
+    describe('assignPermission', ()=>{
+        it('creates and saves a new permission when none exists', async ()=>{
+            mockRepo.findOne.mockResolvedValue(null);
+            mockRepo.create.mockReturnValue(buildPermission());
+            mockRepo.save.mockResolvedValue(buildPermission());
+            await service.assignPermission('user-1', 'company-1', PermissionType.COMPANY);
+            expect(mockRepo.create).toHaveBeenCalledWith({
+                userId: 'user-1',
+                permissionType: PermissionType.COMPANY,
+                targetId: 'company-1'
+            });
+            expect(mockRepo.save).toHaveBeenCalled();
+        });
+        it('throws ConflictException when the permission already exists', async ()=>{
+            mockRepo.findOne.mockResolvedValue(buildPermission());
+            await expect(service.assignPermission('user-1', 'company-1', PermissionType.COMPANY)).rejects.toThrow(ConflictException);
+            expect(mockRepo.save).not.toHaveBeenCalled();
+        });
+        it('translates a duplicate-entry database error into ConflictException', async ()=>{
+            mockRepo.findOne.mockResolvedValue(null);
+            mockRepo.create.mockReturnValue(buildPermission());
+            mockRepo.save.mockRejectedValue({
+                code: 'ER_DUP_ENTRY',
+                message: 'Duplicate entry'
+            });
+            await expect(service.assignPermission('user-1', 'company-1', PermissionType.COMPANY)).rejects.toThrow(ConflictException);
+        });
+        it('rethrows unrelated database errors from save', async ()=>{
+            mockRepo.findOne.mockResolvedValue(null);
+            mockRepo.create.mockReturnValue(buildPermission());
+            const dbError = new Error('connection lost');
+            mockRepo.save.mockRejectedValue(dbError);
+            await expect(service.assignPermission('user-1', 'company-1', PermissionType.COMPANY)).rejects.toThrow('connection lost');
+        });
+    });
+    describe('revokePermission', ()=>{
+        it('throws NotFoundException when the permission does not exist', async ()=>{
+            mockRepo.findOne.mockResolvedValue(null);
+            await expect(service.revokePermission('user-1', 'company-1', PermissionType.COMPANY)).rejects.toThrow(NotFoundException);
+        });
+        it('removes a company permission and cascades revocation to its branches', async ()=>{
+            const companyPermission = buildPermission({
+                permissionType: PermissionType.COMPANY
+            });
+            mockRepo.findOne.mockResolvedValue(companyPermission);
+            mockRepo.remove.mockResolvedValue(companyPermission);
+            const branchPermission = buildPermission({
+                id: 'perm-branch-1',
+                permissionType: PermissionType.BRANCH,
+                targetId: 'branch-1'
+            });
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
+                branchPermission
+            ]);
+            await service.revokePermission('user-1', 'company-1', PermissionType.COMPANY);
+            expect(mockRepo.remove).toHaveBeenCalledWith(companyPermission);
+            expect(mockRepo.remove).toHaveBeenCalledWith([
+                branchPermission
+            ]);
+            expect(mockPermissionSyncAdapter.onUserCompanyAccessRevoked).toHaveBeenCalledWith('user-1', 'company-1');
+            expect(mockPermissionSyncAdapter.onUserBranchAccessRevoked).toHaveBeenCalledWith('user-1', 'branch-1', 'company-1');
+        });
+        it('removes a branch permission and notifies the sync adapter with its company id', async ()=>{
+            const branchPermission = buildPermission({
+                permissionType: PermissionType.BRANCH,
+                targetId: 'branch-1',
+                branch: {
+                    companyId: 'company-1'
+                }
+            });
+            mockRepo.findOne.mockResolvedValue(branchPermission);
+            mockRepo.remove.mockResolvedValue(branchPermission);
+            await service.revokePermission('user-1', 'branch-1', PermissionType.BRANCH);
+            expect(mockRepo.remove).toHaveBeenCalledWith(branchPermission);
+            expect(mockPermissionSyncAdapter.onUserBranchAccessRevoked).toHaveBeenCalledWith('user-1', 'branch-1', 'company-1');
+        });
+        it('does not notify the sync adapter for a branch permission with no resolvable company', async ()=>{
+            const branchPermission = buildPermission({
+                permissionType: PermissionType.BRANCH,
+                targetId: 'branch-1',
+                branch: undefined
+            });
+            mockRepo.findOne.mockResolvedValue(branchPermission);
+            mockRepo.remove.mockResolvedValue(branchPermission);
+            await service.revokePermission('user-1', 'branch-1', PermissionType.BRANCH);
+            expect(mockPermissionSyncAdapter.onUserBranchAccessRevoked).not.toHaveBeenCalled();
+        });
+        it('works without a permission sync adapter configured', async ()=>{
+            service = new UserPermissionService(createMockDataSourceProvider(mockRepo), undefined);
+            const companyPermission = buildPermission({
+                permissionType: PermissionType.COMPANY
+            });
+            mockRepo.findOne.mockResolvedValue(companyPermission);
+            mockRepo.remove.mockResolvedValue(companyPermission);
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([]);
+            await expect(service.revokePermission('user-1', 'company-1', PermissionType.COMPANY)).resolves.toBeUndefined();
+        });
+    });
+    describe('findUserCompanies', ()=>{
+        it('delegates to findUserPermissions with COMPANY type', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildPermission()
+            ]);
+            const result = await service.findUserCompanies('user-1');
+            expect(result).toHaveLength(1);
+            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
+                where: {
+                    userId: 'user-1',
+                    permissionType: PermissionType.COMPANY
+                }
+            }));
+        });
+    });
+    describe('findUserBranches', ()=>{
+        it('queries branch permissions for a user without a company filter', async ()=>{
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([]);
+            await service.findUserBranches('user-1');
+            const qb = mockRepo.createQueryBuilder();
+            expect(qb.where).toHaveBeenCalledWith('permission.userId = :userId', {
+                userId: 'user-1'
+            });
+            expect(qb.andWhere).toHaveBeenCalledWith('permission.permissionType = :type', {
+                type: PermissionType.BRANCH
+            });
+        });
+        it('applies an additional company filter when companyId is provided', async ()=>{
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([]);
+            await service.findUserBranches('user-1', 'company-1');
+            const qb = mockRepo.createQueryBuilder();
+            expect(qb.andWhere).toHaveBeenCalledWith('branch.companyId = :companyId', {
+                companyId: 'company-1'
+            });
+        });
+    });
+});