@flusys/nestjs-auth 7.0.2 → 7.1.0

package/fesm/providers/social-provider.registry.spec.js

@@ -0,0 +1,131 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { getSocialProvider } from './social-provider.registry';
+const CREDENTIALS = {
+    clientId: 'client-id',
+    clientSecret: 'client-secret',
+    redirectUri: 'http://localhost:2001/auth/social/callback'
+};
+function mockFetchSequence(...responses) {
+    const fetchMock = jest.fn();
+    for (const response of responses){
+        fetchMock.mockResolvedValueOnce({
+            ok: response.ok ?? true,
+            status: response.status ?? 200,
+            text: async ()=>JSON.stringify(response.body)
+        });
+    }
+    globalThis.fetch = fetchMock;
+    return fetchMock;
+}
+describe('social providers', ()=>{
+    afterEach(()=>jest.restoreAllMocks());
+    describe('buildAuthorizationUrl', ()=>{
+        it.each(Object.values(SocialProviderTypeEnum))('carries the client id, redirect URI and state for %s', (provider)=>{
+            const url = new URL(getSocialProvider(provider).buildAuthorizationUrl(CREDENTIALS, 'state-token'));
+            expect(url.searchParams.get('client_id')).toBe('client-id');
+            expect(url.searchParams.get('redirect_uri')).toBe(CREDENTIALS.redirectUri);
+            expect(url.searchParams.get('state')).toBe('state-token');
+            expect(url.searchParams.get('scope')).toBeTruthy();
+        });
+        it('uses the configured scopes over the provider defaults', ()=>{
+            const url = new URL(getSocialProvider(SocialProviderTypeEnum.GOOGLE).buildAuthorizationUrl({
+                ...CREDENTIALS,
+                scopes: [
+                    'openid',
+                    'email'
+                ]
+            }, 'state-token'));
+            expect(url.searchParams.get('scope')).toBe('openid email');
+        });
+        it('targets the common Microsoft directory unless a tenant is configured', ()=>{
+            const provider = getSocialProvider(SocialProviderTypeEnum.MICROSOFT);
+            expect(provider.buildAuthorizationUrl(CREDENTIALS, 'state-token')).toContain('login.microsoftonline.com/common/');
+            expect(provider.buildAuthorizationUrl({
+                ...CREDENTIALS,
+                extraConfig: {
+                    tenantId: 'contoso'
+                }
+            }, 'state-token')).toContain('login.microsoftonline.com/contoso/');
+        });
+    });
+    describe('fetchProfile', ()=>{
+        it('normalises a Google OpenID profile', async ()=>{
+            mockFetchSequence({
+                body: {
+                    access_token: 'token'
+                }
+            }, {
+                body: {
+                    sub: 'google-1',
+                    email: 'user@example.com',
+                    email_verified: true,
+                    name: 'Test User',
+                    picture: 'https://cdn.test/avatar.png'
+                }
+            });
+            const profile = await getSocialProvider(SocialProviderTypeEnum.GOOGLE).fetchProfile(CREDENTIALS, 'code');
+            expect(profile).toEqual({
+                providerUserId: 'google-1',
+                email: 'user@example.com',
+                emailVerified: true,
+                name: 'Test User',
+                avatarUrl: 'https://cdn.test/avatar.png'
+            });
+        });
+        it('reads the nested avatar Facebook returns', async ()=>{
+            mockFetchSequence({
+                body: {
+                    access_token: 'token'
+                }
+            }, {
+                body: {
+                    id: 'fb-1',
+                    name: 'Test User',
+                    email: 'user@example.com',
+                    picture: {
+                        data: {
+                            url: 'https://cdn.test/fb.png'
+                        }
+                    }
+                }
+            });
+            const profile = await getSocialProvider(SocialProviderTypeEnum.FACEBOOK).fetchProfile(CREDENTIALS, 'code');
+            expect(profile.avatarUrl).toBe('https://cdn.test/fb.png');
+            expect(profile.emailVerified).toBe(true);
+        });
+        it('falls back to the Microsoft principal name when no mailbox is set', async ()=>{
+            mockFetchSequence({
+                body: {
+                    access_token: 'token'
+                }
+            }, {
+                body: {
+                    id: 'ms-1',
+                    displayName: 'Test User',
+                    userPrincipalName: 'user@contoso.com'
+                }
+            });
+            const profile = await getSocialProvider(SocialProviderTypeEnum.MICROSOFT).fetchProfile(CREDENTIALS, 'code');
+            expect(profile.email).toBe('user@contoso.com');
+        });
+        it('rejects when the token endpoint fails', async ()=>{
+            mockFetchSequence({
+                ok: false,
+                status: 400,
+                body: {
+                    error: 'invalid_grant'
+                }
+            });
+            await expect(getSocialProvider(SocialProviderTypeEnum.LINKEDIN).fetchProfile(CREDENTIALS, 'code')).rejects.toThrow(UnauthorizedException);
+        });
+        it('rejects when the token response carries no access token', async ()=>{
+            mockFetchSequence({
+                body: {
+                    token_type: 'bearer'
+                }
+            });
+            await expect(getSocialProvider(SocialProviderTypeEnum.GOOGLE).fetchProfile(CREDENTIALS, 'code')).rejects.toThrow(UnauthorizedException);
+        });
+    });
+});

package/fesm/services/auth-config.service.js

@@ -45,6 +45,9 @@ export class AuthConfigService {
     isEmailVerificationEnabled() {
         return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isSignUpEnabled() {
+        return this.options.bootstrapAppConfig?.enableSignUp ?? true;
+    }
     isPermissionModeFound() {
         return this.options.bootstrapAppConfig?.permissionMode !== undefined;
     }

package/fesm/services/auth-config.service.spec.js

@@ -17,6 +17,7 @@ describe('AuthConfigService', ()=>{
             expect(service.isMultiTenant()).toBe(false);
             expect(service.isCompanyFeatureEnabled()).toBe(false);
             expect(service.isEmailVerificationEnabled()).toBe(true);
+            expect(service.isSignUpEnabled()).toBe(true);
             expect(service.isPermissionModeFound()).toBe(false);
         });
         it('throws when reading the JWT secret without configuration', ()=>{
@@ -49,6 +50,7 @@ describe('AuthConfigService', ()=>{
                     databaseMode: 'multi-tenant',
                     enableCompanyFeature: true,
                     enableEmailVerification: false,
+                    enableSignUp: false,
                     permissionMode: 'RBAC'
                 },
                 config: {
@@ -70,6 +72,7 @@ describe('AuthConfigService', ()=>{
             const service = new AuthConfigService(buildOptions());
             expect(service.isCompanyFeatureEnabled()).toBe(true);
             expect(service.isEmailVerificationEnabled()).toBe(false);
+            expect(service.isSignUpEnabled()).toBe(false);
             expect(service.isPermissionModeFound()).toBe(true);
         });
         it('returns configured JWT and refresh token values', ()=>{

package/fesm/services/auth-datasource.provider.js

@@ -48,6 +48,10 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
         const effectiveTenant = tenant ?? this.getCurrentTenant();
         return effectiveTenant?.enableEmailVerification ?? this.authOptions.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isSignUpEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableSignUp ?? this.authOptions.bootstrapAppConfig?.enableSignUp ?? true;
+    }
     async getAuthEntities() {
         const { getAuthEntitiesByConfig } = await import('../entities');
         return getAuthEntitiesByConfig({

package/fesm/services/auth-datasource.provider.spec.js

@@ -78,6 +78,36 @@ describe('AuthDataSourceProvider', ()=>{
             })).toBe(false);
         });
     });
+    describe('isSignUpEnabled', ()=>{
+        it('returns true by default (sign-up defaults to enabled)', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: undefined
+            }));
+            expect(provider.isSignUpEnabled()).toBe(true);
+        });
+        it('returns false when bootstrap config disables it', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: false,
+                    enableSignUp: false
+                }
+            }));
+            expect(provider.isSignUpEnabled()).toBe(false);
+        });
+        it('prefers the tenant override over bootstrap config', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'multi-tenant',
+                    enableCompanyFeature: true,
+                    enableSignUp: true
+                }
+            }));
+            expect(provider.isSignUpEnabled({
+                enableSignUp: false
+            })).toBe(false);
+        });
+    });
     describe('getAuthEntities', ()=>{
         it('returns only base entities when company feature and email verification are disabled', async ()=>{
             const provider = new AuthDataSourceProvider(buildOptions({

package/fesm/services/authentication.service.js

@@ -57,6 +57,9 @@ export class AuthenticationService {
         const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
         return featureEnabled && providerAvailable;
     }
+    isSignUpEnabled() {
+        return this.dataSourceProvider?.isSignUpEnabled() ?? this.authConfig.isSignUpEnabled();
+    }
     async getUserRepository() {
         if (!this.dataSourceProvider) {
             throw new InternalServerErrorException({
@@ -83,12 +86,7 @@ export class AuthenticationService {
             };
         }
         const user = await this.validateUser(email, password);
-        if (!user.isActive) {
-            throw new ForbiddenException({
-                message: 'User account is deactivated',
-                messageKey: AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
-            });
-        }
+        this.ensureUserActive(user);
         if (this.isEmailVerificationEnabled() && !user.emailVerified) {
             return {
                 requiresEmailVerification: true,
@@ -97,11 +95,23 @@ export class AuthenticationService {
                 messageKey: AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED
             };
         }
+        return this.issueLoginForUser(user);
+    }
+    async issueLoginForUser(user) {
+        this.ensureUserActive(user);
         if (!this.isCompanyFeatureEnabled()) {
             return this.generateLoginResponse(user);
         }
         return await this.handleCompanyBasedLogin(user);
     }
+    ensureUserActive(user) {
+        if (!user.isActive) {
+            throw new ForbiddenException({
+                message: 'User account is deactivated',
+                messageKey: AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
+            });
+        }
+    }
     async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
         const branchRepository = await this.getCompanyScopedRepository(CompanyBranch);
@@ -149,8 +159,15 @@ export class AuthenticationService {
         const existingUser = await userRepository.findOne({
             where: {
                 email: dto.email
-            }
+            },
+            withDeleted: true
         });
+        if (existingUser?.deletedAt) {
+            throw new BadRequestException({
+                message: 'This account has been permanently deleted. Please contact your system administrator.',
+                messageKey: AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
+            });
+        }
         if (existingUser && this.isCompanyFeatureEnabled()) {
             return await this.handleExistingUserCompanyRegistration(existingUser, dto);
         }
@@ -160,6 +177,12 @@ export class AuthenticationService {
                 messageKey: AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
             });
         }
+        if (!this.isSignUpEnabled()) {
+            throw new BadRequestException({
+                message: 'New account registration is currently disabled.',
+                messageKey: AUTH_MESSAGES.REGISTER_SIGNUP_DISABLED
+            });
+        }
         if (this.isEmailVerificationEnabled() && verifyUrlBase) {
             const companyData = this.isCompanyFeatureEnabled() ? {
                 companySlug: dto.companySlug,
@@ -287,8 +310,15 @@ export class AuthenticationService {
             const existingUser = await queryRunner.manager.findOne(AppUser, {
                 where: {
                     email: pending.email
-                }
+                },
+                withDeleted: true
             });
+            if (existingUser?.deletedAt) {
+                throw new BadRequestException({
+                    message: 'This account has been permanently deleted. Please contact your system administrator.',
+                    messageKey: AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
+                });
+            }
             if (existingUser) {
                 throw new BadRequestException({
                     message: 'This email has already been registered.',

package/fesm/services/authentication.service.spec.js

@@ -86,6 +86,7 @@ describe('AuthenticationService', ()=>{
     let mockUserEnricher;
     let companyFeatureEnabled;
     let emailVerificationEnabled;
+    let signUpEnabled;
     function buildService(overrides = {}) {
         return new AuthenticationService(mockJwtService, mockAuthConfig, 'cacheManager' in overrides ? overrides.cacheManager : mockCacheManager, 'dataSourceProvider' in overrides ? overrides.dataSourceProvider : mockDataSourceProvider, 'sessionService' in overrides ? overrides.sessionService : mockSessionService, 'authEmailService' in overrides ? overrides.authEmailService : mockAuthEmailService, 'userEnricher' in overrides ? overrides.userEnricher : mockUserEnricher, 'notificationAdapter' in overrides ? overrides.notificationAdapter : undefined);
     }
@@ -102,6 +103,7 @@ describe('AuthenticationService', ()=>{
         });
         companyFeatureEnabled = false;
         emailVerificationEnabled = false;
+        signUpEnabled = true;
         mockJwtService = {
             sign: jest.fn().mockReturnValue('signed-token'),
             verify: jest.fn()
@@ -109,6 +111,7 @@ describe('AuthenticationService', ()=>{
         mockAuthConfig = {
             isCompanyFeatureEnabled: jest.fn().mockImplementation(()=>companyFeatureEnabled),
             isEmailVerificationEnabled: jest.fn().mockImplementation(()=>emailVerificationEnabled),
+            isSignUpEnabled: jest.fn().mockImplementation(()=>signUpEnabled),
             getJwtSecret: jest.fn().mockReturnValue('jwt-secret'),
             getJwtExpiration: jest.fn().mockReturnValue('1h'),
             getRefreshTokenSecret: jest.fn().mockReturnValue('refresh-secret'),
@@ -122,6 +125,7 @@ describe('AuthenticationService', ()=>{
         mockDataSourceProvider = {
             isCompanyFeatureEnabled: jest.fn().mockImplementation(()=>companyFeatureEnabled),
             isEmailVerificationEnabled: jest.fn().mockImplementation(()=>emailVerificationEnabled),
+            isSignUpEnabled: jest.fn().mockImplementation(()=>signUpEnabled),
             getRepository: jest.fn().mockImplementation(async (entity)=>{
                 if (entity === AppUser) return userRepo;
                 if (entity === Company) return companyRepo;
@@ -296,6 +300,20 @@ describe('AuthenticationService', ()=>{
                 password: 'Password1!'
             })).rejects.toThrow(BadRequestException);
         });
+        it('throws BadRequestException when the email belongs to a permanently deleted account', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser({
+                deletedAt: new Date()
+            }));
+            const service = buildService();
+            await expect(service.register({
+                email: 'user@example.com',
+                name: 'Test',
+                password: 'Password1!'
+            })).rejects.toThrow(BadRequestException);
+            expect(userRepo.findOne).toHaveBeenCalledWith(expect.objectContaining({
+                withDeleted: true
+            }));
+        });
         it('routes existing users to company registration when the company feature is enabled', async ()=>{
             companyFeatureEnabled = true;
             userRepo.findOne.mockResolvedValue(buildUser());
@@ -317,6 +335,16 @@ describe('AuthenticationService', ()=>{
                 accessToken: expect.any(String)
             }));
         });
+        it('throws BadRequestException for a new user when sign-up is disabled', async ()=>{
+            signUpEnabled = false;
+            userRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.register({
+                email: 'new@example.com',
+                name: 'New User',
+                password: 'Password1!'
+            })).rejects.toThrow(BadRequestException);
+        });
         it('sends a verification email and returns requiresEmailVerification when email verification is enabled', async ()=>{
             emailVerificationEnabled = true;
             userRepo.findOne.mockResolvedValue(null);
@@ -823,6 +851,36 @@ describe('AuthenticationService', ()=>{
             })).rejects.toThrow(BadRequestException);
             expect(queryRunner.rollbackTransaction).toHaveBeenCalled();
         });
+        it('throws BadRequestException when the email belongs to a permanently deleted account', async ()=>{
+            const queryRunner = {
+                connect: jest.fn(),
+                startTransaction: jest.fn(),
+                commitTransaction: jest.fn(),
+                rollbackTransaction: jest.fn(),
+                release: jest.fn(),
+                manager: {
+                    findOne: jest.fn().mockResolvedValue(buildUser({
+                        deletedAt: new Date()
+                    })),
+                    create: jest.fn(),
+                    save: jest.fn()
+                }
+            };
+            mockDataSourceProvider.getDataSource.mockResolvedValue({
+                createQueryRunner: ()=>queryRunner
+            });
+            const service = buildService();
+            await expect(service.createUserFromPendingRegistration({
+                email: 'user@example.com',
+                name: 'Test',
+                passwordHash: 'hash'
+            })).rejects.toThrow(BadRequestException);
+            expect(queryRunner.manager.findOne).toHaveBeenCalledWith(AppUser, expect.objectContaining({
+                withDeleted: true
+            }));
+            expect(queryRunner.manager.create).not.toHaveBeenCalled();
+            expect(queryRunner.rollbackTransaction).toHaveBeenCalled();
+        });
         it('creates the user with the email marked as verified', async ()=>{
             const queryRunner = {
                 connect: jest.fn(),

package/fesm/services/index.js

@@ -1,6 +1,8 @@
 export * from './authentication.service';
 export * from './auth-email.service';
 export * from './company-selection-session.service';
+export * from './social-auth.service';
+export * from './social-auth-config.service';
 export * from './user.service';
 export * from './company.service';
 export * from './branch.service';

package/fesm/services/social-auth-config.service.js

@@ -0,0 +1,93 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { ConflictException, Inject, Injectable, Scope } from '@nestjs/common';
+import { IsNull, Not } from 'typeorm';
+import { AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, SOCIAL_AUTH_CONFIG_MESSAGES } from '../config';
+import { SocialAuthConfig } from '../entities/social-auth-config.entity';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+export class SocialAuthConfigService extends ApiService {
+    async beforeInsertOperation(dto, _user, _queryRunner) {
+        for (const entry of Array.isArray(dto) ? dto : [
+            dto
+        ]){
+            await this.ensureProviderUnclaimed(entry.provider);
+        }
+    }
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        for (const entry of Array.isArray(dto) ? dto : [
+            dto
+        ]){
+            if (entry.provider) await this.ensureProviderUnclaimed(entry.provider, entry.id);
+        }
+    }
+    async ensureProviderUnclaimed(provider, exceptId) {
+        await this.ensureDataSourceRepository();
+        const existing = await this.repository.findOne({
+            where: {
+                provider,
+                deletedAt: IsNull(),
+                ...exceptId ? {
+                    id: Not(exceptId)
+                } : {}
+            }
+        });
+        if (existing) {
+            throw new ConflictException({
+                message: `Social provider "${provider}" is already configured`,
+                messageKey: SOCIAL_AUTH_CONFIG_MESSAGES.PROVIDER_ALREADY_CONFIGURED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+    }
+    async getExtraManipulateQuery(query, filterDto, user) {
+        const result = await super.getExtraManipulateQuery(query, filterDto, user);
+        query.orderBy(`${this.entityName}.provider`, 'ASC');
+        return result;
+    }
+    constructor(cacheManager, utilsService, dataSourceProvider){
+        super(AUTH_EVENT_ENTITIES.SOCIAL_AUTH_CONFIG, cacheManager, utilsService, SocialAuthConfigService.name, true, AUTH_EVENT_MODULE, dataSourceProvider, SocialAuthConfig), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService;
+    }
+}
+SocialAuthConfigService = _ts_decorate([
+    Injectable({
+        scope: Scope.REQUEST
+    }),
+    _ts_param(0, Inject('CACHE_INSTANCE')),
+    _ts_param(1, Inject(UtilsService)),
+    _ts_param(2, Inject(AuthDataSourceProvider)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof HybridCache === "undefined" ? Object : HybridCache,
+        typeof UtilsService === "undefined" ? Object : UtilsService,
+        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider
+    ])
+], SocialAuthConfigService);

package/fesm/services/social-auth-config.service.spec.js

@@ -0,0 +1,67 @@
+import { ConflictException } from '@nestjs/common';
+import { createMockRepository } from '@test-utils/mocks/repository.mock';
+import { Not } from 'typeorm';
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { SocialAuthConfigService } from './social-auth-config.service';
+describe('SocialAuthConfigService', ()=>{
+    let repo;
+    let service;
+    beforeEach(()=>{
+        repo = createMockRepository();
+        const dataSourceProvider = {
+            getRepository: jest.fn().mockResolvedValue(repo)
+        };
+        service = new SocialAuthConfigService({
+            get: jest.fn(),
+            set: jest.fn(),
+            del: jest.fn()
+        }, {}, dataSourceProvider);
+    });
+    const beforeInsert = (dto)=>service.beforeInsertOperation(dto, null, {});
+    const beforeUpdate = (dto)=>service.beforeUpdateOperation(dto, null, {});
+    it('allows the first configuration of a provider', async ()=>{
+        repo.findOne.mockResolvedValue(null);
+        await expect(beforeInsert({
+            provider: SocialProviderTypeEnum.GOOGLE
+        })).resolves.toBeUndefined();
+    });
+    it('rejects a second row for a provider that is already configured', async ()=>{
+        repo.findOne.mockResolvedValue({
+            id: 'existing'
+        });
+        await expect(beforeInsert({
+            provider: SocialProviderTypeEnum.GOOGLE
+        })).rejects.toThrow(ConflictException);
+    });
+    it('checks every provider in a batch insert', async ()=>{
+        repo.findOne.mockResolvedValue(null);
+        await beforeInsert([
+            {
+                provider: SocialProviderTypeEnum.GOOGLE
+            },
+            {
+                provider: SocialProviderTypeEnum.FACEBOOK
+            }
+        ]);
+        expect(repo.findOne).toHaveBeenCalledTimes(2);
+    });
+    it('lets a row keep its own provider on update', async ()=>{
+        repo.findOne.mockResolvedValue(null);
+        await beforeUpdate({
+            id: 'config-1',
+            provider: SocialProviderTypeEnum.GOOGLE
+        });
+        expect(repo.findOne).toHaveBeenCalledWith(expect.objectContaining({
+            where: expect.objectContaining({
+                id: Not('config-1')
+            })
+        }));
+    });
+    it('skips the check for an update that does not touch the provider', async ()=>{
+        await beforeUpdate({
+            id: 'config-1',
+            isEnabled: false
+        });
+        expect(repo.findOne).not.toHaveBeenCalled();
+    });
+});