@flusys/nestjs-auth 7.1.0 → 8.0.0-beta.1

package/cjs/services/social-auth.service.spec.js

@@ -1,310 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _repositorymock = require("@test-utils/mocks/repository.mock");
-const _common = require("@nestjs/common");
-const _appuserentity = require("../entities/app-user.entity");
-const _socialauthconfigentity = require("../entities/social-auth-config.entity");
-const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
-const _socialproviderregistry = /*#__PURE__*/ _interop_require_wildcard(require("../providers/social-provider.registry"));
-const _socialauthservice = require("./social-auth.service");
-function _getRequireWildcardCache(nodeInterop) {
-    if (typeof WeakMap !== "function") return null;
-    var cacheBabelInterop = new WeakMap();
-    var cacheNodeInterop = new WeakMap();
-    return (_getRequireWildcardCache = function(nodeInterop) {
-        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
-    })(nodeInterop);
-}
-function _interop_require_wildcard(obj, nodeInterop) {
-    if (!nodeInterop && obj && obj.__esModule) {
-        return obj;
-    }
-    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
-        return {
-            default: obj
-        };
-    }
-    var cache = _getRequireWildcardCache(nodeInterop);
-    if (cache && cache.has(obj)) {
-        return cache.get(obj);
-    }
-    var newObj = {
-        __proto__: null
-    };
-    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
-    for(var key in obj){
-        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
-            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
-            if (desc && (desc.get || desc.set)) {
-                Object.defineProperty(newObj, key, desc);
-            } else {
-                newObj[key] = obj[key];
-            }
-        }
-    }
-    newObj.default = obj;
-    if (cache) {
-        cache.set(obj, newObj);
-    }
-    return newObj;
-}
-const REDIRECT_URI = 'http://localhost:2001/auth/social/callback';
-function buildConfig(overrides = {}) {
-    return {
-        id: 'config-1',
-        provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
-        isEnabled: true,
-        clientId: 'client-id',
-        clientSecret: 'client-secret',
-        scopes: null,
-        extraConfig: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        deletedAt: null,
-        createdById: null,
-        updatedById: null,
-        deletedById: null,
-        ...overrides
-    };
-}
-function buildProfile(overrides = {}) {
-    return {
-        providerUserId: 'google-user-1',
-        email: 'user@example.com',
-        emailVerified: true,
-        name: 'Test User',
-        avatarUrl: null,
-        ...overrides
-    };
-}
-function buildUser(overrides = {}) {
-    return {
-        id: 'user-1',
-        email: 'user@example.com',
-        isActive: true,
-        ...overrides
-    };
-}
-describe('SocialAuthService', ()=>{
-    let configRepo;
-    let userRepo;
-    let cache;
-    let authService;
-    let fetchProfile;
-    let buildAuthorizationUrl;
-    let signUpEnabled;
-    let companyFeatureEnabled;
-    function buildService() {
-        const dataSourceProvider = {
-            getRepository: jest.fn().mockImplementation(async (entity)=>{
-                if (entity === _socialauthconfigentity.SocialAuthConfig) return configRepo;
-                if (entity === _appuserentity.AppUser) return userRepo;
-                throw new Error(`Unexpected entity: ${String(entity)}`);
-            }),
-            isSignUpEnabled: ()=>signUpEnabled,
-            isCompanyFeatureEnabled: ()=>companyFeatureEnabled
-        };
-        return new _socialauthservice.SocialAuthService(authService, dataSourceProvider, cache);
-    }
-    beforeEach(()=>{
-        signUpEnabled = true;
-        companyFeatureEnabled = false;
-        configRepo = (0, _repositorymock.createMockRepository)();
-        userRepo = (0, _repositorymock.createMockRepository)();
-        cache = {
-            get: jest.fn(),
-            set: jest.fn(),
-            del: jest.fn()
-        };
-        authService = {
-            issueLoginForUser: jest.fn().mockResolvedValue({
-                accessToken: 'access-token'
-            })
-        };
-        fetchProfile = jest.fn().mockResolvedValue(buildProfile());
-        buildAuthorizationUrl = jest.fn().mockReturnValue('https://provider.test/consent');
-        jest.spyOn(_socialproviderregistry, 'getSocialProvider').mockReturnValue({
-            provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
-            defaultScopes: [
-                'openid'
-            ],
-            buildAuthorizationUrl,
-            fetchProfile
-        });
-        userRepo.create.mockImplementation((data)=>({
-                ...data
-            }));
-        userRepo.save.mockImplementation(async (entity)=>({
-                id: 'new-user',
-                ...entity
-            }));
-    });
-    afterEach(()=>jest.restoreAllMocks());
-    describe('listEnabledProviders', ()=>{
-        it('drops enabled providers that have no credentials yet', async ()=>{
-            configRepo.find.mockResolvedValue([
-                buildConfig(),
-                buildConfig({
-                    id: 'config-2',
-                    provider: _socialprovidertypeenum.SocialProviderTypeEnum.FACEBOOK,
-                    clientSecret: null
-                })
-            ]);
-            const providers = await buildService().listEnabledProviders(REDIRECT_URI);
-            expect(providers).toEqual([
-                {
-                    provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
-                    redirectUri: REDIRECT_URI
-                }
-            ]);
-        });
-    });
-    describe('createAuthorization', ()=>{
-        it('caches the state and returns the provider consent URL', async ()=>{
-            configRepo.findOne.mockResolvedValue(buildConfig());
-            const result = await buildService().createAuthorization(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE, REDIRECT_URI);
-            expect(result.authorizationUrl).toBe('https://provider.test/consent');
-            expect(cache.set).toHaveBeenCalledWith(`auth:social:state:${result.state}`, {
-                provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
-                redirectUri: REDIRECT_URI
-            }, 10 * 60 * 1000);
-        });
-        it('rejects a provider that is configured but switched off', async ()=>{
-            configRepo.findOne.mockResolvedValue(buildConfig({
-                isEnabled: false
-            }));
-            await expect(buildService().createAuthorization(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(_common.BadRequestException);
-        });
-        it('rejects a provider that is switched on but has no credentials', async ()=>{
-            configRepo.findOne.mockResolvedValue(buildConfig({
-                clientId: null
-            }));
-            await expect(buildService().createAuthorization(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(_common.BadRequestException);
-        });
-    });
-    describe('completeLogin', ()=>{
-        beforeEach(()=>{
-            cache.get.mockResolvedValue({
-                provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
-                redirectUri: REDIRECT_URI
-            });
-            configRepo.findOne.mockResolvedValue(buildConfig());
-        });
-        it('signs in the AppUser that already has this email, marking the email verified', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            const result = await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            // The provider already proved ownership of the email, so a previously-unverified
-            // account is marked verified rather than silently bypassing app-side verification.
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                id: 'user-1',
-                emailVerified: true
-            }));
-            expect(authService.issueLoginForUser).toHaveBeenCalledWith(expect.objectContaining({
-                id: 'user-1',
-                emailVerified: true
-            }));
-            expect(result).toEqual({
-                accessToken: 'access-token'
-            });
-        });
-        it('refuses to sign in or re-register an email that belongs to a permanently deleted account', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser({
-                deletedAt: new Date()
-            }));
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
-            expect(userRepo.findOne).toHaveBeenCalledWith(expect.objectContaining({
-                withDeleted: true
-            }));
-            expect(userRepo.save).not.toHaveBeenCalled();
-            expect(userRepo.create).not.toHaveBeenCalled();
-        });
-        it('does not re-save an existing user whose email is already verified', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser({
-                emailVerified: true
-            }));
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.save).not.toHaveBeenCalled();
-        });
-        it('adopts an existing password account that shares the email without creating a new one', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.create).not.toHaveBeenCalled();
-        });
-        it('creates a new AppUser with no password on a first sign-in', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                email: 'user@example.com',
-                password: null,
-                emailVerified: true
-            }));
-        });
-        it('refuses an unknown email when sign-up is disabled', async ()=>{
-            signUpEnabled = false;
-            userRepo.findOne.mockResolvedValue(null);
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
-            expect(userRepo.save).not.toHaveBeenCalled();
-        });
-        it('signs an existing user in even when sign-up is disabled', async ()=>{
-            signUpEnabled = false;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
-                accessToken: 'access-token'
-            });
-            expect(userRepo.create).not.toHaveBeenCalled();
-        });
-        it('refuses to create an account that could not be given a company', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(null);
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
-            expect(userRepo.save).not.toHaveBeenCalled();
-        });
-        it('signs in a user who already has a company, company feature and all', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
-                accessToken: 'access-token'
-            });
-        });
-        it('refuses an email the provider has not verified', async ()=>{
-            fetchProfile.mockResolvedValue(buildProfile({
-                emailVerified: false
-            }));
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
-            expect(userRepo.findOne).not.toHaveBeenCalled();
-        });
-        it('marks an auto-created account verified, since only verified profiles get that far', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                emailVerified: true
-            }));
-        });
-        it('refuses a profile the provider gave no email for', async ()=>{
-            fetchProfile.mockResolvedValue(buildProfile({
-                email: null
-            }));
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
-        });
-        it('refuses a profile with no account identifier', async ()=>{
-            fetchProfile.mockResolvedValue(buildProfile({
-                providerUserId: ''
-            }));
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
-        });
-        it('refuses an unknown or expired state', async ()=>{
-            cache.get.mockResolvedValue(undefined);
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
-        });
-        it('refuses a redirect URI the sign-in did not start with', async ()=>{
-            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(_common.UnauthorizedException);
-        });
-        it('burns the state even when the redirect URI does not match, so it cannot be retried', async ()=>{
-            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(_common.UnauthorizedException);
-            expect(cache.del).toHaveBeenCalledWith('auth:social:state:state');
-        });
-    });
-});

package/cjs/services/user-permission.service.js

@@ -1,236 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "UserPermissionService", {
-    enumerable: true,
-    get: function() {
-        return UserPermissionService;
-    }
-});
-const _nestjsshared = require("@flusys/nestjs-shared");
-const _classes = require("@flusys/nestjs-shared/classes");
-const _interfaces = require("@flusys/nestjs-shared/interfaces");
-const _common = require("@nestjs/common");
-const _config = require("../config");
-const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-const _authdatasourceprovider = require("./auth-datasource.provider");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let UserPermissionService = class UserPermissionService {
-    async getRepository() {
-        if (!this._repository) {
-            this._repository = await this.dataSourceProvider.getRepository(_usercompanypermissionentity.UserCompanyPermission);
-        }
-        return this._repository;
-    }
-    // Generic Permission Operations
-    /** Find all permissions of a specific type for a user */ async findUserPermissions(userId, type) {
-        const repository = await this.getRepository();
-        return repository.find({
-            where: {
-                userId,
-                permissionType: type
-            },
-            relations: [
-                type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch'
-            ],
-            order: {
-                createdAt: 'DESC'
-            }
-        });
-    }
-    /** Assign permission to user */ async assignPermission(userId, targetId, type) {
-        const repository = await this.getRepository();
-        const typeName = type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch';
-        const existing = await repository.findOne({
-            where: {
-                userId,
-                targetId,
-                permissionType: type
-            }
-        });
-        if (existing) {
-            throw new _common.ConflictException({
-                message: `User already assigned to this ${typeName}`,
-                messageKey: _config.USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                messageVariables: {
-                    type: typeName
-                }
-            });
-        }
-        try {
-            await repository.save(repository.create({
-                userId,
-                permissionType: type,
-                targetId
-            }));
-        } catch (error) {
-            const err = error;
-            if (err?.code === 'ER_DUP_ENTRY' || String(err?.message).includes('Duplicate entry')) {
-                throw new _common.ConflictException({
-                    message: `User already assigned to this ${typeName}. Please refresh and try again.`,
-                    messageKey: _config.USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                    messageVariables: {
-                        type: typeName
-                    }
-                });
-            }
-            throw error;
-        }
-        await this.publishPermissionEvent(_config.AUTH_EVENT_ACTIONS.PERMISSION_GRANTED, userId, targetId, type);
-    }
-    async revokePermission(userId, targetId, type) {
-        const repository = await this.getRepository();
-        const typeName = type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch';
-        const permission = await repository.findOne({
-            where: {
-                userId,
-                targetId,
-                permissionType: type
-            },
-            relations: [
-                type === _usercompanypermissionentity.PermissionType.BRANCH ? 'branch' : 'company'
-            ]
-        });
-        if (!permission) {
-            throw new _common.NotFoundException({
-                message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
-                messageKey: _config.USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND,
-                messageVariables: {
-                    type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
-                }
-            });
-        }
-        const companyId = type === _usercompanypermissionentity.PermissionType.COMPANY ? targetId : permission.branch?.companyId;
-        await repository.remove(permission);
-        if (type === _usercompanypermissionentity.PermissionType.COMPANY) {
-            const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
-            await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
-            await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
-        } else {
-            if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
-        }
-        await this.publishPermissionEvent(_config.AUTH_EVENT_ACTIONS.PERMISSION_REVOKED, userId, targetId, type, companyId);
-    }
-    async publishPermissionEvent(action, userId, targetId, type, companyId) {
-        await (0, _classes.publishDomainEvent)({
-            module: _config.AUTH_EVENT_MODULE,
-            entity: _config.AUTH_EVENT_ENTITIES.USER_PERMISSION,
-            action,
-            ids: [
-                targetId
-            ],
-            metadata: {
-                targetUserId: userId,
-                permissionType: type,
-                ...companyId ? {
-                    companyId
-                } : {}
-            }
-        });
-    }
-    async revokeBranchPermissionsForCompany(repository, userId, companyId) {
-        const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
-            userId
-        }).andWhere('permission.permissionType = :type', {
-            type: _usercompanypermissionentity.PermissionType.BRANCH
-        }).andWhere('branch.companyId = :companyId', {
-            companyId
-        }).getMany();
-        if (branchPermissions.length === 0) {
-            return [];
-        }
-        await repository.remove(branchPermissions);
-        return branchPermissions.map((permission)=>permission.targetId);
-    }
-    /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
-        const repository = await this.getRepository();
-        const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
-            userId
-        }).andWhere('permission.permissionType = :type', {
-            type: _usercompanypermissionentity.PermissionType.BRANCH
-        }).orderBy('permission.createdAt', 'DESC');
-        if (companyId) {
-            queryBuilder.andWhere('branch.companyId = :companyId', {
-                companyId
-            });
-        }
-        return queryBuilder.getMany();
-    }
-    constructor(dataSourceProvider, permissionSyncAdapter){
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "permissionSyncAdapter", void 0);
-        _define_property(this, "_repository", void 0);
-        // Convenience Methods
-        _define_property(this, "findUserCompanies", void 0);
-        this.dataSourceProvider = dataSourceProvider;
-        this.permissionSyncAdapter = permissionSyncAdapter;
-        this._repository = null;
-        this.findUserCompanies = (userId)=>this.findUserPermissions(userId, _usercompanypermissionentity.PermissionType.COMPANY);
-    }
-};
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'user.assignPermission',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        typeof _usercompanypermissionentity.PermissionType === "undefined" ? Object : _usercompanypermissionentity.PermissionType
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserPermissionService.prototype, "assignPermission", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'user.revokePermission',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        typeof _usercompanypermissionentity.PermissionType === "undefined" ? Object : _usercompanypermissionentity.PermissionType
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserPermissionService.prototype, "revokePermission", null);
-UserPermissionService = _ts_decorate([
-    (0, _common.Injectable)({
-        scope: _common.Scope.REQUEST
-    }),
-    _ts_param(0, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
-    _ts_param(1, (0, _common.Optional)()),
-    _ts_param(1, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
-        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
-    ])
-], UserPermissionService);