@flusys/nestjs-auth 7.1.0 → 8.0.0-beta.1

package/fesm/services/company.service.spec.js

@@ -1,123 +0,0 @@
-import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
-import { CompanyService } from './company.service';
-import { CompanyBranch } from '../entities/company-branch.entity';
-import { UserCompanyPermission } from '../entities/user-company-permission.entity';
-describe('CompanyService', ()=>{
-    let service;
-    let mockRepo;
-    let mockPermissionSyncAdapter;
-    let mockQueryRunner;
-    let branchRepo;
-    let permissionRepo;
-    beforeEach(()=>{
-        mockRepo = createMockRepository();
-        mockRepo.find.mockResolvedValue([]);
-        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
-        mockPermissionSyncAdapter = {
-            onCompanyDeleted: jest.fn()
-        };
-        service = new CompanyService({}, {}, mockDataSourceProvider, mockPermissionSyncAdapter);
-        branchRepo = createMockRepository();
-        branchRepo.find.mockResolvedValue([]);
-        permissionRepo = createMockRepository();
-        mockQueryRunner = {
-            manager: {
-                getRepository: jest.fn().mockImplementation((entity)=>{
-                    if (entity === CompanyBranch) return branchRepo;
-                    if (entity === UserCompanyPermission) return permissionRepo;
-                    throw new Error('Unexpected entity');
-                })
-            }
-        };
-    });
-    describe('beforeDeleteOperation', ()=>{
-        it('deletes permissions for the companies and their branches', async ()=>{
-            branchRepo.find.mockResolvedValue([
-                {
-                    id: 'branch-1'
-                }
-            ]);
-            await service.beforeDeleteOperation({
-                id: [
-                    'company-1'
-                ]
-            }, null, mockQueryRunner);
-            const deleteArg = permissionRepo.delete.mock.calls[0][0];
-            expect(deleteArg.targetId._value).toEqual(expect.arrayContaining([
-                'company-1',
-                'branch-1'
-            ]));
-        });
-        it('handles a single (non-array) company id', async ()=>{
-            await service.beforeDeleteOperation({
-                id: 'company-1'
-            }, null, mockQueryRunner);
-            expect(branchRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                where: {
-                    companyId: expect.anything()
-                }
-            }));
-        });
-        it('does nothing further when no permission sync adapter is configured', async ()=>{
-            service = new CompanyService({}, {}, createMockDataSourceProvider(mockRepo), undefined);
-            await expect(service.beforeDeleteOperation({
-                id: [
-                    'company-1'
-                ]
-            }, null, mockQueryRunner)).resolves.toBeUndefined();
-        });
-        it('notifies the permission sync adapter for each deleted company', async ()=>{
-            await service.beforeDeleteOperation({
-                id: [
-                    'company-1',
-                    'company-2'
-                ]
-            }, null, mockQueryRunner);
-            expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-1');
-            expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-2');
-        });
-        it('rejects deleting a readonly company', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                {
-                    id: 'company-1',
-                    name: 'Default Company',
-                    readOnly: true
-                }
-            ]);
-            await expect(service.beforeDeleteOperation({
-                id: 'company-1'
-            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly company');
-            expect(branchRepo.find).not.toHaveBeenCalled();
-        });
-    });
-    describe('getSelectQuery', ()=>{
-        it('applies the default selected fields when none are provided', async ()=>{
-            const qb = mockRepo.createQueryBuilder();
-            const { isRaw } = await service.getSelectQuery(qb, null);
-            expect(qb.select).toHaveBeenCalledWith(expect.arrayContaining([
-                'company.id',
-                'company.name',
-                'company.slug'
-            ]));
-            expect(isRaw).toBe(false);
-        });
-        it('honors an explicit select list', async ()=>{
-            const qb = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(qb, null, [
-                'id'
-            ]);
-            expect(qb.select).toHaveBeenCalledWith([
-                'company.id'
-            ]);
-        });
-    });
-    describe('getGlobalSearchQuery', ()=>{
-        it('adds a LIKE search clause across name/slug/email', async ()=>{
-            const qb = mockRepo.createQueryBuilder();
-            await service.getGlobalSearchQuery(qb, 'acme');
-            expect(qb.andWhere).toHaveBeenCalledWith(expect.stringContaining('company.name LIKE'), {
-                search: '%acme%'
-            });
-        });
-    });
-});

package/fesm/services/social-auth-config.service.js

@@ -1,93 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
-import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { ConflictException, Inject, Injectable, Scope } from '@nestjs/common';
-import { IsNull, Not } from 'typeorm';
-import { AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, SOCIAL_AUTH_CONFIG_MESSAGES } from '../config';
-import { SocialAuthConfig } from '../entities/social-auth-config.entity';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-export class SocialAuthConfigService extends ApiService {
-    async beforeInsertOperation(dto, _user, _queryRunner) {
-        for (const entry of Array.isArray(dto) ? dto : [
-            dto
-        ]){
-            await this.ensureProviderUnclaimed(entry.provider);
-        }
-    }
-    async beforeUpdateOperation(dto, _user, _queryRunner) {
-        for (const entry of Array.isArray(dto) ? dto : [
-            dto
-        ]){
-            if (entry.provider) await this.ensureProviderUnclaimed(entry.provider, entry.id);
-        }
-    }
-    async ensureProviderUnclaimed(provider, exceptId) {
-        await this.ensureDataSourceRepository();
-        const existing = await this.repository.findOne({
-            where: {
-                provider,
-                deletedAt: IsNull(),
-                ...exceptId ? {
-                    id: Not(exceptId)
-                } : {}
-            }
-        });
-        if (existing) {
-            throw new ConflictException({
-                message: `Social provider "${provider}" is already configured`,
-                messageKey: SOCIAL_AUTH_CONFIG_MESSAGES.PROVIDER_ALREADY_CONFIGURED,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-    }
-    async getExtraManipulateQuery(query, filterDto, user) {
-        const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        query.orderBy(`${this.entityName}.provider`, 'ASC');
-        return result;
-    }
-    constructor(cacheManager, utilsService, dataSourceProvider){
-        super(AUTH_EVENT_ENTITIES.SOCIAL_AUTH_CONFIG, cacheManager, utilsService, SocialAuthConfigService.name, true, AUTH_EVENT_MODULE, dataSourceProvider, SocialAuthConfig), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService;
-    }
-}
-SocialAuthConfigService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject('CACHE_INSTANCE')),
-    _ts_param(1, Inject(UtilsService)),
-    _ts_param(2, Inject(AuthDataSourceProvider)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof HybridCache === "undefined" ? Object : HybridCache,
-        typeof UtilsService === "undefined" ? Object : UtilsService,
-        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider
-    ])
-], SocialAuthConfigService);

package/fesm/services/social-auth-config.service.spec.js

@@ -1,67 +0,0 @@
-import { ConflictException } from '@nestjs/common';
-import { createMockRepository } from '@test-utils/mocks/repository.mock';
-import { Not } from 'typeorm';
-import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
-import { SocialAuthConfigService } from './social-auth-config.service';
-describe('SocialAuthConfigService', ()=>{
-    let repo;
-    let service;
-    beforeEach(()=>{
-        repo = createMockRepository();
-        const dataSourceProvider = {
-            getRepository: jest.fn().mockResolvedValue(repo)
-        };
-        service = new SocialAuthConfigService({
-            get: jest.fn(),
-            set: jest.fn(),
-            del: jest.fn()
-        }, {}, dataSourceProvider);
-    });
-    const beforeInsert = (dto)=>service.beforeInsertOperation(dto, null, {});
-    const beforeUpdate = (dto)=>service.beforeUpdateOperation(dto, null, {});
-    it('allows the first configuration of a provider', async ()=>{
-        repo.findOne.mockResolvedValue(null);
-        await expect(beforeInsert({
-            provider: SocialProviderTypeEnum.GOOGLE
-        })).resolves.toBeUndefined();
-    });
-    it('rejects a second row for a provider that is already configured', async ()=>{
-        repo.findOne.mockResolvedValue({
-            id: 'existing'
-        });
-        await expect(beforeInsert({
-            provider: SocialProviderTypeEnum.GOOGLE
-        })).rejects.toThrow(ConflictException);
-    });
-    it('checks every provider in a batch insert', async ()=>{
-        repo.findOne.mockResolvedValue(null);
-        await beforeInsert([
-            {
-                provider: SocialProviderTypeEnum.GOOGLE
-            },
-            {
-                provider: SocialProviderTypeEnum.FACEBOOK
-            }
-        ]);
-        expect(repo.findOne).toHaveBeenCalledTimes(2);
-    });
-    it('lets a row keep its own provider on update', async ()=>{
-        repo.findOne.mockResolvedValue(null);
-        await beforeUpdate({
-            id: 'config-1',
-            provider: SocialProviderTypeEnum.GOOGLE
-        });
-        expect(repo.findOne).toHaveBeenCalledWith(expect.objectContaining({
-            where: expect.objectContaining({
-                id: Not('config-1')
-            })
-        }));
-    });
-    it('skips the check for an update that does not touch the provider', async ()=>{
-        await beforeUpdate({
-            id: 'config-1',
-            isEnabled: false
-        });
-        expect(repo.findOne).not.toHaveBeenCalled();
-    });
-});

package/fesm/services/social-auth.service.js

@@ -1,300 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { LogAction } from '@flusys/nestjs-shared';
-import { HybridCache, publishDomainEvent } from '@flusys/nestjs-shared/classes';
-import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
-import { BadRequestException, Inject, Injectable, InternalServerErrorException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
-import { randomBytes } from 'crypto';
-import { IsNull } from 'typeorm';
-import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, SOCIAL_AUTH_MESSAGES, SOCIAL_STATE_PREFIX, SOCIAL_STATE_TTL_MS } from '../config';
-import { AppUser } from '../entities/app-user.entity';
-import { SocialAuthConfig } from '../entities/social-auth-config.entity';
-import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
-import { getSocialProvider } from '../providers/social-provider.registry';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-import { AuthenticationService } from './authentication.service';
-export class SocialAuthService {
-    async listEnabledProviders(redirectUri) {
-        const repository = await this.dataSourceProvider.getRepository(SocialAuthConfig);
-        const configs = await repository.find({
-            where: {
-                isEnabled: true,
-                deletedAt: IsNull()
-            }
-        });
-        return configs.filter((config)=>!!config.clientId && !!config.clientSecret).map((config)=>({
-                provider: config.provider,
-                redirectUri
-            }));
-    }
-    async createAuthorization(provider, redirectUri) {
-        const config = await this.getUsableConfig(provider);
-        const state = randomBytes(24).toString('hex');
-        await this.getCache().set(this.stateKey(state), {
-            provider,
-            redirectUri
-        }, SOCIAL_STATE_TTL_MS);
-        return {
-            provider,
-            authorizationUrl: getSocialProvider(provider).buildAuthorizationUrl(this.toCredentials(config, redirectUri), state),
-            state
-        };
-    }
-    async completeLogin(code, state, redirectUri) {
-        const provider = await this.consumeState(state, redirectUri);
-        const config = await this.getUsableConfig(provider);
-        const profile = await getSocialProvider(provider).fetchProfile(this.toCredentials(config, redirectUri), code);
-        if (!profile.providerUserId) {
-            throw new UnauthorizedException({
-                message: `${provider} did not return an account identifier`,
-                messageKey: SOCIAL_AUTH_MESSAGES.PROFILE_INCOMPLETE,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-        const user = await this.resolveUser(provider, profile);
-        const response = await this.authService.issueLoginForUser(user);
-        this.publishSocialEvent(AUTH_EVENT_ENTITIES.SESSION, AUTH_EVENT_ACTIONS.SOCIAL_LOGGED_IN, user, provider);
-        return response;
-    }
-    async resolveUser(provider, profile) {
-        this.ensureVerifiedEmail(provider, profile);
-        const userRepository = await this.dataSourceProvider.getRepository(AppUser);
-        const existing = await userRepository.findOne({
-            where: {
-                email: profile.email
-            },
-            withDeleted: true
-        });
-        if (existing?.deletedAt) {
-            throw new UnauthorizedException({
-                message: 'This account has been permanently deleted. Please contact your system administrator.',
-                messageKey: SOCIAL_AUTH_MESSAGES.ACCOUNT_DELETED
-            });
-        }
-        if (existing) {
-            // The provider already proved ownership of this email (ensureVerifiedEmail above),
-            // so a social login carries at least as much proof as clicking a verification link.
-            if (!existing.emailVerified) {
-                existing.emailVerified = true;
-                await userRepository.save(existing);
-            }
-            return existing;
-        }
-        const user = await this.registerUser(provider, userRepository, profile);
-        this.publishSocialEvent(AUTH_EVENT_ENTITIES.USER, AUTH_EVENT_ACTIONS.REGISTERED, user, provider);
-        return user;
-    }
-    ensureVerifiedEmail(provider, profile) {
-        if (!profile.email) {
-            throw new UnauthorizedException({
-                message: `${provider} did not share an email address`,
-                messageKey: SOCIAL_AUTH_MESSAGES.EMAIL_REQUIRED,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-        if (!profile.emailVerified) {
-            throw new UnauthorizedException({
-                message: `${provider} has not verified this email address`,
-                messageKey: SOCIAL_AUTH_MESSAGES.EMAIL_NOT_VERIFIED,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-    }
-    async registerUser(provider, userRepository, profile) {
-        if (!this.dataSourceProvider.isSignUpEnabled()) {
-            throw new UnauthorizedException({
-                message: `No account is linked to this ${provider} profile`,
-                messageKey: SOCIAL_AUTH_MESSAGES.ACCOUNT_NOT_LINKED,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-        if (this.dataSourceProvider.isCompanyFeatureEnabled()) {
-            throw new UnauthorizedException({
-                message: `No account is linked to this ${provider} profile. Please sign up manually and join or create a company first, then social sign-in will work.`,
-                messageKey: SOCIAL_AUTH_MESSAGES.COMPANY_REQUIRED,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-        return userRepository.save(userRepository.create({
-            email: profile.email,
-            name: profile.name,
-            password: null,
-            isActive: true,
-            emailVerified: true
-        }));
-    }
-    async getUsableConfig(provider) {
-        const repository = await this.dataSourceProvider.getRepository(SocialAuthConfig);
-        const config = await repository.findOne({
-            where: {
-                provider,
-                deletedAt: IsNull()
-            }
-        });
-        if (!config?.isEnabled) {
-            throw new BadRequestException({
-                message: `Social sign-in with ${provider} is not enabled`,
-                messageKey: SOCIAL_AUTH_MESSAGES.PROVIDER_DISABLED,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-        if (!config.clientId || !config.clientSecret) {
-            throw new BadRequestException({
-                message: `Social sign-in with ${provider} is missing its client credentials`,
-                messageKey: SOCIAL_AUTH_MESSAGES.PROVIDER_NOT_CONFIGURED,
-                messageVariables: {
-                    provider
-                }
-            });
-        }
-        return config;
-    }
-    toCredentials(config, redirectUri) {
-        return {
-            clientId: config.clientId,
-            clientSecret: config.clientSecret,
-            redirectUri,
-            scopes: config.scopes,
-            extraConfig: config.extraConfig
-        };
-    }
-    async consumeState(state, redirectUri) {
-        const key = this.stateKey(state);
-        const stored = await this.getCache().get(key);
-        await this.getCache().del(key);
-        if (!stored) {
-            throw new UnauthorizedException({
-                message: 'Social sign-in session is invalid or has expired',
-                messageKey: SOCIAL_AUTH_MESSAGES.STATE_INVALID
-            });
-        }
-        if (stored.redirectUri !== redirectUri) {
-            throw new UnauthorizedException({
-                message: 'Redirect URI does not match the one the sign-in started with',
-                messageKey: SOCIAL_AUTH_MESSAGES.REDIRECT_URI_MISMATCH
-            });
-        }
-        return stored.provider;
-    }
-    stateKey(state) {
-        return `${SOCIAL_STATE_PREFIX}:${state}`;
-    }
-    getCache() {
-        if (!this.cacheManager) {
-            throw new InternalServerErrorException({
-                message: 'Cache is required to hold the social sign-in state',
-                messageKey: SYSTEM_MESSAGES.SERVICE_NOT_AVAILABLE,
-                messageVariables: {
-                    provider: 'CACHE_INSTANCE',
-                    available: ''
-                }
-            });
-        }
-        return this.cacheManager;
-    }
-    publishSocialEvent(entity, action, user, provider) {
-        void publishDomainEvent({
-            module: AUTH_EVENT_MODULE,
-            entity,
-            action,
-            ids: [
-                user.id
-            ],
-            metadata: {
-                email: user.email,
-                provider
-            },
-            user: {
-                id: user.id,
-                email: user.email
-            }
-        });
-    }
-    constructor(authService, dataSourceProvider, cacheManager){
-        _define_property(this, "authService", void 0);
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "cacheManager", void 0);
-        this.authService = authService;
-        this.dataSourceProvider = dataSourceProvider;
-        this.cacheManager = cacheManager;
-    }
-}
-_ts_decorate([
-    LogAction({
-        action: 'auth.social.authorize',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof SocialProviderTypeEnum === "undefined" ? Object : SocialProviderTypeEnum,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], SocialAuthService.prototype, "createAuthorization", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.social.login',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], SocialAuthService.prototype, "completeLogin", null);
-SocialAuthService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject(AuthenticationService)),
-    _ts_param(1, Inject(AuthDataSourceProvider)),
-    _ts_param(2, Optional()),
-    _ts_param(2, Inject('CACHE_INSTANCE')),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AuthenticationService === "undefined" ? Object : AuthenticationService,
-        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
-        typeof HybridCache === "undefined" ? Object : HybridCache
-    ])
-], SocialAuthService);