@flusys/nestjs-auth 7.1.0 → 8.0.0-beta.1

package/fesm/services/social-auth.service.spec.js

@@ -1,265 +0,0 @@
-import { createMockRepository } from '@test-utils/mocks/repository.mock';
-import { BadRequestException, UnauthorizedException } from '@nestjs/common';
-import { AppUser } from '../entities/app-user.entity';
-import { SocialAuthConfig } from '../entities/social-auth-config.entity';
-import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
-import * as registry from '../providers/social-provider.registry';
-import { SocialAuthService } from './social-auth.service';
-const REDIRECT_URI = 'http://localhost:2001/auth/social/callback';
-function buildConfig(overrides = {}) {
-    return {
-        id: 'config-1',
-        provider: SocialProviderTypeEnum.GOOGLE,
-        isEnabled: true,
-        clientId: 'client-id',
-        clientSecret: 'client-secret',
-        scopes: null,
-        extraConfig: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        deletedAt: null,
-        createdById: null,
-        updatedById: null,
-        deletedById: null,
-        ...overrides
-    };
-}
-function buildProfile(overrides = {}) {
-    return {
-        providerUserId: 'google-user-1',
-        email: 'user@example.com',
-        emailVerified: true,
-        name: 'Test User',
-        avatarUrl: null,
-        ...overrides
-    };
-}
-function buildUser(overrides = {}) {
-    return {
-        id: 'user-1',
-        email: 'user@example.com',
-        isActive: true,
-        ...overrides
-    };
-}
-describe('SocialAuthService', ()=>{
-    let configRepo;
-    let userRepo;
-    let cache;
-    let authService;
-    let fetchProfile;
-    let buildAuthorizationUrl;
-    let signUpEnabled;
-    let companyFeatureEnabled;
-    function buildService() {
-        const dataSourceProvider = {
-            getRepository: jest.fn().mockImplementation(async (entity)=>{
-                if (entity === SocialAuthConfig) return configRepo;
-                if (entity === AppUser) return userRepo;
-                throw new Error(`Unexpected entity: ${String(entity)}`);
-            }),
-            isSignUpEnabled: ()=>signUpEnabled,
-            isCompanyFeatureEnabled: ()=>companyFeatureEnabled
-        };
-        return new SocialAuthService(authService, dataSourceProvider, cache);
-    }
-    beforeEach(()=>{
-        signUpEnabled = true;
-        companyFeatureEnabled = false;
-        configRepo = createMockRepository();
-        userRepo = createMockRepository();
-        cache = {
-            get: jest.fn(),
-            set: jest.fn(),
-            del: jest.fn()
-        };
-        authService = {
-            issueLoginForUser: jest.fn().mockResolvedValue({
-                accessToken: 'access-token'
-            })
-        };
-        fetchProfile = jest.fn().mockResolvedValue(buildProfile());
-        buildAuthorizationUrl = jest.fn().mockReturnValue('https://provider.test/consent');
-        jest.spyOn(registry, 'getSocialProvider').mockReturnValue({
-            provider: SocialProviderTypeEnum.GOOGLE,
-            defaultScopes: [
-                'openid'
-            ],
-            buildAuthorizationUrl,
-            fetchProfile
-        });
-        userRepo.create.mockImplementation((data)=>({
-                ...data
-            }));
-        userRepo.save.mockImplementation(async (entity)=>({
-                id: 'new-user',
-                ...entity
-            }));
-    });
-    afterEach(()=>jest.restoreAllMocks());
-    describe('listEnabledProviders', ()=>{
-        it('drops enabled providers that have no credentials yet', async ()=>{
-            configRepo.find.mockResolvedValue([
-                buildConfig(),
-                buildConfig({
-                    id: 'config-2',
-                    provider: SocialProviderTypeEnum.FACEBOOK,
-                    clientSecret: null
-                })
-            ]);
-            const providers = await buildService().listEnabledProviders(REDIRECT_URI);
-            expect(providers).toEqual([
-                {
-                    provider: SocialProviderTypeEnum.GOOGLE,
-                    redirectUri: REDIRECT_URI
-                }
-            ]);
-        });
-    });
-    describe('createAuthorization', ()=>{
-        it('caches the state and returns the provider consent URL', async ()=>{
-            configRepo.findOne.mockResolvedValue(buildConfig());
-            const result = await buildService().createAuthorization(SocialProviderTypeEnum.GOOGLE, REDIRECT_URI);
-            expect(result.authorizationUrl).toBe('https://provider.test/consent');
-            expect(cache.set).toHaveBeenCalledWith(`auth:social:state:${result.state}`, {
-                provider: SocialProviderTypeEnum.GOOGLE,
-                redirectUri: REDIRECT_URI
-            }, 10 * 60 * 1000);
-        });
-        it('rejects a provider that is configured but switched off', async ()=>{
-            configRepo.findOne.mockResolvedValue(buildConfig({
-                isEnabled: false
-            }));
-            await expect(buildService().createAuthorization(SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(BadRequestException);
-        });
-        it('rejects a provider that is switched on but has no credentials', async ()=>{
-            configRepo.findOne.mockResolvedValue(buildConfig({
-                clientId: null
-            }));
-            await expect(buildService().createAuthorization(SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(BadRequestException);
-        });
-    });
-    describe('completeLogin', ()=>{
-        beforeEach(()=>{
-            cache.get.mockResolvedValue({
-                provider: SocialProviderTypeEnum.GOOGLE,
-                redirectUri: REDIRECT_URI
-            });
-            configRepo.findOne.mockResolvedValue(buildConfig());
-        });
-        it('signs in the AppUser that already has this email, marking the email verified', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            const result = await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            // The provider already proved ownership of the email, so a previously-unverified
-            // account is marked verified rather than silently bypassing app-side verification.
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                id: 'user-1',
-                emailVerified: true
-            }));
-            expect(authService.issueLoginForUser).toHaveBeenCalledWith(expect.objectContaining({
-                id: 'user-1',
-                emailVerified: true
-            }));
-            expect(result).toEqual({
-                accessToken: 'access-token'
-            });
-        });
-        it('refuses to sign in or re-register an email that belongs to a permanently deleted account', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser({
-                deletedAt: new Date()
-            }));
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
-            expect(userRepo.findOne).toHaveBeenCalledWith(expect.objectContaining({
-                withDeleted: true
-            }));
-            expect(userRepo.save).not.toHaveBeenCalled();
-            expect(userRepo.create).not.toHaveBeenCalled();
-        });
-        it('does not re-save an existing user whose email is already verified', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser({
-                emailVerified: true
-            }));
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.save).not.toHaveBeenCalled();
-        });
-        it('adopts an existing password account that shares the email without creating a new one', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.create).not.toHaveBeenCalled();
-        });
-        it('creates a new AppUser with no password on a first sign-in', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                email: 'user@example.com',
-                password: null,
-                emailVerified: true
-            }));
-        });
-        it('refuses an unknown email when sign-up is disabled', async ()=>{
-            signUpEnabled = false;
-            userRepo.findOne.mockResolvedValue(null);
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
-            expect(userRepo.save).not.toHaveBeenCalled();
-        });
-        it('signs an existing user in even when sign-up is disabled', async ()=>{
-            signUpEnabled = false;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
-                accessToken: 'access-token'
-            });
-            expect(userRepo.create).not.toHaveBeenCalled();
-        });
-        it('refuses to create an account that could not be given a company', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(null);
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
-            expect(userRepo.save).not.toHaveBeenCalled();
-        });
-        it('signs in a user who already has a company, company feature and all', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
-                accessToken: 'access-token'
-            });
-        });
-        it('refuses an email the provider has not verified', async ()=>{
-            fetchProfile.mockResolvedValue(buildProfile({
-                emailVerified: false
-            }));
-            userRepo.findOne.mockResolvedValue(buildUser());
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
-            expect(userRepo.findOne).not.toHaveBeenCalled();
-        });
-        it('marks an auto-created account verified, since only verified profiles get that far', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            await buildService().completeLogin('code', 'state', REDIRECT_URI);
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                emailVerified: true
-            }));
-        });
-        it('refuses a profile the provider gave no email for', async ()=>{
-            fetchProfile.mockResolvedValue(buildProfile({
-                email: null
-            }));
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
-        });
-        it('refuses a profile with no account identifier', async ()=>{
-            fetchProfile.mockResolvedValue(buildProfile({
-                providerUserId: ''
-            }));
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
-        });
-        it('refuses an unknown or expired state', async ()=>{
-            cache.get.mockResolvedValue(undefined);
-            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
-        });
-        it('refuses a redirect URI the sign-in did not start with', async ()=>{
-            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(UnauthorizedException);
-        });
-        it('burns the state even when the redirect URI does not match, so it cannot be retried', async ()=>{
-            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(UnauthorizedException);
-            expect(cache.del).toHaveBeenCalledWith('auth:social:state:state');
-        });
-    });
-});

package/fesm/services/user-permission.service.js

@@ -1,226 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { LogAction } from '@flusys/nestjs-shared';
-import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
-import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
-import { ConflictException, Inject, Injectable, NotFoundException, Optional, Scope } from '@nestjs/common';
-import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, USER_PERMISSION_MESSAGES } from '../config';
-import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-export class UserPermissionService {
-    async getRepository() {
-        if (!this._repository) {
-            this._repository = await this.dataSourceProvider.getRepository(UserCompanyPermission);
-        }
-        return this._repository;
-    }
-    // Generic Permission Operations
-    /** Find all permissions of a specific type for a user */ async findUserPermissions(userId, type) {
-        const repository = await this.getRepository();
-        return repository.find({
-            where: {
-                userId,
-                permissionType: type
-            },
-            relations: [
-                type === PermissionType.COMPANY ? 'company' : 'branch'
-            ],
-            order: {
-                createdAt: 'DESC'
-            }
-        });
-    }
-    /** Assign permission to user */ async assignPermission(userId, targetId, type) {
-        const repository = await this.getRepository();
-        const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
-        const existing = await repository.findOne({
-            where: {
-                userId,
-                targetId,
-                permissionType: type
-            }
-        });
-        if (existing) {
-            throw new ConflictException({
-                message: `User already assigned to this ${typeName}`,
-                messageKey: USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                messageVariables: {
-                    type: typeName
-                }
-            });
-        }
-        try {
-            await repository.save(repository.create({
-                userId,
-                permissionType: type,
-                targetId
-            }));
-        } catch (error) {
-            const err = error;
-            if (err?.code === 'ER_DUP_ENTRY' || String(err?.message).includes('Duplicate entry')) {
-                throw new ConflictException({
-                    message: `User already assigned to this ${typeName}. Please refresh and try again.`,
-                    messageKey: USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                    messageVariables: {
-                        type: typeName
-                    }
-                });
-            }
-            throw error;
-        }
-        await this.publishPermissionEvent(AUTH_EVENT_ACTIONS.PERMISSION_GRANTED, userId, targetId, type);
-    }
-    async revokePermission(userId, targetId, type) {
-        const repository = await this.getRepository();
-        const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
-        const permission = await repository.findOne({
-            where: {
-                userId,
-                targetId,
-                permissionType: type
-            },
-            relations: [
-                type === PermissionType.BRANCH ? 'branch' : 'company'
-            ]
-        });
-        if (!permission) {
-            throw new NotFoundException({
-                message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
-                messageKey: USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND,
-                messageVariables: {
-                    type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
-                }
-            });
-        }
-        const companyId = type === PermissionType.COMPANY ? targetId : permission.branch?.companyId;
-        await repository.remove(permission);
-        if (type === PermissionType.COMPANY) {
-            const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
-            await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
-            await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
-        } else {
-            if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
-        }
-        await this.publishPermissionEvent(AUTH_EVENT_ACTIONS.PERMISSION_REVOKED, userId, targetId, type, companyId);
-    }
-    async publishPermissionEvent(action, userId, targetId, type, companyId) {
-        await publishDomainEvent({
-            module: AUTH_EVENT_MODULE,
-            entity: AUTH_EVENT_ENTITIES.USER_PERMISSION,
-            action,
-            ids: [
-                targetId
-            ],
-            metadata: {
-                targetUserId: userId,
-                permissionType: type,
-                ...companyId ? {
-                    companyId
-                } : {}
-            }
-        });
-    }
-    async revokeBranchPermissionsForCompany(repository, userId, companyId) {
-        const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
-            userId
-        }).andWhere('permission.permissionType = :type', {
-            type: PermissionType.BRANCH
-        }).andWhere('branch.companyId = :companyId', {
-            companyId
-        }).getMany();
-        if (branchPermissions.length === 0) {
-            return [];
-        }
-        await repository.remove(branchPermissions);
-        return branchPermissions.map((permission)=>permission.targetId);
-    }
-    /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
-        const repository = await this.getRepository();
-        const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
-            userId
-        }).andWhere('permission.permissionType = :type', {
-            type: PermissionType.BRANCH
-        }).orderBy('permission.createdAt', 'DESC');
-        if (companyId) {
-            queryBuilder.andWhere('branch.companyId = :companyId', {
-                companyId
-            });
-        }
-        return queryBuilder.getMany();
-    }
-    constructor(dataSourceProvider, permissionSyncAdapter){
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "permissionSyncAdapter", void 0);
-        _define_property(this, "_repository", void 0);
-        // Convenience Methods
-        _define_property(this, "findUserCompanies", void 0);
-        this.dataSourceProvider = dataSourceProvider;
-        this.permissionSyncAdapter = permissionSyncAdapter;
-        this._repository = null;
-        this.findUserCompanies = (userId)=>this.findUserPermissions(userId, PermissionType.COMPANY);
-    }
-}
-_ts_decorate([
-    LogAction({
-        action: 'user.assignPermission',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        typeof PermissionType === "undefined" ? Object : PermissionType
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserPermissionService.prototype, "assignPermission", null);
-_ts_decorate([
-    LogAction({
-        action: 'user.revokePermission',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        typeof PermissionType === "undefined" ? Object : PermissionType
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserPermissionService.prototype, "revokePermission", null);
-UserPermissionService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject(AuthDataSourceProvider)),
-    _ts_param(1, Optional()),
-    _ts_param(1, Inject(PERMISSION_SYNC_ADAPTER)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
-        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
-    ])
-], UserPermissionService);