@flusys/nestjs-iam 6.0.1 → 6.1.0

package/fesm/services/action.service.spec.js

@@ -0,0 +1,310 @@
+import { Test } from '@nestjs/testing';
+import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
+import { ActionType } from '../enums';
+import { ActionService } from './action.service';
+import { IAMConfigService } from './iam-config.service';
+import { IAMDataSourceService } from './iam-datasource.service';
+import { PermissionCacheService } from './permission-cache.service';
+import { PermissionService } from './permission.service';
+function buildAction(overrides = {}) {
+    return {
+        id: 'action-uuid-1',
+        readOnly: false,
+        name: 'View Products',
+        description: null,
+        code: 'products.read',
+        actionType: ActionType.BACKEND,
+        permissionLogic: null,
+        serial: 1,
+        isActive: true,
+        parentId: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+describe('ActionService', ()=>{
+    let service;
+    let mockRepo;
+    let mockIamConfigService;
+    let mockPermissionService;
+    let mockPermissionCacheService;
+    beforeEach(async ()=>{
+        mockRepo = createMockRepository();
+        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
+        mockIamConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
+        };
+        mockPermissionService = {
+            getCompanyActionIds: jest.fn(),
+            invalidateCompanyMembersCache: jest.fn()
+        };
+        mockPermissionCacheService = {
+            invalidateUsers: jest.fn()
+        };
+        const module = await Test.createTestingModule({
+            providers: [
+                ActionService,
+                {
+                    provide: 'CACHE_INSTANCE',
+                    useValue: {}
+                },
+                {
+                    provide: UtilsService,
+                    useValue: {}
+                },
+                {
+                    provide: IAMConfigService,
+                    useValue: mockIamConfigService
+                },
+                {
+                    provide: IAMDataSourceService,
+                    useValue: mockDataSourceProvider
+                },
+                {
+                    provide: PermissionService,
+                    useValue: mockPermissionService
+                },
+                {
+                    provide: PermissionCacheService,
+                    useValue: mockPermissionCacheService
+                }
+            ]
+        }).compile();
+        service = await module.resolve(ActionService);
+    });
+    describe('getActionsForPermission', ()=>{
+        it('returns all actions when the company feature is disabled', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildAction()
+            ]);
+            const result = await service.getActionsForPermission(buildMockUser());
+            expect(mockPermissionService.getCompanyActionIds).not.toHaveBeenCalled();
+            expect(result).toHaveLength(1);
+            expect(result[0].code).toBe('products.read');
+        });
+        it('scopes actions to the company whitelist when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionService.getCompanyActionIds.mockResolvedValue([
+                'action-uuid-1'
+            ]);
+            mockRepo.find.mockResolvedValue([
+                buildAction()
+            ]);
+            await service.getActionsForPermission(buildMockUser(), 'company-uuid-1');
+            expect(mockPermissionService.getCompanyActionIds).toHaveBeenCalledWith('company-uuid-1');
+            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
+                where: {
+                    id: expect.anything()
+                }
+            }));
+        });
+        it('short-circuits without querying when the company has no whitelisted actions', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionService.getCompanyActionIds.mockResolvedValue([]);
+            const result = await service.getActionsForPermission(buildMockUser(), 'company-uuid-1');
+            expect(result).toEqual([]);
+            expect(mockRepo.find).not.toHaveBeenCalled();
+        });
+        it('throws when no user is provided', async ()=>{
+            await expect(service.getActionsForPermission(null)).rejects.toThrow();
+        });
+    });
+    describe('getActionTree', ()=>{
+        it('nests child actions under their parent', async ()=>{
+            const parent = buildAction({
+                id: 'parent-1',
+                parentId: null,
+                serial: 1
+            });
+            const child = buildAction({
+                id: 'child-1',
+                parentId: 'parent-1',
+                serial: 2,
+                code: 'products.create'
+            });
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
+                parent,
+                child
+            ]);
+            const tree = await service.getActionTree(buildMockUser());
+            expect(tree).toHaveLength(1);
+            expect(tree[0].id).toBe('parent-1');
+            expect(tree[0].children).toHaveLength(1);
+            expect(tree[0].children?.[0].id).toBe('child-1');
+        });
+        it('throws when no user is provided', async ()=>{
+            await expect(service.getActionTree(null)).rejects.toThrow();
+        });
+        it('treats an action with a missing/unknown parentId as a root node', async ()=>{
+            const orphan = buildAction({
+                id: 'orphan-1',
+                parentId: 'does-not-exist'
+            });
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
+                orphan
+            ]);
+            const tree = await service.getActionTree(buildMockUser());
+            expect(tree).toHaveLength(1);
+            expect(tree[0].id).toBe('orphan-1');
+        });
+        it('excludes soft-deleted actions by default and applies search/isActive filters', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            query.getMany.mockResolvedValue([]);
+            await service.getActionTree(buildMockUser(), 'view', true, false);
+            expect(query.andWhere).toHaveBeenCalledWith('action.deletedAt IS NULL');
+            expect(query.andWhere).toHaveBeenCalledWith('action.isActive = :isActive', {
+                isActive: true
+            });
+            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search)', {
+                search: '%view%'
+            });
+        });
+        it('includes soft-deleted actions when withDeleted is true', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            query.getMany.mockResolvedValue([]);
+            await service.getActionTree(buildMockUser(), undefined, undefined, true);
+            expect(query.andWhere).not.toHaveBeenCalledWith('action.deletedAt IS NULL');
+        });
+    });
+    describe('getSelectQuery', ()=>{
+        it('selects the default field set when none is provided', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, buildMockUser());
+            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
+                'action.code',
+                'action.actionType',
+                'action.permissionLogic'
+            ]));
+        });
+        it('uses the explicitly provided select list as-is', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, buildMockUser(), [
+                'id',
+                'code'
+            ]);
+            expect(query.select).toHaveBeenCalledWith([
+                'action.id',
+                'action.code'
+            ]);
+        });
+    });
+    describe('getGlobalSearchQuery', ()=>{
+        it('filters by name, code, or description', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getGlobalSearchQuery(query, 'view');
+            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
+                search: '%view%'
+            });
+        });
+    });
+    describe('convertEntityToResponseDto', ()=>{
+        it('maps every entity field onto the response shape', ()=>{
+            const entity = buildAction({
+                code: 'user.view'
+            });
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto).toEqual(expect.objectContaining({
+                id: entity.id,
+                code: 'user.view',
+                actionType: ActionType.BACKEND
+            }));
+        });
+    });
+    describe('beforeDeleteOperation', ()=>{
+        function buildQueryRunner(permissionRepo) {
+            return {
+                manager: {
+                    getRepository: jest.fn().mockReturnValue(permissionRepo)
+                }
+            };
+        }
+        it('does nothing when the delete DTO has no ids', async ()=>{
+            const permissionRepo = createMockRepository();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('cascades role/user/company action-permission cleanup and invalidates affected caches', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const permissionRepo = createMockRepository();
+            // Company feature is disabled, so companyActionRows resolves via Promise.resolve([]) and
+            // never calls permissionRepo.find() — only 3 real find() calls happen: role-action,
+            // user-action, then the role -> user cascade lookup.
+            permissionRepo.find.mockResolvedValueOnce([
+                {
+                    sourceId: 'role-1'
+                }
+            ]) // role-action rows referencing the deleted action
+            .mockResolvedValueOnce([
+                {
+                    userId: 'user-1'
+                }
+            ]) // direct user-action rows
+            .mockResolvedValueOnce([
+                {
+                    userId: 'user-2'
+                }
+            ]); // users holding role-1 (cascaded lookup)
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: 'action-uuid-1',
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'role_action'
+            }));
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'user_action'
+            }));
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'company_action'
+            }));
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith(expect.arrayContaining([
+                'user-1',
+                'user-2'
+            ]));
+            expect(mockPermissionService.invalidateCompanyMembersCache).not.toHaveBeenCalled();
+        });
+        it('also queries and invalidates company whitelist entries when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            const permissionRepo = createMockRepository();
+            permissionRepo.find.mockResolvedValueOnce([]) // role-action rows
+            .mockResolvedValueOnce([]) // direct user-action rows
+            .mockResolvedValueOnce([
+                {
+                    sourceId: 'company-1'
+                }
+            ]); // company-action rows
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'action-uuid-1'
+                ],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(mockPermissionService.invalidateCompanyMembersCache).toHaveBeenCalledWith('company-1');
+        });
+        it('does not invalidate any cache when nothing is affected', async ()=>{
+            const permissionRepo = createMockRepository();
+            permissionRepo.find.mockResolvedValue([]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'action-uuid-1'
+                ],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
+        });
+    });
+});

package/fesm/services/iam-config.service.spec.js

@@ -0,0 +1,106 @@
+import { IAMPermissionMode } from '../enums/permission-type.enum';
+import { IAMConfigService } from './iam-config.service';
+describe('IAMConfigService', ()=>{
+    describe('with no injected options (defaults)', ()=>{
+        let service;
+        beforeEach(()=>{
+            service = new IAMConfigService();
+        });
+        it('defaults to single database mode', ()=>{
+            expect(service.getDatabaseMode()).toBe('single');
+            expect(service.isMultiTenant()).toBe(false);
+        });
+        it('defaults company feature to disabled', ()=>{
+            expect(service.isCompanyFeatureEnabled()).toBe(false);
+        });
+        it('defaults permission mode to FULL', ()=>{
+            expect(service.getPermissionMode()).toBe(IAMPermissionMode.FULL);
+            expect(service.isRbacEnabled()).toBe(true);
+            expect(service.isDirectPermissionEnabled()).toBe(true);
+        });
+        it('returns the fallback options object from getOptions', ()=>{
+            expect(service.getOptions()).toEqual({
+                global: false,
+                includeController: false
+            });
+        });
+    });
+    describe('with injected options', ()=>{
+        function buildService(overrides) {
+            const options = {
+                global: false,
+                includeController: false,
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: false,
+                    ...overrides
+                }
+            };
+            return new IAMConfigService(options);
+        }
+        it('reports multi-tenant mode when configured', ()=>{
+            const service = buildService({
+                databaseMode: 'multi-tenant'
+            });
+            expect(service.getDatabaseMode()).toBe('multi-tenant');
+            expect(service.isMultiTenant()).toBe(true);
+        });
+        it('reports company feature enabled when configured', ()=>{
+            const service = buildService({
+                enableCompanyFeature: true
+            });
+            expect(service.isCompanyFeatureEnabled()).toBe(true);
+        });
+        describe('permission mode: RBAC', ()=>{
+            let service;
+            beforeEach(()=>{
+                service = buildService({
+                    permissionMode: 'RBAC'
+                });
+            });
+            it('enables RBAC but not direct permissions', ()=>{
+                expect(service.getPermissionMode()).toBe(IAMPermissionMode.RBAC);
+                expect(service.isRbacEnabled()).toBe(true);
+                expect(service.isDirectPermissionEnabled()).toBe(false);
+            });
+        });
+        describe('permission mode: DIRECT', ()=>{
+            let service;
+            beforeEach(()=>{
+                service = buildService({
+                    permissionMode: 'DIRECT'
+                });
+            });
+            it('enables direct permissions but not RBAC', ()=>{
+                expect(service.getPermissionMode()).toBe(IAMPermissionMode.DIRECT);
+                expect(service.isRbacEnabled()).toBe(false);
+                expect(service.isDirectPermissionEnabled()).toBe(true);
+            });
+        });
+        describe('permission mode: FULL', ()=>{
+            let service;
+            beforeEach(()=>{
+                service = buildService({
+                    permissionMode: 'FULL'
+                });
+            });
+            it('enables both RBAC and direct permissions', ()=>{
+                expect(service.getPermissionMode()).toBe(IAMPermissionMode.FULL);
+                expect(service.isRbacEnabled()).toBe(true);
+                expect(service.isDirectPermissionEnabled()).toBe(true);
+            });
+        });
+        it('returns the exact injected options object from getOptions', ()=>{
+            const options = {
+                global: true,
+                includeController: true,
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: true
+                }
+            };
+            const service = new IAMConfigService(options);
+            expect(service.getOptions()).toBe(options);
+        });
+    });
+});

package/fesm/services/iam-datasource.service.spec.js

@@ -0,0 +1,113 @@
+import { MultiTenantDataSourceService } from '@flusys/nestjs-shared/modules';
+import { Action } from '../entities/action.entity';
+import { UserIamPermission } from '../entities/user-iam-permission.entity';
+import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
+import { Role } from '../entities/role.entity';
+import { RoleWithCompany } from '../entities/role-with-company.entity';
+import { IAMDataSourceService } from './iam-datasource.service';
+describe('IAMDataSourceService', ()=>{
+    let mockConfigService;
+    beforeEach(()=>{
+        mockConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false),
+            getPermissionMode: jest.fn(),
+            getOptions: jest.fn().mockReturnValue({
+                global: false,
+                includeController: false
+            })
+        };
+    });
+    function buildService(request) {
+        return new IAMDataSourceService(mockConfigService, request);
+    }
+    describe('getEnableCompanyFeatureForTenant', ()=>{
+        it('uses the tenant override when defined (true)', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            expect(service.getEnableCompanyFeatureForTenant({
+                enableCompanyFeature: true
+            })).toBe(true);
+        });
+        it('uses the tenant override when defined (false)', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForTenant({
+                enableCompanyFeature: false
+            })).toBe(false);
+        });
+        it('falls back to the config service when the tenant has no override', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForTenant({})).toBe(true);
+        });
+        it('falls back to the config service when no tenant is provided', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForTenant(undefined)).toBe(true);
+        });
+    });
+    describe('getEnableCompanyFeatureForCurrentTenant', ()=>{
+        it('falls back to the config service when there is no current request/tenant', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForCurrentTenant()).toBe(true);
+        });
+    });
+    describe('getIAMEntities', ()=>{
+        it('returns Action + non-company permission + role entities for RBAC mode', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            mockConfigService.getPermissionMode.mockReturnValue(1); // RBAC
+            const service = buildService();
+            const entities = await service.getIAMEntities();
+            expect(entities).toContain(Action);
+            expect(entities).toContain(UserIamPermission);
+            expect(entities).toContain(Role);
+            expect(entities).not.toContain(UserIamPermissionWithCompany);
+            expect(entities).not.toContain(RoleWithCompany);
+        });
+        it('returns company-scoped entities when company feature is enabled', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockConfigService.getPermissionMode.mockReturnValue(3); // FULL
+            const service = buildService();
+            const entities = await service.getIAMEntities();
+            expect(entities).toContain(Action);
+            expect(entities).toContain(UserIamPermissionWithCompany);
+            expect(entities).toContain(RoleWithCompany);
+            expect(entities).not.toContain(UserIamPermission);
+            expect(entities).not.toContain(Role);
+        });
+        it('excludes role entities entirely in DIRECT mode', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            mockConfigService.getPermissionMode.mockReturnValue(2); // DIRECT
+            const service = buildService();
+            const entities = await service.getIAMEntities();
+            expect(entities).toEqual([
+                Action,
+                UserIamPermission
+            ]);
+        });
+    });
+    describe('createDataSourceFromConfig', ()=>{
+        it('resolves IAM entities and delegates to the parent with them', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            mockConfigService.getPermissionMode.mockReturnValue(1); // RBAC
+            const service = buildService();
+            const fakeDataSource = {
+                isInitialized: true
+            };
+            const parentSpy = jest.spyOn(MultiTenantDataSourceService.prototype, 'createDataSourceFromConfig').mockResolvedValue(fakeDataSource);
+            const config = {
+                type: 'mysql',
+                host: 'localhost'
+            };
+            const result = await service.createDataSourceFromConfig(config);
+            expect(result).toBe(fakeDataSource);
+            expect(parentSpy).toHaveBeenCalledWith(config, [
+                Action,
+                UserIamPermission,
+                Role
+            ]);
+            parentSpy.mockRestore();
+        });
+    });
+});