@flusys/nestjs-iam 6.0.2 → 6.1.0

package/cjs/helpers/company-access.helper.spec.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _constants = require("@flusys/nestjs-shared/constants");
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _companyaccesshelper = require("./company-access.helper");
+describe('validateCompanyAccess', ()=>{
+    function buildConfig(isCompanyFeatureEnabled) {
+        return {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(isCompanyFeatureEnabled)
+        };
+    }
+    it('does not throw when company feature is disabled', ()=>{
+        const config = buildConfig(false);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user)).not.toThrow();
+    });
+    it('does not throw when companyId is undefined', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, undefined, user)).not.toThrow();
+    });
+    it('does not throw when the companyId matches the user company', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-1', user)).not.toThrow();
+    });
+    it('throws ForbiddenException with default message/key when the company does not match', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        try {
+            (0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user);
+            fail('expected validateCompanyAccess to throw');
+        } catch (error) {
+            expect(error).toBeInstanceOf(_common.ForbiddenException);
+            expect(error.getResponse()).toEqual(expect.objectContaining({
+                message: 'You do not have access to this company',
+                messageKey: _constants.AUTH_MESSAGES.COMPANY_NO_ACCESS
+            }));
+        }
+    });
+    it('throws with a custom message and messageKey when provided', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        try {
+            (0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user, 'Custom message', 'custom.message.key');
+            fail('expected validateCompanyAccess to throw');
+        } catch (error) {
+            expect(error).toBeInstanceOf(_common.ForbiddenException);
+            expect(error.getResponse()).toEqual(expect.objectContaining({
+                message: 'Custom message',
+                messageKey: 'custom.message.key'
+            }));
+        }
+    });
+});

package/cjs/helpers/permission-mode.helper.spec.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _permissiontypeenum = require("../enums/permission-type.enum");
+const _permissionmodehelper = require("./permission-mode.helper");
+describe('PermissionModeHelper', ()=>{
+    describe('fromString', ()=>{
+        it('converts "RBAC" to IAMPermissionMode.RBAC', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('RBAC')).toBe(_permissiontypeenum.IAMPermissionMode.RBAC);
+        });
+        it('converts "DIRECT" to IAMPermissionMode.DIRECT', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('DIRECT')).toBe(_permissiontypeenum.IAMPermissionMode.DIRECT);
+        });
+        it('converts "FULL" to IAMPermissionMode.FULL', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('FULL')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is undefined', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString(undefined)).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is empty', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is not a known mode', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('INVALID_MODE')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('is case-sensitive and falls back to FULL for lowercase input', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('rbac')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+    });
+    describe('toString', ()=>{
+        it('converts IAMPermissionMode.RBAC to "RBAC"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.RBAC)).toBe('RBAC');
+        });
+        it('converts IAMPermissionMode.DIRECT to "DIRECT"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.DIRECT)).toBe('DIRECT');
+        });
+        it('converts IAMPermissionMode.FULL to "FULL"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.FULL)).toBe('FULL');
+        });
+    });
+    describe('round trip', ()=>{
+        it('fromString(toString(mode)) returns the original mode for every enum value', ()=>{
+            const modes = [
+                _permissiontypeenum.IAMPermissionMode.RBAC,
+                _permissiontypeenum.IAMPermissionMode.DIRECT,
+                _permissiontypeenum.IAMPermissionMode.FULL
+            ];
+            for (const mode of modes){
+                expect(_permissionmodehelper.PermissionModeHelper.fromString(_permissionmodehelper.PermissionModeHelper.toString(mode))).toBe(mode);
+            }
+        });
+    });
+});

package/cjs/modules/iam.module.spec.js

@@ -0,0 +1,293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _nestjsshared = require("@flusys/nestjs-shared");
+const _iammodule = require("./iam.module");
+const _iamconstants = require("../config/iam.constants");
+const _controllers = require("../controllers");
+const _services = require("../services");
+const _iamconfigservice = require("../services/iam-config.service");
+const _iamdatasourceservice = require("../services/iam-datasource.service");
+const _permissioncacheservice = require("../services/permission-cache.service");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function providerTokens(providers) {
+    return providers.map((p)=>typeof p === 'function' ? p : p.provide);
+}
+describe('IAMModule', ()=>{
+    describe('forRoot - controller/service registration matrix', ()=>{
+        it('should register no controllers by default (includeController defaults to false)', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(dynamicModule.controllers).toEqual([]);
+        });
+        it('DIRECT mode: registers only UserActionPermissionController beyond the base set', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.UserActionPermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(_services.RoleService);
+        });
+        it('RBAC mode: registers RoleController + RolePermissionController but not UserActionPermissionController', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.RoleController,
+                _controllers.RolePermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).toContain(_services.RoleService);
+        });
+        it('FULL mode: registers every permission controller', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]);
+        });
+        it('defaults to FULL mode when permissionMode is omitted', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]));
+        });
+        it('defaults to FULL mode when permissionMode is an unrecognized string', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'BOGUS'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]));
+        });
+        it('adds CompanyActionPermissionController only when enableCompanyFeature is true', ()=>{
+            const withCompany = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const withoutCompany = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: false
+                }
+            });
+            expect(withCompany.controllers).toContain(_controllers.CompanyActionPermissionController);
+            expect(withoutCompany.controllers).not.toContain(_controllers.CompanyActionPermissionController);
+        });
+        it('excludes RoleService for DIRECT mode but includes it for RBAC/FULL', ()=>{
+            const direct = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            const rbac = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            const full = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(providerTokens(direct.providers)).not.toContain(_services.RoleService);
+            expect(providerTokens(rbac.providers)).toContain(_services.RoleService);
+            expect(providerTokens(full.providers)).toContain(_services.RoleService);
+            expect(providerTokens(direct.exports)).not.toContain(_services.RoleService);
+            expect(providerTokens(rbac.exports)).toContain(_services.RoleService);
+        });
+        it('always registers the base providers/exports (ActionService, PermissionService, PermissionCacheService)', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(providerTokens(dynamicModule.providers)).toEqual(expect.arrayContaining([
+                _iamconfigservice.IAMConfigService,
+                _iamdatasourceservice.IAMDataSourceService,
+                _services.ActionService,
+                _services.PermissionService,
+                _permissioncacheservice.PermissionCacheService
+            ]));
+            expect(dynamicModule.exports).toEqual(expect.arrayContaining([
+                _iamconfigservice.IAMConfigService,
+                _iamdatasourceservice.IAMDataSourceService,
+                _services.ActionService,
+                _services.PermissionService,
+                _permissioncacheservice.PermissionCacheService,
+                _nestjsshared.PERMISSION_GUARD_CONFIG
+            ]));
+        });
+    });
+    describe('forRoot - options/global handling', ()=>{
+        it('should not set `global` on the returned module when global is false/omitted', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(dynamicModule.global).toBeUndefined();
+        });
+        it('should set global: true when requested', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                global: true
+            });
+            expect(dynamicModule.global).toBe(true);
+        });
+        it('should register IAM_MODULE_OPTIONS with the given options', ()=>{
+            const options = {
+                includeController: true
+            };
+            const dynamicModule = _iammodule.IAMModule.forRoot(options);
+            const provider = dynamicModule.providers.find((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(provider.useValue).toBe(options);
+        });
+        it('should build a company-aware PERMISSION_GUARD_CONFIG provider', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const provider = dynamicModule.providers.find((p)=>p.provide === _nestjsshared.PERMISSION_GUARD_CONFIG);
+            expect(provider.useValue.enableCompanyFeature).toBe(true);
+            expect(provider.useValue.userPermissionKeyFormat).toContain('{userId}');
+            expect(provider.useValue.companyPermissionKeyFormat).toContain('{companyId}');
+        });
+    });
+    describe('forRootAsync', ()=>{
+        it('mirrors the controller/service registration matrix of forRoot', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.UserActionPermissionController
+            ]);
+        });
+        it('should forward external imports alongside CacheModule/UtilsModule', ()=>{
+            let FakeImportedModule = class FakeImportedModule {
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                imports: [
+                    FakeImportedModule
+                ]
+            });
+            expect(dynamicModule.imports).toEqual(expect.arrayContaining([
+                FakeImportedModule
+            ]));
+        });
+        it('useFactory: registers a single options provider using the given inject tokens', async ()=>{
+            const useFactory = jest.fn().mockResolvedValue({
+                foo: 'bar'
+            });
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useFactory,
+                inject: [
+                    'SOME_TOKEN'
+                ]
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.useFactory).toBe(useFactory);
+            expect(provider.inject).toEqual([
+                'SOME_TOKEN'
+            ]);
+        });
+        it('useClass: registers both the class provider and an options provider that calls createIAMOptions()', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-class'
+                    }));
+                }
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useClass: MyOptionsFactory
+            });
+            const classProvider = dynamicModule.providers.find((p)=>p.provide === MyOptionsFactory);
+            expect(classProvider.useClass).toBe(MyOptionsFactory);
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await optionsProvider.useFactory(instance);
+            expect(instance.createIAMOptions).toHaveBeenCalled();
+            expect(resolved).toEqual({
+                foo: 'from-class'
+            });
+        });
+        it('useExisting: registers a single options provider injecting the existing factory', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-existing'
+                    }));
+                }
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useExisting: MyOptionsFactory
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await provider.useFactory(instance);
+            expect(resolved).toEqual({
+                foo: 'from-existing'
+            });
+        });
+    });
+    describe('forFeature', ()=>{
+        it('should behave identically to forRoot', ()=>{
+            const options = {
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            };
+            expect(_iammodule.IAMModule.forFeature(options)).toEqual(_iammodule.IAMModule.forRoot(options));
+        });
+    });
+});