@flusys/nestjs-iam 6.0.2 → 6.1.0

package/cjs/services/permission-cache.service.spec.js

@@ -0,0 +1,252 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _nestjsshared = require("@flusys/nestjs-shared");
+const _permissioncacheservice = require("./permission-cache.service");
+function buildCacheData(overrides = {}) {
+    return {
+        frontendActions: [],
+        backendCodes: [],
+        ...overrides
+    };
+}
+describe('PermissionCacheService', ()=>{
+    let mockCacheManager;
+    beforeEach(()=>{
+        mockCacheManager = {
+            get: jest.fn(),
+            set: jest.fn(),
+            del: jest.fn()
+        };
+    });
+    function buildService(guardConfig) {
+        return new _permissioncacheservice.PermissionCacheService(mockCacheManager, guardConfig);
+    }
+    describe('setMyPermissions / getMyPermissions', ()=>{
+        it('stores data under the user-scoped key and tracks it', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const data = buildCacheData({
+                backendCodes: [
+                    'user.read'
+                ]
+            });
+            await service.setMyPermissions({
+                userId: 'user-1'
+            }, data);
+            const expectedKey = (0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1'
+            });
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expectedKey, data, expect.any(Number));
+            // tracked keys + tracked scopes get written too
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys:user:user-1'), [
+                expectedKey
+            ], expect.any(Number));
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'), [
+                'none'
+            ], expect.any(Number));
+        });
+        it('does not duplicate an already-tracked key', async ()=>{
+            const service = buildService();
+            const expectedKey = (0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1'
+            });
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    expectedKey
+                ];
+                if (key.includes('permission-tracked-scopes')) return [
+                    'none'
+                ];
+                return undefined;
+            });
+            await service.setMyPermissions({
+                userId: 'user-1'
+            }, buildCacheData());
+            const trackedKeysCalls = mockCacheManager.set.mock.calls.filter(([key])=>String(key).includes('permission-tracked-keys'));
+            expect(trackedKeysCalls).toHaveLength(0);
+        });
+        it('returns cached data on a hit', async ()=>{
+            const service = buildService();
+            const data = buildCacheData({
+                backendCodes: [
+                    'a.b'
+                ]
+            });
+            mockCacheManager.get.mockResolvedValue(data);
+            const result = await service.getMyPermissions({
+                userId: 'user-1'
+            });
+            expect(result).toBe(data);
+        });
+        it('returns null on a cache miss', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.getMyPermissions({
+                userId: 'user-1'
+            });
+            expect(result).toBeNull();
+        });
+        it('returns null (not throw) when the cache backend errors', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockRejectedValue(new Error('cache down'));
+            const result = await service.getMyPermissions({
+                userId: 'user-1'
+            });
+            expect(result).toBeNull();
+        });
+        it('uses the company-scoped key when guard config enables company scope', async ()=>{
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            mockCacheManager.get.mockResolvedValue(undefined);
+            await service.setMyPermissions({
+                userId: 'user-1',
+                companyId: 'company-1'
+            }, buildCacheData());
+            const expectedKey = (0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1'
+            }, guardConfig);
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expectedKey, expect.anything(), expect.any(Number));
+        });
+    });
+    describe('invalidateUser', ()=>{
+        it('invalidates only the given company scope when companyId is provided', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    'tracked-key-1',
+                    'tracked-key-2'
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1', 'company-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('tracked-key-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('tracked-key-2');
+            expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys:user:user-1:company:company-1'));
+            // no company scope given -> tracked-scopes key should not be touched in this branch
+            expect(mockCacheManager.del).not.toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes'));
+        });
+        it('invalidates only the requested branch keys, keeping remaining branches tracked', async ()=>{
+            // company-scoped key format only differentiates by branchId when the guard config
+            // enables the company feature — otherwise every branch maps to the same cache key.
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            const keptKey = (0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-keep'
+            }, guardConfig);
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    keptKey,
+                    'some-other-tracked-key'
+                ];
+                return undefined;
+            });
+            // companyId given directly invokes invalidateScope (bypasses the tracked-scopes fan-out)
+            await service.invalidateUser('user-1', 'company-1', [
+                'branch-a'
+            ]);
+            // the specific branch key gets deleted
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain((0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-a'
+            }, guardConfig));
+            // remaining tracked keys get re-saved rather than the tracked-keys index being wiped
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys'), expect.arrayContaining([
+                keptKey,
+                'some-other-tracked-key'
+            ]), expect.any(Number));
+        });
+        it('deletes the tracked-keys index entirely when no remaining keys are left after branch filtering', async ()=>{
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            const onlyKey = (0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-a'
+            }, guardConfig);
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    onlyKey
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1', 'company-1', [
+                'branch-a'
+            ]);
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain(onlyKey);
+            expect(deletedKeys.some((k)=>String(k).includes('permission-tracked-keys'))).toBe(true);
+        });
+        it('without a companyId, invalidates every tracked scope for the user and clears the scopes index', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-scopes')) return [
+                    'none',
+                    'company-a'
+                ];
+                if (key.includes('company:none')) return [
+                    'key-none-1'
+                ];
+                if (key.includes('company:company-a')) return [
+                    'key-company-a-1'
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('key-none-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('key-company-a-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'));
+        });
+        it('treats a cache read error for tracked scopes as an empty list (no throw)', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockRejectedValue(new Error('down'));
+            await expect(service.invalidateUser('user-1')).resolves.toBeUndefined();
+            expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'));
+        });
+    });
+    describe('invalidateUsers', ()=>{
+        it('returns 0 immediately for an empty user list', async ()=>{
+            const service = buildService();
+            const result = await service.invalidateUsers([]);
+            expect(result).toBe(0);
+            expect(mockCacheManager.get).not.toHaveBeenCalled();
+        });
+        it('invalidates every user and returns the count of successful invalidations', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.invalidateUsers([
+                'user-1',
+                'user-2',
+                'user-3'
+            ], 'company-1');
+            expect(result).toBe(3);
+        });
+        it('does not let one user failing prevent the others from being counted', async ()=>{
+            const service = buildService();
+            let callCount = 0;
+            mockCacheManager.get.mockImplementation(async ()=>{
+                callCount += 1;
+                if (callCount === 1) throw new Error('boom');
+                return undefined;
+            });
+            const result = await service.invalidateUsers([
+                'user-1',
+                'user-2'
+            ], 'company-1');
+            // invalidateUser swallows its own read errors, so both still resolve successfully
+            expect(result).toBe(2);
+        });
+    });
+});