@flusys/nestjs-iam 6.0.2 → 6.1.0

package/fesm/modules/iam.module.spec.js

@@ -0,0 +1,289 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+import { PERMISSION_GUARD_CONFIG } from '@flusys/nestjs-shared';
+import { IAMModule } from './iam.module';
+import { IAM_MODULE_OPTIONS } from '../config/iam.constants';
+import { ActionController, CompanyActionPermissionController, MyPermissionController, RoleController, RolePermissionController, UserActionPermissionController } from '../controllers';
+import { ActionService, PermissionService, RoleService } from '../services';
+import { IAMConfigService } from '../services/iam-config.service';
+import { IAMDataSourceService } from '../services/iam-datasource.service';
+import { PermissionCacheService } from '../services/permission-cache.service';
+function providerTokens(providers) {
+    return providers.map((p)=>typeof p === 'function' ? p : p.provide);
+}
+describe('IAMModule', ()=>{
+    describe('forRoot - controller/service registration matrix', ()=>{
+        it('should register no controllers by default (includeController defaults to false)', ()=>{
+            const dynamicModule = IAMModule.forRoot();
+            expect(dynamicModule.controllers).toEqual([]);
+        });
+        it('DIRECT mode: registers only UserActionPermissionController beyond the base set', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                UserActionPermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(RoleService);
+        });
+        it('RBAC mode: registers RoleController + RolePermissionController but not UserActionPermissionController', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                RoleController,
+                RolePermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).toContain(RoleService);
+        });
+        it('FULL mode: registers every permission controller', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                RoleController,
+                UserActionPermissionController,
+                RolePermissionController
+            ]);
+        });
+        it('defaults to FULL mode when permissionMode is omitted', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                RoleController,
+                UserActionPermissionController,
+                RolePermissionController
+            ]));
+        });
+        it('defaults to FULL mode when permissionMode is an unrecognized string', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'BOGUS'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                RoleController,
+                UserActionPermissionController,
+                RolePermissionController
+            ]));
+        });
+        it('adds CompanyActionPermissionController only when enableCompanyFeature is true', ()=>{
+            const withCompany = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const withoutCompany = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: false
+                }
+            });
+            expect(withCompany.controllers).toContain(CompanyActionPermissionController);
+            expect(withoutCompany.controllers).not.toContain(CompanyActionPermissionController);
+        });
+        it('excludes RoleService for DIRECT mode but includes it for RBAC/FULL', ()=>{
+            const direct = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            const rbac = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            const full = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(providerTokens(direct.providers)).not.toContain(RoleService);
+            expect(providerTokens(rbac.providers)).toContain(RoleService);
+            expect(providerTokens(full.providers)).toContain(RoleService);
+            expect(providerTokens(direct.exports)).not.toContain(RoleService);
+            expect(providerTokens(rbac.exports)).toContain(RoleService);
+        });
+        it('always registers the base providers/exports (ActionService, PermissionService, PermissionCacheService)', ()=>{
+            const dynamicModule = IAMModule.forRoot();
+            expect(providerTokens(dynamicModule.providers)).toEqual(expect.arrayContaining([
+                IAMConfigService,
+                IAMDataSourceService,
+                ActionService,
+                PermissionService,
+                PermissionCacheService
+            ]));
+            expect(dynamicModule.exports).toEqual(expect.arrayContaining([
+                IAMConfigService,
+                IAMDataSourceService,
+                ActionService,
+                PermissionService,
+                PermissionCacheService,
+                PERMISSION_GUARD_CONFIG
+            ]));
+        });
+    });
+    describe('forRoot - options/global handling', ()=>{
+        it('should not set `global` on the returned module when global is false/omitted', ()=>{
+            const dynamicModule = IAMModule.forRoot();
+            expect(dynamicModule.global).toBeUndefined();
+        });
+        it('should set global: true when requested', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                global: true
+            });
+            expect(dynamicModule.global).toBe(true);
+        });
+        it('should register IAM_MODULE_OPTIONS with the given options', ()=>{
+            const options = {
+                includeController: true
+            };
+            const dynamicModule = IAMModule.forRoot(options);
+            const provider = dynamicModule.providers.find((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(provider.useValue).toBe(options);
+        });
+        it('should build a company-aware PERMISSION_GUARD_CONFIG provider', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const provider = dynamicModule.providers.find((p)=>p.provide === PERMISSION_GUARD_CONFIG);
+            expect(provider.useValue.enableCompanyFeature).toBe(true);
+            expect(provider.useValue.userPermissionKeyFormat).toContain('{userId}');
+            expect(provider.useValue.companyPermissionKeyFormat).toContain('{companyId}');
+        });
+    });
+    describe('forRootAsync', ()=>{
+        it('mirrors the controller/service registration matrix of forRoot', ()=>{
+            const dynamicModule = IAMModule.forRootAsync({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                UserActionPermissionController
+            ]);
+        });
+        it('should forward external imports alongside CacheModule/UtilsModule', ()=>{
+            let FakeImportedModule = class FakeImportedModule {
+            };
+            const dynamicModule = IAMModule.forRootAsync({
+                imports: [
+                    FakeImportedModule
+                ]
+            });
+            expect(dynamicModule.imports).toEqual(expect.arrayContaining([
+                FakeImportedModule
+            ]));
+        });
+        it('useFactory: registers a single options provider using the given inject tokens', async ()=>{
+            const useFactory = jest.fn().mockResolvedValue({
+                foo: 'bar'
+            });
+            const dynamicModule = IAMModule.forRootAsync({
+                useFactory,
+                inject: [
+                    'SOME_TOKEN'
+                ]
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.useFactory).toBe(useFactory);
+            expect(provider.inject).toEqual([
+                'SOME_TOKEN'
+            ]);
+        });
+        it('useClass: registers both the class provider and an options provider that calls createIAMOptions()', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-class'
+                    }));
+                }
+            };
+            const dynamicModule = IAMModule.forRootAsync({
+                useClass: MyOptionsFactory
+            });
+            const classProvider = dynamicModule.providers.find((p)=>p.provide === MyOptionsFactory);
+            expect(classProvider.useClass).toBe(MyOptionsFactory);
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await optionsProvider.useFactory(instance);
+            expect(instance.createIAMOptions).toHaveBeenCalled();
+            expect(resolved).toEqual({
+                foo: 'from-class'
+            });
+        });
+        it('useExisting: registers a single options provider injecting the existing factory', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-existing'
+                    }));
+                }
+            };
+            const dynamicModule = IAMModule.forRootAsync({
+                useExisting: MyOptionsFactory
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await provider.useFactory(instance);
+            expect(resolved).toEqual({
+                foo: 'from-existing'
+            });
+        });
+    });
+    describe('forFeature', ()=>{
+        it('should behave identically to forRoot', ()=>{
+            const options = {
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            };
+            expect(IAMModule.forFeature(options)).toEqual(IAMModule.forRoot(options));
+        });
+    });
+});

package/fesm/services/action.service.spec.js

@@ -0,0 +1,310 @@
+import { Test } from '@nestjs/testing';
+import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
+import { ActionType } from '../enums';
+import { ActionService } from './action.service';
+import { IAMConfigService } from './iam-config.service';
+import { IAMDataSourceService } from './iam-datasource.service';
+import { PermissionCacheService } from './permission-cache.service';
+import { PermissionService } from './permission.service';
+function buildAction(overrides = {}) {
+    return {
+        id: 'action-uuid-1',
+        readOnly: false,
+        name: 'View Products',
+        description: null,
+        code: 'products.read',
+        actionType: ActionType.BACKEND,
+        permissionLogic: null,
+        serial: 1,
+        isActive: true,
+        parentId: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+describe('ActionService', ()=>{
+    let service;
+    let mockRepo;
+    let mockIamConfigService;
+    let mockPermissionService;
+    let mockPermissionCacheService;
+    beforeEach(async ()=>{
+        mockRepo = createMockRepository();
+        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
+        mockIamConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
+        };
+        mockPermissionService = {
+            getCompanyActionIds: jest.fn(),
+            invalidateCompanyMembersCache: jest.fn()
+        };
+        mockPermissionCacheService = {
+            invalidateUsers: jest.fn()
+        };
+        const module = await Test.createTestingModule({
+            providers: [
+                ActionService,
+                {
+                    provide: 'CACHE_INSTANCE',
+                    useValue: {}
+                },
+                {
+                    provide: UtilsService,
+                    useValue: {}
+                },
+                {
+                    provide: IAMConfigService,
+                    useValue: mockIamConfigService
+                },
+                {
+                    provide: IAMDataSourceService,
+                    useValue: mockDataSourceProvider
+                },
+                {
+                    provide: PermissionService,
+                    useValue: mockPermissionService
+                },
+                {
+                    provide: PermissionCacheService,
+                    useValue: mockPermissionCacheService
+                }
+            ]
+        }).compile();
+        service = await module.resolve(ActionService);
+    });
+    describe('getActionsForPermission', ()=>{
+        it('returns all actions when the company feature is disabled', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildAction()
+            ]);
+            const result = await service.getActionsForPermission(buildMockUser());
+            expect(mockPermissionService.getCompanyActionIds).not.toHaveBeenCalled();
+            expect(result).toHaveLength(1);
+            expect(result[0].code).toBe('products.read');
+        });
+        it('scopes actions to the company whitelist when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionService.getCompanyActionIds.mockResolvedValue([
+                'action-uuid-1'
+            ]);
+            mockRepo.find.mockResolvedValue([
+                buildAction()
+            ]);
+            await service.getActionsForPermission(buildMockUser(), 'company-uuid-1');
+            expect(mockPermissionService.getCompanyActionIds).toHaveBeenCalledWith('company-uuid-1');
+            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
+                where: {
+                    id: expect.anything()
+                }
+            }));
+        });
+        it('short-circuits without querying when the company has no whitelisted actions', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionService.getCompanyActionIds.mockResolvedValue([]);
+            const result = await service.getActionsForPermission(buildMockUser(), 'company-uuid-1');
+            expect(result).toEqual([]);
+            expect(mockRepo.find).not.toHaveBeenCalled();
+        });
+        it('throws when no user is provided', async ()=>{
+            await expect(service.getActionsForPermission(null)).rejects.toThrow();
+        });
+    });
+    describe('getActionTree', ()=>{
+        it('nests child actions under their parent', async ()=>{
+            const parent = buildAction({
+                id: 'parent-1',
+                parentId: null,
+                serial: 1
+            });
+            const child = buildAction({
+                id: 'child-1',
+                parentId: 'parent-1',
+                serial: 2,
+                code: 'products.create'
+            });
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
+                parent,
+                child
+            ]);
+            const tree = await service.getActionTree(buildMockUser());
+            expect(tree).toHaveLength(1);
+            expect(tree[0].id).toBe('parent-1');
+            expect(tree[0].children).toHaveLength(1);
+            expect(tree[0].children?.[0].id).toBe('child-1');
+        });
+        it('throws when no user is provided', async ()=>{
+            await expect(service.getActionTree(null)).rejects.toThrow();
+        });
+        it('treats an action with a missing/unknown parentId as a root node', async ()=>{
+            const orphan = buildAction({
+                id: 'orphan-1',
+                parentId: 'does-not-exist'
+            });
+            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
+                orphan
+            ]);
+            const tree = await service.getActionTree(buildMockUser());
+            expect(tree).toHaveLength(1);
+            expect(tree[0].id).toBe('orphan-1');
+        });
+        it('excludes soft-deleted actions by default and applies search/isActive filters', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            query.getMany.mockResolvedValue([]);
+            await service.getActionTree(buildMockUser(), 'view', true, false);
+            expect(query.andWhere).toHaveBeenCalledWith('action.deletedAt IS NULL');
+            expect(query.andWhere).toHaveBeenCalledWith('action.isActive = :isActive', {
+                isActive: true
+            });
+            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search)', {
+                search: '%view%'
+            });
+        });
+        it('includes soft-deleted actions when withDeleted is true', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            query.getMany.mockResolvedValue([]);
+            await service.getActionTree(buildMockUser(), undefined, undefined, true);
+            expect(query.andWhere).not.toHaveBeenCalledWith('action.deletedAt IS NULL');
+        });
+    });
+    describe('getSelectQuery', ()=>{
+        it('selects the default field set when none is provided', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, buildMockUser());
+            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
+                'action.code',
+                'action.actionType',
+                'action.permissionLogic'
+            ]));
+        });
+        it('uses the explicitly provided select list as-is', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, buildMockUser(), [
+                'id',
+                'code'
+            ]);
+            expect(query.select).toHaveBeenCalledWith([
+                'action.id',
+                'action.code'
+            ]);
+        });
+    });
+    describe('getGlobalSearchQuery', ()=>{
+        it('filters by name, code, or description', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getGlobalSearchQuery(query, 'view');
+            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
+                search: '%view%'
+            });
+        });
+    });
+    describe('convertEntityToResponseDto', ()=>{
+        it('maps every entity field onto the response shape', ()=>{
+            const entity = buildAction({
+                code: 'user.view'
+            });
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto).toEqual(expect.objectContaining({
+                id: entity.id,
+                code: 'user.view',
+                actionType: ActionType.BACKEND
+            }));
+        });
+    });
+    describe('beforeDeleteOperation', ()=>{
+        function buildQueryRunner(permissionRepo) {
+            return {
+                manager: {
+                    getRepository: jest.fn().mockReturnValue(permissionRepo)
+                }
+            };
+        }
+        it('does nothing when the delete DTO has no ids', async ()=>{
+            const permissionRepo = createMockRepository();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('cascades role/user/company action-permission cleanup and invalidates affected caches', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const permissionRepo = createMockRepository();
+            // Company feature is disabled, so companyActionRows resolves via Promise.resolve([]) and
+            // never calls permissionRepo.find() — only 3 real find() calls happen: role-action,
+            // user-action, then the role -> user cascade lookup.
+            permissionRepo.find.mockResolvedValueOnce([
+                {
+                    sourceId: 'role-1'
+                }
+            ]) // role-action rows referencing the deleted action
+            .mockResolvedValueOnce([
+                {
+                    userId: 'user-1'
+                }
+            ]) // direct user-action rows
+            .mockResolvedValueOnce([
+                {
+                    userId: 'user-2'
+                }
+            ]); // users holding role-1 (cascaded lookup)
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: 'action-uuid-1',
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'role_action'
+            }));
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'user_action'
+            }));
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'company_action'
+            }));
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith(expect.arrayContaining([
+                'user-1',
+                'user-2'
+            ]));
+            expect(mockPermissionService.invalidateCompanyMembersCache).not.toHaveBeenCalled();
+        });
+        it('also queries and invalidates company whitelist entries when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            const permissionRepo = createMockRepository();
+            permissionRepo.find.mockResolvedValueOnce([]) // role-action rows
+            .mockResolvedValueOnce([]) // direct user-action rows
+            .mockResolvedValueOnce([
+                {
+                    sourceId: 'company-1'
+                }
+            ]); // company-action rows
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'action-uuid-1'
+                ],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(mockPermissionService.invalidateCompanyMembersCache).toHaveBeenCalledWith('company-1');
+        });
+        it('does not invalidate any cache when nothing is affected', async ()=>{
+            const permissionRepo = createMockRepository();
+            permissionRepo.find.mockResolvedValue([]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'action-uuid-1'
+                ],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
+        });
+    });
+});