@flusys/nestjs-iam 6.0.2 → 6.1.0

package/fesm/services/iam-config.service.spec.js

@@ -0,0 +1,106 @@
+import { IAMPermissionMode } from '../enums/permission-type.enum';
+import { IAMConfigService } from './iam-config.service';
+describe('IAMConfigService', ()=>{
+    describe('with no injected options (defaults)', ()=>{
+        let service;
+        beforeEach(()=>{
+            service = new IAMConfigService();
+        });
+        it('defaults to single database mode', ()=>{
+            expect(service.getDatabaseMode()).toBe('single');
+            expect(service.isMultiTenant()).toBe(false);
+        });
+        it('defaults company feature to disabled', ()=>{
+            expect(service.isCompanyFeatureEnabled()).toBe(false);
+        });
+        it('defaults permission mode to FULL', ()=>{
+            expect(service.getPermissionMode()).toBe(IAMPermissionMode.FULL);
+            expect(service.isRbacEnabled()).toBe(true);
+            expect(service.isDirectPermissionEnabled()).toBe(true);
+        });
+        it('returns the fallback options object from getOptions', ()=>{
+            expect(service.getOptions()).toEqual({
+                global: false,
+                includeController: false
+            });
+        });
+    });
+    describe('with injected options', ()=>{
+        function buildService(overrides) {
+            const options = {
+                global: false,
+                includeController: false,
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: false,
+                    ...overrides
+                }
+            };
+            return new IAMConfigService(options);
+        }
+        it('reports multi-tenant mode when configured', ()=>{
+            const service = buildService({
+                databaseMode: 'multi-tenant'
+            });
+            expect(service.getDatabaseMode()).toBe('multi-tenant');
+            expect(service.isMultiTenant()).toBe(true);
+        });
+        it('reports company feature enabled when configured', ()=>{
+            const service = buildService({
+                enableCompanyFeature: true
+            });
+            expect(service.isCompanyFeatureEnabled()).toBe(true);
+        });
+        describe('permission mode: RBAC', ()=>{
+            let service;
+            beforeEach(()=>{
+                service = buildService({
+                    permissionMode: 'RBAC'
+                });
+            });
+            it('enables RBAC but not direct permissions', ()=>{
+                expect(service.getPermissionMode()).toBe(IAMPermissionMode.RBAC);
+                expect(service.isRbacEnabled()).toBe(true);
+                expect(service.isDirectPermissionEnabled()).toBe(false);
+            });
+        });
+        describe('permission mode: DIRECT', ()=>{
+            let service;
+            beforeEach(()=>{
+                service = buildService({
+                    permissionMode: 'DIRECT'
+                });
+            });
+            it('enables direct permissions but not RBAC', ()=>{
+                expect(service.getPermissionMode()).toBe(IAMPermissionMode.DIRECT);
+                expect(service.isRbacEnabled()).toBe(false);
+                expect(service.isDirectPermissionEnabled()).toBe(true);
+            });
+        });
+        describe('permission mode: FULL', ()=>{
+            let service;
+            beforeEach(()=>{
+                service = buildService({
+                    permissionMode: 'FULL'
+                });
+            });
+            it('enables both RBAC and direct permissions', ()=>{
+                expect(service.getPermissionMode()).toBe(IAMPermissionMode.FULL);
+                expect(service.isRbacEnabled()).toBe(true);
+                expect(service.isDirectPermissionEnabled()).toBe(true);
+            });
+        });
+        it('returns the exact injected options object from getOptions', ()=>{
+            const options = {
+                global: true,
+                includeController: true,
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: true
+                }
+            };
+            const service = new IAMConfigService(options);
+            expect(service.getOptions()).toBe(options);
+        });
+    });
+});

package/fesm/services/iam-datasource.service.spec.js

@@ -0,0 +1,113 @@
+import { MultiTenantDataSourceService } from '@flusys/nestjs-shared/modules';
+import { Action } from '../entities/action.entity';
+import { UserIamPermission } from '../entities/user-iam-permission.entity';
+import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
+import { Role } from '../entities/role.entity';
+import { RoleWithCompany } from '../entities/role-with-company.entity';
+import { IAMDataSourceService } from './iam-datasource.service';
+describe('IAMDataSourceService', ()=>{
+    let mockConfigService;
+    beforeEach(()=>{
+        mockConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false),
+            getPermissionMode: jest.fn(),
+            getOptions: jest.fn().mockReturnValue({
+                global: false,
+                includeController: false
+            })
+        };
+    });
+    function buildService(request) {
+        return new IAMDataSourceService(mockConfigService, request);
+    }
+    describe('getEnableCompanyFeatureForTenant', ()=>{
+        it('uses the tenant override when defined (true)', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            expect(service.getEnableCompanyFeatureForTenant({
+                enableCompanyFeature: true
+            })).toBe(true);
+        });
+        it('uses the tenant override when defined (false)', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForTenant({
+                enableCompanyFeature: false
+            })).toBe(false);
+        });
+        it('falls back to the config service when the tenant has no override', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForTenant({})).toBe(true);
+        });
+        it('falls back to the config service when no tenant is provided', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForTenant(undefined)).toBe(true);
+        });
+    });
+    describe('getEnableCompanyFeatureForCurrentTenant', ()=>{
+        it('falls back to the config service when there is no current request/tenant', ()=>{
+            const service = buildService();
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.getEnableCompanyFeatureForCurrentTenant()).toBe(true);
+        });
+    });
+    describe('getIAMEntities', ()=>{
+        it('returns Action + non-company permission + role entities for RBAC mode', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            mockConfigService.getPermissionMode.mockReturnValue(1); // RBAC
+            const service = buildService();
+            const entities = await service.getIAMEntities();
+            expect(entities).toContain(Action);
+            expect(entities).toContain(UserIamPermission);
+            expect(entities).toContain(Role);
+            expect(entities).not.toContain(UserIamPermissionWithCompany);
+            expect(entities).not.toContain(RoleWithCompany);
+        });
+        it('returns company-scoped entities when company feature is enabled', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockConfigService.getPermissionMode.mockReturnValue(3); // FULL
+            const service = buildService();
+            const entities = await service.getIAMEntities();
+            expect(entities).toContain(Action);
+            expect(entities).toContain(UserIamPermissionWithCompany);
+            expect(entities).toContain(RoleWithCompany);
+            expect(entities).not.toContain(UserIamPermission);
+            expect(entities).not.toContain(Role);
+        });
+        it('excludes role entities entirely in DIRECT mode', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            mockConfigService.getPermissionMode.mockReturnValue(2); // DIRECT
+            const service = buildService();
+            const entities = await service.getIAMEntities();
+            expect(entities).toEqual([
+                Action,
+                UserIamPermission
+            ]);
+        });
+    });
+    describe('createDataSourceFromConfig', ()=>{
+        it('resolves IAM entities and delegates to the parent with them', async ()=>{
+            mockConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            mockConfigService.getPermissionMode.mockReturnValue(1); // RBAC
+            const service = buildService();
+            const fakeDataSource = {
+                isInitialized: true
+            };
+            const parentSpy = jest.spyOn(MultiTenantDataSourceService.prototype, 'createDataSourceFromConfig').mockResolvedValue(fakeDataSource);
+            const config = {
+                type: 'mysql',
+                host: 'localhost'
+            };
+            const result = await service.createDataSourceFromConfig(config);
+            expect(result).toBe(fakeDataSource);
+            expect(parentSpy).toHaveBeenCalledWith(config, [
+                Action,
+                UserIamPermission,
+                Role
+            ]);
+            parentSpy.mockRestore();
+        });
+    });
+});

package/fesm/services/permission-cache.service.spec.js

@@ -0,0 +1,248 @@
+import { buildPermissionCacheKey } from '@flusys/nestjs-shared';
+import { PermissionCacheService } from './permission-cache.service';
+function buildCacheData(overrides = {}) {
+    return {
+        frontendActions: [],
+        backendCodes: [],
+        ...overrides
+    };
+}
+describe('PermissionCacheService', ()=>{
+    let mockCacheManager;
+    beforeEach(()=>{
+        mockCacheManager = {
+            get: jest.fn(),
+            set: jest.fn(),
+            del: jest.fn()
+        };
+    });
+    function buildService(guardConfig) {
+        return new PermissionCacheService(mockCacheManager, guardConfig);
+    }
+    describe('setMyPermissions / getMyPermissions', ()=>{
+        it('stores data under the user-scoped key and tracks it', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const data = buildCacheData({
+                backendCodes: [
+                    'user.read'
+                ]
+            });
+            await service.setMyPermissions({
+                userId: 'user-1'
+            }, data);
+            const expectedKey = buildPermissionCacheKey({
+                userId: 'user-1'
+            });
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expectedKey, data, expect.any(Number));
+            // tracked keys + tracked scopes get written too
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys:user:user-1'), [
+                expectedKey
+            ], expect.any(Number));
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'), [
+                'none'
+            ], expect.any(Number));
+        });
+        it('does not duplicate an already-tracked key', async ()=>{
+            const service = buildService();
+            const expectedKey = buildPermissionCacheKey({
+                userId: 'user-1'
+            });
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    expectedKey
+                ];
+                if (key.includes('permission-tracked-scopes')) return [
+                    'none'
+                ];
+                return undefined;
+            });
+            await service.setMyPermissions({
+                userId: 'user-1'
+            }, buildCacheData());
+            const trackedKeysCalls = mockCacheManager.set.mock.calls.filter(([key])=>String(key).includes('permission-tracked-keys'));
+            expect(trackedKeysCalls).toHaveLength(0);
+        });
+        it('returns cached data on a hit', async ()=>{
+            const service = buildService();
+            const data = buildCacheData({
+                backendCodes: [
+                    'a.b'
+                ]
+            });
+            mockCacheManager.get.mockResolvedValue(data);
+            const result = await service.getMyPermissions({
+                userId: 'user-1'
+            });
+            expect(result).toBe(data);
+        });
+        it('returns null on a cache miss', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.getMyPermissions({
+                userId: 'user-1'
+            });
+            expect(result).toBeNull();
+        });
+        it('returns null (not throw) when the cache backend errors', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockRejectedValue(new Error('cache down'));
+            const result = await service.getMyPermissions({
+                userId: 'user-1'
+            });
+            expect(result).toBeNull();
+        });
+        it('uses the company-scoped key when guard config enables company scope', async ()=>{
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            mockCacheManager.get.mockResolvedValue(undefined);
+            await service.setMyPermissions({
+                userId: 'user-1',
+                companyId: 'company-1'
+            }, buildCacheData());
+            const expectedKey = buildPermissionCacheKey({
+                userId: 'user-1',
+                companyId: 'company-1'
+            }, guardConfig);
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expectedKey, expect.anything(), expect.any(Number));
+        });
+    });
+    describe('invalidateUser', ()=>{
+        it('invalidates only the given company scope when companyId is provided', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    'tracked-key-1',
+                    'tracked-key-2'
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1', 'company-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('tracked-key-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('tracked-key-2');
+            expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys:user:user-1:company:company-1'));
+            // no company scope given -> tracked-scopes key should not be touched in this branch
+            expect(mockCacheManager.del).not.toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes'));
+        });
+        it('invalidates only the requested branch keys, keeping remaining branches tracked', async ()=>{
+            // company-scoped key format only differentiates by branchId when the guard config
+            // enables the company feature — otherwise every branch maps to the same cache key.
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            const keptKey = buildPermissionCacheKey({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-keep'
+            }, guardConfig);
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    keptKey,
+                    'some-other-tracked-key'
+                ];
+                return undefined;
+            });
+            // companyId given directly invokes invalidateScope (bypasses the tracked-scopes fan-out)
+            await service.invalidateUser('user-1', 'company-1', [
+                'branch-a'
+            ]);
+            // the specific branch key gets deleted
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain(buildPermissionCacheKey({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-a'
+            }, guardConfig));
+            // remaining tracked keys get re-saved rather than the tracked-keys index being wiped
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys'), expect.arrayContaining([
+                keptKey,
+                'some-other-tracked-key'
+            ]), expect.any(Number));
+        });
+        it('deletes the tracked-keys index entirely when no remaining keys are left after branch filtering', async ()=>{
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            const onlyKey = buildPermissionCacheKey({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-a'
+            }, guardConfig);
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    onlyKey
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1', 'company-1', [
+                'branch-a'
+            ]);
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain(onlyKey);
+            expect(deletedKeys.some((k)=>String(k).includes('permission-tracked-keys'))).toBe(true);
+        });
+        it('without a companyId, invalidates every tracked scope for the user and clears the scopes index', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-scopes')) return [
+                    'none',
+                    'company-a'
+                ];
+                if (key.includes('company:none')) return [
+                    'key-none-1'
+                ];
+                if (key.includes('company:company-a')) return [
+                    'key-company-a-1'
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('key-none-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('key-company-a-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'));
+        });
+        it('treats a cache read error for tracked scopes as an empty list (no throw)', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockRejectedValue(new Error('down'));
+            await expect(service.invalidateUser('user-1')).resolves.toBeUndefined();
+            expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'));
+        });
+    });
+    describe('invalidateUsers', ()=>{
+        it('returns 0 immediately for an empty user list', async ()=>{
+            const service = buildService();
+            const result = await service.invalidateUsers([]);
+            expect(result).toBe(0);
+            expect(mockCacheManager.get).not.toHaveBeenCalled();
+        });
+        it('invalidates every user and returns the count of successful invalidations', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.invalidateUsers([
+                'user-1',
+                'user-2',
+                'user-3'
+            ], 'company-1');
+            expect(result).toBe(3);
+        });
+        it('does not let one user failing prevent the others from being counted', async ()=>{
+            const service = buildService();
+            let callCount = 0;
+            mockCacheManager.get.mockImplementation(async ()=>{
+                callCount += 1;
+                if (callCount === 1) throw new Error('boom');
+                return undefined;
+            });
+            const result = await service.invalidateUsers([
+                'user-1',
+                'user-2'
+            ], 'company-1');
+            // invalidateUser swallows its own read errors, so both still resolve successfully
+            expect(result).toBe(2);
+        });
+    });
+});