@flusys/nestjs-iam 6.1.0 → 6.1.2

package/fesm/services/permission-cache.service.spec.js

@@ -1,4 +1,12 @@
 import { buildPermissionCacheKey } from '@flusys/nestjs-shared';
+import { createMockRepository } from '@test-utils/mocks/repository.mock';
+import { Action } from '../entities/action.entity';
+import { RoleWithCompany } from '../entities/role-with-company.entity';
+import { Role } from '../entities/role.entity';
+import { ActionType } from '../enums/action-type.enum';
+import { IamEntityType } from '../enums/iam-entity-type.enum';
+import { IamPermissionType } from '../enums/iam-permission-type.enum';
+import { IAMPermissionMode } from '../enums/permission-type.enum';
 import { PermissionCacheService } from './permission-cache.service';
 function buildCacheData(overrides = {}) {
     return {
@@ -7,17 +15,83 @@ function buildCacheData(overrides = {}) {
         ...overrides
     };
 }
+function buildPermissionRow(overrides = {}) {
+    const row = {
+        id: 'perm-uuid-1',
+        permissionType: IamPermissionType.USER_ACTION,
+        sourceType: IamEntityType.USER,
+        sourceId: 'user-1',
+        targetType: IamEntityType.ACTION,
+        targetId: 'action-1',
+        companyId: null,
+        branchId: null,
+        validFrom: null,
+        validUntil: null,
+        reason: null,
+        createdAt: new Date(),
+        ...overrides
+    };
+    row.isValid = (now = new Date())=>{
+        if (row.validFrom && now < row.validFrom) return false;
+        if (row.validUntil && now > row.validUntil) return false;
+        return true;
+    };
+    return row;
+}
+function buildAction(overrides = {}) {
+    return {
+        id: 'action-1',
+        name: 'View Users',
+        code: 'user.view',
+        description: null,
+        actionType: ActionType.BACKEND,
+        parentId: null,
+        isActive: true,
+        ...overrides
+    };
+}
+function mockRawMany(repo, rows) {
+    const builder = {
+        select: jest.fn().mockReturnThis(),
+        addSelect: jest.fn().mockReturnThis(),
+        where: jest.fn().mockReturnThis(),
+        andWhere: jest.fn().mockReturnThis(),
+        getRawMany: jest.fn().mockResolvedValue(rows)
+    };
+    repo.createQueryBuilder.mockReturnValue(builder);
+    return builder;
+}
 describe('PermissionCacheService', ()=>{
     let mockCacheManager;
+    let mockIamConfigService;
+    let mockPermissionRepo;
+    let mockActionRepo;
+    let mockRoleRepo;
+    let mockDataSourceProvider;
     beforeEach(()=>{
         mockCacheManager = {
             get: jest.fn(),
             set: jest.fn(),
             del: jest.fn()
         };
+        mockIamConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false),
+            getPermissionMode: jest.fn().mockReturnValue(IAMPermissionMode.FULL)
+        };
+        mockPermissionRepo = createMockRepository();
+        mockActionRepo = createMockRepository();
+        mockRoleRepo = createMockRepository();
+        mockDataSourceProvider = {
+            getRepository: jest.fn((entity)=>{
+                if (entity === Action) return Promise.resolve(mockActionRepo);
+                if (entity === Role || entity === RoleWithCompany) return Promise.resolve(mockRoleRepo);
+                return Promise.resolve(mockPermissionRepo);
+            }),
+            getDataSource: jest.fn()
+        };
     });
     function buildService(guardConfig) {
-        return new PermissionCacheService(mockCacheManager, guardConfig);
+        return new PermissionCacheService(mockCacheManager, mockIamConfigService, mockDataSourceProvider, guardConfig);
     }
     describe('setMyPermissions / getMyPermissions', ()=>{
         it('stores data under the user-scoped key and tracks it', async ()=>{
@@ -35,13 +109,11 @@ describe('PermissionCacheService', ()=>{
                 userId: 'user-1'
             });
             expect(mockCacheManager.set).toHaveBeenCalledWith(expectedKey, data, expect.any(Number));
-            // tracked keys + tracked scopes get written too
-            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys:user:user-1'), [
-                expectedKey
-            ], expect.any(Number));
+            // no company scope -> the raw cache key itself is tracked directly in the scopes index
             expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'), [
-                'none'
+                expectedKey
             ], expect.any(Number));
+            expect(mockCacheManager.set).not.toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys'), expect.anything(), expect.any(Number));
         });
         it('does not duplicate an already-tracked key', async ()=>{
             const service = buildService();
@@ -110,20 +182,28 @@ describe('PermissionCacheService', ()=>{
         });
     });
     describe('invalidateUser', ()=>{
-        it('invalidates only the given company scope when companyId is provided', async ()=>{
+        it('invalidates only the given company scope when companyId is provided, narrowing the scopes index', async ()=>{
             const service = buildService();
+            const trackedKeysKey = 'permission-tracked-keys:user:user-1:company:company-1';
             mockCacheManager.get.mockImplementation(async (key)=>{
                 if (key.includes('permission-tracked-keys')) return [
                     'tracked-key-1',
                     'tracked-key-2'
                 ];
+                if (key.includes('permission-tracked-scopes')) return [
+                    trackedKeysKey,
+                    'other-scope'
+                ];
                 return undefined;
             });
             await service.invalidateUser('user-1', 'company-1');
             expect(mockCacheManager.del).toHaveBeenCalledWith('tracked-key-1');
             expect(mockCacheManager.del).toHaveBeenCalledWith('tracked-key-2');
             expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys:user:user-1:company:company-1'));
-            // no company scope given -> tracked-scopes key should not be touched in this branch
+            // the invalidated scope is dropped from the index, but the index survives since another scope remains
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'), [
+                'other-scope'
+            ], expect.any(Number));
             expect(mockCacheManager.del).not.toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes'));
         });
         it('invalidates only the requested branch keys, keeping remaining branches tracked', async ()=>{
@@ -187,22 +267,23 @@ describe('PermissionCacheService', ()=>{
         });
         it('without a companyId, invalidates every tracked scope for the user and clears the scopes index', async ()=>{
             const service = buildService();
+            // scopes list mixes a nested tracked-keys index (company scope) with a raw cache key (untracked scope)
+            const trackedKeysKey = 'permission-tracked-keys:user:user-1:company:company-a';
+            const rawKey = 'my-permissions:user:user-1';
             mockCacheManager.get.mockImplementation(async (key)=>{
                 if (key.includes('permission-tracked-scopes')) return [
-                    'none',
-                    'company-a'
-                ];
-                if (key.includes('company:none')) return [
-                    'key-none-1'
+                    trackedKeysKey,
+                    rawKey
                 ];
-                if (key.includes('company:company-a')) return [
+                if (key === trackedKeysKey) return [
                     'key-company-a-1'
                 ];
                 return undefined;
             });
             await service.invalidateUser('user-1');
-            expect(mockCacheManager.del).toHaveBeenCalledWith('key-none-1');
             expect(mockCacheManager.del).toHaveBeenCalledWith('key-company-a-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith(trackedKeysKey);
+            expect(mockCacheManager.del).toHaveBeenCalledWith(rawKey);
             expect(mockCacheManager.del).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes:user:user-1'));
         });
         it('treats a cache read error for tracked scopes as an empty list (no throw)', async ()=>{
@@ -245,4 +326,370 @@ describe('PermissionCacheService', ()=>{
             expect(result).toBe(2);
         });
     });
+    describe('getMyPermissionsResponse', ()=>{
+        it('returns the response built directly from cached data on a cache hit', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(buildCacheData({
+                frontendActions: [
+                    {
+                        id: 'action-1',
+                        code: 'user.view',
+                        name: 'View',
+                        description: null,
+                        parentId: null
+                    }
+                ],
+                backendCodes: [
+                    'user.read'
+                ]
+            }));
+            const result = await service.getMyPermissionsResponse('user-1', null, 'company-1');
+            expect(result.frontendActions).toHaveLength(1);
+            expect(result.cachedEndpoints).toBe(1);
+            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('fetches from the database and caches the result on a cache miss', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockResolvedValue(undefined);
+            mockPermissionRepo.find.mockResolvedValue([]);
+            const result = await service.getMyPermissionsResponse('user-1', null, null);
+            expect(result).toEqual({
+                frontendActions: [],
+                cachedEndpoints: 0
+            });
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.any(String), {
+                frontendActions: [],
+                backendCodes: []
+            }, expect.any(Number));
+        });
+        it('filters frontend actions by parentCodes when provided', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked')) return undefined;
+                return buildCacheData({
+                    frontendActions: [
+                        {
+                            id: 'child-1',
+                            code: 'user.view',
+                            name: 'View',
+                            description: null,
+                            parentId: 'parent-1'
+                        },
+                        {
+                            id: 'child-2',
+                            code: 'other.view',
+                            name: 'View 2',
+                            description: null,
+                            parentId: 'other-parent'
+                        }
+                    ],
+                    backendCodes: []
+                });
+            });
+            mockActionRepo.find.mockResolvedValue([
+                {
+                    id: 'parent-1',
+                    code: 'user'
+                }
+            ]);
+            const result = await service.getMyPermissionsResponse('user-1', null, null, [
+                'user'
+            ]);
+            expect(result.frontendActions).toHaveLength(1);
+            expect(result.frontendActions[0].id).toBe('child-1');
+        });
+        it('returns an empty frontendActions list when parentCodes resolve to no known parents', async ()=>{
+            const service = buildService();
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked')) return undefined;
+                return buildCacheData({
+                    frontendActions: [
+                        {
+                            id: 'child-1',
+                            code: 'user.view',
+                            name: 'View',
+                            description: null,
+                            parentId: 'parent-1'
+                        }
+                    ],
+                    backendCodes: []
+                });
+            });
+            mockActionRepo.find.mockResolvedValue([]);
+            const result = await service.getMyPermissionsResponse('user-1', null, null, [
+                'unknown-parent-code'
+            ]);
+            expect(result.frontendActions).toEqual([]);
+        });
+    });
+    describe('collectAllActionIds (permission-mode branching)', ()=>{
+        it('RBAC mode: collects only role-derived action ids, ignoring direct user actions', async ()=>{
+            const service = buildService();
+            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.RBAC);
+            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === IamPermissionType.USER_ROLE) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: IamPermissionType.USER_ROLE,
+                            targetId: 'role-1'
+                        })
+                    ];
+                }
+                if (where.permissionType === IamPermissionType.ROLE_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: IamPermissionType.ROLE_ACTION,
+                            targetId: 'action-role-1'
+                        })
+                    ];
+                }
+                if (where.permissionType === IamPermissionType.USER_ACTION) {
+                    throw new Error('DIRECT lookup should not run in RBAC mode');
+                }
+                return [];
+            });
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result)).toEqual([
+                'action-role-1'
+            ]);
+        });
+        it('DIRECT mode: collects only directly-assigned user action ids, ignoring roles', async ()=>{
+            const service = buildService();
+            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.DIRECT);
+            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === IamPermissionType.USER_ROLE) {
+                    throw new Error('RBAC lookup should not run in DIRECT mode');
+                }
+                if (where.permissionType === IamPermissionType.USER_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: IamPermissionType.USER_ACTION,
+                            targetId: 'action-direct-1'
+                        })
+                    ];
+                }
+                return [];
+            });
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result)).toEqual([
+                'action-direct-1'
+            ]);
+        });
+        it('FULL mode: merges role-derived and direct action ids, de-duplicating overlaps', async ()=>{
+            const service = buildService();
+            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.FULL);
+            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === IamPermissionType.USER_ROLE) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: IamPermissionType.USER_ROLE,
+                            targetId: 'role-1'
+                        })
+                    ];
+                }
+                if (where.permissionType === IamPermissionType.ROLE_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: IamPermissionType.ROLE_ACTION,
+                            targetId: 'action-shared'
+                        })
+                    ];
+                }
+                if (where.permissionType === IamPermissionType.USER_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: IamPermissionType.USER_ACTION,
+                            targetId: 'action-shared'
+                        }),
+                        buildPermissionRow({
+                            permissionType: IamPermissionType.USER_ACTION,
+                            targetId: 'action-direct-only'
+                        })
+                    ];
+                }
+                return [];
+            });
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result).sort()).toEqual([
+                'action-direct-only',
+                'action-shared'
+            ]);
+        });
+        it('excludes expired/not-yet-valid permission rows via isValid()', async ()=>{
+            const service = buildService();
+            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.DIRECT);
+            const expired = buildPermissionRow({
+                permissionType: IamPermissionType.USER_ACTION,
+                targetId: 'action-expired',
+                validUntil: new Date('2000-01-01')
+            });
+            const active = buildPermissionRow({
+                permissionType: IamPermissionType.USER_ACTION,
+                targetId: 'action-active'
+            });
+            mockPermissionRepo.find.mockResolvedValue([
+                expired,
+                active
+            ]);
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result)).toEqual([
+                'action-active'
+            ]);
+        });
+    });
+    describe('buildAndCachePermissionData (via getMyPermissionsResponse on a cache miss)', ()=>{
+        it('splits actions into frontend/backend and caches them', async ()=>{
+            const service = buildService();
+            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.DIRECT);
+            mockPermissionRepo.find.mockResolvedValue([
+                buildPermissionRow({
+                    permissionType: IamPermissionType.USER_ACTION,
+                    targetId: 'action-1'
+                })
+            ]);
+            mockCacheManager.get.mockResolvedValue(undefined);
+            mockActionRepo.find.mockResolvedValue([
+                buildAction({
+                    id: 'action-1',
+                    actionType: ActionType.BOTH,
+                    code: 'user.view'
+                })
+            ]);
+            const result = await service.getMyPermissionsResponse('user-1', null, null);
+            expect(result.cachedEndpoints).toBe(1);
+            expect(result.frontendActions).toEqual([
+                {
+                    id: 'action-1',
+                    code: 'user.view',
+                    name: 'View Users',
+                    description: null
+                }
+            ]);
+            expect(mockCacheManager.set).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+                backendCodes: [
+                    'user.view'
+                ]
+            }), expect.any(Number));
+        });
+    });
+    describe('invalidateCompanyMembersCache', ()=>{
+        it('returns 0 without querying when the company feature is disabled', async ()=>{
+            const service = buildService();
+            const result = await service.invalidateCompanyMembersCache('company-1');
+            expect(result).toBe(0);
+            expect(mockPermissionRepo.createQueryBuilder).not.toHaveBeenCalled();
+        });
+        it('returns 0 when the company has no members with permissions', async ()=>{
+            const service = buildService();
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRawMany(mockPermissionRepo, []);
+            const result = await service.invalidateCompanyMembersCache('company-1');
+            expect(result).toBe(0);
+        });
+        it('invalidates every distinct member user id for the company', async ()=>{
+            const service = buildService();
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRawMany(mockPermissionRepo, [
+                {
+                    userId: 'user-1'
+                },
+                {
+                    userId: 'user-2'
+                }
+            ]);
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.invalidateCompanyMembersCache('company-1');
+            expect(result).toBe(2);
+        });
+        it('wipes every tracked cache entry per member instead of only branches with an existing permission row', async ()=>{
+            // Company-wide action changes are merged into every branch a member queries, including
+            // branches where the member holds no explicit permission row — so invalidation must not
+            // be narrowed to whatever branch_ids happen to already exist in the permission table.
+            const service = buildService();
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRawMany(mockPermissionRepo, [
+                {
+                    userId: 'user-1'
+                }
+            ]);
+            const trackedKeysKey = 'permission-tracked-keys:user:user-1:company:company-1';
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) {
+                    return [
+                        'cached-key-branch-untracked-by-any-permission-row'
+                    ];
+                }
+                return undefined;
+            });
+            const result = await service.invalidateCompanyMembersCache('company-1');
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain('cached-key-branch-untracked-by-any-permission-row');
+            expect(deletedKeys).toContain(trackedKeysKey);
+            expect(result).toBe(1);
+        });
+    });
+    describe('invalidateRoleMembersCache', ()=>{
+        it('returns 0 when the role has no members', async ()=>{
+            const service = buildService();
+            mockPermissionRepo.find.mockResolvedValue([]);
+            const result = await service.invalidateRoleMembersCache('role-1');
+            expect(result).toBe(0);
+            expect(mockRoleRepo.findOne).not.toHaveBeenCalled();
+        });
+        it('invalidates every distinct user holding the role, scoped to the role company', async ()=>{
+            const service = buildService();
+            mockPermissionRepo.find.mockResolvedValue([
+                buildPermissionRow({
+                    sourceId: 'user-9'
+                }),
+                buildPermissionRow({
+                    id: 'perm-2',
+                    sourceId: 'user-9'
+                })
+            ]);
+            mockRoleRepo.findOne.mockResolvedValue({
+                id: 'role-1',
+                companyId: null
+            });
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.invalidateRoleMembersCache('role-1');
+            expect(mockRoleRepo.findOne).toHaveBeenCalledWith({
+                where: {
+                    id: 'role-1'
+                }
+            });
+            expect(result).toBe(1);
+        });
+        it('wipes every tracked cache entry for role members instead of only branches with an existing permission row', async ()=>{
+            // Role actions are merged into every branch a member queries, including branches
+            // where the member holds no explicit permission row — so invalidation must not be
+            // narrowed to whatever branch_ids happen to already exist in the permission table.
+            const service = buildService();
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([
+                buildPermissionRow({
+                    sourceId: 'user-9'
+                })
+            ]);
+            mockRoleRepo.findOne.mockResolvedValue({
+                id: 'role-1',
+                companyId: 'company-1'
+            });
+            const trackedKeysKey = 'permission-tracked-keys:user:user-9:company:company-1';
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) {
+                    return [
+                        'cached-key-branch-untracked-by-any-permission-row'
+                    ];
+                }
+                return undefined;
+            });
+            const result = await service.invalidateRoleMembersCache('role-1');
+            expect(mockPermissionRepo.createQueryBuilder).not.toHaveBeenCalled();
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain('cached-key-branch-untracked-by-any-permission-row');
+            expect(deletedKeys).toContain(trackedKeysKey);
+            expect(result).toBe(1);
+        });
+    });
 });