@ftisindia/create-app 0.1.3 → 0.1.5

package/template/test/auth-refresh.spec.ts

@@ -0,0 +1,90 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { AuthService } from '../src/modules/auth/application/services/auth.service';
+
+describe('AuthService.refresh', () => {
+  it('commits refresh-token family revocation when a concurrent replay loses the claim', async () => {
+    const existingToken = {
+      id: 'old-token-id',
+      userId: 'user-id',
+      revokedAt: null,
+      replacedByTokenId: null,
+      expiresAt: new Date(Date.now() + 60_000),
+      user: {
+        id: 'user-id',
+        email: 'owner@example.com',
+        mobile: null,
+        displayName: null,
+        isActive: true,
+      },
+    };
+    const tx = {
+      refreshToken: {
+        updateMany: jest
+          .fn()
+          .mockResolvedValueOnce({ count: 0 })
+          .mockResolvedValueOnce({ count: 2 }),
+        findUnique: jest
+          .fn()
+          .mockResolvedValueOnce({ replacedByTokenId: 'next-token-id' })
+          .mockResolvedValueOnce({ replacedByTokenId: 'next-token-id' })
+          .mockResolvedValueOnce({ replacedByTokenId: null }),
+      },
+      auditLog: {
+        create: jest.fn().mockResolvedValue({}),
+      },
+    };
+    const prisma = {
+      refreshToken: {
+        findUnique: jest.fn().mockResolvedValue(existingToken),
+      },
+      $transaction: jest.fn((callback: (txClient: typeof tx) => unknown) =>
+        Promise.resolve(callback(tx)),
+      ),
+    };
+    const tokenService = {
+      hashRefreshToken: jest.fn().mockReturnValue('refresh-token-hash'),
+      createRefreshToken: jest.fn(),
+      signAccessToken: jest.fn(),
+      getAccessTokenTtlSeconds: jest.fn(),
+    };
+    const requestContext = {
+      getIpAddress: jest.fn(),
+      getUserAgent: jest.fn(),
+    };
+
+    const service = new AuthService(
+      {} as never,
+      {} as never,
+      prisma as never,
+      requestContext as never,
+      tokenService as never,
+    );
+
+    await expect(
+      service.refresh({ refreshToken: 'stale-refresh-token-value' }),
+    ).rejects.toBeInstanceOf(UnauthorizedException);
+
+    expect(tx.refreshToken.updateMany).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        where: {
+          id: {
+            in: ['old-token-id', 'next-token-id'],
+          },
+        },
+        data: {
+          revokedAt: expect.any(Date),
+        },
+      }),
+    );
+    expect(tx.auditLog.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          action: 'auth.refresh.reuse_detected',
+          targetId: 'old-token-id',
+        }),
+      }),
+    );
+    expect(tokenService.createRefreshToken).not.toHaveBeenCalled();
+  });
+});

package/template/test/frontend-bootstrap.spec.ts

@@ -0,0 +1,181 @@
+import { MembershipStatus, OrganisationStatus } from '@prisma/client';
+import { validate, parseCorsOrigins } from '../src/config/env.validation';
+import { CurrentAccessControlController } from '../src/modules/access-control/presentation/current-access-control.controller';
+import { OrganisationsService } from '../src/modules/organisations/application/services/organisations.service';
+
+describe('frontend bootstrap endpoints', () => {
+  it('returns the current effective access-control context without internal cache fields', async () => {
+    const controller = new CurrentAccessControlController({
+      getContext: jest.fn().mockResolvedValue({
+        cacheKey: 'rbac:user-1:org-1',
+        userId: 'user-1',
+        orgId: 'org-1',
+        membershipId: 'membership-1',
+        membershipStatus: MembershipStatus.ACTIVE,
+        roleId: 'role-1',
+        isOwner: false,
+        isBillingContact: true,
+        permissionKeys: ['organisations.read'],
+      }),
+    } as never);
+
+    await expect(
+      controller.me(
+        {
+          id: 'user-1',
+          email: 'user@example.com',
+          mobile: null,
+          displayName: 'User',
+          isActive: true,
+        },
+        'org-1',
+      ),
+    ).resolves.toEqual({
+      orgId: 'org-1',
+      membershipId: 'membership-1',
+      roleId: 'role-1',
+      isOwner: false,
+      isBillingContact: true,
+      permissionKeys: ['organisations.read'],
+    });
+  });
+
+  it('queries only active current-user memberships in active organisations', async () => {
+    const prisma = {
+      membership: {
+        findMany: jest.fn().mockResolvedValue([
+          {
+            id: 'membership-1',
+            roleId: 'role-1',
+            isOwner: true,
+            isBillingContact: true,
+            organisation: {
+              id: 'org-1',
+              name: 'Acme Operations',
+              slug: 'acme',
+              status: OrganisationStatus.ACTIVE,
+            },
+            role: {
+              id: 'role-1',
+              name: 'Owner',
+              description: null,
+              isSystemSeeded: true,
+            },
+          },
+          {
+            id: 'membership-2',
+            roleId: 'role-2',
+            isOwner: false,
+            isBillingContact: false,
+            organisation: {
+              id: 'org-2',
+              name: 'Beta Operations',
+              slug: 'beta',
+              status: OrganisationStatus.ACTIVE,
+            },
+            role: {
+              id: 'role-2',
+              name: 'Viewer',
+              description: null,
+              isSystemSeeded: true,
+            },
+          },
+        ]),
+      },
+    };
+    const service = new OrganisationsService({} as never, prisma as never, {} as never);
+
+    await expect(
+      service.listMine(
+        {
+          id: 'user-1',
+          email: 'user@example.com',
+          mobile: null,
+          displayName: 'User',
+          isActive: true,
+        },
+        { limit: 1 },
+      ),
+    ).resolves.toEqual({
+      items: [
+        {
+          id: 'org-1',
+          name: 'Acme Operations',
+          slug: 'acme',
+          status: OrganisationStatus.ACTIVE,
+          membershipId: 'membership-1',
+          roleId: 'role-1',
+          role: {
+            id: 'role-1',
+            name: 'Owner',
+            description: null,
+            isSystemSeeded: true,
+          },
+          isOwner: true,
+          isBillingContact: true,
+        },
+      ],
+      nextCursor: 'membership-1',
+    });
+
+    expect(prisma.membership.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: {
+          userId: 'user-1',
+          status: MembershipStatus.ACTIVE,
+          organisation: {
+            status: OrganisationStatus.ACTIVE,
+          },
+        },
+        take: 2,
+      }),
+    );
+  });
+});
+
+describe('CORS environment config', () => {
+  it('is disabled by default', () => {
+    const env = validate(baseEnv());
+
+    expect(env.CORS_ENABLED).toBe(false);
+    expect(env.CORS_ORIGINS).toBe('');
+    expect(env.CORS_CREDENTIALS).toBe(false);
+  });
+
+  it('accepts enabled CORS with exact allowed origins', () => {
+    const env = validate({
+      ...baseEnv(),
+      CORS_ENABLED: 'true',
+      CORS_ORIGINS: 'http://localhost:5173, https://app.example.com',
+      CORS_CREDENTIALS: 'true',
+    });
+
+    expect(env.CORS_ENABLED).toBe(true);
+    expect(env.CORS_CREDENTIALS).toBe(true);
+    expect(parseCorsOrigins(env.CORS_ORIGINS)).toEqual([
+      'http://localhost:5173',
+      'https://app.example.com',
+    ]);
+  });
+
+  it('rejects wildcard origins when credentials are enabled', () => {
+    expect(() =>
+      validate({
+        ...baseEnv(),
+        CORS_ENABLED: 'true',
+        CORS_ORIGINS: '*',
+        CORS_CREDENTIALS: 'true',
+      }),
+    ).toThrow(/CORS_ORIGINS cannot include \*/u);
+  });
+});
+
+function baseEnv() {
+  return {
+    NODE_ENV: 'test',
+    PORT: '3000',
+    DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/app_test',
+    JWT_SECRET: 'test-jwt-secret-at-least-32-characters',
+    AUTH_GOOGLE_ENABLED: 'false',
+  };
+}

package/template/test/role-permission-policy.spec.ts

@@ -0,0 +1,94 @@
+import { ForbiddenException } from '@nestjs/common';
+import {
+  assertPermissionChangeWithinActor,
+  assertRoleWithinActorPermissions,
+} from '../src/modules/access-control/application/role-permission-policy';
+
+describe('assertRoleWithinActorPermissions', () => {
+  it('allows owners to assign any role', () => {
+    expect(() =>
+      assertRoleWithinActorPermissions({
+        actorIsOwner: true,
+        actorPermissionKeys: [],
+        rolePermissionKeys: ['billing.manage', 'roles.manage'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('allows a role whose permissions are a subset of the actor', () => {
+    expect(() =>
+      assertRoleWithinActorPermissions({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read', 'users.update', 'roles.manage'],
+        rolePermissionKeys: ['users.read', 'users.update'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('rejects a role carrying a permission the actor does not hold', () => {
+    expect(() =>
+      assertRoleWithinActorPermissions({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read'],
+        rolePermissionKeys: ['users.read', 'billing.manage'],
+      }),
+    ).toThrow(/billing\.manage/u);
+  });
+});
+
+describe('assertPermissionChangeWithinActor', () => {
+  it('allows owners to make any change', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: true,
+        actorPermissionKeys: [],
+        previousPermissionKeys: ['users.read'],
+        nextPermissionKeys: ['users.read', 'billing.manage'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('allows adding and removing permissions the actor holds', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read', 'users.update'],
+        previousPermissionKeys: ['users.read'],
+        nextPermissionKeys: ['users.update'],
+      }),
+    ).not.toThrow();
+  });
+
+  it('rejects adding a permission the actor does not hold', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read'],
+        previousPermissionKeys: ['users.read'],
+        nextPermissionKeys: ['users.read', 'billing.manage'],
+      }),
+    ).toThrow(/billing\.manage/u);
+  });
+
+  it('rejects revoking a permission the actor does not hold', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: ['users.read'],
+        previousPermissionKeys: ['users.read', 'billing.manage'],
+        nextPermissionKeys: ['users.read'],
+      }),
+    ).toThrow(ForbiddenException);
+  });
+
+  it('allows an unchanged set even when it contains permissions the actor lacks', () => {
+    expect(() =>
+      assertPermissionChangeWithinActor({
+        actorIsOwner: false,
+        actorPermissionKeys: [],
+        previousPermissionKeys: ['billing.manage'],
+        nextPermissionKeys: ['billing.manage'],
+      }),
+    ).not.toThrow();
+  });
+});

package/template/test/route-registry.validator.spec.ts

@@ -1,9 +1,11 @@
 import { Controller, Get } from '@nestjs/common';
 import { MetadataScanner, Reflector } from '@nestjs/core';
 import { AccessControlController } from '../src/modules/access-control/presentation/access-control.controller';
+import { CurrentAccessControlController } from '../src/modules/access-control/presentation/current-access-control.controller';
 import { RequirePermissions } from '../src/modules/access-control/presentation/permissions.decorator';
 import { RouteRegistryValidator } from '../src/modules/access-control/application/route-registry.validator';
 import { PermissionKey } from '../src/modules/access-control/types/permission-key';
+import { routePermissionRegistry } from '../src/modules/access-control/types/route-permission-registry';
 import { AuditController } from '../src/modules/audit/presentation/audit.controller';
 import { AuthController } from '../src/modules/auth/presentation/auth.controller';
 import { InvitationsController } from '../src/modules/invitations/presentation/invitations.controller';
@@ -14,6 +16,7 @@ import { SettingsController } from '../src/modules/settings/presentation/setting
 
 const controllers = [
   AccessControlController,
+  CurrentAccessControlController,
   AuditController,
   AuthController,
   InvitationsController,
@@ -28,6 +31,15 @@ describe('RouteRegistryValidator', () => {
     expect(() => createValidator(controllers).onApplicationBootstrap()).not.toThrow();
   });
 
+  it('does not register the current access-control bootstrap route as permission-gated', () => {
+    expect(routePermissionRegistry).not.toContainEqual(
+      expect.objectContaining({
+        method: 'GET',
+        path: '/organisations/:orgId/access-control/me',
+      }),
+    );
+  });
+
   it('fails when a permission-gated route is missing from the registry', () => {
     class DriftController {
       probe() {

package/template/test/security.e2e-spec.ts

@@ -72,7 +72,101 @@ describe('Security invariants (e2e)', () => {
       .expect(403);
   });
 
+  it('requires authentication for frontend bootstrap endpoints', async () => {
+    const { orgId } = await createUserAndOrg('bootstrap-auth');
+
+    await request(app.getHttpServer()).get('/organisations/mine').expect(401);
+    await request(app.getHttpServer()).get(`/organisations/${orgId}/access-control/me`).expect(401);
+  });
+
+  it('lists only active current-user organisations with cursor pagination shape', async () => {
+    const first = await createUserAndOrg('mine-active');
+    const second = await createOrganisation(first.accessToken, 'mine-suspended');
+
+    await prisma.membership.update({
+      where: { id: second.membershipId },
+      data: { status: MembershipStatus.SUSPENDED },
+    });
+
+    const response = await request(app.getHttpServer())
+      .get('/organisations/mine')
+      .set('Authorization', `Bearer ${first.accessToken}`)
+      .expect(200);
+
+    expect(response.body).toEqual({
+      items: [
+        expect.objectContaining({
+          id: first.orgId,
+          membershipId: first.membershipId,
+          roleId: expect.any(String),
+          role: expect.objectContaining({ name: 'Owner' }),
+          isOwner: true,
+          isBillingContact: true,
+        }),
+      ],
+      nextCursor: null,
+    });
+  });
+
+  it('returns effective access-control context for an active member without roles.read', async () => {
+    const owner = await createUserAndOrg('access-me-owner');
+    const member = await createMemberInOrg(owner.orgId, 'access-me-member');
+
+    const response = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/access-control/me`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .expect(200);
+
+    expect(response.body).toEqual({
+      orgId: owner.orgId,
+      membershipId: member.membershipId,
+      roleId: member.roleId,
+      isOwner: false,
+      isBillingContact: false,
+      permissionKeys: [],
+    });
+  });
+
+  it('denies access-control context to non-members', async () => {
+    const first = await createUserAndOrg('access-me-a');
+    const second = await createUserAndOrg('access-me-b');
+
+    await request(app.getHttpServer())
+      .get(`/organisations/${second.orgId}/access-control/me`)
+      .set('Authorization', `Bearer ${first.accessToken}`)
+      .expect(403);
+  });
+
+  it.each([MembershipStatus.SUSPENDED, MembershipStatus.REVOKED])(
+    'denies access-control context for %s memberships',
+    async (status) => {
+      const owner = await createUserAndOrg(`access-me-${status.toLowerCase()}`);
+      const member = await createMemberInOrg(owner.orgId, `member-${status.toLowerCase()}`);
+
+      await prisma.membership.update({
+        where: { id: member.membershipId },
+        data: { status },
+      });
+
+      await request(app.getHttpServer())
+        .get(`/organisations/${owner.orgId}/access-control/me`)
+        .set('Authorization', `Bearer ${member.accessToken}`)
+        .expect(403);
+    },
+  );
+
   async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const org = await createOrganisation(user.accessToken, label);
+
+    return {
+      ...user,
+      orgId: org.orgId,
+      membershipId: org.membershipId,
+    };
+  }
+
+  async function createUser(label: string) {
     const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const signup = await request(app.getHttpServer())
       .post('/auth/signup')
@@ -83,7 +177,14 @@ describe('Security invariants (e2e)', () => {
       })
       .expect(201);
 
-    const accessToken = signup.body.accessToken as string;
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createOrganisation(accessToken: string, label: string) {
+    const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const org = await request(app.getHttpServer())
       .post('/organisations')
       .set('Authorization', `Bearer ${accessToken}`)
@@ -94,9 +195,40 @@ describe('Security invariants (e2e)', () => {
       .expect(201);
 
     return {
-      accessToken,
       orgId: org.body.organisation.id as string,
       membershipId: org.body.membership.id as string,
     };
   }
+
+  async function createMemberInOrg(orgId: string, label: string) {
+    const user = await createUser(label);
+    const role = await prisma.role.findUniqueOrThrow({
+      where: {
+        orgId_name: {
+          orgId,
+          name: 'Viewer',
+        },
+      },
+      select: {
+        id: true,
+      },
+    });
+    const membership = await prisma.membership.create({
+      data: {
+        userId: user.userId,
+        orgId,
+        roleId: role.id,
+      },
+      select: {
+        id: true,
+        roleId: true,
+      },
+    });
+
+    return {
+      ...user,
+      membershipId: membership.id,
+      roleId: membership.roleId,
+    };
+  }
 });