@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.10

package/dist/identity/testing/stub-host.js

@@ -0,0 +1,91 @@
+"use strict";
+// =============================================================================
+// In-memory host ports for booting the identity slice in a test (issue #727)
+// =============================================================================
+//
+// `createStubIdentityHost()` returns a `@Global()` module that binds every
+// identity host port (and core's `PLATFORM_PRISMA`, to the client you pass) to
+// a recording in-memory stand-in, plus the state those stand-ins record, so a
+// test boots `IdentityModule.forRoot({ imports: [host.module] })` with no app.
+// Never use it in production code.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStubIdentityHost = createStubIdentityHost;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../core/index");
+const ports_1 = require("../ports");
+/**
+ * A global module binding identity's host ports to recording stand-ins.
+ *
+ * @param options - the database client and the optional overrides.
+ * @returns the module to pass in `IdentityModule.forRoot({ imports })`, and what it records.
+ *
+ * @example
+ * ```ts
+ * const host = createStubIdentityHost({ prisma: prismaMock });
+ * await Test.createTestingModule({
+ *   imports: [ConfigModule.forRoot({ isGlobal: true, load: [() => identityConfiguration()] }),
+ *             IdentityModule.forRoot({ imports: [host.module] })],
+ * }).compile();
+ * ```
+ *
+ * @stability experimental
+ */
+function createStubIdentityHost(options) {
+    const state = { notifications: [], handlers: [], enqueued: [], metrics: [] };
+    const record = (method) => async (to, notice) => {
+        state.notifications.push({ method, to, notice });
+    };
+    const notifier = {
+        roleChanged: record('roleChanged'),
+        userWelcomed: record('userWelcomed'),
+        allowlistInvitation: record('allowlistInvitation'),
+        orgInvitation: record('orgInvitation'),
+    };
+    const userDefaults = { userSettings: () => structuredClone(options.userSettings ?? {}) };
+    const profileImages = {
+        resolveImageUrl: (user) => user.providerProfileImageUrl ?? null,
+        hasUploadedImage: () => false,
+    };
+    const jobs = {
+        enqueueHousekeepingJob: async ({ type }) => {
+            state.enqueued.push(type);
+        },
+        registerHandler: (handler) => {
+            state.handlers.push(handler);
+        },
+    };
+    const metrics = {
+        authLogin: (outcome) => state.metrics.push(`authLogin:${outcome}`),
+        authRefresh: (outcome) => state.metrics.push(`authRefresh:${outcome}`),
+        add: (key) => state.metrics.push(key),
+    };
+    const nodes = { validateToken: options.validateNodeToken ?? (async () => null) };
+    const providers = [
+        { provide: index_1.PLATFORM_PRISMA, useValue: options.prisma },
+        { provide: ports_1.IDENTITY_NOTIFIER, useValue: notifier },
+        { provide: ports_1.USER_DEFAULTS, useValue: userDefaults },
+        { provide: ports_1.IDENTITY_PROFILE_IMAGES, useValue: profileImages },
+        { provide: ports_1.IDENTITY_JOBS, useValue: jobs },
+        { provide: ports_1.IDENTITY_METRICS, useValue: metrics },
+        { provide: ports_1.IDENTITY_NODE_CREDENTIALS, useValue: nodes },
+        ...(options.authCredentials ? [{ provide: ports_1.IDENTITY_AUTH_CREDENTIALS, useValue: options.authCredentials }] : []),
+    ];
+    let StubIdentityHostModule = class StubIdentityHostModule {
+    };
+    StubIdentityHostModule = __decorate([
+        (0, common_1.Global)(),
+        (0, common_1.Module)({})
+    ], StubIdentityHostModule);
+    return {
+        module: { module: StubIdentityHostModule, global: true, providers, exports: providers.map((provider) => provider.provide) },
+        state,
+    };
+}
+//# sourceMappingURL=stub-host.js.map

package/dist/identity/testing/stub-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub-host.js","sourceRoot":"","sources":["../../../src/identity/testing/stub-host.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,mCAAmC;AACnC,gFAAgF;;;;;;;;AAmGhF,wDAkDC;AAnJD,2CAAiF;AAEjF,4CAAmD;AAEnD,oCAgBkB;AA4DlB;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,MAAM,KAAK,GAA0B,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpG,MAAM,MAAM,GAAG,CAAC,MAA8B,EAAE,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,MAAe,EAAE,EAAE;QACvF,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,QAAQ,GAAqB;QACjC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;QAClC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC;QACpC,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC;KACvC,CAAC;IACF,MAAM,YAAY,GAAiB,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IACvG,MAAM,aAAa,GAA0B;QAC3C,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,IAAI,IAAI;QAC/D,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK;KAC9B,CAAC;IACF,MAAM,IAAI,GAAqB;QAC7B,sBAAsB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAkD,EAAE,EAAE;YACzF,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE;YAC3B,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;IACF,MAAM,OAAO,GAAoB;QAC/B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,EAAE,CAAC;QAClE,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC;QACtE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;KACtC,CAAC;IACF,MAAM,KAAK,GAA4B,EAAE,aAAa,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAE1G,MAAM,SAAS,GAAG;QAChB,EAAE,OAAO,EAAE,uBAAe,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE;QACtD,EAAE,OAAO,EAAE,yBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAClD,EAAE,OAAO,EAAE,qBAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;QAClD,EAAE,OAAO,EAAE,+BAAuB,EAAE,QAAQ,EAAE,aAAa,EAAE;QAC7D,EAAE,OAAO,EAAE,qBAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1C,EAAE,OAAO,EAAE,wBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE;QAChD,EAAE,OAAO,EAAE,iCAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvD,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAyB,EAAE,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChH,CAAC;IAIF,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;KAAG,CAAA;IAAzB,sBAAsB;QAF3B,IAAA,eAAM,GAAE;QACR,IAAA,eAAM,EAAC,EAAE,CAAC;OACL,sBAAsB,CAAG;IAE/B,OAAO;QACL,MAAM,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;QAC3H,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/identity/testing/test-auth.controller.d.ts

@@ -0,0 +1,25 @@
+import { ConfigService } from '@nestjs/config';
+import type { CookieReply as FastifyReply } from '../auth/cookie-http';
+import { TestAuthService } from './test-auth.service';
+import { TestLoginDto } from './dto/test-login.dto';
+/**
+ * REACHABLE DURING A MAINTENANCE WINDOW (#257).
+ *
+ * This module is only registered when `NODE_ENV !== 'production'`, so the
+ * exemption cannot widen a production deployment's surface at all. Where it IS
+ * registered it is how automated tests obtain a token, and a suite that could
+ * not authenticate would be unable to test any of the behaviour a window is
+ * supposed to have — including whether the window itself works.
+ */
+export declare class TestAuthController {
+    private readonly testAuthService;
+    private readonly configService;
+    private readonly logger;
+    constructor(testAuthService: TestAuthService, configService: ConfigService);
+    /**
+     * POST /auth/test/login
+     * Test authentication endpoint - bypasses OAuth for E2E testing
+     */
+    testLogin(dto: TestLoginDto, res: FastifyReply): Promise<void>;
+}
+//# sourceMappingURL=test-auth.controller.d.ts.map

package/dist/identity/testing/test-auth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-auth.controller.d.ts","sourceRoot":"","sources":["../../../src/identity/testing/test-auth.controller.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,KAAK,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAgBpD;;;;;;;;GAQG;AACH,qBAGa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAG3C,eAAe,EAAE,eAAe,EAChC,aAAa,EAAE,aAAa;IAG/C;;;OAGG;IAmBG,SAAS,CACL,GAAG,EAAE,YAAY,EAClB,GAAG,EAAE,YAAY,GACvB,OAAO,CAAC,IAAI,CAAC;CA8BjB"}

package/dist/identity/testing/test-auth.controller.js

@@ -0,0 +1,114 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var TestAuthController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TestAuthController = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const swagger_1 = require("@nestjs/swagger");
+const public_decorator_1 = require("../auth/decorators/public.decorator");
+const test_environment_guard_1 = require("./guards/test-environment.guard");
+const test_auth_service_1 = require("./test-auth.service");
+const test_login_dto_1 = require("./dto/test-login.dto");
+const index_1 = require("../../core/index");
+const auth_error_codes_1 = require("../auth/auth-error-codes");
+const REFRESH_TOKEN_COOKIE = 'refresh_token';
+const COOKIE_OPTIONS = {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/api/auth',
+    maxAge: 14 * 24 * 60 * 60, // 14 days in seconds
+};
+/**
+ * REACHABLE DURING A MAINTENANCE WINDOW (#257).
+ *
+ * This module is only registered when `NODE_ENV !== 'production'`, so the
+ * exemption cannot widen a production deployment's surface at all. Where it IS
+ * registered it is how automated tests obtain a token, and a suite that could
+ * not authenticate would be unable to test any of the behaviour a window is
+ * supposed to have — including whether the window itself works.
+ */
+let TestAuthController = TestAuthController_1 = class TestAuthController {
+    testAuthService;
+    configService;
+    logger = new common_1.Logger(TestAuthController_1.name);
+    constructor(testAuthService, configService) {
+        this.testAuthService = testAuthService;
+        this.configService = configService;
+    }
+    /**
+     * POST /auth/test/login
+     * Test authentication endpoint - bypasses OAuth for E2E testing
+     */
+    async testLogin(dto, res) {
+        this.logger.log(`Test login request for: ${dto.email}`);
+        let result;
+        try {
+            result = await this.testAuthService.loginAsTestUser(dto);
+        }
+        catch (error) {
+            // A policy refusal (PP-6.2, #722: `no_organization` in multi-org mode)
+            // lands where a Google sign-in's does, `/auth/callback?error=<code>`, so
+            // an e2e suite sees the real sign-in error page.
+            if (error instanceof auth_error_codes_1.AuthLoginDeniedException) {
+                return res
+                    .status(302)
+                    .redirect((0, auth_error_codes_1.buildAuthErrorRedirectUrl)(this.configService.get('appUrl'), error.reason));
+            }
+            throw error;
+        }
+        // Set refresh token in HttpOnly cookie
+        res.setCookie(REFRESH_TOKEN_COOKIE, result.refreshToken, COOKIE_OPTIONS);
+        // Redirect to frontend with access token
+        const appUrl = this.configService.get('appUrl');
+        const redirectUrl = new URL('/auth/callback', appUrl);
+        redirectUrl.searchParams.set('token', result.accessToken);
+        redirectUrl.searchParams.set('expiresIn', result.expiresIn.toString());
+        this.logger.log(`Test login successful, redirecting to: ${redirectUrl.toString()}`);
+        return res.status(302).redirect(redirectUrl.toString());
+    }
+};
+exports.TestAuthController = TestAuthController;
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Post)('login'),
+    (0, common_1.UseGuards)(test_environment_guard_1.TestEnvironmentGuard),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Test login (non-production only)',
+        description: 'Authenticate as any user for testing purposes. Only available in non-production environments.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 302,
+        description: 'Redirects to /auth/callback with an access token, or to /auth/callback?error=<code> when the ' +
+            'login is refused by policy (no_organization in multi-org tenancy mode)',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 403,
+        description: 'Forbidden - only available in non-production environments',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [test_login_dto_1.TestLoginDto, Object]),
+    __metadata("design:returntype", Promise)
+], TestAuthController.prototype, "testLogin", null);
+exports.TestAuthController = TestAuthController = TestAuthController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Test Authentication'),
+    (0, common_1.Controller)('auth/test'),
+    (0, index_1.AllowDuringMaintenance)(),
+    __metadata("design:paramtypes", [test_auth_service_1.TestAuthService,
+        config_1.ConfigService])
+], TestAuthController);
+//# sourceMappingURL=test-auth.controller.js.map

package/dist/identity/testing/test-auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-auth.controller.js","sourceRoot":"","sources":["../../../src/identity/testing/test-auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,2CAA+C;AAC/C,6CAAqE;AAErE,0EAA6D;AAC7D,4EAAuE;AACvE,2DAAsD;AACtD,yDAAoD;AACpD,4CAA0D;AAC1D,+DAGkC;AAElC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAC7C,MAAM,cAAc,GAAG;IACrB,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;IAC7C,QAAQ,EAAE,KAAc;IACxB,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,qBAAqB;CACjD,CAAC;AAEF;;;;;;;;GAQG;AAII,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAIV;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAE9D,YACmB,eAAgC,EAChC,aAA4B;QAD5B,oBAAe,GAAf,eAAe,CAAiB;QAChC,kBAAa,GAAb,aAAa,CAAe;IAC5C,CAAC;IAEJ;;;OAGG;IAmBG,AAAN,KAAK,CAAC,SAAS,CACL,GAAiB,EAClB,GAAiB;QAExB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAExD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,yEAAyE;YACzE,iDAAiD;YACjD,IAAI,KAAK,YAAY,2CAAwB,EAAE,CAAC;gBAC9C,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,QAAQ,CAAC,IAAA,4CAAyB,EAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,QAAQ,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,uCAAuC;QACvC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAEzE,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,QAAQ,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACtD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1D,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,0CAA0C,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF,CAAA;AA/DY,gDAAkB;AA8BvB;IAlBL,IAAA,yBAAM,GAAE;IACR,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,kBAAS,EAAC,6CAAoB,CAAC;IAC/B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,+FAA+F;KAClG,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EACT,+FAA+F;YAC/F,wEAAwE;KAC3E,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2DAA2D;KACzE,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,6BAAY;;mDA+B1B;6BA9DU,kBAAkB;IAH9B,IAAA,iBAAO,EAAC,qBAAqB,CAAC;IAC9B,IAAA,mBAAU,EAAC,WAAW,CAAC;IACvB,IAAA,8BAAsB,GAAE;qCAKa,mCAAe;QACjB,sBAAa;GALpC,kBAAkB,CA+D9B"}

package/dist/identity/testing/test-auth.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The test-only login (`POST /api/auth/test/login`), for e2e suites. Mount it with `IdentityModule.forRoot({ enableTestAuth })`, which refuses it in production.
+ *
+ * @stability experimental
+ */
+export declare class TestAuthModule {
+}
+//# sourceMappingURL=test-auth.module.d.ts.map

package/dist/identity/testing/test-auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-auth.module.d.ts","sourceRoot":"","sources":["../../../src/identity/testing/test-auth.module.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,qBAuBa,cAAc;CAAG"}

package/dist/identity/testing/test-auth.module.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TestAuthModule = void 0;
+const principal_cache_module_1 = require("../auth/principal-cache/principal-cache.module");
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const config_1 = require("@nestjs/config");
+const organizations_module_1 = require("../organizations/organizations.module");
+const test_auth_controller_1 = require("./test-auth.controller");
+const test_auth_service_1 = require("./test-auth.service");
+const identity_configuration_1 = require("../identity.configuration");
+/**
+ * The test-only login (`POST /api/auth/test/login`), for e2e suites. Mount it with `IdentityModule.forRoot({ enableTestAuth })`, which refuses it in production.
+ *
+ * @stability experimental
+ */
+let TestAuthModule = class TestAuthModule {
+};
+exports.TestAuthModule = TestAuthModule;
+exports.TestAuthModule = TestAuthModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            // PP-1.12 (#683): the role swap invalidates principals.
+            principal_cache_module_1.PrincipalCacheModule,
+            // JWT configuration (reuse from AuthModule)
+            jwt_1.JwtModule.registerAsync({
+                imports: [config_1.ConfigModule],
+                inject: [config_1.ConfigService],
+                useFactory: (config) => ({
+                    secret: (0, identity_configuration_1.requireJwtSecret)(config),
+                    signOptions: {
+                        expiresIn: `${config.get('jwt.accessTtlMinutes', 15)}m`,
+                    },
+                }),
+            }),
+            config_1.ConfigModule,
+            // PP-6.1 (#721): a new test user joins the default org.
+            organizations_module_1.OrganizationsModule,
+        ],
+        controllers: [test_auth_controller_1.TestAuthController],
+        providers: [test_auth_service_1.TestAuthService],
+        exports: [test_auth_service_1.TestAuthService],
+    })
+], TestAuthModule);
+//# sourceMappingURL=test-auth.module.js.map

package/dist/identity/testing/test-auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-auth.module.js","sourceRoot":"","sources":["../../../src/identity/testing/test-auth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2FAAsF;AACtF,2CAAwC;AACxC,qCAAwC;AACxC,2CAA6D;AAC7D,gFAA4E;AAC5E,iEAA4D;AAC5D,2DAAsD;AACtD,sEAA6D;AAE7D;;;;GAIG;AAwBI,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IAvB1B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,wDAAwD;YACxD,6CAAoB;YACpB,4CAA4C;YAC5C,eAAS,CAAC,aAAa,CAAC;gBACtB,OAAO,EAAE,CAAC,qBAAY,CAAC;gBACvB,MAAM,EAAE,CAAC,sBAAa,CAAC;gBACvB,UAAU,EAAE,CAAC,MAAqB,EAAE,EAAE,CAAC,CAAC;oBACtC,MAAM,EAAE,IAAA,yCAAgB,EAAC,MAAM,CAAC;oBAChC,WAAW,EAAE;wBACX,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAS,sBAAsB,EAAE,EAAE,CAAC,GAAG;qBAChE;iBACF,CAAC;aACH,CAAC;YACF,qBAAY;YACZ,wDAAwD;YACxD,0CAAmB;SACpB;QACD,WAAW,EAAE,CAAC,yCAAkB,CAAC;QACjC,SAAS,EAAE,CAAC,mCAAe,CAAC;QAC5B,OAAO,EAAE,CAAC,mCAAe,CAAC;KAC3B,CAAC;GACW,cAAc,CAAG"}

package/dist/identity/testing/test-auth.service.d.ts

@@ -0,0 +1,64 @@
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { type ResolvedIdentityModuleOptions } from '../identity.options';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import type { IdentityPrisma } from '../ports';
+import { TestLoginDto } from './dto/test-login.dto';
+import { type UserDefaults } from '../ports';
+import { PrincipalCache } from '../auth/principal-cache/principal-cache.service';
+import { OrganizationsService } from '../organizations/organizations.service';
+import { TenancyService } from '../organizations/tenancy.service';
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+export interface TestAuthTokenResponse {
+    accessToken: string;
+    expiresIn: number;
+    refreshToken: string;
+    user: {
+        id: string;
+        email: string;
+        displayName: string | null;
+        roles: string[];
+    };
+}
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+export declare class TestAuthService {
+    private readonly prisma;
+    private readonly jwtService;
+    private readonly configService;
+    private readonly principalCache;
+    private readonly organizations;
+    private readonly tenancy;
+    private readonly userDefaults;
+    private readonly identityOptions;
+    private readonly events?;
+    private readonly logger;
+    constructor(prisma: IdentityPrisma, jwtService: JwtService, configService: ConfigService, principalCache: PrincipalCache, organizations: OrganizationsService, tenancy: TenancyService, userDefaults: UserDefaults, identityOptions?: ResolvedIdentityModuleOptions, events?: EventEmitter2 | undefined);
+    /**
+     * Login as test user - bypass OAuth and allowlist for testing
+     *
+     * The `role` maps onto the split RBAC (PP-6.3, #723) the way
+     * `PUT /api/users/:id/roles` does in single-org mode: `admin` is the system
+     * `admin` role plus `org_admin` on the default-org membership;
+     * `contributor` and `viewer` are that membership's role with no system role.
+     */
+    loginAsTestUser(dto: TestLoginDto): Promise<TestAuthTokenResponse>;
+    /** Same rule as `AuthService.isInitialAdminEmail`. */
+    private isInitialAdminEmail;
+    /**
+     * Create a new refresh token (copied from AuthService)
+     */
+    private createRefreshToken;
+    /**
+     * Hash token for storage
+     */
+    private hashToken;
+}
+//# sourceMappingURL=test-auth.service.d.ts.map

package/dist/identity/testing/test-auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-auth.service.d.ts","sourceRoot":"","sources":["../../../src/identity/testing/test-auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAA8C,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAErH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAI/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AASlE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,qBACa,eAAe;IAIC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAED,OAAO,CAAC,QAAQ,CAAC,YAAY;IAEpD,OAAO,CAAC,QAAQ,CAAC,eAAe;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAhBtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAGf,MAAM,EAAE,cAAc,EAC/C,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EAE5B,cAAc,EAAE,cAAc,EAE9B,aAAa,EAAE,oBAAoB,EAEnC,OAAO,EAAE,cAAc,EAEA,YAAY,EAAE,YAAY,EAEjD,eAAe,GAAE,6BAAwD,EAC7D,MAAM,CAAC,EAAE,aAAa,YAAA;IAGrD;;;;;;;OAOG;IACG,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuLxE,sDAAsD;IACtD,OAAO,CAAC,mBAAmB;IAK3B;;OAEG;YACW,kBAAkB;IA2BhC;;OAEG;IACH,OAAO,CAAC,SAAS;CAGlB"}

package/dist/identity/testing/test-auth.service.js

@@ -0,0 +1,262 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var TestAuthService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TestAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const identity_options_1 = require("../identity.options");
+const identity_events_1 = require("../identity.events");
+const jwt_1 = require("@nestjs/jwt");
+const config_1 = require("@nestjs/config");
+const node_crypto_1 = require("node:crypto");
+const index_1 = require("../../core/index");
+const ports_1 = require("../ports");
+const principal_cache_service_1 = require("../auth/principal-cache/principal-cache.service");
+const organizations_service_1 = require("../organizations/organizations.service");
+const tenancy_service_1 = require("../organizations/tenancy.service");
+const auth_error_codes_1 = require("../auth/auth-error-codes");
+const identity_constants_1 = require("../identity.constants");
+const principal_factory_1 = require("../auth/principal.factory");
+const role_catalog_1 = require("../roles/role-catalog");
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+let TestAuthService = TestAuthService_1 = class TestAuthService {
+    prisma;
+    jwtService;
+    configService;
+    principalCache;
+    organizations;
+    tenancy;
+    userDefaults;
+    identityOptions;
+    events;
+    logger = new common_1.Logger(TestAuthService_1.name);
+    constructor(prisma, jwtService, configService, 
+    // PP-1.12 (#683): the role swap below must reach the next request.
+    principalCache, 
+    // PP-6.1 (#721): a new test user joins the default organization.
+    organizations, 
+    // PP-6.2 (#722): the same tenancy rules as a Google sign-in.
+    tenancy, userDefaults, identityOptions = identity_options_1.DEFAULT_IDENTITY_OPTIONS, events) {
+        this.prisma = prisma;
+        this.jwtService = jwtService;
+        this.configService = configService;
+        this.principalCache = principalCache;
+        this.organizations = organizations;
+        this.tenancy = tenancy;
+        this.userDefaults = userDefaults;
+        this.identityOptions = identityOptions;
+        this.events = events;
+    }
+    /**
+     * Login as test user - bypass OAuth and allowlist for testing
+     *
+     * The `role` maps onto the split RBAC (PP-6.3, #723) the way
+     * `PUT /api/users/:id/roles` does in single-org mode: `admin` is the system
+     * `admin` role plus `org_admin` on the default-org membership;
+     * `contributor` and `viewer` are that membership's role with no system role.
+     */
+    async loginAsTestUser(dto) {
+        this.logger.log(`Test login for email: ${dto.email} with role: ${dto.role}`);
+        const email = dto.email.toLowerCase();
+        const isInitialAdmin = this.isInitialAdminEmail(email);
+        let userWasCreated = false;
+        const roleName = dto.role || this.identityOptions.defaultOrgRole;
+        // Any role the application registered, of either scope (PP-14.15): a system
+        // role is held in `user_roles` (`admin` also makes the default-org
+        // membership `org_admin`; another system role keeps the default org role),
+        // an org role is the default-org membership's role.
+        const known = (0, role_catalog_1.listRoles)().find((role) => role.id === roleName);
+        if (!known) {
+            // A 400, like every refused role: the shape was valid, nothing registered it.
+            throw (0, role_catalog_1.roleNotAssignable)(roleName);
+        }
+        const isSystemRole = known.scope === 'system';
+        const membershipRoleName = roleName === identity_constants_1.ROLES.ADMIN ? identity_constants_1.ORG_ADMIN_ROLE : isSystemRole ? this.identityOptions.defaultOrgRole : roleName;
+        // Resolve the roles first: a missing row is a seed problem.
+        const membershipRole = await this.prisma.role.findUnique({
+            where: { name: membershipRoleName },
+        });
+        const systemRole = isSystemRole
+            ? await this.prisma.role.findUnique({ where: { name: roleName } })
+            : null;
+        if (!membershipRole || (isSystemRole && !systemRole)) {
+            throw new Error(`Role ${dto.role} not found`);
+        }
+        // Find or create user
+        let user = await this.prisma.user.findUnique({
+            where: { email },
+            select: { id: true },
+        });
+        if (!user) {
+            // Create new user
+            const displayName = dto.displayName || email.split('@')[0];
+            // Same shape as `AuthService.createNewUser`: the user and its default
+            // org membership are created in one transaction (PP-6.1, #721), when the
+            // tenancy mode auto-joins this user (PP-6.2, #722): everyone in single
+            // mode, only the initial admin in multi.
+            const defaultOrg = this.tenancy.autoJoinsDefaultOrg(isInitialAdmin)
+                ? await this.organizations.getDefaultOrg()
+                : null;
+            user = await this.prisma.$transaction(async (tx) => {
+                const created = await tx.user.create({
+                    data: {
+                        email,
+                        displayName,
+                        isActive: true,
+                        // Create default user settings
+                        userSettings: {
+                            create: {
+                                value: this.userDefaults.userSettings(),
+                            },
+                        },
+                    },
+                });
+                if (defaultOrg) {
+                    await this.organizations.ensureMembership(tx, defaultOrg.id, created.id, membershipRole.id);
+                }
+                return created;
+            });
+            userWasCreated = true;
+            this.logger.log(`Created test user: ${email}`);
+            (0, identity_events_1.emitIdentityEvent)(this.events, this.logger, identity_events_1.IDENTITY_EVENTS.USER_CREATED, {
+                userId: user.id,
+                email,
+                source: 'test-auth',
+                orgId: defaultOrg?.id ?? null,
+            });
+        }
+        const userId = user.id;
+        // Tenancy mode (PP-6.2, #722), exactly as `AuthService` applies it to a
+        // Google sign-in: test login bypasses OAuth and the allowlist, never the
+        // organization rules, so an e2e suite in multi mode sees the real refusal.
+        // Before the role swap below, so a refused login changes nothing.
+        if (!userWasCreated && this.tenancy.autoJoinsDefaultOrg(isInitialAdmin)) {
+            await this.organizations.ensureDefaultOrgMembership(userId, membershipRoleName);
+        }
+        if (this.tenancy.capabilities.requireActiveMembership &&
+            (await this.organizations.countActiveMemberships(userId)) === 0) {
+            this.logger.warn(`Test login denied - user ${userId} has no active organization membership (tenancy mode multi)`);
+            throw new auth_error_codes_1.AuthLoginDeniedException('no_organization', 'Your account is not a member of any organization. Ask an organization administrator to invite you.');
+        }
+        // Replace the system roles and set the default-org membership's role, so
+        // the same email can be logged in under a different role back to back. A
+        // user with no default-org membership (multi mode) keeps its memberships.
+        await this.prisma.$transaction(async (tx) => {
+            await tx.userRole.deleteMany({ where: { userId } });
+            if (systemRole) {
+                await tx.userRole.create({ data: { userId, roleId: systemRole.id } });
+            }
+            await tx.membership.updateMany({
+                where: { userId, org: { isDefault: true } },
+                data: { roleId: membershipRole.id },
+            });
+        });
+        // Principal cache (PP-1.12, #683): after the transaction committed. E2E
+        // suites log the same email in under different roles back to back.
+        this.principalCache.invalidate({ userId });
+        // Reload user with updated roles
+        const reloaded = await this.prisma.user.findUnique({
+            where: { id: userId },
+            include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+        });
+        if (!reloaded) {
+            throw new Error('Failed to reload user after role assignment');
+        }
+        // The active organization (#724), by the same rule as a Google sign-in:
+        // single mode, the default org's membership; multi mode, the most
+        // recently used active membership.
+        const orgId = await this.organizations.signInOrgId(reloaded, this.tenancy.mode());
+        if (!orgId) {
+            throw new auth_error_codes_1.AuthLoginDeniedException('no_organization', 'Your account is not a member of any organization. Ask an organization administrator to invite you.');
+        }
+        // System roles plus the current org role (`admin` + `org_admin` for an admin).
+        const roles = principal_factory_1.principalFactory.access({ ...reloaded, activeOrgId: orgId }).roles;
+        const payload = {
+            sub: reloaded.id,
+            email: reloaded.email,
+            roles,
+            org: orgId,
+        };
+        const accessTtlMinutes = this.configService.get('jwt.accessTtlMinutes', 15);
+        const accessToken = this.jwtService.sign(payload);
+        // Create refresh token, bound to the same organization
+        const refreshToken = await this.createRefreshToken(reloaded.id, orgId);
+        await this.organizations.touchMembership(orgId, reloaded.id);
+        this.logger.log(`Test login successful for user: ${reloaded.email} with roles: ${roles.join(', ')}`);
+        return {
+            accessToken,
+            expiresIn: accessTtlMinutes * 60, // Convert to seconds
+            refreshToken,
+            user: {
+                id: reloaded.id,
+                email: reloaded.email,
+                displayName: reloaded.displayName,
+                roles,
+            },
+        };
+    }
+    /** Same rule as `AuthService.isInitialAdminEmail`. */
+    isInitialAdminEmail(email) {
+        const initialAdminEmail = this.configService.get(this.identityOptions.initialAdminEmailEnv);
+        return initialAdminEmail ? email === initialAdminEmail.toLowerCase() : false;
+    }
+    /**
+     * Create a new refresh token (copied from AuthService)
+     */
+    async createRefreshToken(userId, orgId) {
+        const refreshTtlDays = this.configService.get('jwt.refreshTtlDays', 14);
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + refreshTtlDays);
+        // Generate random token
+        const token = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        const tokenHash = this.hashToken(token);
+        // Store hashed token in database
+        await this.prisma.refreshToken.create({
+            data: {
+                userId,
+                tokenHash,
+                expiresAt,
+                orgId,
+            },
+        });
+        this.logger.debug(`Created refresh token for user: ${userId}`);
+        return token;
+    }
+    /**
+     * Hash token for storage
+     */
+    hashToken(token) {
+        return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+};
+exports.TestAuthService = TestAuthService;
+exports.TestAuthService = TestAuthService = TestAuthService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(6, (0, common_1.Inject)(ports_1.USER_DEFAULTS)),
+    __param(7, (0, common_1.Optional)()),
+    __param(7, (0, common_1.Inject)(identity_options_1.IDENTITY_OPTIONS)),
+    __param(8, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [Object, jwt_1.JwtService,
+        config_1.ConfigService,
+        principal_cache_service_1.PrincipalCache,
+        organizations_service_1.OrganizationsService,
+        tenancy_service_1.TenancyService, Object, Object, event_emitter_1.EventEmitter2])
+], TestAuthService);
+//# sourceMappingURL=test-auth.service.js.map