@nextage/nx-frame-be 1.0.44 → 1.0.46

package/build/common/base/__test__/audit.test.d.ts

@@ -0,0 +1,15 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * AUDIT - the library keeps `createdBy`/`createdAt`/`updatedBy`/`updatedAt` for models that *
+ * declare them, and keeps out of the way of models that do not.                             *
+ *                                                                                           *
+ * The classes below are EMPTY on purpose. Whatever is stamped has to come from the library, *
+ * so a test that passed while a model helped would prove nothing about the models that      *
+ * never do - which are precisely the ones that used to be left without an audit.            *
+ *                                                                                           *
+ * Every assertion is on the payload the hooks return, not on stored documents: the point is *
+ * what the library puts there, and mongo would only add a round trip and a way to be wrong  *
+ * about it.                                                                                 *
+ *                                                                                           *
+ *********************************************************************************************/
+export {};

package/build/common/base/__test__/audit.test.js

@@ -0,0 +1,126 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * AUDIT - the library keeps `createdBy`/`createdAt`/`updatedBy`/`updatedAt` for models that *
+ * declare them, and keeps out of the way of models that do not.                             *
+ *                                                                                           *
+ * The classes below are EMPTY on purpose. Whatever is stamped has to come from the library, *
+ * so a test that passed while a model helped would prove nothing about the models that      *
+ * never do - which are precisely the ones that used to be left without an audit.            *
+ *                                                                                           *
+ * Every assertion is on the payload the hooks return, not on stored documents: the point is *
+ * what the library puts there, and mongo would only add a round trip and a way to be wrong  *
+ * about it.                                                                                 *
+ *                                                                                           *
+ *********************************************************************************************/
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_model_1 = require("../base.model");
+const mongo_utils_1 = require("../mongo-utils");
+/** Declares all four fields, as a model wanting an audit does. */
+class Audited extends base_model_1.BaseModel {
+}
+/** Declares none of them, as a model wanting no audit does. */
+class Plain extends base_model_1.BaseModel {
+}
+/** Declares them and keeps them itself - the reason `audit: false` exists. */
+class OptedOut extends base_model_1.BaseModel {
+}
+const auditedSchema = {
+    code: { type: String, required: true },
+    createdBy: { type: String },
+    createdAt: { type: Date },
+    updatedBy: { type: String },
+    updatedAt: { type: Date }
+};
+const audited = (0, mongo_utils_1.createModel)({
+    name: 'AuditAudited',
+    modelName: 'AuditAudited',
+    collection: 'auditAudited',
+    classDef: Audited,
+    modelParams: {},
+    schema: auditedSchema
+}, true);
+const plain = (0, mongo_utils_1.createModel)({
+    name: 'AuditPlain',
+    modelName: 'AuditPlain',
+    collection: 'auditPlain',
+    classDef: Plain,
+    modelParams: {},
+    schema: { code: { type: String, required: true } }
+}, true);
+const optedOut = (0, mongo_utils_1.createModel)({
+    name: 'AuditOptedOut',
+    modelName: 'AuditOptedOut',
+    collection: 'auditOptedOut',
+    classDef: OptedOut,
+    modelParams: { audit: false },
+    schema: auditedSchema
+}, true);
+const caller = { user: { id: 'user-1' } };
+const other = { user: { id: 'user-2' } };
+const anonymous = {};
+describe('audit kept by the library', () => {
+    describe('a model that declares the fields', () => {
+        it('stamps author and moment on creation', () => __awaiter(void 0, void 0, void 0, function* () {
+            const item = yield audited.beforeCreate({ code: 'a' }, caller);
+            expect(item.createdBy).toBe('user-1');
+            expect(item.createdAt).toBeInstanceOf(Date);
+        }));
+        it('stamps author and moment on update, and never the creation ones', () => __awaiter(void 0, void 0, void 0, function* () {
+            const item = yield audited.beforeUpdate({ code: 'a' }, other);
+            expect(item.updatedBy).toBe('user-2');
+            expect(item.updatedAt).toBeInstanceOf(Date);
+            expect(item.createdBy).toBeUndefined();
+            expect(item.createdAt).toBeUndefined();
+        }));
+        // The payload is the client's, so an audit it could write would say whatever the client
+        // wanted it to say - which is the same as having none.
+        it('ignores an author named by the payload', () => __awaiter(void 0, void 0, void 0, function* () {
+            const created = yield audited.beforeCreate({ code: 'a', createdBy: 'forged' }, caller);
+            const updated = yield audited.beforeUpdate({ code: 'a', updatedBy: 'forged' }, caller);
+            expect(created.createdBy).toBe('user-1');
+            expect(updated.updatedBy).toBe('user-1');
+        }));
+        // A document is created once: an update carrying the creation fields is either noise or
+        // an attempt to rewrite history, and dropping them costs nothing either way.
+        it('drops the creation fields an update tries to carry', () => __awaiter(void 0, void 0, void 0, function* () {
+            const item = yield audited.beforeUpdate({ code: 'a', createdBy: 'forged', createdAt: new Date(0) }, caller);
+            expect(item.createdBy).toBeUndefined();
+            expect(item.createdAt).toBeUndefined();
+        }));
+        // Nothing to attribute, so nothing is attributed - rather than a document claiming an
+        // author that does not exist.
+        it('leaves the author out when there is no user, and still records the moment', () => __awaiter(void 0, void 0, void 0, function* () {
+            const item = yield audited.beforeCreate({ code: 'a' }, anonymous);
+            expect(item.createdBy).toBeUndefined();
+            expect(item.createdAt).toBeInstanceOf(Date);
+        }));
+    });
+    describe('a model that declares none of them', () => {
+        // What keeps this change safe for consumers that never asked for an audit: no field
+        // appears in a collection that did not declare it.
+        it('is left untouched', () => __awaiter(void 0, void 0, void 0, function* () {
+            const created = yield plain.beforeCreate({ code: 'a' }, caller);
+            const updated = yield plain.beforeUpdate({ code: 'a' }, caller);
+            expect(created).toEqual({ code: 'a' });
+            expect(updated).toEqual({ code: 'a' });
+        }));
+    });
+    describe('a model that opted out', () => {
+        it('is left untouched even though it declares the fields', () => __awaiter(void 0, void 0, void 0, function* () {
+            const created = yield optedOut.beforeCreate({ code: 'a' }, caller);
+            const updated = yield optedOut.beforeUpdate({ code: 'a' }, caller);
+            expect(created).toEqual({ code: 'a' });
+            expect(updated).toEqual({ code: 'a' });
+        }));
+    });
+});

package/build/common/base/__test__/before-get-contract.test.d.ts

@@ -0,0 +1,16 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * BEFOREGET CONTRACT                                                                        *
+ *                                                                                           *
+ * `beforeGet` is declared `Promise<FilterParams>`, so the filter it returns is part of the  *
+ * contract. `get` used to await it and throw the result away, handing `findOne` the object  *
+ * it had built itself - which worked only because every override in existence MUTATES its   *
+ * argument.                                                                                 *
+ *                                                                                           *
+ * That difference is invisible at compile time and silent at run time, and it is the whole  *
+ * point of this file: an override written in pure style - `return { ...filter, tenantId }`, *
+ * the shape the signature invites - compiled, passed review, and read across every tenant.  *
+ * These tests state that BOTH styles scope the read.                                        *
+ *                                                                                           *
+ *********************************************************************************************/
+export {};

package/build/common/base/__test__/before-get-contract.test.js

@@ -0,0 +1,90 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * BEFOREGET CONTRACT                                                                        *
+ *                                                                                           *
+ * `beforeGet` is declared `Promise<FilterParams>`, so the filter it returns is part of the  *
+ * contract. `get` used to await it and throw the result away, handing `findOne` the object  *
+ * it had built itself - which worked only because every override in existence MUTATES its   *
+ * argument.                                                                                 *
+ *                                                                                           *
+ * That difference is invisible at compile time and silent at run time, and it is the whole  *
+ * point of this file: an override written in pure style - `return { ...filter, tenantId }`, *
+ * the shape the signature invites - compiled, passed review, and read across every tenant.  *
+ * These tests state that BOTH styles scope the read.                                        *
+ *                                                                                           *
+ *********************************************************************************************/
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_model_1 = require("../base.model");
+const mongo_utils_1 = require("../mongo-utils");
+/** Scopes the read the way every override in the wild does today: by MUTATING the filter. */
+class MutatingModel extends base_model_1.BaseModel {
+    beforeGet() {
+        return __awaiter(this, arguments, void 0, function* (filter = {}, context = {}) {
+            filter.tenantId = context.tenantId;
+            return filter;
+        });
+    }
+}
+/** Scopes the read in pure style - the shape the `Promise<FilterParams>` signature invites. */
+class PureModel extends base_model_1.BaseModel {
+    beforeGet() {
+        return __awaiter(this, arguments, void 0, function* (filter = {}, context = {}) {
+            return Object.assign(Object.assign({}, filter), { tenantId: context.tenantId });
+        });
+    }
+}
+const schema = {
+    code: { type: String, required: true },
+    tenantId: { type: String, required: true },
+};
+const mutating = (0, mongo_utils_1.createModel)({
+    name: 'BeforeGetMutating',
+    modelName: 'BeforeGetMutating',
+    collection: 'beforeGetMutating',
+    classDef: MutatingModel,
+    modelParams: {},
+    schema
+}, true);
+const pure = (0, mongo_utils_1.createModel)({
+    name: 'BeforeGetPure',
+    modelName: 'BeforeGetPure',
+    collection: 'beforeGetPure',
+    classDef: PureModel,
+    modelParams: {},
+    schema
+}, true);
+describe('BaseModel.get honours the filter beforeGet returns', () => {
+    const owner = { tenantId: 'tenant-a' };
+    const outsider = { tenantId: 'tenant-b' };
+    let mutatingId;
+    let pureId;
+    // Inserted per test: the shared setup empties every collection before each one.
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        const a = yield mutating.mgModel.collection.insertOne({ code: 'A', tenantId: owner.tenantId });
+        const b = yield pure.mgModel.collection.insertOne({ code: 'B', tenantId: owner.tenantId });
+        mutatingId = a.insertedId.toString();
+        pureId = b.insertedId.toString();
+    }));
+    it('denies a foreign read when the override MUTATES the filter', () => __awaiter(void 0, void 0, void 0, function* () {
+        expect(yield mutating.get(mutatingId, outsider)).toBeNull();
+    }));
+    // The one that used to pass in silence: the filter handed to `findOne` was the untouched
+    // `{ _id }`, so another tenant's document came back in full.
+    it('denies a foreign read when the override RETURNS a new filter', () => __awaiter(void 0, void 0, void 0, function* () {
+        expect(yield pure.get(pureId, outsider)).toBeNull();
+    }));
+    it('still finds the document for its own tenant, in both styles', () => __awaiter(void 0, void 0, void 0, function* () {
+        expect(yield mutating.get(mutatingId, owner)).not.toBeNull();
+        expect(yield pure.get(pureId, owner)).not.toBeNull();
+    }));
+});

package/build/common/base/__test__/tenancy-opt-out.test.d.ts

@@ -0,0 +1,21 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * TENANT SCOPING IS OPT-OUT                                                                 *
+ *                                                                                           *
+ * These tests state the behaviour of a model that overrides NOTHING. That is the whole      *
+ * point: every leak this file guards against was born the same way - a class that declared  *
+ * a tenant field and forgot one of the hooks that isolate it, silently answering every      *
+ * tenant from then on.                                                                      *
+ *                                                                                           *
+ * So none of the models below has a body. What they have is a schema with a tenant field    *
+ * and, where it matters, a declared mode - and the isolation has to follow from that        *
+ * alone.                                                                                    *
+ *                                                                                           *
+ * Two properties are asserted together, and they pull in opposite directions on purpose:    *
+ *                                                                                           *
+ *   1. WITH a provider registered, an unaware model is scoped anyway.                       *
+ *   2. WITHOUT one, nothing changes at all - the library is used by consumers that have no  *
+ *      notion of a tenant, and for them this file must be a no-op.                          *
+ *                                                                                           *
+ *********************************************************************************************/
+export {};

package/build/common/base/__test__/tenancy-opt-out.test.js

@@ -0,0 +1,214 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * TENANT SCOPING IS OPT-OUT                                                                 *
+ *                                                                                           *
+ * These tests state the behaviour of a model that overrides NOTHING. That is the whole      *
+ * point: every leak this file guards against was born the same way - a class that declared  *
+ * a tenant field and forgot one of the hooks that isolate it, silently answering every      *
+ * tenant from then on.                                                                      *
+ *                                                                                           *
+ * So none of the models below has a body. What they have is a schema with a tenant field    *
+ * and, where it matters, a declared mode - and the isolation has to follow from that        *
+ * alone.                                                                                    *
+ *                                                                                           *
+ * Two properties are asserted together, and they pull in opposite directions on purpose:    *
+ *                                                                                           *
+ *   1. WITH a provider registered, an unaware model is scoped anyway.                       *
+ *   2. WITHOUT one, nothing changes at all - the library is used by consumers that have no  *
+ *      notion of a tenant, and for them this file must be a no-op.                          *
+ *                                                                                           *
+ *********************************************************************************************/
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const constants_1 = require("../../constants");
+const base_model_1 = require("../base.model");
+const mongo_utils_1 = require("../mongo-utils");
+const enums_1 = require("../../enums");
+/** Marks a document every tenant shares, as an application would mark it. */
+const SHARED = '__GLOBAL__';
+/**
+ * A provider written the way an application would write one: it knows the roles, the
+ * library does not. `systemTier` stands in for the role group entitled to the shared tier.
+ */
+const provider = {
+    field: 'tenantId',
+    read(mode, context) {
+        const tenant = context.tenantId;
+        return (mode === enums_1.TenancyMode.shared) ? { $in: [tenant, SHARED] } : tenant;
+    },
+    write(mode, requested, context) {
+        const ctx = context;
+        if (mode === enums_1.TenancyMode.shared && requested === SHARED) {
+            if (!ctx.systemTier)
+                throw new Error('denied');
+            return SHARED;
+        }
+        return ctx.tenantId;
+    },
+    canWrite(mode, current, context) {
+        const ctx = context;
+        if (current === SHARED)
+            return !!ctx.systemTier;
+        return current === ctx.tenantId;
+    }
+};
+const schema = {
+    code: { type: String, required: true },
+    tenantId: { type: String, required: true }
+};
+/** No body: whatever isolates it has to come from the library. */
+class Unaware extends base_model_1.BaseModel {
+}
+/** Same, in a collection that mixes the shared tier with each tenant's own additions. */
+class Mixed extends base_model_1.BaseModel {
+}
+/** Same, exempted on purpose - as a collection written by event listeners must be. */
+class Exempt extends base_model_1.BaseModel {
+}
+const unaware = (0, mongo_utils_1.createModel)({
+    name: 'TenancyUnaware',
+    modelName: 'TenancyUnaware',
+    collection: 'tenancyUnaware',
+    classDef: Unaware,
+    modelParams: {},
+    schema
+}, true);
+const mixed = (0, mongo_utils_1.createModel)({
+    name: 'TenancyMixed',
+    modelName: 'TenancyMixed',
+    collection: 'tenancyMixed',
+    classDef: Mixed,
+    modelParams: { tenancy: enums_1.TenancyMode.shared },
+    schema
+}, true);
+const exempt = (0, mongo_utils_1.createModel)({
+    name: 'TenancyExempt',
+    modelName: 'TenancyExempt',
+    collection: 'tenancyExempt',
+    classDef: Exempt,
+    modelParams: { tenancy: enums_1.TenancyMode.none },
+    schema
+}, true);
+const owner = { user: { id: 'u1' }, tenantId: 'tenant-a' };
+const outsider = { user: { id: 'u2' }, tenantId: 'tenant-b' };
+const system = { user: { id: 'u3' }, tenantId: 'tenant-a', systemTier: true };
+describe('a model that overrides nothing is scoped anyway', () => {
+    beforeEach(() => { constants_1.APP.tenancy = provider; });
+    afterEach(() => { delete constants_1.APP.tenancy; });
+    it('stamps the owner on create, ignoring what the payload asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield unaware.create({ code: 'A', tenantId: 'tenant-b' }, owner);
+        expect(doc.tenantId).toBe('tenant-a');
+    }));
+    it('does not resolve another tenant document by id', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield unaware.create({ code: 'A' }, owner);
+        expect(yield unaware.get(doc.id, outsider)).toBeNull();
+        expect(yield unaware.get(doc.id, owner)).not.toBeNull();
+    }));
+    it('keeps another tenant out of list, count and findOne', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield unaware.create({ code: 'A' }, owner);
+        expect(yield unaware.list({}, {}, {}, outsider)).toHaveLength(0);
+        expect(yield unaware.count({}, outsider)).toBe(0);
+        expect(yield unaware.findOne({ code: 'A' }, outsider)).toBeNull();
+        expect(yield unaware.list({}, {}, {}, owner)).toHaveLength(1);
+    }));
+    it('refuses to delete another tenant document', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield unaware.create({ code: 'A' }, owner);
+        yield expect(unaware.remove(doc.id, outsider)).rejects.toBeDefined();
+        expect(yield unaware.mgModel.collection.countDocuments({})).toBe(1);
+    }));
+    it('refuses to update another tenant document', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield unaware.create({ code: 'A' }, owner);
+        yield expect(unaware.update(doc.id, { code: 'B' }, outsider)).rejects.toBeDefined();
+    }));
+    it('will not let an update re-home a document into another tenant', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield unaware.create({ code: 'A' }, owner);
+        const updated = yield unaware.update(doc.id, { code: 'B', tenantId: 'tenant-b' }, owner);
+        expect(updated.tenantId).toBe('tenant-a');
+    }));
+});
+describe('a shared collection reads across tiers and writes within one', () => {
+    beforeEach(() => { constants_1.APP.tenancy = provider; });
+    afterEach(() => { delete constants_1.APP.tenancy; });
+    it('shows a tenant both the shared documents and its own', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield mixed.create({ code: 'SYS', tenantId: SHARED }, system);
+        yield mixed.create({ code: 'OWN' }, owner);
+        const seen = yield mixed.list({}, {}, {}, owner);
+        expect(seen.map(d => d.code).sort()).toEqual(['OWN', 'SYS']);
+    }));
+    it('hides another tenant additions while still showing the shared ones', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield mixed.mgModel.collection.insertOne({ code: 'SYS', tenantId: SHARED });
+        yield mixed.create({ code: 'OWN' }, owner);
+        const seen = yield mixed.list({}, {}, {}, outsider);
+        expect(seen.map(d => d.code)).toEqual(['SYS']);
+    }));
+    it('lets the system tier create a shared document', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield mixed.create({ code: 'SYS', tenantId: SHARED }, system);
+        expect(doc.tenantId).toBe(SHARED);
+    }));
+    it('refuses a shared document to a tenant caller, rather than quietly downgrading it', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield expect(mixed.create({ code: 'SYS', tenantId: SHARED }, owner)).rejects.toBeDefined();
+    }));
+    // The one a filter alone cannot express: the shared document IS readable by this caller,
+    // so scoping the read is not enough to stop the write.
+    it('refuses a tenant caller the update and the removal of a shared document', () => __awaiter(void 0, void 0, void 0, function* () {
+        const inserted = yield mixed.mgModel.collection.insertOne({ code: 'SYS', tenantId: SHARED });
+        const id = inserted.insertedId.toString();
+        yield expect(mixed.update(id, { code: 'HACKED' }, owner)).rejects.toBeDefined();
+        yield expect(mixed.remove(id, owner)).rejects.toBeDefined();
+    }));
+    it('lets the system tier update a shared document', () => __awaiter(void 0, void 0, void 0, function* () {
+        const inserted = yield mixed.mgModel.collection.insertOne({ code: 'SYS', tenantId: SHARED });
+        const updated = yield mixed.update(inserted.insertedId.toString(), { code: 'FIXED' }, system);
+        expect(updated.code).toBe('FIXED');
+    }));
+});
+describe('subscription payloads are scoped too', () => {
+    beforeEach(() => { constants_1.APP.tenancy = provider; });
+    afterEach(() => { delete constants_1.APP.tenancy; });
+    // T58: both hooks defaulted to "any authenticated user", and nothing in the project
+    // overrode them - so an event carried a document to every subscriber on the channel.
+    it('withholds another tenant document from a subscriber', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = { code: 'A', tenantId: 'tenant-a' };
+        expect(yield unaware.checkContextPermission(doc, owner)).not.toBeNull();
+        expect(yield unaware.checkContextPermission(doc, outsider)).toBeNull();
+    }));
+    it('delivers a shared document to every tenant, and a private one to its owner alone', () => __awaiter(void 0, void 0, void 0, function* () {
+        expect(yield mixed.checkContextPermission({ code: 'S', tenantId: SHARED }, outsider)).not.toBeNull();
+        expect(yield mixed.checkContextPermission({ code: 'P', tenantId: 'tenant-a' }, outsider)).toBeNull();
+    }));
+    it('turns away a channel subscriber from another tenant', () => __awaiter(void 0, void 0, void 0, function* () {
+        expect(yield unaware.checkChannelSubscriber({ tenantId: 'tenant-a' }, owner)).toBe(true);
+        expect(yield unaware.checkChannelSubscriber({ tenantId: 'tenant-a' }, outsider)).toBe(false);
+    }));
+});
+describe('an exempt model is left alone', () => {
+    beforeEach(() => { constants_1.APP.tenancy = provider; });
+    afterEach(() => { delete constants_1.APP.tenancy; });
+    // Written by event listeners, which run with no user in context: scoping them
+    // automatically would break the very cascade they exist to perform.
+    it('neither stamps nor filters', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield exempt.create({ code: 'A', tenantId: 'tenant-b' }, owner);
+        expect(yield exempt.list({}, {}, {}, outsider)).toHaveLength(1);
+        expect(yield exempt.list({}, {}, {}, {})).toHaveLength(1);
+    }));
+});
+describe('with no provider registered nothing is scoped at all', () => {
+    // The library is used by projects that have no notion of a tenant. For them every
+    // assertion above must NOT hold, or upgrading would silently empty their queries.
+    it('behaves as it did before tenancy existed', () => __awaiter(void 0, void 0, void 0, function* () {
+        expect(constants_1.APP.tenancy).toBeUndefined();
+        const doc = yield unaware.create({ code: 'A', tenantId: 'tenant-b' }, owner);
+        expect(doc.tenantId).toBe('tenant-b');
+        expect(yield unaware.list({}, {}, {}, outsider)).toHaveLength(1);
+        expect(yield unaware.get(doc.id, outsider)).not.toBeNull();
+    }));
+});

package/build/common/base/audit.d.ts

@@ -0,0 +1,55 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * AUDIT - who created a document and when, who last changed it and when.                    *
+ *                                                                                           *
+ * Written by `BaseModel` rather than by every model, for the same reason tenancy is: a      *
+ * rule each author has to remember is a rule that gets forgotten, and forgetting this one   *
+ * is SILENT - the document is simply stored without a trace of who made it.                 *
+ *                                                                                           *
+ * That is not hypothetical. Before this existed, some sixty assignments were spread over    *
+ * twenty-one models in four spellings of the same line, two of them commented out, and one  *
+ * model wrote fields its schema never declared - so mongoose dropped them and the audit it  *
+ * appeared to keep was never kept at all.                                                   *
+ *                                                                                           *
+ * ONLY WHAT THE SCHEMA DECLARES                                                             *
+ *                                                                                           *
+ * A field is stamped only if the model's schema has it. That keeps the change INERT for     *
+ * every consumer that never asked for an audit - nothing appears in collections that did    *
+ * not declare it - which is the same property that made tenancy safe to invert. Wanting     *
+ * the audit is therefore an act: declare the field.                                         *
+ *                                                                                           *
+ * WHY NOT MONGOOSE `timestamps: true`                                                       *
+ *                                                                                           *
+ * Because it knows the WHEN and cannot know the WHO. `createdBy` needs the request context, *
+ * which mongoose has no access to, so the timestamps would come from the schema and the     *
+ * actors from here - two mechanisms, in two places, that drift apart the moment a write     *
+ * goes through only one of them. `updateArrayItem` and `addArrayItem` are exactly that      *
+ * write: they call `findOneAndUpdate` directly, so mongoose would refresh `updatedAt`       *
+ * while `updatedBy` kept naming whoever wrote last through `update()`. An audit that names  *
+ * the wrong author is worse than one that names nobody, because it is believed.             *
+ *                                                                                           *
+ *********************************************************************************************/
+import { NxContext, NxObject } from '../interfaces';
+/** The four fields this module knows how to keep, and the only ones it ever touches. */
+export declare const AUDIT_FIELDS: {
+    createdBy: string;
+    createdAt: string;
+    updatedBy: string;
+    updatedAt: string;
+};
+/**
+ * Stamps the audit fields a schema declares, and leaves every other field alone.
+ *
+ * On UPDATE the creation fields are dropped from the payload instead of being checked: a
+ * document is created once, so an update carrying `createdBy` is either noise or an attempt
+ * to rewrite history, and neither is worth honouring. Same reasoning as the tenant field.
+ *
+ * The user is read from the context and never from the payload - a client naming its own
+ * author would make the whole record worthless.
+ *
+ * @param item     the payload, mutated in place
+ * @param schema   the model's schema definition, used to know which fields exist
+ * @param context  the request context
+ * @param creating whether this is a creation or an update
+ */
+export declare function stampAudit(item: NxObject | undefined, schema: NxObject | undefined, context: NxContext | undefined, creating: boolean): void;

package/build/common/base/audit.js

@@ -0,0 +1,77 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * AUDIT - who created a document and when, who last changed it and when.                    *
+ *                                                                                           *
+ * Written by `BaseModel` rather than by every model, for the same reason tenancy is: a      *
+ * rule each author has to remember is a rule that gets forgotten, and forgetting this one   *
+ * is SILENT - the document is simply stored without a trace of who made it.                 *
+ *                                                                                           *
+ * That is not hypothetical. Before this existed, some sixty assignments were spread over    *
+ * twenty-one models in four spellings of the same line, two of them commented out, and one  *
+ * model wrote fields its schema never declared - so mongoose dropped them and the audit it  *
+ * appeared to keep was never kept at all.                                                   *
+ *                                                                                           *
+ * ONLY WHAT THE SCHEMA DECLARES                                                             *
+ *                                                                                           *
+ * A field is stamped only if the model's schema has it. That keeps the change INERT for     *
+ * every consumer that never asked for an audit - nothing appears in collections that did    *
+ * not declare it - which is the same property that made tenancy safe to invert. Wanting     *
+ * the audit is therefore an act: declare the field.                                         *
+ *                                                                                           *
+ * WHY NOT MONGOOSE `timestamps: true`                                                       *
+ *                                                                                           *
+ * Because it knows the WHEN and cannot know the WHO. `createdBy` needs the request context, *
+ * which mongoose has no access to, so the timestamps would come from the schema and the     *
+ * actors from here - two mechanisms, in two places, that drift apart the moment a write     *
+ * goes through only one of them. `updateArrayItem` and `addArrayItem` are exactly that      *
+ * write: they call `findOneAndUpdate` directly, so mongoose would refresh `updatedAt`       *
+ * while `updatedBy` kept naming whoever wrote last through `update()`. An audit that names  *
+ * the wrong author is worse than one that names nobody, because it is believed.             *
+ *                                                                                           *
+ *********************************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUDIT_FIELDS = void 0;
+exports.stampAudit = stampAudit;
+/** The four fields this module knows how to keep, and the only ones it ever touches. */
+exports.AUDIT_FIELDS = {
+    createdBy: 'createdBy',
+    createdAt: 'createdAt',
+    updatedBy: 'updatedBy',
+    updatedAt: 'updatedAt'
+};
+/**
+ * Stamps the audit fields a schema declares, and leaves every other field alone.
+ *
+ * On UPDATE the creation fields are dropped from the payload instead of being checked: a
+ * document is created once, so an update carrying `createdBy` is either noise or an attempt
+ * to rewrite history, and neither is worth honouring. Same reasoning as the tenant field.
+ *
+ * The user is read from the context and never from the payload - a client naming its own
+ * author would make the whole record worthless.
+ *
+ * @param item     the payload, mutated in place
+ * @param schema   the model's schema definition, used to know which fields exist
+ * @param context  the request context
+ * @param creating whether this is a creation or an update
+ */
+function stampAudit(item, schema, context, creating) {
+    var _a;
+    if (!item || !schema)
+        return;
+    const userId = (_a = context === null || context === void 0 ? void 0 : context.user) === null || _a === void 0 ? void 0 : _a.id;
+    const now = new Date();
+    if (creating) {
+        if (exports.AUDIT_FIELDS.createdAt in schema)
+            item[exports.AUDIT_FIELDS.createdAt] = now;
+        if (userId && exports.AUDIT_FIELDS.createdBy in schema)
+            item[exports.AUDIT_FIELDS.createdBy] = userId;
+        return;
+    }
+    delete item[exports.AUDIT_FIELDS.createdBy];
+    delete item[exports.AUDIT_FIELDS.createdAt];
+    if (exports.AUDIT_FIELDS.updatedAt in schema)
+        item[exports.AUDIT_FIELDS.updatedAt] = now;
+    if (userId && exports.AUDIT_FIELDS.updatedBy in schema)
+        item[exports.AUDIT_FIELDS.updatedBy] = userId;
+}