@open-mercato/core 0.4.5-develop-2e9903a57a → 0.4.5-develop-eeccf7adf4

package/src/modules/auth/commands/__tests__/roles.custom-fields.test.ts

@@ -1,126 +0,0 @@
-jest.mock('#generated/entities.ids.generated', () => ({
-  E: {
-    auth: {
-      user: 'auth:user',
-      role: 'auth:role',
-    },
-    directory: {
-      organization: 'directory:organization',
-    },
-  },
-}))
-
-jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: async () => ({
-    translate: (_key: string, fallback?: string) => fallback ?? _key,
-  }),
-}))
-
-import '@open-mercato/core/modules/auth/commands/roles'
-import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
-import type { Role } from '../../data/entities'
-import type { CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
-import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
-import type { EntityManager } from '@mikro-orm/postgresql'
-
-describe('auth.roles.update undo custom fields', () => {
-  it('restores custom field diff', async () => {
-    const handler = commandRegistry.get<Record<string, unknown>, unknown>('auth.roles.update') as CommandHandler
-    expect(handler).toBeDefined()
-
-    const setCustomFields = jest.fn(async (_opts: Parameters<DataEngine['setCustomFields']>[0]) => undefined) as jest.MockedFunction<DataEngine['setCustomFields']>
-    const updateOrmEntity = (async (opts: Parameters<DataEngine['updateOrmEntity']>[0]) => {
-      const entity = {
-        id: 'role-1',
-        name: 'After Role',
-        tenantId: 'tenant-1',
-        acls: [],
-        custom: { dashboard: false, scope: 'limited' },
-      } as unknown as Role
-      await (opts.apply as (current: Role) => Promise<void> | void)(entity)
-      return entity
-    }) as DataEngine['updateOrmEntity']
-
-    const pending: Parameters<DataEngine['emitOrmEntityEvent']>[0][] = []
-    const emitOrmEntityEvent: DataEngine['emitOrmEntityEvent'] = async () => undefined
-    const markOrmEntityChange: DataEngine['markOrmEntityChange'] = (entry) => {
-      if (!entry?.entity) return
-      pending.push(entry as Parameters<DataEngine['emitOrmEntityEvent']>[0])
-    }
-    const flushOrmEntityChanges: DataEngine['flushOrmEntityChanges'] = async () => {
-      while (pending.length > 0) {
-        const next = pending.shift()
-        if (next) await emitOrmEntityEvent(next)
-      }
-    }
-    const dataEngine: Pick<DataEngine, 'updateOrmEntity' | 'setCustomFields' | 'emitOrmEntityEvent' | 'markOrmEntityChange' | 'flushOrmEntityChanges'> = {
-      updateOrmEntity,
-      setCustomFields,
-      emitOrmEntityEvent,
-      markOrmEntityChange,
-      flushOrmEntityChanges,
-    }
-
-    const em = {
-      nativeDelete: async () => 0,
-      flush: async () => undefined,
-      getReference: () => ({}),
-      create: (_entity: unknown, data: unknown) => data,
-      persist: () => undefined,
-    } as unknown as EntityManager
-
-    const container = {
-      resolve: (token: string) => {
-        switch (token) {
-          case 'dataEngine':
-            return dataEngine
-          case 'em':
-            return em
-          default:
-            throw new Error(`Unexpected dependency: ${token}`)
-        }
-      },
-    }
-
-    const ctx: CommandRuntimeContext = {
-      container: container as any,
-      auth: { sub: 'actor-1', tenantId: 'tenant-1', orgId: null } as any,
-      organizationScope: null,
-      selectedOrganizationId: null,
-      organizationIds: null,
-      request: undefined as any,
-    }
-
-    const logEntry = {
-      commandPayload: {
-        undo: {
-          before: {
-            id: 'role-1',
-            name: 'Before Role',
-            tenantId: 'tenant-1',
-            acls: [],
-            custom: { dashboard: true },
-          },
-          after: {
-            id: 'role-1',
-            name: 'After Role',
-            tenantId: 'tenant-1',
-            acls: [],
-            custom: { dashboard: false, scope: 'limited' },
-          },
-        },
-      },
-    }
-
-    await handler.undo!({ input: undefined, logEntry, ctx })
-
-    expect(setCustomFields).toHaveBeenCalledWith(expect.objectContaining({
-      entityId: 'auth:role',
-      recordId: 'role-1',
-      tenantId: 'tenant-1',
-      organizationId: null,
-      values: { dashboard: true, scope: null },
-      notify: false,
-    }))
-  })
-})

package/src/modules/auth/commands/__tests__/users.custom-fields.test.ts

@@ -1,147 +0,0 @@
-jest.mock('#generated/entities.ids.generated', () => ({
-  E: {
-    auth: {
-      user: 'auth:user',
-      role: 'auth:role',
-    },
-    directory: {
-      organization: 'directory:organization',
-    },
-  },
-}))
-
-jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: async () => ({
-    translate: (_key: string, fallback?: string) => fallback ?? _key,
-  }),
-}))
-
-import '@open-mercato/core/modules/auth/commands/users'
-import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
-import type { User } from '../../data/entities'
-import type { CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
-import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
-import type { EntityManager } from '@mikro-orm/postgresql'
-
-describe('auth.users.update undo custom fields', () => {
-  it('restores custom field diff during undo', async () => {
-    const handler = commandRegistry.get<Record<string, unknown>, unknown>('auth.users.update') as CommandHandler
-    expect(handler).toBeDefined()
-
-    const setCustomFields = jest.fn(async (_opts: Parameters<DataEngine['setCustomFields']>[0]) => undefined) as jest.MockedFunction<DataEngine['setCustomFields']>
-    const updateOrmEntity = (async (opts: Parameters<DataEngine['updateOrmEntity']>[0]) => {
-      const entity = {
-        id: 'user-1',
-        email: 'after@example.com',
-        organizationId: 'org-after',
-        tenantId: 'tenant-1',
-        passwordHash: null,
-        name: 'After',
-        isConfirmed: true,
-        roles: [],
-        acls: [],
-        custom: { priority: 5, severity: 'critical' },
-      } as unknown as User
-      await (opts.apply as (current: User) => Promise<void> | void)(entity)
-      return entity
-    }) as DataEngine['updateOrmEntity']
-
-    const pending: Parameters<DataEngine['emitOrmEntityEvent']>[0][] = []
-    const emitOrmEntityEvent: DataEngine['emitOrmEntityEvent'] = async () => undefined
-    const markOrmEntityChange: DataEngine['markOrmEntityChange'] = (entry) => {
-      if (!entry?.entity) return
-      pending.push(entry as Parameters<DataEngine['emitOrmEntityEvent']>[0])
-    }
-    const flushOrmEntityChanges: DataEngine['flushOrmEntityChanges'] = async () => {
-      while (pending.length > 0) {
-        const next = pending.shift()
-        if (next) await emitOrmEntityEvent(next)
-      }
-    }
-    const dataEngine: Pick<DataEngine, 'updateOrmEntity' | 'setCustomFields' | 'emitOrmEntityEvent' | 'markOrmEntityChange' | 'flushOrmEntityChanges'> = {
-      updateOrmEntity,
-      setCustomFields,
-      emitOrmEntityEvent,
-      markOrmEntityChange,
-      flushOrmEntityChanges,
-    }
-
-    const em = {
-      find: async () => [],
-      remove: () => undefined,
-      persist: () => undefined,
-      flush: async () => undefined,
-      nativeDelete: async () => 0,
-      create: (_entity: unknown, data: unknown) => data,
-      findOne: async () => null,
-    } as unknown as EntityManager
-
-    const container = {
-      resolve: (token: string) => {
-        switch (token) {
-          case 'dataEngine':
-            return dataEngine
-          case 'em':
-            return em
-          case 'rbacService':
-            return { invalidateUserCache: jest.fn(async () => {}) }
-          case 'cache':
-            return { deleteByTags: jest.fn(async () => {}) }
-          default:
-            throw new Error(`Unexpected dependency: ${token}`)
-        }
-      },
-    }
-
-    const ctx: CommandRuntimeContext = {
-      container: container as any,
-      auth: { sub: 'actor-1', tenantId: 'tenant-1', orgId: null } as any,
-      organizationScope: null,
-      selectedOrganizationId: null,
-      organizationIds: null,
-      request: undefined as any,
-    }
-
-    const logEntry = {
-      commandPayload: {
-        undo: {
-          before: {
-            id: 'user-1',
-            email: 'before@example.com',
-            organizationId: 'org-before',
-            tenantId: 'tenant-1',
-            passwordHash: null,
-            name: 'Before',
-            isConfirmed: true,
-            roles: [],
-            acls: [],
-            custom: { priority: 3 },
-          },
-          after: {
-            id: 'user-1',
-            email: 'after@example.com',
-            organizationId: 'org-after',
-            tenantId: 'tenant-1',
-            passwordHash: null,
-            name: 'After',
-            isConfirmed: true,
-            roles: [],
-            acls: [],
-            custom: { priority: 5, severity: 'critical' },
-          },
-        },
-      },
-    }
-
-    await handler.undo!({ input: undefined, logEntry, ctx })
-
-    expect(setCustomFields).toHaveBeenCalledWith(expect.objectContaining({
-      entityId: 'auth:user',
-      recordId: 'user-1',
-      tenantId: 'tenant-1',
-      organizationId: 'org-before',
-      values: { priority: 3, severity: null },
-      notify: false,
-    }))
-  })
-})

package/src/modules/auth/lib/__tests__/rateLimitCheck.test.ts

@@ -1,224 +0,0 @@
-/** @jest-environment node */
-import { NextResponse } from 'next/server'
-import type { RateLimitConfig } from '@open-mercato/shared/lib/ratelimit/types'
-
-const mockGetCachedRateLimiterService = jest.fn()
-jest.mock('@open-mercato/core/bootstrap', () => ({
-  getCachedRateLimiterService: (...args: unknown[]) => mockGetCachedRateLimiterService(...args),
-}))
-
-const mockResolveTranslations = jest.fn()
-jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: (...args: unknown[]) => mockResolveTranslations(...args),
-}))
-
-const mockCheckRateLimit = jest.fn()
-const mockGetClientIp = jest.fn()
-jest.mock('@open-mercato/shared/lib/ratelimit/helpers', () => ({
-  checkRateLimit: (...args: unknown[]) => mockCheckRateLimit(...args),
-  getClientIp: (...args: unknown[]) => mockGetClientIp(...args),
-  RATE_LIMIT_ERROR_KEY: 'api.errors.rateLimit',
-  RATE_LIMIT_ERROR_FALLBACK: 'Too many requests. Please try again later.',
-}))
-
-const mockComputeEmailHash = jest.fn()
-jest.mock('@open-mercato/core/modules/auth/lib/emailHash', () => ({
-  computeEmailHash: (...args: unknown[]) => mockComputeEmailHash(...args),
-}))
-
-import { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
-
-const ipConfig: RateLimitConfig = { points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip' }
-const compoundConfig: RateLimitConfig = { points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login' }
-
-function makeRequest(): Request {
-  return new Request('http://localhost/api/auth/login', { method: 'POST' })
-}
-
-function makeFakeService(overrides?: Partial<{ trustProxyDepth: number; delete: jest.Mock }>) {
-  return {
-    trustProxyDepth: overrides?.trustProxyDepth ?? 1,
-    delete: overrides?.delete ?? jest.fn(),
-  }
-}
-
-beforeEach(() => {
-  jest.clearAllMocks()
-  mockResolveTranslations.mockResolvedValue({
-    translate: (_key: string, fallback?: string) => fallback ?? '',
-  })
-  mockComputeEmailHash.mockImplementation((email: string) => `hash_${email}`)
-})
-
-describe('checkAuthRateLimit', () => {
-  it('returns { error: null } when rate limiter service is null (fail-open)', async () => {
-    mockGetCachedRateLimiterService.mockReturnValue(null)
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-      compoundConfig,
-      compoundIdentifier: 'user@example.com',
-    })
-
-    expect(result.error).toBeNull()
-    expect(result.compoundKey).toBeNull()
-    expect(mockCheckRateLimit).not.toHaveBeenCalled()
-  })
-
-  it('returns { error: null } when getClientIp returns null (fail-open)', async () => {
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService())
-    mockGetClientIp.mockReturnValue(null)
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-      compoundConfig,
-      compoundIdentifier: 'user@example.com',
-    })
-
-    expect(result.error).toBeNull()
-    expect(result.compoundKey).toBeNull()
-    expect(mockCheckRateLimit).not.toHaveBeenCalled()
-  })
-
-  it('returns IP-only error when IP rate limit is exceeded', async () => {
-    const errorResponse = NextResponse.json({ error: 'Too many requests' }, { status: 429 })
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService())
-    mockGetClientIp.mockReturnValue('1.2.3.4')
-    mockCheckRateLimit.mockResolvedValue(errorResponse)
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-      compoundConfig,
-      compoundIdentifier: 'user@example.com',
-    })
-
-    expect(result.error).toBe(errorResponse)
-    expect(result.compoundKey).toBeNull()
-    expect(mockCheckRateLimit).toHaveBeenCalledTimes(1)
-    expect(mockCheckRateLimit).toHaveBeenCalledWith(
-      expect.anything(),
-      ipConfig,
-      '1.2.3.4',
-      expect.any(String),
-    )
-  })
-
-  it('returns compound error when compound rate limit is exceeded', async () => {
-    const compoundError = NextResponse.json({ error: 'Too many requests' }, { status: 429 })
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService())
-    mockGetClientIp.mockReturnValue('1.2.3.4')
-    mockCheckRateLimit
-      .mockResolvedValueOnce(null) // IP layer passes
-      .mockResolvedValueOnce(compoundError) // compound layer fails
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-      compoundConfig,
-      compoundIdentifier: 'user@example.com',
-    })
-
-    expect(result.error).toBe(compoundError)
-    expect(result.compoundKey).toBe('1.2.3.4:hash_user@example.com')
-    expect(mockCheckRateLimit).toHaveBeenCalledTimes(2)
-  })
-
-  it('returns { error: null, compoundKey } when both layers pass', async () => {
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService())
-    mockGetClientIp.mockReturnValue('10.0.0.1')
-    mockCheckRateLimit.mockResolvedValue(null)
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-      compoundConfig,
-      compoundIdentifier: 'test@acme.com',
-    })
-
-    expect(result.error).toBeNull()
-    expect(result.compoundKey).toBe('10.0.0.1:hash_test@acme.com')
-    expect(mockCheckRateLimit).toHaveBeenCalledTimes(2)
-  })
-
-  it('runs IP-only mode when no compoundConfig is provided', async () => {
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService())
-    mockGetClientIp.mockReturnValue('1.2.3.4')
-    mockCheckRateLimit.mockResolvedValue(null)
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-    })
-
-    expect(result.error).toBeNull()
-    expect(result.compoundKey).toBeNull()
-    expect(mockCheckRateLimit).toHaveBeenCalledTimes(1)
-    expect(mockComputeEmailHash).not.toHaveBeenCalled()
-  })
-
-  it('fails open when checkRateLimit throws an exception', async () => {
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService())
-    mockGetClientIp.mockReturnValue('1.2.3.4')
-    mockCheckRateLimit.mockRejectedValue(new Error('Redis connection lost'))
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-      compoundConfig,
-      compoundIdentifier: 'user@example.com',
-    })
-
-    expect(result.error).toBeNull()
-    expect(result.compoundKey).toBeNull()
-  })
-
-  it('uses computeEmailHash for the compound key, not raw email', async () => {
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService())
-    mockGetClientIp.mockReturnValue('5.5.5.5')
-    mockCheckRateLimit.mockResolvedValue(null)
-    mockComputeEmailHash.mockReturnValue('sha256abc')
-
-    const result = await checkAuthRateLimit({
-      req: makeRequest(),
-      ipConfig,
-      compoundConfig,
-      compoundIdentifier: 'sensitive@example.com',
-    })
-
-    expect(mockComputeEmailHash).toHaveBeenCalledWith('sensitive@example.com')
-    expect(result.compoundKey).toBe('5.5.5.5:sha256abc')
-    expect(mockCheckRateLimit).toHaveBeenCalledWith(
-      expect.anything(),
-      compoundConfig,
-      '5.5.5.5:sha256abc',
-      expect.any(String),
-    )
-  })
-})
-
-describe('resetAuthRateLimit', () => {
-  it('calls rateLimiterService.delete with correct args', async () => {
-    const deleteFn = jest.fn().mockResolvedValue(undefined)
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService({ delete: deleteFn }))
-
-    await resetAuthRateLimit('1.2.3.4:hash_user', compoundConfig)
-
-    expect(deleteFn).toHaveBeenCalledWith('1.2.3.4:hash_user', compoundConfig)
-  })
-
-  it('is a no-op when service is null', async () => {
-    mockGetCachedRateLimiterService.mockReturnValue(null)
-
-    await expect(resetAuthRateLimit('key', compoundConfig)).resolves.toBeUndefined()
-  })
-
-  it('swallows exceptions and never throws', async () => {
-    const deleteFn = jest.fn().mockRejectedValue(new Error('Redis down'))
-    mockGetCachedRateLimiterService.mockReturnValue(makeFakeService({ delete: deleteFn }))
-
-    await expect(resetAuthRateLimit('key', compoundConfig)).resolves.toBeUndefined()
-  })
-})

package/src/modules/auth/services/__tests__/authService.test.ts

@@ -1,32 +0,0 @@
-import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
-
-function makeEm() {
-  const calls: any[] = []
-  const em: any = {
-    persistAndFlush: jest.fn(async (e: any) => calls.push(['persistAndFlush', e])),
-    create: jest.fn((cls: any, data: any) => ({ ...data })),
-    findOne: jest.fn(async () => null),
-    nativeDelete: jest.fn(async () => undefined),
-    find: jest.fn(async () => []),
-  }
-  return { em, calls }
-}
-
-describe('AuthService', () => {
-  it('verifyPassword returns false when no hash', async () => {
-    const { em } = makeEm()
-    const svc = new AuthService(em)
-    // @ts-expect-error partial
-    const ok = await svc.verifyPassword({ passwordHash: null }, 'x')
-    expect(ok).toBe(false)
-  })
-
-  it('createSession persists and returns token', async () => {
-    const { em } = makeEm()
-    const svc = new AuthService(em)
-    // @ts-expect-error partial
-    const sess = await svc.createSession({ id: 1 }, new Date(Date.now() + 1000))
-    expect(sess.token).toBeDefined()
-    expect(em.persistAndFlush).toHaveBeenCalled()
-  })
-})