@proteinjs/user-server 1.5.4 → 1.6.0

package/dist/test/UpdateUserInfoSessionRefresh.test.js

@@ -0,0 +1,94 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var UpdateUserInfo_1 = require("../src/services/UpdateUserInfo");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/**
+ * The rename-staleness wart, red-before-green: UpdateUserInfo.updateName wrote the DB but never
+ * refreshed the server session cache (userCache serializes the user into session data), so every
+ * read through UserRepo in the same request context — and any long-lived context that keeps its
+ * session data, e.g. socket sessions — kept serving the OLD name until re-login. The fix routes
+ * every user-info mutation through one helper that persists AND refreshes the session cache.
+ */
+describe('UpdateUserInfo.updateName — persists AND refreshes the server session cache', function () {
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('updates the user row and the session-cached user in the same stroke', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, row;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Old Name', email: 'rename@test.local' })];
+                case 1:
+                    user = _a.sent();
+                    testEnv.actAs(user);
+                    return [4 /*yield*/, new UpdateUserInfo_1.UpdateUserInfo().updateName('New Name')];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { id: user.id })];
+                case 3:
+                    row = _a.sent();
+                    expect(row.name).toBe('New Name');
+                    // Outcome 2 (the wart): the session cache must serve the new name too. RED pre-fix.
+                    expect(new user_1.UserRepo().getUser().name).toBe('New Name');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=UpdateUserInfoSessionRefresh.test.js.map

package/dist/test/UpdateUserInfoSessionRefresh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateUserInfoSessionRefresh.test.js","sourceRoot":"","sources":["../../test/UpdateUserInfoSessionRefresh.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAmD;AACnD,yEAAwE;AACxE,iEAAgE;AAEhE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;GAMG;AACH,QAAQ,CAAC,6EAA6E,EAAE;IACtF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE;;;;wBAC3D,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAAjF,IAAI,GAAG,SAA0E;oBACvF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAEpB,qBAAM,IAAI,+BAAc,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAA;;oBAAjD,SAAiD,CAAC;oBAGtC,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA7D,GAAG,GAAG,SAAuD;oBACnE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAElC,oFAAoF;oBACpF,MAAM,CAAC,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;;;;SACxD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/UserServerTestEnvironment.d.ts

@@ -0,0 +1,26 @@
+import { SpannerDriver } from '@proteinjs/db-driver-spanner';
+import { User } from '@proteinjs/user';
+/**
+ * Emulator-backed test environment for user-server integration tests (Spanner emulator on
+ * SPANNER_EMULATOR_HOST, provisioned on demand). Same shape as chat-server's ChatTestEnvironment:
+ * seed deterministic session storage + db driver into the SourceRepository cache, load the tables
+ * the suites touch, drop them on the way out.
+ */
+export declare class UserServerTestEnvironment {
+    readonly spannerDriver: SpannerDriver;
+    private dropTestTable;
+    private userRepo;
+    beforeAll(): Promise<void>;
+    afterAll(): Promise<void>;
+    /** Insert a user row (as system) and return it. */
+    createUser(args: {
+        name: string;
+        email: string;
+        roles?: string[];
+    }): Promise<User>;
+    /** Seed the session cache with `user` — the identity service calls and scoped db ops run under. */
+    actAs(user: User): void;
+    private loadTables;
+    private dropTables;
+}
+//# sourceMappingURL=UserServerTestEnvironment.d.ts.map

package/dist/test/UserServerTestEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserServerTestEnvironment.d.ts","sourceRoot":"","sources":["../../test/UserServerTestEnvironment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAK7D,OAAO,EAAwB,IAAI,EAAY,MAAM,iBAAiB,CAAC;AAmBvE;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,QAAQ,CAAC,aAAa,gBAInB;IACH,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,QAAQ,CAAkB;IAE5B,SAAS;IAqBT,QAAQ;IAMd,mDAAmD;IAC7C,UAAU,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxF,mGAAmG;IACnG,KAAK,CAAC,IAAI,EAAE,IAAI;YAIF,UAAU;YAOV,UAAU;CAKzB"}

package/dist/test/UserServerTestEnvironment.js

@@ -0,0 +1,202 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserServerTestEnvironment = void 0;
+var db_1 = require("@proteinjs/db");
+var db_driver_spanner_1 = require("@proteinjs/db-driver-spanner");
+var test_1 = require("@proteinjs/db-driver-spanner/test");
+var db_file_1 = require("@proteinjs/db-file");
+var server_api_1 = require("@proteinjs/server-api");
+var reflection_1 = require("@proteinjs/reflection");
+var user_1 = require("@proteinjs/user");
+/** In-memory SessionDataStorage seeded into the SourceRepository cache (tests don't load the
+ *  generated source graph, so `Session` would otherwise find no implementation). */
+var TestSessionDataStorage = /** @class */ (function () {
+    function TestSessionDataStorage() {
+        this.environment = 'node';
+    }
+    TestSessionDataStorage.prototype.setData = function (data) {
+        TestSessionDataStorage.data = data;
+    };
+    TestSessionDataStorage.prototype.getData = function () {
+        return TestSessionDataStorage.data;
+    };
+    return TestSessionDataStorage;
+}());
+/**
+ * Emulator-backed test environment for user-server integration tests (Spanner emulator on
+ * SPANNER_EMULATOR_HOST, provisioned on demand). Same shape as chat-server's ChatTestEnvironment:
+ * seed deterministic session storage + db driver into the SourceRepository cache, load the tables
+ * the suites touch, drop them on the way out.
+ */
+var UserServerTestEnvironment = /** @class */ (function () {
+    function UserServerTestEnvironment() {
+        this.spannerDriver = new db_driver_spanner_1.SpannerDriver({
+            projectId: 'proteinjs-test',
+            instanceName: 'proteinjs-test',
+            databaseName: 'test',
+        });
+        this.dropTestTable = (0, test_1.getDropTestTable)(this.spannerDriver);
+        this.userRepo = new user_1.UserRepo();
+    }
+    UserServerTestEnvironment.prototype.beforeAll = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var objectCache;
+            var _this = this;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: 
+                    // The emulator wipes its in-memory instances on any container restart (and CI service
+                    // containers start empty) — self-provision so suites never depend on out-of-band setup.
+                    return [4 /*yield*/, test_1.SpannerEmulatorProvisioner.ensureProvisioned({
+                            projectId: 'proteinjs-test',
+                            instanceName: 'proteinjs-test',
+                            databaseName: 'test',
+                        })];
+                    case 1:
+                        // The emulator wipes its in-memory instances on any container restart (and CI service
+                        // containers start empty) — self-provision so suites never depend on out-of-band setup.
+                        _a.sent();
+                        objectCache = reflection_1.SourceRepository.get().objectCache;
+                        objectCache['@proteinjs/server-api/SessionDataStorage'] = [new TestSessionDataStorage()];
+                        objectCache['@proteinjs/db/DefaultDbDriverFactory'] = [{ getDbDriver: function () { return _this.spannerDriver; } }];
+                        server_api_1.Session.setData({
+                            sessionId: 'test-session',
+                            user: 'guest',
+                            data: {},
+                        });
+                        return [4 /*yield*/, this.loadTables(user_1.tables)];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, this.loadTables(db_file_1.tables)];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    UserServerTestEnvironment.prototype.afterAll = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.dropTables(db_file_1.tables)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, this.dropTables(user_1.tables)];
+                    case 2:
+                        _a.sent();
+                        test_1.SpannerEmulatorProvisioner.release();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** Insert a user row (as system) and return it. */
+    UserServerTestEnvironment.prototype.createUser = function (args) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.User, {
+                            name: args.name,
+                            email: args.email,
+                            password: 'test',
+                            emailVerified: true,
+                            roles: (_a = args.roles) !== null && _a !== void 0 ? _a : [],
+                        })];
+                    case 1: return [2 /*return*/, _b.sent()];
+                }
+            });
+        });
+    };
+    /** Seed the session cache with `user` — the identity service calls and scoped db ops run under. */
+    UserServerTestEnvironment.prototype.actAs = function (user) {
+        this.userRepo.setUser(user);
+    };
+    UserServerTestEnvironment.prototype.loadTables = function (tables) {
+        return __awaiter(this, void 0, void 0, function () {
+            var dbDriver, _i, _a, table;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dbDriver = db_1.Db.getDefaultDbDriver();
+                        _i = 0, _a = Object.values(tables);
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        table = _a[_i];
+                        return [4 /*yield*/, dbDriver.getTableManager().loadTable(table)];
+                    case 2:
+                        _b.sent();
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    UserServerTestEnvironment.prototype.dropTables = function (tables) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _i, _a, table;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _i = 0, _a = Object.values(tables);
+                        _b.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        table = _a[_i];
+                        return [4 /*yield*/, this.dropTestTable(table)];
+                    case 2:
+                        _b.sent();
+                        _b.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    return UserServerTestEnvironment;
+}());
+exports.UserServerTestEnvironment = UserServerTestEnvironment;
+//# sourceMappingURL=UserServerTestEnvironment.js.map

package/dist/test/UserServerTestEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserServerTestEnvironment.js","sourceRoot":"","sources":["../../test/UserServerTestEnvironment.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAAyD;AACzD,kEAA6D;AAC7D,0DAAiG;AACjG,8CAA0D;AAC1D,oDAA2F;AAC3F,oDAAyD;AACzD,wCAAuE;AAEvE;oFACoF;AACpF;IAAA;QACE,gBAAW,GAAG,MAAe,CAAC;IAUhC,CAAC;IAPC,wCAAO,GAAP,UAAQ,IAAiB;QACvB,sBAAsB,CAAC,IAAI,GAAG,IAAI,CAAC;IACrC,CAAC;IAED,wCAAO,GAAP;QACE,OAAO,sBAAsB,CAAC,IAAI,CAAC;IACrC,CAAC;IACH,6BAAC;AAAD,CAAC,AAXD,IAWC;AAID;;;;;GAKG;AACH;IAAA;QACW,kBAAa,GAAG,IAAI,iCAAa,CAAC;YACzC,SAAS,EAAE,gBAAgB;YAC3B,YAAY,EAAE,gBAAgB;YAC9B,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;QACK,kBAAa,GAAG,IAAA,uBAAgB,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrD,aAAQ,GAAG,IAAI,eAAQ,EAAE,CAAC;IAyDpC,CAAC;IAvDO,6CAAS,GAAf;;;;;;;oBACE,sFAAsF;oBACtF,wFAAwF;oBACxF,qBAAM,iCAA0B,CAAC,iBAAiB,CAAC;4BACjD,SAAS,EAAE,gBAAgB;4BAC3B,YAAY,EAAE,gBAAgB;4BAC9B,YAAY,EAAE,MAAM;yBACrB,CAAC,EAAA;;wBANF,sFAAsF;wBACtF,wFAAwF;wBACxF,SAIE,CAAC;wBACG,WAAW,GAAI,6BAAgB,CAAC,GAAG,EAA2C,CAAC,WAAW,CAAC;wBACjG,WAAW,CAAC,0CAA0C,CAAC,GAAG,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC;wBACzF,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,cAAM,OAAA,KAAI,CAAC,aAAa,EAAlB,CAAkB,EAAE,CAAC,CAAC;wBAClG,oBAAO,CAAC,OAAO,CAAC;4BACd,SAAS,EAAE,cAAc;4BACzB,IAAI,EAAE,OAAO;4BACb,IAAI,EAAE,EAAE;yBACT,CAAC,CAAC;wBAEH,qBAAM,IAAI,CAAC,UAAU,CAAC,aAAU,CAAC,EAAA;;wBAAjC,SAAiC,CAAC;wBAClC,qBAAM,IAAI,CAAC,UAAU,CAAC,gBAAU,CAAC,EAAA;;wBAAjC,SAAiC,CAAC;;;;;KACnC;IAEK,4CAAQ,GAAd;;;;4BACE,qBAAM,IAAI,CAAC,UAAU,CAAC,gBAAU,CAAC,EAAA;;wBAAjC,SAAiC,CAAC;wBAClC,qBAAM,IAAI,CAAC,UAAU,CAAC,aAAU,CAAC,EAAA;;wBAAjC,SAAiC,CAAC;wBAClC,iCAA0B,CAAC,OAAO,EAAE,CAAC;;;;;KACtC;IAED,mDAAmD;IAC7C,8CAAU,GAAhB,UAAiB,IAAuD;;;;;4BAC/D,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAU,CAAC,IAAI,EAAE;4BACnD,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,IAAI;4BACnB,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE;yBACxB,CAAC,EAAA;4BANF,sBAAO,SAML,EAAC;;;;KACJ;IAED,mGAAmG;IACnG,yCAAK,GAAL,UAAM,IAAU;QACd,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAEa,8CAAU,GAAxB,UAAyB,MAAqC;;;;;;wBACtD,QAAQ,GAAG,OAAE,CAAC,kBAAkB,EAAE,CAAC;8BACA,EAArB,KAAA,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;;6BAArB,CAAA,cAAqB,CAAA;wBAA9B,KAAK;wBACd,qBAAM,QAAQ,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAA;;wBAAjD,SAAiD,CAAC;;;wBADhC,IAAqB,CAAA;;;;;;KAG1C;IAEa,8CAAU,GAAxB,UAAyB,MAAqC;;;;;;8BACnB,EAArB,KAAA,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;;6BAArB,CAAA,cAAqB,CAAA;wBAA9B,KAAK;wBACd,qBAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAA;;wBAA/B,SAA+B,CAAC;;;wBADd,IAAqB,CAAA;;;;;;KAG1C;IACH,gCAAC;AAAD,CAAC,AAhED,IAgEC;AAhEY,8DAAyB"}

package/dist/test/avatarRoute.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=avatarRoute.test.d.ts.map

package/dist/test/avatarRoute.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatarRoute.test.d.ts","sourceRoot":"","sources":["../../test/avatarRoute.test.ts"],"names":[],"mappings":""}

package/dist/test/avatarRoute.test.js

@@ -0,0 +1,222 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var sharp_1 = __importDefault(require("sharp"));
+var user_1 = require("@proteinjs/user");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var UpdateUserInfo_1 = require("../src/services/UpdateUserInfo");
+var avatar_1 = require("../src/routes/avatar");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/** Captures exactly what the route writes — status, headers, body. */
+var MockResponse = /** @class */ (function () {
+    function MockResponse() {
+        this.statusCode = 200;
+        this.headers = {};
+    }
+    MockResponse.prototype.status = function (code) {
+        this.statusCode = code;
+        return this;
+    };
+    MockResponse.prototype.setHeader = function (name, value) {
+        this.headers[name.toLowerCase()] = value;
+    };
+    MockResponse.prototype.send = function (body) {
+        this.body = body;
+        return this;
+    };
+    return MockResponse;
+}());
+var requestAvatar = function (userId) { return __awaiter(void 0, void 0, void 0, function () {
+    var response;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                response = new MockResponse();
+                return [4 /*yield*/, avatar_1.avatar.onRequest({ params: { userId: userId } }, response)];
+            case 1:
+                _a.sent();
+                return [2 /*return*/, response];
+        }
+    });
+}); };
+/**
+ * The shared-visibility door for avatar photos: logged-in users can render ANY user's avatar
+ * (File rows are ScopedRecords, so /file/:id can't serve them cross-user); logged-out requests
+ * get 401; emoji/no-avatar users get 404 (clients render emoji/initials from the user record).
+ * Only the file id stored on the user row is ever served.
+ */
+describe('GET /avatar/:userId', function () {
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("serves another user's avatar photo to any logged-in (non-admin) user, cacheable by fileId", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var owner, png, updated, viewer, response, bytes, metadata;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Owner', email: 'owner@test.local' })];
+                case 1:
+                    owner = _a.sent();
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, sharp_1.default)({ create: { width: 100, height: 100, channels: 3, background: { r: 5, g: 150, b: 90 } } })
+                            .png()
+                            .toBuffer()];
+                case 2:
+                    png = _a.sent();
+                    return [4 /*yield*/, new UpdateUserInfo_1.UpdateUserInfo().updateAvatarPhoto(png.toString('base64'), 'image/png')];
+                case 3:
+                    updated = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Viewer', email: 'viewer@test.local', roles: [] })];
+                case 4:
+                    viewer = _a.sent();
+                    testEnv.actAs(viewer);
+                    return [4 /*yield*/, requestAvatar(owner.id)];
+                case 5:
+                    response = _a.sent();
+                    expect(response.statusCode).toBe(200);
+                    expect(response.headers['content-type']).toBe('image/jpeg');
+                    expect(response.headers['cache-control']).toBe('public, max-age=86400, immutable');
+                    bytes = response.body;
+                    expect(Buffer.isBuffer(bytes)).toBe(true);
+                    expect(bytes[0]).toBe(0xff); // JPEG SOI
+                    expect(bytes[1]).toBe(0xd8);
+                    return [4 /*yield*/, (0, sharp_1.default)(bytes).metadata()];
+                case 6:
+                    metadata = _a.sent();
+                    expect(metadata.width).toBe(512);
+                    expect(metadata.height).toBe(512);
+                    // The client-side URL contract carries the cache-buster.
+                    expect(user_1.avatarRoute.path(owner.id, updated.avatarFileId)).toBe("/avatar/".concat(owner.id, "?v=").concat(updated.avatarFileId));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('404s for an emoji-avatar user and a no-avatar user (photos only)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var emojiUser, bareUser, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Emoji', email: 'emoji-route@test.local' })];
+                case 1:
+                    emojiUser = _c.sent();
+                    testEnv.actAs(emojiUser);
+                    return [4 /*yield*/, new UpdateUserInfo_1.UpdateUserInfo().updateAvatarEmoji('🦀')];
+                case 2:
+                    _c.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Bare', email: 'bare-route@test.local' })];
+                case 3:
+                    bareUser = _c.sent();
+                    testEnv.actAs(bareUser);
+                    _a = expect;
+                    return [4 /*yield*/, requestAvatar(emojiUser.id)];
+                case 4:
+                    _a.apply(void 0, [(_c.sent()).statusCode]).toBe(404);
+                    _b = expect;
+                    return [4 /*yield*/, requestAvatar(bareUser.id)];
+                case 5:
+                    _b.apply(void 0, [(_c.sent()).statusCode]).toBe(404);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('404s for unknown ids — :userId is a keyed lookup, never a path', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var viewer, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Curious', email: 'curious@test.local' })];
+                case 1:
+                    viewer = _c.sent();
+                    testEnv.actAs(viewer);
+                    _a = expect;
+                    return [4 /*yield*/, requestAvatar('no-such-user')];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).statusCode]).toBe(404);
+                    _b = expect;
+                    return [4 /*yield*/, requestAvatar('../../etc/passwd')];
+                case 3:
+                    _b.apply(void 0, [(_c.sent()).statusCode]).toBe(404);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('401s without a logged-in session', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var owner, png, response;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Private', email: 'private@test.local' })];
+                case 1:
+                    owner = _a.sent();
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, sharp_1.default)({ create: { width: 32, height: 32, channels: 3, background: { r: 9, g: 9, b: 9 } } })
+                            .png()
+                            .toBuffer()];
+                case 2:
+                    png = _a.sent();
+                    return [4 /*yield*/, new UpdateUserInfo_1.UpdateUserInfo().updateAvatarPhoto(png.toString('base64'), 'image/png')];
+                case 3:
+                    _a.sent();
+                    testEnv.actAs(user_1.guestUser);
+                    return [4 /*yield*/, requestAvatar(owner.id)];
+                case 4:
+                    response = _a.sent();
+                    expect(response.statusCode).toBe(401);
+                    expect(response.body).not.toBeInstanceOf(Buffer);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=avatarRoute.test.js.map

package/dist/test/avatarRoute.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatarRoute.test.js","sourceRoot":"","sources":["../../test/avatarRoute.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAA0B;AAC1B,wCAAyD;AACzD,yEAAwE;AACxE,iEAAgE;AAChE,+CAA8C;AAE9C,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD,sEAAsE;AACtE;IAAA;QACE,eAAU,GAAG,GAAG,CAAC;QACjB,YAAO,GAA2B,EAAE,CAAC;IAgBvC,CAAC;IAbC,6BAAM,GAAN,UAAO,IAAY;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAS,GAAT,UAAU,IAAY,EAAE,KAAa;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IAC3C,CAAC;IAED,2BAAI,GAAJ,UAAK,IAAU;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACH,mBAAC;AAAD,CAAC,AAlBD,IAkBC;AAED,IAAM,aAAa,GAAG,UAAO,MAAc;;;;;gBACnC,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;gBACpC,qBAAM,eAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,QAAA,EAAE,EAAS,EAAE,QAAe,CAAC,EAAA;;gBAAtE,SAAsE,CAAC;gBACvE,sBAAO,QAAQ,EAAC;;;KACjB,CAAC;AAEF;;;;;GAKG;AACH,QAAQ,CAAC,qBAAqB,EAAE;IAC9B,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE;;;;wBAChF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAA9E,KAAK,GAAG,SAAsE;oBACpF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACT,qBAAM,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;6BAC/G,GAAG,EAAE;6BACL,QAAQ,EAAE,EAAA;;oBAFP,GAAG,GAAG,SAEC;oBACG,qBAAM,IAAI,+BAAc,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,EAAA;;oBAA3F,OAAO,GAAG,SAAiF;oBAIlF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAA5F,MAAM,GAAG,SAAmF;oBAClG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACL,qBAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAAxC,QAAQ,GAAG,SAA6B;oBAE9C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAC5D,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;oBAC7E,KAAK,GAAG,QAAQ,CAAC,IAAc,CAAC;oBACtC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW;oBACxC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACX,qBAAM,IAAA,eAAK,EAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAA;;oBAAxC,QAAQ,GAAG,SAA6B;oBAC9C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAElC,yDAAyD;oBACzD,MAAM,CAAC,kBAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,YAAa,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAW,KAAK,CAAC,EAAE,gBAAM,OAAO,CAAC,YAAY,CAAE,CAAC,CAAC;;;;SACjH,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE;;;;wBACnD,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAA;;oBAAxF,SAAS,GAAG,SAA4E;oBAC9F,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACzB,qBAAM,IAAI,+BAAc,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAA;;oBAAlD,SAAkD,CAAC;oBAClC,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAArF,QAAQ,GAAG,SAA0E;oBAE3F,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACxB,KAAA,MAAM,CAAA;oBAAE,qBAAM,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAzC,kBAAO,CAAC,SAAiC,CAAC,CAAC,UAAU,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjE,KAAA,MAAM,CAAA;oBAAE,qBAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAA;;oBAAxC,kBAAO,CAAC,SAAgC,CAAC,CAAC,UAAU,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACjE,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE;;;;wBACpD,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;oBAAnF,MAAM,GAAG,SAA0E;oBACzF,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACtB,KAAA,MAAM,CAAA;oBAAE,qBAAM,aAAa,CAAC,cAAc,CAAC,EAAA;;oBAA3C,kBAAO,CAAC,SAAmC,CAAC,CAAC,UAAU,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnE,KAAA,MAAM,CAAA;oBAAE,qBAAM,aAAa,CAAC,kBAAkB,CAAC,EAAA;;oBAA/C,kBAAO,CAAC,SAAuC,CAAC,CAAC,UAAU,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACxE,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE;;;;wBACvB,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;oBAAlF,KAAK,GAAG,SAA0E;oBACxF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACT,qBAAM,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;6BAC1G,GAAG,EAAE;6BACL,QAAQ,EAAE,EAAA;;oBAFP,GAAG,GAAG,SAEC;oBACb,qBAAM,IAAI,+BAAc,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,EAAA;;oBAAjF,SAAiF,CAAC;oBAElF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACf,qBAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAAxC,QAAQ,GAAG,SAA6B;oBAC9C,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;;;;SAClD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}