@solidxai/core 0.1.13-beta.7 → 0.1.13-beta.8

package/src/services/media.service.ts

@@ -1,13 +1,14 @@
 import { BadRequestException, forwardRef, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
 import { ModuleRef } from "@nestjs/core";
 import { InjectEntityManager } from '@nestjs/typeorm';
-import { EntityManager, In } from 'typeorm';
+import { EntityManager, In, Not } from 'typeorm';
 import * as path from 'path';
 import { Readable } from 'stream';
 
 import { ConfigService } from '@nestjs/config';
 import { CRUDService } from 'src/services/crud.service';
 import { DiskFileService, S3FileService } from 'src/services/file';
+import { classify } from 'src/helpers/string.helper';
 import { MediaDownloadUrlService } from 'src/services/media-download-url.service';
 
 
@@ -176,9 +177,13 @@ export class MediaService extends CRUDService<Media> {
   async delete(id: number, solidRequestContext: any = {}) {
     const media = await this.repo.findOne({
       where: { id },
-      relations: ['mediaStorageProviderMetadata'],
+      relations: ['mediaStorageProviderMetadata', 'modelMetadata'],
     });
 
+    if (media) {
+      await this.assertMediaDeletable([media]);
+    }
+
     const result = await super.delete(id, solidRequestContext);
 
     if (media) {
@@ -193,9 +198,11 @@ export class MediaService extends CRUDService<Media> {
       where: {
         id: In(ids),
       },
-      relations: ['mediaStorageProviderMetadata'],
+      relations: ['mediaStorageProviderMetadata', 'modelMetadata'],
     });
 
+    await this.assertMediaDeletable(mediaRecords);
+
     const result = await super.deleteMany(ids, solidRequestContext);
 
     for (const media of mediaRecords) {
@@ -205,6 +212,33 @@ export class MediaService extends CRUDService<Media> {
     return result;
   }
 
+  /**
+   * Media belonging to a published draft/publish-enabled record must survive edits made to
+   * later drafts (see DraftPublishHelperService.cloneMediaForVersion) - deleting it directly
+   * would strip the published version's media out from under it. Mirrors the equivalent
+   * entity-level guard in DraftPublishHelperService.assertDraftPublishDeleteAllowed.
+   */
+  private async assertMediaDeletable(mediaRecords: Media[]): Promise<void> {
+    const blockedIds: number[] = [];
+
+    for (const media of mediaRecords) {
+      if (!media.modelMetadata?.draftPublishWorkflow) continue;
+
+      const entityRepository = this.entityManager.getRepository(classify(media.modelMetadata.singularName));
+      const owningEntity = await entityRepository.findOne({ where: { id: media.entityId } as any });
+
+      if (owningEntity && (owningEntity as any).isPublished === true) {
+        blockedIds.push(media.id);
+      }
+    }
+
+    if (blockedIds.length > 0) {
+      throw new BadRequestException(
+        'Media belonging to a published record cannot be deleted. Edit the record to create a draft first'
+      );
+    }
+  }
+
   private async decorateMediaRecords(medias: Media[]): Promise<void> {
     for (const media of medias) {
       await this.decorateMediaRecord(media);
@@ -244,6 +278,17 @@ export class MediaService extends CRUDService<Media> {
     }
 
     try {
+      // Draft/publish versioning may clone a Media row that reuses the same
+      // relativeUri (see DraftPublishHelperService.cloneMediaForVersion) instead of
+      // duplicating the underlying file. Skip the physical delete if another row
+      // still references it.
+      const stillReferenced = await this.repo.exists({
+        where: { relativeUri: media.relativeUri, id: Not(media.id) },
+      });
+      if (stillReferenced) {
+        return;
+      }
+
       const mediaStorageProvider = await this.resolveMediaStorageProvider(media);
       if (!mediaStorageProvider) {
         return;

package/src/services/metadata-validation.service.ts

@@ -0,0 +1,39 @@
+import { BadRequestException, Injectable } from "@nestjs/common";
+import { isNotEmpty, matches } from "class-validator";
+import { ModelMetadataService } from "./model-metadata.service";
+
+@Injectable()
+export class MetadataValidationService {
+  constructor(
+    private readonly modelMetadataService: ModelMetadataService,
+  ) {}
+
+  async validateCreateDto(
+    modelName: string,
+    dto: object,
+  ): Promise<void> {
+    const model = await this.modelMetadataService.findOneBySingularName(
+      modelName,
+      { fields: true },
+    );
+
+    for (const field of model.fields ?? []) {
+      const value = (dto as Record<string, unknown>)[field.name];
+
+      if (!isNotEmpty(value) || typeof value !== "string") {
+        continue;
+      }
+
+      if (!isNotEmpty(field.regexPattern)) {
+        continue;
+      }
+
+      if (!matches(value, new RegExp(field.regexPattern))) {
+        throw new BadRequestException(
+          field.regexPatternNotMatchingErrorMsg ||
+            `Validation errors in ${field.name} is invalid i.e Field regex pattern is invalid`,
+        );
+      }
+    }
+  }
+}

package/src/services/model-metadata.service.ts

@@ -1729,7 +1729,10 @@ export class ModelMetadataService {
     // --------------------
     // Find record index in page
     // --------------------
-    const index = records.findIndex(r => String(r.id) === String(recordId));
+    const index = records.findIndex(r =>
+      String(r.id) === String(recordId) ||
+      (r.initialEntityVersionId && String(r.initialEntityVersionId) === String(recordId))
+    );
 
     if (index === -1) {
       throw new BadRequestException(`Record not found in current page`);

package/src/services/object.utils.ts

@@ -0,0 +1,10 @@
+// Some filter/sort DTOs arrive with bracket-wrapped keys (e.g. "[isPublished]") from
+// query-string parsing. Both CrudHelperService and DraftPublishHelperService need to
+// strip that wrapping before reading keys, so it lives here as a shared utility.
+export function normalizeObjectKeys(obj: any): any {
+    return Object.keys(obj).reduce((acc, key) => {
+        const newKey = key.replace(/^\[(.*)\]$/, '$1');
+        acc[newKey] = obj[key];
+        return acc;
+    }, {});
+}

package/src/services/settings/default-settings-provider.service.ts

@@ -125,10 +125,10 @@ const getSolidCoreSettings = (isProd: boolean) =>
     },
     {
       moduleName: "solid-core",
-      key: "rowClickAction",
+      key: "recordClickAction",
       value: "edit",
       level: SettingLevel.SystemAdminEditable,
-      label: "Row Click Action",
+      label: "Record Click Action",
       group: "app-settings",
       sortOrder: 45,
       controlType: "selectionStatic",
@@ -136,7 +136,7 @@ const getSolidCoreSettings = (isProd: boolean) =>
         { label: "Edit", value: "edit" },
         { label: "View", value: "view" },
       ],
-      helpText: "Decides whether clicking a list row opens the record in edit mode or view mode.",
+      helpText: "Decides whether clicking a record in List, Card, Kanban, or Tree View opens it in edit mode or view mode.",
     },
     {
       moduleName: "solid-core",

package/src/services/user.service.ts

@@ -156,10 +156,25 @@ export class UserService extends CRUDService<User> {
     if (!user) {
       throw new Error(ERROR_MESSAGES.USER_NOT_FOUND);
     }
-    if (updateDto.roles != null) {
-      await this.addRolesToUser(user.username, updateDto.roles);
+
+    const { roles, ...userUpdateDto } = updateDto || {};
+    const savedUser = await this.update(
+      id,
+      userUpdateDto,
+      files,
+      true,
+      solidRequestContext,
+    );
+
+    if (roles != null) {
+      await this.addRolesToUser(savedUser.username, roles);
+      return this.repo.findOne({
+        where: { id: savedUser.id },
+        relations: { roles: true },
+      });
     }
-    await this.update(id, updateDto, files, true);
+
+    return savedUser;
   }
 
   async addRoleToUser(username: string, roleName: string): Promise<User> {

package/src/services/view-metadata.service.ts

@@ -4,8 +4,6 @@ import { InjectEntityManager } from '@nestjs/typeorm';
 import { CRUDService } from 'src/services/crud.service';
 import { EntityManager } from 'typeorm';
 
-import { classify } from '../helpers/string.helper';
-import { Locale } from 'src/entities/locale.entity';
 import { ModelMetadataHelperService } from 'src/helpers/model-metadata-helper.service';
 import { SolidRegistry } from 'src/helpers/solid-registry';
 import { ModelMetadataRepository } from 'src/repository/model-metadata.repository';
@@ -197,64 +195,6 @@ export class ViewMetadataService extends CRUDService<ViewMetadata> {
     return this.getDefaultWorkflowFieldData(workflowField, workflowFieldName, fieldsMap);
   }
 
-  //for locales 
-  private async getEntityRecordsInAllLocales(
-    modelName: string,
-    id: string,
-    defaultEntityLocaleIdFromQuery?: string
-  ): Promise<{ records: any[], defaultEntityLocaleId: string | null }> {
-    const solidRegistry = await this.moduleRef.get(SolidRegistry, { strict: false });
-    // const currentEntityTarget = solidRegistry.getEntityTarget(this.entityManager, classify(modelName));
-    const currentEntityRepository = this.entityManager.getRepository(classify(modelName));
-
-    // Case 1: Creating a new record with no defaultEntityLocaleId to clone
-    if (id === 'new' && !defaultEntityLocaleIdFromQuery) {
-      this.logger.debug(`Creating new record without cloning from any defaultEntityLocaleId.`);
-      return { records: [], defaultEntityLocaleId: null };
-    }
-
-    // Case 2: Creating a new record and cloning from an existing defaultEntityLocaleId
-    if (id === 'new' && defaultEntityLocaleIdFromQuery) {
-      this.logger.debug(`Creating new record by cloning translations from defaultEntityLocaleId: ${defaultEntityLocaleIdFromQuery}`);
-
-      const records = await currentEntityRepository.find({
-        where: [
-          { defaultEntityLocaleId: defaultEntityLocaleIdFromQuery },
-          { id: defaultEntityLocaleIdFromQuery }
-        ]
-      });
-
-      this.logger.debug(`Found ${records.length} cloned records for new entity.`);
-      return { records, defaultEntityLocaleId: defaultEntityLocaleIdFromQuery };
-    }
-
-    // Case 3: Editing an existing entity
-    const entityRecord = await currentEntityRepository.findOne({ where: { id } });
-
-    if (!entityRecord) {
-      this.logger.warn(`No entity found for id ${id}`);
-      return { records: [], defaultEntityLocaleId: null };
-    }
-
-    const defaultEntityLocaleId = entityRecord.defaultEntityLocaleId || entityRecord.id;
-    if (entityRecord.defaultEntityLocaleId) {
-      this.logger.debug(`Editing translated locale record. Translation root id: ${defaultEntityLocaleId}`);
-    } else {
-      this.logger.debug(`Editing translation root record with id ${defaultEntityLocaleId}`);
-    }
-
-    const records = await currentEntityRepository.find({
-      where: [
-        { defaultEntityLocaleId: defaultEntityLocaleId },
-        { id: defaultEntityLocaleId }
-      ]
-    });
-
-    this.logger.debug(`Found ${records.length} records in all locales for existing entity.`);
-
-    return { records, defaultEntityLocaleId };
-  }
-
   // START: Custom Service Methods
   async getLayout(query, activeUser) {
     let { modelName, moduleName, viewType, id, populate, menuItemId, menuItemName, actionId, actionName } = query;
@@ -432,92 +372,12 @@ export class ViewMetadataService extends CRUDService<ViewMetadata> {
      * ]
      */
 
-    const applicableLocales: any = []
-    // if (entity.model.internationalisation) {
-    //   const allLocales = await this.entityManager.getRepository(Locale).find({});
-
-    //   if (id === 'new') {
-    //     allLocales.forEach(locale => {
-    //       applicableLocales.push({
-    //         locale: locale.locale,
-    //         displayName: locale.displayName,
-    //         isDefault: locale.isDefault ? 'yes' : 'no',
-    //         defaultEntityLocaleId: null,
-    //         entityId: null
-    //       });
-    //     });
-    //   }
-    //   else {
-    //     const defaultLocale = allLocales.find(locale => locale.isDefault);
-    //     this.logger.debug(`Default locale is: ${defaultLocale.locale}`);
-
-    //     // Get hold of the repository for the current model
-    //     const solidRegistry = await this.moduleRef.get(SolidRegistry, { strict: false });
-    //     const currentEntityTarget = solidRegistry.getEntityTarget(this.entityManager, classify(modelName));
-    //     const currentEntityRepository = this.entityManager.getRepository(currentEntityTarget);
-
-    //     // We are in edit mode, the id that is being edited could be a record tagged with the default locale or it could be tagged with a non-default locale.
-    //     const entityRecord = await currentEntityRepository.findOne({
-    //       where: {
-    //         id: id,
-    //       }
-    //     });
-    //     if(entityRecord){
-    //     //  Resolve the default entity locale id....
-    //       let defaultEntityLocaleId = null;
-    //       if (entityRecord.localeName === defaultLocale.locale) {
-    //         defaultEntityLocaleId = entityRecord.id;
-    //         this.logger.debug(`You are editing a record tagged with the default locale: ${entityRecord.localeName}.`);
-    //       }
-    //       else {
-    //         defaultEntityLocaleId = entityRecord.defaultEntityLocaleId;
-    //         this.logger.debug(`You are editing a record tagged with the non-default locale: ${entityRecord.localeName}. `);
-    //       }
-    //       this.logger.debug(`Identified default Entity Locale Id: ${defaultEntityLocaleId}`);
-
-    //       // Now we query for all records in the same model matching the defaultEntityLocaleId
-    //       // Get all records mathcing the defaultEntityLocaleId or where the id is same as the defaultEntityLocaleId
-    //       const entityRecordsInAllLocales = await currentEntityRepository.find({
-    //         where: [
-    //           { defaultEntityLocaleId: defaultEntityLocaleId },
-    //           { id: defaultEntityLocaleId }
-    //         ],
-    //       });
-    //       this.logger.debug(`Found ${entityRecordsInAllLocales.length} records in all locales for the defaultEntityLocaleId: ${defaultEntityLocaleId}`);
-
-    //       // Loop over all locales and populate the applicableLocales array
-    //       for (const locale of allLocales) {
-    //         // Find the record in the entityRecordsInAllLocales that matches the current locale
-    //         const matchingRecord = entityRecordsInAllLocales.find(record => record.localeName === locale.locale);
-
-    //         applicableLocales.push({
-    //           locale: locale.locale,
-    //           displayName: locale.displayName,
-    //           isDefault: locale.isDefault ? 'yes' : 'no',
-    //           defaultEntityLocaleId: defaultEntityLocaleId,
-    //           entityId: (matchingRecord ? matchingRecord.id : null)
-    //         });
-    //       }
-    //     }else{
-    //       this.logger.warn(`No record found for id: ${id} in model: ${modelName}. Cannot determine applicable locales.`);
-    //     }
-    //   }
-    // }
+    let applicableLocales: any[] = [];
     if (entity.model.internationalisation) {
-      const defaultEntityLocaleIdFromQuery = query?.defaultEntityLocaleId;
-      const { records: entityRecordsInAllLocales, defaultEntityLocaleId } =
-        await this.getEntityRecordsInAllLocales(modelName, id, defaultEntityLocaleIdFromQuery);
-      const allLocales = await this.entityManager.getRepository(Locale).find({});
-      for (const locale of allLocales) {
-        const matchingRecord = entityRecordsInAllLocales.find(record => record.localeName === locale.locale);
-        applicableLocales.push({
-          locale: locale.locale,
-          displayName: locale.displayName,
-          isDefault: locale.isDefault ? 'yes' : 'no',
-          defaultEntityLocaleId: defaultEntityLocaleId,
-          entityId: matchingRecord ? matchingRecord.id : null
-        });
-      }
+      const draftPublishEnabled = entity.model.draftPublishWorkflow === true;
+      applicableLocales = await this.internationalisationHelperService.buildApplicableLocales(
+        this.entityManager, modelName, id, query?.defaultEntityLocaleId, draftPublishEnabled,
+      );
     }
 
     const r = {

package/src/solid-core.module.ts

@@ -38,6 +38,8 @@ import { MqDashboardQueueNameVariableOptionsProvider } from "./services/selectio
 import { PseudoForeignKeySelectionProvider } from "./services/selection-providers/pseudo-foreign-key-selection-provider.service";
 import { ModuleMetadataSeederService } from "./seeders/module-metadata-seeder.service";
 import { ModuleTestDataService } from "./seeders/module-test-data.service";
+import { DraftPublishHelperService } from "./services/draft-publish-helper.service";
+import { InternationalisationHelperService } from "./services/internationalisation-helper.service";
 import { CrudHelperService } from "./services/crud-helper.service";
 import { DatasourceManagementService } from "./services/datasource-management.service";
 import { DatasourceIntrospectionService } from "./services/datasource-introspection.service";
@@ -56,10 +58,10 @@ import { ModulePackageService } from "./services/module-package.service";
 import { SolidIntrospectService } from "./services/solid-introspect.service";
 // import { ListOfComputedFieldProvider } from './providers/list-of-computed-field-provider.service';
 import { ServeStaticModule } from "@nestjs/serve-static";
-import { extname, join } from "path";
+import { basename, join } from "path";
 import { RefreshModelCommand } from "./commands/refresh-model.command";
 import { MediaController } from "./controllers/media.controller";
-import { INLINE_SAFE_EXTENSIONS } from "./constants/media-file-types";
+import { getLowercaseFileExtension, INLINE_SAFE_EXTENSIONS } from "./constants/media-file-types";
 
 import { RefreshModuleCommand } from "./commands/refresh-module.command";
 import { ModelMetadataSubscriber } from "./subscribers/model-metadata.subscriber";
@@ -167,6 +169,7 @@ import { GoogleOauthStrategy } from "./passport-strategies/google-oauth.strategy
 import { ApiKeyService } from "./services/api-key.service";
 import { ActiveSessionStorageService } from "./services/active-session-storage.service";
 import { AuthenticationService } from "./services/authentication.service";
+import { MetadataValidationService } from "./services/metadata-validation.service";
 import { BcryptService } from "./services/bcrypt.service";
 import { UuidExternalIdEntityComputedFieldProvider } from "./services/computed-fields/entity/uuid-externalid-entity-computed-field-provider.service";
 import { UuidExternalIdComputedFieldProvider } from "./services/computed-fields/uuid-external-id-computed-field-provider.service";
@@ -535,7 +538,11 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
           // else (including svg, html, and any other uploaded file) is forced to download
           // rather than be displayed/executed by the browser, regardless of what mimetype or
           // extension it was uploaded with.
-          if (!INLINE_SAFE_EXTENSIONS.has(extname(path).toLowerCase().replace(/^\./, ''))) {
+          // basename first: getLowercaseFileExtension takes a file name, not a path, so a
+          // directory containing a dot must not be mistaken for the extension. An
+          // extensionless file yields undefined, which is not inline-safe - so it correctly
+          // falls through to the forced-download branch.
+          if (!INLINE_SAFE_EXTENSIONS.has(getLowercaseFileExtension(basename(path)) ?? '')) {
             res.setHeader("Content-Type", "application/octet-stream");
             res.setHeader("Content-Disposition", "attachment");
           }
@@ -644,6 +651,7 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
     ModuleMetadataExplorerService,
     ModuleMetadataHelperService,
     ModulePackageService,
+    MetadataValidationService,
     ModelMetadataService,
     ModelMetadataHelperService,
     FieldMetadataService,
@@ -656,6 +664,8 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
     InfoService,
     SolidIntrospectService,
     DiscoveryService,
+    DraftPublishHelperService,
+    InternationalisationHelperService,
     CrudHelperService,
     CRUDService,
     Reflector,
@@ -976,6 +986,8 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
     ChatterMessageRepository,
     ChatterMessageService,
     ConfigModule,
+    DraftPublishHelperService,
+    InternationalisationHelperService,
     CrudHelperService,
     CRUDService,
     CsvService,
@@ -998,6 +1010,7 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
     SmsFactory,
     MediaService,
     MediaStorageProviderMetadataService,
+    MetadataValidationService,
     ModelMetadataHelperService,
     ModelMetadataService,
     ModuleMetadataService,

package/dist-tests/api/authenticate.spec.js

@@ -1,119 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const test_1 = require("@playwright/test");
-const env_1 = require("../helpers/env");
-const baseURL = process.env.API_BASE_URL ?? "http://localhost:3000";
-const TEST_USER_EMAIL = (0, env_1.getRequiredEnv)("TEST_USER_EMAIL");
-const TEST_USER_PASSWORD = (0, env_1.getRequiredEnv)("TEST_USER_PASSWORD");
-function base64UrlDecode(input) {
-    const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
-    const padded = normalized.length % 4 === 0
-        ? normalized
-        : normalized.padEnd(normalized.length + (4 - (normalized.length % 4)), "=");
-    return Buffer.from(padded, "base64").toString("utf-8");
-}
-function validateJwt(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) {
-        throw new Error("JWT must have three dot-separated parts.");
-    }
-    const headerJson = JSON.parse(base64UrlDecode(parts[0]));
-    const payloadJson = JSON.parse(base64UrlDecode(parts[1]));
-    if (!headerJson || typeof headerJson !== "object") {
-        throw new Error("JWT header must be a JSON object.");
-    }
-    if (!payloadJson || typeof payloadJson !== "object") {
-        throw new Error("JWT payload must be a JSON object.");
-    }
-    if (typeof payloadJson.exp !== "number") {
-        throw new Error("JWT payload.exp must be a number.");
-    }
-    return payloadJson;
-}
-(0, test_1.test)("API: authenticate succeeds with valid credentials", async () => {
-    const api = await test_1.request.newContext({
-        baseURL,
-        extraHTTPHeaders: {
-            accept: "*/*",
-            "content-type": "application/json",
-        },
-    });
-    try {
-        const res = await api.post("/api/iam/authenticate", {
-            data: {
-                email: TEST_USER_EMAIL,
-                username: "",
-                password: TEST_USER_PASSWORD,
-            },
-        });
-        (0, test_1.expect)(res.status()).toBe(200);
-        const json = await res.json();
-        (0, test_1.expect)(json.statusCode).toBe(200);
-        (0, test_1.expect)(Array.isArray(json.message)).toBe(true);
-        (0, test_1.expect)(json.message.length).toBe(0);
-        (0, test_1.expect)(json.error).toBe("");
-        const user = json.data?.user;
-        (0, test_1.expect)(user, "Expected data.user to be an object.").toBeTruthy();
-        (0, test_1.expect)(typeof user).toBe("object");
-        const email = user?.email;
-        (0, test_1.expect)(typeof email).toBe("string");
-        if (email === TEST_USER_EMAIL) {
-            (0, test_1.expect)(email).toBe(TEST_USER_EMAIL);
-        }
-        else {
-            (0, test_1.expect)(email.length).toBeGreaterThan(0);
-        }
-        (0, test_1.expect)(typeof user?.mobile).toBe("string");
-        (0, test_1.expect)(typeof user?.username).toBe("string");
-        (0, test_1.expect)(typeof user?.forcePasswordChange).toBe("boolean");
-        (0, test_1.expect)(typeof user?.id).toBe("number");
-        const roles = user?.roles;
-        (0, test_1.expect)(Array.isArray(roles)).toBe(true);
-        if (Array.isArray(roles)) {
-            (0, test_1.expect)(roles.every((role) => typeof role === "string")).toBe(true);
-            (0, test_1.expect)(roles).toContain("Admin");
-        }
-        const accessToken = json.data?.accessToken;
-        const refreshToken = json.data?.refreshToken;
-        (0, test_1.expect)(typeof accessToken).toBe("string");
-        (0, test_1.expect)(typeof refreshToken).toBe("string");
-        const accessPayload = validateJwt(accessToken);
-        const refreshPayload = validateJwt(refreshToken);
-        (0, test_1.expect)(typeof accessPayload.exp).toBe("number");
-        (0, test_1.expect)(typeof refreshPayload.exp).toBe("number");
-    }
-    finally {
-        await api.dispose();
-    }
-});
-(0, test_1.test)("API: authenticate fails with wrong password", async () => {
-    const api = await test_1.request.newContext({
-        baseURL,
-        extraHTTPHeaders: {
-            accept: "*/*",
-            "content-type": "application/json",
-        },
-    });
-    try {
-        const res = await api.post("/api/iam/authenticate", {
-            data: {
-                email: TEST_USER_EMAIL,
-                username: "",
-                password: `${TEST_USER_PASSWORD}__wrong`,
-            },
-        });
-        (0, test_1.expect)(res.status()).toBe(401);
-        const json = await res.json();
-        (0, test_1.expect)(json.statusCode).toBe(401);
-        (0, test_1.expect)(json.statusCodeMessage).toBe("Unauthorized");
-        (0, test_1.expect)(json.message).toBe("Invalid credentials");
-        (0, test_1.expect)(json.error).toBe("Invalid credentials");
-        (0, test_1.expect)(json.data?.statusCode).toBe(401);
-        (0, test_1.expect)(json.data?.error).toBe("Unauthorized");
-        (0, test_1.expect)(json.data?.message).toBe("Invalid credentials");
-    }
-    finally {
-        await api.dispose();
-    }
-});
-//# sourceMappingURL=authenticate.spec.js.map

package/dist-tests/api/authenticate.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticate.spec.js","sourceRoot":"","sources":["../../tests/api/authenticate.spec.ts"],"names":[],"mappings":";;AAAA,2CAAyD;AACzD,wCAAgD;AAOhD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;AACpE,MAAM,eAAe,GAAG,IAAA,oBAAc,EAAC,iBAAiB,CAAC,CAAC;AAC1D,MAAM,kBAAkB,GAAG,IAAA,oBAAc,EAAC,oBAAoB,CAAC,CAAC;AAEhE,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GACV,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,UAAU,CAAC,MAAM,CACjB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACjD,GAAG,CACJ,CAAC;IACN,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,WAAyB,CAAC;AACnC,CAAC;AAED,IAAA,WAAI,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,GAAG,GAAG,MAAM,cAAO,CAAC,UAAU,CAAC;QACnC,OAAO;QACP,gBAAgB,EAAE;YAChB,MAAM,EAAE,KAAK;YACb,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAClD,IAAI,EAAE;gBACJ,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,kBAAkB;aAC7B;SACF,CAAC,CAAC;QAEH,IAAA,aAAM,EAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAA,aAAM,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAA,aAAM,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,IAAA,aAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAA2C,CAAC;QACpE,IAAA,aAAM,EAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC,UAAU,EAAE,CAAC;QACjE,IAAA,aAAM,EAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;QAC1B,IAAA,aAAM,EAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YAEN,IAAA,aAAM,EAAE,KAAgB,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,IAAA,aAAM,EAAC,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,OAAO,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,OAAO,IAAI,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,IAAA,aAAM,EAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;QAC1B,IAAA,aAAM,EAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAA,aAAM,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAC7C,IAAA,aAAM,EAAC,OAAO,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,OAAO,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3C,MAAM,aAAa,GAAG,WAAW,CAAC,WAAqB,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,WAAW,CAAC,YAAsB,CAAC,CAAC;QAE3D,IAAA,aAAM,EAAC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,WAAI,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,GAAG,GAAG,MAAM,cAAO,CAAC,UAAU,CAAC;QACnC,OAAO;QACP,gBAAgB,EAAE;YAChB,MAAM,EAAE,KAAK;YACb,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAClD,IAAI,EAAE;gBACJ,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,GAAG,kBAAkB,SAAS;aACzC;SACF,CAAC,CAAC;QAEH,IAAA,aAAM,EAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAA,aAAM,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAA,aAAM,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpD,IAAA,aAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACjD,IAAA,aAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import { expect, request, test } from \"@playwright/test\";\nimport { getRequiredEnv } from \"../helpers/env\";\n\ntype JwtPayload = {\n  exp?: number;\n  [key: string]: unknown;\n};\n\nconst baseURL = process.env.API_BASE_URL ?? \"http://localhost:3000\";\nconst TEST_USER_EMAIL = getRequiredEnv(\"TEST_USER_EMAIL\");\nconst TEST_USER_PASSWORD = getRequiredEnv(\"TEST_USER_PASSWORD\");\n\nfunction base64UrlDecode(input: string): string {\n  const normalized = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padded =\n    normalized.length % 4 === 0\n      ? normalized\n      : normalized.padEnd(\n        normalized.length + (4 - (normalized.length % 4)),\n        \"=\"\n      );\n  return Buffer.from(padded, \"base64\").toString(\"utf-8\");\n}\n\nfunction validateJwt(token: string): JwtPayload {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    throw new Error(\"JWT must have three dot-separated parts.\");\n  }\n\n  const headerJson = JSON.parse(base64UrlDecode(parts[0]));\n  const payloadJson = JSON.parse(base64UrlDecode(parts[1]));\n\n  if (!headerJson || typeof headerJson !== \"object\") {\n    throw new Error(\"JWT header must be a JSON object.\");\n  }\n\n  if (!payloadJson || typeof payloadJson !== \"object\") {\n    throw new Error(\"JWT payload must be a JSON object.\");\n  }\n\n  if (typeof payloadJson.exp !== \"number\") {\n    throw new Error(\"JWT payload.exp must be a number.\");\n  }\n\n  return payloadJson as JwtPayload;\n}\n\ntest(\"API: authenticate succeeds with valid credentials\", async () => {\n  const api = await request.newContext({\n    baseURL,\n    extraHTTPHeaders: {\n      accept: \"*/*\",\n      \"content-type\": \"application/json\",\n    },\n  });\n\n  try {\n    const res = await api.post(\"/api/iam/authenticate\", {\n      data: {\n        email: TEST_USER_EMAIL,\n        username: \"\",\n        password: TEST_USER_PASSWORD,\n      },\n    });\n\n    expect(res.status()).toBe(200);\n    const json = await res.json();\n\n    expect(json.statusCode).toBe(200);\n    expect(Array.isArray(json.message)).toBe(true);\n    expect(json.message.length).toBe(0);\n    expect(json.error).toBe(\"\");\n\n    const user = json.data?.user as Record<string, unknown> | undefined;\n    expect(user, \"Expected data.user to be an object.\").toBeTruthy();\n    expect(typeof user).toBe(\"object\");\n\n    const email = user?.email;\n    expect(typeof email).toBe(\"string\");\n    if (email === TEST_USER_EMAIL) {\n      expect(email).toBe(TEST_USER_EMAIL);\n    } else {\n      // If your API returns a fixed system email, replace this with an exact match.\n      expect((email as string).length).toBeGreaterThan(0);\n    }\n\n    expect(typeof user?.mobile).toBe(\"string\");\n    expect(typeof user?.username).toBe(\"string\");\n    expect(typeof user?.forcePasswordChange).toBe(\"boolean\");\n    expect(typeof user?.id).toBe(\"number\");\n\n    const roles = user?.roles;\n    expect(Array.isArray(roles)).toBe(true);\n    if (Array.isArray(roles)) {\n      expect(roles.every((role) => typeof role === \"string\")).toBe(true);\n      expect(roles).toContain(\"Admin\");\n    }\n\n    const accessToken = json.data?.accessToken;\n    const refreshToken = json.data?.refreshToken;\n    expect(typeof accessToken).toBe(\"string\");\n    expect(typeof refreshToken).toBe(\"string\");\n\n    const accessPayload = validateJwt(accessToken as string);\n    const refreshPayload = validateJwt(refreshToken as string);\n\n    expect(typeof accessPayload.exp).toBe(\"number\");\n    expect(typeof refreshPayload.exp).toBe(\"number\");\n  } finally {\n    await api.dispose();\n  }\n});\n\ntest(\"API: authenticate fails with wrong password\", async () => {\n  const api = await request.newContext({\n    baseURL,\n    extraHTTPHeaders: {\n      accept: \"*/*\",\n      \"content-type\": \"application/json\",\n    },\n  });\n\n  try {\n    const res = await api.post(\"/api/iam/authenticate\", {\n      data: {\n        email: TEST_USER_EMAIL,\n        username: \"\",\n        password: `${TEST_USER_PASSWORD}__wrong`,\n      },\n    });\n\n    expect(res.status()).toBe(401);\n    const json = await res.json();\n\n    expect(json.statusCode).toBe(401);\n    expect(json.statusCodeMessage).toBe(\"Unauthorized\");\n    expect(json.message).toBe(\"Invalid credentials\");\n    expect(json.error).toBe(\"Invalid credentials\");\n    expect(json.data?.statusCode).toBe(401);\n    expect(json.data?.error).toBe(\"Unauthorized\");\n    expect(json.data?.message).toBe(\"Invalid credentials\");\n  } finally {\n    await api.dispose();\n  }\n});\n"]}