@stonecrop/casl-middleware 0.13.14 → 0.15.0

package/dist/tests/ability.test.js

@@ -1,402 +0,0 @@
-import { AbilityBuilder, PureAbility, subject } from '@casl/ability';
-import { describe, it, expect, vi } from 'vitest';
-import { createAbility, detectSubjectType, defaultAbilityBuilder, createDatabaseAbilityBuilder, createConfigBasedAbilityBuilder, createAbilityFactory, } from '../src/middleware/ability';
-const Ability = PureAbility;
-describe('Ability Creation', () => {
-    describe('createAbility', () => {
-        // Create a test builder with proper matchers - using the same detectSubjectType as production
-        const testBuilder = (user) => {
-            const { can, cannot, build } = new AbilityBuilder(Ability);
-            if (!user) {
-                can('read', 'Query');
-                can('read', 'PublicType');
-            }
-            else {
-                can('read', 'Query');
-                can('read', 'Mutation');
-                if (user.roles?.includes('admin')) {
-                    can('manage', 'all');
-                }
-                else {
-                    can('read', 'User', { id: user.id });
-                    can('update', 'User', { id: user.id });
-                    cannot('update', 'User', 'role');
-                    cannot('update', 'User', 'permissions');
-                }
-                if (user.roles?.includes('moderator')) {
-                    can('update', 'Post');
-                    can('delete', 'Comment');
-                }
-                if (user.roles?.includes('editor')) {
-                    can('create', 'Post');
-                    can('update', 'Post');
-                    can('delete', 'Post');
-                }
-            }
-            return build({
-                detectSubjectType,
-                fieldMatcher: fields => field => {
-                    if (!fields || !field)
-                        return false;
-                    return Array.isArray(fields) ? fields.includes(field) : fields === field;
-                },
-                conditionsMatcher: conditions => object => {
-                    if (!conditions || !object)
-                        return true;
-                    return Object.keys(conditions).every(key => object[key] === conditions[key]);
-                },
-            });
-        };
-        it('should create a basic ability for unauthenticated users', async () => {
-            const ability = await createAbility(undefined, testBuilder);
-            expect(ability).toBeDefined();
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'PublicType')).toBe(true);
-            expect(ability.can('read', 'Mutation')).toBe(false);
-            expect(ability.can('manage', 'all')).toBe(false);
-        });
-        it('should create abilities for authenticated users without roles', async () => {
-            const user = { id: '123', roles: [] };
-            const ability = await createAbility(user, testBuilder);
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'Mutation')).toBe(true);
-            expect(ability.can('read', subject('User', { id: '123' }))).toBe(true);
-            expect(ability.can('update', subject('User', { id: '123' }))).toBe(true);
-            expect(ability.can('update', subject('User', { id: '456' }))).toBe(false);
-            // Check field-level restrictions
-            expect(ability.can('update', 'User', 'role')).toBe(false);
-            expect(ability.can('update', 'User', 'permissions')).toBe(false);
-        });
-        it('should create admin abilities for users with admin role', async () => {
-            const user = { id: '123', roles: ['admin'] };
-            const ability = await createAbility(user, testBuilder);
-            expect(ability.can('manage', 'all')).toBe(true);
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('update', subject('User', { id: '456' }))).toBe(true);
-            expect(ability.can('delete', 'User')).toBe(true);
-        });
-        it('should handle mixed roles correctly', async () => {
-            const user = { id: '123', roles: ['user', 'moderator'] };
-            const ability = await createAbility(user, testBuilder);
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'Mutation')).toBe(true);
-            expect(ability.can('manage', 'all')).toBe(false);
-            expect(ability.can('read', subject('User', { id: '123' }))).toBe(true);
-            expect(ability.can('update', subject('User', { id: '123' }))).toBe(true);
-            // Check field restrictions
-            expect(ability.can('update', 'User', 'role')).toBe(false);
-            expect(ability.can('update', 'User', 'permissions')).toBe(false);
-            // Check moderator permissions
-            expect(ability.can('update', 'Post')).toBe(true);
-            expect(ability.can('delete', 'Comment')).toBe(true);
-        });
-    });
-    describe('Custom Ability Builder', () => {
-        it('should allow custom ability definitions', () => {
-            const customCreateAbility = (user) => {
-                const { can, build } = new AbilityBuilder(Ability);
-                if (user?.permissions?.includes('read:posts')) {
-                    can('read', 'Post');
-                }
-                if (user?.permissions?.includes('write:posts')) {
-                    can(['create', 'update'], 'Post', { authorId: user.id });
-                }
-                if (user?.permissions?.includes('delete:posts')) {
-                    can('delete', 'Post', { authorId: user.id });
-                }
-                return build({
-                    detectSubjectType,
-                    conditionsMatcher: conditions => object => {
-                        if (!conditions || !object)
-                            return true;
-                        return Object.keys(conditions).every(key => object[key] === conditions[key]);
-                    },
-                });
-            };
-            const user = { id: '123', permissions: ['read:posts', 'write:posts'] };
-            const ability = customCreateAbility(user);
-            expect(ability.can('read', 'Post')).toBe(true);
-            expect(ability.can('create', subject('Post', { authorId: '123' }))).toBe(true);
-            expect(ability.can('update', subject('Post', { authorId: '123' }))).toBe(true);
-            expect(ability.can('delete', subject('Post', { authorId: '123' }))).toBe(false);
-            expect(ability.can('update', subject('Post', { authorId: '456' }))).toBe(false);
-        });
-    });
-    describe('detectSubjectType', () => {
-        it('should detect __caslSubjectType__ property', () => {
-            const obj = { __caslSubjectType__: 'CustomType', data: 'test' };
-            expect(detectSubjectType(obj)).toBe('CustomType');
-        });
-        it('should fallback to type property', () => {
-            const obj = { type: 'Post', title: 'Test' };
-            expect(detectSubjectType(obj)).toBe('Post');
-        });
-        it('should fallback to constructor name', () => {
-            class User {
-                name;
-                constructor(name) {
-                    this.name = name;
-                }
-            }
-            const user = new User('John');
-            expect(detectSubjectType(user)).toBe('User');
-        });
-        it('should return Unknown for plain objects', () => {
-            const obj = { data: 'test' };
-            expect(detectSubjectType(obj)).toBe('Unknown');
-        });
-        it('should return Unknown for null or undefined', () => {
-            expect(detectSubjectType(null)).toBe('Unknown');
-            expect(detectSubjectType(undefined)).toBe('Unknown');
-        });
-        it('should return Unknown for primitives', () => {
-            expect(detectSubjectType('string')).toBe('Unknown');
-            expect(detectSubjectType(123)).toBe('Unknown');
-            expect(detectSubjectType(true)).toBe('Unknown');
-        });
-    });
-    describe('defaultAbilityBuilder', () => {
-        it('should create ability with only Query read access for no user', () => {
-            const ability = defaultAbilityBuilder();
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'Mutation')).toBe(false);
-            expect(ability.can('manage', 'all')).toBe(false);
-        });
-        it('should create ability with only Query read access for user without roles', () => {
-            const user = { id: '123', roles: [] };
-            const ability = defaultAbilityBuilder(user);
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'Mutation')).toBe(false);
-        });
-    });
-    describe('createDatabaseAbilityBuilder', () => {
-        it('should build ability from database rules', async () => {
-            const mockFetchRules = vi.fn().mockResolvedValue([
-                { action: 'read', subject: 'Post', inverted: false },
-                { action: 'create', subject: 'Post', inverted: false },
-                { action: 'update', subject: 'Post', fields: ['title'], inverted: false },
-                { action: 'delete', subject: 'Post', inverted: true },
-            ]);
-            const builder = createDatabaseAbilityBuilder(mockFetchRules);
-            const user = { id: '123', roles: ['user'] };
-            const ability = await builder(user);
-            expect(mockFetchRules).toHaveBeenCalledWith('123');
-            expect(ability.can('read', 'Post')).toBe(true);
-            expect(ability.can('create', 'Post')).toBe(true);
-            expect(ability.can('update', 'Post', 'title')).toBe(true);
-            expect(ability.can('delete', 'Post')).toBe(false);
-        });
-        it('should handle rules with conditions', async () => {
-            const mockFetchRules = vi.fn().mockResolvedValue([
-                {
-                    action: 'update',
-                    subject: 'Post',
-                    conditions: { authorId: '123' },
-                    inverted: false,
-                },
-            ]);
-            const builder = createDatabaseAbilityBuilder(mockFetchRules);
-            const user = { id: '123', roles: ['user'] };
-            const ability = await builder(user);
-            expect(ability.can('update', subject('Post', { authorId: '123' }))).toBe(true);
-            expect(ability.can('update', subject('Post', { authorId: '456' }))).toBe(false);
-        });
-        it('should only allow Query read for user without id', async () => {
-            const mockFetchRules = vi.fn();
-            const builder = createDatabaseAbilityBuilder(mockFetchRules);
-            const ability = await builder();
-            expect(mockFetchRules).not.toHaveBeenCalled();
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'Post')).toBe(false);
-        });
-        it('should handle empty rules array', async () => {
-            const mockFetchRules = vi.fn().mockResolvedValue([]);
-            const builder = createDatabaseAbilityBuilder(mockFetchRules);
-            const user = { id: '123', roles: [] };
-            const ability = await builder(user);
-            expect(mockFetchRules).toHaveBeenCalledWith('123');
-            expect(ability.can('read', 'Query')).toBe(false);
-        });
-    });
-    describe('createConfigBasedAbilityBuilder', () => {
-        it('should build ability from role-based config', async () => {
-            const config = {
-                roles: {
-                    editor: [
-                        { action: 'read', subject: 'Post' },
-                        { action: 'create', subject: 'Post' },
-                        { action: 'update', subject: 'Post' },
-                    ],
-                    viewer: [{ action: 'read', subject: 'Post' }],
-                },
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const user = { id: '123', roles: ['editor'] };
-            const ability = await builder(user);
-            expect(ability.can('read', 'Post')).toBe(true);
-            expect(ability.can('create', 'Post')).toBe(true);
-            expect(ability.can('update', 'Post')).toBe(true);
-            expect(ability.can('delete', 'Post')).toBe(false);
-        });
-        it('should apply default rules', async () => {
-            const config = {
-                roles: {},
-                defaultRules: [
-                    { action: 'read', subject: 'Query' },
-                    { action: 'read', subject: 'PublicData' },
-                ],
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const ability = await builder();
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'PublicData')).toBe(true);
-        });
-        it('should combine multiple roles', async () => {
-            const config = {
-                roles: {
-                    editor: [
-                        { action: 'create', subject: 'Post' },
-                        { action: 'update', subject: 'Post' },
-                    ],
-                    moderator: [
-                        { action: 'delete', subject: 'Comment' },
-                        { action: 'update', subject: 'Comment' },
-                    ],
-                },
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const user = { id: '123', roles: ['editor', 'moderator'] };
-            const ability = await builder(user);
-            expect(ability.can('create', 'Post')).toBe(true);
-            expect(ability.can('update', 'Post')).toBe(true);
-            expect(ability.can('delete', 'Comment')).toBe(true);
-            expect(ability.can('update', 'Comment')).toBe(true);
-        });
-        it('should handle field-level permissions', async () => {
-            const config = {
-                roles: {
-                    user: [
-                        { action: 'update', subject: 'User', fields: ['name', 'email'] },
-                        { action: 'update', subject: 'User', fields: 'role', inverted: true },
-                    ],
-                },
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const user = { id: '123', roles: ['user'] };
-            const ability = await builder(user);
-            expect(ability.can('update', 'User', 'name')).toBe(true);
-            expect(ability.can('update', 'User', 'email')).toBe(true);
-            expect(ability.can('update', 'User', 'role')).toBe(false);
-        });
-        it('should process userId template variables in conditions', async () => {
-            const config = {
-                roles: {
-                    user: [
-                        {
-                            action: 'update',
-                            subject: 'Post',
-                            conditions: { authorId: '{{userId}}' },
-                        },
-                    ],
-                },
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const user = { id: '123', roles: ['user'] };
-            const ability = await builder(user);
-            expect(ability.can('update', subject('Post', { authorId: '123' }))).toBe(true);
-            expect(ability.can('update', subject('Post', { authorId: '456' }))).toBe(false);
-        });
-        it('should handle user without roles', async () => {
-            const config = {
-                roles: {
-                    user: [{ action: 'read', subject: 'Post' }],
-                },
-                defaultRules: [{ action: 'read', subject: 'Query' }],
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const ability = await builder({ id: '123', roles: [] });
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'Post')).toBe(false);
-        });
-        it('should handle undefined user', async () => {
-            const config = {
-                roles: {
-                    user: [{ action: 'read', subject: 'Post' }],
-                },
-                defaultRules: [{ action: 'read', subject: 'Query' }],
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const ability = await builder();
-            expect(ability.can('read', 'Query')).toBe(true);
-            expect(ability.can('read', 'Post')).toBe(false);
-        });
-        it('should handle role not defined in config', async () => {
-            const config = {
-                roles: {
-                    admin: [{ action: 'manage', subject: 'all' }],
-                },
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const user = { id: '123', roles: ['unknownRole'] };
-            const ability = await builder(user);
-            expect(ability.can('manage', 'all')).toBe(false);
-        });
-        it('should handle conditions without userId in template', async () => {
-            const config = {
-                roles: {
-                    user: [
-                        {
-                            action: 'update',
-                            subject: 'Post',
-                            conditions: { status: 'draft' },
-                        },
-                    ],
-                },
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const user = { id: '123', roles: ['user'] };
-            const ability = await builder(user);
-            expect(ability.can('update', subject('Post', { status: 'draft' }))).toBe(true);
-            expect(ability.can('update', subject('Post', { status: 'published' }))).toBe(false);
-        });
-    });
-    describe('createAbilityFactory', () => {
-        it('should create a factory function', () => {
-            const builderFn = (user) => {
-                const { can, build } = new AbilityBuilder(Ability);
-                can('read', 'Query');
-                if (user?.roles?.includes('admin')) {
-                    can('manage', 'all');
-                }
-                return build({ detectSubjectType });
-            };
-            const factory = createAbilityFactory(builderFn);
-            expect(typeof factory).toBe('function');
-            const ability1 = factory();
-            expect(ability1.can('read', 'Query')).toBe(true);
-            expect(ability1.can('manage', 'all')).toBe(false);
-            const ability2 = factory({ id: '123', roles: ['admin'] });
-            expect(ability2.can('manage', 'all')).toBe(true);
-        });
-    });
-    describe('createAbility with different builders', () => {
-        it('should work with database builder', async () => {
-            const mockFetchRules = vi.fn().mockResolvedValue([{ action: 'read', subject: 'Post', inverted: false }]);
-            const builder = createDatabaseAbilityBuilder(mockFetchRules);
-            const user = { id: '123', roles: ['user'] };
-            const ability = await createAbility(user, builder);
-            expect(ability.can('read', 'Post')).toBe(true);
-        });
-        it('should work with config-based builder', async () => {
-            const config = {
-                roles: {
-                    admin: [{ action: 'manage', subject: 'all' }],
-                },
-            };
-            const builder = createConfigBasedAbilityBuilder(config);
-            const user = { id: '123', roles: ['admin'] };
-            const ability = await createAbility(user, builder);
-            expect(ability.can('manage', 'all')).toBe(true);
-        });
-    });
-});

package/dist/tests/helpers/test-utils.d.ts

@@ -1,46 +0,0 @@
-import { PureAbility } from '@casl/ability';
-import { GraphQLSchema } from 'graphql';
-import type { AppAbility } from '../../src/middleware/ability';
-import { Context, User } from '../../src/types';
-/**
- * Create a mock GraphQL context for testing
- */
-export declare const createMockContext: (user?: User, ability?: AppAbility) => Context;
-/**
- * Create a simple test schema
- */
-export declare const createTestSchema: () => GraphQLSchema;
-/**
- * Create test users with different roles
- */
-export declare const testUsers: {
-    public: undefined;
-    regular: {
-        id: string;
-        roles: string[];
-    };
-    moderator: {
-        id: string;
-        roles: string[];
-    };
-    editor: {
-        id: string;
-        roles: string[];
-    };
-    admin: {
-        id: string;
-        roles: string[];
-    };
-};
-/**
- * Assertion helper for checking abilities
- */
-export declare const expectAbility: (ability: PureAbility) => {
-    toAllow: (action: string, subject: string, conditions?: any) => void;
-    toDeny: (action: string, subject: string, conditions?: any) => void;
-};
-/**
- * Mock GraphQL ResolveInfo for testing
- */
-export declare const createMockResolveInfo: (overrides?: any) => any;
-//# sourceMappingURL=test-utils.d.ts.map

package/dist/tests/helpers/test-utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-utils.d.ts","sourceRoot":"","sources":["../../../tests/helpers/test-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,IAAI,EAAE,UAAU,UAAU,KAAG,OAOrE,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,QAAO,aA4CnC,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;CAMrB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,WAAW;sBAC/B,MAAM,WAAW,MAAM,eAAe,GAAG;qBAG1C,MAAM,WAAW,MAAM,eAAe,GAAG;CAGzD,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,YAAW,GAAQ,KAAG,GAS1D,CAAA"}

package/dist/tests/helpers/test-utils.js

@@ -1,92 +0,0 @@
-import { PureAbility } from '@casl/ability';
-import { makeExecutableSchema } from '@graphql-tools/schema';
-/**
- * Create a mock GraphQL context for testing
- */
-export const createMockContext = (user, ability) => {
-    const defaultAbility = new PureAbility([{ action: 'read', subject: 'Query' }]);
-    return {
-        user: user || undefined,
-        ability: ability || defaultAbility,
-    };
-};
-/**
- * Create a simple test schema
- */
-export const createTestSchema = () => {
-    const typeDefs = `
-		type User {
-			id: ID!
-			name: String!
-			email: String
-			role: String
-		}
-
-		type Post {
-			id: ID!
-			title: String!
-			content: String!
-			authorId: String!
-		}
-
-		type Query {
-			me: User
-			user(id: ID!): User
-			posts: [Post!]!
-		}
-
-		type Mutation {
-			updateUser(id: ID!, name: String): User
-			createPost(title: String!, content: String!): Post
-		}
-	`;
-    const resolvers = {
-        Query: {
-            me: () => ({ id: '123', name: 'Test User', email: 'test@example.com', role: 'user' }),
-            user: (_, { id }) => ({ id, name: `User ${id}`, email: `user${id}@example.com`, role: 'user' }),
-            posts: () => [
-                { id: '1', title: 'Post 1', content: 'Content 1', authorId: '123' },
-                { id: '2', title: 'Post 2', content: 'Content 2', authorId: '456' },
-            ],
-        },
-        Mutation: {
-            updateUser: (_, { id, name }) => ({ id, name: name || 'Updated', email: 'updated@example.com' }),
-            createPost: (_, { title, content }) => ({ id: '3', title, content, authorId: '123' }),
-        },
-    };
-    return makeExecutableSchema({ typeDefs, resolvers });
-};
-/**
- * Create test users with different roles
- */
-export const testUsers = {
-    public: undefined,
-    regular: { id: '123', roles: ['user'] },
-    moderator: { id: '456', roles: ['user', 'moderator'] },
-    editor: { id: '789', roles: ['user', 'editor'] },
-    admin: { id: '999', roles: ['admin'] },
-};
-/**
- * Assertion helper for checking abilities
- */
-export const expectAbility = (ability) => ({
-    toAllow: (action, subject, conditions) => {
-        expect(ability.can(action, subject, conditions)).toBe(true);
-    },
-    toDeny: (action, subject, conditions) => {
-        expect(ability.can(action, subject, conditions)).toBe(false);
-    },
-});
-/**
- * Mock GraphQL ResolveInfo for testing
- */
-export const createMockResolveInfo = (overrides = {}) => ({
-    fieldName: 'testField',
-    parentType: { name: 'Query' },
-    path: { typename: 'Query', key: 'testField' },
-    operation: {
-        operation: 'query',
-        loc: { source: { body: 'query { testField }' } },
-    },
-    ...overrides,
-});

package/dist/tests/introspection.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=introspection.test.d.ts.map

package/dist/tests/introspection.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"introspection.test.d.ts","sourceRoot":"","sources":["../../tests/introspection.test.ts"],"names":[],"mappings":""}