@tailor-platform/erp-kit 0.2.1 → 0.3.0

package/src/modules/user-management/command/activateUser.test.ts

@@ -1,27 +1,21 @@
 import { describe, expect, it } from "vitest";
-import { createMockDb, testNotFound } from "../../testing/index";
-import { type CommandContext } from "../../shared/internal";
-import { DB } from "../generated/kysely-tailordb";
+import { createMockDb, testNotFound } from "../../../testing/index";
+import { Transaction } from "../generated/kysely-tailordb";
 import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors.generated";
-import { activeUser, baseAuditEvent, inactiveUser, pendingUser } from "../testing/fixtures";
+import { activeUser, inactiveUser, pendingUser } from "../testing/fixtures";
 import { run } from "./activateUser";
 
 describe("activateUser", () => {
-  const ctx: CommandContext = {
-    actorId: "test-actor",
-    permissions: ["user-management:activateUser"],
-  };
-
   it(
     "throws when user does not exist",
-    testNotFound(run, { userId: "nonexistent-user", actorId: "actor-1" }, ctx, UserNotFoundError),
+    testNotFound(run, { userId: "nonexistent-user" }, UserNotFoundError),
   );
 
   it("throws when user is already ACTIVE", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select.mockReturnValue(activeUser);
 
-    const result = await run(db, { userId: activeUser.id, actorId: "actor-1" }, ctx);
+    const result = await run(db, { userId: activeUser.id });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(InvalidStatusTransitionError);
@@ -29,10 +23,10 @@ describe("activateUser", () => {
   });
 
   it("throws when user is INACTIVE (use reactivateUser instead)", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select.mockReturnValue(inactiveUser);
 
-    const result = await run(db, { userId: inactiveUser.id, actorId: "actor-1" }, ctx);
+    const result = await run(db, { userId: inactiveUser.id });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(InvalidStatusTransitionError);
@@ -41,31 +35,19 @@ describe("activateUser", () => {
 
   // Success cases
   it("activates PENDING user to ACTIVE", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     const activatedUser = {
       ...pendingUser,
       status: "ACTIVE" as const,
       updatedAt: new Date("2024-01-15T00:00:00.000Z"),
     };
-    const createdAuditEvent = {
-      ...baseAuditEvent,
-      eventType: "USER_ACTIVATED" as const,
-      actorId: "actor-1",
-      targetId: pendingUser.id,
-    };
 
     spies.select.mockReturnValue(pendingUser);
     spies.update.mockReturnValue(activatedUser);
-    spies.insert.mockReturnValue(createdAuditEvent);
 
-    const result = await run(
-      db,
-      {
-        userId: pendingUser.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      userId: pendingUser.id,
+    });
 
     expect(result.ok).toBe(true);
     if (result.ok) {
@@ -74,39 +56,4 @@ describe("activateUser", () => {
     }
     expect(spies.update).toHaveBeenCalled();
   });
-
-  it("logs USER_ACTIVATED audit event", async () => {
-    const { db, spies } = createMockDb<DB>();
-    const activatedUser = {
-      ...pendingUser,
-      status: "ACTIVE" as const,
-      updatedAt: new Date("2024-01-15T00:00:00.000Z"),
-    };
-    const createdAuditEvent = {
-      ...baseAuditEvent,
-      eventType: "USER_ACTIVATED" as const,
-      actorId: "actor-1",
-      targetId: pendingUser.id,
-    };
-
-    spies.select.mockReturnValue(pendingUser);
-    spies.update.mockReturnValue(activatedUser);
-    spies.insert.mockReturnValue(createdAuditEvent);
-
-    const result = await run(
-      db,
-      {
-        userId: pendingUser.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.value.auditEvent.eventType).toBe("USER_ACTIVATED");
-      expect(result.value.auditEvent.actorId).toBe("actor-1");
-      expect(result.value.auditEvent.targetId).toBe(pendingUser.id);
-    }
-  });
 });

package/src/modules/user-management/command/activateUser.ts

@@ -1,10 +1,9 @@
-import { ok, err, type CommandContext } from "../../shared/internal";
-import { DB } from "../generated/kysely-tailordb";
+import { ok, err } from "../../../shared";
+import { Transaction } from "../generated/kysely-tailordb";
 import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors.generated";
 
 export interface ActivateUserInput {
   userId: string;
-  actorId: string;
   from?: string[];
 }
 
@@ -14,12 +13,12 @@ export interface ActivateUserInput {
  * Transitions a user from PENDING to ACTIVE status.
  * Only PENDING users can be activated; use reactivateUser for INACTIVE users.
  */
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-export async function run(db: DB, input: ActivateUserInput, _ctx: CommandContext) {
+export async function run(db: Transaction, input: ActivateUserInput) {
   const user = await db
     .selectFrom("User")
     .selectAll()
     .where("id", "=", input.userId)
+    .forUpdate()
     .executeTakeFirst();
 
   if (!user) {
@@ -41,19 +40,5 @@ export async function run(db: DB, input: ActivateUserInput, _ctx: CommandContext
     .returningAll()
     .executeTakeFirst();
 
-  const auditEvent = await db
-    .insertInto("AuditEvent")
-    .values({
-      eventType: "USER_ACTIVATED",
-      actorId: input.actorId,
-      targetId: input.userId,
-      targetType: "User",
-      payload: JSON.stringify({ previousStatus: user.status }),
-      createdAt: new Date(),
-      updatedAt: null,
-    })
-    .returningAll()
-    .executeTakeFirst();
-
-  return ok({ user: updatedUser!, auditEvent: auditEvent! });
+  return ok({ user: updatedUser! });
 }

package/src/modules/user-management/command/assignPermissionToRole.generated.ts

@@ -1,5 +1,5 @@
 // @generated — do not edit
-import { defineCommand } from "../../shared/internal";
+import { defineCommand } from "../../../shared";
 import { permissions } from "../lib/permissions.generated";
 import { run } from "./assignPermissionToRole";
 

package/src/modules/user-management/command/assignPermissionToRole.test.ts

@@ -1,30 +1,19 @@
 import { describe, expect, it } from "vitest";
-import { type CommandContext } from "../../shared/internal";
-import { createMockDb } from "../../testing/index";
-import { DB } from "../generated/kysely-tailordb";
+import { createMockDb } from "../../../testing/index";
+import { Transaction } from "../generated/kysely-tailordb";
 import { PermissionNotFoundError, RoleNotFoundError } from "../lib/errors.generated";
-import { baseAuditEvent, basePermission, baseRole, baseRolePermission } from "../testing/fixtures";
+import { basePermission, baseRole, baseRolePermission } from "../testing/fixtures";
 import { run } from "./assignPermissionToRole";
 
 describe("assignPermissionToRole", () => {
-  const ctx: CommandContext = {
-    actorId: "test-actor",
-    permissions: ["user-management:assignPermissionToRole"],
-  };
-
   it("throws when role does not exist", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select.mockReturnValue(undefined);
 
-    const result = await run(
-      db,
-      {
-        roleId: "nonexistent-role",
-        permissionId: basePermission.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      roleId: "nonexistent-role",
+      permissionId: basePermission.id,
+    });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(RoleNotFoundError);
@@ -32,20 +21,15 @@ describe("assignPermissionToRole", () => {
   });
 
   it("throws when permission does not exist", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select
       .mockReturnValueOnce(baseRole) // Role found
       .mockReturnValueOnce(undefined); // Permission not found
 
-    const result = await run(
-      db,
-      {
-        roleId: baseRole.id,
-        permissionId: "nonexistent-permission",
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      roleId: baseRole.id,
+      permissionId: "nonexistent-permission",
+    });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(PermissionNotFoundError);
@@ -53,21 +37,16 @@ describe("assignPermissionToRole", () => {
   });
 
   it("returns success when assignment already exists (idempotent)", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select
       .mockReturnValueOnce(baseRole) // Role found
       .mockReturnValueOnce(basePermission) // Permission found
       .mockReturnValueOnce(baseRolePermission); // Assignment already exists
 
-    const result = await run(
-      db,
-      {
-        roleId: baseRole.id,
-        permissionId: basePermission.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      roleId: baseRole.id,
+      permissionId: basePermission.id,
+    });
 
     expect(result.ok).toBe(true);
     if (result.ok) {
@@ -76,42 +55,28 @@ describe("assignPermissionToRole", () => {
     expect(spies.insert).not.toHaveBeenCalled();
   });
 
-  it("creates RolePermission and logs PERMISSION_ASSIGNED event", async () => {
-    const { db, spies } = createMockDb<DB>();
+  it("creates RolePermission", async () => {
+    const { db, spies } = createMockDb<Transaction>();
     const newRolePermission = {
       ...baseRolePermission,
       id: "new-role-permission-id",
     };
-    const createdAuditEvent = {
-      ...baseAuditEvent,
-      eventType: "PERMISSION_ASSIGNED" as const,
-      actorId: "actor-1",
-      targetId: baseRole.id,
-      targetType: "Role",
-    };
 
     spies.select
       .mockReturnValueOnce(baseRole) // Role found
       .mockReturnValueOnce(basePermission) // Permission found
       .mockReturnValueOnce(undefined); // No existing assignment
-    spies.insert.mockReturnValueOnce(newRolePermission).mockReturnValueOnce(createdAuditEvent);
+    spies.insert.mockReturnValue(newRolePermission);
 
-    const result = await run(
-      db,
-      {
-        roleId: baseRole.id,
-        permissionId: basePermission.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      roleId: baseRole.id,
+      permissionId: basePermission.id,
+    });
 
     expect(result.ok).toBe(true);
     if (result.ok) {
       expect(result.value.rolePermission.roleId).toBe(baseRole.id);
       expect(result.value.rolePermission.permissionId).toBe(basePermission.id);
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-member-access
-      expect((result.value as any).auditEvent?.eventType).toBe("PERMISSION_ASSIGNED");
     }
     expect(spies.insert).toHaveBeenCalled();
   });

package/src/modules/user-management/command/assignPermissionToRole.ts

@@ -1,11 +1,10 @@
-import { ok, err, type CommandContext } from "../../shared/internal";
-import { DB } from "../generated/kysely-tailordb";
+import { ok, err } from "../../../shared";
+import { Transaction } from "../generated/kysely-tailordb";
 import { PermissionNotFoundError, RoleNotFoundError } from "../lib/errors.generated";
 
 export interface AssignPermissionToRoleInput {
   roleId: string;
   permissionId: string;
-  actorId: string;
 }
 
 /**
@@ -16,8 +15,7 @@ export interface AssignPermissionToRoleInput {
  *
  * Note: Permissions for affected users are recomputed asynchronously via executor.
  */
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-export async function run(db: DB, input: AssignPermissionToRoleInput, _ctx: CommandContext) {
+export async function run(db: Transaction, input: AssignPermissionToRoleInput) {
   const role = await db
     .selectFrom("Role")
     .selectAll()
@@ -44,6 +42,7 @@ export async function run(db: DB, input: AssignPermissionToRoleInput, _ctx: Comm
     .selectAll()
     .where("roleId", "=", input.roleId)
     .where("permissionId", "=", input.permissionId)
+    .forUpdate()
     .executeTakeFirst();
 
   if (existingAssignment) {
@@ -62,23 +61,5 @@ export async function run(db: DB, input: AssignPermissionToRoleInput, _ctx: Comm
     .returningAll()
     .executeTakeFirst();
 
-  const auditEvent = await db
-    .insertInto("AuditEvent")
-    .values({
-      eventType: "PERMISSION_ASSIGNED",
-      actorId: input.actorId,
-      targetId: input.roleId,
-      targetType: "Role",
-      payload: JSON.stringify({
-        roleId: input.roleId,
-        permissionId: input.permissionId,
-        permissionKey: permission.key,
-      }),
-      createdAt: new Date(),
-      updatedAt: null,
-    })
-    .returningAll()
-    .executeTakeFirst();
-
-  return ok({ rolePermission: rolePermission!, auditEvent: auditEvent! });
+  return ok({ rolePermission: rolePermission! });
 }

package/src/modules/user-management/command/assignRoleToUser.generated.ts

@@ -1,5 +1,5 @@
 // @generated — do not edit
-import { defineCommand } from "../../shared/internal";
+import { defineCommand } from "../../../shared";
 import { permissions } from "../lib/permissions.generated";
 import { run } from "./assignRoleToUser";
 

package/src/modules/user-management/command/assignRoleToUser.test.ts

@@ -1,37 +1,19 @@
 import { describe, expect, it } from "vitest";
-import { type CommandContext } from "../../shared/internal";
-import { createMockDb } from "../../testing/index";
-import { DB } from "../generated/kysely-tailordb";
+import { createMockDb } from "../../../testing/index";
+import { Transaction } from "../generated/kysely-tailordb";
 import { RoleNotFoundError, UserNotActiveError, UserNotFoundError } from "../lib/errors.generated";
-import {
-  activeUser,
-  baseAuditEvent,
-  baseRole,
-  baseUserRole,
-  inactiveUser,
-  pendingUser,
-} from "../testing/fixtures";
+import { activeUser, baseRole, baseUserRole, inactiveUser, pendingUser } from "../testing/fixtures";
 import { run } from "./assignRoleToUser";
 
 describe("assignRoleToUser", () => {
-  const ctx: CommandContext = {
-    actorId: "test-actor",
-    permissions: ["user-management:assignRoleToUser"],
-  };
-
   it("throws when user does not exist", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select.mockReturnValue(undefined);
 
-    const result = await run(
-      db,
-      {
-        userId: "nonexistent-user",
-        roleId: baseRole.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      userId: "nonexistent-user",
+      roleId: baseRole.id,
+    });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(UserNotFoundError);
@@ -39,18 +21,13 @@ describe("assignRoleToUser", () => {
   });
 
   it("throws when role does not exist", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select.mockReturnValueOnce(activeUser).mockReturnValueOnce(undefined);
 
-    const result = await run(
-      db,
-      {
-        userId: activeUser.id,
-        roleId: "nonexistent-role",
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      userId: activeUser.id,
+      roleId: "nonexistent-role",
+    });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(RoleNotFoundError);
@@ -58,18 +35,13 @@ describe("assignRoleToUser", () => {
   });
 
   it("throws when user is PENDING", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select.mockReturnValueOnce(pendingUser).mockReturnValueOnce(baseRole);
 
-    const result = await run(
-      db,
-      {
-        userId: pendingUser.id,
-        roleId: baseRole.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      userId: pendingUser.id,
+      roleId: baseRole.id,
+    });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(UserNotActiveError);
@@ -77,18 +49,13 @@ describe("assignRoleToUser", () => {
   });
 
   it("throws when user is INACTIVE", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     spies.select.mockReturnValueOnce(inactiveUser).mockReturnValueOnce(baseRole);
 
-    const result = await run(
-      db,
-      {
-        userId: inactiveUser.id,
-        roleId: baseRole.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      userId: inactiveUser.id,
+      roleId: baseRole.id,
+    });
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).toBeInstanceOf(UserNotActiveError);
@@ -96,7 +63,7 @@ describe("assignRoleToUser", () => {
   });
 
   it("returns success when assignment already exists (idempotent)", async () => {
-    const { db, spies } = createMockDb<DB>();
+    const { db, spies } = createMockDb<Transaction>();
     const updatedUser = { ...activeUser, permissions: ["orders:read"] };
     spies.select
       .mockReturnValueOnce(activeUser)
@@ -105,15 +72,10 @@ describe("assignRoleToUser", () => {
       .mockReturnValueOnce([{ key: "orders:read" }]); // Permission keys from recompute
     spies.update.mockReturnValueOnce(updatedUser);
 
-    const result = await run(
-      db,
-      {
-        userId: activeUser.id,
-        roleId: baseRole.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      userId: activeUser.id,
+      roleId: baseRole.id,
+    });
 
     expect(result.ok).toBe(true);
     if (result.ok) {
@@ -123,19 +85,12 @@ describe("assignRoleToUser", () => {
     expect(spies.insert).not.toHaveBeenCalled();
   });
 
-  it("creates UserRole and logs ROLE_ASSIGNED event", async () => {
-    const { db, spies } = createMockDb<DB>();
+  it("creates UserRole and recomputes permissions", async () => {
+    const { db, spies } = createMockDb<Transaction>();
     const newUserRole = {
       ...baseUserRole,
       id: "new-user-role-id",
     };
-    const createdAuditEvent = {
-      ...baseAuditEvent,
-      eventType: "ROLE_ASSIGNED" as const,
-      actorId: "actor-1",
-      targetId: activeUser.id,
-      targetType: "User",
-    };
     const updatedUser = { ...activeUser, permissions: ["orders:read"] };
 
     spies.select
@@ -143,25 +98,18 @@ describe("assignRoleToUser", () => {
       .mockReturnValueOnce(baseRole)
       .mockReturnValueOnce(undefined) // No existing assignment
       .mockReturnValueOnce([{ key: "orders:read" }]); // Permission keys from recompute
-    spies.insert.mockReturnValueOnce(newUserRole).mockReturnValueOnce(createdAuditEvent);
+    spies.insert.mockReturnValue(newUserRole);
     spies.update.mockReturnValueOnce(updatedUser);
 
-    const result = await run(
-      db,
-      {
-        userId: activeUser.id,
-        roleId: baseRole.id,
-        actorId: "actor-1",
-      },
-      ctx,
-    );
+    const result = await run(db, {
+      userId: activeUser.id,
+      roleId: baseRole.id,
+    });
 
     expect(result.ok).toBe(true);
     if (result.ok) {
       expect(result.value.userRole.userId).toBe(activeUser.id);
       expect(result.value.userRole.roleId).toBe(baseRole.id);
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-member-access
-      expect((result.value as any).auditEvent?.eventType).toBe("ROLE_ASSIGNED");
       expect(result.value.user.permissions).toEqual(["orders:read"]);
     }
     expect(spies.insert).toHaveBeenCalled();

package/src/modules/user-management/command/assignRoleToUser.ts

@@ -1,12 +1,11 @@
-import { ok, err, type CommandContext } from "../../shared/internal";
-import { DB } from "../generated/kysely-tailordb";
+import { ok, err } from "../../../shared";
+import { Transaction } from "../generated/kysely-tailordb";
 import { RoleNotFoundError, UserNotActiveError, UserNotFoundError } from "../lib/errors.generated";
 import { recomputeUserPermissions } from "../lib/recomputeUserPermissions";
 
 export interface AssignRoleToUserInput {
   userId: string;
   roleId: string;
-  actorId: string;
 }
 
 /**
@@ -16,8 +15,7 @@ export interface AssignRoleToUserInput {
  * Operation is idempotent - assigning the same role twice does not create
  * duplicate records or error.
  */
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-export async function run(db: DB, input: AssignRoleToUserInput, _ctx: CommandContext) {
+export async function run(db: Transaction, input: AssignRoleToUserInput) {
   const user = await db
     .selectFrom("User")
     .selectAll()
@@ -48,6 +46,7 @@ export async function run(db: DB, input: AssignRoleToUserInput, _ctx: CommandCon
     .selectAll()
     .where("userId", "=", input.userId)
     .where("roleId", "=", input.roleId)
+    .forUpdate()
     .executeTakeFirst();
 
   if (existingAssignment) {
@@ -66,25 +65,7 @@ export async function run(db: DB, input: AssignRoleToUserInput, _ctx: CommandCon
     .returningAll()
     .executeTakeFirst();
 
-  const auditEvent = await db
-    .insertInto("AuditEvent")
-    .values({
-      eventType: "ROLE_ASSIGNED",
-      actorId: input.actorId,
-      targetId: input.userId,
-      targetType: "User",
-      payload: JSON.stringify({
-        userId: input.userId,
-        roleId: input.roleId,
-        roleName: role.name,
-      }),
-      createdAt: new Date(),
-      updatedAt: null,
-    })
-    .returningAll()
-    .executeTakeFirst();
-
   const updatedUser = await recomputeUserPermissions(db, input.userId);
 
-  return ok({ userRole: userRole!, user: updatedUser, auditEvent: auditEvent! });
+  return ok({ userRole: userRole!, user: updatedUser });
 }

package/src/modules/user-management/command/createPermission.generated.ts

@@ -1,5 +1,5 @@
 // @generated — do not edit
-import { defineCommand } from "../../shared/internal";
+import { defineCommand } from "../../../shared";
 import { permissions } from "../lib/permissions.generated";
 import { run } from "./createPermission";