@tailor-platform/erp-kit 0.3.0 → 0.4.0

package/src/modules/audit/query/listAuditPolicies.ts

@@ -0,0 +1,100 @@
+import {
+  ok,
+  err,
+  requirePermission,
+  type ReadonlyDB,
+  type QueryContext,
+  type PaginationInput,
+  buildPaginatedResult,
+  DEFAULT_PAGE_SIZE,
+} from "../../../shared";
+import type { DB } from "../generated/kysely-tailordb";
+import { UnauthorizedError } from "../lib/errors.generated";
+
+type PolicyOrderByField = "entityName" | "status" | "operationType" | "createdAt";
+
+export interface ListAuditPoliciesInput extends PaginationInput<PolicyOrderByField> {
+  entityName?: string;
+  status?: string;
+  companyId?: string | null;
+  operationType?: string;
+}
+
+export async function run(db: ReadonlyDB<DB>, input: ListAuditPoliciesInput, ctx: QueryContext) {
+  const permCheck = requirePermission(ctx, "audit:manageAuditPolicies");
+  if (!permCheck.ok) return permCheck;
+
+  const limit = input.limit ?? DEFAULT_PAGE_SIZE;
+  const offset = input.offset ?? 0;
+  const orderBy = input.orderBy ?? "id";
+  const orderDirection = input.orderDirection ?? "asc";
+
+  let query = db.selectFrom("AuditPolicy").selectAll();
+
+  if (input.entityName) query = query.where("entityName", "=", input.entityName);
+  if (input.status) query = query.where("status", "=", input.status);
+  if (input.operationType) query = query.where("operationType", "=", input.operationType);
+
+  // Apply company-scope filtering from context
+  if (ctx.companyId !== undefined) {
+    // Reject out-of-scope requests
+    if (input.companyId !== undefined) {
+      if (ctx.companyId === null && input.companyId !== null) {
+        return err(new UnauthorizedError(ctx.actorId));
+      }
+      if (ctx.companyId !== null && input.companyId !== ctx.companyId) {
+        return err(new UnauthorizedError(ctx.actorId));
+      }
+    }
+    // Apply context scope restriction
+    if (ctx.companyId === null) {
+      query = query.where("companyId", "is", null);
+    } else {
+      query = query.where("companyId", "=", ctx.companyId);
+    }
+  } else if (input.companyId !== undefined) {
+    // No scope restriction from context; apply input filter if provided
+    if (input.companyId === null) {
+      query = query.where("companyId", "is", null);
+    } else {
+      query = query.where("companyId", "=", input.companyId);
+    }
+  }
+
+  const policies = await query
+    .orderBy(orderBy, orderDirection)
+    .limit(limit + 1)
+    .offset(offset)
+    .execute();
+
+  const paginatedResult = buildPaginatedResult(policies, limit);
+
+  // Load field rules for all policies in the current page
+  const policyIds = paginatedResult.items.map((p) => p.id);
+  const fieldRules =
+    policyIds.length > 0
+      ? await db
+          .selectFrom("PolicyFieldRule")
+          .selectAll()
+          .where("auditPolicyId", "in", policyIds)
+          .execute()
+      : [];
+
+  // Map field rules onto each policy
+  const fieldRulesByPolicyId = new Map<string, (typeof fieldRules)[number][]>();
+  for (const rule of fieldRules) {
+    const existing = fieldRulesByPolicyId.get(rule.auditPolicyId) ?? [];
+    existing.push(rule);
+    fieldRulesByPolicyId.set(rule.auditPolicyId, existing);
+  }
+
+  const items = paginatedResult.items.map((policy) => ({
+    policy,
+    fieldRules: fieldRulesByPolicyId.get(policy.id) ?? [],
+  }));
+
+  return ok({
+    items,
+    hasNextPage: paginatedResult.hasNextPage,
+  });
+}

package/src/modules/audit/query/searchAuditEntries.generated.ts

@@ -0,0 +1,5 @@
+// @generated — do not edit
+import { defineQuery } from "../../../shared";
+import { run } from "./searchAuditEntries";
+
+export const searchAuditEntries = defineQuery(run);

package/src/modules/audit/query/searchAuditEntries.test.ts

@@ -0,0 +1,424 @@
+import { describe, expect, it } from "vitest";
+import { createMockDb } from "../../../testing/index";
+import { InsufficientPermissionError } from "../../../shared";
+import type { QueryContext } from "../../../shared";
+import type { DB } from "../generated/kysely-tailordb";
+import {
+  ValidationErrorError,
+  InvalidScopeError,
+  UnauthorizedError,
+} from "../lib/errors.generated";
+import { baseAuditEntry, globalAuditEntry } from "../testing/fixtures";
+import { run } from "./searchAuditEntries";
+
+const ctx: QueryContext = {
+  actorId: "test-actor",
+  permissions: ["audit:viewAuditHistory"],
+};
+
+describe("searchAuditEntries", () => {
+  it("returns entries filtered by actorId", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { actorId: "user-1" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0]).toEqual(baseAuditEntry);
+    }
+  });
+
+  it("returns entries filtered by actorType and actorId", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { actorType: "USER", actorId: "user-1" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("returns entries filtered by entityType", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { entityType: "SalesOrder" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("returns entries filtered by entityType and entityId", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { entityType: "SalesOrder", entityId: "so-1" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("returns entries filtered by operationType", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { operationType: "UPDATE" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("returns entries filtered by date range", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(
+      db,
+      {
+        dateFrom: new Date("2024-01-01"),
+        dateTo: new Date("2024-12-31"),
+      },
+      ctx,
+    );
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("returns entries filtered by companyId", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { companyId: "company-1" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0].companyId).toBe("company-1");
+    }
+  });
+
+  it("returns global entries when companyId is omitted", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([globalAuditEntry]);
+
+    const result = await run(db, { entityType: "User" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0].companyId).toBeNull();
+    }
+  });
+
+  it("returns only company entries when scope is COMPANY", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { scope: "COMPANY", companyId: "company-1" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0].companyId).toBe("company-1");
+    }
+  });
+
+  it("returns only global entries when scope is GLOBAL", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([globalAuditEntry]);
+
+    const result = await run(db, { scope: "GLOBAL" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0].companyId).toBeNull();
+    }
+  });
+
+  it("returns combined company and global entries when scope is ALL", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry, globalAuditEntry]);
+
+    const result = await run(db, { scope: "ALL" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(2);
+    }
+  });
+
+  it("restricts combined results to scopes the caller is authorized for when scope is ALL", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry, globalAuditEntry]);
+
+    const result = await run(db, { scope: "ALL" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(2);
+    }
+  });
+
+  it("returns only company entries in combined scope when caller lacks global permission", async () => {
+    // Permission enforcement is middleware; query layer returns what DB gives
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(db, { scope: "ALL" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("returns only global entries in combined scope when caller lacks company permission", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([globalAuditEntry]);
+
+    const result = await run(db, { scope: "ALL" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("filters combined scope results by companyId when both scope=ALL and companyId are provided", async () => {
+    const { db, spies } = createMockDb<DB>();
+    // scope=ALL + companyId returns company entries + global entries (combined)
+    spies.select.mockReturnValue([baseAuditEntry, globalAuditEntry]);
+
+    const result = await run(db, { scope: "ALL", companyId: "company-1" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(2);
+    }
+  });
+
+  it("rejects scope=COMPANY when companyId is not provided", async () => {
+    const { db } = createMockDb<DB>();
+
+    const result = await run(db, { scope: "COMPANY" }, ctx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(ValidationErrorError);
+    }
+  });
+
+  it("rejects invalid scope value", async () => {
+    const { db } = createMockDb<DB>();
+
+    const result = await run(db, { scope: "INVALID", entityType: "SalesOrder" }, ctx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidScopeError);
+    }
+  });
+
+  it("returns entries filtered by correlationId", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([globalAuditEntry]);
+
+    const result = await run(db, { correlationId: "corr-uuid-1" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0].correlationId).toBe("corr-uuid-1");
+    }
+  });
+
+  it("combines multiple filter criteria", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+
+    const result = await run(
+      db,
+      {
+        actorId: "user-1",
+        entityType: "SalesOrder",
+        operationType: "UPDATE",
+        companyId: "company-1",
+      },
+      ctx,
+    );
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+    }
+  });
+
+  it("returns results in chronological order", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry, globalAuditEntry]);
+
+    const result = await run(db, { scope: "ALL" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(2);
+      // Default order is timestamp asc
+      expect(result.value.items[0].timestamp.getTime()).toBeLessThanOrEqual(
+        result.value.items[1].timestamp.getTime(),
+      );
+    }
+  });
+
+  it("paginates large result sets", async () => {
+    const { db, spies } = createMockDb<DB>();
+    const manyEntries = Array.from({ length: 3 }, (_, i) => ({
+      ...baseAuditEntry,
+      id: `entry-${i}`,
+    }));
+    spies.select.mockReturnValue(manyEntries);
+
+    const result = await run(db, { entityType: "SalesOrder", limit: 2 }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(2);
+      expect(result.value.hasNextPage).toBe(true);
+    }
+  });
+
+  it("returns empty list when no entries match", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([]);
+
+    const result = await run(db, { entityType: "NonExistent" }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(0);
+      expect(result.value.hasNextPage).toBe(false);
+    }
+  });
+
+  it("rejects when no filter parameters are provided", async () => {
+    const { db } = createMockDb<DB>();
+
+    const result = await run(db, {}, ctx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(ValidationErrorError);
+    }
+  });
+
+  it("rejects when caller lacks viewAuditHistory permission", async () => {
+    const { db } = createMockDb<DB>();
+    const noPermsCtx: QueryContext = { actorId: "test-actor", permissions: [] };
+
+    const result = await run(db, { entityType: "SalesOrder" }, noPermsCtx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InsufficientPermissionError);
+    }
+  });
+
+  it("rejects when caller lacks permission for requested company scope", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+    const scopedCtx: QueryContext = {
+      actorId: "test-actor",
+      permissions: ["audit:viewAuditHistory"],
+      companyId: "company-1",
+    };
+
+    const result = await run(db, { companyId: "company-2" }, scopedCtx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(UnauthorizedError);
+    }
+  });
+
+  it("restricts company-scoped caller to their company even when scope=GLOBAL", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([]);
+    const scopedCtx: QueryContext = {
+      actorId: "test-actor",
+      permissions: ["audit:viewAuditHistory"],
+      companyId: "company-1",
+    };
+
+    const result = await run(db, { scope: "GLOBAL" }, scopedCtx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(0);
+    }
+  });
+
+  it("restricts company-scoped caller to their company even when scope=ALL", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([baseAuditEntry]);
+    const scopedCtx: QueryContext = {
+      actorId: "test-actor",
+      permissions: ["audit:viewAuditHistory"],
+      companyId: "company-1",
+    };
+
+    const result = await run(db, { scope: "ALL" }, scopedCtx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0].companyId).toBe("company-1");
+    }
+  });
+
+  it("restricts global-scoped caller to global entries even when scope=COMPANY", async () => {
+    const { db } = createMockDb<DB>();
+    const globalCtx: QueryContext = {
+      actorId: "test-actor",
+      permissions: ["audit:viewAuditHistory"],
+      companyId: null,
+    };
+
+    const result = await run(db, { scope: "COMPANY", companyId: "company-1" }, globalCtx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(0);
+    }
+  });
+
+  it("restricts global-scoped caller to global entries even when scope=ALL", async () => {
+    const { db, spies } = createMockDb<DB>();
+    spies.select.mockReturnValue([globalAuditEntry]);
+    const globalCtx: QueryContext = {
+      actorId: "test-actor",
+      permissions: ["audit:viewAuditHistory"],
+      companyId: null,
+    };
+
+    const result = await run(db, { scope: "ALL" }, globalCtx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.items).toHaveLength(1);
+      expect(result.value.items[0].companyId).toBeNull();
+    }
+  });
+});

package/src/modules/audit/query/searchAuditEntries.ts

@@ -0,0 +1,121 @@
+import {
+  ok,
+  err,
+  requirePermission,
+  type ReadonlyDB,
+  type QueryContext,
+  type PaginationInput,
+  buildPaginatedResult,
+  DEFAULT_PAGE_SIZE,
+} from "../../../shared";
+import type { DB } from "../generated/kysely-tailordb";
+import {
+  ValidationErrorError,
+  InvalidScopeError,
+  UnauthorizedError,
+} from "../lib/errors.generated";
+
+const VALID_SCOPES = ["COMPANY", "GLOBAL", "ALL"];
+
+type SearchOrderByField = "timestamp" | "entityType" | "operationType" | "actorType";
+
+export interface SearchAuditEntriesInput extends PaginationInput<SearchOrderByField> {
+  actorId?: string;
+  actorType?: string;
+  entityType?: string;
+  entityId?: string;
+  operationType?: string;
+  companyId?: string;
+  correlationId?: string;
+  dateFrom?: Date;
+  dateTo?: Date;
+  scope?: string;
+}
+
+export async function run(db: ReadonlyDB<DB>, input: SearchAuditEntriesInput, ctx: QueryContext) {
+  const permCheck = requirePermission(ctx, "audit:viewAuditHistory");
+  if (!permCheck.ok) return permCheck;
+
+  // Validate scope
+  if (input.scope && !VALID_SCOPES.includes(input.scope)) {
+    return err(new InvalidScopeError(input.scope));
+  }
+  if (input.scope === "COMPANY" && !input.companyId) {
+    return err(new ValidationErrorError("scope=COMPANY requires companyId"));
+  }
+
+  // Check at least one filter
+  const hasFilter =
+    input.actorId !== undefined ||
+    input.actorType !== undefined ||
+    input.entityType !== undefined ||
+    input.entityId !== undefined ||
+    input.operationType !== undefined ||
+    input.companyId !== undefined ||
+    input.correlationId !== undefined ||
+    input.dateFrom !== undefined ||
+    input.dateTo !== undefined ||
+    input.scope !== undefined;
+  if (!hasFilter) {
+    return err(new ValidationErrorError("At least one filter parameter is required"));
+  }
+
+  const limit = input.limit ?? DEFAULT_PAGE_SIZE;
+  const offset = input.offset ?? 0;
+  const orderBy = input.orderBy ?? "timestamp";
+  const orderDirection = input.orderDirection ?? "asc";
+
+  let query = db.selectFrom("AuditEntry").selectAll();
+
+  // Apply filters
+  if (input.actorId) query = query.where("actorId", "=", input.actorId);
+  if (input.actorType) query = query.where("actorType", "=", input.actorType);
+  if (input.entityType) query = query.where("entityType", "=", input.entityType);
+  if (input.entityId) query = query.where("entityId", "=", input.entityId);
+  if (input.operationType) query = query.where("operationType", "=", input.operationType);
+  if (input.correlationId) query = query.where("correlationId", "=", input.correlationId);
+  if (input.dateFrom) query = query.where("timestamp", ">=", input.dateFrom);
+  if (input.dateTo) query = query.where("timestamp", "<=", input.dateTo);
+
+  // Apply company-scope restriction from context
+  if (ctx.companyId !== undefined) {
+    // Reject if caller requests a company they are not authorized for
+    if (ctx.companyId !== null && input.companyId && input.companyId !== ctx.companyId) {
+      return err(new UnauthorizedError(ctx.actorId));
+    }
+    if (ctx.companyId === null) {
+      // Global-scoped caller: cannot see company-scoped entries
+      if (input.scope === "COMPANY") {
+        return ok(buildPaginatedResult([], limit));
+      }
+      query = query.where("companyId", "is", null);
+    } else {
+      // Company-scoped caller: cannot see global entries
+      if (input.scope === "GLOBAL") {
+        return ok(buildPaginatedResult([], limit));
+      }
+      query = query.where("companyId", "=", ctx.companyId);
+    }
+  } else {
+    // No scope restriction from context; apply input scope filtering
+    if (input.scope === "COMPANY" || (!input.scope && input.companyId)) {
+      query = query.where("companyId", "=", input.companyId!);
+    } else if (input.scope === "GLOBAL" || (!input.scope && !input.companyId)) {
+      query = query.where("companyId", "is", null);
+    } else if (input.scope === "ALL" && input.companyId) {
+      // scope=ALL with companyId: return combined company + global results
+      query = query.where((eb) =>
+        eb.or([eb("companyId", "=", input.companyId!), eb("companyId", "is", null)]),
+      );
+    }
+    // scope=ALL without companyId: no companyId filter (return all scopes)
+  }
+
+  const entries = await query
+    .orderBy(orderBy, orderDirection)
+    .limit(limit + 1)
+    .offset(offset)
+    .execute();
+
+  return ok(buildPaginatedResult(entries, limit));
+}

package/src/modules/audit/tailor.config.ts

@@ -0,0 +1,13 @@
+import { defineConfig, definePlugins } from "@tailor-platform/sdk";
+import { kyselyTypePlugin } from "@tailor-platform/sdk/plugin/kysely-type";
+import { enumConstantsPlugin } from "@tailor-platform/sdk/plugin/enum-constants";
+
+export default defineConfig({
+  name: "audit",
+  db: { "main-db": { files: [`./db/*.ts`, `./lib/_db_deps.ts`] } },
+});
+
+export const plugins = definePlugins(
+  kyselyTypePlugin({ distPath: `./generated/kysely-tailordb.ts` }),
+  enumConstantsPlugin({ distPath: "./generated/enums.ts" }),
+);

package/src/modules/audit/tailor.d.ts

@@ -0,0 +1,13 @@
+// This file is auto-generated by @tailor-platform/sdk
+// Do not edit this file manually
+// Regenerated automatically when running 'tailor-sdk apply' or 'tailor-sdk generate'
+
+declare module "@tailor-platform/sdk" {
+  interface AttributeMap {}
+  interface AttributeList {
+    __tuple?: [];
+  }
+  interface Env {}
+}
+
+export {};