@tailor-platform/erp-kit 0.3.0 → 0.4.1

package/src/modules/audit/command/deactivateAuditPolicy.ts

@@ -0,0 +1,58 @@
+import type { Transaction } from "../generated/kysely-tailordb";
+import { PolicyNotFoundError, InvalidStateError, UnauthorizedError } from "../lib/errors.generated";
+import { ok, err, type CommandContext } from "@tailor-platform/erp-kit/module";
+
+export interface DeactivateAuditPolicyInput {
+  policyId: string;
+}
+
+/**
+ * Function: deactivateAuditPolicy
+ *
+ * Transitions an audit policy from ACTIVE to INACTIVE status, stopping new
+ * audit capture for the specified entity, operation type, and scope. Previously
+ * recorded audit entries are not deleted.
+ */
+export async function run(db: Transaction, input: DeactivateAuditPolicyInput, ctx: CommandContext) {
+  const { policyId } = input;
+
+  // 1. Find policy with forUpdate
+  const existing = await db
+    .selectFrom("AuditPolicy")
+    .selectAll()
+    .where("id", "=", policyId)
+    .forUpdate()
+    .executeTakeFirst();
+
+  if (!existing) {
+    return err(new PolicyNotFoundError(policyId));
+  }
+
+  // 2. Scope authorization
+  if (ctx.companyId !== undefined) {
+    if (ctx.companyId !== null && existing.companyId !== ctx.companyId) {
+      return err(new UnauthorizedError(ctx.actorId));
+    }
+    if (ctx.companyId === null && existing.companyId !== null) {
+      return err(new UnauthorizedError(ctx.actorId));
+    }
+  }
+
+  // 3. Must be ACTIVE
+  if (existing.status !== "ACTIVE") {
+    return err(new InvalidStateError(policyId));
+  }
+
+  // 3. Set status INACTIVE
+  const policy = await db
+    .updateTable("AuditPolicy")
+    .set({
+      status: "INACTIVE",
+      updatedAt: new Date(),
+    })
+    .where("id", "=", policyId)
+    .returningAll()
+    .executeTakeFirst();
+
+  return ok({ policy: policy! });
+}

package/src/modules/audit/command/deleteAuditPolicy.generated.ts

@@ -0,0 +1,6 @@
+// @generated — do not edit
+import { permissions } from "../lib/permissions.generated";
+import { run } from "./deleteAuditPolicy";
+import { defineCommand } from "@tailor-platform/erp-kit/module";
+
+export const deleteAuditPolicy = defineCommand(permissions.deleteAuditPolicy, run);

package/src/modules/audit/command/deleteAuditPolicy.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, it } from "vitest";
+import { createMockDb } from "../../../testing/index";
+import type { Transaction } from "../generated/kysely-tailordb";
+import { PolicyNotFoundError, InvalidStateError, UnauthorizedError } from "../lib/errors.generated";
+import { draftPolicy, activePolicy, inactivePolicy } from "../testing/fixtures";
+import { run } from "./deleteAuditPolicy";
+import { deleteAuditPolicy } from "./deleteAuditPolicy.generated";
+import { InsufficientPermissionError } from "@tailor-platform/erp-kit/module";
+
+const ctx = { actorId: "test-actor", permissions: ["audit:deleteAuditPolicy"] };
+
+describe("deleteAuditPolicy", () => {
+  it("deletes DRAFT policy", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(draftPolicy);
+
+    const result = await run(db, { policyId: draftPolicy.id }, ctx);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.policyId).toBe(draftPolicy.id);
+    }
+  });
+
+  it("deletes associated PolicyFieldRules when deleting policy", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(draftPolicy);
+
+    const result = await run(db, { policyId: draftPolicy.id }, ctx);
+
+    expect(result.ok).toBe(true);
+    // delete spy should be called twice: once for PolicyFieldRules, once for AuditPolicy
+    expect(spies.delete).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not affect previously recorded audit entries", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(draftPolicy);
+
+    const result = await run(db, { policyId: draftPolicy.id }, ctx);
+
+    expect(result.ok).toBe(true);
+    // delete spy is called only for PolicyFieldRule and AuditPolicy, not AuditEntry
+    expect(spies.delete).toHaveBeenCalledTimes(2);
+  });
+
+  it("rejects deletion of ACTIVE policy", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(activePolicy);
+
+    const result = await run(db, { policyId: activePolicy.id }, ctx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidStateError);
+    }
+  });
+
+  it("rejects deletion of INACTIVE policy", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(inactivePolicy);
+
+    const result = await run(db, { policyId: inactivePolicy.id }, ctx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidStateError);
+    }
+  });
+
+  it("rejects when policy does not exist", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(undefined);
+
+    const result = await run(db, { policyId: "nonexistent" }, ctx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(PolicyNotFoundError);
+    }
+  });
+
+  it("rejects when caller lacks manageAuditPolicies permission", async () => {
+    const { db } = createMockDb<Transaction>();
+    const denied = { actorId: "test-actor", permissions: [] as string[] };
+    const cmd = deleteAuditPolicy();
+
+    const result = await cmd(db, { policyId: draftPolicy.id }, denied);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InsufficientPermissionError);
+    }
+  });
+
+  it("rejects when company-scoped caller deletes policy for a different company", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(draftPolicy); // policy with companyId: "company-1"
+    const scopedCtx = { ...ctx, companyId: "company-2" };
+
+    const result = await run(db, { policyId: draftPolicy.id }, scopedCtx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(UnauthorizedError);
+    }
+  });
+
+  it("rejects when global-scoped caller deletes company-scoped policy", async () => {
+    const { db, spies } = createMockDb<Transaction>();
+    spies.select.mockReturnValueOnce(draftPolicy); // policy with companyId: "company-1"
+    const globalCtx = { ...ctx, companyId: null };
+
+    const result = await run(db, { policyId: draftPolicy.id }, globalCtx);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(UnauthorizedError);
+    }
+  });
+});

package/src/modules/audit/command/deleteAuditPolicy.ts

@@ -0,0 +1,52 @@
+import type { Transaction } from "../generated/kysely-tailordb";
+import { PolicyNotFoundError, InvalidStateError, UnauthorizedError } from "../lib/errors.generated";
+import { ok, err, type CommandContext } from "@tailor-platform/erp-kit/module";
+
+export interface DeleteAuditPolicyInput {
+  policyId: string;
+}
+
+/**
+ * Function: deleteAuditPolicy
+ *
+ * Permanently removes a DRAFT audit policy and its associated field rules.
+ * Only policies in DRAFT status can be deleted.
+ */
+export async function run(db: Transaction, input: DeleteAuditPolicyInput, ctx: CommandContext) {
+  const { policyId } = input;
+
+  // 1. Find policy by ID with forUpdate
+  const existing = await db
+    .selectFrom("AuditPolicy")
+    .selectAll()
+    .where("id", "=", policyId)
+    .forUpdate()
+    .executeTakeFirst();
+
+  if (!existing) {
+    return err(new PolicyNotFoundError(policyId));
+  }
+
+  // Scope authorization checks
+  if (ctx.companyId !== undefined) {
+    if (ctx.companyId !== null && existing.companyId !== ctx.companyId) {
+      return err(new UnauthorizedError(ctx.actorId));
+    }
+    if (ctx.companyId === null && existing.companyId !== null) {
+      return err(new UnauthorizedError(ctx.actorId));
+    }
+  }
+
+  // 2. Not DRAFT → InvalidStateError
+  if (existing.status !== "DRAFT") {
+    return err(new InvalidStateError(policyId));
+  }
+
+  // 3. Delete associated PolicyFieldRules
+  await db.deleteFrom("PolicyFieldRule").where("auditPolicyId", "=", policyId).execute();
+
+  // 4. Delete AuditPolicy
+  await db.deleteFrom("AuditPolicy").where("id", "=", policyId).execute();
+
+  return ok({ policyId });
+}

package/src/modules/audit/command/logAuditEvent.generated.ts

@@ -0,0 +1,6 @@
+// @generated — do not edit
+import { permissions } from "../lib/permissions.generated";
+import { run } from "./logAuditEvent";
+import { defineCommand } from "@tailor-platform/erp-kit/module";
+
+export const logAuditEvent = defineCommand(permissions.logAuditEvent, run);