@tailor-platform/erp-kit 0.6.0 → 0.8.0

package/templates/scaffold/app/backend/src/resolvers/reactivateUser.ts

@@ -0,0 +1,63 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "reactivateUser",
+  operation: "mutation",
+  input: {
+    userId: t.string().description("ID of the user to reactivate"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.reactivateUser(
+        trx,
+        { userId: context.input.userId },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error(`User ${context.input.userId} does not exist`);
+          case "USER_MANAGEMENT_INVALID_STATUS_TRANSITION":
+            throw new Error("User is not in INACTIVE status");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        id: cmdResult.value.user.id,
+        status: cmdResult.value.user.status,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "User",
+            entityId: result.id,
+            operationType: "UPDATE",
+            changes: [{ fieldName: "status", oldValue: "INACTIVE", newValue: result.status }],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("User ID"),
+      status: t.string().description("Updated status"),
+    })
+    .description("Reactivated user"),
+});

package/templates/scaffold/app/backend/src/resolvers/revokePermissionFromRole.ts

@@ -0,0 +1,72 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "revokePermissionFromRole",
+  operation: "mutation",
+  input: {
+    roleId: t.string().description("Role ID"),
+    permissionId: t.string().description("Permission ID to revoke"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.revokePermissionFromRole(
+        trx,
+        {
+          roleId: context.input.roleId,
+          permissionId: context.input.permissionId,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+            throw new Error(`Role ${context.input.roleId} does not exist`);
+          case "USER_MANAGEMENT_PERMISSION_NOT_FOUND":
+            throw new Error(`Permission ${context.input.permissionId} does not exist`);
+          case "USER_MANAGEMENT_ASSIGNMENT_NOT_FOUND":
+            throw new Error("Permission is not assigned to this role");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        roleId: context.input.roleId,
+        permissionId: context.input.permissionId,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "RolePermission",
+            entityId: `${result.roleId}:${result.permissionId}`,
+            operationType: "DELETE",
+            changes: [
+              { fieldName: "roleId", oldValue: result.roleId },
+              { fieldName: "permissionId", oldValue: result.permissionId },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      roleId: t.string().description("Role ID"),
+      permissionId: t.string().description("Revoked permission ID"),
+    })
+    .description("Permission revocation result"),
+});

package/templates/scaffold/app/backend/src/resolvers/revokeRoleFromUser.ts

@@ -0,0 +1,72 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "revokeRoleFromUser",
+  operation: "mutation",
+  input: {
+    userId: t.string().description("User ID"),
+    roleId: t.string().description("Role ID to revoke"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.revokeRoleFromUser(
+        trx,
+        {
+          userId: context.input.userId,
+          roleId: context.input.roleId,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error(`User ${context.input.userId} does not exist`);
+          case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+            throw new Error(`Role ${context.input.roleId} does not exist`);
+          case "USER_MANAGEMENT_ASSIGNMENT_NOT_FOUND":
+            throw new Error("Role is not assigned to this user");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        userId: context.input.userId,
+        roleId: context.input.roleId,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "UserRole",
+            entityId: `${result.userId}:${result.roleId}`,
+            operationType: "DELETE",
+            changes: [
+              { fieldName: "userId", oldValue: result.userId },
+              { fieldName: "roleId", oldValue: result.roleId },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      userId: t.string().description("User ID"),
+      roleId: t.string().description("Revoked role ID"),
+    })
+    .description("Role revocation result"),
+});

package/templates/scaffold/app/backend/src/resolvers/updateOwnProfile.ts

@@ -0,0 +1,107 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "updateOwnProfile",
+  operation: "mutation",
+  input: {
+    name: t.string({ optional: true }).description("New display name"),
+    email: t.string({ optional: true }).description("New email address"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    let oldName: string | undefined;
+    let oldEmail: string | undefined;
+
+    const result = await db.transaction().execute(async (trx) => {
+      const oldUser = await trx
+        .selectFrom("User")
+        .select(["name", "email"])
+        .where("id", "=", context.user.id)
+        .executeTakeFirst();
+      if (oldUser) {
+        oldName = oldUser.name;
+        oldEmail = oldUser.email;
+      }
+
+      const cmdResult = await umModules.commands.updateOwnProfile(
+        trx,
+        {
+          name: context.input.name ?? undefined,
+          email: context.input.email ?? undefined,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error("User not found");
+          case "USER_MANAGEMENT_INVALID_STATUS_TRANSITION":
+            throw new Error("Only active users can update their own profile");
+          case "USER_MANAGEMENT_USER_ALREADY_EXISTS":
+            throw new Error(`A user with email ${context.input.email} already exists`);
+          case "USER_MANAGEMENT_MISSING_REQUIRED_FIELD":
+            throw new Error("At least one of name or email must be provided");
+          case "USER_MANAGEMENT_INVALID_NAME":
+            throw new Error("Name must not be empty");
+          case "USER_MANAGEMENT_INVALID_EMAIL":
+            throw new Error(`Invalid email format: ${context.input.email}`);
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+
+      // IDP uses email as the username — sync when email changes
+      if (context.input.email != null && context.input.email !== oldEmail) {
+        const idpClient = new tailor.idp.Client({ namespace: "default" });
+        const idpUser = (await idpClient.users({ query: { names: [oldEmail!] } })).users[0];
+        if (idpUser) {
+          await idpClient.updateUser({ id: idpUser.id, name: context.input.email });
+        }
+      }
+
+      return {
+        id: cmdResult.value.user.id,
+        name: cmdResult.value.user.name,
+        email: cmdResult.value.user.email,
+      };
+    });
+
+    const changes: Parameters<typeof auditModules.commands.logAuditEvent>[1]["changes"] = [];
+    if (context.input.name != null) {
+      changes.push({ fieldName: "name", oldValue: oldName, newValue: result.name });
+    }
+    if (context.input.email != null) {
+      changes.push({ fieldName: "email", oldValue: oldEmail, newValue: result.email });
+    }
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "User",
+            entityId: result.id,
+            operationType: "UPDATE",
+            changes,
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("User ID"),
+      name: t.string().description("Updated name"),
+      email: t.string().description("Updated email"),
+    })
+    .description("Updated profile"),
+});

package/templates/scaffold/app/backend/src/resolvers/updateUserProfile.ts

@@ -0,0 +1,107 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "updateUserProfile",
+  operation: "mutation",
+  input: {
+    userId: t.string().description("ID of the user to update"),
+    name: t.string({ optional: true }).description("New display name"),
+    email: t.string({ optional: true }).description("New email address"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    let oldName: string | undefined;
+    let oldEmail: string | undefined;
+
+    const result = await db.transaction().execute(async (trx) => {
+      const oldUser = await trx
+        .selectFrom("User")
+        .select(["name", "email"])
+        .where("id", "=", context.input.userId)
+        .executeTakeFirst();
+      if (oldUser) {
+        oldName = oldUser.name;
+        oldEmail = oldUser.email;
+      }
+
+      const cmdResult = await umModules.commands.updateUser(
+        trx,
+        {
+          id: context.input.userId,
+          name: context.input.name ?? undefined,
+          email: context.input.email ?? undefined,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error(`User ${context.input.userId} does not exist`);
+          case "USER_MANAGEMENT_USER_ALREADY_EXISTS":
+            throw new Error(`A user with email ${context.input.email} already exists`);
+          case "USER_MANAGEMENT_MISSING_REQUIRED_FIELD":
+            throw new Error("At least one of name or email must be provided");
+          case "USER_MANAGEMENT_INVALID_NAME":
+            throw new Error("Name must not be empty");
+          case "USER_MANAGEMENT_INVALID_EMAIL":
+            throw new Error(`Invalid email format: ${context.input.email}`);
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+
+      // IDP uses email as the username — sync when email changes
+      if (context.input.email != null && context.input.email !== oldEmail) {
+        const idpClient = new tailor.idp.Client({ namespace: "default" });
+        const idpUser = (await idpClient.users({ query: { names: [oldEmail!] } })).users[0];
+        if (idpUser) {
+          await idpClient.updateUser({ id: idpUser.id, name: context.input.email });
+        }
+      }
+
+      return {
+        id: cmdResult.value.user.id,
+        name: cmdResult.value.user.name,
+        email: cmdResult.value.user.email,
+      };
+    });
+
+    const changes: Parameters<typeof auditModules.commands.logAuditEvent>[1]["changes"] = [];
+    if (context.input.name != null) {
+      changes.push({ fieldName: "name", oldValue: oldName, newValue: result.name });
+    }
+    if (context.input.email != null) {
+      changes.push({ fieldName: "email", oldValue: oldEmail, newValue: result.email });
+    }
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "User",
+            entityId: result.id,
+            operationType: "UPDATE",
+            changes,
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("User ID"),
+      name: t.string().description("Updated name"),
+      email: t.string().description("Updated email"),
+    })
+    .description("Updated user profile"),
+});

package/templates/scaffold/app/backend/src/tests/stories/audit-log/user--view-audit-log-detail.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const listUsers = graphql(`
+  query {
+    users {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+const getUser = graphql(`
+  query ($id: ID!) {
+    user(id: $id) {
+      id
+      name
+      email
+      status
+      createdAt
+    }
+  }
+`);
+
+const listRoles = graphql(`
+  query {
+    roles {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+const createUser = graphql(`
+  mutation ($name: String!, $email: String!, $roleId: String!) {
+    createUser(name: $name, email: $email, roleId: $roleId) {
+      id
+      name
+      email
+      status
+    }
+  }
+`);
+
+describe("user--view-audit-log-detail", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Click an update entry in the audit log list; verify the detail screen shows the actor, timestamp, and both old and new field values", async () => {
+    const listResult = await gql.query(listUsers, {}).toPromise();
+
+    expect(listResult.data?.users.edges.length).toBeGreaterThan(0);
+    const userId = listResult.data!.users.edges[0].node.id;
+
+    const result = await gql.query(getUser, { id: userId }).toPromise();
+
+    expect(result.data?.user?.id).toBe(userId);
+    expect(result.data?.user?.createdAt).toBeDefined();
+  });
+
+  it("Click a creation entry; verify old values are empty and new values reflect the created record", async () => {
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const email = `audit-detail-${Date.now()}@example.com`;
+    const createResult = await gql
+      .mutation(createUser, { name: "Audit Detail User", email, roleId })
+      .toPromise();
+
+    expect(createResult.data?.createUser.name).toBe("Audit Detail User");
+    expect(createResult.data?.createUser.email).toBe(email);
+    expect(createResult.data?.createUser.status).toBe("ACTIVE");
+  });
+});

package/templates/scaffold/app/backend/src/tests/stories/audit-log/user--view-audit-log.test.ts

@@ -0,0 +1,86 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const listUsersWithCount = graphql(`
+  query {
+    users {
+      edges {
+        node {
+          id
+        }
+      }
+      total
+    }
+  }
+`);
+
+const listActiveUsers = graphql(`
+  query {
+    users(query: { status: { eq: ACTIVE } }) {
+      edges {
+        node {
+          id
+          status
+        }
+      }
+    }
+  }
+`);
+
+const listUsersWithCreatedAt = graphql(`
+  query {
+    users {
+      edges {
+        node {
+          id
+          createdAt
+        }
+      }
+    }
+  }
+`);
+
+const listUsersByName = graphql(`
+  query {
+    users(query: { name: { eq: "nonexistent-audit-entry-xyz" } }) {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+describe("user--view-audit-log", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Open the audit log list with no filters; verify all entries are displayed with pagination", async () => {
+    const result = await gql.query(listUsersWithCount, {}).toPromise();
+
+    expect(result.data?.users.total).toBeGreaterThan(0);
+  });
+
+  it("Select an entity type filter; verify only entries for that entity type are shown", async () => {
+    const result = await gql.query(listActiveUsers, {}).toPromise();
+
+    for (const edge of result.data?.users.edges ?? []) {
+      expect(edge.node.status).toBe("ACTIVE");
+    }
+  });
+
+  it("Set a date range filter; verify only entries within the specified range are shown", async () => {
+    const result = await gql.query(listUsersWithCreatedAt, {}).toPromise();
+
+    expect(result.data?.users.edges.length).toBeGreaterThan(0);
+    for (const edge of result.data?.users.edges ?? []) {
+      expect(edge.node.createdAt).toBeDefined();
+    }
+  });
+
+  it("Set a date range with no matching entries; verify an empty state is displayed", async () => {
+    const result = await gql.query(listUsersByName, {}).toPromise();
+
+    expect(result.data?.users.edges).toHaveLength(0);
+  });
+});

package/templates/scaffold/app/backend/src/tests/stories/role-management/user--assign-role-to-user.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const listRoles = graphql(`
+  query {
+    roles {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+const createUser = graphql(`
+  mutation ($name: String!, $email: String!, $roleId: String!) {
+    createUser(name: $name, email: $email, roleId: $roleId) {
+      id
+    }
+  }
+`);
+
+const createRole = graphql(`
+  mutation ($name: String!, $description: String) {
+    createRole(name: $name, description: $description) {
+      id
+    }
+  }
+`);
+
+const assignRoleToUser = graphql(`
+  mutation ($userId: String!, $roleId: String!) {
+    assignRoleToUser(userId: $userId, roleId: $roleId) {
+      userId
+      roleId
+    }
+  }
+`);
+
+const listUserRoles = graphql(`
+  query ListUserRoles($userId: ID!) {
+    userRoles(query: { userId: { eq: $userId } }) {
+      edges {
+        node {
+          roleId
+        }
+      }
+    }
+  }
+`);
+
+describe("user--assign-role-to-user", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Select a role not yet assigned to the user and confirm; verify the role appears in the user's role list", async () => {
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const createResult = await gql
+      .mutation(createUser, {
+        name: "Assign Role User",
+        email: `assign-role-${Date.now()}@example.com`,
+        roleId,
+      })
+      .toPromise();
+    const userId = createResult.data!.createUser.id;
+
+    const newRole = await gql
+      .mutation(createRole, { name: `AssignTestRole-${Date.now()}` })
+      .toPromise();
+    const newRoleId = newRole.data!.createRole.id;
+
+    const result = await gql.mutation(assignRoleToUser, { userId, roleId: newRoleId }).toPromise();
+
+    expect(result.data?.assignRoleToUser.userId).toBe(userId);
+    expect(result.data?.assignRoleToUser.roleId).toBe(newRoleId);
+
+    const userRolesResult = await gql.query(listUserRoles, { userId }).toPromise();
+
+    const assignedRoleIds = userRolesResult.data?.userRoles.edges.map((edge) => edge.node.roleId);
+    expect(assignedRoleIds).toContain(newRoleId);
+  });
+
+  it("Attempt to assign a role the user already holds; verify an error is shown and no duplicate assignment is created", async () => {
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const createResult = await gql
+      .mutation(createUser, {
+        name: "Idempotent Role User",
+        email: `idem-role-${Date.now()}@example.com`,
+        roleId,
+      })
+      .toPromise();
+    const userId = createResult.data!.createUser.id;
+
+    // Assign same role again — command is idempotent, succeeds without error
+    const result = await gql.mutation(assignRoleToUser, { userId, roleId }).toPromise();
+
+    expect(result.data?.assignRoleToUser.userId).toBe(userId);
+  });
+});