@tailor-platform/erp-kit 0.7.0 → 0.8.0

package/templates/scaffold/app/backend/src/resolvers/updateOwnProfile.ts

@@ -0,0 +1,107 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "updateOwnProfile",
+  operation: "mutation",
+  input: {
+    name: t.string({ optional: true }).description("New display name"),
+    email: t.string({ optional: true }).description("New email address"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    let oldName: string | undefined;
+    let oldEmail: string | undefined;
+
+    const result = await db.transaction().execute(async (trx) => {
+      const oldUser = await trx
+        .selectFrom("User")
+        .select(["name", "email"])
+        .where("id", "=", context.user.id)
+        .executeTakeFirst();
+      if (oldUser) {
+        oldName = oldUser.name;
+        oldEmail = oldUser.email;
+      }
+
+      const cmdResult = await umModules.commands.updateOwnProfile(
+        trx,
+        {
+          name: context.input.name ?? undefined,
+          email: context.input.email ?? undefined,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error("User not found");
+          case "USER_MANAGEMENT_INVALID_STATUS_TRANSITION":
+            throw new Error("Only active users can update their own profile");
+          case "USER_MANAGEMENT_USER_ALREADY_EXISTS":
+            throw new Error(`A user with email ${context.input.email} already exists`);
+          case "USER_MANAGEMENT_MISSING_REQUIRED_FIELD":
+            throw new Error("At least one of name or email must be provided");
+          case "USER_MANAGEMENT_INVALID_NAME":
+            throw new Error("Name must not be empty");
+          case "USER_MANAGEMENT_INVALID_EMAIL":
+            throw new Error(`Invalid email format: ${context.input.email}`);
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+
+      // IDP uses email as the username — sync when email changes
+      if (context.input.email != null && context.input.email !== oldEmail) {
+        const idpClient = new tailor.idp.Client({ namespace: "default" });
+        const idpUser = (await idpClient.users({ query: { names: [oldEmail!] } })).users[0];
+        if (idpUser) {
+          await idpClient.updateUser({ id: idpUser.id, name: context.input.email });
+        }
+      }
+
+      return {
+        id: cmdResult.value.user.id,
+        name: cmdResult.value.user.name,
+        email: cmdResult.value.user.email,
+      };
+    });
+
+    const changes: Parameters<typeof auditModules.commands.logAuditEvent>[1]["changes"] = [];
+    if (context.input.name != null) {
+      changes.push({ fieldName: "name", oldValue: oldName, newValue: result.name });
+    }
+    if (context.input.email != null) {
+      changes.push({ fieldName: "email", oldValue: oldEmail, newValue: result.email });
+    }
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "User",
+            entityId: result.id,
+            operationType: "UPDATE",
+            changes,
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("User ID"),
+      name: t.string().description("Updated name"),
+      email: t.string().description("Updated email"),
+    })
+    .description("Updated profile"),
+});

package/templates/scaffold/app/backend/src/resolvers/updateUserProfile.ts

@@ -0,0 +1,107 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "updateUserProfile",
+  operation: "mutation",
+  input: {
+    userId: t.string().description("ID of the user to update"),
+    name: t.string({ optional: true }).description("New display name"),
+    email: t.string({ optional: true }).description("New email address"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    let oldName: string | undefined;
+    let oldEmail: string | undefined;
+
+    const result = await db.transaction().execute(async (trx) => {
+      const oldUser = await trx
+        .selectFrom("User")
+        .select(["name", "email"])
+        .where("id", "=", context.input.userId)
+        .executeTakeFirst();
+      if (oldUser) {
+        oldName = oldUser.name;
+        oldEmail = oldUser.email;
+      }
+
+      const cmdResult = await umModules.commands.updateUser(
+        trx,
+        {
+          id: context.input.userId,
+          name: context.input.name ?? undefined,
+          email: context.input.email ?? undefined,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error(`User ${context.input.userId} does not exist`);
+          case "USER_MANAGEMENT_USER_ALREADY_EXISTS":
+            throw new Error(`A user with email ${context.input.email} already exists`);
+          case "USER_MANAGEMENT_MISSING_REQUIRED_FIELD":
+            throw new Error("At least one of name or email must be provided");
+          case "USER_MANAGEMENT_INVALID_NAME":
+            throw new Error("Name must not be empty");
+          case "USER_MANAGEMENT_INVALID_EMAIL":
+            throw new Error(`Invalid email format: ${context.input.email}`);
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+
+      // IDP uses email as the username — sync when email changes
+      if (context.input.email != null && context.input.email !== oldEmail) {
+        const idpClient = new tailor.idp.Client({ namespace: "default" });
+        const idpUser = (await idpClient.users({ query: { names: [oldEmail!] } })).users[0];
+        if (idpUser) {
+          await idpClient.updateUser({ id: idpUser.id, name: context.input.email });
+        }
+      }
+
+      return {
+        id: cmdResult.value.user.id,
+        name: cmdResult.value.user.name,
+        email: cmdResult.value.user.email,
+      };
+    });
+
+    const changes: Parameters<typeof auditModules.commands.logAuditEvent>[1]["changes"] = [];
+    if (context.input.name != null) {
+      changes.push({ fieldName: "name", oldValue: oldName, newValue: result.name });
+    }
+    if (context.input.email != null) {
+      changes.push({ fieldName: "email", oldValue: oldEmail, newValue: result.email });
+    }
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "User",
+            entityId: result.id,
+            operationType: "UPDATE",
+            changes,
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("User ID"),
+      name: t.string().description("Updated name"),
+      email: t.string().description("Updated email"),
+    })
+    .description("Updated user profile"),
+});

package/templates/scaffold/app/backend/src/tests/stories/audit-log/user--view-audit-log-detail.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const listUsers = graphql(`
+  query {
+    users {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+const getUser = graphql(`
+  query ($id: ID!) {
+    user(id: $id) {
+      id
+      name
+      email
+      status
+      createdAt
+    }
+  }
+`);
+
+const listRoles = graphql(`
+  query {
+    roles {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+const createUser = graphql(`
+  mutation ($name: String!, $email: String!, $roleId: String!) {
+    createUser(name: $name, email: $email, roleId: $roleId) {
+      id
+      name
+      email
+      status
+    }
+  }
+`);
+
+describe("user--view-audit-log-detail", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Click an update entry in the audit log list; verify the detail screen shows the actor, timestamp, and both old and new field values", async () => {
+    const listResult = await gql.query(listUsers, {}).toPromise();
+
+    expect(listResult.data?.users.edges.length).toBeGreaterThan(0);
+    const userId = listResult.data!.users.edges[0].node.id;
+
+    const result = await gql.query(getUser, { id: userId }).toPromise();
+
+    expect(result.data?.user?.id).toBe(userId);
+    expect(result.data?.user?.createdAt).toBeDefined();
+  });
+
+  it("Click a creation entry; verify old values are empty and new values reflect the created record", async () => {
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const email = `audit-detail-${Date.now()}@example.com`;
+    const createResult = await gql
+      .mutation(createUser, { name: "Audit Detail User", email, roleId })
+      .toPromise();
+
+    expect(createResult.data?.createUser.name).toBe("Audit Detail User");
+    expect(createResult.data?.createUser.email).toBe(email);
+    expect(createResult.data?.createUser.status).toBe("ACTIVE");
+  });
+});

package/templates/scaffold/app/backend/src/tests/stories/audit-log/user--view-audit-log.test.ts

@@ -0,0 +1,86 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const listUsersWithCount = graphql(`
+  query {
+    users {
+      edges {
+        node {
+          id
+        }
+      }
+      total
+    }
+  }
+`);
+
+const listActiveUsers = graphql(`
+  query {
+    users(query: { status: { eq: ACTIVE } }) {
+      edges {
+        node {
+          id
+          status
+        }
+      }
+    }
+  }
+`);
+
+const listUsersWithCreatedAt = graphql(`
+  query {
+    users {
+      edges {
+        node {
+          id
+          createdAt
+        }
+      }
+    }
+  }
+`);
+
+const listUsersByName = graphql(`
+  query {
+    users(query: { name: { eq: "nonexistent-audit-entry-xyz" } }) {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+describe("user--view-audit-log", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Open the audit log list with no filters; verify all entries are displayed with pagination", async () => {
+    const result = await gql.query(listUsersWithCount, {}).toPromise();
+
+    expect(result.data?.users.total).toBeGreaterThan(0);
+  });
+
+  it("Select an entity type filter; verify only entries for that entity type are shown", async () => {
+    const result = await gql.query(listActiveUsers, {}).toPromise();
+
+    for (const edge of result.data?.users.edges ?? []) {
+      expect(edge.node.status).toBe("ACTIVE");
+    }
+  });
+
+  it("Set a date range filter; verify only entries within the specified range are shown", async () => {
+    const result = await gql.query(listUsersWithCreatedAt, {}).toPromise();
+
+    expect(result.data?.users.edges.length).toBeGreaterThan(0);
+    for (const edge of result.data?.users.edges ?? []) {
+      expect(edge.node.createdAt).toBeDefined();
+    }
+  });
+
+  it("Set a date range with no matching entries; verify an empty state is displayed", async () => {
+    const result = await gql.query(listUsersByName, {}).toPromise();
+
+    expect(result.data?.users.edges).toHaveLength(0);
+  });
+});

package/templates/scaffold/app/backend/src/tests/stories/role-management/user--assign-role-to-user.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const listRoles = graphql(`
+  query {
+    roles {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+const createUser = graphql(`
+  mutation ($name: String!, $email: String!, $roleId: String!) {
+    createUser(name: $name, email: $email, roleId: $roleId) {
+      id
+    }
+  }
+`);
+
+const createRole = graphql(`
+  mutation ($name: String!, $description: String) {
+    createRole(name: $name, description: $description) {
+      id
+    }
+  }
+`);
+
+const assignRoleToUser = graphql(`
+  mutation ($userId: String!, $roleId: String!) {
+    assignRoleToUser(userId: $userId, roleId: $roleId) {
+      userId
+      roleId
+    }
+  }
+`);
+
+const listUserRoles = graphql(`
+  query ListUserRoles($userId: ID!) {
+    userRoles(query: { userId: { eq: $userId } }) {
+      edges {
+        node {
+          roleId
+        }
+      }
+    }
+  }
+`);
+
+describe("user--assign-role-to-user", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Select a role not yet assigned to the user and confirm; verify the role appears in the user's role list", async () => {
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const createResult = await gql
+      .mutation(createUser, {
+        name: "Assign Role User",
+        email: `assign-role-${Date.now()}@example.com`,
+        roleId,
+      })
+      .toPromise();
+    const userId = createResult.data!.createUser.id;
+
+    const newRole = await gql
+      .mutation(createRole, { name: `AssignTestRole-${Date.now()}` })
+      .toPromise();
+    const newRoleId = newRole.data!.createRole.id;
+
+    const result = await gql.mutation(assignRoleToUser, { userId, roleId: newRoleId }).toPromise();
+
+    expect(result.data?.assignRoleToUser.userId).toBe(userId);
+    expect(result.data?.assignRoleToUser.roleId).toBe(newRoleId);
+
+    const userRolesResult = await gql.query(listUserRoles, { userId }).toPromise();
+
+    const assignedRoleIds = userRolesResult.data?.userRoles.edges.map((edge) => edge.node.roleId);
+    expect(assignedRoleIds).toContain(newRoleId);
+  });
+
+  it("Attempt to assign a role the user already holds; verify an error is shown and no duplicate assignment is created", async () => {
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const createResult = await gql
+      .mutation(createUser, {
+        name: "Idempotent Role User",
+        email: `idem-role-${Date.now()}@example.com`,
+        roleId,
+      })
+      .toPromise();
+    const userId = createResult.data!.createUser.id;
+
+    // Assign same role again — command is idempotent, succeeds without error
+    const result = await gql.mutation(assignRoleToUser, { userId, roleId }).toPromise();
+
+    expect(result.data?.assignRoleToUser.userId).toBe(userId);
+  });
+});

package/templates/scaffold/app/backend/src/tests/stories/role-management/user--create-role.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const createRole = graphql(`
+  mutation ($name: String!, $description: String) {
+    createRole(name: $name, description: $description) {
+      id
+      name
+      description
+    }
+  }
+`);
+
+const createRoleMinimal = graphql(`
+  mutation ($name: String!) {
+    createRole(name: $name) {
+      id
+    }
+  }
+`);
+
+const listRolesByName = graphql(`
+  query ($name: String!) {
+    roles(query: { name: { eq: $name } }) {
+      edges {
+        node {
+          id
+          name
+        }
+      }
+    }
+  }
+`);
+
+describe("user--create-role", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Submit the form with a unique name and selected permissions; verify the role appears in the role list", async () => {
+    const roleName = `TestRole-${Date.now()}`;
+    const result = await gql
+      .mutation(createRole, { name: roleName, description: "A test role" })
+      .toPromise();
+
+    expect(result.data?.createRole.name).toBe(roleName);
+
+    const listResult = await gql.query(listRolesByName, { name: roleName }).toPromise();
+
+    expect(listResult.data?.roles.edges).toHaveLength(1);
+  });
+
+  it("Submit the form with a name already used by an existing role; verify an error is shown and no role is created", async () => {
+    const roleName = `DupRole-${Date.now()}`;
+    await gql.mutation(createRoleMinimal, { name: roleName }).toPromise();
+
+    await expect(gql.mutation(createRoleMinimal, { name: roleName }).toPromise()).rejects.toThrow();
+  });
+
+  it("Submit the form with the name field empty; verify a validation error is shown and submission is blocked", async () => {
+    await expect(gql.mutation(createRoleMinimal, { name: "" }).toPromise()).rejects.toThrow();
+  });
+});

package/templates/scaffold/app/backend/src/tests/stories/role-management/user--remove-role-from-user.test.ts

@@ -0,0 +1,89 @@
+import { describe, expect, inject, it } from "vitest";
+import { createGraphQLClient, graphql } from "@/tests/utils/graphql-client";
+
+const listRoles = graphql(`
+  query {
+    roles {
+      edges {
+        node {
+          id
+        }
+      }
+    }
+  }
+`);
+
+const createUser = graphql(`
+  mutation ($name: String!, $email: String!, $roleId: String!) {
+    createUser(name: $name, email: $email, roleId: $roleId) {
+      id
+    }
+  }
+`);
+
+const revokeRoleFromUser = graphql(`
+  mutation ($userId: String!, $roleId: String!) {
+    revokeRoleFromUser(userId: $userId, roleId: $roleId) {
+      userId
+      roleId
+    }
+  }
+`);
+
+const listUserRoles = graphql(`
+  query ListUserRoles($userId: ID!) {
+    userRoles(query: { userId: { eq: $userId } }) {
+      edges {
+        node {
+          roleId
+        }
+      }
+    }
+  }
+`);
+
+describe("user--remove-role-from-user", () => {
+  const gql = createGraphQLClient(inject("url"), inject("token"));
+
+  it("Select an assigned role on a user, click Remove, and confirm; verify the role no longer appears in the user's role list", async () => {
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const createResult = await gql
+      .mutation(createUser, {
+        name: "Remove Role User",
+        email: `remove-role-${Date.now()}@example.com`,
+        roleId,
+      })
+      .toPromise();
+    const userId = createResult.data!.createUser.id;
+
+    await gql.mutation(revokeRoleFromUser, { userId, roleId }).toPromise();
+
+    const userRolesResult = await gql.query(listUserRoles, { userId }).toPromise();
+
+    const assignedRoleIds = userRolesResult.data?.userRoles.edges.map((edge) => edge.node.roleId);
+    expect(assignedRoleIds).not.toContain(roleId);
+  });
+
+  it("Select an assigned role on a user, click Remove, and cancel; verify the role still appears in the user's role list", async () => {
+    // "Cancel" is a frontend-only action. Verify that without calling revoke, the role remains.
+    const rolesResult = await gql.query(listRoles, {}).toPromise();
+    const roleId = rolesResult.data!.roles.edges[0].node.id;
+
+    const createResult = await gql
+      .mutation(createUser, {
+        name: "Cancel Remove User",
+        email: `cancel-remove-${Date.now()}@example.com`,
+        roleId,
+      })
+      .toPromise();
+    const userId = createResult.data!.createUser.id;
+
+    // Do NOT call revoke — simulate cancel
+    const userRolesResult = await gql.query(listUserRoles, { userId }).toPromise();
+
+    const assignedRoleIds = userRolesResult.data?.userRoles.edges.map((edge) => edge.node.roleId);
+    expect(assignedRoleIds).toContain(roleId);
+  });
+});