@team-codeme/crud-forge 0.0.0-stage → 1.0.1

package/test/auth-interceptor.js

@@ -0,0 +1,84 @@
+// Behavioral tests of the emitted TypeScript without Angular DI or a live account.
+// Node 24+ is also required by the generated Fuse app.
+const assert = require('assert/strict');
+const fs = require('fs');
+const path = require('path');
+const vm = require('vm');
+const { stripTypeScriptTypes } = require('module');
+const rx = require('rxjs');
+
+class HttpErrorResponse extends Error {
+  constructor(status, error = {}, url = '/services/example/api/items') {
+    super('HTTP error'); this.status = status; this.error = error; this.url = url;
+  }
+}
+class Headers {
+  constructor(values = {}) { this.values = values; }
+  delete(key) { const values = { ...this.values }; delete values[key]; return new Headers(values); }
+  set(key, value) { return new Headers({ ...this.values, [key]: value }); }
+}
+function load(name, exported, context) {
+  const text = fs.readFileSync(path.join(__dirname, '../src/templates/angular/auth', name), 'utf8')
+    .replace(/^import .*?;\n/gm, '').replace(/^@Injectable.*\n/gm, '').replace(/^export /gm, '');
+  const module = { exports: {} };
+  vm.runInNewContext(stripTypeScriptTypes(text) + `\nmodule.exports = ${exported};`, { module, ...rx, HttpErrorResponse, ...context });
+  return module.exports;
+}
+
+async function test() {
+  if (!stripTypeScriptTypes) throw new Error('Auth behavior tests require Node 24+.');
+  const Auth = load('auth.service.ts.ejs', 'AuthService', {});
+  const service = Object.create(Auth.prototype);
+  const token = '/realms/PMB-DEV/protocol/openid-connect/token';
+  assert.equal(service.isTerminalAuthError(new HttpErrorResponse(400, { error: 'invalid_grant' }, token)), true);
+  assert.equal(service.isTerminalAuthError(new HttpErrorResponse(401, {}, token)), true);
+  for (const error of [new HttpErrorResponse(403, {}, token), new HttpErrorResponse(500, {}, token),
+    new HttpErrorResponse(0, {}, token), new HttpErrorResponse(401), new HttpErrorResponse(400, {})]) {
+    assert.equal(service.isTerminalAuthError(error), false);
+  }
+
+  async function scenario({ expired = false, refreshError, responses, url = '/services/example/api/items' }) {
+    let signOuts = 0, refreshes = 0, calls = 0;
+    const sent = [];
+    const auth = {
+      accessToken: 'old', refreshToken: 'refresh', isAuthenticated: true,
+      resetInactivityTimer() {}, tryStartDisabledAccountLockFromAuthError() { return false; },
+      isTerminalAuthError: error => service.isTerminalAuthError(error),
+      signOut() { signOuts++; },
+      refreshAccessToken() {
+        refreshes++;
+        if (refreshError) return rx.throwError(() => refreshError);
+        auth.accessToken = 'fresh'; return rx.of({});
+      },
+    };
+    const interceptor = load('auth.interceptor.ts.ejs', 'authInterceptor', {
+      AuthService: {}, inject: () => auth,
+      environment: { sso: token, useMockAuth: false }, AuthUtils: { shouldRefreshAccessToken: () => expired },
+    });
+    const request = { url, headers: new Headers({ Cookie: 'discard', 'X-Tenant-ID': 'discard' }), clone(options) { return { ...this, ...options }; } };
+    let error;
+    try {
+      await rx.firstValueFrom(interceptor(request, req => {
+        sent.push(req.headers.values); const response = responses[calls++];
+        return response instanceof Error ? rx.throwError(() => response) : rx.of(response);
+      }));
+    } catch (caught) { error = caught; }
+    for (const headers of sent) { assert(!headers.Cookie); assert(!headers['X-Tenant-ID']); }
+    return { signOuts, refreshes, calls, sent, error };
+  }
+  let result = await scenario({ responses: [new HttpErrorResponse(401), { ok: true }] });
+  assert.equal(result.refreshes, 1); assert.equal(result.calls, 2); assert.equal(result.signOuts, 0);
+  assert.equal(result.sent[1].Authorization, 'Bearer fresh');
+  result = await scenario({ responses: [new HttpErrorResponse(403)] });
+  assert.equal(result.refreshes, 0); assert.equal(result.signOuts, 0); assert(result.error);
+  result = await scenario({ expired: true, responses: [new HttpErrorResponse(401)] });
+  assert.equal(result.refreshes, 1); assert.equal(result.calls, 1); assert.equal(result.signOuts, 0); assert(result.error);
+  result = await scenario({ expired: true, refreshError: new HttpErrorResponse(500, {}, token), responses: [] });
+  assert.equal(result.calls, 0); assert.equal(result.signOuts, 0); assert(result.error);
+  result = await scenario({ expired: true, refreshError: new HttpErrorResponse(400, { error: 'invalid_grant' }, token), responses: [] });
+  assert.equal(result.signOuts, 1); assert.equal(result.calls, 0);
+  result = await scenario({ url: token, responses: [new HttpErrorResponse(401, {}, token)] });
+  assert.equal(result.refreshes, 0); assert.equal(result.signOuts, 0); assert(!result.sent[0].Authorization);
+  console.log('Auth behavior passed: one refresh/retry, bearer headers, terminal grant rejection, and session preservation on API/transport errors.');
+}
+test().catch(error => { console.error(error); process.exitCode = 1; });

package/test/auth-provision-checks.js

@@ -0,0 +1,297 @@
+const fs = require('fs-extra');
+const os = require('os');
+const path = require('path');
+const { loadEnvFile, resolveEnv } = require('../src/config/env-refs');
+const { validateAuthConfig, AuthConfigError, deriveAuthUrls, stripSecretsForGenerate } = require('../src/config/auth-config');
+const defaultValues = require('../src/config/default-values');
+
+async function runAuthProvisionChecks() {
+  console.log('🧪 Testing auth provision config, env refs, and bootstrap exports...');
+
+  if (defaultValues.auth.provision.enabled !== false) {
+    throw new Error('❌ Default auth.provision.enabled must be false so generate never mutates Keycloak.');
+  }
+  if (defaultValues.auth.provider !== 'none') {
+    throw new Error('❌ Default auth.provider must remain none.');
+  }
+  if (String(defaultValues.auth.serverUrl || '') !== '') {
+    throw new Error('❌ Default auth.serverUrl must stay empty (no QA host in reusable defaults).');
+  }
+
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'cforge-env-'));
+  const envFile = path.join(tmpDir, '.env.qa');
+  process.env.KEEP_ME = 'original';
+  await fs.writeFile(envFile, 'KEEP_ME=overridden\nNEW_QA_VAR=from-file\n# comment\nexport OTHER=1\n');
+  loadEnvFile(envFile);
+  if (process.env.KEEP_ME !== 'original') {
+    throw new Error('❌ loadEnvFile overrode an existing environment variable.');
+  }
+  if (resolveEnv('NEW_QA_VAR') !== 'from-file') {
+    throw new Error('❌ loadEnvFile did not load NEW_QA_VAR.');
+  }
+
+  validateAuthConfig({ auth: { provider: 'none' } });
+  validateAuthConfig({ auth: { provider: 'keycloak', useMockAuth: true } });
+
+  let liveFailed = false;
+  try {
+    validateAuthConfig({ auth: { provider: 'keycloak', useMockAuth: false, realm: 'x', clientId: 'y' } });
+  } catch (err) {
+    liveFailed = err instanceof AuthConfigError && err.message.includes('auth.serverUrl');
+  }
+  if (!liveFailed) {
+    throw new Error('❌ Live Keycloak config must require auth.serverUrl.');
+  }
+
+  let missingEnvFailed = false;
+  delete process.env.KEYCLOAK_ADMIN_USERNAME;
+  delete process.env.KEYCLOAK_ADMIN_PASSWORD;
+  try {
+    validateAuthConfig(
+      {
+        auth: {
+          provider: 'keycloak',
+          serverUrl: 'http://example.invalid',
+          realm: 'demo',
+          provision: {
+            enabled: true,
+            adapter: 'keycloak-admin-rest',
+            adminUsernameEnv: 'KEYCLOAK_ADMIN_USERNAME',
+            adminPasswordEnv: 'KEYCLOAK_ADMIN_PASSWORD',
+          },
+        },
+      },
+      { requireProvision: true }
+    );
+  } catch (err) {
+    missingEnvFailed = err instanceof AuthConfigError && err.message.includes('KEYCLOAK_ADMIN_USERNAME');
+    if (JSON.stringify(err.message).includes('crud')) {
+      throw new Error('❌ Auth errors must not include secret values.');
+    }
+  }
+  if (!missingEnvFailed) {
+    throw new Error('❌ Provision validation must name the missing KEYCLOAK_ADMIN_USERNAME env var.');
+  }
+
+  const stripped = stripSecretsForGenerate({
+    clientSecret: 'super-secret',
+    provision: { users: [{ username: 'a', password: 'nope', passwordEnv: 'X' }] },
+  });
+  if (stripped.clientSecret || stripped.provision.users[0].password) {
+    throw new Error('❌ stripSecretsForGenerate left secrets in place.');
+  }
+
+  const generateJs = await fs.readFile(path.join(__dirname, '..', 'src/commands/generate.js'), 'utf8');
+  const generatorJs = await fs.readFile(path.join(__dirname, '..', 'src/generator/index.js'), 'utf8');
+  if (!generateJs.includes('stripSecretsForGenerate') || !generatorJs.includes('stripSecretsForGenerate')) {
+    throw new Error('❌ generate CLI and generator engine must strip secrets before writing templates.');
+  }
+
+  const { parseJdl } = require('../src/parser/jdl-parser');
+  const { generate } = require('../src/generator');
+  const secretOut = path.join(tmpDir, 'secret-gen');
+  const genConfig = JSON.parse(JSON.stringify(defaultValues));
+  genConfig.output.directory = secretOut;
+  genConfig.api.microservice = 'book-service';
+  genConfig.auth = {
+    provider: 'keycloak',
+    useMockAuth: true,
+    clientSecret: 'MUST-NOT-EMIT-SECRET',
+    provision: {
+      enabled: false,
+      users: [{ username: 'seed', password: 'MUST-NOT-EMIT-PASSWORD', passwordEnv: 'X' }],
+    },
+  };
+  const parsed = parseJdl('entity Book { name String }', genConfig);
+  await generate(parsed, genConfig);
+  const leaked = [];
+  async function scan(dir) {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await scan(full);
+        continue;
+      }
+      const text = await fs.readFile(full, 'utf8');
+      if (text.includes('MUST-NOT-EMIT-SECRET') || text.includes('MUST-NOT-EMIT-PASSWORD')) {
+        leaked.push(path.relative(secretOut, full));
+      }
+    }
+  }
+  await scan(secretOut);
+  if (leaked.length) {
+    throw new Error(`❌ Generator emitted secrets into: ${leaked.join(', ')}`);
+  }
+
+  const derived = deriveAuthUrls({ serverUrl: 'http://kc.example/', realm: 'CRUD-FORDGE' });
+  if (derived.issuerUrl !== 'http://kc.example/realms/CRUD-FORDGE') {
+    throw new Error('❌ deriveAuthUrls did not normalize issuerUrl.');
+  }
+
+  const fuseRuntimeSrc = await fs.readFile(path.join(__dirname, '..', 'src/generator/fuse-runtime.js'), 'utf8');
+  if (!fuseRuntimeSrc.includes("parsed['/realms']") || !fuseRuntimeSrc.includes('/services/keycloak-admin')) {
+    throw new Error('❌ Live Keycloak proxy must wire /realms + /services/keycloak-admin (middleware).');
+  }
+  if (fuseRuntimeSrc.includes("parsed['/admin/realms'] =")) {
+    throw new Error('❌ Live proxy must not assign /admin/realms (native Keycloak); use Admin Service /api/v1.');
+  }
+
+  const { applyFuseRuntimePack, normalizeServices, resolveProxyFiles } = require('../src/generator/fuse-runtime');
+  const normalized = normalizeServices({
+    identityaccessmodule: 'http://62.84.188.166:30084',
+    'book-service': { prod: 'http://prod:1', dev: 'http://dev:2', pathRewrite: '/book-service' },
+  });
+  if (normalized.length !== 2 || normalized[0].proxyPath !== '/services/identityaccessmodule') {
+    throw new Error('❌ normalizeServices failed for string service entries.');
+  }
+  if (resolveProxyFiles('prod').join() !== 'proxy.conf.json' || resolveProxyFiles('dev').join() !== 'proxy.dev.conf.json') {
+    throw new Error('❌ resolveProxyFiles must map prod→proxy.conf.json and dev→proxy.dev.conf.json.');
+  }
+
+  const runtimeOut = path.join(tmpDir, 'runtime-gen');
+  await fs.copy(path.join(__dirname, '..', 'fuse-starter-pack/fuse-v21.1/src/environments'), path.join(runtimeOut, 'src/environments'));
+  await fs.copy(path.join(__dirname, '..', 'fuse-starter-pack/fuse-v21.1/proxy.conf.json'), path.join(runtimeOut, 'proxy.conf.json'));
+  await fs.copy(path.join(__dirname, '..', 'fuse-starter-pack/fuse-v21.1/proxy.dev.conf.json'), path.join(runtimeOut, 'proxy.dev.conf.json'));
+  const runtimeConfig = {
+    fuse: { enabled: true },
+    api: {
+      baseUrl: '/api',
+      services: { identityaccessmodule: 'http://62.84.188.166:30084' },
+    },
+    proxy: { write: 'prod' },
+    auth: {
+      provider: 'keycloak',
+      serverUrl: 'http://62.84.188.166:31740',
+      realm: 'CRUD-FORDGE',
+      clientId: 'crudforge-client-QA',
+      useMockAuth: false,
+      forwardedProto: 'https',
+      provision: { adminServiceUrl: 'http://62.84.188.166:31740/' },
+    },
+  };
+  applyFuseRuntimePack({
+    outputDir: runtimeOut,
+    config: runtimeConfig,
+    writeOrPreview: (file, content) => fs.writeFileSync(file, content),
+  });
+  const envText = await fs.readFile(path.join(runtimeOut, 'src/environments/environment.ts'), 'utf8');
+  if (!envText.includes("kcClientId: 'crudforge-client-QA'") || !envText.includes('identityaccessmodule')) {
+    throw new Error('❌ Fuse runtime did not write Keycloak + services into environment.ts.');
+  }
+  if (envText.includes('clientSecret') || envText.includes('PASSWORD') || envText.includes(':30080')) {
+    throw new Error('❌ Fuse runtime must not emit secrets or native Keycloak :30080.');
+  }
+  const prodProxy = JSON.parse(await fs.readFile(path.join(runtimeOut, 'proxy.conf.json'), 'utf8'));
+  const devProxy = JSON.parse(await fs.readFile(path.join(runtimeOut, 'proxy.dev.conf.json'), 'utf8'));
+  if (!prodProxy['/services/identityaccessmodule'] || !prodProxy['/realms']) {
+    throw new Error('❌ prod proxy missing service or /realms entries.');
+  }
+  if (prodProxy['/admin/realms'] || String(JSON.stringify(prodProxy)).includes(':30080')) {
+    throw new Error('❌ prod proxy must not use /admin/realms or Keycloak :30080.');
+  }
+  if (!prodProxy['/services/keycloak-admin'] || !String(prodProxy['/services/keycloak-admin'].target || '').includes('31740')) {
+    throw new Error('❌ prod proxy missing Keycloak admin-service (/services/keycloak-admin → :31740).');
+  }
+  if (!String(prodProxy['/realms'].target || '').includes('31740')) {
+    throw new Error('❌ prod /realms must target Admin Service :31740.');
+  }
+  if (!envText.includes("kcAdminServiceUrl: '/services/keycloak-admin'") || !envText.includes('useKeycloakAdminService: true')) {
+    throw new Error('❌ environment.ts must expose relative kcAdminServiceUrl + useKeycloakAdminService.');
+  }
+  if (devProxy['/services/identityaccessmodule']) {
+    throw new Error('❌ proxy.write=prod must not update proxy.dev.conf.json services.');
+  }
+
+  // Developer generate via config file (preferences) must wire the same proxies.
+  const { generateFromSource } = require('../src/index');
+  const cfgGenOut = path.join(tmpDir, 'cfg-gen-app');
+  await fs.ensureDir(cfgGenOut);
+  const prefsPath = path.join(tmpDir, 'dev-keycloak.yml');
+  await fs.writeFile(
+    prefsPath,
+    `
+fuse:
+  enabled: true
+  cleanLayout: true
+  starterPackPath: "${path.join(__dirname, '..', 'fuse-starter-pack', 'fuse-v21.1').replace(/\\/g, '/')}"
+output:
+  directory: "${cfgGenOut.replace(/\\/g, '/')}"
+  overwritePolicy: overwrite
+proxy:
+  write: both
+auth:
+  provider: keycloak
+  serverUrl: http://62.84.188.166:31740
+  realm: CRUD-FORDGE
+  clientId: crudforge-client-QA
+  useMockAuth: false
+  forwardedProto: https
+  provision:
+    enabled: false
+    adapter: admin-service
+    adminServiceUrl: http://62.84.188.166:31740/
+api:
+  baseUrl: /api
+  microservice: book-service
+`.trim()
+  );
+  process.env.KEYCLOAK_ADMIN_USERNAME = process.env.KEYCLOAK_ADMIN_USERNAME || 'crud';
+  process.env.KEYCLOAK_ADMIN_PASSWORD = process.env.KEYCLOAK_ADMIN_PASSWORD || 'crud';
+  const fixture = await fs.readFile(path.join(__dirname, 'fixtures/mock.jdl'), 'utf8');
+  await generateFromSource(fixture, {
+    filePath: path.join(__dirname, 'fixtures/mock.jdl'),
+    configPath: prefsPath,
+    outputDirectory: cfgGenOut,
+    fuse: { enabled: true, cleanLayout: true },
+    auth: {
+      provider: 'keycloak',
+      useMockAuth: false,
+      serverUrl: 'http://62.84.188.166:31740',
+      realm: 'CRUD-FORDGE',
+      clientId: 'crudforge-client-QA',
+      forwardedProto: 'https',
+      provision: { enabled: false, adapter: 'admin-service', adminServiceUrl: 'http://62.84.188.166:31740/' },
+    },
+    proxy: { write: 'both' },
+  });
+  const cfgProxy = JSON.parse(await fs.readFile(path.join(cfgGenOut, 'proxy.conf.json'), 'utf8'));
+  const cfgDevProxy = JSON.parse(await fs.readFile(path.join(cfgGenOut, 'proxy.dev.conf.json'), 'utf8'));
+  const cfgEnv = await fs.readFile(path.join(cfgGenOut, 'src/environments/environment.ts'), 'utf8');
+  for (const proxy of [cfgProxy, cfgDevProxy]) {
+    if (!proxy['/realms'] || !proxy['/services/keycloak-admin']) {
+      throw new Error('❌ Config-file Keycloak generate missing /realms or /services/keycloak-admin in proxy.');
+    }
+    if (proxy['/admin/realms'] || String(JSON.stringify(proxy)).includes(':30080')) {
+      throw new Error('❌ Config-file generate must not proxy native Keycloak :30080.');
+    }
+    if (!String(proxy['/realms'].target).includes('31740') || !String(proxy['/services/keycloak-admin'].target).includes('31740')) {
+      throw new Error('❌ Config-file Keycloak generate proxy targets must be Admin Service :31740.');
+    }
+  }
+  if (!cfgEnv.includes('useMockAuth: false') || !cfgEnv.includes("kcAdminServiceUrl: '/services/keycloak-admin'")) {
+    throw new Error('❌ Config-file Keycloak generate environment.ts is not live-wired.');
+  }
+
+  const bootstrap = require('../src/provision/bootstrap');
+  if (typeof bootstrap.runBootstrap !== 'function' || typeof bootstrap.runCleanup !== 'function') {
+    throw new Error('❌ src/provision/bootstrap.js must export runBootstrap and runCleanup.');
+  }
+
+  const exampleEnv = path.join(__dirname, '..', '.env.qa.example');
+  if (!fs.existsSync(exampleEnv)) {
+    throw new Error('❌ Missing committed .env.qa.example');
+  }
+  const exampleText = await fs.readFile(exampleEnv, 'utf8');
+  if (exampleText.includes('=crud') && exampleText.match(/PASSWORD=.+/)) {
+    const assigned = exampleText.split('\n').filter((line) => /PASSWORD=.+/.test(line) && !line.includes('your-'));
+    if (assigned.some((line) => !line.includes('your-') && !line.includes('change-me') && line.split('=')[1])) {
+      // placeholders are fine
+    }
+  }
+
+  await fs.remove(tmpDir);
+  console.log('✅ Auth provision configuration, env refs, and bootstrap exports validated.');
+}
+
+module.exports = { runAuthProvisionChecks };

package/test/field-preferences.js

@@ -0,0 +1,145 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const { stripTypeScriptTypes } = require('node:module');
+const { validateFieldPreferences, entityFieldSettings } = require('../src/config/field-preferences');
+const { validateConfig } = require('../src/config/load-config');
+
+function load(name, exported, context = {}) {
+  let source = fs.readFileSync(path.join(__dirname, '../src/templates/angular', name), 'utf8')
+    .replace(/^import[\s\S]*?;\n/gm, '').replace(/@Directive\(\{[\s\S]*?\n\}\)\n/, '')
+    .replace(/@Input\(\) /g, '').replace(/^@Injectable.*\n/gm, '').replace(/^export /gm, '');
+  const module = { exports: {} };
+  vm.runInNewContext(stripTypeScriptTypes(source) + `\nmodule.exports = ${exported};`, {module, ...context});
+  return module.exports;
+}
+const entity = { name: 'Province', fields: [
+  {fieldName:'code',fieldType:'String'}, {fieldName:'description',fieldType:'TextBlob'},
+  {fieldName:'count',fieldType:'Integer'}, {fieldName:'state',fieldType:'State',fieldTypeIsEnum:true},
+  {fieldName:'createdBy',fieldType:'String'},
+] };
+const config = format => ({fields:{entities:{Province:{fields:{code:{inputFormat:format}}}}}});
+for(const format of ['none','uppercase','lowercase']) validateFieldPreferences(config(format),[entity],'/example/config.yml');
+assert.throws(()=>validateConfig(config('titlecase'),'/example/config.yml'), /config.yml.*code.inputFormat.*uppercase/);
+assert.throws(()=>validateFieldPreferences(config('none'),[], '/example/config.yml'), /Province.*unknown entity/);
+for(const field of ['count','state','createdBy','missing']) {
+  assert.throws(()=>validateFieldPreferences({fields:{entities:{Province:{fields:{[field]:{inputFormat:'uppercase'}}}}}},[entity]), /incompatible|unknown field/);
+}
+assert.equal(entityFieldSettings({}, entity).code.inputFormat,'none');
+assert.equal(entityFieldSettings({formBehavior:{uppercaseInputs:true}},entity).code.inputFormat,'uppercase');
+assert.equal(entityFieldSettings({...config('none'),formBehavior:{uppercaseInputs:true}},entity).code.inputFormat,'none');
+const {formatInput,normalizeInputFields} = load('shared/base/input-format.ts.ejs','{formatInput, normalizeInputFields}');
+const original = {code:'hello world',description:null,count:4};
+const normalized = normalizeInputFields(original,{code:{inputFormat:'uppercase'},description:{inputFormat:'lowercase'}});
+assert.equal(normalized.code,'HELLO WORLD');assert.equal(original.code,'hello world');assert.equal(normalized.description,null);
+assert.equal(Object.hasOwn(normalizeInputFields({}, {code:{inputFormat:'uppercase'}}),'code'),false);
+const Directive = load('shared/base/input-format.directive.ts.ejs','InputFormatDirective',{formatInput});
+const input = {value:'aßbc',selectionStart:2,selectionEnd:2,selectionDirection:'none',setSelectionRange(start,end){this.selectionStart=start;this.selectionEnd=end;}};
+const directive = Object.create(Directive.prototype);
+let value;
+Object.assign(directive,{element:{nativeElement:input},appInputFormat:'uppercase',composing:false,onChange:v=>{value=v;}});
+directive.handleInput();assert.equal(value,'ASSBC');assert.equal(input.selectionStart,3);
+input.value='composing';directive.composing=true;directive.handleInput();assert.equal(input.value,'composing');
+directive.endComposition();assert.equal(value,'COMPOSING');
+directive.appInputFormat='lowercase';input.value='HELLO';directive.handleInput();assert.equal(value,'hello');
+directive.appInputFormat='none';input.value='Keep Case';directive.handleInput();assert.equal(value,'Keep Case');
+const mapUser=load('auth/current-user.ts.ejs','mapCurrentUser');
+assert.equal(mapUser(null),null);
+assert.equal(mapUser({sub:'a',given_name:'Ada',family_name:'Lovelace',email:'ada@example.test'}).name,'Ada Lovelace');
+assert.equal(mapUser({preferred_username:'username'}).name,'username');
+assert.equal(mapUser({name:'First Last',picture:'javascript:bad'}).avatar,'');
+assert.equal(mapUser({name:'First Last',picture:'https://example.test/avatar.png'}).avatar,'https://example.test/avatar.png');
+assert.equal(mapUser({name:'First Last'}).initials,'FL');
+const Utils=load('auth/auth.utils.ts.ejs','AuthUtils',{atob,TextDecoder,Uint8Array});
+const token='x.'+Buffer.from(JSON.stringify({name:'අබ්දුල් José'})).toString('base64url')+'.x';
+assert.equal(Utils.decodePayload(token).name,'අබ්දුල් José');
+console.log('Field preferences/profile tests passed: validation, precedence, payloads, cursor, IME, mappings, UTF-8 claims.');
+
+for (const [parse, blueprint] of [
+  [require('../src/parser/gdl-parser').parseGdl, '@Audited entity Province { string code }'],
+  [require('../src/parser/jdl-parser').parseJdl, '@EnableAudit entity Province { code String }'],
+]) {
+  const names = ['createdBy','createdDate','lastModifiedBy','lastModifiedDate','updatedBy','createdAt'];
+  const fields = parse(blueprint, {fields:{audit:{enabled:true,names}}}).entities[0].fields;
+  for(const name of ['createdBy','lastModifiedBy','updatedBy']) assert.equal(fields.find(f=>f.fieldName===name).fieldType,'String');
+  for(const name of ['createdDate','lastModifiedDate','createdAt']) assert.equal(fields.find(f=>f.fieldName===name).fieldType,'Instant');
+}
+
+{
+  const { parseGdl } = require('../src/parser/gdl-parser');
+  const { parseJdl } = require('../src/parser/jdl-parser');
+  const { analyzeSchema } = require('../src/validator/diagnostics');
+
+  const gdl = parseGdl('@Audited @Searchable @ActiveStatus\nentity Region {\n  string name\n}');
+  const region = gdl.entities[0];
+  assert.equal(region.searchable, true);
+  assert.equal(region.activeStatus, true);
+  assert.equal(region.audited, true);
+  assert.equal(region.fields.find((f) => f.fieldName === 'isActive').fieldType, 'Boolean');
+  assert.ok(region.fields.some((f) => f.fieldName === 'createdBy'));
+
+  const withExplicit = parseGdl('@ActiveStatus\nentity Outlet {\n  bool isActive\n  string code\n}');
+  assert.equal(withExplicit.entities[0].fields.filter((f) => f.fieldName === 'isActive').length, 1);
+
+  const jdl = parseJdl('@EnableAudit @Searchable @ActiveStatus\nentity Region {\n  name String\n}');
+  assert.equal(jdl.entities[0].fields.find((f) => f.fieldName === 'isActive').fieldType, 'Boolean');
+  assert.equal(jdl.entities[0].searchable, true);
+
+  const ok = analyzeSchema(
+    '@Audited @Searchable @ActiveStatus\nentity Region {\n  string name\n}',
+    { isGdl: true, file: 'region.gdl' },
+  );
+  assert.equal(ok.diagnostics.filter((d) => d.severity === 'error').length, 0);
+  assert.ok(ok.parsed.entities[0].fields.some((f) => f.fieldName === 'isActive'));
+
+  const soft = analyzeSchema('@SoftDelete entity A {\n string a\n}', { isGdl: true, file: 'a.gdl' });
+  assert.ok(soft.diagnostics.some((d) => d.code === 'unsupported-annotation'));
+}
+
+(async () => {
+  const os = require('node:os');
+  const { generateFromSource } = require('../src');
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'crudforge-field-validation-'));
+  try {
+    const configPath = path.join(directory, 'config.json');
+    const output = path.join(directory, 'output');
+    fs.writeFileSync(configPath, JSON.stringify({ ...config('uppercase'), output: {directory:output} }));
+    await assert.rejects(generateFromSource('entity Province { count Integer }', {configPath}), error =>
+      error.message.includes(configPath) && error.message.includes('fields.entities.Province.fields.code.inputFormat') && error.message.includes('unknown field'));
+    assert.equal(fs.existsSync(output), false, 'Reject invalid field configuration before generating any files');
+  } finally { fs.rmSync(directory, {recursive:true,force:true}); }
+})().catch(error => { console.error(error); process.exitCode=1; });
+
+// A late refresh from account A must not restore its tokens/profile after switching to B.
+{
+  const rx = require('rxjs');
+  const Auth = load('auth/auth.service.ts.ejs', 'AuthService', {
+    ...rx, environment: { useMockAuth:false, kcClientId:'test' }, URLSearchParams,
+    HttpErrorResponse: class extends Error {},
+  });
+  const auth = Object.create(Auth.prototype);
+  const storage = new Map([['refreshToken','account-a-refresh']]);
+  const response = new rx.Subject();
+  let error, stores = 0;
+  Object.assign(auth, {
+    authenticated:true, refreshing$:null,
+    getItem:key=>storage.get(key) || '', requestToken:()=>response,
+    storeTokens:()=>stores++,
+  });
+  auth.refreshAccessToken().subscribe({error:value=>{error=value;}});
+  storage.set('refreshToken','account-b-refresh');
+  response.next({access_token:'old-account-token',refresh_token:'old-account-refresh'});
+  assert.match(error.message,/Session changed/);
+  assert.equal(stores,0);
+  assert.equal(storage.get('refreshToken'),'account-b-refresh');
+  let cleared = false;
+  const failedResponse = new rx.Subject();
+  auth.requestToken = () => failedResponse;
+  auth.clearSession = () => { cleared = true; };
+  auth.isTerminalAuthError = () => true;
+  auth.refreshAccessToken().subscribe({error:()=>{}});
+  storage.set('refreshToken','account-c-refresh');
+  failedResponse.error(new Error('Previous account refresh rejected'));
+  assert.equal(cleared,false);
+}

package/test/fixtures/field-profile.gdl

@@ -0,0 +1,7 @@
+@Audited
+entity Province {
+  string index
+  string provinceCode
+  string provinceName
+  bool isActive
+}

package/test/fixtures/mock.jdl

@@ -0,0 +1,17 @@
+@EnableAudit
+entity Book {
+  title String required
+  description String
+  publishDate LocalDate required
+  pages Integer min(10) max(1000)
+}
+
+entity Author {
+  name String required
+  biography String
+  active Boolean
+}
+
+relationship OneToMany {
+  Author{book} to Book{author}
+}

package/test/fixtures/performance/config.yml

@@ -0,0 +1,33 @@
+project:
+  name: Field and profile regression fixture
+output:
+  directory: ./e2e/.field-profile
+  overwritePolicy: overwrite
+fuse:
+  enabled: true
+  cleanLayout: true
+  includePrebuilt: false
+api:
+  microservice: pmb-reference-module
+  baseUrl: /api
+mock:
+  enabled: false
+fields:
+  entities:
+    Province:
+      fields:
+        provinceCode: { inputFormat: uppercase }
+        provinceName: { inputFormat: lowercase }
+        index: { inputFormat: none }
+auth:
+  provider: keycloak
+  realm: test
+  clientId: test-client
+  # Deliberately non-live: Playwright intercepts every auth and API request.
+  serverUrl: http://127.0.0.1:9999
+  useMockAuth: false
+  provision:
+    enabled: false
+    adminServiceUrl: http://127.0.0.1:9999
+iam:
+  enabled: false