@things-factory/auth-base 10.0.0 → 10.0.3

package/dist-server/utils/get-user-domains.d.ts

@@ -1,5 +1,21 @@
 import { Domain } from '@things-factory/shell';
 import { User } from '../service/user/user.js';
+/**
+ * 사용자가 체크인할 수 있는 도메인 목록.
+ *
+ * 판정 규칙과 그 근거는 `checkin-domain-rule.ts` 에 있다. 요약하면 체크인 대상은
+ * "역할을 정의한 도메인" 이 아니라 "역할을 부여한 도메인" 이며, 부모 도메인으로부터 상속받은
+ * 역할을 부여한 경우에도 부여가 일어난 자식 도메인이 대상이다.
+ *
+ * 목록이 필요한 지점(체크인 화면·부트스트랩)에서만 사용한다. 도메인 하나에 대한 가부만
+ * 필요하면 `canUserCheckinDomain` 을 쓴다.
+ */
 export declare function getUserDomains(user: User): Promise<Partial<Domain>[]>;
+/**
+ * 체크인 가능한 도메인 중, 체크인 근거가 된 역할이 주어진 권한을 가진 도메인 목록.
+ *
+ * 상속 역할로 체크인하는 자식 도메인은 부모 도메인에 정의된 역할의 권한으로 판정한다.
+ * 도메인 소유자는 권한 판정 없이 포함한다 (기존 동작 유지).
+ */
 export declare function getDomainsWithPrivilege(user: User, privilege: string, category: string): Promise<Partial<Domain>[]>;
 export declare function getDomainsAsOwner(user: User): Promise<Partial<Domain>[]>;

package/dist-server/utils/get-user-domains.js

@@ -5,102 +5,60 @@ exports.getDomainsWithPrivilege = getDomainsWithPrivilege;
 exports.getDomainsAsOwner = getDomainsAsOwner;
 const shell_1 = require("@things-factory/shell");
 const env_1 = require("@things-factory/env");
-const user_js_1 = require("../service/user/user.js");
+const checkin_domain_facts_js_1 = require("./checkin-domain-facts.js");
+const checkin_domain_rule_js_1 = require("./checkin-domain-rule.js");
 const domainTypes = env_1.config.get('domainTypes', []);
+function byName(left, right) {
+    return (left.name || '').localeCompare(right.name || '');
+}
+function brief(domain) {
+    const { id, name, description, subdomain, extType, brandName, brandImage } = domain;
+    /* do not remove id column for result */
+    return { id, name, description, subdomain, extType, brandName, brandImage };
+}
+/**
+ * 사용자가 체크인할 수 있는 도메인 목록.
+ *
+ * 판정 규칙과 그 근거는 `checkin-domain-rule.ts` 에 있다. 요약하면 체크인 대상은
+ * "역할을 정의한 도메인" 이 아니라 "역할을 부여한 도메인" 이며, 부모 도메인으로부터 상속받은
+ * 역할을 부여한 경우에도 부여가 일어난 자식 도메인이 대상이다.
+ *
+ * 목록이 필요한 지점(체크인 화면·부트스트랩)에서만 사용한다. 도메인 하나에 대한 가부만
+ * 필요하면 `canUserCheckinDomain` 을 쓴다.
+ */
 async function getUserDomains(user) {
-    return (await (0, shell_1.getRepository)(shell_1.Domain)
-        .createQueryBuilder('DOMAIN')
-        .where(qb => {
-        const subQuery = qb
-            .subQuery()
-            .distinct(true)
-            .select('DOMAIN.id')
-            .from(user_js_1.User, 'USER')
-            .leftJoin('USER.roles', 'ROLE')
-            .leftJoin('ROLE.domain', 'DOMAIN')
-            .where('USER.id = :userId', { userId: user.id })
-            .getQuery();
-        return 'DOMAIN.id IN ' + subQuery;
-    })
-        .orWhere(qb => {
-        const subQuery = qb
-            .subQuery()
-            .select('DOMAIN.id')
-            .from(shell_1.Domain, 'DOMAIN')
-            .where('DOMAIN.owner = :owner', { owner: user.id })
-            .getQuery();
-        return 'DOMAIN.id IN ' + subQuery;
-    })
-        .orderBy('DOMAIN.name', 'ASC')
-        .getMany())
-        .filter(d => !d.extType || domainTypes.includes(d.extType))
-        .map(domain => {
-        const { id, name, description, subdomain, extType, brandName, brandImage } = domain;
-        /* do not remove id column for result */
-        return { id, name, description, subdomain, extType, brandName, brandImage };
-    });
+    if (!user?.id) {
+        return [];
+    }
+    const { facts, candidates } = await (0, checkin_domain_facts_js_1.collectCheckinCandidates)(user);
+    return candidates
+        .filter(domain => (0, checkin_domain_rule_js_1.checkinGrantsOf)(domain, facts).length > 0)
+        .filter(domain => !domain.extType || domainTypes.includes(domain.extType))
+        .sort(byName)
+        .map(brief);
 }
-// export async function getRoleBasedDomains(user: User): Promise<Partial<Domain>[]> {
-//   return (
-//     await getRepository(Domain)
-//       .createQueryBuilder('DOMAIN')
-//       .where(qb => {
-//         const subQuery = qb
-//           .subQuery()
-//           .distinct(true)
-//           .select('DOMAIN.id')
-//           .from(User, 'USER')
-//           .leftJoin('USER.roles', 'ROLE')
-//           .leftJoin('ROLE.domain', 'DOMAIN')
-//           .where('USER.id = :userId', { userId: user.id })
-//           .getQuery()
-//         return 'DOMAIN.id IN ' + subQuery
-//       })
-//       .getMany()
-//   ).map(domain => {
-//     const { id, name, description, subdomain, extType, brandName, brandImage } = domain
-//     return { id, name, description, subdomain, extType, brandName, brandImage }
-//   })
-// }
+/**
+ * 체크인 가능한 도메인 중, 체크인 근거가 된 역할이 주어진 권한을 가진 도메인 목록.
+ *
+ * 상속 역할로 체크인하는 자식 도메인은 부모 도메인에 정의된 역할의 권한으로 판정한다.
+ * 도메인 소유자는 권한 판정 없이 포함한다 (기존 동작 유지).
+ */
 async function getDomainsWithPrivilege(user, privilege, category) {
-    return (await (0, shell_1.getRepository)(shell_1.Domain)
-        .createQueryBuilder('DOMAIN')
-        .where(qb => {
-        const subQuery = qb
-            .subQuery()
-            .distinct(true)
-            .select('DOMAIN.id')
-            .from(user_js_1.User, 'USER')
-            .leftJoin('USER.roles', 'ROLE')
-            .leftJoin('ROLE.domain', 'DOMAIN')
-            .leftJoin('ROLE.privileges', 'PRIVILEGE')
-            .where('USER.id = :userId', { userId: user.id })
-            .andWhere('PRIVILEGE.name = :privilege', { privilege })
-            .andWhere('PRIVILEGE.category = :category', { category })
-            .getQuery();
-        return 'DOMAIN.id IN ' + subQuery;
-    })
-        .orWhere(qb => {
-        const subQuery = qb
-            .subQuery()
-            .select('DOMAIN.id')
-            .from(shell_1.Domain, 'DOMAIN')
-            .where('DOMAIN.owner = :owner', { owner: user.id })
-            .getQuery();
-        return 'DOMAIN.id IN ' + subQuery;
-    })
-        .orderBy('DOMAIN.name', 'ASC')
-        .getMany()).map(domain => {
-        const { id, name, description, subdomain, extType, brandName, brandImage } = domain;
-        return { id, name, description, subdomain, extType, brandName, brandImage };
-    });
+    if (!user?.id) {
+        return [];
+    }
+    const [{ facts, candidates }, privilegedRoleDomainIds] = await Promise.all([
+        (0, checkin_domain_facts_js_1.collectCheckinCandidates)(user),
+        (0, checkin_domain_facts_js_1.findRoleDomainIdsWithPrivilege)(user, privilege, category)
+    ]);
+    return candidates
+        .filter(domain => (0, checkin_domain_rule_js_1.checkinGrantsOf)(domain, facts).some(grant => grant.via === 'owner' || privilegedRoleDomainIds.has(grant.roleDomainId)))
+        .sort(byName)
+        .map(brief);
 }
 async function getDomainsAsOwner(user) {
     return (await (0, shell_1.getRepository)(shell_1.Domain).find({
         where: { owner: user.id }
-    })).map(domain => {
-        const { id, name, description, subdomain, extType, brandName, brandImage } = domain;
-        return { id, name, description, subdomain, extType, brandName, brandImage };
-    });
+    })).map(brief);
 }
 //# sourceMappingURL=get-user-domains.js.map

package/dist-server/utils/get-user-domains.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-user-domains.js","sourceRoot":"","sources":["../../server/utils/get-user-domains.ts"],"names":[],"mappings":";;AAOA,wCAkCC;AAyBD,0DAsCC;AAED,8CASC;AAnHD,iDAA6D;AAC7D,6CAA4C;AAE5C,qDAA8C;AAE9C,MAAM,WAAW,GAAG,YAAM,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAE1C,KAAK,UAAU,cAAc,CAAC,IAAU;IAC7C,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC;SACxB,kBAAkB,CAAC,QAAQ,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,EAAE;QACV,MAAM,QAAQ,GAAG,EAAE;aAChB,QAAQ,EAAE;aACV,QAAQ,CAAC,IAAI,CAAC;aACd,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,cAAI,EAAE,MAAM,CAAC;aAClB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;aACjC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,EAAE,CAAA;QACb,OAAO,eAAe,GAAG,QAAQ,CAAA;IACnC,CAAC,CAAC;SACD,OAAO,CAAC,EAAE,CAAC,EAAE;QACZ,MAAM,QAAQ,GAAG,EAAE;aAChB,QAAQ,EAAE;aACV,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,cAAM,EAAE,QAAQ,CAAC;aACtB,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAClD,QAAQ,EAAE,CAAA;QACb,OAAO,eAAe,GAAG,QAAQ,CAAA;IACnC,CAAC,CAAC;SACD,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;SAC7B,OAAO,EAAE,CACb;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SAC1D,GAAG,CAAC,MAAM,CAAC,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;QACnF,wCAAwC;QACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAC7E,CAAC,CAAC,CAAA;AACN,CAAC;AAED,sFAAsF;AACtF,aAAa;AACb,kCAAkC;AAClC,sCAAsC;AACtC,uBAAuB;AACvB,8BAA8B;AAC9B,wBAAwB;AACxB,4BAA4B;AAC5B,iCAAiC;AACjC,gCAAgC;AAChC,4CAA4C;AAC5C,+CAA+C;AAC/C,6DAA6D;AAC7D,wBAAwB;AACxB,4CAA4C;AAC5C,WAAW;AACX,mBAAmB;AACnB,sBAAsB;AACtB,0FAA0F;AAC1F,kFAAkF;AAClF,OAAO;AACP,IAAI;AAEG,KAAK,UAAU,uBAAuB,CAC3C,IAAU,EACV,SAAiB,EACjB,QAAgB;IAEhB,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC;SACxB,kBAAkB,CAAC,QAAQ,CAAC;SAC5B,KAAK,CAAC,EAAE,CAAC,EAAE;QACV,MAAM,QAAQ,GAAG,EAAE;aAChB,QAAQ,EAAE;aACV,QAAQ,CAAC,IAAI,CAAC;aACd,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,cAAI,EAAE,MAAM,CAAC;aAClB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;aACjC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC;aACxC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC;aACtD,QAAQ,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC;aACxD,QAAQ,EAAE,CAAA;QACb,OAAO,eAAe,GAAG,QAAQ,CAAA;IACnC,CAAC,CAAC;SACD,OAAO,CAAC,EAAE,CAAC,EAAE;QACZ,MAAM,QAAQ,GAAG,EAAE;aAChB,QAAQ,EAAE;aACV,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,cAAM,EAAE,QAAQ,CAAC;aACtB,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAClD,QAAQ,EAAE,CAAA;QACb,OAAO,eAAe,GAAG,QAAQ,CAAA;IACnC,CAAC,CAAC;SACD,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;SAC7B,OAAO,EAAE,CACb,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACb,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;QACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAU;IAChD,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,IAAI,CAAC;QAC/B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE;KAC1B,CAAC,CACH,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACb,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;QACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { Domain, getRepository } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user.js'\n\nconst domainTypes = config.get('domainTypes', [])\n\nexport async function getUserDomains(user: User): Promise<Partial<Domain>[]> {\n  return (\n    await getRepository(Domain)\n      .createQueryBuilder('DOMAIN')\n      .where(qb => {\n        const subQuery = qb\n          .subQuery()\n          .distinct(true)\n          .select('DOMAIN.id')\n          .from(User, 'USER')\n          .leftJoin('USER.roles', 'ROLE')\n          .leftJoin('ROLE.domain', 'DOMAIN')\n          .where('USER.id = :userId', { userId: user.id })\n          .getQuery()\n        return 'DOMAIN.id IN ' + subQuery\n      })\n      .orWhere(qb => {\n        const subQuery = qb\n          .subQuery()\n          .select('DOMAIN.id')\n          .from(Domain, 'DOMAIN')\n          .where('DOMAIN.owner = :owner', { owner: user.id })\n          .getQuery()\n        return 'DOMAIN.id IN ' + subQuery\n      })\n      .orderBy('DOMAIN.name', 'ASC')\n      .getMany()\n  )\n    .filter(d => !d.extType || domainTypes.includes(d.extType))\n    .map(domain => {\n      const { id, name, description, subdomain, extType, brandName, brandImage } = domain\n      /* do not remove id column for result */\n      return { id, name, description, subdomain, extType, brandName, brandImage }\n    })\n}\n\n// export async function getRoleBasedDomains(user: User): Promise<Partial<Domain>[]> {\n//   return (\n//     await getRepository(Domain)\n//       .createQueryBuilder('DOMAIN')\n//       .where(qb => {\n//         const subQuery = qb\n//           .subQuery()\n//           .distinct(true)\n//           .select('DOMAIN.id')\n//           .from(User, 'USER')\n//           .leftJoin('USER.roles', 'ROLE')\n//           .leftJoin('ROLE.domain', 'DOMAIN')\n//           .where('USER.id = :userId', { userId: user.id })\n//           .getQuery()\n//         return 'DOMAIN.id IN ' + subQuery\n//       })\n//       .getMany()\n//   ).map(domain => {\n//     const { id, name, description, subdomain, extType, brandName, brandImage } = domain\n//     return { id, name, description, subdomain, extType, brandName, brandImage }\n//   })\n// }\n\nexport async function getDomainsWithPrivilege(\n  user: User,\n  privilege: string,\n  category: string\n): Promise<Partial<Domain>[]> {\n  return (\n    await getRepository(Domain)\n      .createQueryBuilder('DOMAIN')\n      .where(qb => {\n        const subQuery = qb\n          .subQuery()\n          .distinct(true)\n          .select('DOMAIN.id')\n          .from(User, 'USER')\n          .leftJoin('USER.roles', 'ROLE')\n          .leftJoin('ROLE.domain', 'DOMAIN')\n          .leftJoin('ROLE.privileges', 'PRIVILEGE')\n          .where('USER.id = :userId', { userId: user.id })\n          .andWhere('PRIVILEGE.name = :privilege', { privilege })\n          .andWhere('PRIVILEGE.category = :category', { category })\n          .getQuery()\n        return 'DOMAIN.id IN ' + subQuery\n      })\n      .orWhere(qb => {\n        const subQuery = qb\n          .subQuery()\n          .select('DOMAIN.id')\n          .from(Domain, 'DOMAIN')\n          .where('DOMAIN.owner = :owner', { owner: user.id })\n          .getQuery()\n        return 'DOMAIN.id IN ' + subQuery\n      })\n      .orderBy('DOMAIN.name', 'ASC')\n      .getMany()\n  ).map(domain => {\n    const { id, name, description, subdomain, extType, brandName, brandImage } = domain\n    return { id, name, description, subdomain, extType, brandName, brandImage }\n  })\n}\n\nexport async function getDomainsAsOwner(user: User): Promise<Partial<Domain>[]> {\n  return (\n    await getRepository(Domain).find({\n      where: { owner: user.id }\n    })\n  ).map(domain => {\n    const { id, name, description, subdomain, extType, brandName, brandImage } = domain\n    return { id, name, description, subdomain, extType, brandName, brandImage }\n  })\n}\n"]}
+{"version":3,"file":"get-user-domains.js","sourceRoot":"","sources":["../../server/utils/get-user-domains.ts"],"names":[],"mappings":";;AA6BA,wCAYC;AAQD,0DAsBC;AAED,8CAMC;AA/ED,iDAA6D;AAC7D,6CAA4C;AAG5C,uEAAoG;AACpG,qEAA0D;AAE1D,MAAM,WAAW,GAAG,YAAM,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAEjD,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IACnF,wCAAwC;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,cAAc,CAAC,IAAU;IAC7C,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,kDAAwB,EAAC,IAAI,CAAC,CAAA;IAElE,OAAO,UAAU;SACd,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAA,wCAAe,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACzE,IAAI,CAAC,MAAM,CAAC;SACZ,GAAG,CAAC,KAAK,CAAC,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAC3C,IAAU,EACV,SAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,uBAAuB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzE,IAAA,kDAAwB,EAAC,IAAI,CAAC;QAC9B,IAAA,wDAA8B,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC1D,CAAC,CAAA;IAEF,OAAO,UAAU;SACd,MAAM,CAAC,MAAM,CAAC,EAAE,CACf,IAAA,wCAAe,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CACjC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAClF,CACF;SACA,IAAI,CAAC,MAAM,CAAC;SACZ,GAAG,CAAC,KAAK,CAAC,CAAA;AACf,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAU;IAChD,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,IAAI,CAAC;QAC/B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE;KAC1B,CAAC,CACH,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACd,CAAC","sourcesContent":["import { Domain, getRepository } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user.js'\nimport { collectCheckinCandidates, findRoleDomainIdsWithPrivilege } from './checkin-domain-facts.js'\nimport { checkinGrantsOf } from './checkin-domain-rule.js'\n\nconst domainTypes = config.get('domainTypes', [])\n\nfunction byName(left: Domain, right: Domain): number {\n  return (left.name || '').localeCompare(right.name || '')\n}\n\nfunction brief(domain: Domain): Partial<Domain> {\n  const { id, name, description, subdomain, extType, brandName, brandImage } = domain\n  /* do not remove id column for result */\n  return { id, name, description, subdomain, extType, brandName, brandImage }\n}\n\n/**\n * 사용자가 체크인할 수 있는 도메인 목록.\n *\n * 판정 규칙과 그 근거는 `checkin-domain-rule.ts` 에 있다. 요약하면 체크인 대상은\n * \"역할을 정의한 도메인\" 이 아니라 \"역할을 부여한 도메인\" 이며, 부모 도메인으로부터 상속받은\n * 역할을 부여한 경우에도 부여가 일어난 자식 도메인이 대상이다.\n *\n * 목록이 필요한 지점(체크인 화면·부트스트랩)에서만 사용한다. 도메인 하나에 대한 가부만\n * 필요하면 `canUserCheckinDomain` 을 쓴다.\n */\nexport async function getUserDomains(user: User): Promise<Partial<Domain>[]> {\n  if (!user?.id) {\n    return []\n  }\n\n  const { facts, candidates } = await collectCheckinCandidates(user)\n\n  return candidates\n    .filter(domain => checkinGrantsOf(domain, facts).length > 0)\n    .filter(domain => !domain.extType || domainTypes.includes(domain.extType))\n    .sort(byName)\n    .map(brief)\n}\n\n/**\n * 체크인 가능한 도메인 중, 체크인 근거가 된 역할이 주어진 권한을 가진 도메인 목록.\n *\n * 상속 역할로 체크인하는 자식 도메인은 부모 도메인에 정의된 역할의 권한으로 판정한다.\n * 도메인 소유자는 권한 판정 없이 포함한다 (기존 동작 유지).\n */\nexport async function getDomainsWithPrivilege(\n  user: User,\n  privilege: string,\n  category: string\n): Promise<Partial<Domain>[]> {\n  if (!user?.id) {\n    return []\n  }\n\n  const [{ facts, candidates }, privilegedRoleDomainIds] = await Promise.all([\n    collectCheckinCandidates(user),\n    findRoleDomainIdsWithPrivilege(user, privilege, category)\n  ])\n\n  return candidates\n    .filter(domain =>\n      checkinGrantsOf(domain, facts).some(\n        grant => grant.via === 'owner' || privilegedRoleDomainIds.has(grant.roleDomainId)\n      )\n    )\n    .sort(byName)\n    .map(brief)\n}\n\nexport async function getDomainsAsOwner(user: User): Promise<Partial<Domain>[]> {\n  return (\n    await getRepository(Domain).find({\n      where: { owner: user.id }\n    })\n  ).map(brief)\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.0.0",
+  "version": "10.0.3",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -34,9 +34,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.0.0",
+    "@things-factory/email-base": "^10.0.3",
     "@things-factory/env": "^10.0.0",
-    "@things-factory/shell": "^10.0.0",
+    "@things-factory/shell": "^10.0.3",
     "@things-factory/utils": "^10.0.0",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "b20fa0816c33727f7ec327e0455687d3be620c58"
+  "gitHead": "c7d253b722b6917e8911f6ef6e78e5fc2b295e82"
 }

package/spec/unit/checkin-domain.spec.ts

@@ -0,0 +1,307 @@
+/**
+ * 체크인 자격 판정 — 실제 엔티티·실제 쿼리 검증.
+ *
+ * 보안 판정이므로 로직을 재현하지 않고, 빌드된 `@things-factory/auth-base` 의 실제 함수
+ * (`getUserDomains` / `canUserCheckinDomain`)를 실제 엔티티 메타데이터(실제 조인 테이블·네이밍
+ * 전략)로 만든 sqlite in-memory 스키마에 대해 그대로 실행한다.
+ *
+ * 주의: 이 스펙은 빌드 산출물(`dist-server`)을 대상으로 한다 — 소스를 고친 뒤에는
+ * `npm run build:server` 를 먼저 실행해야 변경이 반영된다.
+ */
+
+import { DataSource } from 'typeorm'
+
+import { NamingStrategy, addDataSource, entities as shellEntities, Domain } from '@things-factory/shell'
+import {
+  DomainOwner,
+  GrantedRole,
+  Role,
+  User,
+  canUserCheckinDomain,
+  entities as authEntities,
+  getUserDomains
+} from '@things-factory/auth-base'
+
+let dataSource: DataSource
+
+async function domain(name: string, parent?: Domain, owner?: string): Promise<Domain> {
+  return await dataSource.getRepository(Domain).save({
+    name,
+    subdomain: name,
+    parent,
+    owner
+  } as any)
+}
+
+async function user(name: string, domains: Domain[], roles: Role[] = []): Promise<User> {
+  return await dataSource.getRepository(User).save({
+    name,
+    email: `${name}@test.com`,
+    username: name,
+    domains,
+    roles
+  } as any)
+}
+
+async function role(name: string, roleDomain: Domain): Promise<Role> {
+  return await dataSource.getRepository(Role).save({ name, domain: roleDomain } as any)
+}
+
+/** 판정에 쓰이는 도메인은 `context.state.domain` 처럼 온전히 적재된 것이어야 한다. */
+async function reload(target: Domain): Promise<Domain> {
+  return await dataSource.getRepository(Domain).findOneBy({ id: target.id })
+}
+
+async function reloadUser(target: User): Promise<User> {
+  return await dataSource.getRepository(User).findOne({ where: { id: target.id }, relations: ['domains'] })
+}
+
+async function checkinSubdomains(target: User): Promise<string[]> {
+  return (await getUserDomains(await reloadUser(target))).map(d => d.subdomain)
+}
+
+beforeAll(async () => {
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new NamingStrategy(),
+    entities: [...shellEntities, ...authEntities],
+    logging: false
+  })
+
+  await dataSource.initialize()
+  addDataSource('default', dataSource)
+})
+
+afterAll(async () => {
+  await dataSource?.destroy()
+})
+
+beforeEach(async () => {
+  /* 스펙 간 격리 — 테이블 이름은 엔티티 메타데이터에서 얻는다 (네이밍 전략에 의존하지 않기 위해). */
+  for (const junction of dataSource.entityMetadatas.filter(metadata => metadata.isJunction)) {
+    await dataSource.query(`DELETE FROM "${junction.tableName}"`)
+  }
+
+  for (const target of [GrantedRole, DomainOwner, Role, User, Domain]) {
+    await dataSource.query(`DELETE FROM "${dataSource.getMetadata(target).tableName}"`)
+  }
+})
+
+describe('부모 도메인으로부터 상속받은 역할', () => {
+  it('부여가 일어난 자식 도메인에 체크인할 수 있다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const inheritedRole = await role('operator', parent)
+    const member = await user('kim', [child], [inheritedRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(member), await reload(child))).toBe(true)
+    expect(await checkinSubdomains(member)).toEqual(['child'])
+  })
+
+  it('역할을 정의한 부모 도메인에는 체크인할 수 없다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const inheritedRole = await role('operator', parent)
+    const member = await user('kim', [child], [inheritedRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(member), await reload(parent))).toBe(false)
+    expect(await checkinSubdomains(member)).not.toContain('parent')
+  })
+
+  it('멤버가 아닌 형제 자식 도메인에는 체크인할 수 없다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const sibling = await domain('sibling', parent)
+    const inheritedRole = await role('operator', parent)
+    const member = await user('kim', [child], [inheritedRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(member), await reload(sibling))).toBe(false)
+    expect(await checkinSubdomains(member)).toEqual(['child'])
+  })
+
+  it('부모의 역할을 부모에서 부여받았다면 부모에 체크인한다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const parentRole = await role('operator', parent)
+    const member = await user('kim', [parent], [parentRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(member), await reload(parent))).toBe(true)
+    expect(await canUserCheckinDomain(await reloadUser(member), await reload(child))).toBe(false)
+  })
+})
+
+describe('자기 도메인에 정의된 역할', () => {
+  it('멤버이고 역할이 있으면 체크인한다', async () => {
+    const target = await domain('acme')
+    const ownRole = await role('operator', target)
+    const member = await user('kim', [target], [ownRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(member), await reload(target))).toBe(true)
+  })
+
+  it('멤버이지만 역할이 없으면 체크인하지 못한다', async () => {
+    const target = await domain('acme')
+    const member = await user('kim', [target], [])
+
+    expect(await canUserCheckinDomain(await reloadUser(member), await reload(target))).toBe(false)
+    expect(await checkinSubdomains(member)).toEqual([])
+  })
+
+  it('역할이 있지만 멤버가 아니면 체크인하지 못한다', async () => {
+    const target = await domain('acme')
+    const outsideRole = await role('operator', target)
+    const outsider = await user('lee', [], [outsideRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(outsider), await reload(target))).toBe(false)
+    expect(await checkinSubdomains(outsider)).toEqual([])
+  })
+})
+
+describe('파트너십으로 grant 된 역할', () => {
+  it('공급자 도메인의 멤버가 아니어도 체크인한다', async () => {
+    const supplier = await domain('supplier')
+    const customer = await domain('customer')
+    const supplierRole = await role('carrier', supplier)
+    await dataSource.getRepository(GrantedRole).save({ role: supplierRole, domain: customer } as any)
+
+    const customerUser = await user('park', [customer], [supplierRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(customerUser), await reload(supplier))).toBe(true)
+    expect((await checkinSubdomains(customerUser)).sort()).toEqual(['supplier'])
+  })
+
+  it('grant 되지 않은 역할은 파트너 경로를 열지 않는다', async () => {
+    const supplier = await domain('supplier')
+    const customer = await domain('customer')
+    const supplierRole = await role('carrier', supplier)
+
+    const customerUser = await user('park', [customer], [supplierRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(customerUser), await reload(supplier))).toBe(false)
+  })
+
+  it('다른 도메인에 grant 된 역할은 근거가 되지 않는다', async () => {
+    const supplier = await domain('supplier')
+    const customer = await domain('customer')
+    const stranger = await domain('stranger')
+    const supplierRole = await role('carrier', supplier)
+    await dataSource.getRepository(GrantedRole).save({ role: supplierRole, domain: stranger } as any)
+
+    const customerUser = await user('park', [customer], [supplierRole])
+
+    expect(await canUserCheckinDomain(await reloadUser(customerUser), await reload(supplier))).toBe(false)
+  })
+})
+
+describe('소유권', () => {
+  it('하위 호환 owner 컬럼으로 체크인한다', async () => {
+    const target = await domain('acme')
+    const owner = await user('boss', [])
+    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
+
+    expect(await canUserCheckinDomain(await reloadUser(owner), await reload(target))).toBe(true)
+    expect(await checkinSubdomains(owner)).toEqual(['acme'])
+  })
+
+  it('DomainOwner 테이블 기준으로도 체크인한다', async () => {
+    const target = await domain('acme')
+    const owner = await user('boss', [])
+    await dataSource.getRepository(DomainOwner).save({ domain: target, user: owner } as any)
+
+    expect(await canUserCheckinDomain(await reloadUser(owner), await reload(target))).toBe(true)
+    expect(await checkinSubdomains(owner)).toEqual(['acme'])
+  })
+
+  it('다른 사용자가 owner 인 도메인은 체크인하지 못한다', async () => {
+    const target = await domain('acme')
+    const owner = await user('boss', [])
+    const other = await user('lee', [])
+    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
+
+    expect(await canUserCheckinDomain(await reloadUser(other), await reload(target))).toBe(false)
+  })
+})
+
+describe('핫패스 조회 비용', () => {
+  /**
+   * `canUserCheckinDomain` 은 매 요청 도메인 인증에서 호출된다. 도메인 목록 전체를 계산하지
+   * 않고 대상 도메인만 판정하도록 되어 있는데, 이 성질이 깨지면 요청당 비용이 늘어난다.
+   */
+  async function countQueries(work: () => Promise<unknown>): Promise<number> {
+    let count = 0
+    const original = (dataSource as any).logger
+
+    ;(dataSource as any).logger = {
+      logQuery: () => {
+        count++
+      },
+      logQueryError: () => {},
+      logQuerySlow: () => {},
+      logSchemaBuild: () => {},
+      logMigration: () => {},
+      log: () => {}
+    }
+
+    try {
+      await work()
+    } finally {
+      ;(dataSource as any).logger = original
+    }
+
+    return count
+  }
+
+  it('통과 판정은 1회 조회로 끝난다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const inheritedRole = await role('operator', parent)
+    const member = await user('kim', [child], [inheritedRole])
+
+    const loadedUser = await reloadUser(member)
+    const loadedDomain = await reload(child)
+
+    expect(await countQueries(() => canUserCheckinDomain(loadedUser, loadedDomain))).toBe(1)
+  })
+
+  it('목록 계산은 4회 조회로 끝난다 (경로별 조회가 도메인 행을 직접 반환한다)', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const inheritedRole = await role('operator', parent)
+    const member = await user('kim', [child], [inheritedRole])
+
+    const loadedUser = await reloadUser(member)
+
+    expect(await countQueries(() => getUserDomains(loadedUser))).toBe(4)
+  })
+
+  it('거절 판정도 3회를 넘지 않는다', async () => {
+    const target = await domain('acme')
+    const outsider = await user('lee', [], [])
+
+    const loadedUser = await reloadUser(outsider)
+    const loadedDomain = await reload(target)
+
+    expect(await countQueries(() => canUserCheckinDomain(loadedUser, loadedDomain))).toBeLessThanOrEqual(3)
+  })
+})
+
+describe('여러 도메인이 얽힌 목록 계산', () => {
+  it('부여받은 도메인만 목록에 담는다', async () => {
+    const parent = await domain('parent')
+    const childA = await domain('child-a', parent)
+    const childB = await domain('child-b', parent)
+    const other = await domain('other')
+
+    const inheritedRole = await role('operator', parent)
+    const childBRole = await role('viewer', childB)
+    await role('unassigned', other)
+
+    /* childA: 상속 역할 부여 / childB: 자기 역할 부여 / other: 멤버이지만 역할 없음 */
+    const member = await user('kim', [childA, childB, other], [inheritedRole, childBRole])
+
+    expect((await checkinSubdomains(member)).sort()).toEqual(['child-a', 'child-b'])
+  })
+})