@things-factory/auth-base 10.0.0 → 10.0.4

package/spec/unit/checkin-privilege.spec.ts

@@ -0,0 +1,205 @@
+/**
+ * 권한 판정의 도메인 상속 — 실제 엔티티·실제 쿼리 검증.
+ *
+ * 역할은 부모 도메인으로부터 상속되므로, 상속 역할을 부여받아 자식 도메인에 체크인한 사용자는
+ * 그 역할의 권한을 자식 도메인에서 행사할 수 있어야 한다. 체크인만 열리고 권한이 0 이면
+ * 상속 부여는 무의미하다.
+ *
+ * 주의: 이 스펙은 빌드 산출물(`dist-server`)을 대상으로 한다.
+ */
+
+import { DataSource } from 'typeorm'
+
+import { NamingStrategy, addDataSource, entities as shellEntities, Domain } from '@things-factory/shell'
+import {
+  DomainOwner,
+  Privilege,
+  Role,
+  User,
+  entities as authEntities,
+  getDomainsWithPrivilege
+} from '@things-factory/auth-base'
+
+let dataSource: DataSource
+
+async function domain(name: string, parent?: Domain): Promise<Domain> {
+  return await dataSource.getRepository(Domain).save({ name, subdomain: name, parent } as any)
+}
+
+async function privilege(name: string, category: string): Promise<Privilege> {
+  return await dataSource.getRepository(Privilege).save({ name, category } as any)
+}
+
+async function role(name: string, roleDomain: Domain, privileges: Privilege[]): Promise<Role> {
+  return await dataSource.getRepository(Role).save({ name, domain: roleDomain, privileges } as any)
+}
+
+async function user(name: string, domains: Domain[], roles: Role[]): Promise<User> {
+  return await dataSource.getRepository(User).save({
+    name,
+    email: `${name}@test.com`,
+    username: name,
+    domains,
+    roles
+  } as any)
+}
+
+async function reload(target: Domain): Promise<Domain> {
+  return await dataSource.getRepository(Domain).findOneBy({ id: target.id })
+}
+
+async function reloadUser(target: User): Promise<User> {
+  return await dataSource.getRepository(User).findOne({ where: { id: target.id }, relations: ['domains'] })
+}
+
+beforeAll(async () => {
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new NamingStrategy(),
+    entities: [...shellEntities, ...authEntities],
+    logging: false
+  })
+
+  await dataSource.initialize()
+  addDataSource('default', dataSource)
+})
+
+afterAll(async () => {
+  await dataSource?.destroy()
+})
+
+beforeEach(async () => {
+  for (const junction of dataSource.entityMetadatas.filter(metadata => metadata.isJunction)) {
+    await dataSource.query(`DELETE FROM "${junction.tableName}"`)
+  }
+
+  for (const target of [DomainOwner, Role, Privilege, User, Domain]) {
+    await dataSource.query(`DELETE FROM "${dataSource.getMetadata(target).tableName}"`)
+  }
+})
+
+describe('User.hasPrivilege — 도메인 상속', () => {
+  it('자기 도메인에 정의된 역할의 권한을 행사한다', async () => {
+    const target = await domain('acme')
+    const query = await privilege('query', 'board')
+    const operator = await role('operator', target, [query])
+    const member = await user('kim', [target], [operator])
+
+    expect(await User.hasPrivilege('query', 'board', await reload(target), member)).toBe(true)
+  })
+
+  it('부모 도메인에 정의된 상속 역할의 권한을 자식 도메인에서 행사한다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const query = await privilege('query', 'board')
+    const inherited = await role('operator', parent, [query])
+    const member = await user('kim', [child], [inherited])
+
+    expect(await User.hasPrivilege('query', 'board', await reload(child), member)).toBe(true)
+  })
+
+  it('무관한 도메인에 정의된 역할의 권한은 행사하지 못한다', async () => {
+    const target = await domain('acme')
+    const other = await domain('other')
+    const query = await privilege('query', 'board')
+    const otherRole = await role('operator', other, [query])
+    const member = await user('kim', [target], [otherRole])
+
+    expect(await User.hasPrivilege('query', 'board', await reload(target), member)).toBe(false)
+  })
+
+  it('역할이 갖지 않은 권한은 행사하지 못한다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const query = await privilege('query', 'board')
+    await privilege('mutation', 'board')
+    const inherited = await role('viewer', parent, [query])
+    const member = await user('kim', [child], [inherited])
+
+    expect(await User.hasPrivilege('mutation', 'board', await reload(child), member)).toBe(false)
+  })
+
+  it('조부모 도메인의 역할까지 거슬러 올라가지는 않는다 (상속은 1단)', async () => {
+    const grandParent = await domain('grand')
+    const parent = await domain('parent', grandParent)
+    const child = await domain('child', parent)
+    const query = await privilege('query', 'board')
+    const grandRole = await role('operator', grandParent, [query])
+    const member = await user('kim', [child], [grandRole])
+
+    expect(await User.hasPrivilege('query', 'board', await reload(child), member)).toBe(false)
+  })
+})
+
+describe('User.getPrivilegesByDomain — 도메인 상속', () => {
+  it('상속 역할의 권한이 목록에 포함된다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const inheritedPrivilege = await privilege('query', 'board')
+    const ownPrivilege = await privilege('mutation', 'worklist')
+    const inherited = await role('operator', parent, [inheritedPrivilege])
+    const own = await role('editor', child, [ownPrivilege])
+    const member = await user('kim', [child], [inherited, own])
+
+    const privileges = await User.getPrivilegesByDomain(member, await reload(child))
+
+    expect(privileges).toEqual(
+      expect.arrayContaining([
+        { category: 'board', privilege: 'query' },
+        { category: 'worklist', privilege: 'mutation' }
+      ])
+    )
+  })
+
+  it('무관한 도메인 역할의 권한은 목록에서 제외된다', async () => {
+    const target = await domain('acme')
+    const other = await domain('other')
+    const otherPrivilege = await privilege('query', 'secret')
+    const otherRole = await role('operator', other, [otherPrivilege])
+    const member = await user('kim', [target, other], [otherRole])
+
+    const privileges = await User.getPrivilegesByDomain(member, await reload(target))
+
+    expect(privileges).toEqual([])
+  })
+})
+
+describe('getDomainsWithPrivilege — 부여 도메인 + 상속', () => {
+  it('상속 역할로 권한을 가진 자식 도메인을 반환한다', async () => {
+    const parent = await domain('parent')
+    const child = await domain('child', parent)
+    const query = await privilege('query', 'board')
+    const inherited = await role('operator', parent, [query])
+    const member = await user('kim', [child], [inherited])
+
+    const domains = await getDomainsWithPrivilege(await reloadUser(member), 'query', 'board')
+
+    expect(domains.map(d => d.subdomain)).toEqual(['child'])
+  })
+
+  it('권한 없는 역할만 부여된 도메인은 제외한다', async () => {
+    const withPrivilege = await domain('with')
+    const without = await domain('without')
+    const query = await privilege('query', 'board')
+    const granted = await role('operator', withPrivilege, [query])
+    const plain = await role('guest', without, [])
+    const member = await user('kim', [withPrivilege, without], [granted, plain])
+
+    const domains = await getDomainsWithPrivilege(await reloadUser(member), 'query', 'board')
+
+    expect(domains.map(d => d.subdomain)).toEqual(['with'])
+  })
+
+  it('소유 도메인은 권한 판정 없이 포함한다', async () => {
+    const owned = await domain('owned')
+    const owner = await user('boss', [], [])
+    await dataSource.getRepository(Domain).update(owned.id, { owner: owner.id })
+
+    const domains = await getDomainsWithPrivilege(await reloadUser(owner), 'query', 'board')
+
+    expect(domains.map(d => d.subdomain)).toEqual(['owned'])
+  })
+})

package/spec/unit/domain-ownership.spec.ts

@@ -0,0 +1,188 @@
+/**
+ * 도메인 소유권 판정 — 실제 엔티티·실제 쿼리 검증.
+ *
+ * 도메인 관리자는 여러 명일 수 있다(`DomainOwner` 테이블). `Domain.owner` 컬럼은 대표 오너
+ * 표시용 캐시이므로, 도메인 범위의 판정은 두 경로를 함께 봐야 한다.
+ *
+ * 주의: 이 스펙은 빌드 산출물(`dist-server`)을 대상으로 한다.
+ */
+
+import { DataSource } from 'typeorm'
+
+import { NamingStrategy, addDataSource, entities as shellEntities, Domain } from '@things-factory/shell'
+import {
+  DomainOwner,
+  User,
+  entities as authEntities,
+  findDomainOwnerUserIds,
+  isDomainOwner,
+  setPrimaryDomainOwner
+} from '@things-factory/auth-base'
+
+let dataSource: DataSource
+
+async function domain(name: string): Promise<Domain> {
+  return await dataSource.getRepository(Domain).save({ name, subdomain: name } as any)
+}
+
+async function usr(name: string): Promise<User> {
+  return await dataSource.getRepository(User).save({
+    name,
+    email: `${name}@test.com`,
+    username: name
+  } as any)
+}
+
+async function reload(target: Domain): Promise<Domain> {
+  return await dataSource.getRepository(Domain).findOneBy({ id: target.id })
+}
+
+async function ownerEntryCount(target: Domain): Promise<number> {
+  return await dataSource.getRepository(DomainOwner).count({ where: { domain: { id: target.id } } })
+}
+
+beforeAll(async () => {
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new NamingStrategy(),
+    entities: [...shellEntities, ...authEntities],
+    logging: false
+  })
+
+  await dataSource.initialize()
+  addDataSource('default', dataSource)
+})
+
+afterAll(async () => {
+  await dataSource?.destroy()
+})
+
+beforeEach(async () => {
+  for (const junction of dataSource.entityMetadatas.filter(metadata => metadata.isJunction)) {
+    await dataSource.query(`DELETE FROM "${junction.tableName}"`)
+  }
+
+  for (const target of [DomainOwner, User, Domain]) {
+    await dataSource.query(`DELETE FROM "${dataSource.getMetadata(target).tableName}"`)
+  }
+})
+
+describe('isDomainOwner', () => {
+  it('대표 오너 컬럼으로 인정한다', async () => {
+    const target = await domain('acme')
+    const owner = await usr('boss')
+    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
+
+    expect(await isDomainOwner(await reload(target), owner)).toBe(true)
+  })
+
+  it('DomainOwner 테이블의 공동 오너도 인정한다', async () => {
+    const target = await domain('acme')
+    const primary = await usr('boss')
+    const coOwner = await usr('deputy')
+    await dataSource.getRepository(Domain).update(target.id, { owner: primary.id })
+    await dataSource.getRepository(DomainOwner).save({ domain: target, user: coOwner } as any)
+
+    expect(await isDomainOwner(await reload(target), coOwner)).toBe(true)
+  })
+
+  it('오너가 아닌 사용자는 인정하지 않는다', async () => {
+    const target = await domain('acme')
+    const owner = await usr('boss')
+    const other = await usr('lee')
+    await dataSource.getRepository(Domain).update(target.id, { owner: owner.id })
+
+    expect(await isDomainOwner(await reload(target), other)).toBe(false)
+  })
+
+  it('다른 도메인의 오너 엔트리는 인정하지 않는다', async () => {
+    const target = await domain('acme')
+    const another = await domain('other')
+    const coOwner = await usr('deputy')
+    await dataSource.getRepository(DomainOwner).save({ domain: another, user: coOwner } as any)
+
+    expect(await isDomainOwner(await reload(target), coOwner)).toBe(false)
+  })
+
+  it('도메인이나 사용자가 없으면 인정하지 않는다', async () => {
+    const target = await domain('acme')
+    const owner = await usr('boss')
+
+    expect(await isDomainOwner(null, owner)).toBe(false)
+    expect(await isDomainOwner(await reload(target), null)).toBe(false)
+  })
+})
+
+describe('findDomainOwnerUserIds', () => {
+  it('대표 오너와 공동 오너를 합쳐서 반환한다', async () => {
+    const target = await domain('acme')
+    const primary = await usr('boss')
+    const coOwner = await usr('deputy')
+    const plain = await usr('lee')
+    await dataSource.getRepository(Domain).update(target.id, { owner: primary.id })
+    await dataSource.getRepository(DomainOwner).save({ domain: target, user: coOwner } as any)
+
+    const ownerIds = await findDomainOwnerUserIds(await reload(target))
+
+    expect(ownerIds.has(primary.id)).toBe(true)
+    expect(ownerIds.has(coOwner.id)).toBe(true)
+    expect(ownerIds.has(plain.id)).toBe(false)
+    expect(ownerIds.size).toBe(2)
+  })
+
+  it('대표 오너가 테이블에도 있으면 중복 계산하지 않는다', async () => {
+    const target = await domain('acme')
+    const primary = await usr('boss')
+    await dataSource.getRepository(Domain).update(target.id, { owner: primary.id })
+    await dataSource.getRepository(DomainOwner).save({ domain: target, user: primary } as any)
+
+    expect((await findDomainOwnerUserIds(await reload(target))).size).toBe(1)
+  })
+})
+
+describe('setPrimaryDomainOwner', () => {
+  it('컬럼과 테이블을 함께 세팅한다', async () => {
+    const target = await domain('acme')
+    const owner = await usr('boss')
+
+    await setPrimaryDomainOwner(target, owner.id)
+
+    expect((await reload(target)).owner).toBe(owner.id)
+    expect(await ownerEntryCount(target)).toBe(1)
+    expect(await isDomainOwner(await reload(target), owner)).toBe(true)
+  })
+
+  it('기존 공동 오너 엔트리를 제거하지 않는다', async () => {
+    const target = await domain('acme')
+    const previous = await usr('boss')
+    const next = await usr('deputy')
+    await setPrimaryDomainOwner(target, previous.id)
+
+    await setPrimaryDomainOwner(target, next.id)
+
+    expect((await reload(target)).owner).toBe(next.id)
+    expect(await ownerEntryCount(target)).toBe(2)
+    /* 이관 후에도 이전 오너는 공동 오너로 남는다 — 제거는 removeDomainOwner 의 책임. */
+    expect(await isDomainOwner(await reload(target), previous)).toBe(true)
+  })
+
+  it('같은 오너를 다시 지정해도 엔트리를 중복 생성하지 않는다', async () => {
+    const target = await domain('acme')
+    const owner = await usr('boss')
+
+    await setPrimaryDomainOwner(target, owner.id)
+    await setPrimaryDomainOwner(target, owner.id)
+
+    expect(await ownerEntryCount(target)).toBe(1)
+  })
+
+  it('도메인이나 사용자가 없으면 명시적으로 실패한다', async () => {
+    const target = await domain('acme')
+
+    await expect(setPrimaryDomainOwner(target, '')).rejects.toThrow()
+    await expect(setPrimaryDomainOwner(null as any, 'some-user')).rejects.toThrow()
+  })
+})

package/tests/checkin-domain-rule.test.ts

@@ -0,0 +1,128 @@
+/**
+ * 체크인 대상 도메인 판정 규칙 테스트.
+ *
+ * 핵심 회귀: 부모 도메인에 정의된 역할을 자식 도메인에서 부여받은 사용자는
+ * "역할을 부여한 도메인(자식)" 에 체크인해야 하고, "역할을 정의한 도메인(부모)" 에는 체크인하지 못한다.
+ */
+
+import { CheckinFacts, checkinGrantsOf, isCheckinAllowed } from '../server/utils/checkin-domain-rule.js'
+
+const USER = 'user-1'
+const PARENT = { id: 'domain-parent', parentId: null }
+const CHILD = { id: 'domain-child', parentId: 'domain-parent' }
+const SIBLING = { id: 'domain-sibling', parentId: 'domain-parent' }
+const SUPPLIER = { id: 'domain-supplier', parentId: null }
+
+function facts(partial: Partial<CheckinFacts> = {}): CheckinFacts {
+  return {
+    userId: USER,
+    memberDomainIds: [],
+    roleDomainIds: [],
+    ...partial
+  }
+}
+
+describe('checkin domain rule', () => {
+  describe('상속받은 역할을 부여한 도메인', () => {
+    /* 자식 도메인 관리자가 부모 정의 역할(상속)을 자기 도메인 사용자에게 부여한 상황. */
+    const inheritedGrant = facts({
+      memberDomainIds: [CHILD.id],
+      roleDomainIds: [PARENT.id]
+    })
+
+    it('부여가 일어난 자식 도메인에 체크인할 수 있다', () => {
+      expect(isCheckinAllowed(CHILD, inheritedGrant)).toBe(true)
+      expect(checkinGrantsOf(CHILD, inheritedGrant)).toEqual([{ via: 'inherited-role', roleDomainId: PARENT.id }])
+    })
+
+    it('역할을 정의한 부모 도메인에는 체크인할 수 없다', () => {
+      expect(isCheckinAllowed(PARENT, inheritedGrant)).toBe(false)
+    })
+
+    it('멤버가 아닌 형제 자식 도메인에는 체크인할 수 없다', () => {
+      /* 부모 역할은 모든 자식이 상속하므로, 멤버십 없이 열리면 테넌트 격리가 깨진다. */
+      expect(isCheckinAllowed(SIBLING, inheritedGrant)).toBe(false)
+    })
+  })
+
+  describe('자기 도메인에 정의된 역할', () => {
+    const ownGrant = facts({
+      memberDomainIds: [CHILD.id],
+      roleDomainIds: [CHILD.id]
+    })
+
+    it('그 도메인에 체크인할 수 있다', () => {
+      expect(checkinGrantsOf(CHILD, ownGrant)).toEqual([{ via: 'role', roleDomainId: CHILD.id }])
+    })
+
+    it('부모 도메인에는 체크인할 수 없다', () => {
+      expect(isCheckinAllowed(PARENT, ownGrant)).toBe(false)
+    })
+  })
+
+  describe('멤버십과 역할', () => {
+    it('멤버이지만 어떤 역할도 없으면 체크인할 수 없다', () => {
+      expect(isCheckinAllowed(CHILD, facts({ memberDomainIds: [CHILD.id] }))).toBe(false)
+    })
+
+    it('역할만 있고 멤버가 아니면 체크인할 수 없다', () => {
+      expect(isCheckinAllowed(CHILD, facts({ roleDomainIds: [CHILD.id] }))).toBe(false)
+    })
+
+    it('최상위 도메인은 상속 경로가 없다', () => {
+      const rootFacts = facts({ memberDomainIds: [PARENT.id], roleDomainIds: ['domain-other'] })
+      expect(isCheckinAllowed(PARENT, rootFacts)).toBe(false)
+    })
+  })
+
+  describe('파트너십으로 grant 된 역할', () => {
+    /* 공급자 도메인이 자기 역할을 고객 도메인에 grant 하고, 고객 사용자가 그 역할을 부여받았다. */
+    const partnerGrant = facts({
+      memberDomainIds: [CHILD.id],
+      roleDomainIds: [SUPPLIER.id],
+      partnerRoleDomainIds: [SUPPLIER.id]
+    })
+
+    it('멤버가 아니어도 공급자 도메인에 체크인할 수 있다', () => {
+      expect(checkinGrantsOf(SUPPLIER, partnerGrant)).toEqual([{ via: 'partner', roleDomainId: SUPPLIER.id }])
+    })
+
+    it('grant 되지 않은 역할은 파트너 경로를 열지 않는다', () => {
+      const notGranted = facts({
+        memberDomainIds: [CHILD.id],
+        roleDomainIds: [SUPPLIER.id]
+      })
+      expect(isCheckinAllowed(SUPPLIER, notGranted)).toBe(false)
+    })
+  })
+
+  describe('소유권', () => {
+    it('하위 호환 owner 캐시 컬럼으로 체크인할 수 있다', () => {
+      expect(checkinGrantsOf({ ...PARENT, owner: USER }, facts())).toEqual([{ via: 'owner' }])
+    })
+
+    it('DomainOwner 테이블 기준으로도 체크인할 수 있다', () => {
+      expect(checkinGrantsOf(PARENT, facts({ ownedDomainIds: [PARENT.id] }))).toEqual([{ via: 'owner' }])
+    })
+
+    it('다른 사용자가 owner 인 도메인은 체크인할 수 없다', () => {
+      expect(isCheckinAllowed({ ...PARENT, owner: 'user-2' }, facts())).toBe(false)
+    })
+  })
+
+  describe('여러 근거가 동시에 성립하는 경우', () => {
+    it('근거를 모두 반환한다 (권한 판정이 그중 권한 있는 역할을 골라야 한다)', () => {
+      const both = facts({
+        memberDomainIds: [CHILD.id],
+        roleDomainIds: [CHILD.id, PARENT.id],
+        ownedDomainIds: [CHILD.id]
+      })
+
+      expect(checkinGrantsOf(CHILD, both)).toEqual([
+        { via: 'owner' },
+        { via: 'role', roleDomainId: CHILD.id },
+        { via: 'inherited-role', roleDomainId: PARENT.id }
+      ])
+    })
+  })
+})