@things-factory/auth-base 10.1.111 → 10.1.113

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.111",
+  "version": "10.1.113",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "f33122c15e5b3e45393129e9418e2c367a273ade"
+  "gitHead": "9da1e467ddce23e600e64f08454289cb3b806212"
 }

package/tests/list-inheritance-db.test.ts

@@ -0,0 +1,149 @@
+/**
+ * A list reads this domain's rows only - whatever `inherited` the caller sent (2026-10-02).
+ *
+ * `getQueryBuilderFromListParams` honours `inherited: Include | Only`, so a list that hands the client's ListParam
+ * through lets a child domain read its parent's rows. For these lists a parent's rows are another tenant's
+ * configuration or people, and no screen asks for them: the query pins `inherited` to None. The same pin as
+ * `accessRequests` (access-request-db.test.ts).
+ *
+ * Roles are not here - the role screens ask for the parent's roles on purpose (assignable scope, docs/design/auth-rebuild.md).
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { AuthProvider } = loadCompiled('service/auth-provider/auth-provider')
+const { AuthProviderQuery } = loadCompiled('service/auth-provider/auth-provider-query')
+const { Appliance } = loadCompiled('service/appliance/appliance')
+const { ApplianceQuery } = loadCompiled('service/appliance/appliance-query')
+const { Application } = loadCompiled('service/application/application')
+const { ApplicationQuery } = loadCompiled('service/application/application-query')
+const { Invitation } = loadCompiled('service/invitation/invitation')
+const { InvitationStatus } = loadCompiled('utils/invitation-state')
+const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
+const { Partner } = loadCompiled('service/partner/partner')
+const { PartnerQuery } = loadCompiled('service/partner/partner-query')
+const { LoginHistory } = loadCompiled('service/login-history/login-history')
+const { LoginHistoryQuery } = loadCompiled('service/login-history/login-history-query')
+
+let parent: any
+let child: any
+let partnerDomain: any
+let parentUser: any
+let childUser: any
+
+async function makeUser(name: string, domains: any[]) {
+  return await getRepository(User).save({
+    username: name,
+    email: `${name}@example.com`,
+    name,
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains
+  })
+}
+
+const from = (domain: any, user: any) => ({ state: { domain, user } }) as any
+const ONLY = { inherited: 'Only' } as any
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const savedParent = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  parent = await getRepository(Domain).findOneBy({ id: savedParent.id })
+  const savedChild = await getRepository(Domain).save({ name: 'Plant A-1', subdomain: 'plant-a-1', parent })
+  child = await getRepository(Domain).findOneBy({ id: savedChild.id })
+  partnerDomain = await getRepository(Domain).save({ name: 'Vendor', subdomain: 'vendor' })
+
+  parentUser = await makeUser('parent-admin', [parent])
+  childUser = await makeUser('child-admin', [child])
+})
+
+/*
+ * Each list: the parent reads its own row (so an empty answer below is the pin, not a broken fixture), and the
+ * child asking for the parent's with `inherited: Only` reads nothing.
+ */
+const LISTS: [string, () => Promise<any>, (params: any, context: any) => Promise<any>][] = [
+  [
+    'auth providers',
+    () => getRepository(AuthProvider).save({ domain: parent, type: 'keycloak', clientSecret: 'parent-secret' }),
+    (params, context) => new AuthProviderQuery().authProviders(params, context)
+  ],
+  [
+    'appliances',
+    () => getRepository(Appliance).save({ domain: parent, name: 'gate', serialNo: 'gate-SN', brand: 'Acme', model: 'X1' }),
+    (params, context) => new ApplianceQuery().appliances(params, context)
+  ],
+  [
+    'edges',
+    () => getRepository(Appliance).save({ domain: parent, name: 'edge', serialNo: 'edge-SN', brand: 'Acme', model: 'X1' }),
+    (params, context) => new ApplianceQuery().edges(params, context)
+  ],
+  [
+    'applications',
+    () =>
+      getRepository(Application).save({
+        domain: parent,
+        name: 'billing',
+        email: 'billing@acme.z',
+        url: 'https://billing.example.com',
+        redirectUrl: 'https://billing.example.com/callback',
+        status: 0,
+        type: 'OTHERS',
+        appSecret: 'parent-app-secret'
+      }),
+    (params, context) => new ApplicationQuery().applications(params, context)
+  ],
+  [
+    'invitations',
+    () =>
+      getRepository(Invitation).save({
+        email: 'lee@acme.z',
+        domain: parent,
+        status: InvitationStatus.PENDING,
+        token: 'parent-token',
+        expiresAt: new Date(Date.now() + 3600_000)
+      }),
+    (params, context) => new InvitationQuery().invitations(params, context)
+  ],
+  [
+    'partners',
+    () => getRepository(Partner).save({ domain: parent, partnerDomain, requestedAt: new Date() }),
+    (params, context) => new PartnerQuery().partners(params, context)
+  ],
+  [
+    'login histories',
+    () => LoginHistory.stamp(parent, parentUser, '10.0.0.1'),
+    (params, context) => new LoginHistoryQuery().loginHistories(params, context)
+  ]
+]
+
+describe.each(LISTS)('%s', (_name, seed, list) => {
+  it("★ the parent reads its own row - the fixture is real", async () => {
+    await seed()
+    const answer = await list({}, from(parent, parentUser))
+    expect(answer.items).toHaveLength(1)
+  })
+
+  it("★ a child domain asking for the parent's with inherited: Only reads nothing", async () => {
+    await seed()
+    const answer = await list(ONLY, from(child, childUser))
+    expect(answer.items).toEqual([])
+    expect(answer.total).toBe(0)
+  })
+
+  it("a child domain asking with inherited: Include reads nothing of the parent's", async () => {
+    await seed()
+    const answer = await list({ inherited: 'Include' }, from(child, childUser))
+    expect(answer.items).toEqual([])
+  })
+})