@things-factory/auth-base 10.1.111 → 10.1.116

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.111",
+  "version": "10.1.116",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "f33122c15e5b3e45393129e9418e2c367a273ade"
+  "gitHead": "49fa935cc703be70200eef4d29f473de98f871ce"
 }

package/tests/access-entry-targets-db.test.ts

@@ -10,6 +10,7 @@
 import { parse } from 'graphql'
 
 import { clearEntryTargets, declareEntryTarget } from '../../ai-assistant/server/service/data-entry/entry-target'
+import { applyEntryProposal } from '../../ai-assistant/server/service/data-entry/entry-apply'
 
 import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
 import { loadCompiled } from './compiled'
@@ -22,6 +23,8 @@ const { Privilege } = loadCompiled('service/privilege/privilege')
 const { User } = loadCompiled('service/user/user')
 const access = loadCompiled('controllers/access-request')
 const targets = loadCompiled('ai-entry/access-entry-targets')
+const { judgePermission } = loadCompiled('utils/check-permission')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
 
 const rootFields = (document: string) =>
   ((parse(document).definitions[0] as any).selectionSet.selections as any[]).map(one => one.name.value)
@@ -31,6 +34,10 @@ const row = (values: Record<string, unknown>, index = 0) => ({ index, values, so
 describe('the declarations', () => {
   afterEach(() => clearEntryTargets())
 
+  it('the built public AUTH entry exports the same refusal formatter used by AI entry', () => {
+    expect(loadCompiled('index').privilegeRejection).toBe(loadCompiled('service/privilege/privilege-rejection').privilegeRejection)
+  })
+
   it('are accepted by the assistant as declared', () => {
     for (const target of targets.accessEntryTargets()) expect(() => declareEntryTarget(target)).not.toThrow()
   })
@@ -110,6 +117,35 @@ describe('the card says what the screen says', () => {
 
   const state = (user: any) => ({ domain, user })
 
+  it.each(['GRANT', 'DENY'])('a stored AI decision applies %s through the same controller and schedules the result after commit', async decision => {
+    const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
+    const target = targets.accessDecisionEntryTarget()
+    const notify = jest.fn().mockResolvedValue(undefined)
+    const afterCommit: any[] = []
+    const context = { state: { ...state(park), notify, afterCommit }, t: (key: string) => key }
+    const execute = jest.fn(async (document, variables) => {
+      expect(document).toBe(target.mutation)
+      const decided = await access.decideAccessRequest(variables.decision, context)
+      return { data: { decideAccessRequest: decided } }
+    })
+    const proposal = { key: 'ai-decision', kind: 'entry', target: target.key, rows: [row({ request: { id: request.id }, decision, ...(decision === 'GRANT' ? { role: { id: inbound.id } } : { reason: 'IT only' }) })] }
+    const outcome = await applyEntryProposal(proposal.key, {
+      messages: [{ id: 'm', proposals: [proposal] }], answered: false, state: context.state,
+      passesDoor: async door => {
+        expect(door).toBe('Mutation.decideAccessRequest')
+        return (await judgePermission({ category: 'user', privilege: 'mutation', owner: true }, park, domain)).permitted
+      },
+      execute
+    }, key => key === target.key ? target : undefined)
+    expect(outcome).toMatchObject({ verdict: 'accepted', applied: 1, missed: 0 })
+    expect(execute).toHaveBeenCalledTimes(1)
+    expect(notify).not.toHaveBeenCalled()
+    for (const step of afterCommit) await step.run()
+    expect(notify).toHaveBeenCalledWith(expect.objectContaining({ receivers: [kim.id], url: 'my-access-requests', title: `access-request.notify.${decision === 'GRANT' ? 'granted' : 'denied'}.title` }))
+    expect((await getRepository(AccessRequest).findOneBy({ id: request.id })).state).toBe(decision === 'GRANT' ? 'GRANTED' : 'DENIED')
+    expect(await User.hasPrivilege('mutation', 'warehouse', domain, kim)).toBe(decision === 'GRANT')
+  })
+
   it('★ the card\'s findings are reviewDecision\'s, for grant and for deny', async () => {
     const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
     const rows = [

package/tests/list-inheritance-db.test.ts

@@ -0,0 +1,149 @@
+/**
+ * A list reads this domain's rows only - whatever `inherited` the caller sent (2026-10-02).
+ *
+ * `getQueryBuilderFromListParams` honours `inherited: Include | Only`, so a list that hands the client's ListParam
+ * through lets a child domain read its parent's rows. For these lists a parent's rows are another tenant's
+ * configuration or people, and no screen asks for them: the query pins `inherited` to None. The same pin as
+ * `accessRequests` (access-request-db.test.ts).
+ *
+ * Roles are not here - the role screens ask for the parent's roles on purpose (assignable scope, docs/design/auth-rebuild.md).
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { AuthProvider } = loadCompiled('service/auth-provider/auth-provider')
+const { AuthProviderQuery } = loadCompiled('service/auth-provider/auth-provider-query')
+const { Appliance } = loadCompiled('service/appliance/appliance')
+const { ApplianceQuery } = loadCompiled('service/appliance/appliance-query')
+const { Application } = loadCompiled('service/application/application')
+const { ApplicationQuery } = loadCompiled('service/application/application-query')
+const { Invitation } = loadCompiled('service/invitation/invitation')
+const { InvitationStatus } = loadCompiled('utils/invitation-state')
+const { InvitationQuery } = loadCompiled('service/invitation/invitation-query')
+const { Partner } = loadCompiled('service/partner/partner')
+const { PartnerQuery } = loadCompiled('service/partner/partner-query')
+const { LoginHistory } = loadCompiled('service/login-history/login-history')
+const { LoginHistoryQuery } = loadCompiled('service/login-history/login-history-query')
+
+let parent: any
+let child: any
+let partnerDomain: any
+let parentUser: any
+let childUser: any
+
+async function makeUser(name: string, domains: any[]) {
+  return await getRepository(User).save({
+    username: name,
+    email: `${name}@example.com`,
+    name,
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains
+  })
+}
+
+const from = (domain: any, user: any) => ({ state: { domain, user } }) as any
+const ONLY = { inherited: 'Only' } as any
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const savedParent = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  parent = await getRepository(Domain).findOneBy({ id: savedParent.id })
+  const savedChild = await getRepository(Domain).save({ name: 'Plant A-1', subdomain: 'plant-a-1', parent })
+  child = await getRepository(Domain).findOneBy({ id: savedChild.id })
+  partnerDomain = await getRepository(Domain).save({ name: 'Vendor', subdomain: 'vendor' })
+
+  parentUser = await makeUser('parent-admin', [parent])
+  childUser = await makeUser('child-admin', [child])
+})
+
+/*
+ * Each list: the parent reads its own row (so an empty answer below is the pin, not a broken fixture), and the
+ * child asking for the parent's with `inherited: Only` reads nothing.
+ */
+const LISTS: [string, () => Promise<any>, (params: any, context: any) => Promise<any>][] = [
+  [
+    'auth providers',
+    () => getRepository(AuthProvider).save({ domain: parent, type: 'keycloak', clientSecret: 'parent-secret' }),
+    (params, context) => new AuthProviderQuery().authProviders(params, context)
+  ],
+  [
+    'appliances',
+    () => getRepository(Appliance).save({ domain: parent, name: 'gate', serialNo: 'gate-SN', brand: 'Acme', model: 'X1' }),
+    (params, context) => new ApplianceQuery().appliances(params, context)
+  ],
+  [
+    'edges',
+    () => getRepository(Appliance).save({ domain: parent, name: 'edge', serialNo: 'edge-SN', brand: 'Acme', model: 'X1' }),
+    (params, context) => new ApplianceQuery().edges(params, context)
+  ],
+  [
+    'applications',
+    () =>
+      getRepository(Application).save({
+        domain: parent,
+        name: 'billing',
+        email: 'billing@acme.z',
+        url: 'https://billing.example.com',
+        redirectUrl: 'https://billing.example.com/callback',
+        status: 0,
+        type: 'OTHERS',
+        appSecret: 'parent-app-secret'
+      }),
+    (params, context) => new ApplicationQuery().applications(params, context)
+  ],
+  [
+    'invitations',
+    () =>
+      getRepository(Invitation).save({
+        email: 'lee@acme.z',
+        domain: parent,
+        status: InvitationStatus.PENDING,
+        token: 'parent-token',
+        expiresAt: new Date(Date.now() + 3600_000)
+      }),
+    (params, context) => new InvitationQuery().invitations(params, context)
+  ],
+  [
+    'partners',
+    () => getRepository(Partner).save({ domain: parent, partnerDomain, requestedAt: new Date() }),
+    (params, context) => new PartnerQuery().partners(params, context)
+  ],
+  [
+    'login histories',
+    () => LoginHistory.stamp(parent, parentUser, '10.0.0.1'),
+    (params, context) => new LoginHistoryQuery().loginHistories(params, context)
+  ]
+]
+
+describe.each(LISTS)('%s', (_name, seed, list) => {
+  it("★ the parent reads its own row - the fixture is real", async () => {
+    await seed()
+    const answer = await list({}, from(parent, parentUser))
+    expect(answer.items).toHaveLength(1)
+  })
+
+  it("★ a child domain asking for the parent's with inherited: Only reads nothing", async () => {
+    await seed()
+    const answer = await list(ONLY, from(child, childUser))
+    expect(answer.items).toEqual([])
+    expect(answer.total).toBe(0)
+  })
+
+  it("a child domain asking with inherited: Include reads nothing of the parent's", async () => {
+    await seed()
+    const answer = await list({ inherited: 'Include' }, from(child, childUser))
+    expect(answer.items).toEqual([])
+  })
+})