@things-factory/auth-base 10.1.113 → 10.1.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.113",
+  "version": "10.1.121",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -34,9 +34,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.106",
+    "@things-factory/email-base": "^10.1.121",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.106",
+    "@things-factory/shell": "^10.1.121",
     "@things-factory/utils": "^10.1.20",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "9da1e467ddce23e600e64f08454289cb3b806212"
+  "gitHead": "23536a73b10f103048a2c893d3960b2a4e0f03dd"
 }

package/tests/access-entry-targets-db.test.ts

@@ -10,6 +10,7 @@
 import { parse } from 'graphql'
 
 import { clearEntryTargets, declareEntryTarget } from '../../ai-assistant/server/service/data-entry/entry-target'
+import { applyEntryProposal } from '../../ai-assistant/server/service/data-entry/entry-apply'
 
 import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
 import { loadCompiled } from './compiled'
@@ -22,6 +23,8 @@ const { Privilege } = loadCompiled('service/privilege/privilege')
 const { User } = loadCompiled('service/user/user')
 const access = loadCompiled('controllers/access-request')
 const targets = loadCompiled('ai-entry/access-entry-targets')
+const { judgePermission } = loadCompiled('utils/check-permission')
+const { AccessRequest } = loadCompiled('service/access-request/access-request')
 
 const rootFields = (document: string) =>
   ((parse(document).definitions[0] as any).selectionSet.selections as any[]).map(one => one.name.value)
@@ -31,6 +34,10 @@ const row = (values: Record<string, unknown>, index = 0) => ({ index, values, so
 describe('the declarations', () => {
   afterEach(() => clearEntryTargets())
 
+  it('the built public AUTH entry exports the same refusal formatter used by AI entry', () => {
+    expect(loadCompiled('index').privilegeRejection).toBe(loadCompiled('service/privilege/privilege-rejection').privilegeRejection)
+  })
+
   it('are accepted by the assistant as declared', () => {
     for (const target of targets.accessEntryTargets()) expect(() => declareEntryTarget(target)).not.toThrow()
   })
@@ -110,6 +117,35 @@ describe('the card says what the screen says', () => {
 
   const state = (user: any) => ({ domain, user })
 
+  it.each(['GRANT', 'DENY'])('a stored AI decision applies %s through the same controller and schedules the result after commit', async decision => {
+    const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
+    const target = targets.accessDecisionEntryTarget()
+    const notify = jest.fn().mockResolvedValue(undefined)
+    const afterCommit: any[] = []
+    const context = { state: { ...state(park), notify, afterCommit }, t: (key: string) => key }
+    const execute = jest.fn(async (document, variables) => {
+      expect(document).toBe(target.mutation)
+      const decided = await access.decideAccessRequest(variables.decision, context)
+      return { data: { decideAccessRequest: decided } }
+    })
+    const proposal = { key: 'ai-decision', kind: 'entry', target: target.key, rows: [row({ request: { id: request.id }, decision, ...(decision === 'GRANT' ? { role: { id: inbound.id } } : { reason: 'IT only' }) })] }
+    const outcome = await applyEntryProposal(proposal.key, {
+      messages: [{ id: 'm', proposals: [proposal] }], answered: false, state: context.state,
+      passesDoor: async door => {
+        expect(door).toBe('Mutation.decideAccessRequest')
+        return (await judgePermission({ category: 'user', privilege: 'mutation', owner: true }, park, domain)).permitted
+      },
+      execute
+    }, key => key === target.key ? target : undefined)
+    expect(outcome).toMatchObject({ verdict: 'accepted', applied: 1, missed: 0 })
+    expect(execute).toHaveBeenCalledTimes(1)
+    expect(notify).not.toHaveBeenCalled()
+    for (const step of afterCommit) await step.run()
+    expect(notify).toHaveBeenCalledWith(expect.objectContaining({ receivers: [kim.id], url: 'my-access-requests', title: `access-request.notify.${decision === 'GRANT' ? 'granted' : 'denied'}.title` }))
+    expect((await getRepository(AccessRequest).findOneBy({ id: request.id })).state).toBe(decision === 'GRANT' ? 'GRANTED' : 'DENIED')
+    expect(await User.hasPrivilege('mutation', 'warehouse', domain, kim)).toBe(decision === 'GRANT')
+  })
+
   it('★ the card\'s findings are reviewDecision\'s, for grant and for deny', async () => {
     const request = await access.requestAccess({ category: 'warehouse', privilege: 'mutation', reason: 'inbound' }, { state: { ...state(kim), afterCommit: [] } } as any)
     const rows = [