@things-factory/auth-base 10.1.16 → 10.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.16",
+  "version": "10.1.17",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "aff86bc162b42c1d933711f7bc85a073f1ddcd29"
+  "gitHead": "0c8214182702162ceb5398bdcf42ef14ea672394"
 }

package/tests/app-binding-db.test.ts

@@ -0,0 +1,162 @@
+/**
+ * App binding lookups — against a real database.
+ *
+ * Both defects here are invisible to a pure test. One is about which tenant's rows come
+ * back; the other is about the order paging and filtering happen in, which only shows up
+ * once there are more rows than fit on a page. Neither can be seen by reading the function.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { AppBindingQuery } = loadCompiled('service/app-binding/app-binding-query')
+
+const query = new AppBindingQuery()
+
+let ours: any
+let theirs: any
+
+function context(domain: any) {
+  return { state: { domain } } as any
+}
+
+async function makeUser(domain: any, username: string, userType: string) {
+  return await getRepository(User).save({
+    username,
+    email: `${username}@example.com`,
+    name: username,
+    userType,
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains: [domain]
+  })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const a = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  const b = await getRepository(Domain).save({ name: 'Plant B', subdomain: 'plant-b' })
+
+  ours = await getRepository(Domain).findOneBy({ id: a.id })
+  theirs = await getRepository(Domain).findOneBy({ id: b.id })
+})
+
+describe('one binding', () => {
+  it('answers for a binding in this domain', async () => {
+    const mine = await makeUser(ours, 'app-mine', 'application')
+
+    const found = await query.appBinding(mine.id, context(ours))
+
+    expect(found?.id).toBe(mine.id)
+  })
+
+  it('does not answer for a binding in another domain', async () => {
+    /*
+     * ⚠ The isolation case. The resolver read `domain` out of the context and never used
+     * it — `findOneBy({ id, userType })` searched every tenant, and a comment beside it
+     * said "TODO should check domain is available". An id from anywhere returned that
+     * application user's name, email and reference.
+     */
+    const foreign = await makeUser(theirs, 'app-theirs', 'application')
+
+    const found = await query.appBinding(foreign.id, context(ours))
+
+    expect(found).toBeFalsy()
+  })
+
+  it('answers the same for a foreign id as for one that does not exist', async () => {
+    /*
+     * Deliberate: a different answer would confirm that some id is real somewhere else.
+     */
+    const foreign = await makeUser(theirs, 'app-theirs', 'application')
+
+    const foreignAnswer = await query.appBinding(foreign.id, context(ours))
+    const nonsenseAnswer = await query.appBinding('00000000-0000-4000-8000-000000000000', context(ours))
+
+    expect(foreignAnswer).toEqual(nonsenseAnswer)
+  })
+
+  it('does not answer for a person, only for an application', async () => {
+    const person = await makeUser(ours, 'someone', 'user')
+
+    expect(await query.appBinding(person.id, context(ours))).toBeFalsy()
+  })
+})
+
+describe('the list', () => {
+  it('returns only the applications of this domain', async () => {
+    await makeUser(ours, 'app-one', 'application')
+    await makeUser(ours, 'a-person', 'user')
+    await makeUser(theirs, 'app-theirs', 'application')
+
+    const { items, total } = await query.appBindings({ filters: [] } as any, context(ours))
+
+    expect(items.map((one: any) => one.username)).toEqual(['app-one'])
+    expect(total).toBe(1)
+  })
+
+  it('counts every match, not the ones on this page', async () => {
+    /*
+     * ⚠ The paging case, and it needs rows to show at all.
+     *
+     * The filter used to run in JavaScript on whatever the paged query returned, and the
+     * total was `items.length` — the survivors of that one page. A grid asking for page 1
+     * of 2 was told the total was 2, so it never offered page 2 and the remaining bindings
+     * could not be reached from the screen at all.
+     */
+    for (let i = 0; i < 5; i++) {
+      await makeUser(ours, `app-${i}`, 'application')
+    }
+
+    const { items, total } = await query.appBindings(
+      { filters: [], pagination: { page: 1, limit: 2 } } as any,
+      context(ours)
+    )
+
+    expect(items).toHaveLength(2)
+    expect(total).toBe(5)
+  })
+
+  it('fills a page with matches rather than with whatever the page happened to hold', async () => {
+    /*
+     * The other half of the same defect. Interleaving people and applications used to leave
+     * a page of two carrying one row, or none, depending on the order rows came back.
+     */
+    for (let i = 0; i < 4; i++) {
+      await makeUser(ours, `person-${i}`, 'user')
+      await makeUser(ours, `app-${i}`, 'application')
+    }
+
+    const { items, total } = await query.appBindings(
+      { filters: [], pagination: { page: 1, limit: 3 } } as any,
+      context(ours)
+    )
+
+    expect(items).toHaveLength(3)
+    expect(items.every((one: any) => one.userType === 'application')).toBe(true)
+    expect(total).toBe(4)
+  })
+
+  it('reaches the last page', async () => {
+    for (let i = 0; i < 5; i++) {
+      await makeUser(ours, `app-${i}`, 'application')
+    }
+
+    const { items } = await query.appBindings(
+      { filters: [], pagination: { page: 3, limit: 2 } } as any,
+      context(ours)
+    )
+
+    expect(items).toHaveLength(1)
+  })
+})