@things-factory/auth-base 10.1.16 → 10.1.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.16",
+  "version": "10.1.18",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "aff86bc162b42c1d933711f7bc85a073f1ddcd29"
+  "gitHead": "608fe1a70f430ae9c3aa20497173cecc8121373e"
 }

package/tests/app-binding-db.test.ts

@@ -0,0 +1,162 @@
+/**
+ * App binding lookups — against a real database.
+ *
+ * Both defects here are invisible to a pure test. One is about which tenant's rows come
+ * back; the other is about the order paging and filtering happen in, which only shows up
+ * once there are more rows than fit on a page. Neither can be seen by reading the function.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { User } = loadCompiled('service/user/user')
+const { AppBindingQuery } = loadCompiled('service/app-binding/app-binding-query')
+
+const query = new AppBindingQuery()
+
+let ours: any
+let theirs: any
+
+function context(domain: any) {
+  return { state: { domain } } as any
+}
+
+async function makeUser(domain: any, username: string, userType: string) {
+  return await getRepository(User).save({
+    username,
+    email: `${username}@example.com`,
+    name: username,
+    userType,
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains: [domain]
+  })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const a = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  const b = await getRepository(Domain).save({ name: 'Plant B', subdomain: 'plant-b' })
+
+  ours = await getRepository(Domain).findOneBy({ id: a.id })
+  theirs = await getRepository(Domain).findOneBy({ id: b.id })
+})
+
+describe('one binding', () => {
+  it('answers for a binding in this domain', async () => {
+    const mine = await makeUser(ours, 'app-mine', 'application')
+
+    const found = await query.appBinding(mine.id, context(ours))
+
+    expect(found?.id).toBe(mine.id)
+  })
+
+  it('does not answer for a binding in another domain', async () => {
+    /*
+     * ⚠ The isolation case. The resolver read `domain` out of the context and never used
+     * it — `findOneBy({ id, userType })` searched every tenant, and a comment beside it
+     * said "TODO should check domain is available". An id from anywhere returned that
+     * application user's name, email and reference.
+     */
+    const foreign = await makeUser(theirs, 'app-theirs', 'application')
+
+    const found = await query.appBinding(foreign.id, context(ours))
+
+    expect(found).toBeFalsy()
+  })
+
+  it('answers the same for a foreign id as for one that does not exist', async () => {
+    /*
+     * Deliberate: a different answer would confirm that some id is real somewhere else.
+     */
+    const foreign = await makeUser(theirs, 'app-theirs', 'application')
+
+    const foreignAnswer = await query.appBinding(foreign.id, context(ours))
+    const nonsenseAnswer = await query.appBinding('00000000-0000-4000-8000-000000000000', context(ours))
+
+    expect(foreignAnswer).toEqual(nonsenseAnswer)
+  })
+
+  it('does not answer for a person, only for an application', async () => {
+    const person = await makeUser(ours, 'someone', 'user')
+
+    expect(await query.appBinding(person.id, context(ours))).toBeFalsy()
+  })
+})
+
+describe('the list', () => {
+  it('returns only the applications of this domain', async () => {
+    await makeUser(ours, 'app-one', 'application')
+    await makeUser(ours, 'a-person', 'user')
+    await makeUser(theirs, 'app-theirs', 'application')
+
+    const { items, total } = await query.appBindings({ filters: [] } as any, context(ours))
+
+    expect(items.map((one: any) => one.username)).toEqual(['app-one'])
+    expect(total).toBe(1)
+  })
+
+  it('counts every match, not the ones on this page', async () => {
+    /*
+     * ⚠ The paging case, and it needs rows to show at all.
+     *
+     * The filter used to run in JavaScript on whatever the paged query returned, and the
+     * total was `items.length` — the survivors of that one page. A grid asking for page 1
+     * of 2 was told the total was 2, so it never offered page 2 and the remaining bindings
+     * could not be reached from the screen at all.
+     */
+    for (let i = 0; i < 5; i++) {
+      await makeUser(ours, `app-${i}`, 'application')
+    }
+
+    const { items, total } = await query.appBindings(
+      { filters: [], pagination: { page: 1, limit: 2 } } as any,
+      context(ours)
+    )
+
+    expect(items).toHaveLength(2)
+    expect(total).toBe(5)
+  })
+
+  it('fills a page with matches rather than with whatever the page happened to hold', async () => {
+    /*
+     * The other half of the same defect. Interleaving people and applications used to leave
+     * a page of two carrying one row, or none, depending on the order rows came back.
+     */
+    for (let i = 0; i < 4; i++) {
+      await makeUser(ours, `person-${i}`, 'user')
+      await makeUser(ours, `app-${i}`, 'application')
+    }
+
+    const { items, total } = await query.appBindings(
+      { filters: [], pagination: { page: 1, limit: 3 } } as any,
+      context(ours)
+    )
+
+    expect(items).toHaveLength(3)
+    expect(items.every((one: any) => one.userType === 'application')).toBe(true)
+    expect(total).toBe(4)
+  })
+
+  it('reaches the last page', async () => {
+    for (let i = 0; i < 5; i++) {
+      await makeUser(ours, `app-${i}`, 'application')
+    }
+
+    const { items } = await query.appBindings(
+      { filters: [], pagination: { page: 3, limit: 2 } } as any,
+      context(ours)
+    )
+
+    expect(items).toHaveLength(1)
+  })
+})

package/translations/en.json

@@ -15,8 +15,8 @@
   "error.token or password is invalid": "token or password is invalid",
   "error.unavailable-domain": "unavailable domain",
   "error.user credential not found": "user credential not found. You need to register device to use biometric authentication.",
-  "error.user credential registeration failed": "user credential registration failed. It may be an already registered credential.",
-  "error.user credential registration not allowed": "user credential registration failed. The registration timed out or was not allowed.",
+  "error.user credential registration failed": "registration did not complete. the device was cancelled, or the server could not be reached.",
+  "error.user credential registration not allowed": "this device could not be registered. the registration timed out, or the credential is already registered.",
   "error.user duplicated.": "there is a user account using same email or user ID.",
   "error.user not activated": "user is not activated",
   "error.user not found": "user not found",

package/translations/ja.json

@@ -15,8 +15,8 @@
   "error.token or password is invalid": "トークンまたはパスワードが無効です.",
   "error.unavailable-domain": "使用できないドメインです.",
   "error.user credential not found": "ユーザー資格情報が見つかりません. 生体認証を使用するにはデバイスを登録する必要があります.",
-  "error.user credential registeration failed": "ユーザー資格情報の登録に失敗しました。既に登録されている資格情報の可能性があります。",
-  "error.user credential registration not allowed": "ユーザー資格情報の登録に失敗しました。登録のタイムアウトまたは登録が許可されていません。",
+  "error.user credential registration failed": "登録を完了できませんでした。デバイスでキャンセルされたか、サーバーに到達できませんでした。",
+  "error.user credential registration not allowed": "このデバイスは登録できませんでした。登録がタイムアウトしたか、すでに登録済みです。",
   "error.user duplicated.": "ユーザーが重複しています.",
   "error.user not activated": "ユーザーがアクティブ化されていません.",
   "error.user not found": "ユーザーが存在しません.",

package/translations/ko.json

@@ -15,8 +15,8 @@
   "error.token or password is invalid": "토큰 또는 비밀번호가 유효하지 않습니다.",
   "error.unavailable-domain": "사용할 수 없는 도메인입니다.",
   "error.user credential not found": "사용자 자격 증명을 찾을 수 없습니다. 바이오메트릭 인증을 사용하기 위해서는 먼저 기기를 등록해야 합니다.",
-  "error.user credential registeration failed": "사용자 인증서 등록이 실패하였습니다. 이미 등록된 인증서일 수 있습니다.",
-  "error.user credential registration not allowed": "사용자 인증서 등록이 실패하였습니다. 등록 시간이 초과되었거나 등록이 허용되지 않았습니다.",
+  "error.user credential registration failed": "등록을 마치지 못했습니다. 기기에서 취소했거나 서버에 닿지 못했습니다.",
+  "error.user credential registration not allowed": "이 기기를 등록할 수 없습니다. 등록 시간이 초과되었거나, 이미 등록된 기기입니다.",
   "error.user duplicated": "동일한 이메일이나 사용자아이디로 가입된 계정이 이미 존재합니다.",
   "error.user not activated": "사용자가 활성화되지 않았습니다.",
   "error.user not found": "사용자가 존재하지 않습니다.",

package/translations/ms.json

@@ -15,8 +15,8 @@
   "error.token or password is invalid": "Token atau kata laluan tidak sah",
   "error.unavailable-domain": "Domain tidak tersedia",
   "error.user credential not found": "kelayakan pengguna tidak ditemui. Anda perlu mendaftarkan peranti untuk menggunakan pengesahan biometrik.",
-  "error.user credential registeration failed": "pendaftaran kelayakan pengguna gagal. Mungkin kelayakan tersebut sudah didaftarkan.",
-  "error.user credential registration not allowed": "pendaftaran kelayakan pengguna gagal. Masa pendaftaran telah tamat atau pendaftaran tidak dibenarkan.",
+  "error.user credential registration failed": "pendaftaran tidak selesai. peranti dibatalkan, atau pelayan tidak dapat dihubungi.",
+  "error.user credential registration not allowed": "peranti ini tidak dapat didaftarkan. masa pendaftaran tamat, atau kelayakan sudah didaftarkan.",
   "error.user duplicated": "terdapat akaun pengguna yang menggunakan e-mel atau ID pengguna yang sama.",
   "error.user not activated": "Pengguna tidak diaktifkan",
   "error.user not found": "Pengguna tidak ditemui",

package/translations/zh.json

@@ -1,14 +1,13 @@
 {
   "error.auth error": "认证错误。{message}",
   "error.authn verification failed": "用户认证失败。",
-  "error.ownership required": "没有权限。需要域或系统所有者权限。",
-  "error.user verification failed": "用户验证失败",
   "error.confirm password not matched": "新密码与确认密码不匹配！",
   "error.domain mismatch": "证书不适用于该域！",
   "error.domain not allowed": "用户无权限使用`{subdomain}`域！",
   "error.email already exists": "电子邮件已被其他用户使用！",
   "error.failed to find x": "查询{x}失败！",
   "error.invalid username": "无效的用户名: {username}",
+  "error.ownership required": "没有权限。需要域或系统所有者权限。",
   "error.password should be supported": "应支持初始密码或默认密码",
   "error.password should match the rule": "密码应符合以下规则。${rule}",
   "error.password used in the past": "使用过的密码！",
@@ -16,13 +15,14 @@
   "error.token or password is invalid": "令牌或密码无效！",
   "error.unavailable-domain": "不可用的域名",
   "error.user credential not found": "用户凭证未找到。您需要注册设备以使用生物识别认证。",
-  "error.user credential registeration failed": "用户凭证注册失败。可能是已注册的凭证。",
-  "error.user credential registration not allowed": "用户凭证注册失败。注册超时或注册不被允许。",
+  "error.user credential registration failed": "注册未完成。设备上已取消，或者无法连接到服务器。",
+  "error.user credential registration not allowed": "无法注册此设备。注册超时，或者该凭证已经注册过了。",
   "error.user duplicated": "存在一个用户帐户使用相同的电子邮件或用户ID。",
   "error.user not activated": "用户未激活！",
   "error.user not found": "找不到用户",
   "error.user or verification token not found": "找不到用户或验证令牌。",
   "error.user validation failed": "用户验证失败！",
+  "error.user verification failed": "用户验证失败",
   "error.username already exists": "用户名已被其他用户使用",
   "error.x is not a member of y": "{x}不是{y}的成员",
   "error.x privilege required": "没有权限。需要 {x} 权限。",