@things-factory/auth-base 10.1.167 → 10.1.176

package/dist-server/utils/get-domain-users.d.ts

@@ -1,5 +1,17 @@
 import { EntityManager, SelectQueryBuilder } from 'typeorm';
 import { Domain } from '@things-factory/shell';
 import { User } from '../service/user/user.js';
+import { DomainOwnershipTarget } from './domain-ownership.js';
 export declare function getDomainUsers(domain: Partial<Domain>, trxMgr?: EntityManager): Promise<User[]>;
 export declare function buildDomainUsersQueryBuilder(domainId: string, alias?: string, trxMgr?: EntityManager): SelectQueryBuilder<User>;
+/**
+ * The people work in a domain may be given to: activated users who enter it — its members (`users_domains`) and its
+ * owners, who enter by ownership (`checkin-domain-rule`). The one answer for every 「who may hold this here」 list —
+ * a license's recipient, a sales opportunity's owner. By name.
+ */
+export declare function getDomainAssignees(domain: DomainOwnershipTarget, trxMgr?: EntityManager): Promise<User[]>;
+/**
+ * Whether a user enters the domain as a member or an owner — the membership half of `getDomainAssignees`. The account's
+ * status is the caller's to refuse first, in its own words.
+ */
+export declare function entersDomainAsAssignee(domain: DomainOwnershipTarget, user: Pick<User, 'id'>, trxMgr?: EntityManager): Promise<boolean>;

package/dist-server/utils/get-domain-users.js

@@ -2,17 +2,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDomainUsers = getDomainUsers;
 exports.buildDomainUsersQueryBuilder = buildDomainUsersQueryBuilder;
+exports.getDomainAssignees = getDomainAssignees;
+exports.entersDomainAsAssignee = entersDomainAsAssignee;
+const typeorm_1 = require("typeorm");
 const shell_1 = require("@things-factory/shell");
 const user_js_1 = require("../service/user/user.js");
+const domain_ownership_js_1 = require("./domain-ownership.js");
 async function getDomainUsers(domain, trxMgr) {
     const domainRepo = trxMgr?.getRepository(shell_1.Domain) || (0, shell_1.getRepository)(shell_1.Domain);
+    /* A domain given by its other fields (subdomain, name …) is found by them first. */
     if (!domain.id) {
-        const foundDomain = await domainRepo.findOne({ where: { id: domain.id } });
+        const { id: _id, ...condition } = domain;
+        const foundDomain = Object.keys(condition).length ? await domainRepo.findOne({ where: condition }) : null;
         if (!foundDomain)
-            throw new Error(`Failed to find domain by passed condition, ${domain}`);
+            throw new Error(`Failed to find domain by passed condition, ${JSON.stringify(condition)}`);
         domain = foundDomain;
     }
-    const qb = buildDomainUsersQueryBuilder(domain.id);
+    const qb = buildDomainUsersQueryBuilder(domain.id, 'USER', trxMgr);
     return await qb.getMany();
 }
 function buildDomainUsersQueryBuilder(domainId, alias = 'USER', trxMgr) {
@@ -26,4 +32,25 @@ function buildDomainUsersQueryBuilder(domainId, alias = 'USER', trxMgr) {
         .getQuery()}`);
     return qb;
 }
+/**
+ * The people work in a domain may be given to: activated users who enter it — its members (`users_domains`) and its
+ * owners, who enter by ownership (`checkin-domain-rule`). The one answer for every 「who may hold this here」 list —
+ * a license's recipient, a sales opportunity's owner. By name.
+ */
+async function getDomainAssignees(domain, trxMgr) {
+    const members = await buildDomainUsersQueryBuilder(domain.id, 'USER', trxMgr).andWhere('USER.status = :status', { status: user_js_1.UserStatus.ACTIVATED }).getMany();
+    const ownerIds = [...(await (0, domain_ownership_js_1.findDomainOwnerUserIds)(domain, trxMgr))].filter(id => !members.some(one => one.id === id));
+    const owners = ownerIds.length ? await (trxMgr?.getRepository(user_js_1.User) || (0, shell_1.getRepository)(user_js_1.User)).find({ where: { id: (0, typeorm_1.In)(ownerIds), status: user_js_1.UserStatus.ACTIVATED } }) : [];
+    return [...members, ...owners].sort((a, b) => (a.name ?? '').localeCompare(b.name ?? ''));
+}
+/**
+ * Whether a user enters the domain as a member or an owner — the membership half of `getDomainAssignees`. The account's
+ * status is the caller's to refuse first, in its own words.
+ */
+async function entersDomainAsAssignee(domain, user, trxMgr) {
+    if (!domain?.id || !user?.id)
+        return false;
+    const member = await buildDomainUsersQueryBuilder(domain.id, 'USER', trxMgr).andWhere('USER.id = :userId', { userId: user.id }).getExists();
+    return member || (await (0, domain_ownership_js_1.isDomainOwner)(domain, user, trxMgr));
+}
 //# sourceMappingURL=get-domain-users.js.map

package/dist-server/utils/get-domain-users.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-domain-users.js","sourceRoot":"","sources":["../../server/utils/get-domain-users.ts"],"names":[],"mappings":";;AAMA,wCAYC;AAED,oEAiBC;AAnCD,iDAA6D;AAE7D,qDAA8C;AAEvC,KAAK,UAAU,cAAc,CAAC,MAAuB,EAAE,MAAsB;IAClF,MAAM,UAAU,GAAuB,MAAM,EAAE,aAAa,CAAC,cAAM,CAAC,IAAI,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAA;IAE7F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,WAAW,GAAW,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,EAAE,CAAC,CAAA;QAEzF,MAAM,GAAG,WAAW,CAAA;IACtB,CAAC;IAED,MAAM,EAAE,GAA6B,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC5E,OAAO,MAAM,EAAE,CAAC,OAAO,EAAE,CAAA;AAC3B,CAAC;AAED,SAAgB,4BAA4B,CAC1C,QAAgB,EAChB,QAAgB,MAAM,EACtB,MAAsB;IAEtB,MAAM,QAAQ,GAAqB,MAAM,EAAE,aAAa,CAAC,cAAI,CAAC,IAAI,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACrF,MAAM,EAAE,GAA6B,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAClB,GAAG,KAAK,UAAU,EAAE;SACjB,QAAQ,EAAE;SACV,MAAM,CAAC,wBAAwB,CAAC;SAChC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC;SACtC,KAAK,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,CAAC;SAC3D,QAAQ,EAAE,EAAE,CAChB,CAAA;IAED,OAAO,EAAE,CAAA;AACX,CAAC","sourcesContent":["import { EntityManager, Repository, SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { User } from '../service/user/user.js'\n\nexport async function getDomainUsers(domain: Partial<Domain>, trxMgr?: EntityManager): Promise<User[]> {\n  const domainRepo: Repository<Domain> = trxMgr?.getRepository(Domain) || getRepository(Domain)\n\n  if (!domain.id) {\n    const foundDomain: Domain = await domainRepo.findOne({ where: { id: domain.id } })\n    if (!foundDomain) throw new Error(`Failed to find domain by passed condition, ${domain}`)\n\n    domain = foundDomain\n  }\n\n  const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id)\n  return await qb.getMany()\n}\n\nexport function buildDomainUsersQueryBuilder(\n  domainId: string,\n  alias: string = 'USER',\n  trxMgr?: EntityManager\n): SelectQueryBuilder<User> {\n  const userRepo: Repository<User> = trxMgr?.getRepository(User) || getRepository(User)\n  const qb: SelectQueryBuilder<User> = userRepo.createQueryBuilder(alias)\n  qb.select().andWhere(\n    `${alias}.id IN ${qb\n      .subQuery()\n      .select('USERS_DOMAINS.users_id')\n      .from('users_domains', 'USERS_DOMAINS')\n      .where('USERS_DOMAINS.domains_id = :domainId', { domainId })\n      .getQuery()}`\n  )\n\n  return qb\n}\n"]}
+{"version":3,"file":"get-domain-users.js","sourceRoot":"","sources":["../../server/utils/get-domain-users.ts"],"names":[],"mappings":";;AAOA,wCAcC;AAED,oEAiBC;AAOD,gDAKC;AAMD,wDAIC;AA9DD,qCAA2E;AAE3E,iDAA6D;AAE7D,qDAA0D;AAC1D,+DAAoG;AAE7F,KAAK,UAAU,cAAc,CAAC,MAAuB,EAAE,MAAsB;IAClF,MAAM,UAAU,GAAuB,MAAM,EAAE,aAAa,CAAC,cAAM,CAAC,IAAI,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAA;IAE7F,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,CAAA;QACxC,MAAM,WAAW,GAAW,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxH,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAE5G,MAAM,GAAG,WAAW,CAAA;IACtB,CAAC;IAED,MAAM,EAAE,GAA6B,4BAA4B,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5F,OAAO,MAAM,EAAE,CAAC,OAAO,EAAE,CAAA;AAC3B,CAAC;AAED,SAAgB,4BAA4B,CAC1C,QAAgB,EAChB,QAAgB,MAAM,EACtB,MAAsB;IAEtB,MAAM,QAAQ,GAAqB,MAAM,EAAE,aAAa,CAAC,cAAI,CAAC,IAAI,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACrF,MAAM,EAAE,GAA6B,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAClB,GAAG,KAAK,UAAU,EAAE;SACjB,QAAQ,EAAE;SACV,MAAM,CAAC,wBAAwB,CAAC;SAChC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC;SACtC,KAAK,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,CAAC;SAC3D,QAAQ,EAAE,EAAE,CAChB,CAAA;IAED,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,MAA6B,EAAE,MAAsB;IAC5F,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,oBAAU,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IAC3J,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,IAAA,4CAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACtH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,cAAI,CAAC,IAAI,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,oBAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACpK,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,sBAAsB,CAAC,MAA6B,EAAE,IAAsB,EAAE,MAAsB;IACxH,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAA;IAC3I,OAAO,MAAM,IAAI,CAAC,MAAM,IAAA,mCAAa,EAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAC9D,CAAC","sourcesContent":["import { EntityManager, In, Repository, SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { User, UserStatus } from '../service/user/user.js'\nimport { DomainOwnershipTarget, findDomainOwnerUserIds, isDomainOwner } from './domain-ownership.js'\n\nexport async function getDomainUsers(domain: Partial<Domain>, trxMgr?: EntityManager): Promise<User[]> {\n  const domainRepo: Repository<Domain> = trxMgr?.getRepository(Domain) || getRepository(Domain)\n\n  /* A domain given by its other fields (subdomain, name …) is found by them first. */\n  if (!domain.id) {\n    const { id: _id, ...condition } = domain\n    const foundDomain: Domain = Object.keys(condition).length ? await domainRepo.findOne({ where: condition as any }) : null\n    if (!foundDomain) throw new Error(`Failed to find domain by passed condition, ${JSON.stringify(condition)}`)\n\n    domain = foundDomain\n  }\n\n  const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, 'USER', trxMgr)\n  return await qb.getMany()\n}\n\nexport function buildDomainUsersQueryBuilder(\n  domainId: string,\n  alias: string = 'USER',\n  trxMgr?: EntityManager\n): SelectQueryBuilder<User> {\n  const userRepo: Repository<User> = trxMgr?.getRepository(User) || getRepository(User)\n  const qb: SelectQueryBuilder<User> = userRepo.createQueryBuilder(alias)\n  qb.select().andWhere(\n    `${alias}.id IN ${qb\n      .subQuery()\n      .select('USERS_DOMAINS.users_id')\n      .from('users_domains', 'USERS_DOMAINS')\n      .where('USERS_DOMAINS.domains_id = :domainId', { domainId })\n      .getQuery()}`\n  )\n\n  return qb\n}\n\n/**\n * The people work in a domain may be given to: activated users who enter it — its members (`users_domains`) and its\n * owners, who enter by ownership (`checkin-domain-rule`). The one answer for every 「who may hold this here」 list —\n * a license's recipient, a sales opportunity's owner. By name.\n */\nexport async function getDomainAssignees(domain: DomainOwnershipTarget, trxMgr?: EntityManager): Promise<User[]> {\n  const members = await buildDomainUsersQueryBuilder(domain.id, 'USER', trxMgr).andWhere('USER.status = :status', { status: UserStatus.ACTIVATED }).getMany()\n  const ownerIds = [...(await findDomainOwnerUserIds(domain, trxMgr))].filter(id => !members.some(one => one.id === id))\n  const owners = ownerIds.length ? await (trxMgr?.getRepository(User) || getRepository(User)).find({ where: { id: In(ownerIds), status: UserStatus.ACTIVATED } }) : []\n  return [...members, ...owners].sort((a, b) => (a.name ?? '').localeCompare(b.name ?? ''))\n}\n\n/**\n * Whether a user enters the domain as a member or an owner — the membership half of `getDomainAssignees`. The account's\n * status is the caller's to refuse first, in its own words.\n */\nexport async function entersDomainAsAssignee(domain: DomainOwnershipTarget, user: Pick<User, 'id'>, trxMgr?: EntityManager): Promise<boolean> {\n  if (!domain?.id || !user?.id) return false\n  const member = await buildDomainUsersQueryBuilder(domain.id, 'USER', trxMgr).andWhere('USER.id = :userId', { userId: user.id }).getExists()\n  return member || (await isDomainOwner(domain, user, trxMgr))\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.167",
+  "version": "10.1.176",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "86283c5d35042880be6827f777067fc5e6417eed"
+  "gitHead": "24928f127d73de0e9946423bd4c3295f54cce03d"
 }

package/tests/domain-assignees-db.test.ts

@@ -0,0 +1,95 @@
+/**
+ * Who work in a domain may be given to - its activated members and its activated owners (ADR-0138, architect's
+ * ruling 2026-10-17). A license's recipient and a sales opportunity's owner ask the same question; the answer is here
+ * once. Before it, Office listed members and owners, sales members only, and an owner without a membership row could
+ * take a license but not an opportunity.
+ *
+ * And `getDomainUsers`: it read the users outside the caller's transaction, and looked a domain given without an id
+ * up by the id it did not have.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, ENTITIES } from './db'
+import { loadCompiled } from './compiled'
+
+const { DataSource } = require('typeorm')
+const shell = require('@things-factory/shell')
+
+const { User } = loadCompiled('service/user/user')
+const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
+const { getDomainAssignees, entersDomainAsAssignee, getDomainUsers } = loadCompiled('utils/get-domain-users')
+
+let domain: any
+let other: any
+
+async function makeUser(name: string, domains: any[], status = 'activated') {
+  return await getRepository(User).save({ username: name, email: `${name}@example.com`, name, salt: User.generateSalt(), status, domains })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'hatiolab', subdomain: 'hatiolab' })
+  other = await getRepository(Domain).save({ name: 'other', subdomain: 'other' })
+})
+
+describe('the people work in a domain may be given to', () => {
+  it('are its activated members and its activated owners, by name, each once', async () => {
+    await makeUser('bora', [domain])
+    await makeUser('chul', [domain], 'inactive')
+    const owner = await makeUser('ahn', [other])
+    await getRepository(DomainOwner).save({ domain, user: owner })
+    const memberOwner = await makeUser('dana', [domain])
+    await getRepository(DomainOwner).save({ domain, user: memberOwner })
+    const columnOwner = await makeUser('eun', [])
+    await getRepository(Domain).update({ id: domain.id }, { owner: columnOwner.id })
+    const lockedOwner = await makeUser('fin', [], 'locked')
+    await getRepository(DomainOwner).save({ domain, user: lockedOwner })
+    await makeUser('gil', [other])
+
+    const read = await getRepository(Domain).findOneBy({ id: domain.id })
+    expect((await getDomainAssignees(read)).map((one: any) => one.name)).toEqual(['ahn', 'bora', 'dana', 'eun'])
+  })
+
+  it('a member or an owner enters; the status is the caller\'s to refuse', async () => {
+    const read = async () => await getRepository(Domain).findOneBy({ id: domain.id })
+    const inactive = await makeUser('chul', [domain], 'inactive')
+    const owner = await makeUser('ahn', [other])
+    await getRepository(DomainOwner).save({ domain, user: owner })
+    const stranger = await makeUser('gil', [other])
+
+    expect(await entersDomainAsAssignee(await read(), inactive)).toBe(true)
+    expect(await entersDomainAsAssignee(await read(), owner)).toBe(true)
+    expect(await entersDomainAsAssignee(await read(), stranger)).toBe(false)
+    expect(await entersDomainAsAssignee(await read(), { id: undefined })).toBe(false)
+  })
+})
+
+describe('getDomainUsers', () => {
+  it('reads through the manager it is given, not past it', async () => {
+    /* A second database the framework registry does not know: only the manager reaches it. */
+    const elsewhere = await new DataSource({ type: 'sqlite', database: ':memory:', synchronize: true, namingStrategy: new shell.NamingStrategy(), entities: ENTITIES }).initialize()
+    try {
+      const there = await elsewhere.getRepository(Domain).save({ name: 'there', subdomain: 'there' })
+      await elsewhere.getRepository(User).save({ username: 'han', email: 'han@example.com', name: 'han', salt: User.generateSalt(), status: 'activated', domains: [there] })
+
+      expect((await getDomainUsers(there, elsewhere.manager)).map((one: any) => one.name)).toEqual(['han'])
+      expect((await getDomainAssignees(there, elsewhere.manager)).map((one: any) => one.name)).toEqual(['han'])
+    } finally {
+      await elsewhere.destroy()
+    }
+  })
+
+  it('finds a domain given without its id by the fields it has', async () => {
+    await makeUser('bora', [domain])
+    expect((await getDomainUsers({ subdomain: 'hatiolab' })).map((one: any) => one.name)).toEqual(['bora'])
+    await expect(getDomainUsers({ subdomain: 'nowhere' })).rejects.toThrow(/Failed to find domain/)
+    await expect(getDomainUsers({})).rejects.toThrow(/Failed to find domain/)
+  })
+})