@things-factory/auth-base 10.1.250 → 10.1.256

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.250",
+  "version": "10.1.256",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -35,10 +35,10 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.250",
+    "@things-factory/email-base": "^10.1.254",
     "@things-factory/env": "^10.1.149",
-    "@things-factory/shell": "^10.1.247",
-    "@things-factory/task-lease": "^10.1.247",
+    "@things-factory/shell": "^10.1.254",
+    "@things-factory/task-lease": "^10.1.254",
     "@things-factory/utils": "^10.1.179",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "4fdb6d24ef24f43d9e158d4c6d6396ad3097bb9e"
+  "gitHead": "2fd641697190ce6e87bcf454a60b2321553e8110"
 }

package/tests/audit-work.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Work done through the doors (ADR-0185 decision 6) - read from the audit: a declared mutation that went through is a
+ * piece of the person's work on that day; an undeclared one, a failed one, another person's or another day's is not.
+ */
+
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { registerWorkDoors, workDoneBy } = loadCompiled('service/audit/audit-work')
+const { AuditAction } = loadCompiled('service/audit/audit-action')
+const { AuditRequest } = loadCompiled('service/audit/audit-request')
+const { User } = loadCompiled('service/user/user')
+
+let domain: any, kim: any, lee: any
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'work', subdomain: 'work' })
+  kim = await getRepository(User).save({ name: 'kim', email: 'kim@work.test', status: 'activated' })
+  lee = await getRepository(User).save({ name: 'lee', email: 'lee@work.test', status: 'activated' })
+})
+
+const request = async (actor: any, at: string, fields: string, outcome: 'ok' | 'error' | 'both' | null, operationType = 'mutation') => {
+  const one = await getRepository(AuditRequest).save({ id: require('crypto').randomUUID(), domain, actor, createdAt: new Date(at), channel: 'graphql', operationType, fields })
+  for (const each of outcome === 'both' ? ['ok', 'error'] : outcome ? [outcome] : [])
+    await getRepository(AuditAction).save({ domain, actor, requestId: one.id, createdAt: new Date(at), kind: 'door.result', door: 'office:mutation', outcome: each })
+  return one
+}
+
+it('a declared mutation that went through is a piece of work, once per request and work', async () => {
+  registerWorkDoors([
+    { work: 'work.office.bank-lines', fields: ['updateMultipleCashTransaction', 'createCashTransaction'] },
+    { work: 'work.office.tax-invoices', fields: ['importOfficeTaxInvoices'] }
+  ])
+  expect(() => registerWorkDoors([{ work: 'work.other', fields: ['importOfficeTaxInvoices'] }])).toThrow(/declared as the work/)
+
+  await request(kim, '2026-11-10T01:00:00Z', 'updateMultipleCashTransaction,createCashTransaction', 'ok')
+  await request(kim, '2026-11-10T02:00:00Z', 'importOfficeTaxInvoices', 'ok')
+  await request(kim, '2026-11-10T03:00:00Z', 'importOfficeTaxInvoices', 'error')
+  await request(kim, '2026-11-10T03:30:00Z', 'createCashTransaction,importOfficeTaxInvoices', 'both')
+  await request(kim, '2026-11-10T04:00:00Z', 'saveMyDraft', 'ok')
+  await request(kim, '2026-11-10T05:00:00Z', 'importOfficeTaxInvoices', 'ok', 'query')
+  await request(lee, '2026-11-10T06:00:00Z', 'importOfficeTaxInvoices', 'ok')
+  await request(kim, '2026-11-17T01:00:00Z', 'importOfficeTaxInvoices', 'ok')
+
+  const done = await workDoneBy(authDataSource().manager, domain, kim.id, new Date('2026-11-09T00:00:00Z'), new Date('2026-11-16T00:00:00Z'))
+  expect(done.map((one: any) => [one.at.toISOString(), one.work])).toEqual([
+    ['2026-11-10T01:00:00.000Z', 'work.office.bank-lines'],
+    ['2026-11-10T02:00:00.000Z', 'work.office.tax-invoices']
+  ])
+})

package/tests/passkey-signin-route-db.test.ts

@@ -0,0 +1,139 @@
+/**
+ * The passkey sign-in route, through `authenticate401Middleware`, the way the sign-in screen reaches it.
+ *
+ * The screen used to fetch it. A fetch says `Accept: *\/*`, the middleware takes that for a page request,
+ * so a locked account got the whole `auth-activate` page back as the body - and the screen put that body
+ * in a toast. Now the screen posts a form, as the password does, and every refusal is answered with the
+ * page its code leads to: the activate page for a locked or unconfirmed account, the sign-in page with
+ * its one line for the rest.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+import { SoftwareAuthenticator } from './passkey-authenticator'
+
+const { User } = loadCompiled('service/user/user')
+const { authenticate401Middleware } = loadCompiled('middlewares/authenticate-401-middleware')
+const { webAuthnGlobalPublicRouter } = loadCompiled('router/webauthn-router')
+const CODES = loadCompiled('constants/error-code')
+const passkey = loadCompiled('controllers/passkey')
+
+const SITE = { rpID: 'localhost', origin: 'http://localhost:3000' }
+const NAVIGATION = 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
+
+let domain: any
+let kim: any
+
+const signinRoute = webAuthnGlobalPublicRouter.stack.find(
+  (layer: any) => layer.path === '/auth/signin-webauthn' && layer.methods.includes('POST')
+)
+
+/** What the browser gets back for the form the screen posts. */
+async function post(body: (challenge: string) => any) {
+  const { challenge } = await passkey.signinOptions(SITE)
+  const answer: any = { status: 200, cookies: {} }
+
+  const context: any = {
+    t: (key: string) => key,
+    method: 'POST',
+    path: '/auth/signin-webauthn',
+    originalUrl: '/auth/signin-webauthn',
+    header: { accept: NAVIGATION },
+    hostname: SITE.rpID,
+    origin: SITE.origin,
+    secure: false,
+    query: {},
+    session: { challenge },
+    state: { domain },
+    request: { body: body(challenge) },
+    cookies: { set: (key: string, value: string) => (answer.cookies[key] = value) },
+    render: async (view: string, options: any) => (answer.page = { view, ...options }),
+    redirect: (url: string) => (answer.redirect = url)
+  }
+
+  await authenticate401Middleware(context, () => signinRoute.stack[0](context, async () => {}))
+
+  return { ...answer, status: context.status, body: context.body }
+}
+
+async function registered(user: any) {
+  const authenticator = new SoftwareAuthenticator()
+  const { challenge } = await passkey.registrationOptions(user, 'Operato', SITE)
+  await passkey.registerPasskey(user, authenticator.register(challenge, SITE), 'macOS · Chrome', challenge, SITE)
+  return authenticator
+}
+
+const formWith = (authenticator: SoftwareAuthenticator) => (challenge: string) => ({
+  response: JSON.stringify(authenticator.assert(challenge, SITE)),
+  redirectTo: '/office'
+})
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'factory', subdomain: 'factory' })
+
+  const salt = User.generateSalt()
+  kim = await getRepository(User).save({
+    username: 'kim',
+    email: 'kim@example.com',
+    name: 'kim',
+    salt,
+    password: User.encode('Passw0rd!', salt),
+    status: 'activated',
+    domains: [domain]
+  })
+})
+
+it('signs in and goes on to check-in, with the token in the cookie', async () => {
+  const answer = await post(formWith(await registered(kim)))
+
+  expect(answer.redirect).toBe('/auth/checkin/factory?redirect_to=%2Foffice')
+  expect(Object.values(answer.cookies)).toHaveLength(1)
+})
+
+describe.each([
+  ['locked', CODES.USER_LOCKED],
+  ['inactive', CODES.USER_NOT_ACTIVATED]
+])('a %s account', (status, errorCode) => {
+  it('lands on the activate page with its code and its line, the way a password does', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(User).update({ id: kim.id }, { status, lockedAt: new Date() })
+
+    const answer = await post(formWith(authenticator))
+
+    expect(answer.status).toBe(401)
+    expect(answer.page.pageElement).toBe('auth-activate')
+    expect(answer.page.data).toMatchObject({ errorCode, message: `error.${errorCode}`, username: 'kim', redirectTo: '/office' })
+    expect(answer.cookies).toEqual({})
+  })
+})
+
+describe.each([
+  ['deleted', CODES.USER_DELETED],
+  ['password_reset_required', CODES.PASSWORD_SETUP_PENDING]
+])('a %s account', (status, errorCode) => {
+  it('stays on the sign-in page with its one line', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(User).update({ id: kim.id }, { status })
+
+    const answer = await post(formWith(authenticator))
+
+    expect(answer.page.pageElement).toBe('auth-signin')
+    expect(answer.page.data.message).toBe(`error.${errorCode}`)
+  })
+})
+
+it('an answer that is not JSON is a failed verification, said in one line on the sign-in page', async () => {
+  const answer = await post(() => ({ response: '<not json>', redirectTo: '/office' }))
+
+  expect(answer.page.pageElement).toBe('auth-signin')
+  expect(answer.page.data.message).toBe(`error.${CODES.AUTHN_VERIFICATION_FAILED}`)
+})