@things-factory/auth-base 10.1.254 → 10.1.257

package/dist-server/utils/profile-user.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The signed-in person as the client keeps them (`/auth/profile`, the store's `auth.user`).
+ *
+ * `id` is their own id, so nothing new is exposed. The client names whose unsaved drafts are kept in this
+ * browser by it (ADR-0098, `draftOwner()` in @operato/shell); without it no draft had an owner and none
+ * was written (ADR-0190, since 19ed1646178 left it out).
+ */
+export declare function profileUser(user: {
+    id: string;
+    username: string;
+    email?: string;
+    locale?: string;
+    name?: string;
+    userType?: string;
+}, grants: {
+    owner: boolean;
+    super: boolean;
+    unsafeIP?: boolean;
+    privileges: unknown[];
+}): {
+    owner: boolean;
+    super: boolean;
+    unsafeIP?: boolean;
+    privileges: unknown[];
+    id: string;
+    username: string;
+    email: string;
+    locale: string;
+    name: string;
+    userType: string;
+};

package/dist-server/utils/profile-user.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileUser = profileUser;
+/**
+ * The signed-in person as the client keeps them (`/auth/profile`, the store's `auth.user`).
+ *
+ * `id` is their own id, so nothing new is exposed. The client names whose unsaved drafts are kept in this
+ * browser by it (ADR-0098, `draftOwner()` in @operato/shell); without it no draft had an owner and none
+ * was written (ADR-0190, since 19ed1646178 left it out).
+ */
+function profileUser(user, grants) {
+    return {
+        id: user.id,
+        username: user.username,
+        email: user.email,
+        locale: user.locale,
+        name: user.name,
+        userType: user.userType,
+        ...grants
+    };
+}
+//# sourceMappingURL=profile-user.js.map

package/dist-server/utils/profile-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-user.js","sourceRoot":"","sources":["../../server/utils/profile-user.ts"],"names":[],"mappings":";;AAOA,kCAaC;AApBD;;;;;;GAMG;AACH,SAAgB,WAAW,CACzB,IAAyG,EACzG,MAAqF;IAErF,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,MAAM;KACV,CAAA;AACH,CAAC","sourcesContent":["/**\n * The signed-in person as the client keeps them (`/auth/profile`, the store's `auth.user`).\n *\n * `id` is their own id, so nothing new is exposed. The client names whose unsaved drafts are kept in this\n * browser by it (ADR-0098, `draftOwner()` in @operato/shell); without it no draft had an owner and none\n * was written (ADR-0190, since 19ed1646178 left it out).\n */\nexport function profileUser(\n  user: { id: string; username: string; email?: string; locale?: string; name?: string; userType?: string },\n  grants: { owner: boolean; super: boolean; unsafeIP?: boolean; privileges: unknown[] }\n) {\n  return {\n    id: user.id,\n    username: user.username,\n    email: user.email,\n    locale: user.locale,\n    name: user.name,\n    userType: user.userType,\n    ...grants\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.254",
+  "version": "10.1.257",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "793e2fd617db5bb917ec892e64956fb690f7e7b0"
+  "gitHead": "885b594299601ca4936f4f39701d6713273bbf1e"
 }

package/tests/audit-work.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Work done through the doors (ADR-0185 decision 6) - read from the audit: a declared mutation that went through is a
+ * piece of the person's work on that day; an undeclared one, a failed one, another person's or another day's is not.
+ */
+
+import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+
+const { registerWorkDoors, workDoneBy } = loadCompiled('service/audit/audit-work')
+const { AuditAction } = loadCompiled('service/audit/audit-action')
+const { AuditRequest } = loadCompiled('service/audit/audit-request')
+const { User } = loadCompiled('service/user/user')
+
+let domain: any, kim: any, lee: any
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'work', subdomain: 'work' })
+  kim = await getRepository(User).save({ name: 'kim', email: 'kim@work.test', status: 'activated' })
+  lee = await getRepository(User).save({ name: 'lee', email: 'lee@work.test', status: 'activated' })
+})
+
+const request = async (actor: any, at: string, fields: string, outcome: 'ok' | 'error' | 'both' | null, operationType = 'mutation') => {
+  const one = await getRepository(AuditRequest).save({ id: require('crypto').randomUUID(), domain, actor, createdAt: new Date(at), channel: 'graphql', operationType, fields })
+  for (const each of outcome === 'both' ? ['ok', 'error'] : outcome ? [outcome] : [])
+    await getRepository(AuditAction).save({ domain, actor, requestId: one.id, createdAt: new Date(at), kind: 'door.result', door: 'office:mutation', outcome: each })
+  return one
+}
+
+it('a declared mutation that went through is a piece of work, once per request and work', async () => {
+  registerWorkDoors([
+    { work: 'work.office.bank-lines', fields: ['updateMultipleCashTransaction', 'createCashTransaction'] },
+    { work: 'work.office.tax-invoices', fields: ['importOfficeTaxInvoices'] }
+  ])
+  expect(() => registerWorkDoors([{ work: 'work.other', fields: ['importOfficeTaxInvoices'] }])).toThrow(/declared as the work/)
+
+  await request(kim, '2026-11-10T01:00:00Z', 'updateMultipleCashTransaction,createCashTransaction', 'ok')
+  await request(kim, '2026-11-10T02:00:00Z', 'importOfficeTaxInvoices', 'ok')
+  await request(kim, '2026-11-10T03:00:00Z', 'importOfficeTaxInvoices', 'error')
+  await request(kim, '2026-11-10T03:30:00Z', 'createCashTransaction,importOfficeTaxInvoices', 'both')
+  await request(kim, '2026-11-10T04:00:00Z', 'saveMyDraft', 'ok')
+  await request(kim, '2026-11-10T05:00:00Z', 'importOfficeTaxInvoices', 'ok', 'query')
+  await request(lee, '2026-11-10T06:00:00Z', 'importOfficeTaxInvoices', 'ok')
+  await request(kim, '2026-11-17T01:00:00Z', 'importOfficeTaxInvoices', 'ok')
+
+  const done = await workDoneBy(authDataSource().manager, domain, kim.id, new Date('2026-11-09T00:00:00Z'), new Date('2026-11-16T00:00:00Z'))
+  expect(done.map((one: any) => [one.at.toISOString(), one.work])).toEqual([
+    ['2026-11-10T01:00:00.000Z', 'work.office.bank-lines'],
+    ['2026-11-10T02:00:00.000Z', 'work.office.tax-invoices']
+  ])
+})

package/tests/profile-user.test.ts

@@ -0,0 +1,24 @@
+import { profileUser } from '../server/utils/profile-user.js'
+
+/**
+ * The profile carries the person's own id: the client names whose unsaved drafts this browser keeps by it
+ * (ADR-0190). It was left out in 19ed1646178, and from then on no draft had an owner and none was written.
+ */
+describe('profileUser', () => {
+  it('carries the id with what the client shows and the grants', () => {
+    const user = { id: 'u-1', username: 'kim', email: 'kim@example.com', locale: 'ko', name: '김', userType: 'user', password: 'hash', salt: 'salt' }
+    const profile = profileUser(user, { owner: false, super: false, unsafeIP: false, privileges: [] })
+    expect(profile).toEqual({
+      id: 'u-1',
+      username: 'kim',
+      email: 'kim@example.com',
+      locale: 'ko',
+      name: '김',
+      userType: 'user',
+      owner: false,
+      super: false,
+      unsafeIP: false,
+      privileges: []
+    })
+  })
+})