@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/add-user-gates.test.ts

@@ -1,34 +0,0 @@
-import { buildSchema } from 'type-graphql'
-
-import { loadCompiled } from './compiled'
-
-/**
- * The questions the user popups ask are gated as the actions they lead to.
- *
- * `checkUserExistence` is asked only by the add-user popup, before `inviteUser` / `createUser`
- * (each `user:mutation`, owner granted). It asked `user:query` alone, so a domain owner without that role was refused
- * the lookup and the popup took the refusal for "no account" - and set out to create an account for someone who
- * had one. `mayIssuePasswordSetupLink` answers for the setup link button, so it stands where `issuePasswordSetupLink` does.
- */
-const { schema: declared } = loadCompiled('service/index')
-const { privilegeDirectiveResolver, privilegeOfField } = loadCompiled('service/privilege/privilege-directive')
-
-function gateOf(field: string) {
-  const gate = privilegeOfField('Query', field)
-  return [gate.known, gate['gate']?.category, gate['gate']?.privilege, gate['gate']?.owner]
-}
-
-describe('what the user popups ask', () => {
-  beforeAll(async () => {
-    const schema = await buildSchema({ resolvers: declared.resolverClasses, validate: false })
-    privilegeDirectiveResolver(schema, { modules: [] })
-  })
-
-  it('★ checkUserExistence asks what adding a user asks - user:mutation, or the owner', () => {
-    expect(gateOf('checkUserExistence')).toEqual([true, 'user', 'mutation', true])
-  })
-
-  it('mayIssuePasswordSetupLink asks what issuing asks', () => {
-    expect(gateOf('mayIssuePasswordSetupLink')).toEqual([true, 'user', 'mutation', true])
-  })
-})

package/tests/app-binding-db.test.ts

@@ -1,210 +0,0 @@
-/**
- * App binding lookups — against a real database.
- *
- * Both defects here are invisible to a pure test. One is about which tenant's rows come
- * back; the other is about the order paging and filtering happen in, which only shows up
- * once there are more rows than fit on a page. Neither can be seen by reading the function.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { User } = loadCompiled('service/user/user')
-const { AppBindingQuery } = loadCompiled('service/app-binding/app-binding-query')
-
-const query = new AppBindingQuery()
-
-let ours: any
-let theirs: any
-
-function context(domain: any) {
-  return { state: { domain } } as any
-}
-
-async function makeUser(domain: any, username: string, userType: string) {
-  return await getRepository(User).save({
-    username,
-    email: `${username}@example.com`,
-    name: username,
-    userType,
-    salt: User.generateSalt(),
-    status: 'activated',
-    domains: [domain]
-  })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const a = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
-  const b = await getRepository(Domain).save({ name: 'Plant B', subdomain: 'plant-b' })
-
-  ours = await getRepository(Domain).findOneBy({ id: a.id })
-  theirs = await getRepository(Domain).findOneBy({ id: b.id })
-})
-
-describe('one binding', () => {
-  it('answers for a binding in this domain', async () => {
-    const mine = await makeUser(ours, 'app-mine', 'application')
-
-    const found = await query.appBinding(mine.id, context(ours))
-
-    expect(found?.id).toBe(mine.id)
-  })
-
-  it('does not answer for a binding in another domain', async () => {
-    /*
-     * ⚠ The isolation case. The resolver read `domain` out of the context and never used
-     * it — `findOneBy({ id, userType })` searched every tenant, and a comment beside it
-     * said "TODO should check domain is available". An id from anywhere returned that
-     * application user's name, email and reference.
-     */
-    const foreign = await makeUser(theirs, 'app-theirs', 'application')
-
-    const found = await query.appBinding(foreign.id, context(ours))
-
-    expect(found).toBeFalsy()
-  })
-
-  it('answers the same for a foreign id as for one that does not exist', async () => {
-    /*
-     * Deliberate: a different answer would confirm that some id is real somewhere else.
-     */
-    const foreign = await makeUser(theirs, 'app-theirs', 'application')
-
-    const foreignAnswer = await query.appBinding(foreign.id, context(ours))
-    const nonsenseAnswer = await query.appBinding('00000000-0000-4000-8000-000000000000', context(ours))
-
-    expect(foreignAnswer).toEqual(nonsenseAnswer)
-  })
-
-  it('does not answer for a person, only for an application', async () => {
-    const person = await makeUser(ours, 'someone', 'user')
-
-    expect(await query.appBinding(person.id, context(ours))).toBeFalsy()
-  })
-})
-
-describe('the list', () => {
-  it('returns only the applications of this domain', async () => {
-    await makeUser(ours, 'app-one', 'application')
-    await makeUser(ours, 'a-person', 'user')
-    await makeUser(theirs, 'app-theirs', 'application')
-
-    const { items, total } = await query.appBindings({ filters: [] } as any, context(ours))
-
-    expect(items.map((one: any) => one.username)).toEqual(['app-one'])
-    expect(total).toBe(1)
-  })
-
-  it('counts every match, not the ones on this page', async () => {
-    /*
-     * ⚠ The paging case, and it needs rows to show at all.
-     *
-     * The filter used to run in JavaScript on whatever the paged query returned, and the
-     * total was `items.length` — the survivors of that one page. A grid asking for page 1
-     * of 2 was told the total was 2, so it never offered page 2 and the remaining bindings
-     * could not be reached from the screen at all.
-     */
-    for (let i = 0; i < 5; i++) {
-      await makeUser(ours, `app-${i}`, 'application')
-    }
-
-    const { items, total } = await query.appBindings(
-      { filters: [], pagination: { page: 1, limit: 2 } } as any,
-      context(ours)
-    )
-
-    expect(items).toHaveLength(2)
-    expect(total).toBe(5)
-  })
-
-  it('fills a page with matches rather than with whatever the page happened to hold', async () => {
-    /*
-     * The other half of the same defect. Interleaving people and applications used to leave
-     * a page of two carrying one row, or none, depending on the order rows came back.
-     */
-    for (let i = 0; i < 4; i++) {
-      await makeUser(ours, `person-${i}`, 'user')
-      await makeUser(ours, `app-${i}`, 'application')
-    }
-
-    const { items, total } = await query.appBindings(
-      { filters: [], pagination: { page: 1, limit: 3 } } as any,
-      context(ours)
-    )
-
-    expect(items).toHaveLength(3)
-    expect(items.every((one: any) => one.userType === 'application')).toBe(true)
-    expect(total).toBe(4)
-  })
-
-  it('reaches the last page', async () => {
-    for (let i = 0; i < 5; i++) {
-      await makeUser(ours, `app-${i}`, 'application')
-    }
-
-    const { items } = await query.appBindings(
-      { filters: [], pagination: { page: 3, limit: 2 } } as any,
-      context(ours)
-    )
-
-    expect(items).toHaveLength(1)
-  })
-})
-
-describe('the free-text term', () => {
-  /*
-   * The screen now sends the term itself (`ListParam.search`) and lets the server say where it
-   * looks. This door builds with the older `buildQuery`, which only understood search *filters* -
-   * so a term that arrived here was dropped, and the whole list came back as if it were the answer.
-   * A person searching for a binding's name read that as "not here".
-   */
-  it('narrows the list to the bindings that match', async () => {
-    await makeUser(ours, 'erp-bridge', 'application')
-    await makeUser(ours, 'label-printer', 'application')
-    await makeUser(ours, 'erp-archive', 'application')
-
-    const { items, total } = await query.appBindings({ search: 'erp' } as any, context(ours))
-
-    expect(items.map((one: any) => one.username).sort()).toEqual(['erp-archive', 'erp-bridge'])
-    expect(total).toBe(2)
-  })
-
-  it('looks in the email too', async () => {
-    await makeUser(ours, 'scanner-1', 'application')
-    await makeUser(ours, 'scanner-2', 'application')
-
-    const { items } = await query.appBindings({ search: 'scanner-2@example' } as any, context(ours))
-
-    expect(items.map((one: any) => one.username)).toEqual(['scanner-2'])
-  })
-
-  it('still answers only for this domain when a term is given', async () => {
-    /* A term must not widen the tenant: the OR of the search sits inside the domain condition. */
-    await makeUser(ours, 'erp-ours', 'application')
-    await makeUser(theirs, 'erp-theirs', 'application')
-
-    const { items } = await query.appBindings({ search: 'erp' } as any, context(ours))
-
-    expect(items.map((one: any) => one.username)).toEqual(['erp-ours'])
-  })
-
-  it('an empty term is no term', async () => {
-    await makeUser(ours, 'app-one', 'application')
-    await makeUser(ours, 'app-two', 'application')
-
-    const { total } = await query.appBindings({ search: '   ' } as any, context(ours))
-
-    expect(total).toBe(2)
-  })
-})
-

package/tests/app-binding-delete-db.test.ts

@@ -1,188 +0,0 @@
-/**
- * `deleteAppBinding` — cutting one client off without touching the application.
- *
- * ── What the door was ───────────────────────────────────────────────────────
- * It read the domain out of the context, used it for nothing, and ran
- *
- *     getRepository(User).delete({ id })
- *
- * That criteria names neither the kind of row nor the tenant. `AppBinding` is a `User` wearing
- * a type, so every account in the installation is the same kind of row as the one this was for:
- * a person, a domain owner, an appliance's shadow user, another tenant's binding. Any id at all
- * deleted that row and answered true.
- *
- * It carried no `@privilege` either, so the schema recorded it as open and anyone holding a
- * valid token could reach it.
- *
- * ── Why revocation is a delete here ─────────────────────────────────────────
- * An appliance keeps its identity when its credential is taken away, because past rows point at
- * it as creator and updater and a new secret should land on the same subject. A binding is not
- * like that: it is created by the OAuth2 exchange whenever a client is granted access, and the
- * grant is the only thing it records. Deleting it is the revocation — there is no second state
- * for it to be in (ADR-0055).
- *
- * ⚠ sqlite (`tests/db.ts`).
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Application } = loadCompiled('service/application/application')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { AppBindingMutation } = loadCompiled('service/app-binding/app-binding-mutation')
-const { ApplicationMutation } = loadCompiled('service/application/application-mutation')
-
-const mutation = new AppBindingMutation()
-const applications = new ApplicationMutation()
-
-let ours: any
-let theirs: any
-let actor: any
-
-function context(d: any) {
-  return {
-    state: { domain: d, user: actor, tx: undefined },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-async function makeApplication(name: string, d: any) {
-  return await applications.createApplication(
-    {
-      name,
-      email: `${name}@acme.z`,
-      url: `https://${name}.example.com`,
-      redirectUrl: `https://${name}.example.com/callback`,
-      type: 'OTHERS'
-    },
-    context(d)
-  )
-}
-
-async function bind(application: any, label: string, d: any) {
-  return await getRepository(User).save({
-    username: `${label}@acme`,
-    email: `${label}@acme`,
-    name: label,
-    userType: 'application',
-    reference: application.id,
-    status: UserStatus.ACTIVATED,
-    domains: [d]
-  })
-}
-
-async function stillThere(id: string) {
-  return !!(await getRepository(User).findOneBy({ id }))
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  ours = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  theirs = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta' })
-  actor = await getRepository(User).save({
-    username: 'operator@acme.z',
-    email: 'operator@acme.z',
-    name: 'operator',
-    status: UserStatus.ACTIVATED,
-    domains: [ours]
-  })
-})
-
-describe('cutting off a binding of ours', () => {
-  it('deletes it', async () => {
-    const application = await makeApplication('billing', ours)
-    const binding = await bind(application, 'binding-a', ours)
-
-    await mutation.deleteAppBinding(binding.id, context(ours))
-
-    expect(await stillThere(binding.id)).toBe(false)
-  })
-
-  it('leaves the application and its other bindings alone', async () => {
-    /* Revoking one client is not deleting the application. */
-    const application = await makeApplication('billing', ours)
-    const going = await bind(application, 'binding-a', ours)
-    const staying = await bind(application, 'binding-b', ours)
-
-    await mutation.deleteAppBinding(going.id, context(ours))
-
-    expect(await stillThere(staying.id)).toBe(true)
-    expect(await getRepository(Application).findOneBy({ id: application.id })).not.toBeNull()
-  })
-})
-
-describe('an id that is not a binding of ours', () => {
-  it('does not delete a person', async () => {
-    /*
-     * ⚠ The worst of these. A person's account is the same kind of row as a binding, so
-     * `delete({ id })` took it with the same answer — and the caller did not have to be anyone
-     * in particular, because the mutation carried no privilege at all.
-     */
-    const person = await getRepository(User).save({
-      username: 'kim@acme.z',
-      email: 'kim@acme.z',
-      name: 'kim',
-      status: UserStatus.ACTIVATED,
-      domains: [ours]
-    })
-
-    await mutation.deleteAppBinding(person.id, context(ours))
-
-    expect(await stillThere(person.id)).toBe(true)
-  })
-
-  it('does not delete an appliance shadow user', async () => {
-    /*
-     * ⚠ Deleting one stops the device at its next request and leaves the appliance on screen
-     * looking registered — the same end state as the appliance delete leak, reached from here.
-     */
-    const applianceUser = await getRepository(User).save({
-      username: 'device@acme',
-      email: 'device@acme',
-      name: 'device',
-      userType: 'appliance',
-      reference: 'some-appliance-id',
-      status: UserStatus.ACTIVATED,
-      domains: [ours]
-    })
-
-    await mutation.deleteAppBinding(applianceUser.id, context(ours))
-
-    expect(await stillThere(applianceUser.id)).toBe(true)
-  })
-
-  it('does not delete another tenant s binding', async () => {
-    /* ⚠ The tenant boundary. `appBinding` already refuses to read one; this deleted it. */
-    const application = await makeApplication('billing', theirs)
-    const foreign = await bind(application, 'binding-theirs', theirs)
-
-    await mutation.deleteAppBinding(foreign.id, context(ours))
-
-    expect(await stillThere(foreign.id)).toBe(true)
-  })
-
-  it('answers the same whether the id was ours, theirs, or nothing', async () => {
-    /*
-     * Telling them apart would confirm that some id is real somewhere else — the reason
-     * `appBinding` answers nothing for both cases.
-     */
-    const application = await makeApplication('billing', theirs)
-    const foreign = await bind(application, 'binding-theirs', theirs)
-
-    await expect(mutation.deleteAppBinding(foreign.id, context(ours))).resolves.toBe(true)
-    await expect(mutation.deleteAppBinding('no-such-id', context(ours))).resolves.toBe(true)
-  })
-})

package/tests/appliance-credential-state-db.test.ts

@@ -1,207 +0,0 @@
-/**
- * What the screen is allowed to ask about a credential (ADR-0085, the revocation screen).
- *
- * Two questions, and they are not the same one:
- *
- *   applianceCredentialRevocable   does revoking work here at all?
- *   Appliance.credentialRevoked    has this one been revoked?
- *
- * ── Why the first exists ────────────────────────────────────────────────────
- * Revocation is behind `credential/revocable`, and the client cannot read configuration. Without
- * an answer the screen either hides a feature the installation asked for or shows a button that
- * always refuses — and a button that always refuses reads as a broken product rather than as
- * something nobody turned on.
- *
- * ── Why the second exists ───────────────────────────────────────────────────
- * Revoking clears `accessToken`, so a revoked appliance and one that was never issued a
- * credential look identical on screen: an empty box. They are opposite situations. The state
- * that tells them apart is on the shadow user, not on the appliance row, so the field has to be
- * resolved rather than read.
- *
- * ⚠ sqlite (`tests/db.ts`).
- */
-
-import { config } from '@things-factory/env'
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Appliance } = loadCompiled('service/appliance/appliance')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { ApplianceMutation } = loadCompiled('service/appliance/appliance-mutation')
-const { ApplianceQuery } = loadCompiled('service/appliance/appliance-query')
-
-const mutation = new ApplianceMutation()
-const query = new ApplianceQuery()
-
-const configGet = config.get
-
-function revocationOff() {
-  config.get = configGet
-}
-
-function revocationOn() {
-  config.get = ((key: string, fallback?: any) =>
-    key === 'credential/revocable' ? true : configGet(key, fallback)) as typeof config.get
-}
-
-let domain: any
-let actor: any
-
-function context(d: any = domain) {
-  return {
-    state: { domain: d, user: actor, tx: undefined },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-async function register(name: string) {
-  return await mutation.createAppliance({ name, serialNo: `${name}-SN`, brand: 'Acme', model: 'X1' }, context())
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  revocationOff()
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  revocationOff()
-  await resetAuthDatabase()
-
-  domain = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  actor = await getRepository(User).save({
-    username: 'operator@acme.z',
-    email: 'operator@acme.z',
-    name: 'operator',
-    status: UserStatus.ACTIVATED,
-    domains: [domain]
-  })
-})
-
-describe('does revoking work here', () => {
-  it('says no where the installation configured nothing', async () => {
-    /*
-     * ⚠ The default. An installation that takes this release and changes no configuration must
-     * not grow a button, because the mutation behind it answers 404.
-     */
-    expect(await query.applianceCredentialRevocable()).toBe(false)
-  })
-
-  it('says yes once the installation turns it on', async () => {
-    revocationOn()
-
-    expect(await query.applianceCredentialRevocable()).toBe(true)
-  })
-
-  it('answers the same thing the door does', async () => {
-    /*
-     * ⚠ The two have to move together. If the answer said yes while the mutation refused, the
-     * screen would offer an action that cannot be completed — which is the exact thing this
-     * query exists to prevent.
-     */
-    const appliance = await register('gate-a')
-
-    expect(await query.applianceCredentialRevocable()).toBe(false)
-    await expect(mutation.revokeApplianceCredential(appliance.id, context())).rejects.toThrow(/not enabled/)
-
-    revocationOn()
-
-    expect(await query.applianceCredentialRevocable()).toBe(true)
-    await expect(mutation.revokeApplianceCredential(appliance.id, context())).resolves.toBeTruthy()
-  })
-})
-
-describe('has this one been revoked', () => {
-  it('says no for an appliance nobody has issued a credential for', async () => {
-    /*
-     * ⚠ The case the whole field is for. This appliance and a revoked one both show an empty
-     * access token; only this answer separates "waiting to be set up" from "deliberately shut
-     * off".
-     */
-    const appliance = await register('gate-b')
-
-    expect(await query.credentialRevoked(appliance)).toBe(false)
-  })
-
-  it('says no for one holding a working credential', async () => {
-    const issued = await mutation.generateApplianceSecret((await register('gate-c')).id, context())
-
-    expect(await query.credentialRevoked(issued)).toBe(false)
-  })
-
-  it('says yes once it has been revoked', async () => {
-    revocationOn()
-
-    const issued = await mutation.generateApplianceSecret((await register('gate-d')).id, context())
-    const revoked = await mutation.revokeApplianceCredential(issued.id, context())
-
-    expect(await query.credentialRevoked(revoked)).toBe(true)
-  })
-
-  it('says no again after a new credential is issued', async () => {
-    /*
-     * Re-issuing puts the shadow user back to ACTIVATED, which is what makes the new token
-     * usable. The screen has to follow, or a working appliance keeps saying it was revoked.
-     */
-    revocationOn()
-
-    const issued = await mutation.generateApplianceSecret((await register('gate-e')).id, context())
-    await mutation.revokeApplianceCredential(issued.id, context())
-    const reissued = await mutation.generateApplianceSecret(issued.id, context())
-
-    expect(await query.credentialRevoked(reissued)).toBe(false)
-  })
-
-  it('does not read one appliance state onto another', async () => {
-    revocationOn()
-
-    const a = await mutation.generateApplianceSecret((await register('gate-f')).id, context())
-    const b = await mutation.generateApplianceSecret((await register('gate-g')).id, context())
-
-    await mutation.revokeApplianceCredential(a.id, context())
-
-    expect(await query.credentialRevoked(await getRepository(Appliance).findOneBy({ id: a.id }))).toBe(true)
-    expect(await query.credentialRevoked(await getRepository(Appliance).findOneBy({ id: b.id }))).toBe(false)
-  })
-
-  it('reads the shadow user rather than the cleared column', async () => {
-    /*
-     * ⚠ The tempting shortcut is "no access token means revoked". It is wrong in both
-     * directions: a registered appliance has no token and is not revoked, and clearing the
-     * column by hand does not stop anything — the JWT verifies on its signature.
-     *
-     * So an appliance whose token is emptied without going through revocation is not revoked,
-     * and one whose status is INACTIVE is, whatever the column holds.
-     */
-    const issued = await mutation.generateApplianceSecret((await register('gate-h')).id, context())
-
-    await getRepository(Appliance).save({ ...issued, accessToken: null })
-    expect(await query.credentialRevoked(await getRepository(Appliance).findOneBy({ id: issued.id }))).toBe(false)
-
-    const appuser = await getRepository(User).findOneBy({ reference: issued.id, userType: 'appliance' })
-    await getRepository(User).save({ ...appuser, status: UserStatus.INACTIVE })
-
-    expect(await query.credentialRevoked(await getRepository(Appliance).findOneBy({ id: issued.id }))).toBe(true)
-  })
-
-  it('does not call a locked appliance revoked', async () => {
-    /*
-     * LOCKED is the failed-sign-in lockout and it ages out by itself, which is why revocation
-     * does not use it. Reporting it as revoked would tell the reader a lock is permanent.
-     */
-    const issued = await mutation.generateApplianceSecret((await register('gate-i')).id, context())
-
-    const appuser = await getRepository(User).findOneBy({ reference: issued.id, userType: 'appliance' })
-    await getRepository(User).save({ ...appuser, status: UserStatus.LOCKED })
-
-    expect(await query.credentialRevoked(await getRepository(Appliance).findOneBy({ id: issued.id }))).toBe(false)
-  })
-})