@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/application-delete-db.test.ts

@@ -1,190 +0,0 @@
-/**
- * Deleting an application has to stop the clients bound to it.
- *
- * ── The asymmetry this came from ────────────────────────────────────────────
- * An appliance and an application both have a shadow `User` standing in for the machine, and
- * that user is the thing a token names. `deleteAppliance` deletes it along with the appliance.
- * `deleteApplication` deleted only the application row, and the shadow users stayed behind:
- *
- *   ACTIVATED, so `User.checkAuth` passes every token naming them — it looks the user up by the
- *   id in the token and never asks whether the application still exists
- *
- *   holding a refresh token in `password`, which is what `/oauth2/refresh-token` finds a binding
- *   by, so each refresh mints another year of them
- *
- * So the screen said the application was gone and its clients kept working, with no way left on
- * any screen to reach them — the list they would have appeared in is keyed on an application
- * that no longer exists.
- *
- * ⚠ sqlite (`tests/db.ts`).
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Application } = loadCompiled('service/application/application')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { ApplicationMutation } = loadCompiled('service/application/application-mutation')
-
-const mutation = new ApplicationMutation()
-
-let domain: any
-let other: any
-let actor: any
-
-function context(d: any = domain) {
-  return {
-    state: { domain: d, user: actor, tx: undefined },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-async function makeApplication(name: string, d: any = domain) {
-  return await mutation.createApplication(
-    {
-      name,
-      email: `${name}@acme.z`,
-      url: `https://${name}.example.com`,
-      redirectUrl: `https://${name}.example.com/callback`,
-      type: 'OTHERS'
-    },
-    context(d)
-  )
-}
-
-/** A binding, as the OAuth2 exchange leaves one: a shadow user holding a refresh token. */
-async function bind(application: any, label: string, d: any = domain) {
-  const appuser = await getRepository(User).save({
-    username: `${label}@acme`,
-    email: `${label}@acme`,
-    name: label,
-    userType: 'application',
-    reference: application.id,
-    status: UserStatus.ACTIVATED,
-    domains: [d]
-  })
-
-  const refreshToken = Application.generateRefreshToken(d, appuser, application, 'admin')
-
-  return await getRepository(User).save({ ...appuser, password: refreshToken })
-}
-
-async function bindingsOf(applicationId: string) {
-  return await getRepository(User).findBy({ reference: applicationId, userType: 'application' })
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  domain = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  other = await getRepository(Domain).save({ name: 'beta', subdomain: 'beta' })
-  actor = await getRepository(User).save({
-    username: 'operator@acme.z',
-    email: 'operator@acme.z',
-    name: 'operator',
-    status: UserStatus.ACTIVATED,
-    domains: [domain]
-  })
-})
-
-describe('deleting an application', () => {
-  it('takes its bindings with it', async () => {
-    /*
-     * ⚠ The case. A binding left behind is a live credential with no screen to reach it from —
-     * the list it would appear in is keyed on an application that is gone.
-     */
-    const application = await makeApplication('billing')
-    await bind(application, 'binding-a')
-    await bind(application, 'binding-b')
-
-    await mutation.deleteApplication(application.id, context())
-
-    expect(await bindingsOf(application.id)).toHaveLength(0)
-  })
-
-  it('leaves no token that checkAuth would still accept', async () => {
-    /*
-     * ⚠ Why the row mattering is not enough to say. `checkAuth` looks the subject up by the id
-     * baked into the token and never asks whether the application exists, so a surviving user
-     * authenticates whatever happened to the application row.
-     */
-    const application = await makeApplication('billing')
-    const binding = await bind(application, 'binding-a')
-
-    await mutation.deleteApplication(application.id, context())
-
-    await expect(
-      User.checkAuth({ id: binding.id, userType: 'application', domain: { subdomain: 'acme' } })
-    ).rejects.toThrow()
-  })
-
-  it('deletes the application row itself', async () => {
-    const application = await makeApplication('billing')
-
-    await mutation.deleteApplication(application.id, context())
-
-    expect(await getRepository(Application).findOneBy({ id: application.id })).toBeNull()
-  })
-
-  it('leaves another application and its bindings alone', async () => {
-    const going = await makeApplication('billing')
-    const staying = await makeApplication('shipping')
-
-    await bind(going, 'binding-a')
-    const kept = await bind(staying, 'binding-b')
-
-    await mutation.deleteApplication(going.id, context())
-
-    expect(await bindingsOf(staying.id)).toHaveLength(1)
-    expect(await getRepository(User).findOneBy({ id: kept.id })).toMatchObject({ status: UserStatus.ACTIVATED })
-  })
-
-  it('does not reach into another tenant', async () => {
-    /*
-     * The delete is scoped by domain, so an id from elsewhere matches nothing. The bindings must
-     * not be cleared on the way to finding that out.
-     */
-    const theirs = await makeApplication('billing', other)
-    await bind(theirs, 'binding-theirs', other)
-
-    await mutation.deleteApplication(theirs.id, context(domain))
-
-    expect(await getRepository(Application).findOneBy({ id: theirs.id })).not.toBeNull()
-    expect(await bindingsOf(theirs.id)).toHaveLength(1)
-  })
-
-  it('does not touch an appliance that happens to carry the same reference', async () => {
-    /*
-     * `reference` is a plain column shared by both kinds of shadow user, so the delete has to
-     * name `userType` as well. Two ids never collide in practice; the assertion is about the
-     * filter, not about the odds.
-     */
-    const application = await makeApplication('billing')
-
-    const applianceUser = await getRepository(User).save({
-      username: 'device@acme',
-      email: 'device@acme',
-      name: 'device',
-      userType: 'appliance',
-      reference: application.id,
-      status: UserStatus.ACTIVATED,
-      domains: [domain]
-    })
-
-    await mutation.deleteApplication(application.id, context())
-
-    expect(await getRepository(User).findOneBy({ id: applianceUser.id })).not.toBeNull()
-  })
-})

package/tests/application-token-payload-db.test.ts

@@ -1,185 +0,0 @@
-/**
- * What an application's tokens carry in their payload.
- *
- * ── Why this is worth a file of its own ─────────────────────────────────────
- * An application has two 32-character hex strings and they are opposite kinds of thing:
- *
- *   appKey     the client id. Public. It is what a token says it was issued to, and what the
- *              OAuth2 refresh exchange looks the application up by.
- *   appSecret  the client secret. It is what `/oauth2/access-token` compares against to decide
- *              the caller is that client.
- *
- * `Application.sign` takes the first in a positional slot, and a JWT payload is not encrypted —
- * anyone holding the token reads it. So putting the second one in that slot hands the client
- * secret to whoever holds the token, and nothing about the call site looks wrong at a glance:
- * both values are strings on the same object.
- *
- * That is exactly what `renewApplicationAccessToken` did. These cases pin the axis the fix
- * splits — what the payload names — rather than the shape of the call.
- *
- * ── What these do not cover ─────────────────────────────────────────────────
- * The tokens issued before the fix. They carry the secret and they keep carrying it, and the
- * decision is to leave them (2026-09-20 사용자 결정: 이미 발행된 토큰은 무시한다). So there is
- * no audit here and no rule for finding them — only that nothing new goes out that way.
- *
- * ⚠ sqlite (`tests/db.ts`).
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const jwt = require('jsonwebtoken')
-
-const { Application } = loadCompiled('service/application/application')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { ApplicationMutation } = loadCompiled('service/application/application-mutation')
-
-const mutation = new ApplicationMutation()
-
-let domain: any
-let actor: any
-
-function context(d: any = domain) {
-  return {
-    state: { domain: d, user: actor, tx: undefined },
-    throw: (code: number, message: string) => {
-      const error: any = new Error(message)
-      error.status = code
-      throw error
-    }
-  } as any
-}
-
-/** An application plus the shadow user a binding is, which the OAuth2 exchange creates. */
-async function bindApplication(name: string) {
-  const application = await mutation.createApplication(
-    {
-      name,
-      email: `${name}@acme.z`,
-      url: `https://${name}.example.com`,
-      redirectUrl: `https://${name}.example.com/callback`,
-      type: 'OTHERS'
-    },
-    context()
-  )
-
-  const appuser = await getRepository(User).save({
-    username: `${application.appKey}@acme`,
-    email: `${application.appKey}@acme`,
-    name,
-    userType: 'application',
-    reference: application.id,
-    status: UserStatus.ACTIVATED,
-    domains: [domain]
-  })
-
-  return { application, appuser }
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  domain = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  actor = await getRepository(User).save({
-    username: 'operator@acme.z',
-    email: 'operator@acme.z',
-    name: 'operator',
-    status: UserStatus.ACTIVATED,
-    domains: [domain]
-  })
-})
-
-describe('the two strings are not interchangeable', () => {
-  it('gives an application a key and a secret that differ', async () => {
-    /* If these were ever the same value the rest of this file would pass for the wrong reason. */
-    const { application } = await bindApplication('billing')
-
-    expect(application.appKey).toBeTruthy()
-    expect(application.appSecret).toBeTruthy()
-    expect(application.appKey).not.toEqual(application.appSecret)
-  })
-})
-
-describe('renewing an application access token', () => {
-  it('names the application by its key', async () => {
-    const { application, appuser } = await bindApplication('billing')
-
-    const { accessToken } = await mutation.renewApplicationAccessToken(appuser.id, context(), 'admin')
-
-    expect(jwt.decode(accessToken).application.appKey).toEqual(application.appKey)
-  })
-
-  it('does not put the client secret in the access token', async () => {
-    /*
-     * ⚠ The defect. A JWT payload is base64, not encryption — whoever holds the token reads it.
-     * With the secret and the key, which is public, a holder can call `/oauth2/access-token` as
-     * that client.
-     */
-    const { application, appuser } = await bindApplication('billing')
-
-    const { accessToken } = await mutation.renewApplicationAccessToken(appuser.id, context(), 'admin')
-
-    expect(JSON.stringify(jwt.decode(accessToken))).not.toContain(application.appSecret)
-  })
-
-  it('does not put it in the refresh token either', async () => {
-    /*
-     * ⚠ The longer-lived half. The access token is 30 days; this one is a year, and it is the
-     * one handed to the client to keep.
-     */
-    const { application, appuser } = await bindApplication('billing')
-
-    const { refreshToken } = await mutation.renewApplicationAccessToken(appuser.id, context(), 'admin')
-
-    expect(jwt.decode(refreshToken).application.appKey).toEqual(application.appKey)
-    expect(JSON.stringify(jwt.decode(refreshToken))).not.toContain(application.appSecret)
-  })
-
-  it('does not leave it in the row it stores', async () => {
-    /*
-     * The refresh token is saved on the shadow user's `password`, so a payload carrying the
-     * secret writes the secret into a second place as well.
-     */
-    const { application, appuser } = await bindApplication('billing')
-
-    await mutation.renewApplicationAccessToken(appuser.id, context(), 'admin')
-
-    const stored = await getRepository(User).findOneBy({ id: appuser.id })
-
-    expect(stored.password).toBeTruthy()
-    expect(JSON.stringify(jwt.decode(stored.password))).not.toContain(application.appSecret)
-  })
-
-  it('mints a refresh token the OAuth2 exchange can resolve back to the application', async () => {
-    /*
-     * ⚠ The second face of the same defect, and the one an operator would notice. The refresh
-     * exchange reads `application.appKey` out of the token and does `findOneBy({ appKey })`
-     * (`router/oauth2/oauth2-server.ts`). A payload naming the secret finds no row, so the
-     * exchange answers "application is not exist" and the client cannot refresh at all.
-     */
-    const { application, appuser } = await bindApplication('billing')
-
-    const { refreshToken } = await mutation.renewApplicationAccessToken(appuser.id, context(), 'admin')
-    const named = jwt.decode(refreshToken).application.appKey
-
-    expect(await getRepository(Application).findOneBy({ appKey: named })).toMatchObject({ id: application.id })
-  })
-
-  it('does not name one application with the key of another', async () => {
-    const a = await bindApplication('billing')
-    const b = await bindApplication('shipping')
-
-    const renewed = await mutation.renewApplicationAccessToken(a.appuser.id, context(), 'admin')
-
-    expect(jwt.decode(renewed.accessToken).application.appKey).toEqual(a.application.appKey)
-    expect(jwt.decode(renewed.accessToken).application.appKey).not.toEqual(b.application.appKey)
-  })
-})

package/tests/assignable-roles-db.test.ts

@@ -1,219 +0,0 @@
-/**
- * Putting a person into roles - one function, the domain's scope, ids found again (ADR-0103 decision 2).
- *
- * `updateUserRoles` concatenated the client's `selectedRoles` onto the user as sent and removed every held role
- * whose id was in `availableRoles`. A role of another tenant went in; another tenant's role id in
- * `availableRoles` took that role away from the person in the other domain. The access request grants through
- * the same function, so both doors are held here.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { Role } = loadCompiled('service/role/role')
-const { GrantedRole } = loadCompiled('service/granted-role/granted-role')
-const { User } = loadCompiled('service/user/user')
-const { UserMutation } = loadCompiled('service/user/user-mutation')
-const { assignRoles } = loadCompiled('utils/assignable-roles')
-const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
-const { Privilege } = loadCompiled('service/privilege/privilege')
-
-let parent: any
-let child: any
-let stranger: any
-
-async function loadDomain(id: string) {
-  return await getRepository(Domain).findOneBy({ id })
-}
-
-async function makeUser(domains: any[], roles: any[]) {
-  const tag = Math.random().toString(36).slice(2, 8)
-  return await getRepository(User).save({
-    username: `u-${tag}`,
-    email: `u-${tag}@example.com`,
-    name: 'Kim',
-    salt: User.generateSalt(),
-    status: 'activated',
-    domains,
-    roles
-  })
-}
-
-async function heldRoleNames(user: any) {
-  const read = await getRepository(User).findOne({ where: { id: user.id }, relations: ['roles'] })
-  return read.roles.map((role: any) => role.name).sort()
-}
-
-function updateUserRoles(user: any, available: any[], selected: any[], domain: any) {
-  return new UserMutation().updateUserRoles(
-    user.username,
-    available.map(role => ({ id: role.id })),
-    selected.map(role => ({ id: role.id })),
-    { state: { domain }, t: (key: string) => key } as any
-  )
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const domainRepository = getRepository(Domain)
-  const savedParent = await domainRepository.save({ name: 'HQ', subdomain: 'hq' })
-  const savedChild = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a', parent: savedParent })
-  const savedStranger = await domainRepository.save({ name: 'Other', subdomain: 'other' })
-
-  parent = await loadDomain(savedParent.id)
-  child = await loadDomain(savedChild.id)
-  stranger = await loadDomain(savedStranger.id)
-})
-
-describe('what a domain can put a person into', () => {
-  it('its own role, its parent role and a role granted to it - all three', async () => {
-    const own = await getRepository(Role).save({ name: 'operator', domain: child })
-    const inherited = await getRepository(Role).save({ name: 'viewer', domain: parent })
-    const granted = await getRepository(Role).save({ name: 'partner', domain: stranger })
-    await getRepository(GrantedRole).save({ role: granted, domain: child })
-    const user = await makeUser([child], [])
-
-    const parentOwner = await makeUser([parent], [])
-    await getRepository(DomainOwner).save({ domain: parent, user: parentOwner })
-    const { added } = await assignRoles(user, { add: [own.id, inherited.id, granted.id] }, child, undefined, parentOwner)
-
-    expect(added.map((role: any) => role.name).sort()).toEqual(['operator', 'partner', 'viewer'])
-    expect(await heldRoleNames(user)).toEqual(['operator', 'partner', 'viewer'])
-  })
-
-  it('★ another tenant\'s role is refused by name, and nothing is saved', async () => {
-    const own = await getRepository(Role).save({ name: 'operator', domain: child })
-    const foreign = await getRepository(Role).save({ name: 'auditor', domain: stranger })
-    const user = await makeUser([child], [])
-
-    await expect(assignRoles(user, { add: [own.id, foreign.id] }, child)).rejects.toMatchObject({
-      code: 'role-not-assignable-here',
-      params: { roles: foreign.id }
-    })
-    expect(await heldRoleNames(user)).toEqual([])
-  })
-
-  it('a role already held is not added twice and is not reported as added', async () => {
-    const own = await getRepository(Role).save({ name: 'operator', domain: child })
-    const user = await makeUser([child], [own])
-
-    const { added } = await assignRoles(user, { add: [own.id] }, child)
-
-    expect(added).toEqual([])
-    expect(await heldRoleNames(user)).toEqual(['operator'])
-  })
-})
-
-describe('updateUserRoles goes through the same function', () => {
-  it('★ a foreign role in selectedRoles is refused - it used to be attached as sent', async () => {
-    const foreign = await getRepository(Role).save({ name: 'auditor', domain: stranger })
-    const user = await makeUser([child], [])
-
-    /* The method is called directly, so the Refusal arrives before SpeakRefusals turns it into a sentence. */
-    await expect(updateUserRoles(user, [], [foreign], child)).rejects.toMatchObject({ code: 'role-not-assignable-here' })
-    expect(await heldRoleNames(user)).toEqual([])
-  })
-
-  it('★ a foreign role in availableRoles stays with the person - this domain cannot take it', async () => {
-    const own = await getRepository(Role).save({ name: 'operator', domain: child })
-    const theirs = await getRepository(Role).save({ name: 'auditor', domain: stranger })
-    const user = await makeUser([child, stranger], [own, theirs])
-
-    await updateUserRoles(user, [own, theirs], [], child)
-
-    expect(await heldRoleNames(user)).toEqual(['auditor'])
-  })
-
-  it('within the scope it replaces as before - remove the shown, add the chosen', async () => {
-    const a = await getRepository(Role).save({ name: 'a', domain: child })
-    const b = await getRepository(Role).save({ name: 'b', domain: child })
-    const user = await makeUser([child], [a])
-
-    await updateUserRoles(user, [a, b], [b], child)
-
-    expect(await heldRoleNames(user)).toEqual(['b'])
-  })
-})
-
-describe('the parent domain\'s roles - only someone who decides there (ADR-0103 decision 8)', () => {
-  let parentRole: any
-  let childAdmin: any
-  let user: any
-
-  beforeEach(async () => {
-    const grant = await getRepository(Privilege).save({ name: 'mutation', category: 'user' })
-    const childAdmins = await getRepository(Role).save({ name: 'child-admins', domain: child, privileges: [grant] })
-    parentRole = await getRepository(Role).save({ name: 'hq-approver', domain: parent })
-    childAdmin = await makeUser([child], [childAdmins])
-    user = await makeUser([child], [])
-  })
-
-  it('★ a child domain\'s decider cannot give the parent\'s role - refused by name', async () => {
-    await expect(assignRoles(user, { add: [parentRole.id] }, child, undefined, childAdmin)).rejects.toMatchObject({
-      code: 'role-belongs-to-parent',
-      params: { roles: 'hq-approver' }
-    })
-    expect(await heldRoleNames(user)).toEqual([])
-  })
-
-  it('★ nor take it away', async () => {
-    const holder = await makeUser([child], [parentRole])
-    await expect(assignRoles(holder, { remove: [parentRole.id] }, child, undefined, childAdmin)).rejects.toMatchObject({ code: 'role-belongs-to-parent' })
-    expect(await heldRoleNames(holder)).toEqual(['hq-approver'])
-  })
-
-  it('★ the parent\'s owner can - from the child', async () => {
-    const parentOwner = await makeUser([parent], [])
-    await getRepository(DomainOwner).save({ domain: parent, user: parentOwner })
-    await assignRoles(user, { add: [parentRole.id] }, child, undefined, parentOwner)
-    expect(await heldRoleNames(user)).toEqual(['hq-approver'])
-  })
-
-  it('★ a holder of the role-giving privilege in the parent can', async () => {
-    const grant = await getRepository(Privilege).findOneBy({ name: 'mutation', category: 'user' })
-    const hqAdmins = await getRepository(Role).save({ name: 'hq-admins', domain: parent, privileges: [grant] })
-    const hqAdmin = await makeUser([parent, child], [hqAdmins])
-    await assignRoles(user, { add: [parentRole.id] }, child, undefined, hqAdmin)
-    expect(await heldRoleNames(user)).toEqual(['hq-approver'])
-  })
-
-  it('a parent role left as it was is no change - the user screen sends every shown role, nothing is refused', async () => {
-    const own = await getRepository(Role).save({ name: 'operator', domain: child })
-    const holder = await makeUser([child], [parentRole])
-    await assignRoles(holder, { add: [parentRole.id, own.id], remove: [parentRole.id, own.id] }, child, undefined, childAdmin)
-    expect(await heldRoleNames(holder)).toEqual(['hq-approver', 'operator'])
-  })
-
-  it('★ updateUserRoles carries the caller - a child admin adding the parent\'s role is refused', async () => {
-    const mutation = new UserMutation()
-    await expect(
-      mutation.updateUserRoles(user.username, [{ id: parentRole.id }], [{ id: parentRole.id }], { state: { domain: child, user: childAdmin }, t: (k: string) => k } as any)
-    ).rejects.toMatchObject({ code: 'role-belongs-to-parent' })
-  })
-
-  it('★ updateUserRoles carries the caller - the parent\'s owner adding it from the child passes', async () => {
-    const parentOwner = await makeUser([parent, child], [])
-    await getRepository(DomainOwner).save({ domain: parent, user: parentOwner })
-    await new UserMutation().updateUserRoles(user.username, [{ id: parentRole.id }], [{ id: parentRole.id }], {
-      state: { domain: child, user: parentOwner },
-      t: (k: string) => k
-    } as any)
-    expect(await heldRoleNames(user)).toEqual(['hq-approver'])
-  })
-
-  it('a granted role is the granting domain\'s delegation - a child decider assigns it', async () => {
-    const partnerRole = await getRepository(Role).save({ name: 'partner', domain: stranger })
-    await getRepository(GrantedRole).save({ role: partnerRole, domain: child })
-    await assignRoles(user, { add: [partnerRole.id] }, child, undefined, childAdmin)
-    expect(await heldRoleNames(user)).toEqual(['partner'])
-  })
-})