@things-factory/auth-base 10.1.44 → 10.1.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.44",
+  "version": "10.1.46",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -34,9 +34,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.44",
+    "@things-factory/email-base": "^10.1.46",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.44",
+    "@things-factory/shell": "^10.1.46",
     "@things-factory/utils": "^10.1.20",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "7c95c4e75e155e51c714409e865d96f317232c23"
+  "gitHead": "d3467cde550453f3348fed0ed6c79a12a6ba0db4"
 }

package/tests/role-template-gap-db.test.ts

@@ -0,0 +1,125 @@
+/**
+ * What a role lacks against the template of its name - against a real database (ADR-0075 decision 1).
+ *
+ * A template is a seed and nothing pushes its later grants into roles already standing. When
+ * operato-plant's templates gained ai-assistant, the roles in miratek stayed without it and only
+ * plant's security runner noticed. The role screen now shows the gap and the administrator adds
+ * it; these are the facts that screen stands on.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, authDataSource } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
+const { RoleTemplateGapResolver } = loadCompiled('service/role-template/role-template-gap-resolver')
+const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
+
+const mutation = new RoleTemplateMutation()
+const gapOf = (role: any) => new RoleTemplateGapResolver().templateGap(role)
+
+let domain: any
+let actor: any
+
+const context = () => ({ state: { domain, user: actor, tx: authDataSource().manager } }) as any
+
+/** The template as it stood when the role was made, then as it stands after it gained a door. */
+function declareTemplate(axes: string[], extra: { category: string; axes: string[] }[] = []) {
+  ;(process as any)['ROLE_TEMPLATES'] = {}
+  registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes }, ...extra] })
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  domain = await getRepository(Domain).findOneBy({ id: saved.id })
+
+  await getRepository(Privilege).save({ name: 'query', category: 'board' })
+  await getRepository(Privilege).save({ name: 'mutation', category: 'board' })
+  ;(process as any).PRIVILEGES = {
+    'board query': ['board', 'query'],
+    'board mutation': ['board', 'mutation']
+  }
+
+  actor = await getRepository(User).save({
+    username: 'admin',
+    email: 'admin@example.com',
+    name: 'Admin',
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains: [domain]
+  })
+})
+
+describe('the gap between a role and its template', () => {
+  it('is zero for a role made from the template as it stands', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect(await gapOf(role)).toEqual({
+      templateId: 'plant.qi',
+      templateName: 'QUALITY-INSPECTOR',
+      missing: [],
+      missingCount: 0
+    })
+  })
+
+  it('★ names what the template gained after the role was made', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    declareTemplate(['query', 'mutation'])
+
+    const gap = await gapOf(role)
+    expect(gap.missingCount).toBe(1)
+    expect(gap.missing).toEqual([{ category: 'board', axes: ['mutation'] }])
+  })
+
+  it('★ closes when the administrator adds it - the same top-up the template button runs', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    declareTemplate(['query', 'mutation'])
+
+    await mutation.createRoleFromTemplate('plant.qi', 'QUALITY-INSPECTOR', context())
+
+    expect((await gapOf(role)).missingCount).toBe(0)
+  })
+
+  it('★ does not count what this installation does not declare', async () => {
+    declareTemplate(['query'], [{ category: 'order', axes: ['query'] }])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect((await gapOf(role)).missingCount).toBe(0)
+  })
+
+  it('★ is null for a role no template names - a renamed role belongs to its administrator', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', 'NIGHT-INSPECTOR', context())
+
+    expect(await gapOf(role)).toBeNull()
+  })
+
+  it('does not take away what the administrator added beyond the template', async () => {
+    declareTemplate(['query'])
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    const stored = await getRepository(Role).findOne({ where: { id: role.id }, relations: ['privileges'] })
+    stored.privileges = [
+      ...stored.privileges,
+      await getRepository(Privilege).findOneBy({ category: 'board', name: 'mutation' })
+    ]
+    await getRepository(Role).save(stored)
+
+    expect((await gapOf(role)).missingCount).toBe(0)
+  })
+})