@things-factory/auth-base 10.1.6 → 10.1.16

package/tests/role-privileges-db.test.ts

@@ -18,6 +18,7 @@ import { loadCompiled } from './compiled'
 
 const { Role } = loadCompiled('service/role/role')
 const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
 const { RoleQuery } = loadCompiled('service/role/role-query')
 
 const query = new RoleQuery()
@@ -38,6 +39,10 @@ function ask(roleId: string, domain: any) {
   return query.rolePrivileges(roleId, { state: { domain } } as any)
 }
 
+function askUserRoles(userId: string, domain: any) {
+  return query.userRoles(userId, { state: { domain } } as any)
+}
+
 beforeAll(async () => {
   await openAuthDatabase()
 })
@@ -126,3 +131,96 @@ describe('부러지지 않는다', () => {
     expect(await ask("' OR 1=1 --", child)).toEqual([])
   })
 })
+
+/**
+ * 목록이 쓰는 **수**.
+ *
+ * 목록이 「이 역할이 무엇을 여나」를 말하려고 권한 **행**을 받고 있었다 — 역할 20개에
+ * 5,731 bytes · 69ms 대 518 bytes · 7ms(UX 레인 실측). 행을 안 받고 수를 받는다.
+ */
+describe('권한 수', () => {
+  it('가진 것만 센다', async () => {
+    const role = await getRepository(Role).save({ name: 'viewer', domain: child, privileges: [boardQuery] })
+
+    expect(await query.privilegeCount(role)).toBe(1)
+  })
+
+  it('하나도 없으면 0 이다 — 「모른다」가 아니라 0 이다', async () => {
+    const role = await getRepository(Role).save({ name: 'blank', domain: child, privileges: [] })
+
+    expect(await query.privilegeCount(role)).toBe(0)
+  })
+
+  it('다른 역할의 권한을 세지 않는다', async () => {
+    await getRepository(Role).save({ name: 'other', domain: child, privileges: [boardQuery, boardMutation] })
+    const mine = await getRepository(Role).save({ name: 'mine', domain: child, privileges: [boardQuery] })
+
+    expect(await query.privilegeCount(mine)).toBe(1)
+  })
+})
+
+/**
+ * 한 사람의 역할 — `rolePrivileges` 와 **같은 결함을 갖고 있던** 자리.
+ *
+ * 원시 SQL 로 `userId` 를 이어 붙이고, MSSQL 에 없는 `THEN true` 를 쓰고, `FROM roles` 로
+ * **도메인을 아예 안 봤다.** 한 자리를 고쳤으면 두 번째 자리도 재야 한다.
+ */
+describe('사용자의 역할', () => {
+  async function makeUser(roles: any[]) {
+    const salt = User.generateSalt()
+    return await getRepository(User).save({
+      username: `u-${Math.random().toString(36).slice(2, 8)}`,
+      email: `u-${Math.random().toString(36).slice(2, 8)}@example.com`,
+      name: 'Kim',
+      salt,
+      status: 'activated',
+      domains: [child],
+      roles
+    })
+  }
+
+  it('부여할 수 있는 전체를 주고, 가진 것에만 표시한다', async () => {
+    const held = await getRepository(Role).save({ name: 'held', domain: child })
+    await getRepository(Role).save({ name: 'free', domain: child })
+    const user = await makeUser([held])
+
+    const rows = await askUserRoles(user.id, child)
+
+    expect(rows).toHaveLength(2)
+    expect(rows.find(row => row.id === held.id).assigned).toBe(true)
+    expect(rows.find(row => row.name === 'free').assigned).toBe(false)
+  })
+
+  it('부모 도메인의 역할도 준다 — 상속이 부여 범위다', async () => {
+    await getRepository(Role).save({ name: 'shared', domain: parent })
+    const user = await makeUser([])
+
+    expect((await askUserRoles(user.id, child)).map((row: any) => row.name)).toEqual(['shared'])
+  })
+
+  it('남의 도메인 역할은 주지 않는다 — 예전에는 전부 줬다', async () => {
+    await getRepository(Role).save({ name: 'theirs', domain: stranger })
+    await getRepository(Role).save({ name: 'mine', domain: child })
+    const user = await makeUser([])
+
+    expect((await askUserRoles(user.id, child)).map((row: any) => row.name)).toEqual(['mine'])
+  })
+
+  it('없는 사용자에게도 목록을 준다 — 가진 것이 0 인 것과 같다', async () => {
+    await getRepository(Role).save({ name: 'mine', domain: child })
+
+    const rows = await askUserRoles('00000000-0000-0000-0000-000000000000', child)
+
+    expect(rows).toHaveLength(1)
+    expect(rows[0].assigned).toBe(false)
+  })
+
+  it('id 자리에 SQL 을 넣어도 던지지 않는다', async () => {
+    await getRepository(Role).save({ name: 'mine', domain: child })
+
+    const rows = await askUserRoles("' OR 1=1 --", child)
+
+    expect(rows).toHaveLength(1)
+    expect(rows[0].assigned).toBe(false)
+  })
+})

package/tests/role-template-seed-db.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Seeding a role from a template — against a real database.
+ *
+ * `role-template.test.ts` covers what the registry accepts. What it cannot cover is the
+ * part that touches rows, and that is where the rules with teeth are:
+ *
+ *  - the plant names the seat, not the template;
+ *  - an existing name is reused rather than duplicated, because approval lines hold a
+ *    role's id and a second row would leave them pointing at the one nobody edits;
+ *  - two templates on one name make the union, and privileges are never taken away;
+ *  - a privilege this installation does not declare is skipped, never invented.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { authDataSource } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
+const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
+
+const mutation = new RoleTemplateMutation()
+
+let domain: any
+let actor: any
+let boardQuery: any
+let boardMutation: any
+
+function context() {
+  return {
+    state: { domain, user: actor, tx: authDataSource().manager }
+  } as any
+}
+
+async function privilegesOf(id: string): Promise<string[]> {
+  const role = await getRepository(Role).findOne({ where: { id }, relations: ['privileges'] })
+
+  return (role!.privileges || []).map((one: any) => `${one.category}:${one.name}`).sort()
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  ;(process as any)['ROLE_TEMPLATES'] = {}
+
+  const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  domain = await getRepository(Domain).findOneBy({ id: saved.id })
+
+  const privilegeRepository = getRepository(Privilege)
+  boardQuery = await privilegeRepository.save({ name: 'query', category: 'board' })
+  boardMutation = await privilegeRepository.save({ name: 'mutation', category: 'board' })
+
+  /* The gate reads this; seeding reads the rows above. Both have to agree. */
+  ;(process as any).PRIVILEGES = {
+    'board query': ['board', 'query'],
+    'board mutation': ['board', 'mutation']
+  }
+
+  actor = await getRepository(User).save({
+    username: 'admin',
+    email: 'admin@example.com',
+    name: 'Admin',
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains: [domain]
+  })
+})
+
+describe('seeding', () => {
+  it('creates the role with the privileges the template names', async () => {
+    registerRoleTemplate({
+      id: 'plant.qi',
+      name: 'QUALITY-INSPECTOR',
+      grants: [{ category: 'board', axes: ['query'] }]
+    })
+
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect(role.name).toBe('QUALITY-INSPECTOR')
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
+  })
+
+  it('lets the plant name the seat itself', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const role = await mutation.createRoleFromTemplate('plant.qi', '품질검사원', context())
+
+    expect(role.name).toBe('품질검사원')
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
+  })
+
+  it('makes a second seat from one template when the name differs — day shift and night shift', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const day = await mutation.createRoleFromTemplate('plant.qi', 'QI-DAY', context())
+    const night = await mutation.createRoleFromTemplate('plant.qi', 'QI-NIGHT', context())
+
+    expect(day.id).not.toBe(night.id)
+    expect(await privilegesOf(day.id)).toEqual(['board:query'])
+    expect(await privilegesOf(night.id)).toEqual(['board:query'])
+  })
+
+  it('reuses an existing role of that name instead of creating a second one', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const existing = await getRepository(Role).save({ name: 'QUALITY-INSPECTOR', domain, privileges: [] })
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect(role.id).toBe(existing.id)
+    expect(await getRepository(Role).count()).toBe(1)
+  })
+
+  it('adds the union when two applications declare the same seat', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTemplate({
+      id: 'twin.qi',
+      name: 'QUALITY-INSPECTOR',
+      grants: [{ category: 'board', axes: ['mutation'] }]
+    })
+
+    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    const role = await mutation.createRoleFromTemplate('twin.qi', undefined, context())
+
+    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
+    expect(await getRepository(Role).count()).toBe(1)
+  })
+
+  it('leaves privileges the administrator added, and takes nothing away', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const existing = await getRepository(Role).save({
+      name: 'QUALITY-INSPECTOR',
+      domain,
+      privileges: [boardMutation]
+    })
+
+    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect(await privilegesOf(existing.id)).toEqual(['board:mutation', 'board:query'])
+  })
+
+  it('skips a privilege this installation does not declare rather than inventing the row', async () => {
+    registerRoleTemplate({
+      id: 'plant.x',
+      name: 'X',
+      grants: [
+        { category: 'board', axes: ['query'] },
+        { category: 'board-ai', axes: ['query'] }
+      ]
+    })
+
+    const role = await mutation.createRoleFromTemplate('plant.x', undefined, context())
+
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
+    expect(await getRepository(Privilege).count()).toBe(2)
+  })
+
+  it('refuses a template this installation does not have', async () => {
+    await expect(mutation.createRoleFromTemplate('plant.missing', undefined, context())).rejects.toThrow(
+      /no role template/
+    )
+  })
+
+  it('seeds the framework-computed administrator without any application declaring it', async () => {
+    const role = await mutation.createRoleFromTemplate('framework.administrator', undefined, context())
+
+    expect(role.name).toBe('ADMINISTRATOR')
+    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
+  })
+})

package/tests/role-template.test.ts

@@ -0,0 +1,162 @@
+/**
+ * Role templates — the registry and what it refuses.
+ *
+ * The refusals are the interesting part. A template that registers happily and then grants
+ * nothing is the quiet failure this design exists to avoid, so the checks that make noise
+ * are the ones pinned here.
+ */
+
+import { loadCompiled } from './compiled'
+
+const {
+  registerRoleTemplate,
+  roleTemplates,
+  roleTemplateById,
+  computedRoleTemplates,
+  allRoleTemplates,
+  unknownTemplateGrants
+} = loadCompiled('service/role-template/role-template')
+
+const { declareAxes } = loadCompiled('service/privilege/privilege-axis')
+
+beforeEach(() => {
+  /* Nobody declared, so the defaults apply — query/mutation with query read-only. */
+  delete (process as any).PRIVILEGE_AXES
+  ;(process as any)['ROLE_TEMPLATES'] = {}
+  ;(process as any).PRIVILEGES = {
+    'board query': ['board', 'query'],
+    'board mutation': ['board', 'mutation'],
+    'order query': ['order', 'query'],
+    'worklist query': ['worklist', 'query'],
+    'worklist mutation': ['worklist', 'mutation']
+  }
+})
+
+describe('declaring a template', () => {
+  it('can be found again by id', () => {
+    registerRoleTemplate({
+      id: 'plant.production-lead',
+      name: 'PRODUCTION-LEAD',
+      grants: [{ category: 'worklist', axes: ['query', 'mutation'] }]
+    })
+
+    expect(roleTemplateById('plant.production-lead')!.name).toBe('PRODUCTION-LEAD')
+    expect(roleTemplates()).toHaveLength(1)
+  })
+})
+
+describe('what registration refuses', () => {
+  it('refuses a template with no grants written at all', () => {
+    expect(() => registerRoleTemplate({ id: 'x', name: 'X' } as any)).toThrow(/no grants/)
+  })
+
+  it('accepts an empty list — a seat that opens nothing on purpose, for approval routing', () => {
+    registerRoleTemplate({ id: 'twin.quality-inspector', name: 'QUALITY-INSPECTOR', grants: [] })
+
+    expect(roleTemplateById('twin.quality-inspector')!.grants).toEqual([])
+  })
+
+  it('refuses a grant with no axes', () => {
+    expect(() => registerRoleTemplate({ id: 'x', name: 'X', grants: [{ category: 'board', axes: [] }] })).toThrow(
+      /no axes/
+    )
+  })
+
+  it('refuses the same id twice', () => {
+    registerRoleTemplate({ id: 'x', name: 'X', grants: [] })
+
+    expect(() => registerRoleTemplate({ id: 'x', name: 'Y', grants: [] })).toThrow(/declared twice/)
+  })
+
+  it('accepts the same role name from two applications — one seat, declared twice', () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTemplate({ id: 'twin.qi', name: 'QUALITY-INSPECTOR', grants: [] })
+
+    expect(roleTemplates().filter(one => one.name === 'QUALITY-INSPECTOR')).toHaveLength(2)
+  })
+})
+
+describe('names this installation does not declare', () => {
+  it('points at grants that would silently open nothing after a category rename', () => {
+    registerRoleTemplate({
+      id: 'plant.x',
+      name: 'X',
+      grants: [
+        { category: 'board', axes: ['query'] },
+        { category: 'board-ai', axes: ['query', 'mutation'] }
+      ]
+    })
+
+    expect(unknownTemplateGrants(roleTemplateById('plant.x')!)).toEqual(['board-ai:query', 'board-ai:mutation'])
+  })
+
+  it('reports nothing when every named privilege is installed', () => {
+    registerRoleTemplate({ id: 'plant.y', name: 'Y', grants: [{ category: 'order', axes: ['query'] }] })
+
+    expect(unknownTemplateGrants(roleTemplateById('plant.y')!)).toEqual([])
+  })
+})
+
+describe('the two templates the framework computes', () => {
+  it('gives the viewer every category that declares a query axis', () => {
+    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
+
+    expect(viewer.grants.map(grant => grant.category).sort()).toEqual(['board', 'order', 'worklist'])
+    expect(viewer.grants.every(grant => grant.axes.join() === 'query')).toBe(true)
+  })
+
+  it('gives the administrator everything declared', () => {
+    const administrator = computedRoleTemplates().find(one => one.id === 'framework.administrator')!
+    const pairs = administrator.grants.flatMap(grant => grant.axes.map(axis => `${grant.category}:${axis}`)).sort()
+
+    expect(pairs).toEqual(['board:mutation', 'board:query', 'order:query', 'worklist:mutation', 'worklist:query'])
+  })
+
+  it('widens only the administrator when a new axis is declared', () => {
+    ;(process as any).PRIVILEGES['board execute'] = ['board', 'execute']
+
+    const administrator = computedRoleTemplates().find(one => one.id === 'framework.administrator')!
+    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
+
+    expect(administrator.grants.find(grant => grant.category === 'board')!.axes).toContain('execute')
+    expect(viewer.grants.find(grant => grant.category === 'board')!.axes).toEqual(['query'])
+  })
+
+  it('builds the viewer from the declared read-only axes, not from the word "query"', () => {
+    /*
+     * A house that spells its read axis `read` gets a viewer over `read`. Matching the literal
+     * `query` was right here and wrong there — dssp's `kpi` has eight axes and none of them is
+     * `query`, so its main module would have gone missing from VIEWER without a word anywhere.
+     */
+    declareAxes(['read', 'input'], { readOnly: ['read'] })
+    ;(process as any).PRIVILEGES = {
+      'kpi read': ['kpi', 'read'],
+      'kpi input': ['kpi', 'input']
+    }
+
+    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
+
+    expect(viewer.grants).toEqual([{ category: 'kpi', axes: ['read'] }])
+  })
+
+  it('does not offer a viewer at all when nobody said which axes are read-only', () => {
+    /*
+     * ⚠ The point of this one. Offering an empty VIEWER would let an administrator pick it,
+     * get a role, and open nothing — and the role list would count that zero correctly and
+     * present it as fact. "We do not know" is not "there are none", so the template is
+     * withheld and `reportDeclaredAxes` says so at boot.
+     */
+    declareAxes(['read', 'input'])
+
+    const ids = computedRoleTemplates().map(one => one.id)
+
+    expect(ids).toEqual(['framework.administrator'])
+    expect(ids).not.toContain('framework.viewer')
+  })
+
+  it('offers the computed two alongside whatever applications declared', () => {
+    registerRoleTemplate({ id: 'plant.z', name: 'Z', grants: [] })
+
+    expect(allRoleTemplates().map(one => one.id)).toEqual(['framework.viewer', 'framework.administrator', 'plant.z'])
+  })
+})