@things-factory/auth-base 10.1.6 → 10.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.6",
+  "version": "10.1.7",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -34,9 +34,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.4",
+    "@things-factory/email-base": "^10.1.7",
     "@things-factory/env": "^10.1.3",
-    "@things-factory/shell": "^10.1.4",
+    "@things-factory/shell": "^10.1.7",
     "@things-factory/utils": "^10.1.3",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "963aeb9ac470be5aea05bb5842a0a92afcab6036"
+  "gitHead": "9a036f83f5751f9e4af9180e9a0018f716a4ba27"
 }

package/tests/privilege-directive.test.ts

@@ -13,7 +13,6 @@
 
 import { graphql } from 'graphql'
 import { makeExecutableSchema } from '@graphql-tools/schema'
-import { logger } from '@things-factory/env'
 
 import { loadCompiled } from './compiled'
 
@@ -34,7 +33,6 @@ const typeDefs = `
     guardedBoard: String @privilege(category: "board", privilege: "mutation")
     ownershipOnly: String @privilege(domainOwnerGranted: true)
     undeclared: String
-    moved: String @privilege(category: "ai-assistant", privilege: "mutation", legacy: "board-ai")
   }
 `
 
@@ -45,8 +43,7 @@ function buildSchema() {
       Query: {
         guardedBoard: () => 'board',
         ownershipOnly: () => 'ownership',
-        undeclared: () => 'undeclared',
-        moved: () => 'moved'
+        undeclared: () => 'undeclared'
       }
     }
   })
@@ -54,13 +51,6 @@ function buildSchema() {
   return privilegeDirectiveResolver(schema)
 }
 
-/** 이 category 들만 가진 사람. `hasPrivilege(privilege, category, ...)` 순서를 그대로 받는다. */
-function granted(...categories: string[]) {
-  User.hasPrivilege = jest.fn().mockImplementation(async (_privilege: string, category: string) =>
-    categories.includes(category)
-  )
-}
-
 function run(schema: any, field: string, state: any = {}) {
   return graphql({
     schema,
@@ -173,74 +163,6 @@ describe('안전하지 않은 IP 가 이음매를 지나 게이트까지 간다'
   })
 })
 
-/**
- * 권한 이름을 옮기는 중.
- *
- * 옛 이름을 받아 주지 않으면 옮긴 그날 그 기능을 쓰던 사람들이 전부 막힌다. 그런데 옛 부여를
- * 역할 행에 베껴 넣으면 조용히 권한이 번지고 되돌릴 근거가 없어진다. 그래서 **행은 그대로 두고
- * 문에서 한동안 받아 준다.**
- */
-describe('옮기는 중인 권한', () => {
-  it('새 이름을 가졌으면 열린다', async () => {
-    granted('ai-assistant')
-
-    const result = await run(buildSchema(), 'moved')
-
-    expect(result.errors).toBeUndefined()
-    expect(result.data).toEqual({ moved: 'moved' })
-  })
-
-  it('새 이름이 없고 옛 이름만 있어도 열린다 — 옮긴 날 아무도 막히지 않는다', async () => {
-    granted('board-ai')
-
-    const result = await run(buildSchema(), 'moved')
-
-    expect(result.errors).toBeUndefined()
-    expect(result.data).toEqual({ moved: 'moved' })
-  })
-
-  it('둘 다 없으면 거절하고, 필요한 것은 새 이름으로 말한다', async () => {
-    granted()
-
-    const result = await run(buildSchema(), 'moved')
-
-    expect(result.data).toEqual({ moved: null })
-    expect(result.errors).toHaveLength(1)
-    /* 옛 이름을 말하면 관리자가 곧 사라질 권한을 부여한다. */
-    expect((result.errors![0].extensions as any).requires).toEqual({
-      category: 'ai-assistant',
-      privilege: 'mutation'
-    })
-  })
-
-  it('금지 목록이 새 쌍을 막고 있으면 옛 이름으로도 열리지 않는다', async () => {
-    /*
-     * 금지 목록은 옛 이름을 모른다. 별칭이 금지를 되돌리면 「이 IP 에서는 이것을 못 한다」는
-     * 설정이 조용히 무력해진다.
-     */
-    granted('board-ai')
-
-    const result = await run(buildSchema(), 'moved', {
-      unsafeIP: true,
-      prohibitedPrivileges: [{ category: 'ai-assistant', privilege: 'mutation' }]
-    })
-
-    expect(result.errors).toHaveLength(1)
-  })
-
-  it('옛 이름을 부른 것을 로그에 남긴다 — 누가 기대고 있는지가 부여의 근거다', async () => {
-    granted('board-ai')
-
-    const warn = jest.spyOn(logger, 'warn')
-
-    await run(buildSchema(), 'moved')
-
-    expect(warn).toHaveBeenCalled()
-    expect(warn.mock.calls[0][0]).toContain('board-ai:mutation')
-    warn.mockRestore()
-  })
-})
-
 describe('스키마를 지으면서 남기는 것', () => {
   it('선언한 (category, privilege) 를 전역 레지스트리에 등록한다', () => {
     /* 부팅 때 없는 권한 행을 만드는 근거다 — 마이그레이션도 수동 생성도 필요 없다. */
@@ -249,18 +171,6 @@ describe('스키마를 지으면서 남기는 것', () => {
     expect((process as any).PRIVILEGES['board mutation']).toEqual(['board', 'mutation'])
   })
 
-  it('옛 이름은 등록하지 않는다 — 그래서 옛 권한 행이 유령으로 보인다', () => {
-    /*
-     * `isDeprecatedPrivilege` 는 「레지스트리에 없으면 유령」으로 판정한다
-     * (`privilege-deprecation.ts`). 옛 쌍을 등록하면 관리자 목록에서 옛 행이 정상으로 보여
-     * **별칭을 지울 시점을 아무도 못 본다.** 이 시험이 그 신호를 지킨다.
-     */
-    buildSchema()
-
-    expect((process as any).PRIVILEGES['ai-assistant mutation']).toEqual(['ai-assistant', 'mutation'])
-    expect((process as any).PRIVILEGES['board-ai mutation']).toBeUndefined()
-  })
-
   it('필드 설명에 필요한 권한을 적어 둔다', async () => {
     const schema = buildSchema()
     const description = (schema.getQueryType() as any).getFields().guardedBoard.description

package/tests/role-privileges-db.test.ts

@@ -18,6 +18,7 @@ import { loadCompiled } from './compiled'
 
 const { Role } = loadCompiled('service/role/role')
 const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
 const { RoleQuery } = loadCompiled('service/role/role-query')
 
 const query = new RoleQuery()
@@ -38,6 +39,10 @@ function ask(roleId: string, domain: any) {
   return query.rolePrivileges(roleId, { state: { domain } } as any)
 }
 
+function askUserRoles(userId: string, domain: any) {
+  return query.userRoles(userId, { state: { domain } } as any)
+}
+
 beforeAll(async () => {
   await openAuthDatabase()
 })
@@ -126,3 +131,96 @@ describe('부러지지 않는다', () => {
     expect(await ask("' OR 1=1 --", child)).toEqual([])
   })
 })
+
+/**
+ * 목록이 쓰는 **수**.
+ *
+ * 목록이 「이 역할이 무엇을 여나」를 말하려고 권한 **행**을 받고 있었다 — 역할 20개에
+ * 5,731 bytes · 69ms 대 518 bytes · 7ms(UX 레인 실측). 행을 안 받고 수를 받는다.
+ */
+describe('권한 수', () => {
+  it('가진 것만 센다', async () => {
+    const role = await getRepository(Role).save({ name: 'viewer', domain: child, privileges: [boardQuery] })
+
+    expect(await query.privilegeCount(role)).toBe(1)
+  })
+
+  it('하나도 없으면 0 이다 — 「모른다」가 아니라 0 이다', async () => {
+    const role = await getRepository(Role).save({ name: 'blank', domain: child, privileges: [] })
+
+    expect(await query.privilegeCount(role)).toBe(0)
+  })
+
+  it('다른 역할의 권한을 세지 않는다', async () => {
+    await getRepository(Role).save({ name: 'other', domain: child, privileges: [boardQuery, boardMutation] })
+    const mine = await getRepository(Role).save({ name: 'mine', domain: child, privileges: [boardQuery] })
+
+    expect(await query.privilegeCount(mine)).toBe(1)
+  })
+})
+
+/**
+ * 한 사람의 역할 — `rolePrivileges` 와 **같은 결함을 갖고 있던** 자리.
+ *
+ * 원시 SQL 로 `userId` 를 이어 붙이고, MSSQL 에 없는 `THEN true` 를 쓰고, `FROM roles` 로
+ * **도메인을 아예 안 봤다.** 한 자리를 고쳤으면 두 번째 자리도 재야 한다.
+ */
+describe('사용자의 역할', () => {
+  async function makeUser(roles: any[]) {
+    const salt = User.generateSalt()
+    return await getRepository(User).save({
+      username: `u-${Math.random().toString(36).slice(2, 8)}`,
+      email: `u-${Math.random().toString(36).slice(2, 8)}@example.com`,
+      name: 'Kim',
+      salt,
+      status: 'activated',
+      domains: [child],
+      roles
+    })
+  }
+
+  it('부여할 수 있는 전체를 주고, 가진 것에만 표시한다', async () => {
+    const held = await getRepository(Role).save({ name: 'held', domain: child })
+    await getRepository(Role).save({ name: 'free', domain: child })
+    const user = await makeUser([held])
+
+    const rows = await askUserRoles(user.id, child)
+
+    expect(rows).toHaveLength(2)
+    expect(rows.find(row => row.id === held.id).assigned).toBe(true)
+    expect(rows.find(row => row.name === 'free').assigned).toBe(false)
+  })
+
+  it('부모 도메인의 역할도 준다 — 상속이 부여 범위다', async () => {
+    await getRepository(Role).save({ name: 'shared', domain: parent })
+    const user = await makeUser([])
+
+    expect((await askUserRoles(user.id, child)).map((row: any) => row.name)).toEqual(['shared'])
+  })
+
+  it('남의 도메인 역할은 주지 않는다 — 예전에는 전부 줬다', async () => {
+    await getRepository(Role).save({ name: 'theirs', domain: stranger })
+    await getRepository(Role).save({ name: 'mine', domain: child })
+    const user = await makeUser([])
+
+    expect((await askUserRoles(user.id, child)).map((row: any) => row.name)).toEqual(['mine'])
+  })
+
+  it('없는 사용자에게도 목록을 준다 — 가진 것이 0 인 것과 같다', async () => {
+    await getRepository(Role).save({ name: 'mine', domain: child })
+
+    const rows = await askUserRoles('00000000-0000-0000-0000-000000000000', child)
+
+    expect(rows).toHaveLength(1)
+    expect(rows[0].assigned).toBe(false)
+  })
+
+  it('id 자리에 SQL 을 넣어도 던지지 않는다', async () => {
+    await getRepository(Role).save({ name: 'mine', domain: child })
+
+    const rows = await askUserRoles("' OR 1=1 --", child)
+
+    expect(rows).toHaveLength(1)
+    expect(rows[0].assigned).toBe(false)
+  })
+})

package/tests/role-template-seed-db.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Seeding a role from a template — against a real database.
+ *
+ * `role-template.test.ts` covers what the registry accepts. What it cannot cover is the
+ * part that touches rows, and that is where the rules with teeth are:
+ *
+ *  - the plant names the seat, not the template;
+ *  - an existing name is reused rather than duplicated, because approval lines hold a
+ *    role's id and a second row would leave them pointing at the one nobody edits;
+ *  - two templates on one name make the union, and privileges are never taken away;
+ *  - a privilege this installation does not declare is skipped, never invented.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { authDataSource } from './db'
+import { loadCompiled } from './compiled'
+
+const { Role } = loadCompiled('service/role/role')
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { User } = loadCompiled('service/user/user')
+const { RoleTemplateMutation } = loadCompiled('service/role-template/role-template-mutation')
+const { registerRoleTemplate } = loadCompiled('service/role-template/role-template')
+
+const mutation = new RoleTemplateMutation()
+
+let domain: any
+let actor: any
+let boardQuery: any
+let boardMutation: any
+
+function context() {
+  return {
+    state: { domain, user: actor, tx: authDataSource().manager }
+  } as any
+}
+
+async function privilegesOf(id: string): Promise<string[]> {
+  const role = await getRepository(Role).findOne({ where: { id }, relations: ['privileges'] })
+
+  return (role!.privileges || []).map((one: any) => `${one.category}:${one.name}`).sort()
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  ;(process as any)['ROLE_TEMPLATES'] = {}
+
+  const saved = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
+  domain = await getRepository(Domain).findOneBy({ id: saved.id })
+
+  const privilegeRepository = getRepository(Privilege)
+  boardQuery = await privilegeRepository.save({ name: 'query', category: 'board' })
+  boardMutation = await privilegeRepository.save({ name: 'mutation', category: 'board' })
+
+  /* The gate reads this; seeding reads the rows above. Both have to agree. */
+  ;(process as any).PRIVILEGES = {
+    'board query': ['board', 'query'],
+    'board mutation': ['board', 'mutation']
+  }
+
+  actor = await getRepository(User).save({
+    username: 'admin',
+    email: 'admin@example.com',
+    name: 'Admin',
+    salt: User.generateSalt(),
+    status: 'activated',
+    domains: [domain]
+  })
+})
+
+describe('seeding', () => {
+  it('creates the role with the privileges the template names', async () => {
+    registerRoleTemplate({
+      id: 'plant.qi',
+      name: 'QUALITY-INSPECTOR',
+      grants: [{ category: 'board', axes: ['query'] }]
+    })
+
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect(role.name).toBe('QUALITY-INSPECTOR')
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
+  })
+
+  it('lets the plant name the seat itself', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const role = await mutation.createRoleFromTemplate('plant.qi', '품질검사원', context())
+
+    expect(role.name).toBe('품질검사원')
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
+  })
+
+  it('makes a second seat from one template when the name differs — day shift and night shift', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const day = await mutation.createRoleFromTemplate('plant.qi', 'QI-DAY', context())
+    const night = await mutation.createRoleFromTemplate('plant.qi', 'QI-NIGHT', context())
+
+    expect(day.id).not.toBe(night.id)
+    expect(await privilegesOf(day.id)).toEqual(['board:query'])
+    expect(await privilegesOf(night.id)).toEqual(['board:query'])
+  })
+
+  it('reuses an existing role of that name instead of creating a second one', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const existing = await getRepository(Role).save({ name: 'QUALITY-INSPECTOR', domain, privileges: [] })
+    const role = await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect(role.id).toBe(existing.id)
+    expect(await getRepository(Role).count()).toBe(1)
+  })
+
+  it('adds the union when two applications declare the same seat', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTemplate({
+      id: 'twin.qi',
+      name: 'QUALITY-INSPECTOR',
+      grants: [{ category: 'board', axes: ['mutation'] }]
+    })
+
+    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+    const role = await mutation.createRoleFromTemplate('twin.qi', undefined, context())
+
+    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
+    expect(await getRepository(Role).count()).toBe(1)
+  })
+
+  it('leaves privileges the administrator added, and takes nothing away', async () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+
+    const existing = await getRepository(Role).save({
+      name: 'QUALITY-INSPECTOR',
+      domain,
+      privileges: [boardMutation]
+    })
+
+    await mutation.createRoleFromTemplate('plant.qi', undefined, context())
+
+    expect(await privilegesOf(existing.id)).toEqual(['board:mutation', 'board:query'])
+  })
+
+  it('skips a privilege this installation does not declare rather than inventing the row', async () => {
+    registerRoleTemplate({
+      id: 'plant.x',
+      name: 'X',
+      grants: [
+        { category: 'board', axes: ['query'] },
+        { category: 'board-ai', axes: ['query'] }
+      ]
+    })
+
+    const role = await mutation.createRoleFromTemplate('plant.x', undefined, context())
+
+    expect(await privilegesOf(role.id)).toEqual(['board:query'])
+    expect(await getRepository(Privilege).count()).toBe(2)
+  })
+
+  it('refuses a template this installation does not have', async () => {
+    await expect(mutation.createRoleFromTemplate('plant.missing', undefined, context())).rejects.toThrow(
+      /no role template/
+    )
+  })
+
+  it('seeds the framework-computed administrator without any application declaring it', async () => {
+    const role = await mutation.createRoleFromTemplate('framework.administrator', undefined, context())
+
+    expect(role.name).toBe('ADMINISTRATOR')
+    expect(await privilegesOf(role.id)).toEqual(['board:mutation', 'board:query'])
+  })
+})

package/tests/role-template.test.ts

@@ -0,0 +1,126 @@
+/**
+ * Role templates — the registry and what it refuses.
+ *
+ * The refusals are the interesting part. A template that registers happily and then grants
+ * nothing is the quiet failure this design exists to avoid, so the checks that make noise
+ * are the ones pinned here.
+ */
+
+import { loadCompiled } from './compiled'
+
+const {
+  registerRoleTemplate,
+  roleTemplates,
+  roleTemplateById,
+  computedRoleTemplates,
+  allRoleTemplates,
+  unknownTemplateGrants
+} = loadCompiled('service/role-template/role-template')
+
+beforeEach(() => {
+  ;(process as any)['ROLE_TEMPLATES'] = {}
+  ;(process as any).PRIVILEGES = {
+    'board query': ['board', 'query'],
+    'board mutation': ['board', 'mutation'],
+    'order query': ['order', 'query'],
+    'worklist query': ['worklist', 'query'],
+    'worklist mutation': ['worklist', 'mutation']
+  }
+})
+
+describe('declaring a template', () => {
+  it('can be found again by id', () => {
+    registerRoleTemplate({
+      id: 'plant.production-lead',
+      name: 'PRODUCTION-LEAD',
+      grants: [{ category: 'worklist', axes: ['query', 'mutation'] }]
+    })
+
+    expect(roleTemplateById('plant.production-lead')!.name).toBe('PRODUCTION-LEAD')
+    expect(roleTemplates()).toHaveLength(1)
+  })
+})
+
+describe('what registration refuses', () => {
+  it('refuses a template with no grants written at all', () => {
+    expect(() => registerRoleTemplate({ id: 'x', name: 'X' } as any)).toThrow(/no grants/)
+  })
+
+  it('accepts an empty list — a seat that opens nothing on purpose, for approval routing', () => {
+    registerRoleTemplate({ id: 'twin.quality-inspector', name: 'QUALITY-INSPECTOR', grants: [] })
+
+    expect(roleTemplateById('twin.quality-inspector')!.grants).toEqual([])
+  })
+
+  it('refuses a grant with no axes', () => {
+    expect(() => registerRoleTemplate({ id: 'x', name: 'X', grants: [{ category: 'board', axes: [] }] })).toThrow(
+      /no axes/
+    )
+  })
+
+  it('refuses the same id twice', () => {
+    registerRoleTemplate({ id: 'x', name: 'X', grants: [] })
+
+    expect(() => registerRoleTemplate({ id: 'x', name: 'Y', grants: [] })).toThrow(/declared twice/)
+  })
+
+  it('accepts the same role name from two applications — one seat, declared twice', () => {
+    registerRoleTemplate({ id: 'plant.qi', name: 'QUALITY-INSPECTOR', grants: [{ category: 'board', axes: ['query'] }] })
+    registerRoleTemplate({ id: 'twin.qi', name: 'QUALITY-INSPECTOR', grants: [] })
+
+    expect(roleTemplates().filter(one => one.name === 'QUALITY-INSPECTOR')).toHaveLength(2)
+  })
+})
+
+describe('names this installation does not declare', () => {
+  it('points at grants that would silently open nothing after a category rename', () => {
+    registerRoleTemplate({
+      id: 'plant.x',
+      name: 'X',
+      grants: [
+        { category: 'board', axes: ['query'] },
+        { category: 'board-ai', axes: ['query', 'mutation'] }
+      ]
+    })
+
+    expect(unknownTemplateGrants(roleTemplateById('plant.x')!)).toEqual(['board-ai:query', 'board-ai:mutation'])
+  })
+
+  it('reports nothing when every named privilege is installed', () => {
+    registerRoleTemplate({ id: 'plant.y', name: 'Y', grants: [{ category: 'order', axes: ['query'] }] })
+
+    expect(unknownTemplateGrants(roleTemplateById('plant.y')!)).toEqual([])
+  })
+})
+
+describe('the two templates the framework computes', () => {
+  it('gives the viewer every category that declares a query axis', () => {
+    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
+
+    expect(viewer.grants.map(grant => grant.category).sort()).toEqual(['board', 'order', 'worklist'])
+    expect(viewer.grants.every(grant => grant.axes.join() === 'query')).toBe(true)
+  })
+
+  it('gives the administrator everything declared', () => {
+    const administrator = computedRoleTemplates().find(one => one.id === 'framework.administrator')!
+    const pairs = administrator.grants.flatMap(grant => grant.axes.map(axis => `${grant.category}:${axis}`)).sort()
+
+    expect(pairs).toEqual(['board:mutation', 'board:query', 'order:query', 'worklist:mutation', 'worklist:query'])
+  })
+
+  it('widens only the administrator when a new axis is declared', () => {
+    ;(process as any).PRIVILEGES['board execute'] = ['board', 'execute']
+
+    const administrator = computedRoleTemplates().find(one => one.id === 'framework.administrator')!
+    const viewer = computedRoleTemplates().find(one => one.id === 'framework.viewer')!
+
+    expect(administrator.grants.find(grant => grant.category === 'board')!.axes).toContain('execute')
+    expect(viewer.grants.find(grant => grant.category === 'board')!.axes).toEqual(['query'])
+  })
+
+  it('offers the computed two alongside whatever applications declared', () => {
+    registerRoleTemplate({ id: 'plant.z', name: 'Z', grants: [] })
+
+    expect(allRoleTemplates().map(one => one.id)).toEqual(['framework.viewer', 'framework.administrator', 'plant.z'])
+  })
+})