@things-factory/auth-base 10.1.79 → 10.1.106

package/tests/refusal-cause.test.ts

@@ -0,0 +1,80 @@
+/**
+ * Why the gate said no (ADR-0103 decision 1).
+ *
+ * The four refusals used to arrive as one sentence. Only one of them is opened by a role, so a screen
+ * that offers "request access" for all four sends the admin a request they cannot answer - the person is
+ * given the role and is refused again. `judgePermission` says which it was; `checkPermission` stays a boolean.
+ */
+
+import { loadCompiled } from './compiled'
+
+const { judgePermission, checkPermission } = loadCompiled('utils/check-permission')
+const { User } = loadCompiled('service/user/user')
+
+const DOMAIN = { id: 'domain-1' } as any
+const USER = { id: 'user-1' } as any
+const NAMED = { category: 'warehouse', privilege: 'mutation' }
+const OWNED = { ...NAMED, owner: true }
+
+function given({ role = false, owner = false } = {}) {
+  User.hasPrivilege = jest.fn().mockResolvedValue(role)
+  ;(process as any).domainOwnerGranted = jest.fn().mockResolvedValue(owner)
+  ;(process as any).superUserGranted = jest.fn().mockResolvedValue(false)
+}
+
+afterEach(() => {
+  delete (process as any).domainOwnerGranted
+  delete (process as any).superUserGranted
+})
+
+describe('a refusal says which of the four it was', () => {
+  it('★ no role holds it: role', async () => {
+    given()
+    expect(await judgePermission(NAMED, USER, DOMAIN)).toEqual({ permitted: false, because: 'role' })
+    expect(await judgePermission(NAMED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'role' })
+  })
+
+  it('★ withheld by the address list: address - even with the role', async () => {
+    given({ role: true })
+    const prohibited = [{ ...NAMED, by: 'address' }]
+    expect(await judgePermission(NAMED, USER, DOMAIN, true, prohibited)).toEqual({ permitted: false, because: 'address' })
+  })
+
+  it('★ withheld by the license: license - even with the role', async () => {
+    given({ role: true })
+    const prohibited = [{ ...NAMED, by: 'license' }]
+    expect(await judgePermission(NAMED, USER, DOMAIN, false, prohibited)).toEqual({ permitted: false, because: 'license' })
+  })
+
+  it('★ a prohibition that does not say who made it: unknown - the cause is not made up', async () => {
+    given({ role: true })
+    expect(await judgePermission(NAMED, USER, DOMAIN, false, [NAMED])).toEqual({ permitted: false, because: 'unknown' })
+  })
+
+  it('★ only owners may: ownership', async () => {
+    given()
+    expect(await judgePermission({ owner: true }, USER, DOMAIN)).toEqual({ permitted: false, because: 'ownership' })
+  })
+
+  it('★ ownership asked from an unsafe address: address', async () => {
+    given({ owner: true })
+    expect(await judgePermission({ owner: true }, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'address' })
+  })
+
+  it('★ an owner without the role, from an unsafe address: address - from a safe one they pass', async () => {
+    given({ owner: true })
+    expect(await judgePermission(OWNED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'address' })
+    expect(await judgePermission(OWNED, USER, DOMAIN, false)).toEqual({ permitted: true })
+  })
+
+  it('an unsafe address whose ownership cannot be asked still refuses as role - it refused before', async () => {
+    User.hasPrivilege = jest.fn().mockResolvedValue(false)
+    expect(await judgePermission(OWNED, USER, DOMAIN, true)).toEqual({ permitted: false, because: 'role' })
+  })
+
+  it('checkPermission answers the same, as a boolean', async () => {
+    given({ role: true })
+    expect(await checkPermission(NAMED, USER, DOMAIN)).toBe(true)
+    expect(await checkPermission(NAMED, USER, DOMAIN, false, [{ ...NAMED, by: 'license' }])).toBe(false)
+  })
+})

package/translations/en.json

@@ -27,6 +27,11 @@
   "error.username already exists": "username already used by another user",
   "error.x is not a member of y": "{x} is not a member of {y}",
   "error.x privilege required": "unauthorized! {x} privilege required",
+  "error.role-not-assignable-here": "this domain cannot assign the role(s) {roles}.",
+  "error.x not allowed from this address": "unauthorized! {x} is not allowed from this address",
+  "error.x not licensed": "unauthorized! {x} is not licensed on this installation",
+  "error.x refused for this request": "unauthorized! {x} is refused for this request",
+  "error.ownership not allowed from this address": "unauthorized! ownership does not count from this address",
   "field.appliance_id": "appliance id",
   "field.brand": "brand",
   "field.password": "password",
@@ -222,5 +227,25 @@
   "text.user inactivated successfully": "user inactivated successfully",
   "text.user registered successfully": "user registered successfully. find your email to activate account",
   "text.verification email sent": "verification email sent",
-  "privilege.description": "{name} {category}"
+  "privilege.description": "{name} {category}",
+  "error.access-request-names-nothing": "an access request names a category and a privilege.",
+  "error.access-request-unknown-privilege": "there is no privilege {privilege}.",
+  "error.access-request-already-holds": "you already have {privilege}.",
+  "error.access-request-not-by-role": "a role would not open {privilege} here, so it cannot be requested.",
+  "error.access-request-not-withdrawable": "there is no pending request of yours to withdraw.",
+  "error.access-decision-access-request-not-found": "the access request is not found in this domain.",
+  "error.access-decision-request-not-pending": "the request has already been decided, withdrawn or has expired.",
+  "error.access-decision-own-request": "you cannot decide your own request.",
+  "error.access-decision-requester-unavailable": "the requester is locked, inactive or no longer in this domain.",
+  "error.access-decision-deny-needs-reason": "a denial needs a reason.",
+  "error.access-decision-already-holds": "the requester already has this privilege.",
+  "error.access-decision-role-required": "choose the role to grant.",
+  "error.access-decision-role-not-assignable": "this domain cannot assign that role.",
+  "error.access-decision-role-does-not-grant": "that role does not hold the requested privilege.",
+  "access-request.notify.asked.title": "access request",
+  "access-request.notify.asked.body": "{name} asks for {privilege}.",
+  "access-request.notify.granted.title": "access granted",
+  "access-request.notify.granted.body": "you now have {privilege} (role: {role}).",
+  "access-request.notify.denied.title": "access request denied",
+  "access-request.notify.denied.body": "{privilege}: {reason}"
 }

package/translations/ja.json

@@ -27,6 +27,11 @@
   "error.username already exists": "ユーザー名はすでに他のユーザーによって使用されています.",
   "error.x is not a member of y": "{x}は{y}のメンバーではありません.",
   "error.x privilege required": "権限がありません。{x} 権限が必要です。",
+  "error.role-not-assignable-here": "この$t(term.domain)では付与できないロールです: {roles}",
+  "error.x not allowed from this address": "権限がありません。このアドレスからは {x} 権限を使えません。",
+  "error.x not licensed": "権限がありません。このインストールのライセンスには {x} 権限がありません。",
+  "error.x refused for this request": "権限がありません。このリクエストでは {x} 権限が許可されていません。",
+  "error.ownership not allowed from this address": "権限がありません。このアドレスからは所有者権限が適用されません。",
   "field.appliance_id": "器具ID",
   "field.brand": "ブランド",
   "field.password": "パスワード",
@@ -222,5 +227,25 @@
   "privilege.category.user": "ユーザー",
   "privilege.category.webhook": "Webhook",
   "privilege.category.work-shift": "勤務交代",
-  "privilege.category.worker": "作業者"
+  "privilege.category.worker": "作業者",
+  "error.access-request-names-nothing": "権限リクエストにはカテゴリーと権限が必要です。",
+  "error.access-request-unknown-privilege": "{privilege} という権限はありません。",
+  "error.access-request-already-holds": "すでに {privilege} 権限があります。",
+  "error.access-request-not-by-role": "{privilege} はここではロールで開けないため、リクエストできません。",
+  "error.access-request-not-withdrawable": "取り下げられる保留中のリクエストがありません。",
+  "error.access-decision-access-request-not-found": "この$t(term.domain)にその権限リクエストはありません。",
+  "error.access-decision-request-not-pending": "すでに決定済み、取り下げ済み、または期限切れのリクエストです。",
+  "error.access-decision-own-request": "自分のリクエストは決定できません。",
+  "error.access-decision-requester-unavailable": "リクエスト者がロック中、無効、またはこの$t(term.domain)に所属していません。",
+  "error.access-decision-deny-needs-reason": "拒否には理由が必要です。",
+  "error.access-decision-already-holds": "リクエスト者はすでにその権限を持っています。",
+  "error.access-decision-role-required": "付与するロールを選んでください。",
+  "error.access-decision-role-not-assignable": "この$t(term.domain)では付与できないロールです。",
+  "error.access-decision-role-does-not-grant": "そのロールにはリクエストされた権限がありません。",
+  "access-request.notify.asked.title": "権限リクエスト",
+  "access-request.notify.asked.body": "{name} さんが {privilege} 権限をリクエストしました。",
+  "access-request.notify.granted.title": "権限が付与されました",
+  "access-request.notify.granted.body": "{privilege} 権限が付与されました(ロール: {role})。",
+  "access-request.notify.denied.title": "権限リクエストが拒否されました",
+  "access-request.notify.denied.body": "{privilege}: {reason}"
 }

package/translations/ko.json

@@ -27,6 +27,11 @@
   "error.username already exists": "사용자 아이디가 이미 사용되고 있습니다.",
   "error.x is not a member of y": "{x}은(는) {y}의 멤버가 아닙니다.",
   "error.x privilege required": "권한이 없습니다. {x} 권한이 필요합니다.",
+  "error.role-not-assignable-here": "이 $t(term.domain)에서 줄 수 없는 역할입니다: {roles}",
+  "error.x not allowed from this address": "권한이 없습니다. 이 주소에서는 {x} 권한을 쓸 수 없습니다.",
+  "error.x not licensed": "권한이 없습니다. 이 설치의 라이선스에는 {x} 권한이 없습니다.",
+  "error.x refused for this request": "권한이 없습니다. 이 요청에는 {x} 권한이 허용되지 않습니다.",
+  "error.ownership not allowed from this address": "권한이 없습니다. 이 주소에서는 소유자 권한이 적용되지 않습니다.",
   "field.appliance_id": "기구 아이디",
   "field.brand": "브랜드",
   "field.password": "비밀번호",
@@ -222,5 +227,25 @@
   "text.user inactivated successfully": "사용자가 성공적으로 비활성화되었습니다.",
   "text.user registered successfully": "사용자가 성공적으로 등록되었습니다. 확인 이메일을 통해서 계정을 활성화하시기 바랍니다.",
   "text.verification email sent": "확인 이메일을 보냈습니다.",
-  "privilege.description": "{category} {name}"
+  "privilege.description": "{category} {name}",
+  "error.access-request-names-nothing": "권한 요청에는 범주와 권한이 있어야 합니다.",
+  "error.access-request-unknown-privilege": "{privilege} 권한이 없습니다.",
+  "error.access-request-already-holds": "이미 {privilege} 권한이 있습니다.",
+  "error.access-request-not-by-role": "{privilege} 권한은 여기서 역할로 열리지 않아 요청할 수 없습니다.",
+  "error.access-request-not-withdrawable": "거둘 수 있는 내 대기 중 요청이 없습니다.",
+  "error.access-decision-access-request-not-found": "이 $t(term.domain)에서 그 권한 요청을 찾을 수 없습니다.",
+  "error.access-decision-request-not-pending": "이미 정해졌거나, 거두었거나, 만료된 요청입니다.",
+  "error.access-decision-own-request": "자기 요청은 정할 수 없습니다.",
+  "error.access-decision-requester-unavailable": "요청자가 잠겼거나, 비활성이거나, 이 $t(term.domain)에서 빠졌습니다.",
+  "error.access-decision-deny-needs-reason": "거부에는 까닭이 있어야 합니다.",
+  "error.access-decision-already-holds": "요청자가 이미 그 권한을 가지고 있습니다.",
+  "error.access-decision-role-required": "부여할 역할을 고르세요.",
+  "error.access-decision-role-not-assignable": "이 $t(term.domain)에서 줄 수 없는 역할입니다.",
+  "error.access-decision-role-does-not-grant": "그 역할에는 요청한 권한이 없습니다.",
+  "access-request.notify.asked.title": "권한 요청",
+  "access-request.notify.asked.body": "{name} 님이 {privilege} 권한을 요청했습니다.",
+  "access-request.notify.granted.title": "권한을 받았습니다",
+  "access-request.notify.granted.body": "{privilege} 권한을 받았습니다(역할: {role}).",
+  "access-request.notify.denied.title": "권한 요청이 거부되었습니다",
+  "access-request.notify.denied.body": "{privilege}: {reason}"
 }

package/translations/ms.json

@@ -27,6 +27,11 @@
   "error.username already exists": "Nama pengguna telah digunakan oleh pengguna lain",
   "error.x is not a member of y": "{x} bukan ahli {y}",
   "error.x privilege required": "tidak dibenarkan! kebenaran {x} diperlukan",
+  "error.role-not-assignable-here": "$t(term.domain) ini tidak boleh memberikan peranan: {roles}",
+  "error.x not allowed from this address": "tidak dibenarkan! kebenaran {x} tidak dibenarkan dari alamat ini",
+  "error.x not licensed": "tidak dibenarkan! kebenaran {x} tiada dalam lesen pemasangan ini",
+  "error.x refused for this request": "tidak dibenarkan! kebenaran {x} ditolak untuk permintaan ini",
+  "error.ownership not allowed from this address": "tidak dibenarkan! kebenaran pemilik tidak terpakai dari alamat ini",
   "field.appliance_id": "Perkakas",
   "field.brand": "Jenama",
   "field.password": "Kata laluan",
@@ -222,5 +227,25 @@
   "privilege.category.user": "pengguna",
   "privilege.category.webhook": "Webhook",
   "privilege.category.work-shift": "syif kerja",
-  "privilege.category.worker": "pekerja"
+  "privilege.category.worker": "pekerja",
+  "error.access-request-names-nothing": "permintaan akses perlu menamakan kategori dan kebenaran.",
+  "error.access-request-unknown-privilege": "tiada kebenaran {privilege}.",
+  "error.access-request-already-holds": "anda sudah mempunyai {privilege}.",
+  "error.access-request-not-by-role": "{privilege} tidak dibuka oleh peranan di sini, jadi ia tidak boleh dipohon.",
+  "error.access-request-not-withdrawable": "tiada permintaan anda yang menunggu untuk ditarik balik.",
+  "error.access-decision-access-request-not-found": "permintaan akses tidak ditemui dalam $t(term.domain) ini.",
+  "error.access-decision-request-not-pending": "permintaan ini sudah diputuskan, ditarik balik atau tamat tempoh.",
+  "error.access-decision-own-request": "anda tidak boleh memutuskan permintaan anda sendiri.",
+  "error.access-decision-requester-unavailable": "peminta dikunci, tidak aktif atau tiada lagi dalam $t(term.domain) ini.",
+  "error.access-decision-deny-needs-reason": "penolakan memerlukan sebab.",
+  "error.access-decision-already-holds": "peminta sudah mempunyai kebenaran ini.",
+  "error.access-decision-role-required": "pilih peranan untuk diberikan.",
+  "error.access-decision-role-not-assignable": "$t(term.domain) ini tidak boleh memberikan peranan itu.",
+  "error.access-decision-role-does-not-grant": "peranan itu tidak memegang kebenaran yang dipohon.",
+  "access-request.notify.asked.title": "permintaan akses",
+  "access-request.notify.asked.body": "{name} memohon {privilege}.",
+  "access-request.notify.granted.title": "akses diberikan",
+  "access-request.notify.granted.body": "anda kini mempunyai {privilege} (peranan: {role}).",
+  "access-request.notify.denied.title": "permintaan akses ditolak",
+  "access-request.notify.denied.body": "{privilege}: {reason}"
 }

package/translations/zh.json

@@ -27,6 +27,11 @@
   "error.username already exists": "用户名已被其他用户使用",
   "error.x is not a member of y": "{x}不是{y}的成员",
   "error.x privilege required": "没有权限。需要 {x} 权限。",
+  "error.role-not-assignable-here": "此$t(term.domain)不能分配的角色: {roles}",
+  "error.x not allowed from this address": "没有权限。从此地址不能使用 {x} 权限。",
+  "error.x not licensed": "没有权限。此安装的许可证不包含 {x} 权限。",
+  "error.x refused for this request": "没有权限。此请求不允许 {x} 权限。",
+  "error.ownership not allowed from this address": "没有权限。从此地址所有者权限不适用。",
   "field.appliance_id": "终端机ID",
   "field.brand": "品牌",
   "field.password": "密码",
@@ -222,5 +227,25 @@
   "privilege.category.user": "用户",
   "privilege.category.webhook": "Webhook",
   "privilege.category.work-shift": "轮班",
-  "privilege.category.worker": "作业人员"
+  "privilege.category.worker": "作业人员",
+  "error.access-request-names-nothing": "权限请求需要类别和权限。",
+  "error.access-request-unknown-privilege": "不存在权限 {privilege}。",
+  "error.access-request-already-holds": "您已拥有 {privilege} 权限。",
+  "error.access-request-not-by-role": "{privilege} 在此无法通过角色开放，因此不能请求。",
+  "error.access-request-not-withdrawable": "没有可撤回的待处理请求。",
+  "error.access-decision-access-request-not-found": "在此$t(term.domain)中找不到该权限请求。",
+  "error.access-decision-request-not-pending": "该请求已被处理、撤回或已过期。",
+  "error.access-decision-own-request": "不能处理自己的请求。",
+  "error.access-decision-requester-unavailable": "请求者已被锁定、未激活或已不在此$t(term.domain)中。",
+  "error.access-decision-deny-needs-reason": "拒绝需要填写理由。",
+  "error.access-decision-already-holds": "请求者已拥有该权限。",
+  "error.access-decision-role-required": "请选择要授予的角色。",
+  "error.access-decision-role-not-assignable": "此$t(term.domain)不能分配该角色。",
+  "error.access-decision-role-does-not-grant": "该角色不包含所请求的权限。",
+  "access-request.notify.asked.title": "权限请求",
+  "access-request.notify.asked.body": "{name} 请求 {privilege} 权限。",
+  "access-request.notify.granted.title": "权限已授予",
+  "access-request.notify.granted.body": "您已获得 {privilege} 权限(角色: {role})。",
+  "access-request.notify.denied.title": "权限请求被拒绝",
+  "access-request.notify.denied.body": "{privilege}: {reason}"
 }