@things-factory/biz-base 10.1.183 → 10.1.192

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/biz-base",
-  "version": "10.1.183",
+  "version": "10.1.192",
   "main": "dist-server/index.js",
   "browser": "client/index.js",
   "exports": {
@@ -41,8 +41,8 @@
     "test": "npm run build && node --test tests/*.test.mjs tests/*.test.cjs"
   },
   "dependencies": {
-    "@things-factory/attachment-base": "^10.1.183",
-    "@things-factory/auth-base": "^10.1.183"
+    "@things-factory/attachment-base": "^10.1.192",
+    "@things-factory/auth-base": "^10.1.192"
   },
-  "gitHead": "c36684e0db8353f5f4523ed55111df3154bae19e"
+  "gitHead": "c44fe3ae4646dc4ffad7947785322acdb84c7374"
 }

package/tests/counterparty-published.test.mjs

@@ -0,0 +1,105 @@
+import { test, before, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { createRequire } from 'node:module'
+import { readFileSync } from 'node:fs'
+
+/*
+ * Choosing a counterparty without reading it (ADR-0139): `counterparty-published` opens what points at a counterparty -
+ * its name, kind and business number, an account's bank and last four digits - and nothing else, however it is asked.
+ * An in-memory SQLite source; no application database is opened.
+ */
+const require = createRequire(import.meta.url)
+const { DataSource } = require('typeorm')
+const shell = require('@things-factory/shell')
+const auth = require('@things-factory/auth-base')
+const biz = require('../dist-server/index.js')
+
+let db, domain, other, user, hanbit
+before(async () => {
+  db = await new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    entities: [...new Set([...shell.entities, ...auth.entities, ...biz.entities])],
+    namingStrategy: new shell.NamingStrategy()
+  }).initialize()
+  domain = await db.getRepository(shell.Domain).save({ name: 'one', subdomain: 'published-one' })
+  other = await db.getRepository(shell.Domain).save({ name: 'two', subdomain: 'published-two' })
+  user = await db.getRepository(auth.User).save({ name: 'clerk', email: 'clerk@example.test', status: 'activated', domains: [domain] })
+  ;[hanbit] = await db.transaction(tx =>
+    biz.saveCounterparties(tx, domain, user, [
+      { name: '(주)한빛', businessNumber: '123-45-67890', representative: '김비밀', address: '서울 어딘가', notes: '연체주의 메모' },
+      { name: '쉬는 곳', active: false },
+      ...Array.from({ length: 60 }, (_, i) => ({ name: `거래처 ${String(i).padStart(2, '0')}` }))
+    ])
+  )
+  await db.transaction(tx => biz.saveCounterparties(tx, other, user, [{ name: '(주)한빛 남의 도메인' }]))
+  await db.transaction(tx =>
+    biz.saveCounterpartyBankAccounts(tx, domain, user, [{ counterpartyId: hanbit.id, bankName: '기업은행', accountNumber: '026-123456-01-017', holderName: '(주)한빛' }])
+  )
+})
+
+after(async () => {
+  await db?.destroy()
+})
+
+const choices = (search, pagination, into = domain) => biz.counterpartyChoicesOf(db.getRepository(biz.Counterparty), into, { search, pagination })
+
+test('a choice is which counterparty, nothing about it', async () => {
+  const { items } = await choices('한빛')
+  assert.equal(items.length, 1, 'the domain\'s own, not another domain\'s')
+  assert.deepEqual(Object.keys(items[0]).sort(), ['businessNumber', 'id', 'kind', 'name'])
+  assert.equal(items[0].businessNumber, '123-45-67890')
+})
+
+test('★ a closed field is not searched - a match would tell what it says', async () => {
+  for (const word of ['김비밀', '연체주의', '어딘가']) assert.equal((await choices(word)).total, 0, word)
+  assert.equal((await choices('123-45-67890')).total, 1, 'the business number is searched - it is shown')
+})
+
+test('★ a filter on a closed field is refused - a picker sends filters, and only the shown fields take one', async () => {
+  const filtered = filters => biz.counterpartyChoicesOf(db.getRepository(biz.Counterparty), domain, { filters })
+  for (const name of ['notes', 'representative', 'address'])
+    await assert.rejects(filtered([{ name, operator: 'eq', value: 'x' }]), new RegExp(`filtering by "${name}" is not allowed`), name)
+  assert.equal((await filtered([{ name: 'name', operator: 'i_like', value: '한빛' }])).total, 1)
+})
+
+test('an inactive counterparty is not offered, and a page is capped', async () => {
+  assert.equal((await choices('쉬는 곳')).total, 0)
+  const page = await choices(undefined, { page: 1, limit: 500 })
+  assert.equal(page.items.length, biz.CHOICE_LIMIT)
+  assert.equal(page.total, 61)
+})
+
+test("★ an account to pick is its bank and the number's last four digits", async () => {
+  const accounts = await biz.counterpartyAccountChoicesOf(db.getRepository(biz.CounterpartyBankAccount), domain, hanbit.id)
+  assert.deepEqual(accounts.map(one => Object.keys(one).sort()), [['accountTail', 'bankName', 'id']])
+  assert.deepEqual([accounts[0].bankName, accounts[0].accountTail], ['기업은행', '1017'])
+  assert.deepEqual(await biz.counterpartyAccountChoicesOf(db.getRepository(biz.CounterpartyBankAccount), other, hanbit.id), [], 'not from another domain')
+})
+
+const source = file => readFileSync(new URL(`../server/service/counterparty/${file}`, import.meta.url), 'utf8')
+const guarded = (text, field) => new RegExp(`@privilege\\(category: "counterparty", privilege: "query"[^\\n]*\\n(?:(?!  \\w+[?!]?:)  [^\\n]*\\n)*?  ${field}[?!]?:`).test(text)
+
+test("★ the fields past what points at a counterparty are its keeper's, on the declaration", () => {
+  const counterparty = source('counterparty.ts')
+  for (const field of ['aliases', 'branchNumber', 'representative', 'address', 'billingAddress', 'businessType', 'businessItem', 'zeroRated', 'notes']) assert.ok(guarded(counterparty, field), field)
+  for (const field of ['name', 'kind', 'businessNumber', 'active']) assert.ok(!guarded(counterparty, field), `${field} stays open`)
+  const account = source('counterparty-bank-account.ts')
+  for (const field of ['accountNumber', 'holderName', 'notes']) assert.ok(guarded(account, field), `account ${field}`)
+  assert.ok(!guarded(account, 'bankName'), 'the bank stays open')
+  const files = source('counterparty-bank-account-query.ts')
+  for (const field of ['passbookCopy', 'businessRegistration', 'bankAccountCount'])
+    assert.match(files, new RegExp(`@privilege\\(category: "counterparty", privilege: "query"[^\\n]*\\n  @FieldResolver\\([^\\n]*\\n  async ${field}\\(`), field)
+})
+
+test('a choice type has no relation to follow, and both doors read through one page function', () => {
+  const types = source('counterparty-choice.ts')
+  const fieldTypes = [...types.matchAll(/@Field\(type => \[?(\w+)\]?/g)].map(([, type]) => type)
+  assert.deepEqual([...new Set(fieldTypes)].sort(), ['CounterpartyChoice', 'CounterpartyKind', 'ID', 'Int'])
+  const query = source('counterparty-query.ts')
+  assert.match(query, /counterparties\([\s\S]*?counterpartyPage\(getRepository\(Counterparty\), context\.state\.domain, params, \{ searchables: COUNTERPARTY_SEARCHABLES \}\)/)
+  assert.match(types, /counterpartyChoicesOf[\s\S]*?counterpartyPage\(repository, domain, [\s\S]*?filterables: CHOICE_FILTERABLES[\s\S]*?maxLimit: CHOICE_LIMIT/)
+  assert.match(query, /@privilege\(category: "counterparty-published", privilege: "query"[^\n]*\n  @Query\([^\n]*\n  async counterpartyChoices\(/)
+  assert.match(query, /@privilege\(category: "counterparty-published", privilege: "query"[^\n]*\n  @Query\([^\n]*\n  async counterpartyAccountChoices\(/)
+})