@things-factory/code-base 10.1.47 → 10.1.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/code-base",
-  "version": "10.1.47",
+  "version": "10.1.105",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -28,8 +28,8 @@
   },
   "dependencies": {
     "@operato/graphql": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.47",
-    "@things-factory/shell": "^10.1.47"
+    "@things-factory/auth-base": "^10.1.79",
+    "@things-factory/shell": "^10.1.79"
   },
-  "gitHead": "185f20d7d9a15715a0ee2757a6a8189ec36cfb9d"
+  "gitHead": "c8ad9b40d57709beefd5e3d6167fd9cab6efea3a"
 }

package/tests/domain-reference.test.ts

@@ -0,0 +1,169 @@
+/**
+ * A common code and its details are looked up inside the caller's domain.
+ *
+ * The lookups asked by id alone: a detail could be put under another domain's code group, a group could take
+ * over another domain's details, and the grid save (`updateMultiple…`, cuFlag 'M') overwrote a row of another
+ * domain by its id. This runs the real mutations on sqlite and reads the rows back.
+ */
+import 'reflect-metadata'
+
+const { existsSync } = require('fs')
+const { join } = require('path')
+const { DataSource } = require('typeorm')
+
+const shell = require('@things-factory/shell')
+const authBase = require('@things-factory/auth-base')
+
+function loadCompiled(modulePath: string): any {
+  const resolved = join(__dirname, '..', 'dist-server', `${modulePath}.js`)
+  if (!existsSync(resolved)) {
+    throw new Error(`code-base build output is missing: ${resolved}\nBuild it first: npm run build:server`)
+  }
+  return require(resolved)
+}
+
+let dataSource: any
+let CommonCode: any
+let CommonCodeDetail: any
+let CommonCodeMutation: any
+let CommonCodeDetailMutation: any
+
+let domain: any
+let other: any
+let user: any
+let ourCode: any
+let theirCode: any
+let ourDetail: any
+let theirDetail: any
+
+beforeAll(async () => {
+  const codeBase = loadCompiled('service/index')
+  CommonCode = codeBase.CommonCode
+  CommonCodeDetail = codeBase.CommonCodeDetail
+  CommonCodeMutation = loadCompiled('service/common-code/common-code-mutation').CommonCodeMutation
+  CommonCodeDetailMutation = loadCompiled('service/common-code-detail/common-code-detail-mutation').CommonCodeDetailMutation
+
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new shell.NamingStrategy(),
+    entities: [...shell.entities, ...authBase.entities, ...codeBase.entities],
+    logging: false
+  })
+  await dataSource.initialize()
+  shell.addDataSource('default', dataSource)
+  shell.addDataSource('tx', dataSource)
+})
+
+beforeEach(async () => {
+  await dataSource.synchronize(true)
+  const domains = dataSource.getRepository(shell.Domain)
+  domain = await domains.save({ name: 'ours', subdomain: 'ours' })
+  other = await domains.save({ name: 'theirs', subdomain: 'theirs' })
+  user = await dataSource.getRepository(authBase.User).save({ name: 'tester', email: 'tester@code-base.test', locale: 'en' })
+
+  const codes = dataSource.getRepository(CommonCode)
+  ourCode = await codes.save({ domain, name: 'UNIT', description: 'ours' })
+  theirCode = await codes.save({ domain: other, name: 'UNIT', description: 'theirs' })
+
+  const details = dataSource.getRepository(CommonCodeDetail)
+  ourDetail = await details.save({ domain, commonCode: ourCode, name: 'EA', description: 'ours', rank: 1 })
+  theirDetail = await details.save({ domain: other, commonCode: theirCode, name: 'EA', description: 'theirs', rank: 1 })
+})
+
+afterAll(async () => {
+  if (!dataSource) return
+  shell.removeDataSource('default')
+  shell.removeDataSource('tx')
+  await dataSource.destroy()
+})
+
+const context = () => ({ state: { domain, user, tx: dataSource.manager } })
+
+async function groupOf(detailId: string) {
+  return (await dataSource.getRepository(CommonCodeDetail).findOneBy({ id: detailId }))?.commonCodeId ?? null
+}
+
+describe("a detail's code group comes from the caller's domain", () => {
+  it('a group of this domain is accepted', async () => {
+    const created = await new CommonCodeDetailMutation().createCommonCodeDetail(
+      { name: 'BOX', description: 'box', rank: 2, commonCode: { id: ourCode.id } },
+      context()
+    )
+    expect(await groupOf(created.id)).toBe(ourCode.id)
+  })
+
+  it('createCommonCodeDetail refuses a group of another domain', async () => {
+    await expect(
+      new CommonCodeDetailMutation().createCommonCodeDetail(
+        { name: 'BOX', description: 'box', rank: 2, commonCode: { id: theirCode.id } },
+        context()
+      )
+    ).rejects.toThrow(/common code not found in this domain/)
+    expect(await dataSource.getRepository(CommonCodeDetail).countBy({ name: 'BOX' })).toBe(0)
+  })
+
+  it('updateCommonCodeDetail refuses a group of another domain', async () => {
+    await expect(
+      new CommonCodeDetailMutation().updateCommonCodeDetail(ourDetail.id, { commonCode: { id: theirCode.id } }, context())
+    ).rejects.toThrow(/common code not found in this domain/)
+    expect(await groupOf(ourDetail.id)).toBe(ourCode.id)
+  })
+
+  it('updateMultipleCommonCodeDetail refuses it on a new row and on an edited one', async () => {
+    const mutation = new CommonCodeDetailMutation()
+    await expect(
+      mutation.updateMultipleCommonCodeDetail(
+        [{ cuFlag: '+', name: 'BOX', rank: 2, labels: {}, commonCode: { id: theirCode.id } }],
+        context()
+      )
+    ).rejects.toThrow(/common code not found in this domain/)
+    await expect(
+      mutation.updateMultipleCommonCodeDetail(
+        [{ cuFlag: 'M', id: ourDetail.id, labels: {}, commonCode: { id: theirCode.id } }],
+        context()
+      )
+    ).rejects.toThrow(/common code not found in this domain/)
+    expect(await groupOf(ourDetail.id)).toBe(ourCode.id)
+  })
+
+  it("updateMultipleCommonCodeDetail does not edit another domain's detail by its id", async () => {
+    await expect(
+      new CommonCodeDetailMutation().updateMultipleCommonCodeDetail(
+        [{ cuFlag: 'M', id: theirDetail.id, labels: {}, description: 'overwritten' }],
+        context()
+      )
+    ).rejects.toThrow(/common code detail not found in this domain/)
+    expect((await dataSource.getRepository(CommonCodeDetail).findOneBy({ id: theirDetail.id })).description).toBe('theirs')
+  })
+})
+
+describe("a code group's details and rows come from the caller's domain", () => {
+  it('createCommonCode refuses a detail of another domain', async () => {
+    await expect(
+      new CommonCodeMutation().createCommonCode({ name: 'COLOR', description: 'color', details: [theirDetail.id] }, context())
+    ).rejects.toThrow(/common code detail not found in this domain/)
+    expect(await groupOf(theirDetail.id)).toBe(theirCode.id)
+  })
+
+  it('updateCommonCode refuses a detail of another domain', async () => {
+    await expect(
+      new CommonCodeMutation().updateCommonCode('UNIT', { details: [theirDetail.id] }, context())
+    ).rejects.toThrow(/common code detail not found in this domain/)
+    expect(await groupOf(theirDetail.id)).toBe(theirCode.id)
+  })
+
+  it('updateCommonCode keeps the details of this domain', async () => {
+    const updated = await new CommonCodeMutation().updateCommonCode('UNIT', { details: [ourDetail.id] }, context())
+    expect(updated.details.map((detail: any) => detail.id)).toEqual([ourDetail.id])
+  })
+
+  it("updateMultipleCommonCode does not edit another domain's code by its id", async () => {
+    await expect(
+      new CommonCodeMutation().updateMultipleCommonCode([{ cuFlag: 'M', id: theirCode.id, description: 'overwritten' }], context())
+    ).rejects.toThrow(/common code not found in this domain/)
+    expect((await dataSource.getRepository(CommonCode).findOneBy({ id: theirCode.id })).description).toBe('theirs')
+  })
+})

package/tests/open-doors.test.ts

@@ -0,0 +1,27 @@
+/*
+ * Every mutation of code-base asks for `common-code:mutation`, and the domain owner may call it.
+ *
+ * Until 2026-10-01 none declared anything: any member of a domain could create, rename or delete its
+ * common codes and their details. The queries are not gated yet and are not measured here.
+ */
+import { gatesOf, openFields } from '../../../test/helpers/open-doors'
+
+let gates: Awaited<ReturnType<typeof gatesOf>>
+
+beforeAll(async () => {
+  gates = await gatesOf('code-base')
+})
+
+it('no mutation is open', () => {
+  expect(openFields(gates.Mutation)).toEqual([])
+})
+
+it('every mutation asks for common-code:mutation and admits the domain owner', () => {
+  for (const [field, gate] of Object.entries(gates.Mutation)) {
+    expect({ field, ...gate }).toEqual({ field, category: 'common-code', privilege: 'mutation', owner: true, super: false })
+  }
+})
+
+it('the walk reaches every mutation', () => {
+  expect(Object.keys(gates.Mutation)).toHaveLength(12)
+})