@things-factory/erp-systemever 10.1.117 → 10.1.118

package/test/systemever-query-policy.test.ts

@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { planSystemEverQuery, SystemEverQueryError } from '../server/systemever-query-policy.js'
+
+test('verified work-order query fixes program, service and read method order', () => {
+  const plan = planSystemEverQuery({ screen: 'work-order' })
+  assert.equal(plan.pgmSeq, 500880)
+  assert.equal(plan.serviceSeq, 501041)
+  assert.deepEqual(plan.methods, [
+    { name: 'ConfirmQuery', methodSeq: 6 },
+    { name: 'Query', methodSeq: 1 }
+  ])
+  assert.ok(Object.isFrozen(plan))
+  assert.ok(Object.isFrozen(plan.methods))
+  assert.ok(plan.methods.every(Object.isFrozen))
+})
+
+test('unknown and prototype screen names fail before browser access', () => {
+  for (const screen of ['product', 'Save', 'Delete', '__proto__', 'constructor', '', 500880]) {
+    assert.throws(() => planSystemEverQuery({ screen }), {
+      code: 'systemever-query-unknown-screen'
+    })
+  }
+})
+
+test('request overrides and executable input are rejected without exposing values', () => {
+  for (const key of ['pgmSeq', 'serviceSeq', 'methodSeq', 'method', 'url', 'script', 'conditions']) {
+    assert.throws(() => planSystemEverQuery({ screen: 'work-order', [key]: 'secret-value' }), error => {
+      assert.ok(error instanceof SystemEverQueryError)
+      assert.equal(error.code, 'systemever-query-unsupported-param')
+      assert.ok(!error.message.includes('secret-value'))
+      return true
+    })
+  }
+})
+
+test('malformed task parameters fail with a named error', () => {
+  for (const params of [null, undefined, [], 'work-order', 1]) {
+    assert.throws(() => planSystemEverQuery(params), { code: 'systemever-query-invalid-params' })
+  }
+})

package/test/systemever-query-response.test.ts

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { decodeSystemEverQueryBlock } from '../server/systemever-query-response.js'
+
+const envelope = (Columns: unknown, Rows: unknown) => ({
+  JSonData: { Tables: [{ TableName: 'DataBlock3', Columns, Rows }] }
+})
+
+test('query rows follow response column order and preserve identifiers and nulls', () => {
+  assert.deepEqual(decodeSystemEverQueryBlock(
+    envelope(['ItemName', 'ItemNo', 'Spec'], [['제품', '00012', null]]),
+    'DataBlock3', ['ItemNo', 'ItemName']
+  ), [{ ItemName: '제품', ItemNo: '00012', Spec: null }])
+})
+
+test('an explicit empty block is accepted but missing or duplicate blocks are rejected', () => {
+  assert.deepEqual(decodeSystemEverQueryBlock(envelope(['ItemNo'], []), 'DataBlock3', ['ItemNo']), [])
+  for (const response of [null, {}, { JSonData: { Tables: [] } }, {
+    JSonData: { Tables: [envelope([], []).JSonData.Tables[0], envelope([], []).JSonData.Tables[0]] }
+  }]) assert.throws(() => decodeSystemEverQueryBlock(response, 'DataBlock3', []))
+})
+
+test('column drift and malformed rows reject the whole response', () => {
+  for (const response of [
+    envelope(['ItemName'], [['제품']]),
+    envelope(['ItemNo', 'ItemNo'], [['1', '2']]),
+    envelope([123], [['1']]),
+    envelope(['ItemNo'], [['1'], []]),
+    envelope(['ItemNo'], [{ ItemNo: '1' }])
+  ]) assert.throws(() => decodeSystemEverQueryBlock(response, 'DataBlock3', ['ItemNo']))
+})
+
+test('prototype-like column names remain ordinary own properties', () => {
+  const [row] = decodeSystemEverQueryBlock(envelope(['__proto__'], [['value']]), 'DataBlock3', [])
+  assert.equal(Object.getPrototypeOf(row), Object.prototype)
+  assert.equal(Object.getOwnPropertyDescriptor(row, '__proto__')?.value, 'value')
+})

package/test/systemever-query-runner.test.ts

@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { runSystemEverQuery } from '../server/systemever-query-runner.js'
+import { workOrderQueryData } from '../server/systemever-work-order-query.js'
+import { WORK_ORDER_COLUMNS } from '../server/systemever-work-order.js'
+
+const params = { screen: 'work-order', dateFrom: '2026-10-05', dateTo: '2026-10-12', bizUnit: '1' }
+
+test('41 captured conditions preserve defaults, isolate calls and validate date ranges', () => {
+  const first = workOrderQueryData(params)
+  const table = first.Tables[0]
+  assert.equal(table.Columns.length, 41)
+  assert.equal(table.Rows[0].length, 41)
+  assert.equal(table.ColumnsType.length, 41)
+  assert.equal(table.Rows[0][table.Columns.indexOf('WorkDateFr')], '20261005')
+  table.Rows[0][0] = 'tampered'
+  assert.equal(workOrderQueryData(params).Tables[0].Rows[0][0], 'A')
+  for (const change of [{ dateFrom: '2026-02-30' }, { dateFrom: '2026-10-13' }, { bizUnit: '../' }]) {
+    assert.throws(() => workOrderQueryData({ ...params, ...change }))
+  }
+})
+
+test('untrusted scripts, methods and endpoints never reach browser evaluation', async () => {
+  const page = { evaluate: () => { assert.fail('must not evaluate') }, url: () => 'https://example.com' }
+  for (const change of [{ script: 'secret' }, { MethodSeq: 2 }, { screen: '__proto__' }]) {
+    await assert.rejects(runSystemEverQuery(page, { ...params, ...change }))
+  }
+  await assert.rejects(runSystemEverQuery(page, params), { code: 'systemever-query-unexpected-origin' })
+})
+
+test('vendor calls use frame token, fixed query methods and stop on confirm errors', async () => {
+  const calls: any[] = []
+  let failConfirm = false
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, 'window')
+  const previousDocument = Object.getOwnPropertyDescriptor(globalThis, 'document')
+  Object.defineProperty(globalThis, 'window', { configurable: true, value: { Home: {
+    _base: { ConnInfo: { LoginSeq: 'session' } }, OpenPageSeq: (seq: number) => assert.equal(seq, 500880),
+    Const: { Message: class { Option = {} } },
+    Util: { Ajax: (url: string, message: any, verb: string, success: any) => {
+      calls.push(message)
+      assert.equal(url, '')
+      assert.equal(verb, 'POST')
+      success({ ExeMsg: { ErrorSeq: failConfirm ? 1 : 0 }, JSonData: {
+        Tables: [{ TableName: 'DataBlock1', Columns: [...WORK_ORDER_COLUMNS], Rows: [] }]
+      } })
+    } }
+  } } })
+  Object.defineProperty(globalThis, 'document', { configurable: true, value: {
+    querySelector: () => ({ contentDocument: { querySelector: () => ({ value: 'frame-token' }) } })
+  } })
+  const page = { url: () => 'https://mfg.systemevererp.com/',
+    evaluate: (fn: any, arg: any) => fn(arg), waitForFunction: async (fn: any) => assert.equal(fn(), true) }
+  try {
+    assert.deepEqual(await runSystemEverQuery(page, params), [])
+    assert.deepEqual(calls.map(call => call.MethodSeq), [6, 1])
+    for (const call of calls) {
+      assert.equal(call.Seq, 'session')
+      assert.equal(call.PageToken, 'frame-token')
+      assert.equal(call.ServiceSeq, 501041)
+      assert.equal(call.PgmMethodName, 'Query')
+      assert.equal(call.Option.PgmSeq, 500880)
+    }
+    calls.length = 0
+    failConfirm = true
+    await assert.rejects(runSystemEverQuery(page, params), { code: 'systemever-query-vendor-error' })
+    assert.deepEqual(calls.map(call => call.MethodSeq), [6])
+  } finally {
+    for (const [key, descriptor] of [['window', previousWindow], ['document', previousDocument]] as const) {
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor)
+      else delete (globalThis as any)[key]
+    }
+  }
+})

package/test/systemever-query-task.test.ts

@@ -0,0 +1,106 @@
+import assert from 'node:assert/strict'
+import test, { beforeEach } from 'node:test'
+import { registerHooks } from 'node:module'
+import { WORK_ORDER_COLUMNS } from '../server/systemever-work-order.js'
+
+const integrationUrl = 'data:text/javascript,' + encodeURIComponent(`
+  export const state = { reads: 0, recovered: 0, released: 0, session: null, page: null, recoveryPage: null };
+  export const handlers = new Map();
+  export const TaskRegistry = { registerTaskHandler: (name, value) => handlers.set(name, value) };
+  export const ConnectionManager = {
+    getConnectionEntityByName: async () => { state.reads++; return { name: 'systemever', type: 'systemever-connector', endpoint: 'https://mfg.systemevererp.com/' }; },
+    getConnectionInstanceByName: async () => ({
+      reAuthenticateSession: async () => { state.recovered++; return { page: state.recoveryPage }; },
+      releasePage: async () => { state.released++; }
+    }),
+    withSession: async (connection, fn) => { state.session = connection; return fn(state.page); }
+  };
+  export default { ConnectionManager, TaskRegistry };
+`)
+registerHooks({ resolve(specifier, context, next) {
+  if (specifier === '@things-factory/integration-base' && context.parentURL?.endsWith('/systemever-query-task.ts')) {
+    return { url: integrationUrl, shortCircuit: true }
+  }
+  return next(specifier, context)
+} })
+const { lastQueryStartedAt, SYSTEMEVER_QUERY_FLOOR_MS } = await import('../server/systemever-query-task.js')
+/* each test is its own moment; the floor is tested on its own below */
+beforeEach(() => lastQueryStartedAt.clear())
+const { handlers, state } = await import(integrationUrl)
+const handler = handlers.get('systemever-query')
+const params = { screen: 'work-order', dateFrom: '2026-10-05', dateTo: '2026-10-12', bizUnit: '1' }
+const domain = { id: 'domain' }
+const emptyPage = { url: () => 'https://mfg.systemevererp.com/', evaluate: async () => ({ response: {
+  JSonData: { Tables: [{ TableName: 'DataBlock1', Columns: [...WORK_ORDER_COLUMNS], Rows: [] }] }
+} }) }
+
+test('registered task rejects arbitrary instructions before acquiring credentials', async () => {
+  await assert.rejects(handler({ connection: 'systemever', params: { ...params, script: 'untrusted' } }, { domain }),
+    { code: 'systemever-query-unsupported-param' })
+  assert.equal(state.reads, 0)
+})
+
+test('task carries connector metadata into the session lock and returns decoded rows', async () => {
+  state.page = emptyPage
+  assert.deepEqual(await handler({ connection: 'systemever', params }, { domain }), { data: [] })
+  assert.equal(state.session.type, 'systemever-connector')
+  assert.equal(state.session.name, 'systemever')
+  assert.equal(state.session.domain, domain)
+})
+
+test('expired session recovers once and always releases the recovery page', async () => {
+  state.page = { ...emptyPage, evaluate: async () => ({ code: 'systemever-query-session-expired' }) }
+  state.recoveryPage = emptyPage
+  assert.deepEqual(await handler({ connection: 'systemever', params }, { domain }), { data: [] })
+  assert.equal(state.recovered, 1)
+  assert.equal(state.released, 1)
+  state.recoveryPage = state.page
+  lastQueryStartedAt.clear() // a second, separate run of the recovery case — not a test of the floor
+  await assert.rejects(handler({ connection: 'systemever', params }, { domain }), { code: 'systemever-query-session-expired' })
+  assert.equal(state.recovered, 2)
+  assert.equal(state.released, 2)
+})
+
+test('★ a second query of the same screen within a minute is refused by name; the browser is not asked', async () => {
+  state.page = emptyPage
+  await handler({ connection: 'systemever', params }, { domain })
+  const reads = state.reads
+  await assert.rejects(handler({ connection: 'systemever', params }, { domain }), { code: 'systemever-query-too-frequent' })
+  assert.equal(state.reads, reads)
+  assert.ok(SYSTEMEVER_QUERY_FLOOR_MS >= 60_000)
+})
+
+test('the floor is per domain — another plant is not held back', async () => {
+  state.page = emptyPage
+  await handler({ connection: 'systemever', params }, { domain })
+  assert.deepEqual(await handler({ connection: 'systemever', params }, { domain: { id: 'other' } }), { data: [] })
+})
+
+test('★ a platform refusal passes through by its own name — not renamed to a connection failure', async () => {
+  const original = (await import(integrationUrl)).ConnectionManager.getConnectionEntityByName
+  const manager = (await import(integrationUrl)).ConnectionManager
+  manager.getConnectionEntityByName = async () => {
+    throw Object.assign(new Error('integration-runtime-off: connecting "systemever" does not run in this process — MES_PROCESS_ROLE=worker'), { code: 'integration-runtime-off' })
+  }
+  try {
+    await assert.rejects(handler({ connection: 'systemever', params }, { domain }), { code: 'integration-runtime-off' })
+  } finally {
+    manager.getConnectionEntityByName = original
+  }
+})
+
+test('★ any other failure keeps its cause — named in the message, whole on cause, values not quoted', async () => {
+  const manager = (await import(integrationUrl)).ConnectionManager
+  const original = manager.getConnectionEntityByName
+  const boom = new TypeError('secret-looking value 1234')
+  manager.getConnectionEntityByName = async () => { throw boom }
+  try {
+    const error: any = await handler({ connection: 'systemever', params }, { domain }).catch(e => e)
+    assert.equal(error.code, 'systemever-query-connection-failed')
+    assert.match(error.message, /cause: TypeError/)
+    assert.doesNotMatch(error.message, /1234/)
+    assert.equal(error.cause, boom)
+  } finally {
+    manager.getConnectionEntityByName = original
+  }
+})

package/test/systemever-schedule-task.test.ts

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { readFileSync } from 'node:fs'
+import { registerHooks } from 'node:module'
+
+/*
+ * The scenario step that maps SystemEver work-order rows to contract schedule entries. The rows are the recorded
+ * 작업지시조회 response (anonymised) — the same fixture the mapping itself is tested on.
+ */
+const integrationUrl = 'data:text/javascript,' + encodeURIComponent(`
+  export const handlers = new Map();
+  export const TaskRegistry = { registerTaskHandler: (name, value) => handlers.set(name, value) };
+  export default { TaskRegistry };
+`)
+registerHooks({ resolve(specifier, context, next) {
+  if (specifier === '@things-factory/integration-base' && context.parentURL?.endsWith('/systemever-schedule-task.ts')) {
+    return { url: integrationUrl, shortCircuit: true }
+  }
+  return next(specifier, context)
+} })
+await import('../server/systemever-schedule-task.js')
+const { handlers } = await import(integrationUrl)
+const handler = handlers.get('systemever-work-orders-to-schedule')
+
+const ROWS = JSON.parse(readFileSync(new URL('./fixtures/work-order-query.json', import.meta.url), 'utf8')).rows
+
+test('the previous step’s rows become contract schedule entries', async () => {
+  const { data } = await handler({ params: { accessor: 'query', timeZone: 'Asia/Seoul' } }, { data: { query: ROWS } })
+  assert.equal(data.entries.length, 2)
+  assert.equal(data.entries[0].orderId, '20251107-0001')
+  assert.equal(data.entries[0].status, 'completed')
+  assert.deepEqual(data.skipped, [])
+})
+
+test('an order that cannot be mapped is passed on as skipped with its reason, not dropped', async () => {
+  const rows = [{ ...ROWS[0], ProgStatusName: '중단' }, ROWS[1]]
+  const { data } = await handler({ params: { accessor: 'query', timeZone: 'Asia/Seoul' } }, { data: { query: rows } })
+  assert.equal(data.entries.length, 1)
+  assert.match(data.skipped[0].reason, /unknown progress status/)
+})
+
+test('no rows at the accessor, or no zone, is refused by name', async () => {
+  await assert.rejects(handler({ params: { accessor: 'nothing', timeZone: 'Asia/Seoul' } }, { data: {} }), { code: 'systemever-schedule-invalid-rows' })
+  await assert.rejects(handler({ params: { accessor: 'query', timeZone: '' } }, { data: { query: ROWS } }), { code: 'systemever-schedule-invalid-time-zone' })
+  await assert.rejects(handler({ params: { accessor: 'query', timeZone: 'Mars/Olympus' } }, { data: { query: ROWS } }), { code: 'systemever-schedule-invalid-time-zone' })
+})

package/test/systemever-work-order.test.ts

@@ -0,0 +1,101 @@
+/*
+ * SystemEver work orders → contract schedule entries. The fixture is the 2026-10-01 작업지시조회 response with
+ * every column and value shape kept and the names replaced (test/fixtures/work-order-query.json).
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+
+import { contentRevision, localToIso, toScheduleEntries, WORK_ORDER_COLUMNS } from '../server/systemever-work-order.ts'
+
+const FIXTURE = JSON.parse(readFileSync(new URL('./fixtures/work-order-query.json', import.meta.url), 'utf8'))
+const ROWS: Record<string, unknown>[] = FIXTURE.rows
+const SEOUL = { timeZone: 'Asia/Seoul' }
+const row = (over: Record<string, unknown> = {}) => ({ ...ROWS[0], ...over })
+
+test('every column the mapping reads is in the recorded response', () => {
+  for (const column of WORK_ORDER_COLUMNS) assert.ok(FIXTURE.columns.includes(column), column)
+})
+
+test('the recorded rows map: order, item, quantity, unit, plant-local hours, completed', () => {
+  const { entries, skipped } = toScheduleEntries(ROWS, SEOUL)
+  assert.deepEqual(skipped, [])
+  assert.equal(entries.length, 2)
+  const [first] = entries
+  assert.equal(first.orderId, '20251107-0001')
+  assert.equal(first.materialDefinitionId, 'F9901-T0001')
+  assert.equal(first.quantity, 200)
+  assert.equal(first.uom, 'EA')
+  assert.equal(first.status, 'completed')
+  /* 2025-11-07 09:00 and 18:00 in Seoul */
+  assert.equal(first.startTime, '2025-11-07T00:00:00.000Z')
+  assert.equal(first.endTime, '2025-11-07T09:00:00.000Z')
+  assert.equal(first.recordTime, '2025-11-28T05:35:13.000Z')
+  assert.equal(first.workCenter, 'TEST-WorkCenterName-1')
+})
+
+test('the revision follows the content, not the last update time — a remark edit is not a new revision', () => {
+  const [a] = toScheduleEntries([row()], SEOUL).entries
+  const [remark] = toScheduleEntries([row({ Remark: 'edited', LastDateTime: '2025-12-01 09:00:00' })], SEOUL).entries
+  assert.equal(remark.revision, a.revision)
+
+  for (const change of [{ OrderQty: '150.00000' }, { WorkDate: '20251108' }, { ProgStatusName: '진행중' }, { GoodItemNo: 'F9901-T0009' }]) {
+    const [changed] = toScheduleEntries([row(change)], SEOUL).entries
+    assert.notEqual(changed.revision, a.revision, JSON.stringify(change))
+  }
+})
+
+test('statuses read by name; one not known is skipped with the reason, never read as cancelled', () => {
+  const pairs: [string, string][] = [['작성', 'draft'], ['확정', 'released'], ['진행중', 'started'], ['완료', 'completed']]
+  for (const [name, status] of pairs) assert.equal(toScheduleEntries([row({ ProgStatusName: name })], SEOUL).entries[0].status, status)
+
+  for (const name of ['중단', '미완료', '보류']) {
+    const { entries, skipped } = toScheduleEntries([row({ ProgStatusName: name })], SEOUL)
+    assert.equal(entries.length, 0, name)
+    assert.match(skipped[0].reason, /unknown progress status/)
+  }
+})
+
+test('a stopped order is skipped; a stop date alone (as on the recorded completed row) is not a stop', () => {
+  assert.equal(toScheduleEntries([row({ IsStop: '1' })], SEOUL).skipped.length, 1)
+  assert.equal(ROWS[0].StopDate, '20251128')
+  assert.equal(toScheduleEntries([row()], SEOUL).entries.length, 1)
+})
+
+test('an order that comes as two lines (two processes) is skipped whole, not cut to one line', () => {
+  const { entries, skipped } = toScheduleEntries([row({ WorkOrderSerl: 1 }), row({ WorkOrderSerl: 2 }), ROWS[1]], SEOUL)
+  assert.deepEqual(entries.map(e => e.orderId), ['20251231-0002'])
+  assert.equal(skipped.length, 2)
+  assert.match(skipped[0].reason, /2 lines/)
+})
+
+test('no unit, no item, or a quantity that is not a number skips the order — nothing is invented', () => {
+  assert.match(toScheduleEntries([row({ ItemUnitName: '' })], SEOUL).skipped[0].reason, /ItemUnitName/)
+  assert.match(toScheduleEntries([row({ GoodItemNo: null })], SEOUL).skipped[0].reason, /GoodItemNo/)
+  assert.match(toScheduleEntries([row({ OrderQty: 'abc' })], SEOUL).skipped[0].reason, /OrderQty/)
+})
+
+test('blank hours leave the times out rather than inventing midnight', () => {
+  const [e] = toScheduleEntries([row({ WorkStartTime: '', WorkEndTime: '    ' })], SEOUL).entries
+  assert.equal(e.startTime, undefined)
+  assert.equal(e.endTime, undefined)
+})
+
+test('the plant zone is required — the ERP times are local', () => {
+  assert.throws(() => toScheduleEntries(ROWS, { timeZone: '' }), /timeZone/)
+  assert.throws(() => toScheduleEntries(ROWS, { timeZone: 'Mars/Olympus' }))
+  /* the same wall time is another instant in another zone */
+  assert.equal(toScheduleEntries([row()], { timeZone: 'UTC' }).entries[0].startTime, '2025-11-07T09:00:00.000Z')
+})
+
+test('localToIso holds across a daylight-saving change', () => {
+  /* 2026-03-08 03:30 in New York is after the spring-forward gap: UTC-4 */
+  assert.equal(localToIso('20260308', '0330', 'America/New_York'), '2026-03-08T07:30:00.000Z')
+  assert.equal(localToIso('2026-01-15', '09:00', 'America/New_York'), '2026-01-15T14:00:00.000Z')
+  assert.equal(localToIso('2026-1-15', '9', 'UTC'), undefined)
+})
+
+test('contentRevision is stable for the same content', () => {
+  const content = { materialDefinitionId: 'X', quantity: 1, uom: 'EA', status: 'released' as const }
+  assert.equal(contentRevision(content), contentRevision({ ...content }))
+})

package/tsconfig.json

@@ -1,6 +1,8 @@
 {
   "extends": "../tsconfig-base.json",
   "compilerOptions": {
+    "module": "es2022",
+    "incremental": false,
     "outDir": "dist-server",
     "rootDir": "server"
   },