@things-factory/notification 10.1.106 → 10.1.107

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/notification",
-  "version": "10.1.106",
+  "version": "10.1.107",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -30,15 +30,15 @@
     "@material/web": "^2.0.0",
     "@operato/layout": "^10.0.0",
     "@operato/styles": "^10.0.0",
-    "@things-factory/auth-base": "^10.1.106",
-    "@things-factory/i18n-base": "^10.1.106",
-    "@things-factory/organization": "^10.1.106",
-    "@things-factory/setting-base": "^10.1.106",
+    "@things-factory/auth-base": "^10.1.107",
+    "@things-factory/i18n-base": "^10.1.107",
+    "@things-factory/organization": "^10.1.107",
+    "@things-factory/setting-base": "^10.1.107",
     "@things-factory/shell": "^10.1.106",
     "clipboard": "^2.0.6",
     "firebase": "^9.14.0",
     "firebase-admin": "^11.3.0",
     "google": "^2.1.0"
   },
-  "gitHead": "8d78c14708420773ec32d18b8dd44c300771c44d"
+  "gitHead": "65a3d5889e687d8122a65f029b926b1a4769d1c0"
 }

package/tests/notification-audience.test.ts

@@ -0,0 +1,53 @@
+/*
+ * An in-app notification addressed to people reaches only them; one addressed to nobody reaches the domain.
+ *
+ * Until 2026-10-02 the notifier dropped `receivers` on the way to pubsub and the subscription filtered by
+ * domain and subject only: a data archive's download link, sent to its requester, went to every subscriber
+ * of the domain.
+ */
+import { pubsub } from '@things-factory/shell'
+
+import { notificationMiddleware } from '../dist-server/middlewares/notification-middleware.js'
+import { reaches } from '../dist-server/service/notification/notification-audience.js'
+
+const home = { subdomain: 'home' }
+const alice = { id: 'alice', domains: [home] }
+const bob = { id: 'bob', domains: [home] }
+
+describe('reaches', () => {
+  it('reaches only the receivers when there are any', () => {
+    const notification = { domain: home, receivers: ['alice'] }
+    expect(reaches(notification, { domain: home, user: alice })).toBe(true)
+    expect(reaches(notification, { domain: home, user: bob })).toBe(false)
+  })
+
+  it('reaches everyone in the domain when nobody is named', () => {
+    expect(reaches({ domain: home }, { domain: home, user: bob })).toBe(true)
+    expect(reaches({ domain: home, receivers: [] }, { domain: home, user: bob })).toBe(true)
+  })
+
+  it('does not cross domains', () => {
+    expect(reaches({ domain: { subdomain: 'other' } }, { domain: home, user: alice })).toBe(false)
+    expect(reaches({ domain: { subdomain: 'other' } }, { user: alice })).toBe(false)
+  })
+
+  it('still filters by subject', () => {
+    expect(reaches({ domain: home, subject: 'warn' }, { domain: home, user: alice }, ['info'])).toBe(false)
+    expect(reaches({ domain: home, subject: 'info' }, { domain: home, user: alice }, ['info'])).toBe(true)
+  })
+})
+
+describe('notifier', () => {
+  it('publishes the receivers of an in-app notification', async () => {
+    const publish = jest.spyOn(pubsub, 'publish').mockImplementation(async () => {})
+    const context: any = { state: { domain: home, user: alice } }
+    await notificationMiddleware(context, async () => {})
+
+    await context.state.notify({ receivers: ['alice'], mode: 'in-app', title: 'ready' })
+
+    expect(publish).toHaveBeenCalledWith('notification', {
+      notification: expect.objectContaining({ domain: home, receivers: ['alice'] })
+    })
+    publish.mockRestore()
+  })
+})

package/tests/notify-receivers.test.ts

@@ -0,0 +1,172 @@
+/*
+ * `POST /notification/notify` reaches members of the sending domain only, and only someone allowed to
+ * notify others may name anyone but themself.
+ *
+ * Until 2026-10-02 a receiver was looked up by e-mail among every user of every tenant, and the route
+ * asked for nothing: any signed-in member could push a notification to anyone.
+ *
+ * The `@notification` directive sends what it declares, to members of the domain.
+ *
+ * Reads dist-server (entities need tsc's decorator metadata) - run the package's build:server first.
+ */
+import { DataSource } from 'typeorm'
+
+import { NamingStrategy, addDataSource, entities as shellEntities, Domain } from '@things-factory/shell'
+import { Privilege, Role, User, entities as authEntities } from '@things-factory/auth-base'
+
+import { graphql } from 'graphql'
+import { makeExecutableSchema } from '@graphql-tools/schema'
+
+import { notificationRouter } from '../dist-server/routers/notification-router.js'
+import {
+  directiveNotification,
+  notificationDirectiveTypeDefs
+} from '../dist-server/service/notification/directive-notification.js'
+import { domainMemberIdsByEmail } from '../dist-server/controllers/receivers.js'
+
+let dataSource: DataSource
+let home: Domain
+let other: Domain
+let sender: User
+let colleague: User
+let stranger: User
+
+const handler = (() => {
+  const layer = (notificationRouter as any).stack.find(
+    (layer: any) => layer.path === '/notification/notify' && layer.methods.includes('POST')
+  )
+  return layer.stack[layer.stack.length - 1]
+})()
+
+async function post(from: User, receivers: string) {
+  const sent: any[] = []
+  const context: any = {
+    state: { user: from, domain: home, notify: async (message: any) => sent.push(message) },
+    request: { body: { receivers, title: 't', body: 'b' } }
+  }
+  await handler(context, async () => {})
+  return { status: context.status ?? 200, sent }
+}
+
+async function grant(user: User, category: string, name: string) {
+  const privilege = await dataSource.getRepository(Privilege).save({ name, category } as any)
+  const role = await dataSource.getRepository(Role).save({ name: `${category}-${name}`, domain: home, privileges: [privilege] } as any)
+  user.roles = [role]
+  await dataSource.getRepository(User).save(user)
+}
+
+beforeAll(async () => {
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new NamingStrategy(),
+    entities: [...shellEntities, ...authEntities],
+    logging: false
+  })
+  await dataSource.initialize()
+  addDataSource('default', dataSource)
+  ;(process as any).domainOwnerGranted = async () => false
+  ;(process as any).superUserGranted = async () => false
+
+  const domains = dataSource.getRepository(Domain)
+  home = await domains.save({ name: 'home', subdomain: 'home' } as any)
+  other = await domains.save({ name: 'other', subdomain: 'other' } as any)
+
+  const users = dataSource.getRepository(User)
+  const make = (name: string, domains: Domain[]) =>
+    users.save({ name, username: name, email: `${name}@test.com`, domains } as any)
+  sender = await make('sender', [home])
+  colleague = await make('colleague', [home])
+  stranger = await make('stranger', [other])
+
+  await grant(sender, 'notification-rule', 'mutation')
+})
+
+afterAll(async () => {
+  await dataSource?.destroy()
+})
+
+describe('receivers by e-mail', () => {
+  it('finds members of the domain, without case', async () => {
+    expect(await domainMemberIdsByEmail(home, ['COLLEAGUE@test.com', ' sender@test.com '])).toEqual(
+      expect.arrayContaining([colleague.id, sender.id])
+    )
+  })
+
+  it('does not find a user of another domain', async () => {
+    expect(await domainMemberIdsByEmail(home, ['stranger@test.com'])).toEqual([])
+  })
+})
+
+describe('POST /notify', () => {
+  it('sends to the sender when nobody is named', async () => {
+    expect(await post(sender, '')).toEqual({ status: 200, sent: [expect.objectContaining({ receivers: [sender.id] })] })
+  })
+
+  it('does not reach a user of another domain', async () => {
+    const { status, sent } = await post(sender, 'stranger@test.com')
+    expect(status).toBe(404)
+    expect(sent).toEqual([])
+  })
+
+  it('drops the stranger and keeps the colleague when both are named', async () => {
+    const { sent } = await post(sender, 'stranger@test.com, colleague@test.com')
+    expect(sent.map(message => message.receivers)).toEqual([[colleague.id]])
+  })
+
+  it('refuses to name a colleague without notification-rule:mutation', async () => {
+    const { status, sent } = await post(colleague, 'sender@test.com')
+    expect(status).toBe(403)
+    expect(sent).toEqual([])
+  })
+
+  it('lets anyone name only themself', async () => {
+    const { status, sent } = await post(colleague, 'colleague@test.com')
+    expect(status).toBe(200)
+    expect(sent.map(message => message.receivers)).toEqual([[colleague.id]])
+  })
+
+})
+
+describe('@notification directive', () => {
+  const schema = directiveNotification(
+    makeExecutableSchema({
+      typeDefs: [
+        notificationDirectiveTypeDefs,
+        `type Query {
+          mine: String @notification(title: "done", body: "it is done", url: "/x", mode: "in-app")
+          theirs: String @notification(title: "done", receivers: "colleague@test.com, stranger@test.com")
+          outsiders: String @notification(title: "done", receivers: "stranger@test.com")
+        }`
+      ],
+      resolvers: { Query: { mine: () => 'ok', theirs: () => 'ok', outsiders: () => 'ok' } }
+    })
+  )
+
+  async function run(field: string) {
+    const sent: any[] = []
+    const result = await graphql({
+      schema,
+      source: `{ ${field} }`,
+      contextValue: { state: { user: sender, domain: home, notify: async (message: any) => sent.push(message) } }
+    })
+    expect(result.errors).toBeUndefined()
+    return sent
+  }
+
+  it('sends its own arguments to the caller when nobody is named', async () => {
+    expect(await run('mine')).toEqual([
+      expect.objectContaining({ title: 'done', body: 'it is done', url: '/x', mode: 'in-app', receivers: [sender.id] })
+    ])
+  })
+
+  it('reaches the named members of the domain only', async () => {
+    expect((await run('theirs')).map(message => message.receivers)).toEqual([[colleague.id]])
+  })
+
+  it('sends nothing when nobody named is a member', async () => {
+    expect(await run('outsiders')).toEqual([])
+  })
+})