@things-factory/organization 10.1.104 → 10.1.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/organization",
-  "version": "10.1.104",
+  "version": "10.1.105",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -37,9 +37,9 @@
     "@operato/popup": "^10.15.0",
     "@operato/shell": "^10.0.0",
     "@things-factory/auth-base": "^10.1.79",
-    "@things-factory/code-ui": "^10.1.104",
-    "@things-factory/contact": "^10.1.79",
+    "@things-factory/code-ui": "^10.1.105",
+    "@things-factory/contact": "^10.1.105",
     "@things-factory/shell": "^10.1.79"
   },
-  "gitHead": "0d05c7573220c6da2dec2654a4b86d7bd8e3c4fb"
+  "gitHead": "c8ad9b40d57709beefd5e3d6167fd9cab6efea3a"
 }

package/tests/domain-reference.test.ts

@@ -0,0 +1,184 @@
+/**
+ * A department's manager and an employee's supervisor, department and user are looked up inside the caller's domain.
+ *
+ * The lookups asked by id alone, so a mutation run in one domain could link a row of another: an employee of
+ * domain B as the manager of a department of domain A, a user who is not a member of A as an employee of A.
+ * This runs the real mutations on sqlite and reads the links back from the table.
+ */
+import 'reflect-metadata'
+
+const { existsSync } = require('fs')
+const { join } = require('path')
+const { DataSource } = require('typeorm')
+
+const shell = require('@things-factory/shell')
+const authBase = require('@things-factory/auth-base')
+const contact = require('@things-factory/contact')
+
+function loadCompiled(modulePath: string): any {
+  const resolved = join(__dirname, '..', 'dist-server', `${modulePath}.js`)
+  if (!existsSync(resolved)) {
+    throw new Error(`organization build output is missing: ${resolved}\nBuild it first: npm run build:server`)
+  }
+  return require(resolved)
+}
+
+let dataSource: any
+let Department: any
+let Employee: any
+let DepartmentMutation: any
+let EmployeeMutation: any
+
+let domain: any
+let other: any
+let user: any
+let member: any
+let outsider: any
+let ours: any
+let theirs: any
+let ourTeam: any
+let theirTeam: any
+
+beforeAll(async () => {
+  const organization = loadCompiled('service/index')
+  Department = loadCompiled('service/department/department').Department
+  Employee = loadCompiled('service/employee/employee').Employee
+  DepartmentMutation = loadCompiled('service/department/department-mutation').DepartmentMutation
+  EmployeeMutation = loadCompiled('service/employee/employee-mutation').EmployeeMutation
+
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new shell.NamingStrategy(),
+    entities: [...shell.entities, ...authBase.entities, ...contact.entities, ...organization.entities],
+    logging: false
+  })
+  await dataSource.initialize()
+  shell.addDataSource('default', dataSource)
+  shell.addDataSource('tx', dataSource)
+})
+
+beforeEach(async () => {
+  await dataSource.synchronize(true)
+  const domains = dataSource.getRepository(shell.Domain)
+  domain = await domains.save({ name: 'ours', subdomain: 'ours' })
+  other = await domains.save({ name: 'theirs', subdomain: 'theirs' })
+
+  const users = dataSource.getRepository(authBase.User)
+  user = await users.save({ name: 'tester', email: 'tester@domain-reference.test', domains: [domain] })
+  member = await users.save({ name: 'member', email: 'member@domain-reference.test', domains: [domain] })
+  outsider = await users.save({ name: 'outsider', email: 'outsider@domain-reference.test', domains: [other] })
+
+  const employees = dataSource.getRepository(Employee)
+  ours = await employees.save({ domain, controlNo: 'E1', name: 'ours' })
+  theirs = await employees.save({ domain: other, controlNo: 'E1', name: 'theirs' })
+
+  const departments = dataSource.getRepository(Department)
+  ourTeam = await departments.save({ domain, controlNo: 'T1', name: 'our team' })
+  theirTeam = await departments.save({ domain: other, controlNo: 'T1', name: 'their team' })
+})
+
+afterAll(async () => {
+  if (!dataSource) return
+  shell.removeDataSource('default')
+  shell.removeDataSource('tx')
+  await dataSource.destroy()
+})
+
+const context = () => ({ state: { domain, user, tx: dataSource.manager } })
+
+async function managerOf(id: string) {
+  return (await dataSource.getRepository(Department).findOne({ where: { id }, relations: ['manager'] }))?.manager?.id ?? null
+}
+
+async function linksOf(id: string) {
+  const row = await dataSource.getRepository(Employee).findOne({ where: { id }, relations: ['supervisor', 'department', 'user'] })
+  return { supervisor: row?.supervisor?.id ?? null, department: row?.department?.id ?? null, user: row?.user?.id ?? null }
+}
+
+describe("a department's manager comes from the caller's domain", () => {
+  it('an employee of this domain is accepted', async () => {
+    const created = await new DepartmentMutation().createDepartment({ controlNo: 'T2', name: 'new', manager: { id: ours.id } }, context())
+    expect(await managerOf(created.id)).toBe(ours.id)
+  })
+
+  it('createDepartment refuses an employee of another domain', async () => {
+    await expect(
+      new DepartmentMutation().createDepartment({ controlNo: 'T2', name: 'new', manager: { id: theirs.id } }, context())
+    ).rejects.toThrow(/manager not found in this domain/)
+    expect(await dataSource.getRepository(Department).countBy({ name: 'new' })).toBe(0)
+  })
+
+  it('updateDepartment refuses an employee of another domain', async () => {
+    await expect(
+      new DepartmentMutation().updateDepartment(ourTeam.id, { manager: { id: theirs.id } }, context())
+    ).rejects.toThrow(/manager not found in this domain/)
+    expect(await managerOf(ourTeam.id)).toBeNull()
+  })
+
+  it('updateMultipleDepartment refuses it on a new row and on an edited one', async () => {
+    const mutation = new DepartmentMutation()
+    await expect(
+      mutation.updateMultipleDepartment([{ cuFlag: '+', controlNo: 'T2', name: 'new', manager: { id: theirs.id } }], context())
+    ).rejects.toThrow(/manager not found in this domain/)
+    await expect(
+      mutation.updateMultipleDepartment([{ cuFlag: 'M', id: ourTeam.id, manager: { id: theirs.id } }], context())
+    ).rejects.toThrow(/manager not found in this domain/)
+    expect(await managerOf(ourTeam.id)).toBeNull()
+  })
+
+  it('null still clears the manager', async () => {
+    await new DepartmentMutation().updateDepartment(ourTeam.id, { manager: { id: ours.id } }, context())
+    await new DepartmentMutation().updateDepartment(ourTeam.id, { manager: null }, context())
+    expect(await managerOf(ourTeam.id)).toBeNull()
+  })
+})
+
+describe("an employee's supervisor, department and user come from the caller's domain", () => {
+  it('rows of this domain, and a member of it, are accepted', async () => {
+    const created = await new EmployeeMutation().createEmployee(
+      { controlNo: 'E2', name: 'new', supervisor: { id: ours.id }, department: { id: ourTeam.id }, user: { id: member.id } },
+      context()
+    )
+    expect(await linksOf(created.id)).toEqual({ supervisor: ours.id, department: ourTeam.id, user: member.id })
+  })
+
+  it.each([
+    ['supervisor', () => ({ supervisor: { id: theirs.id } })],
+    ['department', () => ({ department: { id: theirTeam.id } })],
+    ['user', () => ({ user: { id: outsider.id } })]
+  ])('createEmployee refuses a %s of another domain', async (what, patch) => {
+    await expect(
+      new EmployeeMutation().createEmployee({ controlNo: 'E2', name: 'new', ...patch() }, context())
+    ).rejects.toThrow(new RegExp(`${what} not found in this domain`))
+    expect(await dataSource.getRepository(Employee).countBy({ controlNo: 'E2' })).toBe(0)
+  })
+
+  it.each([
+    ['supervisor', () => ({ supervisor: { id: theirs.id } })],
+    ['department', () => ({ department: { id: theirTeam.id } })],
+    ['user', () => ({ user: { id: outsider.id } })]
+  ])('updateEmployee refuses a %s of another domain', async (what, patch) => {
+    await expect(new EmployeeMutation().updateEmployee(ours.id, patch(), context())).rejects.toThrow(
+      new RegExp(`${what} not found in this domain`)
+    )
+    expect(await linksOf(ours.id)).toEqual({ supervisor: null, department: null, user: null })
+  })
+
+  it.each([
+    ['supervisor', () => ({ supervisor: { id: theirs.id } })],
+    ['department', () => ({ department: { id: theirTeam.id } })],
+    ['user', () => ({ user: { id: outsider.id } })]
+  ])('updateMultipleEmployee refuses a %s of another domain on a new row and on an edited one', async (what, patch) => {
+    const mutation = new EmployeeMutation()
+    await expect(
+      mutation.updateMultipleEmployee([{ cuFlag: '+', controlNo: 'E2', name: 'new', ...patch() }], context())
+    ).rejects.toThrow(new RegExp(`${what} not found in this domain`))
+    await expect(
+      mutation.updateMultipleEmployee([{ cuFlag: 'M', id: ours.id, ...patch() }], context())
+    ).rejects.toThrow(new RegExp(`${what} not found in this domain`))
+    expect(await linksOf(ours.id)).toEqual({ supervisor: null, department: null, user: null })
+  })
+})