@things-factory/shell 10.0.0 → 10.0.3

package/dist-server/utils/index.d.ts

@@ -1,4 +1,5 @@
 export * from './get-domain.js';
+export * from './apply-domain-filter.js';
 export * from './condition-builder.js';
 export * from './list-query-builder.js';
 export * from './list-params-converter.js';

package/dist-server/utils/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./get-domain.js"), exports);
+tslib_1.__exportStar(require("./apply-domain-filter.js"), exports);
 tslib_1.__exportStar(require("./condition-builder.js"), exports);
 tslib_1.__exportStar(require("./list-query-builder.js"), exports);
 tslib_1.__exportStar(require("./list-params-converter.js"), exports);

package/dist-server/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/utils/index.ts"],"names":[],"mappings":";;;AAAA,0DAA+B;AAC/B,iEAAsC;AACtC,kEAAuC;AACvC,qEAA0C;AAC1C,gEAAqC;AACrC,kFAAuD;AACvD,mEAAwC;AACxC,oEAAyC;AACzC,mEAAwC","sourcesContent":["export * from './get-domain.js'\nexport * from './condition-builder.js'\nexport * from './list-query-builder.js'\nexport * from './list-params-converter.js'\nexport * from './publish-progress.js'\nexport * from './get-query-builder-from-list-params.js'\nexport * from './list-param-adjuster.js'\nexport * from './get-times-for-period.js'\nexport * from './headless-pool/index.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/utils/index.ts"],"names":[],"mappings":";;;AAAA,0DAA+B;AAC/B,mEAAwC;AACxC,iEAAsC;AACtC,kEAAuC;AACvC,qEAA0C;AAC1C,gEAAqC;AACrC,kFAAuD;AACvD,mEAAwC;AACxC,oEAAyC;AACzC,mEAAwC","sourcesContent":["export * from './get-domain.js'\nexport * from './apply-domain-filter.js'\nexport * from './condition-builder.js'\nexport * from './list-query-builder.js'\nexport * from './list-params-converter.js'\nexport * from './publish-progress.js'\nexport * from './get-query-builder-from-list-params.js'\nexport * from './list-param-adjuster.js'\nexport * from './get-times-for-period.js'\nexport * from './headless-pool/index.js'\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/shell",
-  "version": "10.0.0",
+  "version": "10.0.3",
   "description": "Core module for framework",
   "bin": {
     "things-factory": "bin/things-factory",
@@ -126,5 +126,5 @@
     "pg": "^8.7.3",
     "sqlite3": "^5.0.8"
   },
-  "gitHead": "b20fa0816c33727f7ec327e0455687d3be620c58"
+  "gitHead": "c7d253b722b6917e8911f6ef6e78e5fc2b295e82"
 }

package/tests/domain-owner-index.test.ts

@@ -0,0 +1,121 @@
+/**
+ * `domains.owner` 인덱스 — 실제 엔티티 메타데이터와 실제 마이그레이션으로 검증.
+ *
+ * 운영 설정은 `synchronize: false` 이므로 두 경로를 따로 확인한다.
+ *   - 엔티티 `@Index` 선언 → 신규 설치 경로
+ *   - `IndexDomainOwner` 마이그레이션 → 기존 설치 경로
+ */
+
+import { DataSource, IsNull, QueryRunner, TableIndex } from 'typeorm'
+
+import { Domain, NamingStrategy, entities as shellEntities } from '@things-factory/shell'
+
+import { IndexDomainOwner1785369600000 } from '../server/migrations/1785369600000-IndexDomainOwner.js'
+
+const INDEX_NAME = 'ix_domain_1'
+
+let dataSource: DataSource
+let queryRunner: QueryRunner
+
+async function findIndex(): Promise<TableIndex | undefined> {
+  const table = await queryRunner.getTable('domains')
+  return table?.indices.find(index => index.name === INDEX_NAME)
+}
+
+async function saveDomain(name: string, owner?: string): Promise<Domain> {
+  return await dataSource.getRepository(Domain).save({ name, subdomain: name, owner } as any)
+}
+
+beforeAll(async () => {
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new NamingStrategy(),
+    entities: [...shellEntities],
+    logging: false
+  })
+
+  await dataSource.initialize()
+  queryRunner = dataSource.createQueryRunner()
+})
+
+afterAll(async () => {
+  await queryRunner?.release()
+  await dataSource?.destroy()
+})
+
+describe('엔티티 선언 (신규 설치)', () => {
+  it('owner 컬럼에 인덱스가 생성된다', async () => {
+    const index = await findIndex()
+
+    expect(index).toBeDefined()
+    expect(index.columnNames).toEqual(['owner'])
+  })
+
+  it('non-unique 라서 한 사용자가 여러 도메인을 소유할 수 있다', async () => {
+    expect((await findIndex()).isUnique).toBe(false)
+
+    const owner = 'same-owner-id'
+    await saveDomain('multi-a', owner)
+    await saveDomain('multi-b', owner)
+
+    expect(await dataSource.getRepository(Domain).count({ where: { owner } })).toBe(2)
+  })
+
+  it('owner 가 비어 있는 도메인도 여러 개 존재할 수 있다', async () => {
+    await saveDomain('orphan-a')
+    await saveDomain('orphan-b')
+
+    const orphans = await dataSource.getRepository(Domain).find({ where: { owner: IsNull() } })
+
+    expect(orphans.map(domain => domain.subdomain).sort()).toEqual(['orphan-a', 'orphan-b'])
+  })
+})
+
+describe('마이그레이션 (기존 설치)', () => {
+  const migration = new IndexDomainOwner1785369600000()
+
+  afterEach(async () => {
+    /* 다음 검사를 위해 인덱스를 되돌려 둔다. */
+    if (!(await findIndex())) {
+      await migration.up(queryRunner)
+    }
+  })
+
+  it('인덱스가 없는 DB 에 인덱스를 만든다', async () => {
+    await queryRunner.dropIndex('domains', INDEX_NAME)
+    expect(await findIndex()).toBeUndefined()
+
+    await migration.up(queryRunner)
+
+    const index = await findIndex()
+    expect(index.columnNames).toEqual(['owner'])
+    expect(index.isUnique).toBe(false)
+  })
+
+  it('이미 있으면 아무것도 하지 않는다 (idempotent)', async () => {
+    expect(await findIndex()).toBeDefined()
+
+    await expect(migration.up(queryRunner)).resolves.not.toThrow()
+
+    expect(await findIndex()).toBeDefined()
+  })
+
+  it('되돌리면 인덱스만 사라지고 데이터는 남는다', async () => {
+    const saved = await saveDomain('rollback-target', 'owner-id')
+
+    await migration.down(queryRunner)
+
+    expect(await findIndex()).toBeUndefined()
+    expect((await dataSource.getRepository(Domain).findOneBy({ id: saved.id })).owner).toBe('owner-id')
+  })
+
+  it('인덱스가 없는 상태에서 되돌려도 실패하지 않는다', async () => {
+    await migration.down(queryRunner)
+    expect(await findIndex()).toBeUndefined()
+
+    await expect(migration.down(queryRunner)).resolves.not.toThrow()
+  })
+})

package/tests/env-var-tenant-isolation.test.ts

@@ -0,0 +1,118 @@
+/**
+ * 테넌트 격리 회귀 테스트 — 일괄 갱신이 다른 도메인의 행을 건드리지 못한다.
+ *
+ * `updateMultipleX` 계열은 스캐폴딩이 찍어낸 형태라 여러 패키지에 같은 코드가 복제돼 있었고,
+ * 클라이언트가 준 id 로 도메인 조건 없이 행을 집어 저장했다. 즉 자기 테넌트에서 해당 권한만
+ * 있으면 UUID 를 아는 다른 테넌트의 행을 조용히 수정할 수 있었다.
+ *
+ * 여기서는 `EnvVar`(테넌트별 환경변수 — 값이 가장 민감한 축) 로 그 형태를 잠근다.
+ * 리졸버를 직접 호출한다 — `@Directive` 는 GraphQL 스키마 계층이라 직접 호출에 개입하지 않고,
+ * 트랜잭션은 `context.state.tx` 로 주입한다.
+ */
+
+import { DataSource } from 'typeorm'
+
+import { Domain, EnvVar, NamingStrategy, entities as shellEntities } from '@things-factory/shell'
+
+/* 리졸버는 패키지 공개 표면이 아니라 dist-server 에서 직접 가져온다 (빌드 후 실행할 것). */
+import { EnvVarMutation } from '../dist-server/service/env-var/env-var-mutation.js'
+
+let dataSource: DataSource
+
+const mutation = new EnvVarMutation()
+
+function contextFor(domain: Domain) {
+  return { state: { domain, user: null, tx: dataSource.manager } } as any
+}
+
+async function createDomain(name: string): Promise<Domain> {
+  return await dataSource.getRepository(Domain).save({ name, subdomain: name } as any)
+}
+
+async function createEnvVar(domain: Domain, name: string, value: string): Promise<EnvVar> {
+  return await dataSource.getRepository(EnvVar).save({ domain, name, value } as any)
+}
+
+beforeAll(async () => {
+  dataSource = new DataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new NamingStrategy(),
+    entities: [...shellEntities],
+    logging: false
+  })
+
+  await dataSource.initialize()
+})
+
+afterAll(async () => {
+  await dataSource?.destroy()
+})
+
+beforeEach(async () => {
+  await dataSource.query(`DELETE FROM "${dataSource.getMetadata(EnvVar).tableName}"`)
+  await dataSource.query(`DELETE FROM "${dataSource.getMetadata(Domain).tableName}"`)
+})
+
+describe('updateMultipleEnvVars 테넌트 격리', () => {
+  it('다른 도메인의 행은 갱신하지 못하고 실패한다', async () => {
+    const victim = await createDomain('victim')
+    const attacker = await createDomain('attacker')
+    const secret = await createEnvVar(victim, 'API_ENDPOINT', 'https://victim.example.com')
+
+    await expect(
+      mutation.updateMultipleEnvVars(
+        [{ cuFlag: 'M', id: secret.id, value: 'https://attacker.example.com' } as any],
+        contextFor(attacker)
+      )
+    ).rejects.toThrow(secret.id)
+
+    /* 피해 도메인의 값이 그대로여야 한다 */
+    const kept = await dataSource.getRepository(EnvVar).findOneBy({ id: secret.id })
+    expect(kept.value).toBe('https://victim.example.com')
+  })
+
+  it('없는 id 는 조용히 새 행을 만들지 않고 실패한다', async () => {
+    const domain = await createDomain('acme')
+
+    await expect(
+      mutation.updateMultipleEnvVars(
+        [{ cuFlag: 'M', id: '00000000-0000-0000-0000-000000000000', value: 'x' } as any],
+        contextFor(domain)
+      )
+    ).rejects.toThrow()
+
+    expect(await dataSource.getRepository(EnvVar).count()).toBe(0)
+  })
+
+  it('자기 도메인의 행은 정상적으로 갱신한다', async () => {
+    const domain = await createDomain('acme')
+    const envVar = await createEnvVar(domain, 'API_ENDPOINT', 'https://old.example.com')
+
+    const results = await mutation.updateMultipleEnvVars(
+      [{ cuFlag: 'M', id: envVar.id, value: 'https://new.example.com' } as any],
+      contextFor(domain)
+    )
+
+    expect(results).toHaveLength(1)
+    const updated = await dataSource.getRepository(EnvVar).findOneBy({ id: envVar.id })
+    expect(updated.value).toBe('https://new.example.com')
+  })
+
+  it('생성은 현재 도메인으로 귀속된다', async () => {
+    const domain = await createDomain('acme')
+
+    await mutation.updateMultipleEnvVars(
+      [{ cuFlag: '+', name: 'NEW_VAR', value: 'v' } as any],
+      contextFor(domain)
+    )
+
+    const created = await dataSource.getRepository(EnvVar).findOne({
+      where: { name: 'NEW_VAR' },
+      relations: ['domain']
+    })
+    expect(created.domain.id).toBe(domain.id)
+  })
+})