@tstdl/base 0.93.87 → 0.93.89

package/authentication/tests/authentication.service.test.js

@@ -0,0 +1,186 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'vitest';
+import { ActorType, Auditor } from '../../audit/index.js';
+import { NIL_UUID } from '../../constants.js';
+import { runInInjectionContext } from '../../injector/index.js';
+import { clearTenantData, setupIntegrationTest } from '../../unit-test/index.js';
+import { AuthenticationAncillaryService } from '../server/authentication-ancillary.service.js';
+import { AuthenticationService } from '../server/authentication.service.js';
+import { SubjectService } from '../server/subject.service.js';
+import { DefaultAuthenticationAncillaryService } from './authentication.test-ancillary-service.js';
+describe('AuthenticationService', () => {
+    let injector;
+    let database;
+    let authenticationService;
+    let subjectService;
+    let auditor;
+    let ancillaryService;
+    const schema = 'authentication';
+    const tenantId = crypto.randomUUID();
+    beforeAll(async () => {
+        ({ injector, database } = await setupIntegrationTest({
+            modules: { authentication: true },
+            authenticationAncillaryService: DefaultAuthenticationAncillaryService,
+        }));
+        authenticationService = await injector.resolveAsync(AuthenticationService);
+        subjectService = await injector.resolveAsync(SubjectService);
+        auditor = injector.resolve(Auditor);
+        ancillaryService = await injector.resolveAsync(AuthenticationAncillaryService);
+    });
+    afterAll(async () => {
+        await injector?.dispose();
+    });
+    beforeEach(async () => {
+        await clearTenantData(database, schema, ['credentials', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
+    });
+    test('login should create a session and listSessions should return it', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({
+                tenantId,
+                email: 'test@example.com',
+                firstName: 'John',
+                lastName: 'Doe',
+            });
+            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+            const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor.with({ actor: user.id, actorType: ActorType.Subject }));
+            expect(tokenResult.token).toBeDefined();
+            const sessions = await authenticationService.listSessions(tenantId, user.id);
+            expect(sessions).toHaveLength(1);
+            expect(sessions[0]?.id).toBe(tokenResult.jsonToken.payload.session);
+        });
+    });
+    test('invalidateAllSessions should end all active sessions', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({
+                tenantId,
+                email: 'test@example.com',
+                firstName: 'John',
+                lastName: 'Doe',
+            });
+            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+            await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+            await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+            let sessions = await authenticationService.listSessions(tenantId, user.id);
+            expect(sessions).toHaveLength(2);
+            const now = Date.now();
+            expect(sessions.every((s) => s.end > now)).toBe(true);
+            await authenticationService.invalidateAllSessions(tenantId, user.id, userAuditor);
+            sessions = await authenticationService.listSessions(tenantId, user.id);
+            expect(sessions.every((s) => s.end <= now + 1000)).toBe(true); // small buffer for test execution time
+        });
+    });
+    test('getSession and tryGetSession', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({
+                tenantId,
+                email: 'test@example.com',
+                firstName: 'John',
+                lastName: 'Doe',
+            });
+            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+            const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+            const sessionId = tokenResult.jsonToken.payload.session;
+            const session = await authenticationService.getSession(sessionId);
+            expect(session.id).toBe(sessionId);
+            const triedSession = await authenticationService.tryGetSession(sessionId);
+            expect(triedSession?.id).toBe(sessionId);
+            const nonExistent = await authenticationService.tryGetSession(NIL_UUID);
+            expect(nonExistent).toBeUndefined();
+        });
+    });
+    test('refresh should issue new token and session', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'refresh@example.com', firstName: 'R', lastName: 'F' });
+            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+            const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+            const refreshResult = await authenticationService.refresh(loginResult.refreshToken, undefined, {}, userAuditor);
+            expect(refreshResult.token).toBeDefined();
+            expect(refreshResult.refreshToken).not.toBe(loginResult.refreshToken);
+        });
+    });
+    test('changeSecret should update credentials', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'change@example.com', firstName: 'C', lastName: 'S' });
+            await authenticationService.setCredentials(user, 'Old-Password-2026!');
+            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+            await authenticationService.changeSecret({ tenantId, subject: user.id }, 'Old-Password-2026!', 'New-Password-2026!', userAuditor);
+            const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-2026!');
+            expect(authResult.success).toBe(true);
+        });
+    });
+    test('checkSecret, testSecret, and validateSecret', async () => {
+        await runInInjectionContext(injector, async () => {
+            const weak = 'abc';
+            const strong = 'Very-Strong-Password-2026-!@#$';
+            expect((await authenticationService.checkSecret(weak)).strength).toBeLessThan(2);
+            expect((await authenticationService.checkSecret(strong)).strength).toBeGreaterThanOrEqual(2);
+            expect((await authenticationService.testSecret(weak)).success).toBe(false);
+            expect((await authenticationService.testSecret(strong)).success).toBe(true);
+            await expect(authenticationService.validateSecret(weak)).rejects.toThrow();
+            await expect(authenticationService.validateSecret(strong)).resolves.not.toThrow();
+        });
+    });
+    test('tryResolveSubject and resolveSubject', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'resolve@example.com', firstName: 'R', lastName: 'S' });
+            const resolved = await authenticationService.tryResolveSubject({ tenantId, subject: user.id });
+            expect(resolved?.id).toBe(user.id);
+            const resolvedByEmail = await authenticationService.resolveSubject({ tenantId, subject: 'resolve@example.com' });
+            expect(resolvedByEmail.id).toBe(user.id);
+            await expect(authenticationService.resolveSubject({ tenantId, subject: 'missing' })).rejects.toThrow();
+        });
+    });
+    test('impersonation and unimpersonation', async () => {
+        await runInInjectionContext(injector, async () => {
+            const admin = await subjectService.createUser({ tenantId, email: 'admin@example.com', firstName: 'A', lastName: 'D' });
+            const user = await subjectService.createUser({ tenantId, email: 'user@example.com', firstName: 'U', lastName: 'S' });
+            const adminAuditor = auditor.with({ actor: admin.id, actorType: ActorType.Subject });
+            const adminToken = await authenticationService.getToken(admin, undefined);
+            const impersonated = await authenticationService.impersonate(adminToken.token, adminToken.refreshToken, user.id, undefined, adminAuditor);
+            expect(impersonated.jsonToken.payload.subject).toBe(user.id);
+            expect(impersonated.jsonToken.payload.impersonator).toBe(admin.id);
+            const unimpersonated = await authenticationService.unimpersonate(impersonated.impersonatorRefreshToken, undefined, adminAuditor);
+            expect(unimpersonated.jsonToken.payload.subject).toBe(admin.id);
+            expect(unimpersonated.jsonToken.payload.impersonator).toBeUndefined();
+        });
+    });
+    test('refresh should throw on invalid token', async () => {
+        await runInInjectionContext(injector, async () => {
+            await expect(authenticationService.refresh('invalid', undefined, {}, auditor)).rejects.toThrow();
+        });
+    });
+    test('login should throw on invalid credentials', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'fail@example.com', firstName: 'F', lastName: 'L' });
+            await authenticationService.setCredentials(user, 'Very-Strong-Password-2026!');
+            await expect(authenticationService.login({ tenantId, subject: user.id }, 'wrong', undefined, auditor)).rejects.toThrow();
+        });
+    });
+    test('endSession should handle non-existent session gracefully', async () => {
+        await runInInjectionContext(injector, async () => {
+            await expect(authenticationService.endSession(NIL_UUID, auditor)).resolves.not.toThrow();
+        });
+    });
+    test('resolveSubject should throw if not found', async () => {
+        await runInInjectionContext(injector, async () => {
+            await expect(authenticationService.resolveSubject({ tenantId, subject: 'missing' })).rejects.toThrow();
+        });
+    });
+    test('secret reset flow', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'reset@example.com', firstName: 'R', lastName: 'E' });
+            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+            await authenticationService.initSecretReset({ tenantId, subject: user.id }, undefined, userAuditor);
+            expect(ancillaryService.lastResetData).toBeDefined();
+            await authenticationService.resetSecret(ancillaryService.lastResetData.token, 'New-Password-Reset-2026!', userAuditor);
+            const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-Reset-2026!');
+            expect(authResult.success).toBe(true);
+        });
+    });
+    test('deriveSigningSecrets should work', async () => {
+        // This is mostly covered by initialize, but we can test it implicitly by ensuring service works after init
+        expect(authenticationService).toBeDefined();
+    });
+});

package/authentication/tests/authentication.test-ancillary-service.d.ts

@@ -0,0 +1,9 @@
+import { AuthenticationAncillaryService } from '../server/index.js';
+export declare class DefaultAuthenticationAncillaryService extends AuthenticationAncillaryService<any, any, any> {
+    #private;
+    lastResetData: any;
+    getTokenPayload(): Promise<{}>;
+    handleInitSecretReset(data: any): Promise<void>;
+    canImpersonate(_token: any, _subject: any, _data: any): Promise<boolean>;
+    resolveSubjects(data: any): Promise<import("../index.js").Subject[]>;
+}

package/authentication/tests/authentication.test-ancillary-service.js

@@ -0,0 +1,27 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { inject, Injector, Singleton } from '../../injector/index.js';
+import { isUndefined } from '../../utils/type-guards.js';
+import { AuthenticationAncillaryService, AuthenticationService } from '../server/index.js';
+let DefaultAuthenticationAncillaryService = class DefaultAuthenticationAncillaryService extends AuthenticationAncillaryService {
+    #injector = inject(Injector);
+    #authenticationService;
+    lastResetData;
+    async getTokenPayload() { return {}; }
+    async handleInitSecretReset(data) { this.lastResetData = data; }
+    async canImpersonate(_token, _subject, _data) { return true; }
+    async resolveSubjects(data) {
+        if (isUndefined(this.#authenticationService)) {
+            this.#authenticationService = await this.#injector.resolveAsync(AuthenticationService);
+        }
+        return await this.#authenticationService.defaultResolveSubjects(data);
+    }
+};
+DefaultAuthenticationAncillaryService = __decorate([
+    Singleton()
+], DefaultAuthenticationAncillaryService);
+export { DefaultAuthenticationAncillaryService };

package/authentication/tests/helper.test.d.ts

@@ -0,0 +1 @@
+export {};

package/authentication/tests/helper.test.js

@@ -0,0 +1,107 @@
+import { describe, expect, test } from 'vitest';
+import { BadRequestError } from '../../errors/bad-request.error.js';
+import { InvalidTokenError } from '../../errors/invalid-token.error.js';
+import { currentTimestampSeconds } from '../../utils/date-time.js';
+import { createJwtTokenString } from '../../utils/jwt.js';
+import { getRefreshTokenFromString, getSecretResetTokenFromString, getTokenFromRequest, getTokenFromString, tryGetAuthorizationTokenStringFromRequest, tryGetTokenFromRequest } from '../server/helper.js';
+describe('authentication helper', () => {
+    const secret = 'test-secret';
+    test('tryGetAuthorizationTokenStringFromRequest should extract bearer token from header', () => {
+        const request = {
+            headers: {
+                tryGet: (name) => name == 'Authorization' ? 'Bearer my-token' : undefined,
+            },
+            cookies: {
+                tryGet: () => undefined,
+            },
+        };
+        expect(tryGetAuthorizationTokenStringFromRequest(request)).toBe('my-token');
+    });
+    test('tryGetAuthorizationTokenStringFromRequest should extract bearer token from cookie', () => {
+        const request = {
+            headers: {
+                tryGet: () => undefined,
+            },
+            cookies: {
+                tryGet: (name) => name == 'authorization' ? 'Bearer my-token' : undefined,
+            },
+        };
+        expect(tryGetAuthorizationTokenStringFromRequest(request)).toBe('my-token');
+    });
+    test('tryGetAuthorizationTokenStringFromRequest should throw on unsupported scheme', () => {
+        const request = {
+            headers: {
+                tryGet: (name) => name == 'Authorization' ? 'Basic my-token' : undefined,
+            },
+            cookies: {
+                tryGet: () => undefined,
+            },
+        };
+        expect(() => tryGetAuthorizationTokenStringFromRequest(request)).toThrow(BadRequestError);
+    });
+    test('tryGetAuthorizationTokenStringFromRequest should return undefined if no token found', () => {
+        const request = {
+            headers: {
+                tryGet: () => undefined,
+            },
+            cookies: {
+                tryGet: () => undefined,
+            },
+        };
+        expect(tryGetAuthorizationTokenStringFromRequest(request)).toBeUndefined();
+    });
+    test('getTokenFromString should validate token', async () => {
+        const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', jti: 'j' };
+        const token = await createJwtTokenString({ header: { v: 1, alg: 'HS256', typ: 'JWT' }, payload }, secret);
+        const validated = await getTokenFromString(token, 1, secret);
+        expect(validated.payload).toEqual(payload);
+    });
+    test('getTokenFromString should throw on version mismatch', async () => {
+        const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', jti: 'j' };
+        const token = await createJwtTokenString({ header: { v: 2, alg: 'HS256', typ: 'JWT' }, payload }, secret);
+        await expect(getTokenFromString(token, 1, secret)).rejects.toThrow(InvalidTokenError);
+    });
+    test('getTokenFromString should throw on expired token', async () => {
+        const payload = { exp: currentTimestampSeconds() - 60, tenant: 't', subject: 's', jti: 'j' };
+        const token = await createJwtTokenString({ header: { v: 1, alg: 'HS256', typ: 'JWT' }, payload }, secret);
+        await expect(getTokenFromString(token, 1, secret)).rejects.toThrow('Token expired');
+    });
+    test('getRefreshTokenFromString should validate refresh token', async () => {
+        const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', session: 'sess', secret: 'sec' };
+        const token = await createJwtTokenString({ header: { alg: 'HS256', typ: 'JWT' }, payload }, secret);
+        const validated = await getRefreshTokenFromString(token, secret);
+        expect(validated.payload).toEqual(payload);
+    });
+    test('getSecretResetTokenFromString should validate secret reset token', async () => {
+        const payload = { iat: currentTimestampSeconds(), exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's' };
+        const token = await createJwtTokenString({ header: { alg: 'HS256', typ: 'JWT' }, payload }, secret);
+        const validated = await getSecretResetTokenFromString(token, secret);
+        expect(validated.payload).toEqual(payload);
+    });
+    test('getTokenFromRequest should extract and validate token', async () => {
+        const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', jti: 'j' };
+        const token = await createJwtTokenString({ header: { v: 1, alg: 'HS256', typ: 'JWT' }, payload }, secret);
+        const request = {
+            headers: {
+                tryGet: (name) => name == 'Authorization' ? `Bearer ${token}` : undefined,
+            },
+            cookies: {
+                tryGet: () => undefined,
+            },
+        };
+        const validated = await getTokenFromRequest(request, 1, secret);
+        expect(validated.payload).toEqual(payload);
+    });
+    test('tryGetTokenFromRequest should return undefined if no token in request', async () => {
+        const request = {
+            headers: {
+                tryGet: () => undefined,
+            },
+            cookies: {
+                tryGet: () => undefined,
+            },
+        };
+        const validated = await tryGetTokenFromRequest(request, 1, secret);
+        expect(validated).toBeUndefined();
+    });
+});

package/authentication/tests/secret-requirements.error.test.d.ts

@@ -0,0 +1 @@
+export {};

package/authentication/tests/secret-requirements.error.test.js

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import { SecretRequirementsError } from '../errors/secret-requirements.error.js';
+describe('SecretRequirementsError', () => {
+    it('should create an error with the given message', () => {
+        const message = 'Password is too weak.';
+        const error = new SecretRequirementsError(message);
+        expect(error.message).toBe(message);
+        expect(error.name).toBe('SecretRequirementsError');
+    });
+    it('should have the correct name', () => {
+        const error = new SecretRequirementsError('any message');
+        expect(error.name).toBe('SecretRequirementsError');
+    });
+});

package/authentication/tests/subject.service.test.d.ts

@@ -0,0 +1 @@
+export {};

package/authentication/tests/subject.service.test.js

@@ -0,0 +1,140 @@
+import { beforeAll, beforeEach, describe, expect, test } from 'vitest';
+import { NIL_UUID } from '../../constants.js';
+import { runInInjectionContext } from '../../injector/index.js';
+import { clearTenantData, setupIntegrationTest } from '../../unit-test/index.js';
+import { SubjectStatus } from '../models/index.js';
+import { SubjectService } from '../server/subject.service.js';
+describe('SubjectService', () => {
+    let injector;
+    let database;
+    let subjectService;
+    const schema = 'authentication';
+    const tenantId = crypto.randomUUID();
+    beforeAll(async () => {
+        ({ injector, database } = await setupIntegrationTest({ modules: { authentication: true } }));
+        subjectService = injector.resolve(SubjectService);
+    });
+    beforeEach(async () => {
+        await clearTenantData(database, schema, ['user', 'service_account', 'system_account', 'subject'], tenantId);
+    });
+    test('createUser should create a user', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({
+                tenantId,
+                email: 'test@example.com',
+                firstName: 'John',
+                lastName: 'Doe',
+            });
+            expect(user.id).toBeDefined();
+            expect(user.email).toBe('test@example.com');
+            expect(user.status).toBe(SubjectStatus.Active);
+        });
+    });
+    test('exists should return true if subject exists', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({
+                tenantId,
+                email: 'test@example.com',
+                firstName: 'John',
+                lastName: 'Doe',
+            });
+            expect(await subjectService.exists(tenantId, user.id)).toBe(true);
+            expect(await subjectService.exists(tenantId, NIL_UUID)).toBe(false);
+            const found = await subjectService.hasUserByEmail(tenantId, 'test@example.com');
+            const notFound = await subjectService.hasUserByEmail(tenantId, 'missing@example.com');
+            expect(found).toBe(true);
+            expect(notFound).toBe(false);
+        });
+    });
+    test('deleteUser should soft delete a user', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({
+                tenantId,
+                email: 'test@example.com',
+                firstName: 'John',
+                lastName: 'Doe',
+            });
+            expect(await subjectService.exists(tenantId, user.id)).toBe(true);
+            await subjectService.deleteUser(tenantId, user.id);
+            const deletedUser = await subjectService.getSubject(user.id, { withDeleted: true });
+            expect(deletedUser.metadata.deleteTimestamp).not.toBeNull();
+        });
+    });
+    test('listUsers should list all non-deleted users in a tenant', async () => {
+        await runInInjectionContext(injector, async () => {
+            await subjectService.createUser({
+                tenantId,
+                email: 'user1@example.com',
+                firstName: 'User',
+                lastName: 'One',
+            });
+            const user2 = await subjectService.createUser({
+                tenantId,
+                email: 'user2@example.com',
+                firstName: 'User',
+                lastName: 'Two',
+            });
+            await subjectService.deleteUser(tenantId, user2.id);
+            const users = await subjectService.listUsers(tenantId);
+            expect(users).toHaveLength(1);
+            expect(users[0]?.email).toBe('user1@example.com');
+        });
+    });
+    test('getSystemAccountSubject should create or return system account', async () => {
+        await runInInjectionContext(injector, async () => {
+            const sa1 = await subjectService.getSystemAccount(tenantId, 'test-system');
+            expect(sa1.id).toBeDefined();
+            expect(sa1.identifier).toBe('test-system');
+            const sa2 = await subjectService.getSystemAccount(tenantId, 'test-system');
+            expect(sa2.id).toBe(sa1.id);
+        });
+    });
+    test('updateUser should update user details', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'update@example.com', firstName: 'Old', lastName: 'Name' });
+            await subjectService.updateUser(tenantId, user.id, { firstName: 'New', status: SubjectStatus.Inactive });
+            const updated = await subjectService.getUser(tenantId, user.id);
+            expect(updated.firstName).toBe('New');
+            expect(updated.lastName).toBe('Name');
+            expect(updated.status).toBe(SubjectStatus.Inactive);
+        });
+    });
+    test('updateUserEmail should update user email', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'email@example.com', firstName: 'E', lastName: 'M' });
+            await subjectService.updateUserEmail(tenantId, user.id, 'new-email@example.com');
+            const updated = await subjectService.getUserByEmail(tenantId, 'new-email@example.com');
+            expect(updated.id).toBe(user.id);
+            await expect(subjectService.updateUserEmail(tenantId, user.id, 'invalid-email')).rejects.toThrow();
+        });
+    });
+    test('service accounts should be manageable', async () => {
+        await runInInjectionContext(injector, async () => {
+            const sa = await subjectService.createServiceAccount({ tenantId, displayName: 'SA', description: 'Desc', parent: null });
+            expect(sa.displayName).toBe('SA');
+            await subjectService.updateServiceAccount(tenantId, sa.id, { displayName: 'New SA' });
+            const updated = await subjectService.getServiceAccount(tenantId, sa.id);
+            expect(updated.displayName).toBe('New SA');
+            const saBySubject = await subjectService.getServiceAccountBySubject(updated);
+            expect(saBySubject.id).toBe(sa.id);
+            const list = await subjectService.listServiceAccounts(tenantId);
+            expect(list).toHaveLength(1);
+            await subjectService.deleteServiceAccount(tenantId, sa.id);
+            expect(await subjectService.exists(tenantId, sa.id)).toBe(false);
+        });
+    });
+    test('deleteUser should remove user', async () => {
+        await runInInjectionContext(injector, async () => {
+            const user = await subjectService.createUser({ tenantId, email: 'delete@example.com', firstName: 'D', lastName: 'E' });
+            await subjectService.deleteUser(tenantId, user.id);
+            expect(await subjectService.exists(tenantId, user.id)).toBe(false);
+        });
+    });
+    test('getSystemAccountSubject should load or create system account', async () => {
+        await runInInjectionContext(injector, async () => {
+            const sa1 = await subjectService.getSystemAccount(tenantId, 'sys1');
+            const sa2 = await subjectService.getSystemAccount(tenantId, 'sys1');
+            expect(sa1.id).toBe(sa2.id);
+        });
+    });
+});

package/circuit-breaker/postgres/drizzle/meta/0000_snapshot.json

@@ -1,5 +1,5 @@
 {
-  "id": "cc140886-299f-4337-b208-50a976c703f3",
+  "id": "66eb4473-09a7-4c44-b96a-dec157c4b55c",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "version": "7",
   "dialect": "postgresql",

package/circuit-breaker/postgres/drizzle/meta/_journal.json

@@ -5,8 +5,8 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1767729693157,
-      "tag": "0000_hard_shocker",
+      "when": 1768608040303,
+      "tag": "0000_cooing_korath",
       "breakpoints": true
     }
   ]

package/circuit-breaker/postgres/module.d.ts

@@ -1,6 +1,12 @@
+import { Injector } from '../../injector/index.js';
 import { type DatabaseConfig } from '../../orm/server/index.js';
 export declare class PostgresCircuitBreakerModuleConfig {
     database?: DatabaseConfig;
 }
-export declare function configurePostgresCircuitBreaker(config?: PostgresCircuitBreakerModuleConfig, register?: boolean): void;
+/**
+ * configure circuit breaker module
+ */
+export declare function configurePostgresCircuitBreaker({ injector, ...config }?: PostgresCircuitBreakerModuleConfig & {
+    injector?: Injector;
+}): void;
 export declare function migratePostgresCircuitBreaker(): Promise<void>;

package/circuit-breaker/postgres/module.js

@@ -7,12 +7,14 @@ import { PostgresCircuitBreakerProvider } from './provider.js';
 export class PostgresCircuitBreakerModuleConfig {
     database;
 }
-export function configurePostgresCircuitBreaker(config, register = true) {
-    Injector.register(PostgresCircuitBreakerModuleConfig, { useValue: config });
-    if (register) {
-        Injector.registerSingleton(CircuitBreakerProvider, { useToken: PostgresCircuitBreakerProvider });
-        Injector.registerSingleton(CircuitBreaker, { useToken: PostgresCircuitBreakerService });
-    }
+/**
+ * configure circuit breaker module
+ */
+export function configurePostgresCircuitBreaker({ injector, ...config } = {}) {
+    const targetInjector = injector ?? Injector;
+    targetInjector.register(PostgresCircuitBreakerModuleConfig, { useValue: config });
+    targetInjector.registerSingleton(CircuitBreakerProvider, { useToken: PostgresCircuitBreakerProvider });
+    targetInjector.registerSingleton(CircuitBreaker, { useToken: PostgresCircuitBreakerService });
 }
 export async function migratePostgresCircuitBreaker() {
     const connection = inject(PostgresCircuitBreakerModuleConfig, undefined, { optional: true })?.database?.connection;

package/circuit-breaker/tests/circuit-breaker.test.js

@@ -1,33 +1,13 @@
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { CircuitBreakerState } from '../../circuit-breaker/index.js';
 import { CircuitBreakerProvider } from '../../circuit-breaker/provider.js';
-import { Injector, runInInjectionContext } from '../../injector/index.js';
-import { configureOrm } from '../../orm/server/index.js';
-import * as configParser from '../../utils/config-parser.js';
+import { setupIntegrationTest } from '../../unit-test/index.js';
 import { timeout } from '../../utils/timing.js';
-import { configurePostgresCircuitBreaker, migratePostgresCircuitBreaker } from '../postgres/module.js';
-async function setupIntegrationTest() {
-    const injector = new Injector('TestInjector');
-    const dbConfig = {
-        host: configParser.string('DATABASE_HOST', '127.0.0.1'),
-        port: configParser.positiveInteger('DATABASE_PORT', 5432),
-        user: configParser.string('DATABASE_USER', 'tstdl'),
-        password: configParser.string('DATABASE_PASS', 'wf7rq6glrk5jykne'),
-        database: configParser.string('DATABASE_NAME', 'tstdl'),
-    };
-    configureOrm({
-        repositoryConfig: { schema: 'test' },
-        connection: dbConfig,
-    });
-    configurePostgresCircuitBreaker({ database: { connection: dbConfig } });
-    await runInInjectionContext(injector, migratePostgresCircuitBreaker);
-    return injector;
-}
 describe('Circuit Breaker (Standalone) Tests', () => {
     let injector;
     let provider;
     beforeAll(async () => {
-        injector = await setupIntegrationTest();
+        ({ injector } = (await setupIntegrationTest({ modules: { circuitBreaker: true } })));
         provider = injector.resolve(CircuitBreakerProvider);
     });
     afterAll(async () => {

package/document-management/api/document-management.api.js

@@ -30,12 +30,8 @@ export const documentManagementApiDefinition = defineApi({
             parameters: loadDataParametersSchema,
             result: (DataStream),
             credentials: true,
-            data: {
-                [bustCache]: true,
-            },
-            cors: {
-                accessControlAllowHeaders: `${defaultAccessControlAllowHeaders}, Cache-Control`,
-            },
+            data: { [bustCache]: true },
+            cors: { accessControlAllowHeaders: `${defaultAccessControlAllowHeaders}, Cache-Control` },
         },
         loadDocumentRequestsTemplateData: {
             resource: 'views/document-requests-template-data',