cabloy 5.1.116 → 5.1.118

package/vona/src/suite/a-commerce/modules/commerce-member/src/dto/addressMineUpdate.tsx

@@ -0,0 +1,10 @@
+import type { IDecoratorDtoOptions } from 'vona-module-a-web';
+
+import { Dto } from 'vona-module-a-web';
+
+import { DtoAddressMineCreate } from './addressMineCreate.tsx';
+
+export interface IDtoOptionsAddressMineUpdate extends IDecoratorDtoOptions {}
+
+@Dto<IDtoOptionsAddressMineUpdate>()
+export class DtoAddressMineUpdate extends DtoAddressMineCreate {}

package/vona/src/suite/a-commerce/modules/commerce-member/src/dto/addressMineView.tsx

@@ -0,0 +1,10 @@
+import type { IDecoratorDtoOptions } from 'vona-module-a-web';
+
+import { Dto } from 'vona-module-a-web';
+
+import { DtoAddressMineItem } from './addressMineItem.tsx';
+
+export interface IDtoOptionsAddressMineView extends IDecoratorDtoOptions {}
+
+@Dto<IDtoOptionsAddressMineView>()
+export class DtoAddressMineView extends DtoAddressMineItem {}

package/vona/src/suite/a-commerce/modules/commerce-member/src/dto/addressSelectResItem.tsx

@@ -15,9 +15,6 @@ export interface IDtoOptionsAddressSelectResItem extends IDecoratorDtoOptions {}
     ZovaRender.block('basic-page:blockPage', {
       blocks: [
         ZovaRender.block('basic-page:blockFilter'),
-        ZovaRender.block('basic-page:blockToolbarBulk', {
-          actions: [ZovaRender.tableActionBulk('basic-table:actionCreate')],
-        }),
         ZovaRender.block('basic-page:blockTable'),
         ZovaRender.block('basic-page:blockPager'),
       ],
@@ -43,10 +40,7 @@ export class DtoAddressSelectResItem extends $Dto.get(() => ModelAddress, {
     v.title($locale('Operations')),
     ZovaRender.order(1, 'max'),
     ZovaRender.cell('basic-table:actionOperationsRow', {
-      actions: [
-        ZovaRender.tableActionRow('basic-table:actionUpdate'),
-        ZovaRender.tableActionRow('basic-table:actionDelete'),
-      ],
+      actions: [ZovaRender.tableActionRow('basic-table:actionView')],
     }),
   )
   _operationsRow?: unknown;

package/vona/src/suite/a-commerce/modules/commerce-member/src/service/address.ts

@@ -1,57 +1,72 @@
 import type { TableIdentity } from 'table-identity';
-import type { IQueryParams } from 'vona-module-a-orm';
+import type { IQueryParams, TypeModelColumns } from 'vona-module-a-orm';
 
 import { BeanBase } from 'vona';
 import { Service } from 'vona-module-a-bean';
 
-import type { DtoAddressCreate } from '../dto/addressCreate.tsx';
+import type { DtoAddressMineCreate } from '../dto/addressMineCreate.tsx';
+import type { DtoAddressMineRes } from '../dto/addressMineRes.tsx';
+import type { DtoAddressMineUpdate } from '../dto/addressMineUpdate.tsx';
+import type { DtoAddressMineView } from '../dto/addressMineView.tsx';
 import type { DtoAddressSelectRes } from '../dto/addressSelectRes.tsx';
-import type { DtoAddressUpdate } from '../dto/addressUpdate.tsx';
 import type { DtoAddressView } from '../dto/addressView.tsx';
+import type { EntityAddress } from '../entity/address.tsx';
 import type { ModelAddress } from '../model/address.ts';
 
+const addressColumns: TypeModelColumns<EntityAddress> = [
+  'id',
+  'recipientName',
+  'phone',
+  'countryCode',
+  'region',
+  'city',
+  'postalCode',
+  'addressLine1',
+  'addressLine2',
+  'createdAt',
+  'updatedAt',
+];
+
 @Service()
 export class ServiceAddress extends BeanBase {
-  async create(address: DtoAddressCreate) {
-    return await this.scope.model.address.insert({
-      ...address,
-      userId: this._getCurrentUserId(),
+  async select(params?: IQueryParams<ModelAddress>): Promise<DtoAddressSelectRes> {
+    return await this.scope.model.address.selectAndCount({
+      ...params,
+      orders: params?.orders ?? [['id', 'asc']],
     });
   }
 
-  async select(params?: IQueryParams<ModelAddress>): Promise<DtoAddressSelectRes> {
+  async view(id: TableIdentity): Promise<DtoAddressView | undefined> {
+    return await this.scope.model.address.getById(id);
+  }
+
+  async mine(params?: IQueryParams<ModelAddress>): Promise<DtoAddressMineRes> {
     return await this.scope.model.address.selectAndCount({
-      columns: [
-        'id',
-        'recipientName',
-        'phone',
-        'countryCode',
-        'region',
-        'city',
-        'postalCode',
-        'addressLine1',
-        'addressLine2',
-        'createdAt',
-        'updatedAt',
-      ],
+      ...params,
+      columns: addressColumns,
       where: { ...params?.where, userId: this._getCurrentUserId() },
-      orders: [['id', 'asc']],
-      limit: params?.limit ?? 20,
-      offset: params?.offset ?? 0,
+      orders: params?.orders ?? [['id', 'asc']],
     });
   }
 
-  async view(id: TableIdentity): Promise<DtoAddressView | undefined> {
+  async viewMine(id: TableIdentity): Promise<DtoAddressMineView | undefined> {
     return await this._getOwnedAddress(id);
   }
 
-  async update(id: TableIdentity, address: DtoAddressUpdate) {
+  async createMine(address: DtoAddressMineCreate) {
+    return await this.scope.model.address.insert({
+      ...address,
+      userId: this._getCurrentUserId(),
+    });
+  }
+
+  async updateMine(id: TableIdentity, address: DtoAddressMineUpdate) {
     const ownedAddress = await this._getOwnedAddress(id);
     if (!ownedAddress) return;
     await this.scope.model.address.updateById(ownedAddress.id, address);
   }
 
-  async delete(id: TableIdentity) {
+  async deleteMine(id: TableIdentity) {
     const ownedAddress = await this._getOwnedAddress(id);
     if (!ownedAddress) return;
     await this.scope.model.address.deleteById(ownedAddress.id);
@@ -64,21 +79,7 @@ export class ServiceAddress extends BeanBase {
   private async _getOwnedAddress(id: TableIdentity) {
     return await this.scope.model.address.get(
       { id, userId: this._getCurrentUserId() },
-      {
-        columns: [
-          'id',
-          'recipientName',
-          'phone',
-          'countryCode',
-          'region',
-          'city',
-          'postalCode',
-          'addressLine1',
-          'addressLine2',
-          'createdAt',
-          'updatedAt',
-        ],
-      },
+      { columns: addressColumns },
     );
   }
 }

package/vona/src/suite/a-commerce/modules/commerce-member/test/addressOwnership.test.ts

@@ -1,6 +1,6 @@
 import type {
-  DtoAddressCreate,
-  DtoAddressUpdate,
+  DtoAddressMineCreate,
+  DtoAddressMineUpdate,
   EntityAddress,
 } from 'vona-module-commerce-member';
 
@@ -11,12 +11,17 @@ import { describe, it } from 'node:test';
 import { app } from 'vona-mock';
 
 const actionPath = '/commerce/member/address';
+const minePath = `${actionPath}/mine`;
+const viewMinePath = `${actionPath}/viewMine/:id`;
+const createMinePath = `${actionPath}/createMine`;
+const updateMinePath = `${actionPath}/updateMine/:id`;
+const deleteMinePath = `${actionPath}/deleteMine/:id`;
 
 function createTestId() {
   return randomUUID().slice(0, 12);
 }
 
-function createAddress(suffix: string): DtoAddressCreate {
+function createAddress(suffix: string): DtoAddressMineCreate {
   return {
     recipientName: `Recipient ${suffix}`,
     phone: '15555550123',
@@ -45,15 +50,23 @@ async function registerAndSignin(name: string) {
   return { token: token.accessToken, user: app.bean.passport.currentUser! };
 }
 
-describe('address.test.ts', () => {
-  it('denies anonymous address actions', async () => {
+async function deleteOwnedAddresses(ids: Array<number | string | undefined>) {
+  for (const id of ids) {
+    if (id !== undefined) await app.scope('commerce-member').model.address.deleteById(id);
+  }
+}
+
+describe('addressOwnership.test.ts', () => {
+  it('denies anonymous Admin and Web Address actions', async () => {
     await app.bean.executor.mockCtx(async () => {
       for (const [method, path, options] of [
-        ['post', actionPath, { body: createAddress('anonymous') }],
         ['get', actionPath, {}],
         ['get', `${actionPath}/:id`, { params: { id: 999999 } }],
-        ['patch', `${actionPath}/:id`, { params: { id: 999999 }, body: {} }],
-        ['delete', `${actionPath}/:id`, { params: { id: 999999 } }],
+        ['get', minePath, {}],
+        ['get', viewMinePath, { params: { id: 999999 } }],
+        ['post', createMinePath, { body: createAddress('anonymous') }],
+        ['patch', updateMinePath, { params: { id: 999999 }, body: createAddress('anonymous') }],
+        ['delete', deleteMinePath, { params: { id: 999999 } }],
       ] as const) {
         const [_, err] = await catchError(() =>
           app.bean.executor.performAction(method, path, { ...options, innerAccess: false }),
@@ -63,149 +76,174 @@ describe('address.test.ts', () => {
     });
   });
 
-  it('derives ownership from the authenticated customer and scopes every action', async () => {
-    await app.bean.executor.mockCtx(async () => {
-      const suffix = createTestId();
-      const customerA = await registerAndSignin(`address-a-${suffix}`);
-      const customerB = await registerAndSignin(`address-b-${suffix}`);
-      const addressData = createAddress(suffix);
-      const addressId = await performAs(customerA.token, 'post', actionPath, {
-        body: { ...addressData, userId: customerB.user.id, iid: 999999 } as any,
-      });
-
-      const persisted = await app.scope('commerce-member').model.address.getById(addressId);
-      assert.equal(String(persisted?.userId), String(customerA.user.id));
-      assert.equal(persisted?.iid, app.ctx.instance.id);
-
-      const ownList = await performAs(customerA.token, 'get', actionPath);
-      assert.equal(
-        ownList.list.some(item => String(item.id) === String(addressId)),
-        true,
-      );
-      assert.equal(
-        ownList.list.every(item => !Object.hasOwn(item, 'userId')),
-        true,
-      );
-      assert.equal(
-        ownList.list.every(item => !Object.hasOwn(item, 'iid')),
-        true,
-      );
-
-      const { addressLine2: _, ...update } = {
-        ...addressData,
-        city: 'Oakland',
-      } satisfies DtoAddressUpdate;
-      assert.equal(
-        await performAs(customerA.token, 'patch', `${actionPath}/:id`, {
-          params: { id: addressId },
-          body: update,
-        }),
-        null,
-      );
-      const ownAddress: EntityAddress = await performAs(
-        customerA.token,
-        'get',
-        `${actionPath}/:id`,
-        {
-          params: { id: addressId },
-        },
-      );
-      assert.equal(ownAddress.city, update.city);
-      assert.equal(ownAddress.addressLine2, addressData.addressLine2);
-      assert.equal(Object.hasOwn(ownAddress, 'userId'), false);
-      assert.equal(Object.hasOwn(ownAddress, 'iid'), false);
-
-      const foreignList = await performAs(customerB.token, 'get', actionPath);
-      assert.equal(
-        foreignList.list.some(item => String(item.id) === String(addressId)),
-        false,
-      );
-      assert.equal(
-        await performAs(customerB.token, 'get', `${actionPath}/:id`, { params: { id: addressId } }),
-        undefined,
-      );
-      assert.equal(
-        await performAs(customerB.token, 'patch', `${actionPath}/:id`, {
-          params: { id: addressId },
-          body: { ...addressData, city: 'Los Angeles' },
-        }),
-        null,
-      );
-      assert.equal(
-        await performAs(customerB.token, 'delete', `${actionPath}/:id`, {
-          params: { id: addressId },
-        }),
-        null,
-      );
-      assert.equal(
-        (await app.scope('commerce-member').model.address.getById(addressId))?.city,
-        'Oakland',
-      );
-
-      assert.equal(
-        await performAs(customerA.token, 'delete', `${actionPath}/:id`, {
-          params: { id: addressId },
-        }),
-        null,
-      );
-      assert.equal(
-        await performAs(customerA.token, 'get', `${actionPath}/:id`, { params: { id: addressId } }),
-        undefined,
-      );
-    });
-  });
-
-  it('treats another instance address as absent', async () => {
-    let addressId!: number;
-    let customerDefault!: Awaited<ReturnType<typeof registerAndSignin>>;
-    const addressDefault = createAddress('default');
+  it('derives Web ownership from Passport and treats foreign rows as absent', async () => {
     await app.bean.executor.mockCtx(async () => {
-      customerDefault = await registerAndSignin(`address-default-${Date.now()}`);
-      addressId = await performAs(customerDefault.token, 'post', actionPath, {
-        body: addressDefault,
-      });
-    });
+      let addressId: number | undefined;
+      try {
+        const suffix = createTestId();
+        const customerA = await registerAndSignin(`address-a-${suffix}`);
+        const customerB = await registerAndSignin(`address-b-${suffix}`);
+        const addressData = createAddress(suffix);
+        addressId = await performAs(customerA.token, 'post', createMinePath, {
+          body: { ...addressData, userId: customerB.user.id, iid: 999999 } as any,
+        });
+
+        const persisted = await app.scope('commerce-member').model.address.getById(addressId);
+        assert.equal(String(persisted?.userId), String(customerA.user.id));
+        assert.equal(persisted?.iid, app.ctx.instance.id);
+
+        const ownList = await performAs(customerA.token, 'get', minePath);
+        assert.equal(
+          ownList.list.some(item => String(item.id) === String(addressId)),
+          true,
+        );
+        assert.equal(
+          ownList.list.every(item => !Object.hasOwn(item, 'userId')),
+          true,
+        );
+        assert.equal(
+          ownList.list.every(item => !Object.hasOwn(item, 'iid')),
+          true,
+        );
 
-    await app.bean.executor.mockCtx(
-      async () => {
-        const customer = await registerAndSignin(`address-share-${Date.now()}`);
+        const { addressLine2: _, ...update } = {
+          ...addressData,
+          city: 'Oakland',
+        } satisfies DtoAddressMineUpdate;
         assert.equal(
-          await performAs(customer.token, 'get', `${actionPath}/:id`, {
+          await performAs(customerA.token, 'patch', updateMinePath, {
             params: { id: addressId },
+            body: update,
           }),
-          undefined,
+          null,
         );
-        const list = await performAs(customer.token, 'get', actionPath);
+        const ownAddress: EntityAddress = await performAs(customerA.token, 'get', viewMinePath, {
+          params: { id: addressId },
+        });
+        assert.equal(ownAddress.city, update.city);
+        assert.equal(ownAddress.addressLine2, addressData.addressLine2);
+        assert.equal(Object.hasOwn(ownAddress, 'userId'), false);
+        assert.equal(Object.hasOwn(ownAddress, 'iid'), false);
+
+        const foreignList = await performAs(customerB.token, 'get', minePath);
         assert.equal(
-          list.list.some(item => String(item.id) === String(addressId)),
+          foreignList.list.some(item => String(item.id) === String(addressId)),
           false,
         );
         assert.equal(
-          await performAs(customer.token, 'patch', `${actionPath}/:id`, {
+          await performAs(customerB.token, 'get', viewMinePath, { params: { id: addressId } }),
+          undefined,
+        );
+        assert.equal(
+          await performAs(customerB.token, 'patch', updateMinePath, {
             params: { id: addressId },
-            body: { ...createAddress('foreign'), city: 'Other city' },
+            body: { ...addressData, city: 'Los Angeles' },
           }),
           null,
         );
         assert.equal(
-          await performAs(customer.token, 'delete', `${actionPath}/:id`, {
-            params: { id: addressId },
-          }),
+          await performAs(customerB.token, 'delete', deleteMinePath, { params: { id: addressId } }),
           null,
         );
         assert.equal(
-          await app.scope('commerce-member').model.address.getById(addressId),
-          undefined,
+          (await app.scope('commerce-member').model.address.getById(addressId))?.city,
+          'Oakland',
         );
-      },
-      { instanceName: 'shareTest' as any },
-    );
+      } finally {
+        await deleteOwnedAddresses([addressId]);
+      }
+    });
+  });
 
+  it('exposes active-instance Address inspection only to systemAdmin', async () => {
     await app.bean.executor.mockCtx(async () => {
-      const address = await performAs(customerDefault.token, 'get', `${actionPath}/:id`, {
-        params: { id: addressId },
-      });
-      assert.equal(address.city, addressDefault.city);
+      let addressId: number | undefined;
+      try {
+        const suffix = createTestId();
+        const customer = await registerAndSignin(`address-admin-${suffix}`);
+        addressId = await performAs(customer.token, 'post', createMinePath, {
+          body: createAddress(suffix),
+        });
+
+        const [_, nonAdminError] = await catchError(() =>
+          performAs(customer.token, 'get', actionPath),
+        );
+        assert.equal(nonAdminError?.code, 403);
+
+        const admin = await app.bean.passport.signinMock();
+        const list = await performAs(admin.accessToken, 'get', actionPath);
+        assert.equal(
+          list.list.some(item => String(item.id) === String(addressId)),
+          true,
+        );
+        const address = await performAs(admin.accessToken, 'get', `${actionPath}/:id`, {
+          params: { id: addressId },
+        });
+        assert.equal(address?.id, addressId);
+
+        const permissions = await Promise.all(
+          ['create', 'update', 'delete'].map(action =>
+            app.bean.permission.retrievePermissionAction('commerce-member:address', action),
+          ),
+        );
+        assert.deepEqual(permissions, [false, false, false]);
+      } finally {
+        await deleteOwnedAddresses([addressId]);
+      }
     });
   });
+
+  it('treats another instance Address as absent on Web actions', async () => {
+    let addressId: number | undefined;
+    let customerDefault!: Awaited<ReturnType<typeof registerAndSignin>>;
+    const addressDefault = createAddress('default');
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        customerDefault = await registerAndSignin(`address-default-${createTestId()}`);
+        addressId = await performAs(customerDefault.token, 'post', createMinePath, {
+          body: addressDefault,
+        });
+      });
+
+      await app.bean.executor.mockCtx(
+        async () => {
+          const customer = await registerAndSignin(`address-share-${createTestId()}`);
+          assert.equal(
+            await performAs(customer.token, 'get', viewMinePath, { params: { id: addressId } }),
+            undefined,
+          );
+          const list = await performAs(customer.token, 'get', minePath);
+          assert.equal(
+            list.list.some(item => String(item.id) === String(addressId)),
+            false,
+          );
+          assert.equal(
+            await performAs(customer.token, 'patch', updateMinePath, {
+              params: { id: addressId },
+              body: { ...createAddress('foreign'), city: 'Other city' },
+            }),
+            null,
+          );
+          assert.equal(
+            await performAs(customer.token, 'delete', deleteMinePath, {
+              params: { id: addressId },
+            }),
+            null,
+          );
+        },
+        { instanceName: 'shareTest' as any },
+      );
+
+      await app.bean.executor.mockCtx(async () => {
+        const address = await performAs(customerDefault.token, 'get', viewMinePath, {
+          params: { id: addressId },
+        });
+        assert.equal(address.city, addressDefault.city);
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => {
+        await deleteOwnedAddresses([addressId]);
+      });
+    }
+  });
 });