cabloy 5.1.136 → 5.1.138

package/vona/src/suite-vendor/a-vona/modules/a-permission/test/permission.test.ts

@@ -0,0 +1,340 @@
+import type { ICachingActionKeyInfo } from 'vona-module-a-caching';
+import type { IRbacPolicyDecision } from 'vona-module-a-rbac';
+
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+import { beanFullNameFromOnionName } from 'vona';
+import { getRbacDecision, setRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
+
+import { BeanPermission } from '../src/bean/bean.permission.ts';
+
+function createPermission(options: { userId?: string; roleIds?: Array<string | number> }) {
+  const permission = Object.create(BeanPermission.prototype) as BeanPermission;
+  Object.defineProperties(permission, {
+    ctx: {
+      value: {
+        passport: { user: options.userId ? { id: options.userId } : undefined },
+      },
+    },
+    bean: {
+      value: {
+        passport: {
+          currentRoles: (options.roleIds ?? []).map(id => ({ id })),
+        },
+      },
+    },
+  });
+  return permission;
+}
+
+function cacheInfo(...args: unknown[]): ICachingActionKeyInfo {
+  return { args } as ICachingActionKeyInfo;
+}
+
+function createCachePermission(clearedCacheNames: string[]) {
+  const permission = Object.create(BeanPermission.prototype) as BeanPermission;
+  Object.defineProperties(permission, {
+    bean: {
+      value: {
+        summer: {
+          cache(cacheName: string) {
+            return {
+              clear: async () => {
+                clearedCacheNames.push(cacheName);
+              },
+            };
+          },
+        },
+      },
+    },
+  });
+  return permission;
+}
+
+describe('permission.test.ts', { concurrency: false }, () => {
+  it('normalizes role cache keys by role identity', () => {
+    const first = createPermission({
+      userId: 'user-1',
+      roleIds: ['role-b', 'role-a', 'role-a'],
+    });
+    const sameRolesDifferentOrder = createPermission({
+      userId: 'user-2',
+      roleIds: ['role-a', 'role-b'],
+    });
+
+    const info = cacheInfo('training-student:student', 'select');
+    assert.equal(
+      (first as any).retrievePermissionActionByRolesCacheKey(info),
+      'action:training-student:student:select:roles:role-a,role-b',
+    );
+    assert.equal(
+      (first as any).retrievePermissionActionByRolesCacheKey(info),
+      (sameRolesDifferentOrder as any).retrievePermissionActionByRolesCacheKey(info),
+    );
+  });
+
+  it('keeps role and user action cache identities distinct', () => {
+    const permission = createPermission({
+      userId: 'user-1',
+      roleIds: ['role-a'],
+    });
+    const info = cacheInfo('training-student:student', 'select');
+
+    assert.notEqual(
+      (permission as any).retrievePermissionActionByRolesCacheKey(info),
+      (permission as any).retrievePermissionActionByUserCacheKey(info),
+    );
+  });
+
+  it('isolates RBAC action cache keys by user and roles', () => {
+    const first = createPermission({
+      userId: 'user-1',
+      roleIds: ['role-a'],
+    });
+    const otherUser = createPermission({
+      userId: 'user-2',
+      roleIds: ['role-a'],
+    });
+    const changedRoles = createPermission({
+      userId: 'user-1',
+      roleIds: ['role-b'],
+    });
+
+    const info = cacheInfo('training-student:student', 'select');
+    assert.equal(
+      (first as any).retrievePermissionActionByUserCacheKey(info),
+      'action:training-student:student:select:user:user-1:roles:role-a',
+    );
+    assert.notEqual(
+      (first as any).retrievePermissionActionByUserCacheKey(info),
+      (otherUser as any).retrievePermissionActionByUserCacheKey(info),
+    );
+    assert.notEqual(
+      (first as any).retrievePermissionActionByUserCacheKey(info),
+      (changedRoles as any).retrievePermissionActionByUserCacheKey(info),
+    );
+  });
+
+  it('selects the user cache only for RBAC-decorated actions', async () => {
+    const permission = Object.create(BeanPermission.prototype) as BeanPermission;
+    const calls: string[] = [];
+    const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
+    const routes = {
+      ordinary: { route: { meta: {} } },
+      rbac: { route: { meta: { [BeanFullNameGuardRbac]: {} } } },
+    };
+    Object.defineProperties(permission, {
+      _getControllerActionRoute: {
+        value: (_resource: unknown, actionKey: keyof typeof routes) => routes[actionKey],
+      },
+      _matchPassportMeta: { value: () => true },
+      retrievePermissionActionByRoles: {
+        value: async () => {
+          calls.push('roles');
+          return false;
+        },
+      },
+      retrievePermissionActionByUser: {
+        value: async () => {
+          calls.push('user');
+          return true;
+        },
+      },
+      scope: {
+        value: {
+          event: {
+            retrievePermissionAction: {
+              emit: async (_data: unknown, next: () => Promise<unknown>) => await next(),
+            },
+          },
+        },
+      },
+    });
+
+    assert.equal(
+      await permission.retrievePermissionAction('training-student:student', 'ordinary'),
+      false,
+    );
+    assert.equal(
+      await permission.retrievePermissionAction('training-student:student', 'rbac'),
+      true,
+    );
+    assert.deepEqual(calls, ['roles', 'user']);
+  });
+
+  it('isolates resource permission snapshots by user', () => {
+    const first = createPermission({ userId: 'user-1' });
+    const otherUser = createPermission({ userId: 'user-2' });
+    const info = cacheInfo('training-student:student');
+
+    assert.equal(
+      (first as any).retrievePermissionsCacheKey(info),
+      'user:training-student:student:user:user-1',
+    );
+    assert.notEqual(
+      (first as any).retrievePermissionsCacheKey(info),
+      (otherUser as any).retrievePermissionsCacheKey(info),
+    );
+  });
+
+  it('clears the aggregate, role, and user permission cache layers', async () => {
+    const clearedCacheNames: string[] = [];
+    const permission = createCachePermission(clearedCacheNames);
+
+    await permission.clearAllCaches();
+
+    assert.deepEqual(clearedCacheNames, [
+      beanFullNameFromOnionName('a-permission:permissionUser', 'summerCache'),
+      beanFullNameFromOnionName('a-permission:permissionActionByRoles', 'summerCache'),
+      beanFullNameFromOnionName('a-permission:permissionActionByUser', 'summerCache'),
+    ]);
+  });
+
+  it('isolates RBAC decisions when a decorated guard is skipped', async () => {
+    const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
+    const route = {
+      controllerBeanFullName: 'test:controller',
+      action: 'select',
+      route: { meta: { [BeanFullNameGuardRbac]: {} } },
+    } as any;
+    const ctx = { route: { action: 'previous' }, innerAccess: true } as any;
+    const observedDecisions: Array<IRbacPolicyDecision | undefined> = [];
+    const permission = Object.create(BeanPermission.prototype) as BeanPermission;
+    Object.defineProperties(permission, {
+      app: {
+        value: {
+          meta: {},
+          bean: {
+            onion: {
+              guard: {
+                compose: () => async () => true,
+              },
+            },
+          },
+        },
+      },
+      bean: {
+        value: {
+          rbacScope: {
+            current: async () => {
+              observedDecisions.push(getRbacDecision(ctx));
+              const error = new Error('forbidden') as Error & { code: number };
+              error.code = 403;
+              throw error;
+            },
+          },
+        },
+      },
+      ctx: { value: ctx },
+    });
+    const previousDecision = {
+      allowed: true,
+      actionKey: 'previous:controller#select',
+      action: {
+        actionKey: 'previous:controller#select',
+        controllerBeanFullName: 'previous:controller',
+        action: 'select',
+      },
+      terms: [{ dataScope: 'all' }],
+    } as IRbacPolicyDecision;
+
+    assert.equal(await (permission as any)._evaluatePermissionAction(route), false);
+    assert.deepEqual(observedDecisions, [undefined]);
+    assert.equal(Object.hasOwn(ctx, SymbolRbacDecision), false);
+    assert.deepEqual(ctx, { route: { action: 'previous' }, innerAccess: true });
+
+    ctx[SymbolRbacDecision] = undefined;
+    assert.equal(await (permission as any)._evaluatePermissionAction(route), false);
+    assert.deepEqual(observedDecisions, [undefined, undefined]);
+    assert.equal(Object.hasOwn(ctx, SymbolRbacDecision), true);
+    assert.equal(ctx[SymbolRbacDecision], undefined);
+    assert.deepEqual(ctx.route, { action: 'previous' });
+    assert.equal(ctx.innerAccess, true);
+
+    setRbacDecision(ctx, previousDecision);
+    assert.equal(await (permission as any)._evaluatePermissionAction(route), false);
+    assert.deepEqual(observedDecisions, [undefined, undefined, undefined]);
+    assert.equal(getRbacDecision(ctx), previousDecision);
+    assert.equal(Object.hasOwn(ctx, SymbolRbacDecision), true);
+    assert.deepEqual(ctx.route, { action: 'previous' });
+    assert.equal(ctx.innerAccess, true);
+  });
+
+  it('restores RBAC decisions when guard composition throws', async () => {
+    const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
+    const route = {
+      controllerBeanFullName: 'test:controller',
+      action: 'select',
+      route: { meta: { [BeanFullNameGuardRbac]: {} } },
+    } as any;
+    const ctx = { route: { action: 'previous' }, innerAccess: true } as any;
+    const previousDecision = {
+      allowed: true,
+      actionKey: 'previous:controller#select',
+      action: {
+        actionKey: 'previous:controller#select',
+        controllerBeanFullName: 'previous:controller',
+        action: 'select',
+      },
+      terms: [{ dataScope: 'all' }],
+    } as IRbacPolicyDecision;
+    setRbacDecision(ctx, previousDecision);
+    const failure = new Error('guard failure');
+    const permission = Object.create(BeanPermission.prototype) as BeanPermission;
+    Object.defineProperties(permission, {
+      app: {
+        value: {
+          meta: {},
+          bean: {
+            onion: {
+              guard: {
+                compose: () => async () => {
+                  assert.equal(getRbacDecision(ctx), undefined);
+                  throw failure;
+                },
+              },
+            },
+          },
+        },
+      },
+      ctx: { value: ctx },
+    });
+
+    await assert.rejects(() => (permission as any)._evaluatePermissionAction(route), failure);
+    assert.equal(getRbacDecision(ctx), previousDecision);
+    assert.equal(Object.hasOwn(ctx, SymbolRbacDecision), true);
+    assert.deepEqual(ctx.route, { action: 'previous' });
+    assert.equal(ctx.innerAccess, true);
+  });
+
+  it('reduces an RBAC action projection to its final boolean result', async () => {
+    const allowed = createPermission({});
+    const denied = createPermission({});
+    const legacy = createPermission({});
+    Object.defineProperties(allowed, {
+      retrievePermissionAction: {
+        value: async () => ({
+          key: 'test:controller#select',
+          allowed: true,
+          matcher: { mode: 'all' },
+        }),
+      },
+    });
+    Object.defineProperties(denied, {
+      retrievePermissionAction: {
+        value: async () => ({
+          key: 'test:controller#select',
+          allowed: false,
+          matcher: { mode: 'all' },
+        }),
+      },
+    });
+    Object.defineProperties(legacy, {
+      retrievePermissionAction: { value: async () => true },
+    });
+
+    assert.equal(await allowed.checkPermissionAction('training-student:student', 'select'), true);
+    assert.equal(await denied.checkPermissionAction('training-student:student', 'select'), false);
+    assert.equal(await legacy.checkPermissionAction('training-student:student', 'select'), true);
+  });
+});

package/vona/src/suite-vendor/a-vona/modules/a-play/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-play",
-  "version": "5.1.11",
+  "version": "5.1.12",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-play/src/.metadata/index.ts

@@ -6,21 +6,21 @@ export * from '../dto/play.ts';
 import type { IDtoOptionsPlay } from '../dto/play.ts';
 import 'vona-module-a-web';
 declare module 'vona-module-a-web' {
-  
+
     export interface IDtoRecord {
       'a-play:play': IDtoOptionsPlay;
     }
 
-  
+
 }
 declare module 'vona-module-a-play' {
-   
+
 }
 /** dto: end */
 /** dto: begin */
 import type { DtoPlay } from '../dto/play.ts';
 declare module 'vona-module-a-play' {
-  
+
     export interface IDtoOptionsPlay {
       fields?: TypeEntityOptionsFields<DtoPlay, IDtoOptionsPlay[TypeSymbolKeyFieldsMore]>;
     }
@@ -33,16 +33,16 @@ import type { IControllerOptionsMemoryDiag } from '../controller/memoryDiag.ts';
 import type { IControllerOptionsPlay } from '../controller/play.ts';
 import 'vona-module-a-web';
 declare module 'vona-module-a-web' {
-  
+
     export interface IControllerRecord {
       'a-play:memoryDiag': IControllerOptionsMemoryDiag;
 'a-play:play': IControllerOptionsPlay;
     }
 
-  
+
 }
 declare module 'vona-module-a-play' {
-  
+
         export interface ControllerMemoryDiag {
           /** @internal */
           get scope(): ScopeModuleAPlay;
@@ -63,7 +63,7 @@ declare module 'vona-module-a-play' {
             get $beanFullName(): 'a-play.controller.play';
             get $onionName(): 'a-play:play';
             get $onionOptions(): IControllerOptionsPlay;
-          } 
+          }
 }
 /** controller: end */
 /** controller: begin */
@@ -72,7 +72,7 @@ import type { ControllerMemoryDiag } from '../controller/memoryDiag.ts';
 // @ts-ignore ignore
 import type { ControllerPlay } from '../controller/play.ts';
 declare module 'vona-module-a-play' {
-  
+
     export interface IControllerOptionsMemoryDiag {
       actions?: TypeControllerOptionsActions<ControllerMemoryDiag>;
     }
@@ -114,11 +114,11 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     play: ScopeModuleAPlay;
   }
-  
-  
 
-  
 
-  
+
+
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-printtip/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-printtip",
-  "version": "5.1.12",
+  "version": "5.1.13",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-printtip/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../bean/hmr.metaPrintTip.ts';
 
 import 'vona';
 declare module 'vona' {
-  
+
     export interface IHmrRecord {
       'a-printtip:metaPrintTip': never;
     }
 
-  
+
 }
 declare module 'vona-module-a-printtip' {
-  
+
         export interface HmrMetaPrintTip {
           /** @internal */
           get scope(): ScopeModuleAPrinttip;
@@ -21,8 +21,7 @@ declare module 'vona-module-a-printtip' {
           export interface HmrMetaPrintTip {
             get $beanFullName(): 'a-printtip.hmr.metaPrintTip';
             get $onionName(): 'a-printtip:metaPrintTip';
-            
-          } 
+          }
 }
 /** hmr: end */
 /** startup: begin */
@@ -30,15 +29,15 @@ export * from '../bean/startup.printTip.ts';
 
 import { type IDecoratorStartupOptions } from 'vona-module-a-startup';
 declare module 'vona-module-a-startup' {
-  
+
     export interface IStartupRecord {
       'a-printtip:printTip': IDecoratorStartupOptions;
     }
 
-  
+
 }
 declare module 'vona-module-a-printtip' {
-  
+
         export interface StartupPrintTip {
           /** @internal */
           get scope(): ScopeModuleAPrinttip;
@@ -48,7 +47,7 @@ declare module 'vona-module-a-printtip' {
             get $beanFullName(): 'a-printtip.startup.printTip';
             get $onionName(): 'a-printtip:printTip';
             get $onionOptions(): IDecoratorStartupOptions;
-          } 
+          }
 }
 /** startup: end */
 /** config: begin */
@@ -76,13 +75,13 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     printtip: ScopeModuleAPrinttip;
   }
-  
+
   export interface IBeanScopeConfig {
     'a-printtip': ReturnType<typeof config>;
   }
 
-  
 
-  
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-queue/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-queue",
-  "version": "5.1.14",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-queue/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../service/queue.ts';
 
 import 'vona-module-a-bean';
 declare module 'vona-module-a-bean' {
-  
+
     export interface IServiceRecord {
       'a-queue:queue': never;
     }
 
-  
+
 }
 declare module 'vona-module-a-queue' {
-  
+
         export interface ServiceQueue {
           /** @internal */
           get scope(): ScopeModuleAQueue;
@@ -21,8 +21,7 @@ declare module 'vona-module-a-queue' {
           export interface ServiceQueue {
             get $beanFullName(): 'a-queue.service.queue';
             get $onionName(): 'a-queue:queue';
-            
-          } 
+          }
 }
 /** service: end */
 /** service: begin */
@@ -45,15 +44,15 @@ export * from '../bean/hmr.queue.ts';
 
 import 'vona';
 declare module 'vona' {
-  
+
     export interface IHmrRecord {
       'a-queue:queue': never;
     }
 
-  
+
 }
 declare module 'vona-module-a-queue' {
-  
+
         export interface HmrQueue {
           /** @internal */
           get scope(): ScopeModuleAQueue;
@@ -62,8 +61,7 @@ declare module 'vona-module-a-queue' {
           export interface HmrQueue {
             get $beanFullName(): 'a-queue.hmr.queue';
             get $onionName(): 'a-queue:queue';
-            
-          } 
+          }
 }
 /** hmr: end */
 /** startup: begin */
@@ -71,15 +69,15 @@ export * from '../bean/startup.loadQueueWorkers.ts';
 
 import { type IDecoratorStartupOptions } from 'vona-module-a-startup';
 declare module 'vona-module-a-startup' {
-  
+
     export interface IStartupRecord {
       'a-queue:loadQueueWorkers': IDecoratorStartupOptions;
     }
 
-  
+
 }
 declare module 'vona-module-a-queue' {
-  
+
         export interface StartupLoadQueueWorkers {
           /** @internal */
           get scope(): ScopeModuleAQueue;
@@ -89,7 +87,7 @@ declare module 'vona-module-a-queue' {
             get $beanFullName(): 'a-queue.startup.loadQueueWorkers';
             get $onionName(): 'a-queue:loadQueueWorkers';
             get $onionOptions(): IDecoratorStartupOptions;
-          } 
+          }
 }
 /** startup: end */
 /** config: begin */
@@ -121,13 +119,13 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     queue: ScopeModuleAQueue;
   }
-  
+
   export interface IBeanScopeConfig {
     'a-queue': ReturnType<typeof config>;
   }
 
-  
 
-  
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ratelimit",
-  "version": "5.1.1",
+  "version": "5.1.2",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/src/.metadata/index.ts

@@ -47,7 +47,6 @@ declare module 'vona-module-a-ratelimit' {
           export interface ServiceRateLimit {
             get $beanFullName(): 'a-ratelimit.service.rateLimit';
             get $onionName(): 'a-ratelimit:rateLimit';
-
           }
 }
 /** service: end */

package/vona/src/suite-vendor/a-vona/modules/a-redis/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-redis",
-  "version": "5.1.14",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [