create-astram-app 0.11.0 → 0.12.0

package/template/frontend/src/pages/security/securityPolicies.test.mjs

@@ -0,0 +1,429 @@
+// securityPolicies.test.mjs — auth capabilities R2.1, R2.2, R2.6, R2.9, R11.4, R13.4, AC-26: the
+// Security settings page lists, creates, edits and deletes mandatory-2FA policies. Actions are
+// hidden by permission (UX only) and server refusals are still shown. Every id on a policy
+// (company, role, author) is resolved to a name, with a fallback label; a uuid is never shown.
+//
+//   node --test src/pages/security/securityPolicies.test.mjs
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  SECURITY_POLICY_PERMISSIONS,
+  KIND_OPTIONS,
+  MAX_GRACE_DAYS,
+  PLATFORM_SCOPE,
+  isPermissionTarget,
+  policyFormFromRow,
+  validatePolicyForm,
+  policyActions,
+  hasPlatformRow,
+  showFloorNote,
+  collectLabelIds,
+  resolvePolicyLabels,
+  describePolicy,
+  policyFailureText,
+} from './securityPolicies.js';
+
+const COMPANY = '11111111-1111-4111-8111-111111111111';
+const ROLE = '22222222-2222-4222-8222-222222222222';
+const USER = '33333333-3333-4333-8333-333333333333';
+const GONE = '44444444-4444-4444-8444-444444444444';
+
+const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+
+describe('constants', () => {
+  test('the four permission keys', () => {
+    assert.deepEqual(SECURITY_POLICY_PERMISSIONS, {
+      read: 'identity:security_policy:read',
+      create: 'identity:security_policy:create',
+      update: 'identity:security_policy:update',
+      delete: 'identity:security_policy:delete',
+    });
+  });
+
+  test('the three kinds with plain labels', () => {
+    assert.deepEqual(KIND_OPTIONS, [
+      { value: 'tenant', label: 'Everyone in this organisation' },
+      { value: 'role', label: 'Holders of a role' },
+      { value: 'permission', label: 'Holders of a permission' },
+    ]);
+    assert.equal(MAX_GRACE_DAYS, 14);
+  });
+});
+
+describe('isPermissionTarget (mirror of core isSecurityPolicyPermissionTarget)', () => {
+  test('keys and grant wildcards', () => {
+    for (const ok of [
+      'identity:user:update',
+      'identity:*',
+      'identity:user:*',
+      'identity',
+      'crm_x:deal_1:approve',
+    ]) {
+      assert.equal(isPermissionTarget(ok), true, ok);
+    }
+  });
+
+  test('anything else', () => {
+    for (const bad of [
+      '*',
+      'Identity:user:read',
+      'identity:',
+      'identity:*:read',
+      'a:b:c:d',
+      '1x:y:z',
+      'identity:user',
+      ' identity:*',
+      '',
+      undefined,
+      `a:b:${'c'.repeat(260)}`,
+    ]) {
+      assert.equal(isPermissionTarget(bad), false, String(bad));
+    }
+  });
+});
+
+describe('validatePolicyForm — create', () => {
+  const base = { scope: COMPANY, kind: 'tenant', role: null, permission: '', graceDays: '0' };
+
+  test('an organisation-wide policy for a chosen company', () => {
+    assert.deepEqual(validatePolicyForm(base, { isEdit: false }), {
+      ok: true,
+      body: { scopeNodeUuid: COMPANY, targetKind: 'tenant', graceDays: 0 },
+    });
+  });
+
+  test('the platform minimum sends platform:true and no company', () => {
+    assert.deepEqual(
+      validatePolicyForm({ ...base, scope: PLATFORM_SCOPE, graceDays: '3' }, { isEdit: false }),
+      {
+        ok: true,
+        body: { platform: true, targetKind: 'tenant', graceDays: 3 },
+      },
+    );
+  });
+
+  test('a role policy needs a role', () => {
+    assert.deepEqual(validatePolicyForm({ ...base, kind: 'role' }, { isEdit: false }), {
+      ok: false,
+      error: 'Choose a role.',
+    });
+    assert.deepEqual(validatePolicyForm({ ...base, kind: 'role', role: ROLE }, { isEdit: false }), {
+      ok: true,
+      body: { scopeNodeUuid: COMPANY, targetKind: 'role', targetValue: ROLE, graceDays: 0 },
+    });
+  });
+
+  test('a permission policy needs a well-formed key (trimmed)', () => {
+    const bad = validatePolicyForm(
+      { ...base, kind: 'permission', permission: 'Identity:*' },
+      { isEdit: false },
+    );
+    assert.equal(bad.ok, false);
+    assert.match(bad.error, /identity:user:update/);
+    assert.deepEqual(
+      validatePolicyForm(
+        { ...base, kind: 'permission', permission: ' identity:* ' },
+        { isEdit: false },
+      ),
+      {
+        ok: true,
+        body: {
+          scopeNodeUuid: COMPANY,
+          targetKind: 'permission',
+          targetValue: 'identity:*',
+          graceDays: 0,
+        },
+      },
+    );
+  });
+
+  test('a scope is required', () => {
+    assert.deepEqual(validatePolicyForm({ ...base, scope: null }, { isEdit: false }), {
+      ok: false,
+      error: 'Choose an organisation.',
+    });
+  });
+
+  test('grace days: whole number 0–14', () => {
+    for (const g of ['-1', '15', '1.5', 'abc', '']) {
+      assert.deepEqual(validatePolicyForm({ ...base, graceDays: g }, { isEdit: false }), {
+        ok: false,
+        error: 'Grace period must be a whole number of days from 0 to 14.',
+      });
+    }
+    assert.equal(
+      validatePolicyForm({ ...base, graceDays: ' 14 ' }, { isEdit: false }).body.graceDays,
+      14,
+    );
+  });
+
+  test('an unknown kind is refused', () => {
+    assert.equal(validatePolicyForm({ ...base, kind: 'everyone' }, { isEdit: false }).ok, false);
+  });
+});
+
+describe('validatePolicyForm — edit', () => {
+  test('only target value and grace are sent', () => {
+    assert.deepEqual(
+      validatePolicyForm(
+        { scope: COMPANY, kind: 'role', role: ROLE, permission: '', graceDays: '7' },
+        { isEdit: true },
+      ),
+      { ok: true, body: { targetValue: ROLE, graceDays: 7 } },
+    );
+    assert.deepEqual(
+      validatePolicyForm(
+        { scope: PLATFORM_SCOPE, kind: 'tenant', role: null, permission: '', graceDays: '2' },
+        { isEdit: true },
+      ),
+      { ok: true, body: { graceDays: 2 } },
+    );
+  });
+});
+
+describe('policyFormFromRow', () => {
+  test('a stored policy pre-fills the form', () => {
+    assert.deepEqual(
+      policyFormFromRow({
+        id: 'p1',
+        fields: {
+          scopeNodeUuid: COMPANY,
+          platform: false,
+          targetKind: 'permission',
+          targetValue: 'identity:*',
+          graceDays: 5,
+        },
+      }),
+      { scope: COMPANY, kind: 'permission', role: null, permission: 'identity:*', graceDays: '5' },
+    );
+    assert.deepEqual(
+      policyFormFromRow({
+        id: 'p2',
+        fields: {
+          scopeNodeUuid: null,
+          platform: true,
+          targetKind: 'role',
+          targetValue: ROLE,
+          graceDays: 0,
+        },
+      }),
+      { scope: PLATFORM_SCOPE, kind: 'role', role: ROLE, permission: '', graceDays: '0' },
+    );
+  });
+});
+
+describe('policyActions (UX gate)', () => {
+  test('add / edit / delete each follow their own permission', () => {
+    const only =
+      (...keys) =>
+      (k) =>
+        keys.includes(k);
+    assert.deepEqual(policyActions(only()), { add: false, edit: false, remove: false });
+    assert.deepEqual(policyActions(only('identity:security_policy:create')), {
+      add: true,
+      edit: false,
+      remove: false,
+    });
+    assert.deepEqual(
+      policyActions(only('identity:security_policy:update', 'identity:security_policy:delete')),
+      {
+        add: false,
+        edit: true,
+        remove: true,
+      },
+    );
+  });
+});
+
+describe('platform floor rows', () => {
+  const tenantRow = {
+    id: 'p1',
+    fields: { scopeNodeUuid: COMPANY, platform: false, targetKind: 'tenant' },
+  };
+  const floorRow = {
+    id: 'p2',
+    fields: { scopeNodeUuid: null, platform: true, targetKind: 'tenant' },
+  };
+
+  test('a listed floor row proves the caller is root (the server shows floors to root only)', () => {
+    assert.equal(hasPlatformRow([tenantRow, floorRow]), true);
+    assert.equal(hasPlatformRow([tenantRow]), false);
+    assert.equal(hasPlatformRow(undefined), false);
+  });
+
+  test('the "platform minimum may also apply" note shows unless floor rows are visible', () => {
+    assert.equal(showFloorNote([tenantRow]), true);
+    assert.equal(showFloorNote([]), true);
+    assert.equal(showFloorNote([floorRow]), false);
+  });
+});
+
+describe('id resolution', () => {
+  const rows = [
+    {
+      id: 'p1',
+      fields: {
+        scopeNodeUuid: COMPANY,
+        platform: false,
+        targetKind: 'role',
+        targetValue: ROLE,
+        createdBy: USER,
+        graceDays: 0,
+      },
+    },
+    {
+      id: 'p2',
+      fields: {
+        scopeNodeUuid: GONE,
+        platform: false,
+        targetKind: 'role',
+        targetValue: GONE,
+        createdBy: GONE,
+        graceDays: 1,
+      },
+    },
+    {
+      id: 'p3',
+      fields: {
+        scopeNodeUuid: null,
+        platform: true,
+        targetKind: 'permission',
+        targetValue: 'identity:*',
+        createdBy: USER,
+        graceDays: 14,
+      },
+    },
+    {
+      id: 'p4',
+      fields: {
+        scopeNodeUuid: COMPANY,
+        platform: false,
+        targetKind: 'tenant',
+        targetValue: null,
+        graceDays: 2,
+      },
+    },
+  ];
+
+  test('collects unique company, role and user ids (permission keys are not ids)', () => {
+    const ids = collectLabelIds(rows);
+    assert.deepEqual([...ids.companies].sort(), [COMPANY, GONE].sort());
+    assert.deepEqual([...ids.roles].sort(), [ROLE, GONE].sort());
+    assert.deepEqual([...ids.users].sort(), [USER, GONE].sort());
+  });
+
+  const lookups = () => {
+    const calls = [];
+    const rec = (name) => ({ ok: true, record: { id: 'x', fields: name } });
+    return {
+      calls,
+      getCompany: async (id) => (
+        calls.push(['company', id]),
+        id === COMPANY ? rec({ name: 'Acme' }) : { ok: true, record: null }
+      ),
+      getRole: async (id) => (
+        calls.push(['role', id]),
+        id === ROLE ? rec({ name: 'Finance admin' }) : { ok: false, status: 404, error: 'x' }
+      ),
+      getUser: async (id) => (
+        calls.push(['user', id]),
+        id === USER ? rec({ username: 'sonja' }) : { ok: false, status: 403, error: 'x' }
+      ),
+    };
+  };
+
+  test('resolves each id once, with fallbacks for deleted or unreadable records', async () => {
+    const l = lookups();
+    const labels = await resolvePolicyLabels(rows, l);
+    assert.equal(l.calls.length, 6, 'one lookup per unique id');
+    assert.equal(labels.companies.get(COMPANY), 'Acme');
+    assert.equal(labels.companies.get(GONE), 'Deleted company');
+    assert.equal(labels.roles.get(ROLE), 'Finance admin');
+    assert.equal(labels.roles.get(GONE), 'Deleted role');
+    assert.equal(labels.users.get(USER), 'sonja');
+    assert.equal(labels.users.get(GONE), 'Unknown user');
+  });
+
+  test('a lookup that throws still yields the fallback', async () => {
+    const boom = async () => {
+      throw new Error('network');
+    };
+    const labels = await resolvePolicyLabels(rows, {
+      getCompany: boom,
+      getRole: boom,
+      getUser: boom,
+    });
+    assert.equal(labels.companies.get(COMPANY), 'Deleted company');
+    assert.equal(labels.roles.get(ROLE), 'Deleted role');
+    assert.equal(labels.users.get(USER), 'Unknown user');
+  });
+
+  test('describePolicy renders names only — never a uuid', async () => {
+    const labels = await resolvePolicyLabels(rows, lookups());
+    const out = rows.map((r) => describePolicy(r, labels));
+    assert.deepEqual(out[0], {
+      scope: 'Acme',
+      kind: 'Holders of a role',
+      target: 'Finance admin',
+      grace: 'None',
+      createdBy: 'sonja',
+    });
+    assert.deepEqual(out[1], {
+      scope: 'Deleted company',
+      kind: 'Holders of a role',
+      target: 'Deleted role',
+      grace: '1 day',
+      createdBy: 'Unknown user',
+    });
+    assert.deepEqual(out[2], {
+      scope: 'Platform minimum',
+      kind: 'Holders of a permission',
+      target: 'identity:*',
+      grace: '14 days',
+      createdBy: 'sonja',
+    });
+    assert.deepEqual(out[3], {
+      scope: 'Acme',
+      kind: 'Everyone in this organisation',
+      target: 'Everyone',
+      grace: '2 days',
+      createdBy: 'Unknown user',
+    });
+    for (const d of out) for (const v of Object.values(d)) assert.doesNotMatch(v, UUID_RE);
+  });
+
+  test('labels not yet loaded read as a neutral placeholder, never the id', () => {
+    const d = describePolicy(rows[0], undefined);
+    assert.equal(d.scope, '…');
+    assert.equal(d.target, '…');
+    assert.equal(d.createdBy, '…');
+  });
+});
+
+describe('policyFailureText', () => {
+  test('a 403 shows the server fixed message the service passed through', () => {
+    assert.equal(
+      policyFailureText(
+        {
+          ok: false,
+          status: 403,
+          error: 'Only a platform administrator can set a platform-wide policy.',
+        },
+        'save',
+      ),
+      'Only a platform administrator can set a platform-wide policy.',
+    );
+  });
+
+  test('empty error → a generic per-verb message', () => {
+    assert.equal(
+      policyFailureText({ ok: false, status: 500, error: '' }, 'save'),
+      'Could not save the policy.',
+    );
+    assert.equal(
+      policyFailureText({ ok: false, status: 500 }, 'delete'),
+      'Could not delete the policy.',
+    );
+    assert.equal(policyFailureText(undefined, 'load'), 'Could not load security policies.');
+  });
+});

package/template/frontend/src/pages/users/MembershipCard.jsx

@@ -8,8 +8,9 @@
  *
  * Company-scoped dropdowns: this card loads ITS company's department + branch catalogs on
  * mount (the parent may pass a cache to avoid refetching). The Role dropdown is the growable
- * catalog — each PostingRow self-fetches it (server-paginated + searchable) via the injected
- * `identity` client, so no global role list is threaded through here.
+ * catalog — each PostingRow self-fetches THIS company's roles (`listCompanyRoles`, G-013:
+ * a role is posted only in the company that owns it; server-paginated + searchable) via the
+ * injected `identity` client and the `companyUuid` passed here.
  *
  * ⛔ No raw UUIDs: the header renders `companyName`; posting dropdowns render names with
  * uuid values. `membershipUuid` / `companyUuid` are used only as keys/params.
@@ -246,6 +247,7 @@ export default function MembershipCard({
                       posting={row}
                       departments={departments}
                       branches={branches}
+                      companyUuid={companyUuid}
                       token={token}
                       identity={identity}
                       onChange={(patch) => patchRow(row.key, patch)}
@@ -266,6 +268,7 @@ export default function MembershipCard({
                   posting={row}
                   departments={departments}
                   branches={branches}
+                  companyUuid={companyUuid}
                   token={token}
                   identity={identity}
                   onChange={(patch) => patchRow(row.key, patch)}

package/template/frontend/src/pages/users/PostingRow.jsx

@@ -29,8 +29,9 @@
  * Props:
  *   posting   — { roleUuid, roleName, departmentUuid, branchUuid, effectiveFrom, effectiveUntil }
  *   departments / branches — [{ uuid, name }]  (this company's catalogs; may be empty)
+ *   companyUuid — the membership's company: the Role dropdown lists only its roles (G-013)
  *   token     — access token (for the Role dropdown's self-fetch)
- *   identity  — the shared identity client service (for `listRoles`)
+ *   identity  — the shared identity client service (for `listCompanyRoles`)
  *   onChange(patch) — merge a field change into this row
  *   onRemove()      — drop this row
  *   disabled        — save in flight
@@ -43,6 +44,7 @@ import { Badge } from '@/components/ui/badge';
 import { Label } from '@/components/ui/label';
 import { DateField } from '@/components/ui/date-field';
 import { SearchableSelect } from '@/components/ui/searchable-select';
+import { nameOptions } from '../roles/roleRules';
 
 /**
  * Classify a posting's effective window relative to now:
@@ -88,6 +90,7 @@ export default function PostingRow({
   posting,
   departments,
   branches,
+  companyUuid,
   token,
   identity,
   onChange,
@@ -97,20 +100,20 @@ export default function PostingRow({
 }) {
   const chip = windowState(posting.effectiveFrom, posting.effectiveUntil);
 
-  // Role is the growable catalog → server-paginated + searchable via `listRoles`. The row
-  // already knows the selected role's NAME (posting.roleName, resolved server-side), so the
-  // trigger shows a name even before the first page loads.
+  // Role is the growable catalog → server-paginated + searchable via `listCompanyRoles`, for the
+  // membership's company only: a role can be posted only in the company that owns it (G-013;
+  // the server refuses any other with 400). The row already knows the selected role's NAME
+  // (posting.roleName, resolved server-side), so the trigger shows a name even before the first
+  // page loads.
   const fetchRoles = useCallback(
     async ({ search, page, limit }) => {
-      const r = await identity.listRoles(token, { search, page, limit });
+      if (!companyUuid) return { options: [], total: 0, page };
+      const r = await identity.listCompanyRoles(token, companyUuid, { search, page, limit });
       if (!r.ok) return { options: [], total: 0, page };
-      const options = (r.rows || []).map((row) => ({
-        value: row.id,
-        label: row.fields?.name || '(unnamed)',
-      }));
+      const options = nameOptions(r.rows);
       return { options, total: r.total ?? options.length, page: r.page ?? page };
     },
-    [identity, token],
+    [identity, token, companyUuid],
   );
 
   // Department / Branch: small, per-company catalogs (passed in). The SAME control in

package/template/frontend/src/pages/users/SignInActionDialog.jsx

@@ -0,0 +1,98 @@
+/**
+ * SignInActionDialog — confirm one admin sign-in action (reset 2FA, unlock, end sessions;
+ * auth capabilities R11.1, R11.2) with the admin's OWN current 6-digit authenticator code.
+ *
+ * The code goes to the server with the action (`identity.resetUserMfa` / `unlockUser` /
+ * `endUserSessions`); nothing is decided here. The outcome text comes from `signInActionOutcome`:
+ * a wrong code or a partly-applied action keeps the dialog open for another try; a final refusal
+ * (no 2FA on the admin's account, rate limited, not allowed) closes it with a toast.
+ *
+ * The user is named by display name only; `user.id` is passed to the service, never shown.
+ */
+import { useState } from 'react';
+import { toast } from 'sonner';
+import { useAuth } from '@/auth/AuthContext';
+import EntityFormModal from '@/components/EntityFormModal';
+import { InputOTP, InputOTPGroup, InputOTPSlot } from '@/components/ui/input-otp';
+import { Label } from '@/components/ui/label';
+import { isAdminCode, normalizeAdminCode, signInActionOutcome } from './signInAdmin';
+
+export default function SignInActionDialog({ action, user, onClose, onDone }) {
+  const { tokens, identity } = useAuth();
+  const token = tokens?.accessToken;
+  const name = user.fields?.username || user.fields?.email || 'this user';
+
+  const [code, setCode] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState('');
+
+  const submit = async () => {
+    if (busy) return;
+    if (!isAdminCode(code)) {
+      setError('Enter the 6-digit code from your authenticator app.');
+      return;
+    }
+    setError('');
+    setBusy(true);
+    const result = await identity[action.method](token, user.id, normalizeAdminCode(code));
+    setBusy(false);
+    const outcome = signInActionOutcome(action, result, name);
+    if (outcome.kind === 'success') {
+      toast.success(outcome.text);
+      onDone();
+      return;
+    }
+    if (outcome.close) {
+      toast.error(outcome.text);
+      onClose();
+      return;
+    }
+    setCode('');
+    setError(outcome.text);
+  };
+
+  return (
+    <EntityFormModal
+      title={action.title(name)}
+      description={action.description}
+      open
+      onClose={onClose}
+      onSubmit={submit}
+      submitLabel={action.confirmLabel}
+      busy={busy}
+      error={error}
+      expandable={false}
+    >
+      <div className="space-y-1.5">
+        <Label htmlFor="admin-code" variant="field">
+          Your authenticator code
+        </Label>
+        <p className="text-xs text-muted-foreground">
+          Enter the current code from your own authenticator app to confirm.
+        </p>
+        <div className="flex justify-center py-1">
+          <InputOTP
+            id="admin-code"
+            autoFocus
+            maxLength={6}
+            inputMode="numeric"
+            pattern="[0-9]*"
+            autoComplete="one-time-code"
+            value={code}
+            onChange={setCode}
+            disabled={busy}
+          >
+            <InputOTPGroup>
+              <InputOTPSlot index={0} />
+              <InputOTPSlot index={1} />
+              <InputOTPSlot index={2} />
+              <InputOTPSlot index={3} />
+              <InputOTPSlot index={4} />
+              <InputOTPSlot index={5} />
+            </InputOTPGroup>
+          </InputOTP>
+        </div>
+      </div>
+    </EntityFormModal>
+  );
+}