create-astram-app 0.4.0 → 0.5.0

package/template/server/test/enforcement.e2e.spec.ts

@@ -1,5 +1,13 @@
-import type { INestApplication } from '@nestjs/common';
+import { Controller, Get, type INestApplication, type ModuleMetadata } from '@nestjs/common';
+import { DiscoveryModule } from '@nestjs/core';
 import { Test } from '@nestjs/testing';
+import { checkCompleteness, createModuleRegistry } from '@astram/core';
+import {
+  CatalogGatabilityError,
+  CatalogReconciler,
+  OperationInventoryScanner,
+  ShieldModule,
+} from '@astram/guard';
 import request from 'supertest';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { AppModule } from '../src/app.module';
@@ -46,11 +54,70 @@ describe('__APP_NAME__ — framework enforcement + health (e2e)', () => {
       message: expect.stringContaining('public route reachable'),
     });
   });
+});
+
+/**
+ * A deliberately UNCLASSIFIED controller (no @Public(), no @Classified()). It lives
+ * only in this test file — never in src/ — because a live unclassified route would
+ * abort a real boot (see demo.controller.ts). Used to prove both deny-by-default layers.
+ */
+@Controller('probe')
+class UnclassifiedProbeController {
+  @Get('unclassified')
+  unclassifiedRoute(): { message: string } {
+    return { message: 'this body must never be reached — the guard denies first' };
+  }
+}
+
+/** Reflect every mounted route of `imports`/`controllers` into an OperationInventory. */
+async function scanRoutes(opts: Pick<ModuleMetadata, 'imports' | 'controllers'>) {
+  const moduleRef = await Test.createTestingModule({
+    imports: [DiscoveryModule, ...(opts.imports ?? [])],
+    controllers: opts.controllers ?? [],
+    providers: [OperationInventoryScanner],
+  }).compile();
+  const inventory = moduleRef.get(OperationInventoryScanner).scan('app');
+  await moduleRef.close();
+  return inventory;
+}
 
-  it('GET /demo/unclassified is DENIED (403) — deny-by-default (ADR-0002)', async () => {
-    const res = await request(app.getHttpServer()).get('/demo/unclassified');
-    expect(res.status).toBe(403);
-    // The guard denies BEFORE the handler body runs.
-    expect(res.body.message).toContain('no access classification');
+describe('__APP_NAME__ — deny-by-default (ADR-0002)', () => {
+  it('BOOT layer: an unclassified route ABORTS boot via verifyGatable (fail-closed)', async () => {
+    const inventory = await scanRoutes({ controllers: [UnclassifiedProbeController] });
+    // The same check the identity boot provider runs: a forgotten declaration means the
+    // app refuses to start, not that the route silently serves traffic.
+    expect(() => new CatalogReconciler().verifyGatable(inventory, createModuleRegistry())).toThrow(
+      CatalogGatabilityError,
+    );
+    expect(() => new CatalogReconciler().verifyGatable(inventory, createModuleRegistry())).toThrow(
+      /UnclassifiedProbeController#unclassifiedRoute/,
+    );
+  });
+
+  it('BOOT layer: every route in YOUR AppModule is @Public() or @Classified() (none stranded)', async () => {
+    // Fails the moment a route is added without a classification — the same routes the
+    // boot check would strand. (Registering @Classified keys is the identity module's job,
+    // so only the "forgotten declaration" half is asserted here.)
+    const inventory = await scanRoutes({ imports: [AppModule] });
+    expect(inventory.operations.length).toBeGreaterThan(0);
+    const { strandedOperations } = checkCompleteness(inventory, createModuleRegistry());
+    expect(strandedOperations.map((o) => o.operationId)).toEqual([]);
+  });
+
+  it('REQUEST layer: an unclassified route is DENIED (403) before its handler runs', async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [ShieldModule.forRoot()],
+      controllers: [UnclassifiedProbeController],
+    }).compile();
+    const probeApp = moduleRef.createNestApplication();
+    await probeApp.init();
+    try {
+      const res = await request(probeApp.getHttpServer()).get('/probe/unclassified');
+      expect(res.status).toBe(403);
+      // The guard denies BEFORE the handler body runs.
+      expect(res.body.message).toContain('no access classification');
+    } finally {
+      await probeApp.close();
+    }
   });
 });