mongodb-dynamic-api 5.1.0 → 5.3.0

package/src/routes/update-one/update-one-gateway.mixin.js

@@ -23,7 +23,7 @@ const mixin_data_helper_1 = require("../../helpers/mixin-data.helper");
 const format_helper_1 = require("../../helpers/format.helper");
 const mixins_1 = require("../../mixins");
 function UpdateOneGatewayMixin(entity, controllerOptions, { dTOs, useInterceptors = [], broadcast: broadcastConfig, ...routeConfig }, version) {
-    const { routeType, displayedName, isPublic, event, abilityPredicate, } = (0, mixin_data_helper_1.getMixinData)(entity, controllerOptions, routeConfig, true, broadcastConfig);
+    const { routeType, displayedName, isPublic, event, abilityPredicate, authAbilityPredicate, } = (0, mixin_data_helper_1.getMixinData)(entity, controllerOptions, routeConfig, true, broadcastConfig);
     class UpdateOneData extends (dTOs?.body ?? (0, mixins_1.EntityBodyMixin)(entity, true)) {
     }
     Object.defineProperty(UpdateOneData, 'name', {
@@ -38,7 +38,7 @@ function UpdateOneGatewayMixin(entity, controllerOptions, { dTOs, useInterceptor
             : `${displayedName}${(0, versioning_config_helper_1.addVersionSuffix)(version)}Response`,
         writable: false,
     });
-    class UpdateOnePoliciesGuard extends (0, mixins_1.SocketPoliciesGuardMixin)(entity, routeType, event, version, { abilityPredicate, isPublic }) {
+    class UpdateOnePoliciesGuard extends (0, mixins_1.SocketPoliciesGuardMixin)(entity, routeType, event, version, { abilityPredicate, isPublic, authAbilityPredicate }) {
     }
     class BaseUpdateOneGateway extends gateways_1.BaseGateway {
         constructor(service, jwtService) {
@@ -55,7 +55,7 @@ function UpdateOneGatewayMixin(entity, controllerOptions, { dTOs, useInterceptor
             const toEntity = UpdateOneData.toEntity;
             const entity = await this.service.updateOne(id, toEntity ? toEntity(data) : data, socket?.user);
             const fromEntity = UpdateOneResponse.fromEntity;
-            const responseData = fromEntity ? fromEntity(entity) : entity;
+            const responseData = fromEntity ? fromEntity(entity, socket?.user) : entity;
             this.broadcastIfNeeded(socket, event, [responseData], broadcastConfig);
             return {
                 event,

package/src/routes/update-one/update-one-gateway.mixin.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-one-gateway.mixin.js","sourceRoot":"","sources":["../../../../libs/dynamic-api/src/routes/update-one/update-one-gateway.mixin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAqHS,sDAAqB;AArH9B,2CAA8E;AAE9E,mDAAiG;AAEjG,2CAA4D;AAC5D,6CAA6C;AAC7C,yCAA8C;AAC9C,qFAA0E;AAC1E,uEAA+D;AAC/D,+DAA0D;AAE1D,yCAA+F;AAK/F,SAAS,qBAAqB,CAC5B,MAAoB,EACpB,iBAAsD,EACtD,EAAE,IAAI,EAAE,eAAe,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,WAAW,EAAiC,EACzG,OAAgB;IAEhB,MAAM,EACJ,SAAS,EACT,aAAa,EACb,QAAQ,EACR,KAAK,EACL,gBAAgB,GACjB,GAAG,IAAA,gCAAY,EACd,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,IAAI,EACJ,eAAe,CAChB,CAAC;IAEF,MAAM,aAAc,SAAQ,CAC1B,IAAI,EAAE,IAAI,IAAI,IAAA,wBAAe,EAAC,MAAM,EAAE,IAAI,CAAC,CAC5C;KAAG;IAEJ,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE;QAC3C,KAAK,EAAE,YAAY,aAAa,GAAG,IAAA,2CAAgB,EAAC,OAAO,CAAC,MAAM;QAClE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,MAAM,iBAAkB,SAAQ,CAC9B,IAAI,EAAE,SAAS,IAAI,IAAA,6BAAoB,EAAC,MAAM,CAAC,CAChD;KAAG;IAEJ,MAAM,CAAC,cAAc,CAAC,iBAAiB,EAAE,MAAM,EAAE;QAC/C,KAAK,EAAE,IAAI,EAAE,SAAS;YACpB,CAAC,CAAC,YAAY,aAAa,GAAG,IAAA,2CAAgB,EAAC,OAAO,CAAC,UAAU;YACjE,CAAC,CAAC,GAAG,aAAa,GAAG,IAAA,2CAAgB,EAAC,OAAO,CAAC,UAAU;QAC1D,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,MAAM,sBAAuB,SAAQ,IAAA,iCAAwB,EAC3D,MAAM,EACN,SAAS,EACT,KAAK,EACL,OAAO,EACP,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAC/B;KAAG;IAEJ,MAAM,oBAAqB,SAAQ,sBAAmB;QAGpD,YACqB,OAAiC,EACjC,UAAsB;YAEzC,KAAK,CAAC,UAAU,CAAC,CAAC;YAHC,YAAO,GAAP,OAAO,CAA0B;YACjC,eAAU,GAAV,UAAU,CAAY;YAJxB,WAAM,GAAG,MAAM,CAAC;QAOnC,CAAC;QAMK,AAAN,KAAK,CAAC,SAAS,CACM,MAA8B,EAClC,IAAiC;YAEhD,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,wBAAW,CAAC,sBAAsB,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;YAE7B,MAAM,QAAQ,GACZ,aACD,CAAC,QAAQ,CAAC;YAEX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAuB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAEnH,MAAM,UAAU,GACd,iBACD,CAAC,UAAU,CAAC;YAEb,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAoB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEjF,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;YAEvE,OAAO;gBACL,KAAK;gBACL,IAAI,EAAE,YAAY;aACnB,CAAC;QACJ,CAAC;KACF;IA7BO;QAJL,IAAA,mBAAU,EAAC,IAAI,qCAA2B,EAAE,CAAC;QAC7C,IAAA,kBAAS,EAAC,IAAI,uBAAc,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;QAC/D,IAAA,wBAAe,EAAC,GAAG,eAAe,CAAC;QACnC,IAAA,6BAAgB,EAAC,KAAK,CAAC;QAErB,WAAA,IAAA,4BAAe,GAAE,CAAA;QACjB,WAAA,IAAA,wBAAW,GAAE,CAAA;;;;yDA0Bf;IAGH,MAAM,CAAC,cAAc,CAAC,oBAAoB,EAAE,MAAM,EAAE;QAClD,KAAK,EAAE,OAAO,IAAA,2BAAW,EAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;QACzE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"update-one-gateway.mixin.js","sourceRoot":"","sources":["../../../../libs/dynamic-api/src/routes/update-one/update-one-gateway.mixin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAsHS,sDAAqB;AAtH9B,2CAA8E;AAE9E,mDAAiG;AAEjG,2CAA4D;AAC5D,6CAA6C;AAC7C,yCAA8C;AAC9C,qFAA0E;AAC1E,uEAA+D;AAC/D,+DAA0D;AAE1D,yCAA+F;AAK/F,SAAS,qBAAqB,CAC5B,MAAoB,EACpB,iBAAsD,EACtD,EAAE,IAAI,EAAE,eAAe,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,WAAW,EAAiC,EACzG,OAAgB;IAEhB,MAAM,EACJ,SAAS,EACT,aAAa,EACb,QAAQ,EACR,KAAK,EACL,gBAAgB,EAChB,oBAAoB,GACrB,GAAG,IAAA,gCAAY,EACd,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,IAAI,EACJ,eAAe,CAChB,CAAC;IAEF,MAAM,aAAc,SAAQ,CAC1B,IAAI,EAAE,IAAI,IAAI,IAAA,wBAAe,EAAC,MAAM,EAAE,IAAI,CAAC,CAC5C;KAAG;IAEJ,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE;QAC3C,KAAK,EAAE,YAAY,aAAa,GAAG,IAAA,2CAAgB,EAAC,OAAO,CAAC,MAAM;QAClE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,MAAM,iBAAkB,SAAQ,CAC9B,IAAI,EAAE,SAAS,IAAI,IAAA,6BAAoB,EAAC,MAAM,CAAC,CAChD;KAAG;IAEJ,MAAM,CAAC,cAAc,CAAC,iBAAiB,EAAE,MAAM,EAAE;QAC/C,KAAK,EAAE,IAAI,EAAE,SAAS;YACpB,CAAC,CAAC,YAAY,aAAa,GAAG,IAAA,2CAAgB,EAAC,OAAO,CAAC,UAAU;YACjE,CAAC,CAAC,GAAG,aAAa,GAAG,IAAA,2CAAgB,EAAC,OAAO,CAAC,UAAU;QAC1D,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,MAAM,sBAAuB,SAAQ,IAAA,iCAAwB,EAC3D,MAAM,EACN,SAAS,EACT,KAAK,EACL,OAAO,EACP,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CACrD;KAAG;IAEJ,MAAM,oBAAqB,SAAQ,sBAAmB;QAGpD,YACqB,OAAiC,EACjC,UAAsB;YAEzC,KAAK,CAAC,UAAU,CAAC,CAAC;YAHC,YAAO,GAAP,OAAO,CAA0B;YACjC,eAAU,GAAV,UAAU,CAAY;YAJxB,WAAM,GAAG,MAAM,CAAC;QAOnC,CAAC;QAMK,AAAN,KAAK,CAAC,SAAS,CACM,MAA8B,EAClC,IAAiC;YAEhD,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,wBAAW,CAAC,sBAAsB,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;YAE7B,MAAM,QAAQ,GACZ,aACD,CAAC,QAAQ,CAAC;YAEX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAuB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAEnH,MAAM,UAAU,GACd,iBACD,CAAC,UAAU,CAAC;YAEb,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAoB,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAE/F,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;YAEvE,OAAO;gBACL,KAAK;gBACL,IAAI,EAAE,YAAY;aACnB,CAAC;QACJ,CAAC;KACF;IA7BO;QAJL,IAAA,mBAAU,EAAC,IAAI,qCAA2B,EAAE,CAAC;QAC7C,IAAA,kBAAS,EAAC,IAAI,uBAAc,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;QAC/D,IAAA,wBAAe,EAAC,GAAG,eAAe,CAAC;QACnC,IAAA,6BAAgB,EAAC,KAAK,CAAC;QAErB,WAAA,IAAA,4BAAe,GAAE,CAAA;QACjB,WAAA,IAAA,wBAAW,GAAE,CAAA;;;;yDA0Bf;IAGH,MAAM,CAAC,cAAc,CAAC,oBAAoB,EAAE,MAAM,EAAE;QAClD,KAAK,EAAE,OAAO,IAAA,2BAAW,EAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;QACzE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC;AAC9B,CAAC"}

package/src/version.json

@@ -1,3 +1,3 @@
 {
-    "version": "5.1.0"
+    "version": "5.3.0"
 }

package/test/for-feature/presenter-viewer-context.e2e-spec.d.ts

@@ -0,0 +1 @@
+import 'dotenv/config';

package/test/for-feature/presenter-viewer-context.e2e-spec.js

@@ -0,0 +1,144 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const mongoose_1 = require("@nestjs/mongoose");
+const testing_1 = require("@nestjs/testing");
+const mongoose_2 = require("mongoose");
+const src_1 = require("../../src");
+const e2e_setup_1 = require("../e2e.setup");
+require("dotenv/config");
+let ItemEntity = class ItemEntity extends src_1.BaseEntity {
+};
+__decorate([
+    (0, mongoose_1.Prop)({ type: String, required: true }),
+    __metadata("design:type", String)
+], ItemEntity.prototype, "label", void 0);
+ItemEntity = __decorate([
+    (0, mongoose_1.Schema)({ collection: 'viewer-context-items' })
+], ItemEntity);
+class ItemPresenter {
+    static fromEntity(entity, user) {
+        return { id: entity.id, label: entity.label, viewedBy: user?.email };
+    }
+    static fromEntities(entities, user) {
+        return entities.map((entity) => ItemPresenter.fromEntity(entity, user));
+    }
+}
+let UserEntity = class UserEntity extends src_1.BaseEntity {
+};
+__decorate([
+    (0, mongoose_1.Prop)({ type: String, required: true }),
+    __metadata("design:type", String)
+], UserEntity.prototype, "email", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ type: String, required: true }),
+    __metadata("design:type", String)
+], UserEntity.prototype, "password", void 0);
+UserEntity = __decorate([
+    (0, mongoose_1.Schema)({ collection: 'viewer-context-users' })
+], UserEntity);
+(0, vitest_1.describe)('Mappable.fromEntity/fromEntities receive the authenticated user (e2e)', () => {
+    let accessToken;
+    const userEmail = 'viewer-context@test.co';
+    const userPassword = 'test';
+    (0, vitest_1.beforeEach)(async () => {
+        src_1.DynamicApiModule.state['resetState']();
+        const uri = process.env.MONGO_DB_URL;
+        const moduleRef = await testing_1.Test.createTestingModule({
+            imports: [
+                src_1.DynamicApiModule.forRoot(uri, { useAuth: { userEntity: UserEntity } }),
+                src_1.DynamicApiModule.forFeature({
+                    entity: ItemEntity,
+                    controllerOptions: { path: 'viewer-items' },
+                    routes: [
+                        { type: 'CreateOne', dTOs: { presenter: ItemPresenter } },
+                        { type: 'CreateMany', dTOs: { presenter: ItemPresenter } },
+                        { type: 'GetOne', dTOs: { presenter: ItemPresenter } },
+                        { type: 'GetMany', dTOs: { presenter: ItemPresenter } },
+                        { type: 'UpdateOne', dTOs: { presenter: ItemPresenter } },
+                        { type: 'UpdateMany', dTOs: { presenter: ItemPresenter } },
+                        { type: 'ReplaceOne', dTOs: { presenter: ItemPresenter } },
+                        { type: 'DuplicateOne', dTOs: { presenter: ItemPresenter } },
+                        { type: 'DuplicateMany', dTOs: { presenter: ItemPresenter } },
+                    ],
+                }),
+            ],
+        }).compile();
+        await (0, e2e_setup_1.createTestingApp)(moduleRef);
+        await e2e_setup_1.server.post('/auth/register', { email: userEmail, password: userPassword });
+        const { body } = await e2e_setup_1.server.post('/auth/login', { email: userEmail, password: userPassword });
+        accessToken = body.accessToken;
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await (0, e2e_setup_1.closeTestingApp)(mongoose_2.default.connections);
+    });
+    const auth = () => ({ authToken: accessToken });
+    (0, vitest_1.it)('CreateOne: fromEntity receives the authenticated user', async () => {
+        const { status, body } = await e2e_setup_1.server.post('/viewer-items', { label: 'one' }, auth());
+        (0, vitest_1.expect)(status).toBe(201);
+        (0, vitest_1.expect)(body).toEqual(vitest_1.expect.objectContaining({ label: 'one', viewedBy: userEmail }));
+    });
+    (0, vitest_1.it)('CreateMany: fromEntities receives the authenticated user for every entity', async () => {
+        const { status, body } = await e2e_setup_1.server.post('/viewer-items/many', { list: [{ label: 'a' }, { label: 'b' }] }, auth());
+        (0, vitest_1.expect)(status).toBe(201);
+        (0, vitest_1.expect)(body).toHaveLength(2);
+        (0, vitest_1.expect)(body.every((i) => i.viewedBy === userEmail)).toBe(true);
+    });
+    (0, vitest_1.it)('GetOne: fromEntity receives the authenticated user', async () => {
+        const { body: created } = await e2e_setup_1.server.post('/viewer-items', { label: 'get-one' }, auth());
+        const { status, body } = await e2e_setup_1.server.get(`/viewer-items/${created.id}`, auth());
+        (0, vitest_1.expect)(status).toBe(200);
+        (0, vitest_1.expect)(body).toEqual(vitest_1.expect.objectContaining({ label: 'get-one', viewedBy: userEmail }));
+    });
+    (0, vitest_1.it)('GetMany: fromEntities receives the authenticated user for every entity', async () => {
+        await e2e_setup_1.server.post('/viewer-items/many', { list: [{ label: 'gm-1' }, { label: 'gm-2' }] }, auth());
+        const { status, body } = await e2e_setup_1.server.get('/viewer-items', auth());
+        (0, vitest_1.expect)(status).toBe(200);
+        (0, vitest_1.expect)(body.length).toBeGreaterThanOrEqual(2);
+        (0, vitest_1.expect)(body.every((i) => i.viewedBy === userEmail)).toBe(true);
+    });
+    (0, vitest_1.it)('UpdateOne: fromEntity receives the authenticated user', async () => {
+        const { body: created } = await e2e_setup_1.server.post('/viewer-items', { label: 'to-update' }, auth());
+        const { status, body } = await e2e_setup_1.server.patch(`/viewer-items/${created.id}`, { label: 'updated' }, auth());
+        (0, vitest_1.expect)(status).toBe(200);
+        (0, vitest_1.expect)(body).toEqual(vitest_1.expect.objectContaining({ label: 'updated', viewedBy: userEmail }));
+    });
+    (0, vitest_1.it)('UpdateMany: fromEntities receives the authenticated user for every entity', async () => {
+        const { body: items } = await e2e_setup_1.server.post('/viewer-items/many', { list: [{ label: 'um-1' }, { label: 'um-2' }] }, auth());
+        const ids = items.map((i) => i.id);
+        const { status, body } = await e2e_setup_1.server.patch('/viewer-items', { label: 'bulk-updated' }, { ...auth(), query: { ids } });
+        (0, vitest_1.expect)(status).toBe(200);
+        (0, vitest_1.expect)(body).toHaveLength(2);
+        (0, vitest_1.expect)(body.every((i) => i.viewedBy === userEmail)).toBe(true);
+    });
+    (0, vitest_1.it)('ReplaceOne: fromEntity receives the authenticated user', async () => {
+        const { body: created } = await e2e_setup_1.server.post('/viewer-items', { label: 'to-replace' }, auth());
+        const { status, body } = await e2e_setup_1.server.put(`/viewer-items/${created.id}`, { label: 'replaced' }, auth());
+        (0, vitest_1.expect)(status).toBe(200);
+        (0, vitest_1.expect)(body).toEqual(vitest_1.expect.objectContaining({ label: 'replaced', viewedBy: userEmail }));
+    });
+    (0, vitest_1.it)('DuplicateOne: fromEntity receives the authenticated user', async () => {
+        const { body: created } = await e2e_setup_1.server.post('/viewer-items', { label: 'to-dup' }, auth());
+        const { status, body } = await e2e_setup_1.server.post(`/viewer-items/duplicate/${created.id}`, {}, auth());
+        (0, vitest_1.expect)(status).toBe(201);
+        (0, vitest_1.expect)(body).toEqual(vitest_1.expect.objectContaining({ label: 'to-dup', viewedBy: userEmail }));
+    });
+    (0, vitest_1.it)('DuplicateMany: fromEntities receives the authenticated user for every entity', async () => {
+        const { body: items } = await e2e_setup_1.server.post('/viewer-items/many', { list: [{ label: 'dm-1' }, { label: 'dm-2' }] }, auth());
+        const ids = items.map((i) => i.id);
+        const { status, body } = await e2e_setup_1.server.post('/viewer-items/duplicate', {}, { ...auth(), query: { ids } });
+        (0, vitest_1.expect)(status).toBe(201);
+        (0, vitest_1.expect)(body).toHaveLength(2);
+        (0, vitest_1.expect)(body.every((i) => i.viewedBy === userEmail)).toBe(true);
+    });
+});
+//# sourceMappingURL=presenter-viewer-context.e2e-spec.js.map

package/test/for-feature/presenter-viewer-context.e2e-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presenter-viewer-context.e2e-spec.js","sourceRoot":"","sources":["../../../libs/dynamic-api/test/for-feature/presenter-viewer-context.e2e-spec.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,mCAAqE;AACrE,+CAAgD;AAChD,6CAAuC;AACvC,uCAAgC;AAChC,mCAAyD;AACzD,4CAAyE;AACzE,yBAAuB;AAevB,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,gBAAU;CAGlC,CAAA;AADC;IADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACzB;AAFV,UAAU;IADf,IAAA,iBAAM,EAAC,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;GACzC,UAAU,CAGf;AAED,MAAM,aAAa;IAKjB,MAAM,CAAC,UAAU,CAAC,MAAkB,EAAE,IAAyB;QAC7D,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,QAAsB,EAAE,IAAyB;QACnE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;CACF;AAGD,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,gBAAU;CAMlC,CAAA;AAJC;IADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACzB;AAGd;IADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;4CACtB;AALb,UAAU;IADf,IAAA,iBAAM,EAAC,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;GACzC,UAAU,CAMf;AAED,IAAA,iBAAQ,EAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,IAAI,WAAmB,CAAC;IACxB,MAAM,SAAS,GAAG,wBAAwB,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,CAAC;IAE5B,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,sBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAEvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAErC,MAAM,SAAS,GAAG,MAAM,cAAI,CAAC,mBAAmB,CAAC;YAC/C,OAAO,EAAE;gBACP,sBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;gBACtE,sBAAgB,CAAC,UAAU,CAAC;oBAC1B,MAAM,EAAE,UAAU;oBAClB,iBAAiB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;oBAC3C,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBACzD,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBAC1D,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBACtD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBACvD,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBACzD,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBAC1D,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;wBAC5D,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE;qBAC9D;iBACF,CAAC;aACH;SACF,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,IAAA,4BAAgB,EAAC,SAAS,CAAC,CAAC;QAElC,MAAM,kBAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAChC,aAAa,EACb,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CACtC,CAAC;QACT,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,KAAK,IAAI,EAAE;QACnB,MAAM,IAAA,2BAAe,EAAC,kBAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IAEhD,IAAA,WAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAQ,CAAC;QAE7F,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CACxC,oBAAoB,EACpB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAC1C,IAAI,EAAE,CACA,CAAC;QAET,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAQ,CAAC;QAElG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAQ,CAAC;QAExF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,kBAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAElG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAQ,CAAC;QAE1E,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAQ,CAAC;QAEpG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,KAAK,CACzC,iBAAiB,OAAO,CAAC,EAAE,EAAE,EAC7B,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,IAAI,EAAE,CACA,CAAC;QAET,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CACvC,oBAAoB,EACpB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAChD,IAAI,EAAE,CACA,CAAC;QACT,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAExC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,KAAK,CACzC,eAAe,EACf,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,EAAE,GAAG,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CACvB,CAAC;QAET,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAQ,CAAC;QAErG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CACvC,iBAAiB,OAAO,CAAC,EAAE,EAAE,EAC7B,EAAE,KAAK,EAAE,UAAU,EAAE,EACrB,IAAI,EAAE,CACA,CAAC;QAET,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAQ,CAAC;QAEjG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CACxC,2BAA2B,OAAO,CAAC,EAAE,EAAE,EACvC,EAAE,EACF,IAAI,EAAE,CACA,CAAC;QAET,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CACvC,oBAAoB,EACpB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAChD,IAAI,EAAE,CACA,CAAC;QACT,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAExC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CACxC,yBAAyB,EACzB,EAAE,EACF,EAAE,GAAG,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CACvB,CAAC;QAET,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/test/for-feature/standard-route-auth-ability-predicate.e2e-spec.d.ts

@@ -0,0 +1 @@
+import 'dotenv/config';

package/test/for-feature/standard-route-auth-ability-predicate.e2e-spec.js

@@ -0,0 +1,177 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const mongoose_1 = require("@nestjs/mongoose");
+const mongoose_2 = require("mongoose");
+const src_1 = require("../../src");
+const e2e_setup_1 = require("../e2e.setup");
+require("dotenv/config");
+const shared_1 = require("../shared");
+(0, vitest_1.describe)('DynamicApiModule forFeature - standard route authAbilityPredicate (e2e)', () => {
+    (0, vitest_1.beforeEach)(() => {
+        src_1.DynamicApiModule.state['resetState']();
+    });
+    (0, vitest_1.afterEach)(async () => {
+        await (0, e2e_setup_1.closeTestingApp)(mongoose_2.default.connections);
+    });
+    let StdAuthPredicateUserEntity = class StdAuthPredicateUserEntity extends src_1.BaseEntity {
+    };
+    __decorate([
+        (0, mongoose_1.Prop)({ type: String, required: true }),
+        __metadata("design:type", String)
+    ], StdAuthPredicateUserEntity.prototype, "email", void 0);
+    __decorate([
+        (0, mongoose_1.Prop)({ type: String, required: true }),
+        __metadata("design:type", String)
+    ], StdAuthPredicateUserEntity.prototype, "password", void 0);
+    __decorate([
+        (0, mongoose_1.Prop)({ type: String, default: 'user' }),
+        __metadata("design:type", String)
+    ], StdAuthPredicateUserEntity.prototype, "role", void 0);
+    StdAuthPredicateUserEntity = __decorate([
+        (0, mongoose_1.Schema)({ collection: 'std_auth_predicate_users' })
+    ], StdAuthPredicateUserEntity);
+    let StdAuthPredicateEntryEntity = class StdAuthPredicateEntryEntity extends src_1.BaseEntity {
+    };
+    __decorate([
+        (0, mongoose_1.Prop)({ type: String, required: true }),
+        __metadata("design:type", String)
+    ], StdAuthPredicateEntryEntity.prototype, "title", void 0);
+    StdAuthPredicateEntryEntity = __decorate([
+        (0, mongoose_1.Schema)({ collection: 'std_auth_predicate_entries' })
+    ], StdAuthPredicateEntryEntity);
+    const registerAndLogin = async (email, role) => {
+        await e2e_setup_1.server.post('/auth/register', { email, password: 'password123', role });
+        const { body: { accessToken } } = await e2e_setup_1.server.post('/auth/login', { email, password: 'password123' });
+        const { body: account } = await e2e_setup_1.server.get('/auth/account', { authToken: accessToken });
+        return { accessToken, id: account.id };
+    };
+    const isAdminRole = (_entity, user) => user.role === 'admin';
+    const setupWithRoutes = async (routes) => {
+        await (0, shared_1.initApp)({
+            entity: StdAuthPredicateEntryEntity,
+            controllerOptions: { path: 'std-auth-predicate-entries' },
+            routes,
+        }, {
+            useAuth: {
+                userEntity: StdAuthPredicateUserEntity,
+                login: { loginField: 'email', passwordField: 'password', additionalFields: ['role'] },
+                register: {
+                    additionalFields: [{ name: 'role', required: false }],
+                },
+            },
+        });
+    };
+    (0, vitest_1.describe)('abilityPredicate alone on CreateOne — the fail-open bug this option exists to fix', () => {
+        (0, vitest_1.beforeEach)(() => setupWithRoutes([
+            { type: 'CreateOne', abilityPredicate: isAdminRole },
+            { type: 'GetMany' },
+        ]));
+        (0, vitest_1.it)('demonstrates the fail-open bug: a non-admin creates a document because the collection is empty', async () => {
+            const nonAdmin = await registerAndLogin('member@std-auth-predicate.co', 'user');
+            const { status } = await e2e_setup_1.server.post('/std-auth-predicate-entries', { title: 'should have been denied' }, { authToken: nonAdmin.accessToken });
+            (0, vitest_1.expect)(status).toBe(201);
+        });
+    });
+    (0, vitest_1.describe)('authAbilityPredicate on CreateOne — the fix (route-level)', () => {
+        (0, vitest_1.beforeEach)(() => setupWithRoutes([
+            { type: 'CreateOne', authAbilityPredicate: (user) => user.role === 'admin' },
+            { type: 'GetMany' },
+        ]));
+        (0, vitest_1.it)('denies a non-admin, regardless of the backing collection being empty', async () => {
+            const nonAdmin = await registerAndLogin('member2@std-auth-predicate.co', 'user');
+            const { status } = await e2e_setup_1.server.post('/std-auth-predicate-entries', { title: 'should be denied' }, { authToken: nonAdmin.accessToken });
+            (0, vitest_1.expect)(status).toBe(403);
+        });
+        (0, vitest_1.it)('allows an admin', async () => {
+            const admin = await registerAndLogin('admin@std-auth-predicate.co', 'admin');
+            const { status, body } = await e2e_setup_1.server.post('/std-auth-predicate-entries', { title: 'allowed' }, { authToken: admin.accessToken });
+            (0, vitest_1.expect)(status).toBe(201);
+            (0, vitest_1.expect)(body.title).toBe('allowed');
+        });
+        (0, vitest_1.it)('denies an unauthenticated request', async () => {
+            const { status } = await e2e_setup_1.server.post('/std-auth-predicate-entries', { title: 'no token' });
+            (0, vitest_1.expect)(status).toBe(401);
+        });
+    });
+    (0, vitest_1.describe)('abilityPredicate alone on GetMany — the fail-open bug this option exists to fix', () => {
+        (0, vitest_1.beforeEach)(() => setupWithRoutes([
+            { type: 'GetMany', abilityPredicate: isAdminRole },
+        ]));
+        (0, vitest_1.it)('demonstrates the fail-open bug: a non-admin gets 200 because the collection is empty', async () => {
+            const nonAdmin = await registerAndLogin('member3@std-auth-predicate.co', 'user');
+            const { status } = await e2e_setup_1.server.get('/std-auth-predicate-entries', { authToken: nonAdmin.accessToken });
+            (0, vitest_1.expect)(status).toBe(200);
+        });
+    });
+    (0, vitest_1.describe)('authAbilityPredicate on GetMany — the fix (route-level)', () => {
+        (0, vitest_1.beforeEach)(() => setupWithRoutes([
+            { type: 'GetMany', authAbilityPredicate: (user) => user.role === 'admin' },
+        ]));
+        (0, vitest_1.it)('denies a non-admin, regardless of the backing collection being empty', async () => {
+            const nonAdmin = await registerAndLogin('member4@std-auth-predicate.co', 'user');
+            const { status } = await e2e_setup_1.server.get('/std-auth-predicate-entries', { authToken: nonAdmin.accessToken });
+            (0, vitest_1.expect)(status).toBe(403);
+        });
+        (0, vitest_1.it)('allows an admin', async () => {
+            const admin = await registerAndLogin('admin2@std-auth-predicate.co', 'admin');
+            const { status, body } = await e2e_setup_1.server.get('/std-auth-predicate-entries', { authToken: admin.accessToken });
+            (0, vitest_1.expect)(status).toBe(200);
+            (0, vitest_1.expect)(body).toEqual([]);
+        });
+    });
+    (0, vitest_1.describe)('authAbilityPredicate via controllerOptions.abilityPredicates — the fix (controller-level shorthand)', () => {
+        (0, vitest_1.beforeEach)(async () => {
+            await (0, shared_1.initApp)({
+                entity: StdAuthPredicateEntryEntity,
+                controllerOptions: {
+                    path: 'std-auth-predicate-entries',
+                    abilityPredicates: [
+                        {
+                            targets: ['CreateOne', 'GetMany'],
+                            predicate: () => true,
+                            authAbilityPredicate: (user) => user.role === 'admin',
+                        },
+                    ],
+                },
+                routes: [{ type: 'CreateOne' }, { type: 'GetMany' }],
+            }, {
+                useAuth: {
+                    userEntity: StdAuthPredicateUserEntity,
+                    login: { loginField: 'email', passwordField: 'password', additionalFields: ['role'] },
+                    register: {
+                        additionalFields: [{ name: 'role', required: false }],
+                    },
+                },
+            });
+        });
+        (0, vitest_1.it)('denies a non-admin on CreateOne', async () => {
+            const nonAdmin = await registerAndLogin('member5@std-auth-predicate.co', 'user');
+            const { status } = await e2e_setup_1.server.post('/std-auth-predicate-entries', { title: 'denied' }, { authToken: nonAdmin.accessToken });
+            (0, vitest_1.expect)(status).toBe(403);
+        });
+        (0, vitest_1.it)('denies a non-admin on GetMany', async () => {
+            const nonAdmin = await registerAndLogin('member6@std-auth-predicate.co', 'user');
+            const { status } = await e2e_setup_1.server.get('/std-auth-predicate-entries', { authToken: nonAdmin.accessToken });
+            (0, vitest_1.expect)(status).toBe(403);
+        });
+        (0, vitest_1.it)('allows an admin on both CreateOne and GetMany', async () => {
+            const admin = await registerAndLogin('admin3@std-auth-predicate.co', 'admin');
+            const createResponse = await e2e_setup_1.server.post('/std-auth-predicate-entries', { title: 'allowed' }, { authToken: admin.accessToken });
+            const getManyResponse = await e2e_setup_1.server.get('/std-auth-predicate-entries', { authToken: admin.accessToken });
+            (0, vitest_1.expect)(createResponse.status).toBe(201);
+            (0, vitest_1.expect)(getManyResponse.status).toBe(200);
+            (0, vitest_1.expect)(getManyResponse.body).toHaveLength(1);
+        });
+    });
+});
+//# sourceMappingURL=standard-route-auth-ability-predicate.e2e-spec.js.map

package/test/for-feature/standard-route-auth-ability-predicate.e2e-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standard-route-auth-ability-predicate.e2e-spec.js","sourceRoot":"","sources":["../../../libs/dynamic-api/test/for-feature/standard-route-auth-ability-predicate.e2e-spec.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,mCAAqE;AACrE,+CAAgD;AAChD,uCAAgC;AAChC,mCAAgF;AAChF,4CAAuD;AACvD,yBAAuB;AACvB,sCAAoC;AAmBpC,IAAA,iBAAQ,EAAC,yEAAyE,EAAE,GAAG,EAAE;IAEvF,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,sBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,KAAK,IAAI,EAAE;QACnB,MAAM,IAAA,2BAAe,EAAC,kBAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAGH,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,gBAAU;KASlD,CAAA;IAPC;QADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6DACzB;IAGd;QADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gEACtB;IAGjB;QADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;;4DAC3B;IART,0BAA0B;QAD/B,IAAA,iBAAM,EAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;OAC7C,0BAA0B,CAS/B;IAMD,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,gBAAU;KAGnD,CAAA;IADC;QADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8DACzB;IAFV,2BAA2B;QADhC,IAAA,iBAAM,EAAC,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;OAC/C,2BAA2B,CAGhC;IAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE;QAC7D,MAAM,kBAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,MAAM,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QACvG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAExF,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,EAAY,EAAE,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,OAAoC,EACpC,IAAsB,EACtB,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IAE3B,MAAM,eAAe,GAAG,KAAK,EAAE,MAA4D,EAAE,EAAE;QAC7F,MAAM,IAAA,gBAAO,EACX;YACE,MAAM,EAAE,2BAA2B;YACnC,iBAAiB,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE;YACzD,MAAM;SACP,EACD;YACE,OAAO,EAAE;gBACP,UAAU,EAAE,0BAA0B;gBACtC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE;gBACrF,QAAQ,EAAE;oBACR,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;iBACtD;aACF;SACF,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAA,iBAAQ,EAAC,mFAAmF,EAAE,GAAG,EAAE;QACjG,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,eAAe,CAAC;YAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE;YACpD,EAAE,IAAI,EAAE,SAAS,EAAE;SACpB,CAAC,CAAC,CAAC;QAEJ,IAAA,WAAE,EAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;YAC9G,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;YAEhF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAClC,6BAA6B,EAC7B,EAAE,KAAK,EAAE,yBAAyB,EAAE,EACpC,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,CACpC,CAAC;YAMF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,2DAA2D,EAAE,GAAG,EAAE;QACzE,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,eAAe,CAAC;YAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE;YAC9F,EAAE,IAAI,EAAE,SAAS,EAAE;SACpB,CAAC,CAAC,CAAC;QAEJ,IAAA,WAAE,EAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACpF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAClC,6BAA6B,EAC7B,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAC7B,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,CACpC,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;YAC/B,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;YAE7E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CACxC,6BAA6B,EAC7B,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,CACjC,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAClC,6BAA6B,EAC7B,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,iFAAiF,EAAE,GAAG,EAAE;QAC/F,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,eAAe,CAAC;YAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE;SACnD,CAAC,CAAC,CAAC;QAEJ,IAAA,WAAE,EAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;YACpG,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CACjC,6BAA6B,EAC7B,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,CACpC,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,yDAAyD,EAAE,GAAG,EAAE;QACvE,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,eAAe,CAAC;YAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE;SAC7F,CAAC,CAAC,CAAC;QAEJ,IAAA,WAAE,EAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACpF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CACjC,6BAA6B,EAC7B,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,CACpC,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;YAC/B,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;YAE9E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CACvC,6BAA6B,EAC7B,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,CACjC,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,qGAAqG,EAAE,GAAG,EAAE;QACnH,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;YACpB,MAAM,IAAA,gBAAO,EACX;gBACE,MAAM,EAAE,2BAA2B;gBACnC,iBAAiB,EAAE;oBACjB,IAAI,EAAE,4BAA4B;oBAClC,iBAAiB,EAAE;wBACjB;4BACE,OAAO,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC;4BACjC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;4BACrB,oBAAoB,EAAE,CAAC,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;yBACxE;qBACF;iBACF;gBACD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aACrD,EACD;gBACE,OAAO,EAAE;oBACP,UAAU,EAAE,0BAA0B;oBACtC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE;oBACrF,QAAQ,EAAE;wBACR,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;qBACtD;iBACF;aACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAM,CAAC,IAAI,CAClC,6BAA6B,EAC7B,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnB,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,CACpC,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAM,CAAC,GAAG,CACjC,6BAA6B,EAC7B,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,CACpC,CAAC;YAEF,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;YAE9E,MAAM,cAAc,GAAG,MAAM,kBAAM,CAAC,IAAI,CACtC,6BAA6B,EAC7B,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,CACjC,CAAC;YACF,MAAM,eAAe,GAAG,MAAM,kBAAM,CAAC,GAAG,CACtC,6BAA6B,EAC7B,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,CACjC,CAAC;YAEF,IAAA,eAAM,EAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,IAAA,eAAM,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,IAAA,eAAM,EAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}