piper-utils 1.1.66 → 1.1.67

package/src/audit/audit.test.js

@@ -0,0 +1,313 @@
+import {
+    attachAudit,
+    auditModels,
+    bindAuditRequest,
+    decrementWithAudit,
+    getAuditFilter,
+    getAuditModel,
+    incrementWithAudit,
+    modelOptions
+} from './audit.js';
+
+const buildEvent = ({ uid = '42', email = 'kevin@test.com', auditEnabled = true, businessIds = { '1': 'A' } } = {}) => ({
+    requestContext: {
+        authorizer: {
+            claims: {
+                'custom:UID': uid,
+                'email': email,
+                'custom:SET': JSON.stringify({ auditEnabled }),
+                'custom:AR': JSON.stringify({ businessIds })
+            }
+        }
+    }
+});
+
+const resetState = () => {
+    Object.keys(auditModels).forEach((k) => delete auditModels[k]);
+    Object.keys(modelOptions).forEach((k) => delete modelOptions[k]);
+};
+
+describe('audit', () => {
+    describe('bindAuditRequest', () => {
+        it('binds user from JWT claims and businessId from arg', () => {
+            resetState();
+            const Model = { name: 'Customer' };
+            const event = buildEvent({ uid: '7', email: 'kevin@test.com', auditEnabled: true });
+
+            bindAuditRequest(event, 'BIZ-1', [Model]);
+
+            expect(modelOptions['Customer'].user.username).toEqual('kevin@test.com');
+            expect(modelOptions['Customer'].user.id).toEqual(7);
+            expect(modelOptions['Customer'].businessId).toEqual('BIZ-1');
+            expect(modelOptions['Customer'].auditEnabled).toEqual(true);
+        });
+
+        it('reads auditEnabled=false from custom:SET claim', () => {
+            resetState();
+            const Model = { name: 'Customer' };
+            const event = buildEvent({ auditEnabled: false });
+
+            bindAuditRequest(event, 'BIZ-1', [Model]);
+
+            expect(modelOptions['Customer'].auditEnabled).toEqual(false);
+        });
+
+        it('binds multiple models in one call', () => {
+            resetState();
+            const A = { name: 'ModelA' };
+            const B = { name: 'ModelB' };
+
+            bindAuditRequest(buildEvent(), 'BIZ-1', [A, B]);
+
+            expect(modelOptions['ModelA']).toBeDefined();
+            expect(modelOptions['ModelB']).toBeDefined();
+        });
+    });
+
+    describe('attachAudit', () => {
+        it('defines a <Name>Audit model and wires four hooks', async () => {
+            resetState();
+            const auditModel = {
+                belongsTo: jasmine.createSpy('belongsTo'),
+                sync: jasmine.createSpy('sync').and.resolveTo()
+            };
+            const Model = {
+                name: 'Customer',
+                addHook: jasmine.createSpy('addHook'),
+                sequelize: {
+                    define: jasmine.createSpy('define').and.returnValue(auditModel),
+                    Sequelize: { STRING: 'STRING_TYPE' }
+                }
+            };
+
+            await attachAudit(Model);
+
+            expect(Model.sequelize.define).toHaveBeenCalled();
+            const [name, schema, opts] = Model.sequelize.define.calls.mostRecent().args;
+            expect(name).toEqual('CustomerAudit');
+            expect(schema.changedByUser.allowNull).toEqual(false);
+            expect(schema.businessId.allowNull).toEqual(false);
+            expect(opts).toEqual({ updatedAt: false, freezeTableName: true });
+
+            expect(auditModel.belongsTo).toHaveBeenCalledWith(Model, jasmine.objectContaining({ onDelete: 'SET NULL' }));
+            expect(Model.addHook).toHaveBeenCalledWith('afterCreate', jasmine.any(Function));
+            expect(Model.addHook).toHaveBeenCalledWith('afterUpsert', jasmine.any(Function));
+            expect(Model.addHook).toHaveBeenCalledWith('afterUpdate', jasmine.any(Function));
+            expect(Model.addHook).toHaveBeenCalledWith('afterDestroy', jasmine.any(Function));
+            expect(auditModel.sync).toHaveBeenCalled();
+        });
+
+        it('is idempotent — second call is a no-op', async () => {
+            resetState();
+            const Model = {
+                name: 'Customer',
+                addHook: jasmine.createSpy('addHook'),
+                sequelize: {
+                    define: jasmine.createSpy('define').and.returnValue({
+                        belongsTo: () => {},
+                        sync: () => Promise.resolve()
+                    }),
+                    Sequelize: { STRING: 'STRING_TYPE' }
+                }
+            };
+
+            await attachAudit(Model);
+            await attachAudit(Model);
+
+            expect(Model.sequelize.define).toHaveBeenCalledTimes(1);
+        });
+    });
+
+    describe('audit hook (auditMe via attachAudit)', () => {
+        const buildModel = (name) => {
+            const definedAudit = { belongsTo: () => {}, sync: () => Promise.resolve() };
+            return {
+                name,
+                addHook: jasmine.createSpy('addHook'),
+                sequelize: {
+                    define: jasmine.createSpy('define').and.returnValue(definedAudit),
+                    Sequelize: { STRING: 'STRING_TYPE' }
+                }
+            };
+        };
+        const captureHook = async (Model) => {
+            await attachAudit(Model);
+            const auditModel = auditModels[Model.name];
+            auditModel.create = jasmine.createSpy('create').and.resolveTo();
+            const hook = Model.addHook.calls.allArgs().find(([h]) => h === 'afterCreate')[1];
+            return { hook, auditModel };
+        };
+
+        it('writes changedByUser from bound user, no ChangedByUserId field', async () => {
+            resetState();
+            const Model = buildModel('Widget');
+            const { hook, auditModel } = await captureHook(Model);
+            modelOptions['Widget'] = {
+                user: { username: 'kevin@test.com', id: 7 },
+                businessId: 'BIZ-1',
+                auditEnabled: true
+            };
+
+            await hook(
+                { _changed: ['name'], _previousDataValues: { name: 'old' }, dataValues: { id: 99, name: 'new' } },
+                { type: 'INITIAL' }
+            );
+
+            const writtenRow = auditModel.create.calls.mostRecent().args[0];
+            expect(writtenRow.changedByUser).toEqual('kevin@test.com');
+            expect(writtenRow.businessId).toEqual('BIZ-1');
+            expect(writtenRow.WidgetId).toEqual(99);
+            expect(writtenRow.field).toEqual('name');
+            expect(writtenRow.valueOld).toEqual('old');
+            expect(writtenRow.valueNew).toEqual('new');
+            expect(writtenRow.ChangedByUserId).toBeUndefined();
+        });
+
+        it('skips audit when auditEnabled is false for that model', async () => {
+            resetState();
+            const Model = buildModel('Widget');
+            const { hook, auditModel } = await captureHook(Model);
+            modelOptions['Widget'] = {
+                user: { username: 'kevin@test.com', id: 7 },
+                businessId: 'BIZ-1',
+                auditEnabled: false
+            };
+
+            await hook(
+                { _changed: ['name'], _previousDataValues: { name: 'old' }, dataValues: { id: 99, name: 'new' } },
+                { type: 'INITIAL' }
+            );
+
+            expect(auditModel.create).not.toHaveBeenCalled();
+        });
+
+        it('skips audit when no per-request bind exists for the model', async () => {
+            resetState();
+            const Model = buildModel('Widget');
+            const { hook, auditModel } = await captureHook(Model);
+
+            await hook(
+                { _changed: ['name'], _previousDataValues: { name: 'old' }, dataValues: { id: 99, name: 'new' } },
+                { type: 'INITIAL' }
+            );
+
+            expect(auditModel.create).not.toHaveBeenCalled();
+        });
+
+        it('per-model isolation — binding model A does not enable audit for model B', async () => {
+            resetState();
+            const ModelA = buildModel('A');
+            const ModelB = buildModel('B');
+            const { hook: hookA, auditModel: auditA } = await captureHook(ModelA);
+            const { hook: hookB, auditModel: auditB } = await captureHook(ModelB);
+            modelOptions['A'] = { user: { username: 'k', id: 1 }, businessId: 'B1', auditEnabled: true };
+
+            await hookA({ _changed: ['x'], _previousDataValues: { x: '1' }, dataValues: { id: 1, x: '2' } }, {});
+            await hookB({ _changed: ['x'], _previousDataValues: { x: '1' }, dataValues: { id: 1, x: '2' } }, {});
+
+            expect(auditA.create).toHaveBeenCalled();
+            expect(auditB.create).not.toHaveBeenCalled();
+        });
+
+        it('masks sensitive fields inside array values', async () => {
+            resetState();
+            const Model = buildModel('Widget');
+            const { hook, auditModel } = await captureHook(Model);
+            modelOptions['Widget'] = { user: { username: 'k', id: 1 }, businessId: 'B1', auditEnabled: true };
+
+            await hook(
+                {
+                    _changed: ['tokens'],
+                    _previousDataValues: { tokens: [{ token: 'secret-old' }] },
+                    dataValues: { id: 1, tokens: [{ token: 'secret-new' }] }
+                },
+                {}
+            );
+
+            const row = auditModel.create.calls.mostRecent().args[0];
+            expect(row.valueOld).not.toContain('secret-old');
+            expect(row.valueNew).not.toContain('secret-new');
+            expect(row.valueOld).toContain('***************');
+            expect(row.valueNew).toContain('***************');
+        });
+
+        it('passes the transaction through to auditModel.create when present', async () => {
+            resetState();
+            const Model = buildModel('Widget');
+            const { hook, auditModel } = await captureHook(Model);
+            modelOptions['Widget'] = { user: { username: 'k', id: 1 }, businessId: 'B1', auditEnabled: true };
+
+            await hook(
+                { _changed: ['name'], _previousDataValues: { name: 'a' }, dataValues: { id: 1, name: 'b' } },
+                { transaction: 'TX-1' }
+            );
+
+            expect(auditModel.create.calls.mostRecent().args[1]).toEqual({ transaction: 'TX-1' });
+        });
+    });
+
+    describe('incrementWithAudit / decrementWithAudit', () => {
+        it('increments and writes an audit row using bound context', async () => {
+            resetState();
+            const auditModel = { create: jasmine.createSpy('create').and.resolveTo() };
+            auditModels['Inv'] = auditModel;
+            modelOptions['Inv'] = { user: { username: 'k', id: 1 }, businessId: 'B1', auditEnabled: true };
+
+            const incremented = {
+                _previousDataValues: { qty: 5 },
+                dataValues: { id: 10, qty: 6 }
+            };
+            const model = { increment: jasmine.createSpy('increment').and.resolveTo(incremented) };
+
+            const r = await incrementWithAudit('Inv', model, 'qty', { by: 1, transaction: 'TX' });
+
+            expect(model.increment).toHaveBeenCalledWith('qty', { by: 1, transaction: 'TX' });
+            expect(r._changed).toEqual(['qty']);
+            expect(auditModel.create).toHaveBeenCalled();
+            expect(auditModel.create.calls.mostRecent().args[1]).toEqual({ transaction: 'TX' });
+        });
+
+        it('decrements and writes an audit row', async () => {
+            resetState();
+            const auditModel = { create: jasmine.createSpy('create').and.resolveTo() };
+            auditModels['Rel'] = auditModel;
+            modelOptions['Rel'] = { user: { username: 'k', id: 1 }, businessId: 'B1', auditEnabled: true };
+
+            const decremented = {
+                _previousDataValues: { qty: 6 },
+                dataValues: { id: 11, qty: 5 }
+            };
+            const model = { decrement: jasmine.createSpy('decrement').and.resolveTo(decremented) };
+
+            const r = await decrementWithAudit('Rel', model, 'qty', { by: 1 });
+
+            expect(model.decrement).toHaveBeenCalledWith('qty', { by: 1 });
+            expect(r._changed).toEqual(['qty']);
+            expect(auditModel.create).toHaveBeenCalled();
+        });
+    });
+
+    describe('getAuditModel / getAuditFilter', () => {
+        it('returns the audit model registered for a parent', () => {
+            resetState();
+            const fakeAudit = { name: 'WidgetAudit' };
+            auditModels['Widget'] = fakeAudit;
+            expect(getAuditModel({ name: 'Widget' })).toBe(fakeAudit);
+        });
+
+        it('builds a where filter scoped to caller businessIds with parent FK', () => {
+            resetState();
+            const Widget = { name: 'Widget' };
+            const event = buildEvent({ businessIds: { 'B1': 'A', 'B2': 'R' } });
+
+            const filter = getAuditFilter(Widget, 42, { event, offset: 0, limit: 10 });
+
+            expect(filter.where.WidgetId).toEqual(42);
+            expect(filter.where.businessId).toBeDefined();
+            expect(filter.include[0].model).toBe(Widget);
+            expect(filter.order).toEqual([['createdAt', 'DESC']]);
+            expect(filter.offset).toEqual(0);
+            expect(filter.limit).toEqual(10);
+        });
+    });
+});

package/src/index.js

@@ -34,6 +34,15 @@ import { requireCrmAccess as requireCrmAccessImport, requireTicketAccess as requ
 import { scopeToOwnBusiness as scopeToOwnBusinessImport, scopeToPartnerBook as scopeToPartnerBookImport, scopeToBookUnionOwn as scopeToBookUnionOwnImport } from './database/dbUtils/partnerAccess/accessScope.js';
 import { assertCanWriteOwnBusiness as assertCanWriteOwnBusinessImport, assertCanWriteBookBusiness as assertCanWriteBookBusinessImport, assertCanWriteBookUnionOwn as assertCanWriteBookUnionOwnImport, stampOwnBusinessId as stampOwnBusinessIdImport } from './database/dbUtils/partnerAccess/accessWrites.js';
 import { createAccessHelpers as createAccessHelpersImport } from './database/dbUtils/partnerAccess/createAccessHelpers.js';
+import {
+    attachAudit as attachAuditImport,
+    bindAuditRequest as bindAuditRequestImport,
+    bindAuditRequestForUser as bindAuditRequestForUserImport,
+    decrementWithAudit as decrementWithAuditImport,
+    getAuditFilter as getAuditFilterImport,
+    getAuditModel as getAuditModelImport,
+    incrementWithAudit as incrementWithAuditImport
+} from './audit/audit.js';
 
 export const handleFile = handleFileImport;
 export const watchBucket = watchBucketImport;
@@ -80,3 +89,10 @@ export const assertCanWriteBookBusiness = assertCanWriteBookBusinessImport;
 export const assertCanWriteBookUnionOwn = assertCanWriteBookUnionOwnImport;
 export const stampOwnBusinessId = stampOwnBusinessIdImport;
 export const createAccessHelpers = createAccessHelpersImport;
+export const attachAudit = attachAuditImport;
+export const bindAuditRequest = bindAuditRequestImport;
+export const bindAuditRequestForUser = bindAuditRequestForUserImport;
+export const decrementWithAudit = decrementWithAuditImport;
+export const getAuditFilter = getAuditFilterImport;
+export const getAuditModel = getAuditModelImport;
+export const incrementWithAudit = incrementWithAuditImport;