diff --git a/.snyk b/.snyk index c487fd241..499e8ff45 100644 --- a/.snyk +++ b/.snyk @@ -61,11 +61,6 @@ ignore: reason: 'Transitive dependency in Azurite and related dev/test stacks; forcing uuid to 11.1.1 or 14.0.0 breaks packages that import legacy uuid subpaths such as uuid/v4.' expires: '2026-09-08T00:00:00.000Z' created: '2026-06-10T00:00:00.000Z' - 'SNYK-JS-APOLLOPROTOBUFJS-16321047': - - '* > @apollo/protobufjs': - reason: 'Apollo usage-reporting-protobuf depends on @apollo/protobufjs and Snyk reports no fixed version. We are accepting this temporarily until Apollo provides a non-vulnerable upgrade path.' - expires: '2026-07-31T00:00:00.000Z' - created: '2026-04-30T00:00:00.000Z' 'SNYK-JS-MONGOOSE-16425765': - '* > mongoose@8.17.0': reason: 'Mongoose 8.22.1 has TypeScript constraint errors in type definitions (types/inferrawdoctype.d.ts, types/inferschematype.d.ts) that break compilation. Patch attempts failed due to external library type incompatibilities. Risk is Low: requires control of query field names and values.' diff --git a/apps/ui-staff/src/App.tsx b/apps/ui-staff/src/App.tsx index 0541f62e4..7a64848d5 100644 --- a/apps/ui-staff/src/App.tsx +++ b/apps/ui-staff/src/App.tsx @@ -27,6 +27,8 @@ function StaffRoutes() { const canViewStaffUsers = perms?.canViewStaffUsers === true; const canManageFinance = perms?.canManageFinance === true; const canManageTechAdmin = perms?.canManageTechAdmin === true; + const canViewDatabaseDocuments = perms?.canViewDatabaseDocuments === true; + const canAccessTechAdmin = canManageTechAdmin || canViewDatabaseDocuments; const canViewRoles = perms?.canViewRoles === true; const canAddRole = perms?.canAddRole === true; const canEditRole = perms?.canEditRole === true; @@ -34,7 +36,7 @@ function StaffRoutes() { const canAccessUserManagement = canManageUsers || canAssignStaffRoles || canViewStaffUsers || canManageStaffRolesAndPermissions || canViewRoles || canAddRole || canEditRole || canRemoveRole || canManageTechAdmin; let defaultStaffRoute = '/unauthorized'; - if (canManageTechAdmin) { + if (canAccessTechAdmin) { defaultStaffRoute = '/staff/tech'; } else if (canManageFinance) { defaultStaffRoute = '/staff/finance'; @@ -73,7 +75,7 @@ function StaffRoutes() { element={} /> )} - {canManageTechAdmin && ( + {canAccessTechAdmin && ( } diff --git a/apps/ui-staff/src/hooks/use-staff-permissions.ts b/apps/ui-staff/src/hooks/use-staff-permissions.ts index 3d42e9ed0..5d19ba144 100644 --- a/apps/ui-staff/src/hooks/use-staff-permissions.ts +++ b/apps/ui-staff/src/hooks/use-staff-permissions.ts @@ -34,6 +34,7 @@ const CURRENT_STAFF_USER_QUERY = gql` } techAdminPermissions { canManageTechAdmin + canViewDatabaseDocuments } } } @@ -49,6 +50,7 @@ interface StaffPermissions { canViewStaffUsers: boolean; canManageFinance: boolean; canManageTechAdmin: boolean; + canViewDatabaseDocuments: boolean; canViewRoles: boolean; canAddRole: boolean; canEditRole: boolean; @@ -72,7 +74,7 @@ interface StaffUserQueryResult { userPermissions: { canManageUsers: boolean; canAssignStaffRoles: boolean; canViewStaffUsers: boolean }; staffRolePermissions: { canViewRoles: boolean; canAddRole: boolean; canEditRole: boolean; canRemoveRole: boolean }; financePermissions: { canManageFinance: boolean }; - techAdminPermissions: { canManageTechAdmin: boolean }; + techAdminPermissions: { canManageTechAdmin: boolean; canViewDatabaseDocuments: boolean }; }; }; }; @@ -104,6 +106,7 @@ export const useStaffPermissions = (): { canViewStaffUsers: rolePermissions.userPermissions.canViewStaffUsers || rolePermissions.userPermissions.canManageUsers || isTechAdmin, canManageFinance: rolePermissions.financePermissions.canManageFinance || isTechAdmin, canManageTechAdmin: isTechAdmin, + canViewDatabaseDocuments: rolePermissions.techAdminPermissions.canViewDatabaseDocuments || isTechAdmin, canViewRoles: rolePermissions.staffRolePermissions.canViewRoles || rolePermissions.communityPermissions.canManageStaffRolesAndPermissions || isTechAdmin, canAddRole: rolePermissions.staffRolePermissions.canAddRole || rolePermissions.communityPermissions.canManageStaffRolesAndPermissions || isTechAdmin, canEditRole: rolePermissions.staffRolePermissions.canEditRole || rolePermissions.communityPermissions.canManageStaffRolesAndPermissions || isTechAdmin, diff --git a/packages/ocom-verification/acceptance-api/cucumber.js b/packages/ocom-verification/acceptance-api/cucumber.js index 3c059af85..db3523d08 100644 --- a/packages/ocom-verification/acceptance-api/cucumber.js +++ b/packages/ocom-verification/acceptance-api/cucumber.js @@ -1,5 +1,4 @@ import { isAgent } from 'std-env'; - export default { paths: ['../verification-shared/src/scenarios/**/*.feature'], tags: 'not @ui-only and not @e2e-only and not @skip-api', diff --git a/packages/ocom-verification/acceptance-api/src/contexts/staff-role/tasks/ensure-staff-role-exists.ts b/packages/ocom-verification/acceptance-api/src/contexts/staff-role/tasks/ensure-staff-role-exists.ts index 1fef7d564..e34a9867b 100644 --- a/packages/ocom-verification/acceptance-api/src/contexts/staff-role/tasks/ensure-staff-role-exists.ts +++ b/packages/ocom-verification/acceptance-api/src/contexts/staff-role/tasks/ensure-staff-role-exists.ts @@ -27,6 +27,13 @@ export class EnsureStaffRoleExists extends Task { await CreateStaffRoleAbility.as(actor).performAs(actor, { roleName: this.roleName, enterpriseAppRole: DEFAULT_ENTERPRISE_APP_ROLE }); } catch (error) { const message = error instanceof Error ? error.message : String(error); + // Concurrent create or a prior partial write can race; treat "already exists" as success when the role is visible. + if (message.toLowerCase().includes('already exists')) { + const created = await actor.answer(StaffRoleNamed.called(this.roleName)); + if (created) { + return; + } + } throw new Error(`Could not set up staff role "${this.roleName}": ${message}`); } } diff --git a/packages/ocom-verification/acceptance-api/src/shared/graphql/staff-role-operations.ts b/packages/ocom-verification/acceptance-api/src/shared/graphql/staff-role-operations.ts index 38e66c807..970312743 100644 --- a/packages/ocom-verification/acceptance-api/src/shared/graphql/staff-role-operations.ts +++ b/packages/ocom-verification/acceptance-api/src/shared/graphql/staff-role-operations.ts @@ -41,7 +41,7 @@ export const STAFF_ROLE_PERMISSION_GROUP_BY_KEY: Record ({ techAdminPermissions: { __typename: 'StaffRoleTechAdminPermissions', canManageTechAdmin: false, - canViewDatabaseExplorer: false, + canViewDatabaseDocuments: false, canViewBlobExplorer: false, canViewQueueDashboard: false, canSendQueueMessages: false, diff --git a/packages/ocom-verification/e2e-tests/src/contexts/staff-role/abilities/staff-portal-page.ts b/packages/ocom-verification/e2e-tests/src/contexts/staff-role/abilities/staff-portal-page.ts index 08cd1ca12..052494b3c 100644 --- a/packages/ocom-verification/e2e-tests/src/contexts/staff-role/abilities/staff-portal-page.ts +++ b/packages/ocom-verification/e2e-tests/src/contexts/staff-role/abilities/staff-portal-page.ts @@ -8,7 +8,7 @@ import type { StaffE2ENotes } from '../../staff/abilities/staff-types.ts'; export const ROLES_LIST_PATH = '/staff/user-management/staff-roles'; /** Poll a browser condition until it holds or the timeout elapses. */ -export const waitUntil = async (condition: () => Promise, failureMessage: string, timeoutMs = 20_000): Promise => { +export const waitUntil = async (condition: () => Promise, failureMessage: string | (() => string | Promise), timeoutMs = 20_000): Promise => { const deadline = Date.now() + timeoutMs; while (Date.now() < deadline) { if (await condition()) { @@ -16,7 +16,8 @@ export const waitUntil = async (condition: () => Promise, failureMessag } await new Promise((resolve) => setTimeout(resolve, 250)); } - throw new Error(failureMessage); + const message = typeof failureMessage === 'function' ? await failureMessage() : failureMessage; + throw new Error(message); }; /** Resolve the authenticated staff-portal page for the actor's business role. */ @@ -38,14 +39,37 @@ export const formPageOn = (page: Page): StaffRoleFormPage => new StaffRoleFormPa export const isAtRolesList = (url: URL): boolean => url.pathname.endsWith('/staff-roles'); -/** Navigate to the staff roles list and wait for the table rows to render. */ +/** + * Navigate to the staff roles list and wait for the table rows to render. + * + * Uses `domcontentloaded` rather than `networkidle` — Apollo cache-and-network + * refetches and long-lived connections often prevent networkidle under full-suite load. + */ export const openRolesList = async (page: Page): Promise => { - await page.goto(ROLES_LIST_PATH, { waitUntil: 'networkidle' }); + await page.goto(ROLES_LIST_PATH, { waitUntil: 'domcontentloaded', timeout: 30_000 }); const listPage = listPageOn(page); - await waitUntil(async () => (await listPage.listedRoleNames()).length > 0, 'Timed out waiting for the staff roles list to render'); + await listPage.heading.waitFor({ state: 'visible', timeout: 20_000 }).catch(() => undefined); + await waitUntil( + async () => (await listPage.listedRoleNames()).length > 0, + () => diagnoseEmptyRolesList(page), + ); return listPage; }; +const diagnoseEmptyRolesList = async (page: Page): Promise => { + const pathname = new URL(page.url()).pathname; + const bodyText = ( + await page + .locator('body') + .innerText() + .catch(() => '') + ) + .replace(/\s+/g, ' ') + .trim() + .slice(0, 240); + return `Timed out waiting for the staff roles list to render (path=${pathname}; body="${bodyText}")`; +}; + /** Open the edit form for a role and wait for its values to load. */ export const openEditFormFor = async (page: Page, roleName: string): Promise => { const listPage = await openRolesList(page); diff --git a/packages/ocom-verification/e2e-tests/src/contexts/staff-role/tasks/open-staff-roles-screen.ts b/packages/ocom-verification/e2e-tests/src/contexts/staff-role/tasks/open-staff-roles-screen.ts index 28621b68b..b578f09f1 100644 --- a/packages/ocom-verification/e2e-tests/src/contexts/staff-role/tasks/open-staff-roles-screen.ts +++ b/packages/ocom-verification/e2e-tests/src/contexts/staff-role/tasks/open-staff-roles-screen.ts @@ -1,16 +1,35 @@ import { type Actor, Interaction, notes, the } from '@serenity-js/core'; import type { StaffE2ENotes } from '../../staff/abilities/staff-types.ts'; -import { isAtRolesList, ROLES_LIST_PATH, staffPortalPageOf } from '../abilities/staff-portal-page.ts'; +import { isAtRolesList, listPageOn, ROLES_LIST_PATH, staffPortalPageOf, waitUntil } from '../abilities/staff-portal-page.ts'; /** * Task that navigates to the staff roles screen and records where the router * settled, so authorization redirects can be asserted. + * + * Do not treat the roles-list pathname alone as settled — after + * `domcontentloaded` the SPA may still redirect to `/unauthorized` once + * permissions load. Accept unauthorized immediately, or roles only once the + * list heading is visible. */ export const OpenStaffRolesScreenRecordingPath = () => Interaction.where(the`#actor opens the staff roles screen`, async (serenityActor) => { const actor = serenityActor as unknown as Actor; const page = await staffPortalPageOf(actor); - await page.goto(ROLES_LIST_PATH, { waitUntil: 'networkidle' }); - await page.waitForURL((url) => url.pathname === '/unauthorized' || isAtRolesList(url), { timeout: 20_000 }); + await page.goto(ROLES_LIST_PATH, { waitUntil: 'domcontentloaded', timeout: 30_000 }); + await waitUntil( + async () => { + const { pathname } = new URL(page.url()); + if (pathname === '/unauthorized') { + return true; + } + if (!isAtRolesList(new URL(page.url()))) { + return false; + } + return await listPageOn(page) + .heading.isVisible() + .catch(() => false); + }, + () => `Timed out waiting for unauthorized redirect or staff roles list (still on ${new URL(page.url()).pathname})`, + ); await actor.attemptsTo(notes().set('currentPath', new URL(page.url()).pathname)); }); diff --git a/packages/ocom-verification/verification-shared/src/pages/staff-role-form.page.ts b/packages/ocom-verification/verification-shared/src/pages/staff-role-form.page.ts index f72d1270a..631900927 100644 --- a/packages/ocom-verification/verification-shared/src/pages/staff-role-form.page.ts +++ b/packages/ocom-verification/verification-shared/src/pages/staff-role-form.page.ts @@ -23,7 +23,7 @@ export const STAFF_ROLE_PERMISSION_LABELS: Record = { canViewFinanceConfigs: 'Can View Finance Configs', canCreateFinanceConfigs: 'Can Create Finance Configs', canManageTechAdmin: 'Can Manage Tech Admin', - canViewDatabaseExplorer: 'Can View Database Explorer', + canViewDatabaseDocuments: 'Can View Database Documents', canViewBlobExplorer: 'Can View Blob Explorer', canViewQueueDashboard: 'Can View Queue Dashboard', canSendQueueMessages: 'Can Send Queue Messages', diff --git a/packages/ocom-verification/verification-shared/src/test-data/seed/staff-roles.ts b/packages/ocom-verification/verification-shared/src/test-data/seed/staff-roles.ts index 78e2a13c2..5eda9d319 100644 --- a/packages/ocom-verification/verification-shared/src/test-data/seed/staff-roles.ts +++ b/packages/ocom-verification/verification-shared/src/test-data/seed/staff-roles.ts @@ -30,7 +30,7 @@ interface StaffRolePermissionsSeedDocument { }; techAdminPermissions: { canManageTechAdmin: boolean; - canViewDatabaseExplorer: boolean; + canViewDatabaseDocuments: boolean; canViewBlobExplorer: boolean; canViewQueueDashboard: boolean; canSendQueueMessages: boolean; @@ -104,7 +104,7 @@ function buildPermissions(overrides: Partial): }, techAdminPermissions: { canManageTechAdmin: false, - canViewDatabaseExplorer: false, + canViewDatabaseDocuments: false, canViewBlobExplorer: false, canViewQueueDashboard: false, canSendQueueMessages: false, @@ -154,7 +154,7 @@ export const staffRoles: StaffRoleSeedDocument[] = [ }, techAdminPermissions: { canManageTechAdmin: true, - canViewDatabaseExplorer: true, + canViewDatabaseDocuments: true, canViewBlobExplorer: true, canViewQueueDashboard: true, canSendQueueMessages: true, diff --git a/packages/ocom/application-services/package.json b/packages/ocom/application-services/package.json index f22fef4f1..b1f741282 100644 --- a/packages/ocom/application-services/package.json +++ b/packages/ocom/application-services/package.json @@ -30,7 +30,8 @@ "@ocom/domain": "workspace:*", "@ocom/persistence": "workspace:*", "@ocom/service-blob-storage": "workspace:*", - "@ocom/service-queue-storage": "workspace:*" + "@ocom/service-queue-storage": "workspace:*", + "mongoose": "catalog:" }, "devDependencies": { "@cellix/archunit-tests": "workspace:*", diff --git a/packages/ocom/application-services/src/contexts/tech-admin/database-documents.command-mapper.ts b/packages/ocom/application-services/src/contexts/tech-admin/database-documents.command-mapper.ts new file mode 100644 index 000000000..cf9256cf4 --- /dev/null +++ b/packages/ocom/application-services/src/contexts/tech-admin/database-documents.command-mapper.ts @@ -0,0 +1,61 @@ +type DatabaseDocumentsQueryArgs = { + collection: string; + filter?: string | null | undefined; + page?: number | null | undefined; + pageSize?: number | null | undefined; +}; + +const ALLOWED_OPERATORS = new Set(['$eq', '$in', '$gt', '$gte', '$lt', '$lte', '$exists', '$regex', '$and', '$or', '$not']); + +function validateOperatorKey(key: string): void { + if (!key.startsWith('$')) return; + if (key === '$where' || key === '$function' || key === '$expr') { + throw new Error(`Operator ${key} is not allowed in filter`); + } + if (!ALLOWED_OPERATORS.has(key)) { + throw new Error(`Unknown operator: ${key}`); + } +} + +function validateFilterOperators(obj: unknown): void { + if (obj === null || obj === undefined) return; + if (Array.isArray(obj)) { + for (const item of obj) validateFilterOperators(item); + return; + } + if (typeof obj !== 'object') return; + for (const [k, v] of Object.entries(obj as Record)) { + validateOperatorKey(k); + validateFilterOperators(v); + } +} + +export type DatabaseDocumentsQueryCommand = { + collection: string; + filter: Record; + page: number; + pageSize: number; +}; + +export function buildDatabaseDocumentsQueryCommand(args: DatabaseDocumentsQueryArgs): DatabaseDocumentsQueryCommand { + if (!/^[a-zA-Z0-9_-]+$/.test(args.collection)) { + throw new Error('Invalid collection name'); + } + + let parsedFilter: Record = {}; + if (args.filter) { + try { + parsedFilter = JSON.parse(args.filter) as Record; + } catch { + throw new Error('Invalid filter JSON'); + } + validateFilterOperators(parsedFilter); + } + + return { + collection: args.collection, + filter: parsedFilter, + pageSize: Math.min(Math.max(args.pageSize ?? 20, 1), 100), + page: Math.max(args.page ?? 1, 1), + }; +} diff --git a/packages/ocom/application-services/src/contexts/tech-admin/index.ts b/packages/ocom/application-services/src/contexts/tech-admin/index.ts new file mode 100644 index 000000000..88d26129e --- /dev/null +++ b/packages/ocom/application-services/src/contexts/tech-admin/index.ts @@ -0,0 +1,15 @@ +import { ListCollections } from './list-collections.ts'; +import { DatabaseDocuments } from './query-documents.ts'; +export { buildDatabaseDocumentsQueryCommand } from './database-documents.command-mapper.ts'; + +export interface TechAdminApplicationService { + ListCollections: ReturnType; + DatabaseDocuments: ReturnType; +} + +export const TechAdmin = (): TechAdminApplicationService => { + return { + ListCollections: ListCollections(), + DatabaseDocuments: DatabaseDocuments(), + }; +}; diff --git a/packages/ocom/application-services/src/contexts/tech-admin/list-collections.ts b/packages/ocom/application-services/src/contexts/tech-admin/list-collections.ts new file mode 100644 index 000000000..4b2226f55 --- /dev/null +++ b/packages/ocom/application-services/src/contexts/tech-admin/list-collections.ts @@ -0,0 +1,13 @@ +import mongoose from 'mongoose'; + +export const ListCollections = () => { + return async (): Promise => { + const { db } = mongoose.connection; + if (!db) throw new Error('Database connection is not available'); + const cols = await db.listCollections().toArray(); + return cols + .map((c) => c.name) + .filter((n) => !n.startsWith('system.')) + .sort((a, b) => a.localeCompare(b, 'en', { sensitivity: 'base' })); + }; +}; diff --git a/packages/ocom/application-services/src/contexts/tech-admin/query-documents.ts b/packages/ocom/application-services/src/contexts/tech-admin/query-documents.ts new file mode 100644 index 000000000..adae2329d --- /dev/null +++ b/packages/ocom/application-services/src/contexts/tech-admin/query-documents.ts @@ -0,0 +1,129 @@ +import mongoose from 'mongoose'; + +function normalizeBsonValue(value: unknown): unknown { + if (value === null || value === undefined) return value; + if (Array.isArray(value)) return value.map(normalizeBsonValue); + if (value instanceof Date) return value.toISOString(); + if (value && typeof (value as { toHexString?: unknown }).toHexString === 'function') return (value as { toHexString: () => string }).toHexString(); + if (value && (value as { _bsontype?: unknown })._bsontype === 'Decimal128') return (value as { toString: () => string }).toString(); + if (Buffer.isBuffer(value)) return value.toString('base64'); + if (value instanceof Uint8Array) return Buffer.from(value).toString('base64'); + if (typeof value === 'object') { + const out: Record = {}; + for (const [k, v] of Object.entries(value as Record)) { + out[k] = normalizeBsonValue(v); + } + return out; + } + return value; +} + +const OBJECT_ID_KEYS = new Set(['_id', 'role']); +const objectIdPattern = /^[a-fA-F0-9]{24}$/; + +function normalizeObjectIdValue(value: unknown): unknown { + if (typeof value === 'string' && objectIdPattern.test(value)) { + return new mongoose.Types.ObjectId(value); + } + if (Array.isArray(value)) { + return value.map((item) => normalizeObjectIdValue(item)); + } + if (value && typeof value === 'object') { + const out: Record = {}; + for (const [k, v] of Object.entries(value as Record)) { + out[k] = normalizeObjectIdValue(v); + } + return out; + } + return value; +} + +function normalizeFilterObjectIds(obj: unknown): unknown { + if (obj === null || obj === undefined) return obj; + if (Array.isArray(obj)) { + return obj.map((item) => normalizeFilterObjectIds(item)); + } + if (typeof obj !== 'object') return obj; + const out: Record = {}; + for (const [k, v] of Object.entries(obj as Record)) { + if (k.startsWith('$')) { + out[k] = normalizeFilterObjectIds(v); + continue; + } + if (OBJECT_ID_KEYS.has(k)) { + out[k] = normalizeObjectIdValue(v); + continue; + } + out[k] = normalizeFilterObjectIds(v); + } + return out; +} + +async function enrichStaffUserRoles(collection: string, docs: Record[], db: mongoose.mongo.Db): Promise[]> { + if (collection !== 'users') return docs; + const roleIds = new Set(); + for (const doc of docs) { + //biome-ignore lint:useLiteralKeys + const role = doc['role']; + if (typeof role === 'string' && role.length === 24) roleIds.add(role); + if (role && typeof role === 'object' && typeof (role as { id?: unknown }).id === 'string') roleIds.add((role as { id: string }).id); + } + if (roleIds.size === 0) return docs; + const roleObjectIds = [...roleIds].map((id) => new mongoose.Types.ObjectId(id)); + const roles = await db + .collection('roles') + .find({ _id: { $in: roleObjectIds } }, { projection: { roleName: 1, enterpriseAppRole: 1 } }) + .toArray(); + const roleMap = new Map( + roles.map((role) => [ + String(role._id), + { + //biome-ignore lint:useLiteralKeys + roleName: role['roleName'] ?? null, + //biome-ignore lint:useLiteralKeys + enterpriseAppRole: role['enterpriseAppRole'] ?? null, + }, + ]), + ); + return docs.map((doc) => { + //biome-ignore lint:useLiteralKeys + const roleId = typeof doc['role'] === 'string' ? doc['role'] : ((doc['role'] as { id?: string } | undefined)?.id ?? null); + if (!roleId) return doc; + const roleInfo = roleMap.get(roleId); + if (!roleInfo) return doc; + return { ...doc, role: { id: roleId, ...roleInfo } }; + }); +} + +import type { DatabaseDocumentsQueryCommand } from './database-documents.command-mapper.ts'; + +type DatabaseDocument = { + id: string; + json: string; +}; + +type DatabaseDocumentPage = { + documents: DatabaseDocument[]; + totalCount: number; +}; + +export const DatabaseDocuments = () => { + return async (command: DatabaseDocumentsQueryCommand): Promise => { + const { db } = mongoose.connection; + if (!db) throw new Error('Database connection is not available'); + const skip = (command.page - 1) * command.pageSize; + const coll = db.collection(command.collection); + const filter = normalizeFilterObjectIds(command.filter) as Record; + const totalCount = await coll.countDocuments(filter); + const docs = await coll.find(filter).skip(skip).limit(command.pageSize).toArray(); + const enrichedDocs = await enrichStaffUserRoles(command.collection, docs as Record[], db); + return { + totalCount, + documents: enrichedDocs.map((doc) => { + const sanitized = normalizeBsonValue(doc as Record); + //biome-ignore lint:useLiteralKeys + return { id: String(doc['_id']), json: JSON.stringify(sanitized) }; + }), + }; + }; +}; diff --git a/packages/ocom/application-services/src/contexts/user/index.ts b/packages/ocom/application-services/src/contexts/user/index.ts index 6841b047b..8f1618fd8 100644 --- a/packages/ocom/application-services/src/contexts/user/index.ts +++ b/packages/ocom/application-services/src/contexts/user/index.ts @@ -2,11 +2,13 @@ import type { DataSources } from '@ocom/persistence'; import { EndUser as EndUserApi, type EndUserApplicationService } from './end-user/index.ts'; import { StaffRole as StaffRoleApi, type StaffRoleApplicationService } from './staff-role/index.ts'; import { StaffUser as StaffUserApi, type StaffUserApplicationService } from './staff-user/index.ts'; +import { TechAdmin as TechAdminApi, type TechAdminApplicationService } from '../tech-admin/index.ts'; export interface UserContextApplicationService { EndUser: EndUserApplicationService; StaffRole: StaffRoleApplicationService; StaffUser: StaffUserApplicationService; + TechAdmin: TechAdminApplicationService; } export const User = (dataSources: DataSources): UserContextApplicationService => { @@ -14,5 +16,6 @@ export const User = (dataSources: DataSources): UserContextApplicationService => EndUser: EndUserApi(dataSources), StaffRole: StaffRoleApi(dataSources), StaffUser: StaffUserApi(dataSources), + TechAdmin: TechAdminApi(), }; }; diff --git a/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.test.ts b/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.test.ts index cae33193f..863bf48d3 100644 --- a/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.test.ts +++ b/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.test.ts @@ -34,7 +34,7 @@ function makeStaffRole() { }, techAdminPermissions: { canManageTechAdmin: false, - canViewDatabaseExplorer: false, + canViewDatabaseDocuments: false, canViewBlobExplorer: false, canViewQueueDashboard: false, canSendQueueMessages: false, @@ -160,14 +160,14 @@ describe('applyTechAdminPermissions', () => { const staffRole = makeStaffRole(); applyTechAdminPermissions(staffRole, { canManageTechAdmin: true, - canViewDatabaseExplorer: true, + canViewDatabaseDocuments: true, canViewBlobExplorer: true, canViewQueueDashboard: true, canSendQueueMessages: true, }); const tp = staffRole.permissions.techAdminPermissions; expect(tp.canManageTechAdmin).toBe(true); - expect(tp.canViewDatabaseExplorer).toBe(true); + expect(tp.canViewDatabaseDocuments).toBe(true); expect(tp.canViewBlobExplorer).toBe(true); expect(tp.canViewQueueDashboard).toBe(true); expect(tp.canSendQueueMessages).toBe(true); diff --git a/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.ts b/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.ts index cc4d651e5..0cd2f6ec2 100644 --- a/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.ts +++ b/packages/ocom/application-services/src/contexts/user/staff-role/apply-permissions.ts @@ -31,7 +31,7 @@ export interface StaffRoleCommandFinancePermissions { export interface StaffRoleCommandTechAdminPermissions { canManageTechAdmin?: boolean; - canViewDatabaseExplorer?: boolean; + canViewDatabaseDocuments?: boolean; canViewBlobExplorer?: boolean; canViewQueueDashboard?: boolean; canSendQueueMessages?: boolean; @@ -122,8 +122,8 @@ export const applyTechAdminPermissions = (staffRole: Domain.Contexts.User.StaffR if (permissions.canManageTechAdmin !== undefined) { techAdminPermissions.canManageTechAdmin = permissions.canManageTechAdmin; } - if (permissions.canViewDatabaseExplorer !== undefined) { - techAdminPermissions.canViewDatabaseExplorer = permissions.canViewDatabaseExplorer; + if (permissions.canViewDatabaseDocuments !== undefined) { + techAdminPermissions.canViewDatabaseDocuments = permissions.canViewDatabaseDocuments; } if (permissions.canViewBlobExplorer !== undefined) { techAdminPermissions.canViewBlobExplorer = permissions.canViewBlobExplorer; diff --git a/packages/ocom/application-services/src/contexts/user/staff-role/create.test.ts b/packages/ocom/application-services/src/contexts/user/staff-role/create.test.ts index 00cca3bbb..f7554e631 100644 --- a/packages/ocom/application-services/src/contexts/user/staff-role/create.test.ts +++ b/packages/ocom/application-services/src/contexts/user/staff-role/create.test.ts @@ -44,7 +44,7 @@ type MockFinancePermissions = { type MockTechAdminPermissions = { canManageTechAdmin: boolean; - canViewDatabaseExplorer: boolean; + canViewDatabaseDocuments: boolean; canViewBlobExplorer: boolean; canViewQueueDashboard: boolean; canSendQueueMessages: boolean; @@ -102,7 +102,7 @@ function makeMockStaffRoleInstance(roleName: string): MockStaffRoleInstance { }; const techAdminPermissions: MockTechAdminPermissions = { canManageTechAdmin: false, - canViewDatabaseExplorer: false, + canViewDatabaseDocuments: false, canViewBlobExplorer: false, canViewQueueDashboard: false, canSendQueueMessages: false, diff --git a/packages/ocom/application-services/src/contexts/user/staff-role/features/apply-permissions.feature b/packages/ocom/application-services/src/contexts/user/staff-role/features/apply-permissions.feature new file mode 100644 index 000000000..6ab9c8c86 --- /dev/null +++ b/packages/ocom/application-services/src/contexts/user/staff-role/features/apply-permissions.feature @@ -0,0 +1,64 @@ +Feature: Apply Staff Role Permissions + + Background: + Given a staff role with all permissions set to false + + Scenario: Apply community permissions + When I apply community permissions with all values set to true + Then the community permissions should all be true + + Scenario: Apply partial community permissions + When I apply community permissions with only canManageCommunities set to true + Then only canManageCommunities should be true + + Scenario: Apply undefined community permissions + When I apply undefined community permissions + Then the community permissions should remain unchanged + + Scenario: Apply user permissions + When I apply user permissions with all values set to true + Then the user permissions should all be true + + Scenario: Apply partial user permissions + When I apply user permissions with only canViewStaffUsers set to true + Then only canViewStaffUsers should be true + + Scenario: Apply undefined user permissions + When I apply undefined user permissions + Then the user permissions should remain unchanged + + Scenario: Apply staff role permissions + When I apply staff role permissions with all values set to true + Then the staff role permissions should all be true + + Scenario: Apply partial staff role permissions + When I apply staff role permissions with only canEditRole set to true + Then only canEditRole should be true + + Scenario: Apply undefined staff role permissions + When I apply undefined staff role permissions + Then the staff role permissions should remain unchanged + + Scenario: Apply finance permissions + When I apply finance permissions with all values set to true + Then the finance permissions should all be true + + Scenario: Apply partial finance permissions + When I apply finance permissions with only canViewFinanceConfigs set to true + Then only canViewFinanceConfigs should be true + + Scenario: Apply undefined finance permissions + When I apply undefined finance permissions + Then the finance permissions should remain unchanged + + Scenario: Apply tech admin permissions + When I apply tech admin permissions with all values set to true + Then the tech admin permissions should all be true + + Scenario: Apply partial tech admin permissions + When I apply tech admin permissions with only canViewDatabaseDocuments set to true + Then only canViewDatabaseDocuments should be true + + Scenario: Apply undefined tech admin permissions + When I apply undefined tech admin permissions + Then the tech admin permissions should remain unchanged \ No newline at end of file diff --git a/packages/ocom/application-services/src/index.ts b/packages/ocom/application-services/src/index.ts index 9e5407886..a6987dcc2 100644 --- a/packages/ocom/application-services/src/index.ts +++ b/packages/ocom/application-services/src/index.ts @@ -3,13 +3,16 @@ import { Domain } from '@ocom/domain'; import { Community, type CommunityContextApplicationService } from './contexts/community/index.ts'; import { Service, type ServiceContextApplicationService } from './contexts/service/index.ts'; import { User, type UserContextApplicationService } from './contexts/user/index.ts'; +import { TechAdmin, type TechAdminApplicationService } from './contexts/tech-admin/index.ts'; export type { CommunityUpdateSettingsCommand } from './contexts/community/index.ts'; +export { buildDatabaseDocumentsQueryCommand } from './contexts/tech-admin/index.ts'; export interface ApplicationServices { Community: CommunityContextApplicationService; Service: ServiceContextApplicationService; User: UserContextApplicationService; + TechAdmin: TechAdminApplicationService; get verifiedUser(): VerifiedUser | null; } @@ -74,6 +77,7 @@ export const buildApplicationServicesFactory = (context: ApiContextSpec): Applic Community: Community(dataSources, blobStorageService, queueStorageService), Service: Service(dataSources), User: User(dataSources), + TechAdmin: TechAdmin(), get verifiedUser(): VerifiedUser | null { return { ...tokenValidationResult, hints: hints }; }, diff --git a/packages/ocom/data-sources-mongoose-models/src/models/role/staff-role.model.ts b/packages/ocom/data-sources-mongoose-models/src/models/role/staff-role.model.ts index 6099c443f..708a21e88 100644 --- a/packages/ocom/data-sources-mongoose-models/src/models/role/staff-role.model.ts +++ b/packages/ocom/data-sources-mongoose-models/src/models/role/staff-role.model.ts @@ -57,7 +57,7 @@ export interface StaffRoleFinancePermissions { export interface StaffRoleTechAdminPermissions { id?: ObjectId; canManageTechAdmin: boolean; - canViewDatabaseExplorer: boolean; + canViewDatabaseDocuments: boolean; canViewBlobExplorer: boolean; canViewQueueDashboard: boolean; canSendQueueMessages: boolean; @@ -152,7 +152,7 @@ const StaffRoleSchema = new Schema, StaffRole>( } as SchemaDefinition, techAdminPermissions: { canManageTechAdmin: { type: Boolean, required: true, default: false }, - canViewDatabaseExplorer: { type: Boolean, required: true, default: false }, + canViewDatabaseDocuments: { type: Boolean, required: true, default: false }, canViewBlobExplorer: { type: Boolean, required: true, default: false }, canViewQueueDashboard: { type: Boolean, required: true, default: false }, canSendQueueMessages: { type: Boolean, required: true, default: false }, diff --git a/packages/ocom/domain/src/domain/contexts/user/staff-role/features/staff-role-tech-admin-permissions.feature b/packages/ocom/domain/src/domain/contexts/user/staff-role/features/staff-role-tech-admin-permissions.feature index 33816afec..9d8aa9d34 100644 --- a/packages/ocom/domain/src/domain/contexts/user/staff-role/features/staff-role-tech-admin-permissions.feature +++ b/packages/ocom/domain/src/domain/contexts/user/staff-role/features/staff-role-tech-admin-permissions.feature @@ -19,14 +19,14 @@ Feature: StaffRoleTechAdminPermissions When I try to set canManageTechAdmin to true Then a PermissionError should be thrown - Scenario: Changing canViewDatabaseExplorer with manage staff roles permission + Scenario: Changing canViewDatabaseDocuments with manage staff roles permission Given a StaffRoleTechAdminPermissions entity with permission to manage staff roles - When I set canViewDatabaseExplorer to true + When I set canViewDatabaseDocuments to true Then the property should be updated to true - Scenario: Changing canViewDatabaseExplorer without permission + Scenario: Changing canViewDatabaseDocuments without permission Given a StaffRoleTechAdminPermissions entity without permission to manage staff roles or system account - When I try to set canViewDatabaseExplorer to true + When I try to set canViewDatabaseDocuments to true Then a PermissionError should be thrown Scenario: Changing canViewBlobExplorer with manage staff roles permission @@ -62,7 +62,7 @@ Feature: StaffRoleTechAdminPermissions Scenario: Reading tech admin permission flags Given a StaffRoleTechAdminPermissions entity with all permission flags set to true Then canManageTechAdmin should be true - And canViewDatabaseExplorer should be true + And canViewDatabaseDocuments should be true And canViewBlobExplorer should be true And canViewQueueDashboard should be true And canSendQueueMessages should be true diff --git a/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-permissions.ts b/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-permissions.ts index 4f0f8677d..acaf7b5b1 100644 --- a/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-permissions.ts +++ b/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-permissions.ts @@ -113,7 +113,7 @@ export class StaffRolePermissions extends ValueObject return new StaffRoleTechAdminPermissions( this.props.techAdminPermissions ?? { canManageTechAdmin: false, - canViewDatabaseExplorer: false, + canViewDatabaseDocuments: false, canViewBlobExplorer: false, canViewQueueDashboard: false, canSendQueueMessages: false, diff --git a/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.test.ts b/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.test.ts index 07bcae739..29079b750 100644 --- a/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.test.ts +++ b/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.test.ts @@ -18,7 +18,7 @@ function makeVisa({ canManageStaffRolesAndPermissions = true, isSystemAccount = function makeProps(overrides = {}) { return { canManageTechAdmin: false, - canViewDatabaseExplorer: false, + canViewDatabaseDocuments: false, canViewBlobExplorer: false, canViewQueueDashboard: false, canSendQueueMessages: false, @@ -89,28 +89,28 @@ test.for(feature, ({ Scenario, Background, BeforeEachScenario }) => { }); }); - Scenario('Changing canViewDatabaseExplorer with manage staff roles permission', ({ Given, When, Then }) => { + Scenario('Changing canViewDatabaseDocuments with manage staff roles permission', ({ Given, When, Then }) => { Given('a StaffRoleTechAdminPermissions entity with permission to manage staff roles', () => { visa = makeVisa({ canManageStaffRolesAndPermissions: true, isSystemAccount: false }); entity = new StaffRoleTechAdminPermissions(makeProps(), visa); }); - When('I set canViewDatabaseExplorer to true', () => { - entity.canViewDatabaseExplorer = true; + When('I set canViewDatabaseDocuments to true', () => { + entity.canViewDatabaseDocuments = true; }); Then('the property should be updated to true', () => { - expect(entity.canViewDatabaseExplorer).toBe(true); + expect(entity.canViewDatabaseDocuments).toBe(true); }); }); - Scenario('Changing canViewDatabaseExplorer without permission', ({ Given, When, Then }) => { + Scenario('Changing canViewDatabaseDocuments without permission', ({ Given, When, Then }) => { let setWithoutPermission: () => void; Given('a StaffRoleTechAdminPermissions entity without permission to manage staff roles or system account', () => { visa = makeVisa({ canManageStaffRolesAndPermissions: false, isSystemAccount: false }); entity = new StaffRoleTechAdminPermissions(makeProps(), visa); }); - When('I try to set canViewDatabaseExplorer to true', () => { + When('I try to set canViewDatabaseDocuments to true', () => { setWithoutPermission = () => { - entity.canViewDatabaseExplorer = true; + entity.canViewDatabaseDocuments = true; }; }); Then('a PermissionError should be thrown', () => { @@ -213,7 +213,7 @@ test.for(feature, ({ Scenario, Background, BeforeEachScenario }) => { Given('a StaffRoleTechAdminPermissions entity with all permission flags set to true', () => { props = makeProps({ canManageTechAdmin: true, - canViewDatabaseExplorer: true, + canViewDatabaseDocuments: true, canViewBlobExplorer: true, canViewQueueDashboard: true, canSendQueueMessages: true, @@ -223,8 +223,8 @@ test.for(feature, ({ Scenario, Background, BeforeEachScenario }) => { Then('canManageTechAdmin should be true', () => { expect(entity.canManageTechAdmin).toBe(true); }); - And('canViewDatabaseExplorer should be true', () => { - expect(entity.canViewDatabaseExplorer).toBe(true); + And('canViewDatabaseDocuments should be true', () => { + expect(entity.canViewDatabaseDocuments).toBe(true); }); And('canViewBlobExplorer should be true', () => { expect(entity.canViewBlobExplorer).toBe(true); diff --git a/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.ts b/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.ts index 9d225e6c7..dbce9fd89 100644 --- a/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.ts +++ b/packages/ocom/domain/src/domain/contexts/user/staff-role/staff-role-tech-admin-permissions.ts @@ -5,7 +5,7 @@ import type { UserVisa } from '../user.visa.ts'; interface StaffRoleTechAdminPermissionsSpec { canManageTechAdmin: boolean; - canViewDatabaseExplorer: boolean; + canViewDatabaseDocuments: boolean; canViewBlobExplorer: boolean; canViewQueueDashboard: boolean; canSendQueueMessages: boolean; @@ -36,12 +36,12 @@ export class StaffRoleTechAdminPermissions extends ValueObject unknown>; const Mutation = { - ...(staffRoleResolvers.Mutation ?? {}), ...(staffUserResolvers.Mutation ?? {}), } as Record unknown>; diff --git a/packages/ocom/graphql/src/schema/types/tech-admin.graphql b/packages/ocom/graphql/src/schema/types/tech-admin.graphql new file mode 100644 index 000000000..db819e836 --- /dev/null +++ b/packages/ocom/graphql/src/schema/types/tech-admin.graphql @@ -0,0 +1,14 @@ +type DatabaseDocument { + id: String! + json: String! +} + +type DatabaseDocumentPage { + documents: [DatabaseDocument!]! + totalCount: Int! +} + +extend type Query { + techAdminDatabaseCollections: [String!]! + techAdminDatabaseDocuments(collection: String!, filter: String, page: Int, pageSize: Int): DatabaseDocumentPage! +} diff --git a/packages/ocom/graphql/src/schema/types/tech-admin.resolvers.test.ts b/packages/ocom/graphql/src/schema/types/tech-admin.resolvers.test.ts new file mode 100644 index 000000000..572b3a1e5 --- /dev/null +++ b/packages/ocom/graphql/src/schema/types/tech-admin.resolvers.test.ts @@ -0,0 +1,661 @@ +import { type FieldNode, type GraphQLObjectType, type GraphQLResolveInfo, type GraphQLSchema, Kind, type OperationDefinitionNode } from 'graphql'; +import mongoose from 'mongoose'; +import { beforeEach, describe, expect, it, vi } from 'vitest'; + +import type { GraphContext } from '../context.ts'; +import techAdminResolvers from './tech-admin.resolvers.ts'; + +type JwtOverride = { + sub?: string; +}; + +type MockStaffUser = { + role?: { + permissions?: { + techAdminPermissions?: { + canViewDatabaseDocuments?: boolean; + canManageTechAdmin?: boolean; + }; + }; + }; +}; + +type MockStaffUserService = GraphContext['applicationServices']['User']['StaffUser'] & { + queryByExternalId: ReturnType; +}; + +type MockTechAdminService = { + ListCollections: ReturnType; + DatabaseDocuments: ReturnType; +}; + +type TestGraphContext = Omit & { + applicationServices: Omit & { + User: Omit & { + StaffUser: MockStaffUserService; + }; + TechAdmin: MockTechAdminService; + }; +}; + +function makeMockInfo(fieldName: string): GraphQLResolveInfo { + const mockFieldNode: FieldNode = { + kind: Kind.FIELD, + name: { + kind: Kind.NAME, + value: fieldName, + }, + }; + + return { + fieldName, + fieldNodes: [mockFieldNode], + returnType: {} as GraphQLObjectType, + parentType: {} as GraphQLObjectType, + path: { + key: fieldName, + prev: undefined, + typename: undefined, + }, + schema: {} as GraphQLSchema, + fragments: {}, + rootValue: {}, + operation: {} as OperationDefinitionNode, + variableValues: {}, + } as unknown as GraphQLResolveInfo; +} + +function makeMockGraphContext(options: { jwt?: JwtOverride | null; staffUser?: MockStaffUser } = {}): TestGraphContext { + const { jwt = {}, staffUser } = options; + + return { + applicationServices: { + User: { + StaffUser: { + queryByExternalId: vi.fn().mockResolvedValue(staffUser), + }, + }, + verifiedUser: + jwt === null + ? undefined + : { + verifiedJwt: { + sub: 'user-123', + ...jwt, + }, + }, + TechAdmin: { + ListCollections: vi.fn().mockImplementation(async () => { + const { db } = mongoose.connection; + if (!db) throw new Error('Database connection is not available'); + const cols = await db.listCollections().toArray(); + return cols + .map((c) => c.name) + .filter((n) => !n.startsWith('system.')) + .sort((a, b) => a.localeCompare(b, 'en', { sensitivity: 'base' })); + }), + DatabaseDocuments: vi.fn().mockImplementation(async (command: { collection: string; filter: Record; page: number; pageSize: number }) => { + const { db } = mongoose.connection; + if (!db) throw new Error('Database connection is not available'); + const cols = await db.listCollections().toArray(); + const available = cols.map((c) => c.name).filter((n) => !n.startsWith('system.')); + if (!available.includes(command.collection)) { + throw new Error('Collection not found or not allowed'); + } + const coll = db.collection(command.collection); + const totalCount = await coll.countDocuments(command.filter); + const docs = await coll + .find(command.filter) + .skip((command.page - 1) * command.pageSize) + .limit(command.pageSize) + .toArray(); + return { + totalCount, + documents: docs.map((d) => ({ id: String((d as { _id?: unknown })._id), json: JSON.stringify(d) })), + }; + }), + }, + }, + } as unknown as TestGraphContext; +} + +const Query = { + ...(techAdminResolvers.Query ?? {}), +} as Record unknown>; + +const callQuery = (name: string, context: TestGraphContext, args: object = {}) => Query[name]?.({}, args, context, makeMockInfo(name)) as Promise; + +let mockCollections: { name: string }[]; +let mockDocuments: Record[]; + +let countDocumentsMock: ReturnType; +let skipMock: ReturnType; +let limitMock: ReturnType; +let toArrayMock: ReturnType; +let findMock: ReturnType; +let collectionMock: ReturnType; + +beforeEach(() => { + vi.restoreAllMocks(); + + mockCollections = [{ name: 'users' }, { name: 'roles' }, { name: 'system.profile' }]; + + mockDocuments = []; + + countDocumentsMock = vi.fn().mockResolvedValue(0); + + toArrayMock = vi.fn().mockResolvedValue(mockDocuments); + + limitMock = vi.fn().mockReturnValue({ + toArray: toArrayMock, + }); + + skipMock = vi.fn().mockReturnValue({ + limit: limitMock, + }); + + findMock = vi.fn().mockReturnValue({ + skip: skipMock, + }); + + collectionMock = vi.fn().mockReturnValue({ + countDocuments: countDocumentsMock, + find: findMock, + }); + + vi.spyOn(mongoose, 'connection', 'get').mockReturnValue({ + db: { + listCollections: vi.fn().mockReturnValue({ + toArray: vi.fn().mockResolvedValue(mockCollections), + }), + collection: collectionMock, + }, + } as never); +}); +describe('techAdminDatabaseCollections', () => { + let context: TestGraphContext; + + beforeEach(() => { + context = makeMockGraphContext(); + }); + + it('throws Unauthorized when JWT is missing', async () => { + context = makeMockGraphContext({ + jwt: null, + }); + + await expect(callQuery('techAdminDatabaseCollections', context)).rejects.toThrow('Unauthorized'); + }); + + it('throws Unauthorized when user cannot view or manage Tech Admin', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: false, + canManageTechAdmin: false, + }, + }, + }, + }, + }); + + await expect(callQuery('techAdminDatabaseCollections', context)).rejects.toThrow('Unauthorized'); + + expect(context.applicationServices.User.StaffUser.queryByExternalId).toHaveBeenCalledWith({ + externalId: 'user-123', + }); + }); + + it('throws Unauthorized for database collections and documents when user lacks permission', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: false, + canManageTechAdmin: false, + }, + }, + }, + }, + }); + + await expect(callQuery('techAdminDatabaseCollections', context)).rejects.toThrow('Unauthorized'); + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + }), + ).rejects.toThrow('Unauthorized'); + }); + + it('allows users with canViewDatabaseDocuments permission', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + canManageTechAdmin: false, + }, + }, + }, + }, + }); + + const result = await callQuery('techAdminDatabaseCollections', context); + + expect(result).toEqual(['roles', 'users']); + }); + + it('allows users with canManageTechAdmin permission', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: false, + canManageTechAdmin: true, + }, + }, + }, + }, + }); + + const result = await callQuery('techAdminDatabaseCollections', context); + + expect(result).toEqual(['roles', 'users']); + }); + + it('filters out system collections', async () => { + mockCollections = [{ name: 'users' }, { name: 'roles' }, { name: 'system.profile' }, { name: 'system.indexes' }, { name: 'orders' }]; + + vi.spyOn(mongoose, 'connection', 'get').mockReturnValue({ + db: { + listCollections: vi.fn().mockReturnValue({ + toArray: vi.fn().mockResolvedValue(mockCollections), + }), + collection: collectionMock, + }, + } as never); + + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + const result = await callQuery('techAdminDatabaseCollections', context); + + expect(result).toEqual(['orders', 'roles', 'users']); + + expect(result).not.toContain('system.profile'); + expect(result).not.toContain('system.indexes'); + }); + + it('returns collections sorted alphabetically', async () => { + mockCollections = [{ name: 'zebra' }, { name: 'apple' }, { name: 'Monkey' }, { name: 'banana' }]; + + vi.spyOn(mongoose, 'connection', 'get').mockReturnValue({ + db: { + listCollections: vi.fn().mockReturnValue({ + toArray: vi.fn().mockResolvedValue(mockCollections), + }), + collection: collectionMock, + }, + } as never); + + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + const result = await callQuery('techAdminDatabaseCollections', context); + + expect(result).toEqual(['apple', 'banana', 'Monkey', 'zebra']); + }); + + it('throws when database connection is unavailable', async () => { + vi.spyOn(mongoose, 'connection', 'get').mockReturnValue({ + db: undefined, + } as never); + + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await expect(callQuery('techAdminDatabaseCollections', context)).rejects.toThrow('Database connection is not available'); + }); + + it('calls queryByExternalId with JWT subject', async () => { + context = makeMockGraphContext({ + jwt: { + sub: 'external-user-id', + }, + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await callQuery('techAdminDatabaseCollections', context); + + expect(context.applicationServices.User.StaffUser.queryByExternalId).toHaveBeenCalledTimes(1); + + expect(context.applicationServices.User.StaffUser.queryByExternalId).toHaveBeenCalledWith({ + externalId: 'external-user-id', + }); + }); + it('throws Unauthorized when JWT is missing', async () => { + context = makeMockGraphContext({ + jwt: null, + }); + + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + }), + ).rejects.toThrow('Unauthorized'); + }); + it('throws Unauthorized when user lacks permissions', async () => { + context = makeMockGraphContext({ + staffUser: {}, + }); + + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + }), + ).rejects.toThrow('Unauthorized'); + }); + it('throws for invalid collection name', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: '../users', + }), + ).rejects.toThrow('Invalid collection name'); + }); + it('throws when collection does not exist', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: 'unknown', + }), + ).rejects.toThrow('Collection not found or not allowed'); + }); + it('throws for invalid filter JSON', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + filter: '{invalid}', + }), + ).rejects.toThrow('Invalid filter JSON'); + }); + it('rejects $where operator', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + filter: JSON.stringify({ + $where: 'this.age > 18', + }), + }), + ).rejects.toThrow('Operator $where is not allowed in filter'); + }); + it('rejects unknown operators', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await expect( + callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + filter: JSON.stringify({ + name: { + $foo: 'abc', + }, + }), + }), + ).rejects.toThrow('Unknown operator: $foo'); + }); + it('caps pageSize at 100', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + page: 1, + pageSize: 500, + }); + + expect(limitMock).toHaveBeenCalledWith(100); + }); + it('uses page 1 when page is less than 1', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + page: -5, + pageSize: 20, + }); + + expect(skipMock).toHaveBeenCalledWith(0); + }); + it('calculates skip correctly', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + await callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + page: 3, + pageSize: 10, + }); + + expect(skipMock).toHaveBeenCalledWith(20); + }); + it('passes parsed filter to countDocuments', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + const filter = { + name: 'John', + }; + + await callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + filter: JSON.stringify(filter), + }); + + expect(countDocumentsMock).toHaveBeenCalledWith(filter); + }); + it('passes parsed filter to find', async () => { + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + const filter = { + email: 'abc@test.com', + }; + + await callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + filter: JSON.stringify(filter), + }); + + expect(findMock).toHaveBeenCalledWith(filter); + }); + it('returns totalCount', async () => { + countDocumentsMock.mockResolvedValue(45); + + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + const result = await callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + }); + + expect(result).toMatchObject({ + totalCount: 45, + }); + }); + it('returns empty documents when none found', async () => { + mockDocuments = []; + toArrayMock.mockResolvedValue(mockDocuments); + + context = makeMockGraphContext({ + staffUser: { + role: { + permissions: { + techAdminPermissions: { + canViewDatabaseDocuments: true, + }, + }, + }, + }, + }); + + const result = await callQuery('techAdminDatabaseDocuments', context, { + collection: 'users', + }); + + expect(result).toEqual({ + documents: [], + totalCount: 0, + }); + }); +}); diff --git a/packages/ocom/graphql/src/schema/types/tech-admin.resolvers.ts b/packages/ocom/graphql/src/schema/types/tech-admin.resolvers.ts new file mode 100644 index 000000000..49f0b22cd --- /dev/null +++ b/packages/ocom/graphql/src/schema/types/tech-admin.resolvers.ts @@ -0,0 +1,59 @@ +import { GraphQLError, type GraphQLResolveInfo } from 'graphql'; +import type { Resolvers } from '../builder/generated.ts'; +import type { GraphContext } from '../context.ts'; +import { buildDatabaseDocumentsQueryCommand } from '@ocom/application-services'; + +function unauthorizedError() { + return new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } }); +} + +function userInputError(message: string) { + return new GraphQLError(message, { extensions: { code: 'BAD_USER_INPUT' } }); +} + +const techAdminResolvers: Resolvers = { + Query: { + techAdminDatabaseCollections: async (_parent: unknown, _args: unknown, context: GraphContext, _info: GraphQLResolveInfo) => { + const jwt = context.applicationServices.verifiedUser?.verifiedJwt; + if (!jwt) { + throw unauthorizedError(); + } + + const staff = await context.applicationServices.User.StaffUser.queryByExternalId({ externalId: jwt.sub }); + + const canView = staff?.role?.permissions?.techAdminPermissions?.canViewDatabaseDocuments === true; + const canManage = staff?.role?.permissions?.techAdminPermissions?.canManageTechAdmin === true; + if (!canView && !canManage) { + throw unauthorizedError(); + } + + return await context.applicationServices.TechAdmin.ListCollections(); + }, + + techAdminDatabaseDocuments: async (_parent: unknown, args, context: GraphContext, _info: GraphQLResolveInfo) => { + const jwt = context.applicationServices.verifiedUser?.verifiedJwt; + if (!jwt) { + throw unauthorizedError(); + } + + const staff = await context.applicationServices.User.StaffUser.queryByExternalId({ externalId: jwt.sub }); + + const canView = staff?.role?.permissions?.techAdminPermissions?.canViewDatabaseDocuments === true; + const canManage = staff?.role?.permissions?.techAdminPermissions?.canManageTechAdmin === true; + if (!canView && !canManage) { + throw unauthorizedError(); + } + + const command = (() => { + try { + return buildDatabaseDocumentsQueryCommand(args); + } catch (error) { + throw userInputError((error as Error).message); + } + })(); + return await context.applicationServices.TechAdmin.DatabaseDocuments(command); + }, + }, +}; + +export default techAdminResolvers; diff --git a/packages/ocom/persistence/src/datasources/domain/community/member/member-invitation.repository.test.ts b/packages/ocom/persistence/src/datasources/domain/community/member/member-invitation.repository.test.ts index d9ff9c1d4..3a19f4a0b 100644 --- a/packages/ocom/persistence/src/datasources/domain/community/member/member-invitation.repository.test.ts +++ b/packages/ocom/persistence/src/datasources/domain/community/member/member-invitation.repository.test.ts @@ -75,6 +75,7 @@ test.for(feature, ({ Scenario, Background, BeforeEachScenario }) => { })), find: vi.fn((query: Record) => ({ exec: vi.fn(() => { + // biome-ignore lint:useLiteralKeys if (query['communityId'] === 'empty-community') return []; return [invitationDoc]; }), diff --git a/packages/ocom/persistence/src/datasources/domain/user/staff-role/features/staff-role.domain-adapter.feature b/packages/ocom/persistence/src/datasources/domain/user/staff-role/features/staff-role.domain-adapter.feature index 3fba1f420..35221f752 100644 --- a/packages/ocom/persistence/src/datasources/domain/user/staff-role/features/staff-role.domain-adapter.feature +++ b/packages/ocom/persistence/src/datasources/domain/user/staff-role/features/staff-role.domain-adapter.feature @@ -234,13 +234,13 @@ Feature: StaffRoleDomainAdapter When I set the canManageTechAdmin property to true Then the techAdminPermissions' canManageTechAdmin should be true - Scenario: Getting and setting canViewDatabaseExplorer from techAdminPermissions + Scenario: Getting and setting canViewDatabaseDocuments from techAdminPermissions Given a StaffRoleDomainAdapter for the document When I get the permissions property And I get the techAdminPermissions property - Then the canViewDatabaseExplorer property should return false - When I set the canViewDatabaseExplorer property to true - Then the techAdminPermissions' canViewDatabaseExplorer should be true + Then the canViewDatabaseDocuments property should return false + When I set the canViewDatabaseDocuments property to true + Then the techAdminPermissions' canViewDatabaseDocuments should be true Scenario: Getting and setting canViewBlobExplorer from techAdminPermissions Given a StaffRoleDomainAdapter for the document diff --git a/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.test.ts b/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.test.ts index bcf9cf40e..24b9264b8 100644 --- a/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.test.ts +++ b/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.test.ts @@ -147,6 +147,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Scenario('Getting the enterpriseAppRole property when missing', ({ Given, When, Then }) => { Given('a StaffRoleDomainAdapter for the document with no enterpriseAppRole', () => { doc = makeStaffRoleDoc(); + // biome-ignore lint:useLiteralKeys (doc as unknown as Record)['enterpriseAppRole'] = undefined; adapter = new StaffRoleDomainAdapter(doc); }); @@ -737,7 +738,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => }); }); - Scenario('Getting and setting canViewDatabaseExplorer from techAdminPermissions', ({ Given, When, And, Then }) => { + Scenario('Getting and setting canViewDatabaseDocuments from techAdminPermissions', ({ Given, When, And, Then }) => { let permissions: StaffRolePermissionsAdapter; let techAdminPermissions: StaffRoleTechAdminPermissionsAdapter; Given('a StaffRoleDomainAdapter for the document', () => { @@ -749,14 +750,14 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => And('I get the techAdminPermissions property', () => { techAdminPermissions = permissions.techAdminPermissions as StaffRoleTechAdminPermissionsAdapter; }); - Then('the canViewDatabaseExplorer property should return false', () => { - expect(techAdminPermissions.canViewDatabaseExplorer).toBe(false); + Then('the canViewDatabaseDocuments property should return false', () => { + expect(techAdminPermissions.canViewDatabaseDocuments).toBe(false); }); - When('I set the canViewDatabaseExplorer property to true', () => { - techAdminPermissions.canViewDatabaseExplorer = true; + When('I set the canViewDatabaseDocuments property to true', () => { + techAdminPermissions.canViewDatabaseDocuments = true; }); - Then("the techAdminPermissions' canViewDatabaseExplorer should be true", () => { - expect(doc.permissions?.techAdminPermissions?.canViewDatabaseExplorer).toBe(true); + Then("the techAdminPermissions' canViewDatabaseDocuments should be true", () => { + expect(doc.permissions?.techAdminPermissions?.canViewDatabaseDocuments).toBe(true); }); }); @@ -878,6 +879,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => docWithoutPermissions.set = vi.fn().mockImplementation((key: string, value: unknown) => { (docWithoutPermissions as unknown as Record)[key] = value; }); + // biome-ignore lint:useLiteralKeys (docWithoutPermissions as unknown as Record)['permissions'] = undefined; adapter = new StaffRoleDomainAdapter(docWithoutPermissions); }); @@ -894,6 +896,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no communityPermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['communityPermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); @@ -917,6 +920,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no financePermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['financePermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); @@ -940,6 +944,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no techAdminPermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['techAdminPermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); @@ -963,6 +968,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no userPermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['userPermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); @@ -984,6 +990,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Scenario('Getting roleType returns null when document roleType is undefined', ({ Given, When, Then }) => { Given('a StaffRoleDomainAdapter wrapping a document with no roleType', () => { const docWithout = makeStaffRoleDoc(); + // biome-ignore lint:useLiteralKeys (docWithout as unknown as Record)['roleType'] = undefined; adapter = new StaffRoleDomainAdapter(docWithout); }); @@ -1149,6 +1156,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no propertyPermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['propertyPermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); @@ -1172,6 +1180,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no servicePermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['servicePermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); @@ -1195,6 +1204,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no serviceTicketPermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['serviceTicketPermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); @@ -1218,6 +1228,7 @@ test.for(domainAdapterFeature, ({ Scenario, Background, BeforeEachScenario }) => Given('a StaffRoleDomainAdapter wrapping a document with no violationTicketPermissions sub-document', () => { const docWithout = makeStaffRoleDoc(); if (docWithout.permissions) { + // biome-ignore lint:useLiteralKeys (docWithout.permissions as unknown as Record)['violationTicketPermissions'] = undefined; } adapter = new StaffRoleDomainAdapter(docWithout); diff --git a/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.ts b/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.ts index 1a94a9907..d14d4958b 100644 --- a/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.ts +++ b/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.domain-adapter.ts @@ -140,7 +140,7 @@ export class StaffRolePermissionsAdapter implements Domain.Contexts.User.StaffRo if (!this.doc.techAdminPermissions) { this.doc.techAdminPermissions = { canManageTechAdmin: false, - canViewDatabaseExplorer: false, + canViewDatabaseDocuments: false, canViewBlobExplorer: false, canViewQueueDashboard: false, canSendQueueMessages: false, @@ -406,11 +406,11 @@ export class StaffRoleTechAdminPermissionsAdapter implements Domain.Contexts.Use this.doc.canManageTechAdmin = value; } - get canViewDatabaseExplorer(): boolean { - return this.ensureValue(this.doc.canViewDatabaseExplorer); + get canViewDatabaseDocuments(): boolean { + return this.ensureValue(this.doc.canViewDatabaseDocuments); } - set canViewDatabaseExplorer(value: boolean) { - this.doc.canViewDatabaseExplorer = value; + set canViewDatabaseDocuments(value: boolean) { + this.doc.canViewDatabaseDocuments = value; } get canViewBlobExplorer(): boolean { diff --git a/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.repository.ts b/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.repository.ts index e0e2acb49..1eba4fb76 100644 --- a/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.repository.ts +++ b/packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.repository.ts @@ -30,7 +30,7 @@ export class StaffRoleRepository async getDefaultRoleByEnterpriseAppRole(enterpriseAppRole: string): Promise> { const staffRole = await this.model.findOne({ isDefault: true, enterpriseAppRole }).exec(); if (!staffRole) { - throw new NotFoundError(`Default StaffRole with enterpriseAppRole ${enterpriseAppRole} not found`); + throw new Error(`Default StaffRole with enterpriseAppRole ${enterpriseAppRole} not found`); } return this.typeConverter.toDomain(staffRole, this.passport); } diff --git a/packages/ocom/persistence/src/datasources/readonly/index.ts b/packages/ocom/persistence/src/datasources/readonly/index.ts index 5845c7d6b..875d9dfce 100644 --- a/packages/ocom/persistence/src/datasources/readonly/index.ts +++ b/packages/ocom/persistence/src/datasources/readonly/index.ts @@ -4,8 +4,8 @@ import type * as Community from './community/community/index.ts'; import { CommunityContext } from './community/index.ts'; import type * as Member from './community/member/index.ts'; import type * as EndUser from './user/end-user/index.ts'; -import { UserContext } from './user/index.ts'; import type * as StaffRole from './user/staff-role/index.ts'; +import { UserContext } from './user/index.ts'; import type * as StaffUser from './user/staff-user/index.ts'; export interface ReadonlyDataSource { diff --git a/packages/ocom/persistence/src/datasources/readonly/mongo-data-source.ts b/packages/ocom/persistence/src/datasources/readonly/mongo-data-source.ts index d58165aed..8303ded7f 100644 --- a/packages/ocom/persistence/src/datasources/readonly/mongo-data-source.ts +++ b/packages/ocom/persistence/src/datasources/readonly/mongo-data-source.ts @@ -55,8 +55,8 @@ export class MongoDataSourceImpl implements private appendId(doc: LeanBase): Lean { const id = doc._id; - const stringId = typeof id === 'string' ? id : hasToHexString(id) ? id.toHexString() : null; - if (stringId === null) { + const stringId = typeof id === 'string' ? id : hasToHexString(id) ? id.toHexString() : id != null ? String(id) : null; + if (stringId === null || stringId === '' || stringId === 'undefined' || stringId === 'null') { throw new TypeError('MongoDB document is missing a string-compatible _id'); } return { diff --git a/packages/ocom/persistence/src/datasources/readonly/user/staff-role/staff-role.read-repository.test.ts b/packages/ocom/persistence/src/datasources/readonly/user/staff-role/staff-role.read-repository.test.ts index 5b586d7ae..3f517d441 100644 --- a/packages/ocom/persistence/src/datasources/readonly/user/staff-role/staff-role.read-repository.test.ts +++ b/packages/ocom/persistence/src/datasources/readonly/user/staff-role/staff-role.read-repository.test.ts @@ -1,14 +1,14 @@ import path from 'node:path'; import { fileURLToPath } from 'node:url'; import { describeFeature, loadFeature } from '@amiceli/vitest-cucumber'; -import type { StaffRole, StaffRoleModelType } from '@ocom/data-sources-mongoose-models/role/staff-role'; +import { expect, vi } from 'vitest'; import type { Domain } from '@ocom/domain'; -import { expect, vi } from 'vitest'; +import type { StaffRole, StaffRoleModelType } from '@ocom/data-sources-mongoose-models/role/staff-role'; import type { ModelsContext } from '../../../../index.ts'; import { StaffRoleConverter } from '../../../domain/user/staff-role/staff-role.domain-adapter.ts'; -import type { StaffRoleReadRepository } from './staff-role.read-repository.ts'; import { getStaffRoleReadRepository } from './staff-role.read-repository.ts'; +import type { StaffRoleReadRepository } from './staff-role.read-repository.ts'; const test = { for: describeFeature }; diff --git a/packages/ocom/persistence/src/datasources/readonly/user/staff-user/staff-user.read-repository.test.ts b/packages/ocom/persistence/src/datasources/readonly/user/staff-user/staff-user.read-repository.test.ts index 9bd5f9932..ba6ae2598 100644 --- a/packages/ocom/persistence/src/datasources/readonly/user/staff-user/staff-user.read-repository.test.ts +++ b/packages/ocom/persistence/src/datasources/readonly/user/staff-user/staff-user.read-repository.test.ts @@ -1,14 +1,14 @@ import path from 'node:path'; import { fileURLToPath } from 'node:url'; import { describeFeature, loadFeature } from '@amiceli/vitest-cucumber'; -import type { StaffUser, StaffUserModelType } from '@ocom/data-sources-mongoose-models/user/staff-user'; +import { expect, vi } from 'vitest'; import type { Domain } from '@ocom/domain'; -import { expect, vi } from 'vitest'; +import type { StaffUser, StaffUserModelType } from '@ocom/data-sources-mongoose-models/user/staff-user'; import type { ModelsContext } from '../../../../index.ts'; import { StaffUserConverter } from '../../../domain/user/staff-user/staff-user.domain-adapter.ts'; -import type { StaffUserReadRepository } from './staff-user.read-repository.ts'; import { getStaffUserReadRepository } from './staff-user.read-repository.ts'; +import type { StaffUserReadRepository } from './staff-user.read-repository.ts'; const test = { for: describeFeature }; diff --git a/packages/ocom/ui-community-route-accounts/src/components/community-list.tsx b/packages/ocom/ui-community-route-accounts/src/components/community-list.tsx index aac337ff8..901ed7afc 100644 --- a/packages/ocom/ui-community-route-accounts/src/components/community-list.tsx +++ b/packages/ocom/ui-community-route-accounts/src/components/community-list.tsx @@ -119,12 +119,12 @@ export const CommunityList: React.FC = (props) => {

Navigate to a Community

- +
= (pr const { data: membersData, loading: membersLoading, error: membersError } = useQuery(AdminSectionLayoutContainerMembersForCurrentEndUserDocument); + return ( = { component: SectionLayout, decorators: [ (Story) => ( - + boolean; } @@ -51,12 +52,14 @@ export const MenuComponent: React.FC = ({ pageLayouts, membe key={child.id} title={child.title} > - - {child.title} - + {!child.hideSelfLinkWhenHasChildren && ( + + {child.title} + + )} {buildMenu(child.id)} ) : ( diff --git a/packages/ocom/ui-staff-route-tech-admin/package.json b/packages/ocom/ui-staff-route-tech-admin/package.json index a1622d8fb..cc8132e18 100644 --- a/packages/ocom/ui-staff-route-tech-admin/package.json +++ b/packages/ocom/ui-staff-route-tech-admin/package.json @@ -15,14 +15,20 @@ }, "dependencies": { "@ant-design/icons": "catalog:", + "@graphql-typed-document-node/core": "^3.2.0", "@ocom/ui-staff-shared": "workspace:*", "react": "catalog:", "react-dom": "catalog:", - "react-router-dom": "catalog:" + "react-router-dom": "catalog:", + "antd": "catalog:", + "@apollo/client": "^3.13.9", + "@cellix/ui-core": "workspace:*" }, + "devDependencies": { "@cellix/config-typescript": "workspace:*", "@cellix/config-vitest": "workspace:*", + "@testing-library/react": "^16.3.0", "@types/react": "^19.1.11", "@types/react-dom": "^19.1.6", "jsdom": "catalog:", diff --git a/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.container.graphql b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.container.graphql new file mode 100644 index 000000000..cecda10ed --- /dev/null +++ b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.container.graphql @@ -0,0 +1,10 @@ +query TechAdminDatabaseExplorerContainerCollections { + techAdminDatabaseCollections +} + +query TechAdminDatabaseExplorerContainerDocuments($collection: String!, $filter: String, $page: Int, $pageSize: Int) { + techAdminDatabaseDocuments(collection: $collection, filter: $filter, page: $page, pageSize: $pageSize) { + documents { id json } + totalCount + } +} diff --git a/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.container.tsx b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.container.tsx new file mode 100644 index 000000000..5a2028a89 --- /dev/null +++ b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.container.tsx @@ -0,0 +1,79 @@ +import type React from 'react'; +import { useMemo, useState } from 'react'; +import { useQuery, gql } from '@apollo/client'; +import { DatabaseExplorer } from './database-explorer.tsx'; +import { ComponentQueryLoader } from '@cellix/ui-core'; +import type { DatabaseDocument } from './database-explorer.tsx'; +import { Empty } from 'antd'; + +const COLLECTIONS_QUERY = gql` +query TechAdminDatabaseExplorerContainerCollections { + techAdminDatabaseCollections +} +`; + +const DOCUMENTS_QUERY = gql` +query TechAdminDatabaseExplorerContainerDocuments($collection: String!, $filter: String, $page: Int, $pageSize: Int) { + techAdminDatabaseDocuments(collection: $collection, filter: $filter, page: $page, pageSize: $pageSize) { + documents { id json } + totalCount + } +} +`; + +interface DocumentsQueryResult { + techAdminDatabaseDocuments: { + documents: { id: string; json: string }[]; + totalCount: number; + }; +} + +export const DatabaseExplorerContainer: React.FC = () => { + const [selectedCollection, setSelectedCollection] = useState(undefined); + const [draftFilter, setDraftFilter] = useState(''); + const [appliedFilter, setAppliedFilter] = useState(''); + const [page, setPage] = useState(1); + const [pageSize, setPageSize] = useState(20); + + const { data: collectionsData, loading: collectionsLoading, error: collectionsError } = useQuery<{ techAdminDatabaseCollections: string[] }>(COLLECTIONS_QUERY, { fetchPolicy: 'cache-first' }); + + const variables = useMemo(() => ({ collection: selectedCollection ?? '', filter: appliedFilter ?? undefined, page, pageSize }), [selectedCollection, appliedFilter, page, pageSize]); + const { data: documentsData, loading: documentsLoading } = useQuery(DOCUMENTS_QUERY, { + variables, + skip: !selectedCollection, + pollInterval: 5000, + }); + + const collections = collectionsData?.techAdminDatabaseCollections ?? []; + const documents: DatabaseDocument[] = (documentsData?.techAdminDatabaseDocuments?.documents ?? []).map((d: { id: string; json: string }) => ({ id: d.id, json: d.json })); + const totalCount = documentsData?.techAdminDatabaseDocuments?.totalCount ?? 0; + + return ( + + ) : ( + { setSelectedCollection(c); setPage(1); }} + filter={draftFilter} + onChangeFilter={setDraftFilter} + onApplyFilter={() => { setAppliedFilter(draftFilter); setPage(1); }} + documents={documents} + totalCount={totalCount} + page={page} + pageSize={pageSize} + onChangePage={(p: number, ps?: number) => { setPage(p); if (ps) setPageSize(ps); }} + loading={documentsLoading} + /> + ) + } + noDataComponent={} + /> + ); +}; diff --git a/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.stories.tsx b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.stories.tsx new file mode 100644 index 000000000..8eae69c39 --- /dev/null +++ b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.stories.tsx @@ -0,0 +1,19 @@ +import { DatabaseExplorer } from './database-explorer.tsx'; + +export default { title: 'Tech Admin/Database Explorer' }; + +export const Default = () => ( + undefined} + filter="" + onChangeFilter={() => undefined} + onApplyFilter={() => undefined} + documents={[{ id: '1', json: JSON.stringify({ name: 'Alice', age: 30 }) }]} + totalCount={1} + page={1} + pageSize={20} + onChangePage={() => undefined} + /> +); diff --git a/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.test.tsx b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.test.tsx new file mode 100644 index 000000000..fd690ee2f --- /dev/null +++ b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.test.tsx @@ -0,0 +1,79 @@ +import { fireEvent, render, screen } from '@testing-library/react'; +import { beforeEach, expect, test, vi } from 'vitest'; +import { DatabaseExplorer } from './database-explorer.tsx'; + +const writeTextMock = vi.fn(); + +beforeEach(() => { + writeTextMock.mockReset(); + Object.defineProperty(globalThis.navigator, 'clipboard', { + value: { writeText: writeTextMock }, + configurable: true, + }); +}); + +test('renders database explorer title', () => { + render( + undefined} + filter="" + onChangeFilter={() => undefined} + onApplyFilter={() => undefined} + documents={[]} + totalCount={0} + page={1} + pageSize={20} + onChangePage={() => undefined} + />, + ); + + expect(screen.getByText(/Database Explorer/i)).toBeTruthy(); +}); + +test('opens full JSON modal from action button', () => { + render( + undefined} + filter="" + onChangeFilter={() => undefined} + onApplyFilter={() => undefined} + documents={[{ id: '1', json: JSON.stringify({ name: 'Alice', age: 30 }) }]} + totalCount={1} + page={1} + pageSize={20} + onChangePage={() => undefined} + />, + ); + + fireEvent.click(screen.getByLabelText('Open JSON modal for 1')); + + expect(screen.getByText('Full JSON')).toBeTruthy(); + expect(screen.getByText(/"Alice"/)).toBeTruthy(); + expect(screen.getByText('string')).toBeTruthy(); +}); + +test('copies json when clipboard icon is clicked', () => { + render( + undefined} + filter="" + onChangeFilter={() => undefined} + onApplyFilter={() => undefined} + documents={[{ id: '1', json: JSON.stringify({ name: 'Alice', age: 30 }) }]} + totalCount={1} + page={1} + pageSize={20} + onChangePage={() => undefined} + />, + ); + + fireEvent.click(screen.getByLabelText('Copy JSON for 1')); + + expect(writeTextMock).toHaveBeenCalledWith('{"name":"Alice","age":30}'); +}); diff --git a/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.tsx b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.tsx new file mode 100644 index 000000000..e4df9aeed --- /dev/null +++ b/packages/ocom/ui-staff-route-tech-admin/src/components/database-explorer.tsx @@ -0,0 +1,297 @@ +import { CopyOutlined, ExpandOutlined } from '@ant-design/icons'; +import { Button, Input, Modal, Select, Space, Table, Tooltip, Typography } from 'antd'; +import type { TableColumnsType } from 'antd'; +import type React from 'react'; +import { useState } from 'react'; + +const { Title } = Typography; +const { TextArea } = Input; +export interface DatabaseDocument { + id: string; + json: string; +} + +type JsonPrimitive = string | number | boolean | null; +type JsonValue = JsonPrimitive | JsonObject | JsonValue[]; +type JsonObject = { [key: string]: JsonValue }; + +interface DatabaseExplorerProps { + collections: string[]; + selectedCollection?: string; + onSelectCollection: (col: string) => void; + filter: string; + onChangeFilter: (val: string) => void; + onApplyFilter: () => void; + documents: DatabaseDocument[]; + totalCount: number; + page: number; + pageSize: number; + onChangePage: (page: number, pageSize?: number) => void; + loading?: boolean; +} + +export const DatabaseExplorer: React.FC = ({ + collections, + selectedCollection, + onSelectCollection, + filter, + onChangeFilter, + onApplyFilter, + documents, + totalCount, + page, + pageSize, + onChangePage, + loading, +}) => { + const [isJsonModalOpen, setIsJsonModalOpen] = useState(false); + const [selectedJson, setSelectedJson] = useState(''); + + const getJsonType = (value: JsonValue): string => { + if (Array.isArray(value)) { + return 'array'; + } + if (value === null) { + return 'null'; + } + return typeof value; + }; + + const renderJsonValue = (value: JsonValue): string => { + if (typeof value === 'string') { + return `"${value}"`; + } + if (value === null) { + return 'null'; + } + return String(value); + }; + + const renderJsonLines = (value: JsonValue, depth = 0): React.ReactNode[] => { + const indent = ' '.repeat(depth); + const childIndent = ' '.repeat(depth + 1); + + if (Array.isArray(value)) { + const lines: React.ReactNode[] = [
{indent}[
]; + value.forEach((item: JsonValue, index: number) => { + if (item !== null && typeof item === 'object') { + lines.push(...renderJsonLines(item, depth + 1)); + } else { + lines.push( +
+ {childIndent} + {getJsonType(item)}{' '} + {renderJsonValue(item)} + {index < value.length - 1 ? ',' : ''} +
, + ); + } + }); + lines.push(
{indent}]
); + return lines; + } + + if (value !== null && typeof value === 'object') { + const entries = Object.entries(value); + const lines: React.ReactNode[] = [
{indent}{'{'}
]; + entries.forEach(([field, fieldValue]: [string, JsonValue], index: number) => { + const isLast = index === entries.length - 1; + if (fieldValue !== null && typeof fieldValue === 'object') { + lines.push( +
+ {childIndent} + "{field}" + :{' '} + {getJsonType(fieldValue)} +
, + ); + const childLines = renderJsonLines(fieldValue, depth + 1); + if (isLast) { + lines.push(...childLines); + } else { + const lastLine = childLines[childLines.length - 1]; + lines.push(...childLines.slice(0, -1)); + lines.push( +
+ {lastLine} + , +
, + ); + } + return; + } + + lines.push( +
+ {childIndent} + "{field}" + :{' '} + {getJsonType(fieldValue)}{' '} + {renderJsonValue(fieldValue)} + {isLast ? '' : ','} +
, + ); + }); + lines.push(
{indent}{'}'}
); + return lines; + } + + return [ +
+ {indent} + {getJsonType(value)}{' '} + {renderJsonValue(value)} +
, + ]; + }; + + const renderSelectedJson = (): React.ReactNode => { + try { + const parsed = JSON.parse(selectedJson) as JsonValue; + return ( +
+ {renderJsonLines(parsed)} +
+ ); + } catch (_error) { + return ( + 
+					{selectedJson}
+
+ ); + } + }; + + const columns: TableColumnsType = [ + { title: 'ID', dataIndex: 'id', key: 'id' }, + { + title: 'Preview', + dataIndex: 'json', + key: 'preview', + render: (json: string) => { + try { + const obj = JSON.parse(json); + return 
{JSON.stringify(obj, null, 2)}
; + } catch (_e) { + return Invalid JSON; + } + }, + }, + { + title: 'Actions', + key: 'actions', + render: (_value: unknown, record: DatabaseDocument) => ( + + +