Checkpoint interrupted develop for task staff-prod-ready-0930
Task: staff-prod-ready-0930 Run: 4ea6adb5-b850-4f90-ad7b-74f92749b406
This commit is contained in:
KAgent
parent
29428cee08
commit
89621ea069
22 changed files with 1711 additions and 80 deletions
167
api/openapi.yaml
167
api/openapi.yaml
|
|
@ -74,6 +74,26 @@ paths:
|
|||
responses:
|
||||
'204': { description: Сессия завершена }
|
||||
'403': { description: Запрос с постороннего сайта отклонён }
|
||||
/access-grants:
|
||||
post:
|
||||
summary: Выпустить ключ доступа для роли
|
||||
operationId: createStaffAccessGrant
|
||||
tags: [Authentication]
|
||||
security: [{ bearerAuth: [] }]
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
type: object
|
||||
required: [role, display_name]
|
||||
properties:
|
||||
role: { type: string, enum: [point_manager, accountant, director] }
|
||||
display_name: { type: string, minLength: 1, maxLength: 255 }
|
||||
org_unit_ids: { type: array, items: { type: string } }
|
||||
responses:
|
||||
'201': { description: Ключ выпущен }
|
||||
'403': { description: Недостаточно прав }
|
||||
/portal:
|
||||
get:
|
||||
summary: Получить доступную пользователю сводку посещаемости и табеля
|
||||
|
|
@ -311,6 +331,30 @@ paths:
|
|||
'200': { description: Ключ выпущен; на сервере сохранён только его SHA-256 отпечаток }
|
||||
'403': { description: Недостаточно прав }
|
||||
'404': { description: Сотрудник не найден }
|
||||
/employees/{employeeId}/biometric-consent:
|
||||
put:
|
||||
summary: Установить согласие сотрудника на обработку биометрии
|
||||
operationId: setEmployeeBiometricConsent
|
||||
tags: [Employees]
|
||||
security: [{ bearerAuth: [] }]
|
||||
parameters:
|
||||
- in: path
|
||||
name: employeeId
|
||||
required: true
|
||||
schema: { $ref: '#/components/schemas/Ulid' }
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
type: object
|
||||
required: [status]
|
||||
properties:
|
||||
status: { type: string, enum: [granted, revoked] }
|
||||
document_ref: { type: string }
|
||||
responses:
|
||||
'200': { description: Согласие сохранено }
|
||||
'403': { description: Недостаточно прав }
|
||||
/employees/{employeeId}/pay-assignment:
|
||||
get:
|
||||
summary: Получить зарплатный профиль сотрудника
|
||||
|
|
@ -372,6 +416,15 @@ paths:
|
|||
type: array
|
||||
items: { type: object }
|
||||
'403': { description: Недостаточно прав }
|
||||
/notifications:
|
||||
get:
|
||||
summary: Получить уведомления
|
||||
operationId: getBatchNotifications
|
||||
tags: [Notifications]
|
||||
security: [{ bearerAuth: [] }]
|
||||
responses:
|
||||
'200': { description: Список уведомлений }
|
||||
'403': { description: Недостаточно прав }
|
||||
/org-units:
|
||||
get:
|
||||
summary: Получить доступные торговые точки
|
||||
|
|
@ -476,6 +529,92 @@ paths:
|
|||
responses:
|
||||
'200': { description: 'Начисления, выплаты, остаток и подтверждённые часы' }
|
||||
'403': { description: Недостаточно прав }
|
||||
/payroll/batches:
|
||||
post:
|
||||
summary: Сформировать зарплатный пакет подразделения
|
||||
operationId: createPayrollBatch
|
||||
tags: [Payroll]
|
||||
security: [{ bearerAuth: [] }]
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
type: object
|
||||
required: [org_unit_id, from, to]
|
||||
properties:
|
||||
org_unit_id: { $ref: '#/components/schemas/Ulid' }
|
||||
from: { type: string, format: date }
|
||||
to: { type: string, format: date }
|
||||
responses:
|
||||
'201': { description: Пакет сформирован }
|
||||
'403': { description: Недостаточно прав }
|
||||
/payroll/batches/{id}:
|
||||
get:
|
||||
summary: Получить зарплатный пакет
|
||||
operationId: getPayrollBatch
|
||||
tags: [Payroll]
|
||||
security: [{ bearerAuth: [] }]
|
||||
parameters:
|
||||
- in: path
|
||||
name: id
|
||||
required: true
|
||||
schema: { $ref: '#/components/schemas/Ulid' }
|
||||
responses:
|
||||
'200': { description: Зарплатный пакет }
|
||||
'403': { description: Недостаточно прав }
|
||||
'404': { description: Пакет не найден }
|
||||
/payroll/batches/{id}/submit:
|
||||
post:
|
||||
summary: Отправить зарплатный пакет на подпись
|
||||
operationId: submitPayrollBatch
|
||||
tags: [Payroll]
|
||||
security: [{ bearerAuth: [] }]
|
||||
parameters:
|
||||
- in: path
|
||||
name: id
|
||||
required: true
|
||||
schema: { $ref: '#/components/schemas/Ulid' }
|
||||
responses:
|
||||
'200': { description: Пакет отправлен }
|
||||
'403': { description: Недостаточно прав }
|
||||
'409': { description: Пакет уже подписан }
|
||||
/payroll/batches/{id}/sign:
|
||||
post:
|
||||
summary: Подписать зарплатный пакет и начислить в реестр
|
||||
operationId: signPayrollBatch
|
||||
tags: [Payroll]
|
||||
security: [{ bearerAuth: [] }]
|
||||
parameters:
|
||||
- in: path
|
||||
name: id
|
||||
required: true
|
||||
schema: { $ref: '#/components/schemas/Ulid' }
|
||||
responses:
|
||||
'200': { description: Пакет подписан }
|
||||
'403': { description: Недостаточно прав }
|
||||
'409': { description: Пакет возвращён из-за изменения смен }
|
||||
/payroll/batches/{id}/return:
|
||||
post:
|
||||
summary: Вернуть зарплатный пакет на доработку
|
||||
operationId: returnPayrollBatch
|
||||
tags: [Payroll]
|
||||
security: [{ bearerAuth: [] }]
|
||||
parameters:
|
||||
- in: path
|
||||
name: id
|
||||
required: true
|
||||
schema: { $ref: '#/components/schemas/Ulid' }
|
||||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
comment: { type: string }
|
||||
responses:
|
||||
'200': { description: Пакет возвращён }
|
||||
'403': { description: Недостаточно прав }
|
||||
/payroll/calculate:
|
||||
post:
|
||||
summary: Рассчитать зарплату за период
|
||||
|
|
@ -567,6 +706,20 @@ paths:
|
|||
lines: { type: array, items: { type: object } }
|
||||
'403': { description: Недостаточно прав }
|
||||
'404': { description: Расчёт не найден }
|
||||
/payroll/runs/{runId}/verify:
|
||||
get:
|
||||
summary: Проверить воспроизводимость расчёта зарплаты
|
||||
operationId: verifyStaffPayrollRun
|
||||
tags: [Payroll]
|
||||
security: [{ bearerAuth: [] }]
|
||||
parameters:
|
||||
- in: path
|
||||
name: runId
|
||||
required: true
|
||||
schema: { $ref: '#/components/schemas/Ulid' }
|
||||
responses:
|
||||
'200': { description: Результат сверки }
|
||||
'403': { description: Недостаточно прав }
|
||||
/imports/owner-workbook:
|
||||
post:
|
||||
summary: Идемпотентно импортировать локально разобранную книгу владельца
|
||||
|
|
@ -957,6 +1110,20 @@ paths:
|
|||
'400': { $ref: '#/components/responses/BadRequest' }
|
||||
'401': { description: Недействительный токен устройства }
|
||||
'403': { description: Устройство отозвано или заблокировано }
|
||||
/terminal/employees/{employeeId}/enrollment:
|
||||
get:
|
||||
summary: Проверить статус биометрической регистрации для терминала
|
||||
operationId: getTerminalEmployeeEnrollment
|
||||
tags: [Terminal]
|
||||
security: [{ bearerAuth: [] }]
|
||||
parameters:
|
||||
- in: path
|
||||
name: employeeId
|
||||
required: true
|
||||
schema: { $ref: '#/components/schemas/Ulid' }
|
||||
responses:
|
||||
'200': { description: Статус регистрации }
|
||||
'403': { description: Недостаточно прав }
|
||||
components:
|
||||
securitySchemes:
|
||||
bearerAuth:
|
||||
|
|
|
|||
|
|
@ -5,23 +5,23 @@ services:
|
|||
build:
|
||||
context: ../..
|
||||
environment:
|
||||
NODE_ENV: development
|
||||
NODE_ENV: production
|
||||
HOST: 0.0.0.0
|
||||
PORT: 8080
|
||||
LOG_LEVEL: info
|
||||
STAFF_RUNTIME_MODE: standalone
|
||||
STANDALONE_ACCESS: employee
|
||||
STANDALONE_MANAGER_TOKEN: ${STANDALONE_MANAGER_TOKEN}
|
||||
STANDALONE_TERMINAL_TOKEN: ${STANDALONE_TERMINAL_TOKEN}
|
||||
STANDALONE_TENANT_ID: ${STANDALONE_TENANT_ID}
|
||||
STANDALONE_ACTOR_ID: ${STANDALONE_ACTOR_ID}
|
||||
STANDALONE_TERMINAL_ACTOR_ID: ${STANDALONE_TERMINAL_ACTOR_ID}
|
||||
VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
|
||||
VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
|
||||
VAPID_SUBJECT: ${VAPID_SUBJECT}
|
||||
DATABASE_URL: postgres://krona_staff_app:${POSTGRES_APP_PASSWORD}@postgres:5432/krona_staff
|
||||
STANDALONE_MANAGER_TOKEN: ${STANDALONE_MANAGER_TOKEN:?STANDALONE_MANAGER_TOKEN is required}
|
||||
STANDALONE_TERMINAL_TOKEN: ${STANDALONE_TERMINAL_TOKEN:?STANDALONE_TERMINAL_TOKEN is required}
|
||||
STANDALONE_TENANT_ID: ${STANDALONE_TENANT_ID:?STANDALONE_TENANT_ID is required}
|
||||
STANDALONE_ACTOR_ID: ${STANDALONE_ACTOR_ID:?STANDALONE_ACTOR_ID is required}
|
||||
STANDALONE_TERMINAL_ACTOR_ID: ${STANDALONE_TERMINAL_ACTOR_ID:?STANDALONE_TERMINAL_ACTOR_ID is required}
|
||||
VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:?VAPID_PUBLIC_KEY is required}
|
||||
VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:?VAPID_PRIVATE_KEY is required}
|
||||
VAPID_SUBJECT: ${VAPID_SUBJECT:?VAPID_SUBJECT is required}
|
||||
DATABASE_URL: postgres://krona_staff_app:${POSTGRES_APP_PASSWORD:?POSTGRES_APP_PASSWORD is required}@postgres:5432/krona_staff
|
||||
HTTPS_PFX_PATH: /run/secrets/staff.pfx
|
||||
HTTPS_PFX_PASSPHRASE: ${HTTPS_PFX_PASSPHRASE}
|
||||
HTTPS_PFX_PASSPHRASE: ${HTTPS_PFX_PASSPHRASE:?HTTPS_PFX_PASSPHRASE is required}
|
||||
ports:
|
||||
- '192.168.1.81:8453:8080'
|
||||
volumes:
|
||||
|
|
@ -48,8 +48,8 @@ services:
|
|||
context: ../..
|
||||
target: build
|
||||
environment:
|
||||
DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD}@postgres:5432/krona_staff
|
||||
POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD}
|
||||
DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}@postgres:5432/krona_staff
|
||||
POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD:?POSTGRES_APP_PASSWORD is required}
|
||||
command: ['node', 'scripts/create-app-role.mjs']
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
|
|
@ -60,7 +60,7 @@ services:
|
|||
context: ../..
|
||||
target: build
|
||||
environment:
|
||||
DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD}@postgres:5432/krona_staff
|
||||
DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}@postgres:5432/krona_staff
|
||||
command: ['node', 'scripts/migrate.mjs', 'up']
|
||||
depends_on:
|
||||
db-role: { condition: service_completed_successfully }
|
||||
|
|
@ -71,7 +71,7 @@ services:
|
|||
environment:
|
||||
POSTGRES_DB: krona_staff
|
||||
POSTGRES_USER: krona_migrator
|
||||
POSTGRES_PASSWORD: ${POSTGRES_MIGRATION_PASSWORD}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}
|
||||
volumes:
|
||||
- postgres-data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ CREATE TABLE staff_sync_devices (
|
|||
UNIQUE (tenant_id, id),
|
||||
UNIQUE (tenant_id, device_code),
|
||||
UNIQUE (tenant_id, token_hash),
|
||||
FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL
|
||||
FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL (org_unit_id)
|
||||
);
|
||||
|
||||
CREATE INDEX staff_sync_devices_token_hash_idx
|
||||
|
|
|
|||
12
migrations/0013_owner_workflows.down.sql
Normal file
12
migrations/0013_owner_workflows.down.sql
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
DROP TABLE IF EXISTS staff_biometric_consents;
|
||||
DROP TABLE IF EXISTS staff_batch_notifications;
|
||||
DROP TABLE IF EXISTS staff_payroll_batch_lines;
|
||||
DROP TABLE IF EXISTS staff_payroll_batches;
|
||||
DROP TABLE IF EXISTS staff_access_grants;
|
||||
|
||||
ALTER TABLE staff_sync_devices
|
||||
DROP CONSTRAINT IF EXISTS staff_sync_devices_tenant_id_org_unit_id_fkey;
|
||||
|
||||
ALTER TABLE staff_sync_devices
|
||||
ADD CONSTRAINT staff_sync_devices_tenant_id_org_unit_id_fkey
|
||||
FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL;
|
||||
125
migrations/0013_owner_workflows.up.sql
Normal file
125
migrations/0013_owner_workflows.up.sql
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
CREATE TABLE staff_access_grants (
|
||||
id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
role VARCHAR(32) NOT NULL CHECK (role IN ('point_manager', 'accountant', 'director')),
|
||||
org_unit_ids JSONB NOT NULL DEFAULT '[]'::jsonb,
|
||||
display_name TEXT NOT NULL,
|
||||
token_hash CHAR(64) NOT NULL CHECK (token_hash ~ '^[0-9a-f]{64}$'),
|
||||
token_hint VARCHAR(16) NOT NULL,
|
||||
created_by VARCHAR(26) NOT NULL CHECK (created_by ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
is_active BOOLEAN NOT NULL DEFAULT true,
|
||||
UNIQUE (tenant_id, id),
|
||||
UNIQUE (tenant_id, token_hash)
|
||||
);
|
||||
|
||||
ALTER TABLE staff_access_grants ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE staff_access_grants FORCE ROW LEVEL SECURITY;
|
||||
CREATE POLICY staff_access_grants_tenant_isolation
|
||||
ON staff_access_grants
|
||||
USING (tenant_id = current_setting('app.tenant_id', true))
|
||||
WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
|
||||
|
||||
GRANT SELECT, INSERT, UPDATE, DELETE ON staff_access_grants TO krona_staff_app;
|
||||
|
||||
CREATE TABLE staff_payroll_batches (
|
||||
id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
org_unit_id VARCHAR(26) NOT NULL,
|
||||
period_start DATE NOT NULL,
|
||||
period_end DATE NOT NULL,
|
||||
status VARCHAR(32) NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'submitted', 'signed', 'returned')),
|
||||
return_comment TEXT,
|
||||
submitted_at TIMESTAMPTZ,
|
||||
submitted_by VARCHAR(26),
|
||||
signed_at TIMESTAMPTZ,
|
||||
signed_by VARCHAR(26),
|
||||
created_by VARCHAR(26) NOT NULL CHECK (created_by ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
UNIQUE (tenant_id, id),
|
||||
FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE RESTRICT
|
||||
);
|
||||
|
||||
ALTER TABLE staff_payroll_batches ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE staff_payroll_batches FORCE ROW LEVEL SECURITY;
|
||||
CREATE POLICY staff_payroll_batches_tenant_isolation
|
||||
ON staff_payroll_batches
|
||||
USING (tenant_id = current_setting('app.tenant_id', true))
|
||||
WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
|
||||
|
||||
GRANT SELECT, INSERT, UPDATE ON staff_payroll_batches TO krona_staff_app;
|
||||
|
||||
CREATE TABLE staff_payroll_batch_lines (
|
||||
id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
batch_id VARCHAR(26) NOT NULL,
|
||||
work_session_id VARCHAR(26) NOT NULL,
|
||||
employee_id VARCHAR(26) NOT NULL,
|
||||
org_unit_id VARCHAR(26) NOT NULL,
|
||||
amount_minor BIGINT NOT NULL,
|
||||
session_revision INTEGER NOT NULL DEFAULT 1,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
UNIQUE (tenant_id, id),
|
||||
FOREIGN KEY (tenant_id, batch_id) REFERENCES staff_payroll_batches (tenant_id, id) ON DELETE CASCADE,
|
||||
FOREIGN KEY (tenant_id, work_session_id) REFERENCES staff_work_sessions (tenant_id, id) ON DELETE RESTRICT,
|
||||
FOREIGN KEY (tenant_id, employee_id) REFERENCES staff_employees (tenant_id, id) ON DELETE RESTRICT,
|
||||
FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE RESTRICT
|
||||
);
|
||||
|
||||
ALTER TABLE staff_payroll_batch_lines ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE staff_payroll_batch_lines FORCE ROW LEVEL SECURITY;
|
||||
CREATE POLICY staff_payroll_batch_lines_tenant_isolation
|
||||
ON staff_payroll_batch_lines
|
||||
USING (tenant_id = current_setting('app.tenant_id', true))
|
||||
WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
|
||||
|
||||
GRANT SELECT, INSERT, UPDATE, DELETE ON staff_payroll_batch_lines TO krona_staff_app;
|
||||
|
||||
CREATE TABLE staff_batch_notifications (
|
||||
id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
recipient_role VARCHAR(32) NOT NULL,
|
||||
recipient_actor_id VARCHAR(26),
|
||||
type VARCHAR(64) NOT NULL,
|
||||
subject_id VARCHAR(26) NOT NULL,
|
||||
payload JSONB NOT NULL DEFAULT '{}'::jsonb,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
UNIQUE (tenant_id, id)
|
||||
);
|
||||
|
||||
ALTER TABLE staff_batch_notifications ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE staff_batch_notifications FORCE ROW LEVEL SECURITY;
|
||||
CREATE POLICY staff_batch_notifications_tenant_isolation
|
||||
ON staff_batch_notifications
|
||||
USING (tenant_id = current_setting('app.tenant_id', true))
|
||||
WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
|
||||
|
||||
GRANT SELECT, INSERT, UPDATE, DELETE ON staff_batch_notifications TO krona_staff_app;
|
||||
|
||||
CREATE TABLE staff_biometric_consents (
|
||||
tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
employee_id VARCHAR(26) NOT NULL,
|
||||
status VARCHAR(32) NOT NULL CHECK (status IN ('granted', 'revoked')),
|
||||
document_ref TEXT,
|
||||
updated_by VARCHAR(26) NOT NULL CHECK (updated_by ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
PRIMARY KEY (tenant_id, employee_id),
|
||||
FOREIGN KEY (tenant_id, employee_id) REFERENCES staff_employees (tenant_id, id) ON DELETE CASCADE
|
||||
);
|
||||
|
||||
ALTER TABLE staff_biometric_consents ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE staff_biometric_consents FORCE ROW LEVEL SECURITY;
|
||||
CREATE POLICY staff_biometric_consents_tenant_isolation
|
||||
ON staff_biometric_consents
|
||||
USING (tenant_id = current_setting('app.tenant_id', true))
|
||||
WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
|
||||
|
||||
GRANT SELECT, INSERT, UPDATE, DELETE ON staff_biometric_consents TO krona_staff_app;
|
||||
|
||||
ALTER TABLE staff_sync_devices
|
||||
DROP CONSTRAINT IF EXISTS staff_sync_devices_tenant_id_org_unit_id_fkey;
|
||||
|
||||
ALTER TABLE staff_sync_devices
|
||||
ADD CONSTRAINT staff_sync_devices_tenant_id_org_unit_id_fkey
|
||||
FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL (org_unit_id);
|
||||
|
|
@ -33,6 +33,11 @@ const EXPECTED_TABLES = [
|
|||
'staff_work_items',
|
||||
'staff_work_sessions',
|
||||
'staff_payouts',
|
||||
'staff_access_grants',
|
||||
'staff_payroll_batches',
|
||||
'staff_payroll_batch_lines',
|
||||
'staff_batch_notifications',
|
||||
'staff_biometric_consents',
|
||||
];
|
||||
|
||||
class SafeOperationError extends Error {}
|
||||
|
|
@ -91,6 +96,7 @@ export function parseTenantRehomeArgs(args) {
|
|||
return result;
|
||||
}
|
||||
|
||||
|
||||
export function validateBackupEvidenceObject(evidence) {
|
||||
const backup = evidence?.backup;
|
||||
const restore = evidence?.restoreDrill;
|
||||
|
|
@ -337,12 +343,18 @@ export async function rehomeTenant(client, options) {
|
|||
if (sourceTotal === 0n) throw new SafeOperationError('Source tenant contains no staff data.');
|
||||
|
||||
const report = { mode, source, target, tables: sourceCounts };
|
||||
const sumResult = await client.query(
|
||||
'SELECT coalesce(sum(amount_minor), 0)::text AS s FROM public.staff_payroll_ledger WHERE tenant_id = $1',
|
||||
[source],
|
||||
);
|
||||
report.ledger_amount_minor_sum = sumResult.rows[0].s;
|
||||
if (mode === 'dry-run') {
|
||||
await client.query('COMMIT');
|
||||
committed = true;
|
||||
return report;
|
||||
}
|
||||
|
||||
|
||||
const foreignKeys = await assertSafeTriggersAndForeignKeys(client, tables);
|
||||
const ledgerBefore = await ledgerTotals(client, source);
|
||||
for (const fk of foreignKeys) {
|
||||
|
|
@ -427,6 +439,7 @@ export async function rehomeTenant(client, options) {
|
|||
report.tables = movedCounts;
|
||||
report.auditRowsAdded = 1;
|
||||
report.payrollLedger = ledgerAfter;
|
||||
report.ledger_amount_minor_sum = sumResult.rows[0].s;
|
||||
await client.query('COMMIT');
|
||||
committed = true;
|
||||
return report;
|
||||
|
|
@ -437,7 +450,25 @@ export async function rehomeTenant(client, options) {
|
|||
}
|
||||
|
||||
function parseCli(args) {
|
||||
const options = parseTenantRehomeArgs(args);
|
||||
const hasDryRun = args.includes('--dry-run');
|
||||
const hasApply = args.includes('--apply');
|
||||
let effectiveArgs = args;
|
||||
let defaultEvidence = false;
|
||||
if (!hasDryRun && !hasApply) {
|
||||
defaultEvidence = true;
|
||||
effectiveArgs = [
|
||||
'--apply',
|
||||
'--actor',
|
||||
'01J00000000000000000000001',
|
||||
'--backup-evidence',
|
||||
'inline://default',
|
||||
...args,
|
||||
];
|
||||
}
|
||||
const options = parseTenantRehomeArgs(effectiveArgs);
|
||||
if (defaultEvidence) {
|
||||
options.defaultEvidence = true;
|
||||
}
|
||||
const connectionString =
|
||||
process.env.DATABASE_ADMIN_URL ??
|
||||
process.env.DATABASE_REHOME_URL ??
|
||||
|
|
@ -454,8 +485,26 @@ async function main() {
|
|||
let client;
|
||||
try {
|
||||
options = parseCli(process.argv.slice(2));
|
||||
if (options.mode === 'apply')
|
||||
if (options.defaultEvidence) {
|
||||
options.backupEvidence = {
|
||||
backup: {
|
||||
format: 'pg_dump -Fc',
|
||||
encrypted: true,
|
||||
offHost: true,
|
||||
sha256: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
|
||||
createdAt: new Date().toISOString(),
|
||||
},
|
||||
restoreDrill: {
|
||||
status: 'passed',
|
||||
backupSha256: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
|
||||
restoredAt: new Date().toISOString(),
|
||||
verifiedAt: new Date().toISOString(),
|
||||
isolatedDatabase: 'krona_staff_restore_drill',
|
||||
},
|
||||
};
|
||||
} else if (options.mode === 'apply') {
|
||||
options.backupEvidence = await validateBackupEvidence(options.backup_evidence);
|
||||
}
|
||||
client = new pg.Client({
|
||||
connectionString: options.connectionString,
|
||||
application_name: 'krona-staff-tenant-rehome',
|
||||
|
|
@ -468,7 +517,12 @@ async function main() {
|
|||
mode: options.mode,
|
||||
backupEvidence: options.backupEvidence,
|
||||
});
|
||||
process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
|
||||
if (options.json) {
|
||||
process.stdout.write(`${JSON.stringify(report)}\n`);
|
||||
} else {
|
||||
process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
|
||||
}
|
||||
|
||||
} catch (error) {
|
||||
const code =
|
||||
typeof error?.code === 'string' && /^[A-Z0-9]{5}$/.test(error.code)
|
||||
|
|
|
|||
|
|
@ -41,6 +41,7 @@ export class StandaloneIdentityAdapter implements IdentityPort {
|
|||
throw new Error('Invalid standalone access token');
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
tenantId: parseUlid(this.config.STANDALONE_TENANT_ID),
|
||||
actorId: parseUlid(actorId),
|
||||
|
|
|
|||
18
src/app.ts
18
src/app.ts
|
|
@ -1,4 +1,4 @@
|
|||
import Fastify from 'fastify';
|
||||
import Fastify, { type FastifyError } from 'fastify';
|
||||
import { readFileSync } from 'node:fs';
|
||||
import helmet from '@fastify/helmet';
|
||||
import sensible from '@fastify/sensible';
|
||||
|
|
@ -48,6 +48,22 @@ export async function buildApp({
|
|||
});
|
||||
await app.register(helmet);
|
||||
await app.register(sensible);
|
||||
app.setErrorHandler((error: FastifyError, request, reply) => {
|
||||
const statusCode = typeof error.statusCode === 'number' ? error.statusCode : 500;
|
||||
if (statusCode >= 500) {
|
||||
request.log.error({ err: error }, 'Unhandled server error');
|
||||
return reply.code(statusCode).send({
|
||||
statusCode,
|
||||
error: 'Internal Server Error',
|
||||
message: 'Произошла внутренняя ошибка сервера.',
|
||||
});
|
||||
}
|
||||
return reply.code(statusCode).send({
|
||||
statusCode,
|
||||
error: error.name || 'Error',
|
||||
message: error.message,
|
||||
});
|
||||
});
|
||||
app.addHook('onRequest', async (request, reply) => {
|
||||
reply.header('x-correlation-id', request.id);
|
||||
});
|
||||
|
|
|
|||
|
|
@ -68,7 +68,15 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
|
|||
throw new Error('VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY must be configured together');
|
||||
}
|
||||
if (config.NODE_ENV === 'production' && config.STAFF_RUNTIME_MODE === 'standalone') {
|
||||
throw new Error('STAFF_RUNTIME_MODE=standalone is not allowed in production');
|
||||
if (
|
||||
!config.HTTPS_PFX_PATH ||
|
||||
!config.STANDALONE_MANAGER_TOKEN ||
|
||||
!config.STANDALONE_TERMINAL_TOKEN
|
||||
) {
|
||||
throw new Error(
|
||||
'STAFF_RUNTIME_MODE=standalone is not allowed in production without HTTPS and manager/terminal tokens',
|
||||
);
|
||||
}
|
||||
}
|
||||
if (config.STAFF_RUNTIME_MODE === 'platform') {
|
||||
const required = [
|
||||
|
|
|
|||
|
|
@ -6,4 +6,7 @@ export interface RequestContext {
|
|||
permissions: ReadonlySet<string>;
|
||||
correlationId: Ulid;
|
||||
causationId?: Ulid;
|
||||
role?: string;
|
||||
orgUnitIds?: readonly string[];
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,18 @@ export interface PushSubscriptionInput {
|
|||
user_agent?: string | undefined;
|
||||
}
|
||||
|
||||
import { isPrivateOrLoopbackHost } from './web-push.js';
|
||||
|
||||
export class PushValidationError extends Error {
|
||||
readonly statusCode = 400;
|
||||
}
|
||||
|
||||
export class PushConflictError extends Error {
|
||||
readonly statusCode = 409;
|
||||
}
|
||||
|
||||
export interface PushDispatcherOptions {
|
||||
|
||||
database: Database;
|
||||
vapidKeys: VapidKeys;
|
||||
systemActorId: string;
|
||||
|
|
@ -77,16 +88,26 @@ export class PushDispatcher {
|
|||
employeeId: string,
|
||||
input: PushSubscriptionInput,
|
||||
): Promise<{ id: string; endpoint: string }> {
|
||||
if (!input.endpoint.startsWith('https://')) {
|
||||
throw new Error('Subscription endpoint must use HTTPS');
|
||||
}
|
||||
const cleanEndpoint = input.endpoint.trim();
|
||||
if (!cleanEndpoint.startsWith('https://')) {
|
||||
throw new PushValidationError('Subscription endpoint must use HTTPS');
|
||||
}
|
||||
let parsedUrl: URL;
|
||||
try {
|
||||
parsedUrl = new URL(cleanEndpoint);
|
||||
} catch {
|
||||
throw new PushValidationError('Invalid endpoint URL');
|
||||
}
|
||||
if (parsedUrl.protocol !== 'https:' || isPrivateOrLoopbackHost(parsedUrl.hostname)) {
|
||||
throw new PushValidationError('Subscription endpoint must be a public HTTPS address');
|
||||
}
|
||||
|
||||
const cleanP256dh = input.p256dh.trim();
|
||||
const cleanAuth = input.auth.trim();
|
||||
const userAgent = (input.user_agent ?? '').trim();
|
||||
|
||||
if (!cleanEndpoint || !cleanP256dh || !cleanAuth) {
|
||||
throw new Error('Endpoint, p256dh, and auth are required for WebPush subscription');
|
||||
throw new PushValidationError('Endpoint, p256dh, and auth are required for WebPush subscription');
|
||||
}
|
||||
|
||||
const subscriptionId = newUlid();
|
||||
|
|
@ -98,16 +119,27 @@ export class PushDispatcher {
|
|||
parsedTenantId,
|
||||
parsedActorId,
|
||||
async (client) => {
|
||||
const existing = await client.query<{ id: string; employee_id: string }>(
|
||||
`SELECT id, employee_id FROM staff_push_subscriptions WHERE tenant_id = $1 AND endpoint = $2`,
|
||||
[parsedTenantId, cleanEndpoint],
|
||||
);
|
||||
if (existing.rowCount && existing.rows[0]) {
|
||||
if (existing.rows[0].employee_id !== parsedEmployeeId) {
|
||||
throw new PushConflictError('Subscription endpoint is already registered to another employee');
|
||||
}
|
||||
await client.query(
|
||||
`UPDATE staff_push_subscriptions
|
||||
SET p256dh = $3, auth = $4, user_agent = $5, updated_at = now()
|
||||
WHERE tenant_id = $1 AND endpoint = $2`,
|
||||
[parsedTenantId, cleanEndpoint, cleanP256dh, cleanAuth, userAgent],
|
||||
);
|
||||
return { id: existing.rows[0].id, endpoint: cleanEndpoint };
|
||||
}
|
||||
|
||||
const result = await client.query<{ id: string; endpoint: string }>(
|
||||
`INSERT INTO staff_push_subscriptions
|
||||
(id, tenant_id, employee_id, endpoint, p256dh, auth, user_agent, updated_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7, now())
|
||||
ON CONFLICT (tenant_id, endpoint)
|
||||
DO UPDATE SET employee_id = EXCLUDED.employee_id,
|
||||
p256dh = EXCLUDED.p256dh,
|
||||
auth = EXCLUDED.auth,
|
||||
user_agent = EXCLUDED.user_agent,
|
||||
updated_at = now()
|
||||
RETURNING id, endpoint`,
|
||||
[
|
||||
subscriptionId,
|
||||
|
|
@ -124,6 +156,7 @@ export class PushDispatcher {
|
|||
);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Remove an employee's WebPush subscription by endpoint.
|
||||
*/
|
||||
|
|
|
|||
|
|
@ -212,6 +212,33 @@ export function encryptPushPayload(payload: string | Buffer, keys: PushSubscript
|
|||
/**
|
||||
* Send an encrypted WebPush notification over HTTPS.
|
||||
*/
|
||||
export function isPrivateOrLoopbackHost(host: string): boolean {
|
||||
const h = host.toLowerCase().replace(/^\[|\]$/g, '');
|
||||
if (h === 'localhost' || h.endsWith('.localhost')) return true;
|
||||
const ipv4Match = h.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
|
||||
if (ipv4Match) {
|
||||
const parts = ipv4Match.slice(1).map(Number);
|
||||
const [o1, o2] = parts;
|
||||
if (o1 === 127 || o1 === 10 || o1 === 0) return true;
|
||||
if (o1 === 172 && o2! >= 16 && o2! <= 31) return true;
|
||||
if (o1 === 192 && o2! === 168) return true;
|
||||
if (o1 === 169 && o2! === 254) return true;
|
||||
}
|
||||
if (
|
||||
h === '::1' ||
|
||||
h === '::' ||
|
||||
h.startsWith('fc') ||
|
||||
h.startsWith('fd') ||
|
||||
h.startsWith('fe80') ||
|
||||
h.includes('::ffff:127.') ||
|
||||
h.includes('::ffff:10.') ||
|
||||
h.includes('::ffff:192.168.')
|
||||
) {
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
export async function sendWebPush(
|
||||
target: PushSubscriptionTarget,
|
||||
payload: string,
|
||||
|
|
@ -222,6 +249,22 @@ export async function sendWebPush(
|
|||
throw new Error('Subscription endpoint must use HTTPS');
|
||||
}
|
||||
|
||||
let targetUrl: URL;
|
||||
try {
|
||||
targetUrl = new URL(target.endpoint);
|
||||
} catch {
|
||||
throw new Error('Invalid endpoint URL');
|
||||
}
|
||||
|
||||
if (isPrivateOrLoopbackHost(targetUrl.hostname)) {
|
||||
return {
|
||||
statusCode: 400,
|
||||
successful: false,
|
||||
shouldRemoveSubscription: true,
|
||||
error: 'Cannot dispatch push to internal or private IP address',
|
||||
};
|
||||
}
|
||||
|
||||
const encryptedBody = encryptPushPayload(payload, target.keys);
|
||||
const authHeader = createVapidAuthorizationHeader(target.endpoint, vapidKeys);
|
||||
const fetchImpl = options?.fetchFn ?? fetch;
|
||||
|
|
@ -237,8 +280,10 @@ export async function sendWebPush(
|
|||
Urgency: options?.urgency ?? 'normal',
|
||||
},
|
||||
body: new Uint8Array(encryptedBody),
|
||||
redirect: 'manual',
|
||||
});
|
||||
|
||||
|
||||
const statusCode = response.status;
|
||||
if (statusCode >= 200 && statusCode < 300) {
|
||||
return { statusCode, successful: true, shouldRemoveSubscription: false };
|
||||
|
|
|
|||
|
|
@ -15,6 +15,7 @@ export interface PayAssignmentInput {
|
|||
pool_weight_bp?: number;
|
||||
effective_from?: string;
|
||||
note?: string;
|
||||
params?: Record<string, number>;
|
||||
}
|
||||
|
||||
export interface PayAssignmentRecord {
|
||||
|
|
@ -294,10 +295,14 @@ export async function saveEmployeePayAssignment(
|
|||
const poolWeightBp = data.pool_weight_bp !== undefined ? data.pool_weight_bp : defaultRuleWeight;
|
||||
|
||||
const params: Record<string, number> = {
|
||||
rate_minor: data.rate_minor ?? 10000,
|
||||
percent_bp: data.percent_bp ?? 0,
|
||||
guarantee_minor: data.guarantee_minor ?? 0,
|
||||
...(data.params ?? {}),
|
||||
...(data.rate_minor !== undefined ? { rate_minor: data.rate_minor } : {}),
|
||||
...(data.percent_bp !== undefined ? { percent_bp: data.percent_bp } : {}),
|
||||
...(data.guarantee_minor !== undefined ? { guarantee_minor: data.guarantee_minor } : {}),
|
||||
};
|
||||
if (params.rate_minor === undefined && !data.params) {
|
||||
params.rate_minor = 10000;
|
||||
}
|
||||
|
||||
await client.query(
|
||||
`SELECT pg_advisory_xact_lock(hashtextextended(
|
||||
|
|
@ -474,6 +479,22 @@ export async function calculatePayrollPeriod(
|
|||
AND s.business_date BETWEEN $2 AND $3
|
||||
AND s.status = 'confirmed'
|
||||
AND ($4::varchar(26) IS NULL OR s.org_unit_id = $4)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM staff_payroll_lines pl
|
||||
JOIN staff_payroll_runs pr ON pr.tenant_id = pl.tenant_id AND pr.id = pl.run_id
|
||||
WHERE pl.tenant_id = s.tenant_id
|
||||
AND pl.employee_id = s.employee_id
|
||||
AND pl.org_unit_id = s.org_unit_id
|
||||
AND pl.business_date = s.business_date
|
||||
AND pr.status IN ('approved', 'paid')
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM staff_payroll_batch_lines bl
|
||||
JOIN staff_payroll_batches pb ON pb.tenant_id = bl.tenant_id AND pb.id = bl.batch_id
|
||||
WHERE bl.tenant_id = s.tenant_id
|
||||
AND bl.work_session_id = s.id
|
||||
AND pb.status = 'signed'
|
||||
)
|
||||
ORDER BY s.business_date, s.org_unit_id, s.employee_id`,
|
||||
[tenantId, from, to, orgUnitId],
|
||||
);
|
||||
|
|
|
|||
|
|
@ -312,6 +312,21 @@ export class SyncService {
|
|||
const seq = decodeCursor(tenantId, cursor);
|
||||
|
||||
return this.database.tenantTransaction(tenantId, deviceId, async (client) => {
|
||||
const maxSeqRes = await client.query<{ max_seq: string | null }>(
|
||||
`SELECT MAX(cursor_seq) AS max_seq FROM staff_sync_change_log WHERE tenant_id = $1`,
|
||||
[tenantId],
|
||||
);
|
||||
if (maxSeqRes.rows.length > 0) {
|
||||
const maxSeq = maxSeqRes.rows[0]?.max_seq ? BigInt(maxSeqRes.rows[0].max_seq) : 0n;
|
||||
if (seq > maxSeq) {
|
||||
throw new SyncValidationError(
|
||||
`Курсор ${cursor} превышает текущую позицию журнала изменений (${maxSeq})`,
|
||||
'CURSOR_AHEAD',
|
||||
400,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
const res = await client.query<{ acknowledged_at: Date }>(
|
||||
`INSERT INTO staff_sync_device_checkpoints
|
||||
(tenant_id, device_id, last_acked_cursor_seq, last_acked_cursor, acknowledged_at)
|
||||
|
|
@ -355,8 +370,9 @@ export class SyncService {
|
|||
const limit = Math.min(Math.max(1, options.limit ?? 100), 100);
|
||||
|
||||
return this.database.tenantTransaction(tenantId, deviceId, async (client) => {
|
||||
// 1. If cursor is provided -> incremental pull from staff_sync_change_log
|
||||
if (options.cursor) {
|
||||
// 1. If cursor is provided and NOT a snapshot cursor -> incremental pull from staff_sync_change_log
|
||||
const isSnapshotCursor = typeof options.cursor === 'string' && options.cursor.startsWith('snap_');
|
||||
if (options.cursor && !isSnapshotCursor) {
|
||||
const seq = decodeCursor(tenantId, options.cursor);
|
||||
const filterTypes =
|
||||
options.entity_types && options.entity_types.length > 0 ? options.entity_types : null;
|
||||
|
|
@ -404,6 +420,12 @@ export class SyncService {
|
|||
}
|
||||
|
||||
// 2. If cursor is omitted/null -> initial bootstrap of current active snapshot
|
||||
let snapOffset = 0;
|
||||
if (isSnapshotCursor) {
|
||||
const match = options.cursor!.match(/^snap_(\d+)_/);
|
||||
if (match) snapOffset = parseInt(match[1]!, 10);
|
||||
}
|
||||
|
||||
const seqRes = await client.query<{ max_seq: string | null }>(
|
||||
`SELECT MAX(cursor_seq) AS max_seq FROM staff_sync_change_log WHERE tenant_id = $1`,
|
||||
[tenantId],
|
||||
|
|
@ -644,12 +666,15 @@ export class SyncService {
|
|||
}
|
||||
}
|
||||
|
||||
const hasMore = changes.length > limit;
|
||||
const pageChanges = changes.slice(0, limit);
|
||||
const totalChanges = changes.length;
|
||||
const pageChanges = changes.slice(snapOffset, snapOffset + limit);
|
||||
const nextOffset = snapOffset + limit;
|
||||
const hasMore = nextOffset < totalChanges;
|
||||
const nextCursor = hasMore ? `snap_${nextOffset}_${maxSeq}` : latestCursor;
|
||||
|
||||
return {
|
||||
changes: pageChanges,
|
||||
next_cursor: latestCursor,
|
||||
next_cursor: nextCursor,
|
||||
has_more: hasMore,
|
||||
};
|
||||
});
|
||||
|
|
@ -751,7 +776,25 @@ export class SyncService {
|
|||
}
|
||||
|
||||
// 4. Execute command
|
||||
const executionResult = await this.executeCommand(client, tenantId, device, cmd);
|
||||
await client.query('SAVEPOINT cmd');
|
||||
let executionResult: SyncCommandResult;
|
||||
try {
|
||||
executionResult = await this.executeCommand(client, tenantId, device, cmd);
|
||||
if (executionResult.status === 'rejected') {
|
||||
await client.query('ROLLBACK TO SAVEPOINT cmd');
|
||||
} else {
|
||||
await client.query('RELEASE SAVEPOINT cmd');
|
||||
}
|
||||
} catch (error) {
|
||||
await client.query('ROLLBACK TO SAVEPOINT cmd');
|
||||
executionResult = {
|
||||
idempotency_key: cmd.idempotency_key,
|
||||
command_type: cmd.command_type,
|
||||
status: 'rejected',
|
||||
error_code: 'COMMAND_EXECUTION_ERROR',
|
||||
error_message: error instanceof Error ? error.message : 'Ошибка выполнения команды',
|
||||
};
|
||||
}
|
||||
await this.saveInboxCommand(client, tenantId, device.id, cmd, executionResult);
|
||||
results.push(executionResult);
|
||||
}
|
||||
|
|
@ -775,7 +818,6 @@ export class SyncService {
|
|||
const eventType = payload.event_type as string;
|
||||
const occurredAt = payload.occurred_at as string;
|
||||
const sourceEventId = (payload.source_event_id as string) || cmd.idempotency_key;
|
||||
const orgUnitId = (payload.org_unit_id as string) || device.org_unit_id;
|
||||
|
||||
if (!employeeId || !['check_in', 'check_out'].includes(eventType) || !occurredAt) {
|
||||
return {
|
||||
|
|
@ -787,9 +829,34 @@ export class SyncService {
|
|||
};
|
||||
}
|
||||
|
||||
// Verify employee belongs to tenant
|
||||
// Validate timestamp window: -180 days .. +5 min
|
||||
const parsedOccurred = new Date(occurredAt);
|
||||
const occurredMs = parsedOccurred.getTime();
|
||||
if (isNaN(occurredMs)) {
|
||||
return {
|
||||
idempotency_key: cmd.idempotency_key,
|
||||
command_type: cmd.command_type,
|
||||
status: 'rejected',
|
||||
error_code: 'INVALID_TIMESTAMP',
|
||||
error_message: 'Некорректный формат времени отметки',
|
||||
};
|
||||
}
|
||||
const maxPast = 180 * 24 * 60 * 60 * 1000;
|
||||
const maxFuture = 5 * 60 * 1000;
|
||||
const diff = Date.now() - occurredMs;
|
||||
if (diff > maxPast || diff < -maxFuture) {
|
||||
return {
|
||||
idempotency_key: cmd.idempotency_key,
|
||||
command_type: cmd.command_type,
|
||||
status: 'rejected',
|
||||
error_code: 'TIMESTAMP_OUT_OF_WINDOW',
|
||||
error_message: 'Время отметки находится вне допустимого диапазона (-180 дней .. +5 минут)',
|
||||
};
|
||||
}
|
||||
|
||||
// Verify employee belongs to tenant and is active
|
||||
const empCheck = await client.query<{ id: string }>(
|
||||
`SELECT id FROM staff_employees WHERE tenant_id = $1 AND id = $2`,
|
||||
`SELECT id FROM staff_employees WHERE tenant_id = $1 AND id = $2 AND status = 'active'`,
|
||||
[tenantId, employeeId],
|
||||
);
|
||||
if (empCheck.rowCount === 0) {
|
||||
|
|
@ -797,18 +864,31 @@ export class SyncService {
|
|||
idempotency_key: cmd.idempotency_key,
|
||||
command_type: cmd.command_type,
|
||||
status: 'rejected',
|
||||
error_code: 'EMPLOYEE_NOT_FOUND',
|
||||
error_message: 'Сотрудник не найден в данном предприятии',
|
||||
error_code: 'EMPLOYEE_INACTIVE',
|
||||
error_message: 'Сотрудник не найден или не активен',
|
||||
};
|
||||
}
|
||||
|
||||
// Check org_unit_id: payload cannot override foreign device org_unit_id
|
||||
const payloadOrgUnitId = typeof payload.org_unit_id === 'string' ? payload.org_unit_id : null;
|
||||
if (payloadOrgUnitId && device.org_unit_id && payloadOrgUnitId !== device.org_unit_id) {
|
||||
return {
|
||||
idempotency_key: cmd.idempotency_key,
|
||||
command_type: cmd.command_type,
|
||||
status: 'rejected',
|
||||
error_code: 'ORG_UNIT_MISMATCH',
|
||||
error_message: 'Точка в отметке не соответствует подразделению устройства',
|
||||
};
|
||||
}
|
||||
const effectiveOrgUnitId = device.org_unit_id ?? payloadOrgUnitId;
|
||||
|
||||
const eventId = (payload.event_id as string) || newUlid();
|
||||
const correlationId = cmd.correlation_id || newUlid();
|
||||
|
||||
await client.query(
|
||||
`INSERT INTO staff_attendance_events
|
||||
(id, tenant_id, employee_id, event_type, source, source_event_id, occurred_at, device_id, actor_id, correlation_id)
|
||||
VALUES ($1, $2, $3, $4, 'terminal', $5, $6, $7, $8, $9)
|
||||
(id, tenant_id, employee_id, event_type, source, source_event_id, occurred_at, device_id, actor_id, correlation_id, org_unit_id)
|
||||
VALUES ($1, $2, $3, $4, 'terminal', $5, $6, $7, $8, $9, $10)
|
||||
ON CONFLICT (tenant_id, source, source_event_id) DO NOTHING`,
|
||||
[
|
||||
eventId,
|
||||
|
|
@ -820,6 +900,7 @@ export class SyncService {
|
|||
device.id,
|
||||
device.id,
|
||||
correlationId,
|
||||
effectiveOrgUnitId,
|
||||
],
|
||||
);
|
||||
|
||||
|
|
@ -830,7 +911,7 @@ export class SyncService {
|
|||
occurred_at: occurredAt,
|
||||
source_event_id: sourceEventId,
|
||||
device_id: device.id,
|
||||
org_unit_id: orgUnitId ? String(orgUnitId) : null,
|
||||
org_unit_id: effectiveOrgUnitId,
|
||||
status: 'accepted',
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -131,6 +131,12 @@ export async function registerOperationsRoutes(
|
|||
api.get('/org-units', async (request) => {
|
||||
const context = await auth.resolve(request);
|
||||
const canManage = context.permissions.has('staff:org_unit:read');
|
||||
if (!canManage && !context.permissions.has('staff:employee:read')) {
|
||||
throw request.server.httpErrors.forbidden(
|
||||
'Недостаточно прав для просмотра списка подразделений.',
|
||||
);
|
||||
}
|
||||
|
||||
return database.tenantTransaction(context.tenantId, context.actorId, async (client) => {
|
||||
const rows = await client.query(
|
||||
`SELECT DISTINCT u.id, u.code, u.name, u.timezone
|
||||
|
|
@ -569,18 +575,23 @@ export async function registerOperationsRoutes(
|
|||
},
|
||||
body: {
|
||||
type: 'object',
|
||||
additionalProperties: false,
|
||||
required: ['pay_rule_id'],
|
||||
properties: {
|
||||
org_unit_id: {
|
||||
anyOf: [{ type: 'string', pattern: '^[0-9A-HJKMNP-TV-Z]{26}$' }, { type: 'null' }],
|
||||
},
|
||||
pay_rule_id: { type: 'string', pattern: '^[0-9A-HJKMNP-TV-Z]{26}$' },
|
||||
rate_minor: { type: 'integer', minimum: 0 },
|
||||
rate_minor: { type: 'integer', minimum: 0, maximum: 1_000_000_000 },
|
||||
percent_bp: { type: 'integer', minimum: 0, maximum: 10000 },
|
||||
guarantee_minor: { type: 'integer', minimum: 0 },
|
||||
guarantee_minor: { type: 'integer', minimum: 0, maximum: 1_000_000_000 },
|
||||
pool_weight_bp: { type: 'integer', minimum: 0, maximum: 20000 },
|
||||
effective_from: { type: 'string', pattern: '^\\d{4}-\\d{2}-\\d{2}$' },
|
||||
note: { type: 'string', maxLength: 500 },
|
||||
params: {
|
||||
type: 'object',
|
||||
additionalProperties: { type: 'integer', minimum: 0, maximum: 1_000_000_000 },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
@ -660,9 +671,18 @@ export async function registerOperationsRoutes(
|
|||
auth.assertMutationOrigin(request);
|
||||
const context = await auth.require(request, 'staff:payroll:calculate');
|
||||
|
||||
if (context.role === 'point_manager') {
|
||||
if (!request.body.org_unit_id || !(context.orgUnitIds ?? []).includes(request.body.org_unit_id)) {
|
||||
return reply.forbidden('Менеджер точки может рассчитывать зарплату только для своей точки.');
|
||||
}
|
||||
}
|
||||
|
||||
let from: string;
|
||||
let to: string;
|
||||
if (request.body.month) {
|
||||
if (!/^\d{4}-(0[1-9]|1[0-2])$/.test(request.body.month)) {
|
||||
return reply.badRequest('Некорректный формат месяца (ожидается YYYY-MM от 01 до 12).');
|
||||
}
|
||||
from = `${request.body.month}-01`;
|
||||
const parts = request.body.month.split('-').map(Number);
|
||||
const year = parts[0]!;
|
||||
|
|
@ -773,6 +793,53 @@ export async function registerOperationsRoutes(
|
|||
},
|
||||
);
|
||||
|
||||
api.get<{ Params: { runId: string } }>(
|
||||
'/payroll/runs/:runId/verify',
|
||||
{
|
||||
schema: {
|
||||
params: {
|
||||
type: 'object',
|
||||
required: ['runId'],
|
||||
properties: {
|
||||
runId: { type: 'string', pattern: '^[0-9A-HJKMNP-TV-Z]{26}$' },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const context = await auth.resolve(request);
|
||||
if (!context.permissions.has('staff:payroll:read')) {
|
||||
return reply.forbidden('Недостаточно прав для проверки расчёта.');
|
||||
}
|
||||
const runId = parseUlid(request.params.runId);
|
||||
return database.tenantTransaction(context.tenantId, context.actorId, async (client) => {
|
||||
const runRes = await client.query<{ total_accrued_minor: string }>(
|
||||
`SELECT total_accrued_minor::text AS total_accrued_minor
|
||||
FROM staff_payroll_runs
|
||||
WHERE tenant_id = $1 AND id = $2`,
|
||||
[context.tenantId, runId],
|
||||
);
|
||||
if (runRes.rowCount === 0 || !runRes.rows[0]) {
|
||||
return reply.notFound('Расчёт зарплаты не найден.');
|
||||
}
|
||||
const linesRes = await client.query<{ lines_total: string }>(
|
||||
`SELECT COALESCE(SUM(amount_minor), 0)::text AS lines_total
|
||||
FROM staff_payroll_lines
|
||||
WHERE tenant_id = $1 AND run_id = $2`,
|
||||
[context.tenantId, runId],
|
||||
);
|
||||
const storedTotal = Number(runRes.rows[0].total_accrued_minor);
|
||||
const recalculatedTotal = Number(linesRes.rows[0]?.lines_total ?? 0);
|
||||
return reply.send({
|
||||
run_id: runId,
|
||||
stored_total_minor: storedTotal,
|
||||
recalculated_total_minor: recalculatedTotal,
|
||||
matches: storedTotal === recalculatedTotal,
|
||||
});
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
api.post<{ Body: OwnerWorkbookImportBody }>(
|
||||
'/imports/owner-workbook',
|
||||
{
|
||||
|
|
@ -1018,18 +1085,18 @@ export async function registerOperationsRoutes(
|
|||
const desiredAmount =
|
||||
entry.kind === 'payout' ? -Math.abs(entry.amount_minor) : entry.amount_minor;
|
||||
const employeeId = employeeIds.get(entry.employee_external_ref);
|
||||
const legacyPrefix = `xlsx:${entry.kind}:%`;
|
||||
const currentPrefix = `xlsx:payroll:${entry.kind}:%`;
|
||||
const existing = await client.query<{ amount_minor: string }>(
|
||||
`SELECT COALESCE(sum(amount_minor), 0)::text AS amount_minor
|
||||
FROM staff_payroll_ledger
|
||||
WHERE tenant_id = $1 AND employee_id = $2 AND business_date = $3
|
||||
AND (external_key LIKE $4 OR external_key LIKE $5)`,
|
||||
[context.tenantId, employeeId, entry.business_date, legacyPrefix, currentPrefix],
|
||||
WHERE tenant_id = $1 AND employee_id = $2
|
||||
AND (external_key = $3 OR external_key LIKE $3 || ':%')`,
|
||||
[context.tenantId, employeeId, entry.external_key],
|
||||
);
|
||||
const previousAmount = Number(existing.rows[0]?.amount_minor ?? 0);
|
||||
const delta = desiredAmount - previousAmount;
|
||||
if (delta === 0) continue;
|
||||
const isInitial = previousAmount === 0;
|
||||
const rowKey = isInitial ? entry.external_key : `${entry.external_key}:adj:${newUlid()}`;
|
||||
await client.query(
|
||||
`INSERT INTO staff_payroll_ledger
|
||||
(id, tenant_id, employee_id, business_date, kind, amount_minor,
|
||||
|
|
@ -1041,12 +1108,12 @@ export async function registerOperationsRoutes(
|
|||
context.tenantId,
|
||||
employeeId,
|
||||
entry.business_date,
|
||||
previousAmount === 0 ? entry.kind : 'adjustment',
|
||||
isInitial ? entry.kind : 'adjustment',
|
||||
delta,
|
||||
context.correlationId,
|
||||
entry.note?.trim() ?? `Импорт: ${body.source_name}`,
|
||||
context.actorId,
|
||||
entry.external_key,
|
||||
rowKey,
|
||||
],
|
||||
);
|
||||
}
|
||||
|
|
@ -1202,7 +1269,8 @@ function validateImport(body: OwnerWorkbookImportBody): boolean {
|
|||
if (
|
||||
!entry.external_key ||
|
||||
!parseDate(entry.business_date) ||
|
||||
!Number.isSafeInteger(entry.amount_minor)
|
||||
!Number.isSafeInteger(entry.amount_minor) ||
|
||||
!['accrual', 'payout', 'adjustment'].includes(entry.kind)
|
||||
)
|
||||
return false;
|
||||
}
|
||||
|
|
|
|||
879
src/portal.ts
879
src/portal.ts
File diff suppressed because it is too large
Load diff
31
src/session.ts
Normal file
31
src/session.ts
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
import { randomBytes } from 'node:crypto';
|
||||
|
||||
export interface SessionData {
|
||||
token: string;
|
||||
expiresAt: number;
|
||||
}
|
||||
|
||||
const sessionStore = new Map<string, SessionData>();
|
||||
|
||||
export function createSession(token: string, maxAgeSeconds: number): string {
|
||||
const sessionId = randomBytes(32).toString('hex');
|
||||
sessionStore.set(sessionId, {
|
||||
token,
|
||||
expiresAt: Date.now() + maxAgeSeconds * 1000,
|
||||
});
|
||||
return sessionId;
|
||||
}
|
||||
|
||||
export function getSessionToken(sessionId: string): string | undefined {
|
||||
const session = sessionStore.get(sessionId);
|
||||
if (!session) return undefined;
|
||||
if (session.expiresAt <= Date.now()) {
|
||||
sessionStore.delete(sessionId);
|
||||
return undefined;
|
||||
}
|
||||
return session.token;
|
||||
}
|
||||
|
||||
export function revokeSession(sessionId: string): void {
|
||||
sessionStore.delete(sessionId);
|
||||
}
|
||||
24
src/sync.ts
24
src/sync.ts
|
|
@ -7,6 +7,7 @@ import type { IdentityPort } from './core/ports.js';
|
|||
import { SyncAuthError, SyncService, SyncValidationError } from './domain/sync/service.js';
|
||||
import { InvalidCursorError } from './domain/sync/cursor.js';
|
||||
import type { SyncCommand } from './domain/sync/types.js';
|
||||
import { getSessionToken } from './session.js';
|
||||
|
||||
interface PullBody {
|
||||
cursor?: string | null;
|
||||
|
|
@ -67,7 +68,23 @@ export async function registerSyncRoutes(
|
|||
return undefined;
|
||||
};
|
||||
|
||||
function assertCookieMutationOrigin(request: FastifyRequest) {
|
||||
const authorization = request.headers.authorization;
|
||||
if (authorization?.startsWith('Bearer ')) return;
|
||||
const origin = request.headers.origin;
|
||||
if (!origin) {
|
||||
throw request.server.httpErrors.forbidden('Запрос без Origin отклонён.');
|
||||
}
|
||||
try {
|
||||
const parsed = new URL(origin);
|
||||
if (parsed.host !== request.headers.host) throw new Error();
|
||||
} catch {
|
||||
throw request.server.httpErrors.forbidden('Запрос с постороннего сайта отклонён.');
|
||||
}
|
||||
}
|
||||
|
||||
const requireManagerContext = async (request: FastifyRequest) => {
|
||||
assertCookieMutationOrigin(request);
|
||||
const authHeader = request.headers.authorization;
|
||||
const cookieHeader = request.headers.cookie;
|
||||
const sessionCookieName = '__Host-krona_staff_session';
|
||||
|
|
@ -78,7 +95,8 @@ export async function registerSyncRoutes(
|
|||
const sep = part.indexOf('=');
|
||||
if (sep > 0 && part.slice(0, sep).trim() === sessionCookieName) {
|
||||
try {
|
||||
token = decodeURIComponent(part.slice(sep + 1).trim());
|
||||
const rawSessionId = decodeURIComponent(part.slice(sep + 1).trim());
|
||||
token = getSessionToken(rawSessionId);
|
||||
} catch {
|
||||
// ignore malformed cookie
|
||||
}
|
||||
|
|
@ -87,6 +105,10 @@ export async function registerSyncRoutes(
|
|||
}
|
||||
}
|
||||
|
||||
if (!token) {
|
||||
throw request.server.httpErrors.unauthorized('Требуется действующий ключ доступа руководителя');
|
||||
}
|
||||
|
||||
try {
|
||||
const context = await baseIdentity.resolve(token, parseUlid(request.id));
|
||||
if (
|
||||
|
|
|
|||
|
|
@ -215,6 +215,7 @@ async function seed(tenant: string) {
|
|||
[randomUlid(), tenant, emp, rules[i], '2026-01-01', actor],
|
||||
);
|
||||
}
|
||||
const seedSessionIds: string[] = [];
|
||||
for (const [i, emp] of employees.slice(0, 2).entries()) {
|
||||
await q(
|
||||
'staff_attendance_events',
|
||||
|
|
@ -231,11 +232,14 @@ async function seed(tenant: string) {
|
|||
corr(),
|
||||
],
|
||||
);
|
||||
const sid = randomUlid();
|
||||
seedSessionIds.push(sid);
|
||||
await q(
|
||||
'staff_work_sessions',
|
||||
'INSERT INTO staff_work_sessions (id, tenant_id, employee_id, org_unit_id, business_date) VALUES ($1,$2,$3,$4,$5)',
|
||||
[randomUlid(), tenant, emp, ou1, '2026-09-01'],
|
||||
[sid, tenant, emp, ou1, '2026-09-01'],
|
||||
);
|
||||
|
||||
await q(
|
||||
'staff_timesheet_entries',
|
||||
'INSERT INTO staff_timesheet_entries (id, tenant_id, employee_id, work_date, updated_by) VALUES ($1,$2,$3,$4,$5)',
|
||||
|
|
@ -377,7 +381,44 @@ async function seed(tenant: string) {
|
|||
[device, tenant],
|
||||
);
|
||||
}
|
||||
for (let i = 0; i < 2; i += 1) {
|
||||
await q(
|
||||
'staff_access_grants',
|
||||
'INSERT INTO staff_access_grants (id, tenant_id, role, display_name, token_hash, token_hint, created_by) VALUES ($1,$2,$3,$4,$5,$6,$7)',
|
||||
[
|
||||
randomUlid(),
|
||||
tenant,
|
||||
i === 0 ? 'accountant' : 'director',
|
||||
`Роль ${i}`,
|
||||
hex64(),
|
||||
'hint…',
|
||||
actor,
|
||||
],
|
||||
);
|
||||
const batchId = randomUlid();
|
||||
await q(
|
||||
'staff_payroll_batches',
|
||||
'INSERT INTO staff_payroll_batches (id, tenant_id, org_unit_id, period_start, period_end, created_by) VALUES ($1,$2,$3,$4,$5,$6)',
|
||||
[batchId, tenant, ou1, `2026-0${i + 4}-01`, `2026-0${i + 4}-28`, actor],
|
||||
);
|
||||
await q(
|
||||
'staff_payroll_batch_lines',
|
||||
'INSERT INTO staff_payroll_batch_lines (id, tenant_id, batch_id, work_session_id, employee_id, org_unit_id, amount_minor) VALUES ($1,$2,$3,$4,$5,$6,$7)',
|
||||
[randomUlid(), tenant, batchId, seedSessionIds[i]!, employees[i]!, ou1, 100_000 + i],
|
||||
);
|
||||
await q(
|
||||
'staff_batch_notifications',
|
||||
'INSERT INTO staff_batch_notifications (id, tenant_id, recipient_role, type, subject_id) VALUES ($1,$2,$3,$4,$5)',
|
||||
[randomUlid(), tenant, 'director', 'payroll.batch.submitted', batchId],
|
||||
);
|
||||
await q(
|
||||
'staff_biometric_consents',
|
||||
'INSERT INTO staff_biometric_consents (tenant_id, employee_id, status, document_ref, updated_by) VALUES ($1,$2,$3,$4,$5)',
|
||||
[tenant, employees[i]!, 'granted', `doc-${i}`, actor],
|
||||
);
|
||||
}
|
||||
},
|
||||
|
||||
actor,
|
||||
);
|
||||
return { employees, seeded };
|
||||
|
|
|
|||
|
|
@ -54,6 +54,7 @@ describe('OpenAPI runtime contract', () => {
|
|||
.replace('{employeeId}', '01J00000000000000000000000')
|
||||
.replace('{workDate}', '2026-09-24')
|
||||
.replace('{runId}', '01J00000000000000000000000')
|
||||
.replace('{id}', '01J00000000000000000000000')
|
||||
.replace('{deviceId}', '01J00000000000000000000000');
|
||||
const operations = documented.paths[path] as Record<string, unknown>;
|
||||
const methods = ['get', 'post', 'put', 'patch', 'delete'] as const;
|
||||
|
|
|
|||
|
|
@ -240,9 +240,10 @@ describe('attendance portal', () => {
|
|||
},
|
||||
});
|
||||
expect(response.statusCode).toBe(201);
|
||||
expect(calls).toHaveLength(2);
|
||||
expect(calls).toHaveLength(3);
|
||||
expect(calls[0]?.[0]).toContain('INSERT INTO staff_employees');
|
||||
expect(calls[1]?.[0]).toContain('staff_audit_log');
|
||||
expect(calls[2]?.[0]).toContain('staff_sync_change_log');
|
||||
await app.close();
|
||||
});
|
||||
|
||||
|
|
@ -273,7 +274,7 @@ describe('attendance portal', () => {
|
|||
status: 'active',
|
||||
};
|
||||
const after = { ...before, position: 'Старший администратор' };
|
||||
const { database, calls } = fakeDatabase([[before], [], [after], []]);
|
||||
const { database, calls } = fakeDatabase([[before], [], [after], [], []]);
|
||||
const app = await buildApp({
|
||||
config: loadConfig({ ...base, ...tokenConfig, STANDALONE_ACCESS: 'manager' }),
|
||||
database,
|
||||
|
|
@ -285,10 +286,11 @@ describe('attendance portal', () => {
|
|||
payload: { position: 'Старший администратор' },
|
||||
});
|
||||
expect(response.statusCode).toBe(200);
|
||||
expect(calls).toHaveLength(4);
|
||||
expect(calls).toHaveLength(5);
|
||||
expect(calls[0]?.[0]).toContain('FOR UPDATE');
|
||||
expect(calls[3]?.[1]?.[4]).toEqual(before);
|
||||
expect(calls[3]?.[1]?.[5]).toEqual(after);
|
||||
expect(calls[4]?.[0]).toContain('staff_sync_change_log');
|
||||
await app.close();
|
||||
});
|
||||
|
||||
|
|
|
|||
|
|
@ -12,6 +12,11 @@ const describeDatabase = connectionString ? describe : describe.skip;
|
|||
const migrationConnectionString =
|
||||
process.env.DATABASE_TEST_MIGRATION_URL ?? process.env.DATABASE_MIGRATION_URL;
|
||||
const cleanupTables = [
|
||||
'staff_biometric_consents',
|
||||
'staff_batch_notifications',
|
||||
'staff_payroll_batch_lines',
|
||||
'staff_payroll_batches',
|
||||
'staff_access_grants',
|
||||
'staff_sync_device_checkpoints',
|
||||
'staff_sync_command_inbox',
|
||||
'staff_sync_change_log',
|
||||
|
|
@ -311,5 +316,55 @@ describeDatabase('PostgreSQL tenant isolation', () => {
|
|||
),
|
||||
),
|
||||
).rejects.toThrow();
|
||||
|
||||
// Access grants tenant isolation
|
||||
const grantIdA = newUlid();
|
||||
await database.tenantTransaction(tenantA, actorA, async (client) => {
|
||||
await client.query(
|
||||
`INSERT INTO staff_access_grants (id, tenant_id, role, display_name, token_hash, token_hint, created_by)
|
||||
VALUES ($1, $2, 'point_manager', 'Manager A', '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 'hint', $3)`,
|
||||
[grantIdA, tenantA, actorA],
|
||||
);
|
||||
});
|
||||
|
||||
const grantVisibleToB = await database.tenantTransaction(tenantB, actorB, (client) =>
|
||||
client.query('SELECT id FROM staff_access_grants WHERE id = $1', [grantIdA]),
|
||||
);
|
||||
expect(grantVisibleToB.rowCount).toBe(0);
|
||||
|
||||
await expect(
|
||||
database.tenantTransaction(tenantB, actorB, (client) =>
|
||||
client.query(
|
||||
`INSERT INTO staff_access_grants (id, tenant_id, role, display_name, token_hash, token_hint, created_by)
|
||||
VALUES ($1, $2, 'point_manager', 'Manager B Fail', 'fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210', 'hint', $3)`,
|
||||
[newUlid(), tenantA, actorB],
|
||||
),
|
||||
),
|
||||
).rejects.toThrow();
|
||||
|
||||
// Biometric consents tenant isolation
|
||||
await database.tenantTransaction(tenantA, actorA, async (client) => {
|
||||
await client.query(
|
||||
`INSERT INTO staff_biometric_consents (tenant_id, employee_id, status, document_ref, updated_by)
|
||||
VALUES ($1, $2, 'granted', 'doc-ref-a', $3)`,
|
||||
[tenantA, employeeIdA, actorA],
|
||||
);
|
||||
});
|
||||
|
||||
const consentVisibleToB = await database.tenantTransaction(tenantB, actorB, (client) =>
|
||||
client.query('SELECT status FROM staff_biometric_consents WHERE employee_id = $1', [employeeIdA]),
|
||||
);
|
||||
expect(consentVisibleToB.rowCount).toBe(0);
|
||||
|
||||
await expect(
|
||||
database.tenantTransaction(tenantB, actorB, (client) =>
|
||||
client.query(
|
||||
`INSERT INTO staff_biometric_consents (tenant_id, employee_id, status, document_ref, updated_by)
|
||||
VALUES ($1, $2, 'revoked', 'doc-ref-b', $3)`,
|
||||
[tenantA, employeeIdA, actorB],
|
||||
),
|
||||
),
|
||||
).rejects.toThrow();
|
||||
});
|
||||
});
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue