Compare commits
1
Commits
v2.3.0
..
efc13a9f67
| Author | SHA1 | Date | |
|---|---|---|---|
 ksv741
|
efc13a9f67 |
@@ -89,9 +89,4 @@ Commits и PR titles — Conventional Commits с parser-recognized Issue referen
|
||||
`spec:`. Каждый commit содержит одну задачу. Исключения release и правила
|
||||
ссылки — в Engineering Workflow из AGENTS. Root другого checkout не управляет этим repo.
|
||||
Прямой push в `main`, force-push и перенос опубликованных тегов не входят в
|
||||
обычную работу. PR сливается squash или rebase-merge; merge-коммит не
|
||||
используется. `main` обновляется только fast-forward из `develop`, поэтому
|
||||
`origin/main` всегда предок `origin/develop`:
|
||||
`git merge-base --is-ancestor origin/main origin/develop`. Срочный fix —
|
||||
обычная ветка `fix/*` от `develop`; пути hotfix от `main` нет.
|
||||
Перед релизом прочитай местный README, раздел «Релизы».
|
||||
обычную работу. Перед release/hotfix прочитай местный README, раздел «Релизы».
|
||||
|
||||
@@ -34,11 +34,7 @@ jobs:
|
||||
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
||||
run: |
|
||||
printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
|
||||
if [[ "$PR_TITLE" =~ ^chore\(release\):\ [0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||||
npm run commitlint -- --strict --from "$HEAD_SHA^" --to "$HEAD_SHA"
|
||||
else
|
||||
npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
|
||||
fi
|
||||
npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
|
||||
|
||||
security:
|
||||
needs: commits
|
||||
|
||||
@@ -1,103 +1,5 @@
|
||||
# Changelog
|
||||
|
||||
## [2.3.0](https://git.personal.ksv741.ru/WealthLedger/backend/compare/v2.2.0...v2.3.0) (2026-10-24)
|
||||
|
||||
### Features
|
||||
|
||||
* log unhandled errors and pretty dev output (WealthLedger/backend[#120](https://git.personal.ksv741.ru/WealthLedger/backend/issues/120)) ([#126](https://git.personal.ksv741.ru/WealthLedger/backend/issues/126)) ([966a1f7](https://git.personal.ksv741.ru/WealthLedger/backend/commit/966a1f793aa2087cce3e47750e0017f78315bd64))
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* persist refresh cookie across browser restarts (WealthLedger/backend[#123](https://git.personal.ksv741.ru/WealthLedger/backend/issues/123)) ([d1f6969](https://git.personal.ksv741.ru/WealthLedger/backend/commit/d1f6969dc7c22ae3cf7396bccdbf0cea2f61db2e))
|
||||
|
||||
### Maintenance
|
||||
|
||||
* **deps:** update non-major dependencies [#11](https://git.personal.ksv741.ru/WealthLedger/backend/issues/11) ([449cfcd](https://git.personal.ksv741.ru/WealthLedger/backend/commit/449cfcd6c5a91307012bb3a640c8255ba243cbf5))
|
||||
|
||||
## [2.2.0](https://git.personal.ksv741.ru/WealthLedger/backend/compare/v2.1.0...v2.2.0) (2026-10-18)
|
||||
|
||||
### Features
|
||||
|
||||
* unify income payment cards and drop period comparisons (WealthLedger/main[#33](https://git.personal.ksv741.ru/WealthLedger/backend/issues/33)) ([#83](https://git.personal.ksv741.ru/WealthLedger/backend/issues/83)) ([31b0e15](https://git.personal.ksv741.ru/WealthLedger/backend/commit/31b0e1557978019a9293e5fd3efeee319194cddd))
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* align password policy to 8-72 printable ASCII on register (WealthLedger/backend[#60](https://git.personal.ksv741.ru/WealthLedger/backend/issues/60)) ([#109](https://git.personal.ksv741.ru/WealthLedger/backend/issues/109)) ([e03fad6](https://git.personal.ksv741.ru/WealthLedger/backend/commit/e03fad622bfec0fa7e42d536f65e361d319a1ac9))
|
||||
* restore screener OpenAPI constraints (WealthLedger/backend[#70](https://git.personal.ksv741.ru/WealthLedger/backend/issues/70)) ([#95](https://git.personal.ksv741.ru/WealthLedger/backend/issues/95)) ([2ad3517](https://git.personal.ksv741.ru/WealthLedger/backend/commit/2ad3517d87bffa8af9285d72fd6f78b96b3eed9f))
|
||||
* separate T-Bank RPC network time from queue wait (WealthLedger/backend[#81](https://git.personal.ksv741.ru/WealthLedger/backend/issues/81)) ([#94](https://git.personal.ksv741.ru/WealthLedger/backend/issues/94)) ([0d7839c](https://git.personal.ksv741.ru/WealthLedger/backend/commit/0d7839cf79669768bba55f420ed43304545ac8d9))
|
||||
* skip hourly terms overlapped by a long walk (WealthLedger/backend[#54](https://git.personal.ksv741.ru/WealthLedger/backend/issues/54)) ([6975853](https://git.personal.ksv741.ru/WealthLedger/backend/commit/6975853656698b61781ca056f35c0d68e47ea32a))
|
||||
* surface durable hourly attempt in accounts and income meta (WealthLedger/backend[#58](https://git.personal.ksv741.ru/WealthLedger/backend/issues/58)) ([14bcb9d](https://git.personal.ksv741.ru/WealthLedger/backend/commit/14bcb9da5ff081710d672d140175d348a03a2fe5))
|
||||
* translate permanent invalid-token errors on online entrypoints (WealthLedger/backend[#59](https://git.personal.ksv741.ru/WealthLedger/backend/issues/59)) ([#110](https://git.personal.ksv741.ru/WealthLedger/backend/issues/110)) ([8a6f60d](https://git.personal.ksv741.ru/WealthLedger/backend/commit/8a6f60d9651fc7c474dd9b3690314505e18c4fa0))
|
||||
|
||||
### Performance
|
||||
|
||||
* batch bank operation page relations (WealthLedger/backend[#68](https://git.personal.ksv741.ru/WealthLedger/backend/issues/68)) ([285dd08](https://git.personal.ksv741.ru/WealthLedger/backend/commit/285dd08472d9acb66fab8d46d511d9ce607b110f))
|
||||
* start bond search prices with details (WealthLedger/backend[#71](https://git.personal.ksv741.ru/WealthLedger/backend/issues/71)) ([#89](https://git.personal.ksv741.ru/WealthLedger/backend/issues/89)) ([da2e1d0](https://git.personal.ksv741.ru/WealthLedger/backend/commit/da2e1d0781d23f4ab1c38e7bf3cad2e254d026d5))
|
||||
|
||||
### Refactoring
|
||||
|
||||
* extract shared public instrument projection ([#69](https://git.personal.ksv741.ru/WealthLedger/backend/issues/69)) ([#84](https://git.personal.ksv741.ru/WealthLedger/backend/issues/84)) ([9b7e5e1](https://git.personal.ksv741.ru/WealthLedger/backend/commit/9b7e5e1215b7c1c5320effb6ba5b2c2a8b0cd604))
|
||||
* remove unreachable catalog producer and sync orchestration (WealthLedger/backend[#62](https://git.personal.ksv741.ru/WealthLedger/backend/issues/62)) ([#98](https://git.personal.ksv741.ru/WealthLedger/backend/issues/98)) ([96d4de4](https://git.personal.ksv741.ru/WealthLedger/backend/commit/96d4de4195b105d64ac6ffaf8d3d8aab4142ece4))
|
||||
|
||||
### CI
|
||||
|
||||
* validate edited PR titles (WealthLedger/backend[#74](https://git.personal.ksv741.ru/WealthLedger/backend/issues/74)) ([bbb5aff](https://git.personal.ksv741.ru/WealthLedger/backend/commit/bbb5afff842720374feecfcd74eea83283e0b2ae))
|
||||
|
||||
### Tests
|
||||
|
||||
* await portfolio publication done instead of polling ticks (WealthLedger/backend[#63](https://git.personal.ksv741.ru/WealthLedger/backend/issues/63)) ([#103](https://git.personal.ksv741.ru/WealthLedger/backend/issues/103)) ([7023021](https://git.personal.ksv741.ru/WealthLedger/backend/commit/702302126b81335959be2e66b4b5ad38e5806b70))
|
||||
* cover auth token, cookie and expiry boundaries (WealthLedger/backend[#61](https://git.personal.ksv741.ru/WealthLedger/backend/issues/61)) ([#113](https://git.personal.ksv741.ru/WealthLedger/backend/issues/113)) ([32622c1](https://git.personal.ksv741.ru/WealthLedger/backend/commit/32622c1dad9649842d8cb78d8e964da33e5df459))
|
||||
* isolate HTTP suites from scheduler and bank-card case order (WealthLedger/backend[#65](https://git.personal.ksv741.ru/WealthLedger/backend/issues/65)) ([#100](https://git.personal.ksv741.ru/WealthLedger/backend/issues/100)) ([9e4f9d9](https://git.personal.ksv741.ru/WealthLedger/backend/commit/9e4f9d9cab12aa714449b99280894a521c3514b6))
|
||||
* replace late portfolio sleep with started and done barriers (WealthLedger/backend[#63](https://git.personal.ksv741.ru/WealthLedger/backend/issues/63)) ([#101](https://git.personal.ksv741.ru/WealthLedger/backend/issues/101)) ([7bc7d8d](https://git.personal.ksv741.ru/WealthLedger/backend/commit/7bc7d8ddecc6cb9f387d00be68f61eb99d57d6fc))
|
||||
* replace metadata sleeps with upstream start barriers (WealthLedger/backend[#63](https://git.personal.ksv741.ru/WealthLedger/backend/issues/63)) ([#102](https://git.personal.ksv741.ru/WealthLedger/backend/issues/102)) ([ec6d9a2](https://git.personal.ksv741.ru/WealthLedger/backend/commit/ec6d9a2639f1845674bf7ce5fc357f2f7b7f5dfb))
|
||||
* slim sqlite runner regression workload (WealthLedger/backend[#72](https://git.personal.ksv741.ru/WealthLedger/backend/issues/72)) ([1033d21](https://git.personal.ksv741.ru/WealthLedger/backend/commit/1033d2114e99232a90c5d5c321749a9c6e3fbff0))
|
||||
|
||||
### Maintenance
|
||||
|
||||
* adopt linear git model in backend docs ([#111](https://git.personal.ksv741.ru/WealthLedger/backend/issues/111)) ([4f485ab](https://git.personal.ksv741.ru/WealthLedger/backend/commit/4f485ab0e9f0f9d52ae446e51966525473948b0e))
|
||||
* align SQLite driver version (WealthLedger/backend[#67](https://git.personal.ksv741.ru/WealthLedger/backend/issues/67)) ([203cc72](https://git.personal.ksv741.ru/WealthLedger/backend/commit/203cc72cb2d1aac34f39c5ba528820b511666f17))
|
||||
* drop unused direct source-map-support dependency (WealthLedger/backend[#4](https://git.personal.ksv741.ru/WealthLedger/backend/issues/4)) ([#96](https://git.personal.ksv741.ru/WealthLedger/backend/issues/96)) ([c789e33](https://git.personal.ksv741.ru/WealthLedger/backend/commit/c789e33c41281f2fc3de8851f21ae897a81e2b5d))
|
||||
* make OpenAPI export atomic and add read-only check (WealthLedger/backend[#3](https://git.personal.ksv741.ru/WealthLedger/backend/issues/3)) ([#97](https://git.personal.ksv741.ru/WealthLedger/backend/issues/97)) ([a93f2d5](https://git.personal.ksv741.ru/WealthLedger/backend/commit/a93f2d55e7a31515ed1cc056cd57101f2b315405))
|
||||
* unify verification preparation (WealthLedger/backend[#66](https://git.personal.ksv741.ru/WealthLedger/backend/issues/66)) ([b90cedd](https://git.personal.ksv741.ru/WealthLedger/backend/commit/b90cedd580321fb560a4ad0d9f9f5ba03303248e))
|
||||
|
||||
## [2.1.0](https://git.personal.ksv741.ru/WealthLedger/backend/compare/v2.0.0...v2.1.0) (2026-10-12)
|
||||
|
||||
### Features
|
||||
|
||||
* add hourly portfolio sync history ([0057925](https://git.personal.ksv741.ru/WealthLedger/backend/commit/0057925888dde874830149865fc5e13920ac5783))
|
||||
* add stock screener ([7d10ef8](https://git.personal.ksv741.ru/WealthLedger/backend/commit/7d10ef8adfce76ad2ed6368e1022fbd3f6847a23))
|
||||
* reconcile hourly investment resource states ([323b83b](https://git.personal.ksv741.ru/WealthLedger/backend/commit/323b83b5827d1191fbc14cfdf1d0e62f249fc78d))
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* align backend workflow rules (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/backend/issues/27)) ([c7d0600](https://git.personal.ksv741.ru/WealthLedger/backend/commit/c7d060023b612af9e1dd4c2a2fb2d5d1bf173784))
|
||||
* bound hourly step awaits by the per-step wait limit ([#56](https://git.personal.ksv741.ru/WealthLedger/backend/issues/56)) ([52fa3a3](https://git.personal.ksv741.ru/WealthLedger/backend/commit/52fa3a36baa5ab236a7ebd64ef1b4f447c91e129))
|
||||
* keep candle retries read-only ([947ffef](https://git.personal.ksv741.ru/WealthLedger/backend/commit/947ffefa9b8cad7f19355c187f2bd50c9739a822))
|
||||
* restore terminal hourly lifecycle after persistence failure ([#56](https://git.personal.ksv741.ru/WealthLedger/backend/issues/56)) ([fa57a20](https://git.personal.ksv741.ru/WealthLedger/backend/commit/fa57a201fdd8127774aee9af553da75a75add07c))
|
||||
* unblock backend dependency audit ([85858a1](https://git.personal.ksv741.ru/WealthLedger/backend/commit/85858a160f00dd428c80b8fa1824c1779245fdfe))
|
||||
|
||||
### Documentation
|
||||
|
||||
* clarify backend verification policy ([d7895f2](https://git.personal.ksv741.ru/WealthLedger/backend/commit/d7895f287ee802e7b13df7a2a4c6dba0b711e5a9))
|
||||
* pin backend workflow reference (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/backend/issues/27)) ([c5248db](https://git.personal.ksv741.ru/WealthLedger/backend/commit/c5248dbefc4b11a9f417bc835041a4294bd61047))
|
||||
|
||||
### CI
|
||||
|
||||
* skip checks on PR metadata edits ([0ad84ff](https://git.personal.ksv741.ru/WealthLedger/backend/commit/0ad84ff4f0b4712abc7e69dc299856f14af6eadd))
|
||||
|
||||
### Tests
|
||||
|
||||
* align all accounts metadata ([db375cb](https://git.personal.ksv741.ru/WealthLedger/backend/commit/db375cbee7d8f1eff48822b8e3c74898f40e8886))
|
||||
* align resource availability metadata ([bc631e7](https://git.personal.ksv741.ru/WealthLedger/backend/commit/bc631e72de0d9b0ff7b261b1ea644a73c2943d2a))
|
||||
* align upcoming events with local reads ([966b2a5](https://git.personal.ksv741.ru/WealthLedger/backend/commit/966b2a5836cdaf5b761e3c76568ff30a90ba1f4c))
|
||||
* extend ledger sqlite timeout ([4870d49](https://git.personal.ksv741.ru/WealthLedger/backend/commit/4870d4950303ad1de743e19b665b2fbdc05b781a))
|
||||
* increase ledger request timeout ([2facd86](https://git.personal.ksv741.ru/WealthLedger/backend/commit/2facd8675c74a97d92e0e8f44ed4a93aabb47674))
|
||||
|
||||
### Maintenance
|
||||
|
||||
* align backend engineering workflow (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/backend/issues/27)) ([a31e8d2](https://git.personal.ksv741.ru/WealthLedger/backend/commit/a31e8d2c4d85a21cdd5efdcc9f5fe503f210804b))
|
||||
* prune obsolete eslint suppressions ([a46a411](https://git.personal.ksv741.ru/WealthLedger/backend/commit/a46a4112cbcc72b1c3ff17cac4ac8bebcf579bca))
|
||||
|
||||
## [2.0.0](https://git.personal.ksv741.ru/WealthLedger/backend/compare/v1.0.0...v2.0.0) (2026-10-07)
|
||||
|
||||
### ⚠ BREAKING CHANGES
|
||||
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
FROM node:24.22.1-bookworm-slim AS base
|
||||
FROM node:24.21.0-bookworm-slim AS base
|
||||
WORKDIR /app
|
||||
|
||||
FROM base AS dependencies
|
||||
|
||||
@@ -307,57 +307,35 @@ Durability оставляет временные DB, логи и `result.json`
|
||||
Репозиторий выпускается независимо. `develop` — интеграция, `main` — принятые
|
||||
релизы. Обычная работа: issue-linked ветка от актуального `develop`, PR в `develop`;
|
||||
общие правила — в Engineering Workflow по ссылке из AGENTS.
|
||||
PR сливается squash или rebase-merge; merge-коммит не используется. `main`
|
||||
обновляется только fast-forward из `develop`, поэтому история линейна:
|
||||
|
||||
```text
|
||||
<type>/<issue>-<slug> --squash--> develop --ff-only--> main --> tag vX.Y.Z
|
||||
```
|
||||
|
||||
Инвариант: `origin/main` всегда предок `origin/develop`. Проверка:
|
||||
|
||||
```bash
|
||||
git fetch -q origin
|
||||
git merge-base --is-ancestor origin/main origin/develop && echo ok || echo BROKEN
|
||||
```
|
||||
|
||||
Обычные PR допускают squash; release и обратная синхронизация сохраняют историю.
|
||||
Commits и PR titles — Conventional Commits со ссылкой на Issue (кроме release),
|
||||
включая `spec:`. Версии вручную не повышай.
|
||||
|
||||
1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Проверь
|
||||
инвариант. Создай `release/X.Y.Z` от проверенного `develop`;
|
||||
`nvm use --silent`, `npm ci`.
|
||||
1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Убедись, что
|
||||
`develop` содержит последний релиз. Создай `release/<name>` от проверенного
|
||||
`develop`; `nvm use --silent`, `npm ci`. Hotfix начинается от `main` в
|
||||
`release/hotfix-<name>` и проходит тот же процесс.
|
||||
2. На чистой ветке выполни `npm run release:preview`, просмотри версию/changelog,
|
||||
затем `npm run release:prepare`. Команда создаёт `chore(release): X.Y.Z`,
|
||||
обновляет manifest/lockfile/CHANGELOG; тег и push не выполняет. Не обходи
|
||||
guards ветки, чистого дерева, отсутствующих тегов или уже подготовленной версии.
|
||||
3. Проверь diff и штатные gates этого репозитория. Отправь только release-ветку,
|
||||
открой PR в **`develop`** с заголовком `chore(release): X.Y.Z`. После зелёных
|
||||
`verify`, `security`, `commits` выполни fast-forward-only merge. Если
|
||||
`develop` изменился, обнови release-ветку и повтори проверки кандидата.
|
||||
4. Открой PR `develop → main` с тем же заголовком и слей fast-forward-only.
|
||||
5. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
|
||||
открой PR в `main` с заголовком `chore(release): X.Y.Z`. После зелёных
|
||||
`verify`, `security`, `commits` выполни fast-forward-only merge. Если `main`
|
||||
изменился, согласуй историю и повтори проверки кандидата.
|
||||
4. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
|
||||
manifest/lockfile. Создай аннотированный `vX.Y.Z` именно на этом SHA:
|
||||
`git tag -a vX.Y.Z <release-sha> -m "Release X.Y.Z"`, затем отправь только
|
||||
`git push origin refs/tags/vX.Y.Z`. Не запускай release-it повторно на `main`.
|
||||
Обратная синхронизация не нужна: release-коммит попал в `develop` на шаге 3.
|
||||
Опубликованные теги не перемещай. При сбое после merge создай отсутствующий тег
|
||||
без нового bump; до merge исправь и проверь существующий кандидат без
|
||||
повторного повышения версии.
|
||||
|
||||
Freeze релиза не поддерживается: пока открыт релизный PR, `develop` не двигают.
|
||||
Срочный fix — обычная ветка `fix/*` от `develop` с последующим релизом;
|
||||
пути от `main` нет, он сделал бы `main` не-предком `develop`. Исключение
|
||||
требует явного решения: `release/hotfix-<name>` от `main`, PR в `main`, тег,
|
||||
затем merge `main → develop` для восстановления инварианта.
|
||||
5. Верни release-коммит через PR `main → develop` без squash/rebase; проверь,
|
||||
что `develop` содержит тег. Опубликованные теги не перемещай. При сбое после
|
||||
merge создай отсутствующий тег без нового bump; до merge исправь и проверь
|
||||
существующий кандидат без повторного повышения версии.
|
||||
|
||||
`feat:` повышает minor, `fix:`/`perf:` и прочие разрешённые типы — patch;
|
||||
`!`/`BREAKING CHANGE:` — major, включая версии до 1.0. `chore(release):`
|
||||
исключён из рекомендации и changelog. Конфигурация — `.release-it.json`.
|
||||
В Gitea для `main`/`develop` должны быть запрещены прямой/force push и обход
|
||||
администратором, включена блокировка устаревшей ветки, обязательны `verify`,
|
||||
`security`, `commits`; теги `v*` защищены. Линейность обеспечивают merge styles
|
||||
репозитория: merge-коммиты и rebase `--no-ff` выключены, доступны squash,
|
||||
rebase-merge и fast-forward-only; стиль по умолчанию — squash.
|
||||
администратором, обязательны `verify`, `security`, `commits`; теги `v*` защищены.
|
||||
Workflow сам не включает эти настройки. Отдельное review approval для одного
|
||||
владельца не требуется. Npm publishing, deploy и Gitea Releases не включены.
|
||||
|
||||
+1
-1
@@ -37,7 +37,7 @@ export default defineConfig(
|
||||
linterOptions: { reportUnusedDisableDirectives: 'error' },
|
||||
settings: {
|
||||
'import-x/resolver-next': [createTypeScriptImportResolver()],
|
||||
'node': { tryExtensions: ['.ts', '.js', '.json', '.node'], version: '24.22.1' },
|
||||
'node': { tryExtensions: ['.ts', '.js', '.json', '.node'], version: '24.21.0' },
|
||||
},
|
||||
rules: {
|
||||
'curly': ['error', 'multi-line'],
|
||||
|
||||
Generated
+1271
-1011
File diff suppressed because it is too large
Load Diff
+39
-49
@@ -1,12 +1,12 @@
|
||||
{
|
||||
"name": "wealth-ledger-backend",
|
||||
"version": "2.3.0",
|
||||
"version": "2.0.0",
|
||||
"description": "",
|
||||
"author": "",
|
||||
"private": true,
|
||||
"license": "UNLICENSED",
|
||||
"engines": {
|
||||
"node": "v24.22.1"
|
||||
"node": "v24.21.0"
|
||||
},
|
||||
"scripts": {
|
||||
"build": "prisma generate && nest build",
|
||||
@@ -39,17 +39,17 @@
|
||||
"test:lint": "node --test test/eslint-config.cjs"
|
||||
},
|
||||
"dependencies": {
|
||||
"@grpc/grpc-js": "1.14.6",
|
||||
"@grpc/grpc-js": "1.14.5",
|
||||
"@grpc/proto-loader": "0.8.1",
|
||||
"@nestjs/common": "12.2.0",
|
||||
"@nestjs/config": "12.0.1",
|
||||
"@nestjs/core": "12.2.0",
|
||||
"@nestjs/jwt": "12.0.3",
|
||||
"@nestjs/common": "12.0.1",
|
||||
"@nestjs/config": "12.0.0",
|
||||
"@nestjs/core": "12.0.1",
|
||||
"@nestjs/jwt": "12.0.1",
|
||||
"@nestjs/passport": "12.0.0",
|
||||
"@nestjs/platform-express": "12.2.0",
|
||||
"@nestjs/swagger": "12.0.4",
|
||||
"@prisma/adapter-better-sqlite3": "7.10.1",
|
||||
"@prisma/client": "7.10.1",
|
||||
"@nestjs/platform-express": "12.0.1",
|
||||
"@nestjs/swagger": "12.0.1",
|
||||
"@prisma/adapter-better-sqlite3": "7.10.0",
|
||||
"@prisma/client": "7.10.0",
|
||||
"bcrypt": "6.0.0",
|
||||
"better-sqlite3": "12.11.1",
|
||||
"cheerio": "1.2.0",
|
||||
@@ -57,77 +57,67 @@
|
||||
"class-validator": "0.15.1",
|
||||
"cookie-parser": "1.4.7",
|
||||
"dotenv": "17.4.2",
|
||||
"lru-cache": "11.5.3",
|
||||
"nestjs-pino": "5.3.1",
|
||||
"lru-cache": "11.5.2",
|
||||
"nestjs-pino": "5.1.0",
|
||||
"passport": "0.7.0",
|
||||
"passport-jwt": "4.0.1",
|
||||
"pino-http": "11.0.0",
|
||||
"prisma": "7.10.1",
|
||||
"prisma": "7.10.0",
|
||||
"reflect-metadata": "0.2.2",
|
||||
"rxjs": "7.8.2"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@commitlint/cli": "21.2.4",
|
||||
"@commitlint/config-conventional": "21.2.4",
|
||||
"@darraghor/eslint-plugin-nestjs-typed": "7.5.8",
|
||||
"@commitlint/cli": "21.2.2",
|
||||
"@commitlint/config-conventional": "21.2.2",
|
||||
"@darraghor/eslint-plugin-nestjs-typed": "7.5.6",
|
||||
"@eslint/js": "10.0.1",
|
||||
"@nestjs/cli": "12.0.10",
|
||||
"@nestjs/schematics": "12.0.10",
|
||||
"@nestjs/testing": "12.2.0",
|
||||
"@release-it/conventional-changelog": "12.0.2",
|
||||
"@nestjs/cli": "12.0.0",
|
||||
"@nestjs/schematics": "12.0.1",
|
||||
"@nestjs/testing": "12.0.1",
|
||||
"@release-it/conventional-changelog": "12.0.0",
|
||||
"@stylistic/eslint-plugin": "5.10.0",
|
||||
"@types/bcrypt": "6.0.0",
|
||||
"@types/cookie-parser": "1.4.10",
|
||||
"@types/express": "5.0.6",
|
||||
"@types/jest": "30.0.0",
|
||||
"@types/node": "24.19.2",
|
||||
"@types/node": "24.13.4",
|
||||
"@types/passport-jwt": "4.0.1",
|
||||
"@types/supertest": "7.2.1",
|
||||
"conventional-changelog-conventionalcommits": "10.4.1",
|
||||
"eslint": "10.13.0",
|
||||
"conventional-changelog-conventionalcommits": "10.4.0",
|
||||
"eslint": "10.11.0",
|
||||
"eslint-import-resolver-typescript": "4.4.5",
|
||||
"eslint-plugin-import-x": "4.17.1",
|
||||
"eslint-plugin-jest": "29.17.0",
|
||||
"eslint-plugin-n": "18.5.0",
|
||||
"eslint-plugin-perfectionist": "5.13.0",
|
||||
"eslint-plugin-jest": "29.16.6",
|
||||
"eslint-plugin-n": "18.4.0",
|
||||
"eslint-plugin-perfectionist": "5.12.1",
|
||||
"eslint-plugin-regexp": "3.3.1",
|
||||
"eslint-plugin-security": "4.2.0",
|
||||
"eslint-plugin-sonarjs": "4.2.2",
|
||||
"globals": "17.13.0",
|
||||
"jest": "30.5.2",
|
||||
"pino-pretty": "13.2.0",
|
||||
"release-it": "21.1.1",
|
||||
"supertest": "7.3.1",
|
||||
"ts-jest": "29.4.15",
|
||||
"eslint-plugin-security": "4.1.0",
|
||||
"eslint-plugin-sonarjs": "4.2.1",
|
||||
"globals": "17.12.0",
|
||||
"jest": "30.5.1",
|
||||
"release-it": "21.0.2",
|
||||
"supertest": "7.2.2",
|
||||
"ts-jest": "29.4.12",
|
||||
"ts-loader": "9.6.2",
|
||||
"ts-node": "10.9.2",
|
||||
"tsconfig-paths": "4.2.0",
|
||||
"typescript": "6.0.3",
|
||||
"typescript-eslint": "8.72.0"
|
||||
"typescript-eslint": "8.70.1"
|
||||
},
|
||||
"overrides": {
|
||||
"proxy-addr": "2.0.8",
|
||||
"express": {
|
||||
"body-parser": "2.4.0"
|
||||
},
|
||||
"@nestjs/platform-express": {
|
||||
"multer": "2.5.0"
|
||||
},
|
||||
"ajv": {
|
||||
"fast-uri": "3.1.9"
|
||||
"multer": "2.4.0"
|
||||
},
|
||||
"@prisma/config@7.10.0": {
|
||||
"deepmerge-ts": "8.0.2"
|
||||
},
|
||||
"release-it": {
|
||||
"basic-ftp": "6.2.3",
|
||||
"undici": "7.30.1"
|
||||
},
|
||||
"socks": {
|
||||
"ip-address": "10.7.4"
|
||||
"basic-ftp": "6.2.1",
|
||||
"undici": "7.29.1"
|
||||
},
|
||||
"prisma": {
|
||||
"mysql2": "3.24.6"
|
||||
"mysql2": "3.24.4"
|
||||
}
|
||||
},
|
||||
"jest": {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { BadRequestException, ValidationPipe } from '@nestjs/common';
|
||||
|
||||
import { LoginDto, RegisterDto } from '../modules/auth/presentation/auth.dto';
|
||||
import { CredentialsDto } from '../modules/auth/presentation/auth.dto';
|
||||
import {
|
||||
CreateBankCardDto,
|
||||
UpdateBankCardDto,
|
||||
@@ -11,7 +11,7 @@ describe('DTO validation', () => {
|
||||
forbidUnknownValues: true, transform: true, whitelist: true });
|
||||
|
||||
it('requires credentials and normalizes a valid email', async () => {
|
||||
const metadata = { type: 'body' as const, metatype: RegisterDto };
|
||||
const metadata = { type: 'body' as const, metatype: CredentialsDto };
|
||||
await expect(pipe.transform({}, metadata)).rejects.toBeInstanceOf(
|
||||
BadRequestException,
|
||||
);
|
||||
@@ -29,59 +29,6 @@ describe('DTO validation', () => {
|
||||
});
|
||||
});
|
||||
|
||||
// Test intent: register accepts 8..72 printable ASCII characters only (bcrypt
|
||||
// reads 72 bytes, so non-ASCII could be silently truncated); login only caps
|
||||
// bytes so accounts created under the older policy can still sign in.
|
||||
describe('password policy', () => {
|
||||
const register = { type: 'body' as const, metatype: RegisterDto };
|
||||
const login = { type: 'body' as const, metatype: LoginDto };
|
||||
const body = (password: string) => ({ email: 'user@example.com', password });
|
||||
const accepts = (value: unknown, metadata: typeof login | typeof register) =>
|
||||
pipe.transform(value, metadata).then(
|
||||
() => true,
|
||||
(error: unknown) => {
|
||||
if (!(error instanceof BadRequestException)) throw error;
|
||||
return false;
|
||||
},
|
||||
);
|
||||
|
||||
it.each([
|
||||
['7 chars', 'a'.repeat(7), false],
|
||||
['8 chars', 'a'.repeat(8), true],
|
||||
['72 chars', 'a'.repeat(72), true],
|
||||
['73 chars', 'a'.repeat(73), false],
|
||||
['all printable symbols and space', 'Aa1 !~"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}', true],
|
||||
['Cyrillic, 8+ chars', 'пароль-пароль', false],
|
||||
['emoji', 'passw😀rd', false],
|
||||
['tab', 'pass\tword1', false],
|
||||
['newline', 'password1\n', false],
|
||||
['DEL', 'password\x7f1', false],
|
||||
['non-string', 12345678, false],
|
||||
])('register: %s', async (_, password, accepted) => {
|
||||
await expect(accepts(body(password as string), register)).resolves.toBe(accepted);
|
||||
});
|
||||
|
||||
it('register keeps raw whitespace untouched', async () => {
|
||||
const password = ' spaced pass ';
|
||||
await expect(pipe.transform(body(password), register)).resolves.toEqual(
|
||||
body(password),
|
||||
);
|
||||
});
|
||||
|
||||
it.each([
|
||||
['legacy Cyrillic password', 'пароль-пароль', true],
|
||||
['short legacy password', 'short', true],
|
||||
['72 bytes', 'a'.repeat(72), true],
|
||||
['73 bytes', 'a'.repeat(73), false],
|
||||
['36 Cyrillic letters = 72 bytes', 'я'.repeat(36), true],
|
||||
['37 Cyrillic letters = 74 bytes', 'я'.repeat(37), false],
|
||||
['empty', '', false],
|
||||
['non-string', 12345678, false],
|
||||
])('login: %s', async (_, password, accepted) => {
|
||||
await expect(accepts(body(password as string), login)).resolves.toBe(accepted);
|
||||
});
|
||||
});
|
||||
|
||||
it('requires and validates nested money in a new card', async () => {
|
||||
const metadata = { type: 'body' as const, metatype: CreateBankCardDto };
|
||||
const card = {
|
||||
|
||||
@@ -1,29 +1,24 @@
|
||||
import { ArgumentsHost, BadRequestException } from '@nestjs/common';
|
||||
import { ArgumentsHost } from '@nestjs/common';
|
||||
|
||||
import { StructuredLogger } from '../logging/structured-logger.service';
|
||||
import { HttpExceptionFilter } from './http-exception.filter';
|
||||
|
||||
describe('HttpExceptionFilter', () => {
|
||||
const setup = () => {
|
||||
it('does not expose internal error details', () => {
|
||||
const status = jest.fn().mockReturnThis();
|
||||
const type = jest.fn().mockReturnThis();
|
||||
const json = jest.fn();
|
||||
const locals: Record<string, unknown> = {};
|
||||
const logger = { event: jest.fn() };
|
||||
const filter = new HttpExceptionFilter(logger as unknown as StructuredLogger);
|
||||
const filter = new HttpExceptionFilter();
|
||||
const host = {
|
||||
switchToHttp: () => ({
|
||||
getResponse: () => ({ status, type, json, locals }),
|
||||
}),
|
||||
} as unknown as ArgumentsHost;
|
||||
return { filter, host, status, type, json, locals, logger };
|
||||
};
|
||||
|
||||
it('logs unhandled errors with name and stack frames but never the message', () => {
|
||||
const { filter, host, status, type, json, locals, logger } = setup();
|
||||
const error = new Error('operation failed\npassword: SYNTHETIC_AUDIT_SECRET');
|
||||
|
||||
filter.catch(error, host);
|
||||
filter.catch(
|
||||
new Error('operation failed\npassword: SYNTHETIC_AUDIT_SECRET'),
|
||||
host,
|
||||
);
|
||||
|
||||
expect(status).toHaveBeenCalledWith(500);
|
||||
expect(type).toHaveBeenCalledWith('application/problem+json');
|
||||
@@ -32,29 +27,6 @@ describe('HttpExceptionFilter', () => {
|
||||
code: 'INTERNAL_SERVER_ERROR',
|
||||
});
|
||||
expect(locals.publicErrorCode).toBe('INTERNAL_SERVER_ERROR');
|
||||
expect(logger.event).toHaveBeenCalledTimes(1);
|
||||
const [level, event, fields] = logger.event.mock.calls[0] as [string, string, Record<string, unknown>];
|
||||
expect(level).toBe('error');
|
||||
expect(event).toBe('http.request.unhandled');
|
||||
expect(fields).toMatchObject({ code: 'INTERNAL_SERVER_ERROR', errorName: 'Error' });
|
||||
expect(JSON.stringify(fields)).not.toContain('SYNTHETIC_AUDIT_SECRET');
|
||||
expect(String(fields['errorStack']).split('\n').every((line) => line.startsWith(' at '))).toBe(true);
|
||||
});
|
||||
|
||||
it('logs field pointers without values for validation errors', () => {
|
||||
const { filter, host, status, logger, locals } = setup();
|
||||
const exception = new BadRequestException({
|
||||
message: [
|
||||
{ property: 'amount', constraints: { isPositive: 'amount must be positive' }, value: -42 },
|
||||
{ property: 'amount', constraints: { min: 'amount too small' }, value: -42 },
|
||||
],
|
||||
});
|
||||
|
||||
filter.catch(exception, host);
|
||||
|
||||
expect(status).toHaveBeenCalledWith(400);
|
||||
expect(locals.invalidFields).toBe('#/amount');
|
||||
expect(logger.event).not.toHaveBeenCalled();
|
||||
expect(JSON.stringify(locals)).not.toContain('-42');
|
||||
expect(locals.errorStack).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
@@ -10,12 +10,9 @@ import {
|
||||
} from '@nestjs/common';
|
||||
|
||||
import { HttpErrorCode } from '../error-code';
|
||||
import { StructuredLogger } from '../logging/structured-logger.service';
|
||||
|
||||
@Catch()
|
||||
export class HttpExceptionFilter implements ExceptionFilter {
|
||||
constructor(private readonly logger: StructuredLogger) {}
|
||||
|
||||
catch(exception: unknown, host: ArgumentsHost): void {
|
||||
const context = host.switchToHttp();
|
||||
const response = context.getResponse<Response>();
|
||||
@@ -34,18 +31,6 @@ export class HttpExceptionFilter implements ExceptionFilter {
|
||||
: this.codeFor(status, payload);
|
||||
response.locals ??= {};
|
||||
response.locals.publicErrorCode = code;
|
||||
if (isValidation) {
|
||||
response.locals.invalidFields = [
|
||||
...new Set(
|
||||
this.validationErrors(
|
||||
(payload as { message: ValidationError[] }).message,
|
||||
).map((error) => error.pointer),
|
||||
),
|
||||
].join(',');
|
||||
}
|
||||
if (!(exception instanceof HttpException)) {
|
||||
this.logUnhandled(exception, code);
|
||||
}
|
||||
response
|
||||
.status(status)
|
||||
.type('application/problem+json')
|
||||
@@ -62,20 +47,6 @@ export class HttpExceptionFilter implements ExceptionFilter {
|
||||
});
|
||||
}
|
||||
|
||||
// ponytail: stack содержит текст message в первой строке; оставляем только кадры, message не пишем.
|
||||
private logUnhandled(exception: unknown, code: string): void {
|
||||
const error = exception instanceof Error ? exception : undefined;
|
||||
const frames = (error?.stack ?? '')
|
||||
.split('\n')
|
||||
.filter((line) => line.startsWith(' at '))
|
||||
.join('\n');
|
||||
this.logger.event('error', 'http.request.unhandled', {
|
||||
code,
|
||||
errorName: error?.name ?? typeof exception,
|
||||
errorStack: frames,
|
||||
});
|
||||
}
|
||||
|
||||
private codeFor(status: number, payload: unknown): string {
|
||||
if (typeof payload === 'object' && payload !== null && 'code' in payload) {
|
||||
const code = (payload as { code?: unknown }).code;
|
||||
|
||||
@@ -24,7 +24,6 @@ function completion(request: Request, response: Response, value: { responseTime:
|
||||
status: response.statusCode,
|
||||
durationMs: Math.round(value.responseTime),
|
||||
...(typeof response.locals.publicErrorCode === 'string' ? { code: response.locals.publicErrorCode } : {}),
|
||||
...(typeof response.locals.invalidFields === 'string' ? { invalidFields: response.locals.invalidFields } : {}),
|
||||
};
|
||||
}
|
||||
|
||||
@@ -32,10 +31,6 @@ export function loggingOptions(config: ConfigService<Environment, true>): Option
|
||||
return {
|
||||
level: config.getOrThrow('LOG_LEVEL'),
|
||||
messageKey: 'message',
|
||||
// ponytail: development-only pretty output; production never loads pino-pretty.
|
||||
...(process.env['NODE_ENV'] === 'development'
|
||||
? { transport: { target: 'pino-pretty', options: { colorize: true, singleLine: true, messageKey: 'message' } } }
|
||||
: {}),
|
||||
genReqId: (_request, response) => {
|
||||
const id = randomUUID();
|
||||
response.setHeader('X-Request-ID', id);
|
||||
|
||||
@@ -14,12 +14,9 @@ const allowedFields = new Set([
|
||||
'count',
|
||||
'durationMs',
|
||||
'environment',
|
||||
'errorName',
|
||||
'errorStack',
|
||||
'found',
|
||||
'grpcCode',
|
||||
'headersReceived',
|
||||
'invalidFields',
|
||||
'method',
|
||||
'networkMs',
|
||||
'operation',
|
||||
|
||||
@@ -121,11 +121,19 @@ export class TbankAccessService {
|
||||
return work ? this.tokens.decrypt(work.connection.encryptedToken) : null;
|
||||
}
|
||||
|
||||
// Online reads: a permanent upstream auth refusal becomes 400/INVALID_TBANK_TOKEN here, once, for every caller.
|
||||
async online<T>(
|
||||
userId: string,
|
||||
run: (connection: { revision: string; token: string }) => Promise<T>,
|
||||
): Promise<T> {
|
||||
async onlineToken(userId: string) {
|
||||
const connection = await this.prisma.tbankConnection.findUnique({
|
||||
where: { userId },
|
||||
select: { encryptedToken: true, invalidToken: true },
|
||||
});
|
||||
if (!connection) throw new ConflictException({ code: TbankErrorCode.NotConnected });
|
||||
if (connection.invalidToken) {
|
||||
throw new BadRequestException({ code: TbankErrorCode.InvalidToken });
|
||||
}
|
||||
return this.tokens.decrypt(connection.encryptedToken);
|
||||
}
|
||||
|
||||
async current(userId: string): Promise<{ revision: string; token: string }> {
|
||||
const connection = await this.prisma.tbankConnection.findUnique({
|
||||
where: { userId },
|
||||
select: { encryptedToken: true, invalidToken: true, revision: true },
|
||||
@@ -134,8 +142,7 @@ export class TbankAccessService {
|
||||
if (connection.invalidToken) {
|
||||
throw new BadRequestException({ code: TbankErrorCode.InvalidToken });
|
||||
}
|
||||
const token = this.tokens.decrypt(connection.encryptedToken);
|
||||
return this.tokens.translateInvalidToken(() => run({ revision: connection.revision, token }));
|
||||
return { revision: connection.revision, token: this.tokens.decrypt(connection.encryptedToken) };
|
||||
}
|
||||
|
||||
async publishMembership(
|
||||
|
||||
+1
-1
@@ -37,7 +37,7 @@ export function configureApp(app: INestApplication): void {
|
||||
exceptionFactory: (message) => new BadRequestException({ message }),
|
||||
}),
|
||||
);
|
||||
app.useGlobalFilters(new HttpExceptionFilter(app.get(StructuredLogger)));
|
||||
app.useGlobalFilters(new HttpExceptionFilter());
|
||||
app.enableShutdownHooks();
|
||||
}
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ import { AuthenticationResult, AuthUser, RefreshPayload } from './auth.types';
|
||||
const EXPECTED_ROTATED_SESSIONS = 1;
|
||||
|
||||
const PASSWORD_HASH_ROUNDS = 12;
|
||||
export const REFRESH_TTL_MS = 604_800_000;
|
||||
const REFRESH_TTL_MS = 604_800_000;
|
||||
|
||||
const ACCESS_TTL = '15m';
|
||||
const REFRESH_TTL = '7d';
|
||||
|
||||
@@ -22,9 +22,9 @@ import {
|
||||
|
||||
import { ApiProblemResponses } from '../../../common/decorators/api-safe-error-response.decorator';
|
||||
import { HttpErrorCode } from '../../../common/error-code';
|
||||
import { AuthService, REFRESH_TTL_MS } from '../application/auth.service';
|
||||
import { AuthService } from '../application/auth.service';
|
||||
import { AccessPayload, AuthenticationResult } from '../application/auth.types';
|
||||
import { LoginDto, RegisterDto } from './auth.dto';
|
||||
import { CredentialsDto } from './auth.dto';
|
||||
import { JwtAuthGuard } from './jwt-auth.guard';
|
||||
|
||||
const REFRESH_COOKIE = 'refresh_token';
|
||||
@@ -56,7 +56,7 @@ export class AuthController {
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiOkResponse({ type: AuthenticationDto })
|
||||
async register(
|
||||
@Body() credentials: RegisterDto,
|
||||
@Body() credentials: CredentialsDto,
|
||||
@Res({ passthrough: true }) response: Response,
|
||||
) {
|
||||
return this.respond(
|
||||
@@ -69,7 +69,7 @@ export class AuthController {
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiOkResponse({ type: AuthenticationDto })
|
||||
async login(
|
||||
@Body() credentials: LoginDto,
|
||||
@Body() credentials: CredentialsDto,
|
||||
@Res({ passthrough: true }) response: Response,
|
||||
) {
|
||||
return this.respond(
|
||||
@@ -134,7 +134,6 @@ export class AuthController {
|
||||
sameSite: 'lax' as const,
|
||||
secure: process.env['NODE_ENV'] !== 'development',
|
||||
path: COOKIE_PATH,
|
||||
maxAge: REFRESH_TTL_MS,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
import { ApiProperty } from '@nestjs/swagger';
|
||||
import { Transform } from 'class-transformer';
|
||||
import {
|
||||
IsNotEmpty,
|
||||
IsString,
|
||||
Matches,
|
||||
MinLength,
|
||||
Validate,
|
||||
ValidatorConstraint,
|
||||
} from 'class-validator';
|
||||
@@ -14,10 +13,8 @@ const FIRST_CHARACTER_INDEX = 0;
|
||||
const MAX_EMAIL_LENGTH = 254;
|
||||
const ASCII_SPACE = 32;
|
||||
const ASCII_DELETE = 127;
|
||||
// bcrypt reads at most 72 bytes; printable ASCII keeps characters == bytes.
|
||||
const MIN_PASSWORD_LENGTH = 8;
|
||||
const MIN_PASSWORD_LENGTH = 12;
|
||||
const MAX_PASSWORD_BYTES = 72;
|
||||
const PASSWORD_PATTERN = `^[\\x20-\\x7E]{${MIN_PASSWORD_LENGTH},${MAX_PASSWORD_BYTES}}$`;
|
||||
|
||||
@ValidatorConstraint({ name: 'email' })
|
||||
class EmailConstraint {
|
||||
@@ -43,9 +40,8 @@ class EmailConstraint {
|
||||
}
|
||||
}
|
||||
|
||||
// Login stays lenient: accounts created under an older policy must still sign in.
|
||||
@ValidatorConstraint({ name: 'passwordMaxBytes' })
|
||||
class PasswordMaxBytesConstraint {
|
||||
@ValidatorConstraint({ name: 'passwordBytes' })
|
||||
class PasswordBytesConstraint {
|
||||
validate(value: unknown): boolean {
|
||||
return (
|
||||
typeof value === 'string' &&
|
||||
@@ -54,11 +50,11 @@ class PasswordMaxBytesConstraint {
|
||||
}
|
||||
|
||||
defaultMessage(): string {
|
||||
return `must not exceed ${MAX_PASSWORD_BYTES} UTF-8 bytes`;
|
||||
return 'must not exceed 72 UTF-8 bytes';
|
||||
}
|
||||
}
|
||||
|
||||
class EmailDto {
|
||||
export class CredentialsDto {
|
||||
@ApiProperty({ example: 'user@example.com' })
|
||||
@IsString()
|
||||
@Transform(({ value }: { value: unknown }) =>
|
||||
@@ -66,28 +62,14 @@ class EmailDto {
|
||||
)
|
||||
@Validate(EmailConstraint)
|
||||
declare email: string;
|
||||
}
|
||||
|
||||
export class RegisterDto extends EmailDto {
|
||||
@ApiProperty({
|
||||
description: `Raw password: ${MIN_PASSWORD_LENGTH}-${MAX_PASSWORD_BYTES} printable ASCII characters (letters, digits, symbols, space). Not trimmed or normalized.`,
|
||||
pattern: PASSWORD_PATTERN,
|
||||
minLength: MIN_PASSWORD_LENGTH,
|
||||
maxLength: MAX_PASSWORD_BYTES,
|
||||
example: 'a secure password',
|
||||
})
|
||||
@IsString()
|
||||
@Matches(new RegExp(PASSWORD_PATTERN), {
|
||||
message: `must be ${MIN_PASSWORD_LENGTH}-${MAX_PASSWORD_BYTES} printable ASCII characters`,
|
||||
})
|
||||
declare password: string;
|
||||
}
|
||||
|
||||
export class LoginDto extends EmailDto {
|
||||
@ApiProperty({
|
||||
description: `Raw password, at most ${MAX_PASSWORD_BYTES} UTF-8 bytes. Not trimmed or normalized.`,
|
||||
example: 'a secure password',
|
||||
})
|
||||
@IsString()
|
||||
@IsNotEmpty()
|
||||
@Validate(PasswordMaxBytesConstraint)
|
||||
@MinLength(MIN_PASSWORD_LENGTH)
|
||||
@Validate(PasswordBytesConstraint)
|
||||
declare password: string;
|
||||
}
|
||||
|
||||
@@ -122,11 +122,11 @@ export class CatalogDiscoveryService {
|
||||
observe = false,
|
||||
) {
|
||||
if (!observe) {
|
||||
const instrument = await this.access.online(userId, ({ token }) =>
|
||||
const token = await this.access.onlineToken(userId);
|
||||
const instrument =
|
||||
instrumentType === 'share'
|
||||
? this.tbank.getShare(token, uid)
|
||||
: this.tbank.getBond(token, uid),
|
||||
);
|
||||
? await this.tbank.getShare(token, uid)
|
||||
: await this.tbank.getBond(token, uid);
|
||||
if (!instrument) throw new NotFoundException();
|
||||
return {
|
||||
data: { ...publicInstrument({ ...instrument, uid }), uid, slug: instrument.ticker?.toUpperCase() ?? uid },
|
||||
@@ -201,11 +201,11 @@ export class CatalogDiscoveryService {
|
||||
) {
|
||||
if (!observe) {
|
||||
const query = ticker.trim().toUpperCase();
|
||||
const found = await this.access.online(userId, ({ token }) =>
|
||||
const token = await this.access.onlineToken(userId);
|
||||
const found =
|
||||
instrumentType === 'share'
|
||||
? this.tbank.findShares(token, query)
|
||||
: this.tbank.findBonds(token, query),
|
||||
);
|
||||
? await this.tbank.findShares(token, query)
|
||||
: await this.tbank.findBonds(token, query);
|
||||
const matches = selectCatalogInstruments(
|
||||
found.filter((item) => item.ticker?.trim().toUpperCase() === query),
|
||||
query,
|
||||
@@ -268,32 +268,30 @@ export class CatalogDiscoveryService {
|
||||
}
|
||||
|
||||
private async onlineSearch(userId: string, input: CatalogQuery) {
|
||||
const { details, instruments, prices } = await this.access.online(userId, async ({ token }) => {
|
||||
const found =
|
||||
input.instrumentType === 'share'
|
||||
? await this.tbank.findShares(token, input.query)
|
||||
: await this.tbank.findBonds(token, input.query);
|
||||
const instruments = selectCatalogInstruments(
|
||||
input.exactTicker
|
||||
? found.filter((item) => item.ticker?.trim().toUpperCase() === input.query)
|
||||
: found,
|
||||
input.query,
|
||||
input.instrumentType,
|
||||
).slice(FIRST_RESULT_OFFSET, input.exactTicker ? tickerAmbiguityLimit : catalogSearchLimit);
|
||||
const [details, prices] = await Promise.all([
|
||||
Promise.all(
|
||||
instruments.map((item) =>
|
||||
input.instrumentType === 'share'
|
||||
? this.tbank.getShare(token, item.uid)
|
||||
: this.tbank.getBond(token, item.uid),
|
||||
),
|
||||
const token = await this.access.onlineToken(userId);
|
||||
const found =
|
||||
input.instrumentType === 'share'
|
||||
? await this.tbank.findShares(token, input.query)
|
||||
: await this.tbank.findBonds(token, input.query);
|
||||
const instruments = selectCatalogInstruments(
|
||||
input.exactTicker
|
||||
? found.filter((item) => item.ticker?.trim().toUpperCase() === input.query)
|
||||
: found,
|
||||
input.query,
|
||||
input.instrumentType,
|
||||
).slice(FIRST_RESULT_OFFSET, input.exactTicker ? tickerAmbiguityLimit : catalogSearchLimit);
|
||||
const [details, prices] = await Promise.all([
|
||||
Promise.all(
|
||||
instruments.map((item) =>
|
||||
input.instrumentType === 'share'
|
||||
? this.tbank.getShare(token, item.uid)
|
||||
: this.tbank.getBond(token, item.uid),
|
||||
),
|
||||
instruments.length
|
||||
? this.tbank.getLastPrices(token, instruments.map((item) => item.uid))
|
||||
: [],
|
||||
]);
|
||||
return { details, instruments, prices };
|
||||
});
|
||||
),
|
||||
instruments.length
|
||||
? this.tbank.getLastPrices(token, instruments.map((item) => item.uid))
|
||||
: [],
|
||||
]);
|
||||
const fetchedAt = new Date();
|
||||
const data = instruments.flatMap((item, index) => {
|
||||
const detail = details.at(index);
|
||||
|
||||
@@ -231,6 +231,7 @@ export class CatalogEnrichmentService {
|
||||
return reservation;
|
||||
}
|
||||
|
||||
// eslint-disable-next-line sonarjs/cognitive-complexity -- Section composition owns the source dependency policy.
|
||||
async section(
|
||||
userId: string,
|
||||
instrumentType: 'bond' | 'share',
|
||||
@@ -239,20 +240,18 @@ export class CatalogEnrichmentService {
|
||||
observe = false,
|
||||
) {
|
||||
if (section === 'company' && !observe) {
|
||||
const { description, fundamentals, instrument } = await this.access.online(userId, async ({ token }) => {
|
||||
const instrument =
|
||||
instrumentType === 'share'
|
||||
? await this.tbank.getShare(token, uid)
|
||||
: await this.tbank.getBond(token, uid);
|
||||
if (!instrument) throw new NotFoundException();
|
||||
const [description, fundamentals] = instrument.assetUid
|
||||
? await Promise.all([
|
||||
this.tbank.getAssetDescription(token, instrument.assetUid),
|
||||
this.tbank.getFundamentals(token, instrument.assetUid),
|
||||
])
|
||||
: [null, null];
|
||||
return { description, fundamentals, instrument };
|
||||
});
|
||||
const token = await this.access.onlineToken(userId);
|
||||
const instrument =
|
||||
instrumentType === 'share'
|
||||
? await this.tbank.getShare(token, uid)
|
||||
: await this.tbank.getBond(token, uid);
|
||||
if (!instrument) throw new NotFoundException();
|
||||
const [description, fundamentals] = instrument.assetUid
|
||||
? await Promise.all([
|
||||
this.tbank.getAssetDescription(token, instrument.assetUid),
|
||||
this.tbank.getFundamentals(token, instrument.assetUid),
|
||||
])
|
||||
: [null, null];
|
||||
const meta = investmentResourceMeta({
|
||||
resourceKey: `${instrumentType}/company/${uid}`,
|
||||
dataRevision: `online:${Date.now()}`,
|
||||
|
||||
+2
-4
@@ -22,16 +22,14 @@ function share(index: number, overrides: Partial<TbankShare> = {}): TbankShare {
|
||||
}
|
||||
|
||||
describe('StockScreenerService', () => {
|
||||
const access = { online: jest.fn(), local: jest.fn() };
|
||||
const access = { current: jest.fn(), local: jest.fn() };
|
||||
const client = { getAllShares: jest.fn() };
|
||||
const logger = { event: jest.fn() };
|
||||
let service: StockScreenerService;
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks();
|
||||
access.online.mockImplementation((_userId: string, run: (connection: { revision: string; token: string }) => Promise<unknown>) =>
|
||||
run({ revision, token }),
|
||||
);
|
||||
access.current.mockResolvedValue({ revision, token });
|
||||
access.local.mockResolvedValue({ revision });
|
||||
client.getAllShares.mockResolvedValue(
|
||||
Array.from({ length: pageSize + 1 }, (_, index) => share(index)),
|
||||
|
||||
@@ -48,8 +48,8 @@ type StockScreenerPage = {
|
||||
};
|
||||
type Snapshot = { asOf: string; expiresAt: number; items: StockScreenerItem[]; revision: string; userId: string };
|
||||
type TbankAccess = {
|
||||
current(userId: string): Promise<{ revision: string; token: string }>;
|
||||
local(userId: string): Promise<{ revision: string }>;
|
||||
online<T>(userId: string, run: (connection: { revision: string; token: string }) => Promise<T>): Promise<T>;
|
||||
};
|
||||
|
||||
@Injectable()
|
||||
@@ -63,10 +63,8 @@ export class StockScreenerService {
|
||||
) {}
|
||||
|
||||
async search(userId: string, conditions: StockScreenerConditions): Promise<StockScreenerPage> {
|
||||
const { instruments, revision } = await this.access.online(userId, async (connection) => ({
|
||||
instruments: await this.client.getAllShares(connection.token),
|
||||
revision: connection.revision,
|
||||
}));
|
||||
const connection = await this.access.current(userId);
|
||||
const instruments = await this.client.getAllShares(connection.token);
|
||||
const asOf = new Date().toISOString();
|
||||
const selected = selectStockScreenerInstruments({ asOf: new Date(asOf), instruments }, conditions)
|
||||
.instruments.map((instrument) => this.item(instrument));
|
||||
@@ -76,7 +74,7 @@ export class StockScreenerService {
|
||||
asOf,
|
||||
expiresAt: Date.now() + SNAPSHOT_TTL_MS,
|
||||
items: selected,
|
||||
revision,
|
||||
revision: connection.revision,
|
||||
userId,
|
||||
});
|
||||
this.logger.event('info', 'stock.screener.search.completed', { asOf, count: selected.length, operation: 'stock-screener-search' });
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import assert from 'node:assert/strict';
|
||||
import { setImmediate as immediate } from 'node:timers/promises';
|
||||
jest.mock('../../../../prisma/prisma.service', () => ({
|
||||
PrismaService: class {},
|
||||
}));
|
||||
@@ -97,9 +97,14 @@ describe('persistent portfolio projection', () => {
|
||||
],
|
||||
work: [],
|
||||
});
|
||||
const handle = await service.request('user', 'private', 'a');
|
||||
assert(handle);
|
||||
await handle.done;
|
||||
await service.request('user', 'private', 'a');
|
||||
for (
|
||||
let index = 0;
|
||||
index < 10 && !repository.publish.mock.calls.length;
|
||||
index += 1
|
||||
) {
|
||||
await immediate();
|
||||
}
|
||||
const snapshot = (
|
||||
repository.publish.mock.calls as [unknown, string, PortfolioDto][]
|
||||
)[0][2];
|
||||
@@ -142,9 +147,10 @@ describe('persistent portfolio projection', () => {
|
||||
{ units: '99' },
|
||||
{ currency: 'EUR', units: '1' },
|
||||
] });
|
||||
const handle = await service.request('user', 'private', 'a');
|
||||
assert(handle);
|
||||
await handle.done;
|
||||
await service.request('user', 'private', 'a');
|
||||
for (let index = 0; index < 10 && !repository.publish.mock.calls.length; index++) {
|
||||
await immediate();
|
||||
}
|
||||
const snapshot = (repository.publish.mock.calls as [unknown, string, PortfolioDto][])[0][2];
|
||||
expect(snapshot.cashBalances).toEqual([
|
||||
{ currency: 'RUB', value: '0' },
|
||||
|
||||
+13
-240
@@ -2,9 +2,7 @@ import { INestApplication } from '@nestjs/common';
|
||||
import { ConfigService } from '@nestjs/config';
|
||||
import { JwtService } from '@nestjs/jwt';
|
||||
import { Test, TestingModule } from '@nestjs/testing';
|
||||
import * as bcrypt from 'bcrypt';
|
||||
import { PARAMS_PROVIDER_TOKEN } from 'nestjs-pino';
|
||||
import { createHash, randomUUID } from 'node:crypto';
|
||||
import request from 'supertest';
|
||||
import { App } from 'supertest/types';
|
||||
|
||||
@@ -32,7 +30,6 @@ describe('Authentication (e2e)', () => {
|
||||
pinoHttp: {
|
||||
...loggingOptions(config),
|
||||
level: 'info',
|
||||
transport: undefined,
|
||||
stream: { write: (line: string) => logs.push(JSON.parse(line) as Record<string, unknown>) },
|
||||
},
|
||||
assignResponse: true,
|
||||
@@ -97,171 +94,6 @@ describe('Authentication (e2e)', () => {
|
||||
await agent.post('/api/v1/auth/logout').expect(204);
|
||||
});
|
||||
|
||||
it('rejects a valid refresh token as Bearer while its session stays usable', async () => {
|
||||
const registration = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/register')
|
||||
.send({ email: 'bearer@example.test', password: 'a secure password' })
|
||||
.expect(200);
|
||||
const cookie = registration.headers['set-cookie'][0];
|
||||
const refreshToken = /^refresh_token=([^;]+)/.exec(cookie)?.[1];
|
||||
if (!refreshToken) throw new Error('Expected a refresh token cookie');
|
||||
// Signed, unexpired and backed by a live session: only its type is wrong.
|
||||
await expect(app.get(JwtService).verifyAsync(refreshToken)).resolves.toMatchObject({
|
||||
type: 'refresh',
|
||||
});
|
||||
|
||||
await request(app.getHttpServer())
|
||||
.get('/api/v1/auth/me')
|
||||
.set('Authorization', `Bearer ${refreshToken}`)
|
||||
.expect(401)
|
||||
.expect(({ body }: { body: unknown }) =>
|
||||
expect(body).toEqual({ status: 401, code: 'UNAUTHORIZED' }),
|
||||
);
|
||||
|
||||
await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/refresh')
|
||||
.set('Cookie', cookie)
|
||||
.expect(200);
|
||||
});
|
||||
|
||||
describe('refresh cookie policy', () => {
|
||||
const attributes = (cookie: string) =>
|
||||
cookie
|
||||
.split('; ')
|
||||
.slice(1)
|
||||
.filter((attribute) => !attribute.startsWith('Expires='))
|
||||
.sort((a, b) => a.localeCompare(b));
|
||||
const host = ['HttpOnly', 'Path=/api/v1/auth', 'SameSite=Lax'];
|
||||
// Persistent for the Session lifetime (7 days), otherwise the browser drops it on restart.
|
||||
const persistent = [...host, 'Max-Age=604800'];
|
||||
const sorted = (items: string[]) => [...items].sort((a, b) => a.localeCompare(b));
|
||||
const login = async () => {
|
||||
const registration = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/register')
|
||||
.send({ email: 'cookie@example.test', password: 'a secure password' })
|
||||
.expect(200);
|
||||
return registration.headers['set-cookie'][0];
|
||||
};
|
||||
|
||||
// The cookie policy reads NODE_ENV per request; the e2e runner defaults to development.
|
||||
const inEnvironment = async <T>(nodeEnv: string, run: () => Promise<T>) => {
|
||||
const previous = process.env['NODE_ENV'];
|
||||
process.env['NODE_ENV'] = nodeEnv;
|
||||
try {
|
||||
return await run();
|
||||
} finally {
|
||||
process.env['NODE_ENV'] = previous;
|
||||
}
|
||||
};
|
||||
|
||||
it('issues and rotates it persistent (Max-Age) HttpOnly, Lax, path-scoped, host-only and Secure in production, and clears it', async () => {
|
||||
await inEnvironment('production', async () => {
|
||||
const issued = await login();
|
||||
const rotated = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/refresh')
|
||||
.set('Cookie', issued)
|
||||
.expect(200);
|
||||
const cleared = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/logout')
|
||||
.set('Cookie', rotated.headers['set-cookie'][0])
|
||||
.expect(204);
|
||||
|
||||
// Exact set: any added Domain, changed Max-Age or dropped flag fails.
|
||||
for (const cookie of [issued, rotated.headers['set-cookie'][0]]) {
|
||||
expect(attributes(cookie)).toEqual(sorted([...persistent, 'Secure']));
|
||||
}
|
||||
// Clearing must not carry Max-Age; Express expires it with a past Expires.
|
||||
const clearedCookie = cleared.headers['set-cookie'][0];
|
||||
expect(attributes(clearedCookie)).toEqual(sorted([...host, 'Secure']));
|
||||
expect(clearedCookie).toContain('Expires=Thu, 01 Jan 1970');
|
||||
});
|
||||
});
|
||||
|
||||
it('drops only Secure in development and keeps every other attribute', async () => {
|
||||
await inEnvironment('development', async () => {
|
||||
expect(attributes(await login())).toEqual(sorted(persistent));
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('expired credentials', () => {
|
||||
const sha256 = (token: string) => createHash('sha256').update(token).digest('hex');
|
||||
const PAST = () => Math.floor(Date.now() / 1000) - 60;
|
||||
const FUTURE = () => Math.floor(Date.now() / 1000) + 600;
|
||||
const register = async () => {
|
||||
const registration = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/register')
|
||||
.send({ email: 'expiry@example.test', password: 'a secure password' })
|
||||
.expect(200);
|
||||
const session = await app.get(PrismaService).session.findFirstOrThrow();
|
||||
return {
|
||||
cookie: registration.headers['set-cookie'][0],
|
||||
sub: session.userId,
|
||||
sid: session.id,
|
||||
};
|
||||
};
|
||||
|
||||
it('rejects a signed expired access token but admits the same claims unexpired', async () => {
|
||||
const { sub, sid } = await register();
|
||||
const jwt = app.get(JwtService);
|
||||
const expired = await jwt.signAsync({ sub, sid, type: 'access', exp: PAST() });
|
||||
const fresh = await jwt.signAsync({ sub, sid, type: 'access', exp: FUTURE() });
|
||||
|
||||
await request(app.getHttpServer())
|
||||
.get('/api/v1/auth/me')
|
||||
.set('Authorization', `Bearer ${expired}`)
|
||||
.expect(401);
|
||||
await request(app.getHttpServer())
|
||||
.get('/api/v1/auth/me')
|
||||
.set('Authorization', `Bearer ${fresh}`)
|
||||
.expect(200)
|
||||
.expect(({ body }: { body: unknown }) =>
|
||||
expect((body as { email: string }).email).toBe('expiry@example.test'),
|
||||
);
|
||||
});
|
||||
|
||||
it('rejects a signed expired refresh token that matches the live session hash', async () => {
|
||||
const { sub, sid } = await register();
|
||||
const jwt = app.get(JwtService);
|
||||
const prisma = app.get(PrismaService);
|
||||
const claims = { sub, sid, type: 'refresh' };
|
||||
const expired = await jwt.signAsync({ ...claims, jti: randomUUID(), exp: PAST() });
|
||||
const fresh = await jwt.signAsync({ ...claims, jti: randomUUID(), exp: FUTURE() });
|
||||
|
||||
// Hash, session and signature all valid: only `exp` differs between the two.
|
||||
await prisma.session.update({ where: { id: sid }, data: { refreshTokenHash: sha256(expired) } });
|
||||
const rejected = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/refresh')
|
||||
.set('Cookie', `refresh_token=${expired}`)
|
||||
.expect(401);
|
||||
expect(rejected.headers['set-cookie']).toBeUndefined();
|
||||
|
||||
await prisma.session.update({ where: { id: sid }, data: { refreshTokenHash: sha256(fresh) } });
|
||||
await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/refresh')
|
||||
.set('Cookie', `refresh_token=${fresh}`)
|
||||
.expect(200);
|
||||
});
|
||||
|
||||
it('rejects a valid refresh token once its session is DB-expired', async () => {
|
||||
const { cookie, sid } = await register();
|
||||
const prisma = app.get(PrismaService);
|
||||
await prisma.session.update({ where: { id: sid }, data: { expiresAt: new Date(Date.now() - 1000) } });
|
||||
|
||||
const rejected = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/refresh')
|
||||
.set('Cookie', cookie)
|
||||
.expect(401);
|
||||
|
||||
expect(rejected.headers['set-cookie']).toBeUndefined();
|
||||
expect(await prisma.session.count()).toBe(0);
|
||||
await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/refresh')
|
||||
.set('Cookie', cookie)
|
||||
.expect(401);
|
||||
});
|
||||
});
|
||||
|
||||
it('keeps logout idempotent for an invalid refresh token', async () => {
|
||||
const logout = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/logout')
|
||||
@@ -433,45 +265,6 @@ describe('Authentication (e2e)', () => {
|
||||
expect(await app.get(PrismaService).user.count()).toBe(0);
|
||||
});
|
||||
|
||||
it('applies the ASCII 8..72 password policy on register and keeps login lenient', async () => {
|
||||
const validation = (detail: string) => ({
|
||||
status: 400,
|
||||
code: 'VALIDATION_ERROR',
|
||||
errors: [{ pointer: '#/password', detail }],
|
||||
});
|
||||
for (const [index, password] of ['a'.repeat(8), ' '.repeat(2) + 'b'.repeat(70)].entries()) {
|
||||
const credentials = { email: `user${index}@example.com`, password };
|
||||
await request(app.getHttpServer()).post('/api/v1/auth/register').send(credentials).expect(200);
|
||||
await request(app.getHttpServer()).post('/api/v1/auth/login').send(credentials).expect(200);
|
||||
}
|
||||
for (const password of ['a'.repeat(7), 'a'.repeat(73), 'пароль-пароль', 'passw😀rd', 'pass\tword1']) {
|
||||
await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/register')
|
||||
.send({ email: 'rejected@example.com', password })
|
||||
.expect(400)
|
||||
.expect('Content-Type', /application\/problem\+json/)
|
||||
.expect(({ body }: { body: unknown }) =>
|
||||
expect(body).toEqual(validation('must be 8-72 printable ASCII characters')),
|
||||
);
|
||||
}
|
||||
expect(await app.get(PrismaService).user.count()).toBe(2);
|
||||
|
||||
// An account created under the previous policy (Cyrillic, 12+ chars) must still log in.
|
||||
const legacy = { email: 'legacy@example.com', password: 'пароль-пароль' };
|
||||
const prisma = app.get(PrismaService);
|
||||
await prisma.user.create({
|
||||
data: { id: randomUUID(), email: legacy.email, passwordHash: await bcrypt.hash(legacy.password, 4) },
|
||||
});
|
||||
await request(app.getHttpServer()).post('/api/v1/auth/login').send(legacy).expect(200);
|
||||
await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/login')
|
||||
.send({ email: legacy.email, password: 'a'.repeat(73) })
|
||||
.expect(400)
|
||||
.expect(({ body }: { body: unknown }) =>
|
||||
expect(body).toEqual(validation('must not exceed 72 UTF-8 bytes')),
|
||||
);
|
||||
});
|
||||
|
||||
it('guards T-Bank connection and never returns a token', async () => {
|
||||
const registration = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/register')
|
||||
@@ -540,14 +333,7 @@ describe('Authentication (e2e)', () => {
|
||||
'X-Request-ID',
|
||||
);
|
||||
expect(logs.filter((entry) => entry.requestId === response.headers['x-request-id'])).toEqual([
|
||||
expect.objectContaining({
|
||||
level: 40,
|
||||
message: 'http.request.completed',
|
||||
method: 'GET',
|
||||
route: '/api/v1/auth/me',
|
||||
status: 401,
|
||||
code: 'UNAUTHORIZED',
|
||||
}),
|
||||
expect.objectContaining({ level: 40, message: 'http.request.completed', status: 401, code: 'UNAUTHORIZED' }),
|
||||
]);
|
||||
});
|
||||
|
||||
@@ -559,7 +345,7 @@ describe('Authentication (e2e)', () => {
|
||||
new Error('operation failed\npassword: SYNTHETIC_AUDIT_SECRET'),
|
||||
);
|
||||
|
||||
await request(app.getHttpServer())
|
||||
const response = await request(app.getHttpServer())
|
||||
.post('/api/v1/auth/login')
|
||||
.set('X-Request-ID', clientRequestId)
|
||||
.send({ email: 'user@example.com', password: 'a secure password' })
|
||||
@@ -569,30 +355,17 @@ describe('Authentication (e2e)', () => {
|
||||
expect(body).toEqual({ status: 500, code: 'INTERNAL_SERVER_ERROR' }),
|
||||
);
|
||||
|
||||
expect(logs).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
method: 'POST',
|
||||
route: '/api/v1/auth/login',
|
||||
status: 500,
|
||||
code: 'INTERNAL_SERVER_ERROR',
|
||||
level: 50,
|
||||
message: 'http.request.completed',
|
||||
}),
|
||||
]),
|
||||
);
|
||||
expect(logs).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
clientRequestId,
|
||||
code: 'INTERNAL_SERVER_ERROR',
|
||||
level: 50,
|
||||
message: 'http.request.unhandled',
|
||||
errorName: 'Error',
|
||||
errorStack: expect.stringContaining(' at ') as unknown,
|
||||
}),
|
||||
]),
|
||||
);
|
||||
const completed = logs.filter((entry) => entry.requestId === response.headers['x-request-id']);
|
||||
expect(completed).toEqual([
|
||||
expect.objectContaining({
|
||||
requestId: response.headers['x-request-id'],
|
||||
clientRequestId,
|
||||
status: 500,
|
||||
code: 'INTERNAL_SERVER_ERROR',
|
||||
level: 50,
|
||||
message: 'http.request.completed',
|
||||
}),
|
||||
]);
|
||||
expect(JSON.stringify(logs)).not.toContain(
|
||||
'SYNTHETIC_AUDIT_SECRET',
|
||||
);
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
import type { Server } from 'node:http';
|
||||
|
||||
import { status } from '@grpc/grpc-js';
|
||||
import {
|
||||
ConflictException,
|
||||
INestApplication,
|
||||
@@ -17,13 +16,6 @@ import { BondCatalogService } from '../src/modules/investments/instruments/bonds
|
||||
import { BondIncomeService } from '../src/modules/investments/instruments/bonds/application/bond-income.service';
|
||||
import { BondMarketService } from '../src/modules/investments/instruments/bonds/application/bond-market.service';
|
||||
import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
|
||||
import {
|
||||
bootOnlineApp,
|
||||
expectSafeBody,
|
||||
failUpstream,
|
||||
onlineUserId,
|
||||
refusals,
|
||||
} from './online-upstream';
|
||||
|
||||
const uid = 'e6123145-9665-43e0-8413-cd61b8aa9b13';
|
||||
describe('Bond HTTP contract', () => {
|
||||
@@ -209,39 +201,3 @@ describe('Bond HTTP contract', () => {
|
||||
expect(response.body).not.toHaveProperty('stack');
|
||||
});
|
||||
});
|
||||
|
||||
// Real services and TbankClient error mapping; only the gRPC transport is stubbed.
|
||||
// Bonds expose no company or screener route; their online entrypoints are search, detail and ticker.
|
||||
describe('Bond online reads: upstream failure translation', () => {
|
||||
const rpc = jest.fn();
|
||||
let ctx: Awaited<ReturnType<typeof bootOnlineApp>>;
|
||||
const get = (path: string) => request(ctx.app.getHttpServer()).get(path);
|
||||
// [entrypoint, request, RPC that fails second]: a failure after the first call must translate too.
|
||||
const entrypoints: [string, () => request.Test, string][] = [
|
||||
['search', () => get('/api/v1/bonds?query=SBER'), 'getLastPrices'],
|
||||
['detail', () => get(`/api/v1/bonds/${uid}`), 'bondBy'],
|
||||
['ticker', () => get('/api/v1/bonds/by-ticker/SBER'), 'bondBy'],
|
||||
];
|
||||
const cases = entrypoints.flatMap(([name, send, later]) =>
|
||||
refusals.flatMap((code) => [undefined, later].map((at) => [name, code, at, send] as const)),
|
||||
);
|
||||
|
||||
beforeAll(async () => {
|
||||
ctx = await bootOnlineApp(rpc);
|
||||
});
|
||||
afterAll(() => ctx.app.close());
|
||||
|
||||
it.each(cases)('%s: upstream auth refusal %s (failing RPC %s) becomes 400/INVALID_TBANK_TOKEN', async (_name, code, at, send) => {
|
||||
failUpstream(rpc, 'bond', code, at);
|
||||
const response = await send().set('Authorization', ctx.bearer).expect(400);
|
||||
expectSafeBody(response.body, 400, 'INVALID_TBANK_TOKEN');
|
||||
const saved = await ctx.prisma.tbankConnection.findUniqueOrThrow({ where: { userId: onlineUserId } });
|
||||
expect(saved).toMatchObject({ invalidToken: false, revision: ctx.connection.revision });
|
||||
});
|
||||
|
||||
it.each(entrypoints)('%s: temporary unavailability stays 503/TBANK_UNAVAILABLE', async (_name, send) => {
|
||||
failUpstream(rpc, 'bond', status.UNAVAILABLE);
|
||||
const response = await send().set('Authorization', ctx.bearer).expect(503);
|
||||
expectSafeBody(response.body, 503, 'TBANK_UNAVAILABLE');
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
import type { Server } from 'node:http';
|
||||
|
||||
import { status } from '@grpc/grpc-js';
|
||||
import { INestApplication } from '@nestjs/common';
|
||||
import { JwtService } from '@nestjs/jwt';
|
||||
import { Test } from '@nestjs/testing';
|
||||
|
||||
import { AppModule } from '../src/app.module';
|
||||
import { TbankTokenService } from '../src/integrations/tbank/tbank-token.service';
|
||||
import { TbankClient } from '../src/integrations/tbank/tbank.client';
|
||||
import { configureApp } from '../src/main';
|
||||
import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
|
||||
import { PrismaService } from '../src/prisma/prisma.service';
|
||||
|
||||
export const onlineUserId = 'online-reader';
|
||||
export const onlineToken = 'synthetic-online-token';
|
||||
export const rawUpstreamText = 'raw upstream refusal text';
|
||||
export const refusals = [status.UNAUTHENTICATED, status.PERMISSION_DENIED];
|
||||
|
||||
// Real TbankClient with only the transport stubbed: the gRPC status goes through its real error mapping.
|
||||
export async function bootOnlineApp(rpc: jest.Mock) {
|
||||
const upstream = Object.assign(Object.create(TbankClient.prototype) as TbankClient, {
|
||||
logger: { event: jest.fn() },
|
||||
queue: { run: (operation: () => Promise<unknown>) => operation(), size: 0 },
|
||||
request: rpc,
|
||||
});
|
||||
const module = await Test.createTestingModule({ imports: [AppModule] })
|
||||
.overrideProvider(TbankClient)
|
||||
.useValue(upstream)
|
||||
.overrideProvider(TbankHourlyScheduler)
|
||||
.useValue({ tick: jest.fn() })
|
||||
.compile();
|
||||
const app: INestApplication<Server> = module.createNestApplication();
|
||||
configureApp(app);
|
||||
await app.init();
|
||||
await app.listen(0, '127.0.0.1');
|
||||
const prisma = app.get(PrismaService);
|
||||
await prisma.user.create({
|
||||
data: { id: onlineUserId, email: 'online@example.invalid', passwordHash: 'synthetic' },
|
||||
});
|
||||
const connection = await prisma.tbankConnection.create({
|
||||
data: {
|
||||
userId: onlineUserId,
|
||||
encryptedToken: app.get(TbankTokenService).encrypt(onlineToken),
|
||||
connectedAt: new Date(),
|
||||
},
|
||||
});
|
||||
const bearer = `Bearer ${new JwtService().sign(
|
||||
{ sub: onlineUserId, type: 'access' },
|
||||
{ secret: process.env.JWT_SECRET },
|
||||
)}`;
|
||||
return { app, bearer, connection, prisma };
|
||||
}
|
||||
|
||||
// Healthy answers for every RPC an online entrypoint uses; `at` picks the single RPC that fails.
|
||||
export function failUpstream(rpc: jest.Mock, kind: 'bond' | 'share', code: number, at?: string) {
|
||||
const instrument = {
|
||||
apiTradeAvailableFlag: true,
|
||||
assetUid: 'asset-uid',
|
||||
instrumentKind: kind === 'bond' ? 'INSTRUMENT_TYPE_BOND' : 'INSTRUMENT_TYPE_SHARE',
|
||||
ticker: 'SBER',
|
||||
uid: 'e6123145-9665-43e0-8413-cd61b8aa9b13',
|
||||
};
|
||||
const healthy = new Map<string, unknown>([
|
||||
['bondBy', { instrument }],
|
||||
['findInstrument', { instruments: [instrument] }],
|
||||
['getAssetBy', { asset: { description: 'description' } }],
|
||||
['getAssetFundamentals', { fundamentals: [] }],
|
||||
['getLastPrices', { lastPrices: [] }],
|
||||
['shareBy', { instrument }],
|
||||
]);
|
||||
const failure = Object.assign(new Error('grpc failure'), {
|
||||
code,
|
||||
details: `${rawUpstreamText} Bearer ${onlineToken}`,
|
||||
});
|
||||
rpc.mockReset();
|
||||
rpc.mockImplementation((_token: string, _client: unknown, method: string) =>
|
||||
!at || method === at ? Promise.reject(failure) : Promise.resolve(healthy.get(method) ?? {}),
|
||||
);
|
||||
}
|
||||
|
||||
// Safe public error: stable code only, no upstream text, no credentials.
|
||||
export function expectSafeBody(body: unknown, status: number, code: string) {
|
||||
expect(body).toEqual({ code, status });
|
||||
expect(JSON.stringify(body)).not.toContain(rawUpstreamText);
|
||||
expect(JSON.stringify(body)).not.toContain(onlineToken);
|
||||
}
|
||||
@@ -1,6 +1,5 @@
|
||||
import type { Server } from 'node:http';
|
||||
|
||||
import { status } from '@grpc/grpc-js';
|
||||
import {
|
||||
ConflictException,
|
||||
INestApplication,
|
||||
@@ -18,13 +17,6 @@ import { StockIncomeService } from '../src/modules/investments/instruments/stock
|
||||
import { StockMarketService } from '../src/modules/investments/instruments/stocks/application/stock-market.service';
|
||||
import { StockScreenerService } from '../src/modules/investments/instruments/stocks/application/stock-screener.service';
|
||||
import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
|
||||
import {
|
||||
bootOnlineApp,
|
||||
expectSafeBody,
|
||||
failUpstream,
|
||||
onlineUserId,
|
||||
refusals,
|
||||
} from './online-upstream';
|
||||
|
||||
const uid = 'e6123145-9665-43e0-8413-cd61b8aa9b13';
|
||||
describe('Stock HTTP contract', () => {
|
||||
@@ -209,40 +201,3 @@ describe('Stock HTTP contract', () => {
|
||||
expect(response.body).not.toHaveProperty('stack');
|
||||
});
|
||||
});
|
||||
|
||||
// Real services and TbankClient error mapping; only the gRPC transport is stubbed.
|
||||
describe('Stock online reads: upstream failure translation', () => {
|
||||
const rpc = jest.fn();
|
||||
let ctx: Awaited<ReturnType<typeof bootOnlineApp>>;
|
||||
const get = (path: string) => request(ctx.app.getHttpServer()).get(path);
|
||||
// [entrypoint, request, RPC that fails second]: a failure after the first call must translate too.
|
||||
const entrypoints: [string, () => request.Test, string][] = [
|
||||
['search', () => get('/api/v1/stocks?query=SBER'), 'getLastPrices'],
|
||||
['detail', () => get(`/api/v1/stocks/${uid}`), 'shareBy'],
|
||||
['ticker', () => get('/api/v1/stocks/by-ticker/SBER'), 'shareBy'],
|
||||
['company', () => get(`/api/v1/stocks/${uid}/company`), 'getAssetBy'],
|
||||
['screener', () => request(ctx.app.getHttpServer()).post('/api/v1/stocks/screener/search').send({}), 'shares'],
|
||||
];
|
||||
const cases = entrypoints.flatMap(([name, send, later]) =>
|
||||
refusals.flatMap((code) => [undefined, later].map((at) => [name, code, at, send] as const)),
|
||||
);
|
||||
|
||||
beforeAll(async () => {
|
||||
ctx = await bootOnlineApp(rpc);
|
||||
});
|
||||
afterAll(() => ctx.app.close());
|
||||
|
||||
it.each(cases)('%s: upstream auth refusal %s (failing RPC %s) becomes 400/INVALID_TBANK_TOKEN', async (_name, code, at, send) => {
|
||||
failUpstream(rpc, 'share', code, at);
|
||||
const response = await send().set('Authorization', ctx.bearer).expect(400);
|
||||
expectSafeBody(response.body, 400, 'INVALID_TBANK_TOKEN');
|
||||
const saved = await ctx.prisma.tbankConnection.findUniqueOrThrow({ where: { userId: onlineUserId } });
|
||||
expect(saved).toMatchObject({ invalidToken: false, revision: ctx.connection.revision });
|
||||
});
|
||||
|
||||
it.each(entrypoints)('%s: temporary unavailability stays 503/TBANK_UNAVAILABLE', async (_name, send) => {
|
||||
failUpstream(rpc, 'share', status.UNAVAILABLE);
|
||||
const response = await send().set('Authorization', ctx.bearer).expect(503);
|
||||
expectSafeBody(response.body, 503, 'TBANK_UNAVAILABLE');
|
||||
});
|
||||
});
|
||||
|
||||
@@ -129,17 +129,13 @@ describe('durable shared instrument metadata (SQLite)', () => {
|
||||
});
|
||||
it('coalesces twenty requests across users while giving each user a private handle', async () => {
|
||||
const blocked = deferred<TbankInstrument>();
|
||||
const started = deferred<void>();
|
||||
upstream.getInstrumentByUid.mockImplementation(() => {
|
||||
started.resolve();
|
||||
return blocked.promise;
|
||||
});
|
||||
upstream.getInstrumentByUid.mockReturnValue(blocked.promise);
|
||||
const responses = await Promise.all(
|
||||
Array.from({ length: 20 }, (_, i) =>
|
||||
service.read(i % 2 ? 'owner' : 'other', identity),
|
||||
),
|
||||
);
|
||||
await started.promise;
|
||||
await delay(10);
|
||||
expect(upstream.getInstrumentByUid).toHaveBeenCalledTimes(1);
|
||||
const ids = new Set(responses.map((response) => response?.work?.id));
|
||||
expect(ids.size).toBe(2);
|
||||
@@ -155,13 +151,9 @@ describe('durable shared instrument metadata (SQLite)', () => {
|
||||
'discards a producer after %s, including shared freshness, without borrowing another user token',
|
||||
async (action) => {
|
||||
const blocked = deferred<TbankInstrument>();
|
||||
const started = deferred<void>();
|
||||
upstream.getInstrumentByUid.mockImplementationOnce(() => {
|
||||
started.resolve();
|
||||
return blocked.promise;
|
||||
});
|
||||
upstream.getInstrumentByUid.mockReturnValueOnce(blocked.promise);
|
||||
await service.read('owner', identity);
|
||||
await started.promise;
|
||||
await delay(10);
|
||||
await service.read('other', identity);
|
||||
await prisma.tbankConnection.delete({ where: { userId: 'owner' } });
|
||||
if (action === 'replace') {
|
||||
@@ -195,13 +187,9 @@ describe('durable shared instrument metadata (SQLite)', () => {
|
||||
);
|
||||
it('does not turn initiating credentials failure into a shared negative lookup or a foreign credentials error', async () => {
|
||||
const blocked = deferred<TbankInstrument>();
|
||||
const started = deferred<void>();
|
||||
upstream.getInstrumentByUid.mockImplementationOnce(() => {
|
||||
started.resolve();
|
||||
return blocked.promise;
|
||||
});
|
||||
upstream.getInstrumentByUid.mockReturnValueOnce(blocked.promise);
|
||||
await service.read('owner', identity);
|
||||
await started.promise;
|
||||
await delay(10);
|
||||
await service.read('other', identity);
|
||||
blocked.reject(new Error('INVALID_TBANK_TOKEN'));
|
||||
await settled();
|
||||
@@ -238,6 +226,7 @@ describe('durable shared instrument metadata (SQLite)', () => {
|
||||
expect(failed?.fetchedAt).toEqual(old);
|
||||
if (!failedHandle) throw new Error('Expected forced refresh work');
|
||||
expect((await prisma.tbankSyncWork.findUniqueOrThrow({ where: { id: failedHandle } })).state).toBe('failed');
|
||||
await delay(20);
|
||||
expect(upstream.getInstrumentByUid).toHaveBeenCalledTimes(calls + 1);
|
||||
});
|
||||
it('coalesces forced refresh and retains freshness/timestamp when it fails before the TTL', async () => {
|
||||
@@ -296,7 +285,7 @@ describe('durable shared instrument metadata (SQLite)', () => {
|
||||
await prisma.$disconnect();
|
||||
service = createService();
|
||||
await service.read('owner', identity, true);
|
||||
// Observation starts no work, so a no-call assertion holds without waiting.
|
||||
await delay(10);
|
||||
expect(upstream.getInstrumentByUid).not.toHaveBeenCalled();
|
||||
await service.read('owner', identity);
|
||||
await settled();
|
||||
|
||||
@@ -151,12 +151,8 @@ describe('Request-driven operations synchronization (SQLite)', () => {
|
||||
|
||||
it('joins overlapping account and instrument refresh into one atomic publication group', async () => {
|
||||
const gate = deferred<TbankOperationsByCursorResponse>();
|
||||
const started = deferred<void>();
|
||||
upstream.getOperationsByCursor
|
||||
.mockImplementationOnce(() => {
|
||||
started.resolve();
|
||||
return gate.promise;
|
||||
})
|
||||
.mockReturnValueOnce(gate.promise)
|
||||
.mockResolvedValue({
|
||||
hasNext: false,
|
||||
items: [{ ...operation(), instrumentUid: 'uid' }],
|
||||
@@ -168,7 +164,7 @@ describe('Request-driven operations synchronization (SQLite)', () => {
|
||||
true,
|
||||
),
|
||||
);
|
||||
await started.promise;
|
||||
await delay(5);
|
||||
const whole = requiredHandle(
|
||||
await service.request('owner', [january], true),
|
||||
);
|
||||
|
||||
Reference in New Issue
Block a user