ehoandClaude Opus 5
f2d4c900b4
authGuard and capabilityGuard were duplicated byte-for-byte across both
apps, along with their specs — 57 of the 211 duplicated lines BL-002
measured in the two auth contexts, the largest block after session.store.ts.
They are not actor-specific. They ask "is anyone logged in" and "may they do
X", never "who are you or how did you get here". ADR-0002 §3's non-sharing
decision scopes to identity and login flow — Principal, DigiD vs employee
SSO — and a route guard is neither; §Consequences names auth.guard.ts only
as a seam that localises the change, not as something that must be
duplicated.
Moves both to libs/shared/src/application/auth.guard.ts, reading SESSION_PORT
instead of an app-local SessionStore. The port gains one member,
isAuthenticated: Signal<boolean> — free, because both SessionStores already
expose exactly that (session.store.ts:40) and both apps already register
{ provide: SESSION_PORT, useExisting: SessionStore }. The seam existed; it
was just narrower than what it already carried.
Each app keeps a re-export at @auth/auth.guard so app.routes.ts is untouched
— routing asks the auth context for its guards, which is the direction the
boundary should read. The two identical specs collapse into one, plus a case
asserting the guard resolves through the port.
Deliberately NOT merged: session.store.ts, session.ts, digid.adapter.ts,
login-form.component.ts, login.page.ts. Those are identical only because
ADR-C-004 (Session -> Principal) was never executed. Merging them would make
a citizen DigiD/BSN login the backoffice's shared login.
Measured with tools/baseline-scan.mjs: ssp/auth duplicated lines 211 -> 151,
bhp/auth 86.8% -> 82.5%, repo-wide 7.1% -> 6.6%. Both guard clone pairs drop
out of the top-clones list. What remains is exactly the three files
ADR-C-004 should differentiate.
behaviour-spec.mdx regenerated (the spec moved libraries).
Verified: lint, typecheck, dep:check (0 violations, 224 modules), prettier,
ng build --localize for both apps, and 407 tests passing across all four
projects.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
70 lines
2.7 KiB
TypeScript
70 lines
2.7 KiB
TypeScript
import { TestBed } from '@angular/core/testing';
|
|
import { Router } from '@angular/router';
|
|
import { describe, it, expect, vi } from 'vitest';
|
|
import { AccessStore } from '@shared/application/access.store';
|
|
import { SESSION_PORT } from '@shared/application/session.port';
|
|
import { authGuard, capabilityGuard } from './auth.guard';
|
|
|
|
type Opts = {
|
|
authed: boolean;
|
|
can?: (c: string) => boolean;
|
|
whenReady?: () => Promise<void>;
|
|
};
|
|
|
|
function setup({ authed, can = () => false, whenReady = () => Promise.resolve() }: Opts) {
|
|
const createUrlTree = vi.fn((cmds: string[]) => ({ tree: cmds }));
|
|
const readySpy = vi.fn(whenReady);
|
|
TestBed.configureTestingModule({
|
|
providers: [
|
|
{ provide: SESSION_PORT, useValue: { isAuthenticated: () => authed } },
|
|
{ provide: AccessStore, useValue: { whenReady: readySpy, can } },
|
|
{ provide: Router, useValue: { createUrlTree } },
|
|
],
|
|
});
|
|
return { createUrlTree, readySpy };
|
|
}
|
|
|
|
// The guards ignore their (route, state) args; cast to call with none.
|
|
const call = <T>(fn: unknown) => TestBed.runInInjectionContext(() => (fn as () => T)());
|
|
|
|
describe('authGuard', () => {
|
|
it('allows an authenticated user', () => {
|
|
setup({ authed: true });
|
|
expect(call(authGuard)).toBe(true);
|
|
});
|
|
|
|
it('redirects an anonymous user to /login', () => {
|
|
const { createUrlTree } = setup({ authed: false });
|
|
expect(call(authGuard)).toEqual({ tree: ['/login'] });
|
|
expect(createUrlTree).toHaveBeenCalledWith(['/login']);
|
|
});
|
|
});
|
|
|
|
describe('capabilityGuard', () => {
|
|
const guard = () => capabilityGuard('stamdata:edit');
|
|
|
|
it('waits for /me, then allows an entitled admin', async () => {
|
|
const { readySpy } = setup({ authed: true, can: (c) => c === 'stamdata:edit' });
|
|
await expect(call<Promise<unknown>>(guard())).resolves.toBe(true);
|
|
expect(readySpy).toHaveBeenCalledOnce(); // it awaited caps before deciding
|
|
});
|
|
|
|
it('sends an authenticated-but-unentitled user to /dashboard (not a login loop)', async () => {
|
|
setup({ authed: true, can: () => false });
|
|
await expect(call<Promise<unknown>>(guard())).resolves.toEqual({ tree: ['/dashboard'] });
|
|
});
|
|
|
|
it('redirects an anonymous user to /login without waiting for caps', async () => {
|
|
const { readySpy } = setup({ authed: false, can: () => true });
|
|
await expect(call<Promise<unknown>>(guard())).resolves.toEqual({ tree: ['/login'] });
|
|
expect(readySpy).not.toHaveBeenCalled();
|
|
});
|
|
|
|
// The guard reads SESSION_PORT, never a concrete SessionStore — that is what lets one
|
|
// copy serve both apps while ADR-0002 §3 keeps their `auth` contexts separate.
|
|
it('reads authentication through the port, not an app-local store', () => {
|
|
setup({ authed: true });
|
|
expect(TestBed.inject(SESSION_PORT).isAuthenticated()).toBe(true);
|
|
});
|
|
});
|