feat: do final stress tests

apps/api/src/auth/strategies/jwt.strategy.spec.ts

@@ -0,0 +1,20 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { JwtStrategy } from './jwt.strategy';
+
+const mona = { id: 'user-1', email: 'mona@example.com', name: 'Mona', role: 'manager', venueId: 'venue-1' };
+
+function strategy(users: (typeof mona)[]) {
+  const prisma = { clientUser: { findUnique: async ({ where }: any) => users.find((u) => u.id === where.id) ?? null } };
+  return new JwtStrategy(prisma as any);
+}
+
+describe('JwtStrategy', () => {
+  it('takes the user as it is now, not as it was when the token was issued', async () => {
+    const user = await strategy([{ ...mona, role: 'admin' }]).validate({ sub: 'user-1', email: mona.email, role: 'manager', venueId: 'venue-1' });
+    expect(user).toEqual({ ...mona, role: 'admin' });
+  });
+
+  it('refuses the token of a deleted user', async () => {
+    await expect(strategy([]).validate({ sub: 'user-1', role: 'admin', venueId: 'venue-1' })).rejects.toBeInstanceOf(UnauthorizedException);
+  });
+});

apps/api/src/auth/strategies/jwt.strategy.ts

@@ -2,10 +2,11 @@ import { Injectable, UnauthorizedException } from '@nestjs/common';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { getJwtSecret } from '../jwt-secret';
+import { PrismaService } from '../../prisma/prisma.service';
 
 @Injectable()
 export class JwtStrategy extends PassportStrategy(Strategy) {
-  constructor() {
+  constructor(private prisma: PrismaService) {
     super({
       jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
       ignoreExpiration: false,
@@ -13,12 +14,16 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     });
   }
 
+  // Looked up on every request: a deleted user loses access at once instead of when the token expires, and a
+  // changed role or name applies right away
   async validate(payload: any) {
-    return {
-      id: payload.sub,
-      email: payload.email,
-      role: payload.role,
-      venueId: payload.venueId,
-    };
+    const user = await this.prisma.clientUser.findUnique({
+      where: { id: payload.sub },
+      select: { id: true, email: true, name: true, role: true, venueId: true },
+    });
+    if (!user) {
+      throw new UnauthorizedException({ code: 'unauthorized', message: 'Authentication required' });
+    }
+    return user;
   }
 }

apps/api/src/devices/devices.service.ts

@@ -90,9 +90,11 @@ export class DevicesService {
             if (await applyProductEvent(tx, ledger, event, occurredAt)) productsChanged = true;
             continue;
           }
+          // Only drinks that were still on the tab go back into the stock: one settled or deleted meanwhile was sold
+          const stockEvent = event.type === 'line_removed' ? { ...event, quantity: ledger.tabs.removable(event) } : event;
           const settlement = ledger.tabs.apply(event, occurredAt);
           if (settlement) ledger.settlements.push({ ...settlement, deviceId: device.id });
-          ledger.stock.apply(event, occurredAt);
+          ledger.stock.apply(stockEvent, occurredAt);
         }
       }
 

apps/api/src/tabs/tab-state.spec.ts

@@ -124,6 +124,18 @@ describe('findLine', () => {
   });
 });
 
+describe('VenueTabs.removable', () => {
+  it('counts only drinks still on the line, so a removal after a settlement returns nothing to the stock', () => {
+    const tabs = withCola(3);
+    const removal = event({ type: 'line_removed', lineId: 'line-1', quantity: 5, ...cola });
+    expect(tabs.removable(removal)).toBe(3);
+
+    tabs.apply(event({ type: 'settled', amountInCents: 750, paymentMethod: 'cash', items: [{ ...cola, quantity: 3 }] }), time);
+    expect(tabs.removable(removal)).toBe(0);
+    expect(tabs.removable(event({ type: 'line_removed', tabId: 'gone', quantity: 1, ...cola }))).toBe(0);
+  });
+});
+
 describe('seedTabs and tabSummary', () => {
   it("turns a terminal's snapshot into tabs the dashboard sums up the same", () => {
     const [seeded] = seedTabs([{

apps/api/src/tabs/tab-state.ts

@@ -171,6 +171,16 @@ export class VenueTabs {
     }
   }
 
+  /**
+   * How many drinks a line_removed event can actually take off: none when the tab or line is gone (settled or
+   * deleted elsewhere while the terminal was offline).
+   */
+  removable(event: TabEventDto): number {
+    const tab = event.tabId ? this.tabs.get(event.tabId) : undefined;
+    const line = tab && findLine(tab, event);
+    return line ? Math.min(event.quantity ?? 0, lineQuantity(line)) : 0;
+  }
+
   /** Settles everything still on the tab, as the dashboard does. Null when there is nothing to settle. */
   settleAll(tabId: string, settlement: { id: string; settledAt: Date; paymentMethod: string }): SettlementDraft | null {
     const tab = this.tabs.get(tabId);