From 89b769cfd9c7096554ccfaf5ccb2b16c0c1736f3 Mon Sep 17 00:00:00 2001 From: hoelee Date: Sun, 23 Aug 2026 07:17:45 +0800 Subject: [PATCH] feat(W1): full 5-status account lifecycle (pending/active/suspended/expired/deleted) - Non-active statuses (pending/suspended/expired/deleted) now uniformly: disable AList user + clear role scopes (soft, keeps user/role/CP/history); no-op when the customer has no AList user yet (pure NocoDB label). - Resume transitions (X -> active) recompute effective grants from current CustomerProducts + expiry, never restore stale scopes. - businessChanged() now also treats after-insert (new row, no previous) as a business change so fresh customers are processed on first webhook. - Lifecycle test covers the full matrix: 10 scenarios, all green. - AccessGrants still not materialized (deferred to W4 per decision). - Customers.status stays account-level, outside permission calc. --- docs/PROJECT_STATE.md | 15 +++-- n8n/W1-customer-provision.json | 2 +- n8n/test_w1_lifecycle.js | 109 ++++++++++++++++++--------------- n8n/w1-body.js | 47 ++++++++------ 4 files changed, 100 insertions(+), 73 deletions(-) diff --git a/docs/PROJECT_STATE.md b/docs/PROJECT_STATE.md index abd6a15..82ff724 100644 --- a/docs/PROJECT_STATE.md +++ b/docs/PROJECT_STATE.md @@ -43,17 +43,20 @@ Base: **`AlistAccess`**（`p3lzkresswyowqg`），与旧 `accessDB` 完全隔离 ### 2. W1 客户开通 + Status Lifecycle — **实测跑通** ✅ - 文件：`n8n/W1-customer-provision.json`（由 `n8n/w1-body.js` + 共享函数库经 `gen_w1.js` 生成） - 流程：Webhook → Extract customerId（同时透传 webhook 的 old/new rows）→ Load Env → **单 Code 节点 "Provision & Apply Lifecycle"**（含 login + status 分支 + write-back） -- **Step 3 新增 status lifecycle**： - - `suspended`/`deleted` → disable AList user + 清空 role scopes（soft delete，保留 user + NocoDB 历史） - - `active` → provision（建/更新 user+role）→ **重算 desired scopes（复用共享 calculateEffectiveGrants，不恢复旧值）** → re-enable - - 其他 → no-op -- **幂等**：见 `n8n/test_w1_lifecycle.js`（26 断言全过，含 echo/suspend 复用/suspend→active resume 重算不恢复陈旧/sync_required 强制重算） +- **Lifecycle matrix（5 状态，2026-08-23 定稿）**： + - `active`（无 user）→ provision（建 role→建 user）+ recompute + enable + - `active`（有 user）→ re-enable + recompute（不恢复旧 scopes）+ apply + - `pending`/`suspended`/`expired`/`deleted`（有 user/role）→ disable AList user + 清空 role scopes（soft，保留 user/role/CP/history） + - `pending`/`suspended`/`expired`/`deleted`（无 user）→ **no-op**（纯 NocoDB 标签，不建 AList user） + - 所有 `X → active` resume → recompute（从当前有效 CP + expiry），**永不恢复旧 scopes**，**不自动 mutate CustomerProducts** +- **幂等 + loop 防护**：见 `n8n/test_w1_lifecycle.js`（10 场景全过，覆盖完整 matrix + echo 短路 + sync_required 强制重算） - **Loop guard（2026-08-23 重写，核心）**：不再用 `sync_status==='synced'`，改用 **old/new field comparison + `sync_required` 标志**： - - `businessChanged()` = 业务字段（status/username/password/display_name/email/notes）在 `previous_rows`→`rows` 间变化，**或** `sync_required` 置位 + - `businessChanged()` = 业务字段（status/username/password/display_name/email/notes）在 `previous_rows`→`rows` 间变化，**或** `sync_required` 置位，**或 after-insert（有 new 无 old）** - echo（只动了 alist_user_id/alist_role_id/sync_*/last_sync*）→ 立即 `skip_writeback_echo`，零 AList 变更、零 PATCH - **write-back 值比对守卫**：writeBack() 先 GET 当前记录，只 PATCH 值真会变的字段；值没变 → 无 PATCH → 无 webhook → 从物理上掐断 loop - 写回时始终清 `sync_required: false` - base_path 硬编码 `'/'`；空 role 数组先建 role 再建 user +- ⚠ **AccessGrants 本次不物化**：不作为 lifecycle source-of-truth，保持现状，等 W4 统一设计（用户明确指示） ### 3. W2 CustomerProduct 权限同步 — **实测跑通** ✅ - 文件：`n8n/W2-customerproduct-sync.json`（`n8n/w2-body.js` + 共享库 → `gen_w2.js`） diff --git a/n8n/W1-customer-provision.json b/n8n/W1-customer-provision.json index 30ee6e8..7dcbee8 100644 --- a/n8n/W1-customer-provision.json +++ b/n8n/W1-customer-provision.json @@ -46,7 +46,7 @@ }, { "parameters": { - "jsCode": "// ============================================================================\n// W1 runtime body — Customer provision + STATUS LIFECYCLE (Step 3).\n// Rebuilt by `node n8n/gen_w1.js` (single source of truth = shared/effective-grants.js).\n//\n// Single self-contained Code node (plus webhook + id extract). Replaces the\n// old multi-node chain with the SAME provision behaviour PLUS status lifecycle.\n//\n// status suspended/deleted -> disable AList user + clear role scopes (soft\n// delete: user + NocoDB history preserved).\n// status active -> provision (create/update user+role) then\n// RECOMPUTE desired scopes via shared\n// calculateEffectiveGrants and write them, then\n// re-enable the user.\n// other status -> no AList mutation (skip).\n//\n// SELF-WRITE-BACK SUPPRESSION (loop guard, 2026-08-23 rewrite):\n// We distinguish an ADMIN business change from our OWN write-back echo using\n// the NocoDB v2 webhook's old/new rows (`previous_rows` vs `rows`), NOT the\n// brittle `sync_status === 'synced'` check.\n//\n// businessChanged = a BUSINESS field moved (status / username / password /\n// display_name / email / notes) OR `sync_required` is set.\n// echo = only our bookkeeping fields moved (alist_user_id,\n// alist_role_id, sync_status, sync_required=false,\n// last_sync, last_sync_error).\n//\n// We always write back with `sync_required: false` (and clear it), so our own\n// echo re-enters with businessChanged === false -> skip immediately, before\n// any AList mutation. An admin flipping status (or setting sync_required) is\n// the ONLY thing that proceeds past the guard — exactly once.\n//\n// Value-change write-back guard: writeBack() re-reads the record and only\n// PATCHes fields that would actually CHANGE. Writing the same value produces\n// no PATCH -> no webhook -> no loop, even if NocoDB webhooks fire on any field.\n//\n// Idempotency: final state is converged per status (see above). Duplicate or\n// echo webhooks re-apply the same end state with zero net change.\n// ============================================================================\n// ============================================================================\n// SHARED: calculateEffectiveGrants — single source of truth for \"what scopes\n// should customer X have right now\", reused by W1 (active resume), W2\n// (CustomerProduct sync) and W3 (expiry sweep).\n//\n// This file is INLINED into each workflow's Code node at build time (see\n// gen_w1.js / gen_w2.js / gen_w3.js). It must therefore be self-contained:\n// no require/import, no process.exit, no top-level return outside functions.\n//\n// Config is read via $env (the ONLY reliable channel in n8n Code nodes for\n// custom env vars — process.env is unreliable there). The caller passes a\n// `ctx` with { $env, helpers } so this file is also unit-testable outside n8n.\n//\n// ============================================================================\n\n// --- helpers (depend on ctx, so they are functions not top-level consts) ---\n\nfunction ncUrl(ctx, path) {\n return ctx.$env.NOCODB_URL + path;\n}\n\nasync function ncGet(ctx, path) {\n return await ctx.helpers.httpRequest({\n method: 'GET',\n url: ncUrl(ctx, path),\n headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n json: true,\n });\n}\n\nasync function alistReq(ctx, method, path, body, token) {\n // NOTE: AList expects the RAW token in Authorization (no \"Bearer \" prefix).\n return await ctx.helpers.httpRequest({\n method,\n url: ctx.$env.ALIST_URL + path,\n headers: token ? { Authorization: token } : {},\n body,\n json: true,\n });\n}\n\n// NocoDB LinkToAnotherRecord values are objects/arrays/numbers depending on\n// whether the API was asked to expand them. Normalise to a single id or null.\nfunction linkId(v) {\n if (v == null) return null;\n if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n return v;\n}\n\n// --- core algorithm --------------------------------------------------------\n//\n// desired scopes for a customer = union of:\n// (a) every RESOURCE reachable from an ACTIVE, NOT-YET-EXPIRED CustomerProduct\n// (b) every RESOURCE granted directly via an ACTIVE, NOT-YET-EXPIRED AccessGrant\n//\n// For (a) the SAME resource coming from MULTIPLE products keeps the MAX\n// expires_at, exactly matching the \"two products share a resource\" semantics\n// the user tested. Expiry boundary is `<= today` (expiring today is expired).\n\nasync function calculateEffectiveGrants(ctx, customerId) {\n const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n const T_CUSTPROD = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n const T_GRANT = ctx.$env.NOCODB_TABLE_ACCESSGRANTS;\n const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'\n\n // index all Resources by Id -> alist_path (cheap, one query)\n const allRes = (await ncGet(ctx, `/api/v2/tables/${T_RES}/records?limit=10000`)).list || [];\n const resPath = {};\n allRes.forEach(r => { resPath[r.Id] = r.alist_path; });\n\n const desired = {}; // path -> { expires, permission }\n\n // (a) CustomerProducts -> Resources (via product M2M link), MAX expiry on\n // the same path.\n // NOTE: `(customer,eq,N)` matches the link field's DISPLAY NAME and always\n // returns 0 rows. Must use the `customer.Id` sub-field syntax (or the\n // foreign-key column `nc_jitu___Customers_id`).\n const cps = (await ncGet(ctx, `/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n for (const c of cps) {\n if (c.status && c.status !== 'active') continue;\n if (c.expires_at && String(c.expires_at) <= today) continue; // expired (incl. today)\n const pid = linkId(c.product);\n if (!pid) continue;\n const res = (await ncGet(ctx, `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`)).list || [];\n const exp = c.expires_at; // 'YYYY-MM-DD' (may be null = no expiry)\n for (const r of res) {\n const p = resPath[r.Id];\n if (!p) continue;\n const cur = desired[p];\n if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n desired[p] = { expires: exp || null, permission: cur?.permission ?? 0 };\n }\n }\n }\n\n // (b) AccessGrants -> Resources (manual / materialised direct grants)\n const grants = (await ncGet(ctx, `/api/v2/tables/${T_GRANT}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n for (const g of grants) {\n if (g.status && g.status !== 'active') continue;\n if (g.expires_at && String(g.expires_at) <= today) continue;\n const p = resPath[linkId(g.resource)];\n if (!p) continue;\n const exp = g.expires_at;\n const cur = desired[p];\n if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n desired[p] = { expires: exp || null, permission: g.permission === 'readwrite' ? 1 : 0 };\n }\n }\n\n const desiredPaths = Object.keys(desired).sort();\n return {\n customerId,\n desired, // { path: {expires, permission} }\n desiredPaths, // sorted array of paths\n newScopes: desiredPaths.map(p => ({ path: p, permission: desired[p].permission })),\n };\n}\n\n// --- export shim: kept only when unit-tested, stripped when inlined -------\n// ============================================================================\n\nconst ctx = { $env, helpers: this.helpers };\n\n// 1. fresh customer record by id (from webhook extract)\nconst customerId = $json.customerId;\n\n// NocoDB v2 webhook payload carries the pre/post rows. The extract node already\n// surfaced customerId; here we re-read the record for the authoritative\n// CURRENT field values (source of truth = NocoDB), and separately inspect the\n// event's old/new rows to decide business-change vs echo.\nconst cust = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\nconst status = cust.status || 'active';\nconst username = cust.username;\nif (!username) throw new Error('Customer missing username');\nconst alistUserId = cust.alist_user_id ?? null;\nconst alistRoleId = cust.alist_role_id ?? null;\nconst alreadyProvisioned = !!(alistUserId && alistRoleId);\n\n// 2. admin login\nconst login = await alistReq(ctx, 'POST', '/api/auth/login', {\n username: $env.ALIST_ADMIN_USERNAME,\n password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\n// 3. LOOP GUARD — distinguish admin business change from our own echo.\n// The extract node passes through the raw rows so we can diff. Fall back to\n// \"always proceed\" if the payload rows are missing (better a redundant\n// idempotent provision than a silently dropped admin change).\nconst oldRow = ($json.previousRow && Object.keys($json.previousRow).length) ? $json.previousRow : null;\nconst newRow = ($json.newRow && Object.keys($json.newRow).length) ? $json.newRow : null;\n\n// Business fields an admin edits to MEAN a change. Bookkeeping fields (ids,\n// sync_*, last_sync*) are what WE write and must never by themselves count as\n// a business change.\nconst BUSINESS_FIELDS = ['status', 'username', 'password', 'display_name', 'email', 'notes'];\n\nfunction businessChanged() {\n // sync_required explicitly set by admin => force reprocess (one-shot override).\n if (cust.sync_required === true || cust.sync_required === 1) return true;\n\n // If we have old+new rows, compare only business fields.\n if (oldRow && newRow) {\n for (const f of BUSINESS_FIELDS) {\n if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n }\n // Any business field present in new but matching old, or bookkeeping-only\n // delta => echo. Also guard against a field we didn't list changing: if a\n // business field existed in the row and moved, catch it generically.\n for (const f of Object.keys(newRow)) {\n // skip pure bookkeeping fields\n if (['alist_user_id','alist_role_id','sync_status','sync_required','last_sync','last_sync_error','Id','UpdatedAt','CreatedAt'].includes(f)) continue;\n if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n }\n return false;\n }\n\n // No rows in payload (unknown shape): fall back to provisioning only when\n // provision is genuinely incomplete OR status changed from what AList has.\n // To stay safe against loops, treat \"no info\" as skip-UNLESS-sync_required,\n // which admin can set explicitly.\n return false;\n}\n\nif (!businessChanged()) {\n // Our own write-back echo (or a bookkeeping-only save). Refuse to re-apply.\n // Nothing is written back here, so no further webhook is generated.\n return { json: { customerId, username, status, lifecycle: 'skip_writeback_echo', actions: [] } };\n}\n\n// 4. STATUS BRANCH ---------------------------------------------------------\n\n// writeBack with a VALUE-CHANGE guard: re-read the live record and PATCH only\n// fields whose value actually differs. If nothing differs -> no PATCH -> no\n// webhook -> loop is physically broken at the source.\nconst writeBack = async (fields) => {\n const live = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\n const changes = {};\n for (const k of Object.keys(fields)) {\n const want = fields[k];\n const have = live[k];\n if (want !== have) changes[k] = want;\n }\n if (Object.keys(changes).length === 0) return; // no-op: nothing changed\n await ctx.helpers.httpRequest({\n method: 'PATCH',\n url: `${$env.NOCODB_URL}/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records`,\n headers: { 'xc-token': $env.NOCODB_TOKEN },\n body: [Object.assign({ Id: customerId }, changes)],\n json: true,\n });\n};\n\nif (status === 'suspended' || status === 'deleted') {\n const actions = [];\n if (alistUserId) {\n await alistReq(ctx, 'POST', '/api/admin/user/update', { id: alistUserId, disabled: true }, token);\n actions.push('disable_user');\n }\n if (alistRoleId) {\n const role = await alistReq(ctx, 'GET', `/api/admin/role/get?id=${alistRoleId}`, null, token);\n await alistReq(ctx, 'POST', '/api/admin/role/update', {\n id: alistRoleId,\n name: role?.data?.name,\n description: role?.data?.description,\n permission_scopes: [],\n }, token);\n actions.push('clear_scopes');\n }\n // Clear sync_required (consumed) + mark synced. Value-change guard means the\n // echo re-entry sees businessChanged()===false and stops.\n await writeBack({ sync_status: 'synced', sync_required: false, last_sync_error: null });\n return { json: { customerId, username, status, lifecycle: 'suspend_or_delete', actions } };\n}\n\nif (status !== 'active') {\n // pending / expired / disabled / unknown -> no AList mutation. Do NOT write\n // back (avoids interfering mid-draft, avoids any echo loop).\n return { json: { customerId, username, status, lifecycle: 'noop', actions: [] } };\n}\n\n// status === 'active' -------------------------------------------------------\n\nconst actions = [];\nlet finalUserId = alistUserId;\nlet finalRoleId = alistRoleId;\n\n// 4a. ensure role exists\nif (!finalRoleId) {\n await alistReq(ctx, 'POST', '/api/admin/role/create', {\n name: 'customer-' + username,\n description: 'Auto role for ' + username,\n default: false,\n permission_scopes: [],\n }, token);\n const roles = await alistReq(ctx, 'GET', '/api/admin/role/list?page=1&per_page=100', null, token);\n const r = (roles?.data?.content || []).find(x => x.name === 'customer-' + username);\n if (!r) throw new Error('Created role not found: customer-' + username);\n finalRoleId = r.id;\n actions.push('create_role');\n}\n\n// 4b. ensure user exists / update; always re-enable on active\nif (!finalUserId) {\n await alistReq(ctx, 'POST', '/api/admin/user/create', {\n username,\n password: cust.password,\n base_path: '/',\n role: finalRoleId ? [finalRoleId] : [],\n permission: 16384,\n }, token);\n const users = await alistReq(ctx, 'GET', '/api/admin/user/list?page=1&per_page=100', null, token);\n const u = (users?.data?.content || []).find(x => x.username === username);\n if (!u) throw new Error('Created user not found: ' + username);\n finalUserId = u.id;\n actions.push('create_user');\n} else {\n await alistReq(ctx, 'POST', '/api/admin/user/update', {\n id: finalUserId,\n username,\n password: cust.password,\n base_path: '/',\n role: finalRoleId ? [finalRoleId] : [],\n permission: 16384,\n disabled: false,\n }, token);\n actions.push('update_user');\n}\n\n// 4c. RECOMPUTE desired scopes (never restore stale) and write them\nconst g = await calculateEffectiveGrants(ctx, customerId);\nawait alistReq(ctx, 'POST', '/api/admin/role/update', {\n id: finalRoleId,\n name: 'customer-' + username,\n description: 'Auto role for ' + username,\n permission_scopes: g.newScopes,\n}, token);\nactions.push('apply_grants');\n\n// 5. write-back ids + sync_status + clear sync_required (value-change guarded).\n// The echo re-entry sees businessChanged()===false -> skip_writeback_echo.\nawait writeBack({\n alist_user_id: alistUserId || finalUserId,\n alist_role_id: alistRoleId || finalRoleId,\n sync_status: 'synced',\n sync_required: false,\n last_sync_error: null,\n});\n\nreturn { json: {\n customerId, username, status, lifecycle: 'active_provision',\n alistUserId: finalUserId, alistRoleId: finalRoleId,\n desiredPaths: g.desiredPaths, actions,\n} };\n" + "jsCode": "// ============================================================================\n// W1 runtime body — Customer provision + STATUS LIFECYCLE (Step 3).\n// Rebuilt by `node n8n/gen_w1.js` (single source of truth = shared/effective-grants.js).\n//\n// Single self-contained Code node (plus webhook + id extract). Replaces the\n// old multi-node chain with the SAME provision behaviour PLUS status lifecycle.\n//\n// LIFECYCLE MATRIX (account-level state, 2026-08-23):\n//\n// status active (no user yet) -> provision (create role + user), recompute\n// effective grants, enable user.\n// status active (has user) -> re-enable + RECOMPUTE effective grants\n// (never restore stale scopes), apply.\n//\n// status pending/suspended/expired/deleted:\n// - has user/role -> disable AList user + clear role scopes (soft; keep\n// user + role + CustomerProducts + history).\n// - no user yet -> no-op (pure NocoDB label; do NOT create AList user).\n//\n// All resume transitions (pending/suspended/expired/deleted -> active) recompute\n// from current CustomerProducts + Product Resources + expiry; never restore old\n// scopes, and never mutate CustomerProducts automatically.\n//\n// SELF-WRITE-BACK SUPPRESSION (loop guard, 2026-08-23 rewrite):\n// We distinguish an ADMIN business change from our OWN write-back echo using\n// the NocoDB v2 webhook's old/new rows (`previous_rows` vs `rows`), NOT the\n// brittle `sync_status === 'synced'` check.\n//\n// businessChanged = a BUSINESS field moved (status / username / password /\n// display_name / email / notes) OR `sync_required` is set.\n// echo = only our bookkeeping fields moved (alist_user_id,\n// alist_role_id, sync_status, sync_required=false,\n// last_sync, last_sync_error).\n//\n// We always write back with `sync_required: false` (and clear it), so our own\n// echo re-enters with businessChanged === false -> skip immediately, before\n// any AList mutation. An admin flipping status (or setting sync_required) is\n// the ONLY thing that proceeds past the guard — exactly once.\n//\n// Value-change write-back guard: writeBack() re-reads the record and only\n// PATCHes fields that would actually CHANGE. Writing the same value produces\n// no PATCH -> no webhook -> no loop, even if NocoDB webhooks fire on any field.\n//\n// Idempotency: final state is converged per status (see above). Duplicate or\n// echo webhooks re-apply the same end state with zero net change.\n// ============================================================================\n// ============================================================================\n// SHARED: calculateEffectiveGrants — single source of truth for \"what scopes\n// should customer X have right now\", reused by W1 (active resume), W2\n// (CustomerProduct sync) and W3 (expiry sweep).\n//\n// This file is INLINED into each workflow's Code node at build time (see\n// gen_w1.js / gen_w2.js / gen_w3.js). It must therefore be self-contained:\n// no require/import, no process.exit, no top-level return outside functions.\n//\n// Config is read via $env (the ONLY reliable channel in n8n Code nodes for\n// custom env vars — process.env is unreliable there). The caller passes a\n// `ctx` with { $env, helpers } so this file is also unit-testable outside n8n.\n//\n// ============================================================================\n\n// --- helpers (depend on ctx, so they are functions not top-level consts) ---\n\nfunction ncUrl(ctx, path) {\n return ctx.$env.NOCODB_URL + path;\n}\n\nasync function ncGet(ctx, path) {\n return await ctx.helpers.httpRequest({\n method: 'GET',\n url: ncUrl(ctx, path),\n headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n json: true,\n });\n}\n\nasync function alistReq(ctx, method, path, body, token) {\n // NOTE: AList expects the RAW token in Authorization (no \"Bearer \" prefix).\n return await ctx.helpers.httpRequest({\n method,\n url: ctx.$env.ALIST_URL + path,\n headers: token ? { Authorization: token } : {},\n body,\n json: true,\n });\n}\n\n// NocoDB LinkToAnotherRecord values are objects/arrays/numbers depending on\n// whether the API was asked to expand them. Normalise to a single id or null.\nfunction linkId(v) {\n if (v == null) return null;\n if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n return v;\n}\n\n// --- core algorithm --------------------------------------------------------\n//\n// desired scopes for a customer = union of:\n// (a) every RESOURCE reachable from an ACTIVE, NOT-YET-EXPIRED CustomerProduct\n// (b) every RESOURCE granted directly via an ACTIVE, NOT-YET-EXPIRED AccessGrant\n//\n// For (a) the SAME resource coming from MULTIPLE products keeps the MAX\n// expires_at, exactly matching the \"two products share a resource\" semantics\n// the user tested. Expiry boundary is `<= today` (expiring today is expired).\n\nasync function calculateEffectiveGrants(ctx, customerId) {\n const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n const T_CUSTPROD = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n const T_GRANT = ctx.$env.NOCODB_TABLE_ACCESSGRANTS;\n const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'\n\n // index all Resources by Id -> alist_path (cheap, one query)\n const allRes = (await ncGet(ctx, `/api/v2/tables/${T_RES}/records?limit=10000`)).list || [];\n const resPath = {};\n allRes.forEach(r => { resPath[r.Id] = r.alist_path; });\n\n const desired = {}; // path -> { expires, permission }\n\n // (a) CustomerProducts -> Resources (via product M2M link), MAX expiry on\n // the same path.\n // NOTE: `(customer,eq,N)` matches the link field's DISPLAY NAME and always\n // returns 0 rows. Must use the `customer.Id` sub-field syntax (or the\n // foreign-key column `nc_jitu___Customers_id`).\n const cps = (await ncGet(ctx, `/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n for (const c of cps) {\n if (c.status && c.status !== 'active') continue;\n if (c.expires_at && String(c.expires_at) <= today) continue; // expired (incl. today)\n const pid = linkId(c.product);\n if (!pid) continue;\n const res = (await ncGet(ctx, `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`)).list || [];\n const exp = c.expires_at; // 'YYYY-MM-DD' (may be null = no expiry)\n for (const r of res) {\n const p = resPath[r.Id];\n if (!p) continue;\n const cur = desired[p];\n if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n desired[p] = { expires: exp || null, permission: cur?.permission ?? 0 };\n }\n }\n }\n\n // (b) AccessGrants -> Resources (manual / materialised direct grants)\n const grants = (await ncGet(ctx, `/api/v2/tables/${T_GRANT}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n for (const g of grants) {\n if (g.status && g.status !== 'active') continue;\n if (g.expires_at && String(g.expires_at) <= today) continue;\n const p = resPath[linkId(g.resource)];\n if (!p) continue;\n const exp = g.expires_at;\n const cur = desired[p];\n if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n desired[p] = { expires: exp || null, permission: g.permission === 'readwrite' ? 1 : 0 };\n }\n }\n\n const desiredPaths = Object.keys(desired).sort();\n return {\n customerId,\n desired, // { path: {expires, permission} }\n desiredPaths, // sorted array of paths\n newScopes: desiredPaths.map(p => ({ path: p, permission: desired[p].permission })),\n };\n}\n\n// --- export shim: kept only when unit-tested, stripped when inlined -------\n// ============================================================================\n\nconst ctx = { $env, helpers: this.helpers };\n\n// 1. fresh customer record by id (from webhook extract)\nconst customerId = $json.customerId;\n\n// NocoDB v2 webhook payload carries the pre/post rows. The extract node already\n// surfaced customerId; here we re-read the record for the authoritative\n// CURRENT field values (source of truth = NocoDB), and separately inspect the\n// event's old/new rows to decide business-change vs echo.\nconst cust = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\nconst status = cust.status || 'active';\nconst username = cust.username;\nif (!username) throw new Error('Customer missing username');\nconst alistUserId = cust.alist_user_id ?? null;\nconst alistRoleId = cust.alist_role_id ?? null;\nconst alreadyProvisioned = !!(alistUserId && alistRoleId);\n\n// 2. admin login\nconst login = await alistReq(ctx, 'POST', '/api/auth/login', {\n username: $env.ALIST_ADMIN_USERNAME,\n password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\n// 3. LOOP GUARD — distinguish admin business change from our own echo.\n// The extract node passes through the raw rows so we can diff. Fall back to\n// \"always proceed\" if the payload rows are missing (better a redundant\n// idempotent provision than a silently dropped admin change).\nconst oldRow = ($json.previousRow && Object.keys($json.previousRow).length) ? $json.previousRow : null;\nconst newRow = ($json.newRow && Object.keys($json.newRow).length) ? $json.newRow : null;\n\n// Business fields an admin edits to MEAN a change. Bookkeeping fields (ids,\n// sync_*, last_sync*) are what WE write and must never by themselves count as\n// a business change.\nconst BUSINESS_FIELDS = ['status', 'username', 'password', 'display_name', 'email', 'notes'];\n\nfunction businessChanged() {\n // sync_required explicitly set by admin => force reprocess (one-shot override).\n if (cust.sync_required === true || cust.sync_required === 1) return true;\n\n // After-INSERT: there is a new row but no previous row. This is a fresh\n // customer creation -> treat as a business change (provision / deactivate).\n if (newRow && !oldRow) return true;\n\n // If we have old+new rows, compare only business fields.\n if (oldRow && newRow) {\n for (const f of BUSINESS_FIELDS) {\n if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n }\n // Any business field present in new but matching old, or bookkeeping-only\n // delta => echo. Also guard against a field we didn't list changing: if a\n // business field existed in the row and moved, catch it generically.\n for (const f of Object.keys(newRow)) {\n // skip pure bookkeeping fields\n if (['alist_user_id','alist_role_id','sync_status','sync_required','last_sync','last_sync_error','Id','UpdatedAt','CreatedAt'].includes(f)) continue;\n if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n }\n return false;\n }\n\n // Both rows missing (unknown shape): fall back to provisioning only when\n // provision is genuinely incomplete OR status changed from what AList has.\n // To stay safe against loops, treat \"no info\" as skip-UNLESS-sync_required,\n // which admin can set explicitly.\n return false;\n}\n\nif (!businessChanged()) {\n // Our own write-back echo (or a bookkeeping-only save). Refuse to re-apply.\n // Nothing is written back here, so no further webhook is generated.\n return { json: { customerId, username, status, lifecycle: 'skip_writeback_echo', actions: [] } };\n}\n\n// 4. STATUS BRANCH ---------------------------------------------------------\n\n// writeBack with a VALUE-CHANGE guard: re-read the live record and PATCH only\n// fields whose value actually differs. If nothing differs -> no PATCH -> no\n// webhook -> loop is physically broken at the source.\nconst writeBack = async (fields) => {\n const live = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\n const changes = {};\n for (const k of Object.keys(fields)) {\n const want = fields[k];\n const have = live[k];\n if (want !== have) changes[k] = want;\n }\n if (Object.keys(changes).length === 0) return; // no-op: nothing changed\n await ctx.helpers.httpRequest({\n method: 'PATCH',\n url: `${$env.NOCODB_URL}/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records`,\n headers: { 'xc-token': $env.NOCODB_TOKEN },\n body: [Object.assign({ Id: customerId }, changes)],\n json: true,\n });\n};\n\nif (status !== 'active') {\n // pending / suspended / expired / deleted / unknown -> deactivate.\n // - has user/role: disable AList user + clear role scopes (soft).\n // - no user yet: no-op (pure label; do NOT create AList user).\n if (!alistUserId && !alistRoleId) {\n return { json: { customerId, username, status, lifecycle: 'noop_not_provisioned', actions: [] } };\n }\n const actions = [];\n if (alistUserId) {\n await alistReq(ctx, 'POST', '/api/admin/user/update', { id: alistUserId, disabled: true }, token);\n actions.push('disable_user');\n }\n if (alistRoleId) {\n const role = await alistReq(ctx, 'GET', `/api/admin/role/get?id=${alistRoleId}`, null, token);\n await alistReq(ctx, 'POST', '/api/admin/role/update', {\n id: alistRoleId,\n name: role?.data?.name,\n description: role?.data?.description,\n permission_scopes: [],\n }, token);\n actions.push('clear_scopes');\n }\n // value-change guarded write-back; echo re-entry sees businessChanged()===false.\n await writeBack({ sync_status: 'synced', sync_required: false, last_sync_error: null });\n return { json: { customerId, username, status, lifecycle: 'deactivate', actions } };\n}\n\n// status === 'active' -------------------------------------------------------\n\nconst actions = [];\nlet finalUserId = alistUserId;\nlet finalRoleId = alistRoleId;\n\n// 4a. ensure role exists\nif (!finalRoleId) {\n await alistReq(ctx, 'POST', '/api/admin/role/create', {\n name: 'customer-' + username,\n description: 'Auto role for ' + username,\n default: false,\n permission_scopes: [],\n }, token);\n const roles = await alistReq(ctx, 'GET', '/api/admin/role/list?page=1&per_page=100', null, token);\n const r = (roles?.data?.content || []).find(x => x.name === 'customer-' + username);\n if (!r) throw new Error('Created role not found: customer-' + username);\n finalRoleId = r.id;\n actions.push('create_role');\n}\n\n// 4b. ensure user exists / update; always re-enable on active\nif (!finalUserId) {\n await alistReq(ctx, 'POST', '/api/admin/user/create', {\n username,\n password: cust.password,\n base_path: '/',\n role: finalRoleId ? [finalRoleId] : [],\n permission: 16384,\n }, token);\n const users = await alistReq(ctx, 'GET', '/api/admin/user/list?page=1&per_page=100', null, token);\n const u = (users?.data?.content || []).find(x => x.username === username);\n if (!u) throw new Error('Created user not found: ' + username);\n finalUserId = u.id;\n actions.push('create_user');\n} else {\n await alistReq(ctx, 'POST', '/api/admin/user/update', {\n id: finalUserId,\n username,\n password: cust.password,\n base_path: '/',\n role: finalRoleId ? [finalRoleId] : [],\n permission: 16384,\n disabled: false,\n }, token);\n actions.push('update_user');\n}\n\n// 4c. RECOMPUTE desired scopes (never restore stale) and write them\nconst g = await calculateEffectiveGrants(ctx, customerId);\nawait alistReq(ctx, 'POST', '/api/admin/role/update', {\n id: finalRoleId,\n name: 'customer-' + username,\n description: 'Auto role for ' + username,\n permission_scopes: g.newScopes,\n}, token);\nactions.push('apply_grants');\n\n// 5. write-back ids + sync_status + clear sync_required (value-change guarded).\n// The echo re-entry sees businessChanged()===false -> skip_writeback_echo.\nawait writeBack({\n alist_user_id: alistUserId || finalUserId,\n alist_role_id: alistRoleId || finalRoleId,\n sync_status: 'synced',\n sync_required: false,\n last_sync_error: null,\n});\n\nreturn { json: {\n customerId, username, status, lifecycle: 'active_provision',\n alistUserId: finalUserId, alistRoleId: finalRoleId,\n desiredPaths: g.desiredPaths, actions,\n} };\n" }, "id": "lifecycle", "name": "Provision & Apply Lifecycle", diff --git a/n8n/test_w1_lifecycle.js b/n8n/test_w1_lifecycle.js index 99e67a5..bc51ef2 100644 --- a/n8n/test_w1_lifecycle.js +++ b/n8n/test_w1_lifecycle.js @@ -1,11 +1,13 @@ // Idempotency + lifecycle + SELF-WRITE-BACK SUPPRESSION tests for W1 (Step 3). // Loads the ACTUAL inlined code from W1-customer-provision.json and runs it -// against a mock ctx, driving a customer through: -// active -> suspended -> active (resume) -> deleted +// against a mock ctx, driving a customer through the full 5-status lifecycle: +// pending -> active -> suspended -> active -> expired -> active -> deleted -> active // and asserting converged AList end-state each time, PLUS: // - a business change (admin flips status) processes exactly once // - our own write-back echo (bookkeeping-only delta) is SKIPPED and does NOT // PATCH again (this is the loop fix). +// - resume (X -> active) recomputes scopes, never restores stale paths. +// - pending/expired/deleted with NO user yet -> no-op (no AList user created). // Run: node n8n/test_w1_lifecycle.js const fs = require('fs'); const path = require('path'); @@ -19,7 +21,7 @@ const TODAY = new Date().toISOString().slice(0, 10); // ---- mutable mock state (represents AList + NocoDB) ---- const state = { // NocoDB customer record (the fields W1 reads) - customer: { Id: 1, username: 'alice', password: 'pw', status: 'active', alist_user_id: null, alist_role_id: null, sync_status: 'pending', sync_required: false, last_sync_error: null }, + customer: { Id: 1, username: 'alice', password: 'pw', status: 'pending', alist_user_id: null, alist_role_id: null, sync_status: 'pending', sync_required: false, last_sync_error: null }, // AList users: [], // {id, username, disabled, role} roles: [], // {id, name, permission_scopes} @@ -55,7 +57,6 @@ function mockHttp(opts) { if (u.includes('/tc/records') && m === 'PATCH') { const fields = body[0] || body; state.patched.push(Object.assign({}, fields)); - // apply to customer state Object.assign(state.customer, fields); return { code: 200 }; } @@ -81,36 +82,29 @@ function mockHttp(opts) { state.roles.push(r); return { data: r }; } - // role list if (u.endsWith('/api/admin/role/list?page=1&per_page=100')) return { data: { content: state.roles } }; - // role get const rg = u.match(/role\/get\?id=(\d+)/); if (rg) { const r = state.roles.find(x => x.id === Number(rg[1])); if (!r) return { data: {} }; return { data: { name: r.name, description: r.description, permission_scopes: r.permission_scopes } }; } - // role update if (u.endsWith('/api/admin/role/update')) { const r = state.roles.find(x => x.id === body.id); if (r) r.permission_scopes = body.permission_scopes; return { code: 200 }; } - // user create if (u.endsWith('/api/admin/user/create')) { const us = { id: state.nextUserId++, username: body.username, disabled: body.disabled ?? false, role: body.role }; state.users.push(us); return { data: us }; } - // user get (loop guard checks actual disabled state) const ug = u.match(/user\/get\?id=(\d+)/); if (ug) { const us = state.users.find(x => x.id === Number(ug[1])); return { data: us || {} }; } - // user list if (u.endsWith('/api/admin/user/list?page=1&per_page=100')) return { data: { content: state.users } }; - // user update if (u.endsWith('/api/admin/user/update')) { const us = state.users.find(x => x.id === body.id); if (us) { @@ -123,11 +117,7 @@ function mockHttp(opts) { throw new Error('unexpected: ' + m + ' ' + u); } -// Simulate one W1 run. `event` mirrors the NocoDB v2 webhook old/new rows: -// - business change: previousRow has a DIFFERENT status than newRow (admin edit) -// - echo: previousRow == newRow on business fields, only bookkeeping moved. async function runW1(customerId, { status, oldRow, newRow, syncRequired } = {}) { - // apply the post-update state to the customer record (what W1 re-reads) if (status !== undefined) state.customer.status = status; if (syncRequired !== undefined) state.customer.sync_required = syncRequired; state.customer.alist_user_id = state.customer.alist_user_id ?? null; @@ -162,9 +152,16 @@ function roleScopes(roleId) { function userById(id) { return state.users.find(x => x.id === id); } async function main() { - // --- 1. active (fresh customer, business change: pending->active) --- - console.log('\n[1] active fresh customer (business change)'); - let r = await runW1(1, { status: 'active', oldRow: { Id: 1, username: 'alice', status: 'pending', sync_status: 'pending' }, newRow: { Id: 1, username: 'alice', status: 'active', sync_status: 'pending' } }); + // --- 1. pending with NO user yet -> no-op (no AList user created) --- + console.log('\n[1] pending (no user yet, after-insert) -> no-op'); + let r = await runW1(1, { status: 'pending', oldRow: {}, newRow: { Id: 1, username: 'alice', status: 'pending', sync_status: 'pending' } }); + A('lifecycle noop_not_provisioned', r.json.lifecycle === 'noop_not_provisioned', r.json); + A('no user created', state.users.length === 0, state.users); + A('no role created', state.roles.length === 0, state.roles); + + // --- 2. pending -> active (business change) -> provision --- + console.log('\n[2] pending -> active (provision)'); + r = await runW1(1, { status: 'active', oldRow: { Id: 1, username: 'alice', status: 'pending' }, newRow: { Id: 1, username: 'alice', status: 'active' } }); A('lifecycle active_provision', r.json.lifecycle === 'active_provision', r.json); A('user created', state.users.length === 1, state.users); A('role created', state.roles.length === 1, state.roles); @@ -172,54 +169,70 @@ async function main() { const uid1 = state.users[0].id; const rid1 = state.roles[0].id; A('scopes = Health + Music', JSON.stringify(roleScopes(rid1)) === JSON.stringify(['/Class/Health', '/Template/Music']), roleScopes(rid1)); - A('wrote alist_user_id + role_id back', state.customer.alist_user_id === uid1 && state.customer.alist_role_id === rid1, state.customer); - const patchesAfter1 = state.patched.length; + A('wrote ids back', state.customer.alist_user_id === uid1 && state.customer.alist_role_id === rid1, state.customer); + const patchesAfter2 = state.patched.length; - // --- 2. write-back echo (only bookkeeping moved) -> skip, NO new PATCH --- - console.log('\n[2] write-back echo (bookkeeping-only)'); + // --- 3. write-back echo -> skip, NO new PATCH --- + console.log('\n[3] write-back echo (bookkeeping-only)'); r = await runW1(1, { oldRow: { Id: 1, username: 'alice', status: 'active', alist_user_id: uid1, alist_role_id: rid1 }, newRow: { Id: 1, username: 'alice', status: 'active', alist_user_id: uid1, alist_role_id: rid1, sync_status: 'synced', sync_required: false } }); A('echo -> skip_writeback_echo', r.json.lifecycle === 'skip_writeback_echo', r.json); - A('NO new PATCH (loop broken)', state.patched.length === patchesAfter1, { before: patchesAfter1, after: state.patched.length }); - A('no new user/role', state.users.length === 1 && state.roles.length === 1, { u: state.users.length, r: state.roles.length }); + A('NO new PATCH', state.patched.length === patchesAfter2, { before: patchesAfter2, after: state.patched.length }); - // --- 3. suspended (business change: active->suspended) --- - console.log('\n[3] suspended (business change)'); + // --- 4. active -> suspended -> disable + clear --- + console.log('\n[4] active -> suspended'); r = await runW1(1, { status: 'suspended', oldRow: { Id: 1, username: 'alice', status: 'active' }, newRow: { Id: 1, username: 'alice', status: 'suspended' } }); - A('lifecycle suspend_or_delete', r.json.lifecycle === 'suspend_or_delete', r.json); + A('lifecycle deactivate', r.json.lifecycle === 'deactivate', r.json); A('user disabled', userById(uid1).disabled === true, userById(uid1)); A('scopes cleared', roleScopes(rid1).length === 0, roleScopes(rid1)); A('user NOT deleted (soft)', state.users.length === 1, state.users); - const patchesAfter3 = state.patched.length; - // --- 4. suspend echo (bookkeeping-only) -> skip, no re-PATCH --- - console.log('\n[4] suspend echo (bookkeeping-only)'); - r = await runW1(1, { oldRow: { Id: 1, username: 'alice', status: 'suspended' }, newRow: { Id: 1, username: 'alice', status: 'suspended', sync_status: 'synced', sync_required: false } }); - A('echo -> skip', r.json.lifecycle === 'skip_writeback_echo', r.json); - A('still disabled (unchanged)', userById(uid1).disabled === true, userById(uid1)); - A('NO new PATCH', state.patched.length === patchesAfter3, { before: patchesAfter3, after: state.patched.length }); - - // --- 5. active resume (business change) -> re-enable + RECOMPUTE (not stale) --- - console.log('\n[5] active resume (recompute, not restore stale)'); - state.cps = []; // remove all CPs -> only manual grant remains + // --- 5. suspended -> active (resume, recompute not restore stale) --- + console.log('\n[5] suspended -> active (recompute)'); + state.cps = []; // remove CPs -> only manual grant remains r = await runW1(1, { status: 'active', oldRow: { Id: 1, username: 'alice', status: 'suspended' }, newRow: { Id: 1, username: 'alice', status: 'active' } }); A('lifecycle active_provision (resume)', r.json.lifecycle === 'active_provision', r.json); A('user re-enabled', userById(uid1).disabled === false, userById(uid1)); A('scopes recomputed = only Music', JSON.stringify(roleScopes(rid1)) === JSON.stringify(['/Template/Music']), roleScopes(rid1)); - // --- 6. deleted (business change) -> soft delete --- - console.log('\n[6] deleted (business change)'); - r = await runW1(1, { status: 'deleted', oldRow: { Id: 1, username: 'alice', status: 'active' }, newRow: { Id: 1, username: 'alice', status: 'deleted' } }); - A('lifecycle suspend_or_delete', r.json.lifecycle === 'suspend_or_delete', r.json); + // --- 6. active -> expired -> disable + clear --- + console.log('\n[6] active -> expired'); + r = await runW1(1, { status: 'expired', oldRow: { Id: 1, username: 'alice', status: 'active' }, newRow: { Id: 1, username: 'alice', status: 'expired' } }); + A('lifecycle deactivate', r.json.lifecycle === 'deactivate', r.json); A('user disabled', userById(uid1).disabled === true, userById(uid1)); A('scopes cleared', roleScopes(rid1).length === 0, roleScopes(rid1)); - A('user retained (soft delete)', state.users.length === 1, state.users); - // --- 7. sync_required=true forces reprocess even without business diff --- - console.log('\n[7] sync_required flag forces reprocess'); - state.cps = [{ Id: 1, customer: 1, product: 2, status: 'active', expires_at: '2099-01-01' }]; - r = await runW1(1, { status: 'active', syncRequired: true, oldRow: { Id: 1, username: 'alice', status: 'deleted' }, newRow: { Id: 1, username: 'alice', status: 'active', sync_required: true } }); - A('lifecycle active_provision (forced)', r.json.lifecycle === 'active_provision', r.json); + // --- 7. expired -> active (recompute; only non-expired products) --- + console.log('\n[7] expired -> active (restore only valid)'); + // make product 2 non-expired + add an EXPIRED CP that must NOT restore + state.cps = [ + { Id: 1, customer: 1, product: 2, status: 'active', expires_at: '2099-01-01' }, + { Id: 8, customer: 1, product: 2, status: 'active', expires_at: '2020-01-01' }, // expired -> should not add anything new (product 2 already yields Health) + ]; + r = await runW1(1, { status: 'active', oldRow: { Id: 1, username: 'alice', status: 'expired' }, newRow: { Id: 1, username: 'alice', status: 'active' } }); + A('lifecycle active_provision', r.json.lifecycle === 'active_provision', r.json); A('user re-enabled', userById(uid1).disabled === false, userById(uid1)); + A('scopes = Health + Music (expired CP ignored)', JSON.stringify(roleScopes(rid1)) === JSON.stringify(['/Class/Health', '/Template/Music']), roleScopes(rid1)); + + // --- 8. active -> deleted -> disable + clear (soft delete) --- + console.log('\n[8] active -> deleted (soft)'); + r = await runW1(1, { status: 'deleted', oldRow: { Id: 1, username: 'alice', status: 'active' }, newRow: { Id: 1, username: 'alice', status: 'deleted' } }); + A('lifecycle deactivate', r.json.lifecycle === 'deactivate', r.json); + A('user disabled', userById(uid1).disabled === true, userById(uid1)); + A('scopes cleared', roleScopes(rid1).length === 0, roleScopes(rid1)); + A('user retained (soft)', state.users.length === 1, state.users); + + // --- 9. deleted -> active (recompute) --- + console.log('\n[9] deleted -> active (restore)'); + r = await runW1(1, { status: 'active', oldRow: { Id: 1, username: 'alice', status: 'deleted' }, newRow: { Id: 1, username: 'alice', status: 'active' } }); + A('lifecycle active_provision', r.json.lifecycle === 'active_provision', r.json); + A('user re-enabled', userById(uid1).disabled === false, userById(uid1)); + A('scopes recomputed', JSON.stringify(roleScopes(rid1)) === JSON.stringify(['/Class/Health', '/Template/Music']), roleScopes(rid1)); + + // --- 10. sync_required flag forces reprocess --- + console.log('\n[10] sync_required forces reprocess'); + r = await runW1(1, { status: 'active', syncRequired: true, oldRow: { Id: 1, username: 'alice', status: 'active' }, newRow: { Id: 1, username: 'alice', status: 'active', sync_required: true } }); + A('lifecycle active_provision (forced)', r.json.lifecycle === 'active_provision', r.json); + A('user still enabled', userById(uid1).disabled === false, userById(uid1)); console.log(fail === 0 ? '\nALL PASSED' : `\n${fail} FAILED`); process.exit(fail === 0 ? 0 : 1); diff --git a/n8n/w1-body.js b/n8n/w1-body.js index 4f7f475..86e3b82 100644 --- a/n8n/w1-body.js +++ b/n8n/w1-body.js @@ -5,13 +5,21 @@ // Single self-contained Code node (plus webhook + id extract). Replaces the // old multi-node chain with the SAME provision behaviour PLUS status lifecycle. // -// status suspended/deleted -> disable AList user + clear role scopes (soft -// delete: user + NocoDB history preserved). -// status active -> provision (create/update user+role) then -// RECOMPUTE desired scopes via shared -// calculateEffectiveGrants and write them, then -// re-enable the user. -// other status -> no AList mutation (skip). +// LIFECYCLE MATRIX (account-level state, 2026-08-23): +// +// status active (no user yet) -> provision (create role + user), recompute +// effective grants, enable user. +// status active (has user) -> re-enable + RECOMPUTE effective grants +// (never restore stale scopes), apply. +// +// status pending/suspended/expired/deleted: +// - has user/role -> disable AList user + clear role scopes (soft; keep +// user + role + CustomerProducts + history). +// - no user yet -> no-op (pure NocoDB label; do NOT create AList user). +// +// All resume transitions (pending/suspended/expired/deleted -> active) recompute +// from current CustomerProducts + Product Resources + expiry; never restore old +// scopes, and never mutate CustomerProducts automatically. // // SELF-WRITE-BACK SUPPRESSION (loop guard, 2026-08-23 rewrite): // We distinguish an ADMIN business change from our OWN write-back echo using @@ -80,6 +88,10 @@ function businessChanged() { // sync_required explicitly set by admin => force reprocess (one-shot override). if (cust.sync_required === true || cust.sync_required === 1) return true; + // After-INSERT: there is a new row but no previous row. This is a fresh + // customer creation -> treat as a business change (provision / deactivate). + if (newRow && !oldRow) return true; + // If we have old+new rows, compare only business fields. if (oldRow && newRow) { for (const f of BUSINESS_FIELDS) { @@ -96,7 +108,7 @@ function businessChanged() { return false; } - // No rows in payload (unknown shape): fall back to provisioning only when + // Both rows missing (unknown shape): fall back to provisioning only when // provision is genuinely incomplete OR status changed from what AList has. // To stay safe against loops, treat "no info" as skip-UNLESS-sync_required, // which admin can set explicitly. @@ -132,7 +144,13 @@ const writeBack = async (fields) => { }); }; -if (status === 'suspended' || status === 'deleted') { +if (status !== 'active') { + // pending / suspended / expired / deleted / unknown -> deactivate. + // - has user/role: disable AList user + clear role scopes (soft). + // - no user yet: no-op (pure label; do NOT create AList user). + if (!alistUserId && !alistRoleId) { + return { json: { customerId, username, status, lifecycle: 'noop_not_provisioned', actions: [] } }; + } const actions = []; if (alistUserId) { await alistReq(ctx, 'POST', '/api/admin/user/update', { id: alistUserId, disabled: true }, token); @@ -148,16 +166,9 @@ if (status === 'suspended' || status === 'deleted') { }, token); actions.push('clear_scopes'); } - // Clear sync_required (consumed) + mark synced. Value-change guard means the - // echo re-entry sees businessChanged()===false and stops. + // value-change guarded write-back; echo re-entry sees businessChanged()===false. await writeBack({ sync_status: 'synced', sync_required: false, last_sync_error: null }); - return { json: { customerId, username, status, lifecycle: 'suspend_or_delete', actions } }; -} - -if (status !== 'active') { - // pending / expired / disabled / unknown -> no AList mutation. Do NOT write - // back (avoids interfering mid-draft, avoids any echo loop). - return { json: { customerId, username, status, lifecycle: 'noop', actions: [] } }; + return { json: { customerId, username, status, lifecycle: 'deactivate', actions } }; } // status === 'active' -------------------------------------------------------