@7365admin1/core 3.42.3 → 3.44.0

package/test/camera-write-gate.test.mjs

@@ -0,0 +1,121 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * The write gate, asserted on the controller itself.
+ *
+ * The decision the gate makes is already covered as pure logic in
+ * `camera-view.util.test.mjs` (entitlement, permission strings, wildcard). What
+ * cannot be covered that way is the WIRING: constructing the controller needs a
+ * live Atlas connection, so there is no way to drive `add`/`updateById`/
+ * `deleteById` here without a database.
+ *
+ * The realistic regression is not that `isCameraEntitled` starts returning the
+ * wrong answer — it is that a later edit drops the call, or moves it after the
+ * write it was supposed to guard. That is a property of the source, so it is
+ * asserted against the source. End-to-end coverage of the HTTP status codes
+ * lives in API-core (`test/camera-write-auth.spec.ts`).
+ */
+const source = readFileSync(
+  fileURLToPath(new URL("../src/controllers/site-camera.controller.ts", import.meta.url)),
+  "utf8",
+);
+
+/** The body of one handler, so ordering can be asserted inside it. */
+function handler(name) {
+  const start = source.indexOf(`async function ${name}(`);
+  assert.notEqual(start, -1, `handler ${name} is gone`);
+  const rest = source.slice(start + 10);
+  const next = rest.indexOf("\n  async function ");
+  return next === -1 ? rest : rest.slice(0, next);
+}
+
+/**
+ * The list endpoint, which until now was neither scoped nor session-aware.
+ *
+ * `GET /site-cameras` returned every camera in the estate to any signed-in
+ * caller - 15 active IP cameras across 3 owner organisations on staging, with
+ * `host` and `username` on each. The site is now required and authorised.
+ */
+test("listing cameras requires a site and authorises it before reading", () => {
+  const body = handler("getAll");
+
+  assert.match(body, /site:\s*Joi\.string\(\)[\s\S]{0,60}\.required\(\)/);
+  const gate = body.indexOf("entitleSite(");
+  const read = body.indexOf("_getAll(");
+  assert.notEqual(gate, -1, "the list endpoint no longer authorises the site");
+  assert.notEqual(read, -1, "the list endpoint no longer reads cameras");
+  assert.ok(gate < read, "cameras are read before the site is authorised");
+});
+
+test("the list endpoint takes its caller from the session, not the query", () => {
+  const body = handler("getAll");
+  assert.match(body, /entitleSite\(\{\s*siteId:\s*site,\s*userId:\s*callerId\(req\)/);
+  // A site the caller may not see must read exactly like a site that is absent.
+  assert.match(body, /NotFoundError\("Site not found\."\)/);
+});
+
+test("every mutating handler authorises before it mutates", () => {
+  for (const [name, write] of [
+    ["add", "_add("],
+    ["updateById", "_updateById("],
+    ["deleteById", "_deleteById("],
+  ]) {
+    const body = handler(name);
+    const gate = body.indexOf("authorizeWrite(");
+    const mutation = body.indexOf(write);
+    assert.notEqual(gate, -1, `${name} does not authorise at all`);
+    assert.notEqual(mutation, -1, `${name} no longer calls ${write}`);
+    assert.ok(
+      gate < mutation,
+      `${name} calls ${write} before authorising - the gate guards nothing`,
+    );
+  }
+});
+
+test("authorisation is derived from the session, never from the request body", () => {
+  // `callerId` reads `req.user`, which only `requireAuth` sets. A body field
+  // would let a caller nominate themselves.
+  assert.match(source, /function callerId\(req: Request\)[\s\S]{0,160}\(req as any\)\.user/);
+  assert.equal(/callerId\((?!req\b|params\.req\b)/.test(source), false);
+  // No handler may pass a user, site or type taken from the body into the gate
+  // for the two id-scoped handlers: those come off the stored camera.
+  for (const name of ["updateById", "deleteById"]) {
+    const body = handler(name);
+    assert.match(body, /site: camera\.site/);
+    assert.match(body, /type: camera\.type/);
+    assert.equal(/site:\s*(value|req\.body)/.test(body), false);
+  }
+});
+
+test("a camera that is not the caller's is reported exactly as one that is absent", () => {
+  // Otherwise the difference between 404 and 403 enumerates every camera id in
+  // the estate to any signed-in account.
+  for (const name of ["updateById", "deleteById"]) {
+    const body = handler(name);
+    assert.match(body, /NotFoundError\("Camera not found\."\)/);
+  }
+  assert.match(source, /if \(error instanceof NotFoundError\)[\s\S]{0,120}params\.notFound/);
+});
+
+test("the refusal names no site, camera, host or credential", () => {
+  const messages = [
+    ...source.matchAll(/(?:NotFoundError|BadRequestError)\("([^"]+)"\)/g),
+    ...source.matchAll(/notFound: "([^"]+)"/g),
+  ].map((m) => m[1]);
+  assert.ok(messages.length >= 2);
+  for (const message of messages) {
+    assert.equal(/\d{1,3}\.\d{1,3}\.|rtsp:|http:|password|username|\$\{/.test(message), false);
+  }
+  assert.ok(messages.includes("Camera not found."));
+  assert.ok(messages.includes("Site not found."));
+});
+
+test("the permission asked for follows the camera's type", () => {
+  // One endpoint serves both panels; asking for the CCTV string on an ANPR write
+  // would refuse a role provisioned for ANPR alone.
+  assert.match(source, /cameraManagePermissions\(params\.type\)/);
+  assert.equal(source.includes("CAMERA_SETUP_PERMISSIONS"), false);
+});