@antelopejs/dms 0.9.2 → 0.9.4

package/frontend-vue/tests/permission-preview-session.test.ts

@@ -1,69 +0,0 @@
-// @vitest-environment jsdom
-import { afterEach, beforeEach, expect, it, vi } from "vitest";
-import { computed, ref } from "vue";
-import { usePermissionPreview } from "../layers/dms-core/app/build/composables/auth/usePermissionPreview";
-import {
-  PERMISSION_PREVIEW_STORAGE_PREFIX,
-  PERMISSION_PREVIEW_TAB_KEY,
-} from "../layers/dms-core/app/build/utils/permission-preview";
-
-// A "Preview as role" tab only annotates what the viewer is served: its
-// requests leave as they are, run with the viewer's own rights. Signing out
-// forgets every preview this browser holds, so the next account does not find
-// the previous one's role name and draft permissions.
-
-const states = new Map<string, unknown>();
-
-beforeEach(() => {
-  states.clear();
-  vi.stubGlobal("computed", computed);
-  vi.stubGlobal("useDmsState", (key: string, init: () => unknown) => {
-    if (!states.has(key)) states.set(key, ref(init()));
-    return states.get(key);
-  });
-  localStorage.setItem(`${PERMISSION_PREVIEW_STORAGE_PREFIX}a`, "{}");
-  localStorage.setItem(`${PERMISSION_PREVIEW_STORAGE_PREFIX}b`, "{}");
-  localStorage.setItem("unrelated", "kept");
-  sessionStorage.setItem(PERMISSION_PREVIEW_TAB_KEY, "a");
-});
-
-afterEach(() => {
-  localStorage.clear();
-  sessionStorage.clear();
-  vi.unstubAllGlobals();
-});
-
-it("removes the previews of every tab and the session in memory", () => {
-  const preview = usePermissionPreview();
-  preview.session.value = {
-    id: "a",
-  } as unknown as typeof preview.session.value;
-
-  preview.purge();
-
-  expect(preview.session.value).toBeNull();
-  expect(sessionStorage.getItem(PERMISSION_PREVIEW_TAB_KEY)).toBeNull();
-  expect(Object.keys(localStorage)).toEqual(["unrelated"]);
-});
-
-it("lets a preview tab's requests through untouched", () => {
-  const nativeFetch = window.fetch;
-  const nativeOpen = XMLHttpRequest.prototype.open;
-  localStorage.setItem(
-    `${PERMISSION_PREVIEW_STORAGE_PREFIX}a`,
-    JSON.stringify({
-      id: "a",
-      roleId: null,
-      roleName: "Support",
-      permissions: [],
-      unsaved: false,
-      returnTo: "/settings/workspace/roles",
-      updatedAt: Date.now(),
-    }),
-  );
-  const preview = usePermissionPreview();
-
-  expect(preview.activate()).toBe(true);
-  expect(window.fetch).toBe(nativeFetch);
-  expect(XMLHttpRequest.prototype.open).toBe(nativeOpen);
-});

package/frontend-vue/tests/permission-preview.test.ts

@@ -1,196 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  applyPreviewLocks,
-  buildPreviewUrl,
-  childLayoutPath,
-  isPreviewEntryLocked,
-  isStalePreviewSession,
-  listPreviewablePages,
-  parsePreviewSession,
-  PERMISSION_PREVIEW_TTL_MS,
-  type PermissionPreviewResult,
-  type PreviewLockableEntry,
-  resolveActivePreviewBlock,
-  resolvePreviewBlock,
-} from "#dms-core/app/build/utils/permission-preview";
-
-const SESSION = {
-  id: "p1",
-  roleId: "r1",
-  roleName: "Support",
-  permissions: ["sales.orders"],
-  unsaved: true,
-  returnTo: "/settings/roles",
-  updatedAt: 1000,
-};
-
-describe("permission preview", () => {
-  describe("parsePreviewSession", () => {
-    it("reads a stored session", () => {
-      expect(parsePreviewSession(JSON.stringify(SESSION))).toEqual(SESSION);
-    });
-
-    it("defaults the optional fields", () => {
-      const { roleId: _roleId, unsaved: _unsaved, ...rest } = SESSION;
-      expect(parsePreviewSession(JSON.stringify(rest))).toEqual({
-        ...rest,
-        roleId: null,
-        unsaved: false,
-      });
-    });
-
-    it("rejects anything else", () => {
-      expect(parsePreviewSession(null)).toBeNull();
-      expect(parsePreviewSession("{")).toBeNull();
-      expect(parsePreviewSession("[]")).toBeNull();
-      expect(
-        parsePreviewSession(JSON.stringify({ ...SESSION, permissions: [1] })),
-      ).toBeNull();
-    });
-  });
-
-  it("drops sessions past their lifetime", () => {
-    expect(isStalePreviewSession(SESSION, 1000)).toBe(false);
-    expect(
-      isStalePreviewSession(SESSION, 1000 + PERMISSION_PREVIEW_TTL_MS + 1),
-    ).toBe(true);
-  });
-
-  it("builds layout paths like the server", () => {
-    expect(childLayoutPath("grid", "kpis")).toBe("grid.kpis");
-    expect(childLayoutPath(undefined, "kpis")).toBeUndefined();
-  });
-
-  it("resolves the block of a layout path", () => {
-    const result: PermissionPreviewResult = {
-      page: { fullId: "sales.orders", displayName: "Orders", hidden: false },
-      blocks: {
-        table: { state: "readonly", withheld: ["Edit"] },
-        "grid.kpis": { state: "hidden" },
-      },
-      hiddenEntries: [],
-      outOfScope: 0,
-    };
-    expect(resolvePreviewBlock(result, "grid.kpis")).toEqual({
-      state: "hidden",
-    });
-    expect(resolvePreviewBlock(result, "grid")).toBeUndefined();
-    expect(resolvePreviewBlock(result, undefined)).toBeUndefined();
-    expect(resolvePreviewBlock(null, "table")).toBeUndefined();
-  });
-
-  it("adds the preview id to the first URL", () => {
-    expect(buildPreviewUrl("/", "a b")).toBe("/?dms-preview=a%20b");
-    expect(buildPreviewUrl("/x?y=1", "id")).toBe("/x?y=1&dms-preview=id");
-  });
-
-  it("offers the pages reachable without parameters", () => {
-    const pages = {
-      "/": { displayName: "Home" },
-      "/orders": { displayName: "Orders", hasAccess: true },
-      "/denied": { displayName: "Denied", hasAccess: false },
-      "/auth/login": { displayName: "Login", publicAccess: true },
-      "/hidden": { displayName: "Hidden", hidden: true },
-      "/orders/:id": { displayName: "Order" },
-      "/edit": {
-        displayName: "Edit",
-        validation: { requiredQueryParams: ["id"] },
-      },
-    };
-    expect(listPreviewablePages(pages).map(({ slug }) => slug)).toEqual([
-      "/",
-      "/orders",
-    ]);
-  });
-  describe("preview-only rendering", () => {
-    const RESULT: PermissionPreviewResult = {
-      page: { fullId: "sales.orders", displayName: "Orders", hidden: false },
-      blocks: { table: { state: "hidden" } },
-      hiddenEntries: ["sales.orders"],
-      outOfScope: 0,
-    };
-    const HIDDEN = new Set(RESULT.hiddenEntries);
-
-    it("veils a block only while a preview is active", () => {
-      expect(resolveActivePreviewBlock(true, RESULT, "table")).toEqual({
-        state: "hidden",
-      });
-      // A normal session, even holding a stale result, veils nothing.
-      expect(resolveActivePreviewBlock(false, RESULT, "table")).toBeUndefined();
-    });
-
-    it("locks a menu entry only while a preview is active", () => {
-      expect(isPreviewEntryLocked(true, HIDDEN, "sales.orders")).toBe(true);
-      expect(isPreviewEntryLocked(false, HIDDEN, "sales.orders")).toBe(false);
-      expect(isPreviewEntryLocked(true, HIDDEN, "sales.invoices")).toBe(false);
-      expect(isPreviewEntryLocked(true, HIDDEN, undefined)).toBe(false);
-    });
-  });
-
-  describe("applyPreviewLocks", () => {
-    interface Entry extends PreviewLockableEntry {
-      label: string;
-      type?: "label";
-      locked?: boolean;
-      children?: Entry[];
-    }
-    const lock = (entry: Entry): Entry => ({ ...entry, locked: true });
-    const lockedLabels = (entries: Entry[]): string[] =>
-      entries.flatMap((entry) => [
-        ...(entry.locked ? [entry.label] : []),
-        ...lockedLabels(entry.children ?? []),
-      ]);
-    // A label group, a category with a nested category and a dynamic entry,
-    // and the sidebar footer.
-    const MENU: Entry[] = [
-      { label: "Sales", type: "label", fullId: "pages.sales" },
-      {
-        label: "Orders",
-        fullId: "pages.sales.orders",
-        children: [
-          {
-            label: "Archive",
-            fullId: "pages.sales.orders.archive",
-            children: [
-              { label: "Old", fullId: "pages.sales.orders.archive.old" },
-            ],
-          },
-          { label: "Project", fullId: "pages.sales.orders.acme" },
-        ],
-      },
-      { label: "Favorite without id" },
-      { label: "Settings", fullId: "settings" },
-      { label: "Modules", fullId: "modules" },
-    ];
-
-    it("locks labels, categories, nested and footer entries alike", () => {
-      const hidden = new Set([
-        "pages.sales",
-        "pages.sales.orders.archive.old",
-        "pages.sales.orders.acme",
-        "modules",
-      ]);
-      const locked = applyPreviewLocks(
-        MENU,
-        (fullId) => isPreviewEntryLocked(true, hidden, fullId),
-        lock,
-      );
-      expect(lockedLabels(locked)).toEqual([
-        "Sales",
-        "Old",
-        "Project",
-        "Modules",
-      ]);
-    });
-
-    it("locks nothing outside a preview", () => {
-      const hidden = new Set(MENU.map((entry) => entry.fullId ?? ""));
-      const locked = applyPreviewLocks(
-        MENU,
-        (fullId) => isPreviewEntryLocked(false, hidden, fullId),
-        lock,
-      );
-      expect(lockedLabels(locked)).toEqual([]);
-    });
-  });
-});

package/frontend-vue/tests/permission-veil-stable-content.test.ts

@@ -1,191 +0,0 @@
-// @vitest-environment jsdom
-import {
-  createApp,
-  defineComponent,
-  h,
-  nextTick,
-  ref,
-  shallowRef,
-  Suspense,
-  type App,
-  type Component,
-} from "vue";
-import { afterEach, beforeEach, expect, it, vi } from "vitest";
-import PermissionVeil from "../layers/dms-ui/app/build/components/permission/PermissionVeil.vue";
-
-// A role preview veils the blocks of the page it previews, and the veils move
-// as the preview answers for each page. A block's content (a table view) has
-// an async setup: remounting it while the page's Suspense waits for the next
-// page left Vue mounting it under a detached placeholder ("can't access
-// property insertBefore, parent is null"). The veil must keep its content in
-// place whatever its state.
-
-type VeilState = "hidden" | "readonly" | "limited" | null;
-
-let app: App | undefined;
-let host: HTMLDivElement;
-const errors: unknown[] = [];
-const onRejection = (event: PromiseRejectionEvent) => {
-  errors.push(event.reason);
-  event.preventDefault();
-};
-
-function deferred() {
-  let resolve!: () => void;
-  const promise = new Promise<void>((res) => {
-    resolve = res;
-  });
-  return { promise, resolve };
-}
-
-const Stub = defineComponent({
-  setup(_, { slots }) {
-    return () => h("span", slots.default?.());
-  },
-});
-
-function asyncBlock(setups: { count: number }, wait: () => Promise<void>) {
-  return defineComponent({
-    name: "AsyncBlock",
-    async setup() {
-      setups.count++;
-      await wait();
-      return () => h("section", { class: "block" }, "rows");
-    },
-  });
-}
-
-function mount(root: Component) {
-  app = createApp(root);
-  app.component("UTooltip", Stub);
-  app.component("UIcon", Stub);
-  app.config.errorHandler = (error) => {
-    errors.push(error);
-  };
-  app.mount(host);
-}
-
-async function flush() {
-  for (let index = 0; index < 5; index++) {
-    await Promise.resolve();
-    await nextTick();
-  }
-}
-
-beforeEach(() => {
-  host = document.createElement("div");
-  document.body.append(host);
-  errors.length = 0;
-  window.addEventListener("unhandledrejection", onRejection);
-});
-
-afterEach(() => {
-  app?.unmount();
-  app = undefined;
-  host.remove();
-  window.removeEventListener("unhandledrejection", onRejection);
-});
-
-it("keeps a persistent veil's content mounted when its state changes", async () => {
-  const setups = { count: 0 };
-  const Block = asyncBlock(setups, () => Promise.resolve());
-  const state = ref<VeilState>(null);
-  mount({
-    render: () =>
-      h(Suspense, null, {
-        default: () =>
-          h(
-            PermissionVeil,
-            { state: state.value, label: "Limited", persistent: true },
-            { default: () => h(Block) },
-          ),
-      }),
-  });
-  await vi.waitFor(() => expect(host.querySelector(".block")).not.toBeNull());
-  const block = host.querySelector(".block");
-
-  for (const next of ["limited", null, "hidden", "readonly", null] as const) {
-    state.value = next;
-    await flush();
-    expect(host.querySelector(".block")).toBe(block);
-  }
-  expect(setups.count).toBe(1);
-  expect(host.querySelector("[data-permission-veil]")).toBeNull();
-  state.value = "hidden";
-  await flush();
-  expect(
-    host
-      .querySelector("[data-permission-veil]")
-      ?.getAttribute("data-permission-veil"),
-  ).toBe("hidden");
-  expect(errors).toEqual([]);
-});
-
-it("renders the slot alone when it is not persistent and has no state", async () => {
-  mount({
-    render: () =>
-      h(PermissionVeil, { state: null }, { default: () => h("p", "plain") }),
-  });
-  await flush();
-  expect(host.innerHTML).toBe("<p>plain</p>");
-});
-
-it("survives veil changes on the old page while the next page loads", async () => {
-  const setups = { count: 0 };
-  const pending: Array<ReturnType<typeof deferred>> = [];
-  const Block = asyncBlock(setups, () => {
-    // The first mount resolves at once; later ones wait for the test.
-    if (setups.count === 1) return Promise.resolve();
-    const next = deferred();
-    pending.push(next);
-    return next.promise;
-  });
-  const nextPage = deferred();
-  const NextPage = defineComponent({
-    async setup() {
-      await nextPage.promise;
-      return () => h("main", { class: "next" }, "next page");
-    },
-  });
-  const state = ref<VeilState>("limited");
-  const OldPage = defineComponent({
-    setup() {
-      return () =>
-        h(
-          "main",
-          h(
-            PermissionVeil,
-            { state: state.value, label: "Limited", persistent: true },
-            { default: () => h(Block) },
-          ),
-        );
-    },
-  });
-  const page = shallowRef<Component>(OldPage);
-  const pageKey = ref("old");
-  mount({
-    render: () =>
-      h(Suspense, null, {
-        default: () => h(page.value, { key: pageKey.value }),
-      }),
-  });
-  await vi.waitFor(() => expect(host.querySelector(".block")).not.toBeNull());
-
-  // Navigation: the Suspense keeps the old page while the next one loads, and
-  // the preview's answer for the next page moves the old page's veils.
-  page.value = NextPage;
-  pageKey.value = "next";
-  await flush();
-  state.value = null;
-  await flush();
-  state.value = "limited";
-  await flush();
-  for (const entry of pending) entry.resolve();
-  await flush();
-  nextPage.resolve();
-  await vi.waitFor(() => expect(host.querySelector(".next")).not.toBeNull());
-  await flush();
-
-  expect(setups.count).toBe(1);
-  expect(errors).toEqual([]);
-});

package/frontend-vue/tests/permissions-transfer.test.ts

@@ -1,194 +0,0 @@
-// @vitest-environment jsdom
-/**
- * The permission set the `auth` middleware preloads while a server renders a
- * page reaches the browser with the page, through the runtime's real state
- * transfer: the browser's run of the middleware finds it and asks nothing.
- * A caller that only needs a set joins a load in flight.
- */
-import {
-  createApp,
-  createSSRApp,
-  defineComponent,
-  h,
-  nextTick,
-  type App,
-} from "vue";
-import { renderToString } from "vue/server-renderer";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { DmsFrontendRuntime } from "#dms/frontend-module";
-
-const engine = await import("#dms/frontend-module");
-const { createTrailingDeduper } = await import(
-  "../layers/dms-core/app/utils/trailingDeduper"
-);
-vi.stubGlobal("useDmsState", engine.useDmsState);
-vi.stubGlobal("useDmsApp", engine.useDmsApp);
-vi.stubGlobal("defineDmsMiddleware", engine.defineDmsMiddleware);
-vi.stubGlobal("useDmsError", engine.useDmsError);
-vi.stubGlobal("abortDmsNavigation", engine.abortDmsNavigation);
-vi.stubGlobal("navigateDms", engine.navigateDms);
-vi.stubGlobal("createTrailingDeduper", createTrailingDeduper);
-vi.stubGlobal("useDmsRuntimeConfig", () => ({ public: { dms: {} } }));
-vi.stubGlobal("useSiteLayout", () => ({
-  siteLayout: { value: {} },
-  findMatchingRoute: () => ({ metadata: {} }),
-}));
-vi.stubGlobal("useDmsUserSession", () => ({
-  loggedIn: { value: true },
-  user: { value: { isValidated: true } },
-}));
-
-const { useTrailingDeduper } = await import(
-  "../layers/dms-core/app/composables/useTrailingDeduper"
-);
-vi.stubGlobal("useTrailingDeduper", useTrailingDeduper);
-const { usePermissions } = await import(
-  "../layers/dms-core/app/composables/auth/usePermissions"
-);
-vi.stubGlobal("usePermissions", usePermissions);
-const { default: authMiddleware } = await import(
-  "../layers/dms-auth/app/middleware/auth"
-);
-
-const PERMISSION = "orders.read";
-
-interface PendingRequest {
-  resolve: (ids: string[]) => void;
-}
-
-const requests: PendingRequest[] = [];
-// Answers each request once the test releases it, in order.
-const $authFetch = vi.fn(
-  () =>
-    new Promise<string[]>((resolve) => {
-      requests.push({ resolve });
-    }),
-);
-vi.stubGlobal("useAuthFetch", () => ({ $authFetch }));
-
-const mounted: App[] = [];
-
-const settle = async () => {
-  await nextTick();
-  await new Promise((resolve) => setTimeout(resolve, 0));
-};
-
-async function answerRequests(): Promise<void> {
-  for (let round = 0; round < 3; round++) {
-    await settle();
-    for (const request of requests.splice(0)) request.resolve([PERMISSION]);
-  }
-}
-
-const Page = defineComponent({
-  setup() {
-    defineDmsPageMeta({ auth: true });
-    const { hasPermission } = usePermissions();
-    return () => h("p", hasPermission(PERMISSION) ? "can read" : "cannot read");
-  },
-});
-const { defineDmsPageMeta } = engine;
-
-/** A runtime whose app carries the DMS app context, as the real app's does. */
-function attach(app: App, runtime: DmsFrontendRuntime): void {
-  const context = {} as DmsFrontendRuntime["appContext"];
-  app.config.globalProperties.$dms = context;
-  runtime.appContext = context;
-  runtime.route.matched = [{}];
-  engine.provideDmsFrontendRuntime(app, runtime);
-}
-
-beforeEach(async () => {
-  requests.length = 0;
-  $authFetch.mockClear();
-  await engine.setupFrontendModules([
-    {
-      options: { public: {} },
-      module: {
-        setup(sdk) {
-          sdk.registerMiddleware("auth", authMiddleware);
-        },
-      },
-    },
-  ]);
-});
-
-afterEach(() => {
-  mounted.splice(0).forEach((app) => app.unmount());
-});
-
-describe("permissions handed to the browser", () => {
-  it("renders the page with the set the server loaded, and the browser asks nothing", async () => {
-    const server = engine.createDmsFrontendRuntime(undefined, {}, true);
-    const serverApp = createSSRApp(Page);
-    attach(serverApp, server);
-    const rendering = renderToString(serverApp);
-    await answerRequests();
-    expect(await rendering).toContain("can read");
-    expect($authFetch).toHaveBeenCalledTimes(1);
-
-    const payload = structuredClone(engine.serializeDmsPayload(server));
-    expect(payload.state["dms-user-permissions"]).toEqual(
-      new Set([PERMISSION]),
-    );
-
-    $authFetch.mockClear();
-    const browser = engine.createDmsFrontendRuntime(undefined, {});
-    engine.restoreDmsPayload(browser, payload);
-    const browserApp = createApp(Page);
-    attach(browserApp, browser);
-    const host = document.createElement("div");
-    browserApp.mount(host);
-    mounted.push(browserApp);
-    await answerRequests();
-
-    expect($authFetch).not.toHaveBeenCalled();
-    expect(host.textContent).toBe("can read");
-  });
-});
-
-describe("loading the permission set", () => {
-  function browserPermissions() {
-    const runtime = engine.createDmsFrontendRuntime();
-    const app = createApp({ render: () => null });
-    attach(app, runtime);
-    return app.runWithContext(() => usePermissions());
-  }
-
-  it("joins a first load in flight instead of loading twice", async () => {
-    const permissions = browserPermissions();
-    const loads = Promise.all([
-      permissions.loadPermissions(),
-      permissions.loadPermissions(),
-    ]);
-    await answerRequests();
-    await loads;
-
-    expect($authFetch).toHaveBeenCalledTimes(1);
-    expect(permissions.hasPermission(PERMISSION)).toBe(true);
-  });
-
-  it("still gives a refresh asked during a load its own pass", async () => {
-    const permissions = browserPermissions();
-    const runs = Promise.all([
-      permissions.loadPermissions(),
-      permissions.fetchPermissions(),
-    ]);
-    await answerRequests();
-    await runs;
-
-    expect($authFetch).toHaveBeenCalledTimes(2);
-  });
-
-  it("loads again when the load it joined was cleared meanwhile", async () => {
-    const permissions = browserPermissions();
-    const first = permissions.loadPermissions();
-    permissions.clear();
-    const second = permissions.loadPermissions();
-    await answerRequests();
-    await Promise.all([first, second]);
-
-    expect($authFetch).toHaveBeenCalledTimes(2);
-    expect(permissions.isLoaded.value).toBe(true);
-  });
-});