@appsemble/cli 0.27.11 → 0.28.0

package/lib/app.test.js

@@ -1,23 +1,17 @@
-import { authenticate, readFixture, resolveFixture } from '@appsemble/node-utils';
-import { authorizeClientCredentials, createServer, createTestUser, models, setArgv, useTestDatabase, } from '@appsemble/server';
+import { readFixture, resolveFixture } from '@appsemble/node-utils';
+import { createServer, createTestUser, models, setArgv, useTestDatabase } from '@appsemble/server';
 import { ISODateTimePattern } from '@appsemble/utils';
 import { setTestApp } from 'axios-test-instance';
-import { hash } from 'bcrypt';
+import FormData from 'form-data';
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import { patchApp, publishApp, updateApp } from './app.js';
+import { deleteApp, patchApp, publishApp, traverseAppDirectory, updateApp } from './app.js';
 import { initAxios } from './initAxios.js';
-const { App, AppBlockStyle, AppCollection, AppCollectionApp, AppMessages, AppScreenshot, Asset, BlockVersion, Organization, OrganizationMember, Resource, } = models;
+import { authorizeCLI } from './testUtils.js';
+const { App, AppBlockStyle, AppCollection, AppCollectionApp, AppMessages, AppOAuth2Secret, AppSamlSecret, AppScreenshot, AppServiceSecret, AppVariable, Asset, BlockVersion, Organization, OrganizationMember, Resource, } = models;
 const argv = { host: 'http://localhost', secret: 'test', aesSecret: 'testSecret' };
 let user;
 let organization;
 let testApp;
-async function authorizeCLI(scopes) {
-    const OAuth2AuthorizationCode = await authorizeClientCredentials(scopes);
-    const { id, secret } = OAuth2AuthorizationCode;
-    await OAuth2AuthorizationCode.update({ secret: await hash(secret, 10) });
-    await authenticate(testApp.defaults.baseURL, scopes, `${id}:${secret}`);
-    return `${id}:${secret}`;
-}
 useTestDatabase(import.meta);
 beforeAll(() => {
     vi.useFakeTimers();
@@ -60,7 +54,7 @@ afterAll(() => {
 describe('publishApp', () => {
     it('should publish app', async () => {
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await publishApp({
             path: resolveFixture('apps/test'),
             organization: organization.id,
@@ -145,6 +139,7 @@ describe('publishApp', () => {
         "showAppDefinition": true,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": false,
         "visibility": "unlisted",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -183,9 +178,23 @@ describe('publishApp', () => {
         const asset = await Asset.findAll();
         expect(asset).toStrictEqual([]);
     });
+    it('should throw an error if the user doesn’t have enough scope permissions', async () => {
+        const clientCredentials = await authorizeCLI('blocks:write resources:write', testApp);
+        await expect(() => publishApp({
+            path: resolveFixture('apps/test'),
+            organization: organization.id,
+            remote: testApp.defaults.baseURL,
+            clientCredentials,
+            // Required defaults
+            visibility: 'unlisted',
+            iconBackground: '#ffffff',
+        })).rejects.toThrow('write EPIPE');
+        const app = await App.findOne();
+        expect(app).toBeNull();
+    });
     it('should publish app with resources and assets', async () => {
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await publishApp({
             path: resolveFixture('apps/test'),
             organization: organization.id,
@@ -273,6 +282,7 @@ describe('publishApp', () => {
         "showAppDefinition": true,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": false,
         "visibility": "unlisted",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -339,7 +349,7 @@ describe('publishApp', () => {
             visibility: 'public',
         });
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await publishApp({
             path: resolveFixture('apps/test'),
             organization: organization.id,
@@ -426,6 +436,7 @@ describe('publishApp', () => {
         "showAppDefinition": true,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": true,
         "visibility": "public",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -497,7 +508,7 @@ describe('publishApp', () => {
     });
     it('should publish app with app variant patches applied', async () => {
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await publishApp({
             path: resolveFixture('apps/test'),
             organization: organization.id,
@@ -580,6 +591,7 @@ describe('publishApp', () => {
         "showAppDefinition": true,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": false,
         "visibility": "unlisted",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -633,6 +645,164 @@ describe('publishApp', () => {
             await readFixture('apps/test/variants/tux/assets/small-tux.png'),
         ]);
     });
+    it('should publish app variables and secrets', async () => {
+        vi.useRealTimers();
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
+        process.env.TEST_VARIABLE_1 = 'test-variable-1';
+        process.env.TEST_VARIABLE_2 = 'test-variable-2';
+        process.env.TEST_SECRET = 'test-secret';
+        process.env.TEST_SERVICE_URL_PATTERNS = 'http://localhost:1234';
+        process.env.TEST_SERVICE_IDENTIFIER = 'Authorization';
+        process.env.TEST_SERVICE_SECRET = 'secret';
+        process.env.TEST_SAML_IDP_CERTIFICATE = 'certificate';
+        process.env.TEST_SAML_ENTITY_ID = 'http://localhost:1234';
+        process.env.TEST_SAML_SSO_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_AUTHORIZATION_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_TOKEN_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_USER_INFO_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_CLIENT_ID = 'id';
+        process.env.TEST_OAUTH2_CLIENT_SECRET = 'secret';
+        process.env.TEST_SCIM_TOKEN = 'token';
+        process.env.TEST_SSL_KEY = 'key';
+        process.env.TEST_SSL_CERTIFICATE = 'certificate';
+        await publishApp({
+            path: resolveFixture('apps/test'),
+            organization: organization.id,
+            remote: testApp.defaults.baseURL,
+            clientCredentials,
+            visibility: 'unlisted',
+            iconBackground: '#ffffff',
+        });
+        vi.useFakeTimers();
+        const app = await App.findOne({
+            attributes: ['scimEnabled', 'scimToken', 'sslKey', 'sslCertificate'],
+            where: {
+                id: 1,
+            },
+        });
+        expect({
+            scimEnabled: app.scimEnabled,
+            scimToken: app.scimToken,
+            sslKey: app.sslKey,
+            sslCertificate: app.sslCertificate,
+        }).toStrictEqual({
+            scimEnabled: true,
+            scimToken: expect.any(Buffer),
+            sslKey: 'key',
+            sslCertificate: 'certificate',
+        });
+        const appVariables = await AppVariable.findAll({
+            attributes: ['name', 'value'],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect(appVariables[0].toJSON()).toStrictEqual({
+            name: 'test-variable-inline',
+            value: 'inline',
+        });
+        expect(appVariables[1].toJSON()).toStrictEqual({
+            name: 'test-variable',
+            value: 'test-variable-1.test-variable-2',
+        });
+        const appServiceSecret = await AppServiceSecret.findOne({
+            attributes: ['name', 'authenticationMethod', 'urlPatterns', 'identifier', 'secret'],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect(appServiceSecret.toJSON()).toStrictEqual({
+            name: 'test-service-secret',
+            authenticationMethod: 'custom-header',
+            urlPatterns: 'http://localhost:1234',
+            identifier: 'Authorization',
+            secret: expect.any(Buffer),
+        });
+        const appSamlSecret = await AppSamlSecret.findOne({
+            attributes: [
+                'name',
+                'icon',
+                'nameAttribute',
+                'emailAttribute',
+                'idpCertificate',
+                'entityId',
+                'ssoUrl',
+            ],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect(appSamlSecret.toJSON()).toStrictEqual({
+            emailAttribute: 'email',
+            entityId: 'http://localhost:1234',
+            icon: 'redhat',
+            id: 1,
+            idpCertificate: 'certificate',
+            name: 'test-saml-secret',
+            nameAttribute: 'name',
+            ssoUrl: 'http://localhost:1234',
+            spCertificate: expect.any(String),
+        });
+        const appOauth2Secret = await AppOAuth2Secret.findOne({
+            attributes: [
+                'name',
+                'icon',
+                'scope',
+                'remapper',
+                'authorizationUrl',
+                'tokenUrl',
+                'userInfoUrl',
+                'clientId',
+                'clientSecret',
+            ],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect({
+            authorizationUrl: appOauth2Secret.authorizationUrl,
+            clientId: appOauth2Secret.clientId,
+            clientSecret: appOauth2Secret.clientSecret,
+            icon: appOauth2Secret.icon,
+            name: appOauth2Secret.name,
+            remapper: appOauth2Secret.remapper,
+            scope: appOauth2Secret.scope,
+            tokenUrl: appOauth2Secret.tokenUrl,
+            userInfoUrl: appOauth2Secret.userInfoUrl,
+        }).toStrictEqual({
+            authorizationUrl: 'http://localhost:1234',
+            clientId: 'id',
+            clientSecret: 'secret',
+            icon: 'redhat',
+            name: 'test-oauth2-secret',
+            remapper: [{ prop: 'email' }],
+            scope: 'email openid profile',
+            tokenUrl: 'http://localhost:1234',
+            userInfoUrl: 'http://localhost:1234',
+        });
+    });
+    it('should validate and throw if there’s an error before publishing an app', async () => {
+        await BlockVersion.destroy({
+            where: {
+                version: '0.0.0',
+                OrganizationId: 'appsemble',
+                name: 'test',
+            },
+        });
+        vi.useRealTimers();
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
+        await expect(() => publishApp({
+            path: resolveFixture('apps/test'),
+            organization: organization.id,
+            remote: testApp.defaults.baseURL,
+            clientCredentials,
+            // Required defaults
+            visibility: 'unlisted',
+            iconBackground: '#ffffff',
+        })).rejects.toThrow('is not a known block type');
+        const app = await App.findOne();
+        expect(app).toBeNull();
+    });
 });
 describe('updateApp', () => {
     let app;
@@ -648,7 +818,7 @@ describe('updateApp', () => {
     });
     it('should update app', async () => {
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await updateApp({
             id: app.id,
             path: resolveFixture('apps/test'),
@@ -734,6 +904,7 @@ describe('updateApp', () => {
         "showAppDefinition": false,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": false,
         "visibility": "unlisted",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -774,7 +945,7 @@ describe('updateApp', () => {
     });
     it('should update app with resources and assets', async () => {
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await updateApp({
             id: app.id,
             path: resolveFixture('apps/test'),
@@ -863,6 +1034,7 @@ describe('updateApp', () => {
         "showAppDefinition": false,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": false,
         "visibility": "unlisted",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -929,7 +1101,7 @@ describe('updateApp', () => {
             visibility: 'public',
         });
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await updateApp({
             path: resolveFixture('apps/test'),
             id: app.id,
@@ -1017,6 +1189,7 @@ describe('updateApp', () => {
         "showAppDefinition": false,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": true,
         "visibility": "public",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -1089,7 +1262,7 @@ describe('updateApp', () => {
     });
     it('should update app with app variant patches applied', async () => {
         vi.useRealTimers();
-        const clientCredentials = await authorizeCLI('apps:write resources:write');
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
         await updateApp({
             path: resolveFixture('apps/test'),
             id: app.id,
@@ -1173,6 +1346,7 @@ describe('updateApp', () => {
         "showAppDefinition": false,
         "showAppsembleLogin": false,
         "showAppsembleOAuth2Login": true,
+        "template": false,
         "visibility": "unlisted",
         "yaml": "name: Test App
       defaultPage: Test Page
@@ -1226,6 +1400,375 @@ describe('updateApp', () => {
             await readFixture('apps/test/variants/tux/assets/small-tux.png'),
         ]);
     });
+    it('should update app variables and secrets', async () => {
+        vi.useRealTimers();
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
+        process.env.TEST_VARIABLE_1 = 'test-variable-1';
+        process.env.TEST_VARIABLE_2 = 'test-variable-2';
+        process.env.TEST_SECRET = 'test-secret';
+        process.env.TEST_SERVICE_URL_PATTERNS = 'http://localhost:1234';
+        process.env.TEST_SERVICE_IDENTIFIER = 'Authorization';
+        process.env.TEST_SERVICE_SECRET = 'secret';
+        process.env.TEST_SAML_IDP_CERTIFICATE = 'certificate';
+        process.env.TEST_SAML_ENTITY_ID = 'http://localhost:1234';
+        process.env.TEST_SAML_SSO_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_AUTHORIZATION_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_TOKEN_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_USER_INFO_URL = 'http://localhost:1234';
+        process.env.TEST_OAUTH2_CLIENT_ID = 'id';
+        process.env.TEST_OAUTH2_CLIENT_SECRET = 'secret';
+        process.env.TEST_SCIM_TOKEN = 'token';
+        process.env.TEST_SSL_KEY = 'key';
+        process.env.TEST_SSL_CERTIFICATE = 'certificate';
+        await updateApp({
+            id: 1,
+            path: resolveFixture('apps/test'),
+            remote: testApp.defaults.baseURL,
+            clientCredentials,
+            visibility: 'unlisted',
+            iconBackground: '#ffffff',
+            force: true,
+        });
+        vi.useFakeTimers();
+        const updatedApp = await App.findOne({
+            attributes: ['scimEnabled', 'scimToken', 'sslKey', 'sslCertificate'],
+            where: {
+                id: 1,
+            },
+        });
+        expect({
+            scimEnabled: updatedApp.scimEnabled,
+            scimToken: updatedApp.scimToken,
+            sslKey: updatedApp.sslKey,
+            sslCertificate: updatedApp.sslCertificate,
+        }).toStrictEqual({
+            scimEnabled: true,
+            scimToken: expect.any(Buffer),
+            sslKey: 'key',
+            sslCertificate: 'certificate',
+        });
+        const appVariables = await AppVariable.findAll({
+            attributes: ['name', 'value'],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect(appVariables[0].toJSON()).toStrictEqual({
+            name: 'test-variable-inline',
+            value: 'inline',
+        });
+        expect(appVariables[1].toJSON()).toStrictEqual({
+            name: 'test-variable',
+            value: 'test-variable-1.test-variable-2',
+        });
+        const appServiceSecret = await AppServiceSecret.findOne({
+            attributes: ['name', 'authenticationMethod', 'urlPatterns', 'identifier', 'secret'],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect(appServiceSecret.toJSON()).toStrictEqual({
+            name: 'test-service-secret',
+            authenticationMethod: 'custom-header',
+            urlPatterns: 'http://localhost:1234',
+            identifier: 'Authorization',
+            secret: expect.any(Buffer),
+        });
+        const appSamlSecret = await AppSamlSecret.findOne({
+            attributes: [
+                'name',
+                'icon',
+                'nameAttribute',
+                'emailAttribute',
+                'idpCertificate',
+                'entityId',
+                'ssoUrl',
+            ],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect(appSamlSecret.toJSON()).toStrictEqual({
+            emailAttribute: 'email',
+            entityId: 'http://localhost:1234',
+            icon: 'redhat',
+            id: 1,
+            idpCertificate: 'certificate',
+            name: 'test-saml-secret',
+            nameAttribute: 'name',
+            ssoUrl: 'http://localhost:1234',
+            spCertificate: expect.any(String),
+        });
+        const appOauth2Secret = await AppOAuth2Secret.findOne({
+            attributes: [
+                'name',
+                'icon',
+                'scope',
+                'remapper',
+                'authorizationUrl',
+                'tokenUrl',
+                'userInfoUrl',
+                'clientId',
+                'clientSecret',
+            ],
+            where: {
+                AppId: 1,
+            },
+        });
+        expect({
+            authorizationUrl: appOauth2Secret.authorizationUrl,
+            clientId: appOauth2Secret.clientId,
+            clientSecret: appOauth2Secret.clientSecret,
+            icon: appOauth2Secret.icon,
+            name: appOauth2Secret.name,
+            remapper: appOauth2Secret.remapper,
+            scope: appOauth2Secret.scope,
+            tokenUrl: appOauth2Secret.tokenUrl,
+            userInfoUrl: appOauth2Secret.userInfoUrl,
+        }).toStrictEqual({
+            authorizationUrl: 'http://localhost:1234',
+            clientId: 'id',
+            clientSecret: 'secret',
+            icon: 'redhat',
+            name: 'test-oauth2-secret',
+            remapper: [{ prop: 'email' }],
+            scope: 'email openid profile',
+            tokenUrl: 'http://localhost:1234',
+            userInfoUrl: 'http://localhost:1234',
+        });
+    });
+    it('should update an app with `app.locked` set to `fullLock` if force is specified', async () => {
+        await app.update({ locked: 'fullLock' });
+        const clientCredentials = await authorizeCLI('apps:write', testApp);
+        await updateApp({
+            path: resolveFixture('apps/test'),
+            force: true,
+            remote: testApp.defaults.baseURL,
+            id: app.id,
+            clientCredentials,
+            visibility: 'public',
+            iconBackground: '#fff999',
+        });
+        await app.reload();
+        expect(app).toMatchInlineSnapshot(`
+      {
+        "$created": "1970-01-01T00:00:00.000Z",
+        "$updated": "1970-01-01T00:00:00.000Z",
+        "OrganizationId": "testorganization",
+        "OrganizationName": undefined,
+        "controllerCode": null,
+        "controllerImplementations": null,
+        "coreStyle": ".tux {
+        color: rgb(0 0 0);
+      }
+      ",
+        "definition": {
+          "defaultPage": "Test Page",
+          "name": "Test App",
+          "pages": [
+            {
+              "blocks": [
+                {
+                  "type": "test",
+                  "version": "0.0.0",
+                },
+              ],
+              "name": "Test Page",
+            },
+          ],
+          "resources": {
+            "test": {
+              "schema": {
+                "additionalProperties": false,
+                "properties": {
+                  "test": {
+                    "format": "binary",
+                    "type": "string",
+                  },
+                },
+                "type": "object",
+              },
+            },
+          },
+        },
+        "demoMode": false,
+        "domain": null,
+        "emailName": null,
+        "enableSelfRegistration": true,
+        "enableUnsecuredServiceSecrets": false,
+        "googleAnalyticsID": null,
+        "hasClonableAssets": undefined,
+        "hasClonableResources": undefined,
+        "hasIcon": true,
+        "hasMaskableIcon": true,
+        "iconBackground": "#fff999",
+        "iconUrl": "/api/apps/1/icon?maskable=true&updated=1970-01-01T00%3A00%3A00.000Z",
+        "id": 1,
+        "locked": "fullLock",
+        "messages": undefined,
+        "path": "test-app",
+        "rating": undefined,
+        "readmeUrl": undefined,
+        "screenshotUrls": undefined,
+        "sentryDsn": null,
+        "sentryEnvironment": null,
+        "sharedStyle": ".tux {
+        color: rgb(0 0 0);
+      }
+      ",
+        "showAppDefinition": false,
+        "showAppsembleLogin": false,
+        "showAppsembleOAuth2Login": true,
+        "template": false,
+        "visibility": "public",
+        "yaml": "name: Test App
+      defaultPage: Test Page
+      resources:
+        test:
+          schema:
+            additionalProperties: false
+            type: object
+            properties:
+              test:
+                type: string
+                format: binary
+      pages:
+        - name: Test Page
+          blocks:
+            - type: test
+              version: 0.0.0
+      ",
+      }
+    `);
+    });
+    it('should not update an app if the `app.locked` is set to `fullLock`', async () => {
+        await app.update({ locked: 'fullLock' });
+        const clientCredentials = await authorizeCLI('apps:write', testApp);
+        await expect(updateApp({
+            path: resolveFixture('apps/test'),
+            force: false,
+            remote: testApp.defaults.baseURL,
+            id: app.id,
+            clientCredentials,
+            visibility: 'public',
+            iconBackground: '#fff999',
+        })).rejects.toThrow('Request failed with status code 403');
+        await app.reload();
+        expect(app).toMatchInlineSnapshot(`
+      {
+        "$created": "1970-01-01T00:00:00.000Z",
+        "$updated": "1970-01-01T00:00:00.000Z",
+        "OrganizationId": "testorganization",
+        "OrganizationName": undefined,
+        "controllerCode": null,
+        "controllerImplementations": null,
+        "coreStyle": undefined,
+        "definition": {
+          "defaultPage": "Test Page",
+          "name": "Test App",
+        },
+        "demoMode": false,
+        "domain": null,
+        "emailName": null,
+        "enableSelfRegistration": true,
+        "enableUnsecuredServiceSecrets": false,
+        "googleAnalyticsID": null,
+        "hasClonableAssets": undefined,
+        "hasClonableResources": undefined,
+        "hasIcon": false,
+        "hasMaskableIcon": false,
+        "iconBackground": "#ffffff",
+        "iconUrl": null,
+        "id": 1,
+        "locked": "fullLock",
+        "messages": undefined,
+        "path": "test-app",
+        "rating": undefined,
+        "readmeUrl": undefined,
+        "screenshotUrls": undefined,
+        "sentryDsn": null,
+        "sentryEnvironment": null,
+        "sharedStyle": undefined,
+        "showAppDefinition": false,
+        "showAppsembleLogin": false,
+        "showAppsembleOAuth2Login": true,
+        "template": false,
+        "visibility": "public",
+        "yaml": "name: Test App
+      defaultPage: Test Page
+      ",
+      }
+    `);
+    });
+    it('should validate and throw if there’s an error before updating an app', async () => {
+        await BlockVersion.destroy({
+            where: {
+                version: '0.0.0',
+                OrganizationId: 'appsemble',
+                name: 'test',
+            },
+        });
+        vi.useRealTimers();
+        const clientCredentials = await authorizeCLI('apps:write resources:write', testApp);
+        await expect(updateApp({
+            path: resolveFixture('apps/test'),
+            id: app.id,
+            force: false,
+            remote: testApp.defaults.baseURL,
+            clientCredentials,
+            // Required defaults
+            visibility: 'unlisted',
+            iconBackground: '#ffffff',
+        })).rejects.toThrow('is not a known block type');
+        vi.useFakeTimers();
+        await app.reload();
+        expect(app.dataValues).toMatchInlineSnapshot(`
+      {
+        "OrganizationId": "testorganization",
+        "controllerCode": null,
+        "controllerImplementations": null,
+        "coreStyle": null,
+        "created": 1970-01-01T00:00:00.000Z,
+        "definition": {
+          "defaultPage": "Test Page",
+          "name": "Test App",
+        },
+        "deleted": null,
+        "demoMode": false,
+        "domain": null,
+        "emailHost": null,
+        "emailName": null,
+        "emailPassword": null,
+        "emailPort": 587,
+        "emailSecure": true,
+        "emailUser": null,
+        "enableSelfRegistration": true,
+        "enableUnsecuredServiceSecrets": false,
+        "googleAnalyticsID": null,
+        "icon": null,
+        "iconBackground": null,
+        "id": 1,
+        "locked": "unlocked",
+        "maskableIcon": null,
+        "path": "test-app",
+        "scimEnabled": false,
+        "scimToken": null,
+        "sentryDsn": null,
+        "sentryEnvironment": null,
+        "sharedStyle": null,
+        "showAppDefinition": false,
+        "showAppsembleLogin": false,
+        "showAppsembleOAuth2Login": true,
+        "sslCertificate": null,
+        "sslKey": null,
+        "template": false,
+        "updated": 1970-01-01T00:00:00.000Z,
+        "vapidPrivateKey": "b",
+        "vapidPublicKey": "a",
+        "visibility": "public",
+      }
+    `);
+    });
 });
 describe('patchApp', () => {
     it('should apply patches to app', async () => {
@@ -1249,7 +1792,7 @@ describe('patchApp', () => {
             visibility: 'public',
             OrganizationId: organization.id,
         }, { raw: true });
-        await authorizeCLI('apps:write');
+        await authorizeCLI('apps:write', testApp);
         await patchApp({
             ...patches,
             remote: testApp.defaults.baseURL,
@@ -1336,7 +1879,7 @@ describe('patchApp', () => {
             OrganizationId: organization.id,
             [key]: from,
         }, { raw: true });
-        await authorizeCLI('apps:write');
+        await authorizeCLI('apps:write', testApp);
         await patchApp({
             [key]: to,
             remote: testApp.defaults.baseURL,
@@ -1346,5 +1889,207 @@ describe('patchApp', () => {
         await app.reload();
         expect(app.dataValues[key]).toStrictEqual(to);
     });
+    it('should not apply a patch if the `app.locked` is set to `fullLock`', async () => {
+        const app = await App.create({
+            path: 'test-app',
+            definition: { name: 'Test App', defaultPage: 'Test Page' },
+            vapidPublicKey: 'a',
+            vapidPrivateKey: 'b',
+            visibility: 'public',
+            OrganizationId: organization.id,
+            locked: 'fullLock',
+            showAppDefinition: false,
+        }, { raw: true });
+        await authorizeCLI('apps:write', testApp);
+        await patchApp({
+            remote: testApp.defaults.baseURL,
+            id: app.id,
+            showAppDefinition: true,
+        });
+        expect(app.dataValues.showAppDefinition).toBe(false);
+        await app.reload();
+        expect(app.dataValues.showAppDefinition).toBe(false);
+    });
+    it('should apply a patch if the `app.locked` is set to `fullLock` and `force` is specified', async () => {
+        const app = await App.create({
+            path: 'test-app',
+            definition: { name: 'Test App', defaultPage: 'Test Page' },
+            vapidPublicKey: 'a',
+            vapidPrivateKey: 'b',
+            visibility: 'public',
+            OrganizationId: organization.id,
+            locked: 'fullLock',
+            showAppDefinition: false,
+        }, { raw: true });
+        await authorizeCLI('apps:write', testApp);
+        await patchApp({
+            remote: testApp.defaults.baseURL,
+            id: app.id,
+            showAppDefinition: true,
+            force: true,
+        });
+        expect(app.dataValues.showAppDefinition).toBe(false);
+        await app.reload();
+        expect(app.dataValues.showAppDefinition).toBe(true);
+    });
+});
+describe('traverseAppDirectory', () => {
+    it('should read the app definition and appsembleRC from the directory', async () => {
+        const formData = new FormData();
+        const [appsembleContext, appsembleRC, yaml, app] = await traverseAppDirectory(resolveFixture('apps/test'), 'test', formData);
+        expect(appsembleContext).toMatchInlineSnapshot({
+            icon: expect.any(String),
+            maskableIcon: expect.any(String),
+        }, `
+      {
+        "appLock": "studioLock",
+        "assets": true,
+        "assetsClonable": true,
+        "collections": [
+          1,
+        ],
+        "demoMode": true,
+        "googleAnalyticsId": "test",
+        "icon": Any<String>,
+        "iconBackground": "#000000",
+        "id": 1,
+        "maskableIcon": Any<String>,
+        "organization": "testorganization",
+        "resources": true,
+        "sentryDsn": "https://public@sentry.example.com/1",
+        "sentryEnvironment": "test",
+        "showAppDefinition": true,
+        "template": true,
+        "visibility": "public",
+      }
+    `);
+        expect(appsembleRC).toMatchInlineSnapshot({
+            context: {
+                test: {
+                    icon: expect.any(String),
+                    maskableIcon: expect.any(String),
+                },
+            },
+        }, `
+      {
+        "context": {
+          "test": {
+            "appLock": "studioLock",
+            "assets": true,
+            "assetsClonable": true,
+            "collections": [
+              1,
+            ],
+            "demoMode": true,
+            "googleAnalyticsId": "test",
+            "icon": Any<String>,
+            "iconBackground": "#000000",
+            "id": 1,
+            "maskableIcon": Any<String>,
+            "organization": "testorganization",
+            "resources": true,
+            "sentryDsn": "https://public@sentry.example.com/1",
+            "sentryEnvironment": "test",
+            "showAppDefinition": true,
+            "template": true,
+            "visibility": "public",
+          },
+        },
+      }
+    `);
+        expect(yaml).toMatchInlineSnapshot(`
+      "name: Test App
+      defaultPage: Test Page
+
+      resources:
+        test:
+          schema:
+            additionalProperties: false
+            type: object
+            properties:
+              test:
+                type: string
+                format: binary
+
+      pages:
+        - name: Test Page
+          blocks:
+            - type: test
+              version: 0.0.0
+      "
+    `);
+        expect(app).toMatchInlineSnapshot({
+            iconUrl: expect.any(String),
+        }, `
+      {
+        "coreStyle": ".tux {
+        color: rgb(0 0 0);
+      }
+      ",
+        "definition": {
+          "defaultPage": "Test Page",
+          "name": "Test App",
+          "pages": [
+            {
+              "blocks": [
+                {
+                  "type": "test",
+                  "version": "0.0.0",
+                },
+              ],
+              "name": "Test Page",
+            },
+          ],
+          "resources": {
+            "test": {
+              "schema": {
+                "additionalProperties": false,
+                "properties": {
+                  "test": {
+                    "format": "binary",
+                    "type": "string",
+                  },
+                },
+                "type": "object",
+              },
+            },
+          },
+        },
+        "iconUrl": Any<String>,
+        "readmeUrl": "README.md",
+        "screenshotUrls": [
+          "test_en-us.png",
+        ],
+        "sharedStyle": ".tux {
+        color: rgb(0 0 0);
+      }
+      ",
+      }
+    `);
+    });
+    it('should return an error if no app-definition is found in the given directory', async () => {
+        const formData = new FormData();
+        await expect(() => traverseAppDirectory(resolveFixture('apps/empty'), null, formData)).rejects.toThrow('No app definition found');
+    });
+});
+describe('deleteApp', () => {
+    it('should throw if an error occurs', async () => {
+        const clientCredentials = await authorizeCLI('apps:delete', testApp);
+        await expect(() => deleteApp({ id: 1, remote: testApp.defaults.baseURL, clientCredentials })).rejects.toThrow('Request failed with status code 404');
+    });
+    it('should delete an app', async () => {
+        const app = await App.create({
+            path: 'test-app',
+            definition: { name: 'Test App', defaultPage: 'Test Page' },
+            vapidPublicKey: 'a',
+            vapidPrivateKey: 'b',
+            visibility: 'public',
+            OrganizationId: organization.id,
+        });
+        const clientCredentials = await authorizeCLI('apps:delete', testApp);
+        await deleteApp({ id: app.id, remote: testApp.defaults.baseURL, clientCredentials });
+        const foundApps = await App.findAll();
+        expect(foundApps).toStrictEqual([]);
+    });
 });
 //# sourceMappingURL=app.test.js.map