@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/src/modules/access/__tests__/access.routes.proposal-branch.test.ts

@@ -0,0 +1,234 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import express from 'express';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { NodeFs } from '../../kb-fs/node-fs.js';
+
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { AuthService } from '../../auth/auth.service.js';
+import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import { usersDbDouble } from './users-db-double.js';
+import { AccessControlService } from '../access-control.service.js';
+import { createAccessRoutes } from '../access.routes.js';
+import { branchForWorkspaceId, workspaceIdForBranch } from '../../../shared/workspace-id.js';
+
+/**
+ * Manage access on a file that exists ONLY on a change request's branch.
+ *
+ * The share dialog addresses such a file through the proposal branch's
+ * workspace. These tests run the real routes, the real resolver and the real
+ * splice against real git clones, and check what matters to the user: the
+ * grant is a commit on the proposal branch that shows up in the request's
+ * diff, it takes effect on the default branch by merging alone, the gate is
+ * the one every mutation uses (evaluated on the proposal branch), and revoke
+ * is symmetric.
+ */
+
+const KB = 'knowledge-base';
+const MAIN = 'main';
+const PROPOSAL = 'suggestions/alice/knowledge';
+const NEW_FILE = 'Sales/New.md';
+
+const USERS = {
+  alice: { id: 'u-alice', email: 'alice@bevel.software', name: 'Alice' },
+  carol: { id: 'u-carol', email: 'carol@bevel.software', name: 'Carol' },
+};
+const BOB = { kind: 'user' as const, email: 'bob@bevel.software', displayName: 'Bob' };
+
+function git(cwd: string, ...args: string[]): string {
+  return execFileSync(
+    'git',
+    ['-c', 'user.name=Test', '-c', 'user.email=test@bevel.software', '-c', 'commit.gpgsign=false', ...args],
+    { cwd, encoding: 'utf-8' },
+  );
+}
+
+async function write(repo: string, rel: string, contents: string): Promise<void> {
+  const abs = path.join(repo, rel);
+  await fs.mkdir(path.dirname(abs), { recursive: true });
+  await fs.writeFile(abs, contents);
+}
+
+describe('access routes on a proposal branch (real git)', () => {
+  let root: string;
+  let mainRepo: string;
+  let proposalRepo: string;
+  let access: AccessControlService;
+  let server: Server;
+  let baseUrl: string;
+  const releaseLock = vi.fn();
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-proposal-access-'));
+    const dirFor = (branch: string) => path.join(root, workspaceIdForBranch(branch));
+
+    // The default branch: Alice writes Sales; nobody else does.
+    mainRepo = path.join(dirFor(MAIN), KB);
+    await fs.mkdir(mainRepo, { recursive: true });
+    git(mainRepo, 'init', '-q', '-b', MAIN);
+    await write(mainRepo, 'roles.yaml', 'roles:\n  Admin:\n    - razvan@bevel.software\n');
+    await write(mainRepo, 'access.md', '---\nwrite:\n  - Admin\n---\n# Root\n');
+    await write(mainRepo, 'Sales/access.md', '---\nwrite:\n  - Alice <alice@bevel.software>\n---\n# Sales\n');
+    git(mainRepo, 'add', '-A');
+    git(mainRepo, 'commit', '-q', '-m', 'base');
+
+    // Alice's change request ADDS a file that the default branch lacks.
+    git(mainRepo, 'checkout', '-q', '-b', PROPOSAL);
+    await write(mainRepo, NEW_FILE, '# New\n\nProposed page.\n');
+    git(mainRepo, 'add', '-A');
+    git(mainRepo, 'commit', '-q', '-m', 'propose New.md');
+    git(mainRepo, 'checkout', '-q', MAIN);
+
+    // One clone per branch, as the workspace service keeps them.
+    proposalRepo = path.join(dirFor(PROPOSAL), KB);
+    git(mainRepo, 'worktree', 'add', '-q', proposalRepo, PROPOSAL);
+
+    // Ids arrive decoded from the URL; normalise the way the service does.
+    const dirOf = (id: string) => dirFor(branchForWorkspaceId(id));
+    const workspaceService = {
+      getWorkspacePath: async (id: string) => dirOf(id),
+      withPathTurn: async (_id: string, _p: string, op: () => Promise<unknown>) => op(),
+      getOrCreateForBranch: async (branch: string) => ({ id: workspaceIdForBranch(branch), kbDirName: KB }),
+      readFile: async (id: string, wsRel: string) => fs.readFile(path.join(dirOf(id), wsRel), 'utf-8'),
+      readFileBinary: async (id: string, wsRel: string) => fs.readFile(path.join(dirOf(id), wsRel)),
+      writeFile: async (id: string, wsRel: string, content: string) => {
+        await fs.writeFile(path.join(dirOf(id), wsRel), content, 'utf-8');
+      },
+    } as unknown as WorkspaceService;
+
+    access = new AccessControlService(workspaceService, KB, new NodeFs());
+
+    const authService = {
+      getUserById: async (id: string) => Object.values(USERS).find((u) => u.id === id) ?? null,
+    } as unknown as AuthService;
+
+    // Releasing the edit lock is what commits the write — here, synchronously.
+    releaseLock.mockReset();
+    releaseLock.mockImplementation(async (id: string, branch: string, wsPath: string) => {
+      const repo = path.join(dirOf(id), KB);
+      git(repo, 'add', '-A');
+      git(repo, 'commit', '-q', '-m', `access: ${wsPath} on ${branch}`);
+    });
+    const workflowService = {
+      getLock: async () => null,
+      acquireLock: async () => ({ acquired: true, lock: {} }),
+      releaseLock,
+      releaseLockNoCommit: async () => undefined,
+    } as unknown as WorkflowService;
+
+    const app = express();
+    app.use(express.json());
+    app.use('/api', (req, _res, next) => {
+      (req as unknown as { userId: string }).userId = String(req.headers['x-test-user']);
+      next();
+    });
+    app.use(
+      '/api',
+      createAccessRoutes(
+        access,
+        workspaceService,
+        authService,
+        workflowService,
+        { emit: () => {} } as unknown as WorkflowEventBus,
+        usersDbDouble(),
+        KB,
+      ),
+    );
+    server = await new Promise<Server>((resolve) => {
+      const s = app.listen(0, () => resolve(s));
+    });
+    baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+  });
+
+  afterEach(async () => {
+    // A setup failure leaves no server; closing it anyway would mask that
+    // failure and skip removing the temp dir.
+    if (server) await new Promise<void>((resolve) => server.close(() => resolve()));
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  /** Exactly the URL the share dialog builds: the raw workspace id in the path. */
+  function post(route: 'grant' | 'revoke', as: keyof typeof USERS, body: Record<string, unknown>) {
+    return fetch(`${baseUrl}/api/workspace/${workspaceIdForBranch(PROPOSAL)}/access/${route}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'x-test-user': USERS[as].id },
+      body: JSON.stringify({ path: `${KB}/${NEW_FILE}`, kind: 'file', principal: BOB, ...body }),
+    });
+  }
+
+  const requestDiff = () => git(mainRepo, 'diff', `${MAIN}...${PROPOSAL}`, '--', NEW_FILE);
+
+  it('reads current access from the proposal branch', async () => {
+    const res = await fetch(
+      `${baseUrl}/api/workspace/${workspaceIdForBranch(PROPOSAL)}/access?path=${encodeURIComponent(`${KB}/${NEW_FILE}`)}&kind=file`,
+      { headers: { 'x-test-user': USERS.alice.id } },
+    );
+    expect(res.status).toBe(200);
+    const view = (await res.json()) as { canWrite: boolean };
+    // The author writes the proposed file there (inherited from Sales).
+    expect(view.canWrite).toBe(true);
+  });
+
+  it('lands the grant in the proposed file, visible in the request diff, and effective on merge', async () => {
+    const res = await post('grant', 'alice', { verb: 'write' });
+    expect(res.status).toBe(200);
+    // The id reaches the route decoded (Express decodes params); what matters
+    // is that the commit is released on the proposal branch.
+    expect(releaseLock).toHaveBeenCalledWith(
+      expect.any(String),
+      PROPOSAL,
+      `${KB}/${NEW_FILE}`,
+      expect.anything(),
+    );
+
+    // Written into the proposed file on its branch — and nowhere on main.
+    expect(await fs.readFile(path.join(proposalRepo, NEW_FILE), 'utf-8')).toContain('bob@bevel.software');
+    await expect(fs.access(path.join(mainRepo, NEW_FILE))).rejects.toThrow();
+    expect(git(mainRepo, 'status', '--porcelain')).toBe('');
+    expect(requestDiff()).toMatch(/^\+.*bob@bevel\.software/m);
+
+    // Merge the request: Bob holds exactly what was granted on main.
+    git(mainRepo, 'merge', '-q', '--no-edit', PROPOSAL);
+    access.invalidate(workspaceIdForBranch(MAIN));
+    const mainWs = workspaceIdForBranch(MAIN);
+    expect(await access.canWrite(mainWs, BOB.email, NEW_FILE)).toBe(true);
+    expect(await access.canRead(mainWs, BOB.email, NEW_FILE)).toBe(true);
+    expect(await access.canOwner(mainWs, BOB.email, NEW_FILE)).toBe(false);
+    expect(await access.canDownload(mainWs, BOB.email, NEW_FILE)).toBe(false);
+    // Only the new file carries the grant.
+    expect(await access.canWrite(mainWs, BOB.email, 'Sales/access.md')).toBe(false);
+  });
+
+  it('refuses a caller who fails the mutation gate on the proposal branch — nothing written', async () => {
+    const before = git(proposalRepo, 'rev-parse', 'HEAD');
+    const res = await post('grant', 'carol', { verb: 'write' });
+
+    expect(res.status).toBe(403);
+    expect(releaseLock).not.toHaveBeenCalled();
+    expect(git(proposalRepo, 'rev-parse', 'HEAD')).toBe(before);
+    expect(await fs.readFile(path.join(proposalRepo, NEW_FILE), 'utf-8')).not.toContain('bob@');
+  });
+
+  it('revokes symmetrically on the proposal branch', async () => {
+    expect((await post('grant', 'alice', { verb: 'write' })).status).toBe(200);
+    expect(requestDiff()).toContain('bob@bevel.software');
+
+    const res = await post('revoke', 'alice', {});
+    expect(res.status).toBe(200);
+    expect(releaseLock).toHaveBeenCalledTimes(2);
+    expect(await fs.readFile(path.join(proposalRepo, NEW_FILE), 'utf-8')).not.toContain('bob@');
+    expect(requestDiff()).not.toContain('bob@bevel.software');
+  });
+
+  it('refuses a revoke from a caller who fails the gate', async () => {
+    expect((await post('grant', 'alice', { verb: 'write' })).status).toBe(200);
+    const res = await post('revoke', 'carol', {});
+    expect(res.status).toBe(403);
+    expect(await fs.readFile(path.join(proposalRepo, NEW_FILE), 'utf-8')).toContain('bob@bevel.software');
+  });
+});

package/src/modules/access/__tests__/access.routes.prospective.test.ts

@@ -0,0 +1,216 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import express from 'express';
+import { describe, it, expect, afterEach, vi } from 'vitest';
+
+import type { IAccessControl, ProspectiveHolders } from '../access-control.interface.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { AuthService } from '../../auth/auth.service.js';
+import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { Database } from '../../database/connection.js';
+import { createAccessRoutes } from '../access.routes.js';
+import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+
+/**
+ * HTTP contract for `GET /access/prospective` — what the move confirmation
+ * asks so it can name who loses and who gains access. The route's own job is
+ * to derive the destination PATH from the destination FOLDER, gate on read of
+ * the file being moved, and flatten the resolver's holder lists into named
+ * principals. The resolution itself is the service's.
+ */
+
+const USER = { id: 'u-1', email: 'alice@bevel.software', name: 'Alice' };
+const WS = 'main';
+const KB = 'knowledge-base';
+
+/** Engineering reads and writes Legal; Product reads Sales, and Ali is on it by name. */
+const HOLDERS: ProspectiveHolders = {
+  before: {
+    read: { principals: [{ name: 'Engineering', kind: 'group' }], roles: ['Engineering'], users: [] },
+    write: { principals: [{ name: 'Engineering', kind: 'group' }], roles: ['Engineering'], users: [] },
+  },
+  after: {
+    read: {
+      principals: [{ name: 'Product', kind: 'group' }],
+      roles: ['Product'],
+      users: [{ name: 'Ali Raza', email: 'ali@bevel.software' }],
+    },
+    write: { principals: [], roles: [], users: [] },
+  },
+};
+
+interface Harness {
+  server: Server;
+  baseUrl: string;
+  canRead: ReturnType<typeof vi.fn>;
+  prospectiveHolders: ReturnType<typeof vi.fn>;
+}
+
+async function makeHarness(opts: { canRead?: boolean } = {}): Promise<Harness> {
+  const canRead = vi.fn(async () => opts.canRead ?? true);
+  const prospectiveHolders = vi.fn(async () => HOLDERS);
+  const accessControl = { canRead, prospectiveHolders } as unknown as IAccessControl;
+
+  const app = express();
+  app.use(express.json());
+  app.use('/api', (req, _res, next) => {
+    (req as unknown as { userId: string }).userId = USER.id;
+    next();
+  });
+  app.use(
+    '/api',
+    createAccessRoutes(
+      accessControl,
+      {} as unknown as WorkspaceService,
+      { getUserById: vi.fn(async () => USER) } as unknown as AuthService,
+      {} as unknown as WorkflowService,
+      { emit: vi.fn() } as unknown as WorkflowEventBus,
+      {} as unknown as Database,
+      KB,
+    ),
+  );
+
+  const server = await new Promise<Server>((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  const addr = server.address() as AddressInfo;
+  return { server, baseUrl: `http://127.0.0.1:${addr.port}`, canRead, prospectiveHolders };
+}
+
+function close(s: Server): Promise<void> {
+  return new Promise((resolve, reject) => s.close((e) => (e ? reject(e) : resolve())));
+}
+
+describe('GET /access/prospective', () => {
+  let h: Harness | null = null;
+  afterEach(async () => {
+    if (h) await close(h.server);
+    h = null;
+  });
+
+  const get = (query: string) =>
+    fetch(`${h!.baseUrl}/api/workspace/${encodeURIComponent(WS)}/access/prospective?${query}`);
+
+  it('resolves the file where it is and where the destination folder would put it', async () => {
+    h = await makeHarness();
+
+    const res = await get(
+      `from=${encodeURIComponent('Knowledge/Legal/contract.md')}&toDir=${encodeURIComponent('Knowledge/Sales')}`,
+    );
+
+    expect(res.status).toBe(200);
+    // The destination PATH is the route's own derivation — the file keeps its
+    // name, so the caller never gets to name the path it resolves against.
+    expect(h.prospectiveHolders).toHaveBeenCalledWith(
+      WS,
+      'Knowledge/Legal/contract.md',
+      'Knowledge/Sales/contract.md',
+    );
+    expect(await res.json()).toEqual({
+      before: {
+        read: [{ kind: 'group', name: 'Engineering' }],
+        write: [{ kind: 'group', name: 'Engineering' }],
+      },
+      after: {
+        read: [
+          { kind: 'group', name: 'Product' },
+          { kind: 'person', name: 'Ali Raza', email: 'ali@bevel.software' },
+        ],
+        write: [],
+      },
+    });
+  });
+
+  it('strips the workspace-relative kb prefix from both ends', async () => {
+    h = await makeHarness();
+
+    await get(
+      `from=${encodeURIComponent(`${KB}/Knowledge/Legal/contract.md`)}&toDir=${encodeURIComponent(`${KB}/Knowledge/Sales`)}`,
+    );
+
+    expect(h.prospectiveHolders).toHaveBeenCalledWith(
+      WS,
+      'Knowledge/Legal/contract.md',
+      'Knowledge/Sales/contract.md',
+    );
+  });
+
+  it('treats an empty destination as the repo root, not a missing parameter', async () => {
+    h = await makeHarness();
+
+    const res = await get(`from=${encodeURIComponent('Knowledge/Legal/contract.md')}&toDir=`);
+
+    expect(res.status).toBe(200);
+    expect(h.prospectiveHolders).toHaveBeenCalledWith(WS, 'Knowledge/Legal/contract.md', 'contract.md');
+  });
+
+  it('refuses a caller who cannot read the file being moved, resolving nothing', async () => {
+    h = await makeHarness({ canRead: false });
+
+    const res = await get(`from=${encodeURIComponent('Knowledge/Legal/contract.md')}&toDir=Knowledge`);
+
+    expect(res.status).toBe(403);
+    expect(h.prospectiveHolders).not.toHaveBeenCalled();
+  });
+
+  it('400s a missing `from` or `toDir`', async () => {
+    h = await makeHarness();
+
+    expect((await get('toDir=Knowledge')).status).toBe(400);
+    expect((await get('from=&toDir=Knowledge')).status).toBe(400);
+    expect((await get(`from=${encodeURIComponent('Knowledge/a.md')}`)).status).toBe(400);
+    expect(h.prospectiveHolders).not.toHaveBeenCalled();
+  });
+
+  it('refuses a path that would escape the KB repo', async () => {
+    h = await makeHarness();
+
+    for (const query of [
+      `from=${encodeURIComponent('../secrets.md')}&toDir=Knowledge`,
+      `from=${encodeURIComponent('Knowledge/a.md')}&toDir=${encodeURIComponent('../elsewhere')}`,
+      `from=${encodeURIComponent('/etc/passwd')}&toDir=Knowledge`,
+    ]) {
+      expect((await get(query)).status).toBe(400);
+    }
+    expect(h.prospectiveHolders).not.toHaveBeenCalled();
+  });
+
+  it('answers a failed resolver with a clean 500 and no internals', async () => {
+    h = await makeHarness();
+    h.prospectiveHolders.mockRejectedValueOnce(new Error('resolver exploded reading /srv/kb/roles.yaml'));
+
+    const res = await get(`from=${encodeURIComponent('Knowledge/a.md')}&toDir=Knowledge`);
+
+    // The dialog's fallback — the one-sentence form plus "Couldn't work out
+    // the access change." with Move still enabled — rests on the request
+    // FINISHING when the resolver fails. A handler that threw past its catch
+    // would hang the fetch until the 2s budget instead, and a raw message
+    // would leak a server path to a caller who asked about one file.
+    expect(res.status).toBe(500);
+    expect(await res.json()).toEqual({ error: 'Internal error.' });
+  });
+
+  it('refuses a folder source the way the resolver does, without guessing', async () => {
+    h = await makeHarness();
+    h.prospectiveHolders.mockRejectedValueOnce(
+      new WorkflowDomainError('prospective access answers for a file, not a folder', 400),
+    );
+
+    const res = await get(`from=${encodeURIComponent('Knowledge/Legal')}&toDir=Knowledge`);
+
+    expect(res.status).toBe(400);
+  });
+
+  it('falls back to the name-only roles list when the resolver omits kinds', async () => {
+    h = await makeHarness();
+    h.prospectiveHolders.mockResolvedValueOnce({
+      before: { read: { roles: ['Engineering'], users: [] }, write: { roles: [], users: [] } },
+      after: { read: { roles: [], users: [] }, write: { roles: [], users: [] } },
+    });
+
+    const res = await get(`from=${encodeURIComponent('Knowledge/a.md')}&toDir=Knowledge`);
+
+    expect((await res.json()).before.read).toEqual([{ kind: 'role', name: 'Engineering' }]);
+  });
+});

package/src/modules/access/__tests__/access.routes.revoke.test.ts

@@ -8,8 +8,8 @@ import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { AuthService } from '../../auth/auth.service.js';
 import type { WorkflowService } from '../../workflow/workflow.service.js';
 import type { WorkflowEventBus } from '../../workflow/event-bus.js';
-import type { Database } from '../../database/connection.js';
 import { createAccessRoutes } from '../access.routes.js';
+import { usersDbDouble } from './users-db-double.js';
 
 /**
  * HTTP-level contract tests for the revoke route's CLASSIFICATION + MODE logic —
@@ -86,12 +86,14 @@ async function makeHarness(opts: {
     canDownload: vi.fn(async (_w: string, email: string) => effEmail(email, false)),
     canOwner: vi.fn(async (_w: string, email: string) => effEmail(email, false)),
     eligibleWriters: vi.fn(async () => opts.eligibleWriters ?? { roles: [], users: [] }),
+    holdsAdminRootWrite: vi.fn(async () => false),
     eligibleReaders: vi.fn(async () => ({ restricted: true, roles: [], users: [] })),
     eligibleOwners: vi.fn(async () => ({ roles: [], users: [] })),
     eligibleDownloaders: vi.fn(async () => ({ roles: [], users: [] })),
   } as unknown as IAccessControl;
 
   const workspaceService = {
+    withPathTurn: async (_id: string, _p: string, op: () => Promise<unknown>) => op(),
     getOrCreateForBranch: vi.fn(async () => ({ id: WS, name: WS, kbDirName: KB })),
     readFile: vi.fn(async (_id: string, wsRel: string) => {
       const v = files.get(wsRel);
@@ -102,6 +104,9 @@ async function makeHarness(opts: {
       }
       return v;
     }),
+    readFileBinary: vi.fn(async (_id: string, wsRel: string) =>
+      Buffer.from(await (workspaceService.readFile as (id: string, p: string) => Promise<string>)(_id, wsRel), 'utf-8'),
+    ),
     writeFile: vi.fn(async (_id: string, wsRel: string, content: string) => {
       files.set(wsRel, content);
     }),
@@ -120,7 +125,7 @@ async function makeHarness(opts: {
   } as unknown as WorkflowService;
 
   const eventBus = { emit: vi.fn() } as unknown as WorkflowEventBus;
-  const db = {} as unknown as Database;
+  const db = usersDbDouble();
 
   const app = express();
   app.use(express.json());