@ftisindia/create-app 0.1.4 → 0.1.6

package/template/src/modules/settings/types/setting-definitions.ts

@@ -35,6 +35,66 @@ export const settingDefinitions = {
     defaultValue: '',
     parse: parseOptionalUrl,
   },
+  // Form builder (@ftisindia/form-builder) — org-variable policy lives here so
+  // it is typed, validated, and audited like every other org setting.
+  'forms.allowedDangerousActions': {
+    defaultValue: [],
+    parse: parseStringArray('forms.allowedDangerousActions', 50),
+  },
+  'forms.maxFileSizeMb': {
+    defaultValue: 10,
+    parse: parsePositiveInt('forms.maxFileSizeMb', 1024),
+  },
+  'forms.enableRuleIteration': {
+    defaultValue: false,
+    parse: parseBoolean,
+  },
+  'forms.virusScanRequired': {
+    defaultValue: false,
+    parse: parseBoolean,
+  },
+  'forms.maxSubmissionsPerIpPerDay': {
+    defaultValue: 50,
+    parse: parsePositiveInt('forms.maxSubmissionsPerIpPerDay', 100000),
+  },
+  // SSRF gate for definition webhooks: empty list = webhooks disabled until
+  // an admin explicitly allows destination hosts (changes are audited).
+  'forms.webhookAllowedHosts': {
+    defaultValue: [],
+    parse: parseStringArray('forms.webhookAllowedHosts', 50),
+  },
+  // Report builder (@ftisindia/report-builder) — runtime budgets and caps
+  // (report design §5.2/§8/§9). Typed, validated, audited like every setting.
+  'reports.statementTimeoutMs': {
+    defaultValue: 5000,
+    parse: parsePositiveInt('reports.statementTimeoutMs', 60000),
+  },
+  'reports.exportMaxSnapshotSeconds': {
+    defaultValue: 120,
+    parse: parsePositiveInt('reports.exportMaxSnapshotSeconds', 3600),
+  },
+  'reports.maxRowsSync': {
+    defaultValue: 10000,
+    parse: parsePositiveInt('reports.maxRowsSync', 100000),
+  },
+  'reports.countCap': {
+    defaultValue: 10000,
+    parse: parsePositiveInt('reports.countCap', 1000000),
+  },
+  'reports.liveTierMaxRows': {
+    defaultValue: 50000,
+    parse: parsePositiveInt('reports.liveTierMaxRows', 10000000),
+  },
+  // 0 disables the short-TTL result cache (report design §5.7).
+  'reports.resultCacheTtlMs': {
+    defaultValue: 0,
+    parse: parseNonNegativeInt('reports.resultCacheTtlMs', 300000),
+  },
+  // Curated tag vocabulary; empty = free-form tags (report design §7).
+  'reports.tagVocabulary': {
+    defaultValue: [],
+    parse: parseStringArray('reports.tagVocabulary', 200),
+  },
   timezone: {
     defaultValue: 'UTC',
     parse: parseTimezone,
@@ -101,6 +161,40 @@ function parseOptionalUrl(value: unknown) {
   }
 }
 
+function parseStringArray(key: string, maxItems: number) {
+  return (value: unknown) => {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
+      throw new BadRequestException(`${key} must be an array of strings.`);
+    }
+
+    if (value.length > maxItems) {
+      throw new BadRequestException(`${key} must not contain more than ${maxItems} items.`);
+    }
+
+    return value.map((item) => (item as string).trim()).filter((item) => item.length > 0);
+  };
+}
+
+function parsePositiveInt(key: string, max: number) {
+  return (value: unknown) => {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 1 || value > max) {
+      throw new BadRequestException(`${key} must be an integer between 1 and ${max}.`);
+    }
+
+    return value;
+  };
+}
+
+function parseNonNegativeInt(key: string, max: number) {
+  return (value: unknown) => {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 0 || value > max) {
+      throw new BadRequestException(`${key} must be an integer between 0 and ${max}.`);
+    }
+
+    return value;
+  };
+}
+
 function parseTimezone(value: unknown) {
   if (typeof value !== 'string') {
     throw new BadRequestException('timezone must be a string.');

package/template/test/forms-definitions.e2e-spec.ts

@@ -0,0 +1,394 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+
+describe('Forms definitions lifecycle (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.FORMS_FILE_STORAGE_DIR = './var/test-uploads';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('creates drafts with incrementing versions for the same key', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('def-draft');
+    const key = uniqueFormKey('draft');
+
+    const first = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+
+    expect(first.body.status).toBe('DRAFT');
+    expect(first.body.version).toBe(1);
+    expect(first.body.key).toBe(key);
+
+    const second = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+
+    expect(second.body.status).toBe('DRAFT');
+    expect(second.body.version).toBe(2);
+  });
+
+  it('rejects definitions with an unknown field type at save time', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('def-lint');
+    const definition = registrationDefinition(uniqueFormKey('lint'));
+    (definition.fields as Array<Record<string, unknown>>).push({
+      type: 'no-such-type',
+      name: 'mysteryField',
+    });
+
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition })
+      .expect(422);
+
+    const issues = response.body.error.details.issues as Array<{ code: string }>;
+    expect(issues.map((issue) => issue.code)).toContain('UNKNOWN_FIELD_TYPE');
+  });
+
+  it('publishes, freezes published versions, auto-archives priors, and audits', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('def-publish');
+    const key = uniqueFormKey('publish');
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+
+    const published = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/${key}/versions/1/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    expect(published.body.status).toBe('PUBLISHED');
+
+    // Published versions are immutable.
+    await request(app.getHttpServer())
+      .patch(`/organisations/${orgId}/forms/${key}/versions/1`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(409);
+
+    // Publish version 2: version 1 must be auto-archived.
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/${key}/versions/2/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+
+    const versionOne = await request(app.getHttpServer())
+      .get(`/organisations/${orgId}/forms/${key}/versions/1`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    expect(versionOne.body.status).toBe('ARCHIVED');
+
+    const auditRows = await prisma.auditLog.findMany({
+      where: { orgId, action: { in: ['forms.create', 'forms.publish'] } },
+    });
+    expect(auditRows.some((row) => row.action === 'forms.create')).toBe(true);
+    expect(auditRows.some((row) => row.action === 'forms.publish')).toBe(true);
+  });
+
+  it('gates dangerous-action wiring at attach time (permission and allowlist)', async () => {
+    const owner = await createUserAndOrg('def-dangerous');
+    const member = await createMemberInOrg(owner.orgId, 'def-dangerous-member', [
+      'forms.read',
+      'forms.create',
+      'forms.update',
+      'forms.publish',
+    ]);
+
+    // Member lacks forms.wireDangerous.
+    const memberAttempt = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .send({ definition: authenticateDefinition(uniqueFormKey('login-member')) })
+      .expect(422);
+    const memberIssues = memberAttempt.body.error.details.issues as Array<{ code: string }>;
+    expect(memberIssues.map((issue) => issue.code)).toContain('DANGEROUS_NOT_ALLOWED');
+
+    // Owner passes wireDangerous (manage all) but the org allowlist is empty.
+    const ownerAttempt = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: authenticateDefinition(uniqueFormKey('login-owner')) })
+      .expect(422);
+    const ownerIssues = ownerAttempt.body.error.details.issues as Array<{ code: string }>;
+    expect(ownerIssues.map((issue) => issue.code)).toContain('DANGEROUS_NOT_IN_ALLOWLIST');
+    expect(ownerIssues.map((issue) => issue.code)).not.toContain('DANGEROUS_NOT_ALLOWED');
+
+    // With the org allowlist set, owner create + publish succeeds.
+    await setOrgSetting(owner.accessToken, owner.orgId, 'forms.allowedDangerousActions', [
+      'authenticate',
+    ]);
+    const key = uniqueFormKey('login-allowed');
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: authenticateDefinition(key) })
+      .expect(201);
+    const published = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/publish`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+    expect(published.body.status).toBe('PUBLISHED');
+  });
+
+  it('gates public-access flips by forms.managePublicAccess and audits them', async () => {
+    const owner = await createUserAndOrg('def-public-access');
+    const member = await createMemberInOrg(owner.orgId, 'def-public-member', ['forms.read']);
+    const key = uniqueFormKey('flip');
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/publish`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/public-access`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .send({ access: 'public' })
+      .expect(403);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/public-access`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ access: 'public' })
+      .expect(200);
+
+    const auditRow = await prisma.auditLog.findFirst({
+      where: { orgId: owner.orgId, action: 'forms.publicAccess.update' },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(auditRow).not.toBeNull();
+    const metadata = auditRow?.metadata as { previous?: string; next?: string };
+    expect(metadata.previous).toBe('private');
+    expect(metadata.next).toBe('public');
+  });
+
+  it('denies cross-org definition access (403 cross-tenant, 404 foreign key)', async () => {
+    const orgA = await createUserAndOrg('def-cross-a');
+    const orgB = await createUserAndOrg('def-cross-b');
+    const keyA = uniqueFormKey('cross');
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgA.orgId}/forms`)
+      .set('Authorization', `Bearer ${orgA.accessToken}`)
+      .send({ definition: registrationDefinition(keyA) })
+      .expect(201);
+
+    // Org B's owner against org A's path: not a member, denied outright.
+    await request(app.getHttpServer())
+      .get(`/organisations/${orgA.orgId}/forms/${keyA}`)
+      .set('Authorization', `Bearer ${orgB.accessToken}`)
+      .expect(403);
+
+    // Org A's key under org B's own path: scoped lookup finds nothing.
+    await request(app.getHttpServer())
+      .get(`/organisations/${orgB.orgId}/forms/${keyA}`)
+      .set('Authorization', `Bearer ${orgB.accessToken}`)
+      .expect(404);
+  });
+
+  // ── Helpers ────────────────────────────────────────────────────────────────
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueFormKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function registrationDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Event registration',
+      fields: [
+        {
+          type: 'text',
+          name: 'fullName',
+          label: 'Full name',
+          validators: { required: true, maxLength: 120 },
+          reportable: true,
+        },
+        {
+          type: 'email',
+          name: 'email',
+          label: 'Email address',
+          validators: { required: true },
+          reportable: true,
+        },
+        {
+          type: 'select',
+          name: 'ticketType',
+          label: 'Ticket type',
+          validators: { required: true, options: ['standard', 'student', 'vip'] },
+          reportable: true,
+        },
+        {
+          type: 'hidden',
+          name: 'registeredBy',
+          source: 'context',
+          path: 'user.id',
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  function authenticateDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Sign in',
+      fields: [
+        { type: 'email', name: 'email', label: 'Email address', validators: { required: true } },
+        {
+          type: 'password',
+          name: 'password',
+          label: 'Password',
+          validators: { required: true, minLength: 8 },
+        },
+      ],
+      actions: {
+        submit: ['authenticate'],
+      },
+    };
+  }
+
+  async function setOrgSetting(accessToken: string, orgId: string, key: string, value: unknown) {
+    await request(app.getHttpServer())
+      .patch(`/organisations/${orgId}/settings`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ key, value })
+      .expect(200);
+  }
+
+  async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const org = await createOrganisation(user.accessToken, label);
+
+    return {
+      ...user,
+      orgId: org.orgId,
+      membershipId: org.membershipId,
+    };
+  }
+
+  async function createUser(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createOrganisation(accessToken: string, label: string) {
+    const suffix = uniqueSuffix();
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        name: `${label} ${suffix}`,
+        slug: `${label}-${suffix}`,
+      })
+      .expect(201);
+
+    return {
+      orgId: org.body.organisation.id as string,
+      membershipId: org.body.membership.id as string,
+    };
+  }
+
+  async function createMemberInOrg(orgId: string, label: string, permissionKeys: string[]) {
+    const user = await createUser(label);
+    const permissions = await prisma.permission.findMany({
+      where: { key: { in: permissionKeys } },
+      select: { id: true },
+    });
+    expect(permissions).toHaveLength(permissionKeys.length);
+
+    const role = await prisma.role.create({
+      data: {
+        orgId,
+        name: `${label}-${uniqueSuffix()}`,
+        permissions: {
+          create: permissions.map((permission) => ({ permissionId: permission.id })),
+        },
+      },
+      select: { id: true },
+    });
+    const membership = await prisma.membership.create({
+      data: {
+        userId: user.userId,
+        orgId,
+        roleId: role.id,
+      },
+      select: { id: true, roleId: true },
+    });
+
+    return {
+      ...user,
+      membershipId: membership.id,
+      roleId: membership.roleId,
+    };
+  }
+});