@ftisindia/create-app 0.1.4 → 0.1.6

package/template/test/forms-export.e2e-spec.ts

@@ -0,0 +1,390 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import { FieldTypeRegistry } from '@ftisindia/form-builder';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+
+describe('Forms submissions export (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let owner: { accessToken: string; userId: string; orgId: string };
+  let formKey: string;
+  const seededEmails = ['export-one@example.com', 'export-two@example.com'];
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.FORMS_FILE_STORAGE_DIR = './var/test-uploads';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+    app.get(FieldTypeRegistry).register({
+      type: 'api-secret',
+      alwaysSensitive: true,
+      buildValidator: () => ({ type: 'string' }),
+    });
+
+    owner = await createUserAndOrg('export-owner');
+    formKey = await publishDefinition(registrationDefinition(uniqueFormKey('export')));
+
+    for (const [index, email] of seededEmails.entries()) {
+      await request(app.getHttpServer())
+        .post(`/organisations/${owner.orgId}/forms/${formKey}/submissions`)
+        .set('Authorization', `Bearer ${owner.accessToken}`)
+        .send({
+          mode: 'submit',
+          data: { fullName: `Export Person ${index}`, email, ticketType: 'standard' },
+        })
+        .expect(200);
+    }
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('denies export to members holding only formSubmissions.read', async () => {
+    const member = await createMemberInOrg(owner.orgId, 'export-reader', [
+      'formSubmissions.read',
+    ]);
+
+    await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${formKey}/submissions/export`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .expect(403);
+  });
+
+  it('exports reportable fields as JSON and audits every export, empty windows included', async () => {
+    const response = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${formKey}/submissions/export`)
+      .query({ format: 'json' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    const columns = response.body.columns as string[];
+    const rows = response.body.rows as Array<Record<string, unknown>>;
+    expect(columns).toEqual(expect.arrayContaining(['fullName', 'email', 'ticketType']));
+    expect(rows).toHaveLength(2);
+    for (const email of seededEmails) {
+      expect(rows.some((row) => row.email === email)).toBe(true);
+    }
+
+    // Empty filter window: still audited, rowCount 0.
+    const empty = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${formKey}/submissions/export`)
+      .query({
+        format: 'json',
+        from: '2000-01-01T00:00:00.000Z',
+        to: '2000-01-02T00:00:00.000Z',
+      })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+    expect(empty.body.rows).toHaveLength(0);
+
+    const auditRows = await prisma.auditLog.findMany({
+      where: { orgId: owner.orgId, action: 'formSubmissions.export' },
+      orderBy: { createdAt: 'asc' },
+    });
+    const metadatas = auditRows.map(
+      (row) => row.metadata as { rowCount?: number; fields?: string[] },
+    );
+    expect(metadatas.some((metadata) => metadata.rowCount === 2)).toBe(true);
+    expect(metadatas.some((metadata) => metadata.rowCount === 0)).toBe(true);
+    expect(
+      metadatas.some((metadata) => (metadata.fields ?? []).includes('fullName')),
+    ).toBe(true);
+  });
+
+  it('exports CSV with a header line and a text/csv content type', async () => {
+    const response = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${formKey}/submissions/export`)
+      .query({ format: 'csv' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    expect(response.headers['content-type']).toContain('text/csv');
+    const lines = (response.text as string).split(/\r\n/);
+    expect(lines[0]).toContain('id');
+    expect(lines[0]).toContain('formVersion');
+    expect(lines[0]).toContain('fullName');
+    expect(lines.length).toBeGreaterThanOrEqual(3);
+  });
+
+  it('refuses explicitly requested sensitive fields with 403', async () => {
+    const sensitiveKey = uniqueFormKey('export-sensitive');
+    // Draft is enough — export resolves the latest definition of any status.
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: credentialsDefinition(sensitiveKey) })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${sensitiveKey}/submissions/export`)
+      .query({ format: 'json', fields: 'password' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(403);
+  });
+
+  it('treats custom alwaysSensitive field types as non-exportable', async () => {
+    const customKey = uniqueFormKey('export-custom-sensitive');
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: customSensitiveDefinition(customKey) })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${customKey}/submissions/export`)
+      .query({ format: 'json', fields: 'apiKey' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(403);
+
+    const exported = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${customKey}/submissions/export`)
+      .query({ format: 'json' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+    expect(exported.body.columns).not.toContain('apiKey');
+  });
+
+  it('refuses reportable parent objects that contain sensitive children', async () => {
+    const nestedKey = uniqueFormKey('export-nested-sensitive');
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: nestedSensitiveDefinition(nestedKey) })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${nestedKey}/submissions/export`)
+      .query({ format: 'json', fields: 'profile' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(403);
+
+    const exported = await request(app.getHttpServer())
+      .get(`/organisations/${owner.orgId}/forms/${nestedKey}/submissions/export`)
+      .query({ format: 'json' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+    expect(exported.body.columns).not.toContain('profile');
+  });
+
+  // ── Helpers ────────────────────────────────────────────────────────────────
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueFormKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function registrationDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Event registration',
+      fields: [
+        {
+          type: 'text',
+          name: 'fullName',
+          label: 'Full name',
+          validators: { required: true, maxLength: 120 },
+          reportable: true,
+        },
+        {
+          type: 'email',
+          name: 'email',
+          label: 'Email address',
+          validators: { required: true },
+          reportable: true,
+        },
+        {
+          type: 'select',
+          name: 'ticketType',
+          label: 'Ticket type',
+          validators: { required: true, options: ['standard', 'student', 'vip'] },
+          reportable: true,
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  function credentialsDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Account credentials',
+      fields: [
+        {
+          type: 'text',
+          name: 'username',
+          label: 'Username',
+          validators: { required: true },
+          reportable: true,
+        },
+        {
+          type: 'password',
+          name: 'password',
+          label: 'Password',
+          validators: { required: true, minLength: 8 },
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+      },
+    };
+  }
+
+  function customSensitiveDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Custom sensitive field',
+      fields: [
+        {
+          type: 'api-secret',
+          name: 'apiKey',
+          label: 'API key',
+          reportable: true,
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+      },
+    };
+  }
+
+  function nestedSensitiveDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Nested sensitive field',
+      fields: [
+        {
+          type: 'group',
+          name: 'profile',
+          label: 'Profile',
+          reportable: true,
+          fields: [
+            { type: 'text', name: 'displayName', reportable: true },
+            { type: 'password', name: 'secretCode' },
+          ],
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+      },
+    };
+  }
+
+  async function publishDefinition(definition: Record<string, unknown>): Promise<string> {
+    const created = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${owner.orgId}/forms/${created.body.key as string}/versions/${created.body.version as number}/publish`,
+      )
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    return created.body.key as string;
+  }
+
+  async function createUser(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const suffix = uniqueSuffix();
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${user.accessToken}`)
+      .send({
+        name: `${label} ${suffix}`,
+        slug: `${label}-${suffix}`,
+      })
+      .expect(201);
+
+    return {
+      ...user,
+      orgId: org.body.organisation.id as string,
+    };
+  }
+
+  async function createMemberInOrg(orgId: string, label: string, permissionKeys: string[]) {
+    const user = await createUser(label);
+    const permissions = await prisma.permission.findMany({
+      where: { key: { in: permissionKeys } },
+      select: { id: true },
+    });
+    expect(permissions).toHaveLength(permissionKeys.length);
+
+    const role = await prisma.role.create({
+      data: {
+        orgId,
+        name: `${label}-${uniqueSuffix()}`,
+        permissions: {
+          create: permissions.map((permission) => ({ permissionId: permission.id })),
+        },
+      },
+      select: { id: true },
+    });
+    const membership = await prisma.membership.create({
+      data: {
+        userId: user.userId,
+        orgId,
+        roleId: role.id,
+      },
+      select: { id: true, roleId: true },
+    });
+
+    return {
+      ...user,
+      membershipId: membership.id,
+      roleId: membership.roleId,
+    };
+  }
+});