@ftisindia/create-app 0.1.4 → 0.1.6

package/template/test/forms-public.e2e-spec.ts

@@ -0,0 +1,269 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+
+describe('Forms public/anonymous path (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let owner: { accessToken: string; userId: string; email: string; orgId: string };
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.FORMS_FILE_STORAGE_DIR = './var/test-uploads';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+
+    owner = await createUserAndOrg('public-owner');
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('answers 404 for private forms on the anonymous path, then serves them once public', async () => {
+    const key = await publishDefinition(registrationDefinition(uniqueFormKey('pub-flip')));
+
+    // Private published form: existence is never revealed anonymously.
+    await request(app.getHttpServer())
+      .get(`/public/organisations/${owner.orgId}/forms/${key}/render`)
+      .expect(404);
+    await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .send({ data: { fullName: 'Anon', email: 'anon@example.com', ticketType: 'standard' } })
+      .expect(404);
+
+    // Owner flips it public.
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/public-access`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ access: 'public' })
+      .expect(200);
+
+    const render = await request(app.getHttpServer())
+      .get(`/public/organisations/${owner.orgId}/forms/${key}/render`)
+      .expect(200);
+    expect(render.body.definition.key).toBe(key);
+    expect(render.body.options).toBeDefined();
+
+    const submitted = await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('User-Agent', 'forms-public-e2e')
+      .send({ data: { fullName: 'Anon User', email: 'anon@example.com', ticketType: 'student' } })
+      .expect(200);
+
+    const submissionId = submitted.body.submissionId as string;
+    expect(submissionId).toBeTruthy();
+
+    const row = await prisma.formSubmission.findUnique({ where: { id: submissionId } });
+    expect(row).not.toBeNull();
+    expect(row?.createdBy).toBeNull();
+    expect(row?.ipAddress).toBeTruthy();
+    expect(row?.userAgent).toBeTruthy();
+  });
+
+  it('enforces the per-IP daily submission cap on public forms', async () => {
+    const key = uniqueFormKey('pub-cap');
+    await publishDefinition({
+      ...registrationDefinition(key),
+      settings: { access: 'public', maxSubmissionsPerIpPerDay: 2 },
+    });
+
+    for (let i = 0; i < 2; i += 1) {
+      await request(app.getHttpServer())
+        .post(`/public/organisations/${owner.orgId}/forms/${key}/submissions`)
+        .send({
+          data: { fullName: `Cap ${i}`, email: `cap-${i}@example.com`, ticketType: 'standard' },
+        })
+        .expect(200);
+    }
+
+    const blocked = await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .send({ data: { fullName: 'Cap 3', email: 'cap-3@example.com', ticketType: 'standard' } })
+      .expect(422);
+
+    const errors = blocked.body.error.details.errors as Array<{ code: string }>;
+    expect(errors.some((error) => error.code === 'SUBMISSION_CAP')).toBe(true);
+  });
+
+  it('runs the login milestone: anonymous authenticate with full redaction', async () => {
+    await setOrgSetting(owner.accessToken, owner.orgId, 'forms.allowedDangerousActions', [
+      'authenticate',
+    ]);
+    const key = await publishDefinition(loginDefinition(uniqueFormKey('pub-login')));
+
+    const success = await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .send({ data: { email: owner.email, password: 'test-password-123' } })
+      .expect(200);
+
+    const outputs = success.body.outputs as { authenticate?: { accessToken?: string } };
+    expect(outputs.authenticate?.accessToken).toBeTruthy();
+
+    // Dangerous actions log neither input nor output — only the literal.
+    const logRow = await prisma.formActionLog.findFirst({
+      where: { orgId: owner.orgId, formKey: key, action: 'authenticate', status: 'OK' },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(logRow).not.toBeNull();
+    expect(logRow?.input).toBe('[REDACTED]');
+    expect(logRow?.output).toBe('[REDACTED]');
+
+    // AuthService throws Nest exceptions — they propagate as-is (401).
+    await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .send({ data: { email: owner.email, password: 'wrong-password-99' } })
+      .expect(401);
+
+    // Execute-time backstop: removing the allowlist entry blocks submission.
+    await setOrgSetting(owner.accessToken, owner.orgId, 'forms.allowedDangerousActions', []);
+    await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .send({ data: { email: owner.email, password: 'test-password-123' } })
+      .expect(403);
+  });
+
+  // ── Helpers ────────────────────────────────────────────────────────────────
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueFormKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function registrationDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Event registration',
+      fields: [
+        {
+          type: 'text',
+          name: 'fullName',
+          label: 'Full name',
+          validators: { required: true, maxLength: 120 },
+          reportable: true,
+        },
+        {
+          type: 'email',
+          name: 'email',
+          label: 'Email address',
+          validators: { required: true },
+          reportable: true,
+        },
+        {
+          type: 'select',
+          name: 'ticketType',
+          label: 'Ticket type',
+          validators: { required: true, options: ['standard', 'student', 'vip'] },
+          reportable: true,
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  function loginDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Sign in',
+      settings: { access: 'public' },
+      fields: [
+        { type: 'email', name: 'email', label: 'Email address', validators: { required: true } },
+        {
+          type: 'password',
+          name: 'password',
+          label: 'Password',
+          validators: { required: true, minLength: 8 },
+          ui: { widget: 'password' },
+        },
+      ],
+      actions: {
+        submit: ['authenticate'],
+      },
+    };
+  }
+
+  async function setOrgSetting(accessToken: string, orgId: string, key: string, value: unknown) {
+    await request(app.getHttpServer())
+      .patch(`/organisations/${orgId}/settings`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ key, value })
+      .expect(200);
+  }
+
+  async function publishDefinition(definition: Record<string, unknown>): Promise<string> {
+    const created = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${owner.orgId}/forms/${created.body.key as string}/versions/${created.body.version as number}/publish`,
+      )
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    return created.body.key as string;
+  }
+
+  async function createUserAndOrg(label: string) {
+    const suffix = uniqueSuffix();
+    const email = `${label}-${suffix}@example.com`;
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+
+    const accessToken = signup.body.accessToken as string;
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        name: `${label} ${suffix}`,
+        slug: `${label}-${suffix}`,
+      })
+      .expect(201);
+
+    return {
+      accessToken,
+      userId: signup.body.user.id as string,
+      email,
+      orgId: org.body.organisation.id as string,
+    };
+  }
+});

package/template/test/forms-schema-check.e2e-spec.ts

@@ -0,0 +1,65 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+import { FormsSchemaCheckService } from '../src/modules/forms/infrastructure/schema-check/forms-schema-check.service';
+
+describe('Forms schema compatibility check (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let schemaCheck: FormsSchemaCheckService;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.FORMS_FILE_STORAGE_DIR = './var/test-uploads';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+    schemaCheck = app.get(FormsSchemaCheckService);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('passes against the migrated database', async () => {
+    await expect(schemaCheck.check()).resolves.toBeUndefined();
+  });
+
+  it('fails fast with an actionable message when the schema drifts', async () => {
+    // Simulate drift by renaming an engine column. Suites run with
+    // --runInBand, so restoring in finally keeps every other suite green.
+    await prisma.$executeRawUnsafe(
+      'ALTER TABLE "FormSubmission" RENAME COLUMN "locked" TO "locked_bak"',
+    );
+    try {
+      await expect(schemaCheck.check()).rejects.toThrow(/FormSubmission/);
+    } finally {
+      await prisma.$executeRawUnsafe(
+        'ALTER TABLE "FormSubmission" RENAME COLUMN "locked_bak" TO "locked"',
+      );
+    }
+
+    // The restored schema must pass again.
+    await expect(schemaCheck.check()).resolves.toBeUndefined();
+  });
+});