@ftisindia/create-app 0.1.4 → 0.1.6

package/template/test/forms-submissions.e2e-spec.ts

@@ -0,0 +1,500 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import { ActionRegistry, DataSourceRegistry } from '@ftisindia/form-builder';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+
+describe('Forms submissions engine flow (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let owner: { accessToken: string; userId: string; orgId: string };
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.FORMS_FILE_STORAGE_DIR = './var/test-uploads';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+
+    // Test-only engine extensions registered at runtime (pass save-time lint).
+    const actions = app.get(ActionRegistry);
+    actions.register({
+      name: 'failTransactional',
+      kind: 'transactional',
+      execute: () => {
+        return Promise.reject(new Error('induced failure'));
+      },
+    });
+    actions.register({
+      name: 'echoData',
+      kind: 'transactional',
+      execute: (ctx) => Promise.resolve({ ...ctx.data }),
+    });
+
+    const dataSources = app.get(DataSourceRegistry);
+    dataSources.register({
+      key: 'conference-tracks',
+      fetch: () => Promise.resolve([
+        { value: 'ai', label: 'Artificial Intelligence' },
+        { value: 'ml', label: 'Machine Learning' },
+      ]),
+    });
+
+    owner = await createUserAndOrg('sub-owner');
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('accepts a partial draft but rejects the same payload on submit (REQUIRED)', async () => {
+    const key = await publishDefinition(registrationDefinition(uniqueFormKey('reg-draft')));
+
+    const draft = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'draft', data: { email: 'draft@example.com' } })
+      .expect(200);
+    expect(draft.body.submissionId).toBeTruthy();
+
+    const submit = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'submit', data: { email: 'draft@example.com' } })
+      .expect(422);
+
+    expect(submit.body.error.code).toBe('UNPROCESSABLE_ENTITY');
+    expect(submit.body.error.message).toBe('Validation failed.');
+    const errors = submit.body.error.details.errors as Array<{ path: string; code: string }>;
+    expect(errors.some((error) => error.path === 'fullName' && error.code === 'REQUIRED')).toBe(
+      true,
+    );
+  });
+
+  it('rejects mismatched submit mode and button', async () => {
+    const key = await publishDefinition(registrationDefinition(uniqueFormKey('reg-mode-button')));
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'draft', button: 'submit', data: { email: 'draft@example.com' } })
+      .expect(409);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'submit',
+        button: 'saveDraft',
+        data: { fullName: 'Mode Tester', email: 'mode@example.com', ticketType: 'standard' },
+      })
+      .expect(409);
+  });
+
+  it('rejects edits to drafts captured under another form version', async () => {
+    const key = await publishDefinition(registrationDefinition(uniqueFormKey('reg-versioned')));
+    const draft = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'draft', data: { email: 'old-version@example.com' } })
+      .expect(200);
+
+    const createdV2 = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: { ...registrationDefinition(key), title: 'Event registration v2' } })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${owner.orgId}/forms/${key}/versions/${createdV2.body.version as number}/publish`,
+      )
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'draft',
+        submissionId: draft.body.submissionId as string,
+        data: { email: 'still-old-version@example.com' },
+      })
+      .expect(409);
+  });
+
+  it('rejects draft ids replayed through another form route', async () => {
+    const sourceKey = await publishDefinition(registrationDefinition(uniqueFormKey('reg-source')));
+    const targetKey = await publishDefinition(registrationDefinition(uniqueFormKey('reg-target')));
+    const draft = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${sourceKey}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'draft', data: { email: 'source@example.com' } })
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${targetKey}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'draft',
+        submissionId: draft.body.submissionId as string,
+        data: { email: 'target@example.com' },
+      })
+      .expect(404);
+  });
+
+  it('stamps context fields server-side even when the client spoofs them', async () => {
+    const key = await publishDefinition(registrationDefinition(uniqueFormKey('reg-spoof')));
+
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'submit',
+        data: {
+          fullName: 'Ada Lovelace',
+          email: 'ada@example.com',
+          ticketType: 'standard',
+          registeredBy: 'spoofed-user-id',
+        },
+      })
+      .expect(200);
+
+    const submissionId = response.body.submissionId as string;
+    expect(submissionId).toBeTruthy();
+
+    const row = await prisma.formSubmission.findUnique({ where: { id: submissionId } });
+    expect(row).not.toBeNull();
+    expect(row?.status).toBe('SUBMITTED');
+    expect(row?.formVersion).toBe(1);
+    const data = row?.data as unknown as { registeredBy?: string };
+    expect(data.registeredBy).toBe(owner.userId);
+  });
+
+  it('rejects edits to an already-SUBMITTED submission with 409', async () => {
+    const key = await publishDefinition(registrationDefinition(uniqueFormKey('reg-locked')));
+
+    const submitted = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'submit',
+        data: { fullName: 'Grace Hopper', email: 'grace@example.com', ticketType: 'vip' },
+      })
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'draft',
+        submissionId: submitted.body.submissionId as string,
+        data: { fullName: 'Grace Hopper (edited)' },
+      })
+      .expect(409);
+  });
+
+  it('enforces json-logic rules with ruleId on violation', async () => {
+    const key = await publishDefinition(fundingDefinition(uniqueFormKey('funding')));
+
+    const blocked = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'submit', data: { needsFunding: true, fundingSource: '' } })
+      .expect(422);
+
+    const errors = blocked.body.error.details.errors as Array<{ ruleId?: string }>;
+    expect(errors.some((error) => error.ruleId === 'funding-required')).toBe(true);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'submit', data: { needsFunding: true, fundingSource: 'NSF grant 42' } })
+      .expect(200);
+  });
+
+  it('rejects static select values outside the options enum', async () => {
+    const key = await publishDefinition(registrationDefinition(uniqueFormKey('reg-enum')));
+
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'submit',
+        data: { fullName: 'Enum Tester', email: 'enum@example.com', ticketType: 'gold' },
+      })
+      .expect(422);
+
+    const errors = response.body.error.details.errors as Array<{ path: string; code: string }>;
+    expect(errors.some((error) => error.path === 'ticketType' && error.code === 'ENUM')).toBe(true);
+  });
+
+  it('re-validates data-source membership at submit time', async () => {
+    const key = await publishDefinition(trackDefinition(uniqueFormKey('tracks')));
+
+    const rejected = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'submit', data: { track: 'quantum' } })
+      .expect(422);
+
+    const errors = rejected.body.error.details.errors as Array<{ code: string }>;
+    expect(errors.some((error) => error.code === 'NOT_IN_DATASOURCE')).toBe(true);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'submit', data: { track: 'ai' } })
+      .expect(200);
+  });
+
+  it('rolls back the whole transaction when a transactional action fails (§8.3)', async () => {
+    const key = uniqueFormKey('rollback');
+    await publishDefinition({
+      ...registrationDefinition(key),
+      actions: {
+        submit: ['validateAll', 'persist', 'failTransactional', 'sendConfirmationEmail'],
+        saveDraft: ['persistDraft'],
+      },
+    });
+
+    const before = {
+      submissions: await prisma.formSubmission.count(),
+      outbox: await prisma.formOutboxJob.count(),
+      audit: await prisma.auditLog.count(),
+      persistOk: await prisma.formActionLog.count({
+        where: { orgId: owner.orgId, formKey: key, action: 'persist', status: 'OK' },
+      }),
+    };
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'submit',
+        data: { fullName: 'Roll Back', email: 'rollback@example.com', ticketType: 'student' },
+      })
+      .expect(500);
+
+    const after = {
+      submissions: await prisma.formSubmission.count(),
+      outbox: await prisma.formOutboxJob.count(),
+      audit: await prisma.auditLog.count(),
+      persistOk: await prisma.formActionLog.count({
+        where: { orgId: owner.orgId, formKey: key, action: 'persist', status: 'OK' },
+      }),
+    };
+
+    expect(after.submissions).toBe(before.submissions);
+    expect(after.outbox).toBe(before.outbox);
+    expect(after.persistOk).toBe(before.persistOk);
+
+    // One best-effort ERROR row for the failing step is allowed (and expected).
+    const errorRow = await prisma.formActionLog.findFirst({
+      where: { orgId: owner.orgId, formKey: key, action: 'failTransactional' },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(errorRow).not.toBeNull();
+    expect(errorRow?.status).toBe('ERROR');
+  });
+
+  it('redacts sensitive fields in action-log outputs', async () => {
+    const key = await publishDefinition(credentialsDefinition(uniqueFormKey('creds')));
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'submit', data: { username: 'ada', password: 'super-secret-1' } })
+      .expect(200);
+
+    const logRow = await prisma.formActionLog.findFirst({
+      where: { orgId: owner.orgId, formKey: key, action: 'echoData', status: 'OK' },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(logRow).not.toBeNull();
+    const output = logRow?.output as unknown as { username?: string; password?: string };
+    expect(output.password).toBe('[REDACTED]');
+    expect(output.username).toBe('ada');
+  });
+
+  // ── Helpers ────────────────────────────────────────────────────────────────
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueFormKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function registrationDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Event registration',
+      fields: [
+        {
+          type: 'text',
+          name: 'fullName',
+          label: 'Full name',
+          validators: { required: true, maxLength: 120 },
+          reportable: true,
+        },
+        {
+          type: 'email',
+          name: 'email',
+          label: 'Email address',
+          validators: { required: true },
+          reportable: true,
+        },
+        {
+          type: 'select',
+          name: 'ticketType',
+          label: 'Ticket type',
+          validators: { required: true, options: ['standard', 'student', 'vip'] },
+          reportable: true,
+        },
+        {
+          type: 'hidden',
+          name: 'registeredBy',
+          source: 'context',
+          path: 'user.id',
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist', 'sendConfirmationEmail'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  function fundingDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Funding request',
+      fields: [
+        { type: 'boolean', name: 'needsFunding', label: 'Requesting funding?' },
+        { type: 'text', name: 'fundingSource', label: 'Funding source' },
+      ],
+      rules: [
+        {
+          id: 'funding-required',
+          enforceOn: ['submit'],
+          if: { '==': [{ var: 'data.needsFunding' }, true] },
+          then: { require: ['fundingSource'] },
+          message: 'Funding source is required when requesting funding.',
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  function trackDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Track selection',
+      fields: [
+        {
+          type: 'select',
+          name: 'track',
+          label: 'Conference track',
+          dataSource: { key: 'conference-tracks' },
+          validators: { required: true },
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  function credentialsDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Credentials echo',
+      fields: [
+        { type: 'text', name: 'username', label: 'Username', validators: { required: true } },
+        {
+          type: 'password',
+          name: 'password',
+          label: 'Password',
+          validators: { required: true, minLength: 8 },
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist', 'echoData'],
+      },
+    };
+  }
+
+  async function publishDefinition(definition: Record<string, unknown>): Promise<string> {
+    const created = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${owner.orgId}/forms/${created.body.key as string}/versions/${created.body.version as number}/publish`,
+      )
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    return created.body.key as string;
+  }
+
+  async function createUserAndOrg(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+
+    const accessToken = signup.body.accessToken as string;
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        name: `${label} ${suffix}`,
+        slug: `${label}-${suffix}`,
+      })
+      .expect(201);
+
+    return {
+      accessToken,
+      userId: signup.body.user.id as string,
+      orgId: org.body.organisation.id as string,
+    };
+  }
+});