@ftisindia/create-app 0.1.4 → 0.1.6

package/template/test/forms-webhooks.e2e-spec.ts

@@ -0,0 +1,261 @@
+import { createServer, Server } from 'node:http';
+import { createHmac } from 'node:crypto';
+import { AddressInfo } from 'node:net';
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+import { OutboxDispatcherService } from '../src/modules/forms/application/services/outbox-dispatcher.service';
+
+interface CapturedRequest {
+  url: string;
+  signature: string | undefined;
+  body: string;
+}
+
+describe('Forms submission webhooks (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let dispatcher: OutboxDispatcherService;
+  let server: Server;
+  let port: number;
+  const received: CapturedRequest[] = [];
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+
+    server = createServer((req, res) => {
+      const chunks: Buffer[] = [];
+      req.on('data', (chunk: Buffer) => chunks.push(chunk));
+      req.on('end', () => {
+        received.push({
+          url: req.url ?? '',
+          signature: req.headers['x-forms-signature'] as string | undefined,
+          body: Buffer.concat(chunks).toString('utf8'),
+        });
+        res.statusCode = req.url === '/always-500' ? 500 : 200;
+        res.end();
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    port = (server.address() as AddressInfo).port;
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({ forbidNonWhitelisted: true, transform: true, whitelist: true }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+    dispatcher = app.get(OutboxDispatcherService);
+  });
+
+  afterAll(async () => {
+    await app.close();
+    await new Promise<void>((resolve, reject) =>
+      server.close((error) => (error ? reject(error) : resolve())),
+    );
+  });
+
+  it('rejects webhook hosts that are not in the org allowlist (save-time lint)', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-allowlist');
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: makeDefinition([{ url: 'https://hooks.example.com/x' }]) })
+      .expect(422);
+
+    const codes = issueCodes(response.body);
+    expect(codes).toContain('WEBHOOK_HOST_NOT_ALLOWED');
+  });
+
+  it('rejects http urls on non-loopback hosts even when allowlisted', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-insecure');
+    await allowHosts(accessToken, orgId, ['hooks.example.com']);
+
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: makeDefinition([{ url: 'http://hooks.example.com/x' }]) })
+      .expect(422);
+
+    expect(issueCodes(response.body)).toContain('WEBHOOK_URL_INSECURE');
+  });
+
+  it('delivers a signed, redacted webhook atomically with the submission', async () => {
+    const { accessToken, orgId, userId } = await createUserAndOrg('wh-deliver');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/hook`, secret: 'test-secret' }]),
+    );
+
+    const submit = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ mode: 'submit', data: { title: 'Hello', apiKey: 'super-secret-key' } })
+      .expect(200);
+    const submissionId = submit.body.submissionId as string;
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${submissionId}:webhook:0` },
+    });
+    expect(job).not.toBeNull();
+    expect(job!.type).toBe('webhook');
+    expect(job!.status).toBe('PENDING');
+    expect(job!.orgId).toBe(orgId);
+
+    const before = received.length;
+    await dispatcher.runOnce();
+
+    const hits = received.slice(before).filter((entry) => entry.url === '/hook');
+    expect(hits).toHaveLength(1);
+    const hit = hits[0]!;
+    const body = JSON.parse(hit.body) as Record<string, unknown>;
+    expect(body.event).toBe('submitted');
+    expect(body.formKey).toBe('webhook-form');
+    expect(body.submissionId).toBe(submissionId);
+    const data = body.data as Record<string, unknown>;
+    expect(data.title).toBe('Hello');
+    expect(data.apiKey).toBe('[REDACTED]');
+
+    const expectedSignature =
+      'sha256=' + createHmac('sha256', 'test-secret').update(hit.body).digest('hex');
+    expect(hit.signature).toBe(expectedSignature);
+
+    const delivered = await prisma.formOutboxJob.findFirst({ where: { id: job!.id } });
+    expect(delivered!.status).toBe('DONE');
+
+    const audit = await prisma.auditLog.findFirst({
+      where: { orgId, action: 'forms.outbox.delivered', targetId: job!.id },
+    });
+    expect(audit).not.toBeNull();
+    expect(audit!.actorUserId).toBe(userId);
+  });
+
+  it('retries failed webhook deliveries with backoff', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-retry');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/always-500` }]),
+    );
+
+    const submit = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ mode: 'submit', data: { title: 'Retry me' } })
+      .expect(200);
+
+    await dispatcher.runOnce();
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${submit.body.submissionId}:webhook:0` },
+    });
+    expect(job!.status).toBe('PENDING');
+    expect(job!.attempts).toBe(1);
+    expect(job!.lastError).toContain('500');
+    expect(job!.runAfter!.getTime()).toBeGreaterThan(Date.now());
+  });
+
+  it('does not enqueue webhooks for draft saves', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-draft');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/hook` }]),
+    );
+
+    const draft = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ mode: 'draft', data: { title: 'Draft only' } })
+      .expect(200);
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${draft.body.submissionId}:webhook:0` },
+    });
+    expect(job).toBeNull();
+  });
+
+  function makeDefinition(webhooks: Array<Record<string, unknown>>) {
+    return {
+      key: 'webhook-form',
+      version: 1,
+      title: 'Webhook form',
+      fields: [
+        { type: 'text', name: 'title', validators: { required: true, maxLength: 200 } },
+        { type: 'password', name: 'apiKey' },
+      ],
+      actions: { submit: ['validateAll', 'persist'], saveDraft: ['persistDraft'] },
+      settings: { webhooks },
+    };
+  }
+
+  function issueCodes(body: { error?: { details?: { issues?: Array<{ code: string }> } } }) {
+    return (body.error?.details?.issues ?? []).map((issue) => issue.code);
+  }
+
+  async function allowHosts(accessToken: string, orgId: string, hosts: string[]) {
+    await request(app.getHttpServer())
+      .patch(`/organisations/${orgId}/settings`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ key: 'forms.webhookAllowedHosts', value: hosts })
+      .expect(200);
+  }
+
+  async function createAndPublish(
+    accessToken: string,
+    orgId: string,
+    definition: Record<string, unknown>,
+  ) {
+    const created = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/${definition.key as string}/versions/${created.body.version}/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    return created.body as { version: number };
+  }
+
+  async function createUserAndOrg(label: string) {
+    const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+    const accessToken = signup.body.accessToken as string;
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ name: `${label} ${suffix}`, slug: `${label}-${suffix}` })
+      .expect(201);
+
+    return {
+      accessToken,
+      userId: signup.body.user.id as string,
+      orgId: org.body.organisation.id as string,
+    };
+  }
+});

package/template/test/frontend-bootstrap.spec.ts

@@ -0,0 +1,181 @@
+import { MembershipStatus, OrganisationStatus } from '@prisma/client';
+import { validate, parseCorsOrigins } from '../src/config/env.validation';
+import { CurrentAccessControlController } from '../src/modules/access-control/presentation/current-access-control.controller';
+import { OrganisationsService } from '../src/modules/organisations/application/services/organisations.service';
+
+describe('frontend bootstrap endpoints', () => {
+  it('returns the current effective access-control context without internal cache fields', async () => {
+    const controller = new CurrentAccessControlController({
+      getContext: jest.fn().mockResolvedValue({
+        cacheKey: 'rbac:user-1:org-1',
+        userId: 'user-1',
+        orgId: 'org-1',
+        membershipId: 'membership-1',
+        membershipStatus: MembershipStatus.ACTIVE,
+        roleId: 'role-1',
+        isOwner: false,
+        isBillingContact: true,
+        permissionKeys: ['organisations.read'],
+      }),
+    } as never);
+
+    await expect(
+      controller.me(
+        {
+          id: 'user-1',
+          email: 'user@example.com',
+          mobile: null,
+          displayName: 'User',
+          isActive: true,
+        },
+        'org-1',
+      ),
+    ).resolves.toEqual({
+      orgId: 'org-1',
+      membershipId: 'membership-1',
+      roleId: 'role-1',
+      isOwner: false,
+      isBillingContact: true,
+      permissionKeys: ['organisations.read'],
+    });
+  });
+
+  it('queries only active current-user memberships in active organisations', async () => {
+    const prisma = {
+      membership: {
+        findMany: jest.fn().mockResolvedValue([
+          {
+            id: 'membership-1',
+            roleId: 'role-1',
+            isOwner: true,
+            isBillingContact: true,
+            organisation: {
+              id: 'org-1',
+              name: 'Acme Operations',
+              slug: 'acme',
+              status: OrganisationStatus.ACTIVE,
+            },
+            role: {
+              id: 'role-1',
+              name: 'Owner',
+              description: null,
+              isSystemSeeded: true,
+            },
+          },
+          {
+            id: 'membership-2',
+            roleId: 'role-2',
+            isOwner: false,
+            isBillingContact: false,
+            organisation: {
+              id: 'org-2',
+              name: 'Beta Operations',
+              slug: 'beta',
+              status: OrganisationStatus.ACTIVE,
+            },
+            role: {
+              id: 'role-2',
+              name: 'Viewer',
+              description: null,
+              isSystemSeeded: true,
+            },
+          },
+        ]),
+      },
+    };
+    const service = new OrganisationsService({} as never, prisma as never, {} as never);
+
+    await expect(
+      service.listMine(
+        {
+          id: 'user-1',
+          email: 'user@example.com',
+          mobile: null,
+          displayName: 'User',
+          isActive: true,
+        },
+        { limit: 1 },
+      ),
+    ).resolves.toEqual({
+      items: [
+        {
+          id: 'org-1',
+          name: 'Acme Operations',
+          slug: 'acme',
+          status: OrganisationStatus.ACTIVE,
+          membershipId: 'membership-1',
+          roleId: 'role-1',
+          role: {
+            id: 'role-1',
+            name: 'Owner',
+            description: null,
+            isSystemSeeded: true,
+          },
+          isOwner: true,
+          isBillingContact: true,
+        },
+      ],
+      nextCursor: 'membership-1',
+    });
+
+    expect(prisma.membership.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: {
+          userId: 'user-1',
+          status: MembershipStatus.ACTIVE,
+          organisation: {
+            status: OrganisationStatus.ACTIVE,
+          },
+        },
+        take: 2,
+      }),
+    );
+  });
+});
+
+describe('CORS environment config', () => {
+  it('is disabled by default', () => {
+    const env = validate(baseEnv());
+
+    expect(env.CORS_ENABLED).toBe(false);
+    expect(env.CORS_ORIGINS).toBe('');
+    expect(env.CORS_CREDENTIALS).toBe(false);
+  });
+
+  it('accepts enabled CORS with exact allowed origins', () => {
+    const env = validate({
+      ...baseEnv(),
+      CORS_ENABLED: 'true',
+      CORS_ORIGINS: 'http://localhost:5173, https://app.example.com',
+      CORS_CREDENTIALS: 'true',
+    });
+
+    expect(env.CORS_ENABLED).toBe(true);
+    expect(env.CORS_CREDENTIALS).toBe(true);
+    expect(parseCorsOrigins(env.CORS_ORIGINS)).toEqual([
+      'http://localhost:5173',
+      'https://app.example.com',
+    ]);
+  });
+
+  it('rejects wildcard origins when credentials are enabled', () => {
+    expect(() =>
+      validate({
+        ...baseEnv(),
+        CORS_ENABLED: 'true',
+        CORS_ORIGINS: '*',
+        CORS_CREDENTIALS: 'true',
+      }),
+    ).toThrow(/CORS_ORIGINS cannot include \*/u);
+  });
+});
+
+function baseEnv() {
+  return {
+    NODE_ENV: 'test',
+    PORT: '3000',
+    DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/app_test',
+    JWT_SECRET: 'test-jwt-secret-at-least-32-characters',
+    AUTH_GOOGLE_ENABLED: 'false',
+  };
+}