@ftisindia/create-app 0.1.5 → 0.2.0

package/template/test/forms-captcha.e2e-spec.ts

@@ -0,0 +1,163 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import type { CaptchaVerifier } from '@ftisindia/form-builder';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { FORMS_CAPTCHA_VERIFIER } from '../src/modules/forms/forms.tokens';
+
+describe('Forms captcha seam (e2e)', () => {
+  let app: INestApplication;
+  let owner: { accessToken: string; orgId: string };
+  let formKey: string;
+  const seenTokens: string[] = [];
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+
+    const captcha: CaptchaVerifier = {
+      verify: (token) => {
+        seenTokens.push(token);
+        return Promise.resolve(token === 'valid-token');
+      },
+    };
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({ imports: [AppModule] })
+      .overrideProvider(FORMS_CAPTCHA_VERIFIER)
+      .useValue(captcha)
+      .compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+
+    owner = await createUserAndOrg('captcha-owner');
+    formKey = await publishDefinition(publicCaptchaDefinition(uniqueFormKey('captcha')));
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('rejects missing or invalid tokens and accepts a valid captcha token', async () => {
+    const payload = {
+      data: {
+        fullName: 'Captcha User',
+        email: 'captcha@example.com',
+        ticketType: 'standard',
+      },
+    };
+
+    await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${formKey}/submissions`)
+      .send(payload)
+      .expect(422);
+
+    await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${formKey}/submissions`)
+      .send({ ...payload, captchaToken: 'invalid-token' })
+      .expect(422);
+
+    const submitted = await request(app.getHttpServer())
+      .post(`/public/organisations/${owner.orgId}/forms/${formKey}/submissions`)
+      .send({ ...payload, captchaToken: 'valid-token' })
+      .expect(200);
+
+    expect(submitted.body.submissionId).toBeTruthy();
+    expect(seenTokens).toEqual(['invalid-token', 'valid-token']);
+  });
+
+  function publicCaptchaDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Captcha public form',
+      settings: { access: 'public', captcha: true },
+      fields: [
+        {
+          type: 'text',
+          name: 'fullName',
+          validators: { required: true, maxLength: 120 },
+        },
+        {
+          type: 'email',
+          name: 'email',
+          validators: { required: true },
+        },
+        {
+          type: 'select',
+          name: 'ticketType',
+          validators: { required: true, options: ['standard', 'student', 'vip'] },
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  async function publishDefinition(definition: Record<string, unknown>): Promise<string> {
+    const created = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${owner.orgId}/forms/${definition.key as string}/versions/${created.body.version as number}/publish`,
+      )
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    return definition.key as string;
+  }
+
+  async function createUserAndOrg(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+
+    const accessToken = signup.body.accessToken as string;
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        name: `${label} ${suffix}`,
+        slug: `${label}-${suffix}`,
+      })
+      .expect(201);
+
+    return {
+      accessToken,
+      orgId: org.body.organisation.id as string,
+    };
+  }
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueFormKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+});

package/template/test/forms-definitions.e2e-spec.ts

@@ -0,0 +1,394 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+
+describe('Forms definitions lifecycle (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.FORMS_FILE_STORAGE_DIR = './var/test-uploads';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('creates drafts with incrementing versions for the same key', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('def-draft');
+    const key = uniqueFormKey('draft');
+
+    const first = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+
+    expect(first.body.status).toBe('DRAFT');
+    expect(first.body.version).toBe(1);
+    expect(first.body.key).toBe(key);
+
+    const second = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+
+    expect(second.body.status).toBe('DRAFT');
+    expect(second.body.version).toBe(2);
+  });
+
+  it('rejects definitions with an unknown field type at save time', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('def-lint');
+    const definition = registrationDefinition(uniqueFormKey('lint'));
+    (definition.fields as Array<Record<string, unknown>>).push({
+      type: 'no-such-type',
+      name: 'mysteryField',
+    });
+
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition })
+      .expect(422);
+
+    const issues = response.body.error.details.issues as Array<{ code: string }>;
+    expect(issues.map((issue) => issue.code)).toContain('UNKNOWN_FIELD_TYPE');
+  });
+
+  it('publishes, freezes published versions, auto-archives priors, and audits', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('def-publish');
+    const key = uniqueFormKey('publish');
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+
+    const published = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/${key}/versions/1/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    expect(published.body.status).toBe('PUBLISHED');
+
+    // Published versions are immutable.
+    await request(app.getHttpServer())
+      .patch(`/organisations/${orgId}/forms/${key}/versions/1`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(409);
+
+    // Publish version 2: version 1 must be auto-archived.
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/${key}/versions/2/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+
+    const versionOne = await request(app.getHttpServer())
+      .get(`/organisations/${orgId}/forms/${key}/versions/1`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    expect(versionOne.body.status).toBe('ARCHIVED');
+
+    const auditRows = await prisma.auditLog.findMany({
+      where: { orgId, action: { in: ['forms.create', 'forms.publish'] } },
+    });
+    expect(auditRows.some((row) => row.action === 'forms.create')).toBe(true);
+    expect(auditRows.some((row) => row.action === 'forms.publish')).toBe(true);
+  });
+
+  it('gates dangerous-action wiring at attach time (permission and allowlist)', async () => {
+    const owner = await createUserAndOrg('def-dangerous');
+    const member = await createMemberInOrg(owner.orgId, 'def-dangerous-member', [
+      'forms.read',
+      'forms.create',
+      'forms.update',
+      'forms.publish',
+    ]);
+
+    // Member lacks forms.wireDangerous.
+    const memberAttempt = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .send({ definition: authenticateDefinition(uniqueFormKey('login-member')) })
+      .expect(422);
+    const memberIssues = memberAttempt.body.error.details.issues as Array<{ code: string }>;
+    expect(memberIssues.map((issue) => issue.code)).toContain('DANGEROUS_NOT_ALLOWED');
+
+    // Owner passes wireDangerous (manage all) but the org allowlist is empty.
+    const ownerAttempt = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: authenticateDefinition(uniqueFormKey('login-owner')) })
+      .expect(422);
+    const ownerIssues = ownerAttempt.body.error.details.issues as Array<{ code: string }>;
+    expect(ownerIssues.map((issue) => issue.code)).toContain('DANGEROUS_NOT_IN_ALLOWLIST');
+    expect(ownerIssues.map((issue) => issue.code)).not.toContain('DANGEROUS_NOT_ALLOWED');
+
+    // With the org allowlist set, owner create + publish succeeds.
+    await setOrgSetting(owner.accessToken, owner.orgId, 'forms.allowedDangerousActions', [
+      'authenticate',
+    ]);
+    const key = uniqueFormKey('login-allowed');
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: authenticateDefinition(key) })
+      .expect(201);
+    const published = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/publish`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+    expect(published.body.status).toBe('PUBLISHED');
+  });
+
+  it('gates public-access flips by forms.managePublicAccess and audits them', async () => {
+    const owner = await createUserAndOrg('def-public-access');
+    const member = await createMemberInOrg(owner.orgId, 'def-public-member', ['forms.read']);
+    const key = uniqueFormKey('flip');
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: registrationDefinition(key) })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/publish`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/public-access`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .send({ access: 'public' })
+      .expect(403);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/versions/1/public-access`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ access: 'public' })
+      .expect(200);
+
+    const auditRow = await prisma.auditLog.findFirst({
+      where: { orgId: owner.orgId, action: 'forms.publicAccess.update' },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(auditRow).not.toBeNull();
+    const metadata = auditRow?.metadata as { previous?: string; next?: string };
+    expect(metadata.previous).toBe('private');
+    expect(metadata.next).toBe('public');
+  });
+
+  it('denies cross-org definition access (403 cross-tenant, 404 foreign key)', async () => {
+    const orgA = await createUserAndOrg('def-cross-a');
+    const orgB = await createUserAndOrg('def-cross-b');
+    const keyA = uniqueFormKey('cross');
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${orgA.orgId}/forms`)
+      .set('Authorization', `Bearer ${orgA.accessToken}`)
+      .send({ definition: registrationDefinition(keyA) })
+      .expect(201);
+
+    // Org B's owner against org A's path: not a member, denied outright.
+    await request(app.getHttpServer())
+      .get(`/organisations/${orgA.orgId}/forms/${keyA}`)
+      .set('Authorization', `Bearer ${orgB.accessToken}`)
+      .expect(403);
+
+    // Org A's key under org B's own path: scoped lookup finds nothing.
+    await request(app.getHttpServer())
+      .get(`/organisations/${orgB.orgId}/forms/${keyA}`)
+      .set('Authorization', `Bearer ${orgB.accessToken}`)
+      .expect(404);
+  });
+
+  // ── Helpers ────────────────────────────────────────────────────────────────
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueFormKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function registrationDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Event registration',
+      fields: [
+        {
+          type: 'text',
+          name: 'fullName',
+          label: 'Full name',
+          validators: { required: true, maxLength: 120 },
+          reportable: true,
+        },
+        {
+          type: 'email',
+          name: 'email',
+          label: 'Email address',
+          validators: { required: true },
+          reportable: true,
+        },
+        {
+          type: 'select',
+          name: 'ticketType',
+          label: 'Ticket type',
+          validators: { required: true, options: ['standard', 'student', 'vip'] },
+          reportable: true,
+        },
+        {
+          type: 'hidden',
+          name: 'registeredBy',
+          source: 'context',
+          path: 'user.id',
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  function authenticateDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Sign in',
+      fields: [
+        { type: 'email', name: 'email', label: 'Email address', validators: { required: true } },
+        {
+          type: 'password',
+          name: 'password',
+          label: 'Password',
+          validators: { required: true, minLength: 8 },
+        },
+      ],
+      actions: {
+        submit: ['authenticate'],
+      },
+    };
+  }
+
+  async function setOrgSetting(accessToken: string, orgId: string, key: string, value: unknown) {
+    await request(app.getHttpServer())
+      .patch(`/organisations/${orgId}/settings`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ key, value })
+      .expect(200);
+  }
+
+  async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const org = await createOrganisation(user.accessToken, label);
+
+    return {
+      ...user,
+      orgId: org.orgId,
+      membershipId: org.membershipId,
+    };
+  }
+
+  async function createUser(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createOrganisation(accessToken: string, label: string) {
+    const suffix = uniqueSuffix();
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        name: `${label} ${suffix}`,
+        slug: `${label}-${suffix}`,
+      })
+      .expect(201);
+
+    return {
+      orgId: org.body.organisation.id as string,
+      membershipId: org.body.membership.id as string,
+    };
+  }
+
+  async function createMemberInOrg(orgId: string, label: string, permissionKeys: string[]) {
+    const user = await createUser(label);
+    const permissions = await prisma.permission.findMany({
+      where: { key: { in: permissionKeys } },
+      select: { id: true },
+    });
+    expect(permissions).toHaveLength(permissionKeys.length);
+
+    const role = await prisma.role.create({
+      data: {
+        orgId,
+        name: `${label}-${uniqueSuffix()}`,
+        permissions: {
+          create: permissions.map((permission) => ({ permissionId: permission.id })),
+        },
+      },
+      select: { id: true },
+    });
+    const membership = await prisma.membership.create({
+      data: {
+        userId: user.userId,
+        orgId,
+        roleId: role.id,
+      },
+      select: { id: true, roleId: true },
+    });
+
+    return {
+      ...user,
+      membershipId: membership.id,
+      roleId: membership.roleId,
+    };
+  }
+});