@ftisindia/create-app 0.1.5 → 0.2.0

package/template/test/forms-files.e2e-spec.ts

@@ -0,0 +1,345 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import { DataSourceRegistry } from '@ftisindia/form-builder';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+import { FileGcService } from '../src/modules/forms/application/services/file-gc.service';
+
+const PDF_BYTES = Buffer.from('%PDF-1.4\n1 0 obj\n<<>>\nendobj\ntrailer\n<<>>\n%%EOF');
+const PNG_BYTES = Buffer.from([
+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52,
+]);
+
+describe('Forms file uploads (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let owner: { accessToken: string; userId: string; orgId: string };
+  let formKey: string;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.FORMS_FILE_STORAGE_DIR = './var/test-uploads';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+
+    // The abstract-like definition binds a select to this source; register the
+    // stub BEFORE creating the definition so save-time lint passes.
+    app.get(DataSourceRegistry).register({
+      key: 'conference-tracks',
+      fetch: () => Promise.resolve([
+        { value: 'ai', label: 'Artificial Intelligence' },
+        { value: 'ml', label: 'Machine Learning' },
+      ]),
+    });
+
+    owner = await createUserAndOrg('files-owner');
+    formKey = await publishDefinition(abstractDefinition(uniqueFormKey('abstract')));
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('rejects mismatched content (415) and accepts a sniffed PDF', async () => {
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${formKey}/files`)
+      .query({ field: 'manuscript' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .attach('file', PNG_BYTES, 'sneaky.pdf')
+      .expect(415);
+
+    const upload = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${formKey}/files`)
+      .query({ field: 'manuscript' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .attach('file', PDF_BYTES, 'manuscript.pdf');
+
+    expect([200, 201]).toContain(upload.status);
+    expect(upload.body.fileId).toBeTruthy();
+    expect(upload.body.mimeType).toBe('application/pdf');
+    expect(upload.body.status).toBe('TEMPORARY');
+    expect(upload.body.checksum).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('validates uploads against the requested version or draft submission stamp', async () => {
+    const key = await publishDefinition(abstractDefinition(uniqueFormKey('versioned-file')));
+    const draft = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ mode: 'draft', data: { title: 'Versioned upload', track: 'ai' } })
+      .expect(200);
+
+    const createdV2 = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition: abstractDefinition(key, ['image/png']) })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${owner.orgId}/forms/${key}/versions/${createdV2.body.version as number}/publish`,
+      )
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/files`)
+      .query({ field: 'manuscript' })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .attach('file', PDF_BYTES, 'manuscript.pdf')
+      .expect(415);
+
+    const pngUpload = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/files`)
+      .query({ field: 'manuscript', version: createdV2.body.version as number })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .attach('file', PNG_BYTES, 'manuscript.png');
+    expect([200, 201]).toContain(pngUpload.status);
+
+    await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${key}/files`)
+      .query({
+        field: 'manuscript',
+        submissionId: draft.body.submissionId as string,
+        version: createdV2.body.version as number,
+      })
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .attach('file', PNG_BYTES, 'manuscript.png')
+      .expect(409);
+  });
+
+  it('links the referenced file to the submission (TEMPORARY -> LINKED)', async () => {
+    const fileId = await uploadPdf(owner.accessToken);
+
+    const submitted = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${formKey}/submissions`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({
+        mode: 'submit',
+        data: { title: 'On Linking Files', track: 'ai', manuscript: { fileId } },
+      })
+      .expect(200);
+
+    const submissionId = submitted.body.submissionId as string;
+    expect(submissionId).toBeTruthy();
+
+    const row = await prisma.uploadedFile.findUnique({ where: { id: fileId } });
+    expect(row?.status).toBe('LINKED');
+    expect(row?.submissionId).toBe(submissionId);
+  });
+
+  it('rejects another member referencing a file they did not upload (IDOR)', async () => {
+    const fileId = await uploadPdf(owner.accessToken);
+    const member = await createMemberInOrg(owner.orgId, 'files-member', [
+      'formSubmissions.create',
+    ]);
+
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${formKey}/submissions`)
+      .set('Authorization', `Bearer ${member.accessToken}`)
+      .send({
+        mode: 'submit',
+        data: { title: 'Stolen Reference', track: 'ml', manuscript: { fileId } },
+      })
+      .expect(422);
+
+    const errors = response.body.error.details.errors as Array<{ code: string; path: string }>;
+    expect(errors.some((error) => error.code === 'FILE_REFERENCE')).toBe(true);
+
+    // The file is untouched.
+    const row = await prisma.uploadedFile.findUnique({ where: { id: fileId } });
+    expect(row?.status).toBe('TEMPORARY');
+  });
+
+  it('garbage-collects orphaned TEMPORARY uploads past the TTL', async () => {
+    const fileId = await uploadPdf(owner.accessToken);
+
+    await prisma.uploadedFile.update({
+      where: { id: fileId },
+      data: { createdAt: new Date(Date.now() - 365 * 24 * 60 * 60 * 1000) },
+    });
+
+    const removed = await app.get(FileGcService).runOnce();
+    expect(removed).toBeGreaterThanOrEqual(1);
+
+    const row = await prisma.uploadedFile.findUnique({ where: { id: fileId } });
+    expect(row).toBeNull();
+  });
+
+  it('refuses to flip a definition with file fields to public access', async () => {
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${formKey}/versions/1/public-access`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ access: 'public' })
+      .expect(422);
+
+    const issues = response.body.error.details.issues as Array<{ code: string }>;
+    expect(issues.map((issue) => issue.code)).toContain('PUBLIC_FILE_FIELD');
+  });
+
+  // ── Helpers ────────────────────────────────────────────────────────────────
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueFormKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function abstractDefinition(
+    key: string,
+    accept: string[] = ['application/pdf'],
+  ): Record<string, unknown> {
+    return {
+      key,
+      version: 1,
+      title: 'Scientific abstract submission',
+      fields: [
+        {
+          type: 'text',
+          name: 'title',
+          label: 'Abstract title',
+          validators: { required: true, maxLength: 200 },
+          reportable: true,
+        },
+        {
+          type: 'select',
+          name: 'track',
+          label: 'Conference track',
+          dataSource: { key: 'conference-tracks' },
+          validators: { required: true },
+          reportable: true,
+        },
+        {
+          type: 'file',
+          name: 'manuscript',
+          label: 'Full manuscript (PDF)',
+          accept,
+          maxSizeMb: 5,
+        },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+    };
+  }
+
+  async function uploadPdf(accessToken: string): Promise<string> {
+    const upload = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms/${formKey}/files`)
+      .query({ field: 'manuscript' })
+      .set('Authorization', `Bearer ${accessToken}`)
+      .attach('file', PDF_BYTES, 'manuscript.pdf');
+
+    expect([200, 201]).toContain(upload.status);
+    return upload.body.fileId as string;
+  }
+
+  async function publishDefinition(definition: Record<string, unknown>): Promise<string> {
+    const created = await request(app.getHttpServer())
+      .post(`/organisations/${owner.orgId}/forms`)
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .send({ definition })
+      .expect(201);
+
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${owner.orgId}/forms/${created.body.key as string}/versions/${created.body.version as number}/publish`,
+      )
+      .set('Authorization', `Bearer ${owner.accessToken}`)
+      .expect(200);
+
+    return created.body.key as string;
+  }
+
+  async function createUser(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const suffix = uniqueSuffix();
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${user.accessToken}`)
+      .send({
+        name: `${label} ${suffix}`,
+        slug: `${label}-${suffix}`,
+      })
+      .expect(201);
+
+    return {
+      ...user,
+      orgId: org.body.organisation.id as string,
+    };
+  }
+
+  async function createMemberInOrg(orgId: string, label: string, permissionKeys: string[]) {
+    const user = await createUser(label);
+    const permissions = await prisma.permission.findMany({
+      where: { key: { in: permissionKeys } },
+      select: { id: true },
+    });
+    expect(permissions).toHaveLength(permissionKeys.length);
+
+    const role = await prisma.role.create({
+      data: {
+        orgId,
+        name: `${label}-${uniqueSuffix()}`,
+        permissions: {
+          create: permissions.map((permission) => ({ permissionId: permission.id })),
+        },
+      },
+      select: { id: true },
+    });
+    const membership = await prisma.membership.create({
+      data: {
+        userId: user.userId,
+        orgId,
+        roleId: role.id,
+      },
+      select: { id: true, roleId: true },
+    });
+
+    return {
+      ...user,
+      membershipId: membership.id,
+      roleId: membership.roleId,
+    };
+  }
+});