@ftisindia/create-app 0.1.5 → 0.2.0

package/template/test/reports-query.e2e-spec.ts

@@ -0,0 +1,402 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request, { type Response } from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+
+/**
+ * Reports end-to-end (@ftisindia/report-builder) over the `org-members`
+ * CUSTOM source — the Phase-1 standalone milestone (report design §14): a
+ * report that filters/sorts/searches/paginates at constant cost with ZERO
+ * form-builder involvement. Creating an org seeds the owner's membership, so
+ * the source has real rows to query.
+ */
+// Cold ts-jest compile of the full app graph + boot (DI scan, schema checks,
+// Prisma connect) exceeds jest's 5s default; each test also runs many
+// sequential HTTP + DB calls.
+jest.setTimeout(60_000);
+
+describe('Reports query lifecycle (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-32-characters-long';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.REPORTS_SCHEMA_CHECK = 'on';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({ forbidNonWhitelisted: true, transform: true, whitelist: true }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('publishes a custom-source report and queries member rows (the standalone milestone)', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-pub');
+    const key = uniqueKey('members');
+
+    const draft = await api()
+      .post(`/organisations/${orgId}/reports`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send(orgMembersDefinition(key))
+      .expect(201);
+    expect(draft.body.status).toBe('DRAFT');
+    expect(draft.body.version).toBe(1);
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200)
+      .expect((res) => expect(res.body.status).toBe('PUBLISHED'));
+
+    const result = await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ pageSize: 50 })
+      .expect(200);
+
+    expect(result.body.rows).toHaveLength(1); // the owner
+    const row = result.body.rows[0];
+    expect(typeof row.$id).toBe('string');
+    expect(Array.isArray(row.$tags)).toBe(true);
+    expect(row.role).toBe('Owner');
+    expect(row.status).toBe('ACTIVE');
+    expect(typeof row.displayName).toBe('string');
+    expect(result.body.meta.reportVersion).toBe(1);
+    expect(result.body.pageInfo.hasMore).toBe(false);
+  });
+
+  it('paginates members at constant cost with keyset cursors', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-page');
+    await createMemberInOrg(orgId, 'rep-page-b', ['reports.read']);
+    await createMemberInOrg(orgId, 'rep-page-c', ['reports.read']);
+    const key = uniqueKey('page');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    // Three members; walk one row per page via the signed cursor.
+    const seen = new Set<string>();
+    let cursor: string | null = null;
+    for (let page = 0; page < 3; page += 1) {
+      const res: Response = await api()
+        .post(`/organisations/${orgId}/reports/${key}/query`)
+        .set('Authorization', `Bearer ${accessToken}`)
+        .send({ pageSize: 1, sort: [{ column: 'displayName', dir: 'asc' }], cursor })
+        .expect(200);
+      expect(res.body.rows).toHaveLength(1);
+      seen.add(res.body.rows[0].$id);
+      cursor = res.body.pageInfo.nextCursor;
+      expect(res.body.pageInfo.hasMore).toBe(page < 2);
+    }
+    expect(seen.size).toBe(3); // every page distinct — no OFFSET skips/dupes
+    expect(cursor).toBeNull();
+  });
+
+  it('filters and sorts through the typed compiler', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-filter');
+    const key = uniqueKey('filter');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ filters: [{ column: 'status', op: 'eq', value: 'ACTIVE' }] })
+      .expect(200)
+      .expect((res) => expect(res.body.rows.length).toBeGreaterThanOrEqual(1));
+
+    // A typed-operator violation is a 400 BEFORE any SQL runs (§4).
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ filters: [{ column: 'joinedAt', op: 'contains', value: 'x' }] })
+      .expect(400);
+  });
+
+  it('describes itself through the meta endpoint', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-meta');
+    const key = uniqueKey('meta');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const meta = await api()
+      .get(`/organisations/${orgId}/reports/${key}/meta`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+
+    expect(meta.body.reportVersion).toBe(1);
+    expect(meta.body.searchEnabled).toBe(true);
+    expect(meta.body.rowActions.map((a: { name: string }) => a.name)).toContain('manageTags');
+    const status = meta.body.columns.find((c: { id: string }) => c.id === 'status');
+    expect(status.operators).toEqual(expect.arrayContaining(['eq', 'in']));
+    expect(status.operators).not.toContain('contains');
+  });
+
+  it('gates queries on reports.read', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-perm');
+    const key = uniqueKey('perm');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const outsider = await createMemberInOrg(orgId, 'rep-perm-no', ['reportTags.manage']);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${outsider.accessToken}`)
+      .send({})
+      .expect(403);
+
+    const reader = await createMemberInOrg(orgId, 'rep-perm-yes', ['reports.read']);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${reader.accessToken}`)
+      .send({})
+      .expect(200);
+  });
+
+  it('saves a personal view and reports its compatibility', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-view');
+    const key = uniqueKey('view');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/views`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ name: 'Active only', spec: { filters: [{ column: 'status', op: 'eq', value: 'ACTIVE' }] } })
+      .expect(201);
+
+    const views = await api()
+      .get(`/organisations/${orgId}/reports/${key}/views`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    const list = Array.isArray(views.body) ? views.body : views.body.items;
+    expect(list).toHaveLength(1);
+    expect(list[0].compatibility.status).toBe('ok');
+  });
+
+  it('tags rows through the manageTags row action and filters on $tags', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-tag');
+    const key = uniqueKey('tag');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const first = await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({})
+      .expect(200);
+    const rowId = first.body.rows[0].$id;
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/actions/manageTags`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ selection: { byIds: [rowId] }, input: { add: ['shortlisted'] } })
+      .expect(200);
+
+    const tagged = await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ filters: [{ column: '$tags', op: 'hasTag', value: 'shortlisted' }] })
+      .expect(200);
+    expect(tagged.body.rows).toHaveLength(1);
+    expect(tagged.body.rows[0].$tags).toContain('shortlisted');
+  });
+
+  it('isolates report query, export, and byIds actions across organisations', async () => {
+    const orgA = await createUserAndOrg('rep-ten-a');
+    const orgB = await createUserAndOrg('rep-ten-b');
+    const keyA = uniqueKey('ten-a');
+    const keyB = uniqueKey('ten-b');
+    await publishOrgMembers(orgA.accessToken, orgA.orgId, keyA);
+    await publishOrgMembers(orgB.accessToken, orgB.orgId, keyB);
+
+    const orgBRows = await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/query`)
+      .set(auth(orgB.accessToken))
+      .send({})
+      .expect(200);
+    const orgBRowId = orgBRows.body.rows[0].$id as string;
+
+    await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/query`)
+      .set(auth(orgA.accessToken))
+      .send({})
+      .expect(403);
+
+    await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/export`)
+      .set(auth(orgA.accessToken))
+      .send({ format: 'csv' })
+      .expect(403);
+
+    await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/actions/manageTags`)
+      .set(auth(orgA.accessToken))
+      .send({ selection: { byIds: [orgBRowId] }, input: { add: ['cross-org-leak'] } })
+      .expect(403);
+
+    const crossOrgIdSelection = await api()
+      .post(`/organisations/${orgA.orgId}/reports/${keyA}/actions/manageTags`)
+      .set(auth(orgA.accessToken))
+      .send({ selection: { byIds: [orgBRowId] }, input: { add: ['cross-org-leak'] } })
+      .expect(200);
+    expect(crossOrgIdSelection.body.affectedRows).toBe(0);
+
+    const orgBTagged = await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/query`)
+      .set(auth(orgB.accessToken))
+      .send({ filters: [{ column: '$tags', op: 'hasTag', value: 'cross-org-leak' }] })
+      .expect(200);
+    expect(orgBTagged.body.rows).toHaveLength(0);
+  });
+
+  it('streams a snapshot-consistent CSV export, gated by reports.export', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-export');
+    const key = uniqueKey('export');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const csv = await api()
+      .post(`/organisations/${orgId}/reports/${key}/export`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ format: 'csv' })
+      .expect(200);
+    expect(csv.headers['content-disposition']).toContain('attachment');
+    expect(csv.text).toContain('Name'); // the displayName header
+    expect(csv.text.split(/\r?\n/).filter(Boolean).length).toBeGreaterThanOrEqual(2);
+
+    // A member without reports.export cannot egress (never implied by read).
+    const reader = await createMemberInOrg(orgId, 'rep-export-no', ['reports.read']);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/export`)
+      .set('Authorization', `Bearer ${reader.accessToken}`)
+      .send({ format: 'csv' })
+      .expect(403);
+  });
+
+  it('rejects a definition that smuggles SQL into a column path (the §2.1 boundary)', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-sql');
+    const def = orgMembersDefinition(uniqueKey('sql'));
+    (def.columns as Array<Record<string, unknown>>).push({
+      id: 'evil',
+      header: 'Evil',
+      path: "name'); DROP TABLE \"User\"; --",
+      type: 'text',
+    });
+    await api()
+      .post(`/organisations/${orgId}/reports`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send(def)
+      .expect(422);
+  });
+
+  // ── helpers (mirrors the forms e2e harness) ─────────────────────────────────
+
+  function api() {
+    return request(app.getHttpServer());
+  }
+
+  function auth(token: string) {
+    return { Authorization: `Bearer ${token}` };
+  }
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function orgMembersDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      title: 'Organisation members',
+      source: { kind: 'custom', key: 'org-members' },
+      columns: [
+        { id: 'displayName', header: 'Name', columnId: 'displayName', type: 'text', sortable: true, filterable: true, searchable: true },
+        { id: 'email', header: 'Email', columnId: 'email', type: 'text', sortable: true, filterable: true },
+        { id: 'role', header: 'Role', columnId: 'role', type: 'text', sortable: true, filterable: true },
+        { id: 'status', header: 'Status', columnId: 'status', type: 'enum', filterable: true, enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'] },
+        { id: 'joinedAt', header: 'Joined', columnId: 'joinedAt', type: 'datetime', sortable: true },
+      ],
+      defaultSort: [{ column: 'joinedAt', dir: 'desc' }],
+      search: { columns: ['displayName'] },
+      rowActions: ['manageTags'],
+      export: { formats: ['csv', 'xlsx'] },
+      performanceTier: 'live',
+    };
+  }
+
+  async function publishOrgMembers(accessToken: string, orgId: string, key: string) {
+    await api()
+      .post(`/organisations/${orgId}/reports`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send(orgMembersDefinition(key))
+      .expect(201);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+  }
+
+  async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const org = await createOrganisation(user.accessToken, label);
+    return { ...user, orgId: org.orgId, membershipId: org.membershipId };
+  }
+
+  async function createUser(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await api()
+      .post('/auth/signup')
+      .send({ email: `${label}-${suffix}@example.com`, password: 'test-password-123', displayName: label })
+      .expect(201);
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createOrganisation(accessToken: string, label: string) {
+    const suffix = uniqueSuffix();
+    const org = await api()
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ name: `${label} ${suffix}`, slug: `${label}-${suffix}` })
+      .expect(201);
+    return {
+      orgId: org.body.organisation.id as string,
+      membershipId: org.body.membership.id as string,
+    };
+  }
+
+  async function createMemberInOrg(orgId: string, label: string, permissionKeys: string[]) {
+    const user = await createUser(label);
+    const permissions = await prisma.permission.findMany({
+      where: { key: { in: permissionKeys } },
+      select: { id: true },
+    });
+    expect(permissions).toHaveLength(permissionKeys.length);
+    const role = await prisma.role.create({
+      data: {
+        orgId,
+        name: `${label}-${uniqueSuffix()}`,
+        permissions: { create: permissions.map((permission) => ({ permissionId: permission.id })) },
+      },
+      select: { id: true },
+    });
+    const membership = await prisma.membership.create({
+      data: { userId: user.userId, orgId, roleId: role.id },
+      select: { id: true, roleId: true },
+    });
+    return { ...user, membershipId: membership.id, roleId: membership.roleId };
+  }
+});