@ftisindia/create-app 0.1.6 → 0.2.0

package/template/test/forms-webhooks.e2e-spec.ts

@@ -11,6 +11,7 @@ import { OutboxDispatcherService } from '../src/modules/forms/application/servic
 interface CapturedRequest {
   url: string;
   signature: string | undefined;
+  idempotencyKey: string | undefined;
   body: string;
 }
 
@@ -37,8 +38,15 @@ describe('Forms submission webhooks (e2e)', () => {
         received.push({
           url: req.url ?? '',
           signature: req.headers['x-forms-signature'] as string | undefined,
+          idempotencyKey: req.headers['x-forms-idempotency-key'] as string | undefined,
           body: Buffer.concat(chunks).toString('utf8'),
         });
+        if (req.url === '/redirect-metadata') {
+          res.statusCode = 302;
+          res.setHeader('location', 'http://169.254.169.254/latest/meta-data/');
+          res.end();
+          return;
+        }
         res.statusCode = req.url === '/always-500' ? 500 : 200;
         res.end();
       });
@@ -54,11 +62,23 @@ describe('Forms submission webhooks (e2e)', () => {
     app = moduleRef.createNestApplication();
     app.useGlobalFilters(new HttpExceptionFilter());
     app.useGlobalPipes(
-      new ValidationPipe({ forbidNonWhitelisted: true, transform: true, whitelist: true }),
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
     );
     await app.init();
     prisma = app.get(PrismaService);
     dispatcher = app.get(OutboxDispatcherService);
+    await prisma.formOutboxJob.updateMany({
+      where: { status: { in: ['PENDING', 'PROCESSING'] } },
+      data: {
+        status: 'FAILED',
+        claimedBy: null,
+        lastError: 'parked by forms-webhooks e2e setup',
+      },
+    });
   });
 
   afterAll(async () => {
@@ -73,7 +93,9 @@ describe('Forms submission webhooks (e2e)', () => {
     const response = await request(app.getHttpServer())
       .post(`/organisations/${orgId}/forms`)
       .set('Authorization', `Bearer ${accessToken}`)
-      .send({ definition: makeDefinition([{ url: 'https://hooks.example.com/x' }]) })
+      .send({
+        definition: makeDefinition([{ url: 'https://hooks.example.com/x' }]),
+      })
       .expect(422);
 
     const codes = issueCodes(response.body);
@@ -87,7 +109,9 @@ describe('Forms submission webhooks (e2e)', () => {
     const response = await request(app.getHttpServer())
       .post(`/organisations/${orgId}/forms`)
       .set('Authorization', `Bearer ${accessToken}`)
-      .send({ definition: makeDefinition([{ url: 'http://hooks.example.com/x' }]) })
+      .send({
+        definition: makeDefinition([{ url: 'http://hooks.example.com/x' }]),
+      })
       .expect(422);
 
     expect(issueCodes(response.body)).toContain('WEBHOOK_URL_INSECURE');
@@ -105,7 +129,10 @@ describe('Forms submission webhooks (e2e)', () => {
     const submit = await request(app.getHttpServer())
       .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
       .set('Authorization', `Bearer ${accessToken}`)
-      .send({ mode: 'submit', data: { title: 'Hello', apiKey: 'super-secret-key' } })
+      .send({
+        mode: 'submit',
+        data: { title: 'Hello', apiKey: 'super-secret-key' },
+      })
       .expect(200);
     const submissionId = submit.body.submissionId as string;
 
@@ -116,6 +143,9 @@ describe('Forms submission webhooks (e2e)', () => {
     expect(job!.type).toBe('webhook');
     expect(job!.status).toBe('PENDING');
     expect(job!.orgId).toBe(orgId);
+    const payload = job!.payload as Record<string, unknown>;
+    expect(payload.secret).toBeUndefined();
+    expect(payload.signature).toEqual(expect.stringMatching(/^sha256=/));
 
     const before = received.length;
     await dispatcher.runOnce();
@@ -134,8 +164,11 @@ describe('Forms submission webhooks (e2e)', () => {
     const expectedSignature =
       'sha256=' + createHmac('sha256', 'test-secret').update(hit.body).digest('hex');
     expect(hit.signature).toBe(expectedSignature);
+    expect(hit.idempotencyKey).toBe(`${submissionId}:webhook:0`);
 
-    const delivered = await prisma.formOutboxJob.findFirst({ where: { id: job!.id } });
+    const delivered = await prisma.formOutboxJob.findFirst({
+      where: { id: job!.id },
+    });
     expect(delivered!.status).toBe('DONE');
 
     const audit = await prisma.auditLog.findFirst({
@@ -145,6 +178,43 @@ describe('Forms submission webhooks (e2e)', () => {
     expect(audit!.actorUserId).toBe(userId);
   });
 
+  it('sanitizes legacy webhook payloads that still contain a secret', async () => {
+    const { orgId, userId } = await createUserAndOrg('wh-legacy-secret');
+    const body = { event: 'submitted', formKey: 'legacy-webhook' };
+    const job = await prisma.formOutboxJob.create({
+      data: {
+        type: 'webhook',
+        payload: {
+          url: `http://127.0.0.1:${port}/legacy`,
+          body,
+          secret: 'legacy-secret',
+        },
+        status: 'PENDING',
+        attempts: 0,
+        maxAttempts: 3,
+        orgId,
+        actorUserId: userId,
+      },
+    });
+
+    const before = received.length;
+    await dispatcher.runOnce();
+
+    const hits = received.slice(before).filter((entry) => entry.url === '/legacy');
+    expect(hits).toHaveLength(1);
+    const expectedSignature =
+      'sha256=' + createHmac('sha256', 'legacy-secret').update(hits[0]!.body).digest('hex');
+    expect(hits[0]!.signature).toBe(expectedSignature);
+
+    const delivered = await prisma.formOutboxJob.findUnique({ where: { id: job.id } });
+    expect(delivered?.status).toBe('DONE');
+    const sanitized = delivered!.payload as Record<string, unknown>;
+    expect(sanitized.secret).toBeUndefined();
+    expect(sanitized.body).toBeUndefined();
+    expect(sanitized.rawBody).toBe(JSON.stringify(body));
+    expect(sanitized.signature).toBe(expectedSignature);
+  });
+
   it('retries failed webhook deliveries with backoff', async () => {
     const { accessToken, orgId } = await createUserAndOrg('wh-retry');
     await allowHosts(accessToken, orgId, ['127.0.0.1']);
@@ -171,6 +241,69 @@ describe('Forms submission webhooks (e2e)', () => {
     expect(job!.runAfter!.getTime()).toBeGreaterThan(Date.now());
   });
 
+  it('does not follow webhook redirects during delivery', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-redirect');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/redirect-metadata` }]),
+    );
+
+    const submit = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ mode: 'submit', data: { title: 'Redirect me' } })
+      .expect(200);
+
+    const before = received.length;
+    await dispatcher.runOnce();
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${submit.body.submissionId}:webhook:0` },
+    });
+    expect(job!.status).toBe('PENDING');
+    expect(job!.attempts).toBe(1);
+    expect(job!.lastError).toContain('redirects are not allowed');
+    const redirectHits = received
+      .slice(before)
+      .filter((entry) => entry.url === '/redirect-metadata');
+    expect(redirectHits).toHaveLength(1);
+  });
+
+  it('rejects private and link-local webhook destinations at delivery in production', async () => {
+    const { orgId, userId } = await createUserAndOrg('wh-private-delivery');
+    const previousNodeEnv = process.env.NODE_ENV;
+    process.env.NODE_ENV = 'production';
+    try {
+      const job = await prisma.formOutboxJob.create({
+        data: {
+          type: 'webhook',
+          payload: {
+            url: 'https://169.254.169.254/latest/meta-data/',
+            body: { event: 'submitted' },
+          },
+          status: 'PENDING',
+          attempts: 0,
+          maxAttempts: 3,
+          orgId,
+          actorUserId: userId,
+        },
+      });
+
+      await dispatcher.runOnce();
+
+      const retried = await prisma.formOutboxJob.findUnique({
+        where: { id: job.id },
+      });
+      expect(retried!.status).toBe('PENDING');
+      expect(retried!.attempts).toBe(1);
+      expect(retried!.lastError).toContain('private or reserved address');
+    } finally {
+      process.env.NODE_ENV = previousNodeEnv;
+    }
+  });
+
   it('does not enqueue webhooks for draft saves', async () => {
     const { accessToken, orgId } = await createUserAndOrg('wh-draft');
     await allowHosts(accessToken, orgId, ['127.0.0.1']);
@@ -198,10 +331,17 @@ describe('Forms submission webhooks (e2e)', () => {
       version: 1,
       title: 'Webhook form',
       fields: [
-        { type: 'text', name: 'title', validators: { required: true, maxLength: 200 } },
+        {
+          type: 'text',
+          name: 'title',
+          validators: { required: true, maxLength: 200 },
+        },
         { type: 'password', name: 'apiKey' },
       ],
-      actions: { submit: ['validateAll', 'persist'], saveDraft: ['persistDraft'] },
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
       settings: { webhooks },
     };
   }
@@ -229,7 +369,9 @@ describe('Forms submission webhooks (e2e)', () => {
       .send({ definition })
       .expect(201);
     await request(app.getHttpServer())
-      .post(`/organisations/${orgId}/forms/${definition.key as string}/versions/${created.body.version}/publish`)
+      .post(
+        `/organisations/${orgId}/forms/${definition.key as string}/versions/${created.body.version}/publish`,
+      )
       .set('Authorization', `Bearer ${accessToken}`)
       .expect(200);
     return created.body as { version: number };

package/template/test/jest-e2e.json

@@ -3,6 +3,7 @@
   "rootDir": "..",
   "testEnvironment": "node",
   "testRegex": ".e2e-spec.ts$",
+  "testTimeout": 30000,
   "transform": {
     "^.+\\.(t|j)s$": "ts-jest"
   }

package/template/test/reports-advanced.e2e-spec.ts

@@ -167,6 +167,19 @@ describe('Reports advanced lifecycle (e2e)', () => {
     expect(download.headers['content-disposition']).toContain('attachment');
     expect(download.text).toContain('Name');
     expect(download.text.split(/\r?\n/).filter(Boolean).length).toBe(3); // header + 2 rows
+
+    await prisma.reportExportJob.update({
+      where: { id: jobId },
+      data: { updatedAt: new Date(Date.now() - 365 * 24 * 60 * 60 * 1000) },
+    });
+    await expect(dispatcher.cleanupExpiredFiles()).resolves.toBeGreaterThanOrEqual(1);
+
+    const expired = await prisma.reportExportJob.findUnique({ where: { id: jobId } });
+    expect(expired?.fileId).toBeNull();
+    await api()
+      .get(`/organisations/${orgId}/reports/exports/${jobId}/download`)
+      .set(auth(accessToken))
+      .expect(404);
   });
 
   it('streams a structurally valid XLSX synchronously', async () => {

package/template/test/reports-query.e2e-spec.ts

@@ -210,6 +210,54 @@ describe('Reports query lifecycle (e2e)', () => {
     expect(tagged.body.rows[0].$tags).toContain('shortlisted');
   });
 
+  it('isolates report query, export, and byIds actions across organisations', async () => {
+    const orgA = await createUserAndOrg('rep-ten-a');
+    const orgB = await createUserAndOrg('rep-ten-b');
+    const keyA = uniqueKey('ten-a');
+    const keyB = uniqueKey('ten-b');
+    await publishOrgMembers(orgA.accessToken, orgA.orgId, keyA);
+    await publishOrgMembers(orgB.accessToken, orgB.orgId, keyB);
+
+    const orgBRows = await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/query`)
+      .set(auth(orgB.accessToken))
+      .send({})
+      .expect(200);
+    const orgBRowId = orgBRows.body.rows[0].$id as string;
+
+    await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/query`)
+      .set(auth(orgA.accessToken))
+      .send({})
+      .expect(403);
+
+    await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/export`)
+      .set(auth(orgA.accessToken))
+      .send({ format: 'csv' })
+      .expect(403);
+
+    await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/actions/manageTags`)
+      .set(auth(orgA.accessToken))
+      .send({ selection: { byIds: [orgBRowId] }, input: { add: ['cross-org-leak'] } })
+      .expect(403);
+
+    const crossOrgIdSelection = await api()
+      .post(`/organisations/${orgA.orgId}/reports/${keyA}/actions/manageTags`)
+      .set(auth(orgA.accessToken))
+      .send({ selection: { byIds: [orgBRowId] }, input: { add: ['cross-org-leak'] } })
+      .expect(200);
+    expect(crossOrgIdSelection.body.affectedRows).toBe(0);
+
+    const orgBTagged = await api()
+      .post(`/organisations/${orgB.orgId}/reports/${keyB}/query`)
+      .set(auth(orgB.accessToken))
+      .send({ filters: [{ column: '$tags', op: 'hasTag', value: 'cross-org-leak' }] })
+      .expect(200);
+    expect(orgBTagged.body.rows).toHaveLength(0);
+  });
+
   it('streams a snapshot-consistent CSV export, gated by reports.export', async () => {
     const { accessToken, orgId } = await createUserAndOrg('rep-export');
     const key = uniqueKey('export');
@@ -255,6 +303,10 @@ describe('Reports query lifecycle (e2e)', () => {
     return request(app.getHttpServer());
   }
 
+  function auth(token: string) {
+    return { Authorization: `Bearer ${token}` };
+  }
+
   function uniqueSuffix() {
     return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   }

package/template/test/reports-tiers.e2e-spec.ts

@@ -31,12 +31,18 @@ describe('Reports performance tiers + schema check (e2e)', () => {
     process.env.REPORTS_EXPORT_WORKER_ENABLED = 'false';
 
     const { AppModule } = await import('../src/app.module');
-    const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
 
     app = moduleRef.createNestApplication();
     app.useGlobalFilters(new HttpExceptionFilter());
     app.useGlobalPipes(
-      new ValidationPipe({ forbidNonWhitelisted: true, transform: true, whitelist: true }),
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
     );
     await app.init();
     prisma = app.get(PrismaService);
@@ -59,7 +65,11 @@ describe('Reports performance tiers + schema check (e2e)', () => {
     const def = indexedDefinition(key, sourceKey);
 
     try {
-      await api().post(`/organisations/${orgId}/reports`).set(auth(accessToken)).send(def).expect(201);
+      await api()
+        .post(`/organisations/${orgId}/reports`)
+        .set(auth(accessToken))
+        .send(def)
+        .expect(201);
 
       // Publish runs the catalog lint: the declared indexes do not exist yet,
       // so it fails CONSTRUCTIVELY with the exact CREATE INDEX SQL (§8).
@@ -71,8 +81,12 @@ describe('Reports performance tiers + schema check (e2e)', () => {
       expect(JSON.stringify(failed.body)).toContain(statusIdx);
 
       // Apply the suggested indexes (org-leading btrees on the physical columns).
-      await prisma.$executeRawUnsafe(`CREATE INDEX "${statusIdx}" ON "Membership" ("orgId", "status")`);
-      await prisma.$executeRawUnsafe(`CREATE INDEX "${joinedIdx}" ON "Membership" ("orgId", "createdAt")`);
+      await prisma.$executeRawUnsafe(
+        `CREATE INDEX "${statusIdx}" ON "Membership" ("orgId", "status")`,
+      );
+      await prisma.$executeRawUnsafe(
+        `CREATE INDEX "${joinedIdx}" ON "Membership" ("orgId", "createdAt")`,
+      );
 
       // The SAME draft now publishes: catalog + plan lint pass.
       await api()
@@ -113,15 +127,35 @@ describe('Reports performance tiers + schema check (e2e)', () => {
         title: 'Member stats (materialized)',
         source: { kind: 'custom', key: sourceKey },
         columns: [
-          { id: 'status', header: 'Status', columnId: 'status', type: 'enum', filterable: true, enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'] },
-          { id: 'joinedAt', header: 'Joined', columnId: 'joinedAt', type: 'datetime', sortable: true },
+          {
+            id: 'status',
+            header: 'Status',
+            columnId: 'status',
+            type: 'enum',
+            filterable: true,
+            enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'],
+          },
+          {
+            id: 'joinedAt',
+            header: 'Joined',
+            columnId: 'joinedAt',
+            type: 'datetime',
+            sortable: true,
+          },
         ],
         defaultSort: [{ column: 'joinedAt', dir: 'desc' }],
         performanceTier: 'materialized',
       };
 
-      await api().post(`/organisations/${orgId}/reports`).set(auth(accessToken)).send(def).expect(201);
-      await api().post(`/organisations/${orgId}/reports/${key}/publish`).set(auth(accessToken)).expect(200);
+      await api()
+        .post(`/organisations/${orgId}/reports`)
+        .set(auth(accessToken))
+        .send(def)
+        .expect(201);
+      await api()
+        .post(`/organisations/${orgId}/reports/${key}/publish`)
+        .set(auth(accessToken))
+        .expect(200);
 
       const result = await api()
         .post(`/organisations/${orgId}/reports/${key}/query`)
@@ -161,8 +195,22 @@ describe('Reports performance tiers + schema check (e2e)', () => {
       title: 'Indexed members',
       source: { kind: 'custom', key: sourceKey },
       columns: [
-        { id: 'status', header: 'Status', columnId: 'status', type: 'enum', filterable: true, sortable: true, enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'] },
-        { id: 'joinedAt', header: 'Joined', columnId: 'joinedAt', type: 'datetime', sortable: true },
+        {
+          id: 'status',
+          header: 'Status',
+          columnId: 'status',
+          type: 'enum',
+          filterable: true,
+          sortable: true,
+          enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'],
+        },
+        {
+          id: 'joinedAt',
+          header: 'Joined',
+          columnId: 'joinedAt',
+          type: 'datetime',
+          sortable: true,
+        },
       ],
       defaultSort: [{ column: 'joinedAt', dir: 'desc' }],
       performanceTier: 'indexed',
@@ -183,7 +231,12 @@ describe('Reports performance tiers + schema check (e2e)', () => {
             filterable: true,
             sortable: true,
             nullable: false,
-            index: { name: statusIdx, kind: 'btree', table: 'Membership', expr: '"orgId", "status"' },
+            index: {
+              name: statusIdx,
+              kind: 'btree',
+              table: 'Membership',
+              expr: '"orgId", "status"',
+            },
           },
           {
             id: 'joinedAt',
@@ -192,11 +245,20 @@ describe('Reports performance tiers + schema check (e2e)', () => {
             valueKind: 'native',
             sortable: true,
             nullable: false,
-            index: { name: joinedIdx, kind: 'btree', table: 'Membership', expr: '"orgId", "createdAt"' },
+            index: {
+              name: joinedIdx,
+              kind: 'btree',
+              table: 'Membership',
+              expr: '"orgId", "createdAt"',
+            },
           },
         ],
       }),
-      baseQuery: () => ({ from: '"Membership" m', orgColumn: 'm."orgId"', primaryTable: 'Membership' }),
+      baseQuery: () => ({
+        from: '"Membership" m',
+        orgColumn: 'm."orgId"',
+        primaryTable: 'Membership',
+      }),
     };
   }
 
@@ -207,13 +269,31 @@ describe('Reports performance tiers + schema check (e2e)', () => {
         rowId: 'm."id"',
         orgScoped: true,
         columns: [
-          { id: 'status', sql: '"status"', type: 'enum', filterable: true, nullable: false },
-          { id: 'joinedAt', sql: '"joinedAt"', type: 'datetime', valueKind: 'native', sortable: true, nullable: false },
+          {
+            id: 'status',
+            sql: '"status"',
+            type: 'enum',
+            filterable: true,
+            nullable: false,
+          },
+          {
+            id: 'joinedAt',
+            sql: '"joinedAt"',
+            type: 'datetime',
+            valueKind: 'native',
+            sortable: true,
+            nullable: false,
+          },
         ],
-        materialization: { relation: mv, orgColumn: '"orgId"', rowIdColumn: 'rowId', stalenessSeconds: 300 },
+        materialization: {
+          relation: mv,
+          orgColumn: '"orgId"',
+          rowIdColumn: 'rowId',
+          stalenessSeconds: 300,
+        },
       }),
       baseQuery: () => ({ from: mv, orgColumn: '"orgId"', primaryTable: mv }),
-      freshAsOf: async () => new Date(),
+      freshAsOf: () => Promise.resolve(new Date()),
     };
   }
 
@@ -233,7 +313,9 @@ describe('Reports performance tiers + schema check (e2e)', () => {
 
   /** A lowercase alphanumeric tag safe for SQL identifiers and report keys. */
   function uniqueTag() {
-    return uniqueSuffix().replace(/[^a-z0-9]/gi, '').toLowerCase();
+    return uniqueSuffix()
+      .replace(/[^a-z0-9]/gi, '')
+      .toLowerCase();
   }
 
   function uniqueKey(label: string) {
@@ -244,7 +326,11 @@ describe('Reports performance tiers + schema check (e2e)', () => {
     const suffix = uniqueSuffix();
     const signup = await api()
       .post('/auth/signup')
-      .send({ email: `${label}-${suffix}@example.com`, password: 'test-password-123', displayName: label })
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
       .expect(201);
     const accessToken = signup.body.accessToken as string;
     const org = await api()