@galadrim/galadmin 0.1.236 → 0.2.6

package/.github/workflows/main.yml

@@ -5,7 +5,38 @@ on:
       - master
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      CI: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 22
+      - name: Dependencies installation
+        run: npm install
+      - name: Run unit tests
+        run: npm test
+      - name: Run integration tests (real MySQL/PostgreSQL via testcontainers)
+        run: npm run test:integration
+        env:
+          TEST_INTEGRATION: '1'
+      - name: Front-end - Load cache
+        uses: actions/cache@v4
+        with:
+          path: '**/src/front/node_modules'
+          key: ${{ runner.os }}-npm-front-${{ hashFiles('**/src/front/package-lock.json') }}
+      - name: Front-end - Dependencies installation
+        run: npm install
+        working-directory: ./src/front
+      - name: Run front-end tests
+        run: npm test -- --watchAll=false
+        working-directory: ./src/front
+
   build-and-deploy:
+    needs: test
     runs-on: ubuntu-latest
     env:
       CI: false
@@ -14,7 +45,7 @@ jobs:
         uses: actions/checkout@v2
       - uses: actions/setup-node@v3
         with:
-          node-version: 18
+          node-version: 22
       - name: 'Automated Version Bump'
         uses: 'phips28/gh-action-bump-version@master'
         env:
@@ -39,4 +70,4 @@ jobs:
       - name: Publish package
         uses: JS-DevTools/npm-publish@v1
         with:
-          token: ${{ secrets.NPM_TOKEN }}
+          token: ${{ secrets.NPM_TOKEN }}

package/README.md

@@ -291,3 +291,68 @@ It is possible to use a FileColumn to allow upload to a remote server via SFTP.
 `nodemon index.js` in `your-project`
 `tsc --watch` in `galadmin`
 `npm run start` in `galadmin/src/front`
+
+## Testing
+
+The backend has a regression test suite (Jest + ts-jest + supertest) covering
+the API routes, the authorization matrix, SQL generation for both MySQL and
+PostgreSQL dialects, file uploads (S3/GCP/SFTP/local), imports/exports and the
+login/session middleware. The route-level behavior runs against real database
+engines (see below); the unit suite covers pure logic and configuration wiring
+without any database.
+
+```bash
+npm test                # run the unit suite (no database required)
+npm run test:watch      # watch mode
+npm run test:coverage   # unit + integration merged report (Docker required)
+```
+
+### Real-database integration tests
+
+A second suite (`tests/integration/`) runs the same routes against real
+MySQL 8 (both the `mysql` and `mysql2` drivers) and PostgreSQL 16 servers
+started with [testcontainers](https://node.testcontainers.org). It asserts
+persisted state, not just emitted SQL, and requires a running Docker daemon.
+
+```bash
+npm run test:integration   # TEST_INTEGRATION=1, jest.integration.config.js
+npm run test:all           # unit suite + integration suite
+```
+
+`npm test` never starts containers. `npm run test:integration` needs a
+reachable Docker daemon and fails without one, so a broken Docker setup in CI
+cannot pass silently.
+
+### Known robustness limitations
+
+The former `tests/security-known-gaps.test.ts` suite encoded unfixed security
+and robustness gaps as expected-safe tests. All of its gaps have since been
+fixed and its tests were folded into the regular suites (`routes.*.test.ts`,
+`dbManager.test.ts`), so no special run is needed anymore — `npm test` covers
+them.
+
+A few robustness limitations remain documented (not assertable over HTTP
+because the error escapes as an unhandled rejection under express 4):
+
+* A throwing `parseImportFile` in `/recordsImport` or `/subrecordsImport` is
+  awaited OUTSIDE the try/catch of the multiparty callback — the 500 is never
+  sent and the process can crash.
+* `formatValueForInsertion(false)` returns `"NULL"`, so a boolean `false`
+  cannot be imported.
+* The local-fs upload backend requires `subdirectory` (publicPath +
+  undefined concat yields a nonexistent upload dir).
+* A throwing `editCallbackFunction` in `/updateRecord` is awaited OUTSIDE any
+  try/catch — the update is committed but the request hangs forever.
+* A missing or non-JSON `file-upload-properties` header on
+  `/uploadFileFromBetterRichTextInput` makes `JSON.parse` throw inside the
+  async handler — the request hangs and the process can crash.
+
+### Frontend tests
+
+The React front (`src/front`) has a small smoke suite (CRA / react-scripts
+test) covering the pure utils, the outside-click handler, the first-view
+redirect and the unauthenticated App render:
+
+```bash
+cd src/front && npm test -- --watchAll=false
+```

package/dist/api.d.ts

@@ -1,3 +1,16 @@
+export declare function generateUniqueIdForObject(obj: any): string;
+export declare const ROOT_ROLE = "root";
+export declare const roleOf: (req: any) => any;
+export declare const canWriteView: (view: any, role: any) => any;
+export declare const viewFromRequest: (req: any) => any;
+export declare const MUTATING_VIEW_ROUTES: Set<string>;
+export declare const areSafeColumnNames: (data: any) => boolean;
+export declare const writableTables: (req: any) => Set<string>;
+export declare const looksLikeSqlBreakout: (frag: any) => boolean;
+export declare function sqlAnd(conditions: any): any;
+export declare function getFormattedValue(column: any, record: any): Promise<any>;
+export declare function evalExpression(expression: any, data: any): any;
+export declare function formatValueForInsertion(value: any, dbType: string): any;
 declare global {
     namespace Express {
         interface Request {
@@ -7,3 +20,6 @@ declare global {
 }
 declare const _default: (db: any, config: any) => import("express-serve-static-core").Express;
 export default _default;
+export declare function collectAllowedQueries(node: any, acc?: Set<string>): Set<string>;
+export declare function enrichConfig(config: any, db: any): Promise<void>;
+export declare function enrichColumn(column: any, tableName: any, info: any): void;