@galadrim/galadmin 0.1.236 → 0.2.6

package/tests/helpers/fixtures.ts

@@ -0,0 +1,68 @@
+/**
+ * Config + database-schema fixtures shared by the route tests.
+ *
+ * `enrichConfig` queries information_schema on every request; `schemaRows`
+ * factories feed the FakeDb so enrichment behaves like a real database.
+ */
+
+export function schemaRow(
+  table: string,
+  column: string,
+  opts: {
+    primary?: boolean;
+    nullable?: boolean;
+    dataType?: string;
+    columnType?: string;
+  } = {},
+) {
+  return {
+    TABLE_NAME: table,
+    COLUMN_NAME: column,
+    COLUMN_KEY: opts.primary ? "PRI" : "",
+    IS_NULLABLE: opts.nullable ? "YES" : "NO",
+    DATA_TYPE: opts.dataType || "varchar",
+    COLUMN_TYPE: opts.columnType || opts.dataType || "varchar",
+  };
+}
+
+export function fruitSchema(extra: any[] = []) {
+  return [
+    schemaRow("fruits", "id", { primary: true, dataType: "int" }),
+    schemaRow("fruits", "fruitName"),
+    schemaRow("fruits", "acidity", { dataType: "int", nullable: true }),
+    ...extra,
+  ];
+}
+
+/** A minimal table view: two plain columns, PK resolved by enrichment. */
+export function fruitView(overrides: any = {}) {
+  return {
+    type: "table",
+    label: "Fruits",
+    tableName: "fruits",
+    columns: [
+      { label: "Nom", name: "fruitName" },
+      { label: "Acidité", name: "acidity" },
+    ],
+    ...overrides,
+  };
+}
+
+export function baseConfig(overrides: any = {}) {
+  return {
+    name: "Test project",
+    sessionSecret: "test-secret",
+    auth: { username: "admin", password: "admin-pass" },
+    mysql: {
+      host: "localhost",
+      user: "root",
+      password: "",
+      database: "galadmin_test",
+    },
+    views: [fruitView()],
+    ...overrides,
+  };
+}
+
+export const EDITOR = { role: "editor", userId: 2 };
+export const VIEWER = { role: "viewer", userId: 3 };

package/tests/imageDimensions.test.ts

@@ -0,0 +1,111 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { getImageDimensions } from "../src/utils/imageDimensions";
+
+const PNG_HEADER = Buffer.from(
+  "89504e470d0a1a0a0000000d49484452000000010000000108" + "0".repeat(64),
+  "hex",
+);
+
+const GIF_HEADER = Buffer.concat([
+  Buffer.from("GIF89a", "latin1"),
+  Buffer.from([0x64, 0x00, 0x32, 0x00]), // 100x50 little-endian
+  Buffer.alloc(8),
+]);
+
+// SOI + SOF0 segment (height 50, width 100) + EOI
+const JPEG_HEADER = Buffer.from("ffd8ffc0001108003200640301110002110003ffd9", "hex");
+
+async function withTempFile(contents: Buffer | string): Promise<string> {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "galadmin-imgdim-"));
+  const filePath = path.join(dir, "file");
+  fs.writeFileSync(filePath, contents);
+  return filePath;
+}
+
+describe("getImageDimensions", () => {
+  it("parses a PNG IHDR", async () => {
+    const filePath = await withTempFile(PNG_HEADER);
+    expect(await getImageDimensions(filePath)).toEqual({ width: 1, height: 1 });
+  });
+
+  it("parses a GIF logical screen descriptor", async () => {
+    const filePath = await withTempFile(GIF_HEADER);
+    expect(await getImageDimensions(filePath)).toEqual({ width: 100, height: 50 });
+  });
+
+  it("parses a JPEG SOF0 frame header", async () => {
+    const filePath = await withTempFile(JPEG_HEADER);
+    expect(await getImageDimensions(filePath)).toEqual({ width: 100, height: 50 });
+  });
+
+  it("returns null for a non-image payload even with an image extension (crafted upload)", async () => {
+    const filePath = await withTempFile(Buffer.from("craftedi 籍content-not-an-image"));
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+
+  it("returns null for a truncated PNG", async () => {
+    const filePath = await withTempFile(PNG_SIGNATURE_ONLY());
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+
+  it("returns null when the file cannot be read", async () => {
+    expect(await getImageDimensions(path.join(os.tmpdir(), "does-not-exist-random-1234"))).toBeNull();
+  });
+
+  it("returns null for a PNG with zero dimensions", async () => {
+    const zero = Buffer.from(
+      "89504e470d0a1a0a0000000d49484452000000000000000008" + "0".repeat(64),
+      "hex",
+    );
+    const filePath = await withTempFile(zero);
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+
+  it("returns null when the PNG IHDR chunk type is corrupted", async () => {
+    const corrupted = Buffer.from(
+      "89504e470d0a1a0a0000000d58485252000000010000000108" + "0".repeat(64),
+      "hex",
+    );
+    const filePath = await withTempFile(corrupted);
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+
+  it("parses a GIF87a signature", async () => {
+    const gif87 = Buffer.concat([
+      Buffer.from("GIF87a", "latin1"),
+      Buffer.from([0x40, 0x00, 0x40, 0x00]), // 64x64 little-endian
+      Buffer.alloc(8),
+    ]);
+    const filePath = await withTempFile(gif87);
+    expect(await getImageDimensions(filePath)).toEqual({ width: 64, height: 64 });
+  });
+
+  it("returns null for a truncated GIF", async () => {
+    const filePath = await withTempFile(Buffer.from("GIF89a123", "latin1"));
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+
+  it("returns null for a JPEG with a malformed marker byte", async () => {
+    const garbage = Buffer.from("ffd8f000ffff00", "hex");
+    const filePath = await withTempFile(garbage);
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+
+  it("returns null for a JPEG truncated inside its frame header", async () => {
+    const truncated = Buffer.from("ffd8ffc0000808003200", "hex");
+    const filePath = await withTempFile(truncated);
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+
+  it("returns null for a JPEG reaching start-of-scan without a frame header", async () => {
+    const noSof = Buffer.from("ffd8ffda00100000", "hex");
+    const filePath = await withTempFile(noSof);
+    expect(await getImageDimensions(filePath)).toBeNull();
+  });
+});
+
+function PNG_SIGNATURE_ONLY(): Buffer {
+  return Buffer.from("89504e470d0a1a0a", "hex");
+}

package/tests/index.sessionStore.test.ts

@@ -0,0 +1,19 @@
+jest.unmock("express-mysql-session");
+jest.mock("../src/utils/dbManager");
+jest.mock("mysql2/promise");
+
+import buildIndexApp from "../src/index";
+
+describe("MySQL session store (real express-mysql-session)", () => {
+  it("builds the app without throwing", () => {
+    expect(() =>
+      buildIndexApp({
+        name: "Test",
+        sessionSecret: "secret",
+        auth: { username: "admin", password: "admin-pass" },
+        mysql: { host: "localhost", user: "root", password: "", database: "db" },
+        views: [],
+      } as any),
+    ).not.toThrow();
+  });
+});

package/tests/index.test.ts

@@ -0,0 +1,363 @@
+import * as bcrypt from "bcryptjs";
+import * as request from "supertest";
+
+import dbManagerMock from "../src/utils/dbManager";
+jest.mock("../src/utils/dbManager");
+jest.mock("express-mysql-session");
+jest.mock("connect-pg-simple");
+jest.mock("pg");
+jest.mock("mysql2/promise");
+jest.mock("argon2");
+
+import * as express from "express";
+import buildIndexApp from "../src/index";
+import { fruitSchema } from "./helpers/fixtures";
+
+const dbManager = dbManagerMock as any;
+
+/**
+ * Builds the index app, then wires the mocked dbManager instance created by
+ * it. The instance only exists after the app is constructed, so the app is
+ * always built first.
+ */
+function buildAppWithDb(
+  config: any,
+  queryImpl: (sql: string, params?: any[]) => Promise<any>,
+) {
+  const app = buildIndexApp(config);
+  const instances = dbManager.mock.instances;
+  const instance = instances[instances.length - 1];
+  instance.dbType = "MYSQL";
+  instance.init = jest.fn();
+  instance.query = jest.fn(queryImpl);
+  return { app, instance };
+}
+
+/** Standard query impl: answers information_schema probes from schemaRows. */
+function withSchema(schemaRows: any[] = [], otherRows: any = []) {
+  return async (sql: string) => {
+    if (sql.includes("information_schema")) {
+      return { err: null, rows: schemaRows };
+    }
+    return { err: null, rows: otherRows };
+  };
+}
+
+function usersRows(rows: any[]) {
+  return async (sql: string) => {
+    if (sql.includes("information_schema")) {
+      return { err: null, rows: fruitSchema() };
+    }
+    return { err: null, rows };
+  };
+}
+
+function mysqlConfig(overrides: any = {}) {
+  return {
+    name: "Test",
+    sessionSecret: "secret",
+    auth: { username: "admin", password: "admin-pass" },
+    mysql: { host: "localhost", user: "root", password: "", database: "db" },
+    views: [
+      {
+        type: "table",
+        label: "Fruits",
+        tableName: "fruits",
+        columns: [{ label: "Nom", name: "fruitName" }],
+      },
+    ],
+    ...overrides,
+  };
+}
+
+function rolesConfig(rows: any[], roleFilters?: string) {
+  return mysqlConfig({
+    authRoles: [
+      {
+        role: "editor",
+        table: "users",
+        usernameField: "username",
+        passwordField: "passwordHash",
+        idField: "id",
+        ...(roleFilters ? { filters: roleFilters } : {}),
+      },
+    ],
+    __usersRows: rows,
+  });
+}
+
+describe("index middleware (src/index.ts)", () => {
+  beforeEach(() => {
+    dbManager.mockClear();
+  });
+
+  describe("POST /api/login", () => {
+    it("logs the root user in from config.auth", async () => {
+      const { app } = buildAppWithDb(mysqlConfig(), withSchema());
+      const res = await request(app)
+        .post("/api/login")
+        .send({ username: "admin", password: "admin-pass" })
+        .expect(200);
+      expect(res.body).toEqual({ success: true });
+    });
+
+    it("rejects wrong root credentials", async () => {
+      const { app } = buildAppWithDb(mysqlConfig(), withSchema());
+      const res = await request(app)
+        .post("/api/login")
+        .send({ username: "admin", password: "wrong" })
+        .expect(200);
+      expect(res.body).toEqual({ success: false });
+    });
+
+    it("authenticates authRoles users against bcrypt hashes", async () => {
+      const hash = bcrypt.hashSync("secret", 4);
+      const { app } = buildAppWithDb(
+        rolesConfig([{ id: 3, username: "bob", passwordHash: hash }]),
+        usersRows([{ id: 3, username: "bob", passwordHash: hash }]),
+      );
+      const agent = request.agent(app);
+      const res = await agent
+        .post("/api/login")
+        .send({ username: "bob", password: "secret" })
+        .expect(200);
+      expect(res.body).toEqual({ success: true });
+
+      // the session grants access to the api
+      const auth = await agent.get("/api/isAuthenticated").expect(200);
+      expect(auth.body).toEqual({ isAuthenticated: true });
+    });
+
+    it("matches plain-text stored passwords (legacy behavior)", async () => {
+      const { app } = buildAppWithDb(
+        rolesConfig([{ id: 4, username: "carol", passwordHash: "plain-secret" }]),
+        usersRows([{ id: 4, username: "carol", passwordHash: "plain-secret" }]),
+      );
+      await request(app)
+        .post("/api/login")
+        .send({ username: "carol", password: "plain-secret" })
+        .expect(200)
+        .expect({ success: true });
+    });
+
+    it("verifies argon2 hashes when useArgon2 is set", async () => {
+      const argon = jest.requireMock("argon2");
+      const { app } = buildAppWithDb(
+        mysqlConfig({
+          authRoles: [
+            {
+              role: "editor",
+              table: "users",
+              usernameField: "username",
+              passwordField: "passwordHash",
+              idField: "id",
+              useArgon2: true,
+            },
+          ],
+        }),
+        usersRows([{ id: 5, username: "dave", passwordHash: "$argon2id$hash" }]),
+      );
+      await request(app)
+        .post("/api/login")
+        .send({ username: "dave", password: "argon-secret" })
+        .expect(200)
+        .expect({ success: true });
+      expect(argon.verify).toHaveBeenCalledWith("$argon2id$hash", "argon-secret");
+    });
+
+    it("returns success:false for unknown authRoles users", async () => {
+      const { app } = buildAppWithDb(rolesConfig([]), usersRows([]));
+      await request(app)
+        .post("/api/login")
+        .send({ username: "nobody", password: "x" })
+        .expect(200)
+        .expect({ success: false });
+    });
+  });
+
+  describe("auth middleware", () => {
+    it("blocks unauthenticated api access with 401", async () => {
+      const { app } = buildAppWithDb(mysqlConfig(), withSchema(fruitSchema()));
+      await request(app).post("/api/records").send({}).expect(401);
+      await request(app).get("/api/record").query({ viewIndex: 0 }).expect(401);
+    });
+
+    it("invalidates the session when the user record disappears", async () => {
+      const hash = bcrypt.hashSync("secret", 4);
+      let userExists = true;
+      const { app } = buildAppWithDb(
+        rolesConfig([]),
+        async (sql: string) => {
+          if (sql.includes("information_schema")) {
+            return { err: null, rows: fruitSchema() };
+          }
+          return {
+            err: null,
+            rows: userExists
+              ? [{ id: 3, username: "bob", passwordHash: hash }]
+              : [],
+          };
+        },
+      );
+      const agent = request.agent(app);
+      await agent
+        .post("/api/login")
+        .send({ username: "bob", password: "secret" })
+        .expect(200);
+
+      userExists = false; // the account is deactivated between requests
+      const res = await agent
+        .post("/api/records")
+        .send({ viewIndex: 0, page: 1, filters: [] })
+        .expect(401);
+      expect(res.body).toEqual({});
+    });
+
+    it("applies the role filters when re-checking the user", async () => {
+      const hash = bcrypt.hashSync("secret", 4);
+      let filterMatches = true;
+      const { app } = buildAppWithDb(
+        rolesConfig([], "active = 1"),
+        async (sql: string, params: any[] = []) => {
+          if (sql.includes("information_schema")) {
+            return { err: null, rows: fruitSchema() };
+          }
+          if (filterMatches) {
+            return {
+              err: null,
+              rows: [
+                {
+                  id: 3,
+                  username: "bob",
+                  passwordHash: hash,
+                },
+              ],
+            };
+          }
+          return { err: null, rows: [] };
+        },
+      );
+      const agent = request.agent(app);
+      await agent
+        .post("/api/login")
+        .send({ username: "bob", password: "secret" })
+        .expect(200);
+
+      // while the filter matches, the api stays reachable
+      await agent
+        .post("/api/records")
+        .send({ viewIndex: 0, page: 1, filters: [] })
+        .expect(200);
+
+      // simulate the filter no longer matching
+      filterMatches = false;
+      await agent
+        .post("/api/records")
+        .send({ viewIndex: 0, page: 1, filters: [] })
+        .expect(401);
+    });
+  });
+
+  describe("GET /api/isAuthenticated and /api/logout", () => {
+    it("reports unauthenticated state before login", async () => {
+      const { app } = buildAppWithDb(mysqlConfig(), withSchema(fruitSchema()));
+      const res = await request(app).get("/api/isAuthenticated").expect(200);
+      expect(res.body).toEqual({ isAuthenticated: false });
+    });
+
+    it("destroys the session on logout", async () => {
+      const { app } = buildAppWithDb(mysqlConfig(), withSchema(fruitSchema()));
+      const agent = request.agent(app);
+      await agent
+        .post("/api/login")
+        .send({ username: "admin", password: "admin-pass" })
+        .expect(200);
+      await agent.get("/api/isAuthenticated").expect(200);
+      await agent.get("/api/logout").expect(200);
+      const res = await agent.get("/api/isAuthenticated").expect(200);
+      expect(res.body).toEqual({ isAuthenticated: false });
+    });
+  });
+
+  describe("session store selection", () => {
+    it("uses the postgres store when config.postgresql is set", () => {
+      buildAppWithDb(
+        mysqlConfig({
+          mysql: undefined,
+          postgresql: { host: "h", user: "u", password: "p", database: "d" },
+        }),
+        withSchema(),
+      );
+      const pgSession = jest.requireMock("connect-pg-simple");
+      const pg = jest.requireMock("pg");
+      expect(pgSession.__PgSessionStore).toHaveBeenCalled();
+      expect(pg.Pool).toHaveBeenCalled();
+      expect(pgSession.__storeConstructor).toHaveBeenCalledWith(
+        expect.objectContaining({ tableName: "galadmin_sessions" }),
+      );
+    });
+
+    it("uses the mysql store otherwise", () => {
+      buildAppWithDb(mysqlConfig(), withSchema());
+      const sessionStoreMock = jest.requireMock("express-mysql-session");
+      const mysql2Promise = jest.requireMock("mysql2/promise");
+      expect(sessionStoreMock.__MySQLSessionStore).toHaveBeenCalledWith(
+        require("express-session"),
+      );
+      expect(sessionStoreMock.__storeConstructor).toHaveBeenCalledWith(
+        expect.objectContaining({
+          schema: { tableName: "galadmin_sessions" },
+        }),
+        expect.anything(),
+      );
+      expect(mysql2Promise.createPool).toHaveBeenCalledWith(
+        expect.objectContaining({ database: "db", port: 3306 }),
+      );
+    });
+  });
+
+  describe("static file serving", () => {
+    it("serves index.html with the base url substituted for /_HOMEPAGE_", async () => {
+      const { app } = buildAppWithDb(mysqlConfig(), withSchema(fruitSchema()));
+      const fsModule = require("fs");
+      const existsSpy = jest.spyOn(fsModule, "existsSync").mockReturnValue(true);
+      const readSpy = jest
+        .spyOn(fsModule, "readFileSync")
+        .mockReturnValue('<html href="/_HOMEPAGE_/x"></html>' as any);
+      // mount like a real integration: app.use("/admin", galadmin(config))
+      const outer = express();
+      outer.use("/admin", app);
+      try {
+        // "/" maps directly to index.html (has an extension, so mime resolves)
+        const res = await request(outer).get("/admin/").expect(200);
+        expect(res.text).toBe('<html href="/admin/x"></html>');
+        expect(res.headers["content-type"]).toContain("text/html");
+      } finally {
+        existsSpy.mockRestore();
+        readSpy.mockRestore();
+      }
+    });
+
+    it("falls back to index.html for unknown paths (SPA routing)", async () => {
+      const { app } = buildAppWithDb(mysqlConfig(), withSchema(fruitSchema()));
+      const fsModule = require("fs");
+      // only the built index.html "exists" — any other path falls back to it
+      const existsSpy = jest
+        .spyOn(fsModule, "existsSync")
+        .mockImplementation((p: any) => String(p).endsWith("index.html"));
+      const readSpy = jest
+        .spyOn(fsModule, "readFileSync")
+        .mockReturnValue('<html href="/_HOMEPAGE_/x"></html>' as any);
+      const outer = express();
+      outer.use("/admin", app);
+      try {
+        const res = await request(outer).get("/admin/records/0").expect(200);
+        expect(res.text).toBe('<html href="/admin/x"></html>');
+        expect(existsSpy).toHaveBeenCalled();
+      } finally {
+        existsSpy.mockRestore();
+        readSpy.mockRestore();
+      }
+    });
+  });
+});

package/tests/integration/__mocks__/axios.js

@@ -0,0 +1,3 @@
+// Scoped copy: this project's roots don't include tests/__mocks__, so without
+// this file jest.mock("axios") would silently fall back to automock.
+module.exports = require("../../__mocks__/axios.js");