@galadrim/galadmin 0.1.236 → 0.2.6

package/tests/integration/routes.authorization.integration.test.ts

@@ -0,0 +1,319 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import * as request from "supertest";
+import { generateUniqueIdForObject } from "../../src/api";
+import { buildAppForManager } from "../helpers/app";
+import { baseConfig, fruitView, EDITOR, VIEWER } from "../helpers/fixtures";
+import {
+  BackendName,
+  DbHarness,
+  describeIntegration,
+  getMysql2Harness,
+  getMysqlHarness,
+  getPgHarness,
+  resetTables,
+} from "./dbHarness";
+
+jest.mock("axios");
+
+/**
+ * The role matrix against every route guarded by the server-side write
+ * guard, plus the filter/column trust boundaries. The scripted suite
+ * asserted "no query ran" on rejections; here rejections must leave the
+ * database untouched, and allowances must really reach the handler.
+ */
+describeIntegration("authorization against real databases", () => {
+  const harnesses: Record<BackendName, DbHarness> = {} as any;
+
+  beforeAll(async () => {
+    harnesses.mysql = await getMysqlHarness();
+    harnesses.mysql2 = await getMysql2Harness();
+    harnesses.postgresql = await getPgHarness();
+  });
+
+  afterAll(async () => {
+    await harnesses.mysql?.stop();
+    await harnesses.mysql2?.stop();
+    await harnesses.postgresql?.stop();
+  });
+
+  describe.each([
+    ["mysql", () => harnesses.mysql],
+    ["mysql2", () => harnesses.mysql2],
+    ["postgresql", () => harnesses.postgresql],
+  ])("backend: %s", (_backend, getHarness) => {
+    let harness: DbHarness;
+    let panelId: string;
+
+    beforeEach(async () => {
+      harness = getHarness();
+      await resetTables(harness);
+    });
+
+    function config() {
+      // The root role can see and write every view even when its roles/
+      // readRoles exclude it; other roles need to be listed explicitly.
+      const panel: any = {
+        label: "Notes",
+        tableName: "fruit_notes",
+        primaryId: "id",
+      };
+      panelId = generateUniqueIdForObject(panel);
+      return baseConfig({
+        views: [
+          fruitView({
+            roles: ["editor", "root"],
+            readRoles: ["viewer"],
+            customActions: [
+              {
+                label: "Publish",
+                action: async () => null,
+                successMessage: "ok",
+              },
+            ],
+            recordViewPanels: [panel],
+          }),
+        ],
+      });
+    }
+
+    const app = (config: any, user: any = { role: "root", userId: 1 }) =>
+      buildAppForManager(harness.manager, config, user);
+
+    const fruitCount = async () => {
+      const { rows } = await harness.query("SELECT * FROM fruits");
+      return rows.length;
+    };
+
+    const cases = [
+      {
+        name: "POST /updateRecord",
+        path: "/api/updateRecord",
+        body: () => ({ viewIndex: 0, data: {}, primaryValue: 1 }),
+      },
+      {
+        name: "POST /createRecord",
+        path: "/api/createRecord",
+        body: () => ({ viewIndex: 0, data: { fruitName: "x" } }),
+      },
+      {
+        name: "POST /deleteRecord",
+        path: "/api/deleteRecord",
+        body: () => ({ viewIndex: 0, primaryValue: 1 }),
+      },
+      {
+        name: "POST /deleteRecords",
+        path: "/api/deleteRecords",
+        body: () => ({ viewIndex: 0, primaryValues: [1] }),
+      },
+      {
+        name: "POST /deleteRecordFromPanel",
+        path: "/api/deleteRecordFromPanel",
+        body: () => ({ viewIndex: 0, panelId, primaryValue: 1 }),
+      },
+      {
+        name: "POST /customAction",
+        path: "/api/customAction",
+        body: () => ({ viewIndex: 0, actionIndex: 0, selectedRecordIds: [1] }),
+      },
+    ];
+
+    for (const c of cases) {
+      // NOTE: /uploadFile is guarded like these routes, but a bare POST (no
+      // multipart body) fails in multiparty — covered by the dedicated guard
+      // tests below.
+
+      it(`${c.name}: root is allowed past the write-guard`, async () => {
+        const res = await request(app(config()))
+          .post(c.path)
+          .send(c.body());
+        expect(res.status).not.toBe(403);
+      });
+
+      it(`${c.name}: write role is allowed past the write-guard`, async () => {
+        const res = await request(app(config(), EDITOR))
+          .post(c.path)
+          .send(c.body());
+        expect(res.status).not.toBe(403);
+      });
+
+      it(`${c.name}: read-only role gets 403 and the database is untouched`, async () => {
+        await request(app(config(), VIEWER))
+          .post(c.path)
+          .send(c.body())
+          .expect(403);
+        expect(await fruitCount()).toBe(0);
+      });
+
+      it(`${c.name}: anonymous session gets 403`, async () => {
+        await request(app(config(), null))
+          .post(c.path)
+          .send(c.body())
+          .expect(403);
+        expect(await fruitCount()).toBe(0);
+      });
+
+      it(`${c.name}: unknown role gets 403`, async () => {
+        await request(app(config(), { role: "stranger", userId: 9 }))
+          .post(c.path)
+          .send(c.body())
+          .expect(403);
+        expect(await fruitCount()).toBe(0);
+      });
+    }
+
+    it("views without roles are writable by any authenticated role", async () => {
+      await request(app(baseConfig(), VIEWER))
+        .post("/api/updateRecord")
+        .send({ viewIndex: 0, data: {}, primaryValue: 1 })
+        .expect(200);
+    });
+
+    it("updateRecord with an unknown viewIndex gets 403", async () => {
+      // viewFromRequest yields undefined and the guard rejects it.
+      // (body.viewIndex takes precedence over query.viewIndex.)
+      await request(app(config(), EDITOR))
+        .post("/api/updateRecord")
+        .query({ viewIndex: 99 })
+        .send({ viewIndex: 99, data: {}, primaryValue: 1 })
+        .expect(403);
+    });
+
+    it("/uploadFile: read-only role gets 403 before any upload happens", async () => {
+      const config = baseConfig({
+        views: [
+          fruitView({
+            roles: ["editor", "root"],
+            readRoles: ["viewer"],
+            columns: [
+              { label: "Nom", name: "fruitName" },
+              {
+                label: "Img",
+                name: "img",
+                dataType: "file",
+                publicPath: "/tmp",
+              },
+            ],
+          }),
+        ],
+      });
+      const colId = generateUniqueIdForObject(config.views[0].columns[1]);
+      await request(app(config, VIEWER))
+        .post("/api/uploadFile")
+        .query({ viewIndex: 0, columnId: colId })
+        .expect(403);
+      expect(await fruitCount()).toBe(0);
+    });
+
+    it("/uploadFileFromBetterRichTextInput: read-only role gets 403 before any upload happens", async () => {
+      // This endpoint carries no viewIndex: the upload target comes entirely
+      // from the client-supplied file-upload-properties header, so it is
+      // gated on the caller being able to write at least one view.
+      const config = baseConfig({
+        views: [fruitView({ roles: ["editor"], readRoles: ["viewer"] })],
+      });
+      const uploadRoot = fs.mkdtempSync(
+        path.join(os.tmpdir(), "galadmin-auth-"),
+      );
+      fs.mkdirSync(path.join(uploadRoot, "sub"));
+      try {
+        await request(app(config, VIEWER))
+          .post("/api/uploadFileFromBetterRichTextInput")
+          .set(
+            "file-upload-properties",
+            JSON.stringify({ publicPath: uploadRoot, subdirectory: "/sub" }),
+          )
+          .attach("upload", Buffer.from("png"), { filename: "x.png" })
+          .expect(403);
+        expect(await fruitCount()).toBe(0);
+      } finally {
+        fs.rmSync(uploadRoot, { recursive: true, force: true });
+      }
+    });
+
+    it("updateRecord rejects column names breaking out of the identifier charset", async () => {
+      const instance = app(baseConfig());
+      for (const bad of ["a;b", "a b", "a-b", "a)b", "`a`", "a'"]) {
+        await request(instance)
+          .post("/api/updateRecord")
+          .send({ viewIndex: 0, primaryValue: 1, data: { [bad]: "x" } })
+          .expect(400);
+      }
+      expect(await fruitCount()).toBe(0);
+    });
+
+    it("uploadFile resolves the column by __id__ before serving", async () => {
+      // NOTE: an unknown columnId makes uploadFile read properties of
+      // `undefined` — an unhandled rejection under express 4 (not assertable
+      // via HTTP without crashing the worker).
+      const column = {
+        label: "Img",
+        name: "img",
+        dataType: "file",
+        publicPath: "/tmp",
+      };
+      const config = baseConfig({
+        views: [
+          fruitView({
+            columns: [{ label: "Nom", name: "fruitName" }, column],
+          }),
+        ],
+      });
+      const colId = generateUniqueIdForObject(column);
+      // a valid columnId passes the guard and fails later on the missing
+      // multipart body
+      await request(app(config))
+        .post("/api/uploadFile")
+        .query({ viewIndex: 0, columnId: colId })
+        .expect(500);
+    });
+  });
+
+  describe("client filter validation (looksLikeSqlBreakout)", () => {
+    let harness: DbHarness;
+
+    beforeEach(async () => {
+      harness = harnesses.mysql;
+      await resetTables(harness);
+    });
+
+    it("rejects filters containing SQL breakout patterns with 400", async () => {
+      const instance = buildAppForManager(
+        harness.manager,
+        baseConfig({ views: [fruitView({ primaryId: "id" })] }),
+      );
+      const attacks = [
+        "1=1; DROP TABLE fruits",
+        "1=1 -- x",
+        "1=1 /* x */",
+        "1=1 UNION SELECT password FROM users",
+        "INTO OUTFILE '/tmp/x'",
+        "SLEEP(10)",
+        "BENCHMARK(100000, MD5('x'))",
+        "LOAD_FILE('/etc/passwd')",
+      ];
+      for (const attack of attacks) {
+        const res = await request(instance)
+          .post("/api/records")
+          .send({ viewIndex: 0, page: 1, filters: [attack] })
+          .expect(400);
+        expect(res.body).toEqual({ error: "Invalid filter" });
+      }
+      const { rows } = await harness.query("SELECT * FROM fruits");
+      expect(rows).toHaveLength(0);
+    });
+
+    it("allows ordinary filters through", async () => {
+      const instance = buildAppForManager(
+        harness.manager,
+        baseConfig({ views: [fruitView({ primaryId: "id" })] }),
+      );
+      const res = await request(instance)
+        .post("/api/records")
+        .send({ viewIndex: 0, page: 1, filters: ["age < 50"] })
+        .expect(200);
+      expect(res.body.records).toHaveLength(0);
+    });
+  });
+});

package/tests/integration/routes.config.integration.test.ts

@@ -0,0 +1,189 @@
+import * as request from "supertest";
+import { buildAppForManager } from "../helpers/app";
+import { baseConfig, fruitView, VIEWER } from "../helpers/fixtures";
+import {
+  BackendName,
+  DbHarness,
+  describeIntegration,
+  getMysql2Harness,
+  getMysqlHarness,
+  getPgHarness,
+  resetTables,
+} from "./dbHarness";
+
+jest.mock("axios");
+
+/**
+ * GET /api/config against real engines. Serialization and role filtering are
+ * pure JS; the real database is what feeds enrichConfig (information_schema
+ * primaryId/required/dataType resolution).
+ */
+describeIntegration("config route against real databases", () => {
+  const harnesses: Record<BackendName, DbHarness> = {} as any;
+
+  beforeAll(async () => {
+    harnesses.mysql = await getMysqlHarness();
+    harnesses.mysql2 = await getMysql2Harness();
+    harnesses.postgresql = await getPgHarness();
+  });
+
+  afterAll(async () => {
+    await harnesses.mysql?.stop();
+    await harnesses.mysql2?.stop();
+    await harnesses.postgresql?.stop();
+  });
+
+  describe.each([
+    ["mysql", () => harnesses.mysql],
+    ["mysql2", () => harnesses.mysql2],
+    ["postgresql", () => harnesses.postgresql],
+  ])("backend: %s", (_backend, getHarness) => {
+    let harness: DbHarness;
+
+    beforeEach(async () => {
+      harness = getHarness();
+      await resetTables(harness);
+    });
+
+    const app = (config: any, user: any = { role: "root", userId: 1 }) =>
+      buildAppForManager(harness.manager, config, user);
+
+    const getConfig = (instance: any) =>
+      request(instance).get("/api/config").expect(200);
+
+    it("serves a serialized config", async () => {
+      const res = await getConfig(app(baseConfig()));
+      expect(typeof res.body.config).toBe("string");
+      expect(res.body.config).toContain("Fruits");
+    });
+
+    it("strips mysql credentials, auth and sessionSecret", async () => {
+      const res = await getConfig(app(baseConfig()));
+      expect(res.body.config).not.toContain("test-secret");
+      expect(res.body.config).not.toContain("admin-pass");
+      expect(res.body.config).not.toContain("galadmin_test");
+      expect(res.body.config).not.toContain('"auth"');
+      expect(res.body.config).not.toContain('"mysql"');
+      expect(res.body.config).not.toContain('"sessionSecret"');
+    });
+
+    it("filters out views whose roles exclude the current user", async () => {
+      // The role filter runs before enrichment, so the fictional "secrets"
+      // table is never queried by information_schema.
+      const config = baseConfig({
+        views: [
+          fruitView(),
+          {
+            type: "table",
+            label: "Secret",
+            tableName: "secrets",
+            roles: ["admin"],
+            columns: [],
+          },
+        ],
+      });
+      const res = await getConfig(app(config, VIEWER));
+      expect(res.body.config).toContain("Fruits");
+      expect(res.body.config).not.toContain("Secret");
+    });
+
+    it("hides views whose roles exclude root from the root role too", async () => {
+      const config = baseConfig({
+        views: [
+          {
+            type: "table",
+            label: "Clients only",
+            tableName: "orders",
+            roles: ["client"],
+            filtersFromUser: (id) => `client_id = ${id}`,
+            columns: [],
+          },
+          fruitView(),
+        ],
+      });
+      const res = await getConfig(app(config, { role: "root", userId: 1 }));
+      expect(res.body.config).not.toContain("Clients only");
+      expect(res.body.config).toContain("Fruits");
+    });
+
+    it("marks views root can only read as read-only for root", async () => {
+      const config = baseConfig({
+        views: [fruitView({ roles: ["editor"], readRoles: ["root"] })],
+      });
+      const res = await getConfig(app(config, { role: "root", userId: 1 }));
+      expect(res.body.config).toContain('"canEdit":false');
+      expect(res.body.config).toContain('"canCreate":false');
+    });
+
+    it("keeps views when the role is in readRoles and makes them read-only", async () => {
+      const config = baseConfig({
+        views: [
+          fruitView({
+            roles: ["editor"],
+            readRoles: ["viewer"],
+          }),
+        ],
+      });
+      const res = await getConfig(app(config, VIEWER));
+      expect(res.body.config).toContain("Fruits");
+      expect(res.body.config).toContain('"canEdit":false');
+      expect(res.body.config).toContain('"canCreate":false');
+      expect(res.body.config).toContain('"canDelete":false');
+      expect(res.body.config).toContain('"clickToEdit":false');
+    });
+
+    it("filters columns by column.roles", async () => {
+      const config = baseConfig({
+        views: [
+          fruitView({
+            columns: [
+              { label: "Nom", name: "fruitName" },
+              { label: "Secret", name: "secret", roles: ["admin"] },
+            ],
+          }),
+        ],
+      });
+      const res = await getConfig(app(config, VIEWER));
+      expect(res.body.config).toContain("Nom");
+      expect(res.body.config).not.toContain("Secret");
+    });
+
+    it("serves non-table views untouched by the column filter", async () => {
+      const config = baseConfig({
+        views: [
+          fruitView(),
+          { type: "iframe", label: "External", src: "https://example.com" },
+        ],
+      });
+      const res = await getConfig(app(config, VIEWER));
+      expect(res.body.config).toContain("External");
+    });
+
+    it("enriches table views from information_schema on MySQL", async () => {
+      const config = baseConfig({
+        views: [
+          fruitView({
+            tableName: "fruit_tags",
+            columns: [
+              { label: "Tag", name: "tag" },
+              { label: "Fruit", name: "fruitId" },
+            ],
+          }),
+        ],
+      });
+      const res = await getConfig(app(config));
+      if (harness.dbType === "POSTGRESQL") {
+        // GAP 10: enrichment filters information_schema by table_schema =
+        // database name, but PG's schema is "public" — no rows match, so
+        // primaryId/required/dataType are never resolved on PG.
+        expect(res.body.config).not.toContain('"primaryId"');
+        expect(res.body.config).not.toContain('"required"');
+      } else {
+        // tag and fruitId are NOT NULL: enrichment marks them required and
+        // resolves the fruit_tags PK as primaryId.
+        expect(res.body.config).toContain('"primaryId":"id"');
+        expect(res.body.config).toContain('"required":true');
+      }
+    });
+  });
+});