@galadrim/galadmin 0.1.236 → 0.2.6

package/tests/integration/routes.records.integration.test.ts

@@ -0,0 +1,634 @@
+import * as request from "supertest";
+import { generateUniqueIdForObject } from "../../src/api";
+import { buildAppForManager } from "../helpers/app";
+import { baseConfig, fruitView, EDITOR, VIEWER } from "../helpers/fixtures";
+import {
+  BackendName,
+  DbHarness,
+  describeIntegration,
+  getMysql2Harness,
+  getMysqlHarness,
+  getPgHarness,
+  resetTables,
+} from "./dbHarness";
+
+jest.mock("axios");
+
+/**
+ * /records, /adjacentRecordId and /record against real engines. Every
+ * SQL-composition property the scripted suite asserted (pagination, LIKE
+ * search, filter merging, ordering, grouping, custom queries) is verified by
+ * what the engine actually returns.
+ */
+describeIntegration("records routes against real databases", () => {
+  const harnesses: Record<BackendName, DbHarness> = {} as any;
+
+  beforeAll(async () => {
+    harnesses.mysql = await getMysqlHarness();
+    harnesses.mysql2 = await getMysql2Harness();
+    harnesses.postgresql = await getPgHarness();
+  });
+
+  afterAll(async () => {
+    await harnesses.mysql?.stop();
+    await harnesses.mysql2?.stop();
+    await harnesses.postgresql?.stop();
+  });
+
+  describe.each([
+    ["mysql", () => harnesses.mysql],
+    ["mysql2", () => harnesses.mysql2],
+    ["postgresql", () => harnesses.postgresql],
+  ])("backend: %s", (_backend, getHarness) => {
+    let harness: DbHarness;
+
+    beforeEach(async () => {
+      harness = getHarness();
+      await resetTables(harness);
+    });
+
+    const app = (overrides: any = {}, user: any = EDITOR) =>
+      buildAppForManager(
+        harness.manager,
+        baseConfig({ views: [fruitView({ primaryId: "id", ...overrides })] }),
+        user,
+      );
+
+    const postRecords = (instance: any, body: any) =>
+      request(instance).post("/api/records").send({
+        viewIndex: 0,
+        page: 1,
+        filters: [],
+        ...body,
+      });
+
+    const idsOf = (records: any[]) => records.map((r: any) => Number(r.id));
+
+    describe("POST /api/records", () => {
+      it("returns paginated records with a count", async () => {
+        const instance = app();
+        for (const name of ["pomme", "poire", "banane"]) {
+          await request(instance)
+            .post("/api/createRecord")
+            .send({ viewIndex: 0, data: { fruitName: name } })
+            .expect(200);
+        }
+        const res = await postRecords(instance, { page: 1 }).expect(200);
+        expect(res.body.records).toHaveLength(3);
+        // PG returns COUNT(*) as a bigint string.
+        expect(String(res.body.count)).toBe("3");
+        expect(res.body.input.query).toBeDefined();
+      });
+
+      it("indexes views as the root role sees them", async () => {
+        for (const name of ["pomme", "poire"]) {
+          await request(app())
+            .post("/api/createRecord")
+            .send({ viewIndex: 0, data: { fruitName: name } })
+            .expect(200);
+        }
+        // The first view in the raw config is invisible to root; viewIndex
+        // must resolve against the root-filtered list, where the fruits view
+        // is index 0. Selecting the raw index 0 would hit the (nonexistent)
+        // orders table and fail.
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig({
+            views: [
+              {
+                type: "table",
+                label: "Clients only",
+                tableName: "orders",
+                roles: ["client"],
+                filtersFromUser: (id) => `client_id = ${id}`,
+                columns: [{ label: "Id", name: "id" }],
+              },
+              fruitView({ primaryId: "id" }),
+            ],
+          }),
+          { role: "root", userId: 1 },
+        );
+        const res = await postRecords(instance, { page: 1 }).expect(200);
+        expect(idsOf(res.body.records)).toEqual([1, 2]);
+      });
+
+      it("applies view.limit and page-based OFFSET", async () => {
+        const instance = app({ limit: 5 });
+        for (let i = 1; i <= 7; i++) {
+          await request(instance)
+            .post("/api/createRecord")
+            .send({ viewIndex: 0, data: { fruitName: `fruit${i}` } })
+            .expect(200);
+        }
+        const page1 = await postRecords(instance, { page: 1 }).expect(200);
+        expect(page1.body.records).toHaveLength(5);
+        expect(idsOf(page1.body.records)).toEqual([1, 2, 3, 4, 5]);
+        // The count wraps the query WITHOUT its LIMIT/OFFSET: it is the
+        // total matching row count, not the page size.
+        expect(String(page1.body.count)).toBe("7");
+        const page2 = await postRecords(instance, { page: 2 }).expect(200);
+        expect(page2.body.records).toHaveLength(2);
+        expect(idsOf(page2.body.records)).toEqual([6, 7]);
+        expect(String(page2.body.count)).toBe("7");
+        const page3 = await postRecords(instance, { page: 3 }).expect(200);
+        expect(page3.body.records).toHaveLength(0);
+      });
+
+      it("never produces a negative OFFSET", async () => {
+        const instance = app();
+        for (const name of ["a", "b", "c"]) {
+          await request(instance)
+            .post("/api/createRecord")
+            .send({ viewIndex: 0, data: { fruitName: name } })
+            .expect(200);
+        }
+        const res = await postRecords(instance, { page: 0 }).expect(200);
+        expect(res.body.records).toHaveLength(3);
+      });
+
+      it("searches via searchableName expressions and skips searchable:false columns", async () => {
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              columns: [
+                { label: "Nom", name: "fruitName", searchable: false },
+                {
+                  label: "Tout",
+                  name: "irrelevant",
+                  searchableName: "CONCAT_WS(' ', fruitName, acidity)",
+                },
+              ],
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme", acidity: 1 } })
+          .expect(200);
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "x", acidity: 42 } })
+          .expect(200);
+        // "x 42" only matches through the CONCAT_WS expression (the
+        // fruitName column is not searchable).
+        const res = await postRecords(instance, { query: "x 42" }).expect(200);
+        expect(res.body.records).toHaveLength(1);
+        expect(res.body.records[0].fruitName).toBe("x");
+        const res2 = await postRecords(instance, {
+          query: "pomme",
+        }).expect(200);
+        expect(res2.body.records).toHaveLength(1);
+        expect(res2.body.records[0].fruitName).toBe("pomme");
+      });
+
+      it("escapes single quotes in the search term", async () => {
+        const instance = app();
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "l'orange" } })
+          .expect(200);
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "orange" } })
+          .expect(200);
+        const res = await postRecords(instance, {
+          query: "l'orange",
+        }).expect(200);
+        expect(res.body.records).toHaveLength(1);
+        expect(res.body.records[0].fruitName).toBe("l'orange");
+      });
+
+      it("merges view filters, client filters and filtersFromUser", async () => {
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              filters: "acidity < 10",
+              filtersFromUser: (userId: number) => `ownerId = ${userId}`,
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+          EDITOR,
+        );
+        // Passes all three conditions.
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "ok", acidity: 5, ownerId: 2 } })
+          .expect(200);
+        // Rejected by the view filter.
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "acidic", acidity: 15, ownerId: 2 } })
+          .expect(200);
+        // Rejected by filtersFromUser.
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "foreign", acidity: 5, ownerId: 3 } })
+          .expect(200);
+        const res = await postRecords(instance, {
+          filters: ["acidity > 2"],
+        }).expect(200);
+        expect(res.body.records).toHaveLength(1);
+        expect(res.body.records[0].fruitName).toBe("ok");
+      });
+
+      it("sorts by orderBy DESC with the primaryId as tiebreak", async () => {
+        const instance = app();
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "a", acidity: 1 } })
+          .expect(200);
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "b", acidity: 3 } })
+          .expect(200);
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "c", acidity: 3 } })
+          .expect(200);
+        const res = await postRecords(instance, {
+          orderBy: "acidity",
+          isDesc: true,
+        }).expect(200);
+        // acidity DESC first, then the id tiebreak ASC: row 3 (acidity 3)
+        // comes after row 2 (also acidity 3), row 1 (acidity 1) last.
+        expect(idsOf(res.body.records)).toEqual([2, 3, 1]);
+      });
+
+      it("falls back to view.isDesc when body.isDesc is null", async () => {
+        const instance = app({ isDesc: true });
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "a", acidity: 3 } })
+          .expect(200);
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "b", acidity: 1 } })
+          .expect(200);
+        const res = await postRecords(instance, {
+          orderBy: "acidity",
+          isDesc: null,
+        }).expect(200);
+        expect(idsOf(res.body.records)).toEqual([1, 2]);
+      });
+
+      it("orders by primaryId alone when no orderBy is given", async () => {
+        const instance = app();
+        for (const name of ["c", "a", "b"]) {
+          await request(instance)
+            .post("/api/createRecord")
+            .send({ viewIndex: 0, data: { fruitName: name } })
+            .expect(200);
+        }
+        const res = await postRecords(instance, {}).expect(200);
+        expect(idsOf(res.body.records)).toEqual([1, 2, 3]);
+      });
+
+      it("CHARACTERIZATION: grouped subviews run on PG but are rejected by MySQL's ONLY_FULL_GROUP_BY", async () => {
+        const config = {
+          views: [
+            fruitView({
+              // No declared primaryId: on MySQL enrichment resolves it and
+              // the route appends it to ORDER BY; on PG enrichment no-ops
+              // (GAP 10) and it stays undefined.
+              // Grouped select: every projected column must be grouped or
+              // aggregated (ONLY_FULL_GROUP_BY / standard SQL). The column
+              // is table-qualified because the join exposes activity_id on
+              // both sides.
+              selectExpression: "fruits.activity_id, MAX(age) AS maxAge",
+              join:
+                "JOIN activities ON fruits.activity_id = activities.activity_id",
+              groupBy: "fruits.activity_id",
+              subviews: [
+                {
+                  label: "Old",
+                  filters: "age > 50",
+                  having: "MAX(age) > 10",
+                  orderBy: "maxAge",
+                },
+              ],
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await harness.query(
+          "INSERT INTO activities (name) VALUES (?)",
+          ["running"],
+        );
+        await harness.query(
+          "INSERT INTO activities (name) VALUES (?)",
+          ["chess"],
+        );
+        await harness.query(
+          "INSERT INTO fruits (fruitName, age, activity_id) VALUES (?, ?, ?)",
+          ["young-pomme", 30, 1],
+        );
+        await harness.query(
+          "INSERT INTO fruits (fruitName, age, activity_id) VALUES (?, ?, ?)",
+          ["old-pomme", 60, 1],
+        );
+        await harness.query(
+          "INSERT INTO fruits (fruitName, age, activity_id) VALUES (?, ?, ?)",
+          ["chess-fruit", 20, 2],
+        );
+        const res = await request(instance)
+          .post("/api/records")
+          .send({ viewIndex: 0, page: 1, subviewIndex: 0, filters: [] });
+        if (harness.dbType === "POSTGRESQL") {
+          // Without the appended primaryId tiebreak the grouped query is
+          // valid: only activity 1 survives age>50 + MAX(age)>10.
+          expect(res.status).toBe(200);
+          expect(res.body.records).toHaveLength(1);
+          expect(Number(res.body.records[0].activity_id)).toBe(1);
+          expect(Number(res.body.records[0].maxAge)).toBe(60);
+          expect(String(res.body.count)).toBe("1");
+        } else {
+          // GAP: the route always appends the bare primaryId (fruits.id) as
+          // an ORDER BY tiebreak. fruits.id is neither grouped nor
+          // aggregated, so MySQL's ONLY_FULL_GROUP_BY (the 8.x default)
+          // rejects every grouped view.
+          expect(res.status).toBe(500);
+        }
+      });
+
+      it("uses customQuery when set", async () => {
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              customQuery: "SELECT * FROM fruits WHERE acidity > 5",
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "sweet", acidity: 9 } })
+          .expect(200);
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "bland", acidity: 1 } })
+          .expect(200);
+        const res = await postRecords(instance, {}).expect(200);
+        expect(res.body.records).toHaveLength(1);
+        expect(res.body.records[0].fruitName).toBe("sweet");
+      });
+
+      it("enriches records with __formatValue-*__ fields", async () => {
+        const formatter = (record: any) => `${record.fruitName} kg`;
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              columns: [
+                { label: "Nom", name: "fruitName", formatValue: formatter },
+                { label: "Acidité", name: "acidity" },
+              ],
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme" } })
+          .expect(200);
+        const res = await postRecords(instance, {}).expect(200);
+        // Enrichment hashes the pristine column object (before it gains
+        // required/dataType), so the id is the hash of the initial literal.
+        const colId = generateUniqueIdForObject({
+          label: "Nom",
+          name: "fruitName",
+        });
+        expect(res.body.records[0][`__formatValue-${colId}__`]).toBe(
+          "pomme kg",
+        );
+      });
+
+      it("returns 500 when the engine rejects the query", async () => {
+        const config = {
+          views: [
+            fruitView({ tableName: "table_does_not_exist", primaryId: "id" }),
+          ],
+        };
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/records")
+          .send({ viewIndex: 0, page: 1, filters: [] })
+          .expect(500);
+      });
+
+      // NOTE: the unit suite also covered a "falls back to counting fetched
+      // rows when the count query fails" branch. That defensive path is not
+      // reachable on a healthy engine — when the wrapped query runs, its
+      // COUNT(*) projection runs too — so it has no real-engine equivalent.
+
+      it("serves rows scoped per-user via filtersFromUser(userId, role)", async () => {
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              filtersFromUser: (userId: number, role?: string) =>
+                `ownerId = ${userId} AND role = '${role}'`,
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+          EDITOR,
+        );
+        await request(instance)
+          .post("/api/createRecord")
+          .send({
+            viewIndex: 0,
+            data: { fruitName: "mine", ownerId: 2, role: "editor" },
+          })
+          .expect(200);
+        await request(instance)
+          .post("/api/createRecord")
+          .send({
+            viewIndex: 0,
+            data: { fruitName: "root-fruit", ownerId: 2, role: "root" },
+          })
+          .expect(200);
+        const res = await postRecords(instance, {}).expect(200);
+        expect(res.body.records).toHaveLength(1);
+        expect(res.body.records[0].fruitName).toBe("mine");
+      });
+    });
+
+    describe("POST /api/adjacentRecordId", () => {
+      const seedFruits = async (instance: any) => {
+        for (const name of ["pomme", "poire", "banane", "cerise", "datte"]) {
+          await request(instance)
+            .post("/api/createRecord")
+            .send({ viewIndex: 0, data: { fruitName: name } })
+            .expect(200);
+        }
+      };
+
+      it("returns the id of the record at position + offset", async () => {
+        const instance = app();
+        await seedFruits(instance);
+        const res = await request(instance)
+          .post("/api/adjacentRecordId")
+          .send({ position: "2", offset: "-1", primaryId: "id", table: "fruits" })
+          .expect(200);
+        // page = position + offset = 1 record per page → the first record.
+        expect(res.body).toEqual({ recordId: 1 });
+      });
+
+      it("returns null when no record exists at that position", async () => {
+        const instance = app();
+        await seedFruits(instance);
+        const res = await request(instance)
+          .post("/api/adjacentRecordId")
+          .send({ position: "99", offset: "0", primaryId: "id", table: "fruits" })
+          .expect(200);
+        expect(res.body).toEqual({ recordId: null });
+      });
+    });
+
+    describe("GET /api/record", () => {
+      it("returns a single record by primary id", async () => {
+        const instance = app();
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme", acidity: 3 } })
+          .expect(200);
+        const res = await request(instance)
+          .get("/api/record")
+          .query({ viewIndex: 0, recordId: 1 })
+          .expect(200);
+        expect(res.body.fruitName).toBe("pomme");
+        expect(Number(res.body.acidity)).toBe(3);
+      });
+
+      it("applies selectExpression and join from the view", async () => {
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              selectExpression: "*, a.name AS activityName",
+              join:
+                "JOIN activities a ON fruits.activity_id = a.activity_id",
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await harness.query(
+          "INSERT INTO activities (name) VALUES (?)",
+          ["running"],
+        );
+        // A fruit attached to an activity joins through.
+        await harness.query(
+          "INSERT INTO fruits (fruitName, activity_id) VALUES (?, ?)",
+          ["pomme", 1],
+        );
+        // A fruit without an activity disappears through the inner join.
+        await harness.query(
+          "INSERT INTO fruits (fruitName, activity_id) VALUES (?, ?)",
+          ["lonely", null],
+        );
+        const found = await request(instance)
+          .get("/api/record")
+          .query({ viewIndex: 0, recordId: 1 })
+          .expect(200);
+        expect(found.body.fruitName).toBe("pomme");
+        expect(found.body.activityName).toBe("running");
+        await request(instance)
+          .get("/api/record")
+          .query({ viewIndex: 0, recordId: 2 })
+          .expect(404);
+      });
+
+      it("returns 404 when the record does not exist", async () => {
+        await request(app())
+          .get("/api/record")
+          .query({ viewIndex: 0, recordId: 999 })
+          .expect(404);
+      });
+
+      it("returns 500 on db error", async () => {
+        const config = {
+          views: [
+            fruitView({ tableName: "table_does_not_exist", primaryId: "id" }),
+          ],
+        };
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .get("/api/record")
+          .query({ viewIndex: 0, recordId: 5 })
+          .expect(500);
+      });
+
+      it("enriches the record with formatValue columns", async () => {
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              columns: [
+                {
+                  label: "Nom",
+                  name: "fruitName",
+                  formatValue: (r: any) => r.fruitName.toUpperCase(),
+                },
+                { label: "Acidité", name: "acidity" },
+              ],
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme" } })
+          .expect(200);
+        const res = await request(instance)
+          .get("/api/record")
+          .query({ viewIndex: 0, recordId: 1 })
+          .expect(200);
+        const colId = generateUniqueIdForObject({
+          label: "Nom",
+          name: "fruitName",
+        });
+        expect(res.body[`__formatValue-${colId}__`]).toBe("POMME");
+      });
+
+      it("rejects writes for views hidden to the role (403)", async () => {
+        const config = {
+          views: [fruitView({ primaryId: "id", roles: ["admin"] })],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+          VIEWER,
+        );
+        await request(instance)
+          .post("/api/updateRecord")
+          .send({ viewIndex: 0, data: {}, primaryValue: 1 })
+          .expect(403);
+      });
+    });
+  });
+});