@galadrim/galadmin 0.1.236 → 0.2.6

package/tests/__mocks__/@google-cloud/storage.js

@@ -0,0 +1,7 @@
+const upload = jest.fn().mockResolvedValue([{}]);
+const bucket = jest.fn(() => ({ upload }));
+module.exports = {
+  Storage: jest.fn(() => ({ bucket })),
+  __bucket: bucket,
+  __upload: upload,
+};

package/tests/__mocks__/argon2.js

@@ -0,0 +1,3 @@
+module.exports = {
+  verify: jest.fn().mockResolvedValue(true),
+};

package/tests/__mocks__/axios.js

@@ -0,0 +1,7 @@
+const axios = {
+  get: jest.fn(),
+  post: jest.fn(),
+  put: jest.fn(),
+};
+module.exports = axios;
+module.exports.default = axios;

package/tests/__mocks__/connect-pg-simple.js

@@ -0,0 +1,24 @@
+// use the REAL express-session Store base class (provides createSession,
+// EventEmitter, regenerate) and only stub the storage round-trip
+const expressSession = require("express-session");
+
+function createStore() {
+  const sessions = {};
+  const store = new expressSession.Store();
+  store.get = (sid, cb) => cb(null, sessions[sid]);
+  store.set = (sid, sess, cb) => {
+    sessions[sid] = sess;
+    if (cb) cb();
+  };
+  store.destroy = (sid, cb) => {
+    delete sessions[sid];
+    if (cb) cb();
+  };
+  return store;
+}
+
+const storeConstructor = jest.fn(() => createStore());
+const PgSessionStore = jest.fn(() => storeConstructor);
+module.exports = PgSessionStore;
+module.exports.__PgSessionStore = PgSessionStore;
+module.exports.__storeConstructor = storeConstructor;

package/tests/__mocks__/express-mysql-session.js

@@ -0,0 +1,24 @@
+// use the REAL express-session Store base class (provides createSession,
+// EventEmitter, regenerate) and only stub the storage round-trip
+const expressSession = require("express-session");
+
+function createStore() {
+  const sessions = {};
+  const store = new expressSession.Store();
+  store.get = (sid, cb) => cb(null, sessions[sid]);
+  store.set = (sid, sess, cb) => {
+    sessions[sid] = sess;
+    if (cb) cb();
+  };
+  store.destroy = (sid, cb) => {
+    delete sessions[sid];
+    if (cb) cb();
+  };
+  return store;
+}
+
+const storeConstructor = jest.fn(() => createStore());
+const MySQLSessionStore = jest.fn(() => storeConstructor);
+module.exports = MySQLSessionStore;
+module.exports.__MySQLSessionStore = MySQLSessionStore;
+module.exports.__storeConstructor = storeConstructor;

package/tests/__mocks__/mysql2/promise.js

@@ -0,0 +1,3 @@
+module.exports = {
+  createPool: jest.fn(() => ({})),
+};

package/tests/__mocks__/pg.js

@@ -0,0 +1,3 @@
+module.exports = {
+  Pool: jest.fn(() => ({})),
+};

package/tests/__mocks__/rollup.js

@@ -0,0 +1,5 @@
+const generate = jest
+  .fn()
+  .mockResolvedValue({ output: [{ code: "// mocked bundle" }] });
+const rollup = jest.fn().mockResolvedValue({ generate });
+module.exports = { rollup, __generate: generate };

package/tests/__mocks__/ssh2-sftp-client.js

@@ -0,0 +1,10 @@
+const connect = jest.fn().mockResolvedValue(undefined);
+const fastPut = jest.fn().mockResolvedValue(undefined);
+const end = jest.fn().mockResolvedValue(undefined);
+
+function SftpClient() {
+  return { connect, fastPut, end };
+}
+
+module.exports = SftpClient;
+module.exports.__sftp = { connect, fastPut, end };

package/tests/api-helpers.test.ts

@@ -0,0 +1,376 @@
+import {
+  generateUniqueIdForObject,
+  roleOf,
+  canWriteView,
+  viewFromRequest,
+  MUTATING_VIEW_ROUTES,
+  areSafeColumnNames,
+  writableTables,
+  looksLikeSqlBreakout,
+  sqlAnd,
+  evalExpression,
+  getFormattedValue,
+  formatValueForInsertion,
+  collectAllowedQueries,
+  enrichConfig,
+  enrichColumn,
+} from "../src/api";
+import { FakeDb } from "./helpers/fakeDb";
+import { baseConfig, schemaRow } from "./helpers/fixtures";
+
+describe("generateUniqueIdForObject", () => {
+  it("returns a stable 64-char sha256 hex id", () => {
+    const obj = { label: "Fruits", type: "table" };
+    const id = generateUniqueIdForObject(obj);
+    expect(id).toMatch(/^[a-f0-9]{64}$/);
+    expect(generateUniqueIdForObject(obj)).toBe(id);
+  });
+
+  it("differs for different objects", () => {
+    expect(generateUniqueIdForObject({ a: 1 })).not.toBe(
+      generateUniqueIdForObject({ a: 2 }),
+    );
+  });
+});
+
+describe("roleOf", () => {
+  it("reads the session user role", () => {
+    expect(roleOf({ session: { user: { role: "editor" } } })).toBe("editor");
+  });
+  it("returns undefined without a session", () => {
+    expect(roleOf({})).toBeUndefined();
+    expect(roleOf({ session: {} })).toBeUndefined();
+  });
+});
+
+describe("canWriteView", () => {
+  it("always allows root", () => {
+    expect(canWriteView({ roles: ["editor"] }, "root")).toBe(true);
+  });
+  it("allows views without roles", () => {
+    expect(canWriteView({}, "editor")).toBe(true);
+    expect(canWriteView(undefined, "editor")).toBe(true);
+  });
+  it("allows roles listed in view.roles", () => {
+    expect(canWriteView({ roles: ["editor", "viewer"] }, "editor")).toBe(true);
+  });
+  it("rejects roles not listed", () => {
+    expect(canWriteView({ roles: ["editor"] }, "viewer")).toBe(false);
+  });
+});
+
+describe("viewFromRequest", () => {
+  it("resolves the view from body.viewIndex", () => {
+    const req = { body: { viewIndex: 1 }, config: { views: ["a", "b"] } };
+    expect(viewFromRequest(req)).toBe("b");
+  });
+  it("resolves the view from query.viewIndex", () => {
+    const req = { query: { viewIndex: "0" }, config: { views: ["a", "b"] } };
+    expect(viewFromRequest(req)).toBe("a");
+  });
+  it("returns undefined without a config or index", () => {
+    expect(viewFromRequest({ body: {} })).toBeUndefined();
+    expect(viewFromRequest({ body: { viewIndex: 0 }, config: {} })).toBeUndefined();
+  });
+});
+
+describe("MUTATING_VIEW_ROUTES", () => {
+  it("covers every mutating view route", () => {
+    expect([...MUTATING_VIEW_ROUTES].sort()).toEqual(
+      [
+        "/customAction",
+        "/createRecord",
+        "/deleteRecord",
+        "/deleteRecordFromPanel",
+        "/deleteRecords",
+        "/updateRecord",
+        "/uploadFile",
+      ].sort(),
+    );
+  });
+});
+
+describe("areSafeColumnNames", () => {
+  it("accepts plain identifiers", () => {
+    expect(areSafeColumnNames({ fruitName: "a", acidity2: 1 })).toBe(true);
+  });
+  it("accepts empty/missing data", () => {
+    expect(areSafeColumnNames({})).toBe(true);
+    expect(areSafeColumnNames(undefined)).toBe(true);
+    expect(areSafeColumnNames(null)).toBe(true);
+  });
+  it("rejects SQL-breaking keys", () => {
+    expect(areSafeColumnNames({ "a;b": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "a b": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "a-b": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "`a`": 1 })).toBe(false);
+    expect(areSafeColumnNames({ "a'": 1 })).toBe(false);
+  });
+});
+
+describe("writableTables", () => {
+  const config = {
+    views: [
+      {
+        tableName: "fruits",
+        roles: ["editor"],
+        recordViewPanels: [
+          { tableName: "fruit_notes" },
+          { createConfig: { tableName: "fruit_tags" } },
+        ],
+      },
+      { tableName: "open_table" },
+    ],
+  };
+  it("collects writable view + panel tables for the role", () => {
+    const req = { config, session: { user: { role: "editor" } } };
+    expect([...writableTables(req)].sort()).toEqual([
+      "fruit_notes",
+      "fruit_tags",
+      "fruits",
+      "open_table",
+    ]);
+  });
+  it("only collects unrole'd tables for an unknown role", () => {
+    const req = { config, session: { user: { role: "stranger" } } };
+    expect([...writableTables(req)]).toEqual(["open_table"]);
+  });
+  it("an unrole'd view is writable by any role", () => {
+    const req = { config, session: { user: { role: "editor" } } };
+    expect(writableTables(req).has("open_table")).toBe(true);
+  });
+});
+
+describe("looksLikeSqlBreakout", () => {
+  it("rejects every blocked pattern", () => {
+    const attacks = [
+      "1=1; DROP TABLE fruits",
+      "1=1 -- comment",
+      "1=1 /* c */",
+      "a UNION SELECT b",
+      "x INTO OUTFILE '/tmp/f'",
+      "x INTO DUMPFILE '/tmp/f'",
+      "SLEEP(10)",
+      "BENCHMARK(1000, MD5('a'))",
+      "LOAD_FILE('/etc/passwd')",
+    ];
+    for (const a of attacks) {
+      expect(looksLikeSqlBreakout(a)).toBe(true);
+    }
+  });
+  it("accepts ordinary filter fragments", () => {
+    expect(looksLikeSqlBreakout("age < 50 AND name = 'pomme'")).toBe(false);
+    expect(looksLikeSqlBreakout("price > 10.5")).toBe(false);
+  });
+  it("ignores non-strings", () => {
+    expect(looksLikeSqlBreakout(undefined)).toBe(false);
+    expect(looksLikeSqlBreakout(42)).toBe(false);
+  });
+});
+
+describe("sqlAnd", () => {
+  it("joins non-empty conditions with AND, each parenthesized", () => {
+    expect(sqlAnd(["a = 1", "b = 2"])).toBe("(a = 1) AND (b = 2)");
+  });
+  it("returns the single condition as-is", () => {
+    expect(sqlAnd(["a = 1"])).toBe("a = 1");
+  });
+  it("skips falsy/empty conditions", () => {
+    expect(sqlAnd([null, "", "a = 1", undefined])).toBe("a = 1");
+  });
+  it("returns null when nothing remains", () => {
+    expect(sqlAnd([null, ""])).toBeNull();
+    expect(sqlAnd([])).toBeNull();
+  });
+});
+
+describe("evalExpression", () => {
+  it("evaluates an expression against record fields", () => {
+    expect(
+      evalExpression("weight + ' kg'", { weight: 42 }),
+    ).toBe("42 kg");
+  });
+  it("handles object fields via JSON", () => {
+    expect(evalExpression("user.name", { user: { name: "bob" } })).toBe("bob");
+  });
+  it("escapes quotes and strips newlines in strings", () => {
+    expect(
+      evalExpression("text", { text: "l'orange" }),
+    ).toBe("l'orange");
+    expect(evalExpression("text", { text: "a\nb" })).toBe("ab");
+  });
+  it("returns 'Error' when evaluation fails", () => {
+    expect(evalExpression("notAVar + 1", {})).toBe("Error");
+  });
+});
+
+describe("getFormattedValue", () => {
+  it("prefers formatValueForExport", async () => {
+    const column = {
+      name: "a",
+      formatValueForExport: () => "export",
+      formatValue: () => "display",
+    };
+    await expect(getFormattedValue(column, { a: 1 })).resolves.toBe("export");
+  });
+  it("then formattedValue (evaluated)", async () => {
+    const column = { name: "a", formattedValue: "a + '!'" };
+    await expect(getFormattedValue(column, { a: "x" })).resolves.toBe("x!");
+  });
+  it("then formatValue", async () => {
+    const column = { name: "a", formatValue: (r: any) => r.a + "?" };
+    await expect(getFormattedValue(column, { a: "x" })).resolves.toBe("x?");
+  });
+  it("tinyint renders Oui/Non", async () => {
+    await expect(getFormattedValue({ dataType: "tinyint", name: "a" }, { a: 1 })).resolves.toBe("Oui");
+    await expect(getFormattedValue({ dataType: "tinyint", name: "a" }, { a: 0 })).resolves.toBe("Non");
+  });
+  it("falls back to the raw value", async () => {
+    await expect(getFormattedValue({ name: "a" }, { a: "raw" })).resolves.toBe("raw");
+  });
+  it("renders null/undefined as empty string", async () => {
+    await expect(getFormattedValue({ name: "a" }, {})).resolves.toBe("");
+    await expect(getFormattedValue({ name: "a" }, { a: null })).resolves.toBe("");
+  });
+  it("exposes column.options on the record (documented mutation)", async () => {
+    const record: any = {};
+    await getFormattedValue({ name: "a", options: ["x"] }, record);
+    expect(record.options).toEqual(["x"]);
+  });
+});
+
+describe("formatValueForInsertion", () => {
+  it("maps falsy (but not 0) to NULL", () => {
+    expect(formatValueForInsertion(null, "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion(undefined, "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion("", "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion(false, "MYSQL")).toBe("NULL");
+    expect(formatValueForInsertion(0, "MYSQL")).toBe(0);
+  });
+  it("serializes dates as ISO", () => {
+    const d = new Date("2024-01-02T03:04:05.000Z");
+    expect(formatValueForInsertion(d, "MYSQL")).toBe("2024-01-02T03:04:05.000Z");
+  });
+  it("quotes strings with dialect-appropriate escaping", () => {
+    expect(formatValueForInsertion("l'orange", "MYSQL")).toBe("'l\\'orange'");
+    expect(formatValueForInsertion("l'orange", "POSTGRESQL")).toBe("'l''orange'");
+  });
+  it("serializes objects as JSON literals", () => {
+    expect(formatValueForInsertion({ a: "b'c" }, "MYSQL")).toBe(
+      '\'{"a":"b\\\'c"}\'',
+    );
+  });
+  it("serializes booleans as TRUE (false is swallowed as NULL — documented quirk)", () => {
+    expect(formatValueForInsertion(true, "MYSQL")).toBe("TRUE");
+    expect(formatValueForInsertion(false, "POSTGRESQL")).toBe("NULL");
+  });
+  it("passes numbers through", () => {
+    expect(formatValueForInsertion(12.5, "MYSQL")).toBe(12.5);
+  });
+});
+
+describe("collectAllowedQueries", () => {
+  it("collects `query` and *Query string props recursively", () => {
+    const config = {
+      views: [
+        {
+          recordViewPanels: [
+            { query: "  SELECT 1  " },
+            { notificationBadge: { query: "SELECT 2" } },
+          ],
+        },
+        { columns: [{ autocompleteListQuery: "SELECT 3" }] },
+      ],
+    };
+    expect(collectAllowedQueries(config)).toEqual(
+      new Set(["SELECT 1", "SELECT 2", "SELECT 3"]),
+    );
+  });
+  it("ignores non-string and non-matching values", () => {
+    expect(collectAllowedQueries({ query: 42, queryString: "no" })).toEqual(
+      new Set(),
+    );
+  });
+});
+
+describe("enrichConfig", () => {
+  it("resolves primaryId from PRI columns and flags the config enriched", async () => {
+    const db = new FakeDb();
+    db.schemaRows = [
+      schemaRow("fruits", "id", { primary: true, dataType: "int" }),
+    ];
+    const config = baseConfig();
+    await enrichConfig(config, db);
+    expect(config.views[0].primaryId).toBe("id");
+    expect(config.enriched).toBe(true);
+    expect(config.views[0].__id__).toMatch(/^[a-f0-9]{64}$/);
+  });
+
+  it("does nothing on db error", async () => {
+    const db = new FakeDb();
+    // information_schema is intercepted, so simulate the error there
+    const origQuery = db.query.bind(db);
+    db.query = async (sql: string) => {
+      if (sql.includes("information_schema")) {
+        return { err: new Error("boom"), rows: null };
+      }
+      return origQuery(sql);
+    };
+    const config = baseConfig();
+    await enrichConfig(config, db);
+    expect(config.enriched).toBeUndefined();
+    expect(config.views[0].primaryId).toBeUndefined();
+  });
+});
+
+describe("enrichColumn", () => {
+  const info = [
+    schemaRow("fruits", "title", { nullable: false, dataType: "varchar" }),
+    schemaRow("fruits", "state", { dataType: "enum", columnType: "enum('a','b')" }),
+    schemaRow("fruits", "body", { nullable: true, dataType: "text" }),
+  ];
+
+  it("assigns an __id__ and infers dataType + required from the schema", () => {
+    const column: any = { label: "Titre", name: "title" };
+    enrichColumn(column, "fruits", info);
+    expect(column.__id__).toMatch(/^[a-f0-9]{64}$/);
+    expect(column.dataType).toBe("varchar");
+    expect(column.required).toBe(true);
+  });
+
+  it("does not force required on nullable/text columns", () => {
+    const column: any = { label: "Body", name: "body" };
+    enrichColumn(column, "fruits", info);
+    expect(column.required).toBeUndefined();
+  });
+
+  it("converts enum columns to select with parsed options", () => {
+    const column: any = { label: "State", name: "state" };
+    enrichColumn(column, "fruits", info);
+    expect(column.dataType).toBe("select");
+    expect(column.options).toEqual(["a", "b"]);
+  });
+
+  it("rewrites richText column names to the content field", () => {
+    const column: any = { label: "Body", dataType: "richText", htmlField: "html", contentField: "body" };
+    enrichColumn(column, "fruits", info);
+    expect(column.name).toBe("body");
+  });
+
+  it("adds a baseUrl for file columns with s3/gcp config", () => {
+    const column: any = {
+      label: "Img",
+      dataType: "file",
+      name: "img",
+      s3Config: { host: "s3.example.com", bucket: "b" },
+    };
+    enrichColumn(column, "fruits", info);
+    expect(column.baseUrl).toBe("https://s3.example.com/b/");
+  });
+
+  it("keeps explicit dataType when the schema has an unknown column", () => {
+    const column: any = { label: "X", name: "ghost", dataType: "select" };
+    enrichColumn(column, "fruits", info);
+    expect(column.dataType).toBe("select");
+  });
+});

package/tests/dbManager.init.test.ts

@@ -0,0 +1,129 @@
+import dbManager from "../src/utils/dbManager";
+
+jest.mock("mysql", () => ({ createPool: jest.fn() }));
+jest.mock("mysql2", () => ({ createPool: jest.fn() }));
+jest.mock("pg", () => ({ Pool: jest.fn() }));
+
+import { createPool as mysqlCreatePool } from "mysql";
+import { createPool as mysql2CreatePool } from "mysql2";
+import { Pool as PgPool } from "pg";
+
+const mockMysqlCreatePool = mysqlCreatePool as unknown as jest.Mock;
+const mockMysql2CreatePool = mysql2CreatePool as unknown as jest.Mock;
+const mockPgPool = PgPool as unknown as jest.Mock;
+
+// Pool-construction wiring only; driver interaction is covered in
+// tests/integration/dbManager.integration.test.ts.
+describe("dbManager.init (pool wiring)", () => {
+  beforeEach(() => {
+    mockMysqlCreatePool.mockClear();
+    mockMysql2CreatePool.mockClear();
+    mockPgPool.mockClear();
+  });
+
+  const mysqlConfig = {
+    mysql: {
+      host: "db.local",
+      user: "root",
+      password: "secret",
+      database: "galadmin",
+    },
+  };
+
+  it("creates a mysql pool with the expected options", () => {
+    const manager = new dbManager();
+    manager.init(mysqlConfig);
+    expect(mockMysqlCreatePool).toHaveBeenCalledTimes(1);
+    expect(mockMysqlCreatePool).toHaveBeenCalledWith(
+      expect.objectContaining({
+        host: "db.local",
+        user: "root",
+        password: "secret",
+        database: "galadmin",
+        port: 3306,
+        charset: "UTF8MB4_GENERAL_CI",
+        dateStrings: true,
+        multipleStatements: false,
+      }),
+    );
+    expect(manager.dbType).toBe("MYSQL");
+  });
+
+  it("honours a custom mysql port", () => {
+    const manager = new dbManager();
+    manager.init({
+      mysql: { ...mysqlConfig.mysql, port: 3307 },
+    });
+    expect(mockMysqlCreatePool).toHaveBeenCalledWith(
+      expect.objectContaining({ port: 3307 }),
+    );
+  });
+
+  it("keeps multipleStatements OFF unless explicitly opted in", () => {
+    const manager = new dbManager();
+    manager.init({
+      mysql: { ...mysqlConfig.mysql, multipleStatements: true },
+    });
+    expect(mockMysqlCreatePool).toHaveBeenCalledWith(
+      expect.objectContaining({ multipleStatements: true }),
+    );
+  });
+
+  it("switches to the mysql2 driver with useMysql2", () => {
+    const manager = new dbManager();
+    manager.init({ ...mysqlConfig, useMysql2: true });
+    expect(mockMysqlCreatePool).not.toHaveBeenCalled();
+    expect(mockMysql2CreatePool).toHaveBeenCalledTimes(1);
+    expect(manager.dbType).toBe("MYSQL");
+  });
+
+  it("creates a pg pool with port and ssl defaults", () => {
+    const manager = new dbManager();
+    manager.init({
+      postgresql: {
+        host: "pg.local",
+        user: "admin",
+        password: "secret",
+        database: "galadmin",
+      },
+    });
+    expect(mockPgPool).toHaveBeenCalledTimes(1);
+    expect(mockPgPool).toHaveBeenCalledWith(
+      expect.objectContaining({
+        host: "pg.local",
+        user: "admin",
+        password: "secret",
+        database: "galadmin",
+        port: 5432,
+        ssl: undefined,
+      }),
+    );
+    expect(manager.dbType).toBe("POSTGRESQL");
+  });
+
+  it("passes the ssl option through to the pg pool", () => {
+    const manager = new dbManager();
+    const ssl = { rejectUnauthorized: false };
+    manager.init({
+      postgresql: {
+        host: "pg.local",
+        user: "admin",
+        password: "secret",
+        database: "galadmin",
+        ssl,
+      },
+    });
+    expect(mockPgPool).toHaveBeenCalledWith(
+      expect.objectContaining({ ssl }),
+    );
+  });
+
+  it("leaves the manager uninitialised without a database config", () => {
+    const manager = new dbManager();
+    manager.init({});
+    expect(mockMysqlCreatePool).not.toHaveBeenCalled();
+    expect(mockMysql2CreatePool).not.toHaveBeenCalled();
+    expect(mockPgPool).not.toHaveBeenCalled();
+    expect(manager.dbType).toBeUndefined();
+  });
+});