@galadrim/galadmin 0.1.236 → 0.2.7

package/tests/integration/routes.crud.integration.test.ts

@@ -0,0 +1,805 @@
+import * as request from "supertest";
+import { generateUniqueIdForObject } from "../../src/api";
+import { buildAppForManager } from "../helpers/app";
+import { baseConfig, fruitView, EDITOR, VIEWER } from "../helpers/fixtures";
+import {
+  BackendName,
+  DbHarness,
+  describeIntegration,
+  getMysql2Harness,
+  getMysqlHarness,
+  getPgHarness,
+  resetTables,
+} from "./dbHarness";
+
+jest.mock("axios");
+import axios from "axios";
+
+const mockedAxios = axios as any;
+
+/**
+ * CRUD routes against real engines. The former unit suite asserted the exact
+ * SQL text + bound params emitted for a scripted FakeDb; here every property
+ * it protected (identifier quoting, NULL normalization, injection safety,
+ * error mapping, callbacks) is verified by what the engine actually did.
+ */
+describeIntegration("crud routes against real databases", () => {
+  const harnesses: Record<BackendName, DbHarness> = {} as any;
+
+  beforeAll(async () => {
+    harnesses.mysql = await getMysqlHarness();
+    harnesses.mysql2 = await getMysql2Harness();
+    harnesses.postgresql = await getPgHarness();
+  });
+
+  afterAll(async () => {
+    await harnesses.mysql?.stop();
+    await harnesses.mysql2?.stop();
+    await harnesses.postgresql?.stop();
+  });
+
+  describe.each([
+    ["mysql", () => harnesses.mysql],
+    ["mysql2", () => harnesses.mysql2],
+    ["postgresql", () => harnesses.postgresql],
+  ])("backend: %s", (_backend, getHarness) => {
+    let harness: DbHarness;
+
+    beforeEach(async () => {
+      harness = getHarness();
+      await resetTables(harness);
+    });
+
+    const app = (
+      overrides: any = {},
+      user: any = EDITOR,
+    ) =>
+      buildAppForManager(
+        harness.manager,
+        baseConfig({ views: [fruitView({ primaryId: "id", ...overrides })] }),
+        user,
+      );
+
+    const createFruit = async (data: any, instance = app()) => {
+      const res = await request(instance)
+        .post("/api/createRecord")
+        .send({ viewIndex: 0, data })
+        .expect(200);
+      return res;
+    };
+
+    const fruits = async () => (await harness.query("SELECT * FROM fruits")).rows;
+
+    // MySQL/mysql2 drivers expose the AUTO_INCREMENT id; pg results carry no
+    // insertId, so created ids stay undefined in responses (GAP 11).
+    const insertIdIsExposed = () => harness.dbType !== "POSTGRESQL";
+
+    describe("POST /api/updateRecord", () => {
+      it("updates the record and persists the new values", async () => {
+        await createFruit({ fruitName: "pomme", acidity: 3 });
+        await request(app())
+          .post("/api/updateRecord")
+          .send({
+            viewIndex: 0,
+            primaryValue: 1,
+            data: { fruitName: "poire", acidity: 9 },
+          })
+          .expect(200);
+        const [row] = await fruits();
+        expect(row.fruitName).toBe("poire");
+        expect(Number(row.acidity)).toBe(9);
+      });
+
+      it("normalizes 'NULL', empty string and 'Invalid date' to null", async () => {
+        await createFruit({ fruitName: "pomme", acidity: 3, note: "x" });
+        await request(app())
+          .post("/api/updateRecord")
+          .send({
+            viewIndex: 0,
+            primaryValue: 1,
+            data: { acidity: "NULL", fruitName: "", note: "Invalid date" },
+          })
+          .expect(200);
+        const [row] = await fruits();
+        expect(row.acidity).toBeNull();
+        expect(row.fruitName).toBeNull();
+        expect(row.note).toBeNull();
+      });
+
+      it("is a no-op returning 200 when data is empty", async () => {
+        await createFruit({ fruitName: "pomme", acidity: 3 });
+        await request(app())
+          .post("/api/updateRecord")
+          .send({ viewIndex: 0, primaryValue: 1, data: {} })
+          .expect(200);
+        const [row] = await fruits();
+        expect(row.fruitName).toBe("pomme");
+        expect(Number(row.acidity)).toBe(3);
+      });
+
+      it("rejects unsafe column names with 400 and leaves the row untouched", async () => {
+        await createFruit({ fruitName: "pomme" });
+        const res = await request(app())
+          .post("/api/updateRecord")
+          .send({
+            viewIndex: 0,
+            primaryValue: 1,
+            data: { "evil`; DROP TABLE fruits;--": "x" },
+          })
+          .expect(400);
+        expect(res.body).toEqual({ error: "Invalid column name" });
+        const [row] = await fruits();
+        expect(row.fruitName).toBe("pomme");
+      });
+
+      it("returns 500 when the engine rejects the statement", async () => {
+        await createFruit({ fruitName: "pomme" });
+        // "notAColumn" passes the identifier-format check but does not exist:
+        // the failure surfaces from the real engine (unknown column), not a
+        // scripted queue.
+        await request(app())
+          .post("/api/updateRecord")
+          .send({
+            viewIndex: 0,
+            primaryValue: 1,
+            data: { notAColumn: "x" },
+          })
+          .expect(500);
+      });
+
+      it("calls the HTTP editCallback with id, data and previousData", async () => {
+        mockedAxios.post.mockResolvedValue({});
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              editCallback: "https://api.example.com/edited",
+            }),
+          ],
+        };
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/updateRecord")
+          .send({
+            viewIndex: 0,
+            primaryValue: 1,
+            data: { fruitName: "pomme" },
+            previousData: { fruitName: "poire" },
+          })
+          .expect(200);
+        expect(mockedAxios.post).toHaveBeenCalledWith(
+          "https://api.example.com/edited",
+          {
+            id: 1,
+            data: { fruitName: "pomme" },
+            previousData: { fruitName: "poire" },
+          },
+        );
+      });
+
+      it("swallows editCallback HTTP errors", async () => {
+        mockedAxios.post.mockRejectedValue(new Error("network down"));
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              editCallback: "https://api.example.com/edited",
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await createFruit({ fruitName: "poire" }, instance);
+        await request(instance)
+          .post("/api/updateRecord")
+          .send({ viewIndex: 0, primaryValue: 1, data: { fruitName: "pomme" } })
+          .expect(200);
+        const [row] = await fruits();
+        expect(row.fruitName).toBe("pomme");
+      });
+
+      it("calls editCallbackFunction after a successful update", async () => {
+        const callback = jest.fn();
+        const config = {
+          views: [
+            fruitView({ primaryId: "id", editCallbackFunction: callback }),
+          ],
+        };
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/updateRecord")
+          .send({ viewIndex: 0, primaryValue: 1, data: { fruitName: "pomme" } })
+          .expect(200);
+        expect(callback).toHaveBeenCalledWith({
+          id: 1,
+          data: { fruitName: "pomme" },
+        });
+      });
+    });
+
+    describe("POST /api/createRecord", () => {
+      it("inserts the row and returns the insert id", async () => {
+        const res = await createFruit({ fruitName: "pomme", acidity: 3 });
+        if (insertIdIsExposed()) {
+          expect(res.body).toEqual({ id: 1 });
+        } else {
+          // CHARACTERIZATION (GAP 11): pg results carry no insertId.
+          expect(res.body.id).toBeUndefined();
+        }
+        const [row] = await fruits();
+        expect(row.fruitName).toBe("pomme");
+        expect(Number(row.acidity)).toBe(3);
+      });
+
+      it("normalizes 'NULL' and 'Invalid date' to null", async () => {
+        await createFruit({
+          fruitName: "pomme",
+          acidity: "NULL",
+          note: "Invalid date",
+        });
+        const [row] = await fruits();
+        expect(row.fruitName).toBe("pomme");
+        expect(row.acidity).toBeNull();
+        expect(row.note).toBeNull();
+      });
+
+      it("generates a uuid for uuid-typed primary columns", async () => {
+        const config = {
+          views: [
+            fruitView({
+              tableName: "uuid_fruits",
+              primaryId: "id",
+              columns: [
+                { label: "Id", name: "id", dataType: "uuid" },
+                { label: "Nom", name: "fruitName" },
+              ],
+            }),
+          ],
+        };
+        const res = await request(
+          buildAppForManager(harness.manager, baseConfig(config)),
+        )
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme" } })
+          .expect(200);
+        const { rows } = await harness.query("SELECT * FROM uuid_fruits");
+        expect(rows).toHaveLength(1);
+        expect(rows[0].fruitName).toBe("pomme");
+        // A server-generated uuid v4 became the primary key.
+        expect(rows[0].id).toMatch(
+          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,
+        );
+        if (insertIdIsExposed()) {
+          // CHARACTERIZATION: no AUTO_INCREMENT column, so the legacy driver
+          // reports insertId 0 instead of the generated uuid.
+          expect(res.body.id).toBe(0);
+        } else {
+          expect(res.body.id).toBeUndefined();
+        }
+      });
+
+      it("strips columns with includedInCreatePayload === false", async () => {
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              columns: [
+                { label: "Nom", name: "fruitName" },
+                {
+                  label: "Slug",
+                  name: "slug",
+                  includedInCreatePayload: false,
+                },
+              ],
+            }),
+          ],
+        };
+        await request(
+          buildAppForManager(harness.manager, baseConfig(config)),
+        )
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme", slug: "auto" } })
+          .expect(200);
+        const [row] = await fruits();
+        expect(row.fruitName).toBe("pomme");
+        expect(row.slug).toBeNull();
+      });
+
+      const panelConfig = () => ({
+        views: [
+          fruitView({
+            primaryId: "id",
+            recordViewPanels: [
+              {
+                label: "Notes",
+                tableName: "fruit_notes",
+                primaryId: "id",
+                createConfig: {
+                  label: "New note",
+                  recordIdKey: "fruitId",
+                  columns: [{ label: "Texte", name: "text" }],
+                },
+              },
+            ],
+          }),
+        ],
+      });
+
+      it("injects the parent recordId for panel creations", async () => {
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(panelConfig()),
+        );
+        // The front sends indexes as strings, but a numeric panelIndex 0 must
+        // target the panel too.
+        const res = await request(instance)
+          .post("/api/createRecord")
+          .send({
+            viewIndex: "0",
+            panelIndex: "0",
+            recordId: "7",
+            data: { text: "hi" },
+          })
+          .expect(200);
+        if (insertIdIsExposed()) {
+          expect(res.body).toEqual({ id: 1 });
+        } else {
+          expect(res.body.id).toBeUndefined();
+        }
+        const { rows } = await harness.query("SELECT * FROM fruit_notes");
+        expect(rows).toHaveLength(1);
+        expect(rows[0].text).toBe("hi");
+        expect(Number(rows[0].fruitId)).toBe(7);
+      });
+
+      it("targets the panel table when panelIndex is the number 0", async () => {
+        // A numeric 0 must not be treated as "no panel" (falsy) — otherwise
+        // the insert silently targets the view's table without the parent id.
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(panelConfig()),
+        );
+        await request(instance)
+          .post("/api/createRecord")
+          .send({
+            viewIndex: 0,
+            panelIndex: 0,
+            recordId: 7,
+            data: { text: "a" },
+          })
+          .expect(200);
+        const { rows } = await harness.query("SELECT * FROM fruit_notes");
+        expect(rows).toHaveLength(1);
+        expect(rows[0].text).toBe("a");
+        expect(Number(rows[0].fruitId)).toBe(7);
+        expect(await fruits()).toHaveLength(0);
+      });
+
+      it("rejects unsafe column names with 400", async () => {
+        const res = await request(app())
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { "bad;col": "x" } })
+          .expect(400);
+        expect(res.body).toEqual({ error: "Invalid column name" });
+        expect(await fruits()).toHaveLength(0);
+      });
+
+      it("maps a real duplicate entry to a friendly message on MySQL", async () => {
+        const config = {
+          views: [
+            fruitView({
+              tableName: "unique_fruits",
+              primaryId: "id",
+              columns: [{ label: "Nom", name: "fruitName" }],
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme" } })
+          .expect(200);
+        const res = await request(instance)
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme" } })
+          .expect(500);
+        if (harness.dbType === "POSTGRESQL") {
+          // CHARACTERIZATION (GAP): the uniqueness violation arrives with pg's
+          // SQLSTATE 23505, not the MySQL ER_DUP_ENTRY code, so the friendly
+          // French duplicate message is not shown on PostgreSQL.
+          expect(res.body.message).toBe("Une erreur est survenue.");
+        } else {
+          expect(res.body.message).toBe("Cet élément existe déjà.");
+        }
+      });
+
+      it("maps other db errors to a generic message", async () => {
+        const res = await request(app())
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { notAColumn: "x" } })
+          .expect(500);
+        expect(res.body.message).toBe("Une erreur est survenue.");
+      });
+
+      it("calls createCallback (HTTP, swallowed on error) and createCallbackFunction", async () => {
+        const callbackFn = jest.fn();
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              createCallback: "https://api.example.com/created",
+              createCallbackFunction: callbackFn,
+            }),
+          ],
+        };
+        mockedAxios.post.mockRejectedValue(new Error("down"));
+        const res = await request(
+          buildAppForManager(harness.manager, baseConfig(config)),
+        )
+          .post("/api/createRecord")
+          .send({ viewIndex: 0, data: { fruitName: "pomme" } })
+          .expect(200);
+        expect(mockedAxios.post).toHaveBeenCalledWith(
+          "https://api.example.com/created",
+          {
+            id: insertIdIsExposed() ? 1 : undefined,
+            data: { fruitName: "pomme" },
+          },
+        );
+        expect(callbackFn).toHaveBeenCalledWith({
+          id: insertIdIsExposed() ? 1 : undefined,
+          data: { fruitName: "pomme" },
+        });
+        expect(await fruits()).toHaveLength(1);
+      });
+    });
+
+    describe("POST /api/deleteRecord", () => {
+      it("selects then deletes the record, passing deletedRecord to callbacks", async () => {
+        await createFruit({ fruitName: "pomme", acidity: 3 });
+        const callbackFn = jest.fn();
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              deleteCallback: "https://api.example.com/deleted",
+              deleteCallbackFunction: callbackFn,
+            }),
+          ],
+        };
+        mockedAxios.post.mockResolvedValue({});
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+        );
+        await request(instance)
+          .post("/api/deleteRecord")
+          .send({ viewIndex: 0, primaryValue: 1 })
+          .expect(200);
+        expect(mockedAxios.post).toHaveBeenCalledWith(
+          "https://api.example.com/deleted",
+          { id: 1 },
+        );
+        expect(callbackFn).toHaveBeenCalledWith({
+          id: 1,
+          deletedRecord: expect.objectContaining({ fruitName: "pomme" }),
+        });
+        expect(await fruits()).toHaveLength(0);
+      });
+
+      it("returns 404 when the record does not exist", async () => {
+        const res = await request(app())
+          .post("/api/deleteRecord")
+          .send({ viewIndex: 0, primaryValue: 999 })
+          .expect(404);
+        expect(res.text).toBe("Record not found");
+      });
+
+      it("returns 500 when the select fails", async () => {
+        // The view targets a table that does not exist: the engine error
+        // surfaces as a 500 (previously scripted via a queued error).
+        const config = {
+          views: [fruitView({ tableName: "table_does_not_exist", primaryId: "id" })],
+        };
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/deleteRecord")
+          .send({ viewIndex: 0, primaryValue: 1 })
+          .expect(500);
+      });
+    });
+
+    describe("POST /api/deleteRecordFromPanel", () => {
+      const panelView = (panelOverrides: any = {}) => ({
+        views: [
+          fruitView({
+            primaryId: "id",
+            recordViewPanels: [
+              {
+                label: "Notes",
+                tableName: "fruit_notes",
+                primaryId: "id",
+                ...panelOverrides,
+              },
+            ],
+          }),
+        ],
+      });
+
+      const insertNote = async (text: string) => {
+        await harness.query(
+          "INSERT INTO fruit_notes (text, fruitId) VALUES (?, ?)",
+          [text, 3],
+        );
+        const { rows } = await harness.query(
+          "SELECT * FROM fruit_notes WHERE text = ?",
+          [text],
+        );
+        return rows[0];
+      };
+
+      it("deletes from the panel table by its primaryId", async () => {
+        const config = panelView();
+        const panel = config.views[0].recordViewPanels[0];
+        const panelId = generateUniqueIdForObject(panel);
+        const note = await insertNote("a");
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/deleteRecordFromPanel")
+          .send({ viewIndex: 0, panelId, primaryValue: note.id })
+          .expect(200);
+        const { rows } = await harness.query("SELECT * FROM fruit_notes");
+        expect(rows).toHaveLength(0);
+      });
+
+      it("supports panel delete callbacks", async () => {
+        const callbackFn = jest.fn();
+        const config = panelView({
+          deleteCallback: "https://api.example.com/panel-deleted",
+          deleteCallbackFunction: callbackFn,
+        });
+        const panel = config.views[0].recordViewPanels[0];
+        const panelId = generateUniqueIdForObject(panel);
+        const note = await insertNote("hello");
+        mockedAxios.post.mockResolvedValue({});
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/deleteRecordFromPanel")
+          .send({ viewIndex: 0, panelId, primaryValue: note.id })
+          .expect(200);
+        expect(mockedAxios.post).toHaveBeenCalledWith(
+          "https://api.example.com/panel-deleted",
+          { id: note.id },
+        );
+        expect(callbackFn).toHaveBeenCalledWith({
+          id: note.id,
+          deletedRecord: expect.objectContaining({ text: "hello" }),
+        });
+      });
+    });
+
+    describe("POST /api/deleteRecords", () => {
+      it("bulk-deletes by primary values", async () => {
+        const instance = app();
+        for (const name of ["a", "b", "c"]) {
+          await createFruit({ fruitName: name }, instance);
+        }
+        await request(instance)
+          .post("/api/deleteRecords")
+          .send({ viewIndex: 0, primaryValues: ["1", "2", "3"] })
+          .expect(200);
+        expect(await fruits()).toHaveLength(0);
+      });
+
+      it("never breaks out of the IN() list with quote-bearing primary values", async () => {
+        const instance = app();
+        await createFruit({ fruitName: "survivor" }, instance);
+        const payload = "1'); DROP TABLE fruits;--";
+        // Both engines refuse to cast the payload to the integer id (MySQL
+        // strict mode raises ER_TRUNCATED_WRONG_VALUE, pg a 22P02 cast
+        // error) — the old scripted test claimed a 200, the engine is
+        // stricter. Either way the injection never executes.
+        const res = await request(instance)
+          .post("/api/deleteRecords")
+          .send({ viewIndex: 0, primaryValues: [payload] })
+          .expect(500);
+        // The security property holds: the table survives and the untouched
+        // row is still there.
+        const rows = await fruits();
+        expect(rows).toHaveLength(1);
+        expect(rows[0].fruitName).toBe("survivor");
+      });
+
+      it("returns 500 when the engine rejects the statement", async () => {
+        const config = {
+          views: [fruitView({ tableName: "table_does_not_exist", primaryId: "id" })],
+        };
+        await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/deleteRecords")
+          .send({ viewIndex: 0, primaryValues: ["1"] })
+          .expect(500);
+      });
+    });
+
+    // INSERT IGNORE ... SET ? is MySQL-specific syntax; the PG conversion
+    // pipeline does not translate it, so duplicateRecord only works on the
+    // MySQL backends today.
+    (_backend === "postgresql" ? describe.skip : describe)(
+      "POST /api/duplicateRecord",
+      () => {
+        const duplicateConfig = () => ({
+          primaryId: "id",
+          fields: ["fruitName", "acidity"],
+          foreignTables: [{ table: "fruit_tags", fields: ["tag"] }],
+        });
+
+        const dupApp = (overrides: any = {}, user: any = EDITOR) =>
+          app({
+            recordViewPanels: [{ label: "Tags", tableName: "fruit_tags" }],
+            ...overrides,
+          }, user);
+
+        const seedParent = async () => {
+          // Three fruits so the parent's id (3) cannot collide with the
+          // auto-generated fruit_tags ids (1, 2).
+          await createFruit({ fruitName: "pomme", acidity: 3 });
+          await createFruit({ fruitName: "poire" });
+          await createFruit({ fruitName: "banane", acidity: 5 });
+          await harness.query(
+            "INSERT INTO fruit_tags (tag, fruitId) VALUES (?, ?)",
+            ["bio", 3],
+          );
+          await harness.query(
+            "INSERT INTO fruit_tags (tag, fruitId) VALUES (?, ?)",
+            ["local", 3],
+          );
+        };
+
+        it("copies whitelisted fields", async () => {
+          await seedParent();
+          await request(dupApp())
+            .post("/api/duplicateRecord")
+            .send({
+              table: "fruits",
+              primaryValue: 3,
+              duplicateConfig: duplicateConfig(),
+            })
+            .expect(200);
+          const rows = await fruits();
+          expect(rows).toHaveLength(4);
+          const copy = rows.find((r: any) => r.id === 4);
+          expect(copy.fruitName).toBe("banane");
+          expect(Number(copy.acidity)).toBe(5);
+          // Only the whitelisted fields are copied.
+          expect(copy.note).toBeNull();
+        });
+
+        it("CHARACTERIZATION: foreign children are selected by the parent's PK value, so real child rows are never copied", async () => {
+          await seedParent();
+          await request(dupApp())
+            .post("/api/duplicateRecord")
+            .send({
+              table: "fruits",
+              primaryValue: 3,
+              duplicateConfig: duplicateConfig(),
+            })
+            .expect(200);
+          // The route looks up children with WHERE id = <parent id> (3) —
+          // fruit_tags ids are 1 and 2, so nothing is found and no tag is
+          // re-pointed to the copy. The scripted fake previously masked this
+          // by queueing matching rows.
+          const { rows } = await harness.query(
+            "SELECT * FROM fruit_tags WHERE fruitId = 4",
+          );
+          expect(rows).toHaveLength(0);
+        });
+
+        it("rejects tables the role may not write (403)", async () => {
+          await seedParent();
+          await request(dupApp({ roles: ["editor"] }, VIEWER))
+            .post("/api/duplicateRecord")
+            .send({
+              table: "fruits",
+              primaryValue: 3,
+              duplicateConfig: duplicateConfig(),
+            })
+            .expect(403);
+          expect(await fruits()).toHaveLength(3);
+        });
+
+        it("rejects foreign tables outside the writable set (403)", async () => {
+          await seedParent();
+          const cfg = duplicateConfig();
+          cfg.foreignTables.push({ table: "secret_table", fields: ["x"] });
+          await request(dupApp())
+            .post("/api/duplicateRecord")
+            .send({ table: "fruits", primaryValue: 3, duplicateConfig: cfg })
+            .expect(403);
+          expect(await fruits()).toHaveLength(3);
+          const { rows } = await harness.query("SELECT * FROM fruit_tags");
+          expect(rows).toHaveLength(2);
+        });
+      },
+    );
+
+    describe("POST /api/customAction", () => {
+      it("runs the action for every selected record", async () => {
+        const action = jest.fn().mockResolvedValue(null);
+        const config = {
+          views: [
+            fruitView({
+              primaryId: "id",
+              customActions: [
+                { label: "Publish", action, successMessage: "done" },
+              ],
+            }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+          EDITOR,
+        );
+        await createFruit({ fruitName: "a" }, instance);
+        await createFruit({ fruitName: "b" }, instance);
+        const res = await request(instance)
+          .post("/api/customAction")
+          .send({ viewIndex: 0, actionIndex: 0, selectedRecordIds: [1, 2] })
+          .expect(200);
+        expect(res.body).toEqual({ success: true, message: "done" });
+        expect(action).toHaveBeenCalledTimes(2);
+        expect(action).toHaveBeenNthCalledWith(
+          1,
+          expect.objectContaining({ id: 1, fruitName: "a" }),
+          2,
+        );
+        expect(action).toHaveBeenNthCalledWith(
+          2,
+          expect.objectContaining({ id: 2, fruitName: "b" }),
+          2,
+        );
+      });
+
+      it("returns the action result early when truthy", async () => {
+        const action = jest.fn().mockResolvedValue("published 3 rows");
+        const config = {
+          views: [
+            fruitView({ primaryId: "id", customActions: [{ label: "P", action }] }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+          EDITOR,
+        );
+        await createFruit({ fruitName: "a" }, instance);
+        const res = await request(instance)
+          .post("/api/customAction")
+          .send({ viewIndex: 0, actionIndex: 0, selectedRecordIds: [1, 2] })
+          .expect(200);
+        expect(res.body).toEqual({ success: true, message: "published 3 rows" });
+        expect(action).toHaveBeenCalledTimes(1);
+      });
+
+      it("returns { success: false } when the action throws", async () => {
+        const action = jest.fn().mockRejectedValue(new Error("kaput"));
+        const config = {
+          views: [
+            fruitView({ primaryId: "id", customActions: [{ label: "P", action }] }),
+          ],
+        };
+        const instance = buildAppForManager(
+          harness.manager,
+          baseConfig(config),
+          EDITOR,
+        );
+        await createFruit({ fruitName: "a" }, instance);
+        const res = await request(instance)
+          .post("/api/customAction")
+          .send({ viewIndex: 0, actionIndex: 0, selectedRecordIds: [1] })
+          .expect(200);
+        expect(res.body.success).toBe(false);
+      });
+    });
+  });
+});