@galadrim/galadmin 0.1.236 → 0.2.7

package/tests/integration/routes.custom.integration.test.ts

@@ -0,0 +1,376 @@
+import * as request from "supertest";
+import { buildAppForManager } from "../helpers/app";
+import { baseConfig, fruitView } from "../helpers/fixtures";
+import {
+  BackendName,
+  DbHarness,
+  describeIntegration,
+  getMysql2Harness,
+  getMysqlHarness,
+  getPgHarness,
+  resetTables,
+} from "./dbHarness";
+
+jest.mock("axios");
+// Explicit factory: the file-based manual mock in tests/__mocks__/ is not on
+// the integration config's roots, and a bare jest.mock("rollup") automock
+// would leave rollup() returning undefined.
+jest.mock("rollup", () => ({
+  rollup: jest.fn().mockResolvedValue({
+    generate: jest.fn().mockResolvedValue({ output: [{ code: "// mocked bundle" }] }),
+  }),
+}));
+
+/**
+ * /customQuery, /notificationBadges, /searchCompanies and /customComponent.
+ * The two DB-backed routes run against real engines; the SIRENE proxy and the
+ * rollup bundler keep their service mocks (external systems).
+ */
+describeIntegration("custom routes against real databases", () => {
+  const harnesses: Record<BackendName, DbHarness> = {} as any;
+
+  beforeAll(async () => {
+    harnesses.mysql = await getMysqlHarness();
+    harnesses.mysql2 = await getMysql2Harness();
+    harnesses.postgresql = await getPgHarness();
+  });
+
+  afterAll(async () => {
+    await harnesses.mysql?.stop();
+    await harnesses.mysql2?.stop();
+    await harnesses.postgresql?.stop();
+  });
+
+  describe.each([
+    ["mysql", () => harnesses.mysql],
+    ["mysql2", () => harnesses.mysql2],
+    ["postgresql", () => harnesses.postgresql],
+  ])("backend: %s", (_backend, getHarness) => {
+    let harness: DbHarness;
+
+    beforeEach(async () => {
+      harness = getHarness();
+      await resetTables(harness);
+    });
+
+    const app = (viewOverrides: any = {}) =>
+      buildAppForManager(
+        harness.manager,
+        baseConfig({ views: [fruitView({ primaryId: "id", ...viewOverrides })] }),
+      );
+
+    const seedNote = async (fruitId: number, text: string) => {
+      const { err } = await harness.query(
+        "INSERT INTO fruit_notes (fruitId, text) VALUES (?, ?)",
+        [fruitId, text],
+      );
+      expect(err).toBeFalsy();
+    };
+
+    describe("GET /api/customQuery", () => {
+      const PANEL_QUERY = "SELECT * FROM fruit_notes WHERE fruitId = ?";
+
+      it("is replaced by a 404 stub when the config declares no SQL templates", async () => {
+        const res = await request(app())
+          .get("/api/customQuery")
+          .query({ query: "SELECT * FROM fruits", primaryValue: 1 });
+        expect(res.status).toBe(404);
+        // The stub never touches the database.
+        const { rows } = await harness.query("SELECT * FROM fruits");
+        expect(rows).toHaveLength(0);
+      });
+
+      it("runs a whitelisted read-only template with the bound primaryValue", async () => {
+        await seedNote(7, "hello");
+        const config = baseConfig({
+          views: [
+            fruitView({
+              recordViewPanels: [{ label: "Notes", query: PANEL_QUERY }],
+            }),
+          ],
+        });
+        const res = await request(
+          buildAppForManager(harness.manager, config),
+        )
+          .get("/api/customQuery")
+          .query({ query: PANEL_QUERY, primaryValue: 7 })
+          .expect(200);
+        expect(res.body).toEqual([{ id: 1, fruitId: 7, text: "hello" }]);
+      });
+
+      it("rejects templates not present in the config with 403", async () => {
+        const config = baseConfig({
+          views: [
+            fruitView({
+              recordViewPanels: [{ label: "Notes", query: "SELECT 1" }],
+            }),
+          ],
+        });
+        const res = await request(
+          buildAppForManager(harness.manager, config),
+        )
+          .get("/api/customQuery")
+          .query({ query: "SELECT * FROM users", primaryValue: 1 })
+          .expect(403);
+        expect(res.body).toEqual({ error: "Query not allowed" });
+      });
+
+      it("rejects non-read-only templates (400) even when whitelisted", async () => {
+        const config = baseConfig({
+          views: [
+            fruitView({
+              recordViewPanels: [
+                { label: "Bad", query: "DELETE FROM fruits WHERE id = ?" },
+              ],
+            }),
+          ],
+        });
+        const res = await request(
+          buildAppForManager(harness.manager, config),
+        )
+          .get("/api/customQuery")
+          .query({ query: "DELETE FROM fruits WHERE id = ?", primaryValue: 1 })
+          .expect(400);
+        expect(res.body).toEqual({ error: "Only read-only queries are allowed" });
+        // Nothing was actually deleted.
+        const { rows } = await harness.query("SELECT * FROM fruits");
+        expect(rows).toHaveLength(0);
+      });
+
+      it("rejects whitelisted templates containing a semicolon", async () => {
+        const config = baseConfig({
+          views: [
+            fruitView({
+              recordViewPanels: [
+                { label: "Two", query: "SELECT 1; DROP TABLE fruits" },
+              ],
+            }),
+          ],
+        });
+        await request(buildAppForManager(harness.manager, config))
+          .get("/api/customQuery")
+          .query({ query: "SELECT 1; DROP TABLE fruits", primaryValue: 1 })
+          .expect(400);
+        // Fruits survived the rejected template.
+        const { err, rows } = await harness.query("SELECT * FROM fruits");
+        expect(err).toBeFalsy();
+        expect(rows).toHaveLength(0);
+      });
+
+      it("accepts WITH templates", async () => {
+        const config = baseConfig({
+          views: [
+            fruitView({
+              recordViewPanels: [
+                {
+                  label: "Agg",
+                  query: "WITH t AS (SELECT 1 AS n) SELECT * FROM t WHERE n = ?",
+                },
+              ],
+            }),
+          ],
+        });
+        const res = await request(
+          buildAppForManager(harness.manager, config),
+        )
+          .get("/api/customQuery")
+          .query({
+            query: "WITH t AS (SELECT 1 AS n) SELECT * FROM t WHERE n = ?",
+            primaryValue: 1,
+          })
+          .expect(200);
+        expect(Number(res.body[0].n)).toBe(1);
+      });
+
+      it("applies the panel formatValue post-processing", async () => {
+        await seedNote(7, "hello");
+        const panel = {
+          label: "Notes",
+          query: PANEL_QUERY,
+          formatValue: {
+            text: (row: any) => row.text.toUpperCase(),
+          },
+        };
+        const config = baseConfig({
+          views: [fruitView({ recordViewPanels: [panel] })],
+        });
+        const res = await request(
+          buildAppForManager(harness.manager, config),
+        )
+          .get("/api/customQuery")
+          .query({
+            query: PANEL_QUERY,
+            primaryValue: 7,
+            viewIndex: 0,
+            panelIndex: 0,
+          })
+          .expect(200);
+        expect(res.body[0].text).toBe("HELLO");
+      });
+
+      it("returns 500 on engine error", async () => {
+        const config = baseConfig({
+          views: [
+            fruitView({
+              recordViewPanels: [{ label: "Notes", query: "SELECT broken" }],
+            }),
+          ],
+        });
+        await request(buildAppForManager(harness.manager, config))
+          .get("/api/customQuery")
+          .query({ query: "SELECT broken", primaryValue: 1 })
+          .expect(500);
+      });
+    });
+
+    describe("GET /api/notificationBadges", () => {
+      it("computes badges per view and subview", async () => {
+        const view = fruitView({
+          notificationBadge: {
+            query: "SELECT 3 AS count",
+            attribute: "count",
+          },
+          subviews: [
+            {
+              label: "Old",
+              filters: "age > 50",
+              notificationBadge: {
+                query: "SELECT 1 AS total",
+                attribute: "total",
+              },
+            },
+          ],
+        });
+        const res = await request(app({ ...view })).get("/api/notificationBadges").expect(200);
+        // MW1 serves a {...view} copy for table views, so enrichment stamps
+        // the __id__ on the copy — match the view badge by value, the subview
+        // exactly (subview objects are shared, not copied).
+        const values = Object.values(res.body);
+        expect(values).toContain(3);
+        expect(res.body[(view.subviews[0] as any).__id__]).toBe(1);
+      });
+
+      it("honors displayCondition", async () => {
+        const view = fruitView({
+          notificationBadge: {
+            query: "SELECT 5 AS count",
+            attribute: "count",
+            displayCondition: (badge: any) => badge > 10,
+          },
+        });
+        const res = await request(app({ ...view })).get("/api/notificationBadges").expect(200);
+        expect(res.body).toEqual({});
+      });
+
+      it("skips badges whose query fails", async () => {
+        const view = fruitView({
+          notificationBadge: { query: "SELECT broken", attribute: "x" },
+        });
+        const res = await request(app({ ...view })).get("/api/notificationBadges").expect(200);
+        expect(res.body).toEqual({});
+      });
+
+      it("omits falsy badge values", async () => {
+        const view = fruitView({
+          notificationBadge: { query: "SELECT 0 AS count", attribute: "count" },
+        });
+        const res = await request(app({ ...view })).get("/api/notificationBadges").expect(200);
+        expect(res.body).toEqual({});
+      });
+    });
+
+    describe("GET /api/searchCompanies", () => {
+      const opendatasoft = () =>
+        jest.requireMock("axios") as { get: jest.Mock; post: jest.Mock };
+
+      it("proxies the SIRENE search and maps active establishments", async () => {
+        const axiosMock = opendatasoft();
+        axiosMock.get.mockResolvedValueOnce({
+          data: {
+            results: [
+              {
+                denominationunitelegale: "GALADRIM",
+                etatadministratifetablissement: "Actif",
+                siret: "12345678900011",
+                siren: "123456789",
+                numerovoieetablissement: "12",
+                typevoieetablissement: "RUE",
+                libellevoieetablissement: "DES FRUITS",
+                libellecommuneetablissement: "LYON",
+                codepostaletablissement: "69001",
+                activiteprincipaleunitelegale: "62.01Z",
+              },
+              {
+                denominationunitelegale: "CLOSED CO",
+                etatadministratifetablissement: "Fermé",
+              },
+            ],
+          },
+        });
+        const res = await request(app())
+          .get("/api/searchCompanies")
+          .query({ query: "galadrim fr" })
+          .expect(200);
+        expect(axiosMock.get).toHaveBeenCalledWith(
+          "https://public.opendatasoft.com/api/explore/v2.1/catalog/datasets/economicref-france-sirene-v3/records",
+          {
+            params: {
+              where:
+                "denominationunitelegale LIKE 'galadrim-fr*' OR siret LIKE 'galadrim-fr*'",
+              limit: 100,
+            },
+          },
+        );
+        expect(res.body).toHaveLength(1);
+        expect(res.body[0]).toMatchObject({
+          companyName: "GALADRIM",
+          siret: "12345678900011",
+          siren: "123456789",
+          address: "12 RUE DES FRUITS",
+          city: "LYON",
+          zipCode: "69001",
+          activityNumber: "62.01Z",
+        });
+        expect(res.body[0].id).toBeDefined();
+      });
+
+      it("returns [] (with 200) when the external API fails", async () => {
+        const axiosMock = opendatasoft();
+        axiosMock.get.mockRejectedValueOnce(new Error("external down"));
+        const res = await request(app())
+          .get("/api/searchCompanies")
+          .query({ query: "whatever" })
+          .expect(200);
+        expect(res.body).toEqual([]);
+      });
+    });
+
+    describe("GET /api/customComponent", () => {
+      it("bundles the component with rollup and serves the generated code", async () => {
+        const rollupMock = jest.requireMock("rollup") as {
+          rollup: jest.Mock;
+        };
+        const res = await request(app())
+          .get("/api/customComponent")
+          .query({ componentPath: "src/front/src/pages/CustomView.js" })
+          .expect(200);
+        expect(res.text).toBe("// mocked bundle");
+        expect(rollupMock.rollup).toHaveBeenCalled();
+        const call = rollupMock.rollup.mock.calls[0][0];
+        expect(call.input).toContain("CustomView.js");
+        expect(call.external).toContain("react");
+      });
+
+      it("returns 500 when the bundling fails", async () => {
+        const rollupMock = jest.requireMock("rollup") as {
+          rollup: jest.Mock;
+        };
+        rollupMock.rollup.mockRejectedValueOnce(new Error("bundle failure"));
+        await request(app())
+          .get("/api/customComponent")
+          .query({ componentPath: "src/front/src/pages/CustomView.js" })
+          .expect(500);
+      });
+    });
+  });
+});

package/tests/integration/routes.foreign.integration.test.ts

@@ -0,0 +1,306 @@
+import * as request from "supertest";
+import { generateUniqueIdForObject } from "../../src/api";
+import { buildAppForManager } from "../helpers/app";
+import { baseConfig, fruitView, EDITOR } from "../helpers/fixtures";
+import {
+  BackendName,
+  DbHarness,
+  describeIntegration,
+  getMysql2Harness,
+  getMysqlHarness,
+  getPgHarness,
+  resetTables,
+} from "./dbHarness";
+
+jest.mock("axios");
+
+/**
+ * /foreignSelectRecords against real engines. The scripted suite asserted the
+ * generated SQL strings; here the LIKE composition, escaping, limits, filters
+ * and label/value resolution are verified by what the engine returns.
+ */
+describeIntegration("foreignSelectRecords against real databases", () => {
+  const harnesses: Record<BackendName, DbHarness> = {} as any;
+
+  beforeAll(async () => {
+    harnesses.mysql = await getMysqlHarness();
+    harnesses.mysql2 = await getMysql2Harness();
+    harnesses.postgresql = await getPgHarness();
+  });
+
+  afterAll(async () => {
+    await harnesses.mysql?.stop();
+    await harnesses.mysql2?.stop();
+    await harnesses.postgresql?.stop();
+  });
+
+  describe.each([
+    ["mysql", () => harnesses.mysql],
+    ["mysql2", () => harnesses.mysql2],
+    ["postgresql", () => harnesses.postgresql],
+  ])("backend: %s", (_backend, getHarness) => {
+    let harness: DbHarness;
+
+    beforeEach(async () => {
+      harness = getHarness();
+      await resetTables(harness);
+    });
+
+    const foreignColumn = (overrides: any = {}) => ({
+      label: "Famille",
+      name: "familyId",
+      dataType: "foreign",
+      table: "families",
+      foreignName: "id",
+      searchableName: "name",
+      ...overrides,
+    });
+
+    const configWithForeign = (
+      columnOverrides: any = {},
+      viewOverrides: any = {},
+    ) =>
+      baseConfig({
+        views: [
+          fruitView({
+            primaryId: "id",
+            columns: [
+              { label: "Nom", name: "fruitName" },
+              foreignColumn(columnOverrides),
+            ],
+            ...viewOverrides,
+          }),
+        ],
+      });
+
+    const app = (config: any = configWithForeign(), user: any = EDITOR) =>
+      buildAppForManager(harness.manager, config, user);
+
+    const insertFamilies = async (
+      rows: Array<Record<string, any>>,
+    ): Promise<void> => {
+      const keys = [
+        "name",
+        "familyId",
+        "uuid",
+        "active",
+        "ownerId",
+        "f_id",
+      ] as const;
+      // The manager's query path expects MySQL-style ? placeholders on every
+      // dialect: convertQuery maps them to $n for PG.
+      for (let i = 0; i < rows.length; i += 500) {
+        const chunk = rows.slice(i, i + 500);
+        const placeholders = chunk
+          .map(() => `(${keys.map(() => "?").join(", ")})`)
+          .join(", ");
+        const args = chunk.flatMap((row) => keys.map((k) => row[k] ?? null));
+        const { err } = await harness.query(
+          `INSERT INTO families (name, familyId, uuid, active, ownerId, f_id) VALUES ${placeholders}`,
+          args,
+        );
+        expect(err).toBeFalsy();
+      }
+    };
+
+    const postForeign = (
+      instance: any,
+      column: any,
+      body: any = {},
+    ) =>
+      request(instance)
+        .post("/api/foreignSelectRecords")
+        .send({ viewIndex: 0, columnId: generateUniqueIdForObject(column), ...body });
+
+    const byValue = (options: any[]) =>
+      [...options].sort((a, b) => Number(a.value) - Number(b.value));
+
+    describe("POST /api/foreignSelectRecords", () => {
+      it("returns { value, label } options from the foreign table", async () => {
+        await insertFamilies([
+          { name: "Rutaceae", familyId: 11 },
+          { name: "Rosaceae", familyId: 22 },
+        ]);
+        const column = foreignColumn();
+        // Without a query every family is listed; LIKE comparison is
+        // case-insensitive on MySQL's default collation and ILIKE on PG.
+        const all = await postForeign(app(), column).expect(200);
+        expect(byValue(all.body)).toEqual([
+          { value: 1, label: 11 },
+          { value: 2, label: 22 },
+        ]);
+        // The default label falls back to record[column.name].
+        const filtered = await postForeign(app(), column, {
+          query: "ros",
+        }).expect(200);
+        expect(filtered.body).toEqual([{ value: 2, label: 22 }]);
+      });
+
+      it("escapes apostrophes in the search query", async () => {
+        await insertFamilies([
+          { name: "l'agrume du sud", familyId: 1 },
+          { name: "Rutaceae", familyId: 2 },
+        ]);
+        const column = foreignColumn();
+        // MySQL escapes with \' and PostgreSQL with '': both must find the
+        // row without an engine error.
+        const res = await postForeign(app(), column, {
+          query: "l'agrume",
+        }).expect(200);
+        expect(res.body).toEqual([{ value: 1, label: 1 }]);
+      });
+
+      it("wholeSearch matches anywhere, default only the prefix", async () => {
+        await insertFamilies([
+          { name: "rosehip", familyId: 1 },
+          { name: "wildrose", familyId: 2 },
+        ]);
+        const column = foreignColumn();
+        const prefix = await postForeign(app(), column, {
+          query: "ros",
+        }).expect(200);
+        expect(prefix.body).toEqual([{ value: 1, label: 1 }]);
+        const anywhere = await postForeign(
+          app(configWithForeign({ wholeSearch: true })),
+          foreignColumn({ wholeSearch: true }),
+          { query: "ros" },
+        ).expect(200);
+        expect(byValue(anywhere.body)).toEqual([
+          { value: 1, label: 1 },
+          { value: 2, label: 2 },
+        ]);
+      });
+
+      it("respects column.limit and defaults to 1000", async () => {
+        await insertFamilies(
+          Array.from({ length: 1005 }, (_, i) => ({
+            name: `family${i + 1}`,
+            familyId: i + 1,
+          })),
+        );
+        const column = foreignColumn();
+        const defaulted = await postForeign(app(), column).expect(200);
+        expect(defaulted.body).toHaveLength(1000);
+        const limited = await postForeign(
+          app(configWithForeign({ limit: 5 })),
+          foreignColumn({ limit: 5 }),
+        ).expect(200);
+        expect(limited.body).toHaveLength(5);
+      });
+
+      it("applies column.filters and column.filtersFromUser", async () => {
+        await insertFamilies([
+          { name: "rose", familyId: 21, active: 1, ownerId: 2 },
+          { name: "apple", familyId: 22, active: 0, ownerId: 2 },
+          { name: "pear", familyId: 23, active: 1, ownerId: 1 },
+        ]);
+        const overrides = {
+          filters: "active = 1",
+          filtersFromUser: (userId: number) => `ownerId = ${userId}`,
+        };
+        // EDITOR.userId === 2: only the active family owned by user 2.
+        const res = await postForeign(
+          app(configWithForeign(overrides)),
+          foreignColumn(overrides),
+          { query: undefined },
+        ).expect(200);
+        expect(res.body).toEqual([{ value: 1, label: 21 }]);
+      });
+
+      it("composes selectExpression, join and orderBy from the column", async () => {
+        const { err } = await harness.query(
+          `INSERT INTO family_labels (id, label) VALUES (1, 'Zeta'), (2, 'Aria')`,
+        );
+        expect(err).toBeFalsy();
+        await insertFamilies([
+          { name: "Apple", familyId: 11, f_id: 1 },
+          { name: "Banana", familyId: 22, f_id: 2 },
+        ]);
+        const overrides = {
+          selectExpression: "*, fl.label AS fullName",
+          join: "JOIN family_labels fl ON families.f_id = fl.id",
+          orderBy: "fullName",
+        };
+        const res = await postForeign(
+          app(configWithForeign(overrides)),
+          foreignColumn(overrides),
+        ).expect(200);
+        // Ordered by the joined label: Aria (Banana) before Zeta (Apple).
+        expect(res.body).toEqual([
+          { value: 2, label: 22 },
+          { value: 1, label: 11 },
+        ]);
+      });
+
+      it("labels via formatForeignValue first, then formatValue, then formattedValue", async () => {
+        await insertFamilies([{ name: "Rutaceae", familyId: 7 }]);
+        const cases: Array<[any, string]> = [
+          [
+            { formatForeignValue: (r: any) => `FFV:${r.name}` },
+            "FFV:Rutaceae",
+          ],
+          [{ formatValue: (r: any) => `FV:${r.name}` }, "FV:Rutaceae"],
+          [{ formattedValue: "'fmt-' + name" }, "fmt-Rutaceae"],
+        ];
+        for (const [overrides, expected] of cases) {
+          const res = await postForeign(
+            app(configWithForeign(overrides)),
+            foreignColumn(overrides),
+          ).expect(200);
+          expect(res.body).toEqual([{ value: 1, label: expected }]);
+        }
+      });
+
+      it("value prefers foreignName over name", async () => {
+        await insertFamilies([
+          { name: "Rutaceae", familyId: 9, uuid: "abc" },
+        ]);
+        const overrides = { foreignName: "uuid" };
+        const res = await postForeign(
+          app(configWithForeign(overrides)),
+          foreignColumn(overrides),
+        ).expect(200);
+        expect(res.body).toEqual([{ value: "abc", label: 9 }]);
+      });
+
+      it("returns 500 when the engine rejects the query", async () => {
+        await insertFamilies([{ name: "Rutaceae", familyId: 1 }]);
+        const overrides = { searchableName: "nope" };
+        // The LIKE references a non-existent column: ER_BAD_FIELD_ERROR on
+        // MySQL, 42703 on PG.
+        await postForeign(
+          app(configWithForeign(overrides)),
+          foreignColumn(overrides),
+          { query: "x" },
+        ).expect(500);
+      });
+
+      it("also finds columns inside recordViewPanels createConfig", async () => {
+        await insertFamilies([{ name: "Rosaceae", familyId: 33 }]);
+        const panelColumn = foreignColumn();
+        const config = baseConfig({
+          views: [
+            fruitView({
+              primaryId: "id",
+              columns: [{ label: "Nom", name: "fruitName" }],
+              recordViewPanels: [
+                {
+                  label: "Notes",
+                  tableName: "fruit_notes",
+                  primaryId: "id",
+                  createConfig: {
+                    label: "New note",
+                    recordIdKey: "fruitId",
+                    columns: [panelColumn],
+                  },
+                },
+              ],
+            }),
+          ],
+        });
+        const res = await postForeign(app(config), panelColumn).expect(200);
+        expect(res.body).toEqual([{ value: 1, label: 33 }]);
+      });
+    });
+  });
+});