@galadrim/galadmin 0.2.11 → 0.3.0-alpha.2.1

package/src/index.ts

@@ -5,6 +5,7 @@ import * as pgSessionStore from 'connect-pg-simple';
 import * as mysql2 from 'mysql2/promise';
 import * as pg from 'pg';
 import dbManager from "./utils/dbManager";
+import type { DatabaseRow } from "./utils/dbManager";
 import * as bcrypt from "bcryptjs";
 
 import * as fs from "fs";
@@ -13,13 +14,17 @@ import * as mime from "mime";
 
 import * as moment from "moment";
 
-import { Config } from "./types/config"
+import type { Config } from "./types/config"
 
 import api from "./api"
 
+// The runtime accepts promise pools as well as its declared callback connections.
+type MySQLSessionStoreConstructor = ReturnType<typeof SessionStore> &
+    (new (options: SessionStore.Options, connection: mysql2.Pool) => session.Store);
+
 moment.locale('fr');
 
-export default (config: Config): any => {
+export default (config: Config) => {
     const db = new dbManager();
 
     db.init(config);
@@ -51,14 +56,14 @@ export default (config: Config): any => {
             }),
             createTableIfMissing: true,
             tableName: 'galadmin_sessions'
-        }) : new (SessionStore(session))({
+        }) : new (SessionStore(session) as MySQLSessionStoreConstructor)({
             schema: { tableName: 'galadmin_sessions' }
         }, mysql2.createPool({
-            host: config.mysql.host,
-            user: config.mysql.user,
-            password: config.mysql.password,
-            database: config.mysql.database,
-            port: config.mysql.port || 3306
+            host: config.mysql!.host,
+            user: config.mysql!.user,
+            password: config.mysql!.password,
+            database: config.mysql!.database,
+            port: config.mysql!.port || 3306
         })),
         resave: false,
         saveUninitialized: false,
@@ -70,13 +75,13 @@ export default (config: Config): any => {
     if (config.trustedAuth) {
         app.use(async (req, res, next) => {
             try {
-                const user = await config.trustedAuth(req);
+                const user = await config.trustedAuth!(req);
                 if (user) {
-                    if (JSON.stringify(req.session.user) !== JSON.stringify(user)) {
-                        req.session.user = user;
+                    if (JSON.stringify(req.session!.user) !== JSON.stringify(user)) {
+                        req.session!.user = user;
                     }
-                } else if (req.session.user) {
-                    delete req.session.user;
+                } else if (req.session!.user) {
+                    delete req.session!.user;
                 }
                 next();
             } catch (err) {
@@ -85,7 +90,7 @@ export default (config: Config): any => {
         });
     }
 
-    const passwordMatch = async (password: string, hash: string, useArgon2: boolean) => {
+    const passwordMatch = async (password: string, hash: string, useArgon2: boolean | undefined) => {
         if (password === hash || bcrypt.compareSync(password, hash)) {
             return true;
         }
@@ -105,15 +110,23 @@ export default (config: Config): any => {
             return res.send({ success: false })
         }
         if (config.auth && req.body.username === config.auth.username && req.body.password === config.auth.password) {
-            req.session.user = { role: "root" }
+            req.session!.user = { role: "root" }
             res.send({ success: true })
         } else if (config.authRoles) {
             for (const authRole of config.authRoles) {
                 const filters = authRole.filters ? `AND ${authRole.filters}` : ""
                 const { rows } = await db.query(`SELECT * FROM ?? WHERE ?? = ? ${filters}`, [authRole.table, authRole.usernameField, req.body.username]);
-                let user;
+                /*
+                #PORTING-EDIT
+                A mutation result cannot identify a user; ignore non-row results and non-text passwords.
+                */
+                if (!Array.isArray(rows)) continue;
+                let user: DatabaseRow | undefined;
                 for (const row of rows) {
-                    if (await passwordMatch(req.body.password, row[authRole.passwordField], authRole.useArgon2)) {
+                    if (Array.isArray(row)) continue;
+                    const record: DatabaseRow = row;
+                    const hash = record[authRole.passwordField];
+                    if (typeof hash === "string" && await passwordMatch(req.body.password, hash, authRole.useArgon2)) {
                         user = row;
                         break;
                     }
@@ -121,7 +134,7 @@ export default (config: Config): any => {
                 if (!user) {
                     continue;
                 }
-                req.session.user = { role: authRole.role, userId: user[authRole.idField] }
+                req.session!.user = { role: authRole.role, userId: user[authRole.idField] }
                 return res.send({ success: true })
             }
             res.send({ success: false })
@@ -133,13 +146,13 @@ export default (config: Config): any => {
 
     app.get('/api/isAuthenticated', (req, res) => {
         res.send({
-            isAuthenticated: !!req.session.user
+            isAuthenticated: !!req.session!.user
         })
     })
 
 
     app.get('/api/logout', (req, res) => {
-        req.session.destroy((err) => {
+        req.session!.destroy((err) => {
             if (err) {
                 console.error(err)
             }
@@ -148,17 +161,21 @@ export default (config: Config): any => {
     })
 
     app.use("/api", async (req, res, next) => {
-        if (req.method === "OPTIONS" || req.session.user) {
+        if (req.method === "OPTIONS" || req.session!.user) {
             if (req.session?.user?.userId && !config.trustedAuth) {
                 // we check that the user still exists
                 let stillExists = false;
-                for (const authRole of config.authRoles) {
+                for (const authRole of config.authRoles!) {
                     // Re-apply the role's `filters` here too, so an account that becomes
                     // ineligible (e.g. deactivated) has its existing session invalidated
                     // on its next request — not just blocked at login time.
                     const filters = authRole.filters ? `AND ${authRole.filters}` : "";
                     const { rows } = await db.query(`SELECT * FROM ?? WHERE ?? = ? ${filters}`, [authRole.table, authRole.idField, req.session.user.userId]);
-                    if (rows.length > 0) {
+                    /*
+                    #PORTING-EDIT
+                    A non-row result cannot establish that the session user still exists.
+                    */
+                    if (Array.isArray(rows) && rows.length > 0) {
                         stillExists = true;
                         break;
                     }
@@ -189,13 +206,13 @@ export default (config: Config): any => {
 
         // Send media files just like they are
         if ([".woff", ".png"].includes(path.extname(filePath))) {
-            res.contentType(mime.getType(filePath));
+            res.contentType(mime.getType(filePath)!);
             res.send(fs.readFileSync(filePath))
         } else {
             // For text files, we replace _HOMEPAGE_ with the base url of the back-office
             let fileContent = fs.readFileSync(filePath, { encoding: "utf-8" })
             fileContent = fileContent.replace(/\/_HOMEPAGE_/g, req.baseUrl)
-            res.contentType(mime.getType(filePath));
+            res.contentType(mime.getType(filePath)!);
             res.send(fileContent)
         }
     })

package/src/types/config.ts

@@ -1,5 +1,15 @@
+import type { DatabaseId } from "./database";
+
 export type Filter = {};
 
+export type RootUser = { role: "root" };
+export type RegularUser = { role: string; userId?: DatabaseId };
+export type FilterUser = RootUser | RegularUser;
+
+export function isRegularUser(user: FilterUser): user is RegularUser {
+  return user.role !== "root";
+}
+
 export type BaseTypeColumn = {
   label: string;
   hideInTable?: boolean;
@@ -89,7 +99,7 @@ export type ForeignSelectColumn = {
   selectExpression?: string;
   join?: string;
   filters?: Filter[];
-  filtersFromUser?: (userId: number, role?: string) => string;
+  filtersFromUser?: (user: FilterUser) => string;
   orderBy?: string;
   optional?: boolean;
   formatForeignValue?: (record: any) => string;
@@ -105,7 +115,7 @@ export type ForeignDatalistColumn = {
   selectExpression?: string;
   join?: string;
   filters?: Filter[];
-  filtersFromUser?: (userId: number, role?: string) => string;
+  filtersFromUser?: (user: FilterUser) => string;
   orderBy?: string;
   optional?: boolean;
   formatForeignValue?: (record: any) => string;
@@ -237,7 +247,7 @@ export type TableView = {
   isDesc?: boolean;
   limit?: number;
   filters?: string;
-  filtersFromUser?: (userId: number, role?: string) => string;
+  filtersFromUser?: (user: FilterUser) => string;
   notClickable?: boolean;
   clickToEdit?: boolean;
   openInNewTab?: boolean;
@@ -292,7 +302,7 @@ export type BaseTypePanel = {
   label: string;
   folded?: boolean;
   displayCondition?: (record: any) => boolean;
-};
+} & Pick<BaseTypeView, "roles">;
 
 export type CreateConfig = {
   label: string;
@@ -430,7 +440,7 @@ export type AuthRole = {
 
 export type TrustedUser = {
   role: string;
-  userId?: string | number;
+  userId?: DatabaseId;
 };
 
 export type Config = {

package/src/types/database.ts

@@ -0,0 +1,2 @@
+/** A supported database identifier: numeric, string, or UUID. */
+export type DatabaseId = string | number;

package/src/utils/dbManager.ts

@@ -2,6 +2,82 @@ import * as mysql from "mysql";
 import * as mysql2 from "mysql2";
 import * as pg from "pg";
 
+type DatabaseValue = string | number | bigint | boolean | null | Date | Buffer
+  | DatabaseValue[] | DatabaseRow;
+export type DatabaseRow = { [column: string]: DatabaseValue };
+type MutationResult = Pick<mysql2.ResultSetHeader, "insertId" | "affectedRows">;
+type QueryRows = DatabaseRow[] | MutationResult | QueryRows[];
+type QueryField = Pick<pg.FieldDef, "name">;
+type QueryFields = (QueryField | QueryField[] | undefined)[];
+type QueryResult = {
+  err: Error | null;
+  rows: QueryRows | undefined;
+  fields: QueryFields | undefined;
+};
+type DatabaseConfig = {
+  useMysql2?: boolean;
+  mysql?: Pick<mysql.PoolConfig, "host" | "user" | "password" | "database" | "port" | "multipleStatements">;
+  postgresql?: Pick<pg.PoolConfig, "host" | "user" | "password" | "database" | "port" | "ssl">;
+};
+type DatabasePool = {
+  query(sql: string, values: mysql2.QueryValues[], callback: (
+    error: Error | null | undefined, result: unknown, fields?: unknown,
+  ) => void): void;
+};
+
+function isDatabaseValue(value: unknown): value is DatabaseValue {
+  return value === null || typeof value === "string" || typeof value === "number"
+    || typeof value === "bigint" || typeof value === "boolean"
+    || value instanceof Date || Buffer.isBuffer(value)
+    || (Array.isArray(value) ? value.every(isDatabaseValue)
+      : typeof value === "object" && Object.values(value).every(isDatabaseValue));
+}
+
+function isDatabaseRow(value: unknown): value is DatabaseRow {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    && !(value instanceof Date) && !Buffer.isBuffer(value)
+    && Object.values(value).every(isDatabaseValue);
+}
+
+function isQueryRows(value: unknown): value is QueryRows {
+  return Array.isArray(value)
+    ? value.every(isDatabaseRow) || value.every(isQueryRows)
+    : value !== null && typeof value === "object"
+      && "insertId" in value && typeof value.insertId === "number"
+      && "affectedRows" in value && typeof value.affectedRows === "number";
+}
+
+function isQueryField(value: unknown): value is QueryField {
+  return value !== null && typeof value === "object" && "name" in value && typeof value.name === "string";
+}
+
+function isQueryFields(value: unknown): value is QueryFields {
+  return Array.isArray(value) && value.every((field: unknown) =>
+    field === undefined || isQueryField(field) || (Array.isArray(field) && field.every(isQueryField)));
+}
+
+/*
+#PORTING-EDIT
+Check driver results before exposing database values, reject unsupported shapes, and use undefined for absent rows.
+*/
+function readQueryResult(result: unknown, fields: unknown, postgres: boolean) {
+  let rows = result;
+  if (postgres) {
+    if (result === undefined || result === null) return { rows: undefined, fields: undefined };
+    if (typeof result !== "object") throw new TypeError("Invalid PostgreSQL result");
+    rows = "rows" in result ? result.rows : undefined;
+    fields = "fields" in result ? result.fields : undefined;
+  }
+  let checkedFields: QueryFields | undefined;
+  if (fields !== undefined) {
+    if (!isQueryFields(fields)) throw new TypeError("Invalid database fields");
+    checkedFields = fields;
+  }
+  if (rows === undefined || rows === null) return { rows: undefined, fields: checkedFields };
+  if (isQueryRows(rows)) return { rows, fields: checkedFields };
+  throw new TypeError("Invalid database rows");
+}
+
 export function quoteIdentifier(name: string, dbType: string): string {
   const quoteChar = dbType === "POSTGRESQL" ? '"' : "`";
   return quoteChar + name + quoteChar;
@@ -42,9 +118,9 @@ function endOfLiteralOrComment(query: string, start: number): number {
     return query.length;
 }
 
-export function convertQuery(mysqlQuery, params) {
+export function convertQuery(mysqlQuery: string, params: mysql2.QueryValues[]) {
   let pgQuery = "";
-  let pgParams = [];
+  let pgParams: mysql2.QueryValues[] = [];
 
   let paramIndex = 1;
   let charIndex = 0;
@@ -81,7 +157,7 @@ export function convertQuery(mysqlQuery, params) {
   };
 }
 
-export function quotePostgresQuery(query) {
+export function quotePostgresQuery(query: string) {
   query = query.replace(/`/g, '"');
 
   const reservedWords = [
@@ -174,7 +250,7 @@ export function quotePostgresQuery(query) {
     "RETURNING",
   ];
 
-  const wordsToAddQuotes = new Set();
+  const wordsToAddQuotes = new Set<string>();
   const parts = query.split(/[ ,\(\)]/);
 
   let inString = false;
@@ -197,7 +273,7 @@ export function quotePostgresQuery(query) {
     ) {
     } else {
       for (let x of part.split(".")) {
-        if (isNaN(x)) {
+        if (isNaN(Number(x))) {
           wordsToAddQuotes.add(x);
         }
       }
@@ -221,12 +297,14 @@ export function quotePostgresQuery(query) {
 }
 
 export default class dbManager {
-  _db;
-  dbType;
+  _db?: DatabasePool;
+  dbType?: "MYSQL" | "POSTGRESQL";
 
-  init(config) {
+  init(config: DatabaseConfig) {
     if (config.mysql) {
-      this._db = (config.useMysql2 ? mysql2 : mysql).createPool({
+      const driver: { createPool(options: mysql.PoolConfig & mysql2.PoolOptions): DatabasePool } =
+        config.useMysql2 ? mysql2 : mysql;
+      this._db = driver.createPool({
         connectionLimit: 10,
         host: config.mysql.host,
         user: config.mysql.user,
@@ -254,18 +332,25 @@ export default class dbManager {
     }
   }
 
-  async query(queryString, args = []): Promise<any> {
+  async query(queryString: string, args: mysql2.QueryValues[] = []): Promise<QueryResult> {
     return new Promise((resolve, reject) => {
       if (this.dbType === "POSTGRESQL") {
         const result = convertQuery(queryString, args);
         queryString = quotePostgresQuery(result.pgQuery);
         args = result.pgParams;
       }
+      if (!this._db) throw new TypeError("Cannot read properties of undefined (reading 'query')");
       this._db.query(queryString, args, (a, b, c) => {
-        if (this.dbType === "MYSQL") {
-          resolve({ err: a, rows: b, fields: c });
-        } else if (this.dbType === "POSTGRESQL") {
-          resolve({ err: a, rows: b?.rows, fields: b?.fields });
+        if (this.dbType === "MYSQL" || this.dbType === "POSTGRESQL") {
+          try {
+            /*
+            #PORTING-EDIT
+            Both drivers signal success without an error; use null for PostgreSQL's undefined success value.
+            */
+            resolve({ err: a ?? null, ...readQueryResult(b, c, this.dbType === "POSTGRESQL") });
+          } catch (error) {
+            reject(error);
+          }
         }
       });
     });

package/tests/api-helpers.test.ts

@@ -185,6 +185,46 @@ describe("sqlAnd", () => {
 });
 
 describe("evalExpression", () => {
+  it("keeps direct evaluation scope and repeated field getter reads", () => {
+    const data = { a: "x" };
+    expect(evalExpression("[data, statement, varString]", data)).toEqual([
+      data, "var a = 'x';", "var a = 'x';",
+    ]);
+    expect(evalExpression("data", data)).toBe(data);
+    let reads = 0;
+    expect(evalExpression("text", {
+      get text() { return ++reads === 1 ? "guard" : "second read"; },
+    })).toBe("second read");
+    expect(reads).toBe(2);
+    reads = 0;
+    expect(evalExpression("item.read", {
+      get item() { return { read: ++reads }; },
+    })).toBe(3);
+    expect(reads).toBe(3);
+    reads = 0;
+    expect(evalExpression("text", {
+      get text() { return ++reads === 1 ? "guard" : 42; },
+    })).toBe("Error");
+    expect(reads).toBe(2);
+  });
+  it("preserves unchecked result identity, lazy properties and CSV/JSON coercion", () => {
+    const data = { reads: 0 };
+    const result = evalExpression("({get label(){ return ++data.reads; }})", data);
+    expect(data.reads).toBe(0);
+    expect(JSON.stringify({ label: result })).toBe('{"label":{"label":1}}');
+    const coercible = evalExpression('({toString(){return "csv";}, toJSON(){return "json";}})', {});
+    expect("" + coercible).toBe("csv");
+    expect(JSON.stringify({ label: coercible })).toBe('{"label":"json"}');
+    const cycle: { self?: object } = {};
+    cycle.self = cycle;
+    const holder = Object.defineProperty({}, "cycle", { value: cycle });
+    expect(evalExpression("data.cycle", holder)).toBe(cycle);
+    const fn = evalExpression("(function label(){ return 7; })", {});
+    expect("" + fn).toContain("function label");
+    expect(JSON.stringify({ label: fn })).toBe("{}");
+    expect(evalExpression("undefined", {})).toBeUndefined();
+    expect(evalExpression("null", {})).toBeNull();
+  });
   it("evaluates an expression against record fields", () => {
     expect(
       evalExpression("weight + ' kg'", { weight: 42 }),
@@ -205,6 +245,17 @@ describe("evalExpression", () => {
 });
 
 describe("getFormattedValue", () => {
+  it("preserves raw object identity, absent-name indexing and own undefined options", async () => {
+    const value = { nested: true };
+    const record: Record<string, unknown> = { undefined: value };
+    await expect(getFormattedValue({}, record)).resolves.toBe(value);
+    expect(Object.prototype.hasOwnProperty.call(record, "options")).toBe(true);
+    expect(record.options).toBeUndefined();
+    const options = ["x"];
+    await expect(getFormattedValue({ formattedValue: "data", options }, record)).resolves.toBe(record);
+    expect(record.options).toBe(options);
+    await expect(getFormattedValue({ formatValueForExport: () => { throw new Error("formatter failed"); } }, record)).resolves.toBe("");
+  });
   it("prefers formatValueForExport", async () => {
     const column = {
       name: "a",
@@ -240,6 +291,14 @@ describe("getFormattedValue", () => {
 });
 
 describe("formatValueForInsertion", () => {
+  it("preserves unchecked fallback values and existing serialization failures", () => {
+    const symbol = Symbol("raw");
+    const callback = () => "raw";
+    expect(formatValueForInsertion(symbol, "MYSQL")).toBe(symbol);
+    expect(formatValueForInsertion(callback, "MYSQL")).toBe(callback);
+    expect(formatValueForInsertion(BigInt(9), "MYSQL")).toBe(BigInt(9));
+    expect(() => formatValueForInsertion({ toJSON: () => undefined }, "MYSQL")).toThrow(TypeError);
+  });
   it("maps falsy (but not 0) to NULL", () => {
     expect(formatValueForInsertion(null, "MYSQL")).toBe("NULL");
     expect(formatValueForInsertion(undefined, "MYSQL")).toBe("NULL");

package/tests/dbManager.test.ts

@@ -1,4 +1,4 @@
-import {
+import dbManager, {
   convertQuery,
   quotePostgresQuery,
   quoteIdentifier,
@@ -263,3 +263,18 @@ describe("convertQuery / quotePostgresQuery (adversarial cases)", () => {
     );
   });
 });
+
+
+describe("dbManager input behavior", () => {
+  it("rejects a query when the manager has no database", async () => {
+    await expect(new dbManager().query("SELECT 1"))
+      .rejects.toThrow("Cannot read properties of undefined (reading 'query')");
+  });
+
+  it("preserves parameter consumption and exhausted placeholders", () => {
+    const params = ["table", 1];
+    expect(convertQuery("SELECT ? FROM ?? WHERE a = ?", params))
+      .toEqual({ pgQuery: "SELECT $1 FROM 1 WHERE a = $2", pgParams: ["table", undefined] });
+    expect(params).toEqual([]);
+  });
+});

package/tests/helpers/fakeDb.ts

@@ -1,3 +1,5 @@
+import type DbManager from "../../src/utils/dbManager";
+
 /**
  * Scripted fake for the dbManager abstraction used by the galadmin routes.
  *
@@ -15,13 +17,15 @@
 export type FakeQueryResult = { err?: any; rows?: any; fields?: any };
 export type RecordedQuery = { sql: string; params: any[] };
 
-export class FakeDb {
+export class FakeDb implements DbManager {
   dbType: "MYSQL" | "POSTGRESQL" = "MYSQL";
   schemaRows: any[] = [];
   queries: RecordedQuery[] = [];
   private queue: FakeQueryResult[] = [];
   defaultResult: FakeQueryResult = { err: null, rows: [] };
 
+  init(_config: Parameters<DbManager["init"]>[0]): void {}
+
   queueResult(result: FakeQueryResult) {
     this.queue.push({ err: null, rows: [], ...result });
     return this;
@@ -35,15 +39,13 @@ export class FakeDb {
     return this.queueResult({ err, rows: null });
   }
 
-  async query(sql: string, params: any[] = []): Promise<FakeQueryResult> {
+  async query(sql: string, params: any[] = []): Promise<Awaited<ReturnType<DbManager["query"]>>> {
     this.queries.push({ sql, params });
     if (typeof sql === "string" && sql.includes("information_schema")) {
-      return { err: null, rows: this.schemaRows };
-    }
-    if (this.queue.length > 0) {
-      return this.queue.shift()!;
+      return { err: null, rows: this.schemaRows, fields: undefined };
     }
-    return this.defaultResult;
+    const result = this.queue.length > 0 ? this.queue.shift()! : this.defaultResult;
+    return { err: null, rows: [], fields: undefined, ...result };
   }
 
   reset() {

package/tests/integration/authorizationBoundary.integration.test.ts

@@ -0,0 +1,57 @@
+import * as request from "supertest";
+import { canWriteView, roleOf, viewFromRequest } from "../../src/api/authorization";
+import { buildAppForManager } from "../helpers/app";
+import { baseConfig, fruitView } from "../helpers/fixtures";
+import { DbHarness, describeIntegration, getMysqlHarness, resetTables } from "./dbHarness";
+
+describeIntegration("authorization input boundaries", () => {
+  let harness: DbHarness;
+  beforeAll(async () => { harness = await getMysqlHarness(); });
+  beforeEach(async () => { await resetTables(harness); });
+  afterAll(async () => { await harness.stop(); });
+
+  it("uses one absent-role value and preserves declared role decisions", () => {
+    for (const user of [null, undefined, 0, "editor", {}, { role: null }, { role: 42 }]) {
+      const role = roleOf({ session: { user } });
+      expect(role).toBeUndefined();
+      expect(canWriteView({ roles: ["editor"] }, role)).toBe(false);
+      expect(canWriteView({}, role)).toBe(true);
+    }
+    expect(roleOf({ session: { user: { role: "root" } } })).toBe("root");
+    expect(canWriteView({ roles: [] }, "root")).toBe(true);
+  });
+
+  it("preserves canonical index coercion, input precedence, and view identity", () => {
+    const view = { roles: ["editor"] };
+    const config = { views: [view] };
+    for (const viewIndex of [0, "0", [0], { toString: () => "0" }]) {
+      expect(viewFromRequest({ body: { viewIndex }, query: { viewIndex: 99 }, config })).toBe(view);
+    }
+    expect(viewFromRequest({ body: {}, query: { viewIndex: "0" }, config })).toBe(view);
+    for (const viewIndex of [null, {}, [], "01", "length", "__proto__", "constructor", ["length"]]) {
+      expect(viewFromRequest({ body: { viewIndex }, query: { viewIndex: "0" }, config })).toBeUndefined();
+    }
+  });
+
+  it("rejects non-view properties before HTTP writes and keeps valid index writes", async () => {
+    const app = buildAppForManager(harness.manager, baseConfig());
+    for (const viewIndex of ["length", "__proto__", "constructor", ["length"], "01", null]) {
+      await request(app).post("/api/createRecord").query({ viewIndex: "0" })
+        .send({ viewIndex, data: { fruitName: "rejected" } }).expect(403);
+    }
+    expect((await harness.query("SELECT * FROM fruits")).rows).toEqual([]);
+    for (const viewIndex of [0, "0", [0]]) {
+      await request(app).post("/api/createRecord").query({ viewIndex: "99" })
+        .send({ viewIndex, data: { fruitName: "allowed" } }).expect(200);
+    }
+    expect((await harness.query("SELECT * FROM fruits")).rows).toHaveLength(3);
+  });
+
+  it("keeps anonymous HTTP writes denied for role-restricted views", async () => {
+    const config = baseConfig({ views: [fruitView({ roles: ["editor"] })] });
+    const app = buildAppForManager(harness.manager, config, null);
+    await request(app).post("/api/createRecord")
+      .send({ viewIndex: 0, data: { fruitName: "rejected" } }).expect(403);
+    expect((await harness.query("SELECT * FROM fruits")).rows).toEqual([]);
+  });
+});