@galadrim/galadmin 0.2.12 → 0.3.0-alpha.2.1

package/tests/integration/configEnrichment.integration.test.ts

@@ -0,0 +1,79 @@
+import { createPool } from "mysql";
+import { enrichConfig, generateUniqueIdForObject } from "../../src/api/config";
+import dbManager from "../../src/utils/dbManager";
+import { baseConfig, fruitView } from "../helpers/fixtures";
+import {
+  DbHarness, describeIntegration, getMysqlHarness, readIntegrationState,
+} from "./dbHarness";
+
+describeIntegration("config enrichment metadata boundary", () => {
+  let harness: DbHarness;
+
+  beforeAll(async () => {
+    harness = await getMysqlHarness();
+    const { err } = await harness.query("CREATE TABLE port_config_enum (state ENUM('open','closed') NOT NULL)");
+    if (err) throw err;
+  });
+
+  afterAll(async () => {
+    try {
+      const { err } = await harness.query("DROP TABLE port_config_enum");
+      if (err) throw err;
+    } finally {
+      await harness.stop();
+    }
+  });
+
+  const config = () => baseConfig({
+    views: [fruitView({
+      tableName: "port_config_enum",
+      columns: [{ label: "State", name: "state" }],
+    })],
+  });
+
+  it("keeps real enum options, required inference, and stable identifiers", async () => {
+    const value = config();
+    const id = generateUniqueIdForObject(value.views[0].columns[0]);
+    await enrichConfig(value, harness.manager);
+    expect(value.views[0].columns[0]).toEqual({
+      label: "State", name: "state", __id__: id,
+      dataType: "select", options: ["open", "closed"], required: true,
+    });
+    const viewId = value.views[0].__id__;
+    await enrichConfig(value, harness.manager);
+    expect(value.views[0].__id__).toBe(viewId);
+    expect(value.views[0].columns[0].__id__).toBe(id);
+    expect(value.enriched).toBe(true);
+  });
+
+  it.each<[string, string | number, string]>([
+    ["TABLE_NAME", 42, "Invalid database schema columns"],
+    ["COLUMN_TYPE", "enum(1)", "Invalid enum options"],
+  ])("rejects invalid %s returned by a real driver decoder", async (fieldName, decodedValue, message) => {
+    const conn = readIntegrationState()?.mysql;
+    if (!conn) throw new Error("Missing MySQL integration connection");
+    const pool = createPool({
+      ...conn,
+      typeCast(field, next) {
+        return field.name === fieldName ? decodedValue : next();
+      },
+    });
+    const manager = new dbManager();
+    manager.dbType = "MYSQL";
+    manager._db = pool;
+    const value = config();
+    try {
+      await expect(enrichConfig(value, manager)).rejects.toThrow(message);
+      expect(value.enriched).toBeUndefined();
+      if (fieldName === "TABLE_NAME") {
+        expect(value.views[0].columns[0]).toEqual({ label: "State", name: "state" });
+        expect(value.views[0].__id__).toBeUndefined();
+      } else {
+        expect(value.views[0].columns[0].dataType).toBe("select");
+        expect(value.views[0].columns[0].options).toBeUndefined();
+      }
+    } finally {
+      await new Promise<void>((resolve, reject) => pool.end((err) => err ? reject(err) : resolve()));
+    }
+  });
+});

package/tests/integration/customComponentBoundary.integration.test.ts

@@ -0,0 +1,58 @@
+import * as express from "express";
+import * as request from "supertest";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import customComponentRoute from "../../src/api/routes/customComponent";
+import { describeIntegration } from "./dbHarness";
+
+describeIntegration("custom component package boundary with real Rollup", () => {
+  let directory: string;
+  let packagePath: string;
+  let app: express.Express;
+
+  beforeEach(() => {
+    directory = fs.mkdtempSync(path.join(os.tmpdir(), "galadmin-component-"));
+    const packageRoot = path.join(directory, "package");
+    fs.mkdirSync(path.join(packageRoot, "src/front"), { recursive: true });
+    fs.mkdirSync(path.join(packageRoot, "dist"));
+    packagePath = path.join(packageRoot, "src/front/package.json");
+    fs.writeFileSync(packagePath, "{}");
+    fs.writeFileSync(path.join(packageRoot, "babel.config"), "{}");
+    fs.writeFileSync(path.join(directory, "component.js"), "export default 42;");
+    app = express();
+    app.get("/component", customComponentRoute(path.join(packageRoot, "dist")));
+  });
+
+  afterEach(() => fs.rmSync(directory, { recursive: true, force: true }));
+
+  it("bundles a component and keeps declared dependencies external", async () => {
+    fs.writeFileSync(packagePath, JSON.stringify({ dependencies: { "fixture-dependency": "1" } }));
+    fs.writeFileSync(path.join(directory, "component.js"),
+      "import value from 'fixture-dependency'; export default value;");
+    const result = await request(app).get("/component")
+      .query({ componentPath: "component.js" }).expect(200);
+    expect(result.text).toContain("require('fixture-dependency')");
+    expect(result.text).toContain("module.exports");
+  });
+
+  it.each(["{}", "0", '"metadata"', '{"dependencies":false}'])(
+    "retains JavaScript property access for package %s", async (metadata) => {
+      fs.writeFileSync(packagePath, metadata);
+      const result = await request(app).get("/component")
+        .query({ componentPath: "component.js" }).expect(200);
+      expect(result.text).toContain("42");
+      expect(result.text).toContain("module.exports");
+    },
+  );
+
+  it.each(["null", "{invalid"])("returns 500 for package %s", async (metadata) => {
+    fs.writeFileSync(packagePath, metadata);
+    await request(app).get("/component")
+      .query({ componentPath: "component.js" }).expect(500);
+  });
+
+  it("returns 500 for a missing component path", async () => {
+    await request(app).get("/component").expect(500);
+  });
+});

package/tests/integration/dbManager.integration.test.ts

@@ -1,8 +1,13 @@
+import * as request from "supertest";
+import buildIndexApp from "../../src/index";
+import dbManager from "../../src/utils/dbManager";
 import {
   DbHarness,
   describeIntegration,
   getMysql2Harness,
   getPgHarness,
+  readIntegrationState,
+  resetTables,
 } from "./dbHarness";
 
 /**
@@ -33,9 +38,7 @@ describeIntegration("dbManager against real databases", () => {
 
   it("unwraps {rows, fields} from the pg result object", async () => {
     const result = await harnesses.postgresql.query("SELECT 1 AS one");
-    // pg resolves success with an undefined err (MySQL passes null); every
-    // consumer only checks truthiness.
-    expect(result.err).toBeFalsy();
+    expect(result.err).toBeNull();
     expect(result.rows).toEqual([{ one: 1 }]);
     expect(result.fields).toBeDefined();
   });
@@ -62,8 +65,107 @@ describeIntegration("dbManager against real databases", () => {
     expect(rows).toEqual([{ name: "pomme" }]);
   });
 
+  it("preserves PostgreSQL scalar, date, binary, and JSON values", async () => {
+    const raw = harnesses.postgresql.rawPg;
+    await raw.query("CREATE TABLE port_values (number INTEGER, flag BOOLEAN, stamp TIMESTAMPTZ, bytes BYTEA, data JSONB, missing TEXT)");
+    try {
+      const stamp = new Date("2026-01-02T03:04:05.000Z");
+      const bytes = Buffer.from("port");
+      const data = { nested: [true, 2, null, "text"] };
+      await raw.query("INSERT INTO port_values VALUES ($1, $2, $3, $4, $5, $6)", [7, true, stamp, bytes, data, null]);
+      const result = await harnesses.postgresql.query("SELECT * FROM port_values");
+      expect(result.err).toBeNull();
+      expect(result.rows).toEqual([{ number: 7, flag: true, stamp, bytes, data, missing: null }]);
+      expect(result.fields).toEqual(expect.arrayContaining([expect.objectContaining({ name: "stamp" })]));
+    } finally {
+      await raw.query("DROP TABLE port_values");
+    }
+  });
+
+  it("preserves MySQL mutation headers and multiple result sets when opted in", async () => {
+    const harness = new DbHarness();
+    harness.manager = new dbManager();
+    harness.manager.init({ useMysql2: true, mysql: { ...readIntegrationState().mysql, multipleStatements: true } });
+    try {
+      const setup = await harness.query("CREATE TEMPORARY TABLE port_multi (id INT PRIMARY KEY)");
+      expect(setup.err).toBeNull();
+      const result = await harness.query("INSERT INTO port_multi VALUES (1); SELECT id FROM port_multi");
+      expect(result.err).toBeNull();
+      expect(result.rows).toEqual([expect.objectContaining({ insertId: 0, affectedRows: 1 }), [{ id: 1 }]]);
+      expect(result.fields[0]).toBeUndefined();
+      expect(result.fields[1]).toEqual([expect.objectContaining({ name: "id" })]);
+      const failure = await harness.query("SELECT missing_column FROM port_multi");
+      expect(failure.err).toBeInstanceOf(Error);
+      expect(failure.rows).toBeUndefined();
+      expect(failure.fields).toBeUndefined();
+    } finally {
+      await harness.stop();
+    }
+  });
+
+  it("preserves the existing PostgreSQL multiple-result response", async () => {
+    expect(await harnesses.postgresql.query("SELECT 'one'; SELECT 'two'"))
+      .toEqual({ err: null, rows: undefined, fields: undefined });
+  });
+
   it("rejects stacked statements (multipleStatements off by default)", async () => {
     const result = await harnesses.mysql2.query("SELECT 1; SELECT 2");
     expect(result.err).toBeTruthy();
   });
 });
+
+
+describeIntegration("authentication with real PostgreSQL sessions", () => {
+  let harness: DbHarness;
+  let app: ReturnType<typeof buildIndexApp>;
+
+  beforeAll(async () => {
+    harness = await getPgHarness();
+    await resetTables(harness);
+    await harness.rawPg.query(
+      'INSERT INTO fruits ("fruitName", acidity, note) VALUES ($1, $2, NULL), ($3, NULL, $4)',
+      ["numeric-user", 123, "text-user", "secret"],
+    );
+    app = buildIndexApp({
+      name: "Port integration",
+      sessionSecret: "port-integration-session-secret",
+      auth: { username: "root", password: "root-secret" },
+      postgresql: readIntegrationState().postgresql,
+      authRoles: [
+        { role: "numeric", table: "fruits", usernameField: "fruitName", passwordField: "acidity", idField: "id", filters: "acidity IS NOT NULL" },
+        { role: "editor", table: "fruits", usernameField: "fruitName", passwordField: "note", idField: "id", filters: "note IS NOT NULL" },
+      ],
+      views: [],
+    });
+  });
+
+  afterAll(async () => {
+    try {
+      // The app owns its pools; wait for their native idle timeout before stopping PostgreSQL.
+      const deadline = Date.now() + 15_000;
+      while (true) {
+        const { rows } = await harness.rawPg.query(
+          "SELECT count(*)::int AS connections FROM pg_stat_activity WHERE datname = current_database() AND usename = current_user AND pid <> pg_backend_pid()",
+        );
+        if (rows[0].connections === 0) break;
+        if (Date.now() >= deadline) throw new Error("Application database pools did not become idle");
+        await new Promise((resolve) => setTimeout(resolve, 250));
+      }
+    } finally {
+      await harness?.stop();
+    }
+  });
+
+  it("rejects numeric passwords, accepts text passwords, and revokes a deleted user's session", async () => {
+    await request(app).post("/api/login")
+      .send({ username: "numeric-user", password: 123 })
+      .expect(200).expect({ success: false });
+    const agent = request.agent(app);
+    await agent.post("/api/login")
+      .send({ username: "text-user", password: "secret" })
+      .expect(200).expect({ success: true });
+    await agent.get("/api/isAuthenticated").expect(200).expect({ isAuthenticated: true });
+    await harness.rawPg.query('DELETE FROM fruits WHERE "fruitName" = $1', ["text-user"]);
+    await agent.post("/api/records").send({ viewIndex: 0 }).expect(401);
+  });
+});

package/tests/integration/importParserChild.cjs

@@ -0,0 +1,55 @@
+// Isolate unhandled parser rejections so characterization cannot crash Jest.
+const fs = require("fs");
+const ts = require("typescript");
+require.extensions[".ts"] = (module, filename) => {
+  const source = fs.readFileSync(filename, "utf8");
+  const { outputText } = ts.transpileModule(source, {
+    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2019 },
+    fileName: filename,
+  });
+  module._compile(outputText, filename);
+};
+const request = require("supertest");
+const { buildAppForManager } = require("../helpers/app.ts");
+const { baseConfig, fruitView } = require("../helpers/fixtures.ts");
+const { getMysqlHarness, getMysql2Harness, getPgHarness } = require("./dbHarness.ts");
+
+(async () => {
+  const factory = { mysql: getMysqlHarness, mysql2: getMysql2Harness, postgresql: getPgHarness };
+  const harness = await factory[process.env.IMPORT_BACKEND]();
+  let finished = false;
+  const finish = async (result) => {
+    if (finished) return;
+    finished = true;
+    await harness.stop();
+    process.send(result, () => process.exit(0));
+  };
+  process.on("unhandledRejection", (error) => finish({
+    kind: "unhandled", message: error.message,
+  }));
+  const parseImportFile = () => {
+    switch (process.env.IMPORT_CASE) {
+      case "throw": throw new Error("parser sync failure");
+      case "reject": return Promise.reject(new Error("parser async failure"));
+      case "null": return Promise.resolve(null);
+      case "undefined": return Promise.resolve(undefined);
+      default: throw new Error("Unknown parser case");
+    }
+  };
+  const panel = process.env.IMPORT_ROUTE === "panel";
+  const view = panel
+    ? fruitView({ recordViewPanels: [{
+      label: "Notes", tableName: "fruit_notes", parseImportFile,
+      createConfig: { label: "New note", recordIdKey: "fruitId", columns: [] },
+    }] })
+    : fruitView({ primaryId: "id", importFileUniqueField: "id", parseImportFile });
+  const config = baseConfig({ views: [view] });
+  const pending = request(buildAppForManager(harness.manager, config))
+    .post(panel ? "/api/subrecordsImport" : "/api/recordsImport").field("viewIndex", "0");
+  if (panel) pending.field("panelIndex", "0").field("recordId", "7");
+  const response = await pending.attach("data", Buffer.from("csv"), "import.csv");
+  await finish({ kind: "response", status: response.status, body: response.body });
+})().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/tests/integration/indexRuntime.integration.test.ts

@@ -0,0 +1,22 @@
+import { fork } from "child_process";
+import * as path from "path";
+import { describeIntegration } from "./dbHarness";
+
+describeIntegration("index runtime with real MySQL sessions and static files", () => {
+  it("preserves promise-pool persistence, authentication, assets and unknown-MIME errors", async () => {
+    const result = await new Promise<unknown>((resolve, reject) => {
+      const child = fork(path.join(__dirname, "indexRuntimeChild.cjs"), [], {
+        env: process.env,
+        stdio: ["ignore", "ignore", "pipe", "ipc"],
+      });
+      let result: unknown;
+      let errors = "";
+      child.stderr?.on("data", (chunk) => { errors += chunk.toString(); });
+      child.on("message", (message) => { result = message; });
+      child.on("error", reject);
+      child.on("exit", (code) => code === 0 ? resolve(result) : reject(new Error(errors || `Child exited ${code}`)));
+    });
+    expect(result).toEqual({ sessionPool: "PromisePool", persisted: true, logout: true, trustedCalls: 2,
+      text: 200, media: 200, unknownMime: 500 });
+  });
+});

package/tests/integration/indexRuntimeChild.cjs

@@ -0,0 +1,110 @@
+// Isolate the unchanged index runtime from the known session-store declaration mismatch.
+// Final build/strict checks still compile production source with the installed declarations.
+const fs = require("fs");
+const path = require("path");
+const assert = require("assert").strict;
+const ts = require("typescript");
+require.extensions[".ts"] = (module, filename) => {
+  const { outputText } = ts.transpileModule(fs.readFileSync(filename, "utf8"), {
+    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2019 },
+    fileName: filename,
+  });
+  module._compile(outputText, filename);
+};
+const request = require("supertest");
+const express = require("express");
+const buildIndexApp = require("../../src/index.ts").default;
+const { getMysql2Harness, readIntegrationState } = require("./dbHarness.ts");
+
+(async () => {
+  const harness = await getMysql2Harness();
+  const stores = new Set();
+  const files = [];
+  try {
+    const config = {
+      name: "Index runtime", sessionSecret: "index-runtime-characterization-secret",
+      mysql: readIntegrationState().mysql, enriched: true, views: [],
+      auth: { username: "root", password: "secret" },
+    };
+    const mount = (settings) => {
+      const outer = express();
+      outer.use((req, res, next) => {
+        res.on("finish", () => { if (req.sessionStore) stores.add(req.sessionStore); });
+        next();
+      });
+      outer.use("/admin", buildIndexApp(settings));
+      return outer;
+    };
+    const app = mount(config);
+    const agent = request.agent(app);
+    await agent.get("/admin/api/isAuthenticated").expect(200, { isAuthenticated: false });
+    const store = [...stores][0];
+    await store.onReady();
+    assert.equal(store.connection.constructor.name, "PromisePool");
+    const login = await agent.post("/admin/api/login").send({ username: "root", password: "secret" })
+      .expect(200, { success: true });
+    const cookie = login.headers["set-cookie"][0].split(";")[0];
+    const signed = decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1));
+    const sid = signed.slice(2, signed.indexOf("."));
+    const persisted = await harness.query("SELECT data FROM galadmin_sessions WHERE session_id = ?", [sid]);
+    assert.equal(persisted.err, null);
+    assert.equal(persisted.rows.length, 1);
+    assert.deepEqual(JSON.parse(persisted.rows[0].data).user, { role: "root" });
+    await agent.get("/admin/api/isAuthenticated").expect(200, { isAuthenticated: true });
+    await agent.get("/admin/api/logout").expect(200);
+    let remaining = true;
+    for (let attempt = 0; attempt < 50; attempt++) {
+      const result = await harness.query("SELECT session_id FROM galadmin_sessions WHERE session_id = ?", [sid]);
+      assert.equal(result.err, null);
+      remaining = result.rows.length !== 0;
+      if (!remaining) break;
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+    assert.equal(remaining, false);
+    await agent.get("/admin/api/isAuthenticated").expect(200, { isAuthenticated: false });
+
+    let hostUser = { role: "root", userId: "host-id" };
+    let calls = 0;
+    const trustedConfig = { ...config, trustedAuth(req) {
+      assert.equal(this, trustedConfig);
+      assert.equal(req.method, "GET");
+      calls++;
+      return hostUser;
+    } };
+    const trusted = request.agent(mount(trustedConfig));
+    await trusted.get("/admin/api/isAuthenticated").expect(200, { isAuthenticated: true });
+    hostUser = null;
+    await trusted.get("/admin/api/isAuthenticated").expect(200, { isAuthenticated: false });
+    assert.equal(calls, 2);
+
+    const dir = path.resolve(__dirname, "../../src/front/build");
+    fs.mkdirSync(dir, { recursive: true });
+    const fixture = (extension, content) => {
+      const name = `__port_index_${process.pid}.${extension}`;
+      const file = path.join(dir, name);
+      fs.writeFileSync(file, content, { flag: "wx" });
+      files.push(file);
+      return "/admin/" + name;
+    };
+    const text = await request(app).get(fixture("txt", "url=/_HOMEPAGE_/asset")).expect(200);
+    assert.match(text.headers["content-type"], /^text\/plain/);
+    assert.equal(text.text, "url=/admin/asset");
+    const bytes = Buffer.from([137, 80, 78, 71, 0, 255]);
+    const media = await request(app).get(fixture("png", bytes)).expect(200);
+    assert.match(media.headers["content-type"], /^image\/png/);
+    assert.deepEqual(media.body, bytes);
+    const unknown = await request(app).get(fixture("port-unknown-mime", "unknown type")).expect(500);
+    assert.match(unknown.text, /indexOf/);
+    assert.match(unknown.headers["content-type"], /^text\/html/);
+    process.send({ sessionPool: "PromisePool", persisted: true, logout: true, trustedCalls: calls,
+      text: 200, media: 200, unknownMime: unknown.status });
+  } finally {
+    for (const file of files) fs.unlinkSync(file);
+    for (const store of stores) {
+      await store.onReady();
+      await store.close();
+      await store.connection.end();
+    }
+    await harness.stop();
+  }
+})().then(() => process.exit(0), (error) => { console.error(error); process.exit(1); });

package/tests/integration/queries.integration.test.ts

@@ -0,0 +1,88 @@
+import { createPool } from "mysql";
+import createRecordQueries, { collectAllowedQueries, sqlAnd } from "../../src/api/queries";
+import dbManager from "../../src/utils/dbManager";
+import {
+  DbHarness, describeIntegration, getMysqlHarness, getMysql2Harness, getPgHarness,
+  readIntegrationState,
+} from "./dbHarness";
+
+for (const [backend, connect] of [
+  ["mysql", getMysqlHarness], ["mysql2", getMysql2Harness], ["postgresql", getPgHarness],
+] as const) {
+  describeIntegration(`record query results (${backend})`, () => {
+    let harness: DbHarness;
+    beforeAll(async () => { harness = await connect(); });
+    afterAll(async () => { await harness.stop(); });
+
+    it("preserves rows, driver count values, and the original input", async () => {
+      const queries = createRecordQueries(harness.manager);
+      const params = { table: "fruits", customQuery: "SELECT 1 AS id", page: "1", limit: "2", orderBy: null };
+      const result = await queries.getRecords(params, true);
+      expect(result.error).toBeUndefined();
+      expect(result.rows).toEqual([{ id: 1 }]);
+      expect(result.count).toBe(backend === "postgresql" ? "1" : 1);
+      expect(result.input?.params).toBe(params);
+      expect(params.orderBy).toBeNull();
+      expect(Object.keys(result)).toEqual(["rows", "queryString", "input", "count"]);
+      const adjacent = { table: "fruits", customQuery: "SELECT 1 AS id", position: "1", offset: 0 };
+      const found = await queries.findRecordByPosition(adjacent);
+      expect(found.input?.params).toBe(adjacent);
+      expect(adjacent).toMatchObject({ page: 1, limit: 1 });
+      expect(found.count).toBeUndefined();
+    });
+
+    it("preserves the error-only result", async () => {
+      const result = await createRecordQueries(harness.manager).getRecords({
+        table: "port_missing_table", page: 1, limit: 1,
+      });
+      expect(result.error).toBeInstanceOf(Error);
+      expect(Object.keys(result)).toEqual(["error"]);
+    });
+
+    if (backend !== "postgresql") {
+      it("uses the unpaged row count when the count subquery fails", async () => {
+        const result = await createRecordQueries(harness.manager).getRecords({
+          table: "fruits", customQuery: "SELECT 1 AS id, 2 AS id", page: 1, limit: 1,
+        }, true);
+        expect(result.rows).toEqual([{ id: 2 }]);
+        expect(result.count).toBe(1);
+      });
+    } else {
+      it("rejects absent rows from a PostgreSQL multiple-result response", async () => {
+        await expect(createRecordQueries(harness.manager).getRecords({
+          table: "fruits", customQuery: "SELECT 1 AS id; SELECT 2 AS id", page: 1, limit: 1,
+        })).rejects.toThrow("Invalid record query rows");
+      });
+    }
+  });
+}
+
+describeIntegration("record query boundary", () => {
+  it("rejects MySQL nested result sets and mutation headers", async () => {
+    const conn = readIntegrationState()?.mysql;
+    if (!conn) throw new Error("Missing MySQL integration connection");
+    const pool = createPool({ ...conn, multipleStatements: true });
+    const manager = new dbManager();
+    manager.dbType = "MYSQL";
+    manager._db = pool;
+    try {
+      for (const customQuery of ["SELECT 1 AS id; SELECT 2 AS id", "SET @port_query_value = 1 -- "]) {
+        await expect(createRecordQueries(manager).getRecords({
+          table: "fruits", customQuery, page: 1, limit: 1,
+        })).rejects.toThrow("Invalid record query rows");
+      }
+    } finally {
+      await new Promise<void>((resolve, reject) => pool.end((err) => err ? reject(err) : resolve()));
+    }
+  });
+
+  it("preserves filter array identity and recursive template collection", () => {
+    const filters = ["id = 1"];
+    expect(sqlAnd([null, filters, undefined])).toBe(filters);
+    expect(sqlAnd([filters, "id > 0"])).toBe("(id = 1) AND (id > 0)");
+    const acc = new Set(["SELECT 0"]);
+    const config = [{ nested: { autocompleteListQuery: " SELECT 1 " } }, null, () => "ignored"];
+    expect(collectAllowedQueries(config, acc)).toBe(acc);
+    expect(acc).toEqual(new Set(["SELECT 0", "SELECT 1"]));
+  });
+});

package/tests/integration/requestConfig.integration.test.ts

@@ -0,0 +1,118 @@
+import * as request from "supertest";
+import type { Column, Config } from "../../src/types/config";
+import { buildAppForManager } from "../helpers/app";
+import { DbHarness, describeIntegration, getMysqlHarness, resetTables } from "./dbHarness";
+
+describeIntegration("request configuration data operations", () => {
+  let harness: DbHarness;
+  beforeAll(async () => { harness = await getMysqlHarness(); });
+  afterAll(async () => { await harness?.stop(); });
+  beforeEach(async () => { await resetTables(harness); });
+
+  describe("hidden column names", () => {
+    beforeAll(async () => {
+      const { err } = await harness.query(
+        "CREATE TABLE api_hidden_names (id INT PRIMARY KEY, `undefined` VARCHAR(255), `null` VARCHAR(255), note VARCHAR(255))",
+      );
+      expect(err).toBeNull();
+    });
+    afterAll(async () => {
+      const { err } = await harness.query("DROP TABLE api_hidden_names");
+      expect(err).toBeNull();
+    });
+    beforeEach(async () => {
+      expect((await harness.query("TRUNCATE TABLE api_hidden_names")).err).toBeNull();
+      expect((await harness.query(
+        "INSERT INTO api_hidden_names (id, `undefined`, `null`, note) VALUES (1, 'undefined value', 'null value', 'private')",
+      )).err).toBeNull();
+    });
+
+    const appForColumns = (columns: Column[]) => {
+      const config: Config = {
+        name: "Hidden names", sessionSecret: "test-secret", enriched: true,
+        views: [{ type: "table", label: "Names", tableName: "api_hidden_names", primaryId: "id", columns }],
+      };
+      const app = buildAppForManager(harness.manager, config, { role: "viewer" });
+      app.get("/api/inspectHiddenNames", (req, res) => {
+        res.send({ hidden: req.config?.views[0].__hiddenColumns });
+      });
+      return app;
+    };
+
+    it("preserves named restrictions and empty-string hidden names", async () => {
+      const columns: Column[] = [
+        { label: "Private", name: "note", roles: ["editor"] },
+        { label: "Empty", name: "", roles: ["editor"] },
+      ];
+      const app = appForColumns(columns);
+      await request(app).get("/api/inspectHiddenNames").expect(200, { hidden: ["note", ""] });
+      const read = await request(app).get("/api/record").query({ viewIndex: 0, recordId: 1 }).expect(200);
+      expect(read.body).toEqual({ id: 1, undefined: "undefined value", null: "null value" });
+      await request(app).post("/api/updateRecord")
+        .send({ viewIndex: 0, primaryValue: 1, data: { note: "forbidden" } }).expect(403);
+      expect((await harness.query("SELECT note FROM api_hidden_names WHERE id = 1")).rows).toEqual([{ note: "private" }]);
+      expect(columns.map((column) => (column as { name?: string }).name)).toEqual(["note", ""]);
+      const literalApp = appForColumns([
+        { label: "Undefined field", name: "undefined", roles: ["editor"] },
+        { label: "Null field", name: "null", roles: ["editor"] },
+      ]);
+      await request(literalApp).get("/api/inspectHiddenNames").expect(200, { hidden: ["undefined", "null"] });
+      await request(literalApp).get("/api/record").query({ viewIndex: 0, recordId: 1 })
+        .expect(200, { id: 1, note: "private" });
+      for (const name of ["undefined", "null"]) {
+        await request(literalApp).post("/api/updateRecord")
+          .send({ viewIndex: 0, primaryValue: 1, data: { [name]: "forbidden" } }).expect(403);
+      }
+    });
+
+    // The externally approved nullish filter changes these original behaviors.
+    it.each([undefined, null])("SANITIZATION: omits %s hidden names without hiding their literal property keys", async (name) => {
+      const unnamed: Column = { label: "Unnamed", name, roles: ["editor"] };
+      const app = appForColumns([unnamed, { label: "Private", name: "note", roles: ["editor"] }]);
+      const metadata = await request(app).get("/api/inspectHiddenNames").expect(200);
+      const read = await request(app).get("/api/record").query({ viewIndex: 0, recordId: 1 }).expect(200);
+      const key = String(name);
+      const write = await request(app).post("/api/updateRecord")
+        .send({ viewIndex: 0, primaryValue: 1, data: { [key]: "updated" } });
+      const { rows, err } = await harness.query("SELECT ?? AS value FROM api_hidden_names WHERE id = 1", [key]);
+      expect(err).toBeNull();
+      expect(unnamed.name).toBe(name);
+      expect(read.body).not.toHaveProperty("note");
+      expect({ hidden: metadata.body.hidden, read: read.body[key], write: write.status, rows }).toEqual({
+        hidden: ["note"], read: `${key} value`, write: 200, rows: [{ value: "updated" }],
+      });
+    });
+  });
+
+  it.each(["table", "custom", "iframe", "link"] as const)("preserves configured data operations for %s views", async (type) => {
+    const common = {
+      label: "Fruit operations",
+      tableName: "fruits",
+      primaryId: "id",
+      columns: [{ label: "Name", name: "fruitName" }],
+    };
+    const view = type === "table" ? { ...common, type }
+      : type === "custom" ? { ...common, type, componentPath: "unused-custom-component.js" }
+      : type === "iframe" ? { ...common, type, src: "https://example.com" }
+      : { ...common, type, src: "https://example.com" };
+    const config: Config = {
+      name: "Request config",
+      sessionSecret: "test-secret",
+      auth: { username: "test", password: "test" },
+      enriched: true,
+      views: [view],
+    };
+    const app = buildAppForManager(harness.manager, config);
+    await request(app).post("/api/createRecord")
+      .send({ viewIndex: 0, data: { fruitName: "pomme" } }).expect(200);
+    await request(app).post("/api/updateRecord")
+      .send({ viewIndex: 0, primaryValue: 1, data: { fruitName: "poire" } }).expect(200);
+    const response = await request(app).post("/api/records")
+      .send({ viewIndex: 0, page: 1, filters: [], isDesc: false }).expect(200);
+    expect(response.body.records).toHaveLength(1);
+    expect(response.body.records[0].fruitName).toBe("poire");
+    const { rows, err } = await harness.query("SELECT fruitName FROM fruits WHERE id = ?", [1]);
+    expect(err).toBeNull();
+    expect(rows).toEqual([{ fruitName: "poire" }]);
+  });
+});