@galadrim/galadmin 0.2.12 → 0.3.0-alpha.2.1

package/tests/integration/routes.authorization.integration.test.ts

@@ -83,6 +83,7 @@ describeIntegration("authorization against real databases", () => {
 
     const fruitCount = async () => {
       const { rows } = await harness.query("SELECT * FROM fruits");
+      if (!Array.isArray(rows)) throw new Error("Expected a row set");
       return rows.length;
     };
 

package/tests/integration/routes.config.integration.test.ts

@@ -1,4 +1,6 @@
 import * as request from "supertest";
+import * as express from "express";
+import configRoute from "../../src/api/routes/config";
 import { buildAppForManager } from "../helpers/app";
 import { baseConfig, fruitView, VIEWER } from "../helpers/fixtures";
 import {
@@ -13,6 +15,41 @@ import {
 
 jest.mock("axios");
 
+describeIntegration("config route error handling", () => {
+  afterEach(() => jest.restoreAllMocks());
+
+  it("logs the destructuring error and sends 500 when config middleware is absent", async () => {
+    const errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
+    const app = express();
+    app.get("/config", configRoute());
+
+    const response = await request(app).get("/config").expect(500);
+
+    expect(response.text).toBe("Internal Server Error");
+    expect(errorLog).toHaveBeenCalledTimes(1);
+    expect(errorLog).toHaveBeenCalledWith(expect.any(TypeError));
+  });
+
+  it("logs serialization failures and sends 500", async () => {
+    const errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
+    const app = express();
+    app.use((req, _res, next) => {
+      req.config = baseConfig({
+        views: [fruitView({ filtersFromUser: String })],
+      });
+      next();
+    });
+    app.get("/config", configRoute());
+
+    const response = await request(app).get("/config").expect(500);
+
+    expect(response.text).toBe("Internal Server Error");
+    expect(errorLog).toHaveBeenCalledTimes(1);
+    expect(errorLog).toHaveBeenCalledWith(expect.any(TypeError));
+    expect(errorLog.mock.calls[0][0].message).toContain("Serializing native function");
+  });
+});
+
 /**
  * GET /api/config against real engines. Serialization and role filtering are
  * pure JS; the real database is what feeds enrichConfig (information_schema
@@ -95,7 +132,8 @@ describeIntegration("config route against real databases", () => {
             label: "Clients only",
             tableName: "orders",
             roles: ["client"],
-            filtersFromUser: (id) => `client_id = ${id}`,
+            filtersFromUser: (user: { role: string; userId?: string | number }) =>
+                  user.role === "root" ? "" : typeof user.userId === "number" ? `client_id = ${user.userId}` : "1 = 0",
             columns: [],
           },
           fruitView(),

package/tests/integration/routes.crud.integration.test.ts

@@ -1,4 +1,5 @@
 import * as request from "supertest";
+import type { DatabaseRow } from "../../src/utils/dbManager";
 import { generateUniqueIdForObject } from "../../src/api";
 import { buildAppForManager } from "../helpers/app";
 import { baseConfig, fruitView, EDITOR, VIEWER } from "../helpers/fixtures";
@@ -68,13 +69,48 @@ describeIntegration("crud routes against real databases", () => {
       return res;
     };
 
-    const fruits = async () => (await harness.query("SELECT * FROM fruits")).rows;
+    const fruits = async () => {
+      const { rows } = await harness.query("SELECT * FROM fruits");
+      if (!Array.isArray(rows) || !rows.every((row): row is DatabaseRow => !Array.isArray(row))) {
+        throw new Error("Expected fruit rows");
+      }
+      return rows;
+    };
 
     // MySQL/mysql2 drivers expose the AUTO_INCREMENT id; pg results carry no
     // insertId, so created ids stay undefined in responses (GAP 11).
     const insertIdIsExposed = () => harness.dbType !== "POSTGRESQL";
 
     describe("POST /api/updateRecord", () => {
+      it("preserves UUID callback IDs, normalized data and HTTP previousData", async () => {
+        const id = "00000000-0000-4000-8000-000000000003";
+        expect((await harness.query("INSERT INTO uuid_fruits (id, fruitName) VALUES (?, ?)", [id, "pomme"])).err).toBeNull();
+        const received: { id: DatabaseRow[string]; data: DatabaseRow }[] = [];
+        const receivers: string[] = [];
+        const instance = app({
+          tableName: "uuid_fruits",
+          editCallback: "https://api.example.com/edited",
+          editCallbackFunction: function (
+            this: { tableName: string },
+            payload: { id: DatabaseRow[string]; data: DatabaseRow },
+          ) {
+            receivers.push(this.tableName);
+            received.push(payload);
+          },
+        });
+        mockedAxios.post.mockResolvedValue({});
+        await request(instance).post("/api/updateRecord").send({
+          viewIndex: "0", primaryValue: id, data: { fruitName: "" },
+          previousData: { id, fruitName: "pomme" },
+        }).expect(200);
+        expect(mockedAxios.post).toHaveBeenCalledWith("https://api.example.com/edited", {
+          id, data: { fruitName: null }, previousData: { id, fruitName: "pomme" },
+        });
+        expect(received).toEqual([{ id, data: { fruitName: null } }]);
+        expect(receivers).toEqual(["uuid_fruits"]);
+        expect((await harness.query("SELECT * FROM uuid_fruits")).rows).toEqual([{ id, fruitName: null }]);
+      });
+
       it("updates the record and persists the new values", async () => {
         await createFruit({ fruitName: "pomme", acidity: 3 });
         await request(app())
@@ -455,9 +491,70 @@ describeIntegration("crud routes against real databases", () => {
         });
         expect(await fruits()).toHaveLength(1);
       });
+
+      it("keeps a panel insert committed when its callback rejects and passes the unfiltered data", async () => {
+        const received: { id: number | undefined; data: DatabaseRow }[] = [];
+        const config = panelConfig();
+        const panel = config.views[0].recordViewPanels[0];
+        Object.assign(panel.createConfig, {
+          columns: [...panel.createConfig.columns, {
+            label: "Excluded",
+            name: "excluded",
+            includedInCreatePayload: false,
+          }],
+        });
+        Object.assign(panel, {
+          createCallbackFunction: async (payload: { id: number | undefined; data: DatabaseRow }) => {
+            received.push(payload);
+            throw new Error("panel callback rejected after insertion");
+          },
+        });
+        const res = await request(buildAppForManager(harness.manager, baseConfig(config)))
+          .post("/api/createRecord")
+          .send({
+            viewIndex: 0,
+            panelIndex: 0,
+            recordId: 7,
+            data: { text: "hello", excluded: "callback only" },
+          })
+          .expect(200);
+        expect(received).toEqual([{
+          id: insertIdIsExposed() ? 1 : undefined,
+          data: { text: "hello", excluded: "callback only", fruitId: 7 },
+        }]);
+        expect(res.body).toEqual(insertIdIsExposed() ? { id: 1 } : {});
+        const { rows } = await harness.query("SELECT * FROM fruit_notes");
+        expect(rows).toEqual([{ id: 1, text: "hello", fruitId: 7 }]);
+        expect(await fruits()).toHaveLength(0);
+      });
     });
 
     describe("POST /api/deleteRecord", () => {
+      it("preserves UUID callback IDs and the deleted row when the HTTP callback fails", async () => {
+        const id = "00000000-0000-4000-8000-000000000001";
+        expect((await harness.query("INSERT INTO uuid_fruits (id, fruitName) VALUES (?, ?)", [id, "pomme"])).err).toBeNull();
+        const received: { id: DatabaseRow[string]; deletedRecord?: DatabaseRow }[] = [];
+        const receivers: string[] = [];
+        const instance = app({
+          tableName: "uuid_fruits",
+          deleteCallback: "https://api.example.com/deleted",
+          deleteCallbackFunction: function (
+            this: { tableName: string },
+            payload: { id: DatabaseRow[string]; deletedRecord?: DatabaseRow },
+          ) {
+            receivers.push(this.tableName);
+            received.push(payload);
+          },
+        });
+        mockedAxios.post.mockRejectedValue(new Error("delete callback unavailable"));
+        await request(instance).post("/api/deleteRecord")
+          .send({ viewIndex: "0", primaryValue: id }).expect(200);
+        expect(mockedAxios.post).toHaveBeenCalledWith("https://api.example.com/deleted", { id });
+        expect(received).toEqual([{ id, deletedRecord: { id, fruitName: "pomme" } }]);
+        expect(receivers).toEqual(["uuid_fruits"]);
+        expect((await harness.query("SELECT * FROM uuid_fruits")).rows).toEqual([]);
+      });
+
       it("selects then deletes the record, passing deletedRecord to callbacks", async () => {
         await createFruit({ fruitName: "pomme", acidity: 3 });
         const callbackFn = jest.fn();
@@ -576,9 +673,63 @@ describeIntegration("crud routes against real databases", () => {
           deletedRecord: expect.objectContaining({ text: "hello" }),
         });
       });
+
+      it.each(["table", "gallery"])("preserves UUID and missing-row callback payloads for %s panels", async (type) => {
+        const id = "00000000-0000-4000-8000-000000000002";
+        expect((await harness.query("INSERT INTO uuid_fruits (id, fruitName) VALUES (?, ?)", [id, "poire"])).err).toBeNull();
+        const received: { id: DatabaseRow[string]; deletedRecord?: DatabaseRow }[] = [];
+        const receivers: string[] = [];
+        const config = panelView({
+          type,
+          tableName: "uuid_fruits",
+          deleteCallback: "https://api.example.com/panel-deleted",
+          deleteCallbackFunction: function (
+            this: { tableName: string },
+            payload: { id: DatabaseRow[string]; deletedRecord?: DatabaseRow },
+          ) {
+            receivers.push(this.tableName);
+            received.push(payload);
+          },
+        });
+        const panelId = generateUniqueIdForObject(config.views[0].recordViewPanels[0]);
+        const instance = buildAppForManager(harness.manager, baseConfig(config));
+        mockedAxios.post.mockRejectedValue(new Error("panel callback unavailable"));
+        for (let attempt = 0; attempt < 2; attempt++) {
+          await request(instance).post("/api/deleteRecordFromPanel")
+            .send({ viewIndex: "0", panelId, primaryValue: id }).expect(200);
+        }
+        expect(mockedAxios.post).toHaveBeenLastCalledWith("https://api.example.com/panel-deleted", { id });
+        expect(received).toEqual([
+          { id, deletedRecord: { id, fruitName: "poire" } },
+          { id, deletedRecord: undefined },
+        ]);
+        expect(receivers).toEqual(["uuid_fruits", "uuid_fruits"]);
+        expect((await harness.query("SELECT * FROM uuid_fruits")).rows).toEqual([]);
+      });
     });
 
     describe("POST /api/deleteRecords", () => {
+      it("preserves the engine error for an empty selection", async () => {
+        await createFruit({ fruitName: "survivor" });
+        await request(app()).post("/api/deleteRecords")
+          .send({ viewIndex: 0, primaryValues: [] }).expect(500);
+        expect((await fruits()).map((row: DatabaseRow) => row.fruitName)).toEqual(["survivor"]);
+      });
+
+      it("binds UUID values including duplicates and leaves unselected rows", async () => {
+        const ids = [
+          "d28c64a3-f0e8-4df8-a3c8-a78655d212fd",
+          "d28c64a3-f0e8-4df8-a3c8-a78655d212fe",
+          "d28c64a3-f0e8-4df8-a3c8-a78655d212ff",
+        ];
+        for (const id of ids) {
+          expect((await harness.query("INSERT INTO uuid_fruits (id, fruitName) VALUES (?, ?)", [id, "fruit"])).err).toBeFalsy();
+        }
+        await request(app({ tableName: "uuid_fruits" })).post("/api/deleteRecords")
+          .send({ viewIndex: "0", primaryValues: [ids[1], ids[0], ids[1]] }).expect(200);
+        expect((await harness.query("SELECT id FROM uuid_fruits")).rows).toEqual([{ id: ids[2] }]);
+      });
+
       it("bulk-deletes by primary values", async () => {
         const instance = app();
         for (const name of ["a", "b", "c"]) {
@@ -621,6 +772,46 @@ describeIntegration("crud routes against real databases", () => {
       });
     });
 
+    describe("POST /api/duplicateRecord boundaries", () => {
+      it("sends the original null error when insertion fails", async () => {
+        await createFruit({ fruitName: "original" });
+        const result = await request(app()).post("/api/duplicateRecord").send({
+          table: "fruits", primaryValue: 1,
+          duplicateConfig: { primaryId: "id", fields: ["missing_column"], foreignTables: [] },
+        }).expect(500);
+        expect(result.text).toBe("");
+        expect(await fruits()).toHaveLength(1);
+      });
+
+      it("preserves foreign copy traversal and the PostgreSQL INSERT IGNORE failure", async () => {
+        await createFruit({ fruitName: "original" });
+        expect((await harness.query("INSERT INTO fruit_tags (tag, fruitId) VALUES (?, ?)", ["tag", 1])).err).toBeFalsy();
+        const result = await request(app({ recordViewPanels: [{ label: "Tags", tableName: "fruit_tags" }] }))
+          .post("/api/duplicateRecord").send({
+            table: "fruits", primaryValue: 1,
+            duplicateConfig: {
+              primaryId: "id", fields: ["fruitName"],
+              foreignTables: [
+                { table: "fruit_tags", fields: ["missing_column"] },
+                { table: "fruit_tags", fields: ["tag", "fruitId"] },
+              ],
+            },
+          }).expect(harness.dbType === "POSTGRESQL" ? 500 : 200);
+        const { rows } = await harness.query("SELECT * FROM fruit_tags ORDER BY id");
+        if (harness.dbType === "POSTGRESQL") {
+          expect(result.text).toBe("");
+          expect(await fruits()).toHaveLength(1);
+          expect(rows).toEqual([{ id: 1, tag: "tag", fruitId: 1 }]);
+        } else {
+          expect(await fruits()).toHaveLength(2);
+          expect(rows).toEqual([
+            { id: 1, tag: "tag", fruitId: 1 },
+            { id: 2, tag: "tag", fruitId: 1 },
+          ]);
+        }
+      });
+    });
+
     // INSERT IGNORE ... SET ? is MySQL-specific syntax; the PG conversion
     // pipeline does not translate it, so duplicateRecord only works on the
     // MySQL backends today.
@@ -723,6 +914,47 @@ describeIntegration("crud routes against real databases", () => {
     );
 
     describe("POST /api/customAction", () => {
+      it("uses the configured message without invoking an action for no selected ids", async () => {
+        const action = jest.fn();
+        const res = await request(app({
+          customActions: [{ label: "Run", action, successMessage: "nothing selected" }],
+        })).post("/api/customAction")
+          .send({ viewIndex: "0", actionIndex: "0", selectedRecordIds: [] })
+          .expect(200);
+        expect(res.body).toEqual({ success: true, message: "nothing selected" });
+        expect(action).not.toHaveBeenCalled();
+      });
+
+      it("passes absent records and root user ids through and continues after an empty result", async () => {
+        const action = jest.fn().mockResolvedValue("");
+        const instance = app({ customActions: [{ label: "Run", action }] }, { role: "root" });
+        const res = await request(instance).post("/api/customAction")
+          .send({ viewIndex: 0, actionIndex: 0, selectedRecordIds: [98, 99] })
+          .expect(200);
+        expect(res.body).toEqual({ success: true });
+        expect(action).toHaveBeenCalledTimes(2);
+        expect(action).toHaveBeenNthCalledWith(1, undefined, undefined);
+        expect(action).toHaveBeenNthCalledWith(2, undefined, undefined);
+      });
+
+      it("catches the missing-row-result error after a failed query and stops actions", async () => {
+        const action = jest.fn();
+        const errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
+        try {
+          const res = await request(app({
+            selectExpression: "column_that_does_not_exist",
+            customActions: [{ label: "Run", action }],
+          })).post("/api/customAction")
+            .send({ viewIndex: 0, actionIndex: 0, selectedRecordIds: [1, 2] })
+            .expect(200);
+          expect(res.body).toEqual({ success: false, error: {} });
+          expect(action).not.toHaveBeenCalled();
+          expect(errorLog).toHaveBeenCalledWith(expect.any(TypeError));
+        } finally {
+          errorLog.mockRestore();
+        }
+      });
+
       it("runs the action for every selected record", async () => {
         const action = jest.fn().mockResolvedValue(null);
         const config = {

package/tests/integration/routes.custom.integration.test.ts

@@ -1,4 +1,5 @@
 import * as request from "supertest";
+import type { DatabaseRow } from "../../src/utils/dbManager";
 import { buildAppForManager } from "../helpers/app";
 import { baseConfig, fruitView } from "../helpers/fixtures";
 import {
@@ -208,6 +209,33 @@ describeIntegration("custom routes against real databases", () => {
         expect(res.body[0].text).toBe("HELLO");
       });
 
+      it("binds every placeholder and formats all rows in key order with the formatter receiver", async () => {
+        await seedNote(7, "first");
+        await seedNote(7, "second");
+        const query = "SELECT * FROM fruit_notes WHERE fruitId = ? OR fruitId = ? ORDER BY id";
+        const formatValue = {
+          text: async (row: DatabaseRow) => String(row.text).toUpperCase(),
+          summary(row: DatabaseRow) {
+            return `${row.text}:${this === formatValue ? "receiver" : "wrong"}`;
+          },
+        };
+        const instance = app({ recordViewPanels: [{ label: "Notes", query, formatValue }] });
+        const result = await request(instance).get("/api/customQuery")
+          .query({ query, primaryValue: 7, viewIndex: "0", panelIndex: "0" }).expect(200);
+        expect(result.body.map((row: { text: string; summary: string }) => [row.text, row.summary]))
+          .toEqual([["FIRST", "FIRST:receiver"], ["SECOND", "SECOND:receiver"]]);
+      });
+
+      it("returns unformatted rows when panel selection is omitted", async () => {
+        await seedNote(7, "hello");
+        const formatValue = { text: jest.fn(() => "formatted") };
+        const instance = app({ recordViewPanels: [{ label: "Notes", query: PANEL_QUERY, formatValue }] });
+        const result = await request(instance).get("/api/customQuery")
+          .query({ query: PANEL_QUERY, primaryValue: 7, viewIndex: "0" }).expect(200);
+        expect(result.body[0].text).toBe("hello");
+        expect(formatValue.text).not.toHaveBeenCalled();
+      });
+
       it("returns 500 on engine error", async () => {
         const config = baseConfig({
           views: [
@@ -224,6 +252,57 @@ describeIntegration("custom routes against real databases", () => {
     });
 
     describe("GET /api/notificationBadges", () => {
+      it("retains PostgreSQL's truthy string zero count", async () => {
+        const result = await request(app({ notificationBadge: {
+          query: "SELECT COUNT(*) AS count FROM fruits", attribute: "count",
+        } })).get("/api/notificationBadges").expect(200);
+        expect(Object.values(result.body)).toEqual(harness.dbType === "POSTGRESQL" ? ["0"] : []);
+      });
+
+      it("continues after a mutation query and overwrites missing ids in view/subview order", async () => {
+        const config = baseConfig({ enriched: true, views: [
+          fruitView({
+            notificationBadge: { query: "UPDATE fruits SET note = 'badge'", attribute: "affectedRows" },
+            subviews: [{ label: "First", filters: "", notificationBadge: { query: "SELECT 2 AS count", attribute: "count" } }],
+          }),
+          fruitView({ notificationBadge: { query: "SELECT 3 AS count", attribute: "count" } }),
+        ] });
+        const result = await request(buildAppForManager(harness.manager, config))
+          .get("/api/notificationBadges").expect(200);
+        expect(result.body).toEqual({ undefined: 3 });
+      });
+
+      it("retains repeated badge property reads and the condition receiver", async () => {
+        let attributeReads = 0;
+        let conditionReads = 0;
+        let receivedBadge: DatabaseRow[string] | undefined;
+        let receivedOwner: object | undefined;
+        const badge = {
+          query: "SELECT 1 AS firstBadge, 7 AS secondBadge",
+          get attribute() { return ++attributeReads === 1 ? "firstBadge" : "secondBadge"; },
+          get displayCondition() {
+            conditionReads++;
+            return function (this: object, value: DatabaseRow[string]) {
+              receivedBadge = value;
+              receivedOwner = this;
+              return true;
+            };
+          },
+        };
+        const config = baseConfig({ enriched: true, views: [fruitView({ notificationBadge: badge })] });
+        const instance = buildAppForManager(harness.manager, config);
+        // API construction scans configured query properties before requests.
+        attributeReads = 0;
+        conditionReads = 0;
+        const result = await request(instance)
+          .get("/api/notificationBadges").expect(200);
+        expect(result.body).toEqual({ undefined: 7 });
+        expect(attributeReads).toBe(2);
+        expect(conditionReads).toBe(2);
+        expect(receivedBadge).toBe(7);
+        expect(receivedOwner).toBe(badge);
+      });
+
       it("computes badges per view and subview", async () => {
         const view = fruitView({
           notificationBadge: {
@@ -283,6 +362,46 @@ describeIntegration("custom routes against real databases", () => {
       const opendatasoft = () =>
         jest.requireMock("axios") as { get: jest.Mock; post: jest.Mock };
 
+      it("ignores primitive entries and preserves raw optional field values and address coercion", async () => {
+        opendatasoft().get.mockResolvedValueOnce({ data: { results: [
+          0, false, "primitive", [],
+          { etatadministratifetablissement: "Actif", denominationunitelegale: null,
+            siret: 123, numerovoieetablissement: 0, typevoieetablissement: false,
+            libellevoieetablissement: null },
+        ] } });
+        const result = await request(app()).get("/api/searchCompanies").query({ query: "test" }).expect(200);
+        expect(result.body).toEqual([{ id: expect.any(String), companyName: null, siret: 123, address: "  " }]);
+      });
+
+      it("preserves active results with deeply nested unused JSON fields", async () => {
+        const depth = 10_000;
+        const data: unknown = JSON.parse(
+          '{"results":[{"etatadministratifetablissement":"Actif","denominationunitelegale":"keep","unused":' +
+          '{"nested":'.repeat(depth) + '0' + '}'.repeat(depth) + '}]}'
+        );
+        opendatasoft().get.mockResolvedValueOnce({ data });
+        const result = await request(app()).get("/api/searchCompanies").query({ query: "test" }).expect(200);
+        expect(result.body).toEqual([{ id: expect.any(String), companyName: "keep", address: "  " }]);
+      });
+
+      it.each([{ results: [null] }, { results: {} }, {}])("returns [] for malformed results %j", async (data) => {
+        opendatasoft().get.mockResolvedValueOnce({ data });
+        const result = await request(app()).get("/api/searchCompanies").query({ query: "test" }).expect(200);
+        expect(result.body).toEqual([]);
+      });
+
+      it("keeps the first thirty active establishments in original order", async () => {
+        opendatasoft().get.mockResolvedValueOnce({ data: { results: [
+          { etatadministratifetablissement: "Fermé", denominationunitelegale: "closed" },
+          ...Array.from({ length: 35 }, (_, index) => ({
+            etatadministratifetablissement: "Actif", denominationunitelegale: `company-${index}`,
+          })),
+        ] } });
+        const result = await request(app()).get("/api/searchCompanies").query({ query: "test" }).expect(200);
+        expect(result.body.map((company: { companyName: string }) => company.companyName))
+          .toEqual(Array.from({ length: 30 }, (_, index) => `company-${index}`));
+      });
+
       it("proxies the SIRENE search and maps active establishments", async () => {
         const axiosMock = opendatasoft();
         axiosMock.get.mockResolvedValueOnce({

package/tests/integration/routes.foreign.integration.test.ts

@@ -188,7 +188,7 @@ describeIntegration("foreignSelectRecords against real databases", () => {
         expect(limited.body).toHaveLength(5);
       });
 
-      it("applies column.filters and column.filtersFromUser", async () => {
+      it("FILTER USER POLICY: applies column.filters and column.filtersFromUser", async () => {
         await insertFamilies([
           { name: "rose", familyId: 21, active: 1, ownerId: 2 },
           { name: "apple", familyId: 22, active: 0, ownerId: 2 },
@@ -196,7 +196,8 @@ describeIntegration("foreignSelectRecords against real databases", () => {
         ]);
         const overrides = {
           filters: "active = 1",
-          filtersFromUser: (userId: number) => `ownerId = ${userId}`,
+          filtersFromUser: (user: { role: string; userId?: string | number }) =>
+                user.role === "root" ? "" : typeof user.userId === "number" ? `ownerId = ${user.userId}` : "1 = 0",
         };
         // EDITOR.userId === 2: only the active family owned by user 2.
         const res = await postForeign(