@haverstack/server 0.8.0 → 0.9.1

package/tests/routes/entity.test.ts

@@ -1,170 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import {
-  buildTestApp,
-  req,
-  TEST_TOKEN,
-  TEST_ENTITY_ID,
-  OTHER_ENTITY_ID,
-  type TestApp,
-} from '../setup.js';
-import type { StackRecord } from '@haverstack/core';
-
-async function seedEntityRecord(ctx: TestApp['ctx']): Promise<StackRecord> {
-  return ctx.adapter.createRecord({
-    id: TEST_ENTITY_ID,
-    typeId: '_entity@1',
-    content: { did: TEST_ENTITY_ID, name: 'Test Entity' },
-    createdAt: new Date(),
-    updatedAt: new Date(),
-    version: 1,
-    entityId: TEST_ENTITY_ID,
-  });
-}
-
-// _entity@1 records get an auto-generated id — even the owner's own card
-// (see Stack.create()'s ownerProfile bootstrap) — with the binding held in
-// content.did rather than the record id. This is the realistic shape.
-async function seedEntityRecordWithGeneratedId(ctx: TestApp['ctx']): Promise<StackRecord> {
-  return ctx.stack.create('_entity@1', { did: TEST_ENTITY_ID, name: 'Test Entity' });
-}
-
-describe('GET /entity', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  it('returns the owner entity record when authenticated as owner', async () => {
-    await seedEntityRecord(t.ctx);
-    const { status, data } = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
-    expect(status).toBe(200);
-    expect((data as Record<string, unknown>).id).toBe(TEST_ENTITY_ID);
-    expect(((data as Record<string, unknown>).content as Record<string, unknown>).name).toBe(
-      'Test Entity',
-    );
-  });
-
-  it('returns 404 when the entity record does not exist', async () => {
-    const { status } = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
-    expect(status).toBe(404);
-  });
-
-  it('finds the owner record by content.did even when its id differs from ownerEntityId', async () => {
-    await seedEntityRecordWithGeneratedId(t.ctx);
-    const { status, data } = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
-    expect(status).toBe(200);
-    const content = (data as Record<string, unknown>).content as Record<string, unknown>;
-    expect(content.did).toBe(TEST_ENTITY_ID);
-    expect(content.name).toBe('Test Entity');
-  });
-
-  it('returns 404, not 403, for a non-owner authenticated entity (anti-oracle rule)', async () => {
-    await seedEntityRecord(t.ctx);
-    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
-    const { status } = await req(t.app, 'GET', '/entity', { token });
-    expect(status).toBe(404);
-  });
-
-  it('returns 401 for an unauthenticated request', async () => {
-    const { status } = await req(t.app, 'GET', '/entity');
-    expect(status).toBe(401);
-  });
-
-  it('resolves the current owner record on each request, including after delete and recreate', async () => {
-    const first = await seedEntityRecordWithGeneratedId(t.ctx);
-
-    const populate = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
-    expect(populate.status).toBe(200);
-
-    await t.ctx.adapter.deleteRecord(first.id, { hard: true });
-    const afterDelete = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
-    expect(afterDelete.status).toBe(404);
-
-    const second = await seedEntityRecordWithGeneratedId(t.ctx);
-    expect(second.id).not.toBe(first.id);
-    const afterRecreate = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
-    expect(afterRecreate.status).toBe(200);
-    expect((afterRecreate.data as Record<string, unknown>).id).toBe(second.id);
-  });
-});
-
-describe('PATCH /entity', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  it('merges content and returns the updated record', async () => {
-    await seedEntityRecord(t.ctx);
-    const { status, data } = await req(t.app, 'PATCH', '/entity', {
-      token: TEST_TOKEN,
-      body: { content: { name: 'Updated Entity', handle: 'updated' } },
-    });
-    expect(status).toBe(200);
-    const content = (data as Record<string, unknown>).content as Record<string, unknown>;
-    expect(content.name).toBe('Updated Entity');
-    expect(content.handle).toBe('updated');
-  });
-
-  it('returns 404 when the entity record does not exist', async () => {
-    const { status } = await req(t.app, 'PATCH', '/entity', {
-      token: TEST_TOKEN,
-      body: { content: { name: 'X' } },
-    });
-    expect(status).toBe(404);
-  });
-
-  it('updates the owner record found by content.did even when its id differs from ownerEntityId', async () => {
-    await seedEntityRecordWithGeneratedId(t.ctx);
-    const { status, data } = await req(t.app, 'PATCH', '/entity', {
-      token: TEST_TOKEN,
-      body: { content: { name: 'Renamed' } },
-    });
-    expect(status).toBe(200);
-    const content = (data as Record<string, unknown>).content as Record<string, unknown>;
-    expect(content.name).toBe('Renamed');
-    expect(content.did).toBe(TEST_ENTITY_ID);
-  });
-
-  it('returns 403 for a non-owner authenticated entity', async () => {
-    await seedEntityRecord(t.ctx);
-    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
-    const { status } = await req(t.app, 'PATCH', '/entity', {
-      token,
-      body: { content: { name: 'Hacked' } },
-    });
-    expect(status).toBe(403);
-  });
-
-  it('returns 401 for an unauthenticated request', async () => {
-    const { status } = await req(t.app, 'PATCH', '/entity', {
-      body: { content: { name: 'X' } },
-    });
-    expect(status).toBe(401);
-  });
-
-  it('resolves the current owner record on each PATCH request after a since-deleted record', async () => {
-    const record = await seedEntityRecordWithGeneratedId(t.ctx);
-    await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
-
-    await t.ctx.adapter.deleteRecord(record.id, { hard: true });
-    const stale = await req(t.app, 'PATCH', '/entity', {
-      token: TEST_TOKEN,
-      body: { content: { name: 'X' } },
-    });
-    expect(stale.status).toBe(404);
-
-    await seedEntityRecordWithGeneratedId(t.ctx);
-    const recovered = await req(t.app, 'PATCH', '/entity', {
-      token: TEST_TOKEN,
-      body: { content: { name: 'Recovered' } },
-    });
-    expect(recovered.status).toBe(200);
-  });
-});

package/tests/routes/groups.test.ts

@@ -1,69 +0,0 @@
-/**
- * _group-scoped permissions: a permission's groupId resolves only against
- * a real _group Record's roster. Core's rule, pinned at this server's HTTP
- * surface rather than assumed to arrive intact.
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { SYSTEM_TYPES } from '@haverstack/core';
-import { buildTestApp, req, OTHER_ENTITY_ID, type TestApp } from '../setup.js';
-
-const NOTE_TYPE = 'com.example.test/note@1';
-const GROUP_TYPE = `${SYSTEM_TYPES.GROUP}@1`;
-
-describe('_group ACL', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-    await t.ctx.stack.defineType(NOTE_TYPE, 'Note', { title: { kind: 'string' } });
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  it('an entity added to a real _group roster gains group-scoped read access', async () => {
-    const group = await t.ctx.stack.create(GROUP_TYPE, { name: 'Test Group' });
-    await t.ctx.stack.associate(group.id, {
-      kind: 'relationship',
-      label: 'member',
-      target: { scope: 'entity', entityId: OTHER_ENTITY_ID },
-    });
-    const record = await t.ctx.stack.create(
-      NOTE_TYPE,
-      { title: 'group-visible' },
-      { permissions: [{ access: 'group', groupId: group.id, read: true, write: false }] },
-    );
-    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
-    const { status } = await req(t.app, 'GET', `/records/${record.id}`, { token });
-    expect(status).toBe(200);
-  });
-
-  it('a non-_group record with matching relationship associations is never treated as a roster', async () => {
-    // Same association shape a real group roster uses (kind: relationship,
-    // label: member, target: entity) — but on an ordinary Note, not a
-    // _group Record. Before the 0.20 fix, any record's relationship
-    // associations could serve as an ACL; this pins that it can't.
-    const notAGroup = await t.ctx.stack.create(
-      NOTE_TYPE,
-      { title: 'not a real group' },
-      {
-        associations: [
-          {
-            kind: 'relationship',
-            label: 'member',
-            target: { scope: 'entity', entityId: OTHER_ENTITY_ID },
-          },
-        ],
-      },
-    );
-    const record = await t.ctx.stack.create(
-      NOTE_TYPE,
-      { title: 'should stay private' },
-      { permissions: [{ access: 'group', groupId: notAGroup.id, read: true, write: false }] },
-    );
-    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
-    const { status } = await req(t.app, 'GET', `/records/${record.id}`, { token });
-    // Anti-oracle: unreadable is 404, same as any other record this entity
-    // can't reach — never a 403 that would confirm the record exists.
-    expect(status).toBe(404);
-  });
-});