@haverstack/server 0.8.0

package/tests/routes/entity.test.ts

@@ -0,0 +1,170 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+  buildTestApp,
+  req,
+  TEST_TOKEN,
+  TEST_ENTITY_ID,
+  OTHER_ENTITY_ID,
+  type TestApp,
+} from '../setup.js';
+import type { StackRecord } from '@haverstack/core';
+
+async function seedEntityRecord(ctx: TestApp['ctx']): Promise<StackRecord> {
+  return ctx.adapter.createRecord({
+    id: TEST_ENTITY_ID,
+    typeId: '_entity@1',
+    content: { did: TEST_ENTITY_ID, name: 'Test Entity' },
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    version: 1,
+    entityId: TEST_ENTITY_ID,
+  });
+}
+
+// _entity@1 records get an auto-generated id — even the owner's own card
+// (see Stack.create()'s ownerProfile bootstrap) — with the binding held in
+// content.did rather than the record id. This is the realistic shape.
+async function seedEntityRecordWithGeneratedId(ctx: TestApp['ctx']): Promise<StackRecord> {
+  return ctx.stack.create('_entity@1', { did: TEST_ENTITY_ID, name: 'Test Entity' });
+}
+
+describe('GET /entity', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('returns the owner entity record when authenticated as owner', async () => {
+    await seedEntityRecord(t.ctx);
+    const { status, data } = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
+    expect(status).toBe(200);
+    expect((data as Record<string, unknown>).id).toBe(TEST_ENTITY_ID);
+    expect(((data as Record<string, unknown>).content as Record<string, unknown>).name).toBe(
+      'Test Entity',
+    );
+  });
+
+  it('returns 404 when the entity record does not exist', async () => {
+    const { status } = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
+    expect(status).toBe(404);
+  });
+
+  it('finds the owner record by content.did even when its id differs from ownerEntityId', async () => {
+    await seedEntityRecordWithGeneratedId(t.ctx);
+    const { status, data } = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
+    expect(status).toBe(200);
+    const content = (data as Record<string, unknown>).content as Record<string, unknown>;
+    expect(content.did).toBe(TEST_ENTITY_ID);
+    expect(content.name).toBe('Test Entity');
+  });
+
+  it('returns 404, not 403, for a non-owner authenticated entity (anti-oracle rule)', async () => {
+    await seedEntityRecord(t.ctx);
+    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'GET', '/entity', { token });
+    expect(status).toBe(404);
+  });
+
+  it('returns 401 for an unauthenticated request', async () => {
+    const { status } = await req(t.app, 'GET', '/entity');
+    expect(status).toBe(401);
+  });
+
+  it('resolves the current owner record on each request, including after delete and recreate', async () => {
+    const first = await seedEntityRecordWithGeneratedId(t.ctx);
+
+    const populate = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
+    expect(populate.status).toBe(200);
+
+    await t.ctx.adapter.deleteRecord(first.id, { hard: true });
+    const afterDelete = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
+    expect(afterDelete.status).toBe(404);
+
+    const second = await seedEntityRecordWithGeneratedId(t.ctx);
+    expect(second.id).not.toBe(first.id);
+    const afterRecreate = await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
+    expect(afterRecreate.status).toBe(200);
+    expect((afterRecreate.data as Record<string, unknown>).id).toBe(second.id);
+  });
+});
+
+describe('PATCH /entity', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('merges content and returns the updated record', async () => {
+    await seedEntityRecord(t.ctx);
+    const { status, data } = await req(t.app, 'PATCH', '/entity', {
+      token: TEST_TOKEN,
+      body: { content: { name: 'Updated Entity', handle: 'updated' } },
+    });
+    expect(status).toBe(200);
+    const content = (data as Record<string, unknown>).content as Record<string, unknown>;
+    expect(content.name).toBe('Updated Entity');
+    expect(content.handle).toBe('updated');
+  });
+
+  it('returns 404 when the entity record does not exist', async () => {
+    const { status } = await req(t.app, 'PATCH', '/entity', {
+      token: TEST_TOKEN,
+      body: { content: { name: 'X' } },
+    });
+    expect(status).toBe(404);
+  });
+
+  it('updates the owner record found by content.did even when its id differs from ownerEntityId', async () => {
+    await seedEntityRecordWithGeneratedId(t.ctx);
+    const { status, data } = await req(t.app, 'PATCH', '/entity', {
+      token: TEST_TOKEN,
+      body: { content: { name: 'Renamed' } },
+    });
+    expect(status).toBe(200);
+    const content = (data as Record<string, unknown>).content as Record<string, unknown>;
+    expect(content.name).toBe('Renamed');
+    expect(content.did).toBe(TEST_ENTITY_ID);
+  });
+
+  it('returns 403 for a non-owner authenticated entity', async () => {
+    await seedEntityRecord(t.ctx);
+    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'PATCH', '/entity', {
+      token,
+      body: { content: { name: 'Hacked' } },
+    });
+    expect(status).toBe(403);
+  });
+
+  it('returns 401 for an unauthenticated request', async () => {
+    const { status } = await req(t.app, 'PATCH', '/entity', {
+      body: { content: { name: 'X' } },
+    });
+    expect(status).toBe(401);
+  });
+
+  it('resolves the current owner record on each PATCH request after a since-deleted record', async () => {
+    const record = await seedEntityRecordWithGeneratedId(t.ctx);
+    await req(t.app, 'GET', '/entity', { token: TEST_TOKEN });
+
+    await t.ctx.adapter.deleteRecord(record.id, { hard: true });
+    const stale = await req(t.app, 'PATCH', '/entity', {
+      token: TEST_TOKEN,
+      body: { content: { name: 'X' } },
+    });
+    expect(stale.status).toBe(404);
+
+    await seedEntityRecordWithGeneratedId(t.ctx);
+    const recovered = await req(t.app, 'PATCH', '/entity', {
+      token: TEST_TOKEN,
+      body: { content: { name: 'Recovered' } },
+    });
+    expect(recovered.status).toBe(200);
+  });
+});

package/tests/routes/groups.test.ts

@@ -0,0 +1,69 @@
+/**
+ * _group-scoped permissions: a permission's groupId resolves only against
+ * a real _group Record's roster. Core's rule, pinned at this server's HTTP
+ * surface rather than assumed to arrive intact.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { SYSTEM_TYPES } from '@haverstack/core';
+import { buildTestApp, req, OTHER_ENTITY_ID, type TestApp } from '../setup.js';
+
+const NOTE_TYPE = 'com.example.test/note@1';
+const GROUP_TYPE = `${SYSTEM_TYPES.GROUP}@1`;
+
+describe('_group ACL', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+    await t.ctx.stack.defineType(NOTE_TYPE, 'Note', { title: { kind: 'string' } });
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('an entity added to a real _group roster gains group-scoped read access', async () => {
+    const group = await t.ctx.stack.create(GROUP_TYPE, { name: 'Test Group' });
+    await t.ctx.stack.associate(group.id, {
+      kind: 'relationship',
+      label: 'member',
+      target: { scope: 'entity', entityId: OTHER_ENTITY_ID },
+    });
+    const record = await t.ctx.stack.create(
+      NOTE_TYPE,
+      { title: 'group-visible' },
+      { permissions: [{ access: 'group', groupId: group.id, read: true, write: false }] },
+    );
+    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'GET', `/records/${record.id}`, { token });
+    expect(status).toBe(200);
+  });
+
+  it('a non-_group record with matching relationship associations is never treated as a roster', async () => {
+    // Same association shape a real group roster uses (kind: relationship,
+    // label: member, target: entity) — but on an ordinary Note, not a
+    // _group Record. Before the 0.20 fix, any record's relationship
+    // associations could serve as an ACL; this pins that it can't.
+    const notAGroup = await t.ctx.stack.create(
+      NOTE_TYPE,
+      { title: 'not a real group' },
+      {
+        associations: [
+          {
+            kind: 'relationship',
+            label: 'member',
+            target: { scope: 'entity', entityId: OTHER_ENTITY_ID },
+          },
+        ],
+      },
+    );
+    const record = await t.ctx.stack.create(
+      NOTE_TYPE,
+      { title: 'should stay private' },
+      { permissions: [{ access: 'group', groupId: notAGroup.id, read: true, write: false }] },
+    );
+    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'GET', `/records/${record.id}`, { token });
+    // Anti-oracle: unreadable is 404, same as any other record this entity
+    // can't reach — never a 403 that would confirm the record exists.
+    expect(status).toBe(404);
+  });
+});