@libredb/studio 0.9.7

package/tests/api/seed/managed-route.test.ts

@@ -0,0 +1,113 @@
+import { describe, it, expect, beforeEach, mock } from 'bun:test';
+import path from 'path';
+
+const FIXTURES = path.resolve(__dirname, '../../fixtures/seed-connections');
+process.env.SEED_CONFIG_PATH = path.join(FIXTURES, 'multi-role-config.yaml');
+process.env.ADMIN_PG_PASS = 'admin-secret';
+process.env.USER_MYSQL_PASS = 'user-secret';
+process.env.SHARED_PG_PASS = 'shared-secret';
+process.env.BOTH_PG_PASS = 'both-secret';
+
+// Mock auth — must be before route import
+mock.module('@/lib/auth', () => ({
+  getSession: mock(() => ({ role: 'admin', username: 'admin@test.com' })),
+  verifyJWT: mock(() => ({ role: 'admin', username: 'admin@test.com' })),
+}));
+
+import { GET } from '@/app/api/connections/managed/route';
+import { resetCache } from '@/lib/seed/config-loader';
+import { getSession } from '@/lib/auth';
+
+describe('GET /api/connections/managed', () => {
+  beforeEach(() => {
+    resetCache();
+    // Reset mock to default admin session
+    (getSession as ReturnType<typeof mock>).mockImplementation(() =>
+      ({ role: 'admin', username: 'admin@test.com' })
+    );
+  });
+
+  it('returns managed connections for admin role', async () => {
+    const res = await GET();
+    expect(res.status).toBe(200);
+    const data = await res.json();
+    expect(data.connections.length).toBeGreaterThan(0);
+    expect(data.cacheHint).toBe(60000);
+  });
+
+  it('filters connections by role', async () => {
+    const res = await GET();
+    const data = await res.json();
+    const ids = data.connections.map((c: { seedId: string }) => c.seedId);
+    expect(ids).toContain('admin-only');
+    expect(ids).toContain('everyone');
+    expect(ids).toContain('admin-and-user');
+  });
+
+  it('strips password from managed:true connections', async () => {
+    const res = await GET();
+    const data = await res.json();
+    const managed = data.connections.find((c: { managed: boolean }) => c.managed);
+    if (managed) {
+      expect(managed.password).toBeUndefined();
+    }
+  });
+
+  it('returns 401 when no session', async () => {
+    (getSession as ReturnType<typeof mock>).mockImplementation(() => null);
+    const res = await GET();
+    expect(res.status).toBe(401);
+  });
+
+  it('returns empty array when config file missing', async () => {
+    const origPath = process.env.SEED_CONFIG_PATH;
+    process.env.SEED_CONFIG_PATH = '/nonexistent/path.yaml';
+    resetCache();
+    const res = await GET();
+    const data = await res.json();
+    expect(data.connections).toHaveLength(0);
+    process.env.SEED_CONFIG_PATH = origPath;
+    resetCache();
+  });
+
+  it('includes credentials for managed:false connections', async () => {
+    const origPath = process.env.SEED_CONFIG_PATH;
+    process.env.SEED_CONFIG_PATH = path.join(
+      path.resolve(__dirname, '../../fixtures/seed-connections'),
+      'valid-config.yaml',
+    );
+    process.env.TEST_PG_PASSWORD = 'pg-pass';
+    process.env.TEST_MYSQL_PASSWORD = 'mysql-pass';
+    process.env.TEST_MONGO_URI = 'mongodb://host/db';
+    process.env.TEST_REDIS_PASSWORD = 'redis-pass';
+    resetCache();
+
+    const res = await GET();
+    const data = await res.json();
+    const unmanaged = data.connections.find((c: { managed: boolean }) => !c.managed);
+    expect(unmanaged).toBeDefined();
+    expect(unmanaged.password).toBe('mysql-pass');
+
+    process.env.SEED_CONFIG_PATH = origPath;
+    delete process.env.TEST_PG_PASSWORD;
+    delete process.env.TEST_MYSQL_PASSWORD;
+    delete process.env.TEST_MONGO_URI;
+    delete process.env.TEST_REDIS_PASSWORD;
+    resetCache();
+  });
+
+  it('returns 500 when config is invalid', async () => {
+    const origPath = process.env.SEED_CONFIG_PATH;
+    process.env.SEED_CONFIG_PATH = path.join(
+      path.resolve(__dirname, '../../fixtures/seed-connections'),
+      'invalid-config.yaml',
+    );
+    resetCache();
+
+    const res = await GET();
+    expect(res.status).toBe(500);
+
+    process.env.SEED_CONFIG_PATH = origPath;
+    resetCache();
+  });
+});

package/tests/api/storage/config.test.ts

@@ -0,0 +1,42 @@
+import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import { GET } from '@/app/api/storage/config/route';
+
+describe('GET /api/storage/config', () => {
+  const originalEnv = process.env.STORAGE_PROVIDER;
+
+  beforeEach(() => {
+    delete process.env.STORAGE_PROVIDER;
+  });
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.STORAGE_PROVIDER;
+    } else {
+      process.env.STORAGE_PROVIDER = originalEnv;
+    }
+  });
+
+  test('returns local config by default', async () => {
+    const res = await GET();
+    expect(res.status).toBe(200);
+    const json = await res.json();
+    expect(json.provider).toBe('local');
+    expect(json.serverMode).toBe(false);
+  });
+
+  test('returns sqlite config when STORAGE_PROVIDER=sqlite', async () => {
+    process.env.STORAGE_PROVIDER = 'sqlite';
+    const res = await GET();
+    const json = await res.json();
+    expect(json.provider).toBe('sqlite');
+    expect(json.serverMode).toBe(true);
+  });
+
+  test('returns postgres config when STORAGE_PROVIDER=postgres', async () => {
+    process.env.STORAGE_PROVIDER = 'postgres';
+    const res = await GET();
+    const json = await res.json();
+    expect(json.provider).toBe('postgres');
+    expect(json.serverMode).toBe(true);
+  });
+});

package/tests/api/storage/storage-routes.test.ts

@@ -0,0 +1,309 @@
+import { describe, test, expect, mock, beforeEach } from 'bun:test';
+import { NextRequest } from 'next/server';
+
+// ── Mock auth ────────────────────────────────────────────────────────────────
+
+let mockSession: { username: string; role: string } | null = { username: 'admin@test.com', role: 'admin' };
+
+mock.module('@/lib/auth', () => ({
+  getSession: async () => mockSession,
+}));
+
+// ── Mock storage factory ─────────────────────────────────────────────────────
+
+const mockProvider = {
+  getAllData: mock(async () => ({
+    connections: [{ id: 'c1' }],
+  })),
+  getCollection: mock(async () => [{ id: 'c1' }]),
+  setCollection: mock(async () => {}),
+  mergeData: mock(async () => {}),
+};
+
+let providerEnabled = true;
+
+mock.module('@/lib/storage/factory', () => ({
+  getStorageProvider: async () => (providerEnabled ? mockProvider : null),
+}));
+
+mock.module('@/lib/storage/types', () => ({
+  STORAGE_COLLECTIONS: [
+    'connections', 'history', 'saved_queries', 'schema_snapshots',
+    'saved_charts', 'active_connection_id', 'audit_log',
+    'masking_config', 'threshold_config',
+  ],
+}));
+
+// ── Import routes ────────────────────────────────────────────────────────────
+
+import { GET } from '@/app/api/storage/route';
+import { PUT } from '@/app/api/storage/[collection]/route';
+import { POST } from '@/app/api/storage/migrate/route';
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe('GET /api/storage', () => {
+  beforeEach(() => {
+    mockSession = { username: 'admin@test.com', role: 'admin' };
+    providerEnabled = true;
+    mockProvider.getAllData.mockClear();
+  });
+
+  test('returns 404 when storage not enabled', async () => {
+    providerEnabled = false;
+    const res = await GET();
+    expect(res.status).toBe(404);
+  });
+
+  test('returns 401 when not authenticated', async () => {
+    mockSession = null;
+    const res = await GET();
+    expect(res.status).toBe(401);
+  });
+
+  test('returns user data on success', async () => {
+    const res = await GET();
+    expect(res.status).toBe(200);
+    const json = await res.json();
+    expect(json.connections).toEqual([{ id: 'c1' }]);
+    expect(mockProvider.getAllData).toHaveBeenCalledWith('admin@test.com');
+  });
+});
+
+describe('PUT /api/storage/[collection]', () => {
+  beforeEach(() => {
+    mockSession = { username: 'admin@test.com', role: 'admin' };
+    providerEnabled = true;
+    mockProvider.setCollection.mockClear();
+  });
+
+  function makeRequest(collection: string, data: unknown) {
+    return PUT(
+      new NextRequest(`http://localhost/api/storage/${collection}`, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ data }),
+      }),
+      { params: Promise.resolve({ collection }) }
+    );
+  }
+
+  test('returns 404 when storage not enabled', async () => {
+    providerEnabled = false;
+    const res = await makeRequest('connections', []);
+    expect(res.status).toBe(404);
+  });
+
+  test('returns 401 when not authenticated', async () => {
+    mockSession = null;
+    const res = await makeRequest('connections', []);
+    expect(res.status).toBe(401);
+  });
+
+  test('returns 400 for invalid collection', async () => {
+    const res = await makeRequest('invalid_collection', []);
+    expect(res.status).toBe(400);
+  });
+
+  test('updates collection on success', async () => {
+    const data = [{ id: 'c1', name: 'New DB' }];
+    const res = await makeRequest('connections', data);
+    expect(res.status).toBe(200);
+    expect(mockProvider.setCollection).toHaveBeenCalledWith(
+      'admin@test.com',
+      'connections',
+      data
+    );
+  });
+});
+
+describe('POST /api/storage/migrate', () => {
+  beforeEach(() => {
+    mockSession = { username: 'admin@test.com', role: 'admin' };
+    providerEnabled = true;
+    mockProvider.mergeData.mockClear();
+  });
+
+  function makeMigrateRequest(data: Record<string, unknown>) {
+    return POST(
+      new NextRequest('http://localhost/api/storage/migrate', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(data),
+      })
+    );
+  }
+
+  test('returns 404 when storage not enabled', async () => {
+    providerEnabled = false;
+    const res = await makeMigrateRequest({});
+    expect(res.status).toBe(404);
+  });
+
+  test('returns 401 when not authenticated', async () => {
+    mockSession = null;
+    const res = await makeMigrateRequest({});
+    expect(res.status).toBe(401);
+  });
+
+  test('merges data on success', async () => {
+    const data = { connections: [{ id: 'c1' }], history: [] };
+    const res = await makeMigrateRequest(data);
+    expect(res.status).toBe(200);
+    const json = await res.json();
+    expect(json.ok).toBe(true);
+    expect(json.migrated).toContain('connections');
+    expect(json.migrated).toContain('history');
+    expect(mockProvider.mergeData).toHaveBeenCalledWith('admin@test.com', data);
+  });
+
+  test('returns empty migrated array for empty payload', async () => {
+    const res = await makeMigrateRequest({});
+    expect(res.status).toBe(200);
+    const json = await res.json();
+    expect(json.ok).toBe(true);
+    expect(json.migrated).toEqual([]);
+  });
+});
+
+// ── Malformed JSON body tests ──────────────────────────────────────────────
+
+describe('PUT /api/storage/[collection]: malformed JSON', () => {
+  beforeEach(() => {
+    mockSession = { username: 'admin@test.com', role: 'admin' };
+    providerEnabled = true;
+  });
+
+  test('returns 400 for malformed JSON body in PUT', async () => {
+    const request = new NextRequest('http://localhost/api/storage/connections', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{invalid json}',
+    });
+    const res = await PUT(request, { params: Promise.resolve({ collection: 'connections' }) });
+    expect(res.status).toBe(400);
+    const json = await res.json();
+    expect(json.error).toContain('Invalid JSON');
+  });
+});
+
+describe('POST /api/storage/migrate: malformed JSON', () => {
+  beforeEach(() => {
+    mockSession = { username: 'admin@test.com', role: 'admin' };
+    providerEnabled = true;
+  });
+
+  test('returns 400 for malformed JSON body in POST', async () => {
+    const request = new NextRequest('http://localhost/api/storage/migrate', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{invalid json}',
+    });
+    const res = await POST(request);
+    expect(res.status).toBe(400);
+    const json = await res.json();
+    expect(json.error).toContain('Invalid JSON');
+  });
+});
+
+// ── Error propagation from provider ────────────────────────────────────────
+
+describe('API routes: provider error propagation', () => {
+  beforeEach(() => {
+    mockSession = { username: 'admin@test.com', role: 'admin' };
+    providerEnabled = true;
+    mockProvider.getAllData.mockClear();
+    mockProvider.setCollection.mockClear();
+    mockProvider.mergeData.mockClear();
+  });
+
+  test('GET /api/storage returns 500 on provider error', async () => {
+    mockProvider.getAllData.mockRejectedValueOnce(new Error('DB connection lost'));
+    const res = await GET();
+    expect(res.status).toBe(500);
+    const json = await res.json();
+    expect(json.error).toBe('DB connection lost');
+  });
+
+  test('PUT collection response includes ok:true on success', async () => {
+    const res = await PUT(
+      new NextRequest('http://localhost/api/storage/connections', {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ data: [{ id: 'c1' }] }),
+      }),
+      { params: Promise.resolve({ collection: 'connections' }) }
+    );
+    expect(res.status).toBe(200);
+    const json = await res.json();
+    expect(json.ok).toBe(true);
+  });
+
+  test('PUT uses session username for user scoping', async () => {
+    mockSession = { username: 'user@test.com', role: 'user' };
+    const data = [{ id: 'c1' }];
+    await PUT(
+      new NextRequest('http://localhost/api/storage/connections', {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ data }),
+      }),
+      { params: Promise.resolve({ collection: 'connections' }) }
+    );
+    expect(mockProvider.setCollection).toHaveBeenCalledWith('user@test.com', 'connections', data);
+  });
+
+  test('GET uses session username for user scoping', async () => {
+    mockSession = { username: 'user@test.com', role: 'user' };
+    await GET();
+    expect(mockProvider.getAllData).toHaveBeenCalledWith('user@test.com');
+  });
+
+  test('PUT validates all 9 valid collection names', async () => {
+    const validCollections = [
+      'connections', 'history', 'saved_queries', 'schema_snapshots',
+      'saved_charts', 'active_connection_id', 'audit_log',
+      'masking_config', 'threshold_config',
+    ];
+
+    for (const collection of validCollections) {
+      mockProvider.setCollection.mockClear();
+      const res = await PUT(
+        new NextRequest(`http://localhost/api/storage/${collection}`, {
+          method: 'PUT',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ data: [] }),
+        }),
+        { params: Promise.resolve({ collection }) }
+      );
+      expect(res.status).toBe(200);
+    }
+  });
+
+  test('PUT rejects collection names not in whitelist', async () => {
+    const invalidNames = ['settings', 'users', 'passwords', '../connections', 'CONNECTIONS'];
+    for (const name of invalidNames) {
+      const res = await PUT(
+        new NextRequest(`http://localhost/api/storage/${name}`, {
+          method: 'PUT',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ data: [] }),
+        }),
+        { params: Promise.resolve({ collection: name }) }
+      );
+      expect(res.status).toBe(400);
+    }
+  });
+
+  test('migrate uses session username for user scoping', async () => {
+    mockSession = { username: 'user@test.com', role: 'user' };
+    await POST(
+      new NextRequest('http://localhost/api/storage/migrate', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ connections: [] }),
+      })
+    );
+    expect(mockProvider.mergeData).toHaveBeenCalledWith('user@test.com', { connections: [] });
+  });
+});