@libredb/studio 0.9.7

package/tests/unit/seed/credential-resolver.test.ts

@@ -0,0 +1,85 @@
+import { describe, it, expect, beforeEach, afterEach } from 'bun:test';
+import {
+  resolveConnectionCredentials,
+  resolveAllCredentials,
+  resetPlaintextWarnings,
+} from '@/lib/seed/credential-resolver';
+import type { SeedConnection } from '@/lib/seed/types';
+
+const baseConn: SeedConnection = {
+  id: 'test',
+  name: 'Test',
+  type: 'postgres',
+  host: 'localhost',
+  roles: ['*'],
+};
+
+describe('credential-resolver', () => {
+  beforeEach(() => {
+    resetPlaintextWarnings();
+  });
+
+  afterEach(() => {
+    delete process.env.MY_PASSWORD;
+    delete process.env.MY_HOST;
+    delete process.env.MY_USER;
+    delete process.env.MY_DB;
+    delete process.env.MY_CONN_STR;
+  });
+
+  it('resolves ${VAR} in password field', () => {
+    process.env.MY_PASSWORD = 'secret123';
+    const conn = { ...baseConn, password: '${MY_PASSWORD}' };
+    const resolved = resolveConnectionCredentials(conn);
+    expect(resolved.password).toBe('secret123');
+  });
+
+  it('resolves ${VAR} in connectionString field', () => {
+    process.env.MY_CONN_STR = 'mongodb://user:pass@host/db';
+    const conn = { ...baseConn, connectionString: '${MY_CONN_STR}' };
+    const resolved = resolveConnectionCredentials(conn);
+    expect(resolved.connectionString).toBe('mongodb://user:pass@host/db');
+  });
+
+  it('resolves ${VAR} in user, host, database fields', () => {
+    process.env.MY_USER = 'admin';
+    process.env.MY_HOST = 'db.internal';
+    process.env.MY_DB = 'mydb';
+    const conn = { ...baseConn, user: '${MY_USER}', host: '${MY_HOST}', database: '${MY_DB}' };
+    const resolved = resolveConnectionCredentials(conn);
+    expect(resolved.user).toBe('admin');
+    expect(resolved.host).toBe('db.internal');
+    expect(resolved.database).toBe('mydb');
+  });
+
+  it('throws when env var is not defined', () => {
+    const conn = { ...baseConn, password: '${NONEXISTENT_VAR}' };
+    expect(() => resolveConnectionCredentials(conn)).toThrow(/NONEXISTENT_VAR/);
+  });
+
+  it('leaves fields without ${} pattern unchanged', () => {
+    const conn = { ...baseConn, host: 'static-host.internal', port: 5432 };
+    const resolved = resolveConnectionCredentials(conn);
+    expect(resolved.host).toBe('static-host.internal');
+    expect(resolved.port).toBe(5432);
+  });
+
+  it('resolveAllCredentials skips connections with unresolvable vars', () => {
+    process.env.MY_PASSWORD = 'good';
+    const connections: SeedConnection[] = [
+      { ...baseConn, id: 'good', password: '${MY_PASSWORD}' },
+      { ...baseConn, id: 'bad', password: '${MISSING}' },
+      { ...baseConn, id: 'also-good', host: 'static' },
+    ];
+    const resolved = resolveAllCredentials(connections);
+    expect(resolved).toHaveLength(2);
+    expect(resolved[0].id).toBe('good');
+    expect(resolved[1].id).toBe('also-good');
+  });
+
+  it('does not throw for plaintext passwords, just warns', () => {
+    const conn = { ...baseConn, id: 'plain', password: 'hardcoded_secret' };
+    const resolved = resolveConnectionCredentials(conn);
+    expect(resolved.password).toBe('hardcoded_secret');
+  });
+});

package/tests/unit/seed/index.test.ts

@@ -0,0 +1,72 @@
+import { describe, it, expect, beforeEach, afterEach } from 'bun:test';
+import path from 'path';
+import {
+  getManagedConnections,
+  getSeedConnectionById,
+  getSeedConnectionByIdUnfiltered,
+  resetCache,
+} from '@/lib/seed';
+import { resetPlaintextWarnings } from '@/lib/seed/credential-resolver';
+
+const FIXTURES = path.resolve(__dirname, '../../fixtures/seed-connections');
+
+describe('seed/index orchestrator', () => {
+  beforeEach(() => {
+    resetCache();
+    resetPlaintextWarnings();
+    process.env.SEED_CONFIG_PATH = path.join(FIXTURES, 'multi-role-config.yaml');
+    process.env.ADMIN_PG_PASS = 'admin-secret';
+    process.env.USER_MYSQL_PASS = 'user-secret';
+    process.env.SHARED_PG_PASS = 'shared-secret';
+    process.env.BOTH_PG_PASS = 'both-secret';
+  });
+
+  afterEach(() => {
+    delete process.env.SEED_CONFIG_PATH;
+    delete process.env.ADMIN_PG_PASS;
+    delete process.env.USER_MYSQL_PASS;
+    delete process.env.SHARED_PG_PASS;
+    delete process.env.BOTH_PG_PASS;
+  });
+
+  it('getManagedConnections returns role-filtered connections', async () => {
+    const adminConns = await getManagedConnections(['admin']);
+    expect(adminConns.length).toBeGreaterThanOrEqual(3);
+
+    const userConns = await getManagedConnections(['user']);
+    const userIds = userConns.map((c) => c.seedId);
+    expect(userIds).toContain('everyone');
+    expect(userIds).toContain('user-only');
+    expect(userIds).not.toContain('admin-only');
+  });
+
+  it('getSeedConnectionById returns connection with role check', async () => {
+    const conn = await getSeedConnectionById('everyone', ['user']);
+    expect(conn).not.toBeNull();
+    expect(conn!.seedId).toBe('everyone');
+    expect(conn!.password).toBe('shared-secret');
+  });
+
+  it('getSeedConnectionById returns null when role mismatches', async () => {
+    const conn = await getSeedConnectionById('admin-only', ['user']);
+    expect(conn).toBeNull();
+  });
+
+  it('getSeedConnectionByIdUnfiltered returns connection regardless of role', async () => {
+    const conn = await getSeedConnectionByIdUnfiltered('admin-only');
+    expect(conn).not.toBeNull();
+    expect(conn!.seedId).toBe('admin-only');
+  });
+
+  it('getSeedConnectionByIdUnfiltered returns null for nonexistent ID', async () => {
+    const conn = await getSeedConnectionByIdUnfiltered('nonexistent');
+    expect(conn).toBeNull();
+  });
+
+  it('returns empty array when config file missing', async () => {
+    process.env.SEED_CONFIG_PATH = '/nonexistent.yaml';
+    resetCache();
+    const conns = await getManagedConnections(['admin']);
+    expect(conns).toHaveLength(0);
+  });
+});

package/tests/unit/seed/resolve-connection.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect, beforeEach } from 'bun:test';
+import path from 'path';
+import type { DatabaseConnection } from '@/lib/types';
+
+const FIXTURES = path.resolve(__dirname, '../../fixtures/seed-connections');
+process.env.SEED_CONFIG_PATH = path.join(FIXTURES, 'multi-role-config.yaml');
+process.env.ADMIN_PG_PASS = 'admin-secret';
+process.env.USER_MYSQL_PASS = 'user-secret';
+process.env.SHARED_PG_PASS = 'shared-secret';
+process.env.BOTH_PG_PASS = 'both-secret';
+
+import { resolveConnection, SeedConnectionError } from '@/lib/seed/resolve-connection';
+import { resetCache } from '@/lib/seed/config-loader';
+
+describe('resolve-connection', () => {
+  beforeEach(() => {
+    resetCache();
+  });
+
+  it('returns connection object as-is when no connectionId', async () => {
+    const conn: DatabaseConnection = {
+      id: 'user-conn', name: 'User DB', type: 'postgres', host: 'localhost', createdAt: new Date(),
+    };
+    const result = await resolveConnection({ connection: conn }, { role: 'user', username: 'test' });
+    expect(result.id).toBe('user-conn');
+  });
+
+  it('resolves seed connection by connectionId', async () => {
+    const result = await resolveConnection(
+      { connectionId: 'seed:everyone' },
+      { role: 'user', username: 'test' },
+    );
+    expect(result.id).toBe('seed:everyone');
+    expect(result.password).toBe('shared-secret');
+  });
+
+  it('throws 403 when role does not have access', async () => {
+    try {
+      await resolveConnection({ connectionId: 'seed:admin-only' }, { role: 'user', username: 'test' });
+      expect(true).toBe(false);
+    } catch (err) {
+      expect(err).toBeInstanceOf(SeedConnectionError);
+      expect((err as SeedConnectionError).statusCode).toBe(403);
+    }
+  });
+
+  it('throws 404 when seed connection does not exist', async () => {
+    try {
+      await resolveConnection({ connectionId: 'seed:nonexistent' }, { role: 'admin', username: 'test' });
+      expect(true).toBe(false);
+    } catch (err) {
+      expect(err).toBeInstanceOf(SeedConnectionError);
+      expect((err as SeedConnectionError).statusCode).toBe(404);
+    }
+  });
+
+  it('admin can access admin-only connections', async () => {
+    const result = await resolveConnection(
+      { connectionId: 'seed:admin-only' },
+      { role: 'admin', username: 'test' },
+    );
+    expect(result.password).toBe('admin-secret');
+  });
+
+  it('throws 400 when neither connection nor connectionId', async () => {
+    try {
+      await resolveConnection({}, { role: 'admin', username: 'test' });
+      expect(true).toBe(false);
+    } catch (err) {
+      expect(err).toBeInstanceOf(SeedConnectionError);
+      expect((err as SeedConnectionError).statusCode).toBe(400);
+    }
+  });
+});

package/tests/unit/seed/types.test.ts

@@ -0,0 +1,129 @@
+import { describe, it, expect } from 'bun:test';
+import {
+  SeedConnectionSchema,
+  SeedConfigSchema,
+  SeedDefaultsSchema,
+} from '@/lib/seed/types';
+
+describe('SeedConnectionSchema', () => {
+  const validConn = {
+    id: 'test-pg',
+    name: 'Test PG',
+    type: 'postgres',
+    host: 'localhost',
+    port: 5432,
+    roles: ['admin'],
+  };
+
+  it('accepts a valid connection', () => {
+    const result = SeedConnectionSchema.safeParse(validConn);
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects invalid id format (uppercase)', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, id: 'INVALID' });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects empty name', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, name: '' });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects empty roles array', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, roles: [] });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts wildcard role', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, roles: ['*'] });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects unknown roles like data-team', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, roles: ['data-team'] });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts combined admin and user roles', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, roles: ['admin', 'user'] });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects invalid port range', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, port: 99999 });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts valid color hex', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, color: '#10B981' });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects invalid color format', () => {
+    const result = SeedConnectionSchema.safeParse({ ...validConn, color: 'red' });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts all 7 valid database types', () => {
+    for (const type of ['postgres', 'mysql', 'sqlite', 'mongodb', 'redis', 'oracle', 'mssql']) {
+      const result = SeedConnectionSchema.safeParse({ ...validConn, type });
+      expect(result.success).toBe(true);
+    }
+  });
+});
+
+describe('SeedConfigSchema', () => {
+  it('accepts valid config with version 1', () => {
+    const result = SeedConfigSchema.safeParse({
+      version: '1',
+      connections: [{ id: 'a', name: 'A', type: 'postgres', host: 'h', roles: ['*'] }],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects version 2', () => {
+    const result = SeedConfigSchema.safeParse({
+      version: '2',
+      connections: [{ id: 'a', name: 'A', type: 'postgres', host: 'h', roles: ['*'] }],
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects duplicate connection IDs', () => {
+    const result = SeedConfigSchema.safeParse({
+      version: '1',
+      connections: [
+        { id: 'dup', name: 'A', type: 'postgres', host: 'h', roles: ['*'] },
+        { id: 'dup', name: 'B', type: 'mysql', host: 'h', roles: ['*'] },
+      ],
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects empty connections array', () => {
+    const result = SeedConfigSchema.safeParse({ version: '1', connections: [] });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe('SeedDefaultsSchema', () => {
+  it('accepts valid ssl config with mode require', () => {
+    const result = SeedDefaultsSchema.safeParse({
+      ssl: { mode: 'require', rejectUnauthorized: true },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects ssl mode prefer (not in SSLMode type)', () => {
+    const result = SeedDefaultsSchema.safeParse({
+      ssl: { mode: 'prefer' },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects invalid environment', () => {
+    const result = SeedDefaultsSchema.safeParse({ environment: 'unknown' });
+    expect(result.success).toBe(false);
+  });
+});