@liminalfunctions/framework 1.0.51 → 1.0.53

package/test/1_1_security_ownership.test.ts

@@ -30,7 +30,12 @@ describe('Security Model Ownership', function () {
         _id: z_mongodb_id,
         user_id: z_mongodb_id,
         name: z.string(),
-        email: z.string()
+        email: z.string(),
+        nicknames: z.array(z.object({
+            _id: z_mongodb_id,
+            server_key: z.string(),
+            name: z.string()
+        }))
     })
 
     // set up schema: user
@@ -99,7 +104,8 @@ describe('Security Model Ownership', function () {
         let user_display = await collection_user_display.mongoose_model.create({
             user_id: user._id,
             name: 'steve',
-            email: 'steve@example.com'
+            email: 'steve@example.com',
+            nicknames: [],
         })
 
         return { user, user_display}
@@ -157,7 +163,8 @@ describe('Security Model Ownership', function () {
             user_displays.push(await collection_user_display.mongoose_model.create({
                 user_id: user._id,
                 name: 'steve',
-                email: 'steve@example.com'
+                email: 'steve@example.com',
+                nicknames: [],
             }))
         }
 
@@ -185,7 +192,8 @@ describe('Security Model Ownership', function () {
             user_displays.push(await collection_user_display.mongoose_model.create({
                 user_id: user._id,
                 name: 'steve',
-                email: 'steve@example.com'
+                email: 'steve@example.com',
+                nicknames: [],
             }))
         }
         
@@ -261,7 +269,8 @@ describe('Security Model Ownership', function () {
             json: {
                 user_id: user._id,
                 name: 'grogfurd',
-                email: 'grogfurd@example.com'
+                email: 'grogfurd@example.com',
+                nicknames: [],
             }
         }).json();
 
@@ -284,7 +293,8 @@ describe('Security Model Ownership', function () {
                 json: {
                     user_id: user._id,
                     name: 'grogfurd',
-                    email: 'grogfurd@example.com'
+                    email: 'grogfurd@example.com',
+                    nicknames: []
                 }
             }).json();
         }, {
@@ -330,4 +340,174 @@ describe('Security Model Ownership', function () {
             message: 'Response code 403 (Forbidden)'
         })
     });
+
+      ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+     /////////////////////////////////////////////////////////////    ARRAY OPERATIONS     //////////////////////////////////////////////////////////////////////////
+    ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+
+    it(`should authorize a POST operation on a child array`, async function () {
+        let { user, user_display } = await generate_user_and_display();
+
+        let results = await got.post(`http://localhost:${port}/api/user_display/${user_display._id}/nicknames`, {
+            headers: {
+                authorization: 'steve'
+            },
+            json: {
+                server_key: 'best_server',
+                name: 'steve the mighty'
+            }
+        }).json();
+
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_user_display.mongoose_model.findById(user_display._id))), results.data);
+        assert.deepEqual(JSON.parse(JSON.stringify((await collection_user_display.mongoose_model.findById(user_display._id)))).nicknames.length, 1);
+    });
+
+    it(`should reject a POST operation on a child array authenticated to the wrong user`, async function () {
+        let { user, user_display } = await generate_user_and_display();
+
+        let user_2 = await collection_user.mongoose_model.create({
+            auth_id: 'sharon'
+        });
+
+        await assert.rejects(async () => {
+            let results = await got.post(`http://localhost:${port}/api/user_display/${user_display._id}/nicknames`, {
+                headers: {
+                    authorization: 'sharon'
+                },
+                json: {
+                    server_key: 'best_server',
+                    name: 'steve the mighty'
+                }
+            }).json();
+        }, {
+            message: 'Response code 403 (Forbidden)'
+        })
+    });
+
+    it(`should authorize a PUT operation on a child array`, async function () {
+        let { user, user_display } = await generate_user_and_display();
+        await collection_user_display.mongoose_model.findByIdAndUpdate(user_display._id, {
+            $push: {
+                nicknames: {
+                    server_key: 'best_server',
+                    name: 'steve the mighty'
+                }
+            }
+        });
+        //@ts-ignore
+        user_display = await collection_user_display.mongoose_model.findById(user_display._id);
+
+        let nickname_id = user_display.nicknames[0]._id + '';
+
+        let results = await got.put(`http://localhost:${port}/api/user_display/${user_display._id}/nicknames/${nickname_id}`, {
+            headers: {
+                authorization: 'steve'
+            },
+            json: {
+                _id: nickname_id,
+                server_key: 'best_server',
+                name: 'ubersteve'
+            }
+        }).json();
+        
+        //@ts-ignore
+        assert.deepEqual('ubersteve', results.data.nicknames[0].name);
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_user_display.mongoose_model.findById(user_display._id))), JSON.parse(JSON.stringify(results.data)));
+    });
+
+    it(`should reject a PUT operation on a child array authenticated to the wrong user`, async function () {
+        let { user, user_display } = await generate_user_and_display();
+        await collection_user_display.mongoose_model.findByIdAndUpdate(user_display._id, {
+            $push: {
+                nicknames: {
+                    server_key: 'best_server',
+                    name: 'steve the mighty'
+                }
+            }
+        });
+
+        let user_2 = await collection_user.mongoose_model.create({
+            auth_id: 'sharon'
+        });
+
+
+        //@ts-ignore
+        user_display = await collection_user_display.mongoose_model.findById(user_display._id);
+
+        let nickname_id = user_display.nicknames[0]._id + '';
+
+        await assert.rejects(async () => {
+            let results = await got.put(`http://localhost:${port}/api/user_display/${user_display._id}/nicknames/${nickname_id}`, {
+                headers: {
+                    authorization: 'sharon'
+                },
+                json: {
+                    _id: nickname_id,
+                    server_key: 'best_server',
+                    name: 'ubersteve'
+                }
+            }).json();
+        }, {
+            message: 'Response code 403 (Forbidden)'
+        })
+    });
+
+    it(`should authorize a DELETE operation on a child array`, async function () {
+        let { user, user_display } = await generate_user_and_display();
+        await collection_user_display.mongoose_model.findByIdAndUpdate(user_display._id, {
+            $push: {
+                nicknames: {
+                    server_key: 'best_server',
+                    name: 'steve the mighty'
+                }
+            }
+        });
+        //@ts-ignore
+        user_display = await collection_user_display.mongoose_model.findById(user_display._id);
+        let nickname_id = user_display.nicknames[0]._id + '';
+
+        let results = await got.delete(`http://localhost:${port}/api/user_display/${user_display._id}/nicknames/${nickname_id}`, {
+            headers: {
+                authorization: 'steve'
+            },
+        }).json();
+        
+        //@ts-ignore
+        assert.deepEqual(0, results.data.nicknames.length);
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_user_display.mongoose_model.findById(user_display._id))), JSON.parse(JSON.stringify(results.data)));
+    });
+
+    it(`should reject a DELETE operation authenticated to the wrong user`, async function () {
+        let { user, user_display } = await generate_user_and_display();
+
+        let user_2 = await collection_user.mongoose_model.create({
+            auth_id: 'sharon'
+        });
+
+        await collection_user_display.mongoose_model.findByIdAndUpdate(user_display._id, {
+            $push: {
+                nicknames: {
+                    server_key: 'best_server',
+                    name: 'steve the mighty'
+                }
+            }
+        });
+        //@ts-ignore
+        user_display = await collection_user_display.mongoose_model.findById(user_display._id);
+        let nickname_id = user_display.nicknames[0]._id + '';
+        
+        await assert.rejects(async () => {
+            let results = await got.delete(`http://localhost:${port}/api/user_display/${user_display._id}/nicknames/${nickname_id}`, {
+                headers: {
+                    authorization: 'sharon'
+                },
+            }).json();
+        }, {
+            message: 'Response code 403 (Forbidden)'
+        })
+    });
 });

package/test/1_2_role_membership.test.ts

@@ -8,7 +8,7 @@ import { F_SM_Open_Access } from '../dist/F_Security_Models/F_SM_Open_Access.js'
 import { F_SM_Role_Membership } from '../dist/F_Security_Models/F_SM_Role_Membership.js'
 import { F_Security_Model } from '../dist/F_Security_Models/F_Security_Model.js'
 import { Cache } from '../dist/utils/cache.js'
-import { z, ZodBoolean, ZodDate, ZodNumber, ZodString } from 'zod'
+import { z, ZodAny, ZodBoolean, ZodDate, ZodNumber, ZodString } from 'zod'
 
 import got from 'got'
 import express, { Express, Request, Response, NextFunction } from 'express'
@@ -38,6 +38,10 @@ describe.skip('Security Model Role Membership', function () {
         institution_id: z_mongodb_id,
         client_id: z_mongodb_id,
         name: z.string(),
+        steps: z.array(z.object({
+            _id: z_mongodb_id,
+            name: z.string()
+        }))
     });
     let validate_user = z.object({
         _id: z_mongodb_id,
@@ -255,25 +259,29 @@ describe.skip('Security Model Role Membership', function () {
         let steve_project = await collection_project.mongoose_model.create({
             institution_id: steve_institution._id,
             client_id: steve_client,
-            name: 'steve project'
+            name: 'steve project',
+            steps: [],
         })
 
         let joe_project = await collection_project.mongoose_model.create({
             institution_id: steve_institution._id,
             client_id: joe_client,
-            name: 'joe project'
+            name: 'joe project',
+            steps: [],
         })
 
         let nathan_project = await collection_project.mongoose_model.create({
             institution_id: edwin_institution._id,
             client_id: nathan_client,
-            name: 'nathan project'
+            name: 'nathan project',
+            steps: [],
         })
 
         let edna_project = await collection_project.mongoose_model.create({
             institution_id: edwin_institution._id,
             client_id: edna_client,
-            name: 'edna project'
+            name: 'edna project',
+            steps: [],
         })
 
         let access_role_steve_institution_grants_project = await collection_role.mongoose_model.create({
@@ -460,7 +468,8 @@ describe.skip('Security Model Role Membership', function () {
             projects.push(await collection_project.mongoose_model.create({
                 institution_id: steve_institution._id,
                 client_id: steve_client,
-                name: `additional project ${q}`
+                name: `additional project ${q}`,
+                steps: [],
             }))
         }
 
@@ -482,7 +491,8 @@ describe.skip('Security Model Role Membership', function () {
             projects.push(await collection_project.mongoose_model.create({
                 institution_id: edwin_institution._id,
                 client_id: nathan_client,
-                name: `additional project ${q}`
+                name: `additional project ${q}`,
+                steps: [],
             }))
         }
 
@@ -504,7 +514,8 @@ describe.skip('Security Model Role Membership', function () {
             projects.push(await collection_project.mongoose_model.create({
                 institution_id: edwin_institution._id,
                 client_id: edna_client,
-                name: `additional project ${q}`
+                name: `additional project ${q}`,
+                steps: [],
             }))
         }
 
@@ -526,7 +537,8 @@ describe.skip('Security Model Role Membership', function () {
             projects.push(await collection_project.mongoose_model.create({
                 institution_id: steve_institution._id,
                 client_id: steve_client,
-                name: `additional project ${q}`
+                name: `additional project ${q}`,
+                steps: [],
             }))
         }
 
@@ -631,6 +643,7 @@ describe.skip('Security Model Role Membership', function () {
                 name: 'Flammable Project',
                 institution_id: steve_institution._id,
                 client_id: steve_client._id,
+                steps: [],
             }
         }).json();
 
@@ -649,6 +662,7 @@ describe.skip('Security Model Role Membership', function () {
                 name: 'Flammable Project',
                 institution_id: edwin_institution._id,
                 client_id: nathan_client._id,
+                steps: [],
             }
         }).json();
 
@@ -668,6 +682,7 @@ describe.skip('Security Model Role Membership', function () {
                     name: 'Flammable Project',
                     institution_id: edwin_institution._id,
                     client_id: edna_client._id,
+                    steps: [],
                 }
             }).json();
         },
@@ -752,4 +767,309 @@ describe.skip('Security Model Role Membership', function () {
         },
         { message: 'Response code 403 (Forbidden)' })
     });
+
+
+      ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+     /////////////////////////////////////////////////////////////    ARRAY OPERATIONS     //////////////////////////////////////////////////////////////////////////
+    ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+    it(`should authorize a basic POST operation on a document's array children where the user has a T1 role membership`, async function () {
+        let { steve_institution, steve_client, steve_project } = await generate_test_setup();
+
+        let results = await got.post(`http://localhost:${port}/api/institution/${steve_institution._id}/client/${steve_client._id}/project/${steve_project._id}/steps`, {
+            headers: {
+                authorization: 'steve'
+            },
+            json: {
+                name: 'Fancy Step'
+            }
+        }).json();
+
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_project.mongoose_model.findById(steve_project._id))), results.data);
+        assert.equal((await collection_project.mongoose_model.findById(steve_project._id))?.steps.length, 1)
+    });
+
+    it(`should authorize a basic PUT operation on a document's array children where the user has a T1 role membership`, async function () {
+        let { steve_institution, steve_client, steve_project } = await generate_test_setup();
+
+        //@ts-ignore
+        steve_project = await collection_project.mongoose_model.findByIdAndUpdate(steve_project._id, {
+            $push: {
+                steps: {
+                    name: 'Fancy Step'
+                }
+            }
+        }, {new: true}).lean();
+        let step_id = steve_project.steps[0]._id;
+
+        let results = await got.put(`http://localhost:${port}/api/institution/${steve_institution._id}/client/${steve_client._id}/project/${steve_project._id}/steps/${step_id}`, {
+            headers: {
+                authorization: 'steve'
+            },
+            json: {
+                _id: step_id,
+                name: 'Somber Step'
+            }
+        }).json();
+
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_project.mongoose_model.findById(steve_project._id))), results.data);
+        assert.equal((await collection_project.mongoose_model.findById(steve_project._id))?.steps[0].name, 'Somber Step')
+    });
+
+    it(`should authorize a basic DELETE operation on a document's array children where the user has a T1 role membership`, async function () {
+        let { steve_institution, steve_client, steve_project } = await generate_test_setup();
+
+        //@ts-ignore
+        steve_project = await collection_project.mongoose_model.findByIdAndUpdate(steve_project._id, {
+            $push: {
+                steps: {
+                    name: 'Fancy Step'
+                }
+            }
+        }, {new: true}).lean();
+        let step_id = steve_project.steps[0]._id;
+
+        let results = await got.delete(`http://localhost:${port}/api/institution/${steve_institution._id}/client/${steve_client._id}/project/${steve_project._id}/steps/${step_id}`, {
+            headers: {
+                authorization: 'steve'
+            }
+        }).json();
+
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_project.mongoose_model.findById(steve_project._id))), results.data);
+        assert.equal((await collection_project.mongoose_model.findById(steve_project._id))?.steps.length, 0)
+    });
+
+    it(`should authorize a basic POST operation on a document's array children where the user has a T2 role membership`, async function () {
+        let { edwin_institution, nathan_client, nathan_project } = await generate_test_setup();
+
+        let results = await got.post(`http://localhost:${port}/api/institution/${edwin_institution._id}/client/${nathan_client._id}/project/${nathan_project._id}/steps`, {
+            headers: {
+                authorization: 'steve'
+            },
+            json: {
+                name: 'Fancy Step'
+            }
+        }).json();
+
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_project.mongoose_model.findById(nathan_project._id))), results.data);
+        assert.equal((await collection_project.mongoose_model.findById(nathan_project._id))?.steps.length, 1)
+    });
+
+    it(`should authorize a basic PUT operation on a document's array children where the user has a T2 role membership`, async function () {
+        let { edwin_institution, nathan_client, nathan_project } = await generate_test_setup();
+
+        //@ts-ignore
+        nathan_project = await collection_project.mongoose_model.findByIdAndUpdate(nathan_project._id, {
+            $push: {
+                steps: {
+                    name: 'Fancy Step'
+                }
+            }
+        }, {new: true}).lean();
+        let step_id = nathan_project.steps[0]._id;
+
+        let results = await got.put(`http://localhost:${port}/api/institution/${edwin_institution._id}/client/${nathan_client._id}/project/${nathan_project._id}/steps/${step_id}`, {
+            headers: {
+                authorization: 'steve'
+            },
+            json: {
+                _id: step_id,
+                name: 'Somber Step'
+            }
+        }).json();
+
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_project.mongoose_model.findById(nathan_project._id))), results.data);
+        assert.equal((await collection_project.mongoose_model.findById(nathan_project._id))?.steps[0].name, 'Somber Step')
+    });
+
+    it(`should authorize a basic DELETE operation on a document's array children where the user has a T2 role membership`, async function () {
+        let { edwin_institution, nathan_client, nathan_project } = await generate_test_setup();
+
+        //@ts-ignore
+        nathan_project = await collection_project.mongoose_model.findByIdAndUpdate(nathan_project._id, {
+            $push: {
+                steps: {
+                    name: 'Fancy Step'
+                }
+            }
+        }, {new: true}).lean();
+        let step_id = nathan_project.steps[0]._id;
+
+        let results = await got.delete(`http://localhost:${port}/api/institution/${edwin_institution._id}/client/${nathan_client._id}/project/${nathan_project._id}/steps/${step_id}`, {
+            headers: {
+                authorization: 'steve'
+            }
+        }).json();
+
+        //@ts-ignore
+        assert.deepEqual(JSON.parse(JSON.stringify(await collection_project.mongoose_model.findById(nathan_project._id))), results.data);
+        assert.equal((await collection_project.mongoose_model.findById(nathan_project._id))?.steps.length, 0)
+    });
+
+    it(`should reject a basic POST operation on a document's array children where the user has a role membership without permission`, async function () {
+        let { edwin_institution, edna_client, edna_project } = await generate_test_setup();
+
+        await assert.rejects(async () => {
+            let results = await got.post(`http://localhost:${port}/api/institution/${edwin_institution._id}/client/${edna_client._id}/project/${edna_project._id}/steps`, {
+                headers: {
+                    authorization: 'steve'
+                },
+                json: {
+                    name: 'Fancy Step'
+                }
+            }).json();
+        },
+        { message: 'Response code 403 (Forbidden)' })
+    });
+
+    it(`should reject a basic PUT operation on a document's array children where the user has a role membership without permission`, async function () {
+        let { edwin_institution, edna_client, edna_project } = await generate_test_setup();
+
+        //@ts-ignore
+        edna_project = await collection_project.mongoose_model.findByIdAndUpdate(edna_project._id, {
+            $push: {
+                steps: {
+                    name: 'Fancy Step'
+                }
+            }
+        }, {new: true}).lean();
+        let step_id = edna_project.steps[0]._id;
+
+        await assert.rejects(async () => {
+            let results = await got.put(`http://localhost:${port}/api/institution/${edwin_institution._id}/client/${edna_client._id}/project/${edna_project._id}/steps/${step_id}`, {
+                headers: {
+                    authorization: 'steve'
+                },
+                json: {
+                    _id: step_id,
+                    name: 'Somber Step'
+                }
+            }).json();
+        },
+        { message: 'Response code 403 (Forbidden)' })
+    });
+
+    it(`should reject a basic DELETE operation on a document's array children where the user has a role membership without permission`, async function () {
+        let { edwin_institution, edna_client, edna_project } = await generate_test_setup();
+
+        //@ts-ignore
+        edna_project = await collection_project.mongoose_model.findByIdAndUpdate(edna_project._id, {
+            $push: {
+                steps: {
+                    name: 'Fancy Step'
+                }
+            }
+        }, {new: true}).lean();
+        let step_id = edna_project.steps[0]._id;
+
+        await assert.rejects(async () => {
+            let results = await got.delete(`http://localhost:${port}/api/institution/${edwin_institution._id}/client/${edna_client._id}/project/${edna_project._id}/steps/${step_id}`, {
+                headers: {
+                    authorization: 'steve'
+                }
+            }).json();
+        },
+        { message: 'Response code 403 (Forbidden)' })
+    });
+
+    it(`should reject a basic POST operation on a document's array children where the user has POST permission but not PUT permission`, async function () {
+        let { steve_institution, steve_client, steve_project } = await generate_test_setup();
+
+        let user_barnabus = await collection_user.mongoose_model.create({
+            auth_id: 'barnabus'
+        });
+
+        let access_role_steve_institution_grants_project_no_update = await collection_role.mongoose_model.create({
+            name: 'steve full access',
+            institution_id: steve_institution._id,
+            permissions: {
+                institutions: ['read', 'create', 'update', 'delete'],
+                clients: ['read', 'create', 'update', 'delete'],
+                projects: ['read', 'create', 'delete'],
+                roles: ['read', 'create', 'update', 'delete'],
+            }
+        });
+
+        let barnabus_institution_role_membership = await collection_institution_role_membership.mongoose_model.create({
+            role_id: access_role_steve_institution_grants_project_no_update._id,
+            user_id: user_barnabus._id,
+            institution_id: steve_institution._id,
+        })
+
+        await assert.rejects(async () => {
+            let results = await got.post(`http://localhost:${port}/api/institution/${steve_institution._id}/client/${steve_client._id}/project/${steve_project._id}/steps`, {
+                headers: {
+                    authorization: 'barnabus'
+                },
+                json: {
+                    name: 'Fancy Step'
+                }
+            }).json();
+        },
+        { message: 'Response code 403 (Forbidden)' })
+    });
+
+    it(`should reject a basic DELETE operation on a document's array children where the user has DELETE permission but not PUT permission`, async function () {
+        let { steve_institution, steve_client, steve_project, steve_steve_institution_role_membership } = await generate_test_setup();
+
+        let user_barnabus = await collection_user.mongoose_model.create({
+            auth_id: 'barnabus'
+        });
+
+        let access_role_steve_institution_grants_project_no_update = await collection_role.mongoose_model.create({
+            name: 'steve full access',
+            institution_id: steve_institution._id,
+            permissions: {
+                institutions: ['read', 'create', 'update', 'delete'],
+                clients: ['read', 'create', 'update', 'delete'],
+                projects: ['read', 'create', 'delete'],
+                roles: ['read', 'create', 'update', 'delete'],
+            }
+        });
+
+        let barnabus_institution_role_membership = await collection_institution_role_membership.mongoose_model.create({
+            role_id: access_role_steve_institution_grants_project_no_update._id,
+            user_id: user_barnabus._id,
+            institution_id: steve_institution._id,
+        })
+
+        let steve_new_access_role = await collection_role.mongoose_model.create({
+            name: 'steve no project update',
+            institution_id: steve_institution._id,
+            permissions: {
+                institutions: ['read', 'create', 'update', 'delete'],
+                clients: ['read', 'create', 'update', 'delete'],
+                projects: ['read', 'create', 'delete'],
+                roles: ['read', 'create', 'update', 'delete'],
+            }
+        });
+
+        await collection_client_role_membership.mongoose_model.findByIdAndUpdate(steve_steve_institution_role_membership._id, {
+            role_id: steve_new_access_role._id
+        })
+
+        //@ts-ignore
+        steve_project = await collection_project.mongoose_model.findByIdAndUpdate(steve_project._id, {
+            $push: {
+                steps: {
+                    name: 'Fancy Step'
+                }
+            }
+        }, {new: true}).lean();
+        let step_id = steve_project.steps[0]._id;
+
+        await assert.rejects(async () => {
+            let results = await got.delete(`http://localhost:${port}/api/institution/${steve_institution._id}/client/${steve_client._id}/project/${steve_project._id}/steps/${step_id}`, {
+                headers: {
+                    authorization: 'barnabus'
+                }
+            }).json();
+        },
+        { message: 'Response code 403 (Forbidden)' })
+    });
 });