@malloy-publisher/server 0.0.227 → 0.0.228

package/tests/integration/query_givens/query_givens.integration.spec.ts

@@ -0,0 +1,146 @@
+/// <reference types="bun-types" />
+
+/**
+ * HTTP E2E coverage for `given:` runtime parameters on POST .../query:
+ * givens retarget query results, unknown/mistyped givens surface as 400 (not
+ * 500), givens compose with filterParams, a `null` given value is an
+ * explicit SQL-NULL override, and a numeric-string value is accepted for a
+ * `number`-typed given (Malloy's own coercion). Malloy is the single validator:
+ * an unknown name or bad value throws a `runtime-given-*` error that
+ * model.ts maps to a 400 (see getQueryResults).
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import path from "path";
+import { fileURLToPath } from "url";
+import { type RestE2EEnv, startRestE2E } from "../../harness/rest_e2e";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ENV_NAME = "query-givens-env";
+const PKG = "query-givens";
+const MODEL = "model.malloy";
+
+type Row = Record<string, unknown>;
+
+describe("givens forwarding on /query (HTTP E2E)", () => {
+   let env: (RestE2EEnv & { stop(): Promise<void> }) | null = null;
+   let baseUrl: string;
+
+   beforeAll(async () => {
+      env = await startRestE2E();
+      baseUrl = env.baseUrl;
+      const fixtureDir = path.resolve(__dirname, "../../fixtures/query-givens");
+      const createRes = await fetch(`${baseUrl}/api/v0/environments`, {
+         method: "POST",
+         headers: { "Content-Type": "application/json" },
+         body: JSON.stringify({
+            name: ENV_NAME,
+            packages: [{ name: PKG, location: fixtureDir }],
+            connections: [],
+         }),
+      });
+      if (!createRes.ok) {
+         throw new Error(
+            `Failed to create test environment (${createRes.status}): ${await createRes.text()}`,
+         );
+      }
+      const deadline = Date.now() + 30_000;
+      while (Date.now() < deadline) {
+         const res = await fetch(
+            `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}`,
+         );
+         if (res.ok) break;
+         await new Promise((r) => setTimeout(r, 250));
+      }
+   });
+
+   afterAll(async () => {
+      await fetch(`${baseUrl}/api/v0/environments/${ENV_NAME}`, {
+         method: "DELETE",
+      }).catch(() => {});
+      await env?.stop();
+   });
+
+   const query = (body: Record<string, unknown>) =>
+      fetch(
+         `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}/models/${MODEL}/query`,
+         {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+               sourceName: "orders",
+               queryName: "by_given_region",
+               compactJson: true,
+               ...body,
+            }),
+         },
+      );
+
+   async function rows(res: Response): Promise<Row[]> {
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { result: string };
+      return JSON.parse(body.result) as Row[];
+   }
+
+   it("retargets rows via a given override (EU vs default US)", async () => {
+      const res = await query({ givens: { target_region: "EU" } });
+      const r = await rows(res);
+      expect(r.length).toBe(1);
+      expect(Number(r[0].order_count)).toBe(3);
+   });
+
+   it("returns 400 for an unknown given name, naming it in the message", async () => {
+      // Malloy rejects the unknown name (`runtime-given-unknown`, with a
+      // did-you-mean hint) at prepare time; model.ts maps that to a 400 and
+      // forwards Malloy's message, which names the given.
+      const res = await query({ givens: { NOtaGiven: 1 } });
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { message: string };
+      expect(body.message).toContain("NOtaGiven");
+   });
+
+   it("returns 400 for a value-type mismatch on a number-typed given", async () => {
+      // "min_amount" is declared `:: number`; a non-numeric string can't be
+      // coerced, so Malloy rejects it at prepare time (`runtime-given-*`),
+      // surfaced as a 400 via the run try/catch in model.ts, not a 500.
+      const res = await query({ givens: { min_amount: "not-a-number" } });
+      expect(res.status).toBe(400);
+   });
+
+   it("composes givens with filterParams", async () => {
+      // target_region=EU narrows to ids 4,5,6; filterParams status=active
+      // narrows further to ids 4,6 -> order_count=2.
+      const res = await query({
+         givens: { target_region: "EU" },
+         filterParams: { status: "active" },
+      });
+      const r = await rows(res);
+      expect(r.length).toBe(1);
+      expect(Number(r[0].order_count)).toBe(2);
+   });
+
+   it("omitting givens entirely uses the declared defaults (US baseline)", async () => {
+      const res = await query({});
+      const r = await rows(res);
+      expect(r.length).toBe(1);
+      expect(Number(r[0].order_count)).toBe(3);
+   });
+
+   it("a null given value is an explicit SQL-NULL override", async () => {
+      // `region = NULL` is never true in SQL, so this should return zero
+      // matching rows rather than falling back to the 'US' default.
+      const res = await query({ givens: { target_region: null } });
+      const r = await rows(res);
+      expect(r.length).toBe(1);
+      expect(Number(r[0].order_count)).toBe(0);
+   });
+
+   it("accepts a numeric string for a number-typed given", async () => {
+      // Guards against Malloy's numeric-string coercion for `number` givens
+      // regressing; "5" should be accepted just like the literal 5.
+      const res = await query({ givens: { min_amount: "5" } });
+      const r = await rows(res);
+      expect(r.length).toBe(1);
+      expect(Number(r[0].order_count)).toBe(3);
+   });
+});

package/tests/integration/query_givens/query_givens_authorize.integration.spec.ts

@@ -0,0 +1,121 @@
+/// <reference types="bun-types" />
+
+/**
+ * HTTP E2E for the givens × `#(authorize)` interaction. Malloy is the single
+ * given validator, so on a GATED source a bad given (unknown NAME or wrong-typed
+ * VALUE) is caught inside the authorize probe, which fails closed — surfacing as
+ * a 403, not the 400 the ungated path returns. This suite pins that documented
+ * asymmetry so it stays intentional:
+ *
+ *   - unknown given name        -> 403 (probe can't bind it -> fails closed)
+ *   - authorized + valid givens -> 200 (retargets rows)
+ *   - authorize denies          -> 403
+ *   - valid name, BAD value     -> 403 (probe can't evaluate it -> fails closed)
+ *
+ * On an UNGATED source the same unknown name / bad value are a clean 400 (Malloy
+ * `runtime-given-*` mapped by model.ts) — see query_givens.integration.spec.ts.
+ *
+ * See packages/server/src/service/authorize.ts (evaluateAuthorize, fail-closed).
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import path from "path";
+import { fileURLToPath } from "url";
+import { type RestE2EEnv, startRestE2E } from "../../harness/rest_e2e";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ENV_NAME = "query-givens-authz-env";
+const PKG = "query-givens";
+const MODEL = "model.malloy";
+
+type Row = Record<string, unknown>;
+
+describe("givens × authorize on /query (HTTP E2E)", () => {
+   let env: (RestE2EEnv & { stop(): Promise<void> }) | null = null;
+   let baseUrl: string;
+
+   beforeAll(async () => {
+      env = await startRestE2E();
+      baseUrl = env.baseUrl;
+      const fixtureDir = path.resolve(__dirname, "../../fixtures/query-givens");
+      const createRes = await fetch(`${baseUrl}/api/v0/environments`, {
+         method: "POST",
+         headers: { "Content-Type": "application/json" },
+         body: JSON.stringify({
+            name: ENV_NAME,
+            packages: [{ name: PKG, location: fixtureDir }],
+            connections: [],
+         }),
+      });
+      if (!createRes.ok) {
+         throw new Error(
+            `Failed to create test environment (${createRes.status}): ${await createRes.text()}`,
+         );
+      }
+      const deadline = Date.now() + 30_000;
+      while (Date.now() < deadline) {
+         const res = await fetch(
+            `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}`,
+         );
+         if (res.ok) break;
+         await new Promise((r) => setTimeout(r, 250));
+      }
+   });
+
+   afterAll(async () => {
+      await fetch(`${baseUrl}/api/v0/environments/${ENV_NAME}`, {
+         method: "DELETE",
+      }).catch(() => {});
+      await env?.stop();
+   });
+
+   const queryGated = (body: Record<string, unknown>) =>
+      fetch(
+         `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}/models/${MODEL}/query`,
+         {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+               sourceName: "gated_orders",
+               queryName: "by_given_region",
+               compactJson: true,
+               ...body,
+            }),
+         },
+      );
+
+   it("unknown given name -> 403 on a gated source (authorize probe fails closed)", async () => {
+      // Even with role=admin, the unknown given makes the authorize probe throw
+      // (`runtime-given-unknown`), which the gate treats as not-granting. On an
+      // ungated source the same name is a clean 400 (see query_givens suite).
+      const res = await queryGated({
+         givens: { role: "admin", NOtaGiven: 1 },
+      });
+      expect(res.status).toBe(403);
+   });
+
+   it("authorized caller with valid givens -> 200 and retargets rows", async () => {
+      const res = await queryGated({
+         givens: { role: "admin", target_region: "EU" },
+      });
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { result: string };
+      const r = JSON.parse(body.result) as Row[];
+      expect(Number(r[0].order_count)).toBe(3);
+   });
+
+   it("authorize deny (non-admin role) -> 403", async () => {
+      const res = await queryGated({ givens: { role: "guest" } });
+      expect(res.status).toBe(403);
+   });
+
+   it("valid given name with a bad value -> 403 on a gated source (fail-closed authorize)", async () => {
+      // The authorize probe binds the supplied givens; a value it can't evaluate
+      // makes the probe throw and the gate denies. On the UNGATED path the same
+      // bad value is a 400 (Malloy at prepare time) — this asymmetry is by design.
+      const res = await queryGated({
+         givens: { role: "admin", min_amount: "not-a-number" },
+      });
+      expect(res.status).toBe(403);
+   });
+});

package/tests/integration/sdk_givens/sdk_givens.integration.spec.ts

@@ -0,0 +1,110 @@
+/// <reference types="bun-types" />
+
+/**
+ * Proves the browser SDK (`packages/server/src/runtime/publisher.js`, served
+ * at GET /sdk/publisher.js) actually puts `givens` on the wire: fetch the
+ * served source, evaluate it in a sandboxed vm context standing in for
+ * `window` (self === top, so the in-iframe/live-reload branches are
+ * inert no-ops), and call `window.Publisher.query(...)` with a `givens`
+ * override against the real HTTP server. Approach used: sandbox-eval via
+ * Node's `vm` module — evaluating the actual runtime rather than just
+ * grepping its source proves the SDK's fetch body really carries `givens`
+ * end-to-end.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import path from "path";
+import { fileURLToPath } from "url";
+import vm from "vm";
+import { type RestE2EEnv, startRestE2E } from "../../harness/rest_e2e";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ENV_NAME = "sdk-givens-env";
+const PKG = "query-givens";
+const MODEL = "model.malloy";
+
+type Row = Record<string, unknown>;
+
+describe("Publisher SDK forwards givens (sandbox-eval HTTP E2E)", () => {
+   let env: (RestE2EEnv & { stop(): Promise<void> }) | null = null;
+   let baseUrl: string;
+
+   beforeAll(async () => {
+      env = await startRestE2E();
+      baseUrl = env.baseUrl;
+      const fixtureDir = path.resolve(__dirname, "../../fixtures/query-givens");
+      const createRes = await fetch(`${baseUrl}/api/v0/environments`, {
+         method: "POST",
+         headers: { "Content-Type": "application/json" },
+         body: JSON.stringify({
+            name: ENV_NAME,
+            packages: [{ name: PKG, location: fixtureDir }],
+            connections: [],
+         }),
+      });
+      if (!createRes.ok) {
+         throw new Error(
+            `Failed to create test environment (${createRes.status}): ${await createRes.text()}`,
+         );
+      }
+      const deadline = Date.now() + 30_000;
+      while (Date.now() < deadline) {
+         const res = await fetch(
+            `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}`,
+         );
+         if (res.ok) break;
+         await new Promise((r) => setTimeout(r, 250));
+      }
+   });
+
+   afterAll(async () => {
+      await fetch(`${baseUrl}/api/v0/environments/${ENV_NAME}`, {
+         method: "DELETE",
+      }).catch(() => {});
+      await env?.stop();
+   });
+
+   it("Publisher.query() with a givens override reaches the server and retargets rows", async () => {
+      const sdkRes = await fetch(`${baseUrl}/sdk/publisher.js`);
+      expect(sdkRes.status).toBe(200);
+      const sdkSource = await sdkRes.text();
+
+      // Sandbox stands in for `window`. self === top so the runtime's
+      // in-iframe (postMessage resize) and live-reload (EventSource) branches
+      // are no-ops; document/EventSource are omitted since that code path
+      // never runs for a non-embedded page.
+      const sandbox: Record<string, unknown> = {
+         fetch,
+         location: {
+            pathname: `/environments/${ENV_NAME}/packages/${PKG}/`,
+            origin: baseUrl,
+         },
+         console,
+      };
+      sandbox.self = sandbox;
+      sandbox.top = sandbox;
+      sandbox.window = sandbox;
+
+      const context = vm.createContext(sandbox);
+      vm.runInContext(sdkSource, context, { filename: "publisher.js" });
+
+      const publisher = (sandbox.window as { Publisher: unknown })
+         .Publisher as {
+         query: (
+            modelPath: string,
+            malloyQuery: string | undefined,
+            opts: Record<string, unknown>,
+         ) => Promise<Row[]>;
+      };
+      expect(publisher).toBeDefined();
+
+      const rows = await publisher.query(MODEL, undefined, {
+         sourceName: "orders",
+         queryName: "by_given_region",
+         givens: { target_region: "EU" },
+      });
+
+      expect(rows.length).toBe(1);
+      expect(Number(rows[0].order_count)).toBe(3);
+   });
+});