@nocobase/app-template-default 1.0.0-beta.72 → 1.0.0-beta.74

package/tests/logic/default-access-model.test.ts

@@ -0,0 +1,167 @@
+import { expect, it } from 'vitest';
+import type { AuthorizationOptionsResponse } from '@nocobase/app-plugin-authorization/client';
+import {
+  actionKey,
+  ruleResources,
+  ruleScopes,
+  replaceRuleScope,
+  editableRule,
+  type DefaultAccessRule,
+} from '../../client/pages/settings/default-access-model.js';
+const catalog: AuthorizationOptionsResponse = {
+  sections: [
+    {
+      name: 'business',
+      title: 'Business',
+      order: 0,
+      subsections: [
+        {
+          name: 'projects',
+          title: 'Projects',
+          resources: [
+            {
+              type: 'composite',
+              id: 'projects',
+              title: 'Projects',
+              actions: [
+                { name: 'view', title: 'View' },
+                { name: 'submit', title: 'Submit' },
+              ],
+              dataScopes: {
+                view: [
+                  {
+                    key: 'projects',
+                    title: 'Projects',
+                    collection: 'projects',
+                    fields: ['name'],
+                    recordAccess: ['own', 'customFilter'],
+                  },
+                ],
+                submit: [
+                  {
+                    key: 'projects',
+                    title: 'Projects',
+                    collection: 'projects',
+                    fields: ['name'],
+                    recordAccess: ['own'],
+                  },
+                  {
+                    key: 'quotes',
+                    title: 'Quotes',
+                    collection: 'quotes',
+                    fields: ['name'],
+                    recordAccess: ['own'],
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      ],
+    },
+  ],
+  subjectTypes: [],
+  recordAccess: [
+    { key: 'own', title: 'Own', collections: ['*'] },
+    { key: 'customFilter', title: 'Custom', collections: ['*'] },
+  ],
+  collections: [{ name: 'projects', fields: ['name'] }],
+};
+const resource = ruleResources(catalog)[0]!;
+const scopes = ruleScopes(resource, catalog);
+const rule: DefaultAccessRule = {
+  key: 'baseline',
+  resource: { type: 'composite', id: 'projects' },
+  actions: [
+    {
+      action: 'view',
+      scopeKey: 'projects',
+      selection: {
+        type: 'recordAccess',
+        key: 'customFilter',
+        params: { filter: { $and: [{ name: { $eq: 'Secret' } }] } },
+      },
+    },
+    {
+      action: 'submit',
+      scopeKey: 'quotes',
+      selection: { type: 'records', ids: ['q1', 'q2'] },
+    },
+    {
+      action: 'submit',
+      scopeKey: 'projects',
+      selection: {
+        type: 'recordAccess',
+        key: 'own',
+        params: { preserved: { value: true } },
+      },
+    },
+  ],
+};
+it('updates exactly one independently keyed scope without mutating advanced filters, record IDs or unrelated parameters', () => {
+  const before = structuredClone(rule);
+  const changed = replaceRuleScope(
+    rule,
+    scopes.find(
+      (scope) =>
+        scope.id === actionKey({ action: 'submit', scopeKey: 'projects' }),
+    )!,
+    { type: 'all' },
+  );
+  expect(changed.actions[0]).toEqual(rule.actions[0]);
+  expect(changed.actions[1]).toEqual(rule.actions[1]);
+  expect(changed.actions[2]?.selection).toEqual({ type: 'all' });
+  expect(rule).toEqual(before);
+  expect(
+    replaceRuleScope(changed, scopes[0]!, changed.actions[0]!.selection),
+  ).toBe(changed);
+});
+it('removes only an explicit scope and adds no default for unconfigured operations', () => {
+  const removed = replaceRuleScope(rule, scopes[0]!, undefined);
+  expect(removed.actions).toEqual(rule.actions.slice(1));
+  const empty = { ...rule, actions: [] };
+  expect(replaceRuleScope(empty, scopes[0]!, undefined)).toBe(empty);
+});
+it('preserves unknown entries and makes them read-only instead of dropping them from an update', () => {
+  expect(editableRule(rule, scopes, catalog)).toBe(true);
+  for (const changed of [
+    {
+      ...rule,
+      actions: [
+        ...rule.actions,
+        { action: 'legacy', selection: { type: 'all' as const } },
+      ],
+    },
+    {
+      ...rule,
+      actions: [
+        {
+          action: 'view',
+          scopeKey: 'projects',
+          selection: { type: 'recordAccess' as const, key: 'removed' },
+        },
+      ],
+    },
+  ]) {
+    const snapshot = structuredClone(changed);
+    expect(editableRule(changed, scopes, catalog)).toBe(false);
+    expect(changed).toEqual(snapshot);
+  }
+  expect(editableRule(rule, [], catalog)).toBe(false);
+});
+it('offers database rules without unsupported create actions and never confuses collection and composite scopes', () => {
+  const collection = ruleResources(catalog).find(
+    (resource) => resource.type === 'database.collection',
+  )!;
+  expect(
+    ruleScopes(collection, catalog).map((scope) => [
+      scope.action,
+      scope.scopeKey,
+    ]),
+  ).toEqual([
+    ['read', undefined],
+    ['update', undefined],
+    ['delete', undefined],
+  ]);
+  expect(new Set(scopes.map((scope) => scope.id)).size).toBe(scopes.length);
+});

package/tests/logic/permission-management-routes.test.ts

@@ -0,0 +1,64 @@
+import { resolveAppClientContributions } from '@nocobase/app-client/plugins';
+import { expect, it } from 'vitest';
+import settings from '../../client/pages/settings/routes.js';
+import {
+  buildRouteNavigation,
+  selectedNavigationId,
+  routeKey,
+} from '../../client/routing/route-navigation.js';
+it('groups existing permission pages without changing their URLs or authorization and hides inaccessible children', () => {
+  const { routes } = resolveAppClientContributions([
+    { packageName: 'test', source: 'application', routes: [settings] },
+  ]);
+  const group = routes[0].children!.find(
+    (route) => route.name === 'permissionManagement',
+  )!;
+  expect(group.componentLoader).toBeUndefined();
+  expect(
+    group.children!.map((route) => [route.name, route.path, route.authz]),
+  ).toEqual([
+    [
+      'settingsRoles',
+      '/settings/roles',
+      {
+        resource: { type: 'settings', id: 'authorization.permission-sets' },
+        action: 'read',
+      },
+    ],
+    [
+      'settingsDefaultAccess',
+      '/settings/default-access',
+      {
+        resource: { type: 'settings', id: 'authorization.default-access' },
+        action: 'read',
+      },
+    ],
+  ]);
+  const visible = buildRouteNavigation(routes, new Set())[0].children.find(
+    ({ route }) => route.name === 'permissionManagement',
+  )!;
+  expect(visible.children).toEqual([]);
+  expect(visible.route.path).toBe('/settings/roles');
+  expect(visible.route.navigation?.title).toBe('settings.permissionManagement');
+  expect(selectedNavigationId(routes, '/settings/roles/member/edit')).toBe(
+    routeKey(visible.route),
+  );
+  expect(selectedNavigationId(routes, '/settings/default-access')).toBe(
+    routeKey(visible.route),
+  );
+  const denied = new Set([routeKey(group.children![0])]);
+  const onlyDefault = buildRouteNavigation(routes, denied)[0].children.find(
+    ({ route }) => route.name === 'permissionManagement',
+  )!;
+  expect(onlyDefault.children).toEqual([]);
+  expect(onlyDefault.route.path).toBe('/settings/default-access');
+  expect(selectedNavigationId(routes, '/settings/default-access', denied)).toBe(
+    routeKey(onlyDefault.route),
+  );
+  denied.add(routeKey(group.children![1]));
+  expect(
+    buildRouteNavigation(routes, denied)[0].children.map(
+      ({ route }) => route.name,
+    ),
+  ).toEqual(['settingsUsers']);
+});

package/tests/logic/settings-permissions.test.ts

@@ -243,3 +243,92 @@ it.each(['retiredScope', { type: 'legacyPolicy', filter: { owner: 'me' } }])(
     ).toEqual({ records: 'all' });
   },
 );
+
+it('describes unselected data ranges without claiming that inherited access is denied', () => {
+  const described = {
+    ...resource,
+    actions: [
+      { name: 'edit', title: 'Edit', description: 'Change order information.' },
+    ],
+  };
+  const grants = [
+    {
+      resource: { type: 'composite', id: 'orders' },
+      actions: [
+        {
+          action: 'edit',
+          policy: { type: 'composite', scopes: { records: '' } },
+        },
+      ],
+    },
+  ];
+  const before = structuredClone(grants);
+  const catalog = {
+    sections: [
+      {
+        name: 'business',
+        title: 'Business operations',
+        order: 100,
+        subsections: [
+          { name: 'orders', title: 'Orders', resources: [described] },
+        ],
+      },
+    ],
+    recordAccess: [],
+  } as unknown as Parameters<typeof permissionSections>[0];
+  const result = permissionSections(catalog, grants, (value) =>
+    typeof value === 'string' ? value : value.key,
+  );
+  expect(result[0]?.description).toBe('settings.businessOperationsHint');
+  expect(result[0]?.groups[0]?.rows[0]?.hint).toBe('Change order information.');
+  expect(result[0]?.groups[0]?.rows[0]?.scopes?.[0]).toMatchObject({
+    level: '',
+    hint: 'settings.noAdditionalScopeHint',
+  });
+  expect(grants).toEqual(before);
+});
+
+it('shows a shared plugin action explanation once without duplicating row hints', () => {
+  const catalog = {
+    sections: [
+      {
+        name: 'administration',
+        title: 'System and tools',
+        order: 200,
+        subsections: [
+          {
+            name: 'agents',
+            title: 'Agents',
+            resources: [
+              {
+                type: 'agents',
+                id: 'agents.agents',
+                title: 'Agents and skills',
+                actions: [
+                  {
+                    name: 'edit.related',
+                    title: 'Manage own',
+                    description: 'Includes archiving and deletion.',
+                  },
+                  {
+                    name: 'edit.all',
+                    title: 'Manage all',
+                    description: 'Includes archiving and deletion.',
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+    recordAccess: [],
+  } as unknown as Parameters<typeof permissionSections>[0];
+  const result = permissionSections(catalog, [], (value) =>
+    typeof value === 'string' ? value : value.key,
+  );
+  expect(result[0]?.groups[0]?.actionHint).toBe(
+    'Includes archiving and deletion.',
+  );
+  expect(result[0]?.groups[0]?.rows.every((row) => !row.hint)).toBe(true);
+});

package/vitest.config.ts

@@ -11,12 +11,13 @@ export default createReactVitestConfig({
       deps: {
         // Transform the public Client surfaces so vi.mock applies, without duplicating the Server packages' identity tokens.
         inline: [
-          // The authentication guards read the location, so they share the test's react-router rather than Node's copy,
-          // together with every client that resolves the authentication tokens and provider.
-          /@nocobase\/app-plugin-(?:authentication|api-keys|users)\/(?:dist\/)?client\//u,
-          /@nocobase\/app-plugin-authorization\/(?:dist\/)?client\//u,
-          /@nocobase\/app-plugin-(?:lifecycle-example|office-flows-example)\/(?:dist\/)?client\//u,
-          /@nocobase\/app-plugin-notification-in-app\/(?:dist\/)?client\//u,
+          // The published fixture mounts MemoryRouter; transform it with the page to share the router context.
+          /@nocobase\/app-testing\/(?:dist\/)?src\/client\//u,
+          // AppClientProviders includes the navigation guard and must use that same router context.
+          /@nocobase\/app-client\//u,
+          // Client plugins in every scope, including @acme/app-plugin-*, must share the transformed runtime.
+          // Keep server/shared modules external so their service identities remain unchanged.
+          /@[^/]+\/app-plugin-[^/]+\/(?:dist\/)?client\//u,
         ],
       },
     },