@nocobase/app-template-default 1.0.0-beta.73 → 1.0.0-beta.75

package/tests/components/roles.test.tsx

@@ -0,0 +1,85 @@
+import { answerApi, renderWithApp } from '@nocobase/app-testing/client';
+import { apiClientToken, type ClientApplication } from '@nocobase/app-client';
+import {
+  AuthorizationClient,
+  authorizationClientToken,
+} from '@nocobase/app-plugin-authorization/client';
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Routes, Route } from 'react-router';
+import { expect, it } from 'vitest';
+import RolesPage from '../../client/pages/settings/roles.js';
+import enUS from '../../client/locales/en-US.js';
+import zhCN from '../../client/locales/zh-CN.js';
+const settingsNamespace = '@nocobase/compact-role-test';
+const services = (app: ClientApplication) =>
+  app.container.instance(
+    authorizationClientToken,
+    new AuthorizationClient(app.container.resolve(apiClientToken)),
+  );
+const namespaces = {
+  [settingsNamespace]: {
+    'en-US': async () => ({ default: enUS }),
+    'zh-CN': async () => ({ default: zhCN }),
+  },
+};
+
+it('keeps the standard role table sorted, searchable and linked to the current query', async () => {
+  const user = userEvent.setup();
+  await renderWithApp(
+    <Routes>
+      <Route path='/settings/roles' element={<RolesPage />} />
+    </Routes>,
+    {
+      route: '/settings/roles',
+      namespace: settingsNamespace,
+      namespaces,
+      services,
+      fetch: answerApi(({ path }) =>
+        path === 'authorization/permissions'
+          ? { data: { unrestricted: false, permissions: [] } }
+          : {
+              data: [
+                { key: 'team', title: 'NocoBase team', grants: [] },
+                { key: 'cp-customer', title: 'Customer', grants: [] },
+                {
+                  key: 'member',
+                  title: 'Member',
+                  grants: [],
+                  protection: { allow: ['update'] },
+                },
+              ],
+            },
+      ),
+    },
+  );
+  await screen.findByTitle('Customer');
+  const region = screen.getByRole('region', {
+    name: 'Roles and permissions',
+  });
+  const table = within(region).getByRole('table');
+  expect(within(table).getAllByRole('columnheader')).toHaveLength(3);
+  expect(
+    within(table)
+      .getAllByRole('link')
+      .map((link) => link.textContent),
+  ).toEqual(['Customer', 'Member', 'NocoBase team']);
+  expect(
+    screen.queryByRole('heading', { name: 'Customer' }),
+  ).not.toBeInTheDocument();
+  expect(
+    screen.queryByRole('button', { name: 'New role' }),
+  ).not.toBeInTheDocument();
+  await user.type(
+    screen.getByRole('textbox', { name: 'Search role names' }),
+    'Customer',
+  );
+  await waitFor(() => {
+    expect(within(table).getAllByRole('row')).toHaveLength(2);
+    expect(within(table).getAllByRole('link')).toHaveLength(1);
+  });
+  expect(screen.getByTitle('Customer').closest('a')).toHaveAttribute(
+    'href',
+    '/settings/roles/cp-customer/edit?q=Customer',
+  );
+});

package/tests/components/user-permissions.test.tsx

@@ -105,6 +105,18 @@ describe('user permission configuration', () => {
         expect(checkbox).not.toBeChecked();
         await user.click(checkbox);
       }
+      expect(
+        screen.getByRole('heading', { name: words.userInformation }),
+      ).toBeVisible();
+      expect(
+        screen.getByRole('heading', { name: words.accountSecurity }),
+      ).toBeVisible();
+      expect(
+        screen.getByRole('heading', { name: words.roleAssignment }),
+      ).toBeVisible();
+      expect(screen.getAllByRole('checkbox')).toHaveLength(10);
+      const rowIds = screen.getAllByRole('checkbox').map((node) => node.id);
+      expect(new Set(rowIds).size).toBe(10);
       await user.click(
         screen.getByRole('button', { name: words.save, exact: true }),
       );

package/tests/logic/authorization-assignment-safety.test.ts

@@ -0,0 +1,82 @@
+// @vitest-environment node
+
+import { expect, it } from 'vitest';
+import { createAppTest } from '@nocobase/app-testing/server';
+import { createStandaloneServer } from '../../server/standalone.js';
+
+type Assignment = {
+  subjectType: unknown;
+  subjectId: unknown;
+  permissionSetKey: unknown;
+};
+
+function unexpectedGlobalAssignments(
+  assignments: readonly Assignment[],
+): Assignment[] {
+  return assignments.filter(
+    (assignment) =>
+      assignment.subjectId === '*' &&
+      !(
+        assignment.subjectType === 'authenticated' &&
+        assignment.permissionSetKey === 'member'
+      ),
+  );
+}
+
+const test = createAppTest({
+  createServer: createStandaloneServer,
+  connections: ['main'],
+  config: {
+    app: { publicOrigin: 'http://localhost' },
+    auth: { secret: 'test-auth-secret-at-least-32-characters' },
+  },
+});
+
+test('initialization does not silently grant business roles to every signed-in user', async ({
+  connection,
+}) => {
+  const assignments = await connection.query
+    .selectFrom('authorizationPermissionSetAssignments')
+    .select(['subjectType', 'subjectId', 'permissionSetKey'])
+    .execute();
+  expect(
+    unexpectedGlobalAssignments(assignments),
+    'Global role assignments must be explicitly requested and editable in administration. Use per-user role assignments by default; do not remove this guard to make a feature accessible.',
+  ).toEqual([]);
+  const member = await connection.query
+    .selectFrom('authorizationPermissionSets')
+    .select(['grants'])
+    .where('key', '=', 'member')
+    .executeTakeFirstOrThrow();
+  let grants: unknown = member.grants;
+  // Database JSON codecs may preserve the serialized seed value as a string.
+  while (typeof grants === 'string') grants = JSON.parse(grants) as unknown;
+  expect(
+    grants,
+    'The inherited platform member role must not conceal application business grants. Assign a separate business role to explicit users.',
+  ).toEqual([]);
+});
+
+it('detects wildcard recipients regardless of the role name, while preserving explicit user assignments', () => {
+  const global = {
+    subjectType: 'authenticated',
+    subjectId: '*',
+    permissionSetKey: 'task-member',
+  };
+  expect(
+    unexpectedGlobalAssignments([
+      {
+        subjectType: 'authenticated',
+        subjectId: '*',
+        permissionSetKey: 'member',
+      },
+      {
+        subjectType: 'user',
+        subjectId: 'user-1',
+        permissionSetKey: 'task-member',
+      },
+      global,
+      { ...global, subjectType: 'everyone' },
+    ]),
+  ).toEqual([global, { ...global, subjectType: 'everyone' }]);
+});

package/tests/logic/client-routes.test.ts

@@ -90,6 +90,14 @@ describe('app client routes', () => {
         name: 'settingsRoleEdit',
         authorizedAs: 'settings:authorization.permission-sets',
       },
+      ...[
+        'settingsDefaultAccess',
+        'settingsDefaultAccessCreate',
+        'settingsDefaultAccessEdit',
+      ].map((name) => ({
+        name,
+        authorizedAs: 'settings:authorization.default-access',
+      })),
     ]);
     for (const loader of componentLoadersIn(built.routes))
       await expect(loader()).resolves.toMatchObject({

package/tests/logic/default-access-model.test.ts

@@ -0,0 +1,167 @@
+import { expect, it } from 'vitest';
+import type { AuthorizationOptionsResponse } from '@nocobase/app-plugin-authorization/client';
+import {
+  actionKey,
+  ruleResources,
+  ruleScopes,
+  replaceRuleScope,
+  editableRule,
+  type DefaultAccessRule,
+} from '../../client/pages/settings/default-access-model.js';
+const catalog: AuthorizationOptionsResponse = {
+  sections: [
+    {
+      name: 'business',
+      title: 'Business',
+      order: 0,
+      subsections: [
+        {
+          name: 'projects',
+          title: 'Projects',
+          resources: [
+            {
+              type: 'composite',
+              id: 'projects',
+              title: 'Projects',
+              actions: [
+                { name: 'view', title: 'View' },
+                { name: 'submit', title: 'Submit' },
+              ],
+              dataScopes: {
+                view: [
+                  {
+                    key: 'projects',
+                    title: 'Projects',
+                    collection: 'projects',
+                    fields: ['name'],
+                    recordAccess: ['own', 'customFilter'],
+                  },
+                ],
+                submit: [
+                  {
+                    key: 'projects',
+                    title: 'Projects',
+                    collection: 'projects',
+                    fields: ['name'],
+                    recordAccess: ['own'],
+                  },
+                  {
+                    key: 'quotes',
+                    title: 'Quotes',
+                    collection: 'quotes',
+                    fields: ['name'],
+                    recordAccess: ['own'],
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      ],
+    },
+  ],
+  subjectTypes: [],
+  recordAccess: [
+    { key: 'own', title: 'Own', collections: ['*'] },
+    { key: 'customFilter', title: 'Custom', collections: ['*'] },
+  ],
+  collections: [{ name: 'projects', fields: ['name'] }],
+};
+const resource = ruleResources(catalog)[0]!;
+const scopes = ruleScopes(resource, catalog);
+const rule: DefaultAccessRule = {
+  key: 'baseline',
+  resource: { type: 'composite', id: 'projects' },
+  actions: [
+    {
+      action: 'view',
+      scopeKey: 'projects',
+      selection: {
+        type: 'recordAccess',
+        key: 'customFilter',
+        params: { filter: { $and: [{ name: { $eq: 'Secret' } }] } },
+      },
+    },
+    {
+      action: 'submit',
+      scopeKey: 'quotes',
+      selection: { type: 'records', ids: ['q1', 'q2'] },
+    },
+    {
+      action: 'submit',
+      scopeKey: 'projects',
+      selection: {
+        type: 'recordAccess',
+        key: 'own',
+        params: { preserved: { value: true } },
+      },
+    },
+  ],
+};
+it('updates exactly one independently keyed scope without mutating advanced filters, record IDs or unrelated parameters', () => {
+  const before = structuredClone(rule);
+  const changed = replaceRuleScope(
+    rule,
+    scopes.find(
+      (scope) =>
+        scope.id === actionKey({ action: 'submit', scopeKey: 'projects' }),
+    )!,
+    { type: 'all' },
+  );
+  expect(changed.actions[0]).toEqual(rule.actions[0]);
+  expect(changed.actions[1]).toEqual(rule.actions[1]);
+  expect(changed.actions[2]?.selection).toEqual({ type: 'all' });
+  expect(rule).toEqual(before);
+  expect(
+    replaceRuleScope(changed, scopes[0]!, changed.actions[0]!.selection),
+  ).toBe(changed);
+});
+it('removes only an explicit scope and adds no default for unconfigured operations', () => {
+  const removed = replaceRuleScope(rule, scopes[0]!, undefined);
+  expect(removed.actions).toEqual(rule.actions.slice(1));
+  const empty = { ...rule, actions: [] };
+  expect(replaceRuleScope(empty, scopes[0]!, undefined)).toBe(empty);
+});
+it('preserves unknown entries and makes them read-only instead of dropping them from an update', () => {
+  expect(editableRule(rule, scopes, catalog)).toBe(true);
+  for (const changed of [
+    {
+      ...rule,
+      actions: [
+        ...rule.actions,
+        { action: 'legacy', selection: { type: 'all' as const } },
+      ],
+    },
+    {
+      ...rule,
+      actions: [
+        {
+          action: 'view',
+          scopeKey: 'projects',
+          selection: { type: 'recordAccess' as const, key: 'removed' },
+        },
+      ],
+    },
+  ]) {
+    const snapshot = structuredClone(changed);
+    expect(editableRule(changed, scopes, catalog)).toBe(false);
+    expect(changed).toEqual(snapshot);
+  }
+  expect(editableRule(rule, [], catalog)).toBe(false);
+});
+it('offers database rules without unsupported create actions and never confuses collection and composite scopes', () => {
+  const collection = ruleResources(catalog).find(
+    (resource) => resource.type === 'database.collection',
+  )!;
+  expect(
+    ruleScopes(collection, catalog).map((scope) => [
+      scope.action,
+      scope.scopeKey,
+    ]),
+  ).toEqual([
+    ['read', undefined],
+    ['update', undefined],
+    ['delete', undefined],
+  ]);
+  expect(new Set(scopes.map((scope) => scope.id)).size).toBe(scopes.length);
+});

package/tests/logic/foundation-integration.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest';
+import { resolveAppRuntime } from '@nocobase/app-client/runtime';
+import { defineAppRuntime } from '@nocobase/app-client/runtime';
+import appRuntime from '../../client/runtime.js';
+import cliPlugins from '../../cli/plugins.js';
+import serverPlugins from '../../server/plugins.js';
+import settingsRoutes from '../../client/pages/settings/routes.js';
+import { buildRouteNavigation } from '../../client/routing/route-navigation.js';
+
+describe('default Foundation integration', () => {
+  it('registers the Foundation deployment evidence build hook', () => {
+    expect(
+      cliPlugins.plugins.filter(
+        (plugin) => plugin.packageName === '@nocobase/app-plugin-foundation',
+      ),
+    ).toHaveLength(1);
+  });
+  it('exposes Foundation in settings for an unrestricted administrator and removes the empty group when denied', async () => {
+    const runtime = await resolveAppRuntime(appRuntime);
+    const menu = buildRouteNavigation(runtime.routes, new Set());
+    const group = menu.find(({ route }) => route.name === 'foundationSettings');
+    const page = group?.children.find(
+      ({ route }) => route.name === 'foundation',
+    )?.route;
+    expect(page).toMatchObject({
+      path: '/foundation',
+      auth: 'required',
+      authz: 'unrestricted',
+    });
+    if (!page) throw new Error('Foundation route missing');
+    expect(
+      buildRouteNavigation(
+        runtime.routes,
+        new Set([`${page.packageName}:${page.path}:${page.id}`]),
+      ).some(({ route }) => route.name === 'foundationSettings'),
+    ).toBe(false);
+    expect(
+      serverPlugins.plugins.filter(
+        (plugin) => plugin.packageName === '@nocobase/app-plugin-foundation',
+      ),
+    ).toHaveLength(1);
+  });
+
+  it('merges Foundation into business settings without changing its protected URL', async () => {
+    const runtime = await resolveAppRuntime(
+      defineAppRuntime({
+        ...appRuntime,
+        routes: [...appRuntime.routes, settingsRoutes],
+      }),
+    );
+    const menu = buildRouteNavigation(runtime.routes, new Set());
+    expect(menu.some(({ route }) => route.name === 'foundationSettings')).toBe(
+      false,
+    );
+    const settings = menu.find(({ route }) => route.name === 'settings');
+    expect(settings?.children.at(-1)?.route).toMatchObject({
+      name: 'foundation',
+      path: '/foundation',
+      authz: 'unrestricted',
+    });
+  });
+});

package/tests/logic/permission-management-routes.test.ts

@@ -0,0 +1,64 @@
+import { resolveAppClientContributions } from '@nocobase/app-client/plugins';
+import { expect, it } from 'vitest';
+import settings from '../../client/pages/settings/routes.js';
+import {
+  buildRouteNavigation,
+  selectedNavigationId,
+  routeKey,
+} from '../../client/routing/route-navigation.js';
+it('groups existing permission pages without changing their URLs or authorization and hides inaccessible children', () => {
+  const { routes } = resolveAppClientContributions([
+    { packageName: 'test', source: 'application', routes: [settings] },
+  ]);
+  const group = routes[0].children!.find(
+    (route) => route.name === 'permissionManagement',
+  )!;
+  expect(group.componentLoader).toBeUndefined();
+  expect(
+    group.children!.map((route) => [route.name, route.path, route.authz]),
+  ).toEqual([
+    [
+      'settingsRoles',
+      '/settings/roles',
+      {
+        resource: { type: 'settings', id: 'authorization.permission-sets' },
+        action: 'read',
+      },
+    ],
+    [
+      'settingsDefaultAccess',
+      '/settings/default-access',
+      {
+        resource: { type: 'settings', id: 'authorization.default-access' },
+        action: 'read',
+      },
+    ],
+  ]);
+  const visible = buildRouteNavigation(routes, new Set())[0].children.find(
+    ({ route }) => route.name === 'permissionManagement',
+  )!;
+  expect(visible.children).toEqual([]);
+  expect(visible.route.path).toBe('/settings/roles');
+  expect(visible.route.navigation?.title).toBe('settings.permissionManagement');
+  expect(selectedNavigationId(routes, '/settings/roles/member/edit')).toBe(
+    routeKey(visible.route),
+  );
+  expect(selectedNavigationId(routes, '/settings/default-access')).toBe(
+    routeKey(visible.route),
+  );
+  const denied = new Set([routeKey(group.children![0])]);
+  const onlyDefault = buildRouteNavigation(routes, denied)[0].children.find(
+    ({ route }) => route.name === 'permissionManagement',
+  )!;
+  expect(onlyDefault.children).toEqual([]);
+  expect(onlyDefault.route.path).toBe('/settings/default-access');
+  expect(selectedNavigationId(routes, '/settings/default-access', denied)).toBe(
+    routeKey(onlyDefault.route),
+  );
+  denied.add(routeKey(group.children![1]));
+  expect(
+    buildRouteNavigation(routes, denied)[0].children.map(
+      ({ route }) => route.name,
+    ),
+  ).toEqual(['settingsUsers']);
+});

package/tests/logic/settings-permissions.test.ts

@@ -243,3 +243,92 @@ it.each(['retiredScope', { type: 'legacyPolicy', filter: { owner: 'me' } }])(
     ).toEqual({ records: 'all' });
   },
 );
+
+it('describes unselected data ranges without claiming that inherited access is denied', () => {
+  const described = {
+    ...resource,
+    actions: [
+      { name: 'edit', title: 'Edit', description: 'Change order information.' },
+    ],
+  };
+  const grants = [
+    {
+      resource: { type: 'composite', id: 'orders' },
+      actions: [
+        {
+          action: 'edit',
+          policy: { type: 'composite', scopes: { records: '' } },
+        },
+      ],
+    },
+  ];
+  const before = structuredClone(grants);
+  const catalog = {
+    sections: [
+      {
+        name: 'business',
+        title: 'Business operations',
+        order: 100,
+        subsections: [
+          { name: 'orders', title: 'Orders', resources: [described] },
+        ],
+      },
+    ],
+    recordAccess: [],
+  } as unknown as Parameters<typeof permissionSections>[0];
+  const result = permissionSections(catalog, grants, (value) =>
+    typeof value === 'string' ? value : value.key,
+  );
+  expect(result[0]?.description).toBe('settings.businessOperationsHint');
+  expect(result[0]?.groups[0]?.rows[0]?.hint).toBe('Change order information.');
+  expect(result[0]?.groups[0]?.rows[0]?.scopes?.[0]).toMatchObject({
+    level: '',
+    hint: 'settings.noAdditionalScopeHint',
+  });
+  expect(grants).toEqual(before);
+});
+
+it('shows a shared plugin action explanation once without duplicating row hints', () => {
+  const catalog = {
+    sections: [
+      {
+        name: 'administration',
+        title: 'System and tools',
+        order: 200,
+        subsections: [
+          {
+            name: 'agents',
+            title: 'Agents',
+            resources: [
+              {
+                type: 'agents',
+                id: 'agents.agents',
+                title: 'Agents and skills',
+                actions: [
+                  {
+                    name: 'edit.related',
+                    title: 'Manage own',
+                    description: 'Includes archiving and deletion.',
+                  },
+                  {
+                    name: 'edit.all',
+                    title: 'Manage all',
+                    description: 'Includes archiving and deletion.',
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+    recordAccess: [],
+  } as unknown as Parameters<typeof permissionSections>[0];
+  const result = permissionSections(catalog, [], (value) =>
+    typeof value === 'string' ? value : value.key,
+  );
+  expect(result[0]?.groups[0]?.actionHint).toBe(
+    'Includes archiving and deletion.',
+  );
+  expect(result[0]?.groups[0]?.rows.every((row) => !row.hint)).toBe(true);
+});

package/vitest.config.ts

@@ -15,9 +15,9 @@ export default createReactVitestConfig({
           /@nocobase\/app-testing\/(?:dist\/)?src\/client\//u,
           // AppClientProviders includes the navigation guard and must use that same router context.
           /@nocobase\/app-client\//u,
-          // Every client plugin that resolves AppClient tokens must share the transformed runtime.
+          // Client plugins in every scope, including @acme/app-plugin-*, must share the transformed runtime.
           // Keep server/shared modules external so their service identities remain unchanged.
-          /@nocobase\/app-plugin-[^/]+\/(?:dist\/)?client\//u,
+          /@[^/]+\/app-plugin-[^/]+\/(?:dist\/)?client\//u,
         ],
       },
     },