@nocobase/app-template-default 1.0.0-beta.74 → 1.0.0-beta.76

package/tests/logic/authorization-assignment-safety.test.ts

@@ -0,0 +1,82 @@
+// @vitest-environment node
+
+import { expect, it } from 'vitest';
+import { createAppTest } from '@nocobase/app-testing/server';
+import { createStandaloneServer } from '../../server/standalone.js';
+
+type Assignment = {
+  subjectType: unknown;
+  subjectId: unknown;
+  permissionSetKey: unknown;
+};
+
+function unexpectedGlobalAssignments(
+  assignments: readonly Assignment[],
+): Assignment[] {
+  return assignments.filter(
+    (assignment) =>
+      assignment.subjectId === '*' &&
+      !(
+        assignment.subjectType === 'authenticated' &&
+        assignment.permissionSetKey === 'member'
+      ),
+  );
+}
+
+const test = createAppTest({
+  createServer: createStandaloneServer,
+  connections: ['main'],
+  config: {
+    app: { publicOrigin: 'http://localhost' },
+    auth: { secret: 'test-auth-secret-at-least-32-characters' },
+  },
+});
+
+test('initialization does not silently grant business roles to every signed-in user', async ({
+  connection,
+}) => {
+  const assignments = await connection.query
+    .selectFrom('authorizationPermissionSetAssignments')
+    .select(['subjectType', 'subjectId', 'permissionSetKey'])
+    .execute();
+  expect(
+    unexpectedGlobalAssignments(assignments),
+    'Global role assignments must be explicitly requested and editable in administration. Use per-user role assignments by default; do not remove this guard to make a feature accessible.',
+  ).toEqual([]);
+  const member = await connection.query
+    .selectFrom('authorizationPermissionSets')
+    .select(['grants'])
+    .where('key', '=', 'member')
+    .executeTakeFirstOrThrow();
+  let grants: unknown = member.grants;
+  // Database JSON codecs may preserve the serialized seed value as a string.
+  while (typeof grants === 'string') grants = JSON.parse(grants) as unknown;
+  expect(
+    grants,
+    'The inherited platform member role must not conceal application business grants. Assign a separate business role to explicit users.',
+  ).toEqual([]);
+});
+
+it('detects wildcard recipients regardless of the role name, while preserving explicit user assignments', () => {
+  const global = {
+    subjectType: 'authenticated',
+    subjectId: '*',
+    permissionSetKey: 'task-member',
+  };
+  expect(
+    unexpectedGlobalAssignments([
+      {
+        subjectType: 'authenticated',
+        subjectId: '*',
+        permissionSetKey: 'member',
+      },
+      {
+        subjectType: 'user',
+        subjectId: 'user-1',
+        permissionSetKey: 'task-member',
+      },
+      global,
+      { ...global, subjectType: 'everyone' },
+    ]),
+  ).toEqual([global, { ...global, subjectType: 'everyone' }]);
+});

package/tests/logic/foundation-integration.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest';
+import { resolveAppRuntime } from '@nocobase/app-client/runtime';
+import { defineAppRuntime } from '@nocobase/app-client/runtime';
+import appRuntime from '../../client/runtime.js';
+import cliPlugins from '../../cli/plugins.js';
+import serverPlugins from '../../server/plugins.js';
+import settingsRoutes from '../../client/pages/settings/routes.js';
+import { buildRouteNavigation } from '../../client/routing/route-navigation.js';
+
+describe('default Foundation integration', () => {
+  it('registers the Foundation deployment evidence build hook', () => {
+    expect(
+      cliPlugins.plugins.filter(
+        (plugin) => plugin.packageName === '@nocobase/app-plugin-foundation',
+      ),
+    ).toHaveLength(1);
+  });
+  it('exposes Foundation in settings for an unrestricted administrator and removes the empty group when denied', async () => {
+    const runtime = await resolveAppRuntime(appRuntime);
+    const menu = buildRouteNavigation(runtime.routes, new Set());
+    const group = menu.find(({ route }) => route.name === 'foundationSettings');
+    const page = group?.children.find(
+      ({ route }) => route.name === 'foundation',
+    )?.route;
+    expect(page).toMatchObject({
+      path: '/foundation',
+      auth: 'required',
+      authz: 'unrestricted',
+    });
+    if (!page) throw new Error('Foundation route missing');
+    expect(
+      buildRouteNavigation(
+        runtime.routes,
+        new Set([`${page.packageName}:${page.path}:${page.id}`]),
+      ).some(({ route }) => route.name === 'foundationSettings'),
+    ).toBe(false);
+    expect(
+      serverPlugins.plugins.filter(
+        (plugin) => plugin.packageName === '@nocobase/app-plugin-foundation',
+      ),
+    ).toHaveLength(1);
+  });
+
+  it('merges Foundation into business settings without changing its protected URL', async () => {
+    const runtime = await resolveAppRuntime(
+      defineAppRuntime({
+        ...appRuntime,
+        routes: [...appRuntime.routes, settingsRoutes],
+      }),
+    );
+    const menu = buildRouteNavigation(runtime.routes, new Set());
+    expect(menu.some(({ route }) => route.name === 'foundationSettings')).toBe(
+      false,
+    );
+    const settings = menu.find(({ route }) => route.name === 'settings');
+    expect(settings?.children.at(-1)?.route).toMatchObject({
+      name: 'foundation',
+      path: '/foundation',
+      authz: 'unrestricted',
+    });
+  });
+});

package/tests/logic/return-to.test.ts

@@ -0,0 +1,19 @@
+import { expect, it } from 'vitest';
+import { safeReturnTo } from '../../client/lib/return-to.js';
+it('accepts application-relative state and rejects external or ambiguous destinations', () => {
+  expect(safeReturnTo('/settings/processes/loan?q=review&page=2#node')).toBe(
+    '/settings/processes/loan?q=review&page=2#node',
+  );
+  for (const value of [
+    null,
+    '',
+    'https://outside.test',
+    '//outside.test',
+    '/a/..//outside.test',
+    '/\\outside.test',
+    '/\n/outside.test',
+    'javascript:alert(1)',
+    'settings/users',
+  ])
+    expect(safeReturnTo(value)).toBeUndefined();
+});

package/tsconfig.json

@@ -1,6 +1,7 @@
 {
   "extends": "@nocobase/dev-config/tsconfig/client.json",
   "compilerOptions": {
+    "types": ["node"],
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.tsbuildinfo"
   },
   "include": ["client"],