@nocobase/app-template-default 1.0.0-beta.83 → 1.0.0-beta.84

package/tests/fixtures/submission/routes.ts

@@ -0,0 +1,208 @@
+import {
+  authorizationToken,
+  grantBacked,
+  type AuthorizationEnv,
+} from '@nocobase/app-plugin-authorization';
+import type { Application } from '@nocobase/app-server/application';
+import {
+  authenticationToken,
+  type AuthEnv,
+} from '@nocobase/app-plugin-authentication';
+import {
+  ApiError,
+  defineApiRoutes,
+  defineRepositoryApiRoutes,
+  executeIdempotentMutation,
+  describeRoute,
+  apiValidator,
+  dataResponse,
+  apiErrorResponses,
+} from '@nocobase/app-server/router';
+import { databaseManagerToken } from '@nocobase/db';
+import {
+  createRepositoryLifecycleStore,
+  defineLifecycle,
+  LifecycleRuntime,
+  type LifecycleRecord,
+} from '@nocobase/lifecycle';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { randomUUID } from 'node:crypto';
+
+interface Borrowing extends LifecycleRecord {
+  status: 'draft' | 'approved';
+  name: string;
+  assetTag: string;
+}
+type BorrowingTypes = {
+  record: Borrowing;
+  state: Borrowing['status'];
+  parameters: Record<string, never>;
+  services: Record<string, never>;
+};
+/** Isolated synthetic business fixture. Authentication uses this application's native session. */
+export default defineApiRoutes(async (app: Application) => {
+  const database = app.container.resolve(databaseManagerToken);
+  const connection = database.connection();
+  const auth = app.container.resolve(authenticationToken);
+  const authorization = app.container.resolve(authorizationToken);
+  authorization.resourceTypes.add({
+    type: 'submissionBorrowing',
+    actions: ['read', 'create', 'update', 'delete', 'approve'],
+    authorize: grantBacked(),
+  });
+  const runtime = new LifecycleRuntime({
+    store: createRepositoryLifecycleStore(database),
+  });
+  runtime.register(
+    defineLifecycle<BorrowingTypes>({
+      name: 'borrowings',
+      initial: 'draft',
+      states: ['draft', { name: 'approved', final: true }],
+      transitions: {
+        approve: {
+          from: 'draft',
+          to: 'approved',
+          onTransition: async ({ record, transactionHandle }) => {
+            const tx = transactionHandle as typeof connection;
+            await tx.repository('inventoryEntries').createOne({
+              values: { id: randomUUID(), borrowingId: record.id },
+            });
+          },
+        },
+      },
+    }),
+  );
+  const router = new Hono<AuthEnv & AuthorizationEnv>();
+  router.use('*', auth.required(), authorization.middleware());
+  router.use('*', async (c, next) => {
+    const path = c.req.path;
+    const action = path.endsWith('/createOne')
+      ? 'create'
+      : path.endsWith('/updateOne')
+        ? 'update'
+        : path.endsWith('/deleteOne')
+          ? 'delete'
+          : path.endsWith('/approve')
+            ? 'approve'
+            : 'read';
+    await c.get('authz').require(
+      path.endsWith('/fixtureAccess')
+        ? {
+            resource: {
+              type: 'settings',
+              id: 'authorization.permission-sets',
+            },
+            action: 'update',
+          }
+        : { resource: { type: 'submissionBorrowing', id: '*' }, action },
+    );
+    await next();
+  });
+  let revoked = false;
+  router.use('*', async (c, next) => {
+    if (revoked && !c.req.path.endsWith('/fixtureAccess'))
+      throw new ApiError({
+        status: 'PERMISSION_DENIED',
+        reason: 'FIXTURE_REVOKED',
+        domain: 'submissionFixture',
+        message: 'The business permission was revoked.',
+      });
+    await next();
+  });
+  const routes = defineRepositoryApiRoutes({
+    repositories: [
+      {
+        name: 'borrowings',
+        policy: {
+          read: true,
+          create: {
+            scope: true,
+            fields: ['id', 'name', 'assetTag', 'statusChangedAt'],
+          },
+          update: { scope: true, fields: ['name', 'assetTag'] },
+          delete: true,
+        },
+        actions: { findMany: {}, createOne: {}, updateOne: {}, deleteOne: {} },
+      },
+    ],
+  });
+  router.route('/', await routes.createRouter(app));
+  const info = (operationId: string, summary: string) =>
+    describeRoute({
+      tags: ['SubmissionFixture'],
+      summary,
+      operationId,
+      responses: { 200: dataResponse(z.unknown()), ...apiErrorResponses },
+    });
+  router.get(
+    '/submissionFixture/evidence',
+    info('submissionFixtureEvidence', 'Inspect synthetic business data'),
+    async (c) =>
+      c.json({
+        data: {
+          rows: await connection.repository('borrowings').findMany(),
+          entries: await connection.repository('inventoryEntries').findMany(),
+          history: await connection
+            .repository('lifecycleTransitions')
+            .findMany(),
+        },
+      }),
+  );
+  router.post(
+    '/submissionFixture/fixtureAccess',
+    info('submissionFixtureAccess', 'Change the synthetic business permission'),
+    apiValidator('json', z.strictObject({ revoked: z.boolean() })),
+    (c) => {
+      revoked = c.req.valid('json').revoked;
+      return c.json({ data: { revoked } });
+    },
+  );
+  router.post(
+    '/submissionFixture/:id/approve',
+    info('submissionFixtureApprove', 'Approve a synthetic borrowing'),
+    apiValidator('param', z.object({ id: z.string() })),
+    apiValidator('header', z.object({ 'idempotency-key': z.string() })),
+    apiValidator('json', z.strictObject({ note: z.string() })),
+    async (c) => {
+      const user = c.get('auth') as { user: { id: string } };
+      const id = c.req.valid('param').id;
+      const result = await executeIdempotentMutation({
+        connection,
+        key: c.req.valid('header')['idempotency-key'],
+        principal: user.user.id,
+        operation: `borrowings/${id}/approve`,
+        input: c.req.valid('json'),
+        authorize: async () => {
+          if (revoked)
+            throw new ApiError({
+              status: 'PERMISSION_DENIED',
+              reason: 'FIXTURE_REVOKED',
+              domain: 'submissionFixture',
+              message: 'Permission revoked.',
+            });
+        },
+        authorizeReplay: async () => {
+          if (
+            !(await connection
+              .repository('borrowings')
+              .findOne({ filter: { id } }))
+          )
+            throw new Error('Borrowing unavailable.');
+        },
+        execute: async (transaction) => {
+          await runtime.fire('borrowings', id, 'approve', {
+            actor: { id: user.user.id },
+            requestId: c.req.valid('header')['idempotency-key'],
+            input: c.req.valid('json'),
+            transaction,
+          });
+          return { approved: true, id };
+        },
+      });
+      c.header('Idempotency-Replayed', String(result.replayed));
+      return c.json({ data: result.data });
+    },
+  );
+  return new Hono().route('/', router);
+});

package/tests/helpers/settings-client.tsx

@@ -0,0 +1,31 @@
+import type { ReactElement } from 'react';
+import { beforeEach } from 'vitest';
+import { renderWithApp } from '@nocobase/app-testing/client';
+import {
+  AuthenticationProvider,
+  authenticationClientToken,
+  type AuthClient,
+} from '@nocobase/app-plugin-authentication/client';
+
+// Presentation tests keep their existing API doubles; native authentication is exercised separately against the server.
+beforeEach(() => window.sessionStorage.clear());
+export function renderSettingsClient(
+  ui: ReactElement,
+  options: Parameters<typeof renderWithApp>[1] = {},
+): ReturnType<typeof renderWithApp> {
+  return renderWithApp(<AuthenticationProvider>{ui}</AuthenticationProvider>, {
+    ...options,
+    services: (app) => {
+      options.services?.(app);
+      app.container.instance(authenticationClientToken, {
+        getSession: async () => ({
+          data: {
+            user: { id: 'settings-test-user' },
+            session: { id: 'settings-test-session' },
+          },
+          error: null,
+        }),
+      } as unknown as AuthClient);
+    },
+  });
+}

package/tests/server/member-role.test.ts

@@ -1,3 +1,5 @@
+import { randomUUID } from 'node:crypto';
+const createOperationKey = () => `${Date.now()}.${randomUUID()}`;
 // @vitest-environment node
 import { expect } from 'vitest';
 import { createAppTest } from '@nocobase/app-testing/server';
@@ -22,7 +24,11 @@ const test = createAppTest({
 });
 const json = (body: unknown, method = 'POST') => ({
   method,
-  headers: { 'content-type': 'application/json', origin: 'http://localhost' },
+  headers: {
+    'content-type': 'application/json',
+    origin: 'http://localhost',
+    'Idempotency-Key': createOperationKey(),
+  },
   body: JSON.stringify(body),
 });
 

package/tests/server/submission-settings.test.ts

@@ -0,0 +1,241 @@
+import { expect } from 'vitest';
+import { createAppTest } from '@nocobase/app-testing/server';
+import {
+  signIn,
+  DEFAULT_ADMIN_CREDENTIALS,
+} from '@nocobase/app-plugin-authentication/testing';
+import { randomUUID } from 'node:crypto';
+const createOperationKey = () => `${Date.now()}.${randomUUID()}`;
+import { authorizationToken } from '@nocobase/app-plugin-authorization';
+import { createStandaloneServer } from '../../server/standalone.js';
+
+const test = createAppTest({
+  createServer: createStandaloneServer,
+  config: {
+    app: { publicOrigin: 'http://localhost' },
+    auth: { secret: 'test-auth-secret-at-least-32-characters' },
+  },
+});
+const request = (
+  input: unknown,
+  key = createOperationKey(),
+  method = 'POST',
+): RequestInit => ({
+  method,
+  headers: {
+    'content-type': 'application/json',
+    origin: 'http://localhost',
+    'Idempotency-Key': key,
+  },
+  body: JSON.stringify(input),
+});
+
+test('native standard settings recover committed writes and enforce current permissions', async ({
+  testApp,
+  app,
+  connection,
+}) => {
+  const admin = await signIn(testApp, DEFAULT_ADMIN_CREDENTIALS);
+  const role = {
+    key: 'submission-reader',
+    title: 'Submission reader',
+    grants: [
+      { resource: { type: 'user', id: '*' }, actions: [{ action: 'read' }] },
+    ],
+  };
+  const roleRequest = request(role);
+  const firstRole = await admin.fetch(
+    '/authorization/permissionSets',
+    roleRequest,
+  );
+  expect(firstRole.status).toBe(201);
+  const savedRole = await firstRole.json();
+  const replayRole = await admin.fetch(
+    '/authorization/permissionSets',
+    roleRequest,
+  );
+  expect(replayRole.status).toBe(201);
+  expect(await replayRole.json()).toEqual(savedRole);
+  expect(replayRole.headers.get('Idempotency-Replayed')).toBe('true');
+  const account = {
+    name: 'Synthetic reader',
+    username: 'submissionreader',
+    email: 'submission-reader@example.test',
+    password: 'Submission-test-123!',
+    roleScopes: { app: [role.key] },
+  };
+  const accountRequest = request(account);
+  const firstUser = await admin.fetch('/users', accountRequest);
+  expect(firstUser.status).toBe(201);
+  const savedUser = await firstUser.json();
+  const replayUser = await admin.fetch('/users', accountRequest);
+  expect(replayUser.status).toBe(201);
+  expect(await replayUser.json()).toEqual(savedUser);
+  expect(replayUser.headers.get('Idempotency-Replayed')).toBe('true');
+  expect(
+    await connection
+      .repository('user')
+      .count({ filter: { username: account.username } }),
+  ).toBe(1);
+  const reader = await signIn(testApp, {
+    username: account.username,
+    password: account.password,
+  });
+  expect((await reader.fetch('/users')).status).toBe(200);
+  expect(
+    (
+      await reader.fetch(
+        '/users',
+        request({
+          ...account,
+          username: 'denied',
+          email: 'denied@example.test',
+        }),
+      )
+    ).status,
+  ).toBe(403);
+  const updateRequest = request(
+    {
+      title: 'Renamed reader',
+      grants: role.grants,
+      expectedRevision: savedRole.data.revision,
+    },
+    createOperationKey(),
+    'PATCH',
+  );
+  const firstUpdate = await admin.fetch(
+    `/authorization/permissionSets/${role.key}`,
+    updateRequest,
+  );
+  expect(firstUpdate.status).toBe(200);
+  const updateResult = await firstUpdate.json();
+  const replayUpdate = await admin.fetch(
+    `/authorization/permissionSets/${role.key}`,
+    updateRequest,
+  );
+  expect(replayUpdate.status).toBe(200);
+  expect(await replayUpdate.json()).toEqual(updateResult);
+  const userUpdate = request(
+    { name: 'Updated synthetic reader', roleScopes: { app: [role.key] } },
+    createOperationKey(),
+    'PATCH',
+  );
+  const firstEdit = await admin.fetch(
+    `/users/${savedUser.data.id}`,
+    userUpdate,
+  );
+  expect(firstEdit.status).toBe(200);
+  const replayEdit = await admin.fetch(
+    `/users/${savedUser.data.id}`,
+    userUpdate,
+  );
+  expect(replayEdit.status).toBe(200);
+  expect(await replayEdit.json()).toEqual(await firstEdit.json());
+  const missingKey = request({
+    ...account,
+    username: 'missing-key',
+    email: 'missing-key@example.test',
+  });
+  delete (missingKey.headers as Record<string, string>)['Idempotency-Key'];
+  expect((await admin.fetch('/users', missingKey)).status).toBe(400);
+  // A settings editor loses its grant after committing: possession of the old operation key cannot restore it.
+  const authz = app.container.resolve(authorizationToken);
+  await authz.permissionSets.create({
+    key: 'submission-editor',
+    grants: [
+      {
+        resource: { type: 'settings', id: 'authorization.permission-sets' },
+        actions: [{ action: 'read' }, { action: 'create' }],
+      },
+    ],
+  });
+  await authz.permissionSets.replaceSubjectAssignments({
+    subject: { type: 'user', id: savedUser.data.id },
+    managedPermissionSets: ['submission-editor'],
+    permissionSets: ['submission-editor'],
+  });
+  const editorRequest = request({ key: 'created-by-editor', grants: [] });
+  expect(
+    (await reader.fetch('/authorization/permissionSets', editorRequest)).status,
+  ).toBe(201);
+  await authz.permissionSets.replaceSubjectAssignments({
+    subject: { type: 'user', id: savedUser.data.id },
+    managedPermissionSets: ['submission-editor'],
+    permissionSets: [],
+  });
+  expect(
+    (await reader.fetch('/authorization/permissionSets', editorRequest)).status,
+  ).toBe(403);
+  for (const [action, body, expected] of [
+    ['resetPassword', { password: 'Changed-test-123!' }, 204],
+    ['disable', {}, 200],
+    ['enable', {}, 200],
+    ['revokeSessions', {}, 204],
+  ] as const) {
+    const init = request(body);
+    const path = `/users/${savedUser.data.id}/${action}`;
+    const first = await admin.fetch(path, init);
+    expect(first.status).toBe(expected);
+    const second = await admin.fetch(path, init);
+    expect(second.status).toBe(expected);
+    expect(await second.text()).toEqual(await first.text());
+    expect(second.headers.get('Idempotency-Replayed')).toBe('true');
+  }
+  const deleteRole = {
+    ...request(null, createOperationKey(), 'DELETE'),
+    body: undefined,
+  };
+  expect(
+    (
+      await admin.fetch(
+        '/authorization/permissionSets/created-by-editor',
+        deleteRole,
+      )
+    ).status,
+  ).toBe(204);
+  const deletedRoleReplay = await admin.fetch(
+    '/authorization/permissionSets/created-by-editor',
+    deleteRole,
+  );
+  expect(deletedRoleReplay.status).toBe(204);
+  expect(deletedRoleReplay.headers.get('Idempotency-Replayed')).toBe('true');
+});
+
+test('default-access create update and delete replay without repeating preconditions', async ({
+  testApp,
+  app,
+  connection,
+}) => {
+  const admin = await signIn(testApp, DEFAULT_ADMIN_CREDENTIALS);
+  await connection.builder.createCollection('receiptExamples', (c) => {
+    c.string('id').primary();
+  });
+  app.container
+    .resolve(authorizationToken)
+    .database.collections.add({ name: 'receiptExamples' });
+  const rule = {
+    key: 'receipt-default',
+    resource: { type: 'database.collection', id: 'receiptExamples' },
+    actions: [{ action: 'read', selection: { type: 'all' } }],
+  };
+  for (const [path, init, expected] of [
+    ['/authorization/defaultAccess', request(rule), 201],
+    [
+      '/authorization/defaultAccess/receipt-default',
+      request({ actions: [] }, createOperationKey(), 'PATCH'),
+      200,
+    ],
+    [
+      '/authorization/defaultAccess/receipt-default',
+      { ...request(null, createOperationKey(), 'DELETE'), body: undefined },
+      204,
+    ],
+  ] as const) {
+    const first = await admin.fetch(path, init);
+    expect(first.status).toBe(expected);
+    const replay = await admin.fetch(path, init);
+    expect(replay.status).toBe(expected);
+    expect(await replay.text()).toEqual(await first.text());
+    expect(replay.headers.get('Idempotency-Replayed')).toBe('true');
+  }
+});