@opensaas/stack-core 0.27.0 → 0.28.0

package/tests/plugin-engine.test.ts

@@ -681,8 +681,8 @@ describe('Plugin Engine', () => {
     })
   })
 
-  describe('access control merging', () => {
-    test('merges access control from plugins', async () => {
+  describe('access control guardrail (ADR-0013)', () => {
+    test('throws when an extension carries operation access for a pre-existing list', async () => {
       const plugin: Plugin = {
         name: 'test-plugin',
         init: async (context) => {
@@ -711,23 +711,19 @@ describe('Plugin Engine', () => {
         plugins: [plugin],
       }
 
-      const result = await executePlugins(config)
-
-      expect(result.lists.Post.access?.operation?.query).toBeDefined()
-      expect(result.lists.Post.access?.operation?.create).toBeDefined()
-      expect(result.lists.Post.access?.operation?.update).toBeDefined()
+      await expect(executePlugins(config)).rejects.toThrow(
+        'Plugin "test-plugin" tried to set operation-level access while extending list "Post"',
+      )
     })
 
-    test('plugin access control overrides existing', async () => {
-      const pluginQuery = vi.fn(() => false)
-
+    test('extension attempting to override existing access throws instead of silently winning', async () => {
       const plugin: Plugin = {
         name: 'test-plugin',
         init: async (context) => {
           context.extendList('Post', {
             access: {
               operation: {
-                query: pluginQuery,
+                query: () => false,
               },
             },
           })
@@ -750,10 +746,67 @@ describe('Plugin Engine', () => {
         plugins: [plugin],
       }
 
+      await expect(executePlugins(config)).rejects.toThrow('Post')
+
+      // The host's access is untouched — the throw happens before any mutation.
+      expect(config.lists.Post.access?.operation?.query).toBe(originalQuery)
+    })
+
+    test('extension providing only fields/hooks for a pre-existing list leaves its access untouched', async () => {
+      const originalQuery = vi.fn(() => true)
+
+      const plugin: Plugin = {
+        name: 'test-plugin',
+        init: async (context) => {
+          context.extendList('Post', {
+            fields: { views: integer() },
+          })
+        },
+      }
+
+      const config: OpenSaasConfig = {
+        lists: {
+          Post: {
+            fields: { title: text() },
+            access: {
+              operation: {
+                query: originalQuery,
+              },
+            },
+          },
+        },
+        plugins: [plugin],
+      }
+
+      const result = await executePlugins(config)
+
+      expect(result.lists.Post.fields.views).toBeDefined()
+      expect(result.lists.Post.access?.operation?.query).toBe(originalQuery)
+    })
+
+    test('a plugin creating a new list may still set its access via addList', async () => {
+      const plugin: Plugin = {
+        name: 'test-plugin',
+        init: async (context) => {
+          context.addList('Widget', {
+            fields: { name: text() },
+            access: {
+              operation: {
+                query: () => true,
+              },
+            },
+          })
+        },
+      }
+
+      const config: OpenSaasConfig = {
+        lists: {},
+        plugins: [plugin],
+      }
+
       const result = await executePlugins(config)
 
-      // Plugin's access control should override original
-      expect(result.lists.Post.access?.operation?.query).toBe(pluginQuery)
+      expect(result.lists.Widget.access?.operation?.query).toBeDefined()
     })
   })
 

package/tests/sudo.test.ts

@@ -3,6 +3,8 @@ import { getContext } from '../src/context/index.js'
 import { config, list } from '../src/config/index.js'
 import { text, integer, relationship } from '../src/fields/index.js'
 import type { PrismaClient } from '@prisma/client'
+import type { Plugin } from '../src/config/types.js'
+import type { AccessContext } from '../src/access/types.js'
 
 describe('Sudo Context', () => {
   // Mock Prisma client
@@ -624,4 +626,51 @@ describe('Sudo Context', () => {
       ).rejects.toThrow('Access denied')
     })
   })
+
+  describe('Plugin runtime sudo access', () => {
+    // A plugin's `runtime(context, sudo)` factory receives a `sudo` helper as a
+    // plain second argument — NOT a method on `AccessContext` itself. A
+    // self-referential `sudo(): AccessContext` field on that shared, widely
+    // instantiated interface was found to break TypeScript's structural
+    // checking of unrelated generated Prisma types in a downstream app
+    // (nullable JSON `CreateInput` fields); passing it as a separate argument
+    // avoids that recursion while still giving plugins (e.g. the auth
+    // plugin's getUser/getCurrentUser, see ADR-0013) an access-bypassing
+    // identity-lookup path.
+    it('passes a working sudo() as the second argument to plugin.runtime()', async () => {
+      let capturedSudo: (() => AccessContext<typeof mockPrisma>) | undefined
+
+      const plugin: Plugin = {
+        name: 'test-plugin',
+        init: async () => {},
+        runtime: (_context, sudo) => {
+          capturedSudo = sudo as () => AccessContext<typeof mockPrisma>
+          return {}
+        },
+      }
+
+      const pluginConfig = await config({
+        db: { provider: 'sqlite' },
+        plugins: [plugin],
+        lists: {
+          Post: list({
+            fields: { title: text({ validation: { isRequired: true } }) },
+            // Closed list: only sudo() should be able to read from it.
+            access: { operation: { query: () => false } },
+          }),
+        },
+      })
+
+      mockPrisma.post.findMany.mockResolvedValue([{ id: '1', title: 'Test Post' }])
+
+      getContext(pluginConfig, mockPrisma, null)
+
+      expect(capturedSudo).toBeTypeOf('function')
+
+      const sudoContext = capturedSudo!()
+      const sudoResult = await sudoContext.db.post.findMany()
+      expect(sudoResult).toHaveLength(1)
+      expect(sudoResult[0].title).toBe('Test Post')
+    })
+  })
 })