@opensaas/stack-core 0.30.0 → 0.31.1

package/tests/context.test.ts

@@ -202,6 +202,696 @@ describe('getContext', () => {
       })
     })
 
+    describe('removeRelated (relationship-table row removal)', () => {
+      it('unlinks a to-one back-reference via an update on the related list', async () => {
+        const existing = { id: 'p1', title: 'T', content: 'c', authorId: 'u1' }
+        mockPrisma.post.findUnique.mockResolvedValue(existing)
+        mockPrisma.post.update.mockResolvedValue({ id: 'p1', title: 'T', authorId: null })
+
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'removeRelated',
+          mode: 'disconnect',
+          id: 'p1',
+          field: 'author',
+          parentId: 'u1',
+        })
+
+        // Disconnect is an UPDATE on the related list nulling the back-reference
+        // (a to-one back-ref disconnects with `true`), never a delete. The
+        // distinct `{ removed }` shape avoids a redirect-on-success wrapper.
+        expect(mockPrisma.post.update).toHaveBeenCalled()
+        const updateArg = mockPrisma.post.update.mock.calls[0][0]
+        expect(updateArg.where).toEqual({ id: 'p1' })
+        expect(updateArg.data.author).toEqual({ disconnect: true })
+        expect(mockPrisma.post.delete).not.toHaveBeenCalled()
+        expect(result).toEqual({ removed: true })
+      })
+
+      it('deletes the related row when mode is delete', async () => {
+        mockPrisma.post.findUnique.mockResolvedValue({ id: 'p1', title: 'T', authorId: 'u1' })
+        mockPrisma.post.delete.mockResolvedValue({ id: 'p1', title: 'T' })
+
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'removeRelated',
+          mode: 'delete',
+          id: 'p1',
+        })
+
+        expect(mockPrisma.post.delete).toHaveBeenCalled()
+        expect(mockPrisma.post.update).not.toHaveBeenCalled()
+        expect(result).toEqual({ removed: true })
+      })
+
+      it('disconnects a to-many back-reference by parent id (many-to-many)', async () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const m2mPrisma: any = {
+          lesson: {
+            findUnique: vi.fn().mockResolvedValue({ id: 'l1', title: 'L' }),
+            update: vi.fn().mockResolvedValue({ id: 'l1', title: 'L' }),
+            delete: vi.fn(),
+          },
+        }
+        const m2mConfig: OpenSaasConfig = {
+          db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+          lists: {
+            Lesson: {
+              fields: {
+                title: { type: 'text' },
+                teachers: { type: 'relationship', ref: 'Teacher.lessons', many: true },
+              },
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => true,
+                  delete: () => true,
+                },
+              },
+            },
+            Teacher: {
+              fields: {
+                name: { type: 'text' },
+                lessons: { type: 'relationship', ref: 'Lesson.teachers', many: true },
+              },
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => true,
+                  delete: () => true,
+                },
+              },
+            },
+          },
+        }
+
+        const context = await getContext(m2mConfig, m2mPrisma, { userId: 'u1' })
+        await context.serverAction({
+          listKey: 'Lesson',
+          action: 'removeRelated',
+          mode: 'disconnect',
+          id: 'l1',
+          field: 'teachers',
+          parentId: 't1',
+        })
+
+        const updateArg = m2mPrisma.lesson.update.mock.calls[0][0]
+        // A to-many back-reference disconnects the specific parent by id.
+        expect(updateArg.data.teachers).toEqual({ disconnect: { id: 't1' } })
+      })
+
+      it('returns a generic error (Silent failure) when the update is access-denied', async () => {
+        const deniedConfig: OpenSaasConfig = {
+          ...config,
+          lists: {
+            ...config.lists,
+            Post: {
+              ...config.lists.Post,
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => false, // no update access → disconnect denied
+                  delete: () => true,
+                },
+              },
+            },
+          },
+        }
+
+        const context = await getContext(deniedConfig, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'removeRelated',
+          mode: 'disconnect',
+          id: 'p1',
+          field: 'author',
+          parentId: 'u1',
+        })
+
+        // Denied: reported as not removed with a generic reason (no leak).
+        expect(result).toEqual({ removed: false, error: 'Access denied or operation failed' })
+      })
+    })
+
+    describe('bulkAction (custom list bulk actions, #736)', () => {
+      // A config whose Post list declares a custom bulk action that runs each
+      // selected id through the SECURED context (`context.db.post.update`), so
+      // access control + hooks apply per id.
+      function configWithPublishAction(
+        overrides?: Partial<import('../src/config/types.js').BulkAction>,
+      ): OpenSaasConfig {
+        return {
+          ...config,
+          lists: {
+            ...config.lists,
+            Post: {
+              ...config.lists.Post,
+              fields: {
+                ...config.lists.Post.fields,
+                status: { type: 'text' },
+              },
+              ui: {
+                listView: {
+                  bulkActions: [
+                    {
+                      key: 'publish',
+                      label: 'Publish',
+                      handler: async ({ ids, context }) => {
+                        let n = 0
+                        for (const id of ids) {
+                          const r = await context.db.post.update({
+                            where: { id },
+                            data: { status: 'published' },
+                          })
+                          if (r) n++
+                        }
+                        return { message: `Published ${n} of ${ids.length}` }
+                      },
+                      ...overrides,
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        }
+      }
+
+      it('runs the handler over the selected ids through the secured context', async () => {
+        mockPrisma.post.findUnique.mockImplementation(({ where }: { where: { id: string } }) =>
+          Promise.resolve({ id: where.id, title: 'T', content: 'c' }),
+        )
+        mockPrisma.post.update.mockImplementation(({ where }: { where: { id: string } }) =>
+          Promise.resolve({ id: where.id, status: 'published' }),
+        )
+
+        const context = await getContext(configWithPublishAction(), mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'bulkAction',
+          key: 'publish',
+          ids: ['p1', 'p2'],
+        })
+
+        // Each id went through the secured update delegate, not a raw call.
+        expect(mockPrisma.post.update).toHaveBeenCalledTimes(2)
+        expect(result).toEqual({ bulkAction: true, message: 'Published 2 of 2' })
+      })
+
+      it('absorbs a per-id Silent failure into the handler count (no leak)', async () => {
+        // Update access scopes writes to id p1 only → p2 is denied and returns
+        // null through the secured delegate. The handler simply does not count
+        // it; the outcome never reveals which id was denied.
+        const scopedConfig = configWithPublishAction()
+        scopedConfig.lists.Post.access = {
+          operation: {
+            query: () => true,
+            create: () => true,
+            update: () => ({ id: { equals: 'p1' } }),
+            delete: () => true,
+          },
+        }
+        // The access filter merges into the existence pre-check: only p1 is
+        // visible, so p2's update is denied (Silent failure → null) before it
+        // ever reaches the update delegate.
+        mockPrisma.post.findUnique.mockImplementation(({ where }: { where: { id: string } }) =>
+          where.id === 'p1'
+            ? Promise.resolve({ id: 'p1', title: 'T', content: 'c' })
+            : Promise.resolve(null),
+        )
+        // The filter-match re-check (mergeFilters) only ever runs for the row
+        // that passed the existence pre-check (p1), so returning it is enough.
+        mockPrisma.post.findFirst.mockResolvedValue({ id: 'p1', title: 'T', content: 'c' })
+        mockPrisma.post.update.mockResolvedValue({ id: 'p1', status: 'published' })
+
+        const context = await getContext(scopedConfig, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'bulkAction',
+          key: 'publish',
+          ids: ['p1', 'p2'],
+        })
+
+        expect(result).toEqual({ bulkAction: true, message: 'Published 1 of 2' })
+      })
+
+      it('returns an error for an unknown action key', async () => {
+        const context = await getContext(configWithPublishAction(), mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'bulkAction',
+          key: 'nope',
+          ids: ['p1'],
+        })
+
+        expect(result).toMatchObject({ bulkAction: false })
+      })
+
+      it('re-checks hasAccess server-side so a hidden action cannot be invoked', async () => {
+        const context = await getContext(
+          configWithPublishAction({ hasAccess: () => false }),
+          mockPrisma,
+          { userId: 'u1' },
+        )
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'bulkAction',
+          key: 'publish',
+          ids: ['p1', 'p2'],
+        })
+
+        expect(result).toEqual({ bulkAction: false, error: 'Access denied' })
+        // The handler never ran.
+        expect(mockPrisma.post.update).not.toHaveBeenCalled()
+      })
+
+      it('returns a generic message (not the internal text) and logs when the handler throws a plain Error', async () => {
+        // An unexpected, non-Prisma, non-known-error bug inside the handler must
+        // not surface its internal message to the client (#761).
+        const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+        try {
+          const context = await getContext(
+            configWithPublishAction({
+              handler: async () => {
+                throw new Error('secret internal detail: connection string leaked')
+              },
+            }),
+            mockPrisma,
+            { userId: 'u1' },
+          )
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'bulkAction',
+            key: 'publish',
+            ids: ['p1', 'p2'],
+          })
+
+          // Client sees the generic fallback — never the internal message.
+          expect(result).toEqual({ bulkAction: false, error: 'Action failed' })
+          if ('error' in result) {
+            expect(result.error).not.toContain('secret internal detail')
+          }
+          // The real error is logged server-side for the operator.
+          expect(consoleError).toHaveBeenCalled()
+          const loggedArgs = consoleError.mock.calls[0]
+          expect(loggedArgs.some((arg) => arg instanceof Error)).toBe(true)
+        } finally {
+          consoleError.mockRestore()
+        }
+      })
+    })
+
+    describe('updateRelated (relationship-table inline cell edit)', () => {
+      it('updates a single field on the related row through the secured context', async () => {
+        mockPrisma.post.findUnique.mockResolvedValue({
+          id: 'p1',
+          title: 'Old',
+          content: 'c',
+          authorId: 'u1',
+        })
+        mockPrisma.post.update.mockResolvedValue({
+          id: 'p1',
+          title: 'New',
+          content: 'c',
+          authorId: 'u1',
+        })
+
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'updateRelated',
+          id: 'p1',
+          field: 'title',
+          value: 'New',
+        })
+
+        // The edit is an UPDATE on the RELATED list, one field only. The distinct
+        // `{ updated }` shape avoids a redirect-on-success wrapper.
+        expect(mockPrisma.post.update).toHaveBeenCalled()
+        const updateArg = mockPrisma.post.update.mock.calls[0][0]
+        expect(updateArg.where).toEqual({ id: 'p1' })
+        expect(updateArg.data.title).toBe('New')
+        expect(mockPrisma.post.delete).not.toHaveBeenCalled()
+        expect(result).toEqual({ updated: true })
+      })
+
+      it('returns a generic error (Silent failure) when the update is access-denied', async () => {
+        const deniedConfig: OpenSaasConfig = {
+          ...config,
+          lists: {
+            ...config.lists,
+            Post: {
+              ...config.lists.Post,
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => false, // no update access → inline edit denied
+                  delete: () => true,
+                },
+              },
+            },
+          },
+        }
+
+        const context = await getContext(deniedConfig, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'updateRelated',
+          id: 'p1',
+          field: 'title',
+          value: 'New',
+        })
+
+        // Denied: reported as not updated with a generic reason (no denied-vs-absent leak).
+        expect(result).toEqual({ updated: false, error: 'Access denied or operation failed' })
+      })
+
+      it('surfaces a validation error so the cell can revert with a reason', async () => {
+        const validationConfig: OpenSaasConfig = {
+          ...config,
+          lists: {
+            ...config.lists,
+            Post: {
+              ...config.lists.Post,
+              hooks: {
+                validateInput: async (args) => {
+                  if (args.operation === 'delete') return
+                  const { resolvedData, addValidationError } = args
+                  if (resolvedData.title === 'spam') {
+                    addValidationError('Title cannot contain the word "spam"')
+                  }
+                },
+              },
+            },
+          },
+        }
+        mockPrisma.post.findUnique.mockResolvedValue({
+          id: 'p1',
+          title: 'Old',
+          content: 'c',
+          authorId: 'u1',
+        })
+
+        const context = await getContext(validationConfig, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'updateRelated',
+          id: 'p1',
+          field: 'title',
+          value: 'spam',
+        })
+
+        // A validation error becomes { updated: false } with the reason; the write
+        // never reaches the database.
+        expect(mockPrisma.post.update).not.toHaveBeenCalled()
+        expect(result).toMatchObject({ updated: false })
+        const failure = result as { updated: boolean; error?: string }
+        expect(failure.error).toContain('spam')
+      })
+    })
+
+    describe('createRelated (relationship-table pre-linked create)', () => {
+      it('creates a row on the related list with the to-one back-reference preset to the parent', async () => {
+        const created = { id: 'p1', title: 'New', content: 'c', authorId: 'u1' }
+        mockPrisma.post.create.mockResolvedValue(created)
+        // The connect target must be reachable (the related list's read access).
+        mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'createRelated',
+          data: { title: 'New', content: 'c' },
+          field: 'author',
+          parentId: 'u1',
+        })
+
+        // The back-reference is set on the SERVER (a to-one back-ref connects a
+        // single parent), so the new row links to exactly the parent being edited.
+        expect(mockPrisma.post.create).toHaveBeenCalled()
+        const createArg = mockPrisma.post.create.mock.calls[0][0]
+        expect(createArg.data.title).toBe('New')
+        expect(createArg.data.author).toEqual({ connect: { id: 'u1' } })
+        // Distinct `{ created }` shape (never a single-op `success`).
+        expect(result).toEqual({ created: true, id: 'p1' })
+      })
+
+      it('connects a to-many back-reference by parent id (many-to-many)', async () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const m2mPrisma: any = {
+          lesson: {
+            findUnique: vi.fn(),
+            update: vi.fn(),
+            delete: vi.fn(),
+            create: vi.fn().mockResolvedValue({ id: 'l1', title: 'L' }),
+          },
+          teacher: {
+            findUnique: vi.fn().mockResolvedValue({ id: 't1' }),
+            update: vi.fn(),
+            delete: vi.fn(),
+            create: vi.fn(),
+          },
+        }
+        const m2mConfig: OpenSaasConfig = {
+          db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+          lists: {
+            Lesson: {
+              fields: {
+                title: { type: 'text' },
+                teachers: { type: 'relationship', ref: 'Teacher.lessons', many: true },
+              },
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => true,
+                  delete: () => true,
+                },
+              },
+            },
+            Teacher: {
+              fields: {
+                name: { type: 'text' },
+                lessons: { type: 'relationship', ref: 'Lesson.teachers', many: true },
+              },
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => true,
+                  delete: () => true,
+                },
+              },
+            },
+          },
+        }
+
+        const context = await getContext(m2mConfig, m2mPrisma, { userId: 'u1' })
+        await context.serverAction({
+          listKey: 'Lesson',
+          action: 'createRelated',
+          data: { title: 'L' },
+          field: 'teachers',
+          parentId: 't1',
+        })
+
+        const createArg = m2mPrisma.lesson.create.mock.calls[0][0]
+        // A to-many back-reference connects the parent by id.
+        expect(createArg.data.teachers).toEqual({ connect: [{ id: 't1' }] })
+      })
+
+      // Security-critical invariant (#758): the server sets the back-reference by
+      // spreading client `data` and THEN overwriting `data[field]` from the
+      // trusted `parentId`, so a HOSTILE client-supplied `data[field]` can never
+      // re-target the link to a different parent. These lock that overwrite for
+      // both the to-one and the to-many back-reference shapes.
+      it('overwrites a hostile client-supplied to-one back-reference with the trusted parentId', async () => {
+        const created = { id: 'p1', title: 'New', authorId: 'u1' }
+        mockPrisma.post.create.mockResolvedValue(created)
+        // The connect target must be reachable (the related list's read access).
+        mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        await context.serverAction({
+          listKey: 'Post',
+          action: 'createRelated',
+          // Hostile: the client tries to re-target the link to a different parent
+          // by supplying the back-reference field itself.
+          data: { title: 'New', author: 'evil-id' },
+          field: 'author',
+          parentId: 'u1',
+        })
+
+        // The server OVERWRITES the spread-in hostile value with a connect to the
+        // trusted parentId — the evil id never reaches the secured create.
+        const createArg = mockPrisma.post.create.mock.calls[0][0]
+        expect(createArg.data.author).toEqual({ connect: { id: 'u1' } })
+        expect(createArg.data.author).not.toBe('evil-id')
+      })
+
+      it('overwrites a hostile client-supplied to-many back-reference with the trusted parentId', async () => {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const m2mPrisma: any = {
+          lesson: {
+            findUnique: vi.fn(),
+            update: vi.fn(),
+            delete: vi.fn(),
+            create: vi.fn().mockResolvedValue({ id: 'l1', title: 'L' }),
+          },
+          teacher: {
+            findUnique: vi.fn().mockResolvedValue({ id: 't1' }),
+            update: vi.fn(),
+            delete: vi.fn(),
+            create: vi.fn(),
+          },
+        }
+        const m2mConfig: OpenSaasConfig = {
+          db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+          lists: {
+            Lesson: {
+              fields: {
+                title: { type: 'text' },
+                teachers: { type: 'relationship', ref: 'Teacher.lessons', many: true },
+              },
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => true,
+                  delete: () => true,
+                },
+              },
+            },
+            Teacher: {
+              fields: {
+                name: { type: 'text' },
+                lessons: { type: 'relationship', ref: 'Lesson.teachers', many: true },
+              },
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => true,
+                  update: () => true,
+                  delete: () => true,
+                },
+              },
+            },
+          },
+        }
+
+        const context = await getContext(m2mConfig, m2mPrisma, { userId: 'u1' })
+        await context.serverAction({
+          listKey: 'Lesson',
+          action: 'createRelated',
+          // Hostile: the client tries to connect a different teacher.
+          data: { title: 'L', teachers: { connect: [{ id: 'evil-id' }] } },
+          field: 'teachers',
+          parentId: 't1',
+        })
+
+        // The to-many back-reference is overwritten to connect exactly the trusted
+        // parent by id — the hostile connect is discarded.
+        const createArg = m2mPrisma.lesson.create.mock.calls[0][0]
+        expect(createArg.data.teachers).toEqual({ connect: [{ id: 't1' }] })
+      })
+
+      // Defensive guard (#758): malformed direct calls (unreachable from the
+      // drawer, which always sends a valid relationship back-reference plus both
+      // field and parentId) are rejected rather than degrading to an unguarded
+      // create.
+      it('rejects a malformed call supplying only one of field/parentId (defensive guard)', async () => {
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'createRelated',
+          data: { title: 'New', author: 'evil-id' },
+          field: 'author',
+          // parentId omitted — a lone back-reference field is malformed.
+        })
+
+        expect(result).toEqual({
+          created: false,
+          error: 'createRelated requires both field and parentId, or neither',
+        })
+        // The unguarded create is never attempted.
+        expect(mockPrisma.post.create).not.toHaveBeenCalled()
+      })
+
+      it('rejects a back-reference that does not name a relationship field (defensive guard)', async () => {
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'createRelated',
+          data: { title: 'New' },
+          field: 'title', // a scalar field, not a relationship
+          parentId: 'u1',
+        })
+
+        expect(result).toMatchObject({ created: false })
+        expect(mockPrisma.post.create).not.toHaveBeenCalled()
+      })
+
+      it('returns a generic error (Silent failure) when the create is access-denied', async () => {
+        const deniedConfig: OpenSaasConfig = {
+          ...config,
+          lists: {
+            ...config.lists,
+            Post: {
+              ...config.lists.Post,
+              access: {
+                operation: {
+                  query: () => true,
+                  create: () => false, // no create access → create denied
+                  update: () => true,
+                  delete: () => true,
+                },
+              },
+            },
+          },
+        }
+
+        const context = await getContext(deniedConfig, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'createRelated',
+          data: { title: 'New' },
+          field: 'author',
+          parentId: 'u1',
+        })
+
+        // Denied: reported as not created with a generic reason (no leak). The
+        // create is never attempted at the Prisma layer.
+        expect(result).toEqual({ created: false, error: 'Access denied or operation failed' })
+        expect(mockPrisma.post.create).not.toHaveBeenCalled()
+      })
+
+      it('surfaces field errors from the create (e.g. a unique constraint) in the drawer shape', async () => {
+        mockPrisma.post.create.mockRejectedValue({ code: 'P2002', meta: { target: ['title'] } })
+        mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+        const context = await getContext(config, mockPrisma, { userId: 'u1' })
+        const result = await context.serverAction({
+          listKey: 'Post',
+          action: 'createRelated',
+          data: { title: 'Dup' },
+          field: 'author',
+          parentId: 'u1',
+        })
+
+        // Parsed to a distinct { created: false } with per-field errors the drawer
+        // renders — never a single-op `success` envelope.
+        expect(result).toMatchObject({ created: false })
+        const created = result as { created: boolean; fieldErrors?: Record<string, string> }
+        expect(created.fieldErrors?.title).toBeDefined()
+      })
+    })
+
     describe('relationshipOptions', () => {
       it('returns { id, label }[] for the related list, unfiltered/unincluded', async () => {
         mockPrisma.user.findMany.mockResolvedValue([