@ossy/resources 1.7.0 → 1.8.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ossy/resources",
   "description": "Resource domain — aggregate and events for the Ossy resource model",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "private": false,
   "type": "module",
   "main": "./src/index.js",
@@ -9,11 +9,20 @@
   "exports": {
     ".": "./src/index.js"
   },
+  "scripts": {
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest --verbose"
+  },
   "author": "Ossy <yourfriends@ossy.se> (https://ossy.se)",
   "license": "MIT",
   "ossy": {
     "src": "./src"
   },
+  "devDependencies": {
+    "@jest/globals": "^30.2.0",
+    "@ossy/platform": "^1.35.0",
+    "casual": "^1.6.2",
+    "jest": "^30.2.0"
+  },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -22,5 +31,5 @@
     "/src",
     "README.md"
   ],
-  "gitHead": "c6697078268867d88553ca0bac08faad5cea1546"
+  "gitHead": "24df2bde0d5d8794c5a82b9e802a2594ca73a5d9"
 }

package/src/access-filter.spec.js

@@ -0,0 +1,134 @@
+import { accessFilter } from './resources.queries.js'
+
+// Helper to build a minimal Policy aggregate document that policyToQueryClause expects.
+function makePolicy({ effect = 'allow', actions = ['resource:read'], where = {} } = {}) {
+  return {
+    state: {
+      effect,
+      actions,
+      where: {
+        workspace: '*',
+        location: '*',
+        type: '*',
+        ...where,
+      },
+    },
+  }
+}
+
+// ---------------------------------------------------------------------------
+// accessFilter
+// ---------------------------------------------------------------------------
+
+describe('accessFilter', () => {
+
+  describe('anonymous user', () => {
+    it('returns only the public condition', () => {
+      const filter = accessFilter({ anonymous: true })
+      expect(filter).toEqual({
+        $or: [
+          { 'state.access': 'public' },
+        ],
+      })
+    })
+  })
+
+  describe('authenticated user with no workspaces and no policies', () => {
+    it('returns only the public condition', () => {
+      const user = { id: 'u-1', workspaces: [], policies: [] }
+      const filter = accessFilter(user)
+      expect(filter).toEqual({
+        $or: [
+          { 'state.access': 'public' },
+        ],
+      })
+    })
+  })
+
+  describe('authenticated user with workspaces', () => {
+    it('includes workspace condition with all workspace ids in $in', () => {
+      const user = { id: 'u-1', workspaces: ['ws-1', 'ws-2'], policies: [] }
+      const filter = accessFilter(user)
+      expect(filter.$or).toContainEqual({
+        'state.access': { $in: ['public', 'workspace'] },
+        'state.belongsTo': { $in: ['ws-1', 'ws-2'] },
+      })
+    })
+
+    it('still includes the public condition alongside the workspace condition', () => {
+      const user = { id: 'u-1', workspaces: ['ws-1'], policies: [] }
+      const filter = accessFilter(user)
+      expect(filter.$or).toContainEqual({ 'state.access': 'public' })
+    })
+
+    it('includes all workspace ids in the $in clause', () => {
+      const workspaces = ['ws-a', 'ws-b', 'ws-c']
+      const filter = accessFilter({ id: 'u-1', workspaces, policies: [] })
+      const workspaceCondition = filter.$or.find(c => c['state.belongsTo'])
+      expect(workspaceCondition['state.belongsTo'].$in).toEqual(workspaces)
+    })
+  })
+
+  describe('authenticated user with allow policies', () => {
+    it('includes a restricted condition for each matching allow policy', () => {
+      const policy = makePolicy({ where: { workspace: 'ws-1' } })
+      const user = { id: 'u-1', workspaces: [], policies: [policy] }
+      const filter = accessFilter(user)
+      expect(filter.$or).toContainEqual(
+        expect.objectContaining({ 'state.access': 'restricted', 'state.belongsTo': 'ws-1' })
+      )
+    })
+
+    it('policy with effect deny is not included', () => {
+      const denyPolicy = makePolicy({ effect: 'deny' })
+      const user = { id: 'u-1', workspaces: [], policies: [denyPolicy] }
+      const filter = accessFilter(user)
+      const restrictedConditions = filter.$or.filter(c => c['state.access'] === 'restricted')
+      expect(restrictedConditions).toHaveLength(0)
+    })
+
+    it('policy without resource:read action is not included', () => {
+      const writeOnlyPolicy = makePolicy({ actions: ['resource:write'] })
+      const user = { id: 'u-1', workspaces: [], policies: [writeOnlyPolicy] }
+      const filter = accessFilter(user)
+      const restrictedConditions = filter.$or.filter(c => c['state.access'] === 'restricted')
+      expect(restrictedConditions).toHaveLength(0)
+    })
+
+    it('wildcard workspace policy does not add state.belongsTo to the clause', () => {
+      const policy = makePolicy({ where: { workspace: '*' } })
+      const user = { id: 'u-1', workspaces: [], policies: [policy] }
+      const filter = accessFilter(user)
+      const restrictedCondition = filter.$or.find(c => c['state.access'] === 'restricted')
+      expect(restrictedCondition['state.belongsTo']).toBeUndefined()
+    })
+
+    it('includes one restricted clause per valid allow policy', () => {
+      const policies = [
+        makePolicy({ where: { workspace: 'ws-1' } }),
+        makePolicy({ where: { workspace: 'ws-2' } }),
+      ]
+      const user = { id: 'u-1', workspaces: [], policies }
+      const filter = accessFilter(user)
+      const restrictedConditions = filter.$or.filter(c => c['state.access'] === 'restricted')
+      expect(restrictedConditions).toHaveLength(2)
+    })
+  })
+
+  describe('null / undefined user', () => {
+    it('returns only the public condition for null user', () => {
+      const filter = accessFilter(null)
+      expect(filter.$or).toContainEqual({ 'state.access': 'public' })
+      const nonPublic = filter.$or.filter(c => c['state.access'] !== 'public')
+      expect(nonPublic).toHaveLength(0)
+    })
+
+    it('returns only the public condition for undefined user', () => {
+      const filter = accessFilter(undefined)
+      expect(filter.$or).toContainEqual({ 'state.access': 'public' })
+      const nonPublic = filter.$or.filter(c => c['state.access'] !== 'public')
+      expect(nonPublic).toHaveLength(0)
+    })
+  })
+
+})

package/src/resources.queries.js

@@ -30,7 +30,7 @@ function policyToQueryClause(policy) {
   return clause
 }
 
-function accessFilter(user) {
+export function accessFilter(user) {
   const conditions = [{ 'state.access': 'public' }]
 
   if (!user?.anonymous) {

package/src/resources.spec.js

@@ -0,0 +1,147 @@
+import casual from 'casual'
+import { TestUtil } from '@ossy/platform/test'
+
+function workspaceHeaders(userToken, workspaceId) {
+  return {
+    'Content-Type': 'application/json',
+    Authorization: userToken,
+    workspaceId,
+  }
+}
+
+describe('[/resources][POST]', () => {
+
+  TestUtil.AssertAuthenticationNeeded({
+    endpoint: '/resources',
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'workspaceId': 'ws-test' },
+  })
+
+})
+
+describe('[/resources][GET]', () => {
+  TestUtil.AssertAuthenticationNeeded({
+    endpoint: '/resources',
+    method: 'GET',
+    headers: { 'Content-Type': 'application/json', 'workspaceId': 'ws-test' },
+  })
+})
+
+describe('[/resources/:resourceId][GET]', () => {
+  TestUtil.AssertAuthenticationNeeded({
+    endpoint: '/resources/r1',
+    method: 'GET',
+    headers: { 'Content-Type': 'application/json', 'workspaceId': 'ws-test' },
+  })
+})
+
+describe('[/resources/:resourceId/name][PUT]', () => {
+  TestUtil.AssertAuthenticationNeeded({
+    endpoint: '/resources/r1/name',
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json', 'workspaceId': 'ws-test' },
+  })
+})
+
+describe('[/resources/:resourceId/location][PUT]', () => {
+  TestUtil.AssertAuthenticationNeeded({
+    endpoint: '/resources/r1/location',
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json', 'workspaceId': 'ws-test' },
+  })
+})
+
+describe('[/resources/:resourceId/content][PUT]', () => {
+  TestUtil.AssertAuthenticationNeeded({
+    endpoint: '/resources/r1/content',
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json', 'workspaceId': 'ws-test' },
+  })
+})
+
+describe('[/resources/:resourceId][DELETE]', () => {
+  TestUtil.AssertAuthenticationNeeded({
+    endpoint: '/resources/r1',
+    method: 'DELETE',
+    headers: { 'Content-Type': 'application/json', 'workspaceId': 'ws-test' },
+  })
+})
+
+describe('E2E: template-backed resource (workspaceId header)', () => {
+  it('create → update content → delete', async () => {
+    const user = await TestUtil.GetAuthenticatedTestUser()
+    const workspace = await TestUtil.MakeRequest({
+      endpoint: '/workspaces',
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: user.token },
+      body: JSON.stringify({ name: casual.word }),
+    }).then(r => r.json())
+
+    const templateType = '@ossy/web/page'
+    const createBody = {
+      location: '/',
+      type: templateType,
+      name: `page-${casual.word}.json`,
+      content: {
+        title: 'Hello',
+        description: 'D',
+        body: '<p>initial</p>',
+      },
+    }
+
+    const createRes = await TestUtil.MakeRequest({
+      endpoint: '/resources',
+      method: 'POST',
+      headers: workspaceHeaders(user.token, workspace.id),
+      body: JSON.stringify(createBody),
+    })
+
+    expect(createRes.status).toEqual(200)
+    const created = await createRes.json()
+    expect(created.type).toEqual(templateType)
+    expect(created.content).toEqual({
+      title: 'Hello',
+      description: 'D',
+      body: '<p>initial</p>',
+    })
+
+    const updateRes = await TestUtil.MakeRequest({
+      endpoint: `/resources/${created.id}/content`,
+      method: 'PUT',
+      headers: workspaceHeaders(user.token, workspace.id),
+      body: JSON.stringify({
+        content: {
+          title: 'Updated',
+          description: 'D2',
+          body: '<p>revised</p>',
+        },
+      }),
+    })
+
+    expect(updateRes.status).toEqual(200)
+    const updated = await updateRes.json()
+    expect(updated.content).toEqual({
+      title: 'Updated',
+      description: 'D2',
+      body: '<p>revised</p>',
+    })
+
+    const deleteRes = await TestUtil.MakeRequest({
+      endpoint: `/resources/${created.id}`,
+      method: 'DELETE',
+      headers: workspaceHeaders(user.token, workspace.id),
+    })
+
+    expect(deleteRes.status).toEqual(204)
+
+    const listRes = await TestUtil.MakeRequest({
+      endpoint: '/resources?location=/',
+      method: 'GET',
+      headers: workspaceHeaders(user.token, workspace.id),
+    })
+
+    expect(listRes.status).toEqual(200)
+    const list = await listRes.json()
+    expect(list.some(r => r.id === created.id)).toBe(false)
+  })
+})