@saltcorn/server 1.6.0-beta.1 → 1.6.0-beta.10

package/serve.js

@@ -24,11 +24,6 @@ const path = require("path");
 const getApp = require("./app");
 const Trigger = require("@saltcorn/data/models/trigger");
 const cluster = require("cluster");
-const {
-  loadAllPlugins,
-  loadAndSaveNewPlugin,
-  loadPlugin,
-} = require("./load_plugins");
 const { getConfig, setConfig } = require("@saltcorn/data/models/config");
 const { migrate } = require("@saltcorn/data/migrate");
 const socketio = require("socket.io");
@@ -255,7 +250,7 @@ const initMaster = async (
       async () => await migrate(db.connectObj.default_schema, true)
     );
   // load all plugins
-  await loadAllPlugins(true);
+  await Plugin.loadAllPlugins(true);
   // switch on sql logging - but it was initiated before???
   if (getState().getConfig("log_sql", false)) db.set_sql_logging();
 
@@ -265,7 +260,7 @@ const initMaster = async (
   if (db.is_it_multi_tenant()) {
     const tenants = await getAllTenants();
     await init_multi_tenant(
-      () => loadAllPlugins(true),
+      () => Plugin.loadAllPlugins(true),
       disableMigrate,
       tenants,
       db.connectObj.multi_node ? getMultiNodeListener : null
@@ -287,7 +282,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
 
   if (msg.refresh_plugin_cfg) {
     Plugin.findOne({ name: msg.refresh_plugin_cfg }).then((plugin) => {
-      if (plugin) loadPlugin(plugin);
+      if (plugin) Plugin.loadPlugin(plugin);
     });
   }
   if (!getState()) {
@@ -307,6 +302,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
       tenant || "public",
       msg.real_time_collab_event.type,
       msg.real_time_collab_event.data,
+      msg.real_time_collab_event.viewname,
       true
     );
   }
@@ -325,7 +321,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
   }
 
   if (msg.reload_plugins) {
-    loadAllPlugins(cluster.isPrimary, true);
+    Plugin.loadAllPlugins(cluster.isPrimary, true);
   }
   if (msg.refresh) {
     if (msg.refresh === "ephemeral_config")
@@ -337,7 +333,7 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
     add_tenant(msg.createTenant);
     create_tenant({
       t: msg.createTenant,
-      plugin_loader: loadAllPlugins,
+      plugin_loader: Plugin.loadAllPlugins,
       noSignalOrDB: true,
       tenant_template,
     });
@@ -346,9 +342,9 @@ const workerDispatchMsg = ({ tenant, ...msg }) => {
     });
   }
   if (msg.installPlugin) {
-    loadAndSaveNewPlugin(msg.installPlugin, msg.force, true);
+    Plugin.loadAndSaveNewPlugin(msg.installPlugin, msg.force, true);
   }
-  if (msg.restart_tenant) restart_tenant(loadAllPlugins);
+  if (msg.restart_tenant) restart_tenant(Plugin.loadAllPlugins);
   if (msg.removePlugin) getState().remove_plugin(msg.removePlugin, true);
 };
 
@@ -508,7 +504,7 @@ module.exports =
           4,
           "SIGHUP received: reloading plugins and state for all tenants"
         );
-        await loadAllPlugins(true, true);
+        await Plugin.loadAllPlugins(true, true);
         await getState().refresh_plugins(true);
         Object.entries(cluster.workers || {}).forEach(([wpid, w]) => {
           w.send({ reload_plugins: true });
@@ -516,7 +512,7 @@ module.exports =
         if (db.is_it_multi_tenant()) {
           for (const tenant of await getAllTenants()) {
             await db.runWithTenant(tenant, async () => {
-              await loadAllPlugins(true, true);
+              await Plugin.loadAllPlugins(true, true);
               await getState().refresh_plugins(true);
               Object.entries(cluster.workers || {}).forEach(([wpid, w]) => {
                 w.send({ tenant, reload_plugins: true });
@@ -850,22 +846,35 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
   });
 
   // Real-time collaboration emitter (tied to views)
-  getState().setCollabEmitter((tenant, type, data) => {
-    io.of("/").to(`_${tenant}_collab_room_`).emit(type, data);
+  getState().setCollabEmitter((tenant, type, data, viewname) => {
+    io.of("/").to(`_${tenant}_collab_room_${viewname}_`).emit(type, data);
   });
 
   // dynamic updates emitter (for run_js_actions)
   getState().setDynamicUpdateEmitter((tenant, data, userIds) => {
-    if (userIds) {
+    if (userIds === null) {
+      // explicit public-only; data may carry page_load_tag for client-side filtering
+      io.of("/")
+        .to(`_${tenant}_public_dynamic_update_room`)
+        .emit("dynamic_update", data);
+    } else if (Array.isArray(userIds)) {
       for (const userId of userIds) {
         io.of("/")
           .to(`_${tenant}:${userId}_dynamic_update_room`)
           .emit("dynamic_update", data);
       }
-    } else {
+    } else if (userIds === undefined) {
+      // broadcast to all authenticated users in this tenant
       io.of("/")
         .to(`_${tenant}_dynamic_update_room`)
         .emit("dynamic_update", data);
+    } else {
+      getState().log(
+        1,
+        `setDynamicUpdateEmitter: unexpected userIds value: ${JSON.stringify(
+          userIds
+        )}`
+      );
     }
   });
 
@@ -932,9 +941,9 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
           const role_id = user ? user.role_id : 100;
           if (view.min_role < role_id)
             throw new Error("Not authorized to join collaboration room");
-          const roomName = `_${tenant}_collab_room_`;
+          const roomName = `_${tenant}_collab_room_${viewname}_`;
           if (!socket.rooms.has(roomName)) {
-            socket.join(`_${tenant}_collab_room_`);
+            socket.join(roomName);
             if (typeof callback === "function") callback({ status: "ok" });
             const socketIds = await getState().getConfig(
               "joined_real_time_socket_ids",
@@ -966,9 +975,12 @@ const setupSocket = (subdomainOffset, pruneSessionInterval, ...servers) => {
           const enabled = getState().getConfig("enable_dynamic_updates", true);
           if (!enabled) throw new Error("Dynamic updates are not enabled");
           const user = socket.request.user;
-          if (!user) throw new Error("Not authorized");
-          socket.join(`_${tenant}_dynamic_update_room`);
-          socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+          if (user) {
+            socket.join(`_${tenant}:${user.id}_dynamic_update_room`);
+            socket.join(`_${tenant}_dynamic_update_room`);
+          } else {
+            socket.join(`_${tenant}_public_dynamic_update_room`);
+          }
           const socketIds = await getState().getConfig(
             "joined_dynamic_update_socket_ids",
             []

package/tests/admin.test.js

@@ -25,7 +25,7 @@ const {
   auto_backup_now,
 } = require("@saltcorn/admin-models/models/backup");
 
-jest.setTimeout(30000);
+jest.setTimeout(30000000);
 
 beforeAll(async () => {
   await resetToFixtures();
@@ -387,7 +387,7 @@ describe("actions", () => {
       .send("table_id=2")
       .send("name=mynewaction")
       .send("when_trigger=Insert")
-      .expect(toRedirect("/actions/configure/8"));
+      .expect(toRedirect("/actions/configure/9"));
   });
   it("show edit", async () => {
     const app = await getApp({ disableCsrf: true });
@@ -451,9 +451,9 @@ describe("actions", () => {
       .send("action=run_js_code")
       .send("when_trigger=API+call")
       .send("min_role=1")
-      .expect(toRedirect("/actions/configure/9"));
+      .expect(toRedirect("/actions/configure/10"));
     await request(app)
-      .post("/actions/configure/9")
+      .post("/actions/configure/10")
       .set("Cookie", loginCookie)
       .send("code=return 27")
       .expect(toRedirect("/actions/"));
@@ -461,7 +461,7 @@ describe("actions", () => {
       .post("/api/action/myact")
       .set("Cookie", loginCookie)
       .expect(
-        respondJsonWith(200, ({ success, data }) => success && data === 27)
+        respondJsonWith(200, ({ success, data }) => success === true && data === 27)
       );
   });
   it("deletes trigger", async () => {

package/tests/api.test.js

@@ -760,7 +760,7 @@ describe("API emit", () => {
     const app = await getApp({ disableCsrf: true });
     const token = await getAdminJwt();
     await request(app)
-      .post("/api/emit-event/event1")
+      .post("/api/emit-event/ReceiveMobileShareData")
       .set("Authorization", `jwt ${token}`)
       .send({ payload: { latitude: 20, longitude: 30 } })
       .expect(succeedJsonWith((success) => success === true));
@@ -770,12 +770,137 @@ describe("API emit", () => {
   it("denies an event without JWT", async () => {
     const app = await getApp({ disableCsrf: true });
     await request(app)
-      .post("/api/emit-event/event1")
+      .post("/api/emit-event/ReceiveMobileShareData")
       .send({ payload: { latitude: 20, longitude: 30 } })
       .expect(notAuthorized);
   });
 });
 
+describe("API emit-event access control", () => {
+  const getPublicJwt = async () => {
+    const app = await getApp({ disableCsrf: true });
+    const res = await request(app)
+      .post("/auth/login-with/jwt")
+      .set("X-Requested-With", "XMLHttpRequest")
+      .set("X-Saltcorn-Client", "mobile-app")
+      .send({});
+    return res.body;
+  };
+
+  let adminJwt;
+  beforeAll(async () => {
+    adminJwt = await getAdminJwt();
+  });
+
+  afterEach(async () => {
+    await getState().setConfig("mobile_emit_allowed_events", []);
+    await getState().setConfig("mobile_emit_public_events", []);
+  });
+
+  // --- authenticated user ---
+
+  it("allows authenticated user to emit ReceiveMobileShareData by default", async () => {
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks authenticated user from emitting other events by default", async () => {
+    const app = await getApp({ disableCsrf: true });
+    for (const eventName of [
+      "AppChange",
+      "Login",
+      "Error",
+      "Startup",
+      "UserVerified",
+    ]) {
+      await request(app)
+        .post(`/api/emit-event/${eventName}`)
+        .set("Authorization", `jwt ${adminJwt}`)
+        .send({ payload: {} })
+        .expect(
+          respondJsonWith(
+            403,
+            (resp) => resp.error === "Event type not allowed"
+          )
+        );
+    }
+  });
+
+  it("allows authenticated user to emit event listed in mobile_emit_allowed_events config", async () => {
+    await getState().setConfig("mobile_emit_allowed_events", ["AppChange"]);
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/AppChange")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks authenticated user from emitting event not listed in mobile_emit_allowed_events config", async () => {
+    await getState().setConfig("mobile_emit_allowed_events", ["AppChange"]);
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/Login")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ payload: {} })
+      .expect(
+        respondJsonWith(403, (resp) => resp.error === "Event type not allowed")
+      );
+  });
+
+  // --- public user ---
+
+  it("blocks public JWT user from emitting any event by default", async () => {
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+
+  it("allows public JWT user to emit event listed in mobile_emit_public_events config", async () => {
+    await getState().setConfig("mobile_emit_public_events", [
+      "CustomerEnquiry",
+    ]);
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/CustomerEnquiry")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(succeedJsonWith((success) => success === true));
+  });
+
+  it("blocks public JWT user from emitting event not listed in mobile_emit_public_events config", async () => {
+    await getState().setConfig("mobile_emit_public_events", [
+      "CustomerEnquiry",
+    ]);
+    const publicJwt = await getPublicJwt();
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/OtherEvent")
+      .set("Authorization", `jwt ${publicJwt}`)
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+
+  // --- no token ---
+
+  it("blocks request with no JWT at all", async () => {
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/api/emit-event/ReceiveMobileShareData")
+      .send({ payload: {} })
+      .expect(notAuthorized);
+  });
+});
+
 describe("test share handler", () => {
   beforeAll(async () => {
     const sharedData = await Table.create("shared_data");
@@ -885,3 +1010,300 @@ describe("API upload-files", () => {
       .expect(respondJsonWith(400, (resp) => resp.error === "No file found"));
   });
 });
+
+describe("API cross-table sub-select access control", () => {
+  it("should not allow probing restricted tables via sub-select query syntax", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The patients table has min_role_read=40 (staff).
+    // A public user should not be able to learn anything about patients data.
+    // The books table is public (min_role_read=100).
+    // The sub-select syntax (e.g. ?id.patients->name=Kirk) constructs:
+    //   WHERE id IN (SELECT id FROM patients WHERE name ILIKE '%Kirk%')
+    // This leaks whether a patient named "Kirk" exists by observing
+    // whether any books are returned.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // Query WITH a name that exists in patients ("Kirk Douglas", id=1)
+    const resp1 = await request(app)
+      .get("/api/books/?id.patients->name=Kirk")
+      .expect(200);
+
+    // Query with a name that does NOT exist in patients
+    const resp2 = await request(app)
+      .get("/api/books/?id.patients->name=ZZZNONEXISTENT")
+      .expect(200);
+
+    // If the sub-select is allowed, resp1 returns books (because patient
+    // "Kirk Douglas" has id=1 which matches book id=1) while resp2
+    // returns nothing. The difference reveals that "Kirk" exists in the
+    // restricted patients table.
+    //
+    // The secure behavior is that both queries return the same results
+    // (the sub-select against a restricted table is ignored or blocked),
+    // OR the query with the sub-select is rejected entirely.
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via or parameter with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The patients table has min_role_read=40 (staff).
+    // The books table is public (min_role_read=100).
+    //
+    // The 'or' query parameter is passed directly through stateFieldsToWhere
+    // into the db where-clause without access control checks. An attacker
+    // can embed an inSelect subquery in 'or' to probe restricted tables:
+    //   ?or[0][id][inSelect][table]=patients&or[0][id][inSelect][field]=favbook
+    //    &or[0][id][inSelect][where][name]=Kirk Douglas
+    // This generates: WHERE (id IN (SELECT favbook FROM patients WHERE name='Kirk Douglas'))
+    // By observing which books are returned, the attacker can determine
+    // whether a patient with a given name exists — leaking data from the
+    // restricted patients table.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // Kirk Douglas exists in patients with favbook=1 (Herman Melville)
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "or[0][id][inSelect][table]": "patients",
+        "or[0][id][inSelect][field]": "favbook",
+        "or[0][id][inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    // Non-existent patient
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "or[0][id][inSelect][table]": "patients",
+        "or[0][id][inSelect][field]": "favbook",
+        "or[0][id][inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    // If the or+inSelect bypass works, resp1 returns only book id=1
+    // (Kirk Douglas's favbook) while resp2 returns nothing.
+    // Secure behavior: both return the same results (all books or error).
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via field object with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // When a field value is an object, stateFieldsToWhere passes it through
+    // directly. An attacker can embed inSelect in a known field name:
+    //   ?id[inSelect][table]=patients&id[inSelect][field]=favbook&...
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "id[inSelect][table]": "patients",
+        "id[inSelect][field]": "favbook",
+        "id[inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "id[inSelect][table]": "patients",
+        "id[inSelect][field]": "favbook",
+        "id[inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via _not_ prefix with inSelect", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The _not_ prefix passes user values into qstate.not[field].
+    // An attacker can embed inSelect to leak data:
+    //   ?_not_id[inSelect][table]=patients&_not_id[inSelect][field]=favbook&...
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        "_not_id[inSelect][table]": "patients",
+        "_not_id[inSelect][field]": "favbook",
+        "_not_id[inSelect][where][name]": "Kirk Douglas",
+      })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        "_not_id[inSelect][table]": "patients",
+        "_not_id[inSelect][field]": "favbook",
+        "_not_id[inSelect][where][name]": "ZZZNONEXISTENT",
+      })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via _relation_path_ parameter", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The _relation_path_ query parameter accepts JSON that specifies a
+    // relation path through arbitrary tables. handleRelationPath() constructs
+    // an inSelectWithLevels subquery with NO authorization checks.
+    //
+    // Attack: query the public books table with a _relation_path_ that
+    // traverses the restricted patients table (min_role_read=40):
+    //   ?_relation_path_={"relation":".books.patients$name","srcId":"Kirk Douglas"}
+    // This generates:
+    //   WHERE id IN (SELECT id FROM patients WHERE name = 'Kirk Douglas')
+    // A public user can determine whether a patient with a given name exists
+    // by observing which books are returned.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    // srcId matching an existing patient name
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({
+        _relation_path_: JSON.stringify({
+          relation: ".books.patients$name",
+          srcId: "Kirk Douglas",
+        }),
+      })
+      .expect(200);
+
+    // srcId with a non-existent patient name
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({
+        _relation_path_: JSON.stringify({
+          relation: ".books.patients$name",
+          srcId: "ZZZNONEXISTENT",
+        }),
+      })
+      .expect(200);
+
+    // If the relation_path is allowed without authorization, resp1 returns
+    // book id=1 (because patient "Kirk Douglas" has id=1) while resp2
+    // returns nothing. The difference reveals that "Kirk Douglas" exists
+    // in the restricted patients table.
+    //
+    // Secure behavior: both queries return the same results (the subquery
+    // against the restricted table is blocked or ignored), OR the query
+    // is rejected.
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+
+  it("should not allow probing restricted tables via dot-prefix relation path", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // The dot-prefix syntax (e.g. ?.books.patients$name=value) is another
+    // way to invoke handleRelationPath, which has no authorization checks.
+    // This constructs the same inSelectWithLevels subquery.
+    const patients = Table.findOne({ name: "patients" });
+    expect(patients.min_role_read).toBe(40);
+
+    const resp1 = await request(app)
+      .get("/api/books/")
+      .query({ ".books.patients$name": "Kirk Douglas" })
+      .expect(200);
+
+    const resp2 = await request(app)
+      .get("/api/books/")
+      .query({ ".books.patients$name": "ZZZNONEXISTENT" })
+      .expect(200);
+
+    const rows1 = resp1.body.success || [];
+    const rows2 = resp2.body.success || [];
+    expect(rows1.length).toBe(rows2.length);
+  });
+});
+
+describe("API CSRF protection", () => {
+  let adminToken, adminJwt;
+
+  beforeAll(async () => {
+    const admin = await User.findOne({ email: "admin@foo.com" });
+    adminToken = await admin.getNewAPIToken();
+    adminJwt = await getAdminJwt();
+    await Trigger.create({
+      action: "run_js_code",
+      when_trigger: "API call",
+      name: "apicallpublic1",
+      min_role: 100,
+      configuration: {
+        code: `return {foo: "bar"}`,
+      },
+    });
+  });
+
+  it("should reject POST with session cookie but no CSRF token", async () => {
+    const app = await getApp({ disableCsrf: false });
+    const loginCookie = await getAdminLoginCookie();
+    await request(app)
+      .post("/api/books/")
+      .set("Cookie", loginCookie)
+      .send({ author: "CSRF Test", pages: 1 })
+      .set("Content-Type", "application/json")
+      .expect(302);
+  });
+
+  it("should allow POST with bearer token and no CSRF token", async () => {
+    const app = await getApp({ disableCsrf: false });
+    await request(app)
+      .post("/api/books/")
+      .set("Authorization", "Bearer " + adminToken)
+      .send({ author: "Bearer No CSRF", pages: 2 })
+      .set("Content-Type", "application/json")
+      .set("Accept", "application/json")
+      .expect(succeedJsonWith((resp) => resp && typeof resp === "number"));
+  });
+
+  it("should allow POST to public api with no bearer token and no CSRF token", async () => {
+    const app = await getApp({ disableCsrf: false });
+    await request(app)
+      .post("/api/action/apicallpublic1")
+      .send({})
+      .set("Content-Type", "application/json")
+      .set("Accept", "application/json")
+      .expect(200)
+      .expect(
+        succeedJsonWithWholeBody(
+          (resp) => resp?.data?.foo === "bar" && resp.success === true
+        )
+      );
+  });
+
+  it("should allow POST with valid JWT and no CSRF token", async () => {
+    const app = await getApp({ disableCsrf: false });
+    await request(app)
+      .post("/api/books/")
+      .set("Authorization", `jwt ${adminJwt}`)
+      .send({ author: "JWT No CSRF", pages: 3 })
+      .set("Content-Type", "application/json")
+      .set("Accept", "application/json")
+      .expect(succeedJsonWith((resp) => resp && typeof resp === "number"));
+  });
+
+  it("should not bypass CSRF by appending a fake ?jwt= query parameter", async () => {
+    const app = await getApp({ disableCsrf: false });
+    const loginCookie = await getAdminLoginCookie();
+
+    await request(app)
+      .post("/api/books/?jwt=fakejwt")
+      .send({ author: "CSRF Bypass Attempt", pages: 4 })
+      .set("Cookie", loginCookie)
+      .set("Content-Type", "application/json")
+      .expect(302);
+  });
+});