@saltcorn/server 1.6.0-beta.1 → 1.6.0-beta.11

package/tests/auth.test.js

@@ -124,7 +124,7 @@ describe("AuthTest user settings", () => {
     expect(user.checkPassword("foHRrr46obar")).toBe(false);
     expect(user.checkPassword("ghrarhr54hg")).toBe(true);
   });
-   it("should needs old password value", async () => {
+  it("should needs old password value", async () => {
     const app = await getApp({ disableCsrf: true });
     //const loginCookie = await getStaffLoginCookie();
     await request(app)
@@ -755,3 +755,232 @@ describe("AuthTest Allowed login methods", () => {
       .expect(toRedirect("/auth/login"));
   });
 });
+
+describe("JWT login rate limiting", () => {
+  it("should rate-limit GET /auth/login-with/jwt after repeated failed attempts", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // Send many failed login attempts via the JWT endpoint
+    // The normal POST /auth/login is rate-limited to 3 attempts per 5 minutes per user,
+    // but GET /auth/login-with/jwt bypasses this rate limiting entirely.
+    // This test asserts that the JWT endpoint is also rate-limited.
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .get("/auth/login-with/jwt")
+        .query({ email: "user@foo.com", password: `wrongpassword${i}` });
+
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+    expect(rateLimited).toBe(true);
+  });
+
+  it("should rate-limit POST /auth/login-with/jwt after repeated failed attempts", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      "X-Saltcorn-Client": "mobile-app",
+    };
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .post("/auth/login-with/jwt")
+        .set(headers)
+        .send({ email: "user@foo.com", password: `wrongpassword${i}` });
+        
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+    expect(rateLimited).toBe(true);
+  });
+});
+
+describe("JWT login disabled user bypass", () => {
+  let testUserEmail = "disabled-jwt-test@foo.com";
+  let testUserPassword = "TestPassword123!";
+
+  beforeAll(async () => {
+    // Create a test user and then disable them
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    // Disable the user
+    await u.update({ disabled: true });
+  });
+
+  afterAll(async () => {
+    // Clean up
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      await u.update({ disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should reject disabled user on normal login", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // Normal login should fail for disabled user - redirects back to login
+    await request(app)
+      .post("/auth/login/")
+      .send(`email=${testUserEmail}`)
+      .send(`password=${testUserPassword}`)
+      .expect(toRedirect("/auth/login"));
+  });
+
+  it("should reject disabled user on JWT login", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      "X-Saltcorn-Client": "mobile-app",
+    };
+    const res = await request(app)
+      .post("/auth/login-with/jwt")
+      .set(headers)
+      .send({ email: testUserEmail, password: testUserPassword });
+
+    // A disabled user should NOT receive a valid JWT token.
+    // The response should contain an error, not a token string.
+    const body = res.body;
+    const isToken = typeof body === "string" && body.includes(".");
+    expect(isToken).toBe(false);
+  });
+});
+
+describe("API token disabled user bypass", () => {
+  let testUserEmail = "disabled-apitoken-test@foo.com";
+  let testUserPassword = "TestPassword456!";
+  let apiToken;
+
+  beforeAll(async () => {
+    // Clean up any leftover user from a previous run
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    // Create a user, generate an API token, then disable them
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    apiToken = await u.getNewAPIToken();
+  });
+
+  afterAll(async () => {
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      await u.update({ disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should allow API token access to rooms for enabled user", async () => {
+    const app = await getApp({ disableCsrf: true });
+    // rooms table has min_role_read=80 (user role) - our user (role 80) can read it
+    const res = await request(app)
+      .get("/api/rooms/")
+      .set("Authorization", "Bearer " + apiToken);
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBeTruthy();
+  });
+
+  it("should reject API token access for disabled user", async () => {
+    // Disable the user
+    const u = await User.findOne({ email: testUserEmail });
+    await u.update({ disabled: true });
+
+    const app = await getApp({ disableCsrf: true });
+    // rooms table has min_role_read=80 (user). Our disabled user has role 80,
+    // so their token would grant access if the disabled check is missing.
+    // Public users (role 100) cannot read rooms.
+    // A disabled user's API token should NOT grant authenticated access.
+    const res = await request(app)
+      .get("/api/rooms/")
+      .set("Authorization", "Bearer " + apiToken);
+    const body = res.body;
+    // Should NOT succeed - a disabled user should not have user-level access
+    expect(body.success).toBeFalsy();
+  });
+});
+
+describe("TOTP brute force protection", () => {
+  let testUserEmail = "totp-bruteforce-test@foo.com";
+  let testUserPassword = "TotpBrute789!";
+  let totpKey = "abcdefghij";
+
+  beforeAll(async () => {
+    // Create a user with TOTP enabled
+    const existingUser = await User.findOne({ email: testUserEmail });
+    if (existingUser) {
+      await existingUser.update({ disabled: false });
+      await existingUser.delete();
+    }
+    const u = await User.create({
+      email: testUserEmail,
+      password: testUserPassword,
+      role_id: 80,
+    });
+    // Enable TOTP with a known key
+    u._attributes.totp_enabled = true;
+    u._attributes.totp_key = totpKey;
+    await u.update({ _attributes: u._attributes });
+  });
+
+  afterAll(async () => {
+    const u = await User.findOne({ email: testUserEmail });
+    if (u) {
+      u._attributes.totp_enabled = false;
+      delete u._attributes.totp_key;
+      await u.update({ _attributes: u._attributes, disabled: false });
+      await u.delete();
+    }
+  });
+
+  it("should rate-limit TOTP login attempts after repeated failures", async () => {
+    const app = await getApp({ disableCsrf: true });
+
+    // Step 1: Login with correct password to get session with pending_user
+    const loginRes = await request(app)
+      .post("/auth/login/")
+      .send(`email=${testUserEmail}`)
+      .send(`password=${testUserPassword}`);
+    expect(loginRes.headers["location"]).toBe("/auth/twofa/login/totp");
+
+    const sessionCookie = resToLoginCookie(loginRes);
+
+    // Step 2: Send many wrong TOTP codes.
+    // The POST /auth/login endpoint is rate-limited (ipLimiter + userLimiter),
+    // but POST /auth/twofa/login/totp has NO rate limiting at all.
+    // This allows an attacker who knows the password to brute-force the 6-digit
+    // TOTP code (1,000,000 possibilities) without any throttling.
+    // The TOTP endpoint should have rate limiting just like the login endpoint.
+    let rateLimited = false;
+    for (let i = 0; i < 10; i++) {
+      const res = await request(app)
+        .post("/auth/twofa/login/totp")
+        .set("Cookie", sessionCookie)
+        .send(`code=${100000 + i}`);
+
+      if (res.statusCode === 429 || res.headers["x-ratelimit-redirect"]) {
+        rateLimited = true;
+        break;
+      }
+    }
+
+    // This SHOULD be rate-limited to prevent TOTP brute-force attacks.
+    // Currently fails because the endpoint has no rate limiting.
+    expect(rateLimited).toBe(true);
+  });
+});

package/tests/fields.test.js

@@ -365,6 +365,22 @@ describe("Field Endpoints", () => {
       })
       .set("Cookie", loginCookie)
       .expect(toInclude(" is: <pre>"));
+  });
+   it("should show on stored expression with half-hjoinfield", async () => {
+    const loginCookie = await getAdminLoginCookie();
+    const table = Table.findOne({ name: "books" });
+
+    const ctx = encodeURIComponent(JSON.stringify({ table_id: table.id }));
+    const app = await getApp({ disableCsrf: true });
+    await request(app)
+      .post("/field/test-formula")
+      .send({
+        formula: "publisherⱵname",
+        tablename: "books",
+        stored: true,
+      })
+      .set("Cookie", loginCookie)
+      .expect(toInclude(" is: <pre>"));
   });
   it("should fail on non-stored expression with joinfield", async () => {
     const loginCookie = await getAdminLoginCookie();

package/tests/files.test.js

@@ -19,6 +19,7 @@ const Field = require("@saltcorn/data/models/field");
 const Table = require("@saltcorn/data/models/table");
 const View = require("@saltcorn/data/models/view");
 const { existsSync } = require("fs");
+const { getState } = require("@saltcorn/data/db/state");
 
 const createTestFile = async (
   folder,
@@ -106,6 +107,13 @@ beforeAll(async () => {
     "console.log('I am a script');",
     1
   );
+  await createTestFile(
+    "/",
+    "malicious.svg",
+    "image/svg+xml",
+    `<svg xmlns="http://www.w3.org/2000/svg"><script>alert('XSS')</script><circle cx="50" cy="50" r="40"/></svg>`,
+    100
+  );
 });
 afterAll(db.close);
 
@@ -162,6 +170,16 @@ describe("files admin", () => {
         toSucceedWithImage({ lengthIs: (bs) => bs < 100000 && bs > 2000 })
       );
   });
+  it("sanitize SVG served via /files/resize (XSS bypass)", async () => {
+    const app = await getApp({ disableCsrf: true });
+    const res = await request(app).get("/files/resize/0/0/malicious.svg");
+    expect(res.status).toBe(200);
+    const body = res.text || Buffer.from(res.body).toString();
+    // The resize endpoint must also sanitize SVG files, just like /files/serve does.
+    // Without this, an attacker can bypass DOMPurify by requesting an SVG via
+    // /files/resize/0/0/path.svg (width=0 makes it serve the original file).
+    expect(body).not.toContain("<script>");
+  });
   it("serve resized file without height", async () => {
     const app = await getApp({ disableCsrf: true });
     await request(app)
@@ -262,7 +280,7 @@ describe("files admin", () => {
           `/files/edit/${encodeURIComponent("_sc_test_subfolder_one/the-script.js")}`
         )
         .set("Cookie", loginCookie)
-        .expect(toInclude("Not found", 404));
+        .expect(toRedirect("/"));
     });
     it("denies editing a file", async () => {
       const app = await getApp({ disableCsrf: true });
@@ -273,12 +291,7 @@ describe("files admin", () => {
         )
         .set("Cookie", loginCookie)
         .send("value=console.log('I have been edited');")
-        .expect(toRedirect("/files"));
-
-      await request(app)
-        .get("/")
-        .set("Cookie", loginCookie)
-        .expect(toInclude("File not found"));
+        .expect(toRedirect("/"));
     });
 
     it("does not open for folders or not editable extensions", async () => {
@@ -474,6 +487,7 @@ describe("visible_entries test", () => {
   };
 
   it("shows allowed files", async () => {
+    await getState().setConfig("min_role_edit_files", 40)
     await setRole(100, path.join("_sc_test_subfolder_one", "foo_image.png"));
     await setDirRole(100, "_sc_test_subfolder_one");
 
@@ -541,4 +555,26 @@ describe("visible_entries test", () => {
     expect(body.files.length).toBe(0);
     expect(body.directories.length).toBe(0);
   });
+
+  it("should not crash on regex special characters in file_exts (CVE: regex injection)", async () => {
+    // The file_exts parameter is passed directly to new RegExp() without escaping.
+    // Regex metacharacters like ( [ cause SyntaxError → 500 Internal Server Error.
+    // This also enables ReDoS: patterns like (a+)+b cause exponential CPU usage.
+    // Confirmed: a file with 30 repeated chars + backtracking regex → 3.6s,
+    //            35 chars → 112s. The endpoint should escape regex metacharacters
+    //            or use literal string matching, not raw user input in new RegExp().
+    const app = await getApp({ disableCsrf: true });
+    const adminCookie = await getAdminLoginCookie();
+    await getState().setConfig("min_role_edit_files", 1);
+    const resp = await request(app)
+      .get(
+        "/files/visible_entries?dir=_sc_test_subfolder_one&file_exts=" +
+          encodeURIComponent("([")
+      )
+      .set("Cookie", adminCookie);
+    // Should return 200 with valid JSON, not crash with 500
+    expect(resp.statusCode).toBe(200);
+    expect(resp.body).toBeDefined();
+    expect(resp.body.files).toBeDefined();
+  });
 });

package/tests/page.test.js

@@ -12,6 +12,7 @@ const {
   resetToFixtures,
 } = require("../auth/testhelp");
 const db = require("@saltcorn/data/db");
+const { getState } = require("@saltcorn/data/db/state");
 const Page = require("@saltcorn/data/models/page");
 const File = require("@saltcorn/data/models/file");
 const { existsSync } = require("fs");
@@ -175,6 +176,58 @@ describe("page create", () => {
   });
 });
 
+describe("homepage with html-file page", () => {
+  beforeAll(async () => {
+    await Page.create({
+      name: "html_home_test_page",
+      title: "HTML Home",
+      description: "",
+      min_role: 1,
+      layout: { html_file: htmlFile.location },
+    });
+  });
+  afterAll(async () => {
+    const p = Page.findOne({ name: "html_home_test_page" });
+    if (p) await p.delete();
+    await getState().setConfig("home_page_by_role", {});
+  });
+
+  it("serves html content when role home page uses an html file", async () => {
+    await getState().setConfig("home_page_by_role", {
+      "1": "html_home_test_page",
+    });
+    const app = await getApp({ disableCsrf: true });
+    const loginCookie = await getAdminLoginCookie();
+    await request(app)
+      .get("/")
+      .set("Cookie", loginCookie)
+      .expect(toInclude("Land here"));
+  });
+
+  it("injects csrf and pageloadtag globals into html_string page", async () => {
+    await Page.create({
+      name: "html_string_csrf_test",
+      title: "",
+      description: "",
+      min_role: 1,
+      layout: {
+        html_string:
+          "<html><head><title>Test</title></head><body>hello</body></html>",
+      },
+    });
+    const app = await getApp({ disableCsrf: false });
+    const loginCookie = await getAdminLoginCookie();
+    const resp = await request(app)
+      .get("/page/html_string_csrf_test")
+      .set("Cookie", loginCookie);
+    expect(resp.text).toContain("_sc_globalCsrf");
+    expect(resp.text).toContain("_sc_pageloadtag");
+    expect(resp.text.indexOf("_sc_globalCsrf")).toBeLessThan(
+      resp.text.indexOf("</head>")
+    );
+  });
+});
+
 describe("page action", () => {
   it("should create", async () => {
     await Page.create({

package/tests/plugin_install.test.js

@@ -9,7 +9,7 @@ const {
 } = require("@saltcorn/admin-models/models/tenant");
 const { resetToFixtures } = require("../auth/testhelp");
 const db = require("@saltcorn/data/db");
-const load_plugins = require("../load_plugins");
+const { get_store_items } = require("../routes/plugins");
 
 beforeAll(async () => {
   if (!db.isSQLite) await db.query(`drop schema if exists test101 CASCADE `);
@@ -37,7 +37,7 @@ describe("Tenant cannot install unsafe plugins", () => {
   if (!db.isSQLite) {
     it("creates a new tenant", async () => {
       db.enable_multi_tenant();
-      const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+      const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
       await getState().setConfig("base_url", "http://example.com/");
 
@@ -56,7 +56,7 @@ describe("Tenant cannot install unsafe plugins", () => {
     });
     it("can install safe plugins on tenant", async () => {
       await db.runWithTenant("test101", async () => {
-        const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
         await install_pack(
           plugin_pack({
@@ -73,7 +73,7 @@ describe("Tenant cannot install unsafe plugins", () => {
     });
     it("cannot install unsafe plugins on tenant", async () => {
       await db.runWithTenant("test101", async () => {
-        const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
         await install_pack(
           plugin_pack({
@@ -88,10 +88,68 @@ describe("Tenant cannot install unsafe plugins", () => {
         expect(dbPlugin).toBe(null);
       });
     });
+    it("cannot install git plugins on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
+
+        await install_pack(
+          plugin_pack({
+            name: "some-git-plugin",
+            source: "git",
+            location: "https://github.com/example/some-git-plugin",
+          }),
+          "Some git plugin",
+          loadAndSaveNewPlugin
+        );
+        const dbPlugin = await Plugin.findOne({ name: "some-git-plugin" });
+        expect(dbPlugin).toBe(null);
+      });
+    });
+    it("cannot install github plugins on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
+
+        await install_pack(
+          plugin_pack({
+            name: "some-github-plugin",
+            source: "github",
+            location: "example/some-github-plugin",
+          }),
+          "Some github plugin",
+          loadAndSaveNewPlugin
+        );
+        const dbPlugin = await Plugin.findOne({ name: "some-github-plugin" });
+        expect(dbPlugin).toBe(null);
+      });
+    });
+    it("loadPlugin skips git plugin on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const result = await Plugin.loadPlugin(
+          new Plugin({
+            name: "some-git-plugin",
+            source: "git",
+            location: "https://github.com/example/some-git-plugin",
+          })
+        );
+        expect(result).toBeUndefined();
+      });
+    });
+    it("loadPlugin skips github plugin on tenant when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const result = await Plugin.loadPlugin(
+          new Plugin({
+            name: "some-github-plugin",
+            source: "github",
+            location: "example/some-github-plugin",
+          })
+        );
+        expect(result).toBeUndefined();
+      });
+    });
     it("can install unsafe plugins on tenant when permitted", async () => {
       await getState().setConfig("tenants_unsafe_plugins", true);
       await db.runWithTenant("test101", async () => {
-        const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+        const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
 
         await install_pack(
           plugin_pack({
@@ -130,7 +188,7 @@ describe("Stable versioning install", () => {
     }
   });
   it("installs latest", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin_two",
@@ -147,7 +205,7 @@ describe("Stable versioning install", () => {
   });
 
   it("installs and downgrades latest", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -165,7 +223,7 @@ describe("Stable versioning install", () => {
   });
 
   it("installs and upgrades a fixed version", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -182,7 +240,7 @@ describe("Stable versioning install", () => {
   });
 
   it("installs and downgrades a fixed version", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -212,7 +270,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to latest", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin_two",
@@ -246,7 +304,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to latest with downgrade to supported", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -280,7 +338,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to fixed version", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin_two",
@@ -314,7 +372,7 @@ describe("Stable versioning upgrade", () => {
   });
 
   it("upgrades to fixed version with downgrade to supported", async () => {
-    const loadAndSaveNewPlugin = load_plugins.loadAndSaveNewPlugin;
+    const loadAndSaveNewPlugin = Plugin.loadAndSaveNewPlugin;
     await loadAndSaveNewPlugin(
       new Plugin({
         name: "@christianhugoch/empty_sc_test_plugin",
@@ -347,3 +405,64 @@ describe("Stable versioning upgrade", () => {
     expect(newPlugin.version).toBe("0.1.0");
   });
 });
+
+describe("Tenant git plugin store filtering", () => {
+  const mockReq = { flash: () => {}, __: (s) => s };
+
+  if (!db.isSQLite) {
+    it("git plugin is excluded from installed list when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const gitPlugin = new Plugin({
+          name: "test-git-plugin",
+          source: "git",
+          location: "https://github.com/example/test-git-plugin",
+        });
+        await gitPlugin.upsert();
+
+        const items = await get_store_items(mockReq);
+        const names = items.map((i) => i.name);
+        expect(names).not.toContain("test-git-plugin");
+
+        await db.deleteWhere("_sc_plugins", { name: "test-git-plugin" });
+      });
+    });
+
+    it("github plugin is excluded from installed list when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const githubPlugin = new Plugin({
+          name: "test-github-plugin",
+          source: "github",
+          location: "example/test-github-plugin",
+        });
+        await githubPlugin.upsert();
+
+        const items = await get_store_items(mockReq);
+        const names = items.map((i) => i.name);
+        expect(names).not.toContain("test-github-plugin");
+
+        await db.deleteWhere("_sc_plugins", { name: "test-github-plugin" });
+      });
+    });
+
+    it("git plugin does not appear as installed in set=all when tenants_install_git is false", async () => {
+      await db.runWithTenant("test101", async () => {
+        const gitPlugin = new Plugin({
+          name: "test-git-plugin",
+          source: "git",
+          location: "https://github.com/example/test-git-plugin",
+        });
+        await gitPlugin.upsert();
+
+        const items = await get_store_items(mockReq);
+        const match = items.find((i) => i.name === "test-git-plugin");
+        expect(match).toBeUndefined();
+
+        await db.deleteWhere("_sc_plugins", { name: "test-git-plugin" });
+      });
+    });
+  } else {
+    it("does not support tenants on SQLite", async () => {
+      expect(db.isSQLite).toBe(true);
+    });
+  }
+});

package/tests/plugins.test.js

@@ -14,7 +14,6 @@ const {
   resetToFixtures,
 } = require("../auth/testhelp");
 const db = require("@saltcorn/data/db");
-const load_plugins = require("../load_plugins");
 
 beforeAll(async () => {
   if (!db.isSQLite) await db.query(`drop schema if exists test101 CASCADE `);
@@ -148,7 +147,7 @@ describe("Plugin dependency resolution and upgrade", () => {
       location: "@saltcorn/tabler",
       version: "0.1.2",
     });
-    await load_plugins.loadAndSaveNewPlugin(tabler);
+    await Plugin.loadAndSaveNewPlugin(tabler);
   });
   it("should refresh store", async () => {
     const loginCookie = await getAdminLoginCookie();