@saltcorn/server 1.6.0-beta.4 → 1.6.0-beta.6

package/tests/sync.test.js

@@ -8,8 +8,8 @@ const {
   toRedirect,
   toInclude,
   toSucceed,
+  resToLoginCookie,
 } = require("../auth/testhelp");
-const load_plugins = require("../load_plugins");
 const db = require("@saltcorn/data/db");
 const { sleep } = require("@saltcorn/data/tests/mocks");
 
@@ -38,7 +38,7 @@ const initSyncInfo = async (tbls) => {
 };
 
 const createAnswersTbl = async () => {
-  await load_plugins.loadAndSaveNewPlugin(
+  await Plugin.loadAndSaveNewPlugin(
     new Plugin({
       name: "json",
       source: "npm",
@@ -101,7 +101,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             books: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
             },
           },
         });
@@ -111,15 +111,16 @@ describe("load remote insert/updates", () => {
       for (const row of data.books.rows) {
         const fromDb = await books.getRows({ id: row._sync_info_tbl_ref_ });
         expect(fromDb.length).toBe(1);
-        expect(row._sync_info_tbl_last_modified_).toBe(loadUntil.valueOf());
-        expect(row._sync_info_tbl_deleted_).toBe(null);
+        expect(typeof row._sync_info_tbl_last_modified_).toBe("number");
+        expect(row._sync_info_tbl_deleted_).toBe(false);
       }
     });
 
-    it("with syncFrom, without sync_infos", async () => {
+    it("with syncFrom, no changes in window", async () => {
       const app = await getApp({ disableCsrf: true });
       const loginCookie = await getAdminLoginCookie();
       const loadUntil = new Date();
+      // syncFrom == loadUntil → empty time window → no rows
       const resp = await request(app)
         .post("/sync/load_changes")
         .set("Cookie", loginCookie)
@@ -127,8 +128,8 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             books: {
-              maxLoadedId: 0,
-              syncFrom: 1000,
+              lastModifiedAt: 0,
+              syncFrom: loadUntil.valueOf(),
             },
           },
         });
@@ -154,7 +155,7 @@ describe("load remote insert/updates", () => {
             loadUntil: (await db.time()).valueOf(),
             syncInfos: {
               books: {
-                maxLoadedId: 0,
+                lastModifiedAt: 0,
                 syncFrom: dbTime.valueOf(),
               },
             },
@@ -169,7 +170,7 @@ describe("load remote insert/updates", () => {
           _sync_info_tbl_deleted_,
           ...rest
         } = data.books.rows[0];
-        expect(_sync_info_tbl_ref_).toBe(2);
+        expect(Number(_sync_info_tbl_ref_)).toBe(2);
         expect(_sync_info_tbl_last_modified_).toBe(last_modified.valueOf());
         expect(_sync_info_tbl_deleted_).toBe(false);
         expect(rest.author).toBe("Leo Tolstoy");
@@ -183,7 +184,7 @@ describe("load remote insert/updates", () => {
             loadUntil: (await db.time()).valueOf(),
             syncInfos: {
               books: {
-                maxLoadedId: 0,
+                lastModifiedAt: 0,
                 syncFrom: dbTime.valueOf(),
               },
             },
@@ -198,13 +199,13 @@ describe("load remote insert/updates", () => {
             _sync_info_tbl_deleted_,
             ...rest
           } = row;
-          expect(_sync_info_tbl_ref_).toBe(rest.id);
+          expect(Number(_sync_info_tbl_ref_)).toBe(rest.id);
           const { last_modified } = await books.latestSyncInfo(rest.id);
           expect(_sync_info_tbl_last_modified_).toBe(last_modified.valueOf());
           expect(_sync_info_tbl_deleted_).toBe(false);
         }
-        expect(data.books.rows[0].author).toBe("Herman Melville");
-        expect(data.books.rows[1].author).toBe("Leo Tolstoy");
+        expect(data.books.rows[0].author).toBe("Leo Tolstoy");
+        expect(data.books.rows[1].author).toBe("Herman Melville");
       }
     });
 
@@ -246,7 +247,7 @@ describe("load remote insert/updates", () => {
           loadUntil: (await db.time()).valueOf(),
           syncInfos: {
             "Table with capitals": {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
               syncFrom: dbTime.valueOf(),
             },
           },
@@ -265,7 +266,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             patients: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
               syncFrom: 1000,
             },
           },
@@ -304,7 +305,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             patients: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
             },
           },
         });
@@ -334,7 +335,7 @@ describe("load remote insert/updates", () => {
           loadUntil: loadUntil.valueOf(),
           syncInfos: {
             patients: {
-              maxLoadedId: 0,
+              lastModifiedAt: 0,
               syncFrom: 1000,
             },
           },
@@ -907,6 +908,522 @@ describe("sync dir access control", () => {
     });
 });
 
+describe("SQL injection protection", () => {
+  if (!db.isSQLite) {
+    beforeAll(async () => {
+      await initSyncInfo(["books"]);
+    });
+
+    // --- /sync/load_changes : lastModifiedAt ---
+
+    it("rejects SQL injection in lastModifiedAt (OR 1=1)", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: { books: { lastModifiedAt: "0 OR 1=1--" } },
+        })
+        .expect(
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
+        );
+    });
+
+    it("rejects SQL injection in lastModifiedAt (UNION SELECT)", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: {
+            books: { lastModifiedAt: "0 UNION SELECT * FROM users--" },
+          },
+        })
+        .expect(
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
+        );
+    });
+
+    it("rejects SQL injection in lastModifiedAt (stacked query)", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: {
+            books: { lastModifiedAt: "0; DROP TABLE books; --" },
+          },
+        })
+        .expect(
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
+        );
+    });
+
+    it("rejects non-numeric string for lastModifiedAt", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: { books: { lastModifiedAt: "abc" } },
+        })
+        .expect(
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
+        );
+    });
+
+    it("rejects float lastModifiedAt", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: { books: { lastModifiedAt: 1.5 } },
+        })
+        .expect(
+          respondJsonWith(
+            400,
+            (resp) => resp.error === "Invalid lastModifiedAt"
+          )
+        );
+    });
+
+    // --- /sync/load_changes : syncFrom ---
+
+    it("rejects invalid syncFrom date", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: { books: { lastModifiedAt: 0, syncFrom: "not-a-date" } },
+        })
+        .expect(
+          respondJsonWith(400, (resp) => resp.error === "Invalid syncFrom")
+        );
+    });
+
+    it("rejects SQL injection payload as syncFrom", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: {
+            books: { lastModifiedAt: 0, syncFrom: "0); SELECT pg_sleep(5)--" },
+          },
+        })
+        .expect(
+          respondJsonWith(400, (resp) => resp.error === "Invalid syncFrom")
+        );
+    });
+
+    // --- /sync/load_changes : loadUntil (syncUntil) ---
+
+    it("rejects invalid loadUntil date", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: "not-a-date",
+          syncInfos: { books: { lastModifiedAt: 0 } },
+        })
+        .expect(
+          respondJsonWith(400, (resp) => resp.error === "Invalid syncUntil")
+        );
+    });
+
+    // --- /sync/deletes : syncTimestamp ---
+
+    it("rejects invalid syncTimestamp in /sync/deletes", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", loginCookie)
+        .send({
+          syncTimestamp: "not-a-date",
+          syncInfos: { books: { syncFrom: new Date(1000).valueOf() } },
+        })
+        .expect(
+          respondJsonWith(400, (resp) => resp.error === "Invalid syncUntil")
+        );
+    });
+
+    it("rejects SQL injection payload as syncTimestamp in /sync/deletes", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", loginCookie)
+        .send({
+          syncTimestamp: "0); SELECT * FROM users--",
+          syncInfos: { books: { syncFrom: new Date(1000).valueOf() } },
+        })
+        .expect(
+          respondJsonWith(400, (resp) => resp.error === "Invalid syncUntil")
+        );
+    });
+
+    // --- /sync/deletes : syncFrom ---
+
+    it("rejects invalid syncFrom in /sync/deletes", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", loginCookie)
+        .send({
+          syncTimestamp: new Date().valueOf(),
+          syncInfos: { books: { syncFrom: "not-a-date" } },
+        })
+        .expect(
+          respondJsonWith(400, (resp) => resp.error === "Invalid syncFrom")
+        );
+    });
+
+    it("rejects SQL injection payload as syncFrom in /sync/deletes", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", loginCookie)
+        .send({
+          syncTimestamp: new Date().valueOf(),
+          syncInfos: {
+            books: { syncFrom: "0); SELECT pg_sleep(5)--" },
+          },
+        })
+        .expect(
+          respondJsonWith(400, (resp) => resp.error === "Invalid syncFrom")
+        );
+    });
+
+    // --- regression: valid requests still succeed ---
+
+    it("valid lastModifiedAt value still works", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: { books: { lastModifiedAt: 0 } },
+        });
+      expect(resp.status).toBe(200);
+      expect(resp._body.books).toBeDefined();
+    });
+
+    it("valid syncFrom timestamp still works", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", loginCookie)
+        .send({
+          loadUntil: new Date().valueOf(),
+          syncInfos: { books: { lastModifiedAt: 0, syncFrom: 1000 } },
+        });
+      expect(resp.status).toBe(200);
+    });
+
+    it("valid /sync/deletes request still works", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const loginCookie = await getAdminLoginCookie();
+      const resp = await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", loginCookie)
+        .send({
+          syncTimestamp: new Date().valueOf(),
+          syncInfos: { books: { syncFrom: 1000 } },
+        });
+      expect(resp.status).toBe(200);
+      expect(resp._body.deletes).toBeDefined();
+    });
+  } else
+    it("only pq support", () => {
+      expect(true).toBe(true);
+    });
+});
+
+describe("deletes authorization", () => {
+  if (!db.isSQLite) {
+    beforeAll(async () => {
+      await initSyncInfo(["patients"]);
+    });
+
+    it("should not return deletes for tables the user cannot read", async () => {
+      const app = await getApp({ disableCsrf: true });
+      const patients = Table.findOne({ name: "patients" });
+      // patients has min_role_read=40 (staff), user role is 80
+      expect(patients.min_role_read).toBe(40);
+
+      const syncFrom = new Date(Date.now() - 10000);
+
+      // Insert and delete a row so there is a delete event in sync_info
+      const newId = await patients.insertRow({ name: "Secret Patient" });
+      await patients.deleteRows({ id: newId });
+      await sleep(200);
+
+      const syncUntil = new Date(Date.now() + 10000);
+
+      // As a regular user (role 80), try to see the deletion
+      const userCookie = await getUserLoginCookie();
+      const resp = await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", userCookie)
+        .send({
+          syncTimestamp: syncUntil.valueOf(),
+          syncInfos: {
+            patients: {
+              syncFrom: syncFrom.valueOf(),
+            },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const data = resp._body;
+      // The user should NOT be able to see deletes from the patients table
+      // because they lack the required min_role_read (40 < 80).
+      // If deletes.patients exists and has rows, that is the vulnerability.
+      const patientDeletes = data.deletes?.patients || [];
+      expect(patientDeletes.length).toBe(0);
+    });
+  } else
+    it("only pq support", () => {
+      expect(true).toBe(true);
+    });
+});
+
+describe("deletes authorization with ownership_formula", () => {
+  if (!db.isSQLite) {
+    let userA, userB;
+    let ownedTable, childTable;
+    let userACookie, userBCookie;
+
+    const loginAs = async (email, password) => {
+      const app = await getApp({ disableCsrf: true });
+      const res = await request(app)
+        .post("/auth/login/")
+        .send(`email=${email}`)
+        .send(`password=${password}`);
+      return res.headers["set-cookie"];
+    };
+
+    beforeAll(async () => {
+      await resetToFixtures();
+
+      // Two regular users — userA owns the rows, userB does not
+      userA = await User.create({
+        email: "userA_sync@test.com",
+        password: "TestPassA1!",
+        role_id: 80,
+      });
+      userB = await User.create({
+        email: "userB_sync@test.com",
+        password: "TestPassB1!",
+        role_id: 80,
+      });
+      userACookie = await loginAs("userA_sync@test.com", "TestPassA1!");
+      userBCookie = await loginAs("userB_sync@test.com", "TestPassB1!");
+
+      const usersTable = Table.findOne({ name: "users" });
+
+      // Parent table: min_role_read=40 so regular users (role 80) access via
+      // ownership only. ownership_formula is a direct field reference.
+      ownedTable = await Table.create("sync_owned", { min_role_read: 40 });
+      await Field.create({
+        table: ownedTable,
+        name: "item_name",
+        label: "Item name",
+        type: "String",
+      });
+      await Field.create({
+        table: ownedTable,
+        name: "owner",
+        label: "Owner",
+        type: "Key",
+        reftable: usersTable,
+        attributes: { summary_field: "email" },
+      });
+      ownedTable = Table.findOne({ name: "sync_owned" });
+      ownedTable.ownership_formula = "owner === user.id";
+      await ownedTable.update(ownedTable);
+      ownedTable = Table.findOne({ name: "sync_owned" });
+
+      // Child table: ownership resolved through a join field.
+      // formula: "sync_owned_ref?.owner === user.id"
+      // After getJoinedRows, row.sync_owned_ref is { id, owner } so the
+      // formula evaluates correctly.
+      childTable = await Table.create("sync_child", { min_role_read: 40 });
+      await Field.create({
+        table: childTable,
+        name: "child_name",
+        label: "Child name",
+        type: "String",
+      });
+      await Field.create({
+        table: childTable,
+        name: "sync_owned_ref",
+        label: "Sync owned ref",
+        type: "Key",
+        reftable: ownedTable,
+        attributes: { summary_field: "item_name" },
+      });
+      childTable = Table.findOne({ name: "sync_child" });
+      childTable.ownership_formula = "sync_owned_ref?.owner === user.id";
+      await childTable.update(childTable);
+      childTable = Table.findOne({ name: "sync_child" });
+
+      // Enable sync tracking on both tables
+      await initSyncInfo(["sync_owned", "sync_child"]);
+      // Re-fetch so has_sync_info = true is reflected in the local references
+      ownedTable = Table.findOne({ name: "sync_owned" });
+      childTable = Table.findOne({ name: "sync_child" });
+    });
+
+    afterAll(async () => {
+      if (childTable) await childTable.delete();
+      if (ownedTable) await ownedTable.delete();
+      if (userA) await userA.delete();
+      if (userB) await userB.delete();
+    });
+
+    it("direct formula: owner sees their own deleted rows", async () => {
+      const syncFrom = new Date(Date.now() - 10000);
+      const itemId = await ownedTable.insertRow({
+        item_name: "userA item",
+        owner: userA.id,
+      });
+      await ownedTable.deleteRows({ id: itemId });
+      await sleep(200);
+      const syncUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", userACookie)
+        .send({
+          syncTimestamp: syncUntil.valueOf(),
+          syncInfos: { sync_owned: { syncFrom: syncFrom.valueOf() } },
+        });
+      expect(resp.status).toBe(200);
+      const deletes = resp._body.deletes?.sync_owned || [];
+      expect(deletes.length).toBe(1);
+      expect(Number(deletes[0].ref)).toBe(itemId);
+    });
+
+    it("direct formula: non-owner does not see deleted rows", async () => {
+      const syncFrom = new Date(Date.now() - 10000);
+      const itemId = await ownedTable.insertRow({
+        item_name: "another userA item",
+        owner: userA.id,
+      });
+      await ownedTable.deleteRows({ id: itemId });
+      await sleep(200);
+      const syncUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", userBCookie)
+        .send({
+          syncTimestamp: syncUntil.valueOf(),
+          syncInfos: { sync_owned: { syncFrom: syncFrom.valueOf() } },
+        });
+      expect(resp.status).toBe(200);
+      const deletes = resp._body.deletes?.sync_owned || [];
+      expect(deletes.length).toBe(0);
+    });
+
+    it("join formula: owner sees deleted child rows", async () => {
+      const syncFrom = new Date(Date.now() - 10000);
+      const parentId = await ownedTable.insertRow({
+        item_name: "parent for join test",
+        owner: userA.id,
+      });
+      const childId = await childTable.insertRow({
+        child_name: "child of userA",
+        sync_owned_ref: parentId,
+      });
+      await childTable.deleteRows({ id: childId });
+      await sleep(200);
+      const syncUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", userACookie)
+        .send({
+          syncTimestamp: syncUntil.valueOf(),
+          syncInfos: { sync_child: { syncFrom: syncFrom.valueOf() } },
+        });
+      expect(resp.status).toBe(200);
+      const deletes = resp._body.deletes?.sync_child || [];
+      expect(deletes.length).toBe(1);
+      expect(Number(deletes[0].ref)).toBe(childId);
+    });
+
+    it("join formula: non-owner does not see deleted child rows", async () => {
+      const syncFrom = new Date(Date.now() - 10000);
+      const parentId = await ownedTable.insertRow({
+        item_name: "parent for join test 2",
+        owner: userA.id,
+      });
+      const childId = await childTable.insertRow({
+        child_name: "child of userA 2",
+        sync_owned_ref: parentId,
+      });
+      await childTable.deleteRows({ id: childId });
+      await sleep(200);
+      const syncUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/deletes")
+        .set("Cookie", userBCookie)
+        .send({
+          syncTimestamp: syncUntil.valueOf(),
+          syncInfos: { sync_child: { syncFrom: syncFrom.valueOf() } },
+        });
+      expect(resp.status).toBe(200);
+      const deletes = resp._body.deletes?.sync_child || [];
+      expect(deletes.length).toBe(0);
+    });
+  } else
+    it("only pq support", () => {
+      expect(true).toBe(true);
+    });
+});
+
 describe("field level conflicts", () => {
   if (!db.isSQLite) {
     beforeAll(async () => {
@@ -1010,3 +1527,310 @@ describe("field level conflicts", () => {
       expect(true).toBe(true);
     });
 });
+
+describe("load_changes authorization with ownership_formula", () => {
+  if (!db.isSQLite) {
+    let userA, userB;
+    let ownedTable, childTable;
+    let userACookie, userBCookie;
+
+    const loginAs = async (email, password) => {
+      const app = await getApp({ disableCsrf: true });
+      const res = await request(app)
+        .post("/auth/login/")
+        .send(`email=${email}`)
+        .send(`password=${password}`);
+      return res.headers["set-cookie"];
+    };
+
+    beforeAll(async () => {
+      await resetToFixtures();
+
+      userA = await User.create({
+        email: "userA_lc@test.com",
+        password: "TestPassA1!",
+        role_id: 80,
+      });
+      userB = await User.create({
+        email: "userB_lc@test.com",
+        password: "TestPassB1!",
+        role_id: 80,
+      });
+      userACookie = await loginAs("userA_lc@test.com", "TestPassA1!");
+      userBCookie = await loginAs("userB_lc@test.com", "TestPassB1!");
+
+      const usersTable = Table.findOne({ name: "users" });
+
+      // Direct formula table: min_role_read=40, ownership_formula = "owner === user.id"
+      ownedTable = await Table.create("lc_owned", { min_role_read: 40 });
+      await Field.create({
+        table: ownedTable,
+        name: "item_name",
+        label: "Item name",
+        type: "String",
+      });
+      await Field.create({
+        table: ownedTable,
+        name: "owner",
+        label: "Owner",
+        type: "Key",
+        reftable: usersTable,
+        attributes: { summary_field: "email" },
+      });
+      ownedTable = Table.findOne({ name: "lc_owned" });
+      ownedTable.ownership_formula = "owner === user.id";
+      await ownedTable.update(ownedTable);
+      ownedTable = Table.findOne({ name: "lc_owned" });
+
+      // Join formula table: ownership resolved through a join field
+      childTable = await Table.create("lc_child", { min_role_read: 40 });
+      await Field.create({
+        table: childTable,
+        name: "child_name",
+        label: "Child name",
+        type: "String",
+      });
+      await Field.create({
+        table: childTable,
+        name: "lc_owned_ref",
+        label: "Lc owned ref",
+        type: "Key",
+        reftable: ownedTable,
+        attributes: { summary_field: "item_name" },
+      });
+      childTable = Table.findOne({ name: "lc_child" });
+      childTable.ownership_formula = "lc_owned_ref?.owner === user.id";
+      await childTable.update(childTable);
+      childTable = Table.findOne({ name: "lc_child" });
+
+      await initSyncInfo(["lc_owned", "lc_child"]);
+      ownedTable = Table.findOne({ name: "lc_owned" });
+      childTable = Table.findOne({ name: "lc_child" });
+    });
+
+    afterAll(async () => {
+      if (childTable) await childTable.delete();
+      if (ownedTable) await ownedTable.delete();
+      if (userA) await userA.delete();
+      if (userB) await userB.delete();
+    });
+
+    it("direct formula: owner sees their own rows in load_changes", async () => {
+      const itemId = await ownedTable.insertRow({
+        item_name: "userA lc item",
+        owner: userA.id,
+      });
+      const loadUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", userACookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            lc_owned: { lastModifiedAt: 0 },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const rows = resp._body.lc_owned?.rows || [];
+      expect(rows.some((r) => r.id === itemId)).toBe(true);
+    });
+
+    it("direct formula: non-owner does not see rows in load_changes", async () => {
+      const itemId = await ownedTable.insertRow({
+        item_name: "userA lc item 2",
+        owner: userA.id,
+      });
+      const loadUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", userBCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            lc_owned: { lastModifiedAt: 0 },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const rows = resp._body.lc_owned?.rows || [];
+      expect(rows.some((r) => r.id === itemId)).toBe(false);
+    });
+
+    it("join formula: owner sees their child rows in load_changes", async () => {
+      const parentId = await ownedTable.insertRow({
+        item_name: "parent for lc join test",
+        owner: userA.id,
+      });
+      const childId = await childTable.insertRow({
+        child_name: "child of userA lc",
+        lc_owned_ref: parentId,
+      });
+      const loadUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", userACookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            lc_child: { lastModifiedAt: 0 },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const rows = resp._body.lc_child?.rows || [];
+      expect(rows.some((r) => r.id === childId)).toBe(true);
+    });
+
+    it("join formula: non-owner does not see child rows in load_changes", async () => {
+      const parentId = await ownedTable.insertRow({
+        item_name: "parent for lc join test 2",
+        owner: userA.id,
+      });
+      const childId = await childTable.insertRow({
+        child_name: "child of userA lc 2",
+        lc_owned_ref: parentId,
+      });
+      const loadUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", userBCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            lc_child: { lastModifiedAt: 0 },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const rows = resp._body.lc_child?.rows || [];
+      expect(rows.some((r) => r.id === childId)).toBe(false);
+    });
+
+    it("direct formula: owner sees updated rows via syncFrom in load_changes", async () => {
+      const itemId = await ownedTable.insertRow({
+        item_name: "userA lc syncFrom item",
+        owner: userA.id,
+      });
+      const syncFrom = await db.time();
+      await sleep(100);
+      await ownedTable.updateRow({ item_name: "userA lc updated" }, itemId);
+      const loadUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", userACookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            lc_owned: { lastModifiedAt: 0, syncFrom: syncFrom.valueOf() },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const rows = resp._body.lc_owned?.rows || [];
+      expect(rows.some((r) => r.id === itemId)).toBe(true);
+    });
+
+    it("direct formula: non-owner does not see updated rows via syncFrom in load_changes", async () => {
+      const itemId = await ownedTable.insertRow({
+        item_name: "userA lc syncFrom item 2",
+        owner: userA.id,
+      });
+      const syncFrom = await db.time();
+      await sleep(100);
+      await ownedTable.updateRow({ item_name: "userA lc updated 2" }, itemId);
+      const loadUntil = new Date(Date.now() + 10000);
+
+      const app = await getApp({ disableCsrf: true });
+      const resp = await request(app)
+        .post("/sync/load_changes")
+        .set("Cookie", userBCookie)
+        .send({
+          loadUntil: loadUntil.valueOf(),
+          syncInfos: {
+            lc_owned: { lastModifiedAt: 0, syncFrom: syncFrom.valueOf() },
+          },
+        });
+      expect(resp.status).toBe(200);
+      const rows = resp._body.lc_owned?.rows || [];
+      expect(rows.some((r) => r.id === itemId)).toBe(false);
+    });
+  } else
+    it("only pq support", () => {
+      expect(true).toBe(true);
+    });
+});
+
+describe("sync dir email suffix attack", () => {
+  if (!db.isSQLite) {
+    beforeAll(async () => {
+      await initSyncInfo(["books"]);
+    });
+
+    it("rejects access when attacker email is a suffix of victim email", async () => {
+      // Create a victim user whose email contains "_user@foo.com" as a suffix
+      // The existing user@foo.com has suffix "_user@foo.com"
+      // "timestamp_x_user@foo.com".endsWith("_user@foo.com") === true
+      // so user@foo.com could access x_user@foo.com's sync dir
+      const victimEmail = "x_user@foo.com";
+      const victimPassword = "TestPass123!";
+      await User.create({
+        email: victimEmail,
+        password: victimPassword,
+        role_id: 80,
+      });
+
+      const app = await getApp({ disableCsrf: true });
+
+      // Login as victim
+      const victimRes = await request(app)
+        .post("/auth/login/")
+        .send(`email=${victimEmail}`)
+        .send(`password=${victimPassword}`);
+      const victimCookie = resToLoginCookie(victimRes);
+
+      // Victim creates a sync directory
+      const resp = await doUpload(
+        app,
+        victimCookie,
+        new Date().valueOf(),
+        new Date().valueOf(),
+        { books: { inserts: [] } }
+      );
+      expect(resp.status).toBe(200);
+      const { syncDir } = resp._body;
+      // syncDir looks like "1234567890123_x_user@foo.com"
+      // endsWith("_user@foo.com") is true!
+      expect(syncDir.endsWith("_user@foo.com")).toBe(true);
+
+      // Login as the attacker (user@foo.com)
+      const attackerCookie = await getUserLoginCookie();
+
+      // Attacker tries to read victim's sync results
+      const pollResp = await request(app)
+        .get(`/sync/upload_finished?dir_name=${encodeURIComponent(syncDir)}`)
+        .set("Cookie", attackerCookie);
+      // Should be 403 - attacker must not access victim's sync dir
+      expect(pollResp.status).toBe(403);
+
+      // Attacker tries to delete victim's sync dir
+      const deleteResp = await request(app)
+        .post("/sync/clean_sync_dir")
+        .send({ dir_name: syncDir })
+        .set("Cookie", attackerCookie);
+      // Should be 403
+      expect(deleteResp.status).toBe(403);
+
+      // Cleanup
+      await cleanSyncDir(app, victimCookie, syncDir);
+    });
+  } else
+    it("only pq support", () => {
+      expect(true).toBe(true);
+    });
+});