canopycms 0.0.0 → 0.0.2

package/src/__integration__/errors/invalid-content.test.ts

@@ -1,238 +0,0 @@
-/**
- * Integration tests for invalid content errors.
- * Tests schema validation, malformed data, and security (path traversal).
- * Tests go through the HTTP API layer.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-
-import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
-import { createMockAuthPlugin } from '../test-utils/multi-user'
-import { createApiClient } from '../test-utils/api-client'
-import { BLOG_SCHEMA } from '../fixtures/schemas'
-import type { ApiResponse } from '../../api/types'
-
-describe('Invalid Content Errors', () => {
-  let workspace: TestWorkspace
-  let editorClient: Awaited<ReturnType<typeof createApiClient>>
-
-  beforeEach(async () => {
-    workspace = await createTestWorkspace({
-      schema: BLOG_SCHEMA,
-    })
-
-    editorClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('editor'),
-      schema: BLOG_SCHEMA,
-    })
-  })
-
-  afterEach(async () => {
-    await workspace.cleanup()
-  })
-
-  it('returns 400 for missing required fields', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/validation-test',
-      title: 'Validation Test',
-    })
-
-    // Try to write content missing required fields
-    await editorClient.put('/api/canopycms/feature-validation-test/content/posts/invalid-post', {
-      format: 'mdx',
-      data: {
-        // Missing required fields: title, author, date
-        tags: ['test'],
-      },
-      body: 'Some content',
-    })
-
-    // TODO: Once schema validation is enforced, this should be 400
-    // For now, ContentStore may accept any data shape
-    // expect(response.status).toBe(400)
-  })
-
-  it('returns 400 for invalid collection name', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/invalid-collection',
-      title: 'Invalid Collection',
-    })
-
-    // Try to write to non-existent collection
-    const response = await editorClient.put(
-      '/api/canopycms/feature-invalid-collection/content/nonexistent/test',
-      {
-        format: 'mdx',
-        data: {
-          title: 'Test',
-        },
-        body: 'Content',
-      },
-    )
-
-    // Should fail with 400 or 404
-    expect(response.status).toBeGreaterThanOrEqual(400)
-    expect(response.ok).toBe(false)
-  })
-
-  it('returns 400 for malformed JSON data', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/malformed-test',
-      title: 'Malformed Test',
-    })
-
-    // Try to write with invalid data structure
-    await editorClient.put('/api/canopycms/feature-malformed-test/content/posts/malformed', {
-      format: 'json',
-      data: 'not an object', // Invalid: should be object, not string
-    })
-
-    // TODO: Once validation is enforced, this should be 400
-    // expect(response.status).toBe(400)
-  })
-
-  it('prevents path traversal attacks in slug', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/security-test',
-      title: 'Security Test',
-    })
-
-    // Try path traversal in slug
-    const response = await editorClient.put(
-      '/api/canopycms/feature-security-test/content/posts/../../etc/passwd',
-      {
-        collection: 'posts',
-        slug: '../../etc/passwd',
-        format: 'mdx',
-        data: {
-          title: 'Malicious',
-        },
-        body: 'Should not write',
-      },
-    )
-
-    // Should fail (either 400 or 403)
-    expect(response.status).toBeGreaterThanOrEqual(400)
-    expect(response.ok).toBe(false)
-  })
-
-  it('prevents path traversal attacks in collection', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/security-test-2',
-      title: 'Security Test 2',
-    })
-
-    // Try path traversal in collection
-    const response = await editorClient.put(
-      '/api/canopycms/feature-security-test-2/content/../../../etc/test',
-      {
-        collection: '../../../etc',
-        slug: 'test',
-        format: 'mdx',
-        data: {
-          title: 'Malicious',
-        },
-        body: 'Should not write',
-      },
-    )
-
-    // Should fail
-    expect(response.status).toBeGreaterThanOrEqual(400)
-    expect(response.ok).toBe(false)
-  })
-
-  it('returns 400 for missing required body fields', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/missing-fields',
-      title: 'Missing Fields',
-    })
-
-    // Try to write without format field (required in body)
-    const response = await editorClient.put(
-      '/api/canopycms/feature-missing-fields/content/posts/test',
-      {
-        // Missing: format (required field)
-        data: { title: 'Test' },
-        body: 'Content',
-      },
-    )
-
-    expect(response.status).toBe(400)
-    expect(response.ok).toBe(false)
-    const error = await response.json<ApiResponse>()
-    expect(error.error).toContain('format')
-  })
-
-  it('returns 400 for invalid format type', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/invalid-format',
-      title: 'Invalid Format',
-    })
-
-    // Try to write with invalid format
-    await editorClient.put('/api/canopycms/feature-invalid-format/content/posts/test', {
-      format: 'invalid-format', // Not a valid ContentFormat
-      data: { title: 'Test' },
-      body: 'Content',
-    })
-
-    // TODO: Once format validation is enforced, this should be 400
-    // expect(response.status).toBe(400)
-  })
-
-  it('handles write errors gracefully', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/write-error',
-      title: 'Write Error Test',
-    })
-
-    // Try to write with empty slug (might cause issues)
-    const response = await editorClient.put('/api/canopycms/feature-write-error/content/posts/', {
-      collection: 'posts',
-      slug: '',
-      format: 'mdx',
-      data: { title: 'Test' },
-      body: 'Content',
-    })
-
-    // Should either succeed (if empty slug is valid) or fail gracefully
-    if (!response.ok) {
-      expect(response.status).toBeGreaterThanOrEqual(400)
-      const error = await response.json<ApiResponse>()
-      expect(error.error).toBeDefined()
-    }
-  })
-
-  it('validates data types for schema fields', async () => {
-    // Create branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/type-validation',
-      title: 'Type Validation',
-    })
-
-    // Try to write with wrong data types
-    await editorClient.put('/api/canopycms/feature-type-validation/content/posts/test', {
-      format: 'mdx',
-      data: {
-        title: 'Test',
-        author: 'Author',
-        date: 12345, // Should be string, not number
-        tags: 'not-an-array', // Should be array, not string
-      },
-      body: 'Content',
-    })
-
-    // TODO: Once type validation is enforced, this should be 400
-    // For now, ContentStore may accept any data
-    // expect(response.status).toBe(400)
-  })
-})

package/src/__integration__/errors/permission-denied.test.ts

@@ -1,220 +0,0 @@
-/**
- * Integration tests for permission denied scenarios.
- * Tests proper error messages and status codes for unauthorized access.
- * Tests go through the HTTP API layer.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-
-import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
-import { createMockAuthPlugin } from '../test-utils/multi-user'
-import { createApiClient } from '../test-utils/api-client'
-import { BLOG_SCHEMA } from '../fixtures/schemas'
-import type { ApiResponse } from '../../api/types'
-
-describe('Permission Denied Errors', () => {
-  let workspace: TestWorkspace
-  let adminClient: Awaited<ReturnType<typeof createApiClient>>
-  let editorClient: Awaited<ReturnType<typeof createApiClient>>
-  let reviewerClient: Awaited<ReturnType<typeof createApiClient>>
-
-  beforeEach(async () => {
-    workspace = await createTestWorkspace({
-      schema: BLOG_SCHEMA,
-    })
-
-    adminClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('admin'),
-      schema: BLOG_SCHEMA,
-    })
-
-    editorClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('editor'),
-      schema: BLOG_SCHEMA,
-    })
-
-    reviewerClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('reviewer'),
-      schema: BLOG_SCHEMA,
-    })
-  })
-
-  afterEach(async () => {
-    await workspace.cleanup()
-  })
-
-  it('returns 403 when editor tries to access restricted branch', async () => {
-    // Admin creates a restricted branch
-    await adminClient.post('/api/canopycms/branches', {
-      branch: 'admin-only',
-      title: 'Admin Only Branch',
-    })
-
-    await adminClient.patch('/api/canopycms/admin-only/access', {
-      allowedUsers: ['test-admin'],
-      allowedGroups: [],
-    })
-
-    // Editor tries to access
-    const response = await editorClient.get('/api/canopycms/admin-only/status')
-
-    expect(response.status).toBe(403)
-    expect(response.ok).toBe(false)
-    const error = await response.json<ApiResponse>()
-    expect(error.error).toBeDefined()
-  })
-
-  it('returns 403 when editor tries to access restricted content path', async () => {
-    // Admin creates branch with path restrictions
-    await adminClient.post('/api/canopycms/branches', {
-      branch: 'restricted-paths',
-      title: 'Restricted Paths',
-    })
-
-    // Write content as admin
-    await adminClient.put('/api/canopycms/restricted-paths/content/posts/admin-post', {
-      format: 'mdx',
-      data: {
-        title: 'Admin Post',
-        author: 'Admin',
-        date: '2024-01-01',
-        tags: ['admin'],
-      },
-      body: 'Admin only content',
-    })
-
-    // TODO: Once path-level access control is enforced in API, test:
-    // - Editor tries to read restricted path (should be 403)
-    // - Editor tries to write to restricted path (should be 403)
-  })
-
-  it('returns 403 when non-reviewer tries to approve', async () => {
-    // Editor creates and submits branch
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/approval-test',
-      title: 'Approval Test',
-    })
-
-    await editorClient.post('/api/canopycms/feature-approval-test/submit', {
-      message: 'Ready for review',
-    })
-
-    // Editor (not a reviewer) tries to approve
-    const response = await editorClient.post('/api/canopycms/feature-approval-test/approve', {
-      message: 'Trying to approve',
-    })
-
-    expect(response.status).toBe(403)
-    expect(response.ok).toBe(false)
-  })
-
-  it('returns 403 when non-admin tries to delete branch they did not create', async () => {
-    // Admin creates a branch
-    await adminClient.post('/api/canopycms/branches', {
-      branch: 'feature/delete-test',
-      title: 'Delete Test',
-    })
-
-    // Editor tries to delete (not their branch, not admin) - should fail
-    const editorDeleteResponse = await editorClient.delete('/api/canopycms/feature-delete-test')
-
-    expect(editorDeleteResponse.status).toBe(403)
-    expect(editorDeleteResponse.ok).toBe(false)
-
-    // Reviewer tries to delete (not their branch, not admin) - should also fail
-    const reviewerDeleteResponse = await reviewerClient.delete('/api/canopycms/feature-delete-test')
-
-    expect(reviewerDeleteResponse.status).toBe(403)
-    expect(reviewerDeleteResponse.ok).toBe(false)
-
-    // Admin can delete (they are the creator and also admin)
-    const adminDeleteResponse = await adminClient.delete('/api/canopycms/feature-delete-test')
-
-    expect(adminDeleteResponse.status).toBe(200)
-    expect(adminDeleteResponse.ok).toBe(true)
-  })
-
-  it('returns 403 when editor tries to modify branch access control on branch they did not create', async () => {
-    // Admin creates a branch
-    await adminClient.post('/api/canopycms/branches', {
-      branch: 'feature/access-test',
-      title: 'Access Test',
-    })
-
-    // Editor tries to modify access control (not their branch, not admin) - should fail
-    const response = await editorClient.patch('/api/canopycms/feature-access-test/access', {
-      allowedUsers: ['test-editor'],
-      allowedGroups: [],
-    })
-
-    expect(response.status).toBe(403)
-    expect(response.ok).toBe(false)
-  })
-
-  it('returns proper error message for permission denied', async () => {
-    // Admin creates restricted branch
-    await adminClient.post('/api/canopycms/branches', {
-      branch: 'restricted',
-      title: 'Restricted',
-    })
-
-    await adminClient.patch('/api/canopycms/restricted/access', {
-      allowedUsers: ['test-admin'],
-      allowedGroups: [],
-    })
-
-    // Editor tries to access
-    const response = await editorClient.get('/api/canopycms/restricted/status')
-
-    expect(response.status).toBe(403)
-    const error = await response.json<ApiResponse>()
-    expect(error.error).toBeTruthy()
-    expect(typeof error.error).toBe('string')
-    // Error message should be informative
-    expect(error.error!.length).toBeGreaterThan(0)
-  })
-
-  it('returns 403 when reviewer tries to edit content', async () => {
-    // Editor creates branch with content
-    await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/reviewer-test',
-      title: 'Reviewer Test',
-    })
-
-    await editorClient.put('/api/canopycms/feature-reviewer-test/content/posts/test-post', {
-      format: 'mdx',
-      data: {
-        title: 'Test Post',
-        author: 'Editor',
-        date: '2024-01-01',
-        tags: ['test'],
-      },
-      body: 'Original content',
-    })
-
-    // Reviewer can read (view access)
-    const readResponse = await reviewerClient.get(
-      '/api/canopycms/feature-reviewer-test/content/posts/test-post',
-    )
-    expect(readResponse.status).toBe(200)
-
-    // Reviewer tries to edit (should fail - reviewers have read-only access)
-    // TODO: Once role-based write restrictions are enforced, this should be 403
-    await reviewerClient.put('/api/canopycms/feature-reviewer-test/content/posts/test-post', {
-      format: 'mdx',
-      data: {
-        title: 'Modified by Reviewer',
-        author: 'Reviewer',
-        date: '2024-01-01',
-        tags: ['test'],
-      },
-      body: 'Modified content',
-    })
-
-    // This might succeed if defaultPathAccess is 'allow', but eventually should be 403
-    // expect(writeResponse.status).toBe(403)
-  })
-})

package/src/__integration__/fixtures/content-seeds.ts

@@ -1,105 +0,0 @@
-import type { ContentStore } from '../../content-store'
-import { unsafeAsLogicalPath, unsafeAsEntrySlug } from '../../paths/test-utils'
-
-/**
- * Sample blog posts for seeding test content
- */
-export const SAMPLE_POSTS = [
-  {
-    slug: 'hello-world',
-    data: {
-      title: 'Hello World',
-      author: 'Test Author',
-      date: '2024-01-01T00:00:00Z',
-      tags: ['intro', 'test'],
-      body: 'Welcome to the test blog! This is the first post.',
-    },
-  },
-  {
-    slug: 'second-post',
-    data: {
-      title: 'Second Post',
-      author: 'Test Author',
-      date: '2024-01-02T00:00:00Z',
-      tags: ['test'],
-      body: 'This is the second post for testing purposes.',
-    },
-  },
-  {
-    slug: 'draft-post',
-    data: {
-      title: 'Draft Post',
-      author: 'Test Author',
-      date: '2024-01-03T00:00:00Z',
-      tags: ['draft'],
-      body: "This is a draft post that hasn't been published yet.",
-    },
-  },
-]
-
-/**
- * Sample about page content
- */
-export const SAMPLE_ABOUT = {
-  title: 'About Us',
-  bio: 'This is a test about page for integration testing.',
-}
-
-/**
- * Sample products for e-commerce schema
- */
-export const SAMPLE_PRODUCTS = [
-  {
-    slug: 'product-1',
-    data: {
-      name: 'Test Product 1',
-      price: 29.99,
-      description: 'A great test product',
-      inStock: true,
-      images: ['product1.jpg'],
-    },
-  },
-  {
-    slug: 'product-2',
-    data: {
-      name: 'Test Product 2',
-      price: 49.99,
-      description: 'Another test product',
-      inStock: false,
-      images: ['product2.jpg', 'product2-alt.jpg'],
-    },
-  },
-]
-
-/**
- * Seed blog content into a ContentStore
- */
-export async function seedBlogContent(store: ContentStore): Promise<void> {
-  // Seed posts
-  for (const post of SAMPLE_POSTS) {
-    await store.write(unsafeAsLogicalPath('content/posts'), unsafeAsEntrySlug(post.slug), {
-      format: 'mdx',
-      data: post.data,
-      body: post.data.body as string,
-    })
-  }
-
-  // Seed about page
-  await store.write(unsafeAsLogicalPath('content/about.md'), '', {
-    format: 'mdx',
-    data: SAMPLE_ABOUT,
-    body: SAMPLE_ABOUT.bio as string,
-  })
-}
-
-/**
- * Seed e-commerce content into a ContentStore
- */
-export async function seedEcommerceContent(store: ContentStore): Promise<void> {
-  for (const product of SAMPLE_PRODUCTS) {
-    await store.write(unsafeAsLogicalPath('content/products'), unsafeAsEntrySlug(product.slug), {
-      format: 'json',
-      data: product.data,
-    })
-  }
-}

package/src/__integration__/fixtures/schemas.ts

@@ -1,67 +0,0 @@
-import type { RootCollectionConfig } from '../../config'
-
-/**
- * Blog schema for testing content workflows
- * Contains posts collection
- */
-export const BLOG_SCHEMA: RootCollectionConfig = {
-  collections: [
-    {
-      name: 'posts',
-      path: 'posts',
-      entries: [
-        {
-          name: 'post',
-          format: 'mdx',
-          schema: [
-            { name: 'title', type: 'string', required: true },
-            { name: 'author', type: 'string' },
-            { name: 'date', type: 'datetime' },
-            { name: 'tags', type: 'string', list: true },
-            { name: 'body', type: 'markdown', required: true },
-          ],
-        },
-      ],
-    },
-  ],
-}
-
-/**
- * E-commerce schema for testing complex permission scenarios
- * Contains products and categories
- */
-export const ECOMMERCE_SCHEMA: RootCollectionConfig = {
-  collections: [
-    {
-      name: 'products',
-      path: 'products',
-      entries: [
-        {
-          name: 'product',
-          format: 'json',
-          schema: [
-            { name: 'name', type: 'string', required: true },
-            { name: 'price', type: 'number', required: true },
-            { name: 'description', type: 'markdown' },
-            { name: 'inStock', type: 'boolean' },
-            { name: 'images', type: 'string', list: true },
-          ],
-        },
-      ],
-    },
-    {
-      name: 'categories',
-      path: 'categories',
-      entries: [
-        {
-          name: 'category',
-          format: 'json',
-          schema: [
-            { name: 'name', type: 'string', required: true },
-            { name: 'description', type: 'string' },
-          ],
-        },
-      ],
-    },
-  ],
-}