cojson 0.9.19 → 0.10.0

package/src/tests/group.test.ts

@@ -467,33 +467,6 @@ describe("writeOnly", () => {
     expect(mapOnNode3.get("test")).toEqual("Written from a writeOnly member");
   });
 
-  test("inherited writer roles should work correctly", async () => {
-    const { node1, node2 } = await createTwoConnectedNodes("server", "server");
-
-    const group = node1.node.createGroup();
-    group.addMember(
-      await loadCoValueOrFail(node1.node, node2.accountID),
-      "writer",
-    );
-
-    const childGroup = node1.node.createGroup();
-    childGroup.extend(group);
-    childGroup.addMember(
-      await loadCoValueOrFail(node1.node, node2.accountID),
-      "writeOnly",
-    );
-
-    const map = childGroup.createMap();
-    map.set("test", "Written from the admin");
-
-    await map.core.waitForSync();
-
-    const mapOnNode2 = await loadCoValueOrFail(node2.node, map.id);
-
-    // The writer role should be able to see the edits from the admin
-    expect(mapOnNode2.get("test")).toEqual("Written from the admin");
-  });
-
   test("upgrade to writer roles should work correctly", async () => {
     const { node1, node2 } = await createTwoConnectedNodes("server", "server");
 
@@ -528,6 +501,35 @@ describe("writeOnly", () => {
     // The writer role should be able to see the edits from the admin
     expect(mapOnNode2.get("test")).toEqual("Written from the writeOnly member");
   });
+});
+
+describe("extend", () => {
+  test("inherited writer roles should work correctly", async () => {
+    const { node1, node2 } = await createTwoConnectedNodes("server", "server");
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "writer",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group);
+    childGroup.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "writeOnly",
+    );
+
+    const map = childGroup.createMap();
+    map.set("test", "Written from the admin");
+
+    await map.core.waitForSync();
+
+    const mapOnNode2 = await loadCoValueOrFail(node2.node, map.id);
+
+    // The writer role should be able to see the edits from the admin
+    expect(mapOnNode2.get("test")).toEqual("Written from the admin");
+  });
 
   test("a user should be able to extend a group when his role on the parent group is writer", async () => {
     const { node1, node2 } = await createTwoConnectedNodes("server", "server");
@@ -638,4 +640,205 @@ describe("writeOnly", () => {
 
     expect(map.get("test")).toEqual("Hello!");
   });
+
+  test("a writerInvite role should not be inherited", async () => {
+    const { node1, node2 } = await createTwoConnectedNodes("server", "server");
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "writerInvite",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group);
+
+    expect(childGroup.roleOf(node2.accountID)).toEqual(undefined);
+  });
+});
+
+describe("extend with role mapping", () => {
+  test("mapping to writer should add the ability to write", async () => {
+    const { node1, node2 } = await createTwoConnectedNodes("server", "server");
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "reader",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group, "writer");
+
+    expect(childGroup.roleOf(node2.accountID)).toEqual("writer");
+
+    const map = childGroup.createMap();
+    map.set("test", "Written from the admin");
+
+    await map.core.waitForSync();
+
+    const mapOnNode2 = await loadCoValueOrFail(node2.node, map.id);
+
+    expect(mapOnNode2.get("test")).toEqual("Written from the admin");
+
+    mapOnNode2.set("test", "Written from the inherited role");
+    expect(mapOnNode2.get("test")).toEqual("Written from the inherited role");
+
+    await mapOnNode2.core.waitForSync();
+
+    expect(map.get("test")).toEqual("Written from the inherited role");
+  });
+
+  test("mapping to reader should remove the ability to write", async () => {
+    const { node1, node2 } = await createTwoConnectedNodes("server", "server");
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "writer",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group, "reader");
+
+    expect(childGroup.roleOf(node2.accountID)).toEqual("reader");
+
+    const map = childGroup.createMap();
+    map.set("test", "Written from the admin");
+
+    await map.core.waitForSync();
+
+    const mapOnNode2 = await loadCoValueOrFail(node2.node, map.id);
+
+    expect(mapOnNode2.get("test")).toEqual("Written from the admin");
+
+    mapOnNode2.set("test", "Should not be visible");
+
+    await mapOnNode2.core.waitForSync();
+
+    expect(map.get("test")).toEqual("Written from the admin");
+    expect(mapOnNode2.get("test")).toEqual("Written from the admin");
+  });
+
+  test("mapping to admin should add the ability to add members", async () => {
+    const { node1, node2, node3 } = await createThreeConnectedNodes(
+      "server",
+      "server",
+      "server",
+    );
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "reader",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group, "admin");
+
+    expect(childGroup.roleOf(node2.accountID)).toEqual("admin");
+
+    await childGroup.core.waitForSync();
+
+    const childGroupOnNode2 = await loadCoValueOrFail(
+      node2.node,
+      childGroup.id,
+    );
+
+    childGroupOnNode2.addMember(
+      await loadCoValueOrFail(node2.node, node3.accountID),
+      "reader",
+    );
+
+    expect(childGroupOnNode2.roleOf(node3.accountID)).toEqual("reader");
+  });
+
+  test("mapping to reader should remove the ability to add members", async () => {
+    const { node1, node2, node3 } = await createThreeConnectedNodes(
+      "server",
+      "server",
+      "server",
+    );
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "admin",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group, "reader");
+
+    expect(childGroup.roleOf(node2.accountID)).toEqual("reader");
+
+    await childGroup.core.waitForSync();
+
+    const childGroupOnNode2 = await loadCoValueOrFail(
+      node2.node,
+      childGroup.id,
+    );
+
+    const accountToAdd = await loadCoValueOrFail(node2.node, node3.accountID);
+
+    expect(() => {
+      childGroupOnNode2.addMember(accountToAdd, "reader");
+    }).toThrow();
+
+    expect(childGroupOnNode2.roleOf(node3.accountID)).toEqual(undefined);
+  });
+
+  test("non-inheritable roles should not give access to the child group when role mapping is used", async () => {
+    const { node1, node2 } = await createTwoConnectedNodes("server", "server");
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "writeOnly",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group, "reader");
+
+    expect(childGroup.roleOf(node2.accountID)).toEqual(undefined);
+
+    const map = childGroup.createMap();
+    map.set("test", "Written from the admin");
+
+    await map.core.waitForSync();
+
+    const mapOnNode2 = await loadCoValueOrFail(node2.node, map.id);
+
+    expect(mapOnNode2.get("test")).toEqual(undefined);
+  });
+
+  test("invite roles should not give write access to the child group when role mapping is used", async () => {
+    const { node1, node2 } = await createTwoConnectedNodes("server", "server");
+
+    const group = node1.node.createGroup();
+    group.addMember(
+      await loadCoValueOrFail(node1.node, node2.accountID),
+      "writerInvite",
+    );
+
+    const childGroup = node1.node.createGroup();
+    childGroup.extend(group, "writer");
+
+    expect(childGroup.roleOf(node2.accountID)).toEqual(undefined);
+
+    const map = childGroup.createMap();
+    map.set("test", "Written from the admin");
+
+    await map.core.waitForSync();
+
+    const mapOnNode2 = await loadCoValueOrFail(node2.node, map.id);
+
+    expect(mapOnNode2.get("test")).toEqual("Written from the admin"); // The invite roles have access to the readKey hence can read the values on inherited groups
+
+    mapOnNode2.set("test", "Should not be visible");
+
+    await mapOnNode2.core.waitForSync();
+
+    expect(map.get("test")).toEqual("Written from the admin");
+    expect(mapOnNode2.get("test")).toEqual("Written from the admin");
+  });
 });

package/src/tests/permissions.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { expect, test, vi } from "vitest";
 import { expectMap } from "../coValue.js";
 import { ControlledAgent } from "../coValues/account.js";
 import { WasmCrypto } from "../crypto/WasmCrypto.js";
@@ -2908,3 +2908,61 @@ test("extend cycles should not break the keys rotation", () => {
 
   expect(map.get("test")).toEqual("Hello!");
 });
+
+test("Admin can remove themselves from a group", async () => {
+  const warnSpy = vi.spyOn(console, "warn");
+  const { group, admin } = newGroupHighLevel();
+
+  // Admin removes themselves
+  await group.removeMember(admin);
+
+  expect(group.myRole()).toBeUndefined();
+  expect(warnSpy).not.toHaveBeenCalled();
+});
+
+test("Can revoke read permission from 'everyone'", async () => {
+  const { group } = newGroupHighLevel();
+  const childObject = group.createMap();
+
+  // Give everyone read access
+  group.addMember("everyone", "reader");
+
+  childObject.set("foo", "bar", "private");
+  expect(childObject.get("foo")).toEqual("bar");
+
+  // Create a new account to verify access
+  const newAccount = new ControlledAgent(Crypto.newRandomAgentSecret(), Crypto);
+  const childContent = expectMap(
+    childObject.core
+      .testWithDifferentAccount(
+        newAccount,
+        Crypto.newRandomSessionID(newAccount.currentAgentID()._unsafeUnwrap()),
+      )
+      .getCurrentContent(),
+  );
+
+  // Verify the new account can read
+  expect(childContent.get("foo")).toEqual("bar");
+
+  // Revoke everyone's access
+  await group.removeMember("everyone");
+
+  childObject.set("foo", "updated after revoke", "private");
+
+  // Create another new account to verify access is revoked
+  const newAccount2 = new ControlledAgent(
+    Crypto.newRandomAgentSecret(),
+    Crypto,
+  );
+  const childContent2 = expectMap(
+    childObject.core
+      .testWithDifferentAccount(
+        newAccount2,
+        Crypto.newRandomSessionID(newAccount2.currentAgentID()._unsafeUnwrap()),
+      )
+      .getCurrentContent(),
+  );
+
+  // Verify the new account cannot read after revocation
+  expect(childContent2.get("foo")).toEqual("bar");
+});