json-rest-api 1.0.13 → 1.0.15

package/tests/rest-api-access.test.js

@@ -1,14 +1,14 @@
-import { describe, it, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import knexLib from 'knex';
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
 import {
   validateJsonApiStructure,
   cleanTables,
   createJsonApiDocument,
   assertResourceAttributes,
   assertResourceRelationship
-} from './helpers/test-utils.js';
-import { createAccessControlApi } from './fixtures/api-configs.js';
+} from './helpers/test-utils.js'
+import { createAccessControlApi } from './fixtures/api-configs.js'
 
 const knex = knexLib({
   client: 'better-sqlite3',
@@ -16,191 +16,191 @@ const knex = knexLib({
     filename: ':memory:'
   },
   useNullAsDefault: true
-});
+})
 
-let api;
+let api
 
-async function createUser(email, displayName = 'Test User') {
+async function createUser (email, displayName = 'Test User') {
   const userDoc = createJsonApiDocument('users', {
     email,
     display_name: displayName
-  });
+  })
 
   const result = await api.resources.users.post({
     inputRecord: userDoc,
     simplified: false
-  }, { auth: { system: true } });
+  }, { auth: { system: true } })
 
-  validateJsonApiStructure(result);
+  validateJsonApiStructure(result)
   assertResourceAttributes(result.data, {
     email,
     display_name: displayName
-  });
+  })
 
-  return Number(result.data.id);
+  return Number(result.data.id)
 }
 
-async function createProjectForUser(userId, name, status = null) {
+async function createProjectForUser (userId, name, status = null) {
   const projectDoc = createJsonApiDocument('projects', {
     name,
     status
-  });
+  })
 
   const result = await api.resources.projects.post({
     inputRecord: projectDoc,
     simplified: false
-  }, { auth: { userId } });
+  }, { auth: { userId } })
 
-  validateJsonApiStructure(result);
-  return result.data;
+  validateJsonApiStructure(result)
+  return result.data
 }
 
 describe('Access plugin', () => {
   before(async () => {
-    api = await createAccessControlApi(knex);
-  });
+    api = await createAccessControlApi(knex)
+  })
 
   after(async () => {
-    await knex.destroy();
-  });
+    await knex.destroy()
+  })
 
   beforeEach(async () => {
     await cleanTables(knex, [
       'access_notes',
       'access_projects',
       'access_users'
-    ]);
-  });
+    ])
+  })
 
   it('rejects unauthenticated requests for protected operations', async () => {
     const projectDoc = createJsonApiDocument('projects', {
       name: 'Unauthenticated project'
-    });
+    })
 
     await assert.rejects(async () => {
       await api.resources.projects.post({
         inputRecord: projectDoc,
         simplified: false
-      });
+      })
     }, (error) => {
-      assert.equal(error.statusCode, 403);
-      assert.match(error.message, /Access denied/);
-      return true;
-    });
-  });
+      assert.equal(error.statusCode, 403)
+      assert.match(error.message, /Access denied/)
+      return true
+    })
+  })
 
   it('auto assigns ownership when creating a project', async () => {
-    const ownerId = await createUser('owner@example.com', 'Owner One');
+    const ownerId = await createUser('owner@example.com', 'Owner One')
 
     const projectDoc = createJsonApiDocument('projects', {
       name: 'Owned Project',
       status: 'active'
-    });
+    })
 
     const createResult = await api.resources.projects.post({
       inputRecord: projectDoc,
       simplified: false
-    }, { auth: { userId: ownerId } });
+    }, { auth: { userId: ownerId } })
 
-    validateJsonApiStructure(createResult);
+    validateJsonApiStructure(createResult)
     assertResourceAttributes(createResult.data, {
       name: 'Owned Project',
       status: 'active'
-    });
+    })
     assertResourceRelationship(createResult.data, 'user', {
       type: 'users',
       id: String(ownerId)
-    });
+    })
 
     const getResult = await api.resources.projects.get({
       id: createResult.data.id,
       simplified: false
-    }, { auth: { userId: ownerId } });
+    }, { auth: { userId: ownerId } })
 
-    validateJsonApiStructure(getResult);
+    validateJsonApiStructure(getResult)
     assertResourceRelationship(getResult.data, 'user', {
       type: 'users',
       id: String(ownerId)
-    });
-  });
+    })
+  })
 
   it('filters query results by ownership for non-admin users', async () => {
-    const aliceId = await createUser('alice@example.com', 'Alice');
-    const bobId = await createUser('bob@example.com', 'Bob');
+    const aliceId = await createUser('alice@example.com', 'Alice')
+    const bobId = await createUser('bob@example.com', 'Bob')
 
-    const aliceProject = await createProjectForUser(aliceId, 'Alice Project', 'active');
-    await createProjectForUser(bobId, 'Bob Project', 'planning');
+    const aliceProject = await createProjectForUser(aliceId, 'Alice Project', 'active')
+    await createProjectForUser(bobId, 'Bob Project', 'planning')
 
     const queryResult = await api.resources.projects.query({
       simplified: false
-    }, { auth: { userId: aliceId } });
+    }, { auth: { userId: aliceId } })
 
-    validateJsonApiStructure(queryResult, true);
-    assert.equal(queryResult.data.length, 1);
-    assert.equal(queryResult.data[0].id, aliceProject.id);
+    validateJsonApiStructure(queryResult, true)
+    assert.equal(queryResult.data.length, 1)
+    assert.equal(queryResult.data[0].id, aliceProject.id)
     assertResourceRelationship(queryResult.data[0], 'user', {
       type: 'users',
       id: String(aliceId)
-    });
-  });
+    })
+  })
 
   it('allows admin roles to bypass ownership filtering', async () => {
-    const userA = await createUser('admin_a@example.com', 'Admin A');
-    const userB = await createUser('admin_b@example.com', 'Admin B');
+    const userA = await createUser('admin_a@example.com', 'Admin A')
+    const userB = await createUser('admin_b@example.com', 'Admin B')
 
-    await createProjectForUser(userA, 'Admin Project A');
-    await createProjectForUser(userB, 'Admin Project B');
+    await createProjectForUser(userA, 'Admin Project A')
+    await createProjectForUser(userB, 'Admin Project B')
 
     const adminQuery = await api.resources.projects.query({
       simplified: false
-    }, { auth: { userId: 999, roles: ['admin'] } });
+    }, { auth: { userId: 999, roles: ['admin'] } })
 
-    validateJsonApiStructure(adminQuery, true);
-    assert.equal(adminQuery.data.length, 2);
+    validateJsonApiStructure(adminQuery, true)
+    assert.equal(adminQuery.data.length, 2)
 
-    const relatedUserIds = adminQuery.data.map((resource) => resource.relationships.user.data.id).sort();
-    assert.deepEqual(relatedUserIds, [String(userA), String(userB)]);
-  });
+    const relatedUserIds = adminQuery.data.map((resource) => resource.relationships.user.data.id).sort()
+    assert.deepEqual(relatedUserIds, [String(userA), String(userB)])
+  })
 
   it('prevents users from accessing records they do not own', async () => {
-    const ownerId = await createUser('primary@example.com', 'Primary');
-    const otherId = await createUser('secondary@example.com', 'Secondary');
+    const ownerId = await createUser('primary@example.com', 'Primary')
+    const otherId = await createUser('secondary@example.com', 'Secondary')
 
-    const project = await createProjectForUser(ownerId, 'Primary Project');
+    const project = await createProjectForUser(ownerId, 'Primary Project')
 
     await assert.rejects(async () => {
       await api.resources.projects.get({
         id: project.id,
         simplified: false
-      }, { auth: { userId: otherId } });
+      }, { auth: { userId: otherId } })
     }, (error) => {
-      assert.equal(error.statusCode, 403);
-      assert.match(error.message, /Access denied/);
-      return true;
-    });
-  });
+      assert.equal(error.statusCode, 403)
+      assert.match(error.message, /Access denied/)
+      return true
+    })
+  })
 
   it('enforces helper ownership checks', () => {
-    const context = { auth: { userId: 123 } };
-    const resource = { user_id: 123 };
+    const context = { auth: { userId: 123 } }
+    const resource = { user_id: 123 }
 
-    const auth = api.helpers.auth.requireOwnership(context, resource);
-    assert.equal(auth.userId, 123);
+    const auth = api.helpers.auth.requireOwnership(context, resource)
+    assert.equal(auth.userId, 123)
 
     assert.throws(() => {
-      api.helpers.auth.requireOwnership({ auth: { userId: 123 } }, { user_id: 456 });
+      api.helpers.auth.requireOwnership({ auth: { userId: 123 } }, { user_id: 456 })
     }, (error) => {
-      assert.equal(error.statusCode, 403);
-      assert.match(error.message, /Access denied/);
-      return true;
-    });
+      assert.equal(error.statusCode, 403)
+      assert.match(error.message, /Access denied/)
+      return true
+    })
 
     assert.throws(() => {
-      api.helpers.auth.requireAuth({});
+      api.helpers.auth.requireAuth({})
     }, (error) => {
-      assert.equal(error.statusCode, 401);
-      assert.match(error.message, /Authentication required/);
-      return true;
-    });
-  });
-});
+      assert.equal(error.statusCode, 401)
+      assert.match(error.message, /Authentication required/)
+      return true
+    })
+  })
+})