json-rest-api 1.0.21 → 1.0.23

package/tests/multihome.test.js.bak

@@ -1,550 +0,0 @@
-import { describe, it, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import knexLib from 'knex';
-import { 
-  validateJsonApiStructure, 
-  cleanTables, 
-  createJsonApiDocument,
-  assertResourceAttributes,
-  createRelationship,
-  resourceIdentifier
-} from './helpers/test-utils.js';
-import { createMultiHomeApi } from './fixtures/api-configs.js';
-
-// Create Knex instance for tests - always use SQLite in-memory
-const knex = knexLib({
-  client: 'sqlite3',
-  connection: {
-    filename: ':memory:'
-  },
-  useNullAsDefault: true
-});
-
-// API instance that persists across ALL tests
-let api;
-
-describe('MultiHome Plugin Tests', () => {
-  // IMPORTANT: before() runs ONCE for the entire test suite
-  before(async () => {
-    // Create API instance ONCE - this is reused for all tests
-    api = await createMultiHomeApi(knex);
-  });
-  
-  // IMPORTANT: after() cleans up resources
-  after(async () => {
-    // Always destroy knex connection to allow tests to exit
-    await knex.destroy();
-  });
-  
-  // IMPORTANT: beforeEach() cleans data but does NOT recreate API
-  beforeEach(async () => {
-    // Clean all tables - list ALL tables your tests use
-    await cleanTables(knex, [
-      'multihome_projects',
-      'multihome_tasks',
-      'multihome_users',
-      'multihome_system_settings'
-    ]);
-  });
-  
-  describe('Tenant Isolation', () => {
-    it('should automatically set tenant_id on new records', async () => {
-      // Create a project for tenant A
-      const doc = createJsonApiDocument('projects', {
-        name: 'Tenant A Project',
-        description: 'A project for tenant A'
-      });
-      
-      // Create with tenant context
-      const createResult = await api.resources.projects.post({
-        inputRecord: doc,
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      // Verify response
-      validateJsonApiStructure(createResult);
-      assert.equal(createResult.data.type, 'projects');
-      assertResourceAttributes(createResult.data, {
-        name: 'Tenant A Project',
-        description: 'A project for tenant A',
-        tenant_id: 'tenant-a' // Should be automatically set
-      });
-    });
-    
-    it('should filter queries by tenant_id', async () => {
-      // Create projects for different tenants
-      const projectA1 = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Project A1'
-        }),
-        simplified: false,
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      const projectA2 = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Project A2'
-        }),
-        simplified: false,
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      const projectB1 = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Project B1'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-b' }
-      });
-      
-      // Query as tenant A - should only see tenant A's projects
-      const resultA = await api.resources.projects.query({
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      validateJsonApiStructure(resultA);
-      assert.equal(resultA.data.length, 2, 'Tenant A should see 2 projects');
-      assert(resultA.data.every(p => p.attributes.name.startsWith('Project A')));
-      
-      // Query as tenant B - should only see tenant B's projects
-      const resultB = await api.resources.projects.query({
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-b' }
-      });
-      
-      validateJsonApiStructure(resultB);
-      assert.equal(resultB.data.length, 1, 'Tenant B should see 1 project');
-      assert.equal(resultB.data[0].attributes.name, 'Project B1');
-    });
-    
-    it('should prevent access to other tenant records', async () => {
-      // Create a project for tenant A
-      const projectA = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Tenant A Secret Project'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      // Try to access as tenant B - should fail
-      await assert.rejects(
-        async () => {
-          await api.resources.projects.get({
-            id: projectA.data.id,
-            simplified: false
-          }, {
-            auth: { multihome_id: 'tenant-b' }
-          });
-        },
-        (err) => {
-          return err.code === 'REST_API_RESOURCE';
-        },
-        'Should not be able to access other tenant data'
-      );
-    });
-    
-    it('should prevent updating tenant_id to different value', async () => {
-      // Create a project for tenant A
-      const project = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Original Project'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      // Try to update with different tenant_id - should fail
-      await assert.rejects(
-        async () => {
-          await api.resources.projects.patch({
-            inputRecord: createJsonApiDocument('projects', {
-              name: 'Updated Project',
-              tenant_id: 'tenant-b' // Trying to change tenant
-            }, null, project.data.id),
-            simplified: false
-          }, {
-            auth: { multihome_id: 'tenant-a' }
-          });
-        },
-        (err) => {
-          return err.message.includes('must match current context');
-        },
-        'Should not be able to change tenant_id'
-      );
-    });
-  });
-  
-  describe('Relationships Across Tenants', () => {
-    it('should maintain tenant isolation for related records', async () => {
-      // Create projects for different tenants
-      const projectA = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Tenant A Project'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      const projectB = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Tenant B Project'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-b' }
-      });
-      
-      // Create task for tenant A project
-      const taskA = await api.resources.tasks.post({
-        inputRecord: createJsonApiDocument('tasks', 
-          {
-            title: 'Task for Tenant A'
-          },
-          {
-            project: createRelationship(resourceIdentifier('projects', projectA.data.id))
-          }
-        ),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      // Try to create task for tenant B project as tenant A - should fail
-      await assert.rejects(
-        async () => {
-          await api.resources.tasks.post({
-            inputRecord: createJsonApiDocument('tasks', 
-              {
-                title: 'Invalid Task'
-              },
-              {
-                project: createRelationship(resourceIdentifier('projects', projectB.data.id))
-              }
-            ),
-            simplified: false
-          }, {
-            auth: { multihome_id: 'tenant-a' }
-          });
-        },
-        (err) => {
-          // Should fail because project belongs to different tenant
-          return err.code === 'REST_API_VALIDATION' || err.code === 'REST_API_RESOURCE';
-        },
-        'Should not be able to link to other tenant resources'
-      );
-      
-      // Query with includes - should only see own tenant data
-      const projectWithTasks = await api.resources.projects.get({
-        id: projectA.data.id,
-        queryParams: {
-          include: ['tasks']
-        },
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      validateJsonApiStructure(projectWithTasks);
-      assert(projectWithTasks.included, 'Should have included tasks');
-      assert.equal(projectWithTasks.included.length, 1, 'Should include one task');
-      assert.equal(projectWithTasks.included[0].attributes.tenant_id, 'tenant-a');
-    });
-  });
-  
-  describe('Excluded Resources', () => {
-    it('should allow access to excluded resources without tenant context', async () => {
-      // Create system setting without tenant context
-      const setting = await api.resources.system_settings.post({
-        inputRecord: createJsonApiDocument('system_settings', {
-          key: 'app.version',
-          value: '1.0.0'
-        }),
-        simplified: false
-      }, {
-        // No auth context
-      });
-      
-      validateJsonApiStructure(setting);
-      assert.equal(setting.data.type, 'system_settings');
-      assert(!setting.data.attributes.tenant_id, 'Should not have tenant_id');
-      
-      // Query without tenant context should work
-      const allSettings = await api.resources.system_settings.query({
-        simplified: false
-      }, {
-        // No auth context
-      });
-      
-      assert.equal(allSettings.data.length, 1);
-      
-      // Should be accessible by any tenant
-      const settingByTenantA = await api.resources.system_settings.get({
-        id: setting.data.id,
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      assert.equal(settingByTenantA.data.id, setting.data.id);
-    });
-  });
-  
-  describe('Configuration Options', () => {
-    it('should require tenant context when requireAuth is true', async () => {
-      // Try to create without tenant context - should fail
-      await assert.rejects(
-        async () => {
-          await api.resources.projects.post({
-            inputRecord: createJsonApiDocument('projects', {
-              name: 'No Tenant Project'
-            }),
-            simplified: false
-          }, {
-            // No auth context
-          });
-        },
-        (err) => {
-          return err.message.includes('multihome context');
-        },
-        'Should require tenant context when requireAuth is true'
-      );
-    });
-    
-    it('should validate resources have tenant field when allowMissing is false', async () => {
-      // This test validates that the plugin threw an error during setup
-      // if a resource was missing the tenant field. Since our test resources
-      // all have tenant_id (except excluded ones), we can verify the
-      // configuration is working by checking vars
-      assert.equal(api.vars.multihome.field, 'tenant_id');
-      assert.equal(api.vars.multihome.allowMissing, false);
-      assert(api.vars.multihome.excludeResources.includes('system_settings'));
-    });
-  });
-  
-  describe('Complex Queries', () => {
-    it('should apply tenant filter to filtered queries', async () => {
-      // Create users for different tenants
-      await api.resources.users.post({
-        inputRecord: createJsonApiDocument('users', {
-          email: 'admin@tenant-a.com',
-          name: 'Admin A',
-          role: 'admin'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      await api.resources.users.post({
-        inputRecord: createJsonApiDocument('users', {
-          email: 'user@tenant-a.com',
-          name: 'User A',
-          role: 'member'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      await api.resources.users.post({
-        inputRecord: createJsonApiDocument('users', {
-          email: 'admin@tenant-b.com',
-          name: 'Admin B',
-          role: 'admin'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-b' }
-      });
-      
-      // Query for admins as tenant A - should only see tenant A admin
-      const adminsA = await api.resources.users.query({
-        queryParams: {
-          filters: { role: 'admin' }
-        },
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      assert.equal(adminsA.data.length, 1, 'Should only see tenant A admin');
-      assert.equal(adminsA.data[0].attributes.email, 'admin@tenant-a.com');
-      
-      // Query for all users as tenant B - should only see tenant B users
-      const usersB = await api.resources.users.query({
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-b' }
-      });
-      
-      assert.equal(usersB.data.length, 1, 'Should only see tenant B users');
-      assert.equal(usersB.data[0].attributes.email, 'admin@tenant-b.com');
-    });
-    
-    it('should apply tenant filter with sorting and pagination', async () => {
-      // Create multiple projects for tenant A
-      for (let i = 1; i <= 5; i++) {
-        await api.resources.projects.post({
-          inputRecord: createJsonApiDocument('projects', {
-            name: `Project A${i}`,
-            status: i % 2 === 0 ? 'active' : 'inactive'
-          }),
-          simplified: false
-        }, {
-          auth: { multihome_id: 'tenant-a' }
-        });
-      }
-      
-      // Create projects for tenant B
-      for (let i = 1; i <= 3; i++) {
-        await api.resources.projects.post({
-          inputRecord: createJsonApiDocument('projects', {
-            name: `Project B${i}`
-          }),
-          simplified: false
-        }, {
-          auth: { multihome_id: 'tenant-b' }
-        });
-      }
-      
-      // Query with pagination as tenant A
-      const page1 = await api.resources.projects.query({
-        queryParams: {
-          page: { size: 2, number: 1 },
-          sort: ['-name'] // Sort by name descending
-        },
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      assert.equal(page1.data.length, 2, 'Should return page size');
-      assert.equal(page1.data[0].attributes.name, 'Project A5', 'Should be sorted descending');
-      assert.equal(page1.data[1].attributes.name, 'Project A4');
-      
-      // Get page 2
-      const page2 = await api.resources.projects.query({
-        queryParams: {
-          page: { size: 2, number: 2 },
-          sort: ['-name']
-        },
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      assert.equal(page2.data.length, 2, 'Should return page size');
-      assert(page2.data.every(p => p.attributes.tenant_id === 'tenant-a'));
-    });
-  });
-  
-  describe('Error Handling', () => {
-    it('should provide clear error when no tenant context available', async () => {
-      await assert.rejects(
-        async () => {
-          await api.resources.projects.query({
-            simplified: false
-          }, {
-            // No auth context
-          });
-        },
-        (err) => {
-          return err.message.includes('No multihome context available');
-        },
-        'Should provide clear error message'
-      );
-    });
-    
-    it('should handle missing tenant field gracefully for excluded resources', async () => {
-      // system_settings is excluded and doesn't have tenant_id field
-      const result = await api.resources.system_settings.post({
-        inputRecord: createJsonApiDocument('system_settings', {
-          key: 'test.setting',
-          value: 'test'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' } // Should be ignored for excluded resources
-      });
-      
-      validateJsonApiStructure(result);
-      assert(!result.data.attributes.tenant_id, 'Excluded resource should not have tenant_id');
-    });
-  });
-  
-  describe('Security', () => {
-    it('should prevent bypassing tenant filter with malicious IDs', async () => {
-      // Create a project for tenant A
-      const project = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Secure Project'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      // Try various bypass attempts as tenant B
-      const maliciousIds = [
-        project.data.id,
-        `${project.data.id} OR 1=1`,
-        `${project.data.id}'; DROP TABLE projects; --`
-      ];
-      
-      for (const id of maliciousIds) {
-        await assert.rejects(
-          async () => {
-            await api.resources.projects.get({
-              id,
-              simplified: false
-            }, {
-              auth: { multihome_id: 'tenant-b' }
-            });
-          },
-          undefined, // Any error is fine
-          `Should not bypass security with ID: ${id}`
-        );
-      }
-    });
-    
-    it('should log security violations', async () => {
-      // This test verifies that the plugin logs security violations
-      // In a real implementation, you might capture logs and verify
-      // For now, we just ensure the security check happens
-      
-      // Create data for tenant A
-      const project = await api.resources.projects.post({
-        inputRecord: createJsonApiDocument('projects', {
-          name: 'Tenant A Data'
-        }),
-        simplified: false
-      }, {
-        auth: { multihome_id: 'tenant-a' }
-      });
-      
-      // Attempt access as tenant B
-      try {
-        await api.resources.projects.get({
-          id: project.data.id,
-          simplified: false
-        }, {
-          auth: { multihome_id: 'tenant-b' }
-        });
-        assert.fail('Should have thrown error');
-      } catch (err) {
-        // Error is expected - security violation should be logged
-        assert(err.code === 'REST_API_RESOURCE' || err.message.includes('Access denied'));
-      }
-    });
-  });
-});

package/tests/ownership-optout.test.js

@@ -1,76 +0,0 @@
-import { describe, it, before, after, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-import knexLib from 'knex'
-import {
-  validateJsonApiStructure,
-  cleanTables,
-  createJsonApiDocument,
-  assertResourceAttributes
-} from './helpers/test-utils.js'
-import { createOwnershipOptOutApi } from './fixtures/api-configs.js'
-
-const knex = knexLib({
-  client: 'better-sqlite3',
-  connection: { filename: ':memory:' },
-  useNullAsDefault: true
-})
-
-let api
-
-async function createPublicItem (resourceName, name, authUserId) {
-  const doc = createJsonApiDocument(resourceName, { name })
-  const res = await api.resources[resourceName].post({
-    inputRecord: doc,
-    simplified: false
-  }, { auth: { userId: authUserId } })
-
-  validateJsonApiStructure(res)
-  assertResourceAttributes(res.data, { name })
-  return res.data
-}
-
-describe('Ownership opt-out (ownerField:false / ownership:false)', () => {
-  before(async () => {
-    api = await createOwnershipOptOutApi(knex)
-  })
-
-  after(async () => {
-    await knex.destroy()
-  })
-
-  beforeEach(async () => {
-    await cleanTables(knex, [
-      'ownopt_public_items_of',
-      'ownopt_public_items_own'
-    ])
-  })
-
-  it('ownerField:false - allows create+query without user_id column present', async () => {
-    await createPublicItem('public_items_ownerfield', 'Alpha', 1)
-    await createPublicItem('public_items_ownerfield', 'Beta', 2)
-
-    // Query with auth
-    const resultAuth = await api.resources.public_items_ownerfield.query({ simplified: false }, { auth: { userId: 1 } })
-    validateJsonApiStructure(resultAuth, true)
-    assert.equal(resultAuth.data.length, 2)
-
-    // Query without auth (ownership disabled -> no filtering)
-    const resultNoAuth = await api.resources.public_items_ownerfield.query({ simplified: false })
-    validateJsonApiStructure(resultNoAuth, true)
-    assert.equal(resultNoAuth.data.length, 2)
-  })
-
-  it('ownership:false - allows create+query without user_id column present', async () => {
-    await createPublicItem('public_items_ownership', 'Gamma', 1)
-    await createPublicItem('public_items_ownership', 'Delta', 2)
-
-    const resultAuth = await api.resources.public_items_ownership.query({ simplified: false }, { auth: { userId: 99 } })
-    validateJsonApiStructure(resultAuth, true)
-    assert.equal(resultAuth.data.length, 2)
-
-    const resultNoAuth = await api.resources.public_items_ownership.query({ simplified: false })
-    validateJsonApiStructure(resultNoAuth, true)
-    assert.equal(resultNoAuth.data.length, 2)
-  })
-})
-