|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#29130] A share link's `redactFields` entries must name columns of the |
| 5 | + * object, or nothing is minted. |
| 6 | + * |
| 7 | + * The mint stored the list as sent. At resolve the per-link list is unioned |
| 8 | + * with the object policy's and applied as names, so an entry matching no |
| 9 | + * column stripped nothing, while the merged list — the unknown entry included |
| 10 | + * — was handed to the landing page, which prints it as the set of hidden |
| 11 | + * fields. One misspelling served the field the minter meant to keep back under |
| 12 | + * a notice saying it was withheld. |
| 13 | + * |
| 14 | + * The column set an entry is judged against is the one a read SERVES |
| 15 | + * (`declaredColumnSet` from `@objectstack/objectql/core`: the registry's field |
| 16 | + * map plus the platform-provisioned columns), so the fake schemas below are |
| 17 | + * shaped like the registry's — `id` is NOT in the field map, as it is not in a |
| 18 | + * registered object's. |
| 19 | + * |
| 20 | + * ⛔ No bare `toThrow()`: a refusal is pinned on its `status` + `code` and on |
| 21 | + * the row never being written. |
| 22 | + */ |
| 23 | + |
| 24 | +import { describe, it, expect, beforeEach } from 'vitest'; |
| 25 | +import type { IHttpRequest, IHttpResponse, RouteHandler } from '@objectstack/spec/contracts'; |
| 26 | +import { buildShareLinkResolveAnswer } from '@objectstack/types'; |
| 27 | +import { assertEngineDeleteDispatch, assertEngineUpdateDispatch } from '@objectstack/objectql'; |
| 28 | +import { ShareLinkService } from './share-link-service.js'; |
| 29 | +import { registerShareLinkRoutes } from './share-link-routes.js'; |
| 30 | + |
| 31 | +interface FakeRow { [k: string]: any } |
| 32 | + |
| 33 | +const SCHEMAS: Record<string, any> = { |
| 34 | + sys_share_link: { name: 'sys_share_link', fields: { token: {} } }, |
| 35 | + doc: { |
| 36 | + name: 'doc', |
| 37 | + publicSharing: { enabled: true, redactFields: ['notes'] }, |
| 38 | + fields: { title: {}, body: {}, notes: {}, created_at: {}, owner_id: {} }, |
| 39 | + }, |
| 40 | + // An object that opts out of the injected audit columns: the timestamps are |
| 41 | + // still provisioned (and served), they are just not in the field map. |
| 42 | + bare: { |
| 43 | + name: 'bare', |
| 44 | + publicSharing: { enabled: true }, |
| 45 | + fields: { title: {}, body: {} }, |
| 46 | + }, |
| 47 | + // No checkable field map: the mint gives no verdict on the names. |
| 48 | + unmapped: { name: 'unmapped', publicSharing: { enabled: true } }, |
| 49 | +}; |
| 50 | + |
| 51 | +function makeEngine() { |
| 52 | + const tables: Record<string, FakeRow[]> = { |
| 53 | + doc: [{ id: 'd1', title: 'Plan', body: 'the withheld text', notes: 'n', created_at: '2026-01-01' }], |
| 54 | + bare: [{ id: 'r1', title: 'T', body: 's', created_at: '2026-01-01', updated_at: '2026-01-02' }], |
| 55 | + unmapped: [{ id: 'u1', title: 'T' }], |
| 56 | + sys_share_link: [], |
| 57 | + }; |
| 58 | + return { |
| 59 | + tables, |
| 60 | + getSchema: (name: string) => SCHEMAS[name], |
| 61 | + async find(object: string, options?: any) { |
| 62 | + const where = options?.where ?? {}; |
| 63 | + const rows = (tables[object] ?? []).filter((r) => Object.entries(where).every(([k, v]) => { |
| 64 | + if (k.startsWith('$')) throw new Error(`fake engine: unsupported operator ${k}`); |
| 65 | + return r[k] === v; |
| 66 | + })); |
| 67 | + return typeof options?.limit === 'number' ? rows.slice(0, options.limit) : rows; |
| 68 | + }, |
| 69 | + async insert(object: string, data: any) { (tables[object] ??= []).push({ ...data }); return data; }, |
| 70 | + async update(object: string, data: any, options?: any) { |
| 71 | + const verdict = assertEngineUpdateDispatch(data, options); |
| 72 | + const targets = verdict.kind === 'by-id' ? (tables[object] ?? []).filter((r) => r.id === verdict.id) : []; |
| 73 | + for (const r of targets) Object.assign(r, data); |
| 74 | + return verdict.kind === 'by-id' ? (targets[0] ?? null) : targets.length; |
| 75 | + }, |
| 76 | + async delete(_object: string, options?: any) { |
| 77 | + assertEngineDeleteDispatch(options); |
| 78 | + return { ok: true }; |
| 79 | + }, |
| 80 | + }; |
| 81 | +} |
| 82 | + |
| 83 | +async function refusal(promise: Promise<unknown>): Promise<{ status?: number; code?: string; message: string }> { |
| 84 | + try { |
| 85 | + await promise; |
| 86 | + } catch (err: any) { |
| 87 | + return { status: err.status, code: err.code, message: String(err.message) }; |
| 88 | + } |
| 89 | + throw new Error('expected the mint to be refused, it was accepted'); |
| 90 | +} |
| 91 | + |
| 92 | +describe('[#29130] share-link mint — redactFields must name columns of the object', () => { |
| 93 | + let engine: ReturnType<typeof makeEngine>; |
| 94 | + let service: ShareLinkService; |
| 95 | + |
| 96 | + beforeEach(() => { |
| 97 | + engine = makeEngine(); |
| 98 | + service = new ShareLinkService({ engine: engine as any }); |
| 99 | + }); |
| 100 | + |
| 101 | + it('refuses an entry naming no column: 400 VALIDATION_FAILED naming it, and nothing is minted', async () => { |
| 102 | + const err = await refusal( |
| 103 | + service.createLink({ object: 'doc', recordId: 'd1', redactFields: ['bdoy'] }, { userId: 'u1' } as any), |
| 104 | + ); |
| 105 | + expect(err.status).toBe(400); |
| 106 | + expect(err.code).toBe('VALIDATION_FAILED'); |
| 107 | + expect(err.message).toContain('bdoy'); |
| 108 | + expect(engine.tables.sys_share_link).toHaveLength(0); |
| 109 | + }); |
| 110 | + |
| 111 | + it('names every unknown entry, and only those, when valid and unknown names are mixed', async () => { |
| 112 | + const err = await refusal( |
| 113 | + service.createLink( |
| 114 | + { object: 'doc', recordId: 'd1', redactFields: ['body', 'bdoy', 'titel', 'bdoy'] }, |
| 115 | + { userId: 'u1' } as any, |
| 116 | + ), |
| 117 | + ); |
| 118 | + expect(err.status).toBe(400); |
| 119 | + expect(err.code).toBe('VALIDATION_FAILED'); |
| 120 | + expect(err.message).toContain('bdoy, titel'); |
| 121 | + expect(err.message).not.toMatch(/\bbody\b/); |
| 122 | + expect(engine.tables.sys_share_link).toHaveLength(0); |
| 123 | + }); |
| 124 | + |
| 125 | + it('refuses a redactFields that is not an array of names, and nothing is minted', async () => { |
| 126 | + for (const redactFields of ['body', [42], { body: true }]) { |
| 127 | + const err = await refusal( |
| 128 | + service.createLink({ object: 'doc', recordId: 'd1', redactFields: redactFields as any }, { userId: 'u1' } as any), |
| 129 | + ); |
| 130 | + expect(err.status).toBe(400); |
| 131 | + expect(err.code).toBe('VALIDATION_FAILED'); |
| 132 | + } |
| 133 | + expect(engine.tables.sys_share_link).toHaveLength(0); |
| 134 | + }); |
| 135 | + |
| 136 | + it('mints a valid name, and resolve withholds that field from the record it serves', async () => { |
| 137 | + const link = await service.createLink( |
| 138 | + { object: 'doc', recordId: 'd1', redactFields: ['body'] }, |
| 139 | + { userId: 'u1' } as any, |
| 140 | + ); |
| 141 | + expect(engine.tables.sys_share_link).toHaveLength(1); |
| 142 | + expect(engine.tables.sys_share_link[0].redact_fields).toEqual(['body']); |
| 143 | + |
| 144 | + const resolved = await service.resolveToken(link.token, {}); |
| 145 | + expect(resolved).not.toBeNull(); |
| 146 | + expect(resolved!.redactFields.sort()).toEqual(['body', 'notes']); |
| 147 | + const answer = buildShareLinkResolveAnswer(engine.tables.doc[0], resolved!, SCHEMAS.doc) as any; |
| 148 | + expect(answer.record).not.toHaveProperty('body'); |
| 149 | + expect(answer.record.title).toBe('Plan'); |
| 150 | + }); |
| 151 | + |
| 152 | + it('accepts the platform-provisioned columns a read serves, though the field map omits them', async () => { |
| 153 | + await service.createLink({ object: 'doc', recordId: 'd1', redactFields: ['id', 'created_at', 'owner_id'] }, { userId: 'u1' } as any); |
| 154 | + await service.createLink({ object: 'bare', recordId: 'r1', redactFields: ['created_at', 'updated_at'] }, { userId: 'u1' } as any); |
| 155 | + expect(engine.tables.sys_share_link.map((r) => r.redact_fields)).toEqual([ |
| 156 | + ['id', 'created_at', 'owner_id'], |
| 157 | + ['created_at', 'updated_at'], |
| 158 | + ]); |
| 159 | + }); |
| 160 | + |
| 161 | + it('keeps an omitted or empty list as no per-link redaction', async () => { |
| 162 | + await service.createLink({ object: 'doc', recordId: 'd1' }, { userId: 'u1' } as any); |
| 163 | + await service.createLink({ object: 'doc', recordId: 'd1', redactFields: [] }, { userId: 'u1' } as any); |
| 164 | + expect(engine.tables.sys_share_link.map((r) => r.redact_fields)).toEqual([null, null]); |
| 165 | + }); |
| 166 | + |
| 167 | + it('gives no verdict when the object has no checkable field map, and keeps the entries as sent', async () => { |
| 168 | + await service.createLink({ object: 'unmapped', recordId: 'u1', redactFields: ['anything'] }, { userId: 'u1' } as any); |
| 169 | + expect(engine.tables.sys_share_link[0].redact_fields).toEqual(['anything']); |
| 170 | + }); |
| 171 | + |
| 172 | + it('refuses a malformed list with the request-shape checks, before any record is read', async () => { |
| 173 | + const reads: string[] = []; |
| 174 | + const find = engine.find.bind(engine); |
| 175 | + engine.find = async (object: string, options?: any) => { reads.push(object); return find(object, options); }; |
| 176 | + const err = await refusal( |
| 177 | + service.createLink({ object: 'doc', recordId: 'missing', redactFields: 'body' as any }, { userId: 'u1' } as any), |
| 178 | + ); |
| 179 | + expect(err.status).toBe(400); |
| 180 | + expect(err.code).toBe('VALIDATION_FAILED'); |
| 181 | + expect(reads).toEqual([]); |
| 182 | + }); |
| 183 | + |
| 184 | + it('answers a caller with no authority over the record 403 before judging the names', async () => { |
| 185 | + const err = await refusal( |
| 186 | + service.createLink({ object: 'doc', recordId: 'missing', redactFields: ['bdoy'] }, { userId: 'u1' } as any), |
| 187 | + ); |
| 188 | + expect(err.status).toBe(403); |
| 189 | + expect(err.code).toBe('FORBIDDEN'); |
| 190 | + expect(err.message).not.toContain('bdoy'); |
| 191 | + }); |
| 192 | +}); |
| 193 | + |
| 194 | +describe('[#29130] share-link REST door — the mint refusal reaches the caller as its envelope', () => { |
| 195 | + function mountCreate(service: ShareLinkService, engine: ReturnType<typeof makeEngine>): RouteHandler { |
| 196 | + const routes = new Map<string, RouteHandler>(); |
| 197 | + const http = { |
| 198 | + get: (p: string, h: RouteHandler) => { routes.set(`GET ${p}`, h); }, |
| 199 | + post: (p: string, h: RouteHandler) => { routes.set(`POST ${p}`, h); }, |
| 200 | + put: () => {}, |
| 201 | + delete: () => {}, |
| 202 | + patch: () => {}, |
| 203 | + use: () => {}, |
| 204 | + listen: async () => {}, |
| 205 | + close: async () => {}, |
| 206 | + }; |
| 207 | + registerShareLinkRoutes(http as any, service, engine as any, { contextFromRequest: () => ({ userId: 'u1' }) as any }); |
| 208 | + const handler = routes.get('POST /api/v1/share-links'); |
| 209 | + if (!handler) throw new Error('fixture: no create handler'); |
| 210 | + return handler; |
| 211 | + } |
| 212 | + |
| 213 | + async function post(handler: RouteHandler, body: unknown) { |
| 214 | + const captured = { status: 200, body: undefined as any }; |
| 215 | + const res: any = { |
| 216 | + json(data: any) { captured.body = data; }, |
| 217 | + send() {}, |
| 218 | + status(code: number) { captured.status = code; return res; }, |
| 219 | + header() { return res; }, |
| 220 | + }; |
| 221 | + const url = '/api/v1/share-links'; |
| 222 | + await handler({ params: {}, query: {}, body, headers: {}, method: 'POST', path: url, url } as unknown as IHttpRequest, res as IHttpResponse); |
| 223 | + return captured; |
| 224 | + } |
| 225 | + |
| 226 | + it('POST with an unknown redactFields entry answers 400 VALIDATION_FAILED and stores no row', async () => { |
| 227 | + const engine = makeEngine(); |
| 228 | + const handler = mountCreate(new ShareLinkService({ engine: engine as any }), engine); |
| 229 | + const res = await post(handler, { object: 'doc', recordId: 'd1', redactFields: ['bdoy'] }); |
| 230 | + expect(res.status).toBe(400); |
| 231 | + expect(res.body?.success).toBe(false); |
| 232 | + expect(res.body?.error?.code).toBe('VALIDATION_FAILED'); |
| 233 | + expect(engine.tables.sys_share_link).toHaveLength(0); |
| 234 | + }); |
| 235 | + |
| 236 | + it('POST with a valid entry still answers 201 and stores it', async () => { |
| 237 | + const engine = makeEngine(); |
| 238 | + const handler = mountCreate(new ShareLinkService({ engine: engine as any }), engine); |
| 239 | + const res = await post(handler, { object: 'doc', recordId: 'd1', redactFields: ['body'] }); |
| 240 | + expect(res.status).toBe(201); |
| 241 | + expect(engine.tables.sys_share_link[0].redact_fields).toEqual(['body']); |
| 242 | + }); |
| 243 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments