|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * objectstack-ai/objectstack#29186 — a refused record read on an edit form says |
| 5 | + * a sentence in the reader's language, never the response body. |
| 6 | + * |
| 7 | + * `/forms/:name?recordId=ID` reads the record before it draws the form. When |
| 8 | + * that read was refused, the banner said |
| 9 | + * `Could not open record "ID" of OBJECT for editing (403): {"error":…}` — the |
| 10 | + * record id, the object's machine name, the status and the server's JSON. |
| 11 | + * |
| 12 | + * The load now reads its refusal through the same `WriteRefusal` the submit |
| 13 | + * uses, and the banner draws one fixed localized line per outcome: a denial is |
| 14 | + * "you don't have access", a `404` is "doesn't exist, or you don't have access" |
| 15 | + * (row-level security answers a hidden row with the same `404`, so the line |
| 16 | + * never tells the two apart), and anything else is the generic line. |
| 17 | + */ |
| 18 | + |
| 19 | +import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'; |
| 20 | +import { render, screen } from '@testing-library/react'; |
| 21 | +import { MemoryRouter, Route, Routes } from 'react-router-dom'; |
| 22 | +import { createI18n } from '@object-ui/i18n'; |
| 23 | +import { FormPage } from './FormPage'; |
| 24 | + |
| 25 | +vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } })); |
| 26 | + |
| 27 | +const VIEW = { |
| 28 | + name: 'showcase_task.edit', |
| 29 | + object: 'showcase_task', |
| 30 | + viewKind: 'form', |
| 31 | + label: 'Log Time', |
| 32 | + config: { type: 'simple', sections: [{ fields: ['title', 'hours'] }] }, |
| 33 | +}; |
| 34 | + |
| 35 | +const OBJECT = { |
| 36 | + name: 'showcase_task', |
| 37 | + label: 'Task', |
| 38 | + fields: { |
| 39 | + title: { type: 'text', label: 'Title' }, |
| 40 | + hours: { type: 'text', label: 'Hours' }, |
| 41 | + }, |
| 42 | +}; |
| 43 | + |
| 44 | +const RECORD_ID = 'rec_7Hq2Kx9'; |
| 45 | + |
| 46 | +/** |
| 47 | + * A `GET /data/:object/:id` on an object the caller has no read right on, as |
| 48 | + * a showcase member measured it on `showcase_contact`. |
| 49 | + */ |
| 50 | +const PERMISSION_DENIED = { |
| 51 | + status: 403, |
| 52 | + body: { |
| 53 | + error: 'You do not have permission to perform this action. Contact your administrator if you need access.', |
| 54 | + code: 'PERMISSION_DENIED', |
| 55 | + object: 'showcase_task', |
| 56 | + }, |
| 57 | +}; |
| 58 | + |
| 59 | +let writes = 0; |
| 60 | + |
| 61 | +/** One answer of the stubbed server; a string body goes out as it is. */ |
| 62 | +function answer(ok: boolean, status: number, body: unknown): Response { |
| 63 | + const text = typeof body === 'string' ? body : JSON.stringify(body); |
| 64 | + return { |
| 65 | + ok, |
| 66 | + status, |
| 67 | + statusText: ok ? 'OK' : 'Refused', |
| 68 | + json: async () => JSON.parse(text), |
| 69 | + text: async () => text, |
| 70 | + } as unknown as Response; |
| 71 | +} |
| 72 | + |
| 73 | +/** The internal edit route, its record read answered with `refusal`. */ |
| 74 | +function openEdit(refusal: { status: number; body: unknown }) { |
| 75 | + vi.stubGlobal( |
| 76 | + 'fetch', |
| 77 | + vi.fn(async (url: string, init?: RequestInit) => { |
| 78 | + const method = (init?.method ?? 'GET').toUpperCase(); |
| 79 | + if (method !== 'GET') { |
| 80 | + writes += 1; |
| 81 | + return answer(true, 200, {}); |
| 82 | + } |
| 83 | + if (String(url).includes('/meta/view/')) return answer(true, 200, VIEW); |
| 84 | + if (String(url).includes('/meta/object/')) return answer(true, 200, OBJECT); |
| 85 | + if (String(url).includes(`/data/showcase_task/${RECORD_ID}`)) { |
| 86 | + return answer(false, refusal.status, refusal.body); |
| 87 | + } |
| 88 | + throw new Error(`unstubbed fetch: ${method} ${url}`); |
| 89 | + }), |
| 90 | + ); |
| 91 | + return render( |
| 92 | + <MemoryRouter initialEntries={[`/forms/showcase_task.edit?recordId=${RECORD_ID}`]}> |
| 93 | + <Routes> |
| 94 | + <Route path="/forms/:name" element={<FormPage mode="internal" />} /> |
| 95 | + </Routes> |
| 96 | + </MemoryRouter>, |
| 97 | + ); |
| 98 | +} |
| 99 | + |
| 100 | +/** |
| 101 | + * The banner reads exactly `line`, the page says nothing of the response, and |
| 102 | + * no editable form is left behind it. |
| 103 | + */ |
| 104 | +async function expectLoadBanner(line: string, status: number) { |
| 105 | + const banner = await screen.findByText(line); |
| 106 | + expect(banner.textContent).toBe(line); |
| 107 | + const page = document.body.textContent ?? ''; |
| 108 | + expect(page).not.toContain('{'); |
| 109 | + expect(page).not.toContain(String(status)); |
| 110 | + expect(page).not.toContain(RECORD_ID); |
| 111 | + expect(page).not.toContain('showcase_task'); |
| 112 | + expect(screen.queryByLabelText(/Title/)).not.toBeInTheDocument(); |
| 113 | + expect(screen.queryByRole('button', { name: /Submit/ })).not.toBeInTheDocument(); |
| 114 | + expect(writes).toBe(0); |
| 115 | +} |
| 116 | + |
| 117 | +beforeEach(() => { |
| 118 | + writes = 0; |
| 119 | + createI18n({ defaultLanguage: 'en', detectBrowserLanguage: false }); |
| 120 | +}); |
| 121 | + |
| 122 | +afterEach(() => { |
| 123 | + vi.unstubAllGlobals(); |
| 124 | +}); |
| 125 | + |
| 126 | +describe('a refused edit-form record read draws a localized line (#29186)', () => { |
| 127 | + it('a 403 PERMISSION_DENIED read says "you don\'t have access", not the body', async () => { |
| 128 | + openEdit(PERMISSION_DENIED); |
| 129 | + await expectLoadBanner("You don't have access to this record.", 403); |
| 130 | + }); |
| 131 | + |
| 132 | + it('says the denial in the reader\'s language', async () => { |
| 133 | + createI18n({ defaultLanguage: 'zh', detectBrowserLanguage: false }); |
| 134 | + openEdit(PERMISSION_DENIED); |
| 135 | + await expectLoadBanner('您没有权限查看这条记录。', 403); |
| 136 | + }); |
| 137 | + |
| 138 | + it('a 404 says "doesn\'t exist, or you don\'t have access"', async () => { |
| 139 | + // The body a showcase member measured for an inquiry the private OWD hides |
| 140 | + // from them — the same shape a missing id answers. |
| 141 | + openEdit({ |
| 142 | + status: 404, |
| 143 | + body: { |
| 144 | + error: `Record ${RECORD_ID} not found in showcase_task`, |
| 145 | + code: 'RECORD_NOT_FOUND', |
| 146 | + object: 'showcase_task', |
| 147 | + }, |
| 148 | + }); |
| 149 | + await expectLoadBanner("This record doesn't exist, or you don't have access to it.", 404); |
| 150 | + }); |
| 151 | + |
| 152 | + it('a 404 whose text names an access rule still reads as not-found-or-hidden', async () => { |
| 153 | + // Row-level security answers a hidden row with 404; whatever its text |
| 154 | + // says, the line must not tell "hidden" from "missing". |
| 155 | + openEdit({ |
| 156 | + status: 404, |
| 157 | + body: { error: 'Access denied by row-level security policy', code: 'RECORD_NOT_FOUND' }, |
| 158 | + }); |
| 159 | + await expectLoadBanner("This record doesn't exist, or you don't have access to it.", 404); |
| 160 | + }); |
| 161 | + |
| 162 | + it('a 500 says the generic line, not the driver text', async () => { |
| 163 | + openEdit({ |
| 164 | + status: 500, |
| 165 | + body: { error: 'SQLITE_BUSY: database is locked', code: 'INTERNAL_ERROR' }, |
| 166 | + }); |
| 167 | + await expectLoadBanner('Could not open this record. Please try again.', 500); |
| 168 | + expect(document.body.textContent).not.toContain('SQLITE_BUSY'); |
| 169 | + }); |
| 170 | + |
| 171 | + it('a proxy\'s markup page says the generic line', async () => { |
| 172 | + openEdit({ status: 502, body: '<html><body><h1>502 Bad Gateway</h1></body></html>' }); |
| 173 | + await expectLoadBanner('Could not open this record. Please try again.', 502); |
| 174 | + }); |
| 175 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments