|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#27899] The cross-object batch door (`POST {basePath}/batch`) judges each |
| 5 | + * op's API exposure on the object the data door would serve for the op's |
| 6 | + * name, and refuses it with the data door's own answer. |
| 7 | + * |
| 8 | + * The `/data/:object` exposure gate reads its object by name, through the read |
| 9 | + * that resolves a legacy `ns__short` object from its short name exactly as the |
| 10 | + * data door's `registry.getObject` does (#27729). The batch door's per-op gate |
| 11 | + * keyed the object LIST by each item's declared name instead, and the list |
| 12 | + * carries no such resolution: an op naming such an object by its short name |
| 13 | + * found "no object" there, passed as unknown, and was then written by the |
| 14 | + * engine, which does resolve the name. It now asks the `/data` gate's read, so |
| 15 | + * every data door gives one answer about whether an object is exposed. |
| 16 | + * |
| 17 | + * A REAL `ObjectQL` engine + `ObjectStackProtocolImplementation` on a REAL |
| 18 | + * sqlite `:memory:` driver, with `objectQLProvider` wired so the batch door is |
| 19 | + * reachable rather than answering 501; nothing below the routes is a double. |
| 20 | + */ |
| 21 | + |
| 22 | +import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'; |
| 23 | +import { ObjectQL } from '@objectstack/objectql'; |
| 24 | +import { SqlDriver } from '@objectstack/driver-sql'; |
| 25 | +import { ObjectStackProtocolImplementation } from '@objectstack/metadata-protocol'; |
| 26 | +import { SysMetadataAuditObject, SysMetadataCommitObject, SysMetadataHistoryObject, SysMetadataObject } from '@objectstack/metadata-core'; |
| 27 | +import { RestServer } from './rest-server'; |
| 28 | + |
| 29 | +const liveEngines: ObjectQL[] = []; |
| 30 | +afterEach(async () => { |
| 31 | + while (liveEngines.length) { |
| 32 | + try { await liveEngines.pop()?.destroy(); } catch { /* noop */ } |
| 33 | + } |
| 34 | +}); |
| 35 | + |
| 36 | +const fields = { |
| 37 | + id: { name: 'id', type: 'text' as const, primaryKey: true, label: 'ID' }, |
| 38 | + title: { name: 'title', type: 'text' as const, label: 'Title' }, |
| 39 | +}; |
| 40 | + |
| 41 | +/** Legacy `ns__short` objects of one package, addressed below by short name. */ |
| 42 | +const LEGACY_PACKAGE = 'app.ex_legacy'; |
| 43 | +/** Exposed: no `enable` block. */ |
| 44 | +const WIDGET = { name: 'exl__widget', label: 'Widget', systemFields: false, fields }; |
| 45 | +/** Hidden from the API. */ |
| 46 | +const VAULT = { name: 'exl__vault', label: 'Vault', systemFields: false, enable: { apiEnabled: false }, fields }; |
| 47 | +/** Exposed for reads only. */ |
| 48 | +const LEDGER = { name: 'exl__ledger', label: 'Ledger', systemFields: false, enable: { apiMethods: ['get', 'list'] }, fields }; |
| 49 | +/** A plain-named object hidden from the API: the gate's answer before this change. */ |
| 50 | +const SECRET = { name: 'ex_secret', label: 'Secret', systemFields: false, enable: { apiEnabled: false }, fields }; |
| 51 | + |
| 52 | +function makeRes() { |
| 53 | + const res: any = { |
| 54 | + write: () => true, end: () => {}, |
| 55 | + header: () => res, |
| 56 | + status: (code: number) => { res._status = code; return res; }, |
| 57 | + json: (body: any) => { res._json = body; return res; }, |
| 58 | + }; |
| 59 | + return res; |
| 60 | +} |
| 61 | + |
| 62 | +async function boot() { |
| 63 | + const engine = new ObjectQL(); |
| 64 | + liveEngines.push(engine); |
| 65 | + engine.registerDriver(new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true }), true); |
| 66 | + await engine.init(); |
| 67 | + engine.registry.installPackage({ id: LEGACY_PACKAGE, name: LEGACY_PACKAGE, version: '1.0.0' } as any, 'code'); |
| 68 | + for (const o of [WIDGET, VAULT, LEDGER]) engine.registry.registerObject(o as any, LEGACY_PACKAGE); |
| 69 | + engine.registry.registerObject(SECRET as any); |
| 70 | + await engine.syncSchemas(); |
| 71 | + // The metadata store every exposure gate reads through. Without it the |
| 72 | + // protocol's object reads answer SERVICE_UNAVAILABLE and every gate fails |
| 73 | + // OPEN by design (#3545), on this door and on the data door alike. |
| 74 | + for (const o of [SysMetadataObject, SysMetadataHistoryObject, SysMetadataAuditObject, SysMetadataCommitObject]) { |
| 75 | + if (!engine.registry.getObject(o.name)) engine.registry.registerObject(o as any); |
| 76 | + } |
| 77 | + |
| 78 | + const protocol = new ObjectStackProtocolImplementation(engine as any); |
| 79 | + const noop = () => {}; |
| 80 | + const server = { get: noop, post: noop, put: noop, delete: noop, patch: noop, use: noop, listen: async () => {}, close: async () => {} }; |
| 81 | + const rest = new RestServer( |
| 82 | + server as any, protocol as any, { api: { requireAuth: false } } as any, |
| 83 | + undefined, undefined, undefined, undefined, // kernelManager, envRegistry, defaultEnvIdProvider, authServiceProvider |
| 84 | + (async () => engine) as any, // objectQLProvider (positional arg #8) |
| 85 | + ); |
| 86 | + (rest as any).resolveExecCtx = async () => ({ userId: 'test-user' }); |
| 87 | + rest.registerRoutes(); |
| 88 | + const routes = rest.getRoutes(); |
| 89 | + const route = (path: string): any => { |
| 90 | + const found = routes.find((r: any) => r.method === 'POST' && r.path === path); |
| 91 | + if (!found) throw new Error(`route POST ${path} is not registered`); |
| 92 | + return found; |
| 93 | + }; |
| 94 | + const doors = { |
| 95 | + batch: route('/api/v1/batch'), |
| 96 | + data: route('/api/v1/data/:object'), |
| 97 | + createMany: route('/api/v1/data/:object/createMany'), |
| 98 | + }; |
| 99 | + const transaction = vi.spyOn(engine, 'transaction'); |
| 100 | + const call = async (door: keyof typeof doors, object: string | undefined, body: unknown) => { |
| 101 | + const res = makeRes(); |
| 102 | + await doors[door].handler({ method: 'POST', params: object ? { object } : {}, query: {}, headers: {}, body } as any, res); |
| 103 | + return { status: res._status ?? 200, body: res._json }; |
| 104 | + }; |
| 105 | + return { |
| 106 | + engine, |
| 107 | + transaction, |
| 108 | + batch: (operations: unknown[]) => call('batch', undefined, { operations }), |
| 109 | + data: (object: string, record: Record<string, unknown>) => call('data', object, record), |
| 110 | + createMany: (object: string, records: Array<Record<string, unknown>>) => call('createMany', object, records), |
| 111 | + /** Rows of a table, counted at the engine. */ |
| 112 | + async count(table: string) { |
| 113 | + const rows = await engine.find(table, { where: {} }); |
| 114 | + return Array.isArray(rows) ? rows.length : 0; |
| 115 | + }, |
| 116 | + }; |
| 117 | +} |
| 118 | + |
| 119 | +describe('[#27899] the batch door judges each op on the object the data door serves for its name', () => { |
| 120 | + let h: Awaited<ReturnType<typeof boot>>; |
| 121 | + beforeEach(async () => { h = await boot(); }); |
| 122 | + |
| 123 | + it('premise: the data door resolves a legacy short name and refuses the hidden object behind it', async () => { |
| 124 | + expect((h.engine.registry.getObject('vault') as any)?.name).toBe('exl__vault'); |
| 125 | + const door = await h.data('vault', { id: 'v0', title: 'x' }); |
| 126 | + expect(door.status).toBe(404); |
| 127 | + expect(door.body?.code).toBe('OBJECT_API_DISABLED'); |
| 128 | + }); |
| 129 | + |
| 130 | + for (const action of ['create', 'update', 'delete'] as const) { |
| 131 | + it(`a ${action} op on a hidden object is refused with the data door's answer, before the transaction opens`, async () => { |
| 132 | + const door = await h.data('vault', { id: 'v0', title: 'x' }); |
| 133 | + const op = action === 'create' |
| 134 | + ? { object: 'vault', action, data: { id: 'v1', title: 'x' } } |
| 135 | + : { object: 'vault', action, id: 'v1', ...(action === 'update' ? { data: { title: 'y' } } : {}) }; |
| 136 | + const batch = await h.batch([op]); |
| 137 | + expect(batch).toEqual({ status: door.status, body: door.body }); |
| 138 | + expect(h.transaction).not.toHaveBeenCalled(); |
| 139 | + expect(await h.count('exl__vault')).toBe(0); |
| 140 | + }); |
| 141 | + } |
| 142 | + |
| 143 | + it('an op the object does not expose is refused with the bulk data door\'s 405, status and body', async () => { |
| 144 | + const bulk = await h.createMany('ledger', [{ id: 'l0', title: 'x' }]); |
| 145 | + expect(bulk.status).toBe(405); |
| 146 | + expect(bulk.body?.code).toBe('OBJECT_API_METHOD_NOT_ALLOWED'); |
| 147 | + const batch = await h.batch([{ object: 'ledger', action: 'create', data: { id: 'l1', title: 'x' } }]); |
| 148 | + expect(batch).toEqual(bulk); |
| 149 | + expect(h.transaction).not.toHaveBeenCalled(); |
| 150 | + expect(await h.count('exl__ledger')).toBe(0); |
| 151 | + }); |
| 152 | + |
| 153 | + it('one refused op refuses the whole batch: an exposed op before it is never written', async () => { |
| 154 | + const batch = await h.batch([ |
| 155 | + { object: 'widget', action: 'create', data: { id: 'w1', title: 'x' } }, |
| 156 | + { object: 'vault', action: 'create', data: { id: 'v1', title: 'x' } }, |
| 157 | + ]); |
| 158 | + expect(batch.status).toBe(404); |
| 159 | + expect(batch.body?.code).toBe('OBJECT_API_DISABLED'); |
| 160 | + expect(h.transaction).not.toHaveBeenCalled(); |
| 161 | + expect(await h.count('exl__widget')).toBe(0); |
| 162 | + expect(await h.count('exl__vault')).toBe(0); |
| 163 | + }); |
| 164 | + |
| 165 | + // ── controls: answers that do not move ──────────────────────────────────── |
| 166 | + |
| 167 | + it('control: the hidden object\'s full name is refused, as it already was', async () => { |
| 168 | + const door = await h.data('exl__vault', { id: 'v0', title: 'x' }); |
| 169 | + expect(door.status).toBe(404); |
| 170 | + const batch = await h.batch([{ object: 'exl__vault', action: 'create', data: { id: 'v1', title: 'x' } }]); |
| 171 | + expect(batch).toEqual({ status: door.status, body: door.body }); |
| 172 | + expect(await h.count('exl__vault')).toBe(0); |
| 173 | + }); |
| 174 | + |
| 175 | + it('control: an exposed object is written under its short name and under its full name', async () => { |
| 176 | + const batch = await h.batch([ |
| 177 | + { object: 'widget', action: 'create', data: { id: 'w1', title: 'x' } }, |
| 178 | + { object: 'exl__widget', action: 'create', data: { id: 'w2', title: 'x' } }, |
| 179 | + ]); |
| 180 | + expect(batch.status).toBe(200); |
| 181 | + expect(batch.body?.results).toHaveLength(2); |
| 182 | + expect(h.transaction).toHaveBeenCalledTimes(1); |
| 183 | + expect(await h.count('exl__widget')).toBe(2); |
| 184 | + }); |
| 185 | + |
| 186 | + it('control: a plain-named hidden object is refused, as it already was', async () => { |
| 187 | + const door = await h.data('ex_secret', { id: 's0', title: 'x' }); |
| 188 | + expect(door.status).toBe(404); |
| 189 | + expect(door.body?.code).toBe('OBJECT_API_DISABLED'); |
| 190 | + const batch = await h.batch([{ object: 'ex_secret', action: 'create', data: { id: 's1', title: 'x' } }]); |
| 191 | + expect(batch).toEqual({ status: door.status, body: door.body }); |
| 192 | + expect(h.transaction).not.toHaveBeenCalled(); |
| 193 | + expect(await h.count('ex_secret')).toBe(0); |
| 194 | + }); |
| 195 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments