|
12 | 12 | * and reports it (`droppedFields`), so an edit never changes whose name a |
13 | 13 | * comment shows. A system write keeps what it supplies, as for `author_id`. |
14 | 14 | * |
| 15 | + * `author_id` is held the same way (the second describe): a row's author is |
| 16 | + * read-only after creation, like its display name. The engine strips a |
| 17 | + * non-system caller's value on update and reports it, the author's edit and a |
| 18 | + * parent editor's alike; a system write and a historical import's update |
| 19 | + * (`preserveAudit`) keep the value they supply; and a create whose session |
| 20 | + * names no user is refused, since there is nobody to record. |
| 21 | + * |
15 | 22 | * Same rig as `comment-edit-stamp.integration.test.ts` (real kernel, real |
16 | 23 | * ObjectQL, real AuditPlugin, real SQLite driver), plus the platform's |
17 | 24 | * `sys_user` object so the profile is a real row. Assertions are on the |
@@ -47,47 +54,49 @@ const boardObject = { |
47 | 54 |
|
48 | 55 | type Row = Record<string, any>; |
49 | 56 |
|
50 | | -describe('sys_comment — the display name and avatar are stamped from the caller\'s session, like the author id', () => { |
51 | | - let kernel: ObjectKernel; |
52 | | - let engine: ObjectQL; |
53 | | - |
54 | | - beforeAll(async () => { |
55 | | - kernel = new ObjectKernel({ logger: { level: 'silent' } }); |
56 | | - await kernel.use(new ObjectQLPlugin()); |
57 | | - await kernel.use(new AuditPlugin()); |
58 | | - await kernel.bootstrap(); |
59 | | - |
60 | | - engine = kernel.getService<ObjectQL>('objectql'); |
61 | | - const driver = new SqliteWasmDriver({ filename: ':memory:' }); |
62 | | - await driver.connect(); |
63 | | - engine.registerDriver(driver, true); |
64 | | - engine.registry.registerObject(SysUser as any, HARNESS_PACKAGE); |
65 | | - engine.registry.registerObject(boardObject as any, HARNESS_PACKAGE); |
66 | | - await engine.syncSchemas(); |
67 | | - await installDefaultOrganization(engine); |
68 | | - for (const user of [ADA, GRACE]) await engine.insert('sys_user', { ...user }, { context: SYS }); |
69 | | - }, 120_000); |
70 | | - |
71 | | - afterAll(async () => { |
72 | | - if (kernel) { |
73 | | - await Promise.race([kernel.shutdown(), new Promise<void>((r) => setTimeout(r, 10_000))]); |
74 | | - } |
75 | | - }, 30_000); |
76 | | - |
77 | | - const newThread = async (): Promise<string> => { |
78 | | - const board = await engine.insert(BOARD, { name: 'board' }, { context: SYS }); |
79 | | - return `${BOARD}:${board.id}`; |
80 | | - }; |
81 | | - const post = async (userId: string, payload: Row): Promise<string> => { |
82 | | - const created = await engine.insert(COMMENT, { thread_id: await newThread(), body: 'hello', ...payload }, { context: as(userId) }); |
83 | | - return String(created.id); |
84 | | - }; |
85 | | - /** The stored identity columns, and nothing else, so a failure prints exactly them. */ |
86 | | - const identity = async (id: string) => { |
87 | | - const row = (await engine.findOne(COMMENT, { where: { id }, context: SYS })) as Row; |
88 | | - return { author_id: row.author_id, author_name: row.author_name ?? null, author_avatar_url: row.author_avatar_url ?? null }; |
89 | | - }; |
| 57 | +// One rig for both describes below: the display identity and the author id it |
| 58 | +// sits beside are one component. |
| 59 | +let kernel: ObjectKernel; |
| 60 | +let engine: ObjectQL; |
| 61 | + |
| 62 | +beforeAll(async () => { |
| 63 | + kernel = new ObjectKernel({ logger: { level: 'silent' } }); |
| 64 | + await kernel.use(new ObjectQLPlugin()); |
| 65 | + await kernel.use(new AuditPlugin()); |
| 66 | + await kernel.bootstrap(); |
| 67 | + |
| 68 | + engine = kernel.getService<ObjectQL>('objectql'); |
| 69 | + const driver = new SqliteWasmDriver({ filename: ':memory:' }); |
| 70 | + await driver.connect(); |
| 71 | + engine.registerDriver(driver, true); |
| 72 | + engine.registry.registerObject(SysUser as any, HARNESS_PACKAGE); |
| 73 | + engine.registry.registerObject(boardObject as any, HARNESS_PACKAGE); |
| 74 | + await engine.syncSchemas(); |
| 75 | + await installDefaultOrganization(engine); |
| 76 | + for (const user of [ADA, GRACE]) await engine.insert('sys_user', { ...user }, { context: SYS }); |
| 77 | +}, 120_000); |
| 78 | + |
| 79 | +afterAll(async () => { |
| 80 | + if (kernel) { |
| 81 | + await Promise.race([kernel.shutdown(), new Promise<void>((r) => setTimeout(r, 10_000))]); |
| 82 | + } |
| 83 | +}, 30_000); |
| 84 | + |
| 85 | +const newThread = async (): Promise<string> => { |
| 86 | + const board = await engine.insert(BOARD, { name: 'board' }, { context: SYS }); |
| 87 | + return `${BOARD}:${board.id}`; |
| 88 | +}; |
| 89 | +const post = async (userId: string, payload: Row): Promise<string> => { |
| 90 | + const created = await engine.insert(COMMENT, { thread_id: await newThread(), body: 'hello', ...payload }, { context: as(userId) }); |
| 91 | + return String(created.id); |
| 92 | +}; |
| 93 | +/** The stored identity columns, and nothing else, so a failure prints exactly them. */ |
| 94 | +const identity = async (id: string) => { |
| 95 | + const row = (await engine.findOne(COMMENT, { where: { id }, context: SYS })) as Row; |
| 96 | + return { author_id: row.author_id, author_name: row.author_name ?? null, author_avatar_url: row.author_avatar_url ?? null }; |
| 97 | +}; |
90 | 98 |
|
| 99 | +describe('sys_comment — the display name and avatar are stamped from the caller\'s session, like the author id', () => { |
91 | 100 | it('a comment shows the caller\'s own name and avatar whatever the client sent, as its author id does', async () => { |
92 | 101 | const id = await post(ADA.id, { author_id: GRACE.id, author_name: GRACE.name, author_avatar_url: GRACE.image }); |
93 | 102 | expect(await identity(id)).toEqual({ author_id: ADA.id, author_name: ADA.name, author_avatar_url: ADA.image }); |
@@ -142,3 +151,61 @@ describe('sys_comment — the display name and avatar are stamped from the calle |
142 | 151 | expect((await identity(id)).author_name).toBe('Re-imported Name'); |
143 | 152 | }); |
144 | 153 | }); |
| 154 | + |
| 155 | +describe('sys_comment — a row\'s author is read-only after creation, like its display name', () => { |
| 156 | + /** Run one update and collect what the engine reports it dropped. */ |
| 157 | + const updateCollectingDrops = async (id: string, data: Row, context: Row): Promise<Row[]> => { |
| 158 | + const drops: Row[] = []; |
| 159 | + await engine.update(COMMENT, data, { where: { id }, context, onFieldsDropped: (e: Row) => drops.push(e) } as any); |
| 160 | + return drops; |
| 161 | + }; |
| 162 | + const authorOf = async (id: string): Promise<unknown> => |
| 163 | + ((await engine.findOne(COMMENT, { where: { id }, context: SYS })) as Row).author_id; |
| 164 | + |
| 165 | + it('the author\'s own edit never changes the author: the value is stripped and reported, and the body lands', async () => { |
| 166 | + const id = await post(ADA.id, {}); |
| 167 | + const drops = await updateCollectingDrops(id, { body: 'edited by the author', author_id: GRACE.id }, as(ADA.id)); |
| 168 | + expect(await authorOf(id)).toBe(ADA.id); |
| 169 | + expect(((await engine.findOne(COMMENT, { where: { id }, context: SYS })) as Row).body).toBe('edited by the author'); |
| 170 | + expect(drops).toEqual([ |
| 171 | + expect.objectContaining({ object: COMMENT, reason: 'readonly', fields: expect.arrayContaining(['author_id']) }), |
| 172 | + ]); |
| 173 | + }); |
| 174 | + |
| 175 | + it('a parent editor\'s edit never changes the author either', async () => { |
| 176 | + const id = await post(ADA.id, {}); |
| 177 | + const drops = await updateCollectingDrops(id, { body: 'moderated', author_id: GRACE.id }, as(GRACE.id)); |
| 178 | + expect(await authorOf(id)).toBe(ADA.id); |
| 179 | + expect(drops).toEqual([ |
| 180 | + expect.objectContaining({ object: COMMENT, reason: 'readonly', fields: expect.arrayContaining(['author_id']) }), |
| 181 | + ]); |
| 182 | + }); |
| 183 | + |
| 184 | + it('control: an ordinary edit that does not name the author lands and drops nothing', async () => { |
| 185 | + const id = await post(ADA.id, {}); |
| 186 | + const drops = await updateCollectingDrops(id, { body: 'a plain edit' }, as(ADA.id)); |
| 187 | + expect(((await engine.findOne(COMMENT, { where: { id }, context: SYS })) as Row).body).toBe('a plain edit'); |
| 188 | + expect(await authorOf(id)).toBe(ADA.id); |
| 189 | + expect(drops).toEqual([]); |
| 190 | + }); |
| 191 | + |
| 192 | + it('control: a system write keeps the author it supplies', async () => { |
| 193 | + const id = await post(ADA.id, {}); |
| 194 | + await engine.update(COMMENT, { author_id: GRACE.id }, { where: { id }, context: SYS }); |
| 195 | + expect(await authorOf(id)).toBe(GRACE.id); |
| 196 | + }); |
| 197 | + |
| 198 | + it('control: a historical import\'s update (preserveAudit) keeps the author it supplies', async () => { |
| 199 | + const id = await post(ADA.id, {}); |
| 200 | + await engine.update(COMMENT, { author_id: GRACE.id }, { where: { id }, context: { ...as(ADA.id), preserveAudit: true } }); |
| 201 | + expect(await authorOf(id)).toBe(GRACE.id); |
| 202 | + }); |
| 203 | + |
| 204 | + it('a create whose session names no user is refused: there is nobody to record as the author', async () => { |
| 205 | + const thread = await newThread(); |
| 206 | + await expect( |
| 207 | + engine.insert(COMMENT, { thread_id: thread, body: 'nobody wrote this', author_id: GRACE.id }, { context: { positions: ['org_member'] } }), |
| 208 | + ).rejects.toMatchObject({ code: 'RECORD_NOT_ACCESSIBLE', status: 403 }); |
| 209 | + expect(await engine.find(COMMENT, { where: { thread_id: thread }, context: SYS })).toEqual([]); |
| 210 | + }); |
| 211 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments