|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * objectstack#26726 — the Hook inspector authors `body.capabilities`. |
| 5 | + * |
| 6 | + * The sandbox throws on a `ctx` call the body was not granted, and the grant |
| 7 | + * list was reachable from no control: `body` is a curated key as a whole, so |
| 8 | + * the "More fields" form never drew its members either. A Studio-authored hook |
| 9 | + * that read data could only be fixed through the API. |
| 10 | + * |
| 11 | + * FIXTURE DISCIPLINE (the #3218 method): every draft is the authored hook fed |
| 12 | + * through `HookSchema.parse`, and every written body is parsed back through the |
| 13 | + * same schema, so a case cannot pass on a shape the spec refuses. |
| 14 | + */ |
| 15 | + |
| 16 | +import { describe, it, expect, vi, afterEach } from 'vitest'; |
| 17 | +import { render, screen, fireEvent, cleanup, within } from '@testing-library/react'; |
| 18 | +import { HookSchema, HookBodyCapability } from '@objectstack/spec/data'; |
| 19 | + |
| 20 | +// The object picker fetches on mount; every fixture uses `object: '*'`, so |
| 21 | +// stub the shared client and keep that fetch off the network. |
| 22 | +const state = vi.hoisted(() => ({ |
| 23 | + metadataClient: { get: vi.fn(async () => undefined), list: vi.fn(async () => [] as unknown[]) }, |
| 24 | +})); |
| 25 | +vi.mock('../useMetadata', () => ({ |
| 26 | + useMetadataClient: () => state.metadataClient, |
| 27 | +})); |
| 28 | + |
| 29 | +import { t } from '../i18n'; |
| 30 | +import { HookDefaultInspector } from './HookDefaultInspector'; |
| 31 | +// `engine.inspector.*` rows live in the lazy `studio` namespace (objectstack#25922). |
| 32 | +import { loadStudioCatalogue } from '@object-ui/i18n/namespaces/studio'; |
| 33 | +await loadStudioCatalogue('zh'); |
| 34 | + |
| 35 | +afterEach(cleanup); |
| 36 | + |
| 37 | +function hookDraft(body: Record<string, unknown>): Record<string, unknown> { |
| 38 | + return HookSchema.parse({ |
| 39 | + name: 'reads_accounts', |
| 40 | + object: '*', |
| 41 | + events: ['beforeInsert'], |
| 42 | + body, |
| 43 | + }) as unknown as Record<string, unknown>; |
| 44 | +} |
| 45 | + |
| 46 | +const JS_BODY = { language: 'js', source: 'await ctx.api.object("account").find({});' }; |
| 47 | + |
| 48 | +function renderInspector( |
| 49 | + draft: Record<string, unknown>, |
| 50 | + { serverSchema, locale = 'en-US' }: { serverSchema?: Record<string, unknown>; locale?: string } = {}, |
| 51 | +) { |
| 52 | + const onPatch = vi.fn(); |
| 53 | + render( |
| 54 | + <HookDefaultInspector |
| 55 | + type="hook" |
| 56 | + name={String(draft.name)} |
| 57 | + draft={draft} |
| 58 | + onPatch={onPatch} |
| 59 | + readOnly={false} |
| 60 | + locale={locale as never} |
| 61 | + serverSchema={serverSchema} |
| 62 | + />, |
| 63 | + ); |
| 64 | + return onPatch; |
| 65 | +} |
| 66 | + |
| 67 | +/** The body the last patch wrote. */ |
| 68 | +function writtenBody(onPatch: ReturnType<typeof vi.fn>): Record<string, unknown> { |
| 69 | + expect(onPatch).toHaveBeenCalled(); |
| 70 | + const patch = onPatch.mock.calls.at(-1)![0] as Record<string, unknown>; |
| 71 | + return patch.body as Record<string, unknown>; |
| 72 | +} |
| 73 | + |
| 74 | +/** The saved hook — the draft with the patch applied — through the spec. */ |
| 75 | +function savedHook(draft: Record<string, unknown>, body: Record<string, unknown>) { |
| 76 | + return HookSchema.parse({ ...draft, body }); |
| 77 | +} |
| 78 | + |
| 79 | +const box = (name: string) => screen.getByRole('checkbox', { name }) as HTMLInputElement; |
| 80 | + |
| 81 | +describe('HookDefaultInspector — body capabilities (objectstack#26726)', () => { |
| 82 | + it('offers one checkbox per spec token on a js body, read from the enum', () => { |
| 83 | + renderInspector(hookDraft(JS_BODY)); |
| 84 | + const control = screen.getByTestId('hook-body-capabilities'); |
| 85 | + const names = within(control) |
| 86 | + .getAllByRole('checkbox') |
| 87 | + .map((el) => el.closest('label')!.textContent); |
| 88 | + expect(names).toEqual([...HookBodyCapability.options]); |
| 89 | + // Each token names the ctx call it unlocks. |
| 90 | + expect(within(control).getByText('ctx.api.object(…).find / findOne / count / aggregate')).toBeInTheDocument(); |
| 91 | + expect(within(control).getByText('ctx.log.debug / info / warn / error')).toBeInTheDocument(); |
| 92 | + }); |
| 93 | + |
| 94 | + it('picking api.read writes body.capabilities ["api.read"], and the saved hook parses', () => { |
| 95 | + const draft = hookDraft(JS_BODY); |
| 96 | + const onPatch = renderInspector(draft); |
| 97 | + |
| 98 | + fireEvent.click(box('api.read')); |
| 99 | + |
| 100 | + const body = writtenBody(onPatch); |
| 101 | + expect(body).toEqual({ ...draft.body as object, capabilities: ['api.read'] }); |
| 102 | + expect(savedHook(draft, body).body).toMatchObject({ language: 'js', capabilities: ['api.read'] }); |
| 103 | + }); |
| 104 | + |
| 105 | + it('an existing grant round-trips: shown ticked, and a new grant is written in spec order beside it', () => { |
| 106 | + const draft = hookDraft({ ...JS_BODY, capabilities: ['log', 'api.read'] }); |
| 107 | + const onPatch = renderInspector(draft); |
| 108 | + |
| 109 | + expect(box('api.read').checked).toBe(true); |
| 110 | + expect(box('log').checked).toBe(true); |
| 111 | + expect(box('api.write').checked).toBe(false); |
| 112 | + |
| 113 | + fireEvent.click(box('api.write')); |
| 114 | + |
| 115 | + const body = writtenBody(onPatch); |
| 116 | + expect(body.capabilities).toEqual(['api.read', 'api.write', 'log']); |
| 117 | + expect(body.source).toBe(JS_BODY.source); |
| 118 | + expect(savedHook(draft, body).body).toMatchObject({ capabilities: ['api.read', 'api.write', 'log'] }); |
| 119 | + }); |
| 120 | + |
| 121 | + it('clearing the last grant writes [], the spec default', () => { |
| 122 | + const draft = hookDraft({ ...JS_BODY, capabilities: ['api.read'] }); |
| 123 | + const onPatch = renderInspector(draft); |
| 124 | + |
| 125 | + fireEvent.click(box('api.read')); |
| 126 | + |
| 127 | + const body = writtenBody(onPatch); |
| 128 | + expect(body.capabilities).toEqual([]); |
| 129 | + expect(savedHook(draft, body).body).toEqual(hookDraft(JS_BODY).body); |
| 130 | + }); |
| 131 | + |
| 132 | + it('an expression body shows no control and its edits never write the key', () => { |
| 133 | + const draft = hookDraft({ language: 'expression', source: 'record.amount >= 0' }); |
| 134 | + const onPatch = renderInspector(draft); |
| 135 | + |
| 136 | + expect(screen.queryByTestId('hook-body-capabilities')).toBeNull(); |
| 137 | + expect(screen.queryByRole('checkbox', { name: 'api.read' })).toBeNull(); |
| 138 | + |
| 139 | + fireEvent.change(screen.getByTestId('hook-body-source'), { target: { value: 'record.amount > 0' } }); |
| 140 | + const body = writtenBody(onPatch); |
| 141 | + expect(body).not.toHaveProperty('capabilities'); |
| 142 | + expect(savedHook(draft, body).body).toEqual({ language: 'expression', source: 'record.amount > 0' }); |
| 143 | + }); |
| 144 | + |
| 145 | + it('switching a granted js body to expression drops the grant, so the save still parses', async () => { |
| 146 | + const draft = hookDraft({ language: 'js', source: 'true', capabilities: ['api.read'] }); |
| 147 | + const onPatch = renderInspector(draft); |
| 148 | + |
| 149 | + // The language select is a Radix combobox button; pick through its listbox. |
| 150 | + const language = screen.getAllByRole('combobox').find((el) => el.tagName === 'BUTTON')!; |
| 151 | + fireEvent.click(language); |
| 152 | + fireEvent.click(await screen.findByRole('option', { name: t('engine.inspector.hook.bodyLang.expression', 'en-US') })); |
| 153 | + |
| 154 | + const body = writtenBody(onPatch); |
| 155 | + expect(body).toEqual({ language: 'expression', source: 'true' }); |
| 156 | + expect(() => savedHook(draft, body)).not.toThrow(); |
| 157 | + }); |
| 158 | + |
| 159 | + it('switching a js body with limits to expression drops every L2-only key, so the save still parses', async () => { |
| 160 | + const draft = hookDraft({ language: 'js', source: 'true', capabilities: ['log'], timeoutMs: 250, memoryMb: 64 }); |
| 161 | + const onPatch = renderInspector(draft); |
| 162 | + |
| 163 | + const language = screen.getAllByRole('combobox').find((el) => el.tagName === 'BUTTON')!; |
| 164 | + fireEvent.click(language); |
| 165 | + fireEvent.click(await screen.findByRole('option', { name: t('engine.inspector.hook.bodyLang.expression', 'en-US') })); |
| 166 | + |
| 167 | + const body = writtenBody(onPatch); |
| 168 | + expect(body).toEqual({ language: 'expression', source: 'true' }); |
| 169 | + expect(savedHook(draft, body).body).toEqual({ language: 'expression', source: 'true' }); |
| 170 | + }); |
| 171 | + |
| 172 | + it('a stored token the spec does not list stays visible, flagged, and is kept on the next write', () => { |
| 173 | + // Not parsed: the spec refuses this token, which is why it must not vanish unseen. |
| 174 | + const draft = { |
| 175 | + name: 'reads_accounts', |
| 176 | + object: '*', |
| 177 | + events: ['beforeInsert'], |
| 178 | + body: { ...JS_BODY, capabilities: ['api.read', 'crypto.hash'] }, |
| 179 | + }; |
| 180 | + const onPatch = renderInspector(draft); |
| 181 | + |
| 182 | + const flagged = box(`crypto.hash ${t('engine.inspector.hook.capabilityUnknown', 'en-US')}`); |
| 183 | + expect(flagged.checked).toBe(true); |
| 184 | + |
| 185 | + fireEvent.click(box('log')); |
| 186 | + expect(writtenBody(onPatch).capabilities).toEqual(['api.read', 'log', 'crypto.hash']); |
| 187 | + |
| 188 | + fireEvent.click(flagged); |
| 189 | + expect(writtenBody(onPatch).capabilities).toEqual(['api.read']); |
| 190 | + }); |
| 191 | + |
| 192 | + it('"More fields" does not draw the key a second time', () => { |
| 193 | + const serverSchema = { |
| 194 | + type: 'object', |
| 195 | + properties: { |
| 196 | + body: { |
| 197 | + type: 'object', |
| 198 | + properties: { |
| 199 | + language: { type: 'string', enum: ['js', 'expression'] }, |
| 200 | + capabilities: { type: 'array', items: { type: 'string', enum: [...HookBodyCapability.options] } }, |
| 201 | + }, |
| 202 | + }, |
| 203 | + timeout: { type: 'number', title: 'Timeout' }, |
| 204 | + }, |
| 205 | + }; |
| 206 | + renderInspector(hookDraft(JS_BODY), { serverSchema }); |
| 207 | + |
| 208 | + expect(screen.getAllByRole('checkbox', { name: 'api.read' })).toHaveLength(1); |
| 209 | + const moreFields = screen.getByText(t('engine.inspector.moreFields', 'en-US')).closest('.border-t') as HTMLElement; |
| 210 | + // Positive control: the form is drawn, with the uncurated key in it. |
| 211 | + expect(within(moreFields).getAllByText(/timeout/i).length).toBeGreaterThan(0); |
| 212 | + expect(within(moreFields).queryByText(/capabilit/i)).toBeNull(); |
| 213 | + expect(within(moreFields).queryByRole('checkbox', { name: 'api.read' })).toBeNull(); |
| 214 | + }); |
| 215 | + |
| 216 | + it('reads its words in the designer locale', () => { |
| 217 | + renderInspector(hookDraft(JS_BODY), { locale: 'zh-CN' }); |
| 218 | + const control = screen.getByTestId('hook-body-capabilities'); |
| 219 | + const zh = t('engine.inspector.hook.capabilities', 'zh-CN'); |
| 220 | + expect(zh).not.toBe(t('engine.inspector.hook.capabilities', 'en-US')); |
| 221 | + expect(within(control).getByText(zh)).toBeInTheDocument(); |
| 222 | + expect(within(control).getByText(t('engine.inspector.hook.capabilitiesHint', 'zh-CN'))).toBeInTheDocument(); |
| 223 | + }); |
| 224 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments