|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * The authentication pin for the datasource-admin HTTP family. |
| 5 | + * |
| 6 | + * ## Why both halves, and why on ONE boot |
| 7 | + * |
| 8 | + * This family mounts straight onto `IHttpServer` from a plugin `init()`, which |
| 9 | + * is outside every seam that produces the platform's 401s — the REST server's |
| 10 | + * `enforceAuth` and the dispatcher domains' anonymous floor both sit on routes |
| 11 | + * this registrar never passes through. A guard added here is therefore the only |
| 12 | + * thing standing between an anonymous caller and datasource lifecycle |
| 13 | + * management, and a test that only asserts the refusal cannot tell "guarded" |
| 14 | + * apart from "broken": an unconditional 401 would pass it perfectly while |
| 15 | + * taking the Setup → Datasources console offline for everyone. |
| 16 | + * |
| 17 | + * So every route below is asserted TWICE against the SAME mounted app — |
| 18 | + * `family` is built once at module scope, so the anonymous refusal and the |
| 19 | + * entitled success are answers from one boot of one registrar, not from two |
| 20 | + * differently-wired fixtures that could disagree for reasons other than the |
| 21 | + * caller's identity. |
| 22 | + * |
| 23 | + * The two halves are separate `it`s rather than one, deliberately: that is what |
| 24 | + * makes the red/green split countable when the guard is reverted — the |
| 25 | + * anonymous half must go red and the entitled half must stay green, and a |
| 26 | + * single combined case would hide the second fact behind the first failure. |
| 27 | + * |
| 28 | + * ## What "entitled" means here, and what it does not |
| 29 | + * |
| 30 | + * Exactly one thing: the caller is AUTHENTICATED. This family's guard is an |
| 31 | + * authentication floor, and nothing in this file asserts a capability — whether |
| 32 | + * these routes should further require something like `manage_platform_settings` |
| 33 | + * is a separate, separately-ruled question (#9593) and deliberately has no |
| 34 | + * scaffolding here. |
| 35 | + * |
| 36 | + * Identity is resolved by the registrar through the platform's shared |
| 37 | + * `resolveAuthzContext`, so the fake `auth` service below is the real seam a |
| 38 | + * session arrives through, not a test-only bypass. |
| 39 | + */ |
| 40 | + |
| 41 | +import { describe, it, expect, vi, beforeEach } from 'vitest'; |
| 42 | +import { HonoHttpServer } from '@objectstack/plugin-hono-server'; |
| 43 | +import { registerDatasourceAdminRoutes } from '../admin-routes.js'; |
| 44 | + |
| 45 | +/** The credential the fake `auth` service below admits. */ |
| 46 | +const ENTITLED = 'Bearer entitled-session'; |
| 47 | + |
| 48 | +/** Every service method the family dispatches to, as spies. */ |
| 49 | +function createServiceDouble() { |
| 50 | + return { |
| 51 | + listDatasources: vi.fn().mockResolvedValue([{ name: 'pg', origin: 'runtime', health: 'ok' }]), |
| 52 | + getDatasource: vi.fn().mockResolvedValue({ name: 'pg', driver: 'sqlite' }), |
| 53 | + createDatasource: vi.fn().mockResolvedValue({ name: 'created', driver: 'sqlite' }), |
| 54 | + updateDatasource: vi.fn().mockResolvedValue({ name: 'pg', driver: 'sqlite' }), |
| 55 | + removeDatasource: vi.fn().mockResolvedValue(undefined), |
| 56 | + migrateCredential: vi.fn().mockResolvedValue({ status: 'migrated' }), |
| 57 | + listRemoteTables: vi.fn().mockResolvedValue([{ name: 'customers' }]), |
| 58 | + generateObjectDraft: vi.fn().mockResolvedValue({ name: 'customer' }), |
| 59 | + // `testConnection` is claimed by BOTH services this module dispatches to |
| 60 | + // (an unsaved draft on `datasource-admin`, a saved name on |
| 61 | + // `external-datasource`); one double serves both lookups. |
| 62 | + testConnection: vi.fn().mockResolvedValue({ ok: true }), |
| 63 | + }; |
| 64 | +} |
| 65 | + |
| 66 | +/** |
| 67 | + * Mount the family once, with a fake `auth` service that admits exactly one |
| 68 | + * credential. `objectql` resolves to `undefined` — the shared resolver reads it |
| 69 | + * only to aggregate permissions, and this pin asserts authentication, so an |
| 70 | + * absent engine must not change who is admitted. |
| 71 | + */ |
| 72 | +function mountFamily() { |
| 73 | + const service = createServiceDouble(); |
| 74 | + const auth = { |
| 75 | + api: { |
| 76 | + getSession: async ({ headers }: { headers: Headers }) => |
| 77 | + headers?.get?.('authorization') === ENTITLED ? { user: { id: 'u_entitled' } } : null, |
| 78 | + }, |
| 79 | + }; |
| 80 | + const ctx = { |
| 81 | + getService: vi.fn((name: string) => { |
| 82 | + if (name === 'auth') return auth; |
| 83 | + if (name === 'objectql' || name === 'data') return undefined; |
| 84 | + return service; |
| 85 | + }), |
| 86 | + logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() }, |
| 87 | + } as any; |
| 88 | + const server = new HonoHttpServer(0); |
| 89 | + registerDatasourceAdminRoutes(server, ctx, '/api/v1'); |
| 90 | + return { app: server.getRawApp(), service }; |
| 91 | +} |
| 92 | + |
| 93 | +/** One mount for the whole file — the "same boot" both halves are asserted on. */ |
| 94 | +const family = mountFamily(); |
| 95 | + |
| 96 | +interface RouteCase { |
| 97 | + /** Reads as a sentence in the test name. */ |
| 98 | + name: string; |
| 99 | + method: 'GET' | 'POST' | 'PATCH' | 'DELETE'; |
| 100 | + path: string; |
| 101 | + body?: Record<string, unknown>; |
| 102 | + /** The status an ENTITLED caller gets. */ |
| 103 | + okStatus: number; |
| 104 | + /** |
| 105 | + * The service method this route dispatches to, if any. Asserted uncalled on |
| 106 | + * the anonymous half: refusing AFTER dispatch would still leak the write. |
| 107 | + * `GET /drivers` is static metadata and dispatches to nothing. |
| 108 | + */ |
| 109 | + dispatches?: keyof ReturnType<typeof createServiceDouble>; |
| 110 | +} |
| 111 | + |
| 112 | +/** Reads. */ |
| 113 | +const READ_CASES: RouteCase[] = [ |
| 114 | + { name: 'GET /datasources (list)', method: 'GET', path: '/api/v1/datasources', okStatus: 200, dispatches: 'listDatasources' }, |
| 115 | + { name: 'GET /datasources/drivers (driver catalog)', method: 'GET', path: '/api/v1/datasources/drivers', okStatus: 200 }, |
| 116 | + { name: 'GET /datasources/:name (read)', method: 'GET', path: '/api/v1/datasources/pg', okStatus: 200, dispatches: 'getDatasource' }, |
| 117 | + { name: 'GET /datasources/:name/remote-tables (remote-table introspection)', method: 'GET', path: '/api/v1/datasources/pg/remote-tables', okStatus: 200, dispatches: 'listRemoteTables' }, |
| 118 | +]; |
| 119 | + |
| 120 | +/** |
| 121 | + * Writes — every state-changing verb spelled out. The card's acceptance names |
| 122 | + * create, patch and remove explicitly because a list-only assertion would have |
| 123 | + * left the three routes that actually mutate the deployment unpinned. |
| 124 | + */ |
| 125 | +const WRITE_CASES: RouteCase[] = [ |
| 126 | + { name: 'POST /datasources (create)', method: 'POST', path: '/api/v1/datasources', body: { name: 'new_ds', driver: 'sqlite' }, okStatus: 201, dispatches: 'createDatasource' }, |
| 127 | + { name: 'PATCH /datasources/:name (patch)', method: 'PATCH', path: '/api/v1/datasources/pg', body: { driver: 'sqlite' }, okStatus: 200, dispatches: 'updateDatasource' }, |
| 128 | + { name: 'DELETE /datasources/:name (remove)', method: 'DELETE', path: '/api/v1/datasources/pg', okStatus: 204, dispatches: 'removeDatasource' }, |
| 129 | + { name: 'POST /datasources/test (probe an unsaved draft)', method: 'POST', path: '/api/v1/datasources/test', body: { driver: 'sqlite' }, okStatus: 200, dispatches: 'testConnection' }, |
| 130 | + { name: 'POST /datasources/:name/test (probe a saved datasource)', method: 'POST', path: '/api/v1/datasources/pg/test', body: {}, okStatus: 200, dispatches: 'testConnection' }, |
| 131 | + { name: 'POST /datasources/:name/object-draft (introspect + draft)', method: 'POST', path: '/api/v1/datasources/pg/object-draft', body: { table: 'customers' }, okStatus: 200, dispatches: 'generateObjectDraft' }, |
| 132 | + { name: 'POST /datasources/:name/migrate-credential (re-home a stored credential)', method: 'POST', path: '/api/v1/datasources/pg/migrate-credential', body: {}, okStatus: 200, dispatches: 'migrateCredential' }, |
| 133 | +]; |
| 134 | + |
| 135 | +const ALL_CASES = [...READ_CASES, ...WRITE_CASES]; |
| 136 | + |
| 137 | +async function drive(c: RouteCase, credential?: string) { |
| 138 | + const headers: Record<string, string> = { 'content-type': 'application/json' }; |
| 139 | + if (credential) headers.authorization = credential; |
| 140 | + const res = await family.app.fetch( |
| 141 | + new Request(`http://local${c.path}`, { |
| 142 | + method: c.method, |
| 143 | + headers, |
| 144 | + body: c.body === undefined ? undefined : JSON.stringify(c.body), |
| 145 | + }), |
| 146 | + ); |
| 147 | + const text = await res.text(); |
| 148 | + return { status: res.status, body: text ? JSON.parse(text) : undefined }; |
| 149 | +} |
| 150 | + |
| 151 | +beforeEach(() => { |
| 152 | + for (const fn of Object.values(family.service)) fn.mockClear(); |
| 153 | +}); |
| 154 | + |
| 155 | +describe('datasource-admin family — the anonymous caller is refused (read AND write)', () => { |
| 156 | + for (const c of ALL_CASES) { |
| 157 | + it(`${c.name} answers 401 UNAUTHENTICATED with no session`, async () => { |
| 158 | + const { status, body } = await drive(c); |
| 159 | + // The status AND the machine-readable code, not merely "not 200": the |
| 160 | + // contract this restores is the one the sibling families answer, and a |
| 161 | + // bare "not 200" would be satisfied by the 503 an unwired service gives. |
| 162 | + expect(status).toBe(401); |
| 163 | + expect(body?.error?.code).toBe('UNAUTHENTICATED'); |
| 164 | + // The refusal precedes dispatch — an anonymous DELETE that reached the |
| 165 | + // service and was refused afterwards would already have removed the row. |
| 166 | + if (c.dispatches) expect(family.service[c.dispatches]).not.toHaveBeenCalled(); |
| 167 | + }); |
| 168 | + } |
| 169 | +}); |
| 170 | + |
| 171 | +describe('datasource-admin family — the entitled caller still succeeds', () => { |
| 172 | + for (const c of ALL_CASES) { |
| 173 | + it(`${c.name} answers ${c.okStatus} for an authenticated caller`, async () => { |
| 174 | + const { status } = await drive(c, ENTITLED); |
| 175 | + expect(status).toBe(c.okStatus); |
| 176 | + if (c.dispatches) expect(family.service[c.dispatches]).toHaveBeenCalled(); |
| 177 | + }); |
| 178 | + } |
| 179 | +}); |
0 commit comments