239 lines
5.3 KiB
TypeScript
239 lines
5.3 KiB
TypeScript
import { ACL } from '@nocobase/acl';
|
|
import { Database, Model } from '@nocobase/database';
|
|
import { MockServer } from '@nocobase/test';
|
|
import { changeMockUser, prepareApp } from './prepare';
|
|
|
|
describe('middleware', () => {
|
|
let app: MockServer;
|
|
let role: Model;
|
|
let db: Database;
|
|
let acl: ACL;
|
|
|
|
beforeEach(async () => {
|
|
app = await prepareApp();
|
|
db = app.db;
|
|
acl = app.acl;
|
|
|
|
await db.getRepository('roles').create({
|
|
values: {
|
|
name: 'admin',
|
|
title: 'Admin User',
|
|
allowConfigure: true,
|
|
},
|
|
});
|
|
|
|
role = await db.getRepository('roles').findOne({
|
|
filter: {
|
|
name: 'admin',
|
|
},
|
|
});
|
|
|
|
await db.getRepository('collections').create({
|
|
values: {
|
|
name: 'posts',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections.fields', 'posts').create({
|
|
values: {
|
|
name: 'title',
|
|
type: 'string',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections.fields', 'posts').create({
|
|
values: {
|
|
name: 'description',
|
|
type: 'string',
|
|
},
|
|
context: {},
|
|
});
|
|
|
|
await db.getRepository('collections.fields', 'posts').create({
|
|
values: {
|
|
name: 'createdById',
|
|
type: 'integer',
|
|
},
|
|
context: {},
|
|
});
|
|
});
|
|
|
|
afterEach(async () => {
|
|
await app.destroy();
|
|
});
|
|
|
|
it('should throw 403 when no permission', async () => {
|
|
const response = await app.agent().resource('posts').create({
|
|
values: {},
|
|
});
|
|
|
|
expect(response.statusCode).toEqual(403);
|
|
});
|
|
|
|
it('should return 200 when role has permission', async () => {
|
|
await db.getRepository('roles').update({
|
|
filterByTk: 'admin',
|
|
values: {
|
|
strategy: {
|
|
actions: ['create:all'],
|
|
},
|
|
},
|
|
});
|
|
|
|
const response = await app.agent().resource('posts').create({
|
|
values: {},
|
|
});
|
|
|
|
expect(response.statusCode).toEqual(200);
|
|
});
|
|
|
|
it('should limit fields on view actions', async () => {
|
|
await app
|
|
.agent()
|
|
.resource('roles.resources')
|
|
.create({
|
|
associatedIndex: role.get('name') as string,
|
|
values: {
|
|
name: 'posts',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
name: 'create',
|
|
fields: ['title', 'description'],
|
|
},
|
|
{
|
|
name: 'view',
|
|
fields: ['title'],
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
await app
|
|
.agent()
|
|
.resource('posts')
|
|
.create({
|
|
values: {
|
|
title: 'post-title',
|
|
description: 'post-description',
|
|
},
|
|
});
|
|
|
|
const post = await db.getRepository('posts').findOne();
|
|
expect(post.get('title')).toEqual('post-title');
|
|
expect(post.get('description')).toEqual('post-description');
|
|
|
|
const response = await app.agent().resource('posts').list({});
|
|
expect(response.statusCode).toEqual(200);
|
|
|
|
const data = response.body.data[0];
|
|
|
|
expect(data['id']).not.toBeUndefined();
|
|
expect(data['title']).toEqual('post-title');
|
|
expect(data['description']).toBeUndefined();
|
|
});
|
|
|
|
it('should parse template value on action params', async () => {
|
|
changeMockUser({
|
|
id: 2,
|
|
});
|
|
|
|
await app
|
|
.agent()
|
|
.resource('rolesResourcesScopes')
|
|
.create({
|
|
values: {
|
|
name: 'own',
|
|
scope: {
|
|
createdById: '{{ ctx.state.currentUser.id }}',
|
|
},
|
|
},
|
|
});
|
|
|
|
const scope = await db.getRepository('rolesResourcesScopes').findOne();
|
|
|
|
await app
|
|
.agent()
|
|
.resource('roles.resources')
|
|
.create({
|
|
associatedIndex: role.get('name') as string,
|
|
values: {
|
|
name: 'posts',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
name: 'create',
|
|
fields: ['title', 'description', 'createdById'],
|
|
},
|
|
{
|
|
name: 'view',
|
|
fields: ['title'],
|
|
scope: scope.get('id'),
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
await app
|
|
.agent()
|
|
.resource('posts')
|
|
.create({
|
|
values: {
|
|
title: 't1',
|
|
description: 'd1',
|
|
createdById: 1,
|
|
},
|
|
});
|
|
|
|
await app
|
|
.agent()
|
|
.resource('posts')
|
|
.create({
|
|
values: {
|
|
title: 't2',
|
|
description: 'p2',
|
|
createdById: 2,
|
|
},
|
|
});
|
|
|
|
const response = await app.agent().resource('posts').list();
|
|
const data = response.body.data;
|
|
expect(data.length).toEqual(1);
|
|
});
|
|
|
|
it('should change fields params to whitelist in create action', async () => {
|
|
await app
|
|
.agent()
|
|
.resource('roles.resources')
|
|
.create({
|
|
associatedIndex: role.get('name') as string,
|
|
values: {
|
|
name: 'posts',
|
|
usingActionsConfig: true,
|
|
actions: [
|
|
{
|
|
name: 'create',
|
|
fields: ['title'],
|
|
},
|
|
],
|
|
},
|
|
});
|
|
|
|
await app
|
|
.agent()
|
|
.resource('posts')
|
|
.create({
|
|
values: {
|
|
title: 'post-title',
|
|
description: 'post-description',
|
|
},
|
|
});
|
|
|
|
const post = await db.getRepository('posts').findOne();
|
|
expect(post.get('title')).toEqual('post-title');
|
|
expect(post.get('description')).toBeNull();
|
|
});
|
|
});
|