|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | +// |
| 3 | +// [#3946] `POST /data/:object/query` spread the request body OVER |
| 4 | +// `{ object: objectName }`, so a body `object` key moved the read to a |
| 5 | +// different object than the URL named — the same shape #3933 fixed on the REST |
| 6 | +// bulk routes, found by the follow-up sweep for that pattern. |
| 7 | +// |
| 8 | +// These run through the REAL `callData`, so they pin both halves at once: the |
| 9 | +// object the ADR-0049 exposure gate consults and the object actually queried |
| 10 | +// are the same one, and it is the one in the path. |
| 11 | + |
| 12 | +import { describe, it, expect, vi } from 'vitest'; |
| 13 | +import { handleDataRequest } from './data.js'; |
| 14 | + |
| 15 | +/** Records what the protocol service was asked for. */ |
| 16 | +function setup(objectDefs: Record<string, any> = {}) { |
| 17 | + const findData = vi.fn(async (req: any) => ({ object: req.object, records: [], total: 0 })); |
| 18 | + const protocol = { findData }; |
| 19 | + const metadata = { getObject: async (name: string) => objectDefs[name] }; |
| 20 | + const deps: any = { |
| 21 | + resolveService: async (name: string) => (name === 'protocol' ? protocol : name === 'metadata' ? metadata : null), |
| 22 | + getService: () => null, |
| 23 | + getObjectQL: async () => null, |
| 24 | + getRequestKernelService: async () => null, |
| 25 | + isMultiTenantHost: () => false, |
| 26 | + success: (data: any) => ({ status: 200, body: data }), |
| 27 | + error: (message: string, code = 500) => ({ status: code, body: { error: message } }), |
| 28 | + routeNotFound: (route: string) => ({ status: 404, body: { route } }), |
| 29 | + errorFromThrown: (e: any) => ({ status: e?.statusCode ?? e?.status ?? 500, body: { error: e?.message } }), |
| 30 | + resolveActiveOrganizationId: async () => undefined, |
| 31 | + announceKernelEvent: async () => {}, |
| 32 | + }; |
| 33 | + const context: any = { dataDriver: undefined, environmentId: undefined, executionContext: { userId: 'u1' } }; |
| 34 | + return { deps, context, findData }; |
| 35 | +} |
| 36 | + |
| 37 | +const post = (deps: any, context: any, path: string, body: any) => |
| 38 | + handleDataRequest(deps, path, 'POST', body, {}, context); |
| 39 | + |
| 40 | +describe('POST /data/:object/query binds to the object in the path (#3946)', () => { |
| 41 | + it('a body `object` cannot move the read to another object', async () => { |
| 42 | + const { deps, context, findData } = setup(); |
| 43 | + const res = await post(deps, context, 'crm_account/query', { |
| 44 | + object: 'sys_user', |
| 45 | + where: { name: 'x' }, |
| 46 | + }); |
| 47 | + |
| 48 | + expect(res.handled).toBe(true); |
| 49 | + expect(findData).toHaveBeenCalledTimes(1); |
| 50 | + expect(findData.mock.calls[0][0].object).toBe('crm_account'); |
| 51 | + }); |
| 52 | + |
| 53 | + it('the exposure gate and the read agree on the path object', async () => { |
| 54 | + // `sys_user` is hidden from the API; `crm_account` is not. Pointing the |
| 55 | + // URL at the exposed object and naming the hidden one in the body must |
| 56 | + // not read the hidden one — and must not be refused on its behalf |
| 57 | + // either. Both decisions follow the path. |
| 58 | + const { deps, context, findData } = setup({ |
| 59 | + crm_account: { apiEnabled: true }, |
| 60 | + sys_user: { apiEnabled: false }, |
| 61 | + }); |
| 62 | + |
| 63 | + const res: any = await post(deps, context, 'crm_account/query', { object: 'sys_user' }); |
| 64 | + expect(res.response.status).toBe(200); |
| 65 | + expect(findData.mock.calls[0][0].object).toBe('crm_account'); |
| 66 | + |
| 67 | + // Addressed directly, the hidden object is still refused. The gate |
| 68 | + // THROWS a `{ statusCode }` shape; the dispatcher above turns it into |
| 69 | + // an envelope (`errorFromThrown`), so assert the throw here. |
| 70 | + await expect(post(deps, context, 'sys_user/query', {})).rejects.toMatchObject({ statusCode: 404 }); |
| 71 | + expect(findData).toHaveBeenCalledTimes(1); // the refused call never read |
| 72 | + }); |
| 73 | + |
| 74 | + it('still forwards the rest of the body as the query', async () => { |
| 75 | + const { deps, context, findData } = setup(); |
| 76 | + await post(deps, context, 'crm_account/query', { where: { status: 'open' }, limit: 5 }); |
| 77 | + |
| 78 | + const req = findData.mock.calls[0][0]; |
| 79 | + expect(req.object).toBe('crm_account'); |
| 80 | + expect(req.query).toMatchObject({ where: { status: 'open' }, limit: 5 }); |
| 81 | + }); |
| 82 | + |
| 83 | + it('still honours an explicit `query` envelope', async () => { |
| 84 | + const { deps, context, findData } = setup(); |
| 85 | + await post(deps, context, 'crm_account/query', { query: { where: { status: 'open' } } }); |
| 86 | + |
| 87 | + expect(findData.mock.calls[0][0].query).toEqual({ where: { status: 'open' } }); |
| 88 | + }); |
| 89 | + |
| 90 | + it('threads the caller execution context through unchanged', async () => { |
| 91 | + const { deps, context, findData } = setup(); |
| 92 | + await post(deps, context, 'crm_account/query', { context: { userId: 'root', isSystem: true } }); |
| 93 | + |
| 94 | + expect(findData.mock.calls[0][0].context).toBe(context.executionContext); |
| 95 | + }); |
| 96 | +}); |
0 commit comments