|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | +// |
| 3 | +// [#3963 step 1] `book.audience: 'public'` is a declared capability, so it must |
| 4 | +// work on a secure-by-default deployment — not only on one that set |
| 5 | +// `requireAuth: false` and opened its entire data plane. The `/meta` umbrella |
| 6 | +// gate now lets an ANONYMOUS GET reach the book/doc surface, and the ADR-0046 |
| 7 | +// §6.7 audience gate inside the handler is what authorizes it. |
| 8 | +// |
| 9 | +// Every test here runs with `requireAuth: true` (the platform default). The |
| 10 | +// interesting assertions are the negative ones: reachability must not leak into |
| 11 | +// authorization, and must not leak to any other metadata type. |
| 12 | + |
| 13 | +import { describe, it, expect, vi } from 'vitest'; |
| 14 | +import { RestServer } from './rest-server'; |
| 15 | + |
| 16 | +const PUBLIC_BOOK = { name: 'manual', label: 'Manual', audience: 'public', groups: [] }; |
| 17 | +const ORG_BOOK = { name: 'internal', label: 'Internal', audience: 'org', groups: [] }; |
| 18 | +const GATED_BOOK = { name: 'admin_guide', label: 'Admin Guide', audience: { permissionSet: 'crm_admin' }, groups: [] }; |
| 19 | +const BOOKS = [PUBLIC_BOOK, ORG_BOOK, GATED_BOOK]; |
| 20 | + |
| 21 | +function createMockServer() { |
| 22 | + return { |
| 23 | + get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn(), patch: vi.fn(), use: vi.fn(), |
| 24 | + listen: vi.fn().mockResolvedValue(undefined), close: vi.fn().mockResolvedValue(undefined), |
| 25 | + }; |
| 26 | +} |
| 27 | + |
| 28 | +function makeRes() { |
| 29 | + const res: any = { statusCode: 200, body: undefined }; |
| 30 | + res.status = vi.fn((c: number) => { res.statusCode = c; return res; }); |
| 31 | + res.json = vi.fn((b: any) => { res.body = b; return res; }); |
| 32 | + res.header = vi.fn(); res.setHeader = vi.fn(); res.write = vi.fn(); res.end = vi.fn(); |
| 33 | + return res; |
| 34 | +} |
| 35 | + |
| 36 | +/** Secure-by-default: `requireAuth` is ON for every case below. */ |
| 37 | +function setup() { |
| 38 | + const protocol: any = { |
| 39 | + getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }), |
| 40 | + getMetaTypes: vi.fn().mockResolvedValue([]), |
| 41 | + getMetaItems: vi.fn(async ({ type }: any) => { |
| 42 | + const t = RestServerTypes.singular(String(type ?? '')); |
| 43 | + if (t === 'book') return BOOKS; |
| 44 | + if (t === 'object') return [{ name: 'crm_account' }]; |
| 45 | + return []; |
| 46 | + }), |
| 47 | + getMetaItem: vi.fn(async ({ name }: any) => BOOKS.find((b) => b.name === name) ?? { name }), |
| 48 | + saveMetaItem: vi.fn().mockResolvedValue({}), |
| 49 | + findData: vi.fn().mockResolvedValue([]), |
| 50 | + }; |
| 51 | + const rest = new RestServer(createMockServer() as any, protocol, { api: { requireAuth: true } } as any); |
| 52 | + rest.registerRoutes(); |
| 53 | + return { rest, protocol }; |
| 54 | +} |
| 55 | + |
| 56 | +/** Tiny local mirror of the plural↔singular normalization for the stub. */ |
| 57 | +const RestServerTypes = { |
| 58 | + singular: (t: string) => (t.endsWith('s') ? t.slice(0, -1) : t), |
| 59 | +}; |
| 60 | + |
| 61 | +function route(rest: any, method: string, path: string) { |
| 62 | + const r = rest.getRoutes().find((x: any) => x.method === method && x.path === path); |
| 63 | + if (!r) throw new Error(`route not registered: ${method} ${path}`); |
| 64 | + return r; |
| 65 | +} |
| 66 | + |
| 67 | +async function call(rest: any, method: string, path: string, params: any, query: any = {}) { |
| 68 | + const res = makeRes(); |
| 69 | + await route(rest, method, path).handler({ method, params, query, body: {} }, res); |
| 70 | + return res; |
| 71 | +} |
| 72 | + |
| 73 | +const LIST = '/api/v1/meta/:type'; |
| 74 | +const ITEM = '/api/v1/meta/:type/:name'; |
| 75 | +const names = (body: any) => { |
| 76 | + const list = Array.isArray(body) ? body : (body?.items ?? []); |
| 77 | + return list.map((b: any) => b?.name).sort(); |
| 78 | +}; |
| 79 | + |
| 80 | +describe('anonymous reachability of the book surface under requireAuth (#3963)', () => { |
| 81 | + it('an anonymous book list is served, filtered down to `public` books only', async () => { |
| 82 | + const { rest } = setup(); |
| 83 | + const res = await call(rest, 'GET', LIST, { type: 'book' }); |
| 84 | + |
| 85 | + expect(res.statusCode).toBe(200); |
| 86 | + // `org` and `{ permissionSet }` books are NOT reachable anonymously — the |
| 87 | + // §6.7 gate, not the auth gate, is what removes them. |
| 88 | + expect(names(res.body)).toEqual(['manual']); |
| 89 | + }); |
| 90 | + |
| 91 | + it('works on the plural spelling too', async () => { |
| 92 | + const { rest } = setup(); |
| 93 | + const res = await call(rest, 'GET', LIST, { type: 'books' }); |
| 94 | + |
| 95 | + expect(res.statusCode).toBe(200); |
| 96 | + expect(names(res.body)).toEqual(['manual']); |
| 97 | + }); |
| 98 | + |
| 99 | + it('an anonymous read of a `public` book by name is served', async () => { |
| 100 | + const { rest } = setup(); |
| 101 | + expect((await call(rest, 'GET', ITEM, { type: 'book', name: 'manual' })).statusCode).toBe(200); |
| 102 | + }); |
| 103 | + |
| 104 | + it('reachability is NOT authorization — org and gated books are still refused', async () => { |
| 105 | + const { rest } = setup(); |
| 106 | + expect((await call(rest, 'GET', ITEM, { type: 'book', name: 'internal' })).statusCode).toBe(401); |
| 107 | + expect((await call(rest, 'GET', ITEM, { type: 'book', name: 'admin_guide' })).statusCode).toBe(401); |
| 108 | + // …and on the plural spelling (#3984). |
| 109 | + expect((await call(rest, 'GET', ITEM, { type: 'books', name: 'admin_guide' })).statusCode).toBe(401); |
| 110 | + }); |
| 111 | +}); |
| 112 | + |
| 113 | +describe('the exemption does not widen past book/doc reads (#3963)', () => { |
| 114 | + it('every other metadata type keeps the anonymous deny', async () => { |
| 115 | + const { rest, protocol } = setup(); |
| 116 | + const res = await call(rest, 'GET', LIST, { type: 'object' }); |
| 117 | + |
| 118 | + expect(res.statusCode).toBe(401); |
| 119 | + // The handler never ran, so the protocol was never asked for object schemas. |
| 120 | + expect(protocol.getMetaItems).not.toHaveBeenCalled(); |
| 121 | + }); |
| 122 | + |
| 123 | + it('the plural spelling of another type is denied too', async () => { |
| 124 | + const { rest } = setup(); |
| 125 | + expect((await call(rest, 'GET', LIST, { type: 'objects' })).statusCode).toBe(401); |
| 126 | + expect((await call(rest, 'GET', ITEM, { type: 'objects', name: 'crm_account' })).statusCode).toBe(401); |
| 127 | + }); |
| 128 | + |
| 129 | + it('a WRITE to the book surface is still denied', async () => { |
| 130 | + const { rest, protocol } = setup(); |
| 131 | + const put = rest.getRoutes().find((r: any) => r.method === 'PUT' && r.path === ITEM); |
| 132 | + if (put) { |
| 133 | + const res = makeRes(); |
| 134 | + await put.handler({ method: 'PUT', params: { type: 'book', name: 'manual' }, query: {}, body: {} }, res); |
| 135 | + expect(res.statusCode).toBe(401); |
| 136 | + expect(protocol.saveMetaItem).not.toHaveBeenCalled(); |
| 137 | + } |
| 138 | + }); |
| 139 | + |
| 140 | + it('the type list itself (/meta) stays denied', async () => { |
| 141 | + const { rest } = setup(); |
| 142 | + const res = makeRes(); |
| 143 | + await route(rest, 'GET', '/api/v1/meta').handler({ method: 'GET', params: {}, query: {}, body: {} }, res); |
| 144 | + expect(res.statusCode).toBe(401); |
| 145 | + }); |
| 146 | +}); |
0 commit comments