feat(documents): add Epson scanner inbox and document shelf
This commit is contained in:
248
backend/tests/scannerInbox.test.ts
Normal file
248
backend/tests/scannerInbox.test.ts
Normal file
@@ -0,0 +1,248 @@
|
||||
import assert from "node:assert/strict"
|
||||
import test from "node:test"
|
||||
import { randomUUID } from "node:crypto"
|
||||
import { execFile } from "node:child_process"
|
||||
import { promisify } from "node:util"
|
||||
import { readFile, mkdtemp, mkdir, writeFile, rm } from "node:fs/promises"
|
||||
import path from "node:path"
|
||||
import os from "node:os"
|
||||
import Fastify from "fastify"
|
||||
import { Pool } from "pg"
|
||||
import { drizzle } from "drizzle-orm/node-postgres"
|
||||
import { migrate } from "drizzle-orm/node-postgres/migrator"
|
||||
import { getTableColumns } from "drizzle-orm"
|
||||
import { PDFDocument } from "pdf-lib"
|
||||
import { files } from "../db/schema"
|
||||
import gateway from "../src/routes/scannerInboxGateway"
|
||||
import inboxRoutes from "../src/routes/documentInbox"
|
||||
import corsPlugin from "../src/plugins/cors"
|
||||
import { createScannerInboxService, SCANNER_UPLOAD_LIMIT, validateScannerFile, type ScannerInboxService } from "../src/modules/scanner-inbox.service"
|
||||
|
||||
const execute = promisify(execFile)
|
||||
const basic = (username = "scanner", password = "secret") => ({ authorization: `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}` })
|
||||
const samplePdf = Buffer.from("%PDF-1.7\nscanner fixture\n%%EOF")
|
||||
|
||||
test("scanner formats are verified independently of the supplied content type", () => {
|
||||
assert.equal(validateScannerFile("scan.PDF", samplePdf), "application/pdf")
|
||||
assert.equal(validateScannerFile("scan.jpg", Buffer.from([255, 216, 255, 0])), "image/jpeg")
|
||||
assert.equal(validateScannerFile("scan.png", Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])), "image/png")
|
||||
assert.equal(validateScannerFile("scan.tiff", Buffer.from("49492a00", "hex")), "image/tiff")
|
||||
for (const [filename, body, status] of [
|
||||
["scan.pdf", Buffer.alloc(0), 400], ["scan.pdf", Buffer.from("<html>error</html>"), 415],
|
||||
["scan.pdf", Buffer.from("%PDF-truncated"), 415], ["scan.zip", samplePdf, 415],
|
||||
["../scan.pdf", samplePdf, 400], ["a/b.pdf", samplePdf, 400], ["a\\b.pdf", samplePdf, 400],
|
||||
[".hidden.pdf", samplePdf, 400], ["a\u0000.pdf", samplePdf, 400],
|
||||
] as const) assert.throws(() => validateScannerFile(filename, body), { statusCode: status })
|
||||
assert.throws(() => validateScannerFile("large.pdf", Buffer.alloc(SCANNER_UPLOAD_LIMIT + 1)), { statusCode: 413 })
|
||||
})
|
||||
|
||||
const protocolFixture = async () => {
|
||||
const calls: any[] = []
|
||||
const service = {
|
||||
authenticate: async (username: string, password: string) => username === "scanner" && password === "secret" ? { tenantId: 7 } : null,
|
||||
accept: async (...args: any[]) => { calls.push(args); validateScannerFile(args[1], args[2]); return { created: true, checksum: "abc" } },
|
||||
find: async () => null,
|
||||
} as unknown as ScannerInboxService
|
||||
const app = Fastify()
|
||||
await app.register(gateway, { prefix: "/scanner-inbox", service })
|
||||
// Match production: the global CORS plugin is registered after the scanner gateway.
|
||||
await app.register(corsPlugin)
|
||||
return { app, calls }
|
||||
}
|
||||
|
||||
test("WebDAV authentication happens before body parsing, including discovery requests", async t => {
|
||||
const { app } = await protocolFixture()
|
||||
t.after(() => app.close())
|
||||
for (const method of ["OPTIONS", "PROPFIND", "PUT", "HEAD"] as const) {
|
||||
const res = await app.inject({ method, url: "/scanner-inbox/scan.pdf" })
|
||||
assert.equal(res.statusCode, 401)
|
||||
assert.match(res.headers["www-authenticate"] as string, /^Basic /)
|
||||
}
|
||||
const res = await app.inject({ method: "PUT", url: "/scanner-inbox/scan.pdf", headers: { ...basic("scanner", "wrong"), "content-type": "application/json" }, payload: "not json" })
|
||||
assert.equal(res.statusCode, 401)
|
||||
})
|
||||
|
||||
test("Epson discovery works with both slash forms, XML bodies and a backend proxy prefix", async t => {
|
||||
const { app } = await protocolFixture()
|
||||
t.after(() => app.close())
|
||||
for (const url of ["/scanner-inbox", "/scanner-inbox/"]) {
|
||||
const options = await app.inject({ method: "OPTIONS", url, headers: basic() })
|
||||
assert.equal(options.statusCode, 200)
|
||||
assert.match(options.headers.allow as string, /PUT/)
|
||||
const head = await app.inject({ method: "HEAD", url, headers: basic() })
|
||||
assert.equal(head.statusCode, 200)
|
||||
const res = await app.inject({ method: "PROPFIND", url, headers: { ...basic(), depth: "1", "content-type": "text/xml", "x-forwarded-prefix": "/backend" }, payload: '<d:propfind xmlns:d="DAV:"><d:allprop/></d:propfind>' })
|
||||
assert.equal(res.statusCode, 207, res.body)
|
||||
assert.match(res.body, /<d:href>\/backend\/scanner-inbox\/<\/d:href>/)
|
||||
assert.match(res.body, /<d:collection\/>/)
|
||||
assert.equal((res.body.match(/<d:response>/g) || []).length, 1)
|
||||
}
|
||||
assert.equal((await app.inject({ method: "PROPFIND", url: "/scanner-inbox/", headers: { ...basic(), depth: "infinity" } })).statusCode, 403)
|
||||
})
|
||||
|
||||
test("raw PDFs reach storage unchanged and scanner credentials cannot download or delete", async t => {
|
||||
const { app, calls } = await protocolFixture()
|
||||
t.after(() => app.close())
|
||||
for (const contentType of ["application/pdf", "application/octet-stream", undefined]) {
|
||||
const res = await app.inject({ method: "PUT", url: "/scanner-inbox/Rechnung%20%26%20Beleg.pdf", headers: { ...basic(), ...(contentType ? { "content-type": contentType } : {}) }, payload: samplePdf })
|
||||
assert.equal(res.statusCode, 201, res.body)
|
||||
assert.equal(calls.at(-1)[0].tenantId, 7)
|
||||
assert.equal(calls.at(-1)[1], "Rechnung & Beleg.pdf")
|
||||
assert.deepEqual(calls.at(-1)[2], samplePdf)
|
||||
}
|
||||
for (const method of ["GET", "DELETE", "POST", "PATCH"] as const) {
|
||||
assert.equal((await app.inject({ method, url: "/scanner-inbox/", headers: basic() })).statusCode, 405)
|
||||
}
|
||||
for (const name of ["sub/scan.pdf", "sub%2Fscan.pdf", "..%5Cscan.pdf"]) {
|
||||
assert.equal((await app.inject({ method: "PUT", url: "/scanner-inbox/" + name, headers: basic(), payload: samplePdf })).statusCode, 400)
|
||||
}
|
||||
assert.equal((await app.inject({ method: "PUT", url: "/scanner-inbox/scan.pdf", headers: { ...basic(), "content-range": "bytes 0-10/20" }, payload: samplePdf })).statusCode, 400)
|
||||
assert.equal((await app.inject({ method: "PUT", url: "/scanner-inbox/scan.pdf", headers: { ...basic(), "if-match": '"old"' }, payload: samplePdf })).statusCode, 412)
|
||||
assert.equal((await app.inject({ method: "PUT", url: "/scanner-inbox/scan.pdf", headers: { ...basic(), "content-type": "application/pdf", "content-length": String(SCANNER_UPLOAD_LIMIT + 1) }, payload: samplePdf })).statusCode, 413)
|
||||
})
|
||||
|
||||
// Uses only a disposable database and fake object storage, never DATABASE_URL or production secrets.
|
||||
test("scanner inbox integration: migration, persistence, isolation, retries and management", {
|
||||
skip: !process.env.FEDEO_TEST_POSTGRES_IMAGE,
|
||||
}, async t => {
|
||||
const container = "fedeo-scanner-inbox-test-" + randomUUID()
|
||||
const dbPassword = randomUUID()
|
||||
await execute("docker", ["run", "--rm", "-d", "--name", container, "-e", `POSTGRES_PASSWORD=${dbPassword}`, "-p", "127.0.0.1::5432", process.env.FEDEO_TEST_POSTGRES_IMAGE!])
|
||||
let pool: Pool | undefined
|
||||
const app = Fastify()
|
||||
const tempMigrations = await mkdtemp(path.join(os.tmpdir(), "fedeo-scanner-inbox-"))
|
||||
t.after(async () => {
|
||||
await app.close()
|
||||
await pool?.end()
|
||||
await execute("docker", ["rm", "-f", container])
|
||||
await rm(tempMigrations, { recursive: true, force: true })
|
||||
})
|
||||
const { stdout } = await execute("docker", ["port", container, "5432/tcp"])
|
||||
pool = new Pool({ host: "127.0.0.1", port: Number(stdout.trim().split(":").at(-1)), user: "postgres", password: dbPassword, database: "postgres", connectionTimeoutMillis: 1000 })
|
||||
for (let attempt = 0; ; attempt++) {
|
||||
try { await pool.query("SELECT 1"); break } catch (error) {
|
||||
if (attempt >= 80) throw error
|
||||
await new Promise(resolve => setTimeout(resolve, 100))
|
||||
}
|
||||
}
|
||||
const columns = Object.values(getTableColumns(files)).map(column => {
|
||||
const suffix = column.name === "id" ? " PRIMARY KEY" : column.name === "created_at" ? " DEFAULT now()" : column.name === "archived" ? " DEFAULT false" : ""
|
||||
return `"${column.name}" ${column.getSQLType()}${suffix}`
|
||||
}).join(", ")
|
||||
await pool.query(`CREATE TABLE tenants (id bigint PRIMARY KEY, locked text);
|
||||
INSERT INTO tenants VALUES (1, null), (2, null);
|
||||
CREATE TABLE files (${columns}, CHECK (name <> 'reject.pdf'));
|
||||
CREATE TABLE auth_profiles (tenant_id bigint, user_id uuid, customer_for_portal bigint);`)
|
||||
const migrationRoot = path.resolve(__dirname, "../db/migrations")
|
||||
const journal = JSON.parse(await readFile(path.join(migrationRoot, "meta/_journal.json"), "utf8"))
|
||||
const entry = journal.entries.find((item: any) => item.tag === "0073_scanner_document_inbox")
|
||||
assert.ok(entry)
|
||||
assert.ok(journal.entries.filter((item: any) => item.idx < entry.idx).every((item: any) => item.when < entry.when))
|
||||
await mkdir(path.join(tempMigrations, "meta"))
|
||||
await writeFile(path.join(tempMigrations, "meta/_journal.json"), JSON.stringify({ ...journal, entries: [entry] }))
|
||||
await writeFile(path.join(tempMigrations, entry.tag + ".sql"), await readFile(path.join(migrationRoot, entry.tag + ".sql")))
|
||||
const db = drizzle(pool) as any
|
||||
await migrate(db, { migrationsFolder: tempMigrations })
|
||||
await migrate(db, { migrationsFolder: tempMigrations })
|
||||
const stored = new Map<string, Buffer>()
|
||||
let storageFailure = false
|
||||
const service = createScannerInboxService(db, {
|
||||
async put(key, body) { stored.set(key, Buffer.from(body)); if (storageFailure) throw new Error("Simulated object store failure") },
|
||||
async remove(key) { stored.delete(key) },
|
||||
})
|
||||
const first = await service.credentials(1)
|
||||
const second = await service.credentials(2)
|
||||
assert.equal(first.password.length, 20, "Epson destination password limit")
|
||||
assert.ok(first.username.length <= 30)
|
||||
assert.equal((await service.connection(1) as any).passwordHash, undefined)
|
||||
assert.equal((await pool.query("SELECT password_hash FROM scanner_inbox_connections WHERE tenant_id=1")).rows[0].password_hash.length, 64)
|
||||
const userId = randomUUID()
|
||||
app.decorate("db", db)
|
||||
await app.register(gateway, { prefix: "/scanner-inbox", service })
|
||||
await app.register(corsPlugin)
|
||||
await app.register(async api => {
|
||||
api.addHook("onRequest", async req => {
|
||||
req.user = { tenant_id: Number(req.headers["x-test-tenant"] || 1) || null, user_id: userId, email: "test@example.invalid", is_admin: req.headers["x-test-admin"] !== "false" }
|
||||
})
|
||||
await api.register(inboxRoutes, { service })
|
||||
}, { prefix: "/api" })
|
||||
const doc = await PDFDocument.create()
|
||||
doc.addPage()
|
||||
doc.addPage()
|
||||
const pdf = Buffer.from(await doc.save())
|
||||
const send = (name: string, payload = pdf, headers: Record<string, string> = basic(first.username, first.password)) => app.inject({ method: "PUT", url: `/scanner-inbox/${encodeURIComponent(name)}`, headers: { "content-type": "application/pdf", ...headers }, payload })
|
||||
|
||||
await t.test("stores one unchanged two-page PDF as one document without extraction", async () => {
|
||||
const res = await send("scan.pdf")
|
||||
assert.equal(res.statusCode, 201, res.body)
|
||||
const row = (await pool.query("SELECT * FROM files")).rows[0]
|
||||
assert.equal(row.tenant, "1")
|
||||
assert.equal(row.mimeType, "application/pdf")
|
||||
assert.equal(row.extracted_text, null)
|
||||
assert.deepEqual(stored.get(row.path), pdf)
|
||||
assert.equal((await PDFDocument.load(stored.get(row.path)!)).getPageCount(), 2)
|
||||
const listing = await app.inject({ method: "GET", url: "/api/document-inbox" })
|
||||
assert.equal(listing.json().total, 1)
|
||||
assert.equal(listing.json().documents[0].name, "scan.pdf")
|
||||
assert.equal((await app.inject({ method: "HEAD", url: "/scanner-inbox/scan.pdf", headers: basic(first.username, first.password) })).statusCode, 200)
|
||||
})
|
||||
await t.test("serialises simultaneous retries and preserves existing content on filename conflicts", async () => {
|
||||
const retry = await Promise.all([send("scan.pdf"), send("scan.pdf")])
|
||||
assert.deepEqual(retry.map(res => res.statusCode), [204, 204])
|
||||
const concurrent = await Promise.all([send("parallel.pdf"), send("parallel.pdf")])
|
||||
assert.deepEqual(concurrent.map(res => res.statusCode).sort(), [201, 204])
|
||||
assert.equal((await send("scan.pdf", samplePdf)).statusCode, 409)
|
||||
assert.equal((await send("scan.pdf", pdf, { ...basic(first.username, first.password), "if-none-match": "*" })).statusCode, 412)
|
||||
assert.equal(stored.size, 2)
|
||||
})
|
||||
await t.test("credentials bind writes, metadata and lists to a tenant", async () => {
|
||||
const otherHeaders = basic(second.username, second.password)
|
||||
assert.equal((await app.inject({ method: "HEAD", url: "/scanner-inbox/scan.pdf", headers: otherHeaders })).statusCode, 404)
|
||||
assert.equal((await send("scan.pdf", pdf, otherHeaders)).statusCode, 201)
|
||||
const otherList = await app.inject({ method: "GET", url: "/api/document-inbox", headers: { "x-test-tenant": "2" } })
|
||||
assert.equal(otherList.json().total, 1)
|
||||
const own = await app.inject({ method: "GET", url: "/api/document-inbox?limit=1&offset=1" })
|
||||
assert.equal(own.json().total, 2)
|
||||
assert.equal(own.json().documents.length, 1)
|
||||
const filtered = await app.inject({ method: "GET", url: "/api/document-inbox?search=parallel" })
|
||||
assert.equal(filtered.json().total, 1)
|
||||
assert.equal((await app.inject({ method: "GET", url: "/api/document-inbox?limit=-1" })).statusCode, 400)
|
||||
})
|
||||
await t.test("storage and database failures leave no incomplete file or inbox entry", async () => {
|
||||
const before = stored.size
|
||||
storageFailure = true
|
||||
assert.equal((await send("failed.pdf")).statusCode, 500)
|
||||
storageFailure = false
|
||||
assert.equal(stored.size, before)
|
||||
assert.equal((await send("reject.pdf")).statusCode, 500)
|
||||
assert.equal(stored.size, before)
|
||||
assert.equal((await pool.query("SELECT count(*) FROM files WHERE name IN ('failed.pdf', 'reject.pdf')")).rows[0].count, "0")
|
||||
assert.equal((await send("failed.pdf")).statusCode, 201)
|
||||
})
|
||||
await t.test("maintenance, portal access and administrator-only settings are enforced", async () => {
|
||||
await pool.query("UPDATE tenants SET locked='maintenance_tenant' WHERE id=1")
|
||||
assert.equal((await send("maintenance.pdf")).statusCode, 423)
|
||||
await pool.query("UPDATE tenants SET locked=null WHERE id=1")
|
||||
assert.equal((await app.inject({ method: "GET", url: "/api/document-inbox", headers: { "x-test-tenant": "0" } })).statusCode, 400)
|
||||
for (const [method, url] of [["GET", "/api/document-inbox/scanner"], ["POST", "/api/document-inbox/scanner/credentials"], ["DELETE", "/api/document-inbox/scanner"]] as const) {
|
||||
assert.equal((await app.inject({ method, url, headers: { "x-test-admin": "false" } })).statusCode, 403)
|
||||
}
|
||||
assert.equal((await app.inject({ method: "GET", url: "/api/document-inbox", headers: { "x-test-admin": "false" } })).statusCode, 200)
|
||||
await pool.query("INSERT INTO auth_profiles VALUES (1, $1, 123)", [userId])
|
||||
assert.equal((await app.inject({ method: "GET", url: "/api/document-inbox" })).statusCode, 403)
|
||||
await pool.query("DELETE FROM auth_profiles")
|
||||
})
|
||||
await t.test("revocation and rotation reject old credentials without removing documents", async () => {
|
||||
const oldIdentity = await service.authenticate(first.username, first.password)
|
||||
assert.equal((await app.inject({ method: "DELETE", url: "/api/document-inbox/scanner" })).statusCode, 204)
|
||||
assert.equal((await send("disabled.pdf")).statusCode, 401)
|
||||
const rotated = await app.inject({ method: "POST", url: "/api/document-inbox/scanner/credentials" })
|
||||
assert.equal(rotated.statusCode, 200)
|
||||
assert.equal(rotated.headers["cache-control"], "no-store")
|
||||
assert.equal(rotated.json().connection.username, first.username)
|
||||
assert.equal((await send("old.pdf")).statusCode, 401)
|
||||
await assert.rejects(service.accept(oldIdentity!, "late.pdf", pdf), { statusCode: 401 })
|
||||
assert.equal((await send("new.pdf", pdf, basic(first.username, rotated.json().connection.password))).statusCode, 201)
|
||||
assert.ok((await service.list(1, 50, 0, "")).total >= 4)
|
||||
})
|
||||
})
|
||||
Reference in New Issue
Block a user