51 lines
3.4 KiB
TypeScript
51 lines
3.4 KiB
TypeScript
import assert from "node:assert/strict"
|
|
import test from "node:test"
|
|
import Fastify from "fastify"
|
|
import communicationRoutes from "../src/routes/communication"
|
|
import { assertCustomRoomKey } from "../src/modules/communication-access"
|
|
import { collaborationDatabase, testDatabaseUrl } from "./helpers/collaboration-db"
|
|
|
|
test("custom room keys cannot impersonate system rooms", () => {
|
|
for (const key of ["allgemein", "direct_abc", "project_7"]) assert.throws(() => assertCustomRoomKey(key))
|
|
assert.doesNotThrow(() => assertCustomRoomKey("baustelle"))
|
|
})
|
|
|
|
test("chat routes protect existing memberships and assigned projects", { skip: !testDatabaseUrl }, async () => {
|
|
const fixture = await collaborationDatabase()
|
|
const app = Fastify()
|
|
const user = "00000000-0000-4000-8000-000000000001"
|
|
const other = "00000000-0000-4000-8000-000000000002"
|
|
const profile = "00000000-0000-4000-8000-000000000003"
|
|
const room = "00000000-0000-4000-8000-000000000004"
|
|
try {
|
|
await fixture.pool.query(`INSERT INTO tenants VALUES (1, 'A', null), (2, 'B', null);
|
|
INSERT INTO auth_users (id,email) VALUES ('${user}', 'a@example.test'), ('${other}', 'b@example.test');
|
|
INSERT INTO auth_tenant_users (tenant_id,user_id) VALUES (1,'${user}'), (1,'${other}');
|
|
INSERT INTO auth_profiles (id,tenant_id,user_id,first_name,last_name) VALUES ('${profile}',1,'${other}','B','Test');
|
|
INSERT INTO projects (id,tenant,name,profiles,archived) VALUES (1,1,'Hidden',ARRAY['${profile}']::uuid[],false);
|
|
INSERT INTO communication_rooms (id,tenant_id,key,name,type,archived) VALUES ('${room}',1,'private','Private','direct',false);
|
|
INSERT INTO communication_room_members (room_id,user_id) VALUES ('${room}','${other}');`)
|
|
app.decorate("db", fixture.db)
|
|
app.addHook("preHandler", async (req: any) => {
|
|
req.user = { tenant_id: 1, user_id: req.headers["x-test-user"] || user, is_admin: false }
|
|
req.hasPermission = () => false
|
|
})
|
|
await app.register(communicationRoutes)
|
|
const duplicate = await app.inject({ method: "POST", url: "/communication/chat/rooms", payload: { key: "private", name: "Open" } })
|
|
assert.equal(duplicate.statusCode, 409)
|
|
const memberships = await fixture.pool.query("SELECT user_id FROM communication_room_members WHERE room_id=$1", [room])
|
|
assert.deepEqual(memberships.rows.map((row) => row.user_id), [other])
|
|
const forbidden = await app.inject({ method: "POST", url: "/communication/chat/project-rooms/1/provision" })
|
|
assert.equal(forbidden.statusCode, 404)
|
|
const list = await app.inject("/communication/chat/project-rooms")
|
|
assert.deepEqual(list.json().rooms, [])
|
|
const assigned = await app.inject({ method: "POST", url: "/communication/chat/project-rooms/1/provision", headers: { "x-test-user": other } })
|
|
assert.equal(assigned.statusCode, 200, assigned.body)
|
|
await fixture.pool.query("UPDATE projects SET profiles='{}'::uuid[] WHERE id=1")
|
|
const removed = await app.inject({ url: "/communication/chat/rooms/project_1/messages", headers: { "x-test-user": other } })
|
|
assert.equal(removed.statusCode, 404)
|
|
await fixture.pool.query("DELETE FROM auth_tenant_users WHERE user_id=$1", [user])
|
|
assert.equal((await app.inject("/communication/chat/users")).statusCode, 403)
|
|
} finally { await app.close(); await fixture.close() }
|
|
})
|