245 lines
14 KiB
JavaScript
245 lines
14 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const { buildApiGroupPayload, saveApiGroup, fetchApiGroupById } = require('../src/data/api-source-groups');
|
|
const { getPendingMigrations } = require('../src/db/migrations');
|
|
const { fetchApiSourcesData, fetchApiSourceById, testApiSourceAuthentication } = require('../src/data/api-sources');
|
|
|
|
function payload(requests, auth) {
|
|
return buildApiGroupPayload(Object.assign({ name: 'Tiltify', auth_method: 'none', requests_json: JSON.stringify(requests) }, auth));
|
|
}
|
|
|
|
function createPool(existing, slides, groupEnabled = 1) {
|
|
const calls = [];
|
|
const connection = {
|
|
async beginTransaction() { calls.push(['begin']); },
|
|
async commit() { calls.push(['commit']); },
|
|
async rollback() { calls.push(['rollback']); },
|
|
release() { calls.push(['release']); },
|
|
async query(sql, params) {
|
|
calls.push([sql, params]);
|
|
if (sql.includes('SELECT id, enabled FROM i_api_source_groups WHERE id')) return [[{ id: 5, enabled: groupEnabled }]];
|
|
if (sql.includes('SELECT id FROM i_api_source_groups WHERE name')) return [[]];
|
|
if (sql.includes('SELECT id FROM i_api_sources')) return [existing.map(id => ({ id }))];
|
|
if (sql.includes('SELECT content_json')) return [(slides || []).map(value => ({ content_json: value }))];
|
|
if (sql.startsWith('INSERT INTO i_api_sources')) return [{ insertId: 99 }];
|
|
if (sql.startsWith('INSERT INTO i_api_source_groups')) return [{ insertId: 10 }];
|
|
return [{}];
|
|
}
|
|
};
|
|
return { calls, async getConnection() { return connection; } };
|
|
}
|
|
|
|
test('group payload supports public requests and independent request settings', () => {
|
|
const group = payload([{ id: 5, name: 'Event', api_url: 'https://example.com/event', update_interval_value: 2, update_interval_unit: 'hours' }, { name: 'Donors', api_url: 'https://example.com/donors', items_path: 'data', update_interval_value: 30, update_interval_unit: 'seconds', enabled: false }]);
|
|
assert.equal(group.auth.auth_method, 'none');
|
|
assert.equal(group.requests[0].id, 5);
|
|
assert.equal(group.requests[0].updateIntervalUnit, 'hours');
|
|
assert.equal(group.requests[1].itemsPath, 'data');
|
|
assert.equal(group.requests[1].enabled, 0);
|
|
assert.throws(() => payload([]), /between 1 and 50/);
|
|
assert.throws(() => payload([{ name: 'Event', api_url: 'https://example.com' }, { name: 'event', api_url: 'https://example.com' }]), /unique name/);
|
|
assert.throws(() => payload([{ id: 5, name: 'Event', api_url: 'https://example.com' }, { id: 5, name: 'Donors', api_url: 'https://example.com' }]), /repeated/);
|
|
});
|
|
|
|
test('request-level auth cannot override group authentication', () => {
|
|
const group = payload([{ name: 'Event', api_url: 'https://example.com', auth_method: 'none' }, { name: 'Donors', api_url: 'https://example.com', auth_bearer_token: 'wrong-token' }], { auth_method: 'bearer', auth_bearer_token: 'shared-token' });
|
|
assert.ok(group.requests.every(request => request.authBearerToken === 'shared-token'));
|
|
});
|
|
|
|
test('saving a group preserves request IDs and does not overwrite response snapshots', async () => {
|
|
const pool = createPool([5]);
|
|
const result = await saveApiGroup(pool, 5, payload([{ id: 5, name: 'Event', api_url: 'https://example.com/event' }, { name: 'Donors', api_url: 'https://example.com/donors' }]), 1, true);
|
|
assert.deepEqual(result.requests.map(request => request.id), [5, 99]);
|
|
assert.equal(result.id, 5);
|
|
const update = pool.calls.find(([sql]) => sql.startsWith('UPDATE i_api_sources'));
|
|
assert.ok(update);
|
|
assert.doesNotMatch(update[0], /last_response|auth_password|auth_bearer_token/);
|
|
assert.deepEqual(update[1].slice(-2), [5, 5]);
|
|
assert.ok(pool.calls.some(([sql]) => sql === 'commit'));
|
|
});
|
|
|
|
test('request ownership, slide usage, and delete permission are enforced before writes', async () => {
|
|
const request = { id: 5, name: 'Event', api_url: 'https://example.com/event' };
|
|
await assert.rejects(saveApiGroup(createPool([5]), 5, payload([{ ...request, id: 6 }]), 1, true), /does not belong/);
|
|
const used = createPool([5, 6], [JSON.stringify({ region: { type: 'api', source_id: 6 } })]);
|
|
await assert.rejects(saveApiGroup(used, 5, payload([request]), 1, true), /still used/);
|
|
assert.ok(!used.calls.some(([sql]) => sql.startsWith('UPDATE')));
|
|
await assert.rejects(saveApiGroup(createPool([5, 6]), 5, payload([request]), 1, false), /permission/);
|
|
const unused = createPool([5, 6]);
|
|
const result = await saveApiGroup(unused, 5, payload([request]), 1, true);
|
|
assert.deepEqual(result.removed, [6]);
|
|
assert.ok(unused.calls.some(([sql]) => sql.startsWith('DELETE FROM i_api_sources')));
|
|
});
|
|
|
|
test('2.16.1 migration preserves source IDs and backfills parent authentication', async () => {
|
|
const calls = [];
|
|
const pool = { async query(sql, params) {
|
|
calls.push([sql, params]);
|
|
if (sql.includes('information_schema.COLUMNS')) return [[{ column_count: 1 }]];
|
|
if (sql.includes('information_schema.TABLES')) return [[{ table_count: 0 }]];
|
|
if (sql.includes('information_schema.KEY_COLUMN_USAGE')) return [[{ fk_count: 1 }]];
|
|
return [[]];
|
|
} };
|
|
const pending = await getPendingMigrations(pool, { currentVersion: '2.16.0' });
|
|
const migration = pending.find(value => value.version === '2.16.1');
|
|
assert.ok(migration);
|
|
await migration.run(pool);
|
|
assert.ok(calls.some(([sql]) => sql.includes('INSERT IGNORE INTO i_api_source_groups (id,') && sql.includes('SELECT id,')));
|
|
assert.ok(calls.some(([sql]) => sql.includes('SET auth_source_id = id WHERE auth_source_id IS NULL')));
|
|
assert.ok(!calls.some(([sql]) => /UPDATE i_api_sources SET id\s*=/.test(sql)));
|
|
});
|
|
|
|
test('2.16.2 adds an enabled master switch without rewriting individual requests', async () => {
|
|
const calls = [];
|
|
const pool = { async query(sql) {
|
|
calls.push(sql);
|
|
if (sql.includes('information_schema.COLUMNS')) return [[{ column_count: 0 }]];
|
|
return [[]];
|
|
} };
|
|
const pending = await getPendingMigrations(pool, { currentVersion: '2.16.1' });
|
|
assert.equal(pending.length, 1);
|
|
assert.equal(pending[0].version, '2.16.2');
|
|
await pending[0].run(pool);
|
|
assert.ok(calls.some(sql => sql.includes('ALTER TABLE i_api_source_groups ADD COLUMN enabled TINYINT(1) NOT NULL DEFAULT 1')));
|
|
assert.ok(!calls.some(sql => sql.includes('UPDATE i_api_sources')));
|
|
});
|
|
|
|
test('editor/player API lists exclude credentials while refresh lookup resolves group authentication', async () => {
|
|
const queries = [];
|
|
const pool = { async query(sql) { queries.push(sql); return [[]]; } };
|
|
await fetchApiSourcesData(pool);
|
|
await fetchApiSourceById(pool, 5);
|
|
assert.doesNotMatch(queries[0], /auth_password|token_request_body_json|request\.\*/);
|
|
assert.match(queries[0], /group_name/);
|
|
assert.match(queries[1], /auth\.auth_password/);
|
|
assert.match(queries[1], /WHERE request.id = \?/);
|
|
});
|
|
|
|
test('authentication-only tests never call a data endpoint', async () => {
|
|
const originalFetch = global.fetch;
|
|
const calls = [];
|
|
global.fetch = async function (url) {
|
|
calls.push(url);
|
|
return { status: 200, ok: true, headers: { get: () => 'application/json' }, text: async () => '{"access_token":"private-token"}' };
|
|
};
|
|
try {
|
|
const result = await testApiSourceAuthentication({ auth_method: 'token_login', token_url: 'https://example.com/token', token_request_body_json: '{"secret":"private-secret"}', api_url: 'https://example.com/donors' });
|
|
assert.equal(result.ok, true);
|
|
assert.deepEqual(calls, ['https://example.com/token']);
|
|
assert.doesNotMatch(JSON.stringify(result), /private-token|private-secret/);
|
|
const publicAuth = await testApiSourceAuthentication({ auth_method: 'none' });
|
|
assert.equal(publicAuth.ok, true);
|
|
assert.equal(calls.length, 1);
|
|
} finally { global.fetch = originalFetch; }
|
|
});
|
|
|
|
test('API refresh queues a saved request without redirects and scopes task status to that request', async () => {
|
|
const registerRoutes = require('../src/web/routes/data-sources/api-sources/routes');
|
|
const routes = { get: {}, post: {} };
|
|
const queued = [];
|
|
let enabled = 1;
|
|
let taskKey = 'api-source-refresh:43';
|
|
const pool = { async query(sql, params) {
|
|
if (sql.startsWith('SELECT * FROM i_api_source_groups')) return [[{ id: 5, name: 'Tiltify' }]];
|
|
if (sql.includes('WHERE request.auth_source_id')) return [[{ id: 43, request_name: 'Event', enabled }]];
|
|
if (sql.startsWith('SELECT id FROM i_api_sources WHERE id')) return [params[0] === 43 && params[1] === 5 ? [{ id: 43 }] : []];
|
|
throw new Error('Unexpected query: ' + sql);
|
|
} };
|
|
registerRoutes({ get(path, ...handlers) { routes.get[path] = handlers; }, post(path, ...handlers) { routes.post[path] = handlers; } }, {
|
|
pool, common: {}, requirePermission: permission => permission, getAuditUserId: () => 1,
|
|
backgroundTaskQueue: { async enqueueTask(task) { queued.push(task); return { id: 101 }; } },
|
|
dataSourceTasks: { async getTaskStatusById() { return { id: 101, key: taskKey, status: 'completed' }; } }
|
|
});
|
|
function response() {
|
|
return { statusCode: 200, headers: {}, status(code) { this.statusCode = code; return this; }, set(key, value) { this.headers[key] = value; return this; }, json(body) { this.body = body; return this; }, redirect() { throw new Error('AJAX refresh must not redirect'); } };
|
|
}
|
|
const refresh = routes.post['/data-sources/api-sources/:id/requests/:requestId/refresh'];
|
|
const state = routes.get['/data-sources/api-sources/:id/requests/:requestId/state'];
|
|
assert.equal(refresh[0], 'api-sources.allow');
|
|
assert.equal(state[0], 'api-sources.allow');
|
|
const req = { params: { id: '5', requestId: '43' }, get: () => 'application/json', query: { refresh_task_id: '101' } };
|
|
const next = error => { throw error; };
|
|
const started = response();
|
|
await refresh[1](req, started, next);
|
|
assert.equal(started.statusCode, 202);
|
|
assert.equal(started.body.taskId, 101);
|
|
assert.equal(started.body.stateUrl, '/data-sources/api-sources/5/requests/43/state');
|
|
assert.equal(queued[0].payload.sourceId, 43);
|
|
const completed = response();
|
|
await state[1](req, completed, next);
|
|
assert.equal(completed.body.status, 'completed');
|
|
assert.equal(completed.headers['Cache-Control'], 'no-store');
|
|
taskKey = 'api-source-refresh:44';
|
|
const wrongTask = response();
|
|
await state[1](req, wrongTask, next);
|
|
assert.equal(wrongTask.statusCode, 404);
|
|
const wrongGroup = response();
|
|
await state[1]({ ...req, params: { id: '6', requestId: '43' } }, wrongGroup, next);
|
|
assert.equal(wrongGroup.statusCode, 404);
|
|
enabled = 0;
|
|
const disabled = response();
|
|
await refresh[1](req, disabled, next);
|
|
assert.equal(disabled.statusCode, 409);
|
|
assert.equal(queued.length, 1);
|
|
});
|
|
|
|
test('saving a disabled group does not re-enable it or erase individual request switches', async () => {
|
|
const pool = createPool([5, 6], [], 0);
|
|
const result = await saveApiGroup(pool, 5, payload([
|
|
{ id: 5, name: 'Event', api_url: 'https://example.com/event', enabled: true },
|
|
{ id: 6, name: 'Donors', api_url: 'https://example.com/donors', enabled: false }
|
|
]), 1, true);
|
|
assert.equal(result.enabled, 0);
|
|
assert.deepEqual(result.requests.map(request => request.enabled), [1, 0]);
|
|
const parentUpdate = pool.calls.find(([sql]) => sql.startsWith('UPDATE i_api_source_groups'));
|
|
assert.doesNotMatch(parentUpdate[0], /\benabled\s*=/);
|
|
});
|
|
|
|
test('disabled parent groups preserve raw request switches in the editor', async () => {
|
|
const pool = { async query(sql) {
|
|
if (sql.startsWith('SELECT * FROM i_api_source_groups')) return [[{ id: 5, enabled: 0 }]];
|
|
return [[{ id: 43, request_name: 'Event', enabled: 0, request_enabled: 1, source_enabled: 0 }]];
|
|
} };
|
|
const group = await fetchApiGroupById(pool, 5);
|
|
assert.equal(group.enabled, 0);
|
|
assert.equal(group.requests[0].enabled, 1);
|
|
assert.equal(group.requests[0].source_enabled, 0);
|
|
});
|
|
|
|
test('the master toggle changes only the group and resumes only individually enabled requests', async () => {
|
|
const registerRoutes = require('../src/web/routes/data-sources/api-sources/routes');
|
|
const routes = {};
|
|
const queries = [];
|
|
const removed = [];
|
|
const registered = [];
|
|
const requests = [{ id: 43, request_name: 'Event', request_enabled: 1 }, { id: 44, request_name: 'Donors', request_enabled: 0 }];
|
|
let enabled = 1;
|
|
const pool = { async query(sql, params) {
|
|
queries.push(sql);
|
|
if (sql.startsWith('SELECT * FROM i_api_source_groups')) return [[{ id: 5, name: 'Tiltify', enabled }]];
|
|
if (sql.includes('WHERE request.auth_source_id')) return [requests.map(request => ({ ...request, enabled: enabled && request.request_enabled, source_enabled: enabled, update_interval_value: 30, update_interval_unit: 'seconds' }))];
|
|
if (sql.startsWith('UPDATE i_api_source_groups SET enabled')) { enabled = params[0]; return [{}]; }
|
|
throw new Error('Unexpected query: ' + sql);
|
|
} };
|
|
registerRoutes({ get() {}, post(path, ...handlers) { routes[path] = handlers; } }, {
|
|
pool, common: {}, requirePermission: permission => permission, getAuditUserId: () => 1,
|
|
dataSourceTasks: { removeRecurringRefresh(type, id) { removed.push(id); }, registerRecurringRefresh(type, id) { registered.push(id); } }
|
|
});
|
|
const res = { redirect(url) { this.url = url; }, status(code) { this.statusCode = code; return this; }, json(body) { this.body = body; } };
|
|
const next = error => { throw error; };
|
|
const route = routes['/data-sources/api-sources/:id'];
|
|
assert.equal(route[0], 'api-sources.update');
|
|
const req = { params: { id: '5' }, body: { data_source_action: 'toggle', name: 'Unsaved draft must not be saved' } };
|
|
await route[1](req, res, next);
|
|
assert.equal(enabled, 0);
|
|
assert.deepEqual(removed, [43, 44]);
|
|
assert.deepEqual(registered, []);
|
|
assert.deepEqual(requests.map(request => request.request_enabled), [1, 0]);
|
|
await routes['/data-sources/api-sources/:id/requests/:requestId/refresh'][1]({ params: { id: '5', requestId: '43' } }, res, next);
|
|
assert.equal(res.statusCode, 409);
|
|
assert.match(res.body.error, /source is disabled/);
|
|
await route[1](req, res, next);
|
|
assert.equal(enabled, 1);
|
|
assert.deepEqual(registered, [43]);
|
|
assert.ok(!queries.some(sql => sql.startsWith('UPDATE i_api_sources')));
|
|
}); |