208 lines
8.0 KiB
JavaScript
208 lines
8.0 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
|
|
require('../src/common');
|
|
|
|
const registerAuditLogRoutes = require('../src/web/routes/settings/audit-log');
|
|
|
|
test('audit log uses its own read permission and shared pagination partial', async () => {
|
|
const handlers = {};
|
|
const queries = [];
|
|
const app = {
|
|
get(path, ...routeHandlers) {
|
|
handlers[path] = routeHandlers;
|
|
}
|
|
};
|
|
|
|
registerAuditLogRoutes(app, {
|
|
pool: {
|
|
async query(sql, params) {
|
|
const query = String(sql);
|
|
queries.push([query, params || []]);
|
|
if (query.includes('SELECT COUNT(*) AS count')) {
|
|
return [[{ count: 2 }]];
|
|
}
|
|
if (query.includes('SELECT DISTINCT e.event_type')) {
|
|
return [[{ event_type: 'login.failed' }, { event_type: 'login.success' }]];
|
|
}
|
|
if (query.includes('FROM o_audit_events')) {
|
|
return [[
|
|
{
|
|
id: 1,
|
|
occurred_at: '2026-08-16T12:00:00.000Z',
|
|
category: 'authentication',
|
|
event_type: 'login.success',
|
|
target_label: 'newer',
|
|
user_agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36',
|
|
details_json: JSON.stringify({
|
|
changes: {
|
|
content: {
|
|
from: { title: 'Same', body: { color: 'red', keep: 'same' } },
|
|
to: { title: 'Same', body: { color: 'blue', keep: 'same' } }
|
|
},
|
|
permissions: {
|
|
from: ['dashboard.read', 'screens.read'],
|
|
to: ['screens.read', 'playlists.read']
|
|
},
|
|
backgroundColor: {
|
|
from: null,
|
|
to: '#111111'
|
|
},
|
|
logoPath: {
|
|
from: '',
|
|
to: '/media/logo.png'
|
|
},
|
|
'content.heading.value': {
|
|
from: 'Old heading',
|
|
to: 'New heading'
|
|
},
|
|
'content.added.value': {
|
|
from: null,
|
|
to: 'Added text'
|
|
},
|
|
'content.removed.value': {
|
|
from: 'Removed text',
|
|
to: null
|
|
},
|
|
'content.qr.qr_svg': {
|
|
from: null,
|
|
to: '[Generated asset: 13 bytes; SHA-256 fingerprint]'
|
|
}
|
|
}
|
|
})
|
|
},
|
|
{
|
|
id: 2,
|
|
occurred_at: '2026-08-15T12:00:00.000Z',
|
|
category: 'authentication',
|
|
event_type: 'login.failed',
|
|
target_label: 'older',
|
|
details_json: null
|
|
}
|
|
]];
|
|
}
|
|
return [[]];
|
|
}
|
|
},
|
|
formatDashboardDate() {
|
|
return 'Aug 16, 2026';
|
|
}
|
|
});
|
|
|
|
assert.ok(handlers['/settings/audit-log']);
|
|
const request = {
|
|
currentUser: { id: 7, permissions: ['audit-log.read', 'audit-log.allow'] },
|
|
query: {}
|
|
};
|
|
let continued = false;
|
|
handlers['/settings/audit-log'][0](request, {}, function () {
|
|
continued = true;
|
|
});
|
|
assert.equal(continued, true);
|
|
|
|
const response = { send(value) { this.body = value; } };
|
|
await handlers['/settings/audit-log'][1](request, response, function (error) {
|
|
throw error;
|
|
});
|
|
assert.match(response.body, /Audit log/);
|
|
assert.ok(response.body.indexOf('>All categories</option>') < response.body.indexOf('>announcements</option>'));
|
|
assert.ok(response.body.indexOf('>announcements</option>') < response.body.indexOf('>api-sources</option>'));
|
|
assert.ok(response.body.indexOf('>api-sources</option>') < response.body.indexOf('>canvas-sizes</option>'));
|
|
assert.match(response.body, /table-pagination/);
|
|
assert.match(response.body, /data-local-datetime/);
|
|
assert.match(response.body, /audit-event-type-options/);
|
|
assert.match(response.body, /login\.success/);
|
|
assert.match(response.body, />Chrome 150\.0\.0\.0 on Windows</);
|
|
assert.doesNotMatch(response.body, /Mozilla\/5\.0 \(Windows NT 10\.0; Win64; x64\)/);
|
|
assert.match(response.body, /content\.body\.color/);
|
|
assert.match(response.body, />red</);
|
|
assert.match(response.body, />blue</);
|
|
assert.doesNotMatch(response.body, /content\.body\.keep/);
|
|
assert.match(response.body, /permissions removed/);
|
|
assert.match(response.body, /permissions added/);
|
|
assert.match(response.body, /dashboard\.read/);
|
|
assert.match(response.body, /playlists\.read/);
|
|
assert.match(response.body, /backgroundColor added/);
|
|
assert.match(response.body, /logoPath added/);
|
|
assert.match(response.body, /content\.heading\.value/);
|
|
assert.match(response.body, />New heading</);
|
|
assert.match(response.body, /content\.added\.value added/);
|
|
assert.match(response.body, /content\.removed\.value removed/);
|
|
assert.match(response.body, /Generated asset: 13 bytes; SHA-256 fingerprint/);
|
|
assert.ok(response.body.indexOf('login.success') < response.body.indexOf('login.failed'));
|
|
assert.match(response.body, />Export</);
|
|
assert.ok(handlers['/settings/audit-log/export']);
|
|
const pageQuery = queries.find(([sql]) => sql.includes('LIMIT ? OFFSET ?'));
|
|
assert.ok(pageQuery);
|
|
assert.match(pageQuery[0], /ORDER BY e\.occurred_at DESC, e\.id DESC LIMIT \? OFFSET \?/);
|
|
assert.deepEqual(pageQuery[1].slice(-2), [25, 0]);
|
|
assert.ok(queries.some(([sql]) => sql.includes('SELECT COUNT(*) AS count')));
|
|
assert.ok(queries.some(([sql]) => sql.includes('SELECT DISTINCT e.event_type') && /WHERE e\.event_type IS NOT NULL/.test(sql)));
|
|
|
|
const exportResponse = {
|
|
headers: {},
|
|
setHeader(name, value) { this.headers[name] = value; },
|
|
send(value) { this.body = value; }
|
|
};
|
|
await handlers['/settings/audit-log/export'][1](request, exportResponse, function (error) {
|
|
throw error;
|
|
});
|
|
assert.match(exportResponse.headers['Content-Type'], /text\/csv/);
|
|
assert.match(exportResponse.body, /Occurred At \(UTC\)/);
|
|
assert.match(exportResponse.body, /login.success/);
|
|
const exportQuery = queries.filter(([sql]) => sql.includes('FROM o_audit_events') && !sql.includes('SELECT COUNT(*)') && !sql.includes('SELECT DISTINCT')).at(-1);
|
|
assert.ok(exportQuery);
|
|
assert.doesNotMatch(exportQuery[0], /LIMIT \?/);
|
|
});
|
|
|
|
test('audit log applies SQL filters, escaped search, and selected sort before pagination', async () => {
|
|
const handlers = {};
|
|
const queries = [];
|
|
const app = {
|
|
get(path, ...routeHandlers) {
|
|
handlers[path] = routeHandlers;
|
|
}
|
|
};
|
|
|
|
registerAuditLogRoutes(app, {
|
|
pool: {
|
|
async query(sql, params) {
|
|
const query = String(sql);
|
|
queries.push([query, params || []]);
|
|
if (query.includes('SELECT COUNT(*) AS count')) return [[{ count: 40 }]];
|
|
return [[]];
|
|
}
|
|
},
|
|
formatDashboardDate() {
|
|
return '';
|
|
}
|
|
});
|
|
|
|
await handlers['/settings/audit-log'][1]({
|
|
currentUser: { id: 7, permissions: ['audit-log.read'] },
|
|
query: {
|
|
category: 'Authentication',
|
|
event_type: 'Login.Success',
|
|
search: ' Alice%_ ',
|
|
sort: 'actor',
|
|
direction: 'desc',
|
|
page: '2'
|
|
}
|
|
}, { send() {} }, function (error) {
|
|
throw error;
|
|
});
|
|
|
|
const countQuery = queries.find(([sql]) => sql.includes('SELECT COUNT(*) AS count'));
|
|
const pageQuery = queries.find(([sql]) => sql.includes('LIMIT ? OFFSET ?'));
|
|
const eventTypesQuery = queries.find(([sql]) => sql.includes('SELECT DISTINCT e.event_type'));
|
|
assert.ok(countQuery);
|
|
assert.ok(pageQuery);
|
|
assert.ok(eventTypesQuery);
|
|
assert.match(countQuery[0], /e\.category = \? AND e\.event_type = \?/);
|
|
assert.match(countQuery[0], /LOWER\(COALESCE\(CAST\(e\.category AS CHAR\)/);
|
|
assert.deepEqual(countQuery[1].slice(0, 2), ['authentication', 'login.success']);
|
|
assert.ok(countQuery[1].includes('%alice\\%\\_%'));
|
|
assert.match(pageQuery[0], /ORDER BY COALESCE\(NULLIF\(u\.name, ''\), u\.username, 'System'\) DESC, e\.occurred_at DESC, e\.id DESC/);
|
|
assert.deepEqual(pageQuery[1].slice(-2), [25, 25]);
|
|
assert.match(eventTypesQuery[0], /AND e\.event_type IS NOT NULL/);
|
|
}); |