All checks were successful
CD / Build and push images (push) Successful in 2m54s
CI / Lint, typecheck, test (push) Successful in 2m25s
CI / Auth e2e pack (push) Successful in 2m58s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m12s
CD / Promote to Int (push) Successful in 12s
Every route now declares its access rule explicitly and is enforced through the shared resolution algorithm (permissions.md): - PermissionGuard + decorators (@RequiresPondRole, @RequiresPagePermission, @RequiresAttachmentPermission, @AuthenticatedOnly) applied to every route; a route-enumeration test proves full coverage alongside @Public()/Site-Admin-guarded routes. - 404/403 policy (documented in README conventions): denied reads answer 404 (existence hiding), denied writes on readable things answer 403; trash views need write capability (ADR 0013). - PermissionService resolves page/pond questions via the shared resolver, with an in-process pond-context cache (grants + label parents) that is invalidated on every grant/label-tree change and TTL-bounded as a multi-process safety net. Grant changes also fire pond_access_changed for collab revalidation (#39/#53). - shared: pond-scope resolution (hasPondRole, canSeePond) next to the page resolver; grant wire schemas + GrantView. - Owner Pond-Admin grants: migration backfill for all existing ponds, created transactionally with every new pond (shared + personal + seed). - Grant CRUD under /ponds/:id/grants (pond_admin-gated) with structural and referential validation, last-admin protection, audit logs. - InterimAccessService deleted; page lists, search, backlinks, phantom links, and trash listings are filtered per page through the resolver; collab tokens are now truly ro for readers. - Fixture-matrix e2e (reader/editor/pond admin/foreign, label-deny, authenticated-subject, revoke-then-immediate-deny cache test). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGdhRiwU1WRL4XxJfZYipY
110 lines
3.8 KiB
TypeScript
110 lines
3.8 KiB
TypeScript
import { INestApplication } from '@nestjs/common';
|
|
import { PrismaClient, User } from '@prisma/client';
|
|
import { afterAll, beforeAll, describe, expect, it } from 'vitest';
|
|
|
|
import { createTestApp } from '../testing/test-app';
|
|
import { createTestPrisma, grantOwnerAdmin, hasTestDb, uniqueSuffix } from '../testing/test-db';
|
|
import { PagesService } from './pages.service';
|
|
|
|
describe.skipIf(!hasTestDb)('PagesService.reposition (db, issue #45)', () => {
|
|
let app: INestApplication;
|
|
let prisma: PrismaClient;
|
|
let pages: PagesService;
|
|
const suffix = uniqueSuffix();
|
|
let owner: User;
|
|
let pondId: string;
|
|
|
|
/** Current manual order of the pond's pages, as the sidebar would render it. */
|
|
async function manualOrder(): Promise<string[]> {
|
|
const list = await pages.list(owner, pondId);
|
|
return list.map((p) => p.title);
|
|
}
|
|
|
|
async function pageIdByTitle(title: string): Promise<string> {
|
|
const p = await prisma.page.findFirstOrThrow({ where: { pondId, title } });
|
|
return p.id;
|
|
}
|
|
|
|
beforeAll(async () => {
|
|
prisma = createTestPrisma();
|
|
app = await createTestApp();
|
|
pages = app.get(PagesService);
|
|
|
|
owner = await prisma.user.create({
|
|
data: {
|
|
username: `pos-owner-${suffix}`,
|
|
email: `pos-owner-${suffix}@example.test`,
|
|
displayName: 'Position Owner',
|
|
},
|
|
});
|
|
const pond = await prisma.pond.create({
|
|
data: {
|
|
slug: `pos-pond-${suffix}`,
|
|
name: 'Position Pond',
|
|
type: 'PERSONAL',
|
|
ownerId: owner.id,
|
|
},
|
|
});
|
|
pondId = pond.id;
|
|
await grantOwnerAdmin(prisma, pondId, owner.id);
|
|
// Manual mode so `list` orders by sort_key.
|
|
await prisma.pond.update({
|
|
where: { id: pondId },
|
|
data: { settings: { sidebarSort: 'manual' } },
|
|
});
|
|
|
|
// Four pages created in order A, B, C, D (each appended at the end).
|
|
for (const title of ['A', 'B', 'C', 'D']) {
|
|
await pages.create(owner, pondId, { title });
|
|
}
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await prisma.page.deleteMany({ where: { pondId } });
|
|
await prisma.pond.deleteMany({ where: { id: pondId } });
|
|
await prisma.user.deleteMany({ where: { id: owner.id } });
|
|
await prisma.$disconnect();
|
|
await app.close();
|
|
});
|
|
|
|
it('starts in creation order', async () => {
|
|
expect(await manualOrder()).toEqual(['A', 'B', 'C', 'D']);
|
|
});
|
|
|
|
it('moves a page and the new order is server-ordered (persisted for everyone)', async () => {
|
|
const d = await pageIdByTitle('D');
|
|
const a = await pageIdByTitle('A');
|
|
const b = await pageIdByTitle('B');
|
|
// Move D to sit between A and B → A, D, B, C.
|
|
await pages.reposition(owner, d, { afterId: a, beforeId: b });
|
|
expect(await manualOrder()).toEqual(['A', 'D', 'B', 'C']);
|
|
|
|
// A fresh read (any other user's view) sees the same order — it lives in
|
|
// sort_key, not client state.
|
|
const reread = (await pages.list(owner, pondId)).map((p) => p.title);
|
|
expect(reread).toEqual(['A', 'D', 'B', 'C']);
|
|
});
|
|
|
|
it('moves a page to the very top (afterId null)', async () => {
|
|
const c = await pageIdByTitle('C');
|
|
const a = await pageIdByTitle('A');
|
|
await pages.reposition(owner, c, { afterId: null, beforeId: a });
|
|
expect(await manualOrder()).toEqual(['C', 'A', 'D', 'B']);
|
|
});
|
|
|
|
it('keeps the manual order when the sort mode changes (just not applied)', async () => {
|
|
await prisma.pond.update({
|
|
where: { id: pondId },
|
|
data: { settings: { sidebarSort: 'alpha' } },
|
|
});
|
|
expect(await manualOrder()).toEqual(['A', 'B', 'C', 'D']); // alpha ignores sort_key
|
|
|
|
await prisma.pond.update({
|
|
where: { id: pondId },
|
|
data: { settings: { sidebarSort: 'manual' } },
|
|
});
|
|
// The manual order from before is intact — switching modes never rewrote keys.
|
|
expect(await manualOrder()).toEqual(['C', 'A', 'D', 'B']);
|
|
});
|
|
});
|