|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#7678] `GET /api/v1/security/suggested-bindings?status=` — the LIVE REST |
| 5 | + * route's `?status=` vocabulary (ADR-0090 D5/D9). |
| 6 | + * |
| 7 | + * ## The defect these cases pin |
| 8 | + * |
| 9 | + * `registerSecurityEndpoints` forwarded `req.query.status` straight into |
| 10 | + * `listAudienceBindingSuggestions`, whose contract |
| 11 | + * (`AudienceBindingSuggestionFilter`) declares exactly three values. An unknown |
| 12 | + * one was not rejected anywhere — it simply matched no row, so |
| 13 | + * `?status=garbage` answered **200 with an empty list**. That is worse than an |
| 14 | + * error: an empty list is a plausible, actionable-looking answer, and it reads |
| 15 | + * as "there are no suggestions" rather than "your filter was not a status". So |
| 16 | + * a `not.toBe(200)` assertion would be worth nothing here — the unfixed code's |
| 17 | + * whole symptom IS a 200 — and every refusal case below asserts the ADR-0112 |
| 18 | + * pair: the HTTP `status` AND the nested `body.error.code`. |
| 19 | + * |
| 20 | + * The rule itself is not new. The runtime dispatcher's `/security` domain has |
| 21 | + * refused unknown statuses since #4127, with a comment describing precisely the |
| 22 | + * empty-list arm above; the live REST route is a second seam onto the same |
| 23 | + * service call and never got it. The fix is therefore a CONVERGENCE — both |
| 24 | + * seams now call `isAudienceBindingSuggestionStatus` from `@objectstack/core` — |
| 25 | + * and the vocabulary is imported here rather than retyped, so a status added to |
| 26 | + * the contract is exercised by these cases automatically. |
| 27 | + * |
| 28 | + * ## The negatives are load-bearing |
| 29 | + * |
| 30 | + * A guard that 400s everything satisfies the refusal cases and breaks the |
| 31 | + * route. The bottom half pins the other direction: every declared status still |
| 32 | + * reaches the service, and omitting `?status` still lists unfiltered. Both |
| 33 | + * assert the ARGUMENT the service was handed, not merely that a 200 came back. |
| 34 | + */ |
| 35 | + |
| 36 | +import { describe, it, expect, vi } from 'vitest'; |
| 37 | +// `.js` on purpose — NodeNext resolution requires the extension, and this |
| 38 | +// package's TEST_DEBT ceiling has no margin for another TS2835 (#7248). |
| 39 | +import { RestServer } from './rest-server.js'; |
| 40 | +import { |
| 41 | + AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES, |
| 42 | + unknownAudienceBindingSuggestionStatusMessage, |
| 43 | +} from '@objectstack/core'; |
| 44 | + |
| 45 | +const SUGGESTED_BINDINGS = '/api/v1/security/suggested-bindings'; |
| 46 | + |
| 47 | +function mockServer() { |
| 48 | + return { |
| 49 | + get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn(), patch: vi.fn(), |
| 50 | + use: vi.fn(), |
| 51 | + listen: vi.fn().mockResolvedValue(undefined), |
| 52 | + close: vi.fn().mockResolvedValue(undefined), |
| 53 | + }; |
| 54 | +} |
| 55 | + |
| 56 | +function mockRes() { |
| 57 | + const res: any = { |
| 58 | + statusCode: 200, |
| 59 | + json: vi.fn(function (this: any, body: any) { this._body = body; return this; }), |
| 60 | + send: vi.fn(function (this: any) { return this; }), |
| 61 | + setHeader: vi.fn(function (this: any) { return this; }), |
| 62 | + status: vi.fn(function (this: any, code: number) { this.statusCode = code; return this; }), |
| 63 | + header: vi.fn(function (this: any) { return this; }), |
| 64 | + }; |
| 65 | + return res; |
| 66 | +} |
| 67 | + |
| 68 | +/** The rows the stub service answers with, so "listed" is distinguishable from "empty". */ |
| 69 | +const SUGGESTIONS = [{ id: 's1', status: 'pending', package_id: 'com.example.crm' }]; |
| 70 | + |
| 71 | +function boot() { |
| 72 | + const listAudienceBindingSuggestions = vi.fn().mockResolvedValue({ |
| 73 | + suggestions: SUGGESTIONS, |
| 74 | + sync: { created: 0, confirmedObserved: 0, pruned: 0 }, |
| 75 | + }); |
| 76 | + |
| 77 | + const rest = new RestServer( |
| 78 | + mockServer() as any, |
| 79 | + { getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: {} }) } as any, |
| 80 | + { api: { requireAuth: false } } as any, |
| 81 | + ); |
| 82 | + // `isSystem` clears the auth gates that run BEFORE the query is read, so |
| 83 | + // every request below reaches the status rule it is named after. |
| 84 | + (rest as any).resolveExecCtx = async () => ({ isSystem: true, userId: 'u1' }); |
| 85 | + (rest as any).securityServiceProvider = async () => ({ listAudienceBindingSuggestions }); |
| 86 | + rest.registerRoutes(); |
| 87 | + |
| 88 | + const route = (rest as any).getRoutes().find( |
| 89 | + (r: any) => r.method === 'GET' && r.path === SUGGESTED_BINDINGS, |
| 90 | + ); |
| 91 | + if (!route) throw new Error(`route not registered: GET ${SUGGESTED_BINDINGS}`); |
| 92 | + |
| 93 | + const drive = async (query: Record<string, unknown>) => { |
| 94 | + const res = mockRes(); |
| 95 | + await route.handler( |
| 96 | + { method: 'GET', path: SUGGESTED_BINDINGS, params: {}, query, headers: {}, body: {} } as any, |
| 97 | + res, |
| 98 | + ); |
| 99 | + return { status: res.statusCode, body: res.json.mock.calls.at(-1)?.[0] }; |
| 100 | + }; |
| 101 | + |
| 102 | + return { drive, listAudienceBindingSuggestions }; |
| 103 | +} |
| 104 | + |
| 105 | +// ───────────────────────────────────────────────────────────────────────────── |
| 106 | +// 1. REFUSAL — the silent-empty-list arm, closed |
| 107 | +// ───────────────────────────────────────────────────────────────────────────── |
| 108 | + |
| 109 | +describe('#7678 — an unknown ?status is REFUSED, not answered with an empty list', () => { |
| 110 | + it('?status=garbage → 400 VALIDATION_ERROR (was: 200 with an empty list)', async () => { |
| 111 | + const { drive, listAudienceBindingSuggestions } = boot(); |
| 112 | + const answer = await drive({ status: 'garbage' }); |
| 113 | + |
| 114 | + // Both halves, per ADR-0112. `status` alone would pass on any 400 the |
| 115 | + // route emits for another reason; `code` alone would pass on the 200 |
| 116 | + // this route used to answer if a code ever appeared in a success body. |
| 117 | + expect( |
| 118 | + answer.status, |
| 119 | + `expected 400 for an unknown ?status, got ${answer.status} with body ${JSON.stringify(answer.body)}`, |
| 120 | + ).toBe(400); |
| 121 | + expect(answer.body?.error?.code).toBe('VALIDATION_ERROR'); |
| 122 | + // `error` is the object, not a bare string — the dialect #7035 retired. |
| 123 | + expect(typeof answer.body?.error).toBe('object'); |
| 124 | + // The wording is the SHARED one, so the two seams cannot drift apart |
| 125 | + // while both still refusing. |
| 126 | + expect(answer.body?.error?.message).toBe( |
| 127 | + unknownAudienceBindingSuggestionStatusMessage('garbage'), |
| 128 | + ); |
| 129 | + expect( |
| 130 | + listAudienceBindingSuggestions, |
| 131 | + 'the refused filter must not reach the service at all', |
| 132 | + ).not.toHaveBeenCalled(); |
| 133 | + }); |
| 134 | + |
| 135 | + it('?status=PENDING → 400: the vocabulary is lowercase, so wrong case is not a status', async () => { |
| 136 | + // The card names this one explicitly. Measured, it is NOT accepted: the |
| 137 | + // contract's values are lowercase and the predicate is case-sensitive, |
| 138 | + // so `PENDING` is refused exactly like `garbage` rather than silently |
| 139 | + // filtering to nothing. |
| 140 | + const { drive, listAudienceBindingSuggestions } = boot(); |
| 141 | + const answer = await drive({ status: 'PENDING' }); |
| 142 | + |
| 143 | + expect(answer.status).toBe(400); |
| 144 | + expect(answer.body?.error?.code).toBe('VALIDATION_ERROR'); |
| 145 | + expect(listAudienceBindingSuggestions).not.toHaveBeenCalled(); |
| 146 | + }); |
| 147 | +}); |
| 148 | + |
| 149 | +// ───────────────────────────────────────────────────────────────────────────── |
| 150 | +// 2. PRESERVATION — a guard that 400s everything would pass §1 and break the route |
| 151 | +// ───────────────────────────────────────────────────────────────────────────── |
| 152 | + |
| 153 | +describe('#7678 — every declared status, and no status at all, still list', () => { |
| 154 | + // Enumerated FROM the contract type, never hand-picked: a status added to |
| 155 | + // `AudienceBindingSuggestionFilter` is covered here the day it is declared. |
| 156 | + it.each(AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES)( |
| 157 | + '?status=%s reaches the service and returns its list', |
| 158 | + async (status) => { |
| 159 | + const { drive, listAudienceBindingSuggestions } = boot(); |
| 160 | + const answer = await drive({ status }); |
| 161 | + |
| 162 | + expect( |
| 163 | + answer.status, |
| 164 | + `a valid ?status=${status} must not be refused`, |
| 165 | + ).toBe(200); |
| 166 | + expect(answer.body?.data?.suggestions).toEqual(SUGGESTIONS); |
| 167 | + // The argument, not just the status code — "still 200" is what the |
| 168 | + // defect looked like. |
| 169 | + expect(listAudienceBindingSuggestions).toHaveBeenCalledWith( |
| 170 | + expect.anything(), |
| 171 | + { status, packageId: undefined }, |
| 172 | + ); |
| 173 | + }, |
| 174 | + ); |
| 175 | + |
| 176 | + it('no ?status at all still returns the unfiltered list', async () => { |
| 177 | + const { drive, listAudienceBindingSuggestions } = boot(); |
| 178 | + const answer = await drive({}); |
| 179 | + |
| 180 | + expect(answer.status).toBe(200); |
| 181 | + expect(answer.body?.data?.suggestions).toEqual(SUGGESTIONS); |
| 182 | + expect(listAudienceBindingSuggestions).toHaveBeenCalledWith( |
| 183 | + expect.anything(), |
| 184 | + { status: undefined, packageId: undefined }, |
| 185 | + ); |
| 186 | + }); |
| 187 | + |
| 188 | + it('an unrelated filter (?packageId) is untouched by the status rule', async () => { |
| 189 | + const { drive, listAudienceBindingSuggestions } = boot(); |
| 190 | + const answer = await drive({ packageId: 'com.example.crm' }); |
| 191 | + |
| 192 | + expect(answer.status).toBe(200); |
| 193 | + expect(listAudienceBindingSuggestions).toHaveBeenCalledWith( |
| 194 | + expect.anything(), |
| 195 | + { status: undefined, packageId: 'com.example.crm' }, |
| 196 | + ); |
| 197 | + }); |
| 198 | +}); |
0 commit comments