|
| 1 | +/** |
| 2 | + * Real PostgreSQL behavior of single-file operations addressed by a `files/…` VFS path instead |
| 3 | + * of an id: the path names exactly one live file in the asserted workspace, never a same-named |
| 4 | + * file in another folder or workspace, a chat upload or an archived file, and authorization is |
| 5 | + * unchanged. |
| 6 | + */ |
| 7 | +import { db } from '@sim/db' |
| 8 | +import { permissions, user, workspace, workspaceFiles } from '@sim/db/schema' |
| 9 | +import { assertDisposableTestDatabaseUrl } from '@sim/db/testing/test-infrastructure' |
| 10 | +import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures' |
| 11 | +import { generateId } from '@sim/utils/id' |
| 12 | +import { eq, inArray, sql } from 'drizzle-orm' |
| 13 | +import { afterAll, beforeAll, describe, expect, it } from 'vitest' |
| 14 | +import { deleteWorkspaceFileOperation } from '@/lib/workspace-files/application/delete-workspace-file' |
| 15 | +import { readWorkspaceFileMetadataWithVersion } from '@/lib/workspace-files/application/read-workspace-file-metadata' |
| 16 | +import { renameWorkspaceFile } from '@/lib/workspace-files/application/rename-workspace-file' |
| 17 | + |
| 18 | +const alice = generateId() |
| 19 | +const bob = generateId() |
| 20 | +const carol = generateId() |
| 21 | +const workspaceId = generateId() |
| 22 | +const otherWorkspaceId = generateId() |
| 23 | +const folders = { docs: generateId(), media: generateId(), foreign: generateId() } |
| 24 | +const session = (userId: string) => ({ kind: 'session' as const, userId, sessionId: generateId() }) |
| 25 | + |
| 26 | +async function insertFile(input: { |
| 27 | + name: string |
| 28 | + folderId?: string | null |
| 29 | + workspaceId?: string |
| 30 | + context?: string |
| 31 | + deleted?: boolean |
| 32 | +}): Promise<string> { |
| 33 | + const id = `wf_${generateId()}` |
| 34 | + const owner = input.workspaceId ?? workspaceId |
| 35 | + await db.execute(sql` |
| 36 | + INSERT INTO ${workspaceFiles} (id, key, user_id, workspace_id, folder_id, context, original_name, |
| 37 | + content_type, size_bytes, uploaded_at, updated_at, deleted_at) |
| 38 | + VALUES (${id}, ${`workspace/${owner}/${generateId()}-${input.name}`}, ${alice}, ${owner}, |
| 39 | + ${input.folderId ?? null}, ${input.context ?? 'workspace'}, ${input.name}, 'text/csv', 10, |
| 40 | + now(), now(), ${input.deleted ? sql`now()` : sql`NULL`})`) |
| 41 | + return id |
| 42 | +} |
| 43 | + |
| 44 | +async function row(id: string) { |
| 45 | + const [file] = await db |
| 46 | + .select({ name: workspaceFiles.originalName, deletedAt: workspaceFiles.deletedAt }) |
| 47 | + .from(workspaceFiles) |
| 48 | + .where(eq(workspaceFiles.id, id)) |
| 49 | + return file |
| 50 | +} |
| 51 | + |
| 52 | +const describeFile = (fileId: string, userId = alice, assertedWorkspaceId = workspaceId) => |
| 53 | + readWorkspaceFileMetadataWithVersion.execute({ |
| 54 | + principal: session(userId), |
| 55 | + input: { fileId, assertedWorkspaceId }, |
| 56 | + }) |
| 57 | + |
| 58 | +const deleteFile = (fileId: string, userId = alice) => |
| 59 | + deleteWorkspaceFileOperation.execute({ |
| 60 | + principal: session(userId), |
| 61 | + input: { fileId, assertedWorkspaceId: workspaceId }, |
| 62 | + }) |
| 63 | + |
| 64 | +describe('single-file operations addressed by VFS path', () => { |
| 65 | + const ids = { |
| 66 | + rootReport: '', |
| 67 | + docsReport: '', |
| 68 | + mediaReport: '', |
| 69 | + foreignReport: '', |
| 70 | + chatUpload: '', |
| 71 | + archived: '', |
| 72 | + } |
| 73 | + |
| 74 | + beforeAll(async () => { |
| 75 | + assertDisposableTestDatabaseUrl(process.env.DATABASE_URL ?? '') |
| 76 | + await db.insert(user).values( |
| 77 | + [alice, bob, carol].map((id) => ({ |
| 78 | + id, |
| 79 | + name: `Fixture ${id}`, |
| 80 | + email: `${id}@fixture.test`, |
| 81 | + emailVerified: true, |
| 82 | + createdAt: new Date(), |
| 83 | + updatedAt: new Date(), |
| 84 | + })) |
| 85 | + ) |
| 86 | + await insertWorkspaceFixture(db, [ |
| 87 | + { id: workspaceId, name: 'Path fixture', ownerId: alice, billedAccountUserId: alice }, |
| 88 | + { id: otherWorkspaceId, name: 'Other fixture', ownerId: alice, billedAccountUserId: alice }, |
| 89 | + ]) |
| 90 | + await db.insert(permissions).values([ |
| 91 | + { |
| 92 | + id: generateId(), |
| 93 | + userId: alice, |
| 94 | + entityType: 'workspace', |
| 95 | + entityId: workspaceId, |
| 96 | + permissionType: 'admin', |
| 97 | + }, |
| 98 | + { |
| 99 | + id: generateId(), |
| 100 | + userId: bob, |
| 101 | + entityType: 'workspace', |
| 102 | + entityId: workspaceId, |
| 103 | + permissionType: 'read', |
| 104 | + }, |
| 105 | + { |
| 106 | + id: generateId(), |
| 107 | + userId: alice, |
| 108 | + entityType: 'workspace', |
| 109 | + entityId: otherWorkspaceId, |
| 110 | + permissionType: 'admin', |
| 111 | + }, |
| 112 | + ]) |
| 113 | + await db.execute(sql` |
| 114 | + INSERT INTO folder (id, name, user_id, workspace_id, resource_type, parent_id) VALUES |
| 115 | + (${folders.docs}, 'Docs', ${alice}, ${workspaceId}, 'file', NULL), |
| 116 | + (${folders.media}, 'Media', ${alice}, ${workspaceId}, 'file', NULL), |
| 117 | + (${folders.foreign}, 'Docs', ${alice}, ${otherWorkspaceId}, 'file', NULL)`) |
| 118 | + ids.rootReport = await insertFile({ name: 'report.csv' }) |
| 119 | + ids.docsReport = await insertFile({ name: 'report.csv', folderId: folders.docs }) |
| 120 | + ids.mediaReport = await insertFile({ name: 'report.csv', folderId: folders.media }) |
| 121 | + ids.foreignReport = await insertFile({ |
| 122 | + name: 'report.csv', |
| 123 | + folderId: folders.foreign, |
| 124 | + workspaceId: otherWorkspaceId, |
| 125 | + }) |
| 126 | + ids.chatUpload = await insertFile({ name: 'notes.txt', context: 'mothership' }) |
| 127 | + ids.archived = await insertFile({ name: 'old.csv', deleted: true }) |
| 128 | + }) |
| 129 | + |
| 130 | + afterAll(async () => { |
| 131 | + await deleteWorkspaceFixture(db, inArray(workspace.id, [workspaceId, otherWorkspaceId])) |
| 132 | + await db.delete(user).where(inArray(user.id, [alice, bob, carol])) |
| 133 | + }) |
| 134 | + |
| 135 | + it('describes the one file at the exact path, not a same-named file elsewhere', async () => { |
| 136 | + expect((await describeFile('files/Docs/report.csv')).file.id).toBe(ids.docsReport) |
| 137 | + expect((await describeFile('files/report.csv')).file.id).toBe(ids.rootReport) |
| 138 | + await expect(describeFile('files/Archive/report.csv')).rejects.toMatchObject({ |
| 139 | + code: 'not_found', |
| 140 | + }) |
| 141 | + await expect(describeFile('files/Docs')).rejects.toMatchObject({ code: 'not_found' }) |
| 142 | + }) |
| 143 | + |
| 144 | + it('renames and deletes only the file the path names', async () => { |
| 145 | + const renamed = await renameWorkspaceFile.execute({ |
| 146 | + principal: session(alice), |
| 147 | + input: { fileId: 'files/Docs/report.csv', assertedWorkspaceId: workspaceId, name: 'q3.csv' }, |
| 148 | + }) |
| 149 | + expect(renamed.file.id).toBe(ids.docsReport) |
| 150 | + expect((await row(ids.docsReport))?.name).toBe('q3.csv') |
| 151 | + |
| 152 | + expect(await deleteFile('files/Media/report.csv')).toMatchObject({ |
| 153 | + id: ids.mediaReport, |
| 154 | + deleted: true, |
| 155 | + }) |
| 156 | + expect((await row(ids.mediaReport))?.deletedAt).not.toBeNull() |
| 157 | + |
| 158 | + for (const untouched of [ids.rootReport, ids.foreignReport]) { |
| 159 | + expect(await row(untouched)).toMatchObject({ name: 'report.csv', deletedAt: null }) |
| 160 | + } |
| 161 | + }) |
| 162 | + |
| 163 | + it('resolves a path only inside the asserted workspace', async () => { |
| 164 | + await expect( |
| 165 | + describeFile('files/Docs/report.csv', alice, otherWorkspaceId) |
| 166 | + ).resolves.toMatchObject({ file: { id: ids.foreignReport } }) |
| 167 | + await expect( |
| 168 | + readWorkspaceFileMetadataWithVersion.execute({ |
| 169 | + principal: session(alice), |
| 170 | + input: { fileId: 'files/report.csv' }, |
| 171 | + }) |
| 172 | + ).rejects.toMatchObject({ code: 'not_found' }) |
| 173 | + }) |
| 174 | + |
| 175 | + it('never reaches a chat upload or an archived file through a path', async () => { |
| 176 | + await expect(deleteFile('files/notes.txt')).rejects.toMatchObject({ code: 'not_found' }) |
| 177 | + expect((await row(ids.chatUpload))?.deletedAt).toBeNull() |
| 178 | + await expect(describeFile('files/old.csv')).rejects.toMatchObject({ code: 'not_found' }) |
| 179 | + }) |
| 180 | + |
| 181 | + it('keeps authorization: a read member cannot delete and a non-member cannot read', async () => { |
| 182 | + await expect(deleteFile('files/report.csv', bob)).rejects.toMatchObject({ code: 'forbidden' }) |
| 183 | + await expect(describeFile('files/report.csv', carol)).rejects.toMatchObject({ |
| 184 | + code: 'forbidden', |
| 185 | + }) |
| 186 | + expect((await row(ids.rootReport))?.deletedAt).toBeNull() |
| 187 | + }) |
| 188 | + |
| 189 | + it('rejects a dot-segment path instead of walking out of its folder', async () => { |
| 190 | + await expect(deleteFile('files/Docs/../report.csv')).rejects.toMatchObject({ |
| 191 | + code: 'validation', |
| 192 | + }) |
| 193 | + expect((await row(ids.rootReport))?.deletedAt).toBeNull() |
| 194 | + }) |
| 195 | +}) |
0 commit comments