OpenVelo Agent
348 lines
13 KiB
TypeScript
348 lines
13 KiB
TypeScript
process.env.DATABASE_PATH = ':memory:';
|
|
process.env.THEMES_DIR = './themes';
|
|
process.env.FRONTEND_DIST = './frontend/dist';
|
|
|
|
import { Test } from '@nestjs/testing';
|
|
import { INestApplication, ValidationPipe } from '@nestjs/common';
|
|
import { HttpAdapterHost } from '@nestjs/core';
|
|
import cookieParser from 'cookie-parser';
|
|
import * as express from 'express';
|
|
import request from 'supertest';
|
|
import { CookieAccessInfo } from 'cookiejar';
|
|
import { AppModule } from '../../backend/src/app.module';
|
|
import { GlobalExceptionFilter } from '../../backend/src/common/filters/global-exception.filter';
|
|
import { CsrfMiddleware } from '../../backend/src/common/middleware/csrf.middleware';
|
|
import { ConfigService } from '@nestjs/config';
|
|
import { initDb } from './db-helper';
|
|
import { BlogPostEntity } from '../../backend/src/database/entities/blog-post.entity';
|
|
import { getRepositoryToken } from '@nestjs/typeorm';
|
|
|
|
async function loginAs(app: INestApplication, username: string, password: string): Promise<{
|
|
agent: ReturnType<typeof request.agent>;
|
|
accessToken: string;
|
|
csrf: string;
|
|
}> {
|
|
const agent = request.agent(app.getHttpServer());
|
|
await agent.get('/api/v1/auth/csrf');
|
|
const cookies: any = agent.jar.getCookies(CookieAccessInfo.All);
|
|
const csrf = cookies.find((c: any) => c.name === 'csrf')?.value;
|
|
const res = await agent
|
|
.post('/api/v1/auth/login')
|
|
.set('X-CSRF-Token', csrf)
|
|
.send({ username, password })
|
|
.expect(201);
|
|
return { agent, accessToken: res.body.accessToken as string, csrf };
|
|
}
|
|
|
|
async function createPlayer(
|
|
app: INestApplication,
|
|
adminToken: string,
|
|
adminCsrf: string,
|
|
username: string,
|
|
password: string,
|
|
): Promise<{ agent: ReturnType<typeof request.agent>; accessToken: string; csrf: string }> {
|
|
const adminAgent = request.agent(app.getHttpServer());
|
|
await adminAgent.get('/api/v1/auth/csrf');
|
|
const adminAgentCookies: any = adminAgent.jar.getCookies(CookieAccessInfo.All);
|
|
const adminAgentCsrf = adminAgentCookies.find((c: any) => c.name === 'csrf')?.value;
|
|
await adminAgent
|
|
.post('/api/v1/admin/users')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminAgentCsrf)
|
|
.send({ username, password, role: 'player' })
|
|
.expect(201);
|
|
return loginAs(app, username, password);
|
|
}
|
|
|
|
describe('Admin blog posts API (Job 869)', () => {
|
|
let app: INestApplication;
|
|
let adminToken: string;
|
|
let adminCsrf: string;
|
|
let adminAgent: ReturnType<typeof request.agent>;
|
|
|
|
beforeAll(async () => {
|
|
const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
|
|
app = moduleRef.createNestApplication();
|
|
app.use(cookieParser());
|
|
app.use(express.json({ limit: '1mb' }));
|
|
const csrfMw = new CsrfMiddleware(app.get(ConfigService));
|
|
app.use((req: any, res: any, next: any) => csrfMw.use(req, res, next));
|
|
app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: false, transform: true }));
|
|
const httpAdapterHost = app.get(HttpAdapterHost);
|
|
app.useGlobalFilters(new GlobalExceptionFilter(httpAdapterHost));
|
|
await app.init();
|
|
await initDb(app);
|
|
|
|
const server = app.getHttpServer();
|
|
await request(server).post('/api/v1/auth/register-first-admin')
|
|
.send({ username: 'admin', password: 'Sup3rSecret!Pass' })
|
|
.expect(201);
|
|
|
|
const logged = await loginAs(app, 'admin', 'Sup3rSecret!Pass');
|
|
adminToken = logged.accessToken;
|
|
adminCsrf = logged.csrf;
|
|
adminAgent = logged.agent;
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await app.close();
|
|
});
|
|
|
|
it('GET /api/v1/admin/blog/posts without a token returns 401', async () => {
|
|
await request(app.getHttpServer()).get('/api/v1/admin/blog/posts').expect(401);
|
|
});
|
|
|
|
it('GET /api/v1/admin/blog/posts with a player JWT returns 403', async () => {
|
|
const player = await createPlayer(app, adminToken, adminCsrf, 'player1', 'Sup3rSecret!Pass');
|
|
await request(app.getHttpServer())
|
|
.get('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${player.accessToken}`)
|
|
.expect(403);
|
|
});
|
|
|
|
it('POST with status=draft creates a draft with publishedAt=null and POST with status=published stamps publishedAt', async () => {
|
|
const draft = await adminAgent
|
|
.post('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: 'Draft Post', bodyMd: 'still cooking', status: 'draft' })
|
|
.expect(201);
|
|
expect(draft.body.status).toBe('draft');
|
|
expect(draft.body.publishedAt).toBeNull();
|
|
expect(draft.body.title).toBe('Draft Post');
|
|
expect(draft.body.id).toBeDefined();
|
|
expect(draft.body.createdAt).toBeDefined();
|
|
|
|
const published = await adminAgent
|
|
.post('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: 'Live Post', bodyMd: '# Hello world', status: 'published' })
|
|
.expect(201);
|
|
expect(published.body.status).toBe('published');
|
|
expect(published.body.publishedAt).toBeTruthy();
|
|
expect(typeof published.body.publishedAt).toBe('string');
|
|
});
|
|
|
|
it('POST with empty title returns 400 VALIDATION_FAILED', async () => {
|
|
const res = await adminAgent
|
|
.post('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: ' ', bodyMd: 'x' })
|
|
.expect(400);
|
|
expect(res.body.code).toBe('VALIDATION_FAILED');
|
|
});
|
|
|
|
it('GET /api/v1/admin/blog/posts returns drafts AND published (admin-only view)', async () => {
|
|
const res = await adminAgent
|
|
.get('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.expect(200);
|
|
expect(Array.isArray(res.body)).toBe(true);
|
|
// Both 'Draft Post' and 'Live Post' should appear since we just created them.
|
|
const titles = res.body.map((p: any) => p.title);
|
|
expect(titles).toEqual(expect.arrayContaining(['Draft Post', 'Live Post']));
|
|
// Every row includes admin-only fields.
|
|
for (const p of res.body) {
|
|
expect(p.status).toBeDefined();
|
|
expect(p.createdAt).toBeDefined();
|
|
expect(p.updatedAt).toBeDefined();
|
|
}
|
|
});
|
|
|
|
it('PUT preserves draft state (publishedAt=null) on a draft edit; PUT to published stamps publishedAt once and preserves it on subsequent edits', async () => {
|
|
// 1. Create a draft.
|
|
const draft = await adminAgent
|
|
.post('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: 'Edit Me Draft', bodyMd: 'v1', status: 'draft' })
|
|
.expect(201);
|
|
const draftId = draft.body.id;
|
|
|
|
// 2. Edit title/body without changing status -> stays draft, publishedAt stays null.
|
|
const edited = await adminAgent
|
|
.put(`/api/v1/admin/blog/posts/${draftId}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: 'Edit Me Draft (updated)', bodyMd: 'v2' })
|
|
.expect(200);
|
|
expect(edited.body.status).toBe('draft');
|
|
expect(edited.body.publishedAt).toBeNull();
|
|
expect(edited.body.bodyMd).toBe('v2');
|
|
|
|
// 3. Publish -> stamps publishedAt.
|
|
const firstPublish = await adminAgent
|
|
.put(`/api/v1/admin/blog/posts/${draftId}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ status: 'published' })
|
|
.expect(200);
|
|
expect(firstPublish.body.status).toBe('published');
|
|
const originalPublishedAt = firstPublish.body.publishedAt;
|
|
expect(originalPublishedAt).toBeTruthy();
|
|
|
|
// 4. Wait a few ms and update body again; publishedAt must not change.
|
|
await new Promise((r) => setTimeout(r, 5));
|
|
const secondEdit = await adminAgent
|
|
.put(`/api/v1/admin/blog/posts/${draftId}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ bodyMd: 'v3 — content edit after publish' })
|
|
.expect(200);
|
|
expect(secondEdit.body.status).toBe('published');
|
|
expect(secondEdit.body.publishedAt).toBe(originalPublishedAt);
|
|
expect(secondEdit.body.bodyMd).toBe('v3 — content edit after publish');
|
|
|
|
// 5. Demote to draft; publishedAt must be preserved so a later re-publish does not change it.
|
|
const demoted = await adminAgent
|
|
.put(`/api/v1/admin/blog/posts/${draftId}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ status: 'draft' })
|
|
.expect(200);
|
|
expect(demoted.body.status).toBe('draft');
|
|
expect(demoted.body.publishedAt).toBe(originalPublishedAt);
|
|
|
|
// 6. Re-publish; publishedAt must STILL be the original timestamp.
|
|
const republished = await adminAgent
|
|
.put(`/api/v1/admin/blog/posts/${draftId}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ status: 'published' })
|
|
.expect(200);
|
|
expect(republished.body.status).toBe('published');
|
|
expect(republished.body.publishedAt).toBe(originalPublishedAt);
|
|
});
|
|
|
|
it('DELETE removes the post and a subsequent DELETE returns 404', async () => {
|
|
const created = await adminAgent
|
|
.post('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: 'To Delete', bodyMd: 'goodbye', status: 'draft' })
|
|
.expect(201);
|
|
const id = created.body.id;
|
|
|
|
await adminAgent
|
|
.delete(`/api/v1/admin/blog/posts/${id}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.expect(204);
|
|
|
|
await adminAgent
|
|
.delete(`/api/v1/admin/blog/posts/${id}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.expect(404);
|
|
});
|
|
|
|
it('public GET /api/v1/blog/posts hides drafts after admin operations', async () => {
|
|
// Make sure a draft and a published exist (regression for public list).
|
|
await adminAgent
|
|
.post('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: 'Hidden Draft', bodyMd: 'should not leak', status: 'draft' })
|
|
.expect(201);
|
|
|
|
const res = await request(app.getHttpServer()).get('/api/v1/blog/posts').expect(200);
|
|
const titles = res.body.posts.map((p: any) => p.title);
|
|
expect(titles).not.toContain('Hidden Draft');
|
|
// No row in the public list should ever include admin-only fields.
|
|
for (const p of res.body.posts) {
|
|
expect(p.status).toBeUndefined();
|
|
}
|
|
});
|
|
|
|
it('PUT with empty title returns 400 VALIDATION_FAILED', async () => {
|
|
const created = await adminAgent
|
|
.post('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: 'Edit Title Test', bodyMd: '', status: 'draft' })
|
|
.expect(201);
|
|
const id = created.body.id;
|
|
|
|
const res = await adminAgent
|
|
.put(`/api/v1/admin/blog/posts/${id}`)
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.send({ title: '' })
|
|
.expect(400);
|
|
expect(res.body.code).toBe('VALIDATION_FAILED');
|
|
});
|
|
});
|
|
|
|
describe('Admin blog posts raw access', () => {
|
|
let app: INestApplication;
|
|
let adminAgent: ReturnType<typeof request.agent>;
|
|
let adminToken: string;
|
|
let adminCsrf: string;
|
|
|
|
beforeAll(async () => {
|
|
process.env.DATABASE_PATH = ':memory:';
|
|
process.env.THEMES_DIR = './themes';
|
|
process.env.FRONTEND_DIST = './frontend/dist';
|
|
const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
|
|
app = moduleRef.createNestApplication();
|
|
app.use(cookieParser());
|
|
app.use(express.json({ limit: '1mb' }));
|
|
const csrfMw = new CsrfMiddleware(app.get(ConfigService));
|
|
app.use((req: any, res: any, next: any) => csrfMw.use(req, res, next));
|
|
const httpAdapterHost = app.get(HttpAdapterHost);
|
|
app.useGlobalFilters(new GlobalExceptionFilter(httpAdapterHost));
|
|
await app.init();
|
|
await initDb(app);
|
|
|
|
const server = app.getHttpServer();
|
|
await request(server).post('/api/v1/auth/register-first-admin')
|
|
.send({ username: 'rawadmin', password: 'Sup3rSecret!Pass' })
|
|
.expect(201);
|
|
|
|
const logged = await loginAs(app, 'rawadmin', 'Sup3rSecret!Pass');
|
|
adminToken = logged.accessToken;
|
|
adminCsrf = logged.csrf;
|
|
adminAgent = logged.agent;
|
|
|
|
// Seed one published + one draft directly via the entity manager.
|
|
const repo = app.get<any>(getRepositoryToken(BlogPostEntity));
|
|
await repo.insert([
|
|
{
|
|
id: 'seed-pub',
|
|
title: 'Seeded Published',
|
|
bodyMd: '# Published',
|
|
status: 'published',
|
|
publishedAt: '2026-07-21T10:00:00.000Z',
|
|
createdAt: '2026-07-20T10:00:00.000Z',
|
|
updatedAt: '2026-07-21T10:00:00.000Z',
|
|
},
|
|
{
|
|
id: 'seed-drf',
|
|
title: 'Seeded Draft',
|
|
bodyMd: 'wip',
|
|
status: 'draft',
|
|
publishedAt: null,
|
|
createdAt: '2026-07-22T10:00:00.000Z',
|
|
updatedAt: '2026-07-22T10:00:00.000Z',
|
|
},
|
|
]);
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await app.close();
|
|
});
|
|
|
|
it('returns both seeded rows including drafts for the admin', async () => {
|
|
const res = await adminAgent
|
|
.get('/api/v1/admin/blog/posts')
|
|
.set('Authorization', `Bearer ${adminToken}`)
|
|
.set('X-CSRF-Token', adminCsrf)
|
|
.expect(200);
|
|
const ids = res.body.map((p: any) => p.id);
|
|
expect(ids).toEqual(expect.arrayContaining(['seed-pub', 'seed-drf']));
|
|
});
|
|
});
|