|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * WHEN the analytics → `security` admission bridge reports that no security |
| 5 | + * service answers the object-level read grant, and at what level. |
| 6 | + * |
| 7 | + * The bridge resolves the `security` service PER QUERY, so plugin order is not |
| 8 | + * significant — and plugin-security registers that service in its `start()`, |
| 9 | + * after every plugin's `init()`. A WARN at init therefore asserted a verdict |
| 10 | + * the same boot contradicts (AGENTS.md "Startup registry reads — never record |
| 11 | + * a verdict the boot can still contradict"), on every default boot. |
| 12 | + * |
| 13 | + * So: |
| 14 | + * - init reports the absence at `info`, as the read-scope sibling already |
| 15 | + * does for the identical situation; |
| 16 | + * - the WARN belongs to the first query that needs the gate and finds no |
| 17 | + * service — once per bridge, not once per query; |
| 18 | + * - what the bridge ENFORCES does not move. Each case below asserts the |
| 19 | + * verdict next to the log line, so a change that quietened the log by |
| 20 | + * changing the answer cannot pass. |
| 21 | + * |
| 22 | + * The three resolutions themselves (absent / threw / cannot answer) are |
| 23 | + * `admission-bridge-resolution.test.ts`'s subject; this file is about the |
| 24 | + * report, not the verdict. |
| 25 | + */ |
| 26 | + |
| 27 | +import { describe, it, expect, vi } from 'vitest'; |
| 28 | +import { LiteKernel, type Plugin, type PluginContext } from '@objectstack/core'; |
| 29 | +import { DatasetSchema } from '@objectstack/spec/ui'; |
| 30 | +import type { ExecutionContext } from '@objectstack/spec/kernel'; |
| 31 | +import { AnalyticsServicePlugin } from '../plugin.js'; |
| 32 | +import type { AnalyticsService } from '../analytics-service.js'; |
| 33 | + |
| 34 | +const probe = DatasetSchema.parse({ |
| 35 | + name: 'probe_member', |
| 36 | + label: 'probe', |
| 37 | + object: 'employer_member', |
| 38 | + dimensions: [], |
| 39 | + measures: [{ name: 'cnt', label: 'Count', aggregate: 'count' }], |
| 40 | +}); |
| 41 | + |
| 42 | +const CALLER = { userId: 'u_seeker', tenantId: 'org_a' } as ExecutionContext; |
| 43 | + |
| 44 | +/** The SQL posture — the path where nothing but this gate stands in the way. */ |
| 45 | +const nativeSql = () => ({ nativeSql: true, objectqlAggregate: false, inMemory: false }); |
| 46 | + |
| 47 | +/** Engine double; every read it serves is recorded, so "denied" means "never read". */ |
| 48 | +function fakeEngine() { |
| 49 | + const reads: string[] = []; |
| 50 | + return { |
| 51 | + reads, |
| 52 | + engine: { |
| 53 | + execute: async (_sql: unknown, options?: { object?: string }) => { |
| 54 | + reads.push(`execute:${options?.object ?? '?'}`); |
| 55 | + return { rows: [{ cnt: 24 }] }; |
| 56 | + }, |
| 57 | + aggregate: async (object: string) => { |
| 58 | + reads.push(`aggregate:${object}`); |
| 59 | + return [{ cnt: 24 }]; |
| 60 | + }, |
| 61 | + hasObjectMiddleware: () => false, |
| 62 | + getObject: (name: string) => |
| 63 | + name === 'employer_member' ? { fields: { id: { type: 'text' } } } : undefined, |
| 64 | + resolveEffectiveDatasource: () => undefined, |
| 65 | + }, |
| 66 | + }; |
| 67 | +} |
| 68 | + |
| 69 | +/** The lines this file is about: anything naming the object-level admission. */ |
| 70 | +const ADMISSION = /admitObjectRead|OBJECT-LEVEL|object-level read admission/; |
| 71 | + |
| 72 | +type Lines = { info: string[]; warn: string[]; error: string[] }; |
| 73 | +const about = (lines: string[]) => lines.filter((l) => ADMISSION.test(l)); |
| 74 | + |
| 75 | +const runProbe = (service: AnalyticsService) => |
| 76 | + service.queryDataset(probe as never, { measures: ['cnt'] } as never, CALLER); |
| 77 | + |
| 78 | +// ── A REAL kernel: the default composition, in the default order ───────────── |
| 79 | + |
| 80 | +/** |
| 81 | + * Boots a real `LiteKernel` with a `data` provider, this plugin, and — when |
| 82 | + * given — a security provider that registers AFTER this plugin's `init()`, |
| 83 | + * which is what every composition shipping plugin-security produces (it |
| 84 | + * registers `security` in its `start()`). The first plugin taps the kernel's |
| 85 | + * logger so every line the analytics plugin writes, at init and at query |
| 86 | + * time, is seen. |
| 87 | + */ |
| 88 | +async function bootKernel(security?: Record<string, unknown>) { |
| 89 | + const lines: Lines = { info: [], warn: [], error: [] }; |
| 90 | + const { engine, reads } = fakeEngine(); |
| 91 | + const tap: Plugin = { |
| 92 | + name: 'test.log-tap', |
| 93 | + init: async (ctx: PluginContext) => { |
| 94 | + for (const level of ['info', 'warn', 'error'] as const) { |
| 95 | + vi.spyOn(ctx.logger, level).mockImplementation((message: unknown) => { |
| 96 | + lines[level].push(String(message)); |
| 97 | + }); |
| 98 | + } |
| 99 | + }, |
| 100 | + }; |
| 101 | + const data: Plugin = { |
| 102 | + name: 'test.data', |
| 103 | + init: async (ctx: PluginContext) => { ctx.registerService('data', engine); }, |
| 104 | + }; |
| 105 | + const kernel = new LiteKernel({ logger: { level: 'silent' } }); |
| 106 | + kernel.use(tap); |
| 107 | + kernel.use(data); |
| 108 | + kernel.use(new AnalyticsServicePlugin({ queryCapabilities: nativeSql })); |
| 109 | + if (security) { |
| 110 | + // Registered from start(), the phase plugin-security registers it in. |
| 111 | + kernel.use({ |
| 112 | + name: 'test.security', |
| 113 | + init: async () => {}, |
| 114 | + start: async (ctx: PluginContext) => { ctx.registerService('security', security); }, |
| 115 | + } satisfies Plugin); |
| 116 | + } |
| 117 | + await kernel.bootstrap(); |
| 118 | + return { service: kernel.getService<AnalyticsService>('analytics'), reads, lines }; |
| 119 | +} |
| 120 | + |
| 121 | +/** A working security service's row-scope half; `undefined` = no row restriction. */ |
| 122 | +const rowScopeOpen = { getReadFilter: async () => undefined }; |
| 123 | + |
| 124 | +describe('admission absence report — a default composition (security registered after analytics init)', () => { |
| 125 | + it('boots with no admitObjectRead WARN: the init-time absence is an info line', async () => { |
| 126 | + const canReadObject = vi.fn(() => true); |
| 127 | + const { lines } = await bootKernel({ ...rowScopeOpen, canReadObject }); |
| 128 | + |
| 129 | + expect(about(lines.warn)).toEqual([]); |
| 130 | + expect(about(lines.error)).toEqual([]); |
| 131 | + expect(about(lines.info).join('\n')).toMatch( |
| 132 | + /admitObjectRead bridged to the "security" service; that service is not registered yet at init/, |
| 133 | + ); |
| 134 | + }); |
| 135 | + |
| 136 | + it('its first query asks the security service that registered later — both verdicts, as before', async () => { |
| 137 | + const canReadObject = vi.fn(() => true); |
| 138 | + const admitted = await bootKernel({ ...rowScopeOpen, canReadObject }); |
| 139 | + |
| 140 | + expect((await runProbe(admitted.service)).rows).toEqual([{ cnt: 24 }]); |
| 141 | + expect(canReadObject).toHaveBeenCalledWith('employer_member', CALLER); |
| 142 | + expect(admitted.reads).toHaveLength(1); |
| 143 | + // Asking the service that is there is not an absence: nothing to report. |
| 144 | + expect(about(admitted.lines.warn)).toEqual([]); |
| 145 | + |
| 146 | + const refused = await bootKernel({ ...rowScopeOpen, canReadObject: () => false }); |
| 147 | + await expect(runProbe(refused.service)).rejects.toMatchObject({ |
| 148 | + code: 'PERMISSION_DENIED', |
| 149 | + status: 403, |
| 150 | + }); |
| 151 | + expect(refused.reads).toEqual([]); |
| 152 | + expect(about(refused.lines.warn).join('\n')).not.toMatch(/No admitObjectRead configured/); |
| 153 | + }); |
| 154 | +}); |
| 155 | + |
| 156 | +describe('admission absence report — a real kernel that never registers a security service', () => { |
| 157 | + it('logs no init-time WARN, and absence stays loud at query time with the outcome unchanged', async () => { |
| 158 | + // The in-repo kernels answer a missing service by THROWING |
| 159 | + // ("[Kernel] Service 'security' not found"), which this bridge classifies |
| 160 | + // as a resolution that threw: it denies, fail-closed, and says so at |
| 161 | + // `error` on every query. That outcome is what this boot produced before |
| 162 | + // the init-time WARN moved, and it is not this file's to change; what is |
| 163 | + // pinned is that dropping the init-time WARN left this case loud. |
| 164 | + const { service, reads, lines } = await bootKernel(undefined); |
| 165 | + |
| 166 | + expect(about(lines.warn)).toEqual([]); |
| 167 | + |
| 168 | + await expect(runProbe(service)).rejects.toMatchObject({ |
| 169 | + code: 'PERMISSION_DENIED', |
| 170 | + status: 403, |
| 171 | + }); |
| 172 | + expect(reads).toEqual([]); |
| 173 | + expect(about(lines.error).join('\n')).toMatch( |
| 174 | + /object-level read admission could not be resolved for "employer_member" .* denying the query \(fail-closed\)/s, |
| 175 | + ); |
| 176 | + }); |
| 177 | +}); |
| 178 | + |
| 179 | +// ── The ABSENT resolution: a context that answers a missing service with nothing ─ |
| 180 | + |
| 181 | +function fakePluginContext() { |
| 182 | + const { engine, reads } = fakeEngine(); |
| 183 | + const registered: Record<string, unknown> = {}; |
| 184 | + const lines: Lines = { info: [], warn: [], error: [] }; |
| 185 | + const record = (level: keyof Lines) => (message: unknown) => { lines[level].push(String(message)); }; |
| 186 | + return { |
| 187 | + reads, |
| 188 | + lines, |
| 189 | + registered, |
| 190 | + ctx: { |
| 191 | + getService: (name: string) => (name === 'data' ? engine : registered[name]), |
| 192 | + registerService: (name: string, svc: unknown) => { registered[name] = svc; }, |
| 193 | + replaceService: (name: string, svc: unknown) => { registered[name] = svc; }, |
| 194 | + logger: { info: record('info'), warn: record('warn'), error: record('error'), debug() {} }, |
| 195 | + }, |
| 196 | + }; |
| 197 | +} |
| 198 | + |
| 199 | +describe('admission absence report — no security service ever registered (the ABSENT resolution)', () => { |
| 200 | + it('WARNs at the first query, once: a second query does not repeat it, and both are admitted as before', async () => { |
| 201 | + const { ctx, registered, reads, lines } = fakePluginContext(); |
| 202 | + await new AnalyticsServicePlugin({ queryCapabilities: nativeSql }).init(ctx as never); |
| 203 | + const service = registered.analytics as AnalyticsService; |
| 204 | + |
| 205 | + // Nothing at init beyond the heads-up: the verdict is the first query's. |
| 206 | + expect(about(lines.warn)).toEqual([]); |
| 207 | + |
| 208 | + expect((await runProbe(service)).rows).toEqual([{ cnt: 24 }]); |
| 209 | + expect(reads).toHaveLength(1); |
| 210 | + const first = about(lines.warn); |
| 211 | + expect(first).toHaveLength(1); |
| 212 | + expect(first[0]).toMatch( |
| 213 | + /No admitObjectRead configured and no "security" service registered when an analytics query needed one \(first: "employer_member"\)/, |
| 214 | + ); |
| 215 | + expect(first[0]).toMatch(/do NOT enforce the OBJECT-LEVEL read grant/); |
| 216 | + |
| 217 | + expect((await runProbe(service)).rows).toEqual([{ cnt: 24 }]); |
| 218 | + expect(reads).toHaveLength(2); |
| 219 | + expect(about(lines.warn)).toEqual(first); |
| 220 | + expect(about(lines.error)).toEqual([]); |
| 221 | + }); |
| 222 | + |
| 223 | + it('reports per plugin instance, not per process: a second plugin init gets its own report', async () => { |
| 224 | + for (let i = 0; i < 2; i++) { |
| 225 | + const { ctx, registered, lines } = fakePluginContext(); |
| 226 | + await new AnalyticsServicePlugin({ queryCapabilities: nativeSql }).init(ctx as never); |
| 227 | + await runProbe(registered.analytics as AnalyticsService); |
| 228 | + expect(about(lines.warn)).toHaveLength(1); |
| 229 | + } |
| 230 | + }); |
| 231 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments