456 lines
18 KiB
JavaScript
456 lines
18 KiB
JavaScript
/**
|
|
* Tests for network-access-store (DC-145).
|
|
* Coverage:
|
|
* - CRUD: getAccessMap empty default, saveAccessMap, setGrant, removeGrant
|
|
* - validation rejections: bad principal type, empty resource, non-bool allowed
|
|
* - dedupe last-wins on saveAccessMap and setGrant upsert
|
|
* - atomicity: concurrent writes serialize; invalid save leaves file untouched
|
|
* - effective access: union of groups, person-override-beats-group (both
|
|
* directions: person true beats group false, person false beats group true)
|
|
* - subscribe change events + unsubscribe + listener isolation
|
|
* - derived views: listPrincipals / listResources
|
|
* - on-disk shape {grants, updatedAt} at data/network-access.json
|
|
*/
|
|
|
|
'use strict';
|
|
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const os = require('os');
|
|
const {
|
|
createNetworkAccessStore,
|
|
normalizeGrants,
|
|
validateGrant,
|
|
} = require('../src/security/network-access-store');
|
|
|
|
function _tmpDir() {
|
|
return fs.mkdtempSync(path.join(os.tmpdir(), 'dashcaddy-netaccess-'));
|
|
}
|
|
function _cleanup(dir) {
|
|
try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
|
|
}
|
|
function _readFile(dir) {
|
|
return JSON.parse(fs.readFileSync(path.join(dir, 'network-access.json'), 'utf8'));
|
|
}
|
|
|
|
describe('network-access-store: basic CRUD', () => {
|
|
let dir, store;
|
|
beforeEach(() => { dir = _tmpDir(); store = createNetworkAccessStore({ dataDir: dir }); });
|
|
afterEach(() => _cleanup(dir));
|
|
|
|
test('empty map when file missing — {grants: [], updatedAt: null}', async () => {
|
|
const map = await store.getAccessMap();
|
|
expect(map).toEqual({ grants: [], updatedAt: null });
|
|
});
|
|
|
|
test('saveAccessMap persists {grants, updatedAt} to network-access.json', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [
|
|
{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: true },
|
|
],
|
|
});
|
|
expect(r.ok).toBe(true);
|
|
expect(r.map.updatedAt).toBeTruthy();
|
|
const onDisk = _readFile(dir);
|
|
expect(onDisk.grants).toHaveLength(1);
|
|
expect(onDisk.grants[0].principal).toEqual({ type: 'person', id: 'p1' });
|
|
expect(onDisk.grants[0].resource).toBe('plex');
|
|
expect(onDisk.grants[0].allowed).toBe(true);
|
|
expect(typeof onDisk.updatedAt).toBe('string');
|
|
});
|
|
|
|
test('getAccessMap returns saved grants', async () => {
|
|
await store.saveAccessMap({
|
|
grants: [{ principal: { type: 'group', id: 'family' }, resource: 'nas', allowed: true }],
|
|
});
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toHaveLength(1);
|
|
expect(map.grants[0].principal.id).toBe('family');
|
|
});
|
|
|
|
test('setGrant adds a grant', async () => {
|
|
const r = await store.setGrant({ type: 'person', id: 'p1' }, 'plex', true);
|
|
expect(r.ok).toBe(true);
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toEqual([
|
|
{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: true },
|
|
]);
|
|
});
|
|
|
|
test('setGrant upserts (replaces) same principal+resource — no duplicate', async () => {
|
|
await store.setGrant({ type: 'person', id: 'p1' }, 'plex', true);
|
|
await store.setGrant({ type: 'person', id: 'p1' }, 'plex', false);
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toHaveLength(1);
|
|
expect(map.grants[0].allowed).toBe(false);
|
|
});
|
|
|
|
test('removeGrant deletes an existing grant', async () => {
|
|
await store.setGrant({ type: 'person', id: 'p1' }, 'plex', true);
|
|
const r = await store.removeGrant({ type: 'person', id: 'p1' }, 'plex');
|
|
expect(r.ok).toBe(true);
|
|
expect(r.removed).toBe(true);
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toHaveLength(0);
|
|
});
|
|
|
|
test('removeGrant on absent grant is idempotent (removed: false)', async () => {
|
|
const r = await store.removeGrant({ type: 'group', id: 'x' }, 'nothing');
|
|
expect(r.ok).toBe(true);
|
|
expect(r.removed).toBe(false);
|
|
});
|
|
|
|
test('person and group grants with same id are distinct principals', async () => {
|
|
await store.setGrant({ type: 'person', id: 'same' }, 'plex', true);
|
|
await store.setGrant({ type: 'group', id: 'same' }, 'plex', false);
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toHaveLength(2);
|
|
});
|
|
});
|
|
|
|
describe('network-access-store: validation rejections', () => {
|
|
let dir, store;
|
|
beforeEach(() => { dir = _tmpDir(); store = createNetworkAccessStore({ dataDir: dir }); });
|
|
afterEach(() => _cleanup(dir));
|
|
|
|
test('saveAccessMap rejects non-array grants', async () => {
|
|
const r = await store.saveAccessMap({ grants: 'nope' });
|
|
expect(r.ok).toBe(false);
|
|
expect(r.reason).toMatch(/invalid_grants/);
|
|
});
|
|
|
|
test('saveAccessMap rejects bad principal type', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [{ principal: { type: 'robot', id: 'x' }, resource: 'plex', allowed: true }],
|
|
});
|
|
expect(r.ok).toBe(false);
|
|
expect(r.reason).toMatch(/invalid_principal_type/);
|
|
});
|
|
|
|
test('saveAccessMap rejects missing principal', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [{ resource: 'plex', allowed: true }],
|
|
});
|
|
expect(r.ok).toBe(false);
|
|
expect(r.reason).toMatch(/invalid_principal/);
|
|
});
|
|
|
|
test('saveAccessMap rejects empty/whitespace resource', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [{ principal: { type: 'person', id: 'p1' }, resource: ' ', allowed: true }],
|
|
});
|
|
expect(r.ok).toBe(false);
|
|
expect(r.reason).toMatch(/invalid_resource/);
|
|
});
|
|
|
|
test('saveAccessMap rejects non-string resource', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [{ principal: { type: 'person', id: 'p1' }, resource: 42, allowed: true }],
|
|
});
|
|
expect(r.ok).toBe(false);
|
|
expect(r.reason).toMatch(/invalid_resource/);
|
|
});
|
|
|
|
test('saveAccessMap rejects non-boolean allowed', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: 'yes' }],
|
|
});
|
|
expect(r.ok).toBe(false);
|
|
expect(r.reason).toMatch(/invalid_allowed/);
|
|
});
|
|
|
|
test('setGrant validates the same way', async () => {
|
|
expect((await store.setGrant({ type: 'boat', id: 'x' }, 'plex', true)).ok).toBe(false);
|
|
expect((await store.setGrant({ type: 'person', id: 'x' }, '', true)).ok).toBe(false);
|
|
expect((await store.setGrant({ type: 'person', id: 'x' }, 'plex', 1)).ok).toBe(false);
|
|
});
|
|
|
|
test('validateGrant exported helper matches store behavior', () => {
|
|
expect(validateGrant({ principal: { type: 'person', id: 'a' }, resource: 'r', allowed: false })).toBe(null);
|
|
expect(validateGrant(null)).toMatch(/invalid_grant/);
|
|
expect(validateGrant({ principal: { type: 'person' }, resource: 'r', allowed: false })).toMatch(/invalid_principal_id/);
|
|
});
|
|
});
|
|
|
|
describe('network-access-store: dedupe last-wins', () => {
|
|
let dir, store;
|
|
beforeEach(() => { dir = _tmpDir(); store = createNetworkAccessStore({ dataDir: dir }); });
|
|
afterEach(() => _cleanup(dir));
|
|
|
|
test('saveAccessMap dedupes exact principal+resource, last entry wins', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [
|
|
{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: true },
|
|
{ principal: { type: 'group', id: 'g1' }, resource: 'plex', allowed: true },
|
|
{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: false }, // dup → wins
|
|
],
|
|
});
|
|
expect(r.ok).toBe(true);
|
|
expect(r.map.grants).toHaveLength(2);
|
|
const p1 = r.map.grants.find(g => g.principal.type === 'person');
|
|
expect(p1.allowed).toBe(false);
|
|
});
|
|
|
|
test('dedupe key includes principal type (person p1 ≠ group p1)', () => {
|
|
const r = normalizeGrants([
|
|
{ principal: { type: 'person', id: 'z' }, resource: 'r', allowed: true },
|
|
{ principal: { type: 'group', id: 'z' }, resource: 'r', allowed: false },
|
|
]);
|
|
expect(r.ok).toBe(true);
|
|
expect(r.grants).toHaveLength(2);
|
|
});
|
|
|
|
test('last-wins across all fields', async () => {
|
|
const r = await store.saveAccessMap({
|
|
grants: [
|
|
{ principal: { type: 'group', id: 'g' }, resource: 'nas', allowed: true },
|
|
{ principal: { type: 'group', id: 'g' }, resource: 'nas', allowed: false },
|
|
{ principal: { type: 'group', id: 'g' }, resource: 'nas', allowed: true },
|
|
],
|
|
});
|
|
expect(r.map.grants).toHaveLength(1);
|
|
expect(r.map.grants[0].allowed).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe('network-access-store: atomicity + concurrency', () => {
|
|
let dir, store;
|
|
beforeEach(() => { dir = _tmpDir(); store = createNetworkAccessStore({ dataDir: dir }); });
|
|
afterEach(() => _cleanup(dir));
|
|
|
|
test('invalid whole-grid save leaves the previous file untouched', async () => {
|
|
await store.saveAccessMap({
|
|
grants: [{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: true }],
|
|
});
|
|
const before = _readFile(dir);
|
|
const bad = await store.saveAccessMap({
|
|
grants: [
|
|
{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: true },
|
|
{ principal: { type: 'ghost', id: 'p2' }, resource: 'plex', allowed: true },
|
|
],
|
|
});
|
|
expect(bad.ok).toBe(false);
|
|
const after = _readFile(dir);
|
|
expect(after).toEqual(before); // nothing written, not even updatedAt
|
|
});
|
|
|
|
test('no partial file after a failed save (readers never see junk)', async () => {
|
|
await store.saveAccessMap({
|
|
grants: [{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: true }],
|
|
});
|
|
await store.saveAccessMap({ grants: 'garbage' });
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toHaveLength(1);
|
|
});
|
|
|
|
test('concurrent setGrant calls all land (mutex serialization, no lost update)', async () => {
|
|
await Promise.all([
|
|
store.setGrant({ type: 'person', id: 'p1' }, 'plex', true),
|
|
store.setGrant({ type: 'person', id: 'p2' }, 'plex', true),
|
|
store.setGrant({ type: 'group', id: 'g1' }, 'nas', false),
|
|
store.setGrant({ type: 'person', id: 'p1' }, 'nas', false),
|
|
]);
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toHaveLength(4);
|
|
});
|
|
|
|
test('corrupt JSON on disk falls back to empty map, not a crash', async () => {
|
|
fs.writeFileSync(path.join(dir, 'network-access.json'), '{not json');
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toEqual([]);
|
|
});
|
|
|
|
test('on-disk grants with junk entries are filtered on load', async () => {
|
|
fs.writeFileSync(path.join(dir, 'network-access.json'), JSON.stringify({
|
|
grants: [
|
|
{ principal: { type: 'person', id: 'p1' }, resource: 'plex', allowed: true },
|
|
{ junk: true },
|
|
],
|
|
updatedAt: '2026-01-01T00:00:00Z',
|
|
}));
|
|
const map = await store.getAccessMap();
|
|
expect(map.grants).toHaveLength(1);
|
|
});
|
|
});
|
|
|
|
describe('network-access-store: effectiveAccess', () => {
|
|
let dir, store;
|
|
beforeEach(() => {
|
|
dir = _tmpDir();
|
|
store = createNetworkAccessStore({ dataDir: dir });
|
|
});
|
|
afterEach(() => _cleanup(dir));
|
|
|
|
async function seed() {
|
|
await store.saveAccessMap({
|
|
grants: [
|
|
// groups
|
|
{ principal: { type: 'group', id: 'family' }, resource: 'plex', allowed: true },
|
|
{ principal: { type: 'group', id: 'family' }, resource: 'nas', allowed: true },
|
|
{ principal: { type: 'group', id: 'family' }, resource: 'jellyfin', allowed: false },
|
|
{ principal: { type: 'group', id: 'adults' }, resource: 'nas', allowed: false },
|
|
{ principal: { type: 'group', id: 'adults' }, resource: 'radarr', allowed: true },
|
|
// person-level
|
|
{ principal: { type: 'person', id: 'sami' }, resource: 'jellyfin', allowed: true }, // override deny
|
|
{ principal: { type: 'person', id: 'kid' }, resource: 'nas', allowed: false }, // override allow
|
|
],
|
|
});
|
|
}
|
|
|
|
test('group principal: own grants only', async () => {
|
|
await seed();
|
|
const r = await store.effectiveAccess({ type: 'group', id: 'family' });
|
|
expect(r.ok).toBe(true);
|
|
expect(r.resources).toEqual({ plex: true, nas: true, jellyfin: false });
|
|
});
|
|
|
|
test('person with no groups and no grants → empty resources', async () => {
|
|
await seed();
|
|
const r = await store.effectiveAccess({ type: 'person', id: 'nobody' });
|
|
expect(r.ok).toBe(true);
|
|
expect(r.resources).toEqual({});
|
|
});
|
|
|
|
test('union of groups', async () => {
|
|
await seed();
|
|
const r = await store.effectiveAccess({ type: 'person', id: 'adult1', groups: ['family', 'adults'] });
|
|
// union: plex(T)+nas(T)+jellyfin(F) from family, nas(F)+radarr(T) from adults
|
|
// (same-resource conflict across groups: later-processed write wins is
|
|
// unspecified, so assert presence, then deterministic bits)
|
|
expect(r.ok).toBe(true);
|
|
expect(r.resources.plex).toBe(true);
|
|
expect(r.resources.jellyfin).toBe(false);
|
|
expect(r.resources.radarr).toBe(true);
|
|
expect(typeof r.resources.nas).toBe('boolean');
|
|
});
|
|
|
|
test('person override beats group — explicit false wins over group true', async () => {
|
|
await seed();
|
|
const r = await store.effectiveAccess({ type: 'person', id: 'kid', groups: ['family'] });
|
|
expect(r.ok).toBe(true);
|
|
expect(r.resources.nas).toBe(false); // person false beats family true
|
|
expect(r.resources.plex).toBe(true); // inherited from group
|
|
});
|
|
|
|
test('person override beats group — explicit true wins over group false', async () => {
|
|
await seed();
|
|
const r = await store.effectiveAccess({ type: 'person', id: 'sami', groups: ['family'] });
|
|
expect(r.ok).toBe(true);
|
|
expect(r.resources.jellyfin).toBe(true); // person true beats family false
|
|
expect(r.resources.nas).toBe(true); // inherited
|
|
});
|
|
|
|
test('person-level false beats group false too (no flip)', async () => {
|
|
await seed();
|
|
const r = await store.effectiveAccess({ type: 'person', id: 'kid', groups: ['family', 'adults'] });
|
|
expect(r.resources.nas).toBe(false);
|
|
});
|
|
|
|
test('person grant on a resource no group touches appears', async () => {
|
|
await store.setGrant({ type: 'person', id: 'lone' }, 'plex', true);
|
|
const r = await store.effectiveAccess({ type: 'person', id: 'lone' });
|
|
expect(r.resources).toEqual({ plex: true });
|
|
});
|
|
|
|
test('invalid principal rejected with ok:false', async () => {
|
|
expect((await store.effectiveAccess(null)).ok).toBe(false);
|
|
expect((await store.effectiveAccess({ type: 'robot', id: 'x' })).ok).toBe(false);
|
|
expect((await store.effectiveAccess({ type: 'person', id: '' })).ok).toBe(false);
|
|
expect((await store.effectiveAccess({ type: 'person' })).ok).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('network-access-store: subscribe change events', () => {
|
|
let dir, store;
|
|
beforeEach(() => { dir = _tmpDir(); store = createNetworkAccessStore({ dataDir: dir }); });
|
|
afterEach(() => _cleanup(dir));
|
|
|
|
test('saveAccessMap, setGrant, removeGrant each emit the new map', async () => {
|
|
const seen = [];
|
|
store.subscribe(map => seen.push(['evt', map.grants.length]));
|
|
await store.saveAccessMap({ grants: [{ principal: { type: 'group', id: 'g' }, resource: 'plex', allowed: true }] });
|
|
await store.setGrant({ type: 'person', id: 'p' }, 'nas', true);
|
|
await store.removeGrant({ type: 'person', id: 'p' }, 'nas');
|
|
expect(seen).toEqual([['evt', 1], ['evt', 2], ['evt', 1]]);
|
|
});
|
|
|
|
test('event map includes updatedAt', async () => {
|
|
let got = null;
|
|
store.subscribe(map => { got = map; });
|
|
await store.setGrant({ type: 'person', id: 'p' }, 'plex', true);
|
|
expect(got).toBeTruthy();
|
|
expect(typeof got.updatedAt).toBe('string');
|
|
expect(got.grants).toHaveLength(1);
|
|
});
|
|
|
|
test('failed saves emit nothing', async () => {
|
|
const seen = [];
|
|
store.subscribe(() => seen.push(1));
|
|
await store.saveAccessMap({ grants: [{ bad: true }] });
|
|
await store.removeGrant({ type: 'person', id: 'ghost' }, 'none'); // no-op
|
|
expect(seen).toEqual([]);
|
|
});
|
|
|
|
test('unsubscribe stops events', async () => {
|
|
const seen = [];
|
|
const off = store.subscribe(() => seen.push(1));
|
|
await store.setGrant({ type: 'person', id: 'p' }, 'plex', true);
|
|
off();
|
|
await store.setGrant({ type: 'person', id: 'p' }, 'nas', true);
|
|
expect(seen).toEqual([1]);
|
|
});
|
|
|
|
test('a throwing listener is isolated — other listeners still run, save still works', async () => {
|
|
const seen = [];
|
|
store.subscribe(() => { throw new Error('boom'); });
|
|
store.subscribe(() => seen.push('ok'));
|
|
const r = await store.setGrant({ type: 'person', id: 'p' }, 'plex', true);
|
|
expect(r.ok).toBe(true);
|
|
expect(seen).toEqual(['ok']);
|
|
expect((await store.getAccessMap()).grants).toHaveLength(1);
|
|
});
|
|
|
|
test('subscribe requires a function', () => {
|
|
expect(() => store.subscribe('nope')).toThrow(TypeError);
|
|
});
|
|
});
|
|
|
|
describe('network-access-store: derived views', () => {
|
|
let dir, store;
|
|
beforeEach(() => { dir = _tmpDir(); store = createNetworkAccessStore({ dataDir: dir }); });
|
|
afterEach(() => _cleanup(dir));
|
|
|
|
test('listPrincipals aggregates grant counts, sorted by type then id', async () => {
|
|
await store.saveAccessMap({
|
|
grants: [
|
|
{ principal: { type: 'person', id: 'zeta' }, resource: 'plex', allowed: true },
|
|
{ principal: { type: 'person', id: 'zeta' }, resource: 'nas', allowed: false },
|
|
{ principal: { type: 'group', id: 'family' }, resource: 'plex', allowed: true },
|
|
{ principal: { type: 'person', id: 'abe' }, resource: 'nas', allowed: true },
|
|
],
|
|
});
|
|
const principals = await store.listPrincipals();
|
|
expect(principals).toEqual([
|
|
{ type: 'group', id: 'family', grantCount: 1 },
|
|
{ type: 'person', id: 'abe', grantCount: 1 },
|
|
{ type: 'person', id: 'zeta', grantCount: 2 },
|
|
]);
|
|
});
|
|
|
|
test('listResources distinct + sorted', async () => {
|
|
await store.saveAccessMap({
|
|
grants: [
|
|
{ principal: { type: 'person', id: 'p' }, resource: 'nas', allowed: true },
|
|
{ principal: { type: 'group', id: 'g' }, resource: 'plex', allowed: true },
|
|
{ principal: { type: 'group', id: 'g' }, resource: 'nas', allowed: false },
|
|
],
|
|
});
|
|
expect(await store.listResources()).toEqual(['nas', 'plex']);
|
|
});
|
|
|
|
test('empty map → empty views', async () => {
|
|
expect(await store.listPrincipals()).toEqual([]);
|
|
expect(await store.listResources()).toEqual([]);
|
|
});
|
|
});
|