698 lines
20 KiB
TypeScript
698 lines
20 KiB
TypeScript
import { Event } from "@server/models";
|
|
import {
|
|
buildUser,
|
|
buildSubscription,
|
|
buildDocument,
|
|
} from "@server/test/factories";
|
|
import { getTestServer } from "@server/test/support";
|
|
|
|
const server = getTestServer();
|
|
|
|
describe("#subscriptions.create", () => {
|
|
it("should create a subscription", async () => {
|
|
const user = await buildUser();
|
|
|
|
const document = await buildDocument({
|
|
userId: user.id,
|
|
teamId: user.teamId,
|
|
});
|
|
|
|
const res = await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(200);
|
|
expect(body.data.id).toBeDefined();
|
|
expect(body.data.userId).toEqual(user.id);
|
|
expect(body.data.documentId).toEqual(document.id);
|
|
});
|
|
|
|
it("should emit event", async () => {
|
|
const user = await buildUser();
|
|
|
|
const document = await buildDocument({
|
|
userId: user.id,
|
|
teamId: user.teamId,
|
|
});
|
|
|
|
const res = await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(200);
|
|
expect(body.ok).toEqual(true);
|
|
|
|
const events = await Event.findAll();
|
|
|
|
expect(events.length).toEqual(1);
|
|
expect(events[0].name).toEqual("subscriptions.create");
|
|
expect(events[0].actorId).toEqual(user.id);
|
|
expect(events[0].documentId).toEqual(document.id);
|
|
});
|
|
|
|
it("should not create duplicate subscriptions", async () => {
|
|
const user = await buildUser();
|
|
|
|
const document = await buildDocument({
|
|
userId: user.id,
|
|
teamId: user.teamId,
|
|
});
|
|
|
|
// First `subscriptions.create` request.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// Second `subscriptions.create` request.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// Third `subscriptions.create` request.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// List subscriptions associated with
|
|
// `document.id`
|
|
const res = await server.post("/api/subscriptions.list", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(200);
|
|
// Database should only have 1 "enabled" subscription registered.
|
|
expect(body.data.length).toEqual(1);
|
|
expect(body.data[0].userId).toEqual(user.id);
|
|
expect(body.data[0].documentId).toEqual(document.id);
|
|
});
|
|
|
|
it("should not create a subscription on invalid events", async () => {
|
|
const user = await buildUser();
|
|
|
|
const document = await buildDocument({
|
|
userId: user.id,
|
|
teamId: user.teamId,
|
|
});
|
|
|
|
const res = await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
// Subscription on event
|
|
// that cannot be subscribed to.
|
|
event: "documents.publish",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(400);
|
|
expect(body.ok).toEqual(false);
|
|
expect(body.error).toEqual("validation_error");
|
|
expect(body.message).toEqual(
|
|
"Not a valid subscription event for documents"
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("#subscriptions.info", () => {
|
|
it("should provide info about a subscription", async () => {
|
|
const creator = await buildUser();
|
|
|
|
const subscriber = await buildUser({ teamId: creator.teamId });
|
|
|
|
// `creator` creates two documents
|
|
const document0 = await buildDocument({
|
|
userId: creator.id,
|
|
teamId: creator.teamId,
|
|
});
|
|
|
|
const document1 = await buildDocument({
|
|
userId: creator.id,
|
|
teamId: creator.teamId,
|
|
});
|
|
|
|
// `subscriber` subscribes to `document0`.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber.getJwtToken(),
|
|
documentId: document0.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber` subscribes to `document1`.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber.getJwtToken(),
|
|
documentId: document1.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber` wants info about
|
|
// their subscription on `document0`.
|
|
const subscription0 = await server.post("/api/subscriptions.info", {
|
|
body: {
|
|
token: subscriber.getJwtToken(),
|
|
documentId: document0.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const response0 = await subscription0.json();
|
|
|
|
expect(subscription0.status).toEqual(200);
|
|
expect(response0.data.id).toBeDefined();
|
|
expect(response0.data.userId).toEqual(subscriber.id);
|
|
expect(response0.data.documentId).toEqual(document0.id);
|
|
});
|
|
|
|
it("should not allow outsiders to gain info about a subscription", async () => {
|
|
const creator = await buildUser();
|
|
const subscriber = await buildUser({ teamId: creator.teamId });
|
|
// `viewer` is not a part of `creator`'s team.
|
|
const viewer = await buildUser();
|
|
|
|
// `creator` creates two documents
|
|
const document0 = await buildDocument({
|
|
userId: creator.id,
|
|
teamId: creator.teamId,
|
|
});
|
|
|
|
const document1 = await buildDocument({
|
|
userId: creator.id,
|
|
teamId: creator.teamId,
|
|
});
|
|
|
|
// `subscriber` subscribes to `document0`.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber.getJwtToken(),
|
|
documentId: document0.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber` subscribes to `document1`.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber.getJwtToken(),
|
|
documentId: document1.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `viewer` wants info about `subscriber`'s
|
|
// subscription on `document0`.
|
|
const subscription0 = await server.post("/api/subscriptions.info", {
|
|
body: {
|
|
token: viewer.getJwtToken(),
|
|
documentId: document0.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const response0 = await subscription0.json();
|
|
|
|
// `viewer` should be unauthorized.
|
|
expect(subscription0.status).toEqual(403);
|
|
expect(response0.ok).toEqual(false);
|
|
expect(response0.error).toEqual("authorization_error");
|
|
expect(response0.message).toEqual("Authorization error");
|
|
|
|
// `viewer` wants info about `subscriber`'s
|
|
// subscription on `document0`.
|
|
const subscription1 = await server.post("/api/subscriptions.info", {
|
|
body: {
|
|
token: viewer.getJwtToken(),
|
|
documentId: document1.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const response1 = await subscription1.json();
|
|
|
|
// `viewer` should be unauthorized.
|
|
expect(subscription1.status).toEqual(403);
|
|
expect(response1.ok).toEqual(false);
|
|
expect(response1.error).toEqual("authorization_error");
|
|
expect(response1.message).toEqual("Authorization error");
|
|
});
|
|
|
|
it("should not provide infomation on invalid events", async () => {
|
|
const creator = await buildUser();
|
|
|
|
const subscriber = await buildUser({ teamId: creator.teamId });
|
|
// `viewer` is a part of `creator`'s team.
|
|
const viewer = await buildUser({ teamId: creator.teamId });
|
|
|
|
// `creator` creates two documents
|
|
const document0 = await buildDocument({
|
|
userId: creator.id,
|
|
teamId: creator.teamId,
|
|
});
|
|
|
|
const document1 = await buildDocument({
|
|
userId: creator.id,
|
|
teamId: creator.teamId,
|
|
});
|
|
|
|
// `subscriber` subscribes to `document0`.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber.getJwtToken(),
|
|
documentId: document0.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber` subscribes to `document1`.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber.getJwtToken(),
|
|
documentId: document1.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `viewer` wants info about `subscriber`'s
|
|
// subscription on `document0`.
|
|
// They have requested an invalid event.
|
|
const subscription0 = await server.post("/api/subscriptions.info", {
|
|
body: {
|
|
token: viewer.getJwtToken(),
|
|
documentId: document0.id,
|
|
event: "documents.changed",
|
|
},
|
|
});
|
|
|
|
const response0 = await subscription0.json();
|
|
|
|
expect(subscription0.status).toEqual(400);
|
|
expect(response0.ok).toEqual(false);
|
|
expect(response0.error).toEqual("validation_error");
|
|
expect(response0.message).toEqual(
|
|
"Not a valid subscription event for documents"
|
|
);
|
|
|
|
// `viewer` wants info about `subscriber`'s
|
|
// subscription on `document0`.
|
|
// They have requested an invalid event.
|
|
const subscription1 = await server.post("/api/subscriptions.info", {
|
|
body: {
|
|
token: viewer.getJwtToken(),
|
|
documentId: document1.id,
|
|
event: "doc.affected",
|
|
},
|
|
});
|
|
|
|
const response1 = await subscription1.json();
|
|
|
|
expect(subscription1.status).toEqual(400);
|
|
expect(response1.ok).toEqual(false);
|
|
expect(response1.error).toEqual("validation_error");
|
|
expect(response1.message).toEqual(
|
|
"Not a valid subscription event for documents"
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("#subscriptions.list", () => {
|
|
it("should list user subscriptions", async () => {
|
|
const user = await buildUser();
|
|
|
|
const document = await buildDocument({
|
|
userId: user.id,
|
|
teamId: user.teamId,
|
|
});
|
|
|
|
await buildSubscription();
|
|
|
|
const subscription = await buildSubscription({
|
|
userId: user.id,
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
});
|
|
|
|
const res = await server.post("/api/subscriptions.list", {
|
|
body: {
|
|
token: user.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(200);
|
|
expect(body.data.length).toEqual(1);
|
|
expect(body.data[0].id).toEqual(subscription.id);
|
|
expect(body.data[0].userId).toEqual(user.id);
|
|
expect(body.data[0].documentId).toEqual(document.id);
|
|
});
|
|
|
|
it("user should be able to list subscriptions on document", async () => {
|
|
const subscriber0 = await buildUser();
|
|
// `subscriber1` belongs to `subscriber0`'s team.
|
|
const subscriber1 = await buildUser({ teamId: subscriber0.teamId });
|
|
// `viewer` belongs to `subscriber0`'s team.
|
|
const viewer = await buildUser({ teamId: subscriber0.teamId });
|
|
|
|
// `subscriber0` created a document.
|
|
const document = await buildDocument({
|
|
userId: subscriber0.id,
|
|
teamId: subscriber0.teamId,
|
|
});
|
|
|
|
// `subscriber0` wants to be notified about
|
|
// changes on this document.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber0.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber1` wants to be notified about
|
|
// changes on this document.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber1.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `viewer` just wants to know the subscribers
|
|
// for this document.
|
|
const res = await server.post("/api/subscriptions.list", {
|
|
body: {
|
|
token: viewer.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(200);
|
|
// `viewer` doesn't have any subscriptions on `document`.
|
|
expect(body.data.length).toEqual(0);
|
|
|
|
// `subscriber0` wants to know the subscribers
|
|
// for this document.
|
|
const res0 = await server.post("/api/subscriptions.list", {
|
|
body: {
|
|
token: subscriber0.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body0 = await res0.json();
|
|
|
|
// `subscriber1` subscribed after `subscriber0`
|
|
expect(body0.data[0].userId).toEqual(subscriber0.id);
|
|
// Both subscribers subscribed to same `document`.
|
|
expect(body0.data[0].documentId).toEqual(document.id);
|
|
|
|
// `subscriber1` wants to know the subscribers
|
|
// for this document.
|
|
const res1 = await server.post("/api/subscriptions.list", {
|
|
body: {
|
|
token: subscriber1.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body1 = await res1.json();
|
|
|
|
// `subscriber1` subscribed after `subscriber1`
|
|
expect(body1.data[0].userId).toEqual(subscriber1.id);
|
|
// Both subscribers subscribed to same `document`.
|
|
expect(body1.data[0].documentId).toEqual(document.id);
|
|
});
|
|
|
|
it("user should not be able to list invalid subscriptions", async () => {
|
|
const subscriber0 = await buildUser();
|
|
// `subscriber1` belongs to `subscriber0`'s team.
|
|
const subscriber1 = await buildUser({ teamId: subscriber0.teamId });
|
|
// `viewer` belongs to `subscriber0`'s team.
|
|
const viewer = await buildUser({ teamId: subscriber0.teamId });
|
|
|
|
// `subscriber0` created a document.
|
|
const document = await buildDocument({
|
|
userId: subscriber0.id,
|
|
teamId: subscriber0.teamId,
|
|
});
|
|
|
|
// `subscriber0` wants to be notified about
|
|
// changes on this document.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber0.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber1` wants to be notified about
|
|
// changes on this document.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber1.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `viewer` just wants to know the subscribers
|
|
// for this document.
|
|
const res = await server.post("/api/subscriptions.list", {
|
|
body: {
|
|
token: viewer.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "changes.on.documents",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(400);
|
|
expect(body.ok).toEqual(false);
|
|
expect(body.error).toEqual("validation_error");
|
|
expect(body.message).toEqual(
|
|
"Not a valid subscription event for documents"
|
|
);
|
|
});
|
|
|
|
it("user outside of the team should not be able to list subscriptions on internal document", async () => {
|
|
const subscriber0 = await buildUser();
|
|
// `subscriber1` belongs to `subscriber0`'s team.
|
|
const subscriber1 = await buildUser({ teamId: subscriber0.teamId });
|
|
// `viewer` belongs to a different team.
|
|
const viewer = await buildUser();
|
|
|
|
// `subscriber0` created a document.
|
|
const document = await buildDocument({
|
|
userId: subscriber0.id,
|
|
teamId: subscriber0.teamId,
|
|
});
|
|
|
|
// `subscriber0` wants to be notified about
|
|
// changes on this document.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber0.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber1` wants to be notified about
|
|
// changes on this document.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber1.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `viewer` wants to know the subscribers
|
|
// for this internal document.
|
|
const res = await server.post("/api/subscriptions.info", {
|
|
body: {
|
|
token: viewer.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
// `viewer` should not be authorized
|
|
// to view subscriptions on this document.
|
|
expect(res.status).toEqual(403);
|
|
expect(body.ok).toEqual(false);
|
|
expect(body.error).toEqual("authorization_error");
|
|
expect(body.message).toEqual("Authorization error");
|
|
});
|
|
});
|
|
|
|
describe("#subscriptions.delete", () => {
|
|
it("should delete user's subscription", async () => {
|
|
const user = await buildUser();
|
|
|
|
const document = await buildDocument({
|
|
userId: user.id,
|
|
teamId: user.teamId,
|
|
});
|
|
|
|
const subscription = await buildSubscription({
|
|
userId: user.id,
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
});
|
|
|
|
const res = await server.post("/api/subscriptions.delete", {
|
|
body: {
|
|
userId: user.id,
|
|
id: subscription.id,
|
|
token: user.getJwtToken(),
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(200);
|
|
expect(body.ok).toEqual(true);
|
|
expect(body.success).toEqual(true);
|
|
});
|
|
|
|
it("should emit event", async () => {
|
|
const user = await buildUser();
|
|
|
|
const document = await buildDocument({
|
|
userId: user.id,
|
|
teamId: user.teamId,
|
|
});
|
|
|
|
const subscription = await buildSubscription({
|
|
userId: user.id,
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
});
|
|
|
|
const res = await server.post("/api/subscriptions.delete", {
|
|
body: {
|
|
userId: user.id,
|
|
id: subscription.id,
|
|
token: user.getJwtToken(),
|
|
},
|
|
});
|
|
|
|
const events = await Event.findAll();
|
|
|
|
expect(events.length).toEqual(1);
|
|
expect(events[0].name).toEqual("subscriptions.delete");
|
|
expect(events[0].modelId).toEqual(subscription.id);
|
|
expect(events[0].actorId).toEqual(user.id);
|
|
expect(events[0].documentId).toEqual(document.id);
|
|
|
|
const body = await res.json();
|
|
|
|
expect(res.status).toEqual(200);
|
|
expect(body.ok).toEqual(true);
|
|
expect(body.success).toEqual(true);
|
|
});
|
|
|
|
it("users should not be able to delete other's subscriptions on document", async () => {
|
|
const subscriber0 = await buildUser();
|
|
// `subscriber1` belongs to `subscriber0`'s team.
|
|
const subscriber1 = await buildUser({ teamId: subscriber0.teamId });
|
|
|
|
// `subscriber0` created a document.
|
|
const document = await buildDocument({
|
|
userId: subscriber0.id,
|
|
teamId: subscriber0.teamId,
|
|
});
|
|
|
|
// `subscriber0` wants to be notified about
|
|
// changes on this document.
|
|
await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber0.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
// `subscriber1` wants to be notified about
|
|
// changes on this document.
|
|
const resp = await server.post("/api/subscriptions.create", {
|
|
body: {
|
|
token: subscriber1.getJwtToken(),
|
|
documentId: document.id,
|
|
event: "documents.update",
|
|
},
|
|
});
|
|
|
|
const subscription1 = await resp.json();
|
|
const subscription1Id = subscription1.data.id;
|
|
|
|
// `subscriber0` wants to change `subscriber1`'s
|
|
// subscription for this document.
|
|
const res = await server.post("/api/subscriptions.delete", {
|
|
body: {
|
|
// `subscriber0`
|
|
userId: subscriber0.id,
|
|
// subscription id of `subscriber1`
|
|
id: subscription1Id,
|
|
token: subscriber0.getJwtToken(),
|
|
},
|
|
});
|
|
|
|
const body = await res.json();
|
|
|
|
// `subscriber0` should be unauthorized.
|
|
expect(res.status).toEqual(403);
|
|
expect(body.ok).toEqual(false);
|
|
expect(body.error).toEqual("authorization_error");
|
|
expect(body.message).toEqual("Authorization error");
|
|
});
|
|
});
|