diff --git a/plugin-sdk/examples/trip-countdown/server/index.js b/plugin-sdk/examples/trip-countdown/server/index.js index a15335c70..03e48f6bf 100644 --- a/plugin-sdk/examples/trip-countdown/server/index.js +++ b/plugin-sdk/examples/trip-countdown/server/index.js @@ -31,7 +31,7 @@ module.exports = definePlugin({ return { status: 200, headers: json(), - body: JSON.stringify({ trip: t ? { name: t.name, days } : null }), + body: JSON.stringify({ trip: t ? { name: t.title, days } : null }), } }, }, diff --git a/server/src/nest/plugins/host/rpc-host.ts b/server/src/nest/plugins/host/rpc-host.ts index 451e94a88..ca0a78efc 100644 --- a/server/src/nest/plugins/host/rpc-host.ts +++ b/server/src/nest/plugins/host/rpc-host.ts @@ -71,7 +71,9 @@ export class PluginRpcHost { } if (has('db:read:trips')) { - this.methods.set('trips.getById', (p) => this.tripRead(p, () => deps.canAccessTrip(num(p.tripId, 'tripId'), num(p.asUserId, 'asUserId')))); + this.methods.set('trips.getById', (p) => + this.tripRead(p, () => deps.db.prepare('SELECT * FROM trips WHERE id = ?').get(num(p.tripId, 'tripId'))), + ); this.methods.set('trips.getPlaces', (p) => this.tripRead(p, () => deps.db.prepare('SELECT * FROM places WHERE trip_id = ? ORDER BY day_id, position').all(num(p.tripId, 'tripId'))), ); diff --git a/server/tests/unit/plugins/rpc-host.test.ts b/server/tests/unit/plugins/rpc-host.test.ts index 22d789ab6..2512c307b 100644 --- a/server/tests/unit/plugins/rpc-host.test.ts +++ b/server/tests/unit/plugins/rpc-host.test.ts @@ -18,9 +18,12 @@ function makeDeps(): HostDeps { close: vi.fn(), } as unknown as HostDeps['data'], db: { - prepare: vi.fn(() => ({ + prepare: vi.fn((sql: string) => ({ all: () => [{ id: 7, name: 'Place' }], - get: () => ({ id: 3, username: 'ada', display_name: 'Ada', avatar: null }), + get: () => + sql.includes('FROM trips') + ? { id: 1, title: 'Japan', start_date: '2027-01-01' } + : { id: 3, username: 'ada', display_name: 'Ada', avatar: null }, })), }, // trip 1 is accessible to user 42; everything else is not @@ -63,7 +66,9 @@ describe('PluginRpcHost — capability enforcement', () => { const host = new PluginRpcHost('p', new Set(['db:read:trips']), deps); const res = await host.dispatch(req('trips.getById', { tripId: 1, asUserId: 42 })); expect(ok(res)).toBe(true); - expect((res as RpcResponse).result).toEqual({ id: 1 }); + // returns the ACTUAL trip row (title/start_date), not the access-check object + expect((res as RpcResponse).result).toMatchObject({ id: 1, title: 'Japan', start_date: '2027-01-01' }); + expect(deps.db.prepare).toHaveBeenCalledWith(expect.stringContaining('FROM trips')); }); it('db:read:trips is still RESOURCE_FORBIDDEN when the user is not a member', async () => {