mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-21 22:31:46 +00:00
Finish the NestJS migration — drop the legacy Express app
NestJS now serves the whole surface: every /api domain plus the platform
routes (uploads, /mcp, the OAuth/MCP SDK + /.well-known metadata and the
production SPA fallback). Removed server/src/app.ts, all of
server/src/routes/* and the strangler dispatcher; index.ts and the
integration suite share a single buildApp() bootstrap so prod and tests
can't drift.
- Platform/transport routes extracted to nest/platform/platform.routes.ts
and mounted before app.init() — Nest's router answers an unmatched
request with a 404, so a route registered after init is never reached.
The SPA fallback is a NotFoundException filter and the catch-all uses a
RegExp (Express 5's path-to-regexp rejects a bare '*').
- New modules: memories (/api/integrations/memories — the Journey
gallery's Immich/Synology proxy), addons (GET /api/addons) and the
cross-trip GET /api/reservations/upcoming.
- TrekExceptionFilter reproduces the old multer / err.statusCode handling
so upload rejections keep their 400/413 { error } body and non-ASCII
filenames survive (defParamCharset).
- addTripToJourney and the MCP get_journey_share_link tool gained the
trip-access check they were missing.
- Re-pointed the 34 integration tests + the websocket test onto the Nest
app; removed the now-meaningless Express-vs-Nest parity tests and a few
orphaned client components.
This commit is contained in:
Maurice
@@ -71,8 +71,10 @@ beforeEach(() => {
|
||||
isAddonEnabledMock.mockReturnValue(true);
|
||||
|
||||
// Default mock: returns a trip-summary-shaped value from the real in-memory DB
|
||||
// so that the trip title / existence match what tests insert, but budget/packing
|
||||
// are arrays (as prompts.ts expects), not the object shape getTripSummary now returns.
|
||||
// so the trip title / existence match what tests insert. `budget` mirrors the
|
||||
// real getTripSummary object shape ({ items, total, ... }) that prompts.ts reads
|
||||
// via budget.items/budget.total; packing stays an array (the packing prompt
|
||||
// tolerates it).
|
||||
mockGetTripSummary.mockImplementation((tripId: any) => {
|
||||
const trip = testDb.prepare('SELECT * FROM trips WHERE id = ?').get(tripId) as any;
|
||||
if (!trip) return null;
|
||||
@@ -87,8 +89,13 @@ beforeEach(() => {
|
||||
trip,
|
||||
days: [],
|
||||
members,
|
||||
budget: budgetRows, // array shape expected by prompts.ts
|
||||
packing: packingRows, // array shape expected by prompts.ts
|
||||
budget: {
|
||||
items: budgetRows,
|
||||
item_count: budgetRows.length,
|
||||
total: budgetRows.reduce((sum, i) => sum + (i.total_price || 0), 0),
|
||||
currency: trip.currency,
|
||||
},
|
||||
packing: packingRows, // array shape; packing prompt tolerates it
|
||||
reservations: [],
|
||||
collabNotes: [],
|
||||
};
|
||||
|
||||
@@ -1,145 +0,0 @@
|
||||
import { describe, it, expect, afterEach } from 'vitest';
|
||||
import { getNestPrefixes, makeNestPathMatcher } from '../../../src/nest/strangler';
|
||||
|
||||
describe('strangler toggle', () => {
|
||||
const original = process.env.NEST_PREFIXES;
|
||||
afterEach(() => {
|
||||
if (original === undefined) delete process.env.NEST_PREFIXES;
|
||||
else process.env.NEST_PREFIXES = original;
|
||||
});
|
||||
|
||||
it('defaults to the migrated prefixes when NEST_PREFIXES is unset', () => {
|
||||
delete process.env.NEST_PREFIXES;
|
||||
expect(getNestPrefixes()).toEqual([
|
||||
'/api/_nest',
|
||||
'/api/weather',
|
||||
'/api/airports',
|
||||
'/api/config',
|
||||
'/api/system-notices',
|
||||
'/api/maps',
|
||||
'/api/categories',
|
||||
'/api/tags',
|
||||
'/api/notifications',
|
||||
'/api/addons/atlas',
|
||||
'/api/addons/vacay',
|
||||
'/api/trips/:tripId/packing',
|
||||
'/api/trips/:tripId/todo',
|
||||
'/api/trips/:tripId/budget',
|
||||
'/api/trips/:tripId/reservations',
|
||||
'/api/trips/:tripId/accommodations',
|
||||
'/api/trips/:tripId/days',
|
||||
'/api/trips/:tripId/assignments',
|
||||
'/api/trips/:tripId/places',
|
||||
'/api/trips/:tripId/collab',
|
||||
'/api/trips/:tripId/files',
|
||||
'/api/photos',
|
||||
'/api/journeys',
|
||||
'/api/public/journey',
|
||||
'/api/shared',
|
||||
'/api/settings',
|
||||
'/api/backup',
|
||||
'/api/auth/app-config',
|
||||
'/api/auth/demo-login',
|
||||
'/api/auth/invite',
|
||||
'/api/auth/register',
|
||||
'/api/auth/login',
|
||||
'/api/auth/forgot-password',
|
||||
'/api/auth/reset-password',
|
||||
'/api/auth/me',
|
||||
'/api/auth/logout',
|
||||
'/api/auth/avatar',
|
||||
'/api/auth/users',
|
||||
'/api/auth/validate-keys',
|
||||
'/api/auth/app-settings',
|
||||
'/api/auth/travel-stats',
|
||||
'/api/auth/mfa',
|
||||
'/api/auth/mcp-tokens',
|
||||
'/api/auth/ws-token',
|
||||
'/api/auth/resource-token',
|
||||
'/api/auth/oidc',
|
||||
'/api/oauth',
|
||||
'/oauth/token',
|
||||
'/oauth/userinfo',
|
||||
'/oauth/revoke',
|
||||
'/api/admin',
|
||||
'/api/trips/:tripId/share-link',
|
||||
'/api/trips|',
|
||||
'/api/trips/:tripId|',
|
||||
'/api/trips/:tripId/members',
|
||||
'/api/trips/:tripId/cover',
|
||||
'/api/trips/:tripId/copy',
|
||||
'/api/trips/:tripId/bundle',
|
||||
'/api/trips/:tripId/export.ics',
|
||||
]);
|
||||
});
|
||||
|
||||
it('parses NEST_PREFIXES (comma-separated, trimmed)', () => {
|
||||
process.env.NEST_PREFIXES = '/api/weather, /api/airports';
|
||||
expect(getNestPrefixes()).toEqual(['/api/weather', '/api/airports']);
|
||||
});
|
||||
|
||||
it('treats an empty NEST_PREFIXES as "all routes on legacy"', () => {
|
||||
process.env.NEST_PREFIXES = '';
|
||||
expect(getNestPrefixes()).toEqual([]);
|
||||
});
|
||||
|
||||
it('matches exact prefixes and subpaths but not lookalikes', () => {
|
||||
const match = makeNestPathMatcher(['/api/_nest']);
|
||||
expect(match('/api/_nest')).toBe(true);
|
||||
expect(match('/api/_nest/health')).toBe(true);
|
||||
expect(match('/api/_nestxyz')).toBe(false);
|
||||
expect(match('/api/health')).toBe(false);
|
||||
});
|
||||
|
||||
it('exact prefixes (trailing |) match the path only, not sub-paths', () => {
|
||||
const match = makeNestPathMatcher(['/api/trips|', '/api/trips/:tripId|', '/api/trips/:tripId/members']);
|
||||
expect(match('/api/trips')).toBe(true);
|
||||
expect(match('/api/trips/5')).toBe(true);
|
||||
expect(match('/api/trips/5/members')).toBe(true);
|
||||
expect(match('/api/trips/5/members/2')).toBe(true);
|
||||
// Not-yet-migrated nested mounts stay on Express:
|
||||
expect(match('/api/trips/5/collab')).toBe(false);
|
||||
expect(match('/api/trips/5/files')).toBe(false);
|
||||
expect(match('/api/trips/5/cover')).toBe(false);
|
||||
});
|
||||
|
||||
it('routes auth sub-paths via their own explicit prefixes (no broad /api/auth catch-all)', () => {
|
||||
// The account prefixes alone must NOT swallow the separately-mounted oidc flow:
|
||||
const accountOnly = makeNestPathMatcher(['/api/auth/login', '/api/auth/me', '/api/auth/mfa', '/api/auth/mcp-tokens']);
|
||||
expect(accountOnly('/api/auth/login')).toBe(true);
|
||||
expect(accountOnly('/api/auth/me/password')).toBe(true);
|
||||
expect(accountOnly('/api/auth/mfa/verify-login')).toBe(true);
|
||||
expect(accountOnly('/api/auth/mcp-tokens/abc')).toBe(true);
|
||||
expect(accountOnly('/api/auth/oidc')).toBe(false);
|
||||
expect(accountOnly('/api/auth/oidc/callback')).toBe(false);
|
||||
// oidc is matched only by its own prefix (A2):
|
||||
const withOidc = makeNestPathMatcher(['/api/auth/oidc']);
|
||||
expect(withOidc('/api/auth/oidc/login')).toBe(true);
|
||||
expect(withOidc('/api/auth/oidc/callback')).toBe(true);
|
||||
});
|
||||
|
||||
it('routes the OAuth public endpoints to Nest but leaves the SDK mounts on Express (A3)', () => {
|
||||
const match = makeNestPathMatcher(['/oauth/token', '/oauth/userinfo', '/oauth/revoke', '/api/oauth']);
|
||||
expect(match('/oauth/token')).toBe(true);
|
||||
expect(match('/oauth/userinfo')).toBe(true);
|
||||
expect(match('/oauth/revoke')).toBe(true);
|
||||
expect(match('/api/oauth/clients')).toBe(true);
|
||||
expect(match('/api/oauth/authorize/validate')).toBe(true);
|
||||
// The MCP SDK handlers must stay on Express:
|
||||
expect(match('/oauth/authorize')).toBe(false);
|
||||
expect(match('/oauth/register')).toBe(false);
|
||||
expect(match('/oauth/consent')).toBe(false);
|
||||
});
|
||||
|
||||
it('matches a pattern prefix with :param without capturing sibling routes', () => {
|
||||
const match = makeNestPathMatcher(['/api/trips/:tripId/packing']);
|
||||
expect(match('/api/trips/5/packing')).toBe(true);
|
||||
expect(match('/api/trips/5/packing/bags')).toBe(true);
|
||||
expect(match('/api/trips/abc/packing/123')).toBe(true);
|
||||
// Sibling trip routes stay on Express:
|
||||
expect(match('/api/trips/5/days')).toBe(false);
|
||||
expect(match('/api/trips/5/places')).toBe(false);
|
||||
expect(match('/api/trips/5')).toBe(false);
|
||||
expect(match('/api/trips/5/packingx')).toBe(false);
|
||||
});
|
||||
});
|
||||
@@ -17,7 +17,15 @@ const { testDb, dbMock } = vi.hoisted(() => {
|
||||
closeDb: () => {},
|
||||
reinitialize: () => {},
|
||||
getPlaceWithTags: () => null,
|
||||
canAccessTrip: () => null,
|
||||
// Mirror the real canAccessTrip semantics against the test DB (owner or member
|
||||
// → truthy access row, else undefined) so addTripToJourney's trip-access guard
|
||||
// behaves as in production. (Was an unused `() => null` stub before the guard existed.)
|
||||
canAccessTrip: (tripId: number | string, userId: number) =>
|
||||
db
|
||||
.prepare(
|
||||
'SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)',
|
||||
)
|
||||
.get(userId, tripId, userId),
|
||||
isOwner: () => false,
|
||||
};
|
||||
return { testDb: db, dbMock: mock };
|
||||
@@ -417,6 +425,22 @@ describe('addTripToJourney / removeTripFromJourney', () => {
|
||||
expect(link).toBeDefined();
|
||||
});
|
||||
|
||||
it('JOURNEY-SVC-024b: refuses to link a trip the caller cannot access (IDOR guard)', () => {
|
||||
const { user } = createUser(testDb);
|
||||
const { user: stranger } = createUser(testDb);
|
||||
const journey = createJourney(testDb, user.id);
|
||||
// A trip owned by someone else, that `user` is not a member of.
|
||||
const foreignTrip = createTrip(testDb, stranger.id, { title: "Stranger's Trip" });
|
||||
|
||||
const result = addTripToJourney(journey.id, foreignTrip.id, user.id);
|
||||
|
||||
expect(result).toBe(false);
|
||||
const link = testDb.prepare(
|
||||
'SELECT * FROM journey_trips WHERE journey_id = ? AND trip_id = ?'
|
||||
).get(journey.id, foreignTrip.id);
|
||||
expect(link).toBeUndefined();
|
||||
});
|
||||
|
||||
it('JOURNEY-SVC-025: syncs places as skeleton entries when linking a trip', () => {
|
||||
const { user } = createUser(testDb);
|
||||
const journey = createJourney(testDb, user.id);
|
||||
|
||||
Reference in New Issue
Block a user