TREK/server/tests/unit/plugins/settings-isolation.test.ts

/**
 * Plugin settings isolation.
 *
 * A plugin's settings live in its OWN storage — instance config in `plugins.config`,
 * per-user config in `plugin_user_config` keyed by (plugin_id, user_id). Plugin code
 * never writes the core `settings` table, and every read helper is host-bound to one
 * plugin id. These tests pin that, plus the settings-key constraint: an unconstrained
 * key (`__proto__`, `constructor`) used to resolve off Object.prototype, so a REQUIRED
 * field with such a name reported as configured for a user who had configured nothing —
 * which for a notification channel meant being dispatched to everyone with no credentials.
 */
import { db as testDb } from '../../../src/db/database';
import { AuditLog } from '../../../src/db/entities/AuditLog.entity';
import { NotificationChannelPreferences } from '../../../src/db/entities/NotificationChannelPreferences.entity';
import { PluginActions } from '../../../src/db/entities/PluginActions.entity';
import { PluginCapabilityAudit } from '../../../src/db/entities/PluginCapabilityAudit.entity';
import { PluginEgressHosts } from '../../../src/db/entities/PluginEgressHosts.entity';
import { PluginEntityMetadata } from '../../../src/db/entities/PluginEntityMetadata.entity';
import { PluginErrorLog } from '../../../src/db/entities/PluginErrorLog.entity';
import { PluginMetaMigrations } from '../../../src/db/entities/PluginMetaMigrations.entity';
import { PluginOauthState } from '../../../src/db/entities/PluginOauthState.entity';
import { PluginOauthTokens } from '../../../src/db/entities/PluginOauthTokens.entity';
import { PluginScheduledTasks } from '../../../src/db/entities/PluginScheduledTasks.entity';
import { PluginSettingsFields } from '../../../src/db/entities/PluginSettingsFields.entity';
import { PluginUserConfig } from '../../../src/db/entities/PluginUserConfig.entity';
import { PluginUserErasureQueue } from '../../../src/db/entities/PluginUserErasureQueue.entity';
import { Plugins } from '../../../src/db/entities/Plugins.entity';
import { Settings } from '../../../src/db/entities/Settings.entity';
import { Users } from '../../../src/db/entities/Users.entity';
import { AuditService } from '../../../src/nest/audit/audit.service';
import { UnitOfWork } from '../../../src/nest/database/unit-of-work';
import { parseManifest, ManifestError } from '../../../src/nest/plugins/install/manifest';
import { PluginUserSettingsService } from '../../../src/nest/plugins/plugin-user-settings.service';
import { createUser } from '../../helpers/factories';
import { createTestAddonsService } from '../../helpers/test-addons';
import { createTestOrm, type TestOrm } from '../../helpers/test-orm';

import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';

vi.mock('../../../src/db/database', async () => {
  const { createSnapshotTestDb } = await import('../../helpers/db-mock');
  const db = createSnapshotTestDb();
  return { db, closeDb: () => {}, reinitialize: () => {}, canAccessTrip: async () => null };
});

vi.mock('../../../src/config', () => ({
  JWT_SECRET: 'x'.repeat(40),
  ENCRYPTION_KEY: 'a'.repeat(64),
  updateJwtSecret: () => {},
}));

/**
 * The host-side settings reads, over the same connection the test seeded. `t` is
 * initialized in `beforeAll` (below) before any test runs — this reaches for
 * `PluginSettingsFieldsRepository`/`PluginUserConfigRepository` through it, matching
 * PSET-007's own `PluginRuntimeService` construction further down, which reuses the
 * SAME `t` rather than a second ORM over the same connection.
 */
const userSettings = () =>
  new PluginUserSettingsService((t as TestOrm).repo(PluginSettingsFields), (t as TestOrm).repo(PluginUserConfig));

let uid: number;
let t: TestOrm | undefined;

afterAll(async () => {
  await t?.close();
});

function declareField(pluginId: string, key: string, opts: { required?: boolean; secret?: boolean } = {}) {
  testDb
    .prepare(
      `INSERT INTO plugin_settings_fields (plugin_id, field_key, label, input_type, required, secret, scope, sort_order)
     VALUES (?, ?, ?, 'text', ?, ?, 'user', 0)`,
    )
    .run(pluginId, key, key, opts.required ? 1 : 0, opts.secret ? 1 : 0);
}
function setUserConfig(pluginId: string, config: Record<string, unknown>) {
  testDb
    .prepare('INSERT OR REPLACE INTO plugin_user_config (plugin_id, user_id, config) VALUES (?, ?, ?)')
    .run(pluginId, uid, JSON.stringify(config));
}

beforeAll(async () => {
  // Plan 3j Task 4 — `userSettings()` above now needs repositories, so the ORM this
  // file eventually built only inside PSET-007 is built here instead, before any
  // test runs (PSET-001..006 call `userSettings()` with no ORM of their own).
  t = await createTestOrm(testDb);
});
beforeEach(() => {
  testDb.prepare('DELETE FROM plugin_settings_fields').run();
  testDb.prepare('DELETE FROM plugin_user_config').run();
  testDb.prepare('DELETE FROM settings').run();
  testDb.prepare('DELETE FROM users').run();
  uid = createUser(testDb).user.id;
});

describe('plugin settings are isolated from core and from each other', () => {
  it('PSET-001 — a plugin declaring "webhook_url" cannot touch the CORE settings row', async () => {
    testDb
      .prepare("INSERT INTO settings (user_id, key, value) VALUES (?, 'webhook_url', 'https://core.example.com/real')")
      .run(uid);
    declareField('evil', 'webhook_url');
    setUserConfig('evil', { webhook_url: 'https://attacker.example.com' });

    // The user's REAL notification webhook is untouched — the plugin's value lives in
    // its own blob, in its own table. The namespacing is structural, not by key naming.
    const core = testDb.prepare("SELECT value FROM settings WHERE user_id = ? AND key = 'webhook_url'").get(uid) as {
      value: string;
    };
    expect(core.value).toBe('https://core.example.com/real');
    expect(await userSettings().readAll('evil', uid)).toEqual({ webhook_url: 'https://attacker.example.com' });
  });

  it('PSET-002 — plugin A cannot read plugin B’s config, even with the same key name', async () => {
    declareField('a', 'token', { secret: true });
    declareField('b', 'token', { secret: true });
    setUserConfig('b', { token: 'B-SECRET' });

    expect(await userSettings().readAll('a', uid)).toEqual({});
    expect(await userSettings().readOne('a', uid, 'token')).toBeUndefined();
    expect(await userSettings().readOne('b', uid, 'token')).toBe('B-SECRET');
  });

  it('PSET-003 — a plugin only ever sees its own DECLARED keys', async () => {
    declareField('p', 'declared');
    // An undeclared key that somehow reached the blob is not handed to the plugin.
    setUserConfig('p', { declared: 'yes', sneaked: 'no' });
    expect(await userSettings().readAll('p', uid)).toEqual({ declared: 'yes' });
  });
});

describe('settings keys cannot resolve off the prototype chain', () => {
  it.each(['__proto__', 'constructor', 'prototype'])(
    'PSET-004 — a REQUIRED field named "%s" is NOT reported as configured',
    async (key) => {
      declareField('evil', key, { required: true });
      // The user has configured nothing at all.
      expect(await userSettings().hasRequired('evil', uid)).toBe(false);
      expect(await userSettings().readAll('evil', uid)).toEqual({});
    },
  );

  it('PSET-005 — a genuinely configured required field still reports configured', async () => {
    declareField('good', 'appToken', { required: true, secret: true });
    expect(await userSettings().hasRequired('good', uid)).toBe(false);
    setUserConfig('good', { appToken: 'T' });
    expect(await userSettings().hasRequired('good', uid)).toBe(true);
  });

  it('PSET-006 — the manifest rejects such a key at install', () => {
    const base = {
      id: 'evil',
      name: 'Evil',
      version: '1.0.0',
      apiVersion: 1,
      type: 'integration',
      nativeModules: false,
      permissions: [],
    };
    for (const key of ['__proto__', 'constructor', 'prototype', 'has space', '1leading', 'a'.repeat(65)]) {
      expect(() => parseManifest({ ...base, settings: [{ key, scope: 'user' }] })).toThrow(ManifestError);
    }
    // …and still accepts an ordinary one.
    expect(
      parseManifest({ ...base, settings: [{ key: 'appToken', scope: 'user', secret: true, required: true }] })
        .settings[0].key,
    ).toBe('appToken');
  });
});

/**
 * The channel label is a plugin-supplied string that becomes a column header in the
 * user's notification preferences matrix, so the host bounds it like every other
 * plugin string it renders (cf. cap()/stripEmoji in the calendar + photo controllers).
 */
describe('a plugin channel label is bounded by the host', () => {
  it('PSET-007 — an oversized, emoji-laden capabilities.title is capped and stripped', async () => {
    const { PluginRuntimeService } = await import('../../../src/nest/plugins/plugin-runtime.service');
    process.env.TREK_PLUGINS_ENABLED = 'true';

    testDb
      .prepare(
        `INSERT OR REPLACE INTO plugins (id, name, status, enabled, version, permissions, granted_permissions, capabilities, config)
       VALUES ('loud', 'Loud', 'active', 1, '1.0.0', '[]', '[]', ?, '{}')`,
      )
      .run(JSON.stringify({ notificationChannel: { title: '🎉'.repeat(5) + 'A'.repeat(500) } }));

    const rt = new PluginRuntimeService(
      new AuditService(t.repo(AuditLog), t.repo(Users)),
      await createTestAddonsService(testDb),
      userSettings(),
      t.repo(Plugins),
      t.repo(PluginErrorLog),
      t.repo(PluginScheduledTasks),
      t.repo(PluginUserErasureQueue),
      t.repo(PluginEgressHosts),
      t.repo(PluginSettingsFields),
      t.repo(PluginActions),
      t.repo(PluginUserConfig),
      t.repo(PluginEntityMetadata),
      t.repo(PluginOauthTokens),
      t.repo(PluginOauthState),
      t.repo(PluginMetaMigrations),
      t.repo(PluginCapabilityAudit),
      t.repo(Settings),
      t.repo(NotificationChannelPreferences),
      // Plan 4 Task 4: `uow` is no longer `@Optional()`.
      new UnitOfWork(t.em),
    );
    // Stand the plugin up as a granted, active notificationChannel provider.
    (rt as unknown as { supervisor: { running: Map<string, unknown> } }).supervisor.running.set('loud', {
      id: 'loud',
      status: 'active',
      hooks: ['notificationChannel'],
      granted: new Set(['hook:notification-channel']),
    });

    const [channel] = await rt.notificationChannels();
    expect(channel.id).toBe('plugin:loud');
    expect(channel.label!.length).toBeLessThanOrEqual(40);
    expect(channel.label).not.toMatch(/\p{Extended_Pictographic}/u);
    delete process.env.TREK_PLUGINS_ENABLED;
  });
});