mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
22d178d2f9
Two pieces of copy-paste in the guard layer. Three addon guards — collections, airtrail, journey — did the same thing and differed only in the addon id they read and the word leading the 404. They are one AddonGuard plus a @RequireAddon(addonId, label) decorator now, read through the Reflector. A handler-level decorator overrides the controller's, and a route without the decorator is not gated at all. The demo-mode upload block was copy-pasted into six handlers, each carrying its own copy of the message. All six call isDemoWriteBlocked now, against the same DEMO_WRITE_ERROR body. That one is deliberately NOT a guard, though all six sites are handlers and a guard is the obvious shape — and this PR did build one first. Guards run before the multipart parser, so throwing from one leaves the request body unread and Node resets the connection: the client gets ECONNRESET instead of the 403. PROFILE-015 caught it. The check has to sit inside the handler, after the interceptor has drained the upload, for the response to arrive at all. The function carries that reasoning so the next person does not rediscover it. Two smaller findings on the way there. The DemoWriteGuard attempt broke eight e2e suites that never touch demo mode: AuthModule listed it as a provider, and RuntimeEnvService was not resolvable inside a TestingModule built around one domain module. AppConfigModule is @Global, but @Global only applies to modules that are in the graph. The five modules whose controllers now inject RuntimeEnvService import it explicitly, the same way PermissionsModule is handled. And both new guards get a test asserting the decorators are actually applied. Once a check moves out of a handler, that handler's own tests stop noticing if the decorator is dropped — the assertions on __guards__ and the @RequireAddon metadata are what keeps the four upload endpoints and the four addon route groups gated, and gated on the right addon.
63 lines
2.3 KiB
TypeScript
63 lines
2.3 KiB
TypeScript
/**
|
|
* The demo-mode upload block.
|
|
*
|
|
* The condition was copy-pasted into six upload handlers, each carrying its own
|
|
* copy of the 403 body. All six call isDemoWriteBlocked now.
|
|
*
|
|
* It is a function rather than a guard on purpose, and that is worth a test of
|
|
* its own: guards run before the multipart parser, so throwing from one leaves
|
|
* the request body unread and Node resets the connection — the client gets
|
|
* ECONNRESET instead of the 403. PROFILE-015 in the integration suite is what
|
|
* demonstrates it end-to-end.
|
|
*/
|
|
import { describe, it, expect, vi, afterEach } from 'vitest';
|
|
|
|
vi.mock('../../../src/nest/common/demo', () => ({ isDemoEmail: vi.fn(() => false) }));
|
|
|
|
import { isDemoWriteBlocked, DEMO_WRITE_ERROR } from '../../../src/nest/common/demo-write';
|
|
import { RuntimeEnvService } from '../../../src/nest/app-config/runtime-env.service';
|
|
import { isDemoEmail } from '../../../src/nest/common/demo';
|
|
|
|
const env = new RuntimeEnvService();
|
|
|
|
afterEach(() => {
|
|
delete process.env.DEMO_MODE;
|
|
vi.mocked(isDemoEmail).mockReturnValue(false);
|
|
});
|
|
|
|
describe('isDemoWriteBlocked', () => {
|
|
it('DEMO-WRITE-001: blocks the demo account while the instance runs in demo mode', () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
vi.mocked(isDemoEmail).mockReturnValue(true);
|
|
|
|
expect(isDemoWriteBlocked(env, 'demo@trek.app')).toBe(true);
|
|
});
|
|
|
|
it('DEMO-WRITE-002: lets a normal account through even while demo mode is on', () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
vi.mocked(isDemoEmail).mockReturnValue(false);
|
|
|
|
expect(isDemoWriteBlocked(env, 'alice@example.com')).toBe(false);
|
|
});
|
|
|
|
it('DEMO-WRITE-003: lets the demo account through when the instance is not in demo mode', () => {
|
|
vi.mocked(isDemoEmail).mockReturnValue(true);
|
|
|
|
expect(isDemoWriteBlocked(env, 'demo@trek.app')).toBe(false);
|
|
});
|
|
|
|
it('DEMO-WRITE-004: reads the env live, so a toggle takes effect without a restart', () => {
|
|
vi.mocked(isDemoEmail).mockReturnValue(true);
|
|
expect(isDemoWriteBlocked(env, 'demo@trek.app')).toBe(false);
|
|
|
|
process.env.DEMO_MODE = 'true';
|
|
expect(isDemoWriteBlocked(env, 'demo@trek.app')).toBe(true);
|
|
});
|
|
|
|
it('DEMO-WRITE-005: the 403 body is the one the six endpoints have always sent', () => {
|
|
expect(DEMO_WRITE_ERROR).toEqual({
|
|
error: 'Uploads are disabled in demo mode. Self-host TREK for full functionality.',
|
|
});
|
|
});
|
|
});
|