|
| 1 | +/* |
| 2 | + * SPDX-FileCopyrightText: 2026 Decidiq Contributors |
| 3 | + * SPDX-License-Identifier: EUPL-1.2 |
| 4 | + * |
| 5 | + * Where the SPA's permission list comes from (decidiq#1267). |
| 6 | + * |
| 7 | + * The nav filter and the route guard both read one list, built in |
| 8 | + * `src/utils/permissions.js` from a single server-provided input: initial |
| 9 | + * state `isAdmin`, published by `DashboardController::renderIndex()` from |
| 10 | + * Nextcloud's own admin test on the acting user. Before #1267 the list was |
| 11 | + * derived from `window.OC.currentUser.permissions`, a property that does not |
| 12 | + * exist (OC.currentUser is the uid STRING), so the list was always `[]` and |
| 13 | + * the nav filter failed open for everyone. |
| 14 | + * |
| 15 | + * This spec asserts the half a browser can observe: what each account's page |
| 16 | + * load actually receives. How that value becomes a list, and how the guard |
| 17 | + * treats the list, is pinned in `tests/vitest/navPermissions.spec.js`; the |
| 18 | + * scenarios for those carry reason-bearing exclusions in the spec. |
| 19 | + * |
| 20 | + * WHY A REAL, NON-ADMIN ACCOUNT. The project's storage state is the `admin` |
| 21 | + * session, and admin is the one account for which the old fail-open bug and |
| 22 | + * a correct implementation look identical: both show everything. Only a |
| 23 | + * second account in no group at all can tell "the server said false" from |
| 24 | + * "nobody said anything". Every assertion names the account it is about. |
| 25 | + * |
| 26 | + * WHY A BROWSER LOGIN, NOT HTTP BASIC. The scenario is about what a person's |
| 27 | + * page load receives, so each account logs in through the login form in its |
| 28 | + * own context, exactly as the global setup does for admin. |
| 29 | + * |
| 30 | + * @e2e openspec/specs/authorization-via-or-rbac/spec.md#the-server-tells-the-spa-whether-the-account-is-an-administrator |
| 31 | + */ |
| 32 | +import type { APIResponse, Browser, Page } from '@playwright/test' |
| 33 | + |
| 34 | +import { expect, test } from '@playwright/test' |
| 35 | +import { randomBytes } from 'node:crypto' |
| 36 | +import { BASE_URL as BASE } from '../base-url.ts' |
| 37 | + |
| 38 | +const ADMIN_USER = process.env.NC_ADMIN_USER ?? 'admin' |
| 39 | +const ADMIN_PASS = process.env.NC_ADMIN_PASS ?? 'admin' |
| 40 | + |
| 41 | +// From a CSPRNG, not Math.random(): the password below is built from it. |
| 42 | +const RUN_ID = `${Date.now()}-${randomBytes(6).toString('hex')}` |
| 43 | + |
| 44 | +/** An account in no group at all, created for this run and deleted after it. */ |
| 45 | +const MEMBER = { |
| 46 | + uid: `dq1267-member-${RUN_ID}`, |
| 47 | + password: `Dq1267-member-${RUN_ID}-pw`, |
| 48 | +} |
| 49 | + |
| 50 | +/** |
| 51 | + * OCS headers. `OCS-APIRequest: true` is required: without it Nextcloud answers |
| 52 | + * an OCS call with 412 (CSRF) instead of processing it. |
| 53 | + */ |
| 54 | +const OCS = { Accept: 'application/json', 'OCS-APIRequest': 'true' } |
| 55 | + |
| 56 | +/** |
| 57 | + * Read a response body for an assertion message without letting a non-JSON |
| 58 | + * body throw inside the message builder. |
| 59 | + * |
| 60 | + * @param resp The response to describe. |
| 61 | + * @return A short printable description. |
| 62 | + */ |
| 63 | +async function summarise(resp: APIResponse): Promise<string> { |
| 64 | + const text = await resp.text().catch(() => '<unreadable body>') |
| 65 | + return `HTTP ${resp.status()} ${text.slice(0, 400)}` |
| 66 | +} |
| 67 | + |
| 68 | +/** |
| 69 | + * Log in through the form in a fresh context, with no inherited cookies, and |
| 70 | + * open the decidiq dashboard. |
| 71 | + * |
| 72 | + * @param browser The Playwright browser. |
| 73 | + * @param username The account to log in as. |
| 74 | + * @param password Its password. |
| 75 | + * @return The page, parked on the decidiq dashboard. |
| 76 | + */ |
| 77 | +async function openDashboardAs( |
| 78 | + browser: Browser, |
| 79 | + username: string, |
| 80 | + password: string, |
| 81 | +): Promise<Page> { |
| 82 | + const context = await browser.newContext({ |
| 83 | + baseURL: BASE, |
| 84 | + storageState: { cookies: [], origins: [] }, |
| 85 | + }) |
| 86 | + const page = await context.newPage() |
| 87 | + await page.goto('/index.php/login', { timeout: 60_000 }) |
| 88 | + await page.locator('input[name="user"]').fill(username) |
| 89 | + await page.locator('input[name="password"]').fill(password) |
| 90 | + await page.locator('button[type="submit"]').first().click() |
| 91 | + await page.waitForURL((url) => !/\/login(\?|$|\/)/.test(url.pathname), { |
| 92 | + timeout: 60_000, |
| 93 | + }) |
| 94 | + await page.goto('/index.php/apps/decidiq/', { timeout: 60_000 }) |
| 95 | + return page |
| 96 | +} |
| 97 | + |
| 98 | +/** |
| 99 | + * The value Nextcloud rendered for decidiq's `isAdmin` initial state. |
| 100 | + * |
| 101 | + * Nextcloud writes each initial state as a hidden input whose value is the |
| 102 | + * base64 of the JSON-encoded value. Read it from the DOM the server sent, |
| 103 | + * not from any variable the app derives from it. |
| 104 | + * |
| 105 | + * @param page A page on the decidiq dashboard. |
| 106 | + * @param account The account name, for the assertion message. |
| 107 | + * @return The decoded value. |
| 108 | + */ |
| 109 | +async function isAdminStateOf(page: Page, account: string): Promise<unknown> { |
| 110 | + const input = page.locator('#initial-state-decidiq-isAdmin') |
| 111 | + await expect( |
| 112 | + input, |
| 113 | + `${account}: the dashboard must publish initial state decidiq/isAdmin`, |
| 114 | + ).toHaveCount(1, { timeout: 30_000 }) |
| 115 | + const raw = await input.getAttribute('value') |
| 116 | + expect(raw, `${account}: initial state decidiq/isAdmin has no value`).not.toBeNull() |
| 117 | + return JSON.parse(Buffer.from(raw as string, 'base64').toString('utf8')) |
| 118 | +} |
| 119 | + |
| 120 | +test.describe('decidiq#1267: the server tells the SPA whether the account is an administrator', () => { |
| 121 | + test.beforeAll(async ({ playwright }) => { |
| 122 | + const admin = await playwright.request.newContext({ |
| 123 | + httpCredentials: { password: ADMIN_PASS, send: 'always', username: ADMIN_USER }, |
| 124 | + storageState: { cookies: [], origins: [] }, |
| 125 | + }) |
| 126 | + const created = await admin.post(`${BASE}/ocs/v2.php/cloud/users?format=json`, { |
| 127 | + data: { password: MEMBER.password, userid: MEMBER.uid }, |
| 128 | + headers: OCS, |
| 129 | + }) |
| 130 | + expect(created.ok(), `creating account ${MEMBER.uid}: ${await summarise(created)}`).toBe( |
| 131 | + true, |
| 132 | + ) |
| 133 | + |
| 134 | + // The whole point of this account is that it holds nothing. Prove it |
| 135 | + // before relying on it, so a stray default group cannot make the |
| 136 | + // "false" assertion below pass for the wrong reason, or fail for one. |
| 137 | + const groups = await admin.get( |
| 138 | + `${BASE}/ocs/v2.php/cloud/users/${MEMBER.uid}/groups?format=json`, |
| 139 | + { headers: OCS }, |
| 140 | + ) |
| 141 | + expect(groups.ok(), `reading the groups of ${MEMBER.uid}: ${await summarise(groups)}`).toBe( |
| 142 | + true, |
| 143 | + ) |
| 144 | + const body = await groups.json() |
| 145 | + expect( |
| 146 | + body?.ocs?.data?.groups ?? [], |
| 147 | + `${MEMBER.uid} must be in no group at all, in particular not in "admin"`, |
| 148 | + ).toEqual([]) |
| 149 | + await admin.dispose() |
| 150 | + }) |
| 151 | + |
| 152 | + test.afterAll(async ({ playwright }) => { |
| 153 | + const admin = await playwright.request.newContext({ |
| 154 | + httpCredentials: { password: ADMIN_PASS, send: 'always', username: ADMIN_USER }, |
| 155 | + storageState: { cookies: [], origins: [] }, |
| 156 | + }) |
| 157 | + await admin.delete(`${BASE}/ocs/v2.php/cloud/users/${MEMBER.uid}?format=json`, { |
| 158 | + headers: OCS, |
| 159 | + }) |
| 160 | + await admin.dispose() |
| 161 | + }) |
| 162 | + |
| 163 | + test('an administrator receives isAdmin true', async ({ browser }) => { |
| 164 | + const page = await openDashboardAs(browser, ADMIN_USER, ADMIN_PASS) |
| 165 | + try { |
| 166 | + expect( |
| 167 | + await isAdminStateOf(page, ADMIN_USER), |
| 168 | + `${ADMIN_USER} (a Nextcloud administrator) must receive isAdmin === true`, |
| 169 | + ).toBe(true) |
| 170 | + } finally { |
| 171 | + await page.context().close() |
| 172 | + } |
| 173 | + }) |
| 174 | + |
| 175 | + test('an account in no group receives isAdmin false, not nothing', async ({ browser }) => { |
| 176 | + const page = await openDashboardAs(browser, MEMBER.uid, MEMBER.password) |
| 177 | + try { |
| 178 | + // toBe(false), not toBeFalsy(): an absent value is exactly the |
| 179 | + // fail-open input #1267 removed, and must not pass as a "no". |
| 180 | + expect( |
| 181 | + await isAdminStateOf(page, MEMBER.uid), |
| 182 | + `${MEMBER.uid} (in no group) must receive isAdmin === false`, |
| 183 | + ).toBe(false) |
| 184 | + } finally { |
| 185 | + await page.context().close() |
| 186 | + } |
| 187 | + }) |
| 188 | +}) |
0 commit comments