From a8f3b63dedff334433bb8d13f497c2e371dd12b0 Mon Sep 17 00:00:00 2001 From: Bradley Schofield Date: Wed, 13 Nov 2024 10:00:40 +0900 Subject: [PATCH] Add Tests for Relationships and Permissions, Update error messages to be a little clearer --- app/controllers/api/databases.php | 6 +- .../e2e/Services/Databases/DatabasesBase.php | 157 ++++++++++++++- .../Databases/DatabasesCustomClientTest.php | 189 ++++++++++++++++++ 3 files changed, 346 insertions(+), 6 deletions(-) diff --git a/app/controllers/api/databases.php b/app/controllers/api/databases.php index 4329565c05..b06866ce43 100644 --- a/app/controllers/api/databases.php +++ b/app/controllers/api/databases.php @@ -2886,11 +2886,11 @@ App::post('/v1/databases/:databaseId/collections/:collectionId/documents') } if (!empty($data) && empty($documentId)) { - throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Document ID is required when creating a single document'); // TODO: Make into normal error type + throw new Exception(Exception::DOCUMENT_MISSING_DATA, 'Document ID is required when creating a single document'); } - + if (!empty($documents) && !empty($documentId)) { - throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Document ID is not required when creating multiple documents'); // TODO: Make into normal error type + throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Param "documentId" is disallowed when creating multiple documents, use $id inside the documents'); } if (!empty($data)) { diff --git a/tests/e2e/Services/Databases/DatabasesBase.php b/tests/e2e/Services/Databases/DatabasesBase.php index c1bb6939d9..62b5118283 100644 --- a/tests/e2e/Services/Databases/DatabasesBase.php +++ b/tests/e2e/Services/Databases/DatabasesBase.php @@ -4809,7 +4809,7 @@ trait DatabasesBase 'x-appwrite-key' => $this->getProject()['apiKey'] ], [ 'databaseId' => ID::unique(), - 'name' => 'Bulk Create' + 'name' => 'Bulk Create Perms', ]); $this->assertNotEmpty($database['body']['$id']); @@ -4822,7 +4822,7 @@ trait DatabasesBase 'x-appwrite-key' => $this->getProject()['apiKey'] ]), [ 'collectionId' => ID::unique(), - 'name' => 'Bulk Create', + 'name' => 'Bulk Create Perms', 'documentSecurity' => true, 'permissions' => [ Permission::create(Role::any()), @@ -4916,9 +4916,160 @@ trait DatabasesBase 'number' => 1, ] ], - ]); + ]); $this->assertEquals(400, $response['headers']['status-code']); + // TEST FAIL - Can't miss $id in bulk documents + $response = $this->client->call(Client::METHOD_POST, "/databases/{$databaseId}/collections/{$data['$id']}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders()), [ + 'documents' => [ + [ + 'number' => 1, + ] + ], + ]); + + $this->assertEquals(400, $response['headers']['status-code']); + $this->assertEquals('$id is required inside documents when creating bulk documents', $response['body']['message']); + } + + public function testBulkCreateRelationships(): void + { + $database = $this->client->call(Client::METHOD_POST, '/databases', [ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ], [ + 'databaseId' => ID::unique(), + 'name' => 'Bulk Creates Relationships' + ]); + + $this->assertNotEmpty($database['body']['$id']); + + $databaseId = $database['body']['$id']; + + $collection1 = $this->client->call(Client::METHOD_POST, '/databases/' . $databaseId . '/collections', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'collectionId' => ID::unique(), + 'name' => 'Collection1', + 'documentSecurity' => false, + 'permissions' => [ + Permission::create(Role::any()), + Permission::read(Role::any()), + Permission::delete(Role::any()), + ], + ]); + + $collection2 = $this->client->call(Client::METHOD_POST, '/databases/' . $databaseId . '/collections', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'collectionId' => ID::unique(), + 'name' => 'Collection2', + 'documentSecurity' => false, + 'permissions' => [ + Permission::create(Role::any()), + Permission::read(Role::any()), + Permission::delete(Role::any()), + ], + ]); + + $collection1 = $collection1['body']['$id']; + $collection2 = $collection2['body']['$id']; + + $this->client->call(Client::METHOD_POST, '/databases/' . $databaseId . '/collections/' . $collection1 . '/attributes/relationship', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'relatedCollectionId' => $collection2, + 'type' => Database::RELATION_ONE_TO_MANY, + 'key' => 'collection2', + 'onDelete' => Database::RELATION_MUTATE_RESTRICT, + ]); + + $this->client->call(Client::METHOD_POST, '/databases/' . $databaseId . '/collections/' . $collection1 . '/attributes/string', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'key' => 'name', + 'size' => 256, + 'required' => true, + ]); + + $this->client->call(Client::METHOD_POST, '/databases/' . $databaseId . '/collections/' . $collection2 . '/attributes/string', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'key' => 'name', + 'size' => 256, + 'required' => true, + ]); + + sleep(3); + + $response = $this->client->call(Client::METHOD_POST, "/databases/{$databaseId}/collections/{$collection1}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders()), [ + 'documents' => [ + [ + '$id' => ID::unique(), + 'name' => 'Document 1', + 'collection2' => [ + [ + '$id' => ID::unique(), + 'name' => 'Document 2', + ], + [ + '$id' => ID::unique(), + 'name' => 'Document 3', + ], + ], + ], + [ + '$id' => ID::unique(), + 'name' => 'Document 2', + 'collection2' => [ + [ + '$id' => ID::unique(), + 'name' => 'Document 4', + ], + [ + '$id' => ID::unique(), + 'name' => 'Document 5', + ], + ], + ], + ], + ]); + + $this->assertEquals(201, $response['headers']['status-code']); + $this->assertEquals(2, $response['body']['modified']); + + $response = $this->client->call(Client::METHOD_GET, "/databases/{$databaseId}/collections/{$collection1}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders())); + + $this->assertEquals(200, $response['headers']['status-code']); + $this->assertEquals(2, $response['body']['total']); + + $response = $this->client->call(Client::METHOD_GET, "/databases/{$databaseId}/collections/{$collection2}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders())); + + $this->assertEquals(200, $response['headers']['status-code']); + $this->assertEquals(4, $response['body']['total']); } } diff --git a/tests/e2e/Services/Databases/DatabasesCustomClientTest.php b/tests/e2e/Services/Databases/DatabasesCustomClientTest.php index 8484996058..51e679c86e 100644 --- a/tests/e2e/Services/Databases/DatabasesCustomClientTest.php +++ b/tests/e2e/Services/Databases/DatabasesCustomClientTest.php @@ -890,4 +890,193 @@ class DatabasesCustomClientTest extends Scope $this->assertEquals(200, $response['headers']['status-code']); } + + public function testBulkCreatePermissions(): void + { + // Create database + $database = $this->client->call(Client::METHOD_POST, '/databases', [ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ], [ + 'databaseId' => ID::unique(), + 'name' => 'Bulk Create' + ]); + + $this->assertNotEmpty($database['body']['$id']); + + $databaseId = $database['body']['$id']; + + $collection = $this->client->call(Client::METHOD_POST, '/databases/' . $databaseId . '/collections', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'collectionId' => ID::unique(), + 'name' => 'Bulk Create', + 'documentSecurity' => true, + 'permissions' => [ + Permission::read(Role::any()), + Permission::delete(Role::any()), + Permission::update(Role::any()), + ], + ]); + + $this->assertEquals(201, $collection['headers']['status-code']); + + + $data = [ + '$id' => $collection['body']['$id'], + 'databaseId' => $collection['body']['databaseId'] + ]; + + // Await attribute + $numberAttribute = $this->client->call(Client::METHOD_POST, '/databases/' . $databaseId . '/collections/' . $data['$id'] . '/attributes/integer', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'key' => 'number', + 'required' => true, + ]); + + $this->assertEquals(202, $numberAttribute['headers']['status-code']); + + sleep(2); + + // TEST FAIL - Can't create document with missing collection level permissions + $response = $this->client->call(Client::METHOD_POST, "/databases/{$databaseId}/collections/{$data['$id']}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders()), [ + 'documents' => [ + [ + '$id' => ID::unique(), + 'number' => 1, + ], + [ + '$id' => ID::unique(), + 'number' => 2, + ], + [ + '$id' => ID::unique(), + 'number' => 3, + ], + ], + ]); + + $this->assertEquals(401, $response['headers']['status-code']); + $this->assertEquals('The current user is not authorized to perform the requested action.', $response['body']['message']); + + // TEST FAIL - Can't create document with missing document level permissions + $collection = $this->client->call(Client::METHOD_PUT, '/databases/' . $data['databaseId'] . '/collections/' . $data['$id'], array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'name' => 'Bulk Creates Perms', + 'documentSecurity' => true + ]); + + $this->assertEquals(200, $collection['headers']['status-code']); + + $response = $this->client->call(Client::METHOD_POST, "/databases/{$databaseId}/collections/{$data['$id']}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders()), [ + 'documents' => [ + [ + '$id' => ID::unique(), + 'number' => 1, + ], + [ + '$id' => ID::unique(), + 'number' => 2, + ], + [ + '$id' => ID::unique(), + 'number' => 3, + ], + ], + ]); + + $this->assertEquals(401, $response['headers']['status-code']); + $this->assertEquals('The current user is not authorized to perform the requested action.', $response['body']['message']); + + // TEST FAIL - Can't create document with permissions that aren't our own. + $collection = $this->client->call(Client::METHOD_PUT, '/databases/' . $data['databaseId'] . '/collections/' . $data['$id'], array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]), [ + 'name' => 'Bulk Creates Perms', + 'documentSecurity' => true, + 'permissions' => [ + Permission::create(Role::user($this->getUser()['$id'])), + Permission::read(Role::user($this->getUser()['$id'])), + Permission::update(Role::user($this->getUser()['$id'])), + Permission::delete(Role::user($this->getUser()['$id'])), + ] + ]); + + $this->assertEquals(200, $collection['headers']['status-code']); + + $response = $this->client->call(Client::METHOD_POST, "/databases/{$databaseId}/collections/{$data['$id']}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders()), [ + 'documents' => [ + [ + '$id' => ID::unique(), + 'number' => 1, + ], + [ + '$id' => ID::unique(), + 'number' => 2, + ], + [ + '$id' => ID::unique(), + 'number' => 3, + ], + ], + 'permissions' => [ + Permission::write(Role::user('aaaaaa')), + Permission::read(Role::user('aaaaaa')), + Permission::update(Role::user('aaaaaa')), + Permission::delete(Role::user('aaaaaa')), + ] + ]); + + $this->assertEquals(401, $response['headers']['status-code']); + + // TEST SUCCESS - Can create document with our own permissions. + $response = $this->client->call(Client::METHOD_POST, "/databases/{$databaseId}/collections/{$data['$id']}/documents", array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], $this->getHeaders()), [ + 'documents' => [ + [ + '$id' => ID::unique(), + 'number' => 1, + ], + [ + '$id' => ID::unique(), + 'number' => 2, + ], + [ + '$id' => ID::unique(), + 'number' => 3, + ], + ], + 'permissions' => [ + Permission::write(Role::user($this->getUser()['$id'])), + Permission::read(Role::user($this->getUser()['$id'])), + Permission::update(Role::user($this->getUser()['$id'])), + Permission::delete(Role::user($this->getUser()['$id'])), + ] + ]); + + $this->assertEquals(201, $response['headers']['status-code']); + $this->assertEquals(3, $response['body']['modified']); + } }