fix(page-data): isolate owner API from public pages

This commit is contained in:
john
2026-07-15 10:56:22 +08:00
parent 72fd88219c
commit a07cf07861
15 changed files with 200 additions and 90 deletions
+12 -2
View File
@@ -15,14 +15,24 @@ test('htmlUsesForbiddenLegacyPageDataApi detects /api/page-data passthrough', ()
assert.equal(detectPageDataDatasetUsageFromHtml(html).size, 0);
});
test('detectPageDataDatasetUsageFromHtml finds insert and read datasets', () => {
test('detectPageDataDatasetUsageFromHtml treats browser deleteRow as a soft delete', () => {
const html = `
await c.insertRow('tkmind_exp_survey', { satisfaction: '满意' });
await c.listRows('tkmind_exp_survey', { limit: 10 });
await c.deleteRow('tkmind_exp_survey', 42);
`;
const usage = detectPageDataDatasetUsageFromHtml(html);
assert.equal(usage.size, 1);
assert.deepEqual(usage.get('tkmind_exp_survey'), { insert: true, read: true });
assert.deepEqual(usage.get('tkmind_exp_survey'), { insert: true, read: true, softDelete: true });
});
test('buildPageDataPolicyDatasetsFromRegistry grants registered soft delete when HTML uses deleteRow', () => {
const datasets = buildPageDataPolicyDatasetsFromRegistry({
html: `const DATASET = 'mood_notes'; await c.deleteRow(DATASET, 1);`,
registryDatasets: [{ name: 'mood_notes', columns: { soft_delete: ['id'] } }],
});
assert.equal(datasets.mood_notes.softDelete, true);
assert.deepEqual(datasets.mood_notes.columns.soft_delete, ['id']);
});
test('detectPageDataDatasetUsageFromHtml resolves dataset constants', () => {