fix(page-data): isolate owner API from public pages
This commit is contained in:
@@ -15,14 +15,24 @@ test('htmlUsesForbiddenLegacyPageDataApi detects /api/page-data passthrough', ()
|
||||
assert.equal(detectPageDataDatasetUsageFromHtml(html).size, 0);
|
||||
});
|
||||
|
||||
test('detectPageDataDatasetUsageFromHtml finds insert and read datasets', () => {
|
||||
test('detectPageDataDatasetUsageFromHtml treats browser deleteRow as a soft delete', () => {
|
||||
const html = `
|
||||
await c.insertRow('tkmind_exp_survey', { satisfaction: '满意' });
|
||||
await c.listRows('tkmind_exp_survey', { limit: 10 });
|
||||
await c.deleteRow('tkmind_exp_survey', 42);
|
||||
`;
|
||||
const usage = detectPageDataDatasetUsageFromHtml(html);
|
||||
assert.equal(usage.size, 1);
|
||||
assert.deepEqual(usage.get('tkmind_exp_survey'), { insert: true, read: true });
|
||||
assert.deepEqual(usage.get('tkmind_exp_survey'), { insert: true, read: true, softDelete: true });
|
||||
});
|
||||
|
||||
test('buildPageDataPolicyDatasetsFromRegistry grants registered soft delete when HTML uses deleteRow', () => {
|
||||
const datasets = buildPageDataPolicyDatasetsFromRegistry({
|
||||
html: `const DATASET = 'mood_notes'; await c.deleteRow(DATASET, 1);`,
|
||||
registryDatasets: [{ name: 'mood_notes', columns: { soft_delete: ['id'] } }],
|
||||
});
|
||||
assert.equal(datasets.mood_notes.softDelete, true);
|
||||
assert.deepEqual(datasets.mood_notes.columns.soft_delete, ['id']);
|
||||
});
|
||||
|
||||
test('detectPageDataDatasetUsageFromHtml resolves dataset constants', () => {
|
||||
|
||||
Reference in New Issue
Block a user