tkmind/memind
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(page-data): isolate owner API from public pages

Browse Source
This commit is contained in:
john
2026-07-15 10:56:22 +08:00
parent 72fd88219c
commit a07cf07861
15 changed files with 200 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
page-data-integration.test.mjs
+11 -11
View File
@@ -133,14 +133,14 @@ test('integration: owner private API and public insert coexist without breaking
const service = await setupWorkspace(workspaceRoot);
const app = buildApp(workspaceRoot);
const ownerInsert = await request(app, 'POST', '/api/page-data/entries/rows', {
const ownerInsert = await request(app, 'POST', '/api/admin/page-data/entries/rows', {
headers: { 'x-test-user': '1' },
body: { title: 'owner 写入' },
});
assert.equal(ownerInsert.status, 201);
assert.equal(ownerInsert.body.data.row.title, 'owner 写入');
const ownerList = await request(app, 'GET', '/api/page-data/entries?limit=10', {
const ownerList = await request(app, 'GET', '/api/admin/page-data/entries?limit=10', {
headers: { 'x-test-user': '1' },
});
assert.equal(ownerList.status, 200);
@@ -157,7 +157,7 @@ test('integration: owner private API and public insert coexist without breaking
},
},
};
const policyWrite = await request(app, 'PUT', `/api/page-data/policies/${PAGE_ID}`, {
const policyWrite = await request(app, 'PUT', `/api/admin/page-data/policies/${PAGE_ID}`, {
headers: { 'x-test-user': '1' },
body: policy,
});
@@ -174,7 +174,7 @@ test('integration: owner private API and public insert coexist without breaking
assert.equal(publicReadDenied.status, 403);
assert.equal(publicReadDenied.body.error.code, 'action_not_allowed');
const ownerListAfterPublic = await request(app, 'GET', '/api/page-data/entries?limit=10', {
const ownerListAfterPublic = await request(app, 'GET', '/api/admin/page-data/entries?limit=10', {
headers: { 'x-test-user': '1' },
});
assert.equal(ownerListAfterPublic.status, 200);
@@ -188,7 +188,7 @@ test('integration: public insert rejects SQL injection style payload keys', asyn
const workspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'page-data-integration-sql-'));
await setupWorkspace(workspaceRoot);
const app = buildApp(workspaceRoot);
await request(app, 'PUT', `/api/page-data/policies/${PAGE_ID}`, {
await request(app, 'PUT', `/api/admin/page-data/policies/${PAGE_ID}`, {
headers: { 'x-test-user': '1' },
body: {
pageId: PAGE_ID,
@@ -252,7 +252,7 @@ test('integration: password publication flow still works for read after data-aut
const app = express();
app.use('/api', api);
await request(app, 'PUT', `/api/page-data/policies/${PAGE_ID}`, {
await request(app, 'PUT', `/api/admin/page-data/policies/${PAGE_ID}`, {
headers: { 'x-test-user': '1' },
body: {
pageId: PAGE_ID,
@@ -284,7 +284,7 @@ test('integration: public insert writes operation logs for owner review', async
const workspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'page-data-logs-int-'));
await setupPublicWorkspace(workspaceRoot);
const app = buildApp(workspaceRoot);
await request(app, 'PUT', `/api/page-data/policies/${PAGE_ID}`, {
await request(app, 'PUT', `/api/admin/page-data/policies/${PAGE_ID}`, {
headers: { 'x-test-user': '1' },
body: {
pageId: PAGE_ID,
@@ -296,7 +296,7 @@ test('integration: public insert writes operation logs for owner review', async
await request(app, 'POST', `/api/public/pages/${PAGE_ID}/data/signups/rows`, {
body: { name: '日志测试', phone: '13800000000' },
});
const logs = await request(app, 'GET', `/api/page-data/policies/${PAGE_ID}/logs`, {
const logs = await request(app, 'GET', `/api/admin/page-data/policies/${PAGE_ID}/logs`, {
headers: { 'x-test-user': '1' },
});
assert.equal(logs.status, 200);
@@ -313,7 +313,7 @@ test('integration: owner can export dataset and restore soft-deleted rows', asyn
phone: '13800000001',
});
const app = buildApp(workspaceRoot);
const exported = await request(app, 'GET', '/api/page-data/signups/export?format=json', {
const exported = await request(app, 'GET', '/api/admin/page-data/signups/export?format=json', {
headers: { 'x-test-user': '1' },
});
assert.equal(exported.status, 200);
@@ -322,7 +322,7 @@ test('integration: owner can export dataset and restore soft-deleted rows', asyn
await ownerService.softDeleteRowForDataset(ownerService.getDataset('signups'), inserted.row.id, {
deletedBy: 'test',
});
const restored = await request(app, 'POST', `/api/page-data/signups/rows/${inserted.row.id}/restore`, {
const restored = await request(app, 'POST', `/api/admin/page-data/signups/rows/${inserted.row.id}/restore`, {
headers: { 'x-test-user': '1' },
});
assert.equal(restored.status, 200);
@@ -334,7 +334,7 @@ test('integration: apply-publish route binds dataset after publication', async (
await setupPublicWorkspace(workspaceRoot);
const app = buildApp(workspaceRoot);
const applied = await request(app, 'POST', `/api/page-data/policies/${PAGE_ID}/apply-publish`, {
const applied = await request(app, 'POST', `/api/admin/page-data/policies/${PAGE_ID}/apply-publish`, {
headers: { 'x-test-user': '1' },
body: {
datasetName: 'signups',