memind/page-data-workspace-bind.test.mjs

import assert from 'node:assert/strict';
import test from 'node:test';
import {
  DEFAULT_PAGE_DATA_ADMIN_PASSWORD,
  resolvePageDataBindAccess,
  resolvePageDataBindPassword,
  resolveRegisteredPageDataPolicy,
} from './page-data-workspace-bind.mjs';

const HTML = '<script src="/assets/page-data-client.js"></script><script>MindSpacePageData.createClient().insertRow("activity_signups", { name: "test" })</script>';

function createDataSpace({ datasets = [], tables = {} } = {}) {
  return {
    listDatasets: () => datasets,
    listTableColumns: (table) => tables[table] ?? [],
  };
}

test('resolvePageDataBindPassword defaults for password mode', () => {
  assert.equal(resolvePageDataBindPassword('password', null), DEFAULT_PAGE_DATA_ADMIN_PASSWORD);
  assert.equal(resolvePageDataBindPassword('password', ''), DEFAULT_PAGE_DATA_ADMIN_PASSWORD);
  assert.equal(resolvePageDataBindPassword('password', '  '), DEFAULT_PAGE_DATA_ADMIN_PASSWORD);
});

test('resolvePageDataBindPassword accepts explicit valid password', () => {
  assert.equal(resolvePageDataBindPassword('password', 'MyPass1234'), 'MyPass1234');
});

test('resolvePageDataBindPassword rejects short passwords', () => {
  assert.throws(
    () => resolvePageDataBindPassword('password', '888'),
    (error) => error.code === 'invalid_publish_input',
  );
});

test('resolvePageDataBindPassword returns null for non-password modes', () => {
  assert.equal(resolvePageDataBindPassword('public', null), null);
  assert.equal(resolvePageDataBindPassword('login_required', 'secret123'), null);
});

test('resolvePageDataBindAccess normalizes access mode', () => {
  assert.equal(resolvePageDataBindAccess('public'), 'public');
  assert.equal(resolvePageDataBindAccess('password'), 'password');
});

test('binding rejects an Agent policy when its HTML dataset is not registered', () => {
  assert.throws(
    () =>
      resolveRegisteredPageDataPolicy({
        html: HTML,
        userId: 'user-1',
        accessMode: 'public',
        pageDataPolicy: { datasets: { activity_signups: { insert: true } } },
        userDataSpace: createDataSpace(),
      }),
    (error) => error.code === 'dataset_not_registered',
  );
});

test('binding derives policy from the registered dataset and rejects a missing table', () => {
  const dataset = {
    name: 'activity_signups',
    table: 'activity_signups',
    actions: ['insert'],
    columns: { insert: ['name'] },
    limits: {},
  };
  assert.throws(
    () =>
      resolveRegisteredPageDataPolicy({
        html: HTML,
        userId: 'user-1',
        accessMode: 'public',
        pageDataPolicy: { datasets: { activity_signups: { insert: true, columns: { insert: ['forged'] } } } },
        userDataSpace: createDataSpace({ datasets: [dataset] }),
      }),
    (error) => error.code === 'table_not_found',
  );
});

test('binding uses registered columns instead of Agent-supplied policy columns', () => {
  const dataset = {
    name: 'activity_signups',
    table: 'activity_signups',
    actions: ['insert'],
    columns: { insert: ['name'] },
    limits: {},
  };
  const policy = resolveRegisteredPageDataPolicy({
    html: HTML,
    userId: 'user-1',
    accessMode: 'public',
    pageDataPolicy: { datasets: { activity_signups: { insert: true, columns: { insert: ['forged'] } } } },
    userDataSpace: createDataSpace({
      datasets: [dataset],
      tables: { activity_signups: [{ name: 'id' }, { name: 'name' }] },
    }),
  });
  assert.deepEqual(policy.datasets.activity_signups.columns.insert, ['name']);
});

test('binding rejects a registered dataset that does not allow the HTML action', () => {
  const dataset = {
    name: 'activity_signups',
    table: 'activity_signups',
    actions: ['read'],
    columns: { insert: ['name'], read: ['id', 'name'] },
    limits: {},
  };
  assert.throws(
    () =>
      resolveRegisteredPageDataPolicy({
        html: HTML,
        userId: 'user-1',
        accessMode: 'public',
        userDataSpace: createDataSpace({
          datasets: [dataset],
          tables: { activity_signups: [{ name: 'id' }, { name: 'name' }] },
        }),
      }),
    (error) => error.code === 'dataset_action_not_registered' && error.action === 'insert',
  );
});