39 lines
3.4 KiB
JavaScript
39 lines
3.4 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import {readFile,readdir} from "node:fs/promises";
|
|
import {PGlite} from "../.data/sql-verification/node_modules/@electric-sql/pglite/dist/index.js";
|
|
const db=new PGlite();
|
|
const id=n=>`00000000-0000-4000-8000-${String(n).padStart(12,"0")}`;
|
|
const [owner,other,player,moderator,admin]=[1,2,3,4,5].map(id);
|
|
try {
|
|
await db.exec(`create role anon;create role authenticated;create role service_role bypassrls;
|
|
create schema auth;create table auth.users(id uuid primary key);
|
|
create function auth.uid() returns uuid language sql as $$select nullif(current_setting('request.jwt.claim.sub',true),'')::uuid$$;
|
|
create schema storage;create table storage.buckets(id text primary key,name text,public boolean,file_size_limit bigint);
|
|
create publication supabase_realtime;`);
|
|
for(const file of (await readdir("supabase/migrations")).filter(f=>f.endsWith(".sql")).sort()) await db.exec(await readFile(`supabase/migrations/${file}`,"utf8"));
|
|
for(const user of [owner,other,player,moderator,admin]) await db.query("insert into auth.users(id) values($1)",[user]);
|
|
await db.query("insert into public.profiles(id,role) values($1,'contributor'),($2,'contributor'),($3,'contributor'),($4,'moderator'),($5,'admin')",[owner,other,player,moderator,admin]);
|
|
await db.query("update public.profiles set account_status='banned',account_status_version=1 where id in($1,$2)",[owner,other]);
|
|
await db.query("insert into public.account_appeals(owner_id,status_version,reason) values($1,1,'First private appeal reason'),($2,1,'Second private appeal reason')",[owner,other]);
|
|
const visible=async(user)=>{
|
|
await db.query("select set_config('request.jwt.claim.sub',$1,false)",[user]);
|
|
await db.exec("set role authenticated");
|
|
try{return (await db.query("select owner_id from public.account_appeals order by owner_id")).rows.map(r=>r.owner_id);}
|
|
finally{await db.exec("reset role");}
|
|
};
|
|
assert.deepEqual(await visible(owner),[owner],"Banned players can receive only their own history");
|
|
assert.deepEqual(await visible(other),[other]);
|
|
assert.deepEqual(await visible(player),[],"Ordinary players cannot observe the staff queue");
|
|
assert.deepEqual(await visible(moderator),[owner,other]);
|
|
assert.deepEqual(await visible(admin),[owner,other]);
|
|
await db.query("update public.profiles set account_status='banned' where id=$1",[moderator]);
|
|
assert.deepEqual(await visible(moderator),[],"A stale Moderator JWT cannot retain staff access");
|
|
await db.query("select set_config('request.jwt.claim.sub',$1,false)",[admin]);await db.exec("set role authenticated");
|
|
for(const sql of ["update public.account_appeals set state='approved'",`insert into public.account_appeals(owner_id,status_version,reason) values('${owner}',2,'Forged direct write is rejected')`,"delete from public.account_appeals"])
|
|
await assert.rejects(db.query(sql),/permission denied/);
|
|
await db.exec("reset role;set role anon");await assert.rejects(db.query("select * from public.account_appeals"),/permission denied/);await db.exec("reset role");
|
|
const published=(await db.query("select tablename from pg_publication_tables where pubname='supabase_realtime' order by tablename")).rows.map(r=>r.tablename);
|
|
assert.deepEqual(published,["account_appeals","profiles"]);
|
|
console.log("Appeal Realtime SQL checks passed: own history, active staff, revoked staff role/status, denied anonymous reads/direct writes, publication tables.");
|
|
} finally {await db.close();}
|