mirror of
https://github.com/simstudioai/sim.git
synced 2026-02-18 18:25:14 -05:00
* feat(audit-log): add persistent audit log system with comprehensive route instrumentation
* fix(audit-log): address PR review — nullable workspaceId, enum usage, remove redundant queries
- Make audit_log.workspace_id nullable with ON DELETE SET NULL (logs survive workspace/user deletion)
- Make audit_log.actor_id nullable with ON DELETE SET NULL
- Replace all 53 routes' string literal action/resourceType with AuditAction.X and AuditResourceType.X enums
- Fix empty workspaceId ('') → null for OAuth, form, and org routes to avoid FK violations
- Remove redundant DB queries in chat manage route (use checkChatAccess return data)
- Fix organization routes to pass workspaceId: null instead of organizationId
* fix(audit-log): replace remaining workspaceId '' fallbacks with null
* fix(audit-log): credential-set org IDs, workspace deletion FK, actorId fallback, string literal action
* reran migrations
* fix(mcp,audit): tighten env var domain bypass, add post-resolution check, form workspaceId
- Only bypass MCP domain check when env var is in hostname/authority, not path/query
- Add post-resolution validateMcpDomain call in test-connection endpoint
- Match client-side isDomainAllowed to same hostname-only bypass logic
- Return workspaceId from checkFormAccess, use in form audit logs
- Add 49 comprehensive domain-check tests covering all edge cases
* fix(mcp): stateful regex lastIndex bug, RFC 3986 authority parsing
- Remove /g flag from module-level ENV_VAR_PATTERN to avoid lastIndex state
- Create fresh regex instances per call in server-side hasEnvVarInHostname
- Fix authority extraction to terminate at /, ?, or # per RFC 3986
- Prevents bypass via https://evil.com?token={{SECRET}} (no path)
- Add test cases for query-only and fragment-only env var URLs (53 total)
* fix(audit-log): try/catch for never-throw contract, accept null actorName/Email, fix misleading action
- Wrap recordAudit body in try/catch so nanoid() or header extraction can't throw
- Accept string | null for actorName and actorEmail (session.user.name can be null)
- Normalize null -> undefined before insert to match DB column types
- Fix org members route: ORG_MEMBER_ADDED -> ORG_INVITATION_CREATED (sends invite, not adds member)
* improvement(audit-log): add resource names and specific invitation actions
* fix(audit-log): use validated chat record, add mock sync tests
212 lines
6.4 KiB
TypeScript
212 lines
6.4 KiB
TypeScript
/**
|
|
* Tests for knowledge base API route
|
|
*
|
|
* @vitest-environment node
|
|
*/
|
|
import {
|
|
auditMock,
|
|
createMockRequest,
|
|
mockAuth,
|
|
mockConsoleLogger,
|
|
mockDrizzleOrm,
|
|
mockKnowledgeSchemas,
|
|
} from '@sim/testing'
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
|
|
|
|
mockKnowledgeSchemas()
|
|
mockDrizzleOrm()
|
|
mockConsoleLogger()
|
|
|
|
vi.mock('@/lib/audit/log', () => auditMock)
|
|
|
|
vi.mock('@/lib/workspaces/permissions/utils', () => ({
|
|
getUserEntityPermissions: vi.fn().mockResolvedValue('admin'),
|
|
}))
|
|
|
|
describe('Knowledge Base API Route', () => {
|
|
const mockAuth$ = mockAuth()
|
|
|
|
const mockDbChain = {
|
|
select: vi.fn().mockReturnThis(),
|
|
from: vi.fn().mockReturnThis(),
|
|
leftJoin: vi.fn().mockReturnThis(),
|
|
where: vi.fn().mockReturnThis(),
|
|
groupBy: vi.fn().mockReturnThis(),
|
|
orderBy: vi.fn().mockResolvedValue([]),
|
|
insert: vi.fn().mockReturnThis(),
|
|
values: vi.fn().mockResolvedValue(undefined),
|
|
}
|
|
|
|
beforeEach(async () => {
|
|
vi.clearAllMocks()
|
|
|
|
vi.doMock('@sim/db', () => ({
|
|
db: mockDbChain,
|
|
}))
|
|
|
|
Object.values(mockDbChain).forEach((fn) => {
|
|
if (typeof fn === 'function') {
|
|
fn.mockClear()
|
|
if (fn !== mockDbChain.orderBy && fn !== mockDbChain.values) {
|
|
fn.mockReturnThis()
|
|
}
|
|
}
|
|
})
|
|
|
|
vi.stubGlobal('crypto', {
|
|
randomUUID: vi.fn().mockReturnValue('mock-uuid-1234-5678'),
|
|
})
|
|
})
|
|
|
|
afterEach(() => {
|
|
vi.clearAllMocks()
|
|
})
|
|
|
|
describe('GET /api/knowledge', () => {
|
|
it('should return unauthorized for unauthenticated user', async () => {
|
|
mockAuth$.mockUnauthenticated()
|
|
|
|
const req = createMockRequest('GET')
|
|
const { GET } = await import('@/app/api/knowledge/route')
|
|
const response = await GET(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(401)
|
|
expect(data.error).toBe('Unauthorized')
|
|
})
|
|
|
|
it('should handle database errors', async () => {
|
|
mockAuth$.mockAuthenticatedUser()
|
|
mockDbChain.orderBy.mockRejectedValue(new Error('Database error'))
|
|
|
|
const req = createMockRequest('GET')
|
|
const { GET } = await import('@/app/api/knowledge/route')
|
|
const response = await GET(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(500)
|
|
expect(data.error).toBe('Failed to fetch knowledge bases')
|
|
})
|
|
})
|
|
|
|
describe('POST /api/knowledge', () => {
|
|
const validKnowledgeBaseData = {
|
|
name: 'Test Knowledge Base',
|
|
description: 'Test description',
|
|
workspaceId: 'test-workspace-id',
|
|
chunkingConfig: {
|
|
maxSize: 1024,
|
|
minSize: 100,
|
|
overlap: 200,
|
|
},
|
|
}
|
|
|
|
it('should create knowledge base successfully', async () => {
|
|
mockAuth$.mockAuthenticatedUser()
|
|
|
|
const req = createMockRequest('POST', validKnowledgeBaseData)
|
|
const { POST } = await import('@/app/api/knowledge/route')
|
|
const response = await POST(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(200)
|
|
expect(data.success).toBe(true)
|
|
expect(data.data.name).toBe(validKnowledgeBaseData.name)
|
|
expect(data.data.description).toBe(validKnowledgeBaseData.description)
|
|
expect(mockDbChain.insert).toHaveBeenCalled()
|
|
})
|
|
|
|
it('should return unauthorized for unauthenticated user', async () => {
|
|
mockAuth$.mockUnauthenticated()
|
|
|
|
const req = createMockRequest('POST', validKnowledgeBaseData)
|
|
const { POST } = await import('@/app/api/knowledge/route')
|
|
const response = await POST(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(401)
|
|
expect(data.error).toBe('Unauthorized')
|
|
})
|
|
|
|
it('should validate required fields', async () => {
|
|
mockAuth$.mockAuthenticatedUser()
|
|
|
|
const req = createMockRequest('POST', { description: 'Missing name' })
|
|
const { POST } = await import('@/app/api/knowledge/route')
|
|
const response = await POST(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(400)
|
|
expect(data.error).toBe('Invalid request data')
|
|
expect(data.details).toBeDefined()
|
|
})
|
|
|
|
it('should require workspaceId', async () => {
|
|
mockAuth$.mockAuthenticatedUser()
|
|
|
|
const req = createMockRequest('POST', { name: 'Test KB' })
|
|
const { POST } = await import('@/app/api/knowledge/route')
|
|
const response = await POST(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(400)
|
|
expect(data.error).toBe('Invalid request data')
|
|
expect(data.details).toBeDefined()
|
|
})
|
|
|
|
it('should validate chunking config constraints', async () => {
|
|
mockAuth$.mockAuthenticatedUser()
|
|
|
|
const invalidData = {
|
|
name: 'Test KB',
|
|
workspaceId: 'test-workspace-id',
|
|
chunkingConfig: {
|
|
maxSize: 100, // 100 tokens = 400 characters
|
|
minSize: 500, // Invalid: minSize (500 chars) > maxSize (400 chars)
|
|
overlap: 50,
|
|
},
|
|
}
|
|
|
|
const req = createMockRequest('POST', invalidData)
|
|
const { POST } = await import('@/app/api/knowledge/route')
|
|
const response = await POST(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(400)
|
|
expect(data.error).toBe('Invalid request data')
|
|
})
|
|
|
|
it('should use default values for optional fields', async () => {
|
|
mockAuth$.mockAuthenticatedUser()
|
|
|
|
const minimalData = { name: 'Test KB', workspaceId: 'test-workspace-id' }
|
|
const req = createMockRequest('POST', minimalData)
|
|
const { POST } = await import('@/app/api/knowledge/route')
|
|
const response = await POST(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(200)
|
|
expect(data.data.embeddingModel).toBe('text-embedding-3-small')
|
|
expect(data.data.embeddingDimension).toBe(1536)
|
|
expect(data.data.chunkingConfig).toEqual({
|
|
maxSize: 1024,
|
|
minSize: 100,
|
|
overlap: 200,
|
|
})
|
|
})
|
|
|
|
it('should handle database errors during creation', async () => {
|
|
mockAuth$.mockAuthenticatedUser()
|
|
mockDbChain.values.mockRejectedValue(new Error('Database error'))
|
|
|
|
const req = createMockRequest('POST', validKnowledgeBaseData)
|
|
const { POST } = await import('@/app/api/knowledge/route')
|
|
const response = await POST(req)
|
|
const data = await response.json()
|
|
|
|
expect(response.status).toBe(500)
|
|
expect(data.error).toBe('Failed to create knowledge base')
|
|
})
|
|
})
|
|
})
|