Make home page’s carousel manageable via the database
I debated with myself whether to create the home_carousel relation or
rather if it would be better to have a single carousel relation for all
pages. However, i thought that it would be actually harder to maintain
a single relation because i would need an additional column to tell one
carrousel from another, and what would that column be? An enum? A
foreign key to another relation? home_carousel carries no such issues.
I was starting to duplicate logic all over the packages, such as the
way to encode media paths or “localization” (l10n) input fields.
Therefore, i refactorized them.
In the case of media path, i added a function that accepts rows of
media, because always need the same columns from the row, and it was
yet another repetition if i needed to pass them all the time. Plus,
these kind of functions can be called as `table.function`, that make
them look like columns from the table; if PostgreSQL implemented virtual
generated columns, i would have used that instead.
I am not sure whether that media_path function can be immutable. An
immutable function is “guaranteed to return the same results given the
same arguments forever”, which would be true if the inputs where the
hash and the original_filename columns, instead of the whole rows, but
i left it as static because i did not know whether PostgreSQL interprets
the “same row but with different values” as a different input. That is,
whether PostgreSQL’s concept of row is the actual tuple or the space
that has a rowid, irrespective of contents; in the latter case, the
function can not be immutable. Just to be in the safe side, i left it
stable.
The home page was starting to grow a bit too much inside the app
package, new that it has its own admin handler, and moved it all to a
separate package.
2023-09-14 23:05:38 +00:00
|
|
|
-- Test home_carousel
|
|
|
|
set client_min_messages to warning;
|
|
|
|
create extension if not exists pgtap;
|
|
|
|
reset client_min_messages;
|
|
|
|
|
|
|
|
begin;
|
|
|
|
|
|
|
|
select plan(30);
|
|
|
|
|
|
|
|
set search_path to camper, public;
|
|
|
|
|
|
|
|
select has_table('home_carousel');
|
|
|
|
select has_pk('home_carousel');
|
|
|
|
select table_privs_are('home_carousel', 'guest', array['SELECT']);
|
|
|
|
select table_privs_are('home_carousel', 'employee', array['SELECT']);
|
|
|
|
select table_privs_are('home_carousel', 'admin', array['SELECT', 'INSERT', 'UPDATE', 'DELETE']);
|
|
|
|
select table_privs_are('home_carousel', 'authenticator', array[]::text[]);
|
|
|
|
|
|
|
|
select has_column('home_carousel', 'media_id');
|
|
|
|
select col_is_pk('home_carousel', 'media_id');
|
|
|
|
select col_is_fk('home_carousel', 'media_id');
|
|
|
|
select fk_ok('home_carousel', 'media_id', 'media', 'media_id');
|
|
|
|
select col_type_is('home_carousel', 'media_id', 'integer');
|
|
|
|
select col_not_null('home_carousel', 'media_id');
|
|
|
|
select col_hasnt_default('home_carousel', 'media_id');
|
|
|
|
|
|
|
|
select has_column('home_carousel', 'caption');
|
|
|
|
select col_type_is('home_carousel', 'caption', 'text');
|
|
|
|
select col_not_null('home_carousel', 'caption');
|
|
|
|
select col_hasnt_default('home_carousel', 'caption');
|
|
|
|
|
|
|
|
set client_min_messages to warning;
|
|
|
|
truncate home_carousel cascade;
|
|
|
|
truncate media cascade;
|
Manage all media uploads in a single place
It made no sense to have a file upload in each form that needs a media,
because to reuse an existing media users would need to upload the exact
same file again; this is very unusual and unfriendly.
A better option is to have a “centralized” media section, where people
can upload files there, and then have a picker to select from there.
Ideally, there would be an upload option in the picker, but i did not
add it yet.
I’ve split the content from the media because i want users to have the
option to update a media, for instance when they need to upload a
reduced or cropped version of the same photo, without an edit they would
need to upload the file as a new media and then update all places where
the old version was used. And i did not want to trouble people that
uploads the same photo twice: without the separate relation, doing so
would throw a constraint error.
I do not believe there is any security problem to have all companies
link their media to the same file, as they were already readable by
everyone and could upload the data from a different company to their
own; in other words, it is not worse than it was now.
2023-09-20 23:56:44 +00:00
|
|
|
truncate media_content cascade;
|
Make home page’s carousel manageable via the database
I debated with myself whether to create the home_carousel relation or
rather if it would be better to have a single carousel relation for all
pages. However, i thought that it would be actually harder to maintain
a single relation because i would need an additional column to tell one
carrousel from another, and what would that column be? An enum? A
foreign key to another relation? home_carousel carries no such issues.
I was starting to duplicate logic all over the packages, such as the
way to encode media paths or “localization” (l10n) input fields.
Therefore, i refactorized them.
In the case of media path, i added a function that accepts rows of
media, because always need the same columns from the row, and it was
yet another repetition if i needed to pass them all the time. Plus,
these kind of functions can be called as `table.function`, that make
them look like columns from the table; if PostgreSQL implemented virtual
generated columns, i would have used that instead.
I am not sure whether that media_path function can be immutable. An
immutable function is “guaranteed to return the same results given the
same arguments forever”, which would be true if the inputs where the
hash and the original_filename columns, instead of the whole rows, but
i left it as static because i did not know whether PostgreSQL interprets
the “same row but with different values” as a different input. That is,
whether PostgreSQL’s concept of row is the actual tuple or the space
that has a rowid, irrespective of contents; in the latter case, the
function can not be immutable. Just to be in the safe side, i left it
stable.
The home page was starting to grow a bit too much inside the app
package, new that it has its own admin handler, and moved it all to a
separate package.
2023-09-14 23:05:38 +00:00
|
|
|
truncate company_host cascade;
|
|
|
|
truncate company_user cascade;
|
|
|
|
truncate company cascade;
|
|
|
|
truncate auth."user" cascade;
|
|
|
|
reset client_min_messages;
|
|
|
|
|
|
|
|
|
|
|
|
insert into auth."user" (user_id, email, name, password, cookie, cookie_expires_at)
|
|
|
|
values (1, 'demo@tandem.blog', 'Demo', 'test', '44facbb30d8a419dfd4bfbc44a4b5539d4970148dfc84bed0e', current_timestamp + interval '1 month')
|
|
|
|
, (5, 'admin@tandem.blog', 'Demo', 'test', '12af4c88b528c2ad4222e3740496ecbc58e76e26f087657524', current_timestamp + interval '1 month')
|
|
|
|
;
|
|
|
|
|
2023-10-14 19:59:36 +00:00
|
|
|
insert into company (company_id, business_name, vatin, trade_name, phone, email, web, address, city, province, postal_code, rtc_number, country_code, currency_code, default_lang_tag)
|
|
|
|
values (2, 'Company 2', 'XX123', '', '555-555-555', 'a@a', '', '', '', '', '', '', 'ES', 'EUR', 'ca')
|
|
|
|
, (4, 'Company 4', 'XX234', '', '666-666-666', 'b@b', '', '', '', '', '', '', 'FR', 'USD', 'ca')
|
Make home page’s carousel manageable via the database
I debated with myself whether to create the home_carousel relation or
rather if it would be better to have a single carousel relation for all
pages. However, i thought that it would be actually harder to maintain
a single relation because i would need an additional column to tell one
carrousel from another, and what would that column be? An enum? A
foreign key to another relation? home_carousel carries no such issues.
I was starting to duplicate logic all over the packages, such as the
way to encode media paths or “localization” (l10n) input fields.
Therefore, i refactorized them.
In the case of media path, i added a function that accepts rows of
media, because always need the same columns from the row, and it was
yet another repetition if i needed to pass them all the time. Plus,
these kind of functions can be called as `table.function`, that make
them look like columns from the table; if PostgreSQL implemented virtual
generated columns, i would have used that instead.
I am not sure whether that media_path function can be immutable. An
immutable function is “guaranteed to return the same results given the
same arguments forever”, which would be true if the inputs where the
hash and the original_filename columns, instead of the whole rows, but
i left it as static because i did not know whether PostgreSQL interprets
the “same row but with different values” as a different input. That is,
whether PostgreSQL’s concept of row is the actual tuple or the space
that has a rowid, irrespective of contents; in the latter case, the
function can not be immutable. Just to be in the safe side, i left it
stable.
The home page was starting to grow a bit too much inside the app
package, new that it has its own admin handler, and moved it all to a
separate package.
2023-09-14 23:05:38 +00:00
|
|
|
;
|
|
|
|
|
|
|
|
insert into company_user (company_id, user_id, role)
|
|
|
|
values (2, 1, 'admin')
|
|
|
|
, (4, 5, 'admin')
|
|
|
|
;
|
|
|
|
|
|
|
|
insert into company_host (company_id, host)
|
|
|
|
values (2, 'co2')
|
|
|
|
, (4, 'co4')
|
|
|
|
;
|
|
|
|
|
Manage all media uploads in a single place
It made no sense to have a file upload in each form that needs a media,
because to reuse an existing media users would need to upload the exact
same file again; this is very unusual and unfriendly.
A better option is to have a “centralized” media section, where people
can upload files there, and then have a picker to select from there.
Ideally, there would be an upload option in the picker, but i did not
add it yet.
I’ve split the content from the media because i want users to have the
option to update a media, for instance when they need to upload a
reduced or cropped version of the same photo, without an edit they would
need to upload the file as a new media and then update all places where
the old version was used. And i did not want to trouble people that
uploads the same photo twice: without the separate relation, doing so
would throw a constraint error.
I do not believe there is any security problem to have all companies
link their media to the same file, as they were already readable by
everyone and could upload the data from a different company to their
own; in other words, it is not worse than it was now.
2023-09-20 23:56:44 +00:00
|
|
|
insert into media_content (media_type, bytes)
|
|
|
|
values ('text/plain', 'content2')
|
|
|
|
, ('text/plain', 'content3')
|
|
|
|
, ('text/plain', 'content4')
|
|
|
|
, ('text/plain', 'content5')
|
|
|
|
;
|
|
|
|
|
|
|
|
insert into media (media_id, company_id, original_filename, content_hash)
|
|
|
|
values ( 7, 2, 'text2.txt', sha256('content2'))
|
|
|
|
, ( 8, 2, 'text3.txt', sha256('content3'))
|
|
|
|
, ( 9, 4, 'text4.txt', sha256('content4'))
|
|
|
|
, (10, 4, 'text5.txt', sha256('content5'))
|
Make home page’s carousel manageable via the database
I debated with myself whether to create the home_carousel relation or
rather if it would be better to have a single carousel relation for all
pages. However, i thought that it would be actually harder to maintain
a single relation because i would need an additional column to tell one
carrousel from another, and what would that column be? An enum? A
foreign key to another relation? home_carousel carries no such issues.
I was starting to duplicate logic all over the packages, such as the
way to encode media paths or “localization” (l10n) input fields.
Therefore, i refactorized them.
In the case of media path, i added a function that accepts rows of
media, because always need the same columns from the row, and it was
yet another repetition if i needed to pass them all the time. Plus,
these kind of functions can be called as `table.function`, that make
them look like columns from the table; if PostgreSQL implemented virtual
generated columns, i would have used that instead.
I am not sure whether that media_path function can be immutable. An
immutable function is “guaranteed to return the same results given the
same arguments forever”, which would be true if the inputs where the
hash and the original_filename columns, instead of the whole rows, but
i left it as static because i did not know whether PostgreSQL interprets
the “same row but with different values” as a different input. That is,
whether PostgreSQL’s concept of row is the actual tuple or the space
that has a rowid, irrespective of contents; in the latter case, the
function can not be immutable. Just to be in the safe side, i left it
stable.
The home page was starting to grow a bit too much inside the app
package, new that it has its own admin handler, and moved it all to a
separate package.
2023-09-14 23:05:38 +00:00
|
|
|
;
|
|
|
|
|
|
|
|
insert into home_carousel (media_id, caption)
|
|
|
|
values (7, 'Caption 7')
|
|
|
|
, (9, 'Caption 9')
|
|
|
|
;
|
|
|
|
|
|
|
|
prepare carousel_data as
|
|
|
|
select media_id, caption
|
|
|
|
from home_carousel
|
|
|
|
order by media_id, caption;
|
|
|
|
|
|
|
|
set role guest;
|
|
|
|
select bag_eq(
|
|
|
|
'carousel_data',
|
|
|
|
$$ values (7, 'Caption 7')
|
|
|
|
, (9, 'Caption 9')
|
|
|
|
$$,
|
|
|
|
'Everyone should be able to list all carousel media across all companies'
|
|
|
|
);
|
|
|
|
reset role;
|
|
|
|
|
|
|
|
select set_cookie('44facbb30d8a419dfd4bfbc44a4b5539d4970148dfc84bed0e/demo@tandem.blog', 'co2');
|
|
|
|
|
|
|
|
select lives_ok(
|
|
|
|
$$ insert into home_carousel(media_id, caption)
|
|
|
|
values (8, 'Caption 8') $$,
|
|
|
|
'Admin from company 2 should be able to insert a new carousel media to that company.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select bag_eq(
|
|
|
|
'carousel_data',
|
|
|
|
$$ values (7, 'Caption 7')
|
|
|
|
, (8, 'Caption 8')
|
|
|
|
, (9, 'Caption 9')
|
|
|
|
$$,
|
|
|
|
'The new row should have been added'
|
|
|
|
);
|
|
|
|
|
|
|
|
select lives_ok(
|
|
|
|
$$ update home_carousel set caption = 'Caption 8.8' where media_id = 8 $$,
|
|
|
|
'Admin from company 2 should be able to update carousel media of that company.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select bag_eq(
|
|
|
|
'carousel_data',
|
|
|
|
$$ values (7, 'Caption 7')
|
|
|
|
, (8, 'Caption 8.8')
|
|
|
|
, (9, 'Caption 9')
|
|
|
|
$$,
|
|
|
|
'The row should have been updated.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select lives_ok(
|
|
|
|
$$ delete from home_carousel where media_id = 8 $$,
|
|
|
|
'Admin from company 2 should be able to delete carousel media from that company.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select bag_eq(
|
|
|
|
'carousel_data',
|
|
|
|
$$ values (7, 'Caption 7')
|
|
|
|
, (9, 'Caption 9')
|
|
|
|
$$,
|
|
|
|
'The row should have been deleted.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select throws_ok(
|
|
|
|
$$ insert into home_carousel (media_id, caption)
|
|
|
|
values (10, 'Caption 10') $$,
|
|
|
|
'42501', 'new row violates row-level security policy for table "home_carousel"',
|
|
|
|
'Admin from company 2 should NOT be able to insert new media to company 4.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select lives_ok(
|
|
|
|
$$ update home_carousel set caption = 'Nope' where media_id = 9 $$,
|
|
|
|
'Admin from company 2 should not be able to update new carousel media of company 4, but no error if media_id is not changed.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select bag_eq(
|
|
|
|
'carousel_data',
|
|
|
|
$$ values (7, 'Caption 7')
|
|
|
|
, (9, 'Caption 9')
|
|
|
|
$$,
|
|
|
|
'No row should have been changed.'
|
|
|
|
);
|
|
|
|
|
|
|
|
select throws_ok(
|
|
|
|
$$ update home_carousel set media_id = 10 where media_id = 7 $$,
|
|
|
|
'42501', 'new row violates row-level security policy for table "home_carousel"',
|
|
|
|
'Admin from company 2 should NOT be able to move carousel media to company 4'
|
|
|
|
);
|
|
|
|
|
|
|
|
select lives_ok(
|
|
|
|
$$ delete from home_carousel where media_id = 9 $$,
|
|
|
|
'Admin from company 2 should NOT be able to delete carousel media from company 4, but no error is thrown'
|
|
|
|
);
|
|
|
|
|
|
|
|
select bag_eq(
|
|
|
|
'carousel_data',
|
|
|
|
$$ values (7, 'Caption 7')
|
|
|
|
, (9, 'Caption 9')
|
|
|
|
$$,
|
|
|
|
'No row should have been changed'
|
|
|
|
);
|
|
|
|
|
|
|
|
reset role;
|
|
|
|
|
|
|
|
select *
|
|
|
|
from finish();
|
|
|
|
|
|
|
|
rollback;
|
|
|
|
|