jordi fita mas
97cf117da3
It made no sense to have a file upload in each form that needs a media, because to reuse an existing media users would need to upload the exact same file again; this is very unusual and unfriendly. A better option is to have a “centralized” media section, where people can upload files there, and then have a picker to select from there. Ideally, there would be an upload option in the picker, but i did not add it yet. I’ve split the content from the media because i want users to have the option to update a media, for instance when they need to upload a reduced or cropped version of the same photo, without an edit they would need to upload the file as a new media and then update all places where the old version was used. And i did not want to trouble people that uploads the same photo twice: without the separate relation, doing so would throw a constraint error. I do not believe there is any security problem to have all companies link their media to the same file, as they were already readable by everyone and could upload the data from a different company to their own; in other words, it is not worse than it was now.
205 lines
6.3 KiB
PL/PgSQL
205 lines
6.3 KiB
PL/PgSQL
-- Test media
|
|
set client_min_messages to warning;
|
|
create extension if not exists pgtap;
|
|
reset client_min_messages;
|
|
|
|
begin;
|
|
|
|
select plan(47);
|
|
|
|
set search_path to camper, public;
|
|
|
|
select has_table('media');
|
|
select has_pk('media');
|
|
select table_privs_are('media', 'guest', array['SELECT']);
|
|
select table_privs_are('media', 'employee', array['SELECT']);
|
|
select table_privs_are('media', 'admin', array['SELECT', 'INSERT', 'UPDATE', 'DELETE']);
|
|
select table_privs_are('media', 'authenticator', array[]::text[]);
|
|
|
|
select has_sequence('media_media_id_seq');
|
|
select sequence_privs_are('media_media_id_seq', 'guest', array[]::text[]);
|
|
select sequence_privs_are('media_media_id_seq', 'employee', array[]::text[]);
|
|
select sequence_privs_are('media_media_id_seq', 'admin', array['USAGE']);
|
|
select sequence_privs_are('media_media_id_seq', 'authenticator', array[]::text[]);
|
|
|
|
select has_column('media', 'media_id');
|
|
select col_is_pk('media', 'media_id');
|
|
select col_type_is('media', 'media_id', 'integer');
|
|
select col_not_null('media', 'media_id');
|
|
select col_has_default('media', 'media_id');
|
|
select col_default_is('media', 'media_id', 'nextval(''media_media_id_seq''::regclass)');
|
|
|
|
select has_column('media', 'company_id');
|
|
select col_is_fk('media', 'company_id');
|
|
select fk_ok('media', 'company_id', 'company', 'company_id');
|
|
select col_type_is('media', 'company_id', 'integer');
|
|
select col_not_null('media', 'company_id');
|
|
select col_hasnt_default('media', 'company_id');
|
|
|
|
select has_column('media', 'content_hash');
|
|
select col_is_fk('media', 'content_hash');
|
|
select fk_ok('media', 'content_hash', 'media_content', 'content_hash');
|
|
select col_type_is('media', 'content_hash', 'bytea');
|
|
select col_not_null('media', 'content_hash');
|
|
select col_hasnt_default('media', 'content_hash');
|
|
|
|
select has_column('media', 'original_filename');
|
|
select col_type_is('media', 'original_filename', 'text');
|
|
select col_not_null('media', 'original_filename');
|
|
select col_hasnt_default('media', 'original_filename');
|
|
|
|
|
|
set client_min_messages to warning;
|
|
truncate media cascade;
|
|
truncate media_content cascade;
|
|
truncate company_host cascade;
|
|
truncate company_user cascade;
|
|
truncate company cascade;
|
|
truncate auth."user" cascade;
|
|
reset client_min_messages;
|
|
|
|
insert into auth."user" (user_id, email, name, password, cookie, cookie_expires_at)
|
|
values (1, 'demo@tandem.blog', 'Demo', 'test', '44facbb30d8a419dfd4bfbc44a4b5539d4970148dfc84bed0e', current_timestamp + interval '1 month')
|
|
, (5, 'admin@tandem.blog', 'Demo', 'test', '12af4c88b528c2ad4222e3740496ecbc58e76e26f087657524', current_timestamp + interval '1 month')
|
|
;
|
|
|
|
insert into company (company_id, business_name, vatin, trade_name, phone, email, web, address, city, province, postal_code, country_code, currency_code, default_lang_tag)
|
|
values (2, 'Company 2', 'XX123', '', '555-555-555', 'a@a', '', '', '', '', '', 'ES', 'EUR', 'ca')
|
|
, (4, 'Company 4', 'XX234', '', '666-666-666', 'b@b', '', '', '', '', '', 'FR', 'USD', 'ca')
|
|
;
|
|
|
|
insert into company_user (company_id, user_id, role)
|
|
values (2, 1, 'admin')
|
|
, (4, 5, 'admin')
|
|
;
|
|
|
|
insert into company_host (company_id, host)
|
|
values (2, 'co2')
|
|
, (4, 'co4')
|
|
;
|
|
|
|
insert into media_content (media_type, bytes)
|
|
values ('text/plain', 'content2')
|
|
, ('text/plain', 'content4')
|
|
, ('text/plain', 'content6')
|
|
;
|
|
|
|
insert into media (company_id, original_filename, content_hash)
|
|
values (2, 'text2.txt', sha256('content2'))
|
|
, (4, 'text4.txt', sha256('content4'))
|
|
;
|
|
|
|
prepare media_data as
|
|
select company_id, original_filename
|
|
from media
|
|
order by company_id, original_filename;
|
|
|
|
set role guest;
|
|
select bag_eq(
|
|
'media_data',
|
|
$$ values (2, 'text2.txt')
|
|
, (4, 'text4.txt')
|
|
$$,
|
|
'Everyone should be able to list all media across all companies'
|
|
);
|
|
reset role;
|
|
|
|
select set_cookie('44facbb30d8a419dfd4bfbc44a4b5539d4970148dfc84bed0e/demo@tandem.blog', 'co2');
|
|
|
|
select lives_ok(
|
|
$$ insert into media(company_id, original_filename, content_hash)
|
|
values (2, 'text2-6.txt', sha256('content6')) $$,
|
|
'Admin from company 2 should be able to insert a new media to that company.'
|
|
);
|
|
|
|
select bag_eq(
|
|
'media_data',
|
|
$$ values (2, 'text2.txt')
|
|
, (2, 'text2-6.txt')
|
|
, (4, 'text4.txt')
|
|
$$,
|
|
'The new row should have been added'
|
|
);
|
|
|
|
select lives_ok(
|
|
$$ update media set original_filename = 'text2_6.txt' where company_id = 2 and original_filename = 'text2-6.txt' $$,
|
|
'Admin from company 2 should be able to update media of that company.'
|
|
);
|
|
|
|
select bag_eq(
|
|
'media_data',
|
|
$$ values (2, 'text2.txt')
|
|
, (2, 'text2_6.txt')
|
|
, (4, 'text4.txt')
|
|
$$,
|
|
'The row should have been updated.'
|
|
);
|
|
|
|
select lives_ok(
|
|
$$ delete from media where company_id = 2 and original_filename = 'text2_6.txt' $$,
|
|
'Admin from company 2 should be able to delete media from that company.'
|
|
);
|
|
|
|
select bag_eq(
|
|
'media_data',
|
|
$$ values (2, 'text2.txt')
|
|
, (4, 'text4.txt')
|
|
$$,
|
|
'The row should have been deleted.'
|
|
);
|
|
|
|
select throws_ok(
|
|
$$ insert into media (company_id, original_filename, content_hash)
|
|
values (4, 'text4-2.txt', sha256('content6')) $$,
|
|
'42501', 'new row violates row-level security policy for table "media"',
|
|
'Admin from company 2 should NOT be able to insert new media to company 4.'
|
|
);
|
|
|
|
select lives_ok(
|
|
$$ update media set original_filename = 'nope.txt' where company_id = 4 $$,
|
|
'Admin from company 2 should not be able to update new media of company 4, but no error if company_id is not changed.'
|
|
);
|
|
|
|
select bag_eq(
|
|
'media_data',
|
|
$$ values (2, 'text2.txt')
|
|
, (4, 'text4.txt')
|
|
$$,
|
|
'No row should have been changed.'
|
|
);
|
|
|
|
select throws_ok(
|
|
$$ update media set company_id = 4 where company_id = 2 $$,
|
|
'42501', 'new row violates row-level security policy for table "media"',
|
|
'Admin from company 2 should NOT be able to move media to company 4'
|
|
);
|
|
|
|
select lives_ok(
|
|
$$ delete from media where company_id = 4 $$,
|
|
'Admin from company 2 should NOT be able to delete media from company 4, but not error is thrown'
|
|
);
|
|
|
|
select bag_eq(
|
|
'media_data',
|
|
$$ values (2, 'text2.txt')
|
|
, (4, 'text4.txt')
|
|
$$,
|
|
'No row should have been changed'
|
|
);
|
|
|
|
select throws_ok(
|
|
$$ insert into media (company_id, original_filename, content_hash) values (2, ' ', sha256('content6')) $$,
|
|
'23514', 'new row for relation "media" violates check constraint "original_filename_not_empty"',
|
|
'Should not be able to insert media with a blank filename.'
|
|
);
|
|
|
|
reset role;
|
|
|
|
|
|
|
|
select *
|
|
from finish();
|
|
|
|
rollback;
|
|
|