restrict openapi spec based on sql grants

2026-08-15 21:41:45 +02:00
parent a8feaadc01
commit 4a5d626112
11 changed files with 209 additions and 54 deletions
@@ -222,6 +222,58 @@ spec withConfig = withConfig baseCfg $ describe "OpenAPI" $ do
                    . nth 0
      liftIO $ tableTag `shouldBe` Just [aesonQQ|"authors_only"|]

+    it "reflects table privileges in the HTTP methods" $ do
+      r <- simpleBody <$> get "/"
+
+      let selectonlyGet = r ^? key "paths" . key "/selectonly" . key "get"
+          selectonlyPost = r ^? key "paths" . key "/selectonly" . key "post"
+          insertonlyGet = r ^? key "paths" . key "/insertonly" . key "get"
+          insertonlyPost = r ^? key "paths" . key "/insertonly" . key "post"
+          insertonlyDelete = r ^? key "paths" . key "/insertonly" . key "delete"
+          limitedStarsGet = r ^? key "paths" . key "/limited_article_stars" . key "get"
+          limitedStarsPost = r ^? key "paths" . key "/limited_article_stars" . key "post"
+          limitedStarsPatch = r ^? key "paths" . key "/limited_article_stars" . key "patch"
+          limitedStarsDelete = r ^? key "paths" . key "/limited_article_stars" . key "delete"
+
+      liftIO $ do
+        selectonlyGet `shouldNotBe` Nothing
+        selectonlyPost `shouldBe` Nothing
+
+        insertonlyGet `shouldBe` Nothing
+        insertonlyPost `shouldNotBe` Nothing
+        insertonlyDelete `shouldBe` Nothing
+
+        limitedStarsGet `shouldNotBe` Nothing
+        limitedStarsPost `shouldNotBe` Nothing
+        limitedStarsPatch `shouldNotBe` Nothing
+        limitedStarsDelete `shouldBe` Nothing
+
+    it "reflects column privileges in the table definition" $ do
+      r <- simpleBody <$> get "/"
+
+      let appUsersId = r ^? key "definitions" . key "app_users" . key "properties" . key "id"
+          appUsersEmail = r ^? key "definitions" . key "app_users" . key "properties" . key "email"
+          appUsersPassword = r ^? key "definitions" . key "app_users" . key "properties" . key "password"
+          appUsersRequired = r ^? key "definitions" . key "app_users" . key "required"
+
+      liftIO $ do
+        appUsersId `shouldNotBe` Nothing
+        appUsersEmail `shouldNotBe` Nothing
+        appUsersPassword `shouldBe` Nothing
+        appUsersRequired `shouldBe` Just [aesonQQ|["id", "email"]|]
+
+    it "reflects column privileges in the rowFilter parameters" $ do
+      r <- simpleBody <$> get "/"
+
+      let filterId = r ^? key "parameters" . key "rowFilter.app_users.id"
+          filterEmail = r ^? key "parameters" . key "rowFilter.app_users.email"
+          filterPassword = r ^? key "parameters" . key "rowFilter.app_users.password"
+
+      liftIO $ do
+        filterId `shouldNotBe` Nothing
+        filterEmail `shouldNotBe` Nothing
+        filterPassword `shouldBe` Nothing
+
    it "includes a fk description for a O2O relationship" $ do
      r <- simpleBody <$> get "/"