pippinmole/ghost

public

Source code of Ghost - On Ghost

api: answer numeric_id as databaseId and REST id instead of nullaf6eb6aa day ago786 lines · 32.1 KB

1	import type { INestApplication } from '@nestjs/common';
2	import { execFile, execFileSync
3	import { mkdtempSync, rmSync
4	import { tmpdir }
5	import path from 'node:path
6	import { promisify }
7	import request from 'supertest
8	import { afterAll, beforeAll
9
10	import { hasBackends, signUp
11
12	describe.skipIf(!hasBackends
13	let app:
14	let owner:
15	let stranger:
16	const username =
17	let work:
18	let pullRequestNumber:
19
20	const graphql =
21	const call =
22	.post('/api/graphql')
23	.send({ query
24	return token ?
25	};
26
27	beforeAll(async ()
28	let origin:
29	({ app, origin
30	owner = await
31	const api =
32	await api
33	.post('/api/repositories')
34	.set('cookie',
35	.send({ name:
36	.expect(201);
37	await api
38	.post('/api/repositories')
39	.set('cookie',
40	.send({ name:
41	.expect(201);
42	stranger = await
43
44	// Ghost numbers pull requests and issues together; one real pull request lets issueOrPullRequest answer a PullRequest.
45	work = mkdtempSync(
46	const git =
47	execFileSync(
48	'git',
49	['-c', 'user.name=E2E'
50	{ cwd: work
51	);
52	git('init',
53	writeFileSync(path.join
54	git('add',
55	git('commit',
56	git('checkout',
57	writeFileSync(path.join
58	git('commit',
59	// The server runs in this process, so the push must not block the event loop.
60	await promisify(execFile
61	'git',
62	[
63	'push',
64	'-q',
65	`${origin.replace(
66	'main',
67	'feature',
68	],
69	{ cwd: work,
70	);
71	const pull =
72	.post(`/api/repositories/${username
73	.set('cookie',
74	.send({ title:
75	.expect(201);
76	pullRequestNumber = pull.
77	}, 120_000);
78
79	afterAll(async ()
80	await app?.close
81	if (work) rmSync
82	});
83
84	it('answers a query at /api/graphql',
85	const response =
86	expect(response.body
87	});
88
89	it('answers introspection, which gh sends to enterprise hosts',
90	const response =
91	200,
92	);
93	expect(response.body
94	});
95
96	it('refuses a wrong token with 401 Bad credentials',
97	const response =
98	'{ __typename }',
99	{},
100	'ghost_pat_nope',
101	).expect(401);
102	expect(response.body
103	});
104	it('answers viewer with the token owner',
105	const response =
106	'{ viewer { __typename id login name url resourcePath avatarUrl } }',
107	{},
108	owner.key,
109	).expect(200);
110	expect(response.body
111	expect(response.body
112	__typename: 'User',
113	login: username,
114	resourcePath: `/${username
115	});
116	expect(response.body
117	});
118
119	it('refuses viewer anonymously, as GitHub does',
120	const response =
121	expect(response.body
122	});
123
124	it('resolves user, repositoryOwner and node by id',
125	const response =
126	'query($login: String!) { user(login: $login) { id login } repositoryOwner(login: $login) { __typename login } }',
127	{ login: username
128	).expect(200);
129	expect(response.body
130	__typename: 'User',
131	login: username,
132	});
133	const node =
134	'query($id: ID!) { node(id: $id) { __typename ... on User { login } } }',
135	{ id: response.
136	).expect(200);
137	expect(node.body
138	__typename: 'User',
139	login: username,
140	});
141	});
142
143	it('answers a missing user as NOT_FOUND with GitHub wording',
144	const response =
145	'{ user(login: "nobody-here-xyz") { login } }',
146	).expect(200);
147	expect(response.body
148	expect(response.body
149	type: 'NOT_FOUND',
150	message:
151	"Could not resolve to a User with the login of 'nobody-here-xyz'.",
152	});
153	});
154
155	const REPO_QUERY =
156	'query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { id databaseId name nameWithOwner owner { login } sshUrl url hasIssuesEnabled hasWikiEnabled description isPrivate visibility viewerPermission defaultBranchRef { name } parent { name } mergeCommitAllowed rebaseMergeAllowed squashMergeAllowed } }';
157
158	it('answers the repository fields gh reads before every command',
159	const response =
160	REPO_QUERY,
161	{ owner: username,
162	owner.key,
163	).expect(200);
164	expect(response.body
165	expect(response.body
166	databaseId: expect.any
167	name: 'public-repo',
168	nameWithOwner: `${username}
169	owner: { login: username
170	hasIssuesEnabled: true,
171	hasWikiEnabled: false,
172	isPrivate: false,
173	visibility: 'PUBLIC',
174	viewerPermission: 'ADMIN',
175	parent: null,
176	mergeCommitAllowed: true,
177	});
178	expect(response.body
179	});
180
181	it.each([
182	['anonymous', () =>
183	['a stranger', () =>
184	])('answers a private repository as NOT_FOUND for %s', async
185	const response =
186	REPO_QUERY,
187	{ owner: username,
188	token(),
189	).expect(200);
190	expect(response.body
191	expect(response.body
192	type: 'NOT_FOUND',
193	message: `Could not resolve to a Repository with the name '${username
194	});
195	});
196	it('lists labels and assignable users, which gh issue create resolves names against',
197	const api =
198	await api
199	.post(`/api/repositories/${username
200	.set('cookie',
201	.send({ name:
202	.expect(201);
203	const response =
204	'query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { labels(first: 100) { totalCount nodes { id name color description } } label(name: "bug") { name } assignableUsers(first: 100) { totalCount nodes { id login name } } } }',
205	{ owner: username,
206	owner.key,
207	).expect(200);
208	expect(response.body
209	const repository =
210	expect(repository.labels
211	expect.objectContaining({
212	);
213	expect(repository.labels
214	expect(repository.label
215	expect(
216	repository.assignableUsers.nodes
217	(user: {
218	),
219	).toContain(username)
220	const label =
221	const lookup =
222	'query($id: ID!) { node(id: $id) { ... on Label { name } } }',
223	{ id: label.
224	owner.key,
225	).expect(200);
226	expect(lookup.body
227	});
228
229	it('lists, filters and pages issues as gh issue list asks',
230	const api =
231	for (const title
232	await api
233	.post(`/api/repositories/${username
234	.set('cookie',
235	.send({ title
236	.expect(201);
237	}
238	const LIST =
239	'query($owner: String!, $repo: String!, $limit: Int, $endCursor: String, $states: [IssueState!] = OPEN, $assignee: String, $author: String) { repository(owner: $owner, name: $repo) { hasIssuesEnabled issues(first: $limit, after: $endCursor, orderBy: {field: CREATED_AT, direction: DESC}, states: $states, filterBy: {assignee: $assignee, createdBy: $author}) { totalCount nodes { number title url state updatedAt labels(first: 100) { nodes { id name description color } totalCount } } pageInfo { hasNextPage endCursor } } } }';
240	const first =
241	LIST,
242	{ owner: username,
243	owner.key,
244	).expect(200);
245	expect(first.body
246	const issues =
247	expect(issues.totalCount
248	expect(issues.nodes
249	['Third', 'Second'
250	);
251	expect(issues.nodes
252	expect(issues.nodes
253	expect(issues.pageInfo
254	const second =
255	LIST,
256	{
257	owner: username,
258	repo: 'public-repo',
259	limit: 2,
260	endCursor: issues.pageInfo
261	},
262	owner.key,
263	).expect(200);
264	expect(
265	second.body.data
266	(issue: {
267	),
268	).toEqual(['First'
269	const repeated =
270	LIST,
271	{
272	owner: username,
273	repo: 'public-repo',
274	limit: 10,
275	states: ['CLOSED',
276	},
277	owner.key,
278	).expect(200);
279	expect(repeated.body
280	const filtered =
281	LIST,
282	{
283	owner: username,
284	repo: 'public-repo',
285	limit: 10,
286	author: `${username}
287	},
288	owner.key,
289	).expect(200);
290	expect(filtered.body
291	const ascending =
292	LIST.replace('direction: DESC
293	{ owner: username,
294	owner.key,
295	).expect(200);
296	expect(ascending.body
297	});
298
299	it('answers every field gh issue view asks for, with empty values for what Ghost lacks',
300	const api =
301	const created =
302	.post(`/api/repositories/${username
303	.set('cookie',
304	.send({ title:
305	.expect(201);
306	await api
307	.post(
308	`/api/repositories/${username}/public-repo/issues/${
309	)
310	.set('cookie',
311	.send({ body:
312	.expect(201);
313	const VIEW =
314	const response =
315	VIEW,
316	{ owner: username,
317	owner.key,
318	).expect(200);
319	expect(response.body
320	expect(response.body
321	__typename: 'Issue',
322	title: 'Viewed',
323	body: 'Body text',
324	state: 'OPEN',
325	stateReason: null,
326	author: { login: username
327	milestone: null,
328	reactionGroups: [],
329	parent: null,
330	subIssues: { nodes: []
331	subIssuesSummary: { total: 0
332	comments: {
333	totalCount: 1,
334	nodes: [
335	{ body: 'A comment',
336	],
337	},
338	});
339	const issueId =
340	const lookup =
341	'query($id: ID!) { node(id: $id) { ... on Issue { title } } }',
342	{ id: issueId
343	owner.key,
344	).expect(200);
345	expect(lookup.body
346	});
347
348	it('answers a pull request number in issueOrPullRequest as a PullRequest',
349	const response =
350	'query($owner: String!, $repo: String!, $number: Int!) { repository(owner: $owner, name: $repo) { issueOrPullRequest(number: $number) { __typename ...on PullRequest { number title } } } }',
351	{ owner: username,
352	owner.key,
353	).expect(200);
354	expect(response.body
355	__typename: 'PullRequest',
356	number: pullRequestNumber,
357	});
358	});
359
360	it('answers a missing issue number as NOT_FOUND',
361	const response =
362	'query($owner: String!, $repo: String!) { repository(owner: $owner, name: $repo) { issue(number: 9999) { title } } }',
363	{ owner: username,
364	owner.key,
365	).expect(200);
366	expect(response.body
367	type: 'NOT_FOUND',
368	message: `Could not resolve to an Issue with the number of 9999.`,
369	});
370	});
371
372	it('searches issues with gh qualifiers and ignores ones Ghost cannot apply',
373	const response =
374	'query($q: String!) { search(type: ISSUE, last: 30, query: $q) { issueCount nodes { ...on Issue { title } } } }',
375	{
376	q: `repo:${username
377	},
378	owner.key,
379	).expect(200);
380	expect(response.body
381	expect(response.body
382	});
383
384	it('creates, edits, comments on, labels, closes and reopens an issue through mutations',
385	const repo =
386	'query($o: String!, $n: String!) { repository(owner: $o, name: $n) { id label(name: "bug") { id } } viewer { id } }',
387	{ o: username,
388	owner.key,
389	).expect(200);
390	const { id:
391	const viewerId =
392
393	const created =
394	'mutation($input: CreateIssueInput!) { createIssue(input: $input) { clientMutationId issue { id number title url labels(first: 10) { nodes { name } } assignees(first: 10) { nodes { login } } } } }',
395	{
396	input: {
397	repositoryId,
398	title: 'From gh',
399	body: 'Body',
400	labelIds: [label.id
401	assigneeIds: [viewerId],
402	clientMutationId: 'c1',
403	},
404	},
405	owner.key,
406	).expect(200);
407	expect(created.body
408	const issue =
409	expect(created.body
410	expect(issue.labels
411	expect(issue.assignees
412
413	const updated =
414	'mutation($input: UpdateIssueInput!) { updateIssue(input: $input) { issue { title body } } }',
415	{ input: { id:
416	owner.key,
417	).expect(200);
418	expect(updated.body
419	title: 'Renamed',
420	body: 'Body',
421	});
422	const cleared =
423	'mutation($input: UpdateIssueInput!) { updateIssue(input: $input) { issue { title body } } }',
424	{ input: { id:
425	owner.key,
426	).expect(200);
427	expect(cleared.body
428	title: 'Renamed',
429	body: '',
430	});
431
432	const comment =
433	'mutation($input: AddCommentInput!) { addComment(input: $input) { commentEdge { node { body url } } } }',
434	{ input: { subjectId:
435	owner.key,
436	).expect(200);
437	expect(comment.body
438
439	const removed =
440	'mutation($input: RemoveLabelsFromLabelableInput!) { removeLabelsFromLabelable(input: $input) { labelable { ...on Issue { labels(first: 10) { totalCount } } } } }',
441	{ input: { labelableId:
442	owner.key,
443	).expect(200);
444	expect(
445	removed.body.data
446	).toBe(0);
447
448	const closed =
449	'mutation($input: CloseIssueInput!) { closeIssue(input: $input) { issue { state stateReason } } }',
450	{ input: { issueId:
451	owner.key,
452	).expect(200);
453	expect(closed.body
454
455	const reopened =
456	'mutation($input: ReopenIssueInput!) { reopenIssue(input: $input) { issue { state } } }',
457	{ input: { issueId:
458	owner.key,
459	).expect(200);
460	expect(reopened.body
461	});
462
463	it('refuses mutations without a viewer, and refuses a node id of the wrong type',
464	const repo =
465	'query($o: String!, $n: String!) { repository(owner: $o, name: $n) { id } }',
466	{ o: username,
467	owner.key,
468	).expect(200);
469	const anonymous =
470	'mutation($input: CreateIssueInput!) { createIssue(input: $input) { issue { id } } }',
471	{ input: { repositoryId:
472	).expect(200);
473	expect(anonymous.body
474	const wrongType =
475	'mutation($input: CloseIssueInput!) { closeIssue(input: $input) { issue { id } } }',
476	{ input: { issueId:
477	owner.key,
478	).expect(200);
479	expect(wrongType.body
480	type: 'NOT_FOUND',
481	message: expect.stringContaining
482	'Could not resolve to a node with the global id of',
483	),
484	});
485	});
486
487	it('refuses a stranger writing to a public repository with FORBIDDEN',
488	const repo =
489	'query($o: String!, $n: String!) { repository(owner: $o, name: $n) { issues(first: 1) { nodes { id } } } }',
490	{ o: username,
491	owner.key,
492	).expect(200);
493	const response =
494	'mutation($input: CloseIssueInput!) { closeIssue(input: $input) { issue { id } } }',
495	{ input: { issueId:
496	stranger.key,
497	).expect(200);
498	expect(response.body
499	});
500
501	it('creates a repository for the viewer through createRepository',
502	const viewer =
503	200,
504	);
505	const response =
506	'mutation($input: CreateRepositoryInput!) { createRepository(input: $input) { repository { name nameWithOwner visibility url } } }',
507	{
508	input: {
509	name: 'made-by-gh',
510	visibility: 'PRIVATE',
511	ownerId: viewer.body
512	description: 'x',
513	},
514	},
515	owner.key,
516	).expect(200);
517	expect(response.body
518	expect(response.body
519	name: 'made-by-gh',
520	nameWithOwner: `${username}
521	visibility: 'PRIVATE',
522	});
523	});
524
525	it('serves GraphiQL to a browser and accepts the session cookie there',
526	const page =
527	.get('/api/graphql')
528	.set('accept',
529	.expect(200);
530	expect(page.text
531	const response =
532	.post('/api/graphql')
533	.set('cookie',
534	.send({ query:
535	.expect(200);
536	expect(response.body
537	});
538
539	it('answers an unknown field with a validation error naming it, which gh prints',
540	const response =
541	'{ viewer { login notAField } }',
542	{},
543	owner.key,
544	).expect(400);
545	expect(response.body
546	});
547
548	it('refuses a label or assignee id that does not resolve, instead of dropping it',
549	const repo =
550	'query($o: String!, $n: String!) { repository(owner: $o, name: $n) { id } }',
551	{ o: username,
552	owner.key,
553	).expect(200);
554	const repositoryId =
555	const secretLabel =
556	.post(`/api/repositories/${username
557	.set('cookie',
558	.send({ name:
559	.expect(201);
560	const foreignLabelId =
561	await graphql(
562	'query($o: String!) { repository(owner: $o, name: "secret-repo") { label(name: "elsewhere") { id } } }',
563	{ o: username
564	owner.key,
565	).expect(200)
566	).body.data.
567	expect(secretLabel.body
568	const create =
569	graphql(
570	'mutation($input: CreateIssueInput!) { createIssue(input: $input) { issue { id } } }',
571	{ input: { repositoryId
572	owner.key,
573	).expect(200);
574	const foreign =
575	expect(foreign.body
576	type: 'NOT_FOUND',
577	message: `Could not resolve to a node with the global id of '${foreignLabelId
578	});
579	const missingUser =
580	const unknown =
581	expect(unknown.body
582	type: 'NOT_FOUND',
583	message: `Could not resolve to a node with the global id of 'U_${missingUser
584	});
585	});
586
587	it('resolves a comment by node id, and a repository through its owner',
588	const issues =
589	'query($o: String!) { repository(owner: $o, name: "public-repo") { issues(first: 50, states: [OPEN, CLOSED]) { nodes { title comments(first: 1) { nodes { id body } } } } } }',
590	{ o: username
591	owner.key,
592	).expect(200);
593	const comment =
594	(issue: {
595	issue.comments.nodes
596	)[0];
597	const lookup =
598	'query($id: ID!) { node(id: $id) { ... on IssueComment { body author { login } } } }',
599	{ id: comment.
600	owner.key,
601	).expect(200);
602	expect(lookup.body
603	body: comment.body
604	author: { login: username
605	});
606	const visible =
607	'query($id: ID!) { nodes(ids: [$id]) { id } }',
608	{ id: comment.
609	stranger.key,
610	).expect(200);
611	expect(visible.body
612
613	const owned =
614	'query($o: String!) { repositoryOwner(login: $o) { repository(name: "public-repo") { name } } user(login: $o) { repository(name: "secret-repo") { name } } }',
615	{ o: username
616	stranger.key,
617	).expect(200);
618	expect(owned.body
619	expect(owned.body
620	repositoryOwner: { repository: {
621	user: { repository: null
622	});
623	});
624
625	it("answers gh's GitHub preview media types in Accept with JSON instead of 406",
626	const response =
627	.post('/api/graphql')
628	.set('authorization',
629	.set(
630	'accept',
631	'application/vnd.github.merge-info-preview+json, application/vnd.github.nebula-preview',
632	)
633	.send({ query:
634	.expect(200);
635	expect(response.body
636	});
637
638	it('pages labels as gh issue create asks for them',
639	const response =
640	'query RepositoryLabelList($owner: String!, $name: String!, $endCursor: String) { repository(owner: $owner, name: $name) { labels(first: 100, orderBy: {field: NAME, direction: ASC}, after: $endCursor) { nodes { id name color description } pageInfo { hasNextPage endCursor } } } }',
641	{ owner: username,
642	owner.key,
643	).expect(200);
644	expect(response.body
645	expect(
646	response.body.data
647	(label: {
648	),
649	).toContain('bug'
650	expect(response.body
651	false,
652	);
653	});
654
655	it('pages assignable users as gh issue create asks for them',
656	const response =
657	'query RepositoryAssignableUsers($owner: String!, $name: String!, $endCursor: String) { repository(owner: $owner, name: $name) { assignableUsers(first: 100, after: $endCursor) { nodes { id login name } pageInfo { hasNextPage endCursor } } } }',
658	{ owner: username,
659	owner.key,
660	).expect(200);
661	expect(response.body
662	expect(
663	response.body.data
664	(user: {
665	),
666	).toContain(username)
667	});
668
669	// gh's IssueByNumber query (pkg/cmd/issue/shared/lookup.go): one field list on both fragments, issue-only fields dropped from the pull request one.
670	const SHARED =
671	'number,url,state,createdAt,title,body,author{login,...on User{id,name}},milestone{number,title,description,dueOn},assignees(first:100){nodes{id,login,name,databaseId},totalCount},labels(first:100){nodes{id,name,description,color},totalCount},reactionGroups{content,users{totalCount}},projectItems(first:100){nodes{id, project{id,title}, status:fieldValueByName(name: "Status") { ... on ProjectV2ItemFieldSingleSelectValue{optionId,name}}},totalCount},id';
672	const LAST_COMMENT =
673	'comments(last: 1){nodes{author{login,...on User{id,name}},authorAssociation,body,createdAt,includesCreatedEdit,isMinimized,minimizedReason,reactionGroups{content,users{totalCount}}},totalCount}';
674	const ALL_COMMENTS =
675	'comments(first: 100){nodes{id,author{login,...on User{id,name}},authorAssociation,body,createdAt,includesCreatedEdit,isMinimized,minimizedReason,reactionGroups{content,users{totalCount}},url,viewerDidAuthor},pageInfo{hasNextPage,endCursor},totalCount}';
676	const ISSUE_ONLY =
677	'stateReason,isPinned,issueType{id,name,description,color},parent{id,number,title,url,state,repository{nameWithOwner}},subIssues(first:100){nodes{id,number,title,url,state,repository{nameWithOwner}},totalCount},subIssuesSummary{total,completed,percentCompleted}';
678	const lookup =
679	`query IssueByNumber($owner: String!, $repo: String!, $number: Int!) { repository(owner: $owner, name: $repo) { hasIssuesEnabled issue: issueOrPullRequest(number: $number) { __typename ...on Issue{${SHARED},${
680
681	it("answers gh's issue lookup, which selects the same fields on Issue and PullRequest",
682	const issues =
683	'query($o: String!) { repository(owner: $o, name: "public-repo") { issues(first: 1) { nodes { number } } } }',
684	{ o: username
685	owner.key,
686	).expect(200);
687	const issueNumber =
688	for (const comments
689	const issue =
690	lookup(comments),
691	{ owner: username,
692	owner.key,
693	).expect(200);
694	expect(issue.body
695	expect(issue.body
696	__typename: 'Issue',
697	number: issueNumber,
698	state: 'OPEN',
699	issueType: null,
700	projectItems: { nodes: []
701	});
702	const pull =
703	lookup(comments),
704	{ owner: username,
705	owner.key,
706	).expect(200);
707	expect(pull.body
708	expect(pull.body
709	__typename: 'PullRequest',
710	number: pullRequestNumber,
711	state: 'OPEN',
712	title: 'Feature',
713	body: '',
714	author: { login: username
715	labels: { totalCount: 0
716	comments: { totalCount: 0
717	});
718	}
719	});
720
721	it('still refuses two different fields under one name on the same type',
722	const response =
723	'{ viewer { a: login a: name } }',
724	{},
725	owner.key,
726	).expect(400);
727	expect(response.body
728	});
729
730	it('accepts the createIssue and updateIssue fields gh sends, and pages project items and comments',
731	const repo =
732	'query($o: String!, $n: String!) { repository(owner: $o, name: $n) { id } }',
733	{ o: username,
734	owner.key,
735	).expect(200);
736	const created =
737	'mutation($input: CreateIssueInput!) { createIssue(input: $input) { issue { id number } } }',
738	{
739	input: {
740	repositoryId: repo.body
741	title: 'With gh nulls',
742	body: 'b',
743	issueTemplate: null,
744	milestoneId: null,
745	projectIds: null,
746	},
747	},
748	owner.key,
749	).expect(200);
750	expect(created.body
751	const { id,
752	const updated =
753	'mutation($input: UpdateIssueInput!) { updateIssue(input: $input) { issue { title } } }',
754	{
755	input: {
756	id,
757	title: 'Still nulls',
758	milestoneId: null,
759	projectIds: null,
760	},
761	},
762	owner.key,
763	).expect(200);
764	expect(updated.body
765	const milestone =
766	'mutation($input: UpdateIssueInput!) { updateIssue(input: $input) { issue { title } } }',
767	{ input: { id
768	owner.key,
769	).expect(200);
770	expect(milestone.body
771	type: 'NOT_FOUND',
772	message: "Could not resolve to a node with the global id of 'MI_bm9uZQ'",
773	});
774
775	const paged =
776	'query($o: String!, $n: Int!, $endCursor: String) { repository(owner: $o, name: "public-repo") { issue(number: $n) { projectItems(first: 100, after: $endCursor) { totalCount nodes { id } pageInfo { hasNextPage endCursor } } comments(first: 100, after: $endCursor) { totalCount pageInfo { hasNextPage } } } } }',
777	{ o: username,
778	owner.key,
779	).expect(200);
780	expect(paged.body
781	expect(paged.body
782	totalCount: 0,
783	nodes: [],
784	});
785	});
786	});