Hynes/Void-Homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(schema): enforce cross-space FK on tasks.project_id via composite key

Browse Source 
Security review flagged that tasks.project_id could reference a project in
a different space. Added composite FK (project_id, space_id) -> projects(id, space_id)
with ON DELETE SET NULL (project_id) so a deleted project leaves the task in
its space with project_id NULL rather than orphaning into a NULL space.

Added two regression tests: cross-space FK rejection + cascade behavior.
This commit is contained in:
root
2026-05-31 02:14:20 +10:00
parent 951016385a
commit 3ca1509935
2 changed files with 52 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
tests/db/migration_001.test.js
View File

@@ -1,9 +1,9 @@
import { describe, it, expect, beforeAll } from 'vitest';
import { describe, it, expect, beforeEach } from 'vitest';
import { resetDb, withClient } from '../helpers/db.js';
import { migrateUp } from '../../lib/db/migrate.js';
describe('migration 001 — core', () => {
beforeAll(async () => { await resetDb(); await migrateUp(); });
beforeEach(async () => { await resetDb(); await migrateUp(); });
it('creates spaces, projects, tasks tables', async () => {
await withClient(async (c) => {
@@ -33,4 +33,47 @@ describe('migration 001 — core', () => {
).rejects.toThrow(/duplicate key/i);
});
});
it('rejects a task whose project is in a different space (composite FK)', async () => {
await withClient(async (c) => {
const { rows: [s1] } = await c.query(
`INSERT INTO spaces(slug, name) VALUES('one', 'One') RETURNING id;`
);
const { rows: [s2] } = await c.query(
`INSERT INTO spaces(slug, name) VALUES('two', 'Two') RETURNING id;`
);
const { rows: [p] } = await c.query(
`INSERT INTO projects(space_id, slug, name) VALUES($1, 'p', 'P') RETURNING id;`,
[s1.id]
);
await expect(
c.query(
`INSERT INTO tasks(space_id, project_id, title) VALUES($1, $2, 'x');`,
[s2.id, p.id]
)
).rejects.toThrow(/foreign key/i);
});
});
it('on project delete, task project_id becomes NULL but space_id stays', async () => {
await withClient(async (c) => {
const { rows: [s] } = await c.query(
`INSERT INTO spaces(slug, name) VALUES('s', 'S') RETURNING id;`
);
const { rows: [p] } = await c.query(
`INSERT INTO projects(space_id, slug, name) VALUES($1, 'p', 'P') RETURNING id;`,
[s.id]
);
const { rows: [t] } = await c.query(
`INSERT INTO tasks(space_id, project_id, title) VALUES($1, $2, 'x') RETURNING id;`,
[s.id, p.id]
);
await c.query(`DELETE FROM projects WHERE id=$1;`, [p.id]);
const { rows: [after] } = await c.query(
`SELECT space_id, project_id FROM tasks WHERE id=$1;`, [t.id]
);
expect(after.project_id).toBeNull();
expect(after.space_id).toBe(s.id);
});
});
});