3ca1509935
Security review flagged that tasks.project_id could reference a project in a different space. Added composite FK (project_id, space_id) -> projects(id, space_id) with ON DELETE SET NULL (project_id) so a deleted project leaves the task in its space with project_id NULL rather than orphaning into a NULL space. Added two regression tests: cross-space FK rejection + cascade behavior.
80 lines
2.7 KiB
JavaScript
80 lines
2.7 KiB
JavaScript
import { describe, it, expect, beforeEach } from 'vitest';
|
|
import { resetDb, withClient } from '../helpers/db.js';
|
|
import { migrateUp } from '../../lib/db/migrate.js';
|
|
|
|
describe('migration 001 — core', () => {
|
|
beforeEach(async () => { await resetDb(); await migrateUp(); });
|
|
|
|
it('creates spaces, projects, tasks tables', async () => {
|
|
await withClient(async (c) => {
|
|
for (const t of ['spaces', 'projects', 'tasks']) {
|
|
const { rows } = await c.query(
|
|
`SELECT to_regclass('public.' || $1) AS t;`, [t]
|
|
);
|
|
expect(rows[0].t).toBe(t);
|
|
}
|
|
});
|
|
});
|
|
|
|
it('enforces UNIQUE(space_id, slug) on projects', async () => {
|
|
await withClient(async (c) => {
|
|
const { rows: [s] } = await c.query(
|
|
`INSERT INTO spaces(slug, name) VALUES('test', 'Test') RETURNING id;`
|
|
);
|
|
await c.query(
|
|
`INSERT INTO projects(space_id, slug, name) VALUES($1, 'a', 'A');`,
|
|
[s.id]
|
|
);
|
|
await expect(
|
|
c.query(
|
|
`INSERT INTO projects(space_id, slug, name) VALUES($1, 'a', 'B');`,
|
|
[s.id]
|
|
)
|
|
).rejects.toThrow(/duplicate key/i);
|
|
});
|
|
});
|
|
|
|
it('rejects a task whose project is in a different space (composite FK)', async () => {
|
|
await withClient(async (c) => {
|
|
const { rows: [s1] } = await c.query(
|
|
`INSERT INTO spaces(slug, name) VALUES('one', 'One') RETURNING id;`
|
|
);
|
|
const { rows: [s2] } = await c.query(
|
|
`INSERT INTO spaces(slug, name) VALUES('two', 'Two') RETURNING id;`
|
|
);
|
|
const { rows: [p] } = await c.query(
|
|
`INSERT INTO projects(space_id, slug, name) VALUES($1, 'p', 'P') RETURNING id;`,
|
|
[s1.id]
|
|
);
|
|
await expect(
|
|
c.query(
|
|
`INSERT INTO tasks(space_id, project_id, title) VALUES($1, $2, 'x');`,
|
|
[s2.id, p.id]
|
|
)
|
|
).rejects.toThrow(/foreign key/i);
|
|
});
|
|
});
|
|
|
|
it('on project delete, task project_id becomes NULL but space_id stays', async () => {
|
|
await withClient(async (c) => {
|
|
const { rows: [s] } = await c.query(
|
|
`INSERT INTO spaces(slug, name) VALUES('s', 'S') RETURNING id;`
|
|
);
|
|
const { rows: [p] } = await c.query(
|
|
`INSERT INTO projects(space_id, slug, name) VALUES($1, 'p', 'P') RETURNING id;`,
|
|
[s.id]
|
|
);
|
|
const { rows: [t] } = await c.query(
|
|
`INSERT INTO tasks(space_id, project_id, title) VALUES($1, $2, 'x') RETURNING id;`,
|
|
[s.id, p.id]
|
|
);
|
|
await c.query(`DELETE FROM projects WHERE id=$1;`, [p.id]);
|
|
const { rows: [after] } = await c.query(
|
|
`SELECT space_id, project_id FROM tasks WHERE id=$1;`, [t.id]
|
|
);
|
|
expect(after.project_id).toBeNull();
|
|
expect(after.space_id).toBe(s.id);
|
|
});
|
|
});
|
|
});
|