mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 05:50:35 +00:00
dfff188409
A plugin with "scope": "global" keeps running across the dashboard and files and can find and open the user's projects and files. Any manifest could ask for this without the user being told. Add the allow:global permission. The plugin registry adds it to every manifest with global scope, so the install dialog lists it, and a plugin that becomes global in a later version shows the permissions update dialog again. The permission is valid in the shared schema, which the backend checks when saving, and in the runtime manifest schema. The built-in MCP plugin declares it too. Document the scope property and the new permission for plugin developers.
395 lines
18 KiB
Clojure
395 lines
18 KiB
Clojure
;; This Source Code Form is subject to the terms of the Mozilla Public
|
|
;; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
;;
|
|
;; Copyright (c) KALEIDOS SUBSIDIARY SL
|
|
|
|
(ns backend-tests.rpc-plugins-test
|
|
(:require
|
|
[app.common.schema :as sm]
|
|
[app.common.types.plugins :as ctp]
|
|
[app.common.uuid :as uuid]
|
|
[app.config :as cf]
|
|
[app.db :as db]
|
|
[app.rpc :as-alias rpc]
|
|
[app.rpc.commands.profile :as profile]
|
|
[backend-tests.helpers :as th]
|
|
[clojure.test :as t]))
|
|
|
|
(t/use-fixtures :once th/state-init)
|
|
(t/use-fixtures :each th/database-reset)
|
|
|
|
(def ^:private plugin-id-1 (str (uuid/next)))
|
|
(def ^:private plugin-id-2 (str (uuid/next)))
|
|
|
|
(def ^:private valid-plugin
|
|
{:plugin-id plugin-id-1
|
|
:name "Test Plugin"
|
|
:description "A test plugin"
|
|
:host "https://example.com"
|
|
:code "(function() { console.log('hello'); })()"
|
|
:icon "icon.svg"
|
|
:permissions #{"content:read" "content:write"}})
|
|
|
|
(t/deftest add-profile-plugin-accepts-valid-permissions
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin valid-plugin}
|
|
out (th/command! data)]
|
|
|
|
(t/is (nil? (:error out)))
|
|
(t/is (some? (:result out)))
|
|
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)
|
|
plugins (get-in props [:props :plugins])]
|
|
(t/is (= [plugin-id-1] (:ids plugins)))
|
|
(t/is (= valid-plugin (get-in plugins [:data plugin-id-1]))))))
|
|
|
|
(t/deftest add-profile-plugin-accepts-global-plugins
|
|
(let [profile (th/create-profile* 1)
|
|
plugin (assoc valid-plugin
|
|
:scope "global"
|
|
:permissions #{"content:read" "allow:global"})
|
|
out (th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin})]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= plugin (:result out)))))
|
|
|
|
(t/deftest add-profile-plugin-rejects-invalid-permissions
|
|
(let [profile (th/create-profile* 1)
|
|
plugin (assoc valid-plugin :permissions #{"content:read" "admin:delete"})
|
|
data {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin}
|
|
out (th/command! data)]
|
|
|
|
;; Schema validation catches invalid permissions before custom validation
|
|
(t/is (th/ex-info? (:error out)))
|
|
(t/is (th/ex-of-type? (:error out) :validation))
|
|
(t/is (th/ex-of-code? (:error out) :params-validation))
|
|
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)
|
|
plugins (get-in props [:props :plugins])]
|
|
(t/is (nil? plugins) "No plugins should be persisted when validation fails"))))
|
|
|
|
(t/deftest add-profile-plugin-updates-existing-plugin
|
|
(let [profile (th/create-profile* 1)
|
|
data1 {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin valid-plugin}
|
|
_ (th/command! data1)
|
|
|
|
updated-plugin (assoc valid-plugin :name "Updated Plugin")
|
|
data2 {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin updated-plugin}
|
|
out (th/command! data2)]
|
|
|
|
(t/is (nil? (:error out)))
|
|
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)
|
|
plugins (get-in props [:props :plugins])]
|
|
(t/is (= 1 (count (:ids plugins))) "Should still have only one plugin")
|
|
(t/is (= "Updated Plugin" (get-in plugins [:data plugin-id-1 :name]))))))
|
|
|
|
(t/deftest remove-profile-plugin-removes-plugin
|
|
(let [profile (th/create-profile* 1)
|
|
data1 {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin valid-plugin}
|
|
_ (th/command! data1)
|
|
|
|
data2 {::th/type :remove-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin-id (uuid/uuid plugin-id-1)}
|
|
out (th/command! data2)]
|
|
|
|
(t/is (nil? (:error out)))
|
|
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)
|
|
plugins (get-in props [:props :plugins])]
|
|
(t/is (= [] (:ids plugins)))
|
|
(t/is (empty? (:data plugins))))))
|
|
|
|
(t/deftest remove-profile-plugin-handles-nonexistent-plugin
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :remove-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin-id (uuid/next)}
|
|
out (th/command! data)]
|
|
|
|
(t/is (nil? (:error out)))
|
|
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)
|
|
plugins (get-in props [:props :plugins])]
|
|
(t/is (or (nil? plugins)
|
|
(and (empty? (:ids plugins))
|
|
(empty? (:data plugins))))
|
|
"Plugins should be nil or empty when no plugins exist"))))
|
|
|
|
(t/deftest add-profile-plugin-multiple-plugins
|
|
(let [profile (th/create-profile* 1)
|
|
plugin1 valid-plugin
|
|
plugin2 (assoc valid-plugin
|
|
:plugin-id plugin-id-2
|
|
:name "Second Plugin")
|
|
|
|
data1 {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin1}
|
|
_ (th/command! data1)
|
|
|
|
data2 {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin2}
|
|
_ (th/command! data2)]
|
|
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)
|
|
plugins (get-in props [:props :plugins])]
|
|
(t/is (= 2 (count (:ids plugins))))
|
|
(t/is (contains? (set (:ids plugins)) plugin-id-1))
|
|
(t/is (contains? (set (:ids plugins)) plugin-id-2))
|
|
(t/is (= "Test Plugin" (get-in plugins [:data plugin-id-1 :name])))
|
|
(t/is (= "Second Plugin" (get-in plugins [:data plugin-id-2 :name]))))))
|
|
|
|
(t/deftest add-profile-plugin-rejects-oversized-code
|
|
;; The merged props must not exceed :profile-props-max-size
|
|
(let [profile (th/create-profile* 1)
|
|
plugin (assoc valid-plugin :code (apply str (repeat 200 "x")))
|
|
data {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin}]
|
|
(with-redefs [cf/get (th/config-get-mock {:profile-props-max-size 100})]
|
|
(let [out (th/command! data)]
|
|
(t/is (th/ex-info? (:error out)))
|
|
(t/is (th/ex-of-type? (:error out) :validation))
|
|
(t/is (th/ex-of-code? (:error out) :props-too-large))))))
|
|
|
|
(t/deftest add-profile-plugin-rejects-oversized-code-path
|
|
;; :code holds a manifest path, not content: overlong values are
|
|
;; rejected by the entry schema before the props size check runs
|
|
(let [profile (th/create-profile* 1)
|
|
plugin (assoc valid-plugin :code (apply str (repeat 501 "x")))
|
|
data {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin}
|
|
out (th/command! data)]
|
|
(t/is (th/ex-info? (:error out)))
|
|
(t/is (th/ex-of-type? (:error out) :validation))
|
|
(t/is (th/ex-of-code? (:error out) :params-validation))))
|
|
|
|
(t/deftest remove-profile-plugin-allowed-on-oversized-profile
|
|
;; Removal shrinks props, so it passes even under a tight limit
|
|
(let [profile (th/create-profile* 1)
|
|
plugin (assoc valid-plugin :code (apply str (repeat 200 "x")))]
|
|
;; Seed an oversized registry while the limit is high
|
|
(with-redefs [cf/get (th/config-get-mock {:profile-props-max-size 100000})]
|
|
(let [out (th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin})]
|
|
(t/is (nil? (:error out)))))
|
|
;; Removal under a tighter limit still passes: the seeded registry
|
|
;; is oversized against it, but the remaining props fit
|
|
(with-redefs [cf/get (th/config-get-mock {:profile-props-max-size 300})]
|
|
(let [out (th/command! {::th/type :remove-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin-id (uuid/uuid plugin-id-1)})]
|
|
(t/is (nil? (:error out)))))))
|
|
|
|
(t/deftest add-profile-plugin-rejects-51st-plugin
|
|
;; The registry holds at most 50 plugins; the 51st (new id) must fail
|
|
(let [profile (th/create-profile* 1)]
|
|
;; Seed 50 plugins
|
|
(doseq [i (range 50)]
|
|
(let [plugin (assoc valid-plugin
|
|
:plugin-id (str (uuid/next))
|
|
:name (str "Plugin " i))
|
|
out (th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin})]
|
|
(t/is (nil? (:error out)) (str "seed plugin " i " should install"))))
|
|
;; The 51st must fail with a specific error
|
|
(let [extra (assoc valid-plugin
|
|
:plugin-id (str (uuid/next))
|
|
:name "One Too Many")
|
|
out (th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin extra})]
|
|
(t/is (th/ex-info? (:error out)))
|
|
(t/is (th/ex-of-type? (:error out) :validation))
|
|
(t/is (th/ex-of-code? (:error out) :too-many-plugins)))
|
|
;; And nothing extra was persisted
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)]
|
|
(t/is (= 50 (count (get-in props [:props :plugins :ids])))))))
|
|
|
|
(t/deftest add-profile-plugin-updates-existing-at-limit
|
|
;; Re-adding an existing id at the limit is an update, not a new entry
|
|
(let [profile (th/create-profile* 1)
|
|
ids (mapv (fn [_] (str (uuid/next))) (range 50))]
|
|
(doseq [[i pid] (map-indexed vector ids)]
|
|
(th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin (assoc valid-plugin :plugin-id pid :name (str "Plugin " i))}))
|
|
(let [out (th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin (assoc valid-plugin :plugin-id (first ids) :name "Renamed")})]
|
|
(t/is (nil? (:error out)))
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)]
|
|
(t/is (= 50 (count (get-in props [:props :plugins :ids]))))
|
|
(t/is (= "Renamed" (get-in props [:props :plugins :data (first ids) :name])))))))
|
|
|
|
(t/deftest add-profile-plugin-full-registry-reports-too-many-before-size
|
|
;; A full registry plus oversized content reports the count guard,
|
|
;; which runs before the size check
|
|
(let [profile (th/create-profile* 1)]
|
|
;; Seed 50 plugins under a generous limit
|
|
(with-redefs [cf/get (th/config-get-mock {:profile-props-max-size 1000000})]
|
|
(doseq [i (range 50)]
|
|
(let [plugin (assoc valid-plugin
|
|
:plugin-id (str (uuid/next))
|
|
:name (str "Plugin " i))
|
|
out (th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin plugin})]
|
|
(t/is (nil? (:error out)) (str "seed plugin " i " should install")))))
|
|
;; Tight limit + 51st small plugin: count wins over size
|
|
(with-redefs [cf/get (th/config-get-mock {:profile-props-max-size 100})]
|
|
(let [extra (assoc valid-plugin
|
|
:plugin-id (str (uuid/next))
|
|
:name "One Too Many")
|
|
out (th/command! {::th/type :add-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin extra})]
|
|
(t/is (th/ex-info? (:error out)))
|
|
(t/is (th/ex-of-type? (:error out) :validation))
|
|
(t/is (th/ex-of-code? (:error out) :too-many-plugins))))
|
|
;; And nothing extra was persisted
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)]
|
|
(t/is (= 50 (count (get-in props [:props :plugins :ids])))))))
|
|
|
|
(t/deftest remove-profile-plugin-noop-on-oversized-profile-without-plugins
|
|
;; Removing an absent id changes nothing: no write, no size failure,
|
|
;; and no :plugins key is manufactured
|
|
(let [profile (th/create-profile* 1)
|
|
big {:onboarding-questions {:big-blob (apply str (repeat 200 "x"))}}]
|
|
(th/db-update! :profile {:props (db/tjson big)} {:id (:id profile)})
|
|
(with-redefs [cf/get (th/config-get-mock {:profile-props-max-size 100})]
|
|
(let [out (th/command! {::th/type :remove-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin-id (uuid/next)})]
|
|
(t/is (nil? (:error out)))))
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)]
|
|
(t/is (nil? (get-in props [:props :plugins])))
|
|
(t/is (= big (get props :props))))))
|
|
|
|
(t/deftest update-profile-props-rejects-plugins
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :update-profile-props
|
|
::rpc/profile-id (:id profile)
|
|
:props {:plugins {:ids ["test"] :data {"test" valid-plugin}}}}
|
|
out (th/command! data)]
|
|
|
|
(t/is (th/ex-info? (:error out)))
|
|
(t/is (th/ex-of-type? (:error out) :validation))
|
|
(t/is (th/ex-of-code? (:error out) :params-validation))
|
|
|
|
(let [saved (th/db-get :profile {:id (:id profile)})
|
|
props (profile/decode-row saved)]
|
|
(t/is (nil? (get-in props [:props :plugins]))
|
|
":plugins must not be writable via update-profile-props"))))
|
|
|
|
;; --- Stored registries over the caps
|
|
|
|
(defn- legacy-entry
|
|
[plugin-id & {:as attrs}]
|
|
(merge valid-plugin {:plugin-id plugin-id :code "plugin.js"} attrs))
|
|
|
|
(defn- legacy-registry
|
|
[entries]
|
|
{:ids (mapv :plugin-id entries)
|
|
:data (into {} (map (juxt :plugin-id identity)) entries)})
|
|
|
|
(defn- stored-props
|
|
"Props as stored in the database, without the read-time clamping."
|
|
[profile-id]
|
|
(db/decode-transit-pgobject (:props (th/db-get :profile {:id profile-id}))))
|
|
|
|
(t/deftest get-profile-clamps-legacy-registry
|
|
(let [profile (th/create-profile* 1)
|
|
big (apply str (repeat 10000 "x"))
|
|
;; "😀" is two chars, so char 500 is a high surrogate
|
|
emoji (str (apply str (repeat 499 "n")) "😀")
|
|
entries (into [(legacy-entry plugin-id-1
|
|
:name emoji
|
|
:description big
|
|
:host big
|
|
:code big
|
|
:icon big)]
|
|
(map #(legacy-entry (str "extra-" %)))
|
|
(range 60))
|
|
stored (-> (legacy-registry entries)
|
|
(update :ids conj "dangling"))]
|
|
(th/db-update! :profile {:props (db/tjson {:plugins stored :renderer :wasm})}
|
|
{:id (:id profile)})
|
|
(let [out (th/command! {::th/type :get-profile ::rpc/profile-id (:id profile)})
|
|
props (get-in out [:result :props])
|
|
plugins (:plugins props)
|
|
entry (get-in plugins [:data plugin-id-1])]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= :wasm (:renderer props)) "other props are kept")
|
|
(t/is (= (mapv :plugin-id (take ctp/max-plugins entries)) (:ids plugins))
|
|
"keeps the first plugins in registry order, drops ids without data")
|
|
(t/is (= (set (:ids plugins)) (set (keys (:data plugins)))))
|
|
(t/is (= (apply str (repeat 499 "n")) (:name entry)) "does not split a surrogate pair")
|
|
(doseq [k [:description :host :code :icon]]
|
|
(t/is (= (get ctp/registry-entry-max-lengths k) (count (get entry k)))
|
|
(str k " truncated to its cap")))
|
|
(t/is (sm/validate ctp/schema:plugin-registry plugins)))
|
|
(t/is (= stored (:plugins (stored-props (:id profile))))
|
|
"reading does not write")))
|
|
|
|
(t/deftest get-profile-keeps-valid-registry
|
|
(let [profile (th/create-profile* 1)
|
|
stored (legacy-registry [(legacy-entry plugin-id-1)])]
|
|
(th/db-update! :profile {:props (db/tjson {:plugins stored})} {:id (:id profile)})
|
|
(let [out (th/command! {::th/type :get-profile ::rpc/profile-id (:id profile)})]
|
|
(t/is (= stored (get-in out [:result :props :plugins]))))))
|
|
|
|
(t/deftest oversized-legacy-profile-recovers-on-write
|
|
;; A stored registry over the caps pushes props past the size limit;
|
|
;; the clamped read lets writes through and saves the clamped registry
|
|
(let [profile (th/create-profile* 1)
|
|
code (apply str (repeat 3000 "c"))
|
|
entries [(legacy-entry plugin-id-1 :code code)
|
|
(legacy-entry plugin-id-2 :code code)]]
|
|
(th/db-update! :profile {:props (db/tjson {:plugins (legacy-registry entries)})}
|
|
{:id (:id profile)})
|
|
(with-redefs [cf/get (th/config-get-mock {:profile-props-max-size 5000})]
|
|
(t/is (thrown? Exception (profile/check-props-size (stored-props (:id profile))))
|
|
"the stored props exceed the limit")
|
|
(let [out (th/command! {::th/type :update-profile-props
|
|
::rpc/profile-id (:id profile)
|
|
:props {:workspace-visited true}})]
|
|
(t/is (nil? (:error out))))
|
|
(let [out (th/command! {::th/type :remove-profile-plugin
|
|
::rpc/profile-id (:id profile)
|
|
:plugin-id (uuid/uuid plugin-id-1)})]
|
|
(t/is (nil? (:error out)))))
|
|
(let [props (stored-props (:id profile))]
|
|
(t/is (true? (:workspace-visited props)))
|
|
(t/is (= [plugin-id-2] (get-in props [:plugins :ids])))
|
|
(t/is (= 500 (count (get-in props [:plugins :data plugin-id-2 :code])))
|
|
"the write saved the clamped registry"))))
|