From 2c803454de18b6f587cf8b20a60354f0f39ee773 Mon Sep 17 00:00:00 2001 From: suyx Date: Tue, 4 Aug 2026 01:29:29 +0800 Subject: [PATCH] feat: implement TASK-WP5-07 preview grant lifecycle --- apps/api/src/app.ts | 22 ++ apps/api/src/preview-grants.ts | 483 ++++++++++++++++++++++++ tests/api/wp5-07-preview-grants.test.ts | 179 +++++++++ 3 files changed, 684 insertions(+) create mode 100644 apps/api/src/preview-grants.ts create mode 100644 tests/api/wp5-07-preview-grants.test.ts diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts index 887501b..837be3c 100644 --- a/apps/api/src/app.ts +++ b/apps/api/src/app.ts @@ -174,6 +174,7 @@ import { registrationFieldError, } from "./registration-errors.js"; import type { RegistrationService } from "./registration.js"; +import type { AssetPreviewGrantService } from "./preview-grants.js"; import type { RecentAssetService } from "./recent-assets.js"; import type { AmapAdapter } from "./amap-adapter.js"; import { ModelConfigurationError } from "./model-configuration.js"; @@ -212,6 +213,7 @@ export interface CreateAppOptions { resourceId: string; userId: string; }) => boolean | Promise; + previewGrants?: AssetPreviewGrantService; privateAssetAdminAuthorizer?: (input: { adminUserId: string; ownerId: string; @@ -871,6 +873,13 @@ export async function createApp(options: CreateAppOptions = {}) { const session = token ? options.registration.readUserSession(token) : undefined; if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id })); const { resourceVersion } = request.params as { resourceVersion: string }; + if (options.previewGrants) { + const manifest = options.previewGrants.projectManifest({ releaseVersion: resourceVersion, userId: session.userId }); + if (!manifest) return reply.code(404).send(); + reply.header("Cache-Control", "private, no-store"); + reply.header("Vary", "Cookie"); + return manifest; + } const available = options.assetReleases?.project("internal_preview_asset", resourceVersion); if (!available || !options.previewAssetAuthorizer) return reply.code(404).send(); const authorizedIds: string[] = []; @@ -901,6 +910,19 @@ export async function createApp(options: CreateAppOptions = {}) { const session = token ? options.registration.readUserSession(token) : undefined; if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id })); const { assetId, resourceVersion } = request.params as { assetId: string; resourceVersion: string }; + if (options.previewGrants) { + const resource = options.previewGrants.readManifestItem({ + manifestItemId: assetId, + releaseVersion: resourceVersion, + userId: session.userId, + }); + if (!resource) return reply.code(404).send(); + reply.type(resource.mimeType); + reply.header("Cache-Control", "private, no-store"); + reply.header("Content-Disposition", "inline"); + reply.header("Vary", "Cookie"); + return resource.bytes; + } const authorized = await options.previewAssetAuthorizer?.({ resourceId: assetId, releaseVersion: resourceVersion, userId: session.userId }); const resource = authorized ? options.assetReleases?.read("internal_preview_asset", resourceVersion, assetId) : undefined; if (!resource) return reply.code(404).send(); diff --git a/apps/api/src/preview-grants.ts b/apps/api/src/preview-grants.ts new file mode 100644 index 0000000..71ff023 --- /dev/null +++ b/apps/api/src/preview-grants.ts @@ -0,0 +1,483 @@ +import { createHash, randomUUID } from "node:crypto"; + +import type { + AssetReleaseManifestItem, + AssetReleaseManifestProjection, + AssetReleaseReader, +} from "@dada/asset-release-manifest"; + +import { auditRetentionMilliseconds, serializeAuditSummary } from "./audit-policy.js"; +import type { RegistrationService } from "./registration.js"; + +export type PreviewBatchStatus = "active" | "closed"; +export type PreviewGrantStatus = "active" | "revoked" | "expired"; + +export interface PreviewBatchView { + batchId: string; + createdAt: number; + createdBy: string; + name: string; + status: PreviewBatchStatus; +} + +export interface PreviewGrantView { + batchId: string; + expiresAt: number; + grantId: string; + grantedAt: number; + grantedBy: string; + status: PreviewGrantStatus; + userId: string; +} + +export class PreviewGrantError extends Error { + constructor( + public readonly reason: + | "admin_invalid" + | "batch_closed" + | "batch_not_found" + | "grant_not_found" + | "invalid_expiry" + | "invalid_request" + | "resource_not_found" + | "user_not_eligible", + ) { + super(reason); + this.name = "PreviewGrantError"; + } +} + +interface PreviewGrantServiceOptions { + assetReleases: AssetReleaseReader; + clock?: () => number; + registration: RegistrationService; +} + +interface PreviewManifestItemMapping { + releaseVersion: string; + resourceId: string; + userId: string; +} + +function isUuid(value: string) { + return /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value); +} + +function assertText(value: string, name: string) { + const normalized = value.trim(); + if (!normalized || normalized.length > 160) throw new PreviewGrantError("invalid_request"); + if (name === "batchId" && !isUuid(normalized)) throw new PreviewGrantError("invalid_request"); + return normalized; +} + +function manifestHash(items: readonly AssetReleaseManifestItem[], releaseVersion: string) { + return createHash("sha256") + .update(JSON.stringify({ + items, + release_version: releaseVersion, + schema_version: "AssetReleaseManifest/v1", + })) + .digest("hex"); +} + +/** + * Owns the P0-A preview grant state. Preview URLs are deliberately ephemeral: + * the random item id is kept only in this process and every read rechecks the + * persisted grant, so revocation and expiry take effect without cache busting. + */ +export class AssetPreviewGrantService { + readonly database: RegistrationService["database"]; + readonly options: Required> & PreviewGrantServiceOptions; + private readonly itemMappings = new Map(); + + constructor(options: PreviewGrantServiceOptions) { + this.database = options.registration.database; + this.options = { ...options, clock: options.clock ?? Date.now }; + this.migrate(); + } + + createBatch(input: { adminUserId: string; batchId?: string; name: string }): PreviewBatchView { + const adminUserId = assertText(input.adminUserId, "adminUserId"); + const name = assertText(input.name, "name"); + const batchId = input.batchId ? assertText(input.batchId, "batchId") : randomUUID(); + const now = this.options.clock(); + this.assertAdmin(adminUserId, now); + this.immediate(() => { + this.database.prepare(` + INSERT INTO test_batches (batch_id, name, status, created_by, created_at, closed_at) + VALUES (?, ?, 'active', ?, ?, NULL) + `).run(batchId, name, adminUserId, now); + this.audit({ + actorRef: adminUserId, + afterSummary: { batch_id: batchId, status: "active" }, + beforeSummary: null, + operationType: "preview_batch_create", + targetRef: batchId, + targetType: "preview_batch", + }, now); + }); + return { batchId, createdAt: now, createdBy: adminUserId, name, status: "active" }; + } + + closeBatch(input: { adminUserId: string; batchId: string }): PreviewBatchView { + const adminUserId = assertText(input.adminUserId, "adminUserId"); + const batchId = assertText(input.batchId, "batchId"); + const now = this.options.clock(); + this.assertAdmin(adminUserId, now); + return this.immediate(() => { + const batch = this.readBatch(batchId); + if (!batch) throw new PreviewGrantError("batch_not_found"); + if (batch.status === "active") { + this.database.prepare("UPDATE test_batches SET status = 'closed', closed_at = ? WHERE batch_id = ?").run(now, batchId); + this.audit({ + actorRef: adminUserId, + afterSummary: { batch_id: batchId, status: "closed" }, + beforeSummary: { batch_id: batchId, status: batch.status }, + operationType: "preview_batch_close", + targetRef: batchId, + targetType: "preview_batch", + }, now); + } + return { ...batch, status: "closed" as const }; + }); + } + + addBatchItems(input: { + adminUserId: string; + batchId: string; + releaseVersion: string; + resourceIds: readonly string[]; + }) { + const adminUserId = assertText(input.adminUserId, "adminUserId"); + const batchId = assertText(input.batchId, "batchId"); + const releaseVersion = assertText(input.releaseVersion, "releaseVersion"); + const resourceIds = [...new Set(input.resourceIds.map((resourceId) => assertText(resourceId, "resourceId")))]; + if (resourceIds.length === 0) throw new PreviewGrantError("invalid_request"); + const now = this.options.clock(); + this.assertAdmin(adminUserId, now); + for (const resourceId of resourceIds) { + if (!this.options.assetReleases.read("internal_preview_asset", releaseVersion, resourceId)) { + throw new PreviewGrantError("resource_not_found"); + } + } + this.immediate(() => { + const batch = this.readBatch(batchId); + if (!batch) throw new PreviewGrantError("batch_not_found"); + if (batch.status !== "active") throw new PreviewGrantError("batch_closed"); + const insert = this.database.prepare(` + INSERT OR IGNORE INTO test_batch_items (test_batch_id, release_version, resource_id) + VALUES (?, ?, ?) + `); + for (const resourceId of resourceIds) insert.run(batchId, releaseVersion, resourceId); + this.audit({ + actorRef: adminUserId, + afterSummary: { batch_id: batchId, item_count: resourceIds.length, release_version: releaseVersion }, + beforeSummary: null, + operationType: "preview_batch_items_add", + targetRef: batchId, + targetType: "preview_batch", + }, now); + }); + return { batchId, releaseVersion, resourceIds }; + } + + grant(input: { + adminUserId: string; + batchId: string; + expiresAt: number; + userId: string; + }): PreviewGrantView { + const adminUserId = assertText(input.adminUserId, "adminUserId"); + const batchId = assertText(input.batchId, "batchId"); + const userId = assertText(input.userId, "userId"); + if (!isUuid(userId)) throw new PreviewGrantError("invalid_request"); + const now = this.options.clock(); + if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt <= now) throw new PreviewGrantError("invalid_expiry"); + this.assertAdmin(adminUserId, now); + return this.immediate(() => { + const batch = this.readBatch(batchId); + if (!batch) throw new PreviewGrantError("batch_not_found"); + if (batch.status !== "active") throw new PreviewGrantError("batch_closed"); + const user = this.database.prepare("SELECT role, status FROM users WHERE user_id = ?").get(userId) as { role: string; status: string } | undefined; + if (!user || user.role !== "user" || user.status !== "active") throw new PreviewGrantError("user_not_eligible"); + const grantId = randomUUID(); + this.database.prepare(` + INSERT INTO asset_preview_grants ( + grant_id, user_id, test_batch_id, granted_by, granted_at, expires_at, status + ) VALUES (?, ?, ?, ?, ?, ?, 'active') + `).run(grantId, userId, batchId, adminUserId, now, input.expiresAt); + this.audit({ + actorRef: adminUserId, + afterSummary: { batch_id: batchId, expires_at: input.expiresAt, grant_id: grantId, status: "active", user_id: userId }, + beforeSummary: null, + operationType: "preview_grant_create", + targetRef: grantId, + targetType: "preview_grant", + }, now); + return { + batchId, + expiresAt: input.expiresAt, + grantId, + grantedAt: now, + grantedBy: adminUserId, + status: "active" as const, + userId, + }; + }); + } + + revoke(input: { adminUserId: string; grantId: string }): PreviewGrantView { + const adminUserId = assertText(input.adminUserId, "adminUserId"); + const grantId = assertText(input.grantId, "grantId"); + const now = this.options.clock(); + this.assertAdmin(adminUserId, now); + return this.immediate(() => { + this.expireDue(now); + const grant = this.readGrant(grantId); + if (!grant) throw new PreviewGrantError("grant_not_found"); + if (grant.status === "active") { + this.database.prepare("UPDATE asset_preview_grants SET status = 'revoked' WHERE grant_id = ? AND status = 'active'").run(grantId); + this.audit({ + actorRef: adminUserId, + afterSummary: { grant_id: grantId, status: "revoked" }, + beforeSummary: { grant_id: grantId, status: grant.status }, + operationType: "preview_grant_revoke", + targetRef: grantId, + targetType: "preview_grant", + }, now); + } + return { ...grant, status: "revoked" as const }; + }); + } + + listBatches(input: { adminUserId: string }): PreviewBatchView[] { + const adminUserId = assertText(input.adminUserId, "adminUserId"); + this.assertAdmin(adminUserId, this.options.clock()); + return (this.database.prepare(` + SELECT batch_id, name, status, created_by, created_at + FROM test_batches ORDER BY created_at DESC, batch_id DESC + `).all() as Array<{ batch_id: string; created_at: number; created_by: string; name: string; status: PreviewBatchStatus }>).map((row) => ({ + batchId: row.batch_id, + createdAt: row.created_at, + createdBy: row.created_by, + name: row.name, + status: row.status, + })); + } + + listGrants(input: { adminUserId: string; batchId?: string; userId?: string }): PreviewGrantView[] { + const adminUserId = assertText(input.adminUserId, "adminUserId"); + this.assertAdmin(adminUserId, this.options.clock()); + const batchId = input.batchId ? assertText(input.batchId, "batchId") : undefined; + const userId = input.userId ? assertText(input.userId, "userId") : undefined; + const now = this.options.clock(); + return this.immediate(() => { + this.expireDue(now); + const rows = this.database.prepare(` + SELECT grant_id, user_id, test_batch_id, granted_by, granted_at, expires_at, status + FROM asset_preview_grants + WHERE (? IS NULL OR test_batch_id = ?) AND (? IS NULL OR user_id = ?) + ORDER BY granted_at DESC, grant_id DESC + `).all(batchId ?? null, batchId ?? null, userId ?? null, userId ?? null) as Array<{ + expires_at: number; grant_id: string; granted_at: number; granted_by: string; + status: PreviewGrantStatus; test_batch_id: string; user_id: string; + }>; + return rows.map((row) => ({ + batchId: row.test_batch_id, + expiresAt: row.expires_at, + grantId: row.grant_id, + grantedAt: row.granted_at, + grantedBy: row.granted_by, + status: row.status, + userId: row.user_id, + })); + }); + } + + projectManifest(input: { releaseVersion: string; userId: string }): AssetReleaseManifestProjection | undefined { + const releaseVersion = assertText(input.releaseVersion, "releaseVersion"); + const userId = assertText(input.userId, "userId"); + const base = this.options.assetReleases.project("internal_preview_asset", releaseVersion); + if (!base) return undefined; + const authorized = base.items.filter((item) => this.authorizeAsset({ releaseVersion, resourceId: item.resource_id, userId })); + if (authorized.length === 0) return undefined; + const items = authorized.map((item) => { + const manifestItemId = randomUUID(); + const mapped: AssetReleaseManifestItem = { + ...item, + resource_id: manifestItemId, + url: `/api/v1/assets/preview/${releaseVersion}/${manifestItemId}`, + }; + this.itemMappings.set(manifestItemId, { + releaseVersion, + resourceId: item.resource_id, + userId, + }); + return mapped; + }); + return Object.freeze({ + items: Object.freeze(items.map((item) => Object.freeze(item))), + manifest_sha256: manifestHash(items, releaseVersion), + release_version: releaseVersion, + schema_version: "AssetReleaseManifest/v1" as const, + }); + } + + authorizeAsset(input: { releaseVersion: string; resourceId: string; userId: string }) { + const releaseVersion = assertText(input.releaseVersion, "releaseVersion"); + const resourceId = assertText(input.resourceId, "resourceId"); + const userId = assertText(input.userId, "userId"); + const now = this.options.clock(); + return this.immediate(() => { + this.expireDue(now); + const user = this.database.prepare("SELECT role, status FROM users WHERE user_id = ?").get(userId) as { role: string; status: string } | undefined; + if (!user || user.role !== "user" || user.status !== "active") return false; + const row = this.database.prepare(` + SELECT 1 AS authorized + FROM asset_preview_grants g + JOIN test_batch_items i ON i.test_batch_id = g.test_batch_id + WHERE g.user_id = ? AND g.status = 'active' AND g.expires_at > ? + AND i.release_version = ? AND i.resource_id = ? + LIMIT 1 + `).get(userId, now, releaseVersion, resourceId) as { authorized: 1 } | undefined; + return Boolean(row); + }); + } + + readManifestItem(input: { manifestItemId: string; releaseVersion: string; userId: string }) { + const manifestItemId = assertText(input.manifestItemId, "manifestItemId"); + const releaseVersion = assertText(input.releaseVersion, "releaseVersion"); + const userId = assertText(input.userId, "userId"); + const mapping = this.itemMappings.get(manifestItemId); + if (!mapping || mapping.releaseVersion !== releaseVersion || mapping.userId !== userId) return undefined; + if (!this.authorizeAsset({ releaseVersion, resourceId: mapping.resourceId, userId })) { + this.itemMappings.delete(manifestItemId); + return undefined; + } + const resource = this.options.assetReleases.read("internal_preview_asset", releaseVersion, mapping.resourceId); + return resource ? { ...resource, resourceId: manifestItemId } : undefined; + } + + private migrate() { + this.database.exec(` + CREATE TABLE IF NOT EXISTS test_batches ( + batch_id TEXT PRIMARY KEY, + name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 160), + status TEXT NOT NULL CHECK (status IN ('active', 'closed')), + created_by TEXT NOT NULL REFERENCES users(user_id), + created_at INTEGER NOT NULL, + closed_at INTEGER + ); + CREATE TABLE IF NOT EXISTS test_batch_items ( + test_batch_id TEXT NOT NULL REFERENCES test_batches(batch_id), + release_version TEXT NOT NULL, + resource_id TEXT NOT NULL, + PRIMARY KEY (test_batch_id, release_version, resource_id) + ); + CREATE TABLE IF NOT EXISTS asset_preview_grants ( + grant_id TEXT PRIMARY KEY, + user_id TEXT NOT NULL REFERENCES users(user_id), + test_batch_id TEXT NOT NULL REFERENCES test_batches(batch_id), + granted_by TEXT NOT NULL REFERENCES users(user_id), + granted_at INTEGER NOT NULL, + expires_at INTEGER NOT NULL CHECK (expires_at > granted_at), + status TEXT NOT NULL CHECK (status IN ('active', 'revoked', 'expired')) + ); + CREATE INDEX IF NOT EXISTS asset_preview_grants_user_status + ON asset_preview_grants(user_id, status, expires_at); + `); + } + + private immediate(action: () => T): T { + this.database.exec("BEGIN IMMEDIATE"); + try { + const value = action(); + this.database.exec("COMMIT"); + return value; + } catch (error) { + if (this.database.inTransaction) this.database.exec("ROLLBACK"); + throw error; + } + } + + private assertAdmin(adminUserId: string, now: number) { + const admin = this.database.prepare(` + SELECT 1 AS allowed FROM users u JOIN admin_access a ON a.user_id = u.user_id + WHERE u.user_id = ? AND u.role = 'super_admin' AND u.status = 'active' AND a.allowed = 1 + `).get(adminUserId) as { allowed: 1 } | undefined; + if (!admin) throw new PreviewGrantError("admin_invalid"); + void now; + } + + private readBatch(batchId: string): PreviewBatchView | undefined { + const row = this.database.prepare(` + SELECT batch_id, name, status, created_by, created_at + FROM test_batches WHERE batch_id = ? + `).get(batchId) as { batch_id: string; created_at: number; created_by: string; name: string; status: PreviewBatchStatus } | undefined; + return row ? { + batchId: row.batch_id, + createdAt: row.created_at, + createdBy: row.created_by, + name: row.name, + status: row.status, + } : undefined; + } + + private readGrant(grantId: string): PreviewGrantView | undefined { + const row = this.database.prepare(` + SELECT grant_id, user_id, test_batch_id, granted_by, granted_at, expires_at, status + FROM asset_preview_grants WHERE grant_id = ? + `).get(grantId) as { + expires_at: number; grant_id: string; granted_at: number; granted_by: string; + status: PreviewGrantStatus; test_batch_id: string; user_id: string; + } | undefined; + return row ? { + batchId: row.test_batch_id, + expiresAt: row.expires_at, + grantId: row.grant_id, + grantedAt: row.granted_at, + grantedBy: row.granted_by, + status: row.status, + userId: row.user_id, + } : undefined; + } + + private expireDue(now: number) { + const rows = this.database.prepare(` + SELECT grant_id, user_id, test_batch_id FROM asset_preview_grants + WHERE status = 'active' AND expires_at <= ? + `).all(now) as Array<{ grant_id: string; test_batch_id: string; user_id: string }>; + if (rows.length === 0) return; + this.database.prepare("UPDATE asset_preview_grants SET status = 'expired' WHERE status = 'active' AND expires_at <= ?").run(now); + for (const row of rows) { + this.audit({ + actorRef: "preview_grant_expiry", + afterSummary: { grant_id: row.grant_id, status: "expired" }, + beforeSummary: { grant_id: row.grant_id, status: "active" }, + operationType: "preview_grant_expire", + targetRef: row.grant_id, + targetType: "preview_grant", + }, now, "system"); + } + } + + private audit(input: { + actorRef: string; + afterSummary: Record | null; + beforeSummary: Record | null; + operationType: string; + targetRef: string; + targetType: string; + }, now: number, actorType: "super_admin" | "system" = "super_admin") { + this.database.prepare(` + INSERT INTO admin_operation_logs ( + log_id, actor_type, actor_ref, operation_type, target_type, target_ref, + result, before_summary, after_summary, occurred_at, expires_at + ) VALUES (?, ?, ?, ?, ?, ?, 'succeeded', ?, ?, ?, ?) + `).run( + randomUUID(), actorType, input.actorRef, input.operationType, input.targetType, input.targetRef, + serializeAuditSummary(input.beforeSummary), serializeAuditSummary(input.afterSummary), + now, now + auditRetentionMilliseconds, + ); + } +} diff --git a/tests/api/wp5-07-preview-grants.test.ts b/tests/api/wp5-07-preview-grants.test.ts new file mode 100644 index 0000000..a0ac33f --- /dev/null +++ b/tests/api/wp5-07-preview-grants.test.ts @@ -0,0 +1,179 @@ +import { randomUUID } from "node:crypto"; +import { mkdtempSync, rmSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; + +import { afterEach, describe, expect, it } from "vitest"; + +import { createApp } from "../../apps/api/src/app.js"; +import { AssetPreviewGrantService } from "../../apps/api/src/preview-grants.js"; +import { RegistrationService } from "../../apps/api/src/registration.js"; +import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js"; +import { createAssetReleaseManifest } from "../../packages/asset-release-manifest/src/index.js"; + +const start = Date.parse("2026-08-04T08:00:00.000Z"); +const releaseVersion = "asset-20260804.1"; +const previewResourceId = "8f9b5c62-7488-4c7a-9f0c-3b8f3fc34f92"; +const roots: string[] = []; +const registrations: RegistrationService[] = []; + +function harness() { + const root = mkdtempSync(join(tmpdir(), "dada-wp5-07-")); + roots.push(root); + let now = start; + const registration = new RegistrationService({ + challengePepper: Buffer.alloc(32, 0x71), + clock: () => now, + currentPrivacyNoticeVersion: "p0a-registration-notice-v1", + databasePath: join(root, "dada.sqlite3"), + invitePepper: Buffer.alloc(32, 0x72), + resend: new MockResendAdapter(), + sessionPepper: Buffer.alloc(32, 0x73), + }); + registrations.push(registration); + const userId = randomUUID(); + registration.database.prepare(` + INSERT INTO users ( + user_id, normalized_email, role, status, counts_toward_stage_limit, + registration_id, created_at + ) VALUES (?, ?, 'user', 'active', 1, ?, ?) + `).run(userId, `${userId}@example.invalid`, randomUUID(), start); + registration.database.prepare(` + INSERT INTO user_profiles (user_id, creator_name, social_id) + VALUES (?, 'Preview User', '@preview_user') + `).run(userId); + registration.database.prepare(` + INSERT INTO credit_accounts (user_id, available_balance, reserved_balance, updated_at) + VALUES (?, 10, 0, ?) + `).run(userId, start); + const adminId = randomUUID(); + registration.database.prepare(` + INSERT INTO users ( + user_id, normalized_email, role, status, counts_toward_stage_limit, + registration_id, created_at + ) VALUES (?, ?, 'super_admin', 'active', 0, ?, ?) + `).run(adminId, `${adminId}@example.invalid`, randomUUID(), start); + registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId); + const assetReleases = createAssetReleaseManifest({ + items: [{ + access_class: "internal_preview_asset", + content: Buffer.from("preview-content"), + mime_type: "image/webp", + relative_path: "preview/TEMPLATE.webp", + resource_id: previewResourceId, + root_ref: "canonical-assets", + }], + release_version: releaseVersion, + }); + const service = new AssetPreviewGrantService({ assetReleases, registration, clock: () => now }); + return { + advance(milliseconds: number) { now += milliseconds; }, + adminId, + registration, + service, + userId, + }; +} + +afterEach(() => { + for (const registration of registrations.splice(0)) registration.close(); + for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true }); +}); + +describe("TASK-WP5-07 internal preview grant lifecycle", () => { + it("keeps ordinary role, returns randomized manifest item IDs, and blocks revoked/expired grants", () => { + const test = harness(); + const batch = test.service.createBatch({ + name: "WP5 preview batch", + adminUserId: test.adminId, + }); + test.service.addBatchItems({ + adminUserId: test.adminId, + batchId: batch.batchId, + releaseVersion, + resourceIds: [previewResourceId], + }); + const grant = test.service.grant({ + adminUserId: test.adminId, + batchId: batch.batchId, + expiresAt: start + 60_000, + userId: test.userId, + }); + + const firstManifest = test.service.projectManifest({ releaseVersion, userId: test.userId }); + expect(firstManifest?.items).toHaveLength(1); + expect(firstManifest?.items[0].resource_id).not.toBe(previewResourceId); + expect(firstManifest?.items[0].url).toContain(firstManifest?.items[0].resource_id ?? ""); + expect(test.service.readManifestItem({ + manifestItemId: firstManifest!.items[0].resource_id, + releaseVersion, + userId: test.userId, + })?.bytes).toEqual(Buffer.from("preview-content")); + expect(test.registration.database.prepare("SELECT role FROM users WHERE user_id = ?").get(test.userId)).toEqual({ role: "user" }); + + test.service.revoke({ adminUserId: test.adminId, grantId: grant.grantId }); + expect(test.service.projectManifest({ releaseVersion, userId: test.userId })).toBeUndefined(); + expect(test.service.readManifestItem({ + manifestItemId: firstManifest!.items[0].resource_id, + releaseVersion, + userId: test.userId, + })).toBeUndefined(); + + const secondGrant = test.service.grant({ + adminUserId: test.adminId, + batchId: batch.batchId, + expiresAt: start + 10_000, + userId: test.userId, + }); + expect(secondGrant.status).toBe("active"); + test.advance(10_001); + expect(test.service.projectManifest({ releaseVersion, userId: test.userId })).toBeUndefined(); + expect(test.registration.database.prepare("SELECT status FROM asset_preview_grants WHERE grant_id = ?").get(secondGrant.grantId)).toEqual({ status: "expired" }); + + test.registration.database.prepare("UPDATE users SET status = 'active' WHERE user_id = ?").run(test.userId); + test.service.grant({ + adminUserId: test.adminId, + batchId: batch.batchId, + expiresAt: start + 120_000, + userId: test.userId, + }); + test.registration.changeUserStatus(test.userId, "suspended"); + expect(test.service.projectManifest({ releaseVersion, userId: test.userId })).toBeUndefined(); + expect(test.registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs WHERE operation_type LIKE 'preview_grant_%'").get()).toEqual({ count: 5 }); + }); + + it("serves the randomized item through the authenticated no-store route", async () => { + const test = harness(); + const batch = test.service.createBatch({ name: "WP5 route batch", adminUserId: test.adminId }); + test.service.addBatchItems({ + adminUserId: test.adminId, + batchId: batch.batchId, + releaseVersion, + resourceIds: [previewResourceId], + }); + const grant = test.service.grant({ adminUserId: test.adminId, batchId: batch.batchId, expiresAt: start + 60_000, userId: test.userId }); + const session = test.registration.issueAuthenticatedSession(test.userId, "user"); + const app = await createApp({ + browserGate: false, + networkBoundary: { allowTestPort: true }, + previewGrants: test.service, + registration: test.registration, + }); + try { + const headers = { cookie: `dada_session=${session.sessionToken}`, host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" }; + const manifest = await app.inject({ headers, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/manifest` }); + expect(manifest.statusCode).toBe(200); + const itemId = manifest.json().items[0].resource_id; + expect(itemId).not.toBe(previewResourceId); + const asset = await app.inject({ headers, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${itemId}` }); + expect(asset.statusCode).toBe(200); + expect(asset.headers["cache-control"]).toBe("private, no-store"); + expect(asset.rawPayload).toEqual(Buffer.from("preview-content")); + test.service.revoke({ adminUserId: test.adminId, grantId: grant.grantId }); + const revoked = await app.inject({ headers, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${itemId}` }); + expect(revoked.statusCode).toBe(404); + } finally { + await app.close(); + } + }); +});