test: api tests

packages/nocodb/src/middlewares/extract-ids/extract-ids.middleware.ts

@@ -484,7 +484,7 @@ export class AclMiddleware implements NestInterceptor {
         if (req.params.sourceId) {
           source = sources.find((s) => s.id === req.params.sourceId);
         } else {
-          source = sources.find((s) => s.isMeta());
+          source = sources.find((s) => s.isMeta()) || sources[0];
         }
       } else if (req.ncSourceId) {
         source = await Source.get(req.context, req.ncSourceId);

packages/nocodb/tests/unit/factory/base.ts

@@ -7,7 +7,7 @@ interface ProjectArgs {
   type?: string;
 }
 
-const sakilaProjectConfig = (context) => {
+const sakilaProjectConfig = (context, additionalConfig = {}) => {
   let source;
 
   if (
@@ -38,6 +38,7 @@ const sakilaProjectConfig = (context) => {
     ...source,
     inflection_column: 'camelize',
     inflection_table: 'camelize',
+    ...additionalConfig,
   };
 
   return {
@@ -67,11 +68,11 @@ const createSharedBase = async (app, token, base, sharedBaseArgs = {}) => {
     });
 };
 
-const createSakilaProject = async (context) => {
+const createSakilaProject = async (context, additionalConfig = {}) => {
   const response = await request(context.app)
     .post('/api/v1/db/meta/projects/')
     .set('xc-auth', context.token)
-    .send(sakilaProjectConfig(context));
+    .send(sakilaProjectConfig(context, additionalConfig));
 
   return (await Base.getByTitleOrId(
     {

packages/nocodb/tests/unit/rest/index.test.ts

@@ -12,6 +12,7 @@ import newDataApisTest from './tests/newDataApis.test';
 import groupByTest from './tests/groupby.test';
 import formulaTests from './tests/formula.test';
 import typeCastsTest from './tests/typeCasts.test';
+import readOnlyTest from './tests/readOnlySource.test';
 
 let workspaceTest = () => {};
 let ssoTest = () => {};
@@ -41,6 +42,7 @@ function restTests() {
   ssoTest();
   cloudOrgTest();
   typeCastsTest();
+  readOnlyTest();
 
   // Enable for dashboard feature
   // widgetTest();

packages/nocodb/tests/unit/rest/tests/readOnlySource.test.ts

@@ -0,0 +1,153 @@
+import 'mocha';
+import request from 'supertest';
+import { beforeEach } from 'mocha';
+import { Exception } from 'handlebars';
+import { expect } from 'chai';
+import { Base } from '../../../../src/models';
+import { createTable, getTable } from '../../factory/table';
+import init from '../../init';
+import {
+  createProject,
+  createSakilaProject,
+  createSharedBase,
+} from '../../factory/base';
+import { RootScopes } from '../../../../src/utils/globals';
+import { generateDefaultRowAttributes } from '../../factory/row';
+import { defaultColumns } from '../../factory/column';
+
+// Test case list
+// 1. Create data readonly source
+// 2. Create schema readonly source
+
+function sourceTest() {
+  let context;
+
+  beforeEach(async function () {
+    console.time('#### readonlySourceTest');
+    context = await init();
+    console.timeEnd('#### readonlySourceTest');
+  });
+
+  it('Readonly data', async () => {
+    const base = await createSakilaProject(context, {
+      is_schema_readonly: false,
+      is_data_readonly: true,
+    });
+
+    const countryTable = await getTable({
+      base,
+      name: 'country',
+    });
+
+    const sakilaCtx = {
+      workspace_id: base.fk_workspace_id,
+      base_id: base.id,
+    };
+
+    const countryColumns = await countryTable.getColumns(sakilaCtx);
+    const rowAttributes = Array(99)
+      .fill(0)
+      .map((index) =>
+        generateDefaultRowAttributes({ columns: countryColumns, index }),
+      );
+
+    await request(context.app)
+      .post(`/api/v1/db/data/bulk/noco/${base.id}/${countryTable.id}`)
+      .set('xc-auth', context.token)
+      .send(rowAttributes)
+      .expect(403);
+
+    await request(context.app)
+      .post(`/api/v1/db/meta/projects/${base.id}/tables`)
+      .set('xc-auth', context.token)
+      .send({
+        table_name: 'new_title',
+        title: 'new_title',
+        columns: defaultColumns(context),
+      })
+      .expect(200);
+  });
+
+  it('Readonly schema', async () => {
+    const base = await createSakilaProject(context, {
+      is_schema_readonly: true,
+      is_data_readonly: false,
+    });
+
+    const countryTable = await getTable({
+      base,
+      name: 'country',
+    });
+
+    const sakilaCtx = {
+      workspace_id: base.fk_workspace_id,
+      base_id: base.id,
+    };
+
+    const countryColumns = await countryTable.getColumns(sakilaCtx);
+    const rowAttributes = Array(99)
+      .fill(0)
+      .map((index) =>
+        generateDefaultRowAttributes({ columns: countryColumns, index }),
+      );
+
+    await request(context.app)
+      .post(`/api/v1/db/data/bulk/noco/${base.id}/${countryTable.id}`)
+      .set('xc-auth', context.token)
+      .send(rowAttributes)
+      .expect(200);
+
+    await request(context.app)
+      .post(`/api/v1/db/meta/projects/${base.id}/tables`)
+      .set('xc-auth', context.token)
+      .send({
+        table_name: 'new_title',
+        title: 'new_title',
+        columns: defaultColumns(context),
+      })
+      .expect(403);
+  });
+  it('Readonly schema & data', async () => {
+    const base = await createSakilaProject(context, {
+      is_schema_readonly: true,
+      is_data_readonly: true,
+    });
+
+    const countryTable = await getTable({
+      base,
+      name: 'country',
+    });
+
+    const sakilaCtx = {
+      workspace_id: base.fk_workspace_id,
+      base_id: base.id,
+    };
+
+    const countryColumns = await countryTable.getColumns(sakilaCtx);
+    const rowAttributes = Array(99)
+      .fill(0)
+      .map((index) =>
+        generateDefaultRowAttributes({ columns: countryColumns, index }),
+      );
+
+    await request(context.app)
+      .post(`/api/v1/db/data/bulk/noco/${base.id}/${countryTable.id}`)
+      .set('xc-auth', context.token)
+      .send(rowAttributes)
+      .expect(403);
+
+    await request(context.app)
+      .post(`/api/v1/db/meta/projects/${base.id}/tables`)
+      .set('xc-auth', context.token)
+      .send({
+        table_name: 'new_title',
+        title: 'new_title',
+        columns: defaultColumns(context),
+      })
+      .expect(403);
+  });
+}
+
+export default function () {
+  describe('SourceRestriction', sourceTest);
+}