test: add functional regression tests for IDOR fixes (Phase 4)

- Add @japa/api-client devDependency (was missing despite being required
  for the 'client' fixture used in functional tests)
- Wire up sessionApiClient/authApiClient/shieldApiClient plugins in
  tests/bootstrap.ts so tests can authenticate (loginAs) and pass CSRF
  validation (withCsrfToken)
- Wrap each functional test in a global DB transaction (withGlobalTransaction)
  for isolation and rollback
- Add .env.test with SESSION_DRIVER=memory: the cookie session driver used
  in dev/prod is incompatible with Japa's session test client, which needs
  a store it can read/write by session id
- tests/functional/computers.spec.ts: covers owner can update; a user
  cannot update/delete another user's computer (404); a user cannot
  attach another user's component via componentsId (404); two components
  of the same unique type cannot be attached (422); deleting a computer
  detaches its components instead of destroying them
- tests/functional/components.spec.ts: covers owner can update; a user
  cannot update/delete another user's component (404); an unauthenticated
  request cannot delete a component (redirects to /auth/login)

All 10 tests pass, exercising the security fixes from commit 3cc189c.

tests/bootstrap.ts

@@ -1,9 +1,13 @@
 import { assert } from '@japa/assert'
+import { apiClient } from '@japa/api-client'
 import app from '@adonisjs/core/services/app'
 import type { Config } from '@japa/runner/types'
 import { pluginAdonisJS } from '@japa/plugin-adonisjs'
 import { dbAssertions } from '@adonisjs/lucid/plugins/db'
 import testUtils from '@adonisjs/core/services/test_utils'
+import { authApiClient } from '@adonisjs/auth/plugins/api_client'
+import { sessionApiClient } from '@adonisjs/session/plugins/api_client'
+import { shieldApiClient } from '@adonisjs/shield/plugins/api_client'
 
 /**
  * This file is imported by the "bin/test.ts" entrypoint file
@@ -13,7 +17,15 @@ import testUtils from '@adonisjs/core/services/test_utils'
  * Configure Japa plugins in the plugins array.
  * Learn more - https://japa.dev/docs/runner-config#plugins-optional
  */
-export const plugins: Config['plugins'] = [assert(), pluginAdonisJS(app), dbAssertions(app)]
+export const plugins: Config['plugins'] = [
+  assert(),
+  apiClient(),
+  sessionApiClient(app),
+  authApiClient(app),
+  shieldApiClient(),
+  pluginAdonisJS(app),
+  dbAssertions(app),
+]
 
 /**
  * Configure lifecycle function to run before and after all the
@@ -33,6 +45,9 @@ export const runnerHooks: Required<Pick<Config, 'setup' | 'teardown'>> = {
  */
 export const configureSuite: Config['configureSuite'] = (suite) => {
   if (['browser', 'functional', 'e2e'].includes(suite.name)) {
-    return suite.setup(() => testUtils.httpServer().start())
+    suite.setup(() => testUtils.httpServer().start())
+    suite.onGroup((group) => {
+      group.each.setup(() => testUtils.db().withGlobalTransaction())
+    })
   }
 }

tests/functional/components.spec.ts

@@ -0,0 +1,104 @@
+import { test } from '@japa/runner'
+import { DateTime } from 'luxon'
+import User from '#models/user'
+import Component from '#models/component'
+import ComponentType from '#models/component_type'
+
+async function createUser(email: string) {
+  return User.create({
+    name: 'Test User',
+    email,
+    password: 'secret@123A',
+  })
+}
+
+async function createType(name: string, unique = true) {
+  return ComponentType.firstOrCreate({ name }, { name, unique })
+}
+
+async function createComponent(userId: number, typeId: number) {
+  return Component.create({
+    name: 'Test Component',
+    price: 20,
+    typeId,
+    userId,
+    computerId: null,
+    purchaseDate: DateTime.now(),
+  })
+}
+
+test.group('Components authorization (IDOR)', () => {
+  test('owner can update their own component', async ({ client, assert }) => {
+    const owner = await createUser('owner-comp-update@example.com')
+    const type = await createType('RAM-comp-1')
+    const component = await createComponent(owner.id, type.id)
+
+    const response = await client
+      .put(`/components/${component.id}`)
+      .loginAs(owner)
+      .withCsrfToken()
+      .redirects(0)
+      .json({
+        name: 'Updated name',
+        price: 30,
+        typeId: type.id,
+        purchaseDate: DateTime.now().toFormat('yyyy-MM-dd'),
+      })
+
+    response.assertStatus(302)
+    await component.refresh()
+    assert.equal(component.name, 'Updated name')
+  })
+
+  test('a user cannot update another user component', async ({ client, assert }) => {
+    const owner = await createUser('owner-comp-a@example.com')
+    const attacker = await createUser('attacker-comp-a@example.com')
+    const type = await createType('RAM-comp-2')
+    const component = await createComponent(owner.id, type.id)
+
+    const response = await client
+      .put(`/components/${component.id}`)
+      .loginAs(attacker)
+      .withCsrfToken()
+      .redirects(0)
+      .json({
+        name: 'Hacked name',
+        price: 1,
+        typeId: type.id,
+        purchaseDate: DateTime.now().toFormat('yyyy-MM-dd'),
+      })
+
+    response.assertStatus(404)
+    await component.refresh()
+    assert.notEqual(component.name, 'Hacked name')
+  })
+
+  test('a user cannot delete another user component', async ({ client, assert }) => {
+    const owner = await createUser('owner-comp-b@example.com')
+    const attacker = await createUser('attacker-comp-b@example.com')
+    const type = await createType('RAM-comp-3')
+    const component = await createComponent(owner.id, type.id)
+
+    const response = await client
+      .delete(`/components/${component.id}`)
+      .loginAs(attacker)
+      .withCsrfToken()
+      .redirects(0)
+
+    response.assertStatus(404)
+    const stillExists = await Component.find(component.id)
+    assert.isNotNull(stillExists)
+  })
+
+  test('an unauthenticated request cannot delete a component', async ({ client, assert }) => {
+    const owner = await createUser('owner-comp-c@example.com')
+    const type = await createType('RAM-comp-4')
+    const component = await createComponent(owner.id, type.id)
+
+    const response = await client.delete(`/components/${component.id}`)
+
+    response.assertRedirectsTo('/auth/login')
+    const stillExists = await Component.find(component.id)
+    assert.isNotNull(stillExists)
+  })
+})

tests/functional/computers.spec.ts

@@ -0,0 +1,198 @@
+import { test } from '@japa/runner'
+import { DateTime } from 'luxon'
+import User from '#models/user'
+import Computer from '#models/computer'
+import ComputerState from '#models/computer_state'
+import Component from '#models/component'
+import ComponentType from '#models/component_type'
+
+async function createUser(email: string) {
+  return User.create({
+    name: 'Test User',
+    email,
+    password: 'secret@123A',
+  })
+}
+
+async function createState(name = 'ON_GOING') {
+  return ComputerState.firstOrCreate({ name }, { name })
+}
+
+async function createType(name: string, unique = true) {
+  return ComponentType.firstOrCreate({ name }, { name, unique })
+}
+
+async function createComponent(userId: number, typeId: number, computerId: number | null = null) {
+  return Component.create({
+    name: 'Test Component',
+    price: 42.5,
+    typeId,
+    userId,
+    computerId,
+    purchaseDate: DateTime.now(),
+  })
+}
+
+async function createComputer(userId: number, stateId: number) {
+  return Computer.create({
+    title: 'My PC',
+    sellPrice: 100,
+    gpuScore: 1,
+    cpuScore: 1,
+    globalScore: 1,
+    stateId,
+    userId,
+  })
+}
+
+test.group('Computers authorization (IDOR)', () => {
+  test('owner can update their own computer', async ({ client, assert }) => {
+    const owner = await createUser('owner-update@example.com')
+    const state = await createState()
+    const computer = await createComputer(owner.id, state.id)
+
+    const response = await client
+      .put(`/computers/${computer.id}`)
+      .loginAs(owner)
+      .withCsrfToken()
+      .redirects(0)
+      .json({
+        title: 'Updated title',
+        sellPrice: 150,
+        gpuScore: 2,
+        cpuScore: 2,
+        globalScore: 2,
+        stateId: state.id,
+        componentsId: [],
+        pictures: [],
+      })
+
+    response.assertStatus(302)
+    await computer.refresh()
+    assert.equal(computer.title, 'Updated title')
+  })
+
+  test('a user cannot update another user computer', async ({ client }) => {
+    const owner = await createUser('owner-a@example.com')
+    const attacker = await createUser('attacker-a@example.com')
+    const state = await createState()
+    const computer = await createComputer(owner.id, state.id)
+
+    const response = await client
+      .put(`/computers/${computer.id}`)
+      .loginAs(attacker)
+      .withCsrfToken()
+      .redirects(0)
+      .json({
+        title: 'Hacked title',
+        sellPrice: 1,
+        gpuScore: 1,
+        cpuScore: 1,
+        globalScore: 1,
+        stateId: state.id,
+        componentsId: [],
+        pictures: [],
+      })
+
+    response.assertStatus(404)
+  })
+
+  test('a user cannot delete another user computer', async ({ client, assert }) => {
+    const owner = await createUser('owner-b@example.com')
+    const attacker = await createUser('attacker-b@example.com')
+    const state = await createState()
+    const computer = await createComputer(owner.id, state.id)
+
+    const response = await client
+      .delete(`/computers/${computer.id}`)
+      .loginAs(attacker)
+      .withCsrfToken()
+      .redirects(0)
+
+    response.assertStatus(404)
+    const stillExists = await Computer.find(computer.id)
+    assert.isNotNull(stillExists)
+  })
+
+  test('a user cannot attach another user component via componentsId', async ({
+    client,
+    assert,
+  }) => {
+    const owner = await createUser('owner-c@example.com')
+    const attacker = await createUser('attacker-c@example.com')
+    const state = await createState()
+    const type = await createType('Processor-IDOR', true)
+    const victimComponent = await createComponent(owner.id, type.id)
+    const attackerComputer = await createComputer(attacker.id, state.id)
+
+    const response = await client
+      .put(`/computers/${attackerComputer.id}`)
+      .loginAs(attacker)
+      .withCsrfToken()
+      .redirects(0)
+      .json({
+        title: attackerComputer.title,
+        sellPrice: attackerComputer.sellPrice,
+        gpuScore: 0,
+        cpuScore: 0,
+        globalScore: 0,
+        stateId: state.id,
+        componentsId: [victimComponent.id],
+        pictures: [],
+      })
+
+    // handleComponents scopes the lookup to the current user, so the
+    // victim's component cannot be found/attached -> 404.
+    response.assertStatus(404)
+    await victimComponent.refresh()
+    assert.isNull(victimComponent.computerId)
+  })
+
+  test('cannot attach two components of the same unique type to a computer', async ({ client }) => {
+    const owner = await createUser('owner-d@example.com')
+    const state = await createState()
+    const type = await createType('Motherboard-IDOR', true)
+    const componentA = await createComponent(owner.id, type.id)
+    const componentB = await createComponent(owner.id, type.id)
+    const computer = await createComputer(owner.id, state.id)
+
+    const response = await client
+      .put(`/computers/${computer.id}`)
+      .loginAs(owner)
+      .withCsrfToken()
+      .redirects(0)
+      .json({
+        title: computer.title,
+        sellPrice: computer.sellPrice,
+        gpuScore: 0,
+        cpuScore: 0,
+        globalScore: 0,
+        stateId: state.id,
+        componentsId: [componentA.id, componentB.id],
+        pictures: [],
+      })
+
+    response.assertStatus(422)
+  })
+
+  test('deleting a computer detaches its components instead of destroying them', async ({
+    client,
+    assert,
+  }) => {
+    const owner = await createUser('owner-e@example.com')
+    const state = await createState()
+    const type = await createType('Fan-IDOR', false)
+    const computer = await createComputer(owner.id, state.id)
+    const component = await createComponent(owner.id, type.id, computer.id)
+
+    const response = await client
+      .delete(`/computers/${computer.id}`)
+      .loginAs(owner)
+      .withCsrfToken()
+      .redirects(0)
+
+    response.assertStatus(302)
+    await component.refresh()
+    assert.isNull(component.computerId)
+  })
+})