Testing Strategy
Relevant source files
The following files were used as context for generating this wiki page:
The @joindeed/prisma-auth testing strategy ensures the reliability of declarative authorization rules applied at the Prisma model level. The project uses the Jest framework to validate that authorization matchers, query constraints, and response patching behave correctly across various user contexts and permission levels.
Sources: package.json:6-10, README.md:1-10
Testing Infrastructure
The project utilizes jest as the primary test runner and ts-jest for handling TypeScript files. The configuration supports unit testing of individual modules and integration testing of the middleware logic.
Core Test Scripts
| Script | Command | Purpose |
|---|---|---|
test | jest | Executes all test suites once. |
test:cov | jest --coverage | Generates code coverage reports. |
test:watch | jest --watch | Runs tests in interactive watch mode. |
Sources: package.json:6-10
Compiler and Environment
Tests run in a Node.js environment configured via tsconfig.json. The setup uses commonjs modules and targets es2019. The configuration includes strict type-checking to prevent common runtime errors during test execution.
Sources: tsconfig.json:3-20
Unit Testing Areas
The testing strategy is divided into functional areas corresponding to the library's core modules.
Authorization Grammar Parsing
Tests for the parser verify that Prisma comments (e.g., /// @Auth(...)) are correctly converted into structured role definitions. These tests cover:
- Simple roles (e.g.,
[Owner, Admin]). - Roles with arguments (e.g.,
User(privileges:[...])). - Parsing of whitespace and special characters in identifiers.
Sources: src/descriptionToRoles.test.ts:4-40
Middleware Logic
Middleware tests simulate GraphQL execution contexts to verify access control.
The diagram shows how different user contexts are processed by the constraint middleware to determine if data access is granted or needs patching.
Sources: src/makeFieldConstraintMiddleware.test.ts:16-35
Field and Type Constraints
Tests in src/makeFieldConstraintMiddleware.test.ts and src/makeTypeConstraintMiddleware.test.ts validate that:
- Owners can access their own records based on
matcherlogic. - Admins bypass specific record ownership checks through global roles.
- Strangers receive
null,"", or[]depending on the return type's nullability. - Introspection fields (prefixed with
__) are skipped to avoid breaking GraphQL tools.
Sources: src/makeFieldConstraintMiddleware.test.ts:60-142, src/makeTypeConstraintMiddleware.test.ts:58-100
Security and Utility Tests
The PrismaSelect utility undergoes rigorous testing for deep merging and security vulnerabilities.
Prototype Pollution Protection
The project includes specific tests to prevent prototype pollution during the merging of Prisma select objects. It explicitly blocks:
__proto__constructorprototype
Sources: src/select.test.ts:4-65
Query Constraint Generation
Tests for getListWhereConstrains ensure that list queries are correctly wrapped in Prisma AND/OR clauses. This prevents user-provided queries from bypassing security constraints.
Sources: src/getListWhereConstrains.test.ts:50-100
Data Flow in Tests
The following sequence diagram illustrates the flow of a typical middleware test case:
The sequence demonstrates the decision path between granting access and applying a patched response when a role matcher fails.
Sources: src/makeFieldConstraintMiddleware.test.ts:60-90, src/patchResponse.test.ts:3-12
Summary
The Testing Strategy prioritizes security by validating both the declarative role parsing and the runtime execution of matchers. By covering edge cases like prototype pollution and GraphQL introspection, the project ensures that the authorization layer remains robust and does not interfere with standard GraphQL operations.
Sources: README.md:12-40, src/select.test.ts:4-30