fix: resolve show access in /aggregate with ShowRequest source

Author: NoOne7135

adminforth/modules/restApi.ts

@@ -1902,7 +1902,7 @@ export default class AdminForthRestAPI implements IAdminForthRestAPI {
         }
 
         const meta = { requestBody: body, pk: undefined };
-        const { allowedActions } = await interpretResource(
+        const { allowedActions: listActions } = await interpretResource(
           adminUser,
           resource,
           meta,
@@ -1911,14 +1911,22 @@ export default class AdminForthRestAPI implements IAdminForthRestAPI {
         );
 
         // aggregation reads a whole set of records at once, so it needs list access
-        const { allowed, error } = checkAccess(AllowedActionsEnum.list, allowedActions);
+        const { allowed, error } = checkAccess(AllowedActionsEnum.list, listActions);
         if (!allowed) {
           return { error };
         }
 
         // ...and min/max/groupBy return raw per-field values, which is what the show view does,
-        // so a resource with no reachable show view must not be aggregatable either
-        const { allowed: showAllowed, error: showError } = checkAccess(AllowedActionsEnum.show, allowedActions);
+        // so a resource with no reachable show view must not be aggregatable either.
+        // ListRequest resolves only 'list', so 'show' is resolved with its own source
+        const { allowedActions: showActions } = await interpretResource(
+          adminUser,
+          resource,
+          meta,
+          ActionCheckSource.ShowRequest,
+          this.adminforth
+        );
+        const { allowed: showAllowed, error: showError } = checkAccess(AllowedActionsEnum.show, showActions);
         if (!showAllowed) {
           return { error: showError };
         }

tests/application/resources/adminuser.ts

@@ -10,6 +10,7 @@ export default {
       'AdminForthAgentPlugin',
       'TwoFactorsAuthPlugin',
       'DashboardPlugin',
+      'OAuthPlugin',
     ].includes(p.className)) || [],
   ],
 }

tests/application/resources/cars_sl_dont_allow_show.ts

@@ -7,7 +7,7 @@ export default {
     ...carsResourseTemplate("cars_sl_no_show", "sqlite", "id").options,
     allowedActions: {
       show: false,
-      list: false
+      list: true
     }
   }
 };

tests/jest_tests/CRUD_sqlite.test.ts

@@ -1231,3 +1231,41 @@ describe('POST /delete_record', () => {
   });
 
 });
+
+describe('POST /aggregate', () => {
+  beforeAll(async () => {
+    const res = await agent
+      .post('/adminapi/v1/login')
+      .send({
+        username: 'adminforth',
+        password: 'adminforth',
+      });
+    expect(res.status).toEqual(200);
+    authCookie = res.headers['set-cookie']?.[0]?.split(';')[0];
+  });
+
+  it('aggregates a resource that allows list and show', async () => {
+    const res = await agent
+      .set('Cookie', authCookie)
+      .post('/adminapi/v1/aggregate')
+      .send({
+        resourceId: 'cars_sl',
+        aggregations: { total: { operation: 'count' } },
+      });
+    expect(res.status).toEqual(200);
+    expect(res.body.error).toBeUndefined();
+    expect(res.body.data).toEqual([{ total: await admin.resource('cars_sl').count() }]);
+  });
+
+  it('should throw error, that action is not allowed when show is denied', async () => {
+    const res = await agent
+      .set('Cookie', authCookie)
+      .post('/adminapi/v1/aggregate')
+      .send({
+        resourceId: 'cars_sl_no_show',
+        aggregations: { total: { operation: 'count' } },
+      });
+    expect(res.status).toEqual(200);
+    expect(res.body.error).toBe("Action is not allowed");
+  });
+});