snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/tests/automation/main_test.go

@@ -0,0 +1,155 @@
+package automation
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/cortezaproject/corteza/server/app"
+	"github.com/cortezaproject/corteza/server/automation/rest"
+	"github.com/cortezaproject/corteza/server/automation/service"
+	"github.com/cortezaproject/corteza/server/pkg/api/server"
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/cortezaproject/corteza/server/pkg/eventbus"
+	"github.com/cortezaproject/corteza/server/pkg/id"
+	"github.com/cortezaproject/corteza/server/pkg/label"
+	ltype "github.com/cortezaproject/corteza/server/pkg/label/types"
+	"github.com/cortezaproject/corteza/server/pkg/locale"
+	"github.com/cortezaproject/corteza/server/pkg/logger"
+	"github.com/cortezaproject/corteza/server/pkg/rand"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/store/adapters/rdbms/drivers/sqlite"
+	sysTypes "github.com/cortezaproject/corteza/server/system/types"
+	"github.com/cortezaproject/corteza/server/tests/helpers"
+	"github.com/go-chi/chi/v5"
+	_ "github.com/joho/godotenv/autoload"
+	"github.com/steinfletcher/apitest"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/text/language"
+)
+
+type (
+	helper struct {
+		t *testing.T
+		a *require.Assertions
+
+		cUser  *sysTypes.User
+		roleID uint64
+		token  []byte
+	}
+)
+
+var (
+	testApp *app.CortezaApp
+	r       chi.Router
+
+	eventBus = eventbus.New()
+)
+
+func init() {
+	helpers.RecursiveDotEnvLoad()
+}
+
+// random string, 10 chars long by default
+func rs(a ...int) string {
+	var l = 10
+	if len(a) > 0 {
+		l = a[0]
+	}
+
+	return string(rand.Bytes(l))
+}
+
+func InitTestApp() {
+	if testApp == nil {
+		ctx := cli.Context()
+
+		testApp = helpers.NewIntegrationTestApp(ctx, func(app *app.CortezaApp) (err error) {
+			service.DefaultStore, err = sqlite.ConnectInMemory(ctx)
+			if err != nil {
+				return err
+			}
+
+			// Tests should be executed w/o any locales
+			locale.SetGlobal(locale.Static(&locale.Language{Tag: language.Und}))
+
+			eventbus.Set(eventBus)
+			return nil
+		})
+	}
+
+	if r == nil {
+		r = chi.NewRouter()
+		r.Use(server.BaseMiddleware(false, logger.Default())...)
+		helpers.BindAuthMiddleware(r)
+		r.Group(rest.MountRoutes())
+	}
+}
+
+func TestMain(m *testing.M) {
+	InitTestApp()
+	os.Exit(m.Run())
+}
+
+func newHelper(t *testing.T) helper {
+	h := helper{
+		t:      t,
+		a:      require.New(t),
+		roleID: id.Next(),
+		cUser: &sysTypes.User{
+			ID: id.Next(),
+		},
+	}
+
+	h.cUser.SetRoles(h.roleID)
+	helpers.UpdateRBAC(h.roleID)
+
+	var err error
+	ctx := context.Background()
+	h.token, err = auth.TokenIssuer.Issue(ctx, auth.WithIdentity(h.cUser))
+	if err != nil {
+		panic(err)
+	}
+
+	return h
+}
+
+func (h helper) MyRole() uint64 {
+	return h.roleID
+}
+
+// Returns context w/ security details
+func (h helper) secCtx() context.Context {
+	return auth.SetIdentityToContext(context.Background(), h.cUser)
+}
+
+// apitest basics, initialize, set handler, add auth
+func (h helper) apiInit() *apitest.APITest {
+	InitTestApp()
+
+	return apitest.
+		New().
+		Handler(r).
+		Intercept(helpers.ReqHeaderRawAuthBearer(h.token))
+
+}
+
+// Unwraps error before it passes it to the tester
+func (h helper) noError(err error) {
+	for errors.Unwrap(err) != nil {
+		err = errors.Unwrap(err)
+	}
+
+	h.a.NoError(err)
+}
+
+func (h helper) setLabel(res label.LabeledResource, name, value string) {
+	h.a.NoError(store.UpsertLabel(h.secCtx(), service.DefaultStore, &ltype.Label{
+		Kind:       res.LabelResourceKind(),
+		ResourceID: res.LabelResourceID(),
+		Name:       name,
+		Value:      ltype.LabelValue{Val: value},
+	}))
+}

server/tests/automation/permissions_test.go

@@ -0,0 +1,115 @@
+package automation
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/cortezaproject/corteza/server/automation/types"
+	"github.com/cortezaproject/corteza/server/pkg/rbac"
+	"github.com/cortezaproject/corteza/server/tests/helpers"
+	"github.com/steinfletcher/apitest-jsonpath"
+)
+
+func TestPermissionsEffective(t *testing.T) {
+	h := newHelper(t)
+	helpers.DenyMe(h, types.ComponentRbacResource(), "workflow.create")
+
+	h.apiInit().
+		Get("/permissions/effective").
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestPermissionsList(t *testing.T) {
+	h := newHelper(t)
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "grant")
+
+	h.apiInit().
+		Get("/permissions/").
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Present(fmt.Sprintf(`$.response[? @.type=="%s"]`, types.ComponentResourceType))).
+		End()
+}
+
+func TestPermissionsRead(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.ComponentRbacResource(), "grant")
+	helpers.DenyMe(h, types.ComponentRbacResource(), "workflow.create")
+
+	h.apiInit().
+		Get(fmt.Sprintf("/permissions/%d/rules", h.roleID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestPermissionsUpdate(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.ComponentRbacResource(), "grant")
+
+	h.apiInit().
+		Patch(fmt.Sprintf("/permissions/%d/rules", h.roleID)).
+		Header("Accept", "application/json").
+		JSON(fmt.Sprintf(`{"rules":[{"resource":"%s","operation":"workflow.create","access":"allow"}]}`, types.ComponentRbacResource())).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestPermissionsDelete(t *testing.T) {
+	h := newHelper(t)
+	p := rbac.Global()
+
+	// Make sure our user can grant
+	helpers.AllowMe(h, types.ComponentRbacResource(), "grant")
+
+	// New role.
+	permDelRole := h.roleID + 1
+
+	h.a.Len(rbac.Global().FindRulesByRoleID(permDelRole), 0)
+
+	// Setup a few fake rules for new role
+	helpers.Grant(rbac.AllowRule(permDelRole, types.ComponentRbacResource(), "workflow.create"))
+
+	h.a.Len(p.FindRulesByRoleID(permDelRole), 1)
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/permissions/%d/rules", permDelRole)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	// Make sure all rules for this role are deleted
+	for _, r := range p.FindRulesByRoleID(permDelRole) {
+		h.a.True(r.Access == rbac.Inherit)
+	}
+}
+
+func TestPermissionsTrace(t *testing.T) {
+	h := newHelper(t)
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "grant")
+
+	h.apiInit().
+		Get("/permissions/trace").
+		Query("roleID[]", "1").
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Present(`$.response`)).
+		End()
+}

server/tests/automation/session_test.go

@@ -0,0 +1,86 @@
+package automation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/cortezaproject/corteza/server/automation/service"
+	"github.com/cortezaproject/corteza/server/automation/types"
+	"github.com/cortezaproject/corteza/server/pkg/id"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/tests/helpers"
+	jsonpath "github.com/steinfletcher/apitest-jsonpath"
+)
+
+func (h helper) clearSessions() {
+	h.noError(store.TruncateAutomationSessions(context.Background(), service.DefaultStore))
+}
+
+func (h helper) repoMakeSession(wf *types.Workflow, ss ...string) *types.Session {
+	var r = &types.Session{
+		ID:         id.Next(),
+		CreatedAt:  time.Now(),
+		WorkflowID: wf.ID,
+	}
+
+	if len(ss) > 1 {
+		r.ResourceType = ss[1]
+	} else {
+		r.ResourceType = "h_" + rs()
+
+	}
+
+	h.a.NoError(store.CreateAutomationSession(context.Background(), service.DefaultStore, r))
+
+	return r
+}
+
+func TestSessionList(t *testing.T) {
+	h := newHelper(t)
+	h.clearSessions()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "sessions.search")
+
+	wf := h.repoMakeWorkflow()
+	h.repoMakeSession(wf)
+	h.repoMakeSession(wf)
+
+	h.apiInit().
+		Get("/sessions/").
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Len(`$.response.set`, 2)).
+		End()
+}
+
+func TestSessionRead(t *testing.T) {
+	h := newHelper(t)
+	h.clearTriggers()
+
+	wf := h.repoMakeWorkflow()
+	s := h.repoMakeSession(wf)
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "sessions.search")
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "sessions.manage")
+
+	h.apiInit().
+		Get(fmt.Sprintf("/sessions/%d", s.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestSessionTrace(t *testing.T) {
+	t.Skip("pending implementation")
+}
+
+func TestSessionDelete(t *testing.T) {
+	t.Skip("pending implementation")
+}

server/tests/automation/trigger_test.go

@@ -0,0 +1,387 @@
+package automation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/cortezaproject/corteza/server/automation/service"
+	"github.com/cortezaproject/corteza/server/automation/types"
+	"github.com/cortezaproject/corteza/server/pkg/expr"
+	"github.com/cortezaproject/corteza/server/pkg/filter"
+	"github.com/cortezaproject/corteza/server/pkg/id"
+	labelTypes "github.com/cortezaproject/corteza/server/pkg/label/types"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/tests/helpers"
+	"github.com/steinfletcher/apitest"
+	"github.com/steinfletcher/apitest-jsonpath"
+	"github.com/stretchr/testify/require"
+)
+
+func (h helper) clearTriggers() {
+	h.noError(store.TruncateAutomationTriggers(context.Background(), service.DefaultStore))
+}
+
+func (h helper) createTrigger(res *types.Trigger) *types.Trigger {
+	if res.ID == 0 {
+		res.ID = id.Next()
+	}
+
+	if res.CreatedAt.IsZero() {
+		res.CreatedAt = time.Now()
+	}
+
+	h.a.NoError(service.DefaultStore.CreateAutomationTrigger(context.Background(), res))
+	return res
+}
+
+func (h helper) repoMakeTrigger(wf *types.Workflow, ss ...string) *types.Trigger {
+	var r = &types.Trigger{
+		ID:         id.Next(),
+		CreatedAt:  time.Now(),
+		WorkflowID: wf.ID,
+	}
+
+	if len(ss) > 1 {
+		r.ResourceType = ss[1]
+	} else {
+		r.ResourceType = "h_" + rs()
+
+	}
+
+	r.Enabled = true
+
+	h.a.NoError(store.CreateAutomationTrigger(context.Background(), service.DefaultStore, r))
+
+	return r
+}
+
+func (h helper) lookupTriggerByID(ID uint64) *types.Trigger {
+	res, err := store.LookupAutomationTriggerByID(context.Background(), service.DefaultStore, ID)
+	h.noError(err)
+	return res
+}
+
+func TestTriggerRead(t *testing.T) {
+	h := newHelper(t)
+	h.clearTriggers()
+
+	wf := h.repoMakeWorkflow()
+	tg := h.repoMakeTrigger(wf)
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "triggers.search")
+
+	h.apiInit().
+		Get(fmt.Sprintf("/triggers/%d", tg.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.resourceType`, tg.ResourceType)).
+		Assert(jsonpath.Equal(`$.response.triggerID`, fmt.Sprintf("%d", tg.ID))).
+		End()
+}
+
+func TestTriggerList(t *testing.T) {
+	h := newHelper(t)
+	h.clearTriggers()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "triggers.search")
+
+	wf := h.repoMakeWorkflow()
+	h.repoMakeTrigger(wf)
+	h.repoMakeTrigger(wf)
+
+	h.apiInit().
+		Get("/triggers/").
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Len(`$.response.set`, 2)).
+		End()
+}
+
+func TestTriggerCreate(t *testing.T) {
+	h := newHelper(t)
+	h.clearTriggers()
+	h.clearWorkflows()
+
+	var (
+		wf  = h.repoMakeWorkflow()
+		req = func() *apitest.Request {
+			return h.apiInit().
+				Post("/triggers/").
+				Header("Accept", "application/json").
+				FormData("name", rs()).
+				FormData("workflowID", fmt.Sprintf("%d", wf.ID))
+
+		}
+	)
+
+	t.Run("allowed", func(t *testing.T) {
+		helpers.AllowMe(h, wf.RbacResource(), "triggers.manage")
+		req().Expect(t).
+			Status(http.StatusOK).
+			Assert(helpers.AssertNoErrors).
+			End()
+	})
+
+	t.Run("denied", func(t *testing.T) {
+		helpers.DenyMe(h, wf.RbacResource(), "triggers.manage")
+		req().Expect(t).
+			Status(http.StatusOK).
+			Assert(helpers.AssertError("trigger.errors.notAllowedToCreate")).
+			End()
+	})
+}
+
+func TestTriggerCreateFull(t *testing.T) {
+	h := newHelper(t)
+
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "triggers.manage")
+
+	h.clearTriggers()
+	var (
+		wf     = h.repoMakeWorkflow()
+		output = &types.Trigger{}
+		stored = &types.Trigger{}
+		input  = &types.Trigger{
+			WorkflowID:   wf.ID,
+			ResourceType: "wf-full-test",
+			Enabled:      true,
+			Input:        expr.EmptyVars(),
+			OwnedBy:      42,
+		}
+	)
+
+	h.apiInit().
+		Post("/triggers/").
+		Header("Accept", "application/json").
+		JSON(helpers.JSON(input)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End().
+		JSON(&struct{ Response *types.Trigger }{output})
+
+	h.a.NotZero(output.ID)
+	h.a.NotZero(output.OwnedBy)
+	h.a.NotNil(output.CreatedAt)
+	h.a.NotZero(output.CreatedBy)
+
+	input.ID = output.ID
+	input.OwnedBy = output.OwnedBy
+	input.CreatedBy = output.CreatedBy
+	input.CreatedAt = output.CreatedAt
+	h.a.NoError(output.Input.ResolveTypes(service.Registry().Type))
+
+	input.Meta = output.Meta
+
+	h.a.Equal(input, output)
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "triggers.search")
+
+	h.apiInit().
+		Get(fmt.Sprintf("/triggers/%d", output.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End().
+		JSON(&struct{ Response *types.Trigger }{stored})
+
+	h.a.NoError(stored.Input.ResolveTypes(service.Registry().Type))
+	input.Meta = stored.Meta
+
+	h.a.Equal(input, stored)
+}
+
+func TestTriggerUpdate(t *testing.T) {
+	h := newHelper(t)
+	h.clearTriggers()
+	h.clearWorkflows()
+
+	var (
+		wf  = h.repoMakeWorkflow()
+		tg1 = h.createTrigger(&types.Trigger{WorkflowID: wf.ID, ResourceType: "as-created"})
+		tg2 = h.createTrigger(&types.Trigger{WorkflowID: wf.ID, ResourceType: "as-created"})
+
+		req = func(id uint64, resType string) *apitest.Request {
+			return h.apiInit().
+				Put(fmt.Sprintf("/triggers/%d", id)).
+				Header("Accept", "application/json").
+				FormData("resourceType", resType)
+
+		}
+	)
+
+	t.Run("allowed", func(t *testing.T) {
+		helpers.AllowMe(h, wf.RbacResource(), "triggers.manage")
+		req(tg1.ID, "foo").Expect(t).
+			Status(http.StatusOK).
+			Assert(helpers.AssertNoErrors).
+			End()
+
+		res := h.lookupTriggerByID(tg1.ID)
+		h.a.NotNil(res)
+		h.a.Equal("foo", res.ResourceType)
+	})
+
+	t.Run("denied", func(t *testing.T) {
+		helpers.DenyMe(h, wf.RbacResource(), "triggers.manage")
+		req(tg2.ID, "bar").Expect(t).
+			Status(http.StatusOK).
+			Assert(helpers.AssertError("trigger.errors.notAllowedToUpdate")).
+			End()
+
+		res := h.lookupTriggerByID(tg2.ID)
+		h.a.NotNil(res)
+		h.a.NotEqual("bar", res.ResourceType)
+	})
+}
+
+func TestTriggerDeleteForbidden(t *testing.T) {
+	h := newHelper(t)
+
+	wf := h.repoMakeWorkflow()
+	res := h.repoMakeTrigger(wf)
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/triggers/%d", res.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("trigger.errors.notAllowedToDelete")).
+		End()
+
+	res = h.lookupTriggerByID(res.ID)
+	h.a.NotNil(res)
+	h.a.Nil(res.DeletedAt)
+}
+
+func TestTriggerDelete(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "triggers.manage")
+
+	wf := h.repoMakeWorkflow()
+	res := h.repoMakeTrigger(wf)
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/triggers/%d", res.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupTriggerByID(res.ID)
+	h.a.NotNil(res)
+	h.a.NotNil(res.DeletedAt)
+}
+
+func TestTriggerUndelete(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "triggers.manage")
+
+	wf := h.repoMakeWorkflow()
+	res := h.repoMakeTrigger(wf)
+
+	h.apiInit().
+		Post(fmt.Sprintf("/triggers/%d/undelete", res.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupTriggerByID(res.ID)
+	h.a.NotNil(res)
+	h.a.Nil(res.DeletedAt)
+}
+
+func TestTriggerLabels(t *testing.T) {
+	h := newHelper(t)
+	h.clearTriggers()
+
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "triggers.manage")
+	helpers.AllowMe(h, types.ComponentRbacResource(), "triggers.search")
+
+	var (
+		ID uint64
+		wf = h.repoMakeWorkflow()
+	)
+
+	t.Run("create", func(t *testing.T) {
+		var (
+			req     = require.New(t)
+			payload = &types.Trigger{}
+		)
+
+		helpers.SetLabelsViaAPI(h.apiInit(), t,
+			"/triggers/",
+			types.Trigger{Labels: map[string]labelTypes.LabelValue{"foo": {Val: "bar"}, "bar": {Val: "42"}}, WorkflowID: wf.ID},
+			payload,
+		)
+		req.NotZero(payload.ID)
+
+		h.a.Equal(payload.Labels["foo"].Val, "bar",
+			"labels must contain foo with value bar")
+		h.a.Equal(payload.Labels["bar"].Val, "42",
+			"labels must contain bar with value 42")
+		req.Equal(helpers.LabelsToStrings(payload.Labels), helpers.LabelsToStrings(helpers.LoadLabelsFromStore(t, service.DefaultStore, payload.LabelResourceKind(), payload.ID)),
+			"response must match stored labels")
+
+		ID = payload.ID
+	})
+
+	t.Run("update", func(t *testing.T) {
+		if ID == 0 {
+			t.Skip("label/create test not ran")
+		}
+
+		var (
+			req     = require.New(t)
+			payload = &types.Trigger{}
+		)
+
+		helpers.SetLabelsViaAPI(h.apiInit(), t,
+			fmt.Sprintf("PUT /triggers/%d", ID),
+			&types.Trigger{Labels: map[string]labelTypes.LabelValue{"foo": {Val: "baz"}, "baz": {Val: "123"}}, WorkflowID: wf.ID},
+			payload,
+		)
+		req.NotZero(payload.ID)
+		//req.Nil(payload.UpdatedAt, "updatedAt must not change after changing labels")
+
+		req.Equal(payload.Labels["foo"].Val, "baz",
+			"labels must contain foo with value baz")
+		req.NotContains(payload.Labels, "bar",
+			"labels must not contain bar")
+		req.Equal(payload.Labels["baz"].Val, "123",
+			"labels must contain baz with value 123")
+		req.Equal(helpers.LabelsToStrings(payload.Labels), helpers.LabelsToStrings(helpers.LoadLabelsFromStore(t, service.DefaultStore, payload.LabelResourceKind(), payload.ID)),
+			"response must match stored labels")
+	})
+
+	t.Run("search", func(t *testing.T) {
+		if ID == 0 {
+			t.Skip("label/create test not ran")
+		}
+
+		var (
+			req    = require.New(t)
+			set    = types.TriggerSet{}
+			params = url.Values{}
+		)
+		params.Add("labels", "baz=123")
+		params.Add("disabled", filter.StateInclusive.String())
+
+		helpers.SearchWithLabelsViaAPI(h.apiInit(), t, "/triggers/", &set, params)
+		req.NotEmpty(set)
+		req.NotNil(set.FindByID(ID))
+		req.NotNil(set.FindByID(ID).Labels)
+	})
+}

server/tests/automation/workflow_test.go

@@ -0,0 +1,504 @@
+package automation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/cortezaproject/corteza/server/automation/service"
+	"github.com/cortezaproject/corteza/server/automation/types"
+	"github.com/cortezaproject/corteza/server/pkg/expr"
+	"github.com/cortezaproject/corteza/server/pkg/filter"
+	"github.com/cortezaproject/corteza/server/pkg/id"
+	labelTypes "github.com/cortezaproject/corteza/server/pkg/label/types"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/tests/helpers"
+	"github.com/steinfletcher/apitest-jsonpath"
+	"github.com/stretchr/testify/require"
+)
+
+func (h helper) clearWorkflows() {
+	h.noError(store.TruncateAutomationWorkflows(context.Background(), service.DefaultStore))
+}
+
+func (h helper) createWorkflow(res *types.Workflow) *types.Workflow {
+	if res.ID == 0 {
+		res.ID = id.Next()
+	}
+
+	if res.CreatedAt.IsZero() {
+		res.CreatedAt = time.Now()
+	}
+
+	h.a.NoError(service.DefaultStore.CreateAutomationWorkflow(context.Background(), res))
+	return res
+}
+
+func (h helper) repoMakeWorkflow(ss ...string) *types.Workflow {
+	var r = &types.Workflow{
+		ID:        id.Next(),
+		CreatedAt: time.Now(),
+		Enabled:   true,
+	}
+
+	if len(ss) > 1 {
+		r.Handle = ss[1]
+	} else {
+		r.Handle = "h_" + rs()
+
+	}
+
+	h.a.NoError(store.CreateAutomationWorkflow(context.Background(), service.DefaultStore, r))
+
+	return r
+}
+
+func (h helper) lookupWorkflowByID(ID uint64) *types.Workflow {
+	res, err := store.LookupAutomationWorkflowByID(context.Background(), service.DefaultStore, ID)
+	h.noError(err)
+	return res
+}
+
+func TestWorkflowRead(t *testing.T) {
+	h := newHelper(t)
+	h.clearWorkflows()
+
+	wf := h.repoMakeWorkflow()
+	helpers.AllowMe(h, wf.RbacResource(), "read")
+
+	h.apiInit().
+		Get(fmt.Sprintf("/workflows/%d", wf.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.handle`, wf.Handle)).
+		Assert(jsonpath.Equal(`$.response.workflowID`, fmt.Sprintf("%d", wf.ID))).
+		End()
+}
+
+func TestWorkflowList(t *testing.T) {
+	h := newHelper(t)
+	h.clearWorkflows()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "workflows.search")
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "read")
+
+	h.repoMakeWorkflow()
+	h.repoMakeWorkflow()
+
+	h.apiInit().
+		Get("/workflows/").
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Len(`$.response.set`, 2)).
+		End()
+}
+
+func TestWorkflowList_filterForbidden(t *testing.T) {
+	h := newHelper(t)
+
+	h.repoMakeWorkflow("workflow")
+	f := h.repoMakeWorkflow()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "workflows.search")
+	helpers.DenyMe(h, f.RbacResource(), "read")
+
+	h.apiInit().
+		Get("/workflows/").
+		Query("handle", f.Handle).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.NotPresent(fmt.Sprintf(`$.response.set[? @.handle=="%s"]`, f.Handle))).
+		End()
+}
+
+func TestWorkflowCreateForbidden(t *testing.T) {
+	h := newHelper(t)
+
+	h.apiInit().
+		Post("/workflows/").
+		Header("Accept", "application/json").
+		FormData("name", rs()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("workflow.errors.notAllowedToCreate")).
+		End()
+}
+
+func TestWorkflowCreateNotUnique(t *testing.T) {
+	h := newHelper(t)
+	h.clearWorkflows()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "workflow.create")
+
+	workflow := h.repoMakeWorkflow()
+	h.apiInit().
+		Post("/workflows/").
+		Header("Accept", "application/json").
+		FormData("meta", fmt.Sprintf(`{"name": "%s"}`, rs())).
+		FormData("handle", workflow.Handle).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("workflow.errors.handleNotUnique")).
+		End()
+}
+
+func TestWorkflowCreate(t *testing.T) {
+	h := newHelper(t)
+	h.clearWorkflows()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "workflow.create")
+
+	h.apiInit().
+		Post("/workflows/").
+		FormData("meta", fmt.Sprintf(`{"name": "%s"}`, rs())).
+		FormData("handle", "handle_"+rs()).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestWorkflowCreateFull(t *testing.T) {
+	h := newHelper(t)
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "workflow.create")
+
+	h.clearWorkflows()
+	var (
+		output = &types.Workflow{}
+		stored = &types.Workflow{}
+		input  = &types.Workflow{
+			Handle: "wf-full-test",
+			Meta: &types.WorkflowMeta{
+				Name:        "name",
+				Description: "desc",
+				Visual:      map[string]interface{}{"foo": "bar"},
+			},
+			Enabled:      true,
+			Trace:        true,
+			KeepSessions: 10000,
+			Scope: func() *expr.Vars {
+				o := &expr.Vars{}
+				_ = o.Set("foo", "bar")
+				return o
+			}(),
+			Steps:   types.WorkflowStepSet{},
+			Paths:   types.WorkflowPathSet{},
+			RunAs:   0,
+			OwnedBy: 42,
+		}
+	)
+
+	h.apiInit().
+		Post("/workflows/").
+		Header("Accept", "application/json").
+		JSON(helpers.JSON(input)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End().
+		JSON(&struct{ Response *types.Workflow }{output})
+
+	h.a.NotZero(output.ID)
+	h.a.NotZero(output.OwnedBy)
+	h.a.NotNil(output.CreatedAt)
+	h.a.NotZero(output.CreatedBy)
+
+	// Make comparing input&output a bit easier
+	input.ID = output.ID
+	input.OwnedBy = output.OwnedBy
+	input.CreatedBy = output.CreatedBy
+	input.CreatedAt = output.CreatedAt
+	h.a.NoError(output.Scope.ResolveTypes(service.Registry().Type))
+
+	h.a.Equal(input, output)
+
+	helpers.AllowMe(h, output.RbacResource(), "read")
+
+	h.apiInit().
+		Get(fmt.Sprintf("/workflows/%d", output.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End().
+		JSON(&struct{ Response *types.Workflow }{stored})
+
+	h.a.NoError(stored.Scope.ResolveTypes(service.Registry().Type))
+
+	h.a.Equal(input, stored)
+}
+
+func TestWorkflowUpdateForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearWorkflows()
+	u := h.repoMakeWorkflow()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/workflows/%d", u.ID)).
+		Header("Accept", "application/json").
+		FormData("meta", fmt.Sprintf(`{"name": "%s"}`, rs())).
+		FormData("email", rs()).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("workflow.errors.notAllowedToUpdate")).
+		End()
+}
+
+func TestWorkflowUpdate(t *testing.T) {
+	h := newHelper(t)
+	h.clearWorkflows()
+	res := h.repoMakeWorkflow()
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "update")
+
+	newName := "updated-" + rs()
+	newHandle := "updated-" + rs()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/workflows/%d", res.ID)).
+		FormData("meta", fmt.Sprintf(`{"name": "%s"}`, newName)).
+		FormData("handle", newHandle).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupWorkflowByID(res.ID)
+	h.a.NotNil(res)
+	h.a.Equal(newHandle, res.Handle)
+}
+
+func TestWorkflowDeleteForbidden(t *testing.T) {
+	h := newHelper(t)
+	u := h.repoMakeWorkflow()
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/workflows/%d", u.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("workflow.errors.notAllowedToDelete")).
+		End()
+}
+
+func TestWorkflowDelete(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "delete")
+
+	res := h.repoMakeWorkflow()
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/workflows/%d", res.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupWorkflowByID(res.ID)
+	h.a.NotNil(res)
+	h.a.NotNil(res.DeletedAt)
+}
+
+func TestWorkflowUndelete(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "undelete")
+
+	res := h.repoMakeWorkflow()
+
+	h.apiInit().
+		Post(fmt.Sprintf("/workflows/%d/undelete", res.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+
+	res = h.lookupWorkflowByID(res.ID)
+	h.a.NotNil(res)
+	h.a.Nil(res.DeletedAt)
+}
+
+func TestWorkflowLabels(t *testing.T) {
+	h := newHelper(t)
+	h.clearWorkflows()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "workflow.create", "workflows.search")
+	helpers.AllowMe(h, types.WorkflowRbacResource(0), "read", "update", "delete")
+
+	var (
+		ID uint64
+	)
+
+	t.Run("create", func(t *testing.T) {
+		var (
+			req     = require.New(t)
+			payload = &types.Workflow{Meta: &types.WorkflowMeta{Name: rs()}}
+		)
+
+		helpers.SetLabelsViaAPI(h.apiInit(), t,
+			"/workflows/",
+			types.Workflow{Labels: map[string]labelTypes.LabelValue{"foo": {Val: "bar"}, "bar": {Val: "42"}}, Meta: &types.WorkflowMeta{Name: rs()}},
+			payload,
+		)
+		req.NotZero(payload.ID)
+
+		h.a.Equal(payload.Labels["foo"].Val, "bar",
+			"labels must contain foo with value bar")
+		h.a.Equal(payload.Labels["bar"].Val, "42",
+			"labels must contain bar with value 42")
+		req.Equal(helpers.LabelsToStrings(payload.Labels), helpers.LabelsToStrings(helpers.LoadLabelsFromStore(t, service.DefaultStore, payload.LabelResourceKind(), payload.ID)),
+			"response must match stored labels")
+
+		ID = payload.ID
+	})
+
+	t.Run("update", func(t *testing.T) {
+		if ID == 0 {
+			t.Skip("label/create test not ran")
+		}
+
+		var (
+			req     = require.New(t)
+			payload = &types.Workflow{}
+		)
+
+		helpers.SetLabelsViaAPI(h.apiInit(), t,
+			fmt.Sprintf("PUT /workflows/%d", ID),
+			&types.Workflow{Labels: map[string]labelTypes.LabelValue{"foo": {Val: "baz"}, "baz": {Val: "123"}}, Meta: &types.WorkflowMeta{Name: rs()}},
+			payload,
+		)
+		req.NotZero(payload.ID)
+		// req.Nil(payload.UpdatedAt, "updatedAt must not change after changing labels")
+
+		req.Equal(payload.Labels["foo"].Val, "baz",
+			"labels must contain foo with value baz")
+		req.NotContains(payload.Labels, "bar",
+			"labels must not contain bar")
+		req.Equal(payload.Labels["baz"].Val, "123",
+			"labels must contain baz with value 123")
+		req.Equal(helpers.LabelsToStrings(payload.Labels), helpers.LabelsToStrings(helpers.LoadLabelsFromStore(t, service.DefaultStore, payload.LabelResourceKind(), payload.ID)),
+			"response must match stored labels")
+	})
+
+	t.Run("search", func(t *testing.T) {
+		if ID == 0 {
+			t.Skip("label/create test not ran")
+		}
+
+		var (
+			req    = require.New(t)
+			set    = types.WorkflowSet{}
+			params = url.Values{}
+		)
+
+		params.Add("labels", "baz=123")
+		params.Add("disabled", filter.StateInclusive.String())
+
+		helpers.SearchWithLabelsViaAPI(h.apiInit(), t, "/workflows/", &set, params)
+		req.NotEmpty(set)
+		req.NotNil(set.FindByID(ID))
+		req.NotNil(set.FindByID(ID).Labels)
+	})
+}
+
+func TestWorkflowStepsPayload(t *testing.T) {
+	wf := &types.Workflow{}
+	h := newHelper(t)
+	helpers.AllowMe(h, types.ComponentRbacResource(), "workflow.create")
+
+	h.apiInit().
+		Post("/workflows/").
+		JSON(`{
+	"scope": {
+		"foo": { "@type": "String", "@value": "" },
+		"bar": { "@type": "String", "@value": "" },
+		"baz": { "@type": "String", "@value": "" },
+		"hgtg": { "@type": "Integer", "@value": 42 }
+	},
+	
+	"meta": {
+		"name": "name of the workdflow",
+		"description": "lorem ipsum dolor sit...",
+		"visual":  { "arbitrary key": "arbitrary value" }
+	},
+	
+	"steps": [
+		{ "stepID": "100",
+		  "kind":   "expressions",
+		  "arguments": [
+			  { "name":  "foo", "expr": "\"foo\"" },
+			  { "name":  "bar", "expr": "\"bar\"" }
+		  ],
+		  "meta": { "name": "step name text", "description": "step description text", "visual":  { "arbitrary key": "arbitrary value" }}
+		},
+		{ "stepID": "101",
+		  "kind":   "expressions",
+		  
+		  "arguments": [
+			  { "name":  "foo", "expr": "\"foo\"" },
+			  { "name":  "bar", "expr": "\"bar\"" }
+		  ] 
+		},
+		
+		{ "stepID": "200", "kind": "gateway", "ref": "join" },
+		{ "stepID": "201", "kind": "gateway", "ref": "fork" },
+		{ "stepID": "202", "kind": "gateway", "ref": "excl" },
+		{ "stepID": "203", "kind": "gateway", "ref": "incl" },
+		
+		{ "stepID": "300",
+		  "kind":   "function",
+		  "ref":    "serverSideFuncRef",
+		  "meta": { "description": "ref needs to come from a predefined list of registered functions; arguments pick values from scope and need to be compatible with registered function's parameters; same goes for results" },
+		  
+		  "arguments": [
+			  { "name":  "arg1", "expr": "foo" },
+			  { "name":  "arg2", "expr": "hgtg * 2" }
+		  ],
+		  
+		  "results": [
+			  { "name":  "scopeVar1", "expr": "nameOfVarFromFunctionsResult1" },
+			  { "name":  "scopeVar2", "expr": "nameOfVarFromFunctionsResult2" }
+		  ] 
+		},
+		{ "stepID": "400",
+		  "kind":   "prompt",
+		  "ref":    "clientPromptRef",
+		  "meta": { "description": "backed does not need to know about ref, it only cares that input data (when resuming session) is compatible with arguments (and tests there)" },
+		  
+		  "arguments": [
+			  { "name":  "foo", "expr": "inputVar1",
+				"tests": [
+					{ "expr": "inputVar1 != \"\"", "error": "expecting inputVar1 to be non-empty string" }
+				]
+			  },
+			  { "name":  "bar", "expr": "inputVar2" }
+		  ]
+		}
+	],
+	
+	"paths": [
+		{ "parentID":  "201", "childID":  "300", "expr": "hgtg == 42",
+		  "meta": { "name": "...", "description": "only if equals 42" } },
+		{ "parentID":  "201", "childID":  "400",
+		  "meta": { "name": "...", "description": "else" } }
+	]
+}`).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End().
+		JSON(&struct{ Response *types.Workflow }{Response: wf})
+}