feat(submit): submit v3 con validación de integridad server-side [4G]
RPC transaccional SECURITY DEFINER (rpc_submit_response) como único camino de escritura. Dropea las policies WITH CHECK(true): cierra la falla donde anon podía insertar cualquier cosa. Validación server-side (7 checks) reusando el motor. Persistencia atómica con instance_id por instancia. Verificado contra Postgres real: instancias separadas, atomicidad, RLS. Riesgo residual de bypass por REST documentado (SEC-004). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
markosbenitez
@@ -176,7 +176,8 @@ export function setAnswer(
|
||||
}
|
||||
}
|
||||
|
||||
function isAnswerEmpty(v: AnswerValue | undefined): boolean {
|
||||
/** Exportada porque también la usa el validador de submit server-side (4G). */
|
||||
export function isAnswerEmpty(v: AnswerValue | undefined): boolean {
|
||||
return v === null || v === undefined || v === '' || (Array.isArray(v) && v.length === 0)
|
||||
}
|
||||
|
||||
|
||||
232
lib/submit-validation.test.mts
Normal file
232
lib/submit-validation.test.mts
Normal file
@@ -0,0 +1,232 @@
|
||||
// Tests Node puros (sin navegador, sin DB) del validador server-side de submit.
|
||||
// Ejecutar: node --test lib/submit-validation.test.mts
|
||||
import { test, describe } from 'node:test'
|
||||
import assert from 'node:assert/strict'
|
||||
import { buildFormSchema } from './form-engine.ts'
|
||||
import { validateSubmission } from './submit-validation.ts'
|
||||
import type { ConditionalRule, Question } from './form-engine.types.ts'
|
||||
import type { SubmitAnswerEntry } from './submit-validation.ts'
|
||||
|
||||
function q(partial: Partial<Question> & Pick<Question, 'code' | 'type' | 'prompt' | 'position'>): Question {
|
||||
return {
|
||||
id: partial.code,
|
||||
is_sensitive: false,
|
||||
required: false,
|
||||
hint: null,
|
||||
options: null,
|
||||
max_select: null,
|
||||
conditional_rules: null,
|
||||
instance_generator: false,
|
||||
instance_of: null,
|
||||
...partial,
|
||||
}
|
||||
}
|
||||
|
||||
const r_show_si_3_1: ConditionalRule[] = [
|
||||
{ if_question: '3.1', op: 'eq', value: 'Sí', action: 'show' },
|
||||
]
|
||||
|
||||
const VINCULOS = ['Hijo menor con discapacidad', 'Familiar mayor con discapacidad', 'Otro / Especificar']
|
||||
|
||||
function buildFixtureSchema() {
|
||||
const rows: Question[] = [
|
||||
q({ code: 'S2', type: 'section', prompt: 'Datos generales', position: 20 }),
|
||||
q({
|
||||
code: '2.5', type: 'single_choice', prompt: 'Género', position: 25, required: true,
|
||||
options: [{ value: 'Femenino', label: 'Femenino' }, { value: 'Masculino', label: 'Masculino' }],
|
||||
}),
|
||||
|
||||
q({ code: 'S3', type: 'section', prompt: 'Prevalencia', position: 30 }),
|
||||
q({
|
||||
code: '3.1', type: 'single_choice', prompt: '¿Tenés discapacidad?', position: 31,
|
||||
options: [{ value: 'Sí', label: 'Sí' }, { value: 'No', label: 'No' }],
|
||||
}),
|
||||
q({
|
||||
code: '3.2', type: 'multiple_choice', prompt: 'Tipo', position: 32, conditional_rules: r_show_si_3_1,
|
||||
options: [{ value: 'Visual', label: 'Visual' }, { value: 'Auditiva', label: 'Auditiva' }],
|
||||
}),
|
||||
|
||||
q({ code: 'S4', type: 'section', prompt: 'Vinculación familiar', position: 40 }),
|
||||
q({
|
||||
code: '4.1', type: 'multiple_choice', prompt: 'Vínculos', position: 41, instance_generator: true,
|
||||
options: VINCULOS.map((v) => ({ value: v, label: v })),
|
||||
}),
|
||||
q({
|
||||
code: '4.2', type: 'multiple_choice', prompt: 'Tipo familiar', position: 42, instance_of: '4.1',
|
||||
max_select: 2,
|
||||
options: [{ value: 'Visual', label: 'Visual' }, { value: 'Auditiva', label: 'Auditiva' }],
|
||||
}),
|
||||
]
|
||||
return buildFormSchema(rows)
|
||||
}
|
||||
|
||||
// ── Happy path: 2 familiares ──────────────────────────────────────────────
|
||||
test('happy path: submit válido con 2 familiares — payload completo con instance_id', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '3.1', instanceId: 'default', value: 'No' }, // oculta 3.2 — no se manda
|
||||
{ code: '4.1', instanceId: 'default', value: [VINCULOS[0], VINCULOS[1]] },
|
||||
{ code: '4.2', instanceId: 'familiar_1', value: ['Visual'] },
|
||||
{ code: '4.2', instanceId: 'familiar_2', value: ['Auditiva'] },
|
||||
]
|
||||
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, true)
|
||||
if (!result.ok) return
|
||||
|
||||
// ── Dato concreto pedido en el reporte: filas reales con instance_id ──
|
||||
console.log('\nPayload validado → filas listas para la RPC (questionId/instanceId/value):')
|
||||
console.log(JSON.stringify(result.rows, null, 2))
|
||||
|
||||
assert.equal(result.rows.length, 5)
|
||||
const f1 = result.rows.find((r) => r.questionId === '4.2' && r.instanceId === 'familiar_1')
|
||||
const f2 = result.rows.find((r) => r.questionId === '4.2' && r.instanceId === 'familiar_2')
|
||||
assert.deepEqual(f1?.value, ['Visual'])
|
||||
assert.deepEqual(f2?.value, ['Auditiva'])
|
||||
})
|
||||
|
||||
describe('rechazos — las 7 validaciones', () => {
|
||||
test('rechaza respuesta a una pregunta que el flujo nunca debió mostrar (3.2 con 3.1=No)', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '3.1', instanceId: 'default', value: 'No' },
|
||||
{ code: '3.2', instanceId: 'default', value: ['Visual'] }, // 3.1='No' la oculta
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.startsWith('question_should_be_hidden:3.2')))
|
||||
})
|
||||
|
||||
test('rechaza valor fuera de las opciones válidas', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '3.1', instanceId: 'default', value: 'Tal vez' }, // no es 'Sí' ni 'No'
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.includes('value_not_in_options') && e.includes('3.1')))
|
||||
})
|
||||
|
||||
test('rechaza max_select excedido (4.2 tiene max_select=2)', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '4.1', instanceId: 'default', value: [VINCULOS[0]] },
|
||||
{ code: '4.2', instanceId: 'familiar_1', value: ['Visual', 'Auditiva', 'Visual'] }, // 3 > max_select(2)
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.includes('exceeds_max_select')))
|
||||
})
|
||||
|
||||
test('rechaza instancia inventada (familiar que 4.1 no generó)', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '4.1', instanceId: 'default', value: [VINCULOS[0]] }, // genera solo familiar_1
|
||||
{ code: '4.2', instanceId: 'familiar_2', value: ['Visual'] }, // familiar_2 NO existe
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.startsWith('invalid_instance:4.2:familiar_2')))
|
||||
})
|
||||
|
||||
test('rechaza instance_id en una pregunta que no es de instancia', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'familiar_1', value: 'Femenino' }, // 2.5 no es instance_of nada
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.startsWith('unexpected_instance_id:2.5')))
|
||||
})
|
||||
|
||||
test('rechaza sin consentimiento operativo', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [{ code: '2.5', instanceId: 'default', value: 'Femenino' }]
|
||||
const result = validateSubmission(schema, entries, false)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.includes('consent_operativo_required'))
|
||||
})
|
||||
|
||||
test('rechaza pregunta requerida visible sin responder', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
// 2.5 es required=true y no se manda
|
||||
const entries: SubmitAnswerEntry[] = [{ code: '3.1', instanceId: 'default', value: 'No' }]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.startsWith('required_missing:2.5')))
|
||||
})
|
||||
|
||||
test('rechaza pregunta que no existe en el esquema (code inventado)', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '99.9', instanceId: 'default', value: 'inyectado' },
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.startsWith('unknown_question:99.9')))
|
||||
})
|
||||
|
||||
test('rechaza respuesta a una fila type=section', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: 'S4', instanceId: 'default', value: 'algo' },
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.startsWith('section_is_not_answerable:S4')))
|
||||
})
|
||||
|
||||
test('rechaza valor de tipo incorrecto (string donde se espera array)', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '4.1', instanceId: 'default', value: 'Hijo menor con discapacidad' as unknown as string[] },
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.some((e) => e.includes('expected_array_value')))
|
||||
})
|
||||
|
||||
test('reporta TODOS los errores encontrados, no solo el primero', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '99.9', instanceId: 'default', value: 'inyectado' },
|
||||
{ code: 'S4', instanceId: 'default', value: 'algo' },
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, false)
|
||||
if (result.ok) return
|
||||
assert.ok(result.errors.length >= 2, `esperaba >=2 errores, hubo ${result.errors.length}`)
|
||||
})
|
||||
})
|
||||
|
||||
describe('valores vacíos', () => {
|
||||
test('una entrada con valor vacío no se valida ni se persiste, pero no bloquea el submit', () => {
|
||||
const schema = buildFixtureSchema()
|
||||
const entries: SubmitAnswerEntry[] = [
|
||||
{ code: '2.5', instanceId: 'default', value: 'Femenino' },
|
||||
{ code: '3.1', instanceId: 'default', value: '' }, // vacío — se ignora, no se evalúa su visibilidad
|
||||
]
|
||||
const result = validateSubmission(schema, entries, true)
|
||||
assert.equal(result.ok, true)
|
||||
if (!result.ok) return
|
||||
assert.equal(result.rows.some((r) => r.questionId === '3.1'), false)
|
||||
})
|
||||
})
|
||||
150
lib/submit-validation.ts
Normal file
150
lib/submit-validation.ts
Normal file
@@ -0,0 +1,150 @@
|
||||
// Validación de integridad server-side del submit (Etapa 4G).
|
||||
// REUSA lib/form-engine.ts (resolveVisibility, resolveScreens, expandInstances) —
|
||||
// no reimplementa lógica de flujo. Corre en el servidor (Server Action), nunca
|
||||
// en el cliente: "la validación de cliente es UX, NO seguridad" (BRIEF decisión 15).
|
||||
//
|
||||
// Lo que esta función NO hace: persistir nada. Solo decide si el payload recibido
|
||||
// es coherente con el esquema + el propio flujo declarado por el payload, y si es
|
||||
// así, devuelve las filas listas para insertar (mapeadas a question_id).
|
||||
|
||||
import type { AnswerValue, FormAnswers, FormSchema, Question } from './form-engine.types'
|
||||
// Extensión .ts explícita (no solo en .mts): a diferencia de form-engine.ts —
|
||||
// que solo importa *tipos* de form-engine.types (se borran en runtime, Node
|
||||
// nunca necesita resolverlos) — este archivo importa FUNCIONES reales y
|
||||
// corre tanto bajo Next.js (Server Action) como bajo Node puro (tests). Node
|
||||
// exige extensión explícita para resolver imports de valor; tsconfig.json
|
||||
// habilita allowImportingTsExtensions para permitir esto sin romper tsc.
|
||||
import { answerKey, expandInstances, isAnswerEmpty, resolveScreens, resolveVisibility } from './form-engine.ts'
|
||||
|
||||
export interface SubmitAnswerEntry {
|
||||
code: string
|
||||
/** 'default' para preguntas normales; 'familiar_N' para preguntas de instancia. */
|
||||
instanceId: string
|
||||
value: AnswerValue
|
||||
}
|
||||
|
||||
export interface ValidatedRow {
|
||||
questionId: string
|
||||
instanceId: string
|
||||
value: AnswerValue
|
||||
}
|
||||
|
||||
export type ValidationResult =
|
||||
| { ok: true; rows: ValidatedRow[] }
|
||||
| { ok: false; errors: string[] }
|
||||
|
||||
function validateValueShape(question: Question, value: AnswerValue): string | null {
|
||||
switch (question.type) {
|
||||
case 'yes_no':
|
||||
return value === 'true' || value === 'false' ? null : 'invalid_yes_no_value'
|
||||
|
||||
case 'single_choice': {
|
||||
if (typeof value !== 'string') return 'expected_string_value'
|
||||
if (question.options && !question.options.some((o) => o.value === value)) {
|
||||
return 'value_not_in_options'
|
||||
}
|
||||
return null
|
||||
}
|
||||
|
||||
case 'multiple_choice': {
|
||||
if (!Array.isArray(value)) return 'expected_array_value'
|
||||
if (!value.every((v) => typeof v === 'string')) return 'expected_string_array'
|
||||
if (question.max_select !== null && value.length > question.max_select) {
|
||||
return 'exceeds_max_select'
|
||||
}
|
||||
if (question.options) {
|
||||
const valid = new Set(question.options.map((o) => o.value))
|
||||
if (!value.every((v) => valid.has(v as string))) return 'value_not_in_options'
|
||||
}
|
||||
return null
|
||||
}
|
||||
|
||||
case 'text_short':
|
||||
case 'text_long':
|
||||
return typeof value === 'string' ? null : 'expected_string_value'
|
||||
|
||||
// rating/nps/matrix/ranking/date/slider: no usados por el instrumento v3 hoy.
|
||||
// No se valida su forma específica — si en el futuro se usan, agregar el caso.
|
||||
default:
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Corre las 7 validaciones del punto 4 de ETAPA_4G_PROMPT.md contra el
|
||||
* esquema cargado de la DB. Si CUALQUIERA falla, devuelve ok:false con la
|
||||
* lista completa de errores encontrados (no solo el primero) — el caller
|
||||
* rechaza el submit entero, sin insertar nada.
|
||||
*/
|
||||
export function validateSubmission(
|
||||
schema: FormSchema,
|
||||
entries: SubmitAnswerEntry[],
|
||||
consentOperativo: boolean
|
||||
): ValidationResult {
|
||||
const errors: string[] = []
|
||||
const byCode = new Map(schema.questions.map((q) => [q.code, q] as const))
|
||||
|
||||
// Reconstruye el mismo FormAnswers que tuvo el wizard — las funciones del
|
||||
// motor lo necesitan para evaluar reglas/instancias/visibilidad.
|
||||
const answers: FormAnswers = {}
|
||||
for (const e of entries) answers[answerKey(e.code, e.instanceId)] = e.value
|
||||
|
||||
// 6. Consentimiento operativo requerido presente
|
||||
if (!consentOperativo) errors.push('consent_operativo_required')
|
||||
|
||||
const nonEmpty = entries.filter((e) => !isAnswerEmpty(e.value))
|
||||
|
||||
// 2. Preguntas legítimas · 3. Valores válidos · 5. Instancias legítimas
|
||||
for (const e of nonEmpty) {
|
||||
const q = byCode.get(e.code)
|
||||
if (!q) { errors.push(`unknown_question:${e.code}`); continue }
|
||||
if (q.type === 'section') { errors.push(`section_is_not_answerable:${e.code}`); continue }
|
||||
|
||||
if (q.instance_of) {
|
||||
const generator = byCode.get(q.instance_of)
|
||||
const instances = generator ? expandInstances(generator, answers) : []
|
||||
if (!instances.some((i) => i.instanceId === e.instanceId)) {
|
||||
errors.push(`invalid_instance:${e.code}:${e.instanceId}`)
|
||||
continue
|
||||
}
|
||||
} else if (e.instanceId !== 'default') {
|
||||
errors.push(`unexpected_instance_id:${e.code}:${e.instanceId}`)
|
||||
continue
|
||||
}
|
||||
|
||||
const shapeError = validateValueShape(q, e.value)
|
||||
if (shapeError) errors.push(`${shapeError}:${e.code}`)
|
||||
}
|
||||
if (errors.length > 0) return { ok: false, errors }
|
||||
|
||||
// 4. Visibilidad coherente — cada respuesta corresponde a algo que el
|
||||
// flujo (con las respuestas recibidas) debía mostrar. Usa resolveVisibility
|
||||
// del motor directamente — ninguna lógica de show/hide se repite acá.
|
||||
for (const e of nonEmpty) {
|
||||
const q = byCode.get(e.code)!
|
||||
if (!resolveVisibility(q, answers)) {
|
||||
errors.push(`question_should_be_hidden:${e.code}:${e.instanceId}`)
|
||||
}
|
||||
}
|
||||
if (errors.length > 0) return { ok: false, errors }
|
||||
|
||||
// 7. Requeridas presentes — recorre las pantallas que el motor resuelve
|
||||
// como visibles dadas estas respuestas, exige valor donde required=true.
|
||||
const screens = resolveScreens(schema, answers)
|
||||
for (const s of screens) {
|
||||
if (s.kind !== 'question' || !s.question?.required) continue
|
||||
const v = answers[answerKey(s.question.code, s.instanceId ?? undefined)]
|
||||
if (isAnswerEmpty(v)) {
|
||||
errors.push(`required_missing:${s.question.code}:${s.instanceId ?? 'default'}`)
|
||||
}
|
||||
}
|
||||
if (errors.length > 0) return { ok: false, errors }
|
||||
|
||||
const rows: ValidatedRow[] = nonEmpty.map((e) => ({
|
||||
questionId: byCode.get(e.code)!.id,
|
||||
instanceId: e.instanceId,
|
||||
value: e.value,
|
||||
}))
|
||||
|
||||
return { ok: true, rows }
|
||||
}
|
||||
Reference in New Issue
Block a user