smartbotic/tests/nodes/workflow-other-collection-refused.json

{
  "name": "verify-workflow-other-collection-refused",
  "comment": "Another workflow's private storage is refused even when this workflow's defaultAccess is read-write. defaultAccess is the dangerous case, not an explicit grant: it is a blanket yes to every name the workflow has not listed, so without a check ahead of it a single careless setting reaches every other workflow's data, across projects.\n\nThe control node is the point of the test. It writes, under the same defaultAccess, to an ordinary collection the workflow was never granted by name, and must succeed. That is what makes the refusal above mean something: writes are working and defaultAccess is being honoured, so the wf_ name was refused for being a wf_ name and not because this workflow could not write anywhere. Without the control the case would pass just as happily if storage were broken outright.",
  "settings": {
    "storagePermissions": {
      "defaultAccess": "read-write"
    }
  },
  "nodes": [
    {
      "id": "n1",
      "name": "Trigger",
      "type": "click-trigger",
      "position": { "x": 0, "y": 0 },
      "config": {}
    },
    {
      "id": "other",
      "name": "Write to another workflow's storage",
      "type": "storage-insert",
      "position": { "x": 0, "y": 100 },
      "config": {
        "collectionSource": "manual",
        "collectionManual": "wf_00000000-0000-0000-0000-000000000000",
        "documentData": "{\"probe\": \"trespass\"}"
      }
    },
    {
      "id": "control",
      "name": "Write to an ordinary collection it was never granted by name",
      "type": "storage-insert",
      "position": { "x": 0, "y": 200 },
      "config": {
        "collectionSource": "manual",
        "collectionManual": "wfprobe_absent_collection",
        "documentData": "{\"probe\": \"control\"}"
      }
    }
  ],
  "connections": [
    {
      "sourceNodeId": "n1",
      "sourceOutput": "main",
      "targetNodeId": "other",
      "targetInput": "data"
    },
    {
      "sourceNodeId": "other",
      "sourceOutput": "main",
      "targetNodeId": "control",
      "targetInput": "data"
    }
  ],
  "expect": {
    "other": {
      "status": "completed",
      "output": { "success": false, "error": "No write access to collection: wf_00000000-0000-0000-0000-000000000000" }
    },
    "control": {
      "status": "completed",
      "output": { "success": true }
    }
  }
}