tablo-core 0.10.0

The core toolkit types for Tablo, a server-rendered admin toolkit on Topcoat and Toasty.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

use super::*;
use crate::test_support::cx;

/// One boolean vocabulary for framework form flags: `1` and `true` are truthy everywhere
/// (`confirm`, `clear_<field>`), and nothing else is.
#[test]
fn truthy_accepts_one_vocabulary() {
    assert!(truthy("1") && truthy("true"));
    assert!(!truthy("yes") && !truthy("") && !truthy("on") && !truthy("TRUE"));
}

#[test]
fn reject_unknown_form_keys_allows_declared_plus_csrf() {
    use crate::schema::{Field, Schema};

    #[derive(Debug, toasty::Model)]
    struct Member {
        #[key]
        #[auto]
        id: uuid::Uuid,
        name: String,
    }
    let schema = Schema::new(Field::text(Member::fields().name()));

    let unclaimed = |posted: &[(&str, &str)]| {
        let posted: Vec<(String, String)> = posted
            .iter()
            .map(|(key, value)| (key.to_string(), value.to_string()))
            .collect();
        schema.read_unclaimed(&cx(), &posted).unwrap().1
    };

    // Declared keys + csrf_token pass.
    let posted = unclaimed(&[("name", "Ada"), (crate::csrf::FIELD_NAME, "some-token")]);
    assert!(reject_unknown_form_keys(&schema, posted).is_ok());

    // Absent keys are fine: an edit completes them from the stored record.
    let posted = unclaimed(&[(crate::csrf::FIELD_NAME, "some-token")]);
    assert!(reject_unknown_form_keys(&schema, posted).is_ok());

    // role/tenant_id smuggling is a 400.
    let posted = unclaimed(&[("name", "Ada"), ("role", "admin"), ("tenant_id", "victim")]);
    assert!(reject_unknown_form_keys(&schema, posted).is_err());
}