feat: complete TASK-WP0-06 public cache

2026-07-27 23:05:23 +08:00
parent e12a83d6d3
commit 2dd6f5c2c2
11 changed files with 775 additions and 2 deletions
@@ -0,0 +1,119 @@
+import { createHash } from "node:crypto";
+
+import { describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import {
+  MAX_PUBLIC_CACHE_BYTES,
+  buildPublicAssetUrl,
+  isPublicCacheDescriptor,
+  isPublicServiceWorkerRoute,
+  planPublicCacheWrite,
+  type PublicAssetLruEntry,
+} from "../../apps/web/src/public-asset-cache.js";
+
+const resourceIds = [
+  "123e4567-e89b-42d3-a456-426614174001",
+  "123e4567-e89b-42d3-a456-426614174002",
+  "123e4567-e89b-42d3-a456-426614174003",
+  "123e4567-e89b-42d3-a456-426614174004",
+] as const;
+
+describe("TDD-WP0-CACHE-001 public allowlist LRU", () => {
+  it("freezes the 150 MiB policy and allows exact equality", () => {
+    expect(MAX_PUBLIC_CACHE_BYTES).toBe(157_286_400);
+    const plan = planPublicCacheWrite([], {
+      bytes: MAX_PUBLIC_CACHE_BYTES,
+      last_accessed_at: 4,
+      release_version: "asset-20260727.2",
+      resource_id: resourceIds[0],
+    }, MAX_PUBLIC_CACHE_BYTES);
+    expect(plan).toEqual({ accepted: true, evict: [], resulting_bytes: MAX_PUBLIC_CACHE_BYTES });
+    expect(planPublicCacheWrite([], {
+      bytes: MAX_PUBLIC_CACHE_BYTES + 1,
+      last_accessed_at: 4,
+      release_version: "asset-20260727.2",
+      resource_id: resourceIds[0],
+    }, MAX_PUBLIC_CACHE_BYTES)).toEqual({ accepted: false, evict: [], resulting_bytes: 0 });
+  });
+
+  it("evicts old releases first and then the least recently used entry before writing", () => {
+    const entries: PublicAssetLruEntry[] = [
+      { bytes: 40, last_accessed_at: 30, release_version: "asset-20260727.1", resource_id: resourceIds[0] },
+      { bytes: 40, last_accessed_at: 10, release_version: "asset-20260727.1", resource_id: resourceIds[1] },
+      { bytes: 40, last_accessed_at: 1, release_version: "asset-20260727.2", resource_id: resourceIds[2] },
+    ];
+    const plan = planPublicCacheWrite(entries, {
+      bytes: 40,
+      last_accessed_at: 40,
+      release_version: "asset-20260727.2",
+      resource_id: resourceIds[3],
+    }, 120);
+    expect(plan).toEqual({ accepted: true, evict: [resourceIds[1]], resulting_bytes: 120 });
+  });
+
+  it.each([
+    { access_class: "internal_preview_asset", cache_kind: "thumbnail" },
+    { access_class: "private_user_asset", cache_kind: "thumbnail" },
+    { access_class: "public_release_asset", cache_kind: "sticker_original" },
+    { access_class: "public_release_asset", cache_kind: "generation" },
+    { access_class: "public_release_asset", cache_kind: "export" },
+    { access_class: "public_release_asset", cache_kind: "project" },
+    { access_class: "public_release_asset", cache_kind: "prompt" },
+    { access_class: "public_release_asset", cache_kind: "verification_code" },
+    { access_class: "public_release_asset", cache_kind: "session" },
+    { access_class: "public_release_asset", cache_kind: "unsaved_edit" },
+    { access_class: "public_release_asset", cache_kind: "user_download" },
+  ])("rejects non-allowlisted candidate $access_class/$cache_kind", (candidate) => {
+    expect(isPublicCacheDescriptor({
+      ...candidate,
+      release_version: "asset-20260727.2",
+      resource_id: resourceIds[0],
+    })).toBe(false);
+  });
+
+  it.each(["thumbnail", "template_conversion", "font"] as const)("allows public %s only", (cacheKind) => {
+    expect(isPublicCacheDescriptor({
+      access_class: "public_release_asset",
+      cache_kind: cacheKind,
+      release_version: "asset-20260727.2",
+      resource_id: resourceIds[0],
+    })).toBe(true);
+  });
+
+  it("constructs and intercepts only same-origin versioned public asset routes", () => {
+    const url = buildPublicAssetUrl("asset-20260727.2", resourceIds[0]);
+    expect(url).toBe(`/api/v1/assets/public/asset-20260727.2/${resourceIds[0]}`);
+    expect(isPublicServiceWorkerRoute(new URL(url, "http://127.0.0.1:43121"), "http://127.0.0.1:43121")).toBe(true);
+    for (const path of [
+      `/api/v1/assets/preview/asset-20260727.2/${resourceIds[0]}`,
+      `/api/v1/private-assets/${resourceIds[0]}`,
+      `/api/v1/projects/${resourceIds[0]}`,
+      "/api/v1/support/check",
+      "file:///C:/private.png",
+    ]) {
+      expect(isPublicServiceWorkerRoute(new URL(path, "http://127.0.0.1:43121"), "http://127.0.0.1:43121")).toBe(false);
+    }
+  });
+
+  it("serves existing public binaries as immutable versioned responses with a strong ETag", { timeout: 15_000 }, async () => {
+    const bytes = Buffer.from("public-thumbnail");
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    const app = await createApp({
+      browserGate: false,
+      publicAssets: {
+        read: () => ({ assetId: resourceIds[0], bytes, mimeType: "image/png", resourceVersion: "asset-20260727.2", sha256 }),
+      },
+    });
+    const response = await app.inject({
+      headers: { host: "127.0.0.1:43121" },
+      method: "GET",
+      url: `/api/v1/assets/public/asset-20260727.2/${resourceIds[0]}`,
+    });
+    expect(response.statusCode).toBe(200);
+    expect(response.headers["cache-control"]).toBe("public, max-age=31536000, immutable");
+    expect(response.headers.etag).toBe(`"sha256-${sha256}"`);
+    expect(response.headers["x-content-type-options"]).toBe("nosniff");
+    await app.close();
+  });
+});