merge: integrate WP6-05 baseline for TASK-WP6-04
# Conflicts: # apps/api/src/app.ts # apps/api/src/main.ts # apps/web/src/generated/api/sdk.gen.ts # apps/web/src/generated/api/types.gen.ts # apps/web/src/main.tsx # openapi/openapi.json # package.json
This commit is contained in:
suyx
@@ -0,0 +1,179 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { mkdtempSync, rmSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { createAdminServicesStorageProvider } from "../../apps/api/src/admin-state.js";
|
||||
import { ManagedStorage } from "../../apps/api/src/managed-storage.js";
|
||||
import { ModelConfigurationService } from "../../apps/api/src/model-configuration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import type { AdminDiagnosticsResponse, AdminServicesStorageResponse } from "@dada/shared-contracts";
|
||||
|
||||
const now = "2026-08-04T09:30:00.000Z";
|
||||
const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
const roots: string[] = [];
|
||||
const registrations: RegistrationService[] = [];
|
||||
const storages: ManagedStorage[] = [];
|
||||
|
||||
const servicesFixture: AdminServicesStorageResponse = {
|
||||
generated_at: now,
|
||||
services: [
|
||||
{ checked_at: now, configured: true, impact_scope: "authentication", pause_reason: null, service_id: "resend", status: "active" },
|
||||
{ checked_at: now, configured: true, impact_scope: "location", pause_reason: "quota_exhausted", service_id: "amap", status: "paused_quota" },
|
||||
{ checked_at: now, configured: true, impact_scope: "generation", pause_reason: "balance_insufficient", service_id: "ai_gateway", status: "degraded" },
|
||||
{ checked_at: now, configured: true, impact_scope: "generation", pause_reason: "worker_stopped", service_id: "worker", status: "degraded" },
|
||||
{ checked_at: now, configured: true, impact_scope: "api", pause_reason: null, service_id: "api", status: "active" },
|
||||
{ checked_at: now, configured: true, impact_scope: "storage", pause_reason: null, service_id: "asset_root", status: "active" },
|
||||
],
|
||||
storage: {
|
||||
capacity_notice_level: "warning",
|
||||
cleanup_pending_count: 2,
|
||||
data_root_ref: "configured_local_data_root",
|
||||
hard_limit_bytes: 5_368_709_120,
|
||||
last_measured_at: now,
|
||||
managed_content_bytes: 4_563_402_752,
|
||||
remeasurement_required: false,
|
||||
status: "active",
|
||||
storage_backend: "local_filesystem",
|
||||
},
|
||||
};
|
||||
|
||||
const diagnosticsFixture: AdminDiagnosticsResponse = {
|
||||
generated_at: now,
|
||||
diagnostic_text: "Dada P0-A\napp_version=0.0.0\napi_status=ready\nworker_status=ready\nstorage_status=active",
|
||||
services: servicesFixture,
|
||||
system: {
|
||||
api_status: "ready",
|
||||
app_version: "0.0.0",
|
||||
browser_support: [{ brand: "Google Chrome", major: 128 }, { brand: "Microsoft Edge", major: 128 }],
|
||||
worker_status: "ready",
|
||||
},
|
||||
};
|
||||
|
||||
function createRegistration() {
|
||||
const root = mkdtempSync(join(tmpdir(), "dada-wp6-05-api-"));
|
||||
roots.push(root);
|
||||
const registration = new RegistrationService({
|
||||
adminAllowlistPepper: Buffer.alloc(32, 0xe1),
|
||||
challengePepper: Buffer.alloc(32, 0xe2),
|
||||
clock: () => Date.parse(now),
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
|
||||
databasePath: join(root, "dada.sqlite3"),
|
||||
invitePepper: Buffer.alloc(32, 0xe3),
|
||||
resend: new MockResendAdapter(),
|
||||
sessionPepper: Buffer.alloc(32, 0xe4),
|
||||
});
|
||||
registrations.push(registration);
|
||||
return registration;
|
||||
}
|
||||
|
||||
function seedAdmin(registration: RegistrationService) {
|
||||
const userId = randomUUID();
|
||||
registration.database.prepare(`
|
||||
INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
|
||||
VALUES (?, ?, 'super_admin', 'active', 0, ?, ?)
|
||||
`).run(userId, `${userId}@example.invalid`, randomUUID(), Date.parse(now));
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
|
||||
return registration.issueAuthenticatedSession(userId, "admin");
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const storage of storages.splice(0)) storage.close();
|
||||
for (const registration of registrations.splice(0)) registration.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe("admin status aggregation", () => {
|
||||
it("reads storage and runtime truth without fabricating provider readiness", () => {
|
||||
const registration = createRegistration();
|
||||
const root = roots[roots.length - 1]!;
|
||||
const storage = new ManagedStorage({ dataRoot: root, databasePath: join(root, "dada.sqlite3") });
|
||||
storages.push(storage);
|
||||
const models = new ModelConfigurationService({ database: registration.database, clock: () => Date.parse(now) });
|
||||
const state = createAdminServicesStorageProvider({ database: registration.database, models, storage, clock: () => Date.parse(now) })();
|
||||
expect(new Set(state.services.map((service) => service.service_id)).size).toBe(6);
|
||||
expect(state.services.find((service) => service.service_id === "worker")?.status).toBe("unavailable");
|
||||
expect(state.services.find((service) => service.service_id === "ai_gateway")?.status).toBe("degraded");
|
||||
expect(state.storage.storage_backend).toBe("local_filesystem");
|
||||
expect(JSON.stringify(state)).not.toContain("http");
|
||||
expect(JSON.stringify(state)).not.toContain("@example");
|
||||
});
|
||||
});
|
||||
|
||||
describe("TDD-WP6-STATE-001-three-model-states", () => {
|
||||
it("requires an active admin session and keeps model/service state provider-backed", async () => {
|
||||
const registration = createRegistration();
|
||||
let serviceCalls = 0;
|
||||
const app = await createApp({
|
||||
adminDiagnostics: async () => diagnosticsFixture,
|
||||
adminServicesStorage: async () => {
|
||||
serviceCalls += 1;
|
||||
return servicesFixture;
|
||||
},
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
|
||||
const denied = await app.inject({ headers, method: "GET", url: "/api/v1/admin/services-storage" });
|
||||
expect(denied.statusCode).toBe(401);
|
||||
expect(serviceCalls).toBe(0);
|
||||
|
||||
const session = seedAdmin(registration);
|
||||
const authorizedHeaders = { ...headers, cookie: `dada_admin_session=${session.sessionToken}` };
|
||||
const state = await app.inject({ headers: authorizedHeaders, method: "GET", url: "/api/v1/admin/services-storage" });
|
||||
expect(state.statusCode).toBe(200);
|
||||
expect(state.json()).toEqual(servicesFixture);
|
||||
expect(serviceCalls).toBe(1);
|
||||
expect(JSON.stringify(state.json()).toLowerCase()).not.toMatch(/secret|password|email|absolute/);
|
||||
|
||||
const diagnostic = await app.inject({ headers: authorizedHeaders, method: "GET", url: "/api/v1/admin/diagnostics" });
|
||||
expect(diagnostic.statusCode).toBe(200);
|
||||
expect(diagnostic.json()).toEqual(diagnosticsFixture);
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
|
||||
describe("TDD-WP6-DIAG-001-redacted-diagnostics", () => {
|
||||
it("rejects a provider diagnostic that contains a credential or absolute path trap", async () => {
|
||||
const registration = createRegistration();
|
||||
const app = await createApp({
|
||||
adminDiagnostics: async () => ({ ...diagnosticsFixture, diagnostic_text: "api_key=trap C:\\Users\\dada\\secret.txt" }),
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
const session = seedAdmin(registration);
|
||||
const response = await app.inject({
|
||||
headers: { ...headers, cookie: `dada_admin_session=${session.sessionToken}` },
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/diagnostics",
|
||||
});
|
||||
expect(response.statusCode).toBe(503);
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("rejects a sensitive nested service reason even when diagnostic text is clean", async () => {
|
||||
const registration = createRegistration();
|
||||
const app = await createApp({
|
||||
adminDiagnostics: async () => ({
|
||||
...diagnosticsFixture,
|
||||
services: {
|
||||
...servicesFixture,
|
||||
services: servicesFixture.services.map((service) => service.service_id === "resend" ? { ...service, pause_reason: "password" } : service),
|
||||
},
|
||||
}),
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
const session = seedAdmin(registration);
|
||||
const response = await app.inject({ headers: { ...headers, cookie: `dada_admin_session=${session.sessionToken}` }, method: "GET", url: "/api/v1/admin/diagnostics" });
|
||||
expect(response.statusCode).toBe(503);
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user