feat: publish admin sticker releases (TASK-WP5-05)

tests/api/wp5-05-sticker-upload.test.ts

@@ -0,0 +1,109 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { createApp } from "../../apps/api/src/app.js";
+import { ManagedStorage } from "../../apps/api/src/managed-storage.js";
+import { RegistrationService } from "../../apps/api/src/registration.js";
+import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
+import { StickerReleaseService } from "../../apps/api/src/sticker-releases.js";
+
+const now = Date.parse("2026-08-03T12:00:00.000Z");
+const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
+const roots: string[] = [];
+const closeables: Array<{ close(): void }> = [];
+const baseHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
+
+async function multipart() {
+  const form = new FormData();
+  form.append("stable_id", "STK1408");
+  form.append("part", "25");
+  form.append("order", "184");
+  form.append("enabled", "true");
+  form.append("original_byte_size", String(png.byteLength));
+  form.append("original_sha256", createHash("sha256").update(png).digest("hex"));
+  form.append("sticker_file", new Blob([png], { type: "image/png" }), "STK1408.png");
+  const serialized = new Response(form);
+  return { contentType: serialized.headers.get("content-type")!, payload: Buffer.from(await serialized.arrayBuffer()) };
+}
+
+function evidence(value: unknown) {
+  const directory = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
+  if (!directory) return;
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(resolve(directory, "response.json"), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+afterEach(() => {
+  for (const value of closeables.splice(0).reverse()) value.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TASK-WP5-05 admin sticker API", () => {
+  it("requires admin mutation controls, publishes upload, and exposes current and versioned public resources", async () => {
+    const dataRoot = mkdtempSync(join(tmpdir(), "dada-wp5-05-api-"));
+    roots.push(dataRoot);
+    mkdirSync(join(dataRoot, "db"), { recursive: true });
+    const databasePath = join(dataRoot, "db", "dada.sqlite3");
+    const registration = new RegistrationService({
+      challengePepper: Buffer.alloc(32, 0x41), clock: () => now,
+      currentPrivacyNoticeVersion: "p0a-registration-notice-v1", databasePath,
+      invitePepper: Buffer.alloc(32, 0x42), resend: new MockResendAdapter(), sessionPepper: Buffer.alloc(32, 0x43),
+    });
+    const storage = new ManagedStorage({ dataRoot, databasePath });
+    const stickers = new StickerReleaseService({ clock: () => now, databasePath, storage });
+    closeables.push(stickers, storage, registration);
+    const adminId = randomUUID();
+    registration.database.prepare(`INSERT INTO users (
+      user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at
+    ) VALUES (?, 'sticker-admin@example.invalid', 'super_admin', 'active', 0, ?, ?)`).run(adminId, randomUUID(), now);
+    registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId);
+    const session = registration.issueAuthenticatedSession(adminId, "admin");
+    const csrf = registration.issueAdminCsrfToken(session.sessionToken);
+    const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration, stickers });
+    const uploadKey = `sticker-${randomUUID()}-${randomUUID()}`;
+
+    const body = await multipart();
+    const denied = await app.inject({ headers: { ...baseHeaders, "content-type": body.contentType }, method: "POST", payload: body.payload, url: "/api/v1/admin/assets/static-stickers" });
+    expect(denied.statusCode).toBe(401);
+
+    const acceptedBody = await multipart();
+    const accepted = await app.inject({
+      headers: {
+        ...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}`, "content-type": acceptedBody.contentType,
+        "idempotency-key": uploadKey, "x-csrf-token": csrf,
+      },
+      method: "POST", payload: acceptedBody.payload, url: "/api/v1/admin/assets/static-stickers",
+    });
+    expect(accepted.statusCode).toBe(201);
+    expect(accepted.json()).toMatchObject({ item: { stable_id: "STK1408" }, release_version: "asset-20260803.1" });
+    const replayBody = await multipart();
+    const replay = await app.inject({
+      headers: {
+        ...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}`, "content-type": replayBody.contentType,
+        "idempotency-key": uploadKey, "x-csrf-token": csrf,
+      },
+      method: "POST", payload: replayBody.payload, url: "/api/v1/admin/assets/static-stickers",
+    });
+    expect(replay.statusCode).toBe(200);
+    expect(replay.json()).toMatchObject({ created: false, release_version: "asset-20260803.1" });
+    expect(storage.inspectCounts()).toMatchObject({ managed_files: 2 });
+
+    const adminList = await app.inject({ headers: { ...baseHeaders, cookie: `dada_admin_session=${session.sessionToken}` }, method: "GET", url: "/api/v1/admin/assets/static-stickers" });
+    const publicList = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/static-stickers/current" });
+    const original = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/assets/public/asset-20260803.1/STK1408" });
+    const thumbnail = await app.inject({ headers: baseHeaders, method: "GET", url: "/api/v1/assets/public/asset-20260803.1/STK1408?variant=thumbnail" });
+    expect(adminList.statusCode).toBe(200);
+    expect(publicList.json()).toMatchObject({ count: 1, items: [{ stable_id: "STK1408" }] });
+    expect(original.rawPayload).toEqual(png);
+    expect(thumbnail.statusCode).toBe(200);
+    expect(thumbnail.headers["content-type"]).toMatch(/^image\/png/);
+    expect(thumbnail.rawPayload).not.toEqual(png);
+
+    evidence({ admin_list_status: adminList.statusCode, public_count: publicList.json().count, upload_status: accepted.statusCode });
+    await app.close();
+  });
+});

tests/e2e/wp5-05-admin-assets.spec.ts

@@ -0,0 +1,131 @@
+import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { expect, test, type Page } from "@playwright/test";
+import { createServer, type ViteDevServer } from "vite";
+
+let vite: ViteDevServer;
+let webUrl: string;
+const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
+const adminSession = { csrf_token: "csrf-wp5-05-admin-000000000000000000000000000000000" };
+const projectId = "00000000-0000-4000-8000-000000001405";
+const userSession = {
+  audience: "user", authenticated: true, credits: { available_balance: 10, reserved_balance: 0 },
+  csrf_token: "csrf-wp5-05-user-0000000000000000000000000000000000",
+  expires_at: "2026-09-03T12:00:00.000Z",
+  user: { creator_name: "Sticker User", role: "user", social_id: "@sticker", status: "active", user_id: projectId },
+};
+
+function asset(stableId = "STK1408") {
+  return {
+    enabled: true, file_state: "committed", height: 3, mime: "image/png", mime_type: "image/png", order: 184,
+    original_byte_size: png.byteLength, original_filename: `${stableId}.png`, original_reference: `/api/v1/assets/public/asset-20260803.1/${stableId}`,
+    origin: "admin_uploaded", part: 25, relative_path: `managed-assets/stickers/original/${stableId}.png`, resource_version: "asset-20260803.1",
+    sha256: "0".repeat(64), stable_id: stableId, thumbnail_byte_size: 75,
+    thumbnail_reference: { media: "thumbnail", resource_id: stableId, resource_version: "asset-20260803.1", url: `/api/v1/assets/public/asset-20260803.1/${stableId}?variant=thumbnail` }, width: 4,
+  };
+}
+
+function assetsResponse(status: "active" | "full" | "unavailable" = "active", items = [asset()]) {
+  return {
+    count: items.length, items, release_version: items.length ? "asset-20260803.1" : null,
+    storage: { capacity_notice_level: status === "active" ? "normal" : "critical", hard_limit_bytes: 5_368_709_120, managed_content_bytes: status === "full" ? 5_368_709_120 : 150, storage_status: status },
+  };
+}
+
+test.beforeAll(async () => {
+  vite = await createServer({ configFile: resolve("apps/web/vite.config.ts"), root: resolve("apps/web"), server: { host: "127.0.0.1", port: 0 } });
+  await vite.listen();
+  const address = vite.httpServer?.address();
+  if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
+  webUrl = `http://127.0.0.1:${address.port}`;
+});
+
+test.afterAll(async () => vite.close());
+
+async function routeAdminSession(page: Page) {
+  await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify(adminSession), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/assets/public/**", (route) => route.fulfill({ body: png, contentType: "image/png", status: 200 }));
+}
+
+test("TDD-WP5-UPL-001-upload-metering uploads and publishes with stable metadata controls", async ({ page }) => {
+  await routeAdminSession(page);
+  let uploaded = false;
+  let multipartBody = "";
+  await page.route("**/api/v1/admin/assets/static-stickers", async (route) => {
+    if (route.request().method() === "POST") {
+      multipartBody = route.request().postDataBuffer()?.toString("latin1") ?? "";
+      uploaded = true;
+      return route.fulfill({ body: JSON.stringify({ created: true, item: asset(), release_version: "asset-20260803.1" }), contentType: "application/json", status: 201 });
+    }
+    return route.fulfill({ body: JSON.stringify(assetsResponse("active", uploaded ? [asset()] : [])), contentType: "application/json", status: 200 });
+  });
+
+  await page.goto(`${webUrl}/admin/assets`);
+  await expect(page.getByRole("heading", { name: "普通贴纸" })).toBeVisible();
+  await expect(page.getByText("当前没有后台上传的普通贴纸。")).toBeVisible();
+  await page.getByLabel("贴纸文件").setInputFiles({ buffer: png, mimeType: "image/png", name: "STK1408.png" });
+  await page.getByRole("button", { name: "上传并发布" }).click();
+  await expect(page.getByRole("rowheader", { name: /STK1408/ })).toBeVisible();
+  expect(multipartBody).toContain("STK1408");
+  expect(multipartBody).toContain("image/png");
+  expect(multipartBody).toContain("original_sha256");
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
+  if (evidenceRoot) {
+    const directory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(directory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(directory, "admin-assets-uploaded.png") });
+  }
+});
+
+test("storage full disables every upload control and load failure exposes retry", async ({ page }) => {
+  await page.setViewportSize({ height: 844, width: 390 });
+  await routeAdminSession(page);
+  await page.route("**/api/v1/admin/assets/static-stickers", (route) => route.fulfill({ body: JSON.stringify(assetsResponse("full")), contentType: "application/json", status: 200 }));
+  await page.goto(`${webUrl}/admin/assets`);
+  await expect(page.getByText("当前存储状态禁止新增原图和缩略图。")).toBeVisible();
+  await expect(page.getByLabel("贴纸文件")).toBeDisabled();
+  await expect(page.getByRole("button", { name: "上传并发布" })).toBeDisabled();
+  const evidenceRoot = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
+  if (evidenceRoot) {
+    const directory = resolve(evidenceRoot, "screenshots");
+    mkdirSync(directory, { recursive: true });
+    await page.screenshot({ fullPage: true, path: resolve(directory, "admin-assets-full-mobile.png") });
+  }
+
+  await page.unroute("**/api/v1/admin/assets/static-stickers");
+  await page.route("**/api/v1/admin/assets/static-stickers", (route) => route.fulfill({ status: 503 }));
+  await page.reload();
+  await expect(page.getByRole("alert")).toContainText("素材状态暂时无法读取");
+  await expect(page.getByRole("button", { name: "重试" })).toBeVisible();
+});
+
+test("the editor merges the current uploaded release and saves its resource version", async ({ page }) => {
+  let savedResourceVersion = "";
+  let originalRequests = 0;
+  await page.route("**/api/v1/auth/session", (route) => route.fulfill({ body: JSON.stringify(userSession), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/static-stickers/current", (route) => route.fulfill({ body: JSON.stringify({ count: 1, items: [asset()], release_version: "asset-20260803.1" }), contentType: "application/json", status: 200 }));
+  await page.route(`**/api/v1/projects/${projectId}`, (route) => route.fulfill({ body: JSON.stringify({
+    canvas_state: { background: { adjustments: { brightness: 0, contrast: 0, crop: null, filter: "none", fit: "fill", saturation: 0, sharpness: 0, temperature: 0 }, asset_id: null }, elements: [], pixel_height: 1440, pixel_width: 1080, ratio: "3:4", schema_version: 1 },
+    created_at: "2026-08-03T12:00:00.000Z", current_image_id: null, images: [], name: "上传贴纸", project_id: projectId, ratio: "3:4", state_version: 1,
+  }), contentType: "application/json", status: 200 }));
+  await page.route(`**/api/v1/projects/${projectId}/state`, async (route) => {
+    const body = route.request().postDataJSON() as { canvas_state: { elements: Array<{ resource_version: string }> } };
+    savedResourceVersion = body.canvas_state.elements[0]?.resource_version ?? "";
+    await route.fulfill({ body: JSON.stringify({ save_status: "saved", state_version: 2 }), contentType: "application/json", status: 200 });
+  });
+  await page.route("**/api/v1/assets/recent?asset_kind=text_template", (route) => route.fulfill({ body: JSON.stringify({ items: [] }), contentType: "application/json", status: 200 }));
+  await page.route("**/api/v1/assets/public/**", async (route) => {
+    if (!new URL(route.request().url()).searchParams.has("variant")) originalRequests += 1;
+    await route.fulfill({ body: png, contentType: "image/png", status: 200 });
+  });
+
+  await page.goto(`${webUrl}/app/projects/${projectId}/editor`);
+  await page.getByRole("button", { name: "普通贴纸", exact: true }).click();
+  await expect(page.getByText("共 1,408 张", { exact: true })).toBeVisible();
+  const list = page.getByTestId("static-sticker-list");
+  await list.evaluate((element) => { element.scrollTop = element.scrollHeight; element.dispatchEvent(new Event("scroll")); });
+  await list.getByRole("button", { name: "添加贴纸 STK1408" }).click();
+  await expect.poll(() => savedResourceVersion).toBe("asset-20260803.1");
+  await expect.poll(() => originalRequests).toBeGreaterThan(0);
+});

tests/integration/wp5-05-sticker-release.test.ts

@@ -0,0 +1,135 @@
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { Readable } from "node:stream";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { HARD_LIMIT_BYTES, ManagedStorage, StorageCapacityError, StorageUnavailableError } from "../../apps/api/src/managed-storage.js";
+import { StickerReleaseService } from "../../apps/api/src/sticker-releases.js";
+
+const now = Date.parse("2026-08-03T12:00:00.000Z");
+const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
+const webp = Buffer.from("UklGRjoAAABXRUJQVlA4IC4AAADQAQCdASoGAAUAAUAmJaACdLoB+AADsAD+9IiH/pNnibPE2fJI/+Uq8Fjc3wAA", "base64");
+const roots: string[] = [];
+const closeables: Array<{ close(): void }> = [];
+
+function filesBelow(path: string): string[] {
+  if (!existsSync(path)) return [];
+  return readdirSync(path, { withFileTypes: true }).flatMap((entry) => {
+    const child = join(path, entry.name);
+    return entry.isDirectory() ? filesBelow(child) : [child];
+  });
+}
+
+function evidence(name: string, value: unknown) {
+  const directory = process.env.DADA_EVIDENCE_DIR_WP5_UPL;
+  if (!directory) return;
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function fixture() {
+  const dataRoot = mkdtempSync(join(tmpdir(), "dada-wp5-05-integration-"));
+  roots.push(dataRoot);
+  mkdirSync(join(dataRoot, "db"), { recursive: true });
+  const databasePath = join(dataRoot, "db", "dada.sqlite3");
+  const storage = new ManagedStorage({ dataRoot, databasePath });
+  const stickers = new StickerReleaseService({ clock: () => now, databasePath, storage });
+  closeables.push(stickers, storage);
+  return { dataRoot, stickers, storage };
+}
+
+async function upload(stickers: StickerReleaseService, stableId: string, order: number, bytes = png, mimeType: "image/png" | "image/webp" = "image/png") {
+  return stickers.upload({
+    actorId: randomUUID(),
+    content: Readable.from(bytes),
+    enabled: true,
+    expectedByteSize: bytes.byteLength,
+    expectedMimeType: mimeType,
+    expectedSha256: createHash("sha256").update(bytes).digest("hex"),
+    fileName: mimeType === "image/png" ? `${stableId}.png` : `${stableId}.webp`,
+    idempotencyKey: `upload-${randomUUID()}-${randomUUID()}`,
+    order,
+    part: 25,
+    stableId,
+  });
+}
+
+afterEach(() => {
+  for (const value of closeables.splice(0).reverse()) value.close();
+  for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
+});
+
+describe("TDD-WP5-UPL-001 upload metering", () => {
+  it("decodes PNG, publishes an immutable release, meters original and thumbnail, and preserves old release reads", async () => {
+    const test = fixture();
+    const before = { files: filesBelow(join(test.dataRoot, "managed-assets")), state: test.storage.getState() };
+    const published = await upload(test.stickers, "STK1408", 184);
+    const afterUpload = test.storage.getState();
+
+    expect(published.release_version).toBe("asset-20260803.1");
+    expect(published.item).toMatchObject({ enabled: true, height: 3, mime_type: "image/png", origin: "admin_uploaded", stable_id: "STK1408", width: 4 });
+    expect(afterUpload.managed_content_bytes).toBe(published.original.byte_size + published.thumbnail.byte_size);
+    expect(test.storage.inspectCounts()).toMatchObject({ active_reservations: 0, managed_files: 2, pending_cleanup: 0 });
+    expect(filesBelow(join(test.dataRoot, "managed-assets"))).toHaveLength(2);
+    expect(test.stickers.listPublic()).toMatchObject({ count: 1, items: [{ stable_id: "STK1408" }] });
+
+    const disabled = test.stickers.update({ actorId: randomUUID(), enabled: false, stableId: "STK1408" });
+    expect(disabled.release_version).toBe("asset-20260803.2");
+    expect(test.stickers.listPublic().items).toEqual([]);
+    expect(test.stickers.listPublic(published.release_version).items).toHaveLength(1);
+    expect(test.stickers.readPublicAsset(published.release_version, "STK1408", "original")?.bytes).toEqual(png);
+    expect(test.stickers.readPublicAsset(disabled.release_version, "STK1408", "original")).toBeUndefined();
+
+    evidence("fs-before.json", before);
+    evidence("fs-after.json", { files: filesBelow(join(test.dataRoot, "managed-assets")), state: test.storage.getState() });
+    evidence("db-diff.json", { releases: test.stickers.inspectCounts(), storage: test.storage.inspectCounts() });
+  });
+
+  it("allows exact equality then blocks full and unavailable storage without partial files or rows", async () => {
+    const sizing = fixture();
+    const measured = await upload(sizing.stickers, "STK1408", 184);
+    const writeBytes = measured.original.byte_size + measured.thumbnail.byte_size;
+
+    const exact = fixture();
+    exact.storage.applyControlledMeasurement(HARD_LIMIT_BYTES - writeBytes);
+    const exactResult = await upload(exact.stickers, "STK1408", 184);
+    expect(exactResult.original.byte_size + exactResult.thumbnail.byte_size).toBe(writeBytes);
+    expect(exact.storage.getState().storage_status).toBe("full");
+    const filesAtFull = filesBelow(join(exact.dataRoot, "managed-assets"));
+    const countsAtFull = exact.stickers.inspectCounts();
+    await expect(upload(exact.stickers, "STK1409", 185)).rejects.toBeInstanceOf(StorageCapacityError);
+    expect(filesBelow(join(exact.dataRoot, "managed-assets"))).toEqual(filesAtFull);
+    expect(exact.stickers.inspectCounts()).toEqual(countsAtFull);
+
+    const unavailable = fixture();
+    unavailable.storage.setAvailability({ dataRootWritable: false, diskSpaceAvailable: true, sqliteWritable: true });
+    await expect(upload(unavailable.stickers, "STK1408", 184)).rejects.toBeInstanceOf(StorageUnavailableError);
+    expect(filesBelow(join(unavailable.dataRoot, "managed-assets"))).toEqual([]);
+    expect(unavailable.stickers.inspectCounts()).toEqual({ items: 0, releases: 0, upload_receipts: 0 });
+  });
+
+  it("rejects a forged PNG before release or managed-file commit", async () => {
+    const test = fixture();
+    const forged = Buffer.concat([png.subarray(0, 8), Buffer.from("not-a-decodable-png")]);
+    await expect(upload(test.stickers, "STK1408", 184, forged)).rejects.toThrow("content_decode_invalid");
+    expect(test.storage.inspectCounts()).toMatchObject({ active_reservations: 0, managed_files: 0 });
+    expect(test.stickers.inspectCounts()).toEqual({ items: 0, releases: 0, upload_receipts: 0 });
+    expect(filesBelow(join(test.dataRoot, "managed-assets"))).toEqual([]);
+  });
+
+  it("decodes WebP and rejects stable-ID or part-order conflicts without extra writes", async () => {
+    const test = fixture();
+    const published = await upload(test.stickers, "STK1408", 184, webp, "image/webp");
+    expect(published.item).toMatchObject({ height: 5, mime_type: "image/webp", width: 6 });
+    expect(test.stickers.readPublicAsset(published.release_version, "STK1408", "original")?.bytes).toEqual(webp);
+    const files = filesBelow(join(test.dataRoot, "managed-assets"));
+    const counts = test.stickers.inspectCounts();
+    await expect(upload(test.stickers, "STK1408", 185)).rejects.toMatchObject({ httpStatus: 409, reason: "sticker_stable_id_conflict" });
+    await expect(upload(test.stickers, "STK1409", 184)).rejects.toMatchObject({ httpStatus: 409, reason: "sticker_order_conflict" });
+    expect(filesBelow(join(test.dataRoot, "managed-assets"))).toEqual(files);
+    expect(test.stickers.inspectCounts()).toEqual(counts);
+  });
+});