ruact 0.0.5 → 0.0.7

data/spec/ruact/manifest_resolver_spec.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "net/http"
+require "tmpdir"
+
+module Ruact
+  RSpec.describe ManifestResolver do
+    # spec_helper pins resolve/resolve_soft to the boot manifest suite-wide for
+    # hermeticity; this spec is the one place that exercises the REAL paths.
+    before do
+      allow(described_class).to receive(:resolve).and_call_original
+      allow(described_class).to receive(:resolve_soft).and_call_original
+    end
+
+    let(:manifest_hash) do
+      {
+        "LikeButton" => {
+          "id" => "/LikeButton.jsx",
+          "name" => "LikeButton",
+          "chunks" => ["/LikeButton.jsx"]
+        }
+      }
+    end
+    let(:manifest_json) { JSON.generate(manifest_hash) }
+
+    # A real Net::HTTPSuccess (HTTPOK < HTTPSuccess) whose body we override, so
+    # the resolver's `response.is_a?(Net::HTTPSuccess)` branch is exercised for
+    # real without touching the network.
+    def http_ok(body)
+      response = Net::HTTPOK.new("1.1", "200", "OK")
+      response.define_singleton_method(:body) { body }
+      response
+    end
+
+    def in_dev
+      allow(Rails).to receive(:env).and_return(ActiveSupport::StringInquirer.new("development"))
+    end
+
+    describe ".resolve in development (the boot-race)" do
+      before do
+        in_dev
+        # Simulate the race: boot read the missing file, so the cached manifest is nil.
+        allow(Ruact).to receive(:manifest).and_return(nil)
+      end
+
+      it "resolves from the Vite dev server over HTTP (no 500, ref resolvable)" do
+        allow(Net::HTTP).to receive(:start).and_return(http_ok(manifest_json))
+
+        manifest = described_class.resolve
+
+        expect(manifest).to be_a(ClientManifest)
+        ref = manifest.reference_for("LikeButton")
+        expect(ref.module_id).to eq("/LikeButton.jsx")
+      end
+
+      it "fetches the manifest from the configured vite_dev_server URL" do
+        allow(Net::HTTP).to receive(:start).and_return(http_ok(manifest_json))
+
+        described_class.resolve
+
+        expect(Net::HTTP).to have_received(:start).with(
+          "localhost", 5173, hash_including(:open_timeout, :read_timeout)
+        )
+      end
+
+      it "does not double-slash the path when vite_dev_server has a trailing slash" do
+        allow(described_class).to receive(:base_url).and_return("http://localhost:5173/")
+        http = instance_double(Net::HTTP)
+        allow(http).to receive(:get).and_return(http_ok(manifest_json))
+        allow(Net::HTTP).to receive(:start).and_yield(http).and_return(http_ok(manifest_json))
+
+        described_class.resolve
+
+        expect(http).to have_received(:get).with("/__ruact/manifest")
+      end
+
+      it "speaks TLS when vite_dev_server is https" do
+        allow(described_class).to receive(:base_url).and_return("https://localhost:5173")
+        allow(Net::HTTP).to receive(:start).and_return(http_ok(manifest_json))
+
+        described_class.resolve
+
+        expect(Net::HTTP).to have_received(:start).with(
+          "localhost", 5173, hash_including(use_ssl: true)
+        )
+      end
+
+      it "falls back to the on-disk file when the dev server is unreachable" do
+        allow(Net::HTTP).to receive(:start).and_raise(Errno::ECONNREFUSED)
+
+        Dir.mktmpdir do |dir|
+          path = File.join(dir, "react-client-manifest.json")
+          File.write(path, manifest_json)
+          allow(described_class).to receive(:file_path).and_return(path)
+
+          manifest = described_class.resolve
+          expect(manifest).to be_a(ClientManifest)
+          expect(manifest.reference_for("LikeButton").module_id).to eq("/LikeButton.jsx")
+        end
+      end
+
+      it "raises a clear, actionable error (not NoMethodError) when neither HTTP nor file is available" do
+        allow(Net::HTTP).to receive(:start).and_raise(Errno::ECONNREFUSED)
+        allow(described_class).to receive(:file_path).and_return("/no/such/manifest.json")
+
+        expect { described_class.resolve }.to raise_error(ManifestError, %r{Vite dev server.*bin/dev}m)
+      end
+
+      it "ignores a non-2xx dev-server response and falls back" do
+        allow(Net::HTTP).to receive(:start).and_return(Net::HTTPNotFound.new("1.1", "404", "Not Found"))
+        allow(described_class).to receive(:file_path).and_return("/no/such/manifest.json")
+
+        expect { described_class.resolve }.to raise_error(ManifestError)
+      end
+    end
+
+    describe ".resolve_soft in development (fail-open for FR100)" do
+      before do
+        in_dev
+        allow(Ruact).to receive(:manifest).and_return(nil)
+      end
+
+      it "returns nil (no raise) when nothing is resolvable" do
+        allow(Net::HTTP).to receive(:start).and_raise(Errno::ECONNREFUSED)
+        allow(described_class).to receive(:file_path).and_return("/no/such/manifest.json")
+
+        expect(described_class.resolve_soft).to be_nil
+      end
+
+      it "returns the dev manifest when the server is up" do
+        allow(Net::HTTP).to receive(:start).and_return(http_ok(manifest_json))
+        expect(described_class.resolve_soft).to be_a(ClientManifest)
+      end
+    end
+
+    describe "production / non-development (untouched)" do
+      it "returns Ruact.manifest verbatim without any HTTP call" do
+        allow(Rails).to receive(:env).and_return(ActiveSupport::StringInquirer.new("production"))
+        allow(Net::HTTP).to receive(:start)
+        boot_manifest = ClientManifest.from_hash(manifest_hash)
+        allow(Ruact).to receive(:manifest).and_return(boot_manifest)
+
+        expect(described_class.resolve).to be(boot_manifest)
+        expect(Net::HTTP).not_to have_received(:start)
+      end
+
+      it "returns Ruact.manifest in the test environment too (no dev fetch)" do
+        allow(Rails).to receive(:env).and_return(ActiveSupport::StringInquirer.new("test"))
+        allow(Net::HTTP).to receive(:start)
+        boot_manifest = ClientManifest.from_hash(manifest_hash)
+        allow(Ruact).to receive(:manifest).and_return(boot_manifest)
+
+        expect(described_class.resolve).to be(boot_manifest)
+        expect(Net::HTTP).not_to have_received(:start)
+      end
+    end
+  end
+end

data/spec/ruact/query_request_spec.rb

@@ -22,6 +22,10 @@ require "action_view/railtie"
 
 require "spec_helper"
 require "rack/test"
+require "global_id"
+require "active_support/core_ext/integer/time"
+require "active_support/core_ext/numeric/time"
+require "active_support/message_verifier"
 
 require "ruact/controller"
 require "ruact/server"
@@ -183,6 +187,41 @@ module QueryRequestSpecSupport # rubocop:disable Style/OneClassPerFile
       { "opt" => opt }
     end
   end
+
+  # Story 13.2 (FR96) — a GlobalID-locatable record used to exercise the signed
+  # reference round-trip through the real host request cycle.
+  class RefPost
+    include GlobalID::Identification
+
+    attr_reader :id
+
+    def initialize(id)
+      @id = id.to_s
+      self.class.store[@id] = self
+    end
+
+    def self.store
+      @store ||= {}
+    end
+
+    def self.find(id)
+      store.fetch(id.to_s)
+    end
+  end
+
+  # Story 13.2 (FR96) — a public query (skips auth) that resolves a signed
+  # reference handed back from the client. A tampered/expired/wrong-purpose
+  # token raises Ruact::InvalidSignedGlobalIDError, which the Story 8.4
+  # structured-error chain renders as a clean 400 (no ActiveRecord::RecordNotFound
+  # leak, no raw-id trust).
+  class SignedRefQuery < ApplicationQuery
+    ruact_skip_before_action :require_login
+
+    def resolve_ref(token:)
+      record = Ruact.locate_signed(token, for: :spec_ref)
+      { "id" => record.id }
+    end
+  end
 end
 
 if defined?(ControllerRequestSpecSupport) &&
@@ -191,7 +230,8 @@ if defined?(ControllerRequestSpecSupport) &&
   ControllerRequestSpecSupport.app_class.routes.append do
     ruact_queries QueryRequestSpecSupport::CatalogQuery,
                   QueryRequestSpecSupport::PublicCatalogQuery,
-                  QueryRequestSpecSupport::SearchQuery
+                  QueryRequestSpecSupport::SearchQuery,
+                  QueryRequestSpecSupport::SignedRefQuery
   end
 end
 
@@ -596,3 +636,71 @@ RSpec.describe "Story 9.5: FR88 query kwargs sanitization", :story_9_5 do
     end
   end
 end
+
+# Story 13.2 (FR96) — SignedGlobalID references resolved through the REAL host
+# request cycle: a valid token round-trips; a tampered token surfaces as a clean
+# 400 via the Story 8.4 structured-error chain (no ActiveRecord::RecordNotFound
+# leak, no raw-id trust).
+RSpec.describe "Story 13.2: SignedGlobalID record references (FR96)", :story_13_2 do
+  include Rack::Test::Methods
+
+  let(:app_class) { ControllerRequestSpecSupport.app_class }
+  let(:app)       { app_class.instance }
+
+  before do
+    Rails.logger = Logger.new(IO::NULL)
+    ControllerRequestSpecSupport.boot!
+    # globalid signing context for the booted app (the 7.9 app sets
+    # secret_key_base but does not load the globalid railtie).
+    GlobalID.app = "ruact-test"
+    SignedGlobalID.verifier = ActiveSupport::MessageVerifier.new("a" * 64)
+  end
+
+  def sign(record, purpose: :spec_ref, expires_in: 1.hour)
+    Ruact.signed_global_id(record, for: purpose, expires_in: expires_in)
+  end
+
+  it "round-trips a valid token through the host chain (no auth needed — public query)" do
+    record = QueryRequestSpecSupport::RefPost.new("42")
+    get "/q/resolveRef", { "token" => sign(record) }
+    expect(last_response.status).to(eq(200), "body=#{last_response.body[0, 300]}")
+    expect(JSON.parse(last_response.body)).to eq("id" => "42")
+  end
+
+  it "rejects a tampered token as a clean 400 structured error (no RecordNotFound leak)" do
+    record = QueryRequestSpecSupport::RefPost.new("99")
+    get "/q/resolveRef", { "token" => "#{sign(record)}tamper" }
+
+    expect(last_response.status).to eq(400)
+    body = JSON.parse(last_response.body)
+    expect(body.fetch("_ruact_server_action_error")).to be(true)
+    expect(body.fetch("action_name")).to eq("resolve_ref")
+    expect(body.fetch("error_class")).to eq("Ruact::InvalidSignedGlobalIDError")
+    expect(last_response.body).not_to include("RecordNotFound")
+  end
+
+  it "rejects a wrong-purpose token as a clean 400" do
+    record = QueryRequestSpecSupport::RefPost.new("7")
+    get "/q/resolveRef", { "token" => sign(record, purpose: :other_purpose) }
+    expect(last_response.status).to eq(400)
+    expect(JSON.parse(last_response.body).fetch("error_class"))
+      .to eq("Ruact::InvalidSignedGlobalIDError")
+  end
+
+  it "does not leak dev-only error fields in production payload mode" do
+    record = QueryRequestSpecSupport::RefPost.new("5")
+    Ruact.configure { |c| c.dev_error_payload_enabled = false }
+    get "/q/resolveRef", { "token" => "#{sign(record)}tamper" }
+    expect(last_response.status).to eq(400)
+    body = JSON.parse(last_response.body)
+    # production payload is exactly the four baseline keys — no split backtrace,
+    # suggestion, or validation/upload blocks (the real dev-only field names).
+    expect(body.keys).to contain_exactly(
+      "_ruact_server_action_error", "action_name", "error_class", "message"
+    )
+    expect(body.keys).not_to include("app_frames", "gem_frames", "suggestion")
+  ensure
+    Ruact.instance_variable_set(:@config, nil)
+    Ruact.instance_variable_set(:@configured_at_least_once, false)
+  end
+end