4runr-os 2.10.85 → 2.10.86

package/apps/os-server/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@4runr/os-server",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "4Runr OS Server — local backend API (Shield, Sentinel, runs, persistence)",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "clean": "rimraf dist",
+    "lint": "eslint src --ext .ts",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:integration": "jest --testPathPattern=integration",
+    "test:unit": "jest --testPathPattern='__tests__' --testPathIgnorePatterns=integration",
+    "test:all-phases": "bash test-all-phases.sh",
+    "test:full-ops": "bash test-full-operations.sh",
+    "load-test": "k6 run load-tests/k6-basic.js",
+    "load-test:rate-limit": "k6 run load-tests/k6-rate-limit.js",
+    "db:migrate": "prisma migrate deploy --schema=../../prisma/schema.prisma",
+    "db:generate": "prisma generate --schema=../../prisma/schema.prisma",
+    "db:studio": "prisma studio --schema=../../prisma/schema.prisma",
+    "seed:api-key": "tsx scripts/seed-api-key.ts"
+  },
+  "dependencies": {
+    "@4runr/sentinel": "file:../../packages/sentinel",
+    "@4runr/shared": "file:../../packages/shared",
+    "@4runr/shield": "file:../../packages/shield",
+    "@anthropic-ai/sdk": "^0.30.0",
+    "@aws-sdk/client-kms": "^3.654.0",
+    "@aws-sdk/client-secrets-manager": "^3.654.0",
+    "@aws-sdk/client-ssm": "^3.654.0",
+    "@fastify/cors": "^11.2.0",
+    "bullmq": "^4.0.0",
+    "dotenv": "^16.6.1",
+    "fastify": "^5.8.4",
+    "fastify-metrics": "^8.0.0",
+    "ioredis": "^5.3.0",
+    "openai": "^4.77.0",
+    "opossum": "^6.2.0",
+    "otplib": "^12.0.1",
+    "prom-client": "^14.2.0",
+    "qrcode": "^1.5.3",
+    "zod": "^3.22.0",
+    "@prisma/client": "^5.5.0"
+  },
+  "devDependencies": {
+    "@types/fastify-cors": "^0.1.0",
+    "@types/jsonwebtoken": "^9.0.5",
+    "@types/node": "^20.8.0",
+    "@typescript-eslint/eslint-plugin": "^6.9.1",
+    "@typescript-eslint/parser": "^6.9.1",
+    "eslint": "^8.53.0",
+    "jest": "^29.7.0",
+    "jsonwebtoken": "^9.0.2",
+    "prisma": "^5.5.0",
+    "rimraf": "^5.0.5",
+    "ts-jest": "^29.1.1",
+    "tsx": "^4.6.0",
+    "typescript": "^5.2.2"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/apps/os-server/scripts/setup-test-env.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+# Setup script for integration tests
+# Ensures test environment is ready (PostgreSQL, Redis, API keys)
+
+set -e
+
+echo "========================================="
+echo "Setting up test environment"
+echo "========================================="
+
+# Check if docker-compose is available
+if command -v docker-compose &> /dev/null; then
+    echo "✓ docker-compose found"
+    
+    # Start test services
+    echo "Starting test services (PostgreSQL, Redis)..."
+    docker-compose -f infra/docker-compose.yml up -d postgres redis
+    
+    # Wait for services to be ready
+    echo "Waiting for PostgreSQL..."
+    timeout 30 bash -c 'until docker-compose -f infra/docker-compose.yml exec -T postgres pg_isready -U postgres; do sleep 1; done' || exit 1
+    
+    echo "Waiting for Redis..."
+    timeout 30 bash -c 'until docker-compose -f infra/docker-compose.yml exec -T redis redis-cli ping; do sleep 1; done' || exit 1
+    
+    echo "✓ Test services ready"
+else
+    echo "⚠️  docker-compose not found. Assuming services are running manually."
+fi
+
+# Check if test API key exists
+if [ -z "$TEST_API_KEY" ]; then
+    echo "⚠️  TEST_API_KEY not set. Using default test key."
+    export TEST_API_KEY="test-key-ce67dabb0d4e27e3d72877c921b89cae"
+fi
+
+# Set default test server URL if not set
+if [ -z "$TEST_SERVER_URL" ]; then
+    export TEST_SERVER_URL="http://localhost:3000"
+    echo "⚠️  TEST_SERVER_URL not set. Using default: $TEST_SERVER_URL"
+fi
+
+# Check if server is running
+echo "Checking if gateway server is running..."
+if curl -s "$TEST_SERVER_URL/health" > /dev/null; then
+    echo "✓ Gateway server is running"
+else
+    echo "⚠️  Gateway server is not running at $TEST_SERVER_URL"
+    echo "   Start it with: docker-compose -f infra/docker-compose.yml up -d gateway"
+    echo "   Or: cd apps/os-server && pnpm start"
+fi
+
+echo ""
+echo "========================================="
+echo "Test environment setup complete"
+echo "========================================="
+echo ""
+echo "Environment variables:"
+echo "  TEST_SERVER_URL=$TEST_SERVER_URL"
+echo "  TEST_API_KEY=$TEST_API_KEY"
+echo "  TEST_DATABASE_URL=${TEST_DATABASE_URL:-not set}"
+echo "  TEST_REDIS_URL=${TEST_REDIS_URL:-not set}"
+echo ""
+echo "Run integration tests:"
+echo "  cd apps/os-server && pnpm test:integration"
+echo ""
+

package/apps/os-server/src/__tests__/integration/README.md

@@ -0,0 +1,92 @@
+# Integration Tests
+
+Integration tests for the 4Runr Gateway that test against real services (PostgreSQL, Redis, etc.).
+
+## Setup
+
+### Prerequisites
+
+1. **PostgreSQL**: Required for persistence tests
+   ```bash
+   # Set test database URL
+   export TEST_DATABASE_URL="postgresql://user:password@localhost:5432/4runr_test"
+   ```
+
+2. **Redis**: Required for idempotency and queue tests
+   ```bash
+   # Set test Redis URL
+   export TEST_REDIS_URL="redis://localhost:6379"
+   ```
+
+3. **Test API Key**: Required for authentication tests
+   ```bash
+   # Set test API key
+   export TEST_API_KEY="test-key-ce67dabb0d4e27e3d72877c921b89cae"
+   ```
+
+4. **Gateway running** (from `4r` connect or `npm run dev`):
+   ```bash
+   # 4runr-os local bundle defaults to port 3001 (not 3000)
+   export TEST_SERVER_URL="http://127.0.0.1:3001"
+   ```
+
+### Running Tests
+
+```bash
+# Run all integration tests
+cd apps/os-server
+pnpm test -- integration
+
+# Run specific test suite
+pnpm test -- postgres-persistence
+pnpm test -- authentication
+pnpm test -- idempotency
+pnpm test -- sentinel
+pnpm test -- rate-limiting
+```
+
+## Test Suites
+
+### 1. PostgreSQL Persistence (`postgres-persistence.test.ts`)
+- Tests CRUD operations with real PostgreSQL
+- Verifies data persistence across restarts
+- Tests run status updates
+
+### 2. Authentication (`authentication.test.ts`)
+- Tests API key authentication
+- Tests JWT authentication
+- Tests mixed mode authentication
+- Tests authentication failures
+
+### 3. Idempotency (`idempotency.test.ts`)
+- Tests duplicate request handling with Redis
+- Tests idempotency key expiration
+- Tests idempotency across different routes
+
+### 4. Sentinel Integration (`sentinel.test.ts`)
+- Tests policy enforcement
+- Tests kill switch functionality
+- Tests event streaming
+- Tests audit trails
+
+### 5. Rate Limiting (`rate-limiting.test.ts`)
+- Tests rate limiting with Redis
+- Tests per-tenant rate limiting
+- Tests rate limit recovery
+- Tests rate limit error responses
+
+## Test Helpers
+
+### `helpers/test-server.ts`
+Utilities for creating and managing test Fastify server instances:
+- `createTestServer()` - Create a test server with custom options
+- `startTestServer()` - Start server and get URL
+- `stopTestServer()` - Stop server and cleanup
+
+## Notes
+
+- Integration tests require real services (PostgreSQL, Redis)
+- Tests should be isolated and clean up after themselves
+- Use test-specific database/Redis instances when possible
+- Tests may take longer than unit tests due to real service interactions
+

package/apps/os-server/src/__tests__/integration/helpers/test-server.ts

@@ -0,0 +1,178 @@
+/**
+ * Test server helper for integration tests
+ * 
+ * For integration tests, we test against the actual running server.
+ * This helper provides utilities for making HTTP requests to the test server.
+ * 
+ * The server should be started separately (e.g., via docker-compose or test setup script)
+ * and the base URL should be provided via TEST_SERVER_URL environment variable.
+ */
+
+export interface TestServerConfig {
+  baseUrl?: string;
+  apiKey?: string;
+  jwtToken?: string;
+}
+
+let defaultConfig: TestServerConfig = {};
+
+/**
+ * Initialize test server configuration
+ */
+export function initTestServer(config: TestServerConfig = {}): void {
+  defaultConfig = {
+    baseUrl: process.env.TEST_SERVER_URL || 'http://localhost:3001',
+    apiKey: process.env.TEST_API_KEY || 'test-key-ce67dabb0d4e27e3d72877c921b89cae',
+    ...config,
+  };
+}
+
+/**
+ * Get the base URL for test requests
+ */
+export function getTestServerUrl(): string {
+  return defaultConfig.baseUrl || process.env.TEST_SERVER_URL || 'http://localhost:3001';
+}
+
+/**
+ * Get test API key
+ */
+export function getTestApiKey(): string {
+  return defaultConfig.apiKey || process.env.TEST_API_KEY || 'test-key-ce67dabb0d4e27e3d72877c921b89cae';
+}
+
+/**
+ * Make an authenticated request to the test server with retry on rate limit
+ */
+export async function authenticatedRequest(
+  endpoint: string,
+  options: RequestInit = {},
+  retryOnRateLimit: boolean = true
+): Promise<Response> {
+  const baseUrl = getTestServerUrl();
+  const apiKey = getTestApiKey();
+  
+  const headers = new Headers(options.headers);
+  headers.set('x-api-key', apiKey);
+  headers.set('Content-Type', 'application/json');
+  
+  const makeRequest = async (): Promise<Response> => {
+    return fetch(`${baseUrl}${endpoint}`, {
+      ...options,
+      headers,
+    });
+  };
+  
+  let response = await makeRequest();
+  
+  // Retry once on rate limit if enabled
+  if (retryOnRateLimit && response.status === 429) {
+    const data = await response.json().catch(() => ({}));
+    const retryAfter = (data as any)?.retry_after_ms || 1000;
+    
+    // Wait for the retry period (max 5 seconds for tests)
+    await new Promise(resolve => setTimeout(resolve, Math.min(retryAfter, 5000)));
+    
+    // Retry once
+    response = await makeRequest();
+  }
+  
+  return response;
+}
+
+/**
+ * Make a JWT-authenticated request to the test server
+ */
+export async function jwtAuthenticatedRequest(
+  endpoint: string,
+  token: string,
+  options: RequestInit = {}
+): Promise<Response> {
+  const baseUrl = getTestServerUrl();
+  
+  const headers = new Headers(options.headers);
+  headers.set('Authorization', `Bearer ${token}`);
+  headers.set('Content-Type', 'application/json');
+  
+  return fetch(`${baseUrl}${endpoint}`, {
+    ...options,
+    headers,
+  });
+}
+
+/**
+ * Make an unauthenticated request to the test server
+ */
+export async function unauthenticatedRequest(
+  endpoint: string,
+  options: RequestInit = {}
+): Promise<Response> {
+  const baseUrl = getTestServerUrl();
+  
+  const headers = new Headers(options.headers);
+  headers.set('Content-Type', 'application/json');
+  
+  return fetch(`${baseUrl}${endpoint}`, {
+    ...options,
+    headers,
+  });
+}
+
+/**
+ * Wait for server to be ready (health check)
+ */
+export async function waitForServer(maxWaitMs: number = 30000): Promise<boolean> {
+  const baseUrl = getTestServerUrl();
+  const startTime = Date.now();
+  
+  while (Date.now() - startTime < maxWaitMs) {
+    try {
+      const response = await fetch(`${baseUrl}/health`);
+      if (response.ok) {
+        return true;
+      }
+    } catch (error) {
+      // Server not ready yet
+    }
+    await new Promise(resolve => setTimeout(resolve, 500));
+  }
+  
+  return false;
+}
+
+/**
+ * Poll GET /api/runs/:id until run reaches target status or a terminal status.
+ */
+export async function pollRunUntilStatus(
+  runId: string,
+  targetStatus: string,
+  options: { maxWaitMs?: number; intervalMs?: number } = {}
+): Promise<Record<string, unknown>> {
+  const maxWaitMs = options.maxWaitMs ?? 90000;
+  const intervalMs = options.intervalMs ?? 1000;
+  const start = Date.now();
+  let lastRun: Record<string, unknown> = {};
+
+  while (Date.now() - start < maxWaitMs) {
+    const response = await authenticatedRequest(`/api/runs/${runId}`);
+    const data = await response.json();
+    const run = (data.run ?? data) as Record<string, unknown>;
+    lastRun = run;
+
+    if (run.status === targetStatus) {
+      return run;
+    }
+
+    const terminal = ['failed', 'completed', 'killed'];
+    if (terminal.includes(String(run.status)) && run.status !== targetStatus) {
+      return run;
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+
+  throw new Error(
+    `Run ${runId} did not reach status ${targetStatus} within ${maxWaitMs}ms (last: ${String(lastRun.status)})`
+  );
+}
+