@allbluecn/web-app 0.18.2 → 0.19.0

package/src/server/collab/__tests__/reindex-endpoint.test.ts

@@ -0,0 +1,168 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// collab → web 向量索引重建通知接收端测试（Yjs 多人协作任务 16，R7 升级信封）：
+// - 内部 HMAC 信封有效（COLLAB_SECRET，域 collab-reindex:v1，ts 时效内）→
+//   202 + 复用 indexDocumentById fire-and-forget
+// - 信封负例：签名缺失/错误 → 401；过期 ts（偏移 >60s）→ 401；未来 ts → 401；
+//   域不符 → 401；docId 缺失 → 400
+// - COLLAB_SECRET 未配置 → 503（fail-closed）
+// - R7 重放窗口语义：窗口内同签名重复验签通过（无 nonce，时效即重放边界）
+
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  INTERNAL_DOMAIN_REINDEX,
+  INTERNAL_SIGNATURE_HEADER,
+  signInternalRequest,
+} from "@allbluecn/collab-core/internal";
+
+const mocks = vi.hoisted(() => ({
+  indexDocumentById: vi.fn(),
+}));
+
+vi.mock("@/server/knowledge/knowledge-index-utils", () => ({
+  indexDocumentById: mocks.indexDocumentById,
+}));
+
+import { handleCollabReindex } from "../reindex-endpoint";
+
+const SECRET = "test-collab-secret";
+const NOW = Math.floor(Date.now() / 1000);
+
+/** 信封签名请求（docId=null → body 无 docId 字段，走 400 负例） */
+function signedRequest(
+  docId: string | null,
+  opts: { ts?: number; secret?: string } = {},
+): Request {
+  const payload: Record<string, unknown> = {};
+  if (docId !== null) payload.docId = docId;
+  const signed = signInternalRequest({
+    secret: opts.secret ?? SECRET,
+    domain: INTERNAL_DOMAIN_REINDEX,
+    payload,
+    now: opts.ts ?? NOW,
+  });
+  return new Request("http://localhost/api/internal/collab-reindex", {
+    method: "POST",
+    headers: signed.headers,
+    body: signed.body,
+  });
+}
+
+/** 原始 body + 指定签名（负例构造用） */
+function rawRequest(body: string, signature?: string): Request {
+  const headers: Record<string, string> = { "content-type": "application/json" };
+  if (signature !== undefined) headers[INTERNAL_SIGNATURE_HEADER] = signature;
+  return new Request("http://localhost/api/internal/collab-reindex", {
+    method: "POST",
+    headers,
+    body,
+  });
+}
+
+describe("handleCollabReindex（collab → web 索引重建通知，内部信封）", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.stubEnv("COLLAB_SECRET", SECRET);
+    mocks.indexDocumentById.mockResolvedValue({ indexed: 3 });
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("有效信封 → 202 排队 + fire-and-forget 调 indexDocumentById", async () => {
+    const res = await handleCollabReindex(signedRequest("doc-1"));
+
+    expect(res.status).toBe(202);
+    expect(await res.json()).toEqual({ queued: true });
+    await vi.waitFor(() => {
+      expect(mocks.indexDocumentById).toHaveBeenCalledWith("doc-1");
+    });
+  });
+
+  it("R7：窗口内同签名重复验签通过（无 nonce，时效即重放边界）", async () => {
+    const req = signedRequest("doc-1");
+    const first = await handleCollabReindex(req);
+    expect(first.status).toBe(202);
+    const second = await handleCollabReindex(signedRequest("doc-1"));
+    expect(second.status).toBe(202);
+  });
+
+  it("签名错误 → 401 且不触发索引", async () => {
+    const res = await handleCollabReindex(rawRequest(JSON.stringify({ domain: INTERNAL_DOMAIN_REINDEX, ts: NOW, docId: "doc-1" }), "bad-signature"));
+
+    expect(res.status).toBe(401);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+
+  it("签名缺失 → 401", async () => {
+    const res = await handleCollabReindex(rawRequest(JSON.stringify({ domain: INTERNAL_DOMAIN_REINDEX, ts: NOW, docId: "doc-1" })));
+
+    expect(res.status).toBe(401);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+
+  it("密钥不匹配（ticket 域签名重放防护）→ 401", async () => {
+    const res = await handleCollabReindex(signedRequest("doc-1", { secret: "other-secret" }));
+
+    expect(res.status).toBe(401);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+
+  it("R7：过期 ts（偏移 >60s）→ 401", async () => {
+    const res = await handleCollabReindex(signedRequest("doc-1", { ts: NOW - 61 }));
+
+    expect(res.status).toBe(401);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+
+  it("R7：未来 ts（偏移 >60s）→ 401", async () => {
+    const res = await handleCollabReindex(signedRequest("doc-1", { ts: NOW + 61 }));
+
+    expect(res.status).toBe(401);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+
+  it("R7：域不符（apply 通道凭证打 reindex 通道）→ 401", async () => {
+    const signed = signInternalRequest({
+      secret: SECRET,
+      domain: "collab-internal-apply:v1",
+      payload: { docId: "doc-1" },
+      now: NOW,
+    });
+    const res = await handleCollabReindex(rawRequest(signed.body, signed.headers[INTERNAL_SIGNATURE_HEADER]));
+
+    expect(res.status).toBe(401);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+
+  it("docId 缺失 → 400", async () => {
+    const res = await handleCollabReindex(signedRequest(null));
+
+    expect(res.status).toBe(400);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+
+  it("COLLAB_SECRET 未配置 → 503 fail-closed", async () => {
+    vi.stubEnv("COLLAB_SECRET", "");
+    const res = await handleCollabReindex(signedRequest("doc-1"));
+
+    expect(res.status).toBe(503);
+    expect(mocks.indexDocumentById).not.toHaveBeenCalled();
+  });
+});

package/src/server/collab/__tests__/resolve.test.ts

@@ -0,0 +1,249 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  storyFindUnique: vi.fn(),
+  bugFindUnique: vi.fn(),
+  testCaseFindUnique: vi.fn(),
+  kbFindUnique: vi.fn(),
+  storyDesignLinkFindMany: vi.fn(),
+  workspaceMemberCount: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: {
+    story: { findUnique: mocks.storyFindUnique },
+    bug: { findUnique: mocks.bugFindUnique },
+    testCase: { findUnique: mocks.testCaseFindUnique },
+    knowledgeBase: { findUnique: mocks.kbFindUnique },
+    storyDesignLink: { findMany: mocks.storyDesignLinkFindMany },
+    workspaceMember: { count: mocks.workspaceMemberCount },
+  },
+}));
+
+import {
+  resolveEntityWorkspace,
+  resolveKbAccess,
+  resolveDesignWorkspaces,
+  isWorkspaceMember,
+} from "../resolve";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("resolveEntityWorkspace", () => {
+  it("story 经 story→project.workspaceId 反查（空间内）", async () => {
+    mocks.storyFindUnique.mockResolvedValue({ project: { workspaceId: "ws1" } });
+    const ws = await resolveEntityWorkspace("story", "story-1");
+    expect(ws).toBe("ws1");
+    expect(mocks.storyFindUnique).toHaveBeenCalledWith({
+      where: { id: "story-1" },
+      select: { project: { select: { workspaceId: true } } },
+    });
+  });
+
+  it("bug 同构：走 prisma.bug", async () => {
+    mocks.bugFindUnique.mockResolvedValue({ project: { workspaceId: "ws2" } });
+    const ws = await resolveEntityWorkspace("bug", "bug-1");
+    expect(ws).toBe("ws2");
+    expect(mocks.bugFindUnique).toHaveBeenCalledWith({
+      where: { id: "bug-1" },
+      select: { project: { select: { workspaceId: true } } },
+    });
+    expect(mocks.storyFindUnique).not.toHaveBeenCalled();
+  });
+
+  it("case 同构：走 prisma.testCase", async () => {
+    mocks.testCaseFindUnique.mockResolvedValue({ project: { workspaceId: "ws3" } });
+    const ws = await resolveEntityWorkspace("case", "case-1");
+    expect(ws).toBe("ws3");
+    expect(mocks.testCaseFindUnique).toHaveBeenCalledWith({
+      where: { id: "case-1" },
+      select: { project: { select: { workspaceId: true } } },
+    });
+  });
+
+  it("空间外：项目未挂工作空间（workspaceId=null）返回 null", async () => {
+    mocks.storyFindUnique.mockResolvedValue({ project: { workspaceId: null } });
+    expect(await resolveEntityWorkspace("story", "story-2")).toBeNull();
+  });
+
+  it("实体不存在返回 null", async () => {
+    mocks.storyFindUnique.mockResolvedValue(null);
+    expect(await resolveEntityWorkspace("story", "missing")).toBeNull();
+  });
+});
+
+describe("resolveKbAccess", () => {
+  it("private → { kind: 'private' }，不协同", async () => {
+    mocks.kbFindUnique.mockResolvedValue({
+      visibility: "private",
+      workspaceId: null,
+      workspaceLinks: [],
+      projectLinks: [],
+    });
+    expect(await resolveKbAccess("kb-1")).toEqual({ kind: "private" });
+  });
+
+  it("查询形状：visibility + workspaceId + workspaceLinks + projectLinks.project.workspaceId", async () => {
+    mocks.kbFindUnique.mockResolvedValue({
+      visibility: "private",
+      workspaceId: null,
+      workspaceLinks: [],
+      projectLinks: [],
+    });
+    await resolveKbAccess("kb-shape");
+    const arg = mocks.kbFindUnique.mock.calls[0][0] as any;
+    expect(arg.where).toEqual({ id: "kb-shape" });
+    expect(arg.select).toEqual({
+      visibility: true,
+      workspaceId: true,
+      workspaceLinks: { select: { workspaceId: true } },
+      projectLinks: { select: { project: { select: { workspaceId: true } } } },
+    });
+  });
+
+  it("team + 直挂 workspaceId → open", async () => {
+    mocks.kbFindUnique.mockResolvedValue({
+      visibility: "team",
+      workspaceId: "ws1",
+      workspaceLinks: [],
+      projectLinks: [],
+    });
+    expect(await resolveKbAccess("kb-2")).toEqual({
+      kind: "open",
+      workspaceIds: ["ws1"],
+    });
+  });
+
+  it("general + ProjectKnowledgeBase 经 project.workspaceId → open", async () => {
+    mocks.kbFindUnique.mockResolvedValue({
+      visibility: "general",
+      workspaceId: null,
+      workspaceLinks: [],
+      projectLinks: [
+        { project: { workspaceId: "ws2" } },
+        { project: { workspaceId: null } },
+      ],
+    });
+    expect(await resolveKbAccess("kb-3")).toEqual({
+      kind: "open",
+      workspaceIds: ["ws2"],
+    });
+  });
+
+  it("team + WorkspaceKnowledgeBase join 关联 → open", async () => {
+    mocks.kbFindUnique.mockResolvedValue({
+      visibility: "team",
+      workspaceId: null,
+      workspaceLinks: [{ workspaceId: "ws3" }],
+      projectLinks: [],
+    });
+    expect(await resolveKbAccess("kb-4")).toEqual({
+      kind: "open",
+      workspaceIds: ["ws3"],
+    });
+  });
+
+  it("多来源合并去重（直挂 + 项目关联 + join）", async () => {
+    mocks.kbFindUnique.mockResolvedValue({
+      visibility: "general",
+      workspaceId: "ws1",
+      workspaceLinks: [{ workspaceId: "ws3" }],
+      projectLinks: [
+        { project: { workspaceId: "ws1" } },
+        { project: { workspaceId: "ws2" } },
+        { project: { workspaceId: null } },
+      ],
+    });
+    expect(await resolveKbAccess("kb-5")).toEqual({
+      kind: "open",
+      workspaceIds: ["ws1", "ws2", "ws3"],
+    });
+  });
+
+  it("team/general 但未挂任何工作空间 → open 空集（无人可协同）", async () => {
+    mocks.kbFindUnique.mockResolvedValue({
+      visibility: "team",
+      workspaceId: null,
+      workspaceLinks: [],
+      projectLinks: [],
+    });
+    expect(await resolveKbAccess("kb-6")).toEqual({
+      kind: "open",
+      workspaceIds: [],
+    });
+  });
+
+  it("KB 不存在 → fail-closed 视为 private", async () => {
+    mocks.kbFindUnique.mockResolvedValue(null);
+    expect(await resolveKbAccess("missing")).toEqual({ kind: "private" });
+  });
+});
+
+describe("resolveDesignWorkspaces", () => {
+  it("经 StoryDesignLink→Story→Project 反查并去重", async () => {
+    mocks.storyDesignLinkFindMany.mockResolvedValue([
+      { story: { project: { workspaceId: "ws1" } } },
+      { story: { project: { workspaceId: "ws1" } } },
+      { story: { project: { workspaceId: "ws2" } } },
+    ]);
+    const ids = await resolveDesignWorkspaces("design-1");
+    expect(ids).toEqual(["ws1", "ws2"]);
+    expect(mocks.storyDesignLinkFindMany).toHaveBeenCalledWith({
+      where: { designId: "design-1" },
+      select: { story: { select: { project: { select: { workspaceId: true } } } } },
+    });
+  });
+
+  it("无任何关联 → 空集（视为私人）", async () => {
+    mocks.storyDesignLinkFindMany.mockResolvedValue([]);
+    expect(await resolveDesignWorkspaces("design-2")).toEqual([]);
+  });
+
+  it("关联项目均未挂工作空间 → 空集", async () => {
+    mocks.storyDesignLinkFindMany.mockResolvedValue([
+      { story: { project: { workspaceId: null } } },
+    ]);
+    expect(await resolveDesignWorkspaces("design-3")).toEqual([]);
+  });
+});
+
+describe("isWorkspaceMember", () => {
+  it("active 成员存在 → true", async () => {
+    mocks.workspaceMemberCount.mockResolvedValue(1);
+    expect(await isWorkspaceMember("ws1", "u1", "active")).toBe(true);
+    expect(mocks.workspaceMemberCount).toHaveBeenCalledWith({
+      where: { workspaceId: "ws1", userId: "u1", status: "active" },
+    });
+  });
+
+  it("非成员或状态不符 → false", async () => {
+    mocks.workspaceMemberCount.mockResolvedValue(0);
+    expect(await isWorkspaceMember("ws1", "u2", "active")).toBe(false);
+  });
+
+  it("status 默认 active", async () => {
+    mocks.workspaceMemberCount.mockResolvedValue(0);
+    await isWorkspaceMember("ws1", "u3", "active");
+    const arg = mocks.workspaceMemberCount.mock.calls[0][0] as any;
+    expect(arg.where.status).toBe("active");
+  });
+});

package/src/server/collab/__tests__/touch-snapshot.test.ts

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// R11 touch 共享 helper 单测：无快照计 0 不误建 / where·data 精确 /
+// 返回计数透传。「含 Y 属主面不 touch」是调用方判定（helper 无从知晓 patch
+// 语义），调用方侧由 bug-crud.test.ts 的 updateBugFn Y 面/非 Y 面用例钉住。
+
+import { describe, expect, it, vi } from "vitest";
+
+const M = vi.hoisted(() => ({
+  updateMany: vi.fn(),
+}));
+
+const tx = {
+  collabDocument: { updateMany: M.updateMany },
+} as unknown as Parameters<typeof import("../touch-snapshot").touchCollabSnapshot>[0];
+
+import { touchCollabSnapshot } from "../touch-snapshot";
+
+const ROOM = "entity:bug:b1";
+const AT = new Date("2026-02-02T03:04:05Z");
+
+describe("touchCollabSnapshot（R11 touch 不变式共享实现）", () => {
+  it("touch 值正确：roomName 精确 where、updatedAt = 业务行回读值", async () => {
+    M.updateMany.mockResolvedValue({ count: 1 });
+
+    const count = await touchCollabSnapshot(tx, ROOM, AT);
+
+    expect(M.updateMany).toHaveBeenCalledWith({
+      where: { roomName: ROOM },
+      data: { updatedAt: AT },
+    });
+    expect(count).toBe(1);
+  });
+
+  it("无快照计 0：updateMany 零行命中（不误建行），计数透传 0", async () => {
+    M.updateMany.mockResolvedValue({ count: 0 });
+
+    const count = await touchCollabSnapshot(tx, "doc:knowledge:never-collab", AT);
+
+    expect(count).toBe(0);
+    expect(M.updateMany).toHaveBeenCalledTimes(1);
+  });
+});