@andypai/agent-kanban 0.5.1 → 0.6.1

package/src/__tests__/postgres-jira-provider.test.ts

@@ -145,6 +145,16 @@ function standardRoutes(opts: { boardCfg?: unknown } = {}): StubRoute[] {
         )
       },
     },
+    {
+      // GET /rest/api/3/issue/{key} backs hydrateIssueByKey's read-after-write.
+      match: (url) => /\/rest\/api\/3\/issue\/ENG-\d+$/.test(new URL(url).pathname),
+      handler: (url) => {
+        const issueKey = new URL(url).pathname.match(/\/issue\/(ENG-\d+)$/)![1]!
+        const issue = issues.find((candidate) => String(candidate.key) === issueKey)
+        if (!issue) return jsonResponse({ errorMessages: ['missing'] }, 404)
+        return jsonResponse(issue)
+      },
+    },
     {
       match: (url) => /\/rest\/api\/3\/issue\/ENG-\d+\/comment$/.test(new URL(url).pathname),
       handler: async (url, init) => {
@@ -401,4 +411,149 @@ describe('postgres jira provider', () => {
       column_id: '20',
     })
   })
+
+  pgTest(
+    'delta sync adds new catalog rows but only a full reconcile prunes obsolete ones',
+    async () => {
+      if (!sql) throw new Error('expected postgres test connection')
+      const prioritiesState = {
+        list: [
+          { id: '2', name: 'High' },
+          { id: '3', name: 'Medium' },
+        ] as Array<{ id: string; name: string }>,
+      }
+      const routes = standardRoutes()
+      const pIdx = routes.findIndex((route) =>
+        route.match('https://example.atlassian.net/rest/api/3/priority'),
+      )
+      routes[pIdx] = {
+        match: (url) => url.includes('/rest/api/3/priority'),
+        handler: () => jsonResponse(prioritiesState.list),
+      }
+      globalThis.fetch = jiraFetchStub(routes).fn
+      // pollingSyncIntervalMs: 0 lets every getBoard run; the first is a full
+      // reconcile (no lastFullSyncAt yet), later ones are delta syncs because the
+      // full-reconcile interval has not elapsed.
+      const provider = new PostgresJiraProvider(sql, {
+        baseUrl: 'https://example.atlassian.net',
+        email: 'user@example.com',
+        apiToken: 'token',
+        projectKey: 'ENG',
+        boardId: 1006,
+        pollingSyncIntervalMs: 0,
+      })
+      const priorityNames = async () =>
+        (await sql!<{ name: string }[]>`SELECT name FROM jira_priorities ORDER BY name`).map(
+          (row) => row.name,
+        )
+
+      await provider.getBoard()
+      expect(await priorityNames()).toEqual(['High', 'Medium'])
+
+      // Drop Medium, add Low upstream. A delta sync must pick up the new row
+      // (Low) via the every-sync UPSERT but must NOT prune the now-obsolete row
+      // (Medium): pruning on a possibly-stale delta snapshot could delete a row
+      // another replica just added. Pruning is confined to the full reconcile.
+      prioritiesState.list = [
+        { id: '2', name: 'High' },
+        { id: '4', name: 'Low' },
+      ]
+      await provider.getBoard()
+      expect(await priorityNames()).toEqual(['High', 'Low', 'Medium'])
+
+      // Force the next sync to be a full reconcile; only then is the obsolete
+      // Medium pruned.
+      await sql`DELETE FROM jira_sync_meta WHERE key = 'lastFullSyncAt'`
+      await provider.getBoard()
+      expect(await priorityNames()).toEqual(['High', 'Low'])
+    },
+  )
+
+  pgTest('concurrent catalog refreshes do not collide on a primary key', async () => {
+    if (!sql) throw new Error('expected postgres test connection')
+    globalThis.fetch = jiraFetchStub(standardRoutes()).fn
+    const sql2 = postgres(databaseUrl as string, { max: 1, onnotice: () => {} })
+    try {
+      const config = {
+        baseUrl: 'https://example.atlassian.net',
+        email: 'user@example.com',
+        apiToken: 'token',
+        projectKey: 'ENG',
+        boardId: 1006,
+        pollingSyncIntervalMs: 0,
+      }
+      // Initialize schema sequentially first; concurrent CREATE TABLE IF NOT
+      // EXISTS races at the DDL level (a pre-existing Postgres quirk unrelated to
+      // catalog refresh). The race under test is the catalog DML below.
+      const p1 = new PostgresJiraProvider(sql, config)
+      await p1.initialize()
+      const p2 = new PostgresJiraProvider(sql2, config)
+      await p2.initialize()
+      // Two replicas on separate connections refreshing the same shared cache
+      // concurrently must not trip a primary-key collision. Both first syncs are
+      // full reconciles (no lastFullSyncAt yet), so this also exercises the
+      // obsolete-row DELETE running concurrently: UPSERT + conditional DELETE is
+      // idempotent and order-independent.
+      await Promise.all([p1.getBoard(), p2.getBoard()])
+      const rows = await sql<
+        { count: number }[]
+      >`SELECT COUNT(*)::int AS count FROM jira_priorities`
+      expect(rows[0]?.count ?? 0).toBeGreaterThan(0)
+    } finally {
+      await sql2.end({ timeout: 1 })
+    }
+  })
+
+  pgTest('full reconcile with a stalled cursor does not prune unfetched-page issues', async () => {
+    if (!sql) throw new Error('expected postgres test connection')
+    // Mirror of the SQLite prune-safety coverage: if the cursor stalls (a
+    // repeated non-last token) mid-scan, seenIssueIds is only partial, so the
+    // incomplete scan must NOT prune issues that exist upstream on pages we never
+    // fetched.
+    let stalled = false
+    const routes = standardRoutes()
+    const sIdx = routes.findIndex((route) => route.match('https://x/rest/api/3/search/jql'))
+    routes[sIdx] = {
+      match: (url) => url.includes('/rest/api/3/search/jql'),
+      handler: () =>
+        stalled
+          ? // Later full reconcile: the cursor stalls after returning only ENG-1,
+            // so ENG-2's page is never reached. isLast=false + a repeated token =>
+            // incomplete.
+            jsonResponse({
+              nextPageToken: 'stuck',
+              isLast: false,
+              issues: [makeIssue({ id: '1', key: 'ENG-1' })],
+            })
+          : // First full reconcile: a clean single terminal page with both issues.
+            jsonResponse({
+              isLast: true,
+              issues: [makeIssue({ id: '1', key: 'ENG-1' }), makeIssue({ id: '2', key: 'ENG-2' })],
+            }),
+    }
+    globalThis.fetch = jiraFetchStub(routes).fn
+    const provider = new PostgresJiraProvider(sql, {
+      baseUrl: 'https://example.atlassian.net',
+      email: 'user@example.com',
+      apiToken: 'token',
+      projectKey: 'ENG',
+      boardId: 1006,
+      pollingSyncIntervalMs: 0,
+    })
+    const issueKeys = async () =>
+      (await sql!<{ key: string }[]>`SELECT key FROM jira_issues ORDER BY key`).map(
+        (row) => row.key,
+      )
+
+    await provider.getBoard()
+    expect(await issueKeys()).toEqual(['ENG-1', 'ENG-2'])
+
+    // Force the next sync to be a full reconcile and hit the stalled cursor.
+    stalled = true
+    await sql`DELETE FROM jira_sync_meta WHERE key = 'lastFullSyncAt'`
+    await provider.getBoard()
+
+    // ENG-2 must survive: the incomplete scan is not authoritative for pruning.
+    expect(await issueKeys()).toEqual(['ENG-1', 'ENG-2'])
+  })
 })

package/src/__tests__/postgres-local-provider.test.ts

@@ -2,7 +2,8 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import postgres from 'postgres'
 
 import { run } from '../index'
-import type { Task, TaskComment, TaskWithColumn } from '../types'
+import { openKanbanRuntime } from '../provider-runtime'
+import type { BoardMetrics, Task, TaskComment, TaskWithColumn } from '../types'
 
 const databaseUrl = process.env['KANBAN_PG_TEST_URL'] ?? process.env['DATABASE_URL']
 const pgTest = databaseUrl ? test : test.skip
@@ -131,4 +132,92 @@ describe('postgres local provider', () => {
 
     expect(created.column_name).toBe('Todo')
   })
+
+  async function positionsInColumn(
+    columnName: string,
+  ): Promise<Array<{ id: string; position: number }>> {
+    if (!sql) throw new Error('sql not initialized')
+    return sql<Array<{ id: string; position: number }>>`
+      SELECT t.id, t.position FROM tasks t
+      JOIN columns c ON t.column_id = c.id
+      WHERE c.name = ${columnName}
+      ORDER BY t.position
+    `
+  }
+
+  pgTest('move renumbers the source column and records column-time tracking', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    const b = expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+    const c = expectOk<TaskWithColumn>(await run(['task', 'add', 'C', '-c', 'backlog']))
+    expect((await positionsInColumn('backlog')).map((r) => r.id)).toEqual([a.id, b.id, c.id])
+
+    expectOk<Task>(await run(['task', 'move', b.id, 'in-progress']))
+
+    // Source column compacted to 0..n-1 with no gap left by B.
+    expect(await positionsInColumn('backlog')).toEqual([
+      { id: a.id, position: 0 },
+      { id: c.id, position: 1 },
+    ])
+
+    // B has a closed backlog interval and an open in-progress interval.
+    const tracking = await sql!<Array<{ column_name: string; exited_at: string | null }>>`
+      SELECT c.name AS column_name, ct.exited_at
+      FROM column_time_tracking ct JOIN columns c ON ct.column_id = c.id
+      WHERE ct.task_id = ${b.id}
+      ORDER BY ct.entered_at
+    `
+    expect(tracking.map((r) => r.column_name)).toEqual(['backlog', 'in-progress'])
+    expect(tracking[0]!.exited_at).not.toBeNull()
+    expect(tracking[1]!.exited_at).toBeNull()
+  })
+
+  pgTest('move to the same column is a no-op (no extra tracking, no reorder)', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    const b = expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+
+    expectOk<Task>(await run(['task', 'move', a.id, 'backlog']))
+
+    // Order preserved (no re-append of A to the end).
+    expect((await positionsInColumn('backlog')).map((r) => r.id)).toEqual([a.id, b.id])
+    // Only the single creation interval exists for A.
+    const trackingRows = await sql!<Array<{ count: string | number }>>`
+      SELECT COUNT(*) AS count FROM column_time_tracking WHERE task_id = ${a.id}
+    `
+    expect(Number(trackingRows[0]?.count ?? 0)).toBe(1)
+  })
+
+  pgTest('delete renumbers the remaining tasks in the column', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    const b = expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+    const c = expectOk<TaskWithColumn>(await run(['task', 'add', 'C', '-c', 'backlog']))
+
+    expectOk<Task>(await run(['task', 'delete', b.id]))
+
+    expect(await positionsInColumn('backlog')).toEqual([
+      { id: a.id, position: 0 },
+      { id: c.id, position: 1 },
+    ])
+  })
+
+  pgTest('getMetrics reports completion time for tasks that reached Done', async () => {
+    const a = expectOk<TaskWithColumn>(await run(['task', 'add', 'A', '-c', 'backlog']))
+    expectOk<TaskWithColumn>(await run(['task', 'add', 'B', '-c', 'backlog']))
+    expectOk<Task>(await run(['task', 'move', a.id, 'done']))
+
+    const runtime = await openKanbanRuntime()
+    let metrics: BoardMetrics
+    try {
+      metrics = await runtime.provider.getMetrics()
+    } finally {
+      await runtime.close()
+    }
+
+    expect(metrics.completedTasks).toBe(1)
+    // Bug fix: a task resting in Done now contributes to the average (no longer
+    // requires exited_at), and the value is a real number, not a string.
+    expect(typeof metrics.avgCompletionHours).toBe('number')
+    expect(metrics.avgCompletionHours!).toBeGreaterThanOrEqual(0)
+    expect(metrics.tasksCreatedThisWeek).toBe(2)
+    expect(metrics.inProgressCount).toBe(0)
+  })
 })

package/src/__tests__/server.test.ts

@@ -289,3 +289,129 @@ describe('startServer', () => {
     expect(syncCalls).toBeGreaterThanOrEqual(2)
   })
 })
+
+describe('startServer auth + CORS', () => {
+  const TOKEN = 'secret-token'
+
+  test('without a token, the API stays open (localhost default)', async () => {
+    const runtime = startServer(makeProvider(), 0)
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`)
+    expect(res.status).toBe(200)
+  })
+
+  test('with a token, protected routes require Bearer auth', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+
+    const noAuth = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`)
+    expect(noAuth.status).toBe(401)
+    const noAuthBody = (await noAuth.json()) as { ok: boolean; error: { code: string } }
+    expect(noAuthBody.ok).toBe(false)
+    expect(noAuthBody.error.code).toBe('UNAUTHORIZED')
+
+    const wrong = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`, {
+      headers: { Authorization: 'Bearer nope' },
+    })
+    expect(wrong.status).toBe(401)
+
+    const ok = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap`, {
+      headers: { Authorization: `Bearer ${TOKEN}` },
+    })
+    expect(ok.status).toBe(200)
+  })
+
+  test('?token= does NOT authorize HTTP API routes (header only)', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/bootstrap?token=${TOKEN}`)
+    expect(res.status).toBe(401)
+  })
+
+  test('/ws requires the token and accepts it as a query param', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+
+    // Plain GET (no upgrade) exercises the auth gate before the upgrade attempt.
+    const noToken = await fetch(`http://127.0.0.1:${runtime.port}/ws`)
+    expect(noToken.status).toBe(401)
+
+    // Correct query token passes the gate; the non-WebSocket request then fails
+    // the upgrade (400) rather than auth (401).
+    const withToken = await fetch(`http://127.0.0.1:${runtime.port}/ws?token=${TOKEN}`)
+    expect(withToken.status).not.toBe(401)
+  })
+
+  test('with a token, /api/health stays public', async () => {
+    const runtime = startServer(makeProvider(), 0, { authToken: TOKEN })
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/health`)
+    expect(res.status).toBe(200)
+  })
+
+  test('with a token, webhook routes are exempt (provider secret guards them)', async () => {
+    const runtime = startServer(
+      makeProvider({
+        type: 'local',
+        async handleWebhook() {
+          return { handled: true }
+        },
+      }),
+      0,
+      { authToken: TOKEN },
+    )
+    runtimes.push(runtime)
+    const res = await fetch(`http://127.0.0.1:${runtime.port}/api/webhooks/local`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}',
+    })
+    // Reaches the provider handler instead of being rejected by bearer auth.
+    expect(res.status).not.toBe(401)
+  })
+
+  test('wsClients are tracked per server instance, not shared globally', async () => {
+    const a = startServer(makeProvider(), 0)
+    runtimes.push(a)
+    const b = startServer(makeProvider(), 0)
+    runtimes.push(b)
+
+    const ws = new WebSocket(`ws://127.0.0.1:${a.port}/ws`)
+    await new Promise<void>((resolve, reject) => {
+      ws.onopen = () => resolve()
+      ws.onerror = () => reject(new Error('ws connection failed'))
+    })
+    // Let server A's open handler register the socket.
+    await sleep(25)
+
+    const healthA = (await (await fetch(`http://127.0.0.1:${a.port}/api/health`)).json()) as {
+      data: { wsClients: number }
+    }
+    const healthB = (await (await fetch(`http://127.0.0.1:${b.port}/api/health`)).json()) as {
+      data: { wsClients: number }
+    }
+    expect(healthA.data.wsClients).toBe(1)
+    // Before per-instance scoping, B shared A's global set and also reported 1.
+    expect(healthB.data.wsClients).toBe(0)
+    ws.close()
+  })
+
+  test('CORS headers are emitted only when an allowed origin is configured', async () => {
+    const withOrigin = startServer(makeProvider(), 0, {
+      allowedOrigin: 'https://kanban.example',
+    })
+    runtimes.push(withOrigin)
+    const res = await fetch(`http://127.0.0.1:${withOrigin.port}/api/health`)
+    expect(res.headers.get('access-control-allow-origin')).toBe('https://kanban.example')
+
+    const preflight = await fetch(`http://127.0.0.1:${withOrigin.port}/api/bootstrap`, {
+      method: 'OPTIONS',
+    })
+    expect(preflight.headers.get('access-control-allow-origin')).toBe('https://kanban.example')
+
+    const noOrigin = startServer(makeProvider(), 0)
+    runtimes.push(noOrigin)
+    const bare = await fetch(`http://127.0.0.1:${noOrigin.port}/api/health`)
+    expect(bare.headers.get('access-control-allow-origin')).toBeNull()
+  })
+})

package/src/__tests__/use-cases.test.ts

@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, test } from 'bun:test'
+import { Database } from 'bun:sqlite'
+import { initSchema, seedDefaultColumns } from '../db'
+import { createProvider } from '../providers/index'
+import type { KanbanProvider } from '../providers/types'
+import * as useCases from '../use-cases'
+
+let db: Database
+let provider: KanbanProvider
+
+beforeEach(() => {
+  db = new Database(':memory:')
+  db.run('PRAGMA foreign_keys = ON')
+  initSchema(db)
+  seedDefaultColumns(db)
+  provider = createProvider(db, { provider: 'local' }, ':memory:')
+})
+
+describe('use-cases label normalization', () => {
+  // The use-case layer owns label normalization so every transport feeds raw
+  // labels in its own shape and gets the same result.
+  test('normalizes CLI-style nested flag arrays', async () => {
+    const task = await useCases.createTask(provider, {
+      title: 'cli',
+      labels: [['bug', 'ui'], undefined],
+    })
+    expect(task.labels).toEqual(['bug', 'ui'])
+  })
+
+  test('normalizes HTTP-style string arrays', async () => {
+    const task = await useCases.createTask(provider, {
+      title: 'http',
+      labels: ['bug', 'ui'],
+    })
+    expect(task.labels).toEqual(['bug', 'ui'])
+  })
+
+  test('normalizes a comma-separated string and de-dupes', async () => {
+    const task = await useCases.createTask(provider, {
+      title: 'csv',
+      labels: 'bug, ui, bug',
+    })
+    expect(task.labels).toEqual(['bug', 'ui'])
+  })
+
+  test('treats omitted labels as none', async () => {
+    const task = await useCases.createTask(provider, { title: 'none' })
+    expect(task.labels).toEqual([])
+  })
+})
+
+describe('use-cases provider forwarding', () => {
+  test('createTask then getTask/listTasks round-trip', async () => {
+    const created = await useCases.createTask(provider, { title: 'roundtrip', column: 'backlog' })
+    const fetched = await useCases.getTask(provider, created.id)
+    expect(fetched.id).toBe(created.id)
+    const all = await useCases.listTasks(provider)
+    expect(all.map((t) => t.id)).toContain(created.id)
+  })
+
+  test('moveTask forwards to the target column and returns the task', async () => {
+    const created = await useCases.createTask(provider, { title: 'mover', column: 'backlog' })
+    const columns = await useCases.listColumns(provider)
+    const target = columns.find((c) => c.name.toLowerCase() === 'in-progress')!
+    const moved = await useCases.moveTask(provider, created.id, target.name)
+    expect(moved.column_id).toBe(target.id)
+  })
+
+  test('addComment / listComments / updateComment forward correctly', async () => {
+    const task = await useCases.createTask(provider, { title: 'commented' })
+    const comment = await useCases.addComment(provider, task.id, 'first')
+    const listed = await useCases.listComments(provider, task.id)
+    expect(listed.map((c) => c.body)).toContain('first')
+    const updated = await useCases.updateComment(provider, task.id, comment.id, 'edited')
+    expect(updated.body).toBe('edited')
+  })
+})