@antasphere/chassis-cli 0.0.0-stage → 1.0.0

package/test/suite/logout.test.ts

@@ -0,0 +1,247 @@
+import { describe, expect, it } from 'vitest';
+import { HUB_TOOL, loadConfig as loadCoreConfig } from '@antasphere/cli-core';
+import { routedHarness, tempConfigEnv, type Route } from '@antasphere/chassis-cli/testing';
+import { cli, run } from '@chassis-cli-test/host';
+import { HUB, HUB_KEY, key, seedHubLogin } from './signin-fixtures.js';
+
+/**
+ * `logout` revokes what it forgets (PRDCT-2947): every key the selected
+ * profile holds, the tool's own and the ones the hub exchange cached, is
+ * self-revoked on the PROFILE's instance, never anywhere else; then the
+ * profile keeps its instance and loses its credentials.
+ */
+
+const { loadConfig, saveConfig } = cli;
+const { envPrefix: P, displayName, bin } = cli.identity;
+
+/** What a plain logout adds when an Antasphere login is stored (PRDCT-3032). */
+const STAYS = ` The Antasphere login ada@x.co stays for the whole tool family (\`${bin} logout --all\` ends it too).`;
+
+const OWN = key('own');
+const CONN_A = key('conna');
+const CONN_B = key('connb');
+
+/** DELETE /cli/auth/key, answering per presented key (default 200). */
+function revokeRoute(answers: Record<string, { status: number; body: unknown }> = {}): Route {
+  return {
+    method: 'DELETE',
+    path: /\/api\/v1\/cli\/auth\/key$/,
+    reply: ({ headers }) => {
+      const presented = headers.get('authorization')?.replace(/^Bearer\s+/, '') ?? '';
+      return answers[presented] ?? { body: { revoked: true, id: 'k1' } };
+    }
+  };
+}
+
+const refusal = (status: number, code: string) => ({ status, body: { error: { code, message: code } } });
+
+async function seeded(profile: Record<string, unknown>, extra: Record<string, string> = {}) {
+  const env = await tempConfigEnv();
+  seedHubLogin(env);
+  saveConfig(env, {
+    activeProfile: 'work',
+    profiles: { work: profile, other: { apiKey: key('other'), baseUrl: 'http://other' } }
+  });
+  return { ...env, ...extra };
+}
+
+const FULL = {
+  apiKey: OWN,
+  baseUrl: 'http://inst',
+  email: 'ada@x.co',
+  connectKeys: { default: { apiKey: CONN_A }, personal: { apiKey: CONN_B } }
+};
+
+describe('logout', () => {
+  it('revokes the cached hub keys, then the profile key, on the profile instance; keeps the profile', async () => {
+    const env = await seeded(FULL);
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout'], h.io)).toBe(0);
+    expect(h.wire).toEqual([
+      { method: 'DELETE', origin: 'http://inst', path: '/api/v1/cli/auth/key', auth: `Bearer ${CONN_A}` },
+      { method: 'DELETE', origin: 'http://inst', path: '/api/v1/cli/auth/key', auth: `Bearer ${CONN_B}` },
+      { method: 'DELETE', origin: 'http://inst', path: '/api/v1/cli/auth/key', auth: `Bearer ${OWN}` }
+    ]);
+    expect(h.out()).toBe(
+      `Logged out of profile "work" on http://inst (3 keys revoked server-side).${STAYS}\n`
+    );
+    expect(h.err()).toBe('');
+    const config = loadConfig(env);
+    expect(config.activeProfile).toBe('work');
+    expect(config.profiles.work).toEqual({ baseUrl: 'http://inst' });
+    // Another profile, and the Antasphere login itself, are untouched.
+    expect(config.profiles.other?.apiKey).toBe(key('other'));
+    expect(loadCoreConfig(env, HUB_TOOL).profiles.default?.apiKey).toBe(HUB_KEY);
+  });
+
+  it('one key: "1 key"', async () => {
+    const env = await seeded({ apiKey: OWN, baseUrl: 'http://inst' });
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout'], h.io)).toBe(0);
+    expect(h.out()).toBe(
+      `Logged out of profile "work" on http://inst (1 key revoked server-side).${STAYS}\n`
+    );
+  });
+
+  it(`never sends a key to the URL of --api-url's instance when --profile names the profile, nor to ${P}_URL`, async () => {
+    const env = await seeded(FULL, { [`${P}_URL`]: 'http://elsewhere' });
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout', '--profile', 'work', '--api-url', 'http://flagged'], h.io)).toBe(0);
+    expect(new Set(h.wire.map((c) => c.origin))).toEqual(new Set(['http://inst']));
+    expect(h.wire).toHaveLength(3);
+  });
+
+  it('--api-url selects the profile of that instance', async () => {
+    const env = await seeded(FULL);
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout', '--api-url', 'http://other/'], h.io)).toBe(0);
+    expect(h.wire).toEqual([
+      {
+        method: 'DELETE',
+        origin: 'http://other',
+        path: '/api/v1/cli/auth/key',
+        auth: `Bearer ${key('other')}`
+      }
+    ]);
+    expect(h.out()).toBe(
+      `Logged out of profile "other" on http://other (1 key revoked server-side).${STAYS}\n`
+    );
+    expect(loadConfig(env).profiles.work?.apiKey).toBe(OWN);
+  });
+
+  it('no profile on disk: nothing to log out of, nothing sent', async () => {
+    const env = await tempConfigEnv();
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout'], h.io)).toBe(1);
+    expect(h.err()).toBe('Error: No profile to log out of.\n');
+    expect(h.wire).toEqual([]);
+  });
+
+  it('a profile that holds no key says so and sends nothing', async () => {
+    const env = await seeded({ baseUrl: 'http://inst' });
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout'], h.io)).toBe(0);
+    expect(h.out()).toBe(`Profile "work" held no key.${STAYS}\n`);
+    expect(h.wire).toEqual([]);
+  });
+
+  it('a 401 on a revoke: already unusable, forgotten', async () => {
+    const env = await seeded(FULL);
+    const h = routedHarness(
+      [
+        revokeRoute({
+          [CONN_A]: refusal(401, 'invalid_api_key'),
+          [OWN]: refusal(401, 'invalid_api_key')
+        })
+      ],
+      env
+    );
+    expect(await run(['logout'], h.io)).toBe(0);
+    expect(h.err()).toBe(
+      'the key of the Antasphere login "default" was already unusable; forgetting it.\n' +
+        'the profile key was already unusable; forgetting it.\n'
+    );
+    expect(h.out()).toBe(
+      `Logged out of profile "work" on http://inst (1 key revoked server-side).${STAYS}\n`
+    );
+    expect(loadConfig(env).profiles.work).toEqual({ baseUrl: 'http://inst' });
+  });
+
+  it('a 403 on a revoke: the key STAYS VALID, said on stderr and in the summary; the local copy goes', async () => {
+    const env = await seeded({ apiKey: OWN, baseUrl: 'http://inst' });
+    const h = routedHarness([revokeRoute({ [OWN]: refusal(403, 'endpoint_not_allowed') })], env);
+    expect(await run(['logout'], h.io)).toBe(0);
+    expect(h.err()).toBe(
+      'The instance refused to revoke the profile key (endpoint_not_allowed): it STAYS VALID server-side; ' +
+        'revoke it from the dashboard. Forgetting the local copy.\n'
+    );
+    expect(h.out()).toBe(
+      `Logged out of profile "work" on http://inst — 1 key could NOT be revoked and stay valid.${STAYS}\n`
+    );
+    expect(loadConfig(env).profiles.work).toEqual({ baseUrl: 'http://inst' });
+  });
+
+  it('--json: the counts, the hub logins, forgotten', async () => {
+    const env = await seeded(FULL);
+    const h = routedHarness([revokeRoute({ [CONN_B]: refusal(403, 'endpoint_not_allowed') })], env);
+    expect(await run(['logout', '--json'], h.io)).toBe(0);
+    expect(JSON.parse(h.out())).toEqual({
+      profile: 'work',
+      baseUrl: 'http://inst',
+      revoked: 2,
+      refused: 1,
+      hubProfiles: ['default', 'personal'],
+      forgotten: true
+    });
+  });
+
+  it('no profile of the tool, an Antasphere login stored: names the two commands that end it, exit 1, nothing sent (PRDCT-3032)', async () => {
+    const env = await tempConfigEnv();
+    seedHubLogin(env);
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout'], h.io)).toBe(1);
+    expect(h.err()).toBe(
+      `Error: Nothing of ${displayName}'s to sign out of on this machine. The Antasphere login ada@x.co ` +
+        `stays for the whole tool family: \`${bin} logout --all\` or \`antasphere logout\` ends it.\n`
+    );
+    expect(h.wire).toEqual([]);
+    expect(loadCoreConfig(env, HUB_TOOL).profiles.default?.apiKey).toBe(HUB_KEY);
+  });
+
+  it('no profile of the tool, --all: the hub key revoked on the hub, the hub profile cleared (PRDCT-3032)', async () => {
+    const env = await tempConfigEnv();
+    seedHubLogin(env);
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout', '--all'], h.io)).toBe(0);
+    expect(h.wire).toEqual([
+      { method: 'DELETE', origin: HUB, path: '/api/v1/cli/auth/key', auth: `Bearer ${HUB_KEY}` }
+    ]);
+    expect(h.out()).toBe(
+      `Nothing of ${displayName}'s to sign out of on this machine. ` +
+        'The Antasphere login ada@x.co is revoked and forgotten.\n'
+    );
+    const hub = loadCoreConfig(env, HUB_TOOL);
+    expect(hub.profiles).toEqual({});
+    expect(hub.activeProfile).toBeUndefined();
+  });
+
+  it("--all on a profile with a cached key: the tool's key revoked on the instance, then the hub key on the hub; both cleared (PRDCT-3032)", async () => {
+    const env = await seeded({ baseUrl: 'http://inst', connectKeys: { default: { apiKey: CONN_A } } });
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout', '--all'], h.io)).toBe(0);
+    expect(h.wire).toEqual([
+      { method: 'DELETE', origin: 'http://inst', path: '/api/v1/cli/auth/key', auth: `Bearer ${CONN_A}` },
+      { method: 'DELETE', origin: HUB, path: '/api/v1/cli/auth/key', auth: `Bearer ${HUB_KEY}` }
+    ]);
+    expect(h.out()).toBe(
+      'Logged out of profile "work" on http://inst (1 key revoked server-side). ' +
+        'The Antasphere login ada@x.co is revoked and forgotten.\n'
+    );
+    expect(loadConfig(env).profiles.work).toEqual({ baseUrl: 'http://inst' });
+    const hub = loadCoreConfig(env, HUB_TOOL);
+    expect(hub.profiles).toEqual({});
+    expect(hub.activeProfile).toBeUndefined();
+  });
+
+  it('the same profile, a plain logout: the tool key alone is revoked, the Antasphere login stays and is named (PRDCT-3032)', async () => {
+    const env = await seeded({ baseUrl: 'http://inst', connectKeys: { default: { apiKey: CONN_A } } });
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout'], h.io)).toBe(0);
+    expect(h.wire).toEqual([
+      { method: 'DELETE', origin: 'http://inst', path: '/api/v1/cli/auth/key', auth: `Bearer ${CONN_A}` }
+    ]);
+    expect(h.out()).toBe(
+      'Logged out of profile "work" on http://inst (1 key revoked server-side). ' +
+        `The Antasphere login ada@x.co stays for the whole tool family (\`${bin} logout --all\` ends it too).\n`
+    );
+    expect(loadCoreConfig(env, HUB_TOOL).profiles.default?.apiKey).toBe(HUB_KEY);
+  });
+
+  it('a profile with no instance of its own revokes on the cloud URL', async () => {
+    const env = await tempConfigEnv();
+    saveConfig(env, { activeProfile: 'mine', profiles: { mine: { apiKey: OWN } } });
+    const h = routedHarness([revokeRoute()], env);
+    expect(await run(['logout'], h.io)).toBe(0);
+    expect(h.wire.map((c) => c.origin)).toEqual([new URL(cli.identity.cloudUrl).origin]);
+  });
+});

package/test/suite/migration.test.ts

@@ -0,0 +1,109 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { routedHarness, tempConfigEnv, type Route } from '@antasphere/chassis-cli/testing';
+import { cli, run } from '@chassis-cli-test/host';
+
+// The kit's config store, and the literals that spell the tool (its identity).
+const { configPath, loadConfig, saveConfig } = cli;
+const { tool, legacyConfigDir, keyPrefix: K } = cli.identity;
+
+/**
+ * The one-shot legacy-config import: profiles saved by pre-cli-core builds
+ * at `$XDG_CONFIG_HOME/<legacyConfigDir>/config.json` are picked up on first run,
+ * NON-destructively (the legacy file stays in place), then never again once
+ * the shared home has the tool's profiles.
+ */
+
+const LEGACY = {
+  activeProfile: 'work',
+  profiles: {
+    work: { apiKey: `${K}_abcdefgh_0123456789abcdef`, baseUrl: 'http://legacy-inst' }
+  }
+};
+
+const ME = {
+  user: { id: 'u1', name: 'Ada', email: 'ada@x.co' },
+  workspace: { id: 'w1', name: 'Acme' },
+  workspaces: [
+    {
+      id: 'w1',
+      name: 'Acme',
+      role: 'owner',
+      hubOrigin: false,
+      centralAccountId: null,
+      look: { theme: null, pattern: null, field: null, grain: null },
+      suspended: false,
+      default: true
+    }
+  ],
+  activeWorkspaceId: 'w1',
+  role: 'owner',
+  via: 'api_key',
+  scopes: ['items:read'],
+  apiKeyExpiresAt: null
+};
+
+const meRoute: Route = { method: 'GET', path: /\/api\/v1\/me$/, reply: () => ({ body: ME }) };
+
+async function writeLegacy(env: Record<string, string>, content: unknown): Promise<string> {
+  const dir = join(env.XDG_CONFIG_HOME!, legacyConfigDir);
+  await mkdir(dir, { recursive: true });
+  const path = join(dir, 'config.json');
+  await writeFile(path, JSON.stringify(content, null, 2));
+  return path;
+}
+
+describe('legacy config migration', () => {
+  it('a first run imports the legacy profile and commands ride it', async () => {
+    const env = await tempConfigEnv();
+    const legacyPath = await writeLegacy(env, LEGACY);
+    const h = routedHarness([meRoute], env);
+    const code = await run(['whoami'], h.io);
+    expect(h.err()).toBe('');
+    expect(code).toBe(0);
+    // whoami resolved the migrated profile's baseUrl + key.
+    expect(h.out()).toContain('http://legacy-inst');
+    // The shared-home file now exists with the imported content…
+    expect(loadConfig(env)).toEqual(LEGACY);
+    expect(configPath(env)).toBe(join(env.XDG_CONFIG_HOME!, 'antasphere', 'tools', `${tool}.json`));
+    // …and the legacy file is untouched (non-destructive).
+    expect(existsSync(legacyPath)).toBe(true);
+    expect(JSON.parse(await readFile(legacyPath, 'utf8'))).toEqual(LEGACY);
+  });
+
+  it('profiles lists the imported profiles; the import happens once', async () => {
+    const env = await tempConfigEnv();
+    await writeLegacy(env, LEGACY);
+    const h = routedHarness([], env);
+    expect(await run(['profiles'], h.io)).toBe(0);
+    expect(h.out()).toContain('work');
+    expect(h.out()).toContain('http://legacy-inst');
+
+    // A later login under a new name does NOT get clobbered by a re-import.
+    saveConfig(env, {
+      activeProfile: 'new',
+      profiles: {
+        ...loadConfig(env).profiles,
+        new: { apiKey: `${K}_new_key_1234567890`, baseUrl: 'http://new' }
+      }
+    });
+    const h2 = routedHarness([], env);
+    expect(await run(['profiles'], h2.io)).toBe(0);
+    expect(loadConfig(env).activeProfile).toBe('new');
+  });
+
+  it(`the legacy file is ignored once the shared home has ${tool} profiles`, async () => {
+    const env = await tempConfigEnv();
+    saveConfig(env, {
+      activeProfile: 'current',
+      profiles: { current: { apiKey: `${K}_current_key_12345`, baseUrl: 'http://current' } }
+    });
+    await writeLegacy(env, LEGACY);
+    const h = routedHarness([meRoute], env);
+    expect(await run(['whoami'], h.io)).toBe(0);
+    expect(h.out()).toContain('http://current');
+    expect(loadConfig(env).profiles.work).toBeUndefined();
+  });
+});

package/test/suite/open.test.ts

@@ -0,0 +1,59 @@
+/* eslint-disable @typescript-eslint/consistent-type-imports -- the `typeof import(…)` casts moved verbatim with their tests (PRDCT-2530) */
+import { EventEmitter } from 'node:events';
+import { describe, expect, it } from 'vitest';
+import { openInBrowser, platformOpener } from '@antasphere/chassis-cli';
+
+/**
+ * The browser opener, the generic half of PRDCT-2280: the platform command,
+ * the URL as its own argv item, the injected `io.openUrl`. What a tool opens
+ * and when (the push decision, `open`, `dev`) is the tool's own open.test.ts.
+ */
+
+describe('the opener', () => {
+  it('is the platform command, the URL its own argv item, never a shell string', () => {
+    expect(platformOpener('darwin')).toEqual({ command: 'open', args: [] });
+    expect(platformOpener('linux')).toEqual({ command: 'xdg-open', args: [] });
+    expect(platformOpener('freebsd')).toEqual({ command: 'xdg-open', args: [] });
+    // `start` is a cmd.exe builtin spawn cannot run; rundll32 is a real binary.
+    expect(platformOpener('win32')).toEqual({ command: 'rundll32', args: ['url.dll,FileProtocolHandler'] });
+  });
+
+  it('spawns with the URL as the last argv item, detached, and never throws', () => {
+    const spawned: Array<{ command: string; args: readonly string[]; opts: unknown }> = [];
+    const fakeSpawn = ((command: string, args: readonly string[], opts: unknown) => {
+      spawned.push({ command, args, opts });
+      const child = new EventEmitter() as EventEmitter & { unref: () => void };
+      child.unref = () => undefined;
+      return child;
+    }) as unknown as typeof import('node:child_process').spawn;
+    const url = 'http://x/decks/abc/present?a=1&b=$(rm -rf /)';
+    openInBrowser(
+      { env: {}, out: { write: () => undefined }, err: { write: () => undefined } },
+      url,
+      fakeSpawn
+    );
+    expect(spawned).toHaveLength(1);
+    expect(spawned[0]!.args[spawned[0]!.args.length - 1]).toBe(url);
+    expect(spawned[0]!.opts).toMatchObject({ detached: true, stdio: 'ignore' });
+    // `shell` is never set: the URL stays one argument.
+    expect((spawned[0]!.opts as { shell?: unknown }).shell).toBeUndefined();
+  });
+
+  it('prefers the injected io.openUrl and spawns nothing', () => {
+    const opened: string[] = [];
+    const fakeSpawn = (() => {
+      throw new Error('must not spawn');
+    }) as unknown as typeof import('node:child_process').spawn;
+    openInBrowser(
+      {
+        env: {},
+        out: { write: () => undefined },
+        err: { write: () => undefined },
+        openUrl: (u) => opened.push(u)
+      },
+      'http://x/decks/abc/present',
+      fakeSpawn
+    );
+    expect(opened).toEqual(['http://x/decks/abc/present']);
+  });
+});