@antasphere/chassis-server 1.0.0

package/test/integration/platform.test.ts

@@ -0,0 +1,246 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import pg from 'pg';
+import { eq } from 'drizzle-orm';
+import { runMigrations } from '@antasphere/chassis-db/migrate';
+import { workspaceMembers } from '@antasphere/chassis-db';
+import { existsSync } from 'node:fs';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+const OWNER = {
+  email: 'owner@example.com',
+  name: 'Owner One',
+  password: 'a-long-owner-password-123'
+};
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+
+// The host's own history, the folder its boot applies (the chassis's fixture
+// here, the tool's packages/db/drizzle under the tool's host).
+const migrationsFolder = host.migrationsDir;
+if (!existsSync(migrationsFolder)) throw new Error(`migrations not found at ${migrationsFolder}`);
+
+beforeAll(async () => {
+  container = await startPostgres();
+  app = await createTestApp(container.getConnectionUri());
+});
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('migrations', () => {
+  it('is idempotent: a second run applies nothing', async () => {
+    // Boot already migrated. Run the migrator again and compare the journal.
+    const client = new pg.Client({ connectionString: container.getConnectionUri() });
+    await client.connect();
+    const before = await client.query('SELECT count(*)::int AS n FROM drizzle.__drizzle_migrations');
+    await runMigrations({ connectionString: container.getConnectionUri(), migrationsFolder });
+    const after = await client.query('SELECT count(*)::int AS n FROM drizzle.__drizzle_migrations');
+    await client.end();
+    expect(after.rows[0].n).toBe(before.rows[0].n);
+    expect(before.rows[0].n).toBeGreaterThan(0);
+  });
+
+  it('ships an image where pgvector is installable (products run CREATE EXTENSION — ADR 004)', async () => {
+    const client = new pg.Client({ connectionString: container.getConnectionUri() });
+    await client.connect();
+    const res = await client.query(
+      `SELECT count(*)::int AS n FROM pg_available_extensions WHERE name = 'vector'`
+    );
+    await client.end();
+    expect(res.rows[0].n).toBe(1);
+  });
+});
+
+describe('first-boot setup', () => {
+  it('reports setupRequired before setup', async () => {
+    const res = await app.app.request('/api/v1/instance');
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    expect(body.setupRequired).toBe(true);
+    expect(body.instanceId).toBeNull();
+    expect(body.auth.methods).toContain('password');
+  });
+
+  it('creates owner + workspace, then flips setupRequired', async () => {
+    const res = await app.app.request('/api/v1/setup', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        setupToken: 'integration-test-setup-token',
+        instanceName: 'Test Instance',
+        owner: OWNER
+      })
+    });
+    expect(res.status).toBe(201);
+    const body = await readJson(res);
+    expect(body.workspaceId).toBeTruthy();
+    expect(body.ownerUserId).toBeTruthy();
+    expect(body.instanceId).toMatch(/^[0-9A-HJKMNP-TV-Z]{26}$/); // ULID
+
+    const inst = await app.app.request('/api/v1/instance');
+    const instBody = await readJson(inst);
+    expect(instBody.setupRequired).toBe(false);
+    expect(instBody.name).toBe('Test Instance');
+  });
+
+  it('returns 410 on a second setup attempt', async () => {
+    const res = await app.app.request('/api/v1/setup', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        setupToken: 'integration-test-setup-token',
+        instanceName: 'Again',
+        owner: { ...OWNER, email: 'other@example.com' }
+      })
+    });
+    expect(res.status).toBe(410);
+    const body = await readJson(res);
+    expect(body.error.code).toBe('already_setup');
+  });
+});
+
+describe('authentication + /me', () => {
+  let cookie: string;
+
+  it('signs in the owner with password and gets a session cookie', async () => {
+    const res = await app.app.request('/api/v1/auth/sign-in/email', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ email: OWNER.email, password: OWNER.password })
+    });
+    expect(res.status).toBe(200);
+    cookie = extractCookie(res);
+    expect(cookie).toContain('better-auth');
+  });
+
+  it('resolves /me with the session cookie (role owner, via session)', async () => {
+    const res = await app.app.request('/api/v1/me', { headers: { cookie } });
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    expect(body.user.email).toBe(OWNER.email);
+    expect(body.role).toBe('owner');
+    expect(body.via).toBe('session');
+    expect(body.scopes).toBeNull();
+    expect(body.workspace.name).toBe('Test Instance');
+  });
+
+  it('401s without credentials', async () => {
+    const res = await app.app.request('/api/v1/me');
+    expect(res.status).toBe(401);
+  });
+
+  it('401s a JWT-shaped bearer that this instance never minted', async () => {
+    const res = await app.app.request('/api/v1/me', {
+      headers: { authorization: 'Bearer aaa.bbb.ccc' }
+    });
+    expect(res.status).toBe(401);
+    const body = await readJson(res);
+    expect(body.error.code).toBe('invalid_token');
+  });
+
+  it('revokes instantly: deactivating the membership kills the live session', async () => {
+    const me = await app.app.request('/api/v1/me', { headers: { cookie } });
+    const body = await readJson(me);
+    // The last-owner trigger (migration 0009) forbids deactivating the sole
+    // owner, so seed a throwaway sibling owner first — this test is about the
+    // live re-check killing the subject's session, not the last-owner rule.
+    const siblingUserId = `sibling-${body.user.id}`;
+    await app.db.pool.query(
+      `INSERT INTO "user" (id, name, email, email_verified) VALUES ($1, 'Sibling Owner', $2, true)`,
+      [siblingUserId, `sibling-${Date.now()}@revoke.test`]
+    );
+    await app.db.pool.query(
+      `INSERT INTO workspace_members (workspace_id, user_id, role, is_active) VALUES ($1, $2, 'owner', true)`,
+      [body.workspace.id, siblingUserId]
+    );
+    try {
+      await app.db.db
+        .update(workspaceMembers)
+        .set({ isActive: false })
+        .where(eq(workspaceMembers.userId, body.user.id));
+
+      // The live re-check kills WORKSPACE access instantly: a real
+      // workspace endpoint 401s (no active membership resolves).
+      const denied = await app.app.request(host.probeRoute, { headers: { cookie } });
+      expect(denied.status).toBe(401);
+      // /me itself now answers the zero-membership zero state (200, empty
+      // list) rather than a 401 — the user is signed in but belongs to no
+      // workspace (user-scoped credential model); the dashboard renders the
+      // no-organization page instead of bouncing to login.
+      const after = await app.app.request('/api/v1/me', { headers: { cookie } });
+      expect(after.status).toBe(200);
+      const afterBody = await readJson(after);
+      expect(afterBody.workspaces).toEqual([]);
+      expect(afterBody.activeWorkspaceId).toBeNull();
+    } finally {
+      // restore even when the assertion fails — later suites need the owner
+      await app.db.db
+        .update(workspaceMembers)
+        .set({ isActive: true })
+        .where(eq(workspaceMembers.userId, body.user.id));
+      // drop the sibling (owner still active, so the trigger is satisfied)
+      await app.db.pool.query(`DELETE FROM workspace_members WHERE user_id = $1`, [siblingUserId]);
+      await app.db.pool.query(`DELETE FROM "user" WHERE id = $1`, [siblingUserId]);
+    }
+  });
+
+  it('blocks public HTTP sign-up (accounts enter via setup or invitations)', async () => {
+    const res = await app.app.request('/api/v1/auth/sign-up/email', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ email: 'squatter@example.com', password: 'x'.repeat(16), name: 'Squatter' })
+    });
+    expect(res.status).toBe(403);
+  });
+});
+
+describe('setup token', () => {
+  it('enforces SETUP_TOKEN when configured (403 wrong, 201 right)', async () => {
+    const url = await createDatabase(container, 'setup_token_test');
+    const tokenApp = await createTestApp(url, { SETUP_TOKEN: 'super-setup-token' });
+    try {
+      const wrong = await tokenApp.app.request('/api/v1/setup', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ instanceName: 'T', owner: OWNER, setupToken: 'nope-wrong-token' })
+      });
+      expect(wrong.status).toBe(403);
+
+      const right = await tokenApp.app.request('/api/v1/setup', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ instanceName: 'T', owner: OWNER, setupToken: 'super-setup-token' })
+      });
+      expect(right.status).toBe(201);
+    } finally {
+      await tokenApp.stop();
+    }
+  });
+});
+
+describe('openapi + health', () => {
+  it('serves a generated OpenAPI document', async () => {
+    const res = await app.app.request('/api/v1/openapi.json');
+    expect(res.status).toBe(200);
+    const doc = await readJson(res);
+    expect(doc.openapi).toBe('3.1.0');
+    expect(Object.keys(doc.paths)).toEqual(expect.arrayContaining(['/instance', '/setup', '/me']));
+  });
+
+  it('reports ready after boot', async () => {
+    const res = await app.app.request('/readyz');
+    expect(res.status).toBe(200);
+  });
+});

package/test/integration/pool-survives-restart.test.ts

@@ -0,0 +1,80 @@
+import { createDb } from '@antasphere/chassis-db';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import pg from 'pg';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { endPool, startPostgres } from '../../src/testing/helpers.js';
+
+/**
+ * The production pool survives what a Postgres restart does to it (lane A's
+ * verifier, F5). node-postgres emits `error` on the POOL when an idle client's
+ * connection ends on the server's side; with no listener that event is an
+ * uncaught exception and the process dies with 57P01. `createDb` listens, so
+ * the cost of a restart is one reconnect.
+ *
+ * The backends are ended with `pg_terminate_backend`, from a connection of its
+ * own: exactly what a restart, a failover or an administrator does.
+ */
+let container: StartedPostgreSqlContainer;
+
+beforeAll(async () => {
+  container = await startPostgres();
+}, 120_000);
+
+afterAll(async () => {
+  await container?.stop();
+});
+
+/** Ends every other backend of this database, the way a restart would. */
+async function terminateOtherBackends(url: string): Promise<number> {
+  const admin = new pg.Client({ connectionString: url });
+  await admin.connect();
+  try {
+    const res = await admin.query<{ ended: boolean }>(
+      `select pg_terminate_backend(pid) as ended from pg_stat_activity
+        where datname = current_database() and pid <> pg_backend_pid()`
+    );
+    return res.rows.filter((r) => r.ended).length;
+  } finally {
+    await admin.end();
+  }
+}
+
+describe('createDb: an idle pooled connection ended by the server', () => {
+  it('reaches the listener, never the process, and the next query gets a new connection', async () => {
+    const url = container.getConnectionUri();
+    const seen: Array<{ code?: string }> = [];
+    const uncaught: unknown[] = [];
+    const onUncaught = (err: unknown) => uncaught.push(err);
+    process.on('uncaughtException', onUncaught);
+
+    const { pool } = createDb(url, {}, { onIdleError: (err) => seen.push(err as { code?: string }) });
+    try {
+      // three IDLE clients: checked out together, then all released
+      const clients = await Promise.all([pool.connect(), pool.connect(), pool.connect()]);
+      for (const c of clients) c.release();
+      expect(pool.idleCount).toBe(3);
+
+      expect(await terminateOtherBackends(url)).toBe(3);
+      await expect.poll(() => seen.length, { timeout: 10_000 }).toBe(3);
+
+      expect(seen.map((e) => e.code)).toEqual(['57P01', '57P01', '57P01']);
+      expect(uncaught).toEqual([]);
+      // the dead clients left the pool, and the pool still serves
+      expect(pool.totalCount).toBe(0);
+      const res = await pool.query<{ one: number }>('select 1 as one');
+      expect(res.rows[0]?.one).toBe(1);
+    } finally {
+      process.off('uncaughtException', onUncaught);
+      await endPool(pool);
+    }
+  });
+
+  it('listens even when the caller gives no callback: the bare handle is safe too', async () => {
+    const { pool } = createDb(container.getConnectionUri(), {});
+    try {
+      expect(pool.listenerCount('error')).toBeGreaterThanOrEqual(1);
+    } finally {
+      await endPool(pool);
+    }
+  });
+});

package/test/integration/projects-cloud.test.ts

@@ -0,0 +1,193 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { and, eq } from 'drizzle-orm';
+import { projectMembers, workspaceMembers } from '@antasphere/chassis-db';
+import { createDatabase, createTestApp, readJson, startPostgres, type TestApp, host } from './helpers.js';
+import { FakeHub, type HubUserFixture } from '@antasphere/chassis-server/testing';
+import * as sso from './sso-helpers.js';
+
+/**
+ * Project membership is the tool's own ON BOTH EDITIONS: never behind the
+ * hub-managed gate. On `EDITION=cloud`, in a HUB-ORIGIN (projected) workspace,
+ * where every local membership mutation answers 403 `hub_managed`
+ * (hub-managed-membership.test.ts), a project is created and its members are
+ * added, changed and removed locally. Nothing here can diverge from the hub:
+ * members are picked among the workspace's existing members, and no
+ * invitation, claim or account is minted.
+ *
+ * The second half is the other side of the same coin: when the hub's
+ * reconcile sweeps a membership, the grants that rode on it go with it.
+ */
+const ORG = '26260000-aaaa-4bbb-8ccc-000000000001';
+/** A second org of the member's, so their session keeps resolving while ORG is swept. */
+const ORG_OTHER = '26260000-aaaa-4bbb-8ccc-000000000002';
+
+const DIALS = {
+  reconcileTtlMs: 120,
+  reconcileStaleMaxMs: 60_000,
+  retryMs: 250,
+  orgsTimeoutMs: 400,
+  tokenTimeoutMs: 2_000
+};
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+/** Let the per-user reconcile cache expire so the next request runs a fresh pass. */
+const expireTtl = () => sleep(DIALS.reconcileTtlMs + 40);
+
+const hubOwner: HubUserFixture = {
+  sub: 'hub-owner-projects',
+  email: 'hub-owner@projects-cloud.test',
+  name: 'Hub Owner',
+  workspaceId: ORG,
+  role: 'owner',
+  workspaceName: 'Org Projects'
+};
+const hubMember: HubUserFixture = {
+  sub: 'hub-member-projects',
+  email: 'hub-member@projects-cloud.test',
+  name: 'Hub Member',
+  workspaceId: ORG,
+  role: 'member',
+  workspaceName: 'Org Projects'
+};
+
+let container: StartedPostgreSqlContainer;
+let hub: FakeHub;
+let app: TestApp;
+let ownerCookie = '';
+let memberCookie = '';
+let workspaceId = '';
+let memberUserId = '';
+
+let ipCounter = 0;
+const nextIp = () => `10.78.0.${(ipCounter++ % 250) + 1}`;
+
+const send = (method: string, path: string, cookie: string, body?: unknown) =>
+  app.app.request(`/api/v1${path}`, {
+    method,
+    headers: {
+      cookie,
+      'x-workspace-id': workspaceId,
+      'x-forwarded-for': nextIp(),
+      ...(body !== undefined ? { 'content-type': 'application/json' } : {})
+    },
+    ...(body !== undefined ? { body: JSON.stringify(body) } : {})
+  });
+
+beforeAll(async () => {
+  [container, hub] = await Promise.all([startPostgres(), FakeHub.start({ clientId: host.hubClientId })]);
+  app = await createTestApp(
+    await createDatabase(container, 'projects_cloud'),
+    {
+      EDITION: 'cloud',
+      HUB_ISSUER_URL: hub.issuer,
+      HUB_CLIENT_ID: host.hubClientId,
+      HUB_CLIENT_SECRET: 'integration-test-hub-secret-projects'
+    },
+    { hubDials: DIALS }
+  );
+  const setup = await app.app.request('/api/v1/setup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-forwarded-for': nextIp() },
+    body: JSON.stringify({
+      setupToken: 'integration-test-setup-token',
+      instanceName: 'Projects Cloud',
+      owner: { email: 'operator@projects-cloud.test', name: 'Operator', password: 'operator-pass-projects-1' }
+    })
+  });
+  expect(setup.status).toBe(201);
+
+  ownerCookie = await sso.ssoLogin(app, hub, hubOwner);
+  const me = await readJson(await app.app.request('/api/v1/me', { headers: { cookie: ownerCookie } }));
+  workspaceId = me.activeWorkspaceId;
+  expect(me.workspace.hubOrigin).toBe(true);
+  memberCookie = await sso.ssoLogin(app, hub, hubMember);
+  const memberMe = await readJson(await app.app.request('/api/v1/me', { headers: { cookie: memberCookie } }));
+  expect(memberMe.activeWorkspaceId).toBe(workspaceId);
+  memberUserId = memberMe.user.id;
+}, 180_000);
+
+afterAll(async () => {
+  await app?.stop();
+  await Promise.all([container?.stop(), hub?.stop()]);
+});
+
+describe('cloud edition, hub-origin workspace', () => {
+  let projectId = '';
+
+  it('a project member is added locally (201) while POST /invitations answers 403 hub_managed', async () => {
+    const created = await send('POST', '/projects', ownerCookie, { name: 'Cloud project' });
+    expect(created.status).toBe(201);
+    projectId = (await readJson(created)).id;
+
+    const added = await send('POST', `/projects/${projectId}/members`, ownerCookie, {
+      email: hubMember.email,
+      role: 'editor'
+    });
+    expect(added.status).toBe(201);
+    expect(await readJson(added)).toMatchObject({ userId: memberUserId, role: 'editor' });
+
+    const invite = await send('POST', '/invitations', ownerCookie, {
+      email: 'newcomer@projects-cloud.test',
+      role: 'member'
+    });
+    expect(invite.status).toBe(403);
+    expect((await readJson(invite)).error.code).toBe('hub_managed');
+  });
+
+  it('a plain hub member creates a project of their own, and every other project mutation stays local too', async () => {
+    const own = await send('POST', '/projects', memberCookie, { name: 'A member’s own' });
+    expect(own.status).toBe(201);
+
+    const role = await send('PATCH', `/projects/${projectId}/members/${memberUserId}`, ownerCookie, {
+      role: 'viewer'
+    });
+    expect(role.status).toBe(200);
+    expect((await send('PATCH', `/projects/${projectId}`, ownerCookie, { name: 'Renamed' })).status).toBe(
+      200
+    );
+    expect((await send('POST', `/projects/${projectId}/archive`, ownerCookie)).status).toBe(200);
+    expect((await send('POST', `/projects/${projectId}/unarchive`, ownerCookie)).status).toBe(200);
+    expect((await send('DELETE', `/projects/${projectId}/members/${memberUserId}`, ownerCookie)).status).toBe(
+      200
+    );
+  });
+
+  it('a membership the hub sweeps loses its project grants, and a re-add at the hub starts with none', async () => {
+    const back = await send('POST', `/projects/${projectId}/members`, ownerCookie, {
+      userId: memberUserId,
+      role: 'editor'
+    });
+    expect(back.status).toBe(201);
+    expect((await send('GET', `/projects/${projectId}`, memberCookie)).status).toBe(200);
+    const membership = async () => {
+      const [row] = await app.db.db
+        .select({ id: workspaceMembers.id, isActive: workspaceMembers.isActive })
+        .from(workspaceMembers)
+        .where(and(eq(workspaceMembers.userId, memberUserId), eq(workspaceMembers.workspaceId, workspaceId)));
+      return row!;
+    };
+    const before = await membership();
+
+    // Removed from the org at the hub. The reconcile DEACTIVATES the local
+    // row, it never deletes it, so the foreign key's cascade does not fire:
+    // the sweep itself takes the grants.
+    hub.setUserOrg(hubMember.sub, ORG_OTHER, { name: 'Another Org', role: 'member' });
+    hub.removeUserOrg(hubMember.sub, ORG);
+    await expireTtl();
+    await app.app.request('/api/v1/me', { headers: { cookie: memberCookie } });
+    expect(await membership()).toEqual({ id: before.id, isActive: false });
+    expect(
+      await app.db.db.select().from(projectMembers).where(eq(projectMembers.memberId, before.id))
+    ).toEqual([]);
+
+    // Added back at the hub: the SAME row comes back to life, with no grant.
+    hub.setUserOrg(hubMember.sub, ORG, { name: 'Org Projects', role: 'member' });
+    await expireTtl();
+    await app.app.request('/api/v1/me', { headers: { cookie: memberCookie } });
+    expect(await membership()).toEqual({ id: before.id, isActive: true });
+    const gone = await send('GET', `/projects/${projectId}`, memberCookie);
+    expect(gone.status).toBe(404);
+    const listed = await readJson(await send('GET', '/projects?archived=all', memberCookie));
+    expect(listed.projects.map((p: { id: string }) => p.id)).not.toContain(projectId);
+  });
+});