@bevel-software/platform-core-backend 0.1.0

package/src/modules/workflow/__tests__/session-ontology.service.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+import { SessionOntologyService } from '../session-ontology.service.js';
+import type { Database } from '../../database/connection.js';
+
+const PRODUCT = 'KnowledgeBase/Product';
+const PLATFORM = 'KnowledgeBase/Platform';
+const P_READ = 'KnowledgeBase/Product/Knowledge/Foo.md';
+const PL_READ = 'KnowledgeBase/Platform/Knowledge/Bar.md';
+
+/**
+ * Faithful in-memory fake of the slice of the Drizzle `Database` the service
+ * uses against the `session_ontology_touches` table (one row per
+ * `(session_id, ontology)`):
+ *  - `insert().onConflictDoNothing()` adds a row unless the PK pair exists.
+ *  - `select({ontology}).from().where(eq(session))` returns the session's rows.
+ *  - `delete().where(eq(session) | lt(touchedAt, cutoff))` removes rows.
+ *
+ * A live-Postgres integration test (real PK conflict, real `touched_at < now()`
+ * sweep) is still owed once the repo grows a Postgres test harness (tasks 3.4).
+ */
+interface Row {
+  sessionId: string;
+  ontology: string;
+  touchedAt: Date;
+}
+
+function makeFakeDb() {
+  const rows: Row[] = [];
+  const db = {
+    _rows: rows,
+    insert() {
+      return {
+        values(v: { sessionId: string; ontology: string }) {
+          return {
+            onConflictDoNothing() {
+              const exists = rows.some((r) => r.sessionId === v.sessionId && r.ontology === v.ontology);
+              if (!exists) rows.push({ sessionId: v.sessionId, ontology: v.ontology, touchedAt: new Date() });
+              return Promise.resolve([]);
+            },
+          };
+        },
+      };
+    },
+    select() {
+      return {
+        from() {
+          return {
+            async where(pred: { sessionId: string }) {
+              return rows
+                .filter((r) => r.sessionId === pred.sessionId)
+                .map((r) => ({ ontology: r.ontology }));
+            },
+          };
+        },
+      };
+    },
+    delete() {
+      return {
+        where(pred: { sessionId?: string; cutoff?: Date }) {
+          if (pred.sessionId !== undefined) {
+            for (let i = rows.length - 1; i >= 0; i--) {
+              if (rows[i].sessionId === pred.sessionId) rows.splice(i, 1);
+            }
+            return { async returning() { return []; } } as never;
+          }
+          const removed: { sessionId: string }[] = [];
+          for (let i = rows.length - 1; i >= 0; i--) {
+            if (pred.cutoff && rows[i].touchedAt < pred.cutoff) {
+              removed.push({ sessionId: rows[i].sessionId });
+              rows.splice(i, 1);
+            }
+          }
+          return { async returning() { return removed; } } as never;
+        },
+      };
+    },
+  };
+  return db;
+}
+
+vi.mock('drizzle-orm', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('drizzle-orm')>();
+  return {
+    ...actual,
+    eq: (_col: unknown, val: string) => ({ sessionId: val }),
+    lt: (_col: unknown, val: Date) => ({ cutoff: val }),
+  };
+});
+
+function makeService() {
+  const db = makeFakeDb();
+  return { svc: new SessionOntologyService(db as unknown as Database), db };
+}
+
+describe('SessionOntologyService (touched-set model)', () => {
+  let svc: SessionOntologyService;
+  let db: ReturnType<typeof makeFakeDb>;
+
+  beforeEach(() => {
+    ({ svc, db } = makeService());
+  });
+
+  it('records a read and allows it', async () => {
+    const d = await svc.checkOperation('s1', P_READ, false);
+    expect(d.allow).toBe(true);
+    expect(await svc.getTouched('s1')).toEqual([PRODUCT]);
+  });
+
+  it('allows reads ACROSS ontologies (reads are never blocked)', async () => {
+    expect((await svc.checkOperation('s1', P_READ, false)).allow).toBe(true);
+    expect((await svc.checkOperation('s1', PL_READ, false)).allow).toBe(true);
+    expect(await svc.getTouched('s1')).toEqual([PLATFORM, PRODUCT]);
+  });
+
+  it('allows a write while the session is confined to that one ontology', async () => {
+    await svc.checkOperation('s1', P_READ, false);
+    expect((await svc.checkOperation('s1', P_READ, true)).allow).toBe(true);
+  });
+
+  it('allows the first write with no prior reads and pins to it', async () => {
+    expect((await svc.checkOperation('s1', P_READ, true)).allow).toBe(true);
+    expect(await svc.getTouched('s1')).toEqual([PRODUCT]);
+  });
+
+  it('blocks a write to a different ontology than the one read (different-ontology)', async () => {
+    // Load-bearing for the start_session↔ask unification: the touched-set is
+    // keyed purely by sessionId, so a READ and a later WRITE that share ONE id
+    // hit the same set and cross-ontology writes are refused. This only protects
+    // the read→ask flow because both now run under the SAME id (start_session
+    // mints a real chat thread; ask accepts it). If a refactor re-splits those
+    // namespaces, the read and the ask write land in different touched-sets and
+    // this guarantee silently evaporates — see workspace.tools.ts start_session.
+    await svc.checkOperation('s1', P_READ, false);
+    const d = await svc.checkOperation('s1', PL_READ, true);
+    expect(d).toMatchObject({ allow: false, reason: 'different-ontology', attempted: PLATFORM });
+    // The blocked write does NOT record Platform.
+    expect(await svc.getTouched('s1')).toEqual([PRODUCT]);
+  });
+
+  it('blocks ALL writes once the session has read across two ontologies (multi-ontology)', async () => {
+    await svc.checkOperation('s1', P_READ, false);
+    await svc.checkOperation('s1', PL_READ, false); // reads across — poisons writes
+    // Even a write back into Product is now blocked.
+    const back = await svc.checkOperation('s1', P_READ, true);
+    expect(back).toMatchObject({ allow: false, reason: 'multi-ontology' });
+    const other = await svc.checkOperation('s1', PL_READ, true);
+    expect(other.allow).toBe(false);
+  });
+
+  it('treats a neutral path as always-allowed and never recorded', async () => {
+    const d = await svc.checkOperation('s1', 'access.md', true);
+    expect(d.allow).toBe(true);
+    expect(await svc.getTouched('s1')).toEqual([]);
+  });
+
+  it('survives a "restart": a new instance re-reads the touched set from the store', async () => {
+    await svc.checkOperation('s1', P_READ, false);
+    await svc.checkOperation('s1', PL_READ, false);
+    const afterRestart = new SessionOntologyService(db as unknown as Database);
+    // The poison persists across the restart: writes still blocked.
+    expect((await afterRestart.checkOperation('s1', P_READ, true)).allow).toBe(false);
+  });
+
+  it('reclaims a session on delete so it can write again', async () => {
+    await svc.checkOperation('s1', P_READ, false);
+    await svc.checkOperation('s1', PL_READ, false);
+    await svc.delete('s1');
+    expect(await svc.getTouched('s1')).toEqual([]);
+    expect((await svc.checkOperation('s1', P_READ, true)).allow).toBe(true);
+  });
+
+  it('sweeps abandoned sessions older than the cutoff', async () => {
+    await svc.checkOperation('old', P_READ, false);
+    db._rows.forEach((r) => { if (r.sessionId === 'old') r.touchedAt = new Date(Date.now() - 60_000); });
+    const removed = await svc.sweepOlderThan(new Date(Date.now() - 30_000));
+    expect(removed).toBe(1);
+    expect(await svc.getTouched('old')).toEqual([]);
+  });
+
+  it('records each ontology only once (idempotent touches)', async () => {
+    await svc.checkOperation('s1', P_READ, false);
+    await svc.checkOperation('s1', P_READ, false);
+    await svc.checkOperation('s1', P_READ, false);
+    expect(db._rows.filter((r) => r.sessionId === 's1').length).toBe(1);
+  });
+
+  it('serializes two concurrent same-session writes to different ontologies (only one wins)', async () => {
+    // Without per-session serialization both could observe an empty touched set
+    // and both pin to a different ontology before either INSERT lands.
+    const [a, b] = await Promise.all([
+      svc.checkOperation('s1', P_READ, true), // write → Product
+      svc.checkOperation('s1', PL_READ, true), // write → Platform (concurrent)
+    ]);
+    // Exactly one write is allowed; the loser is blocked as different-ontology.
+    expect([a, b].filter((d) => d.allow)).toHaveLength(1);
+    // Only the winner's ontology is recorded.
+    expect(await svc.getTouched('s1')).toHaveLength(1);
+  });
+});

package/src/modules/workflow/__tests__/workflow.service.commitFileWhileLocked.test.ts

@@ -0,0 +1,232 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { AuthUser, Change } from '@bevel-software/platform-shared';
+import type { GitService } from '../git/git.service.js';
+import type { PullRequestService } from '../git/pull-request.service.js';
+import type { IReviewWorkflowService } from '../review-workflow/review-workflow.interface.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { IAccessControl } from '../../access/access-control.interface.js';
+import { FileLockService } from '../file-lock.service.js';
+import { PendingCommitsService } from '../pending-commits.service.js';
+import { WorkflowEventBus } from '../event-bus.js';
+import { WorkflowService } from '../workflow.service.js';
+import type { Database } from '../../database/connection.js';
+import { WorkflowValidationError } from '../workflow.errors.js';
+
+/**
+ * `commitFileWhileLocked` (autosave checkpoint) has subtler semantics
+ * than `releaseLock`: the lock stays held, push failures are best-effort
+ * (the user is mid-edit and shouldn't see a failed-save banner for a
+ * background autosave), and `file-changed` still fires on a landed
+ * commit so other tailing clients refresh promptly. These tests pin
+ * those distinctions down so a future refactor can't quietly turn
+ * "autosave is best-effort" into "autosave throws and breaks the editor".
+ */
+
+const USER: AuthUser = { id: 'user-1', email: 'alice@example.com', name: 'Alice' };
+
+const CHANGE: Change = {
+  sha: 'def4567',
+  authorName: 'Alice',
+  authorEmail: 'alice@example.com',
+  subject: 'checkpoint',
+  committedAt: '2026-04-20T00:00:00.000Z',
+};
+
+function makeFileLocks(holderUserId: string | null): FileLockService {
+  return {
+    acquire: vi.fn(),
+    heartbeat: vi.fn(),
+    release: vi.fn(),
+    get: vi.fn().mockResolvedValue(
+      holderUserId === null
+        ? null
+        : {
+            branch: 'feat/x',
+            path: 'foo.md',
+            holderUserId,
+            holderName: 'Alice',
+            acquiredAt: '',
+            lastHeartbeatAt: '',
+            expiresAt: '',
+          },
+    ),
+  } as unknown as FileLockService;
+}
+
+function makeGit(overrides: Partial<{
+  commitFile: Change | null;
+  pushBehavior: 'ok' | 'nff' | 'auth-fail';
+  pullBehavior: 'ok' | 'fail';
+  pushAfterPullBehavior: 'ok' | 'fail';
+}> = {}): GitService {
+  const commitFileResult = overrides.commitFile === undefined ? CHANGE : overrides.commitFile;
+  const pushBehavior = overrides.pushBehavior ?? 'ok';
+  const pullBehavior = overrides.pullBehavior ?? 'ok';
+  const pushAfterPullBehavior = overrides.pushAfterPullBehavior ?? 'ok';
+  let pushCalls = 0;
+  return {
+    commitFile: vi.fn().mockResolvedValue(commitFileResult),
+    push: vi.fn().mockImplementation(async () => {
+      pushCalls++;
+      const phase = pushCalls === 1 ? pushBehavior : pushAfterPullBehavior;
+      if (phase === 'nff') {
+        throw new Error(
+          'git push failed: Command failed: ...\n ! [rejected]        feat/x (non-fast-forward)',
+        );
+      }
+      if (phase === 'auth-fail') {
+        throw new Error('fatal: Authentication failed');
+      }
+      if (phase === 'fail') {
+        throw new Error('git push failed (post-pull retry)');
+      }
+    }),
+    pull: vi.fn().mockImplementation(async () => {
+      if (pullBehavior === 'fail') throw new Error('git pull failed: merge conflict');
+    }),
+  } as unknown as GitService;
+}
+
+function makeFacade(git: GitService, locks: FileLockService, events: WorkflowEventBus): WorkflowService {
+  // Pending-commits is irrelevant to commitFileWhileLocked (autosave
+  // checkpoint commits land synchronously, not through the queue), so a
+  // bare stub suffices.
+  const pending = {
+    enqueue: vi.fn().mockResolvedValue(undefined),
+    claimNext: vi.fn().mockResolvedValue(null),
+    markSucceeded: vi.fn().mockResolvedValue(undefined),
+    markTransientFailure: vi.fn().mockResolvedValue(undefined),
+    markRecoveryStarted: vi.fn().mockResolvedValue(undefined),
+    markNeedsAttention: vi.fn().mockResolvedValue(undefined),
+    listNeedsAttention: vi.fn().mockResolvedValue([]),
+    countPending: vi.fn().mockResolvedValue(0),
+    startupReconcile: vi.fn().mockResolvedValue(undefined),
+  } as unknown as PendingCommitsService;
+  return new WorkflowService(
+    {} as unknown as Database,
+    git,
+    {} as PullRequestService,
+    {} as IReviewWorkflowService,
+    {} as WorkspaceService,
+    {} as IAccessControl,
+    locks,
+    pending,
+    'knowledge-base',
+    events,
+  );
+}
+
+describe('WorkflowService.commitFileWhileLocked', () => {
+  let events: WorkflowEventBus;
+  let emitSpy: ReturnType<typeof spyOnEmit>;
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  function spyOnEmit() { return vi.spyOn(new WorkflowEventBus(), 'emit'); }
+
+  beforeEach(() => {
+    events = new WorkflowEventBus();
+    emitSpy = vi.spyOn(events, 'emit');
+  });
+
+  it('happy path: commits, pushes, leaves lock held, emits file-changed (NOT lock-released)', async () => {
+    // Autosave-style checkpoint: midway through editing, persist + commit
+    // so a crash doesn't lose progress. The lock STAYS held so the user
+    // can keep typing without re-acquiring on every keystroke.
+    const git = makeGit();
+    const locks = makeFileLocks(USER.id);
+    const svc = makeFacade(git, locks, events);
+
+    const change = await svc.commitFileWhileLocked('ws-1', 'feat/x', 'foo.md', USER);
+
+    expect(change).toEqual(CHANGE);
+    expect(git.commitFile).toHaveBeenCalledTimes(1);
+    expect(git.push).toHaveBeenCalledTimes(1);
+    // Crucial: NO lock-released emit (the lock is still held).
+    expect(emitSpy.mock.calls.map((c) => (c[0] as { kind: string }).kind)).toEqual([
+      'file-changed',
+    ]);
+    expect(emitSpy.mock.calls[0][0]).toMatchObject({
+      kind: 'file-changed',
+      newSha: CHANGE.sha,
+    });
+    expect(locks.release).not.toHaveBeenCalled();
+  });
+
+  it('returns null without pushing or emitting when commitFile finds no diff', async () => {
+    const git = makeGit({ commitFile: null });
+    const locks = makeFileLocks(USER.id);
+    const svc = makeFacade(git, locks, events);
+
+    const change = await svc.commitFileWhileLocked('ws-1', 'feat/x', 'foo.md', USER);
+
+    expect(change).toBeNull();
+    expect(git.push).not.toHaveBeenCalled();
+    expect(emitSpy).not.toHaveBeenCalled();
+  });
+
+  it('throws lock-not-held when the caller does not hold the lock', async () => {
+    const git = makeGit();
+    const locks = makeFileLocks('someone-else');
+    const svc = makeFacade(git, locks, events);
+
+    await expect(svc.commitFileWhileLocked('ws-1', 'feat/x', 'foo.md', USER)).rejects.toBeInstanceOf(
+      WorkflowValidationError,
+    );
+    expect(git.commitFile).not.toHaveBeenCalled();
+    expect(emitSpy).not.toHaveBeenCalled();
+  });
+
+  it('still emits file-changed when push fails with a non-recoverable error (commit landed locally)', async () => {
+    // Autosave is best-effort on push. If we can't ship the bytes upstream
+    // (e.g. transient auth failure), we still emit `file-changed` so the
+    // same user's other open tabs / agent see the local commit. The push
+    // catches up on the next checkpoint or final release.
+    const git = makeGit({ pushBehavior: 'auth-fail' });
+    const locks = makeFileLocks(USER.id);
+    const svc = makeFacade(git, locks, events);
+
+    // Should NOT throw — autosave is best-effort.
+    const change = await svc.commitFileWhileLocked('ws-1', 'feat/x', 'foo.md', USER);
+    expect(change).toEqual(CHANGE);
+    expect(git.pull).not.toHaveBeenCalled();
+    expect(emitSpy.mock.calls.map((c) => (c[0] as { kind: string }).kind)).toEqual([
+      'file-changed',
+    ]);
+  });
+
+  it('attempts pull --rebase + retry push on non-fast-forward, then emits file-changed', async () => {
+    // Same recovery as releaseLock — a teammate pushed first, we pull
+    // their commits, then retry. The autosave is best-effort so even
+    // if recovery fails we don't throw (covered by next test).
+    const git = makeGit({ pushBehavior: 'nff' });
+    const locks = makeFileLocks(USER.id);
+    const svc = makeFacade(git, locks, events);
+
+    const change = await svc.commitFileWhileLocked('ws-1', 'feat/x', 'foo.md', USER);
+
+    expect(change).toEqual(CHANGE);
+    expect(git.pull).toHaveBeenCalledTimes(1);
+    expect(git.push).toHaveBeenCalledTimes(2);
+    expect(emitSpy.mock.calls.map((c) => (c[0] as { kind: string }).kind)).toEqual([
+      'file-changed',
+    ]);
+  });
+
+  it('best-effort: still emits file-changed when non-fast-forward recovery itself fails', async () => {
+    // Pull rebase failed (conflicts) or retry-push got rejected again.
+    // Autosave must NOT throw — the user is mid-edit and would see a
+    // baffling error banner for something they didn't even trigger.
+    // The local commit landed; the next checkpoint or final release
+    // will retry the push.
+    const git = makeGit({ pushBehavior: 'nff', pullBehavior: 'fail' });
+    const locks = makeFileLocks(USER.id);
+    const svc = makeFacade(git, locks, events);
+
+    const change = await svc.commitFileWhileLocked('ws-1', 'feat/x', 'foo.md', USER);
+    expect(change).toEqual(CHANGE);
+    // Even though push never succeeded, file-changed still emits so the
+    // local commit is visible to other tabs of the same user.
+    expect(emitSpy.mock.calls.map((c) => (c[0] as { kind: string }).kind)).toEqual([
+      'file-changed',
+    ]);
+  });
+});