@celilo/cli 0.3.30 → 0.4.0-alpha.0

package/src/services/build-bus/receiver-server.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Receiver-server integration tests. Spins up the real Bun.serve
+ * receiver against a temp SQLite bus, fires signed envelopes at it,
+ * asserts the local bus actually received the emit.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { defineEvents, openBus } from '@celilo/event-bus';
+import type { PublishEvent } from '@celilo/event-bus/build-bus';
+import { signEvent } from '@celilo/event-bus/build-bus';
+import { type ReceiverServer, startReceiverServer } from './receiver-server';
+
+const NO_SCHEMAS = defineEvents({});
+
+function buildEvent(overrides: Partial<PublishEvent> = {}): PublishEvent {
+  return {
+    eventId: `evt-${Math.random().toString(36).slice(2)}`,
+    timestamp: new Date().toISOString(),
+    registry: 'npm',
+    tag: 'latest',
+    package: { name: '@celilo/cli', version: '0.4.0' },
+    ...overrides,
+  };
+}
+
+describe('receiver-server', () => {
+  let tmpDir: string;
+  let busPath: string;
+  let server: ReceiverServer;
+  const SECRET = 'shared-receiver-secret';
+
+  beforeEach(async () => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'celilo-build-bus-receiver-'));
+    busPath = join(tmpDir, 'bus.db');
+    server = startReceiverServer({ port: 0, secret: SECRET, busPath });
+  });
+
+  afterEach(async () => {
+    await server.stop();
+    rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  test('GET /health returns 200 ok', async () => {
+    const r = await fetch(`${server.url}health`);
+    expect(r.status).toBe(200);
+    expect(await r.text()).toBe('ok');
+  });
+
+  test('GET / returns 405 method-not-allowed', async () => {
+    const r = await fetch(server.url);
+    expect(r.status).toBe(405);
+  });
+
+  test('POST to unknown path returns 404', async () => {
+    const r = await fetch(`${server.url}other`, { method: 'POST', body: '{}' });
+    expect(r.status).toBe(404);
+  });
+
+  test('properly signed envelope: 200 + event emitted on local bus', async () => {
+    const event = buildEvent();
+    const envelope = { event, signature: signEvent(event, SECRET) };
+
+    const r = await fetch(server.url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(envelope),
+    });
+    expect(r.status).toBe(200);
+    const body = (await r.json()) as { ok: boolean; eventId: string };
+    expect(body.ok).toBe(true);
+    expect(body.eventId).toBe(event.eventId);
+
+    // Open the same bus and confirm the event landed.
+    const bus = openBus({ dbPath: busPath, events: NO_SCHEMAS });
+    try {
+      const recent = bus.recentEvents({ limit: 10, type: 'build-bus.publish' });
+      expect(recent).toHaveLength(1);
+      const payload = recent[0].payload as PublishEvent;
+      expect(payload.eventId).toBe(event.eventId);
+      expect(payload.package.name).toBe('@celilo/cli');
+    } finally {
+      bus.close();
+    }
+  });
+
+  test('wrong-secret signature: 401 + nothing emitted', async () => {
+    const event = buildEvent();
+    const envelope = { event, signature: signEvent(event, 'attacker-secret') };
+
+    const r = await fetch(server.url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(envelope),
+    });
+    expect(r.status).toBe(401);
+
+    const bus = openBus({ dbPath: busPath, events: NO_SCHEMAS });
+    try {
+      const recent = bus.recentEvents({ limit: 10, type: 'build-bus.publish' });
+      expect(recent).toHaveLength(0);
+    } finally {
+      bus.close();
+    }
+  });
+
+  test('stale timestamp: 401', async () => {
+    const event = buildEvent({ timestamp: '2020-01-01T00:00:00.000Z' });
+    const envelope = { event, signature: signEvent(event, SECRET) };
+
+    const r = await fetch(server.url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(envelope),
+    });
+    expect(r.status).toBe(401);
+  });
+
+  test('malformed JSON body: 400', async () => {
+    const r = await fetch(server.url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: 'not json at all',
+    });
+    expect(r.status).toBe(400);
+  });
+
+  test('duplicate eventId dedupes via bus dedupKey (publisher retry safety)', async () => {
+    const event = buildEvent();
+    const envelope = { event, signature: signEvent(event, SECRET) };
+
+    const r1 = await fetch(server.url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(envelope),
+    });
+    expect(r1.status).toBe(200);
+    const r2 = await fetch(server.url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(envelope),
+    });
+    expect(r2.status).toBe(200); // still ok — publisher's idempotent retry
+
+    // Only one event on the bus.
+    const bus = openBus({ dbPath: busPath, events: NO_SCHEMAS });
+    try {
+      const recent = bus.recentEvents({ limit: 10, type: 'build-bus.publish' });
+      expect(recent).toHaveLength(1);
+    } finally {
+      bus.close();
+    }
+  });
+
+  test('onEvent hook fires after a verified emit', async () => {
+    const seen: string[] = [];
+    await server.stop();
+    server = startReceiverServer({
+      port: 0,
+      secret: SECRET,
+      busPath,
+      onEvent: (envelope) => {
+        seen.push(envelope.event.eventId);
+      },
+    });
+
+    const event = buildEvent();
+    const envelope = { event, signature: signEvent(event, SECRET) };
+    await fetch(server.url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(envelope),
+    });
+
+    expect(seen).toEqual([event.eventId]);
+  });
+});

package/src/services/build-bus/receiver-server.ts

@@ -0,0 +1,159 @@
+/**
+ * HTTP receiver daemon for the build bus
+ * ([[v2/BUILD_BUS.md]] Phase 3).
+ *
+ * Verifies signed webhook envelopes against a per-receiver shared
+ * secret, then re-emits the contained PublishEvent onto the local
+ * SQLite event bus. From there, the local-bus dispatcher (or this
+ * process's own hook dispatcher — see hook-dispatcher.ts) can react.
+ *
+ * Local-bus event shape:
+ *
+ *   type:     'build-bus.publish'      (constant; filters happen on payload)
+ *   payload:  the verified PublishEvent
+ *   dedupKey: event.eventId            (the bus silently dedupes
+ *                                       duplicate inserts — no extra
+ *                                       table needed)
+ *
+ * Endpoint: POST / accepts the WebhookEnvelope JSON. Any other path
+ * returns 404. Any other method returns 405. GET /health returns
+ * 200 for liveness probes.
+ */
+
+import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
+import type { WebhookEnvelope } from '@celilo/event-bus/build-bus';
+import { verifyEnvelope } from '@celilo/event-bus/build-bus';
+import { getEventBusPath } from '../../config/paths';
+
+const NO_SCHEMAS = defineEvents({});
+
+export interface ReceiverServerOptions {
+  /** Port to listen on. Default: 8123. */
+  port?: number;
+  /** Shared HMAC secret. Publishers signing webhooks at this endpoint must use the same string. */
+  secret: string;
+  /**
+   * SQLite event-bus path override (mostly for tests). Production
+   * uses `getEventBusPath()` so the receiver emits into the same
+   * bus the rest of celilo reads.
+   */
+  busPath?: string;
+  /**
+   * Optional hook fired after every successful emit. Used by the
+   * combined daemon to trigger the hook dispatcher in-process
+   * without an extra polling layer.
+   */
+  onEvent?: (envelope: WebhookEnvelope) => void | Promise<void>;
+  /** Override for tests; default is the global fetch. */
+  now?: () => number;
+}
+
+export interface ReceiverServer {
+  port: number;
+  /** URL clients should POST to. */
+  url: string;
+  stop(): Promise<void>;
+}
+
+/**
+ * Start the HTTP receiver. Resolves once the listener is bound.
+ * Caller is responsible for keeping the server alive — typically
+ * the CLI command's `await new Promise(() => {})` pattern.
+ */
+export function startReceiverServer(opts: ReceiverServerOptions): ReceiverServer {
+  const port = opts.port ?? 8123;
+  const busPath = opts.busPath ?? getEventBusPath();
+  // Empty registry — we emit to a known type ('build-bus.publish')
+  // without going through any registered schema. Use emitRaw.
+  const bus: Bus = openBus({ dbPath: busPath, events: NO_SCHEMAS });
+
+  const server = Bun.serve({
+    port,
+    fetch: async (req) => {
+      const url = new URL(req.url);
+
+      if (req.method === 'GET' && url.pathname === '/health') {
+        return new Response('ok', { status: 200 });
+      }
+
+      if (url.pathname !== '/') {
+        return new Response('not found', { status: 404 });
+      }
+
+      if (req.method !== 'POST') {
+        return new Response('method not allowed', { status: 405 });
+      }
+
+      let envelope: WebhookEnvelope;
+      try {
+        envelope = (await req.json()) as WebhookEnvelope;
+      } catch (err) {
+        return new Response(
+          JSON.stringify({
+            ok: false,
+            reason: 'malformed',
+            detail: err instanceof Error ? err.message : String(err),
+          }),
+          { status: 400, headers: { 'content-type': 'application/json' } },
+        );
+      }
+
+      const outcome = verifyEnvelope(envelope, {
+        secret: opts.secret,
+        now: opts.now?.(),
+      });
+      if (!outcome.ok) {
+        return new Response(JSON.stringify(outcome), {
+          status: outcome.reason === 'malformed' ? 400 : 401,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+
+      try {
+        bus.emitRaw('build-bus.publish', envelope.event, {
+          dedupKey: envelope.event.eventId,
+          emittedBy: 'build-bus.receiver',
+        });
+      } catch (err) {
+        // emit failures (DB locked, schema mismatch) get a 500 so the
+        // publisher retries. We don't want to drop on the floor.
+        return new Response(
+          JSON.stringify({
+            ok: false,
+            reason: 'emit-failed',
+            detail: err instanceof Error ? err.message : String(err),
+          }),
+          { status: 500, headers: { 'content-type': 'application/json' } },
+        );
+      }
+
+      if (opts.onEvent) {
+        // Best-effort: hook dispatch failures shouldn't 5xx the
+        // webhook (the publisher already won). Surface via the
+        // process's own logging.
+        try {
+          await opts.onEvent(envelope);
+        } catch (err) {
+          console.warn(
+            `[build-bus] onEvent handler failed: ${err instanceof Error ? err.message : String(err)}`,
+          );
+        }
+      }
+
+      return new Response(JSON.stringify({ ok: true, eventId: outcome.eventId }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      });
+    },
+  });
+
+  const actualPort = server.port ?? port;
+  return {
+    port: actualPort,
+    url: `http://localhost:${actualPort}/`,
+    async stop() {
+      server.stop(true);
+      bus.close();
+    },
+  };
+}

package/src/services/build-bus/status.test.ts

@@ -0,0 +1,212 @@
+/**
+ * Status-aggregator tests — Phase 6 of [[v2/BUILD_BUS.md]].
+ *
+ * The aggregator is pure: takes subscribers + delivery records,
+ * returns per-subscriber summaries. The formatter is pure too.
+ * Both tested directly here without spinning up a real bus or
+ * publishing anything.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import type { Subscriber } from '@celilo/event-bus/build-bus';
+import {
+  WEBHOOK_DELIVERED_EVENT,
+  WEBHOOK_FAILED_EVENT,
+  type WebhookDeliveryPayload,
+} from './delivery-events';
+import {
+  type DeliveryRecord,
+  aggregateSubscriberStatus,
+  describeAgo,
+  formatStatus,
+} from './status';
+
+function sub(overrides: Partial<Subscriber>): Subscriber {
+  return {
+    url: 'https://example.test/webhook',
+    secret: 'shared',
+    match: {},
+    ...overrides,
+  };
+}
+
+function record(
+  type: typeof WEBHOOK_DELIVERED_EVENT | typeof WEBHOOK_FAILED_EVENT,
+  payloadOverrides: Partial<WebhookDeliveryPayload>,
+  emittedAt: number,
+): DeliveryRecord {
+  return {
+    type,
+    emittedAt,
+    payload: {
+      subscriberLabel: 'test-sub',
+      subscriberUrl: 'https://example.test/webhook',
+      eventId: 'evt-0',
+      packageName: '@celilo/cli',
+      packageVersion: '0.4.0',
+      tag: 'latest',
+      attempts: 1,
+      durationMs: 42,
+      ...payloadOverrides,
+    },
+  };
+}
+
+describe('aggregateSubscriberStatus', () => {
+  test('subscriber with no deliveries → totals 0, successRate null, no lastDelivery', () => {
+    const [s] = aggregateSubscriberStatus([sub({ name: 'a' })], []);
+    expect(s.totals).toEqual({ delivered: 0, failed: 0 });
+    expect(s.successRatePct).toBeNull();
+    expect(s.lastDelivery).toBeUndefined();
+    expect(s.recentFailures).toEqual([]);
+  });
+
+  test('all deliveries succeed → 100% success', () => {
+    const subscribers = [sub({ name: 'a' })];
+    const records = [
+      record(WEBHOOK_DELIVERED_EVENT, {}, 1000),
+      record(WEBHOOK_DELIVERED_EVENT, {}, 2000),
+      record(WEBHOOK_DELIVERED_EVENT, {}, 3000),
+    ];
+    const [s] = aggregateSubscriberStatus(subscribers, records);
+    expect(s.totals).toEqual({ delivered: 3, failed: 0 });
+    expect(s.successRatePct).toBe(100);
+  });
+
+  test('mixed success/failure → integer success rate', () => {
+    const subscribers = [sub({ name: 'a' })];
+    const records = [
+      record(WEBHOOK_DELIVERED_EVENT, {}, 1000),
+      record(WEBHOOK_FAILED_EVENT, { error: 'boom' }, 2000),
+      record(WEBHOOK_DELIVERED_EVENT, {}, 3000),
+    ];
+    const [s] = aggregateSubscriberStatus(subscribers, records);
+    expect(s.totals).toEqual({ delivered: 2, failed: 1 });
+    // 2/3 = 66.66… → rounded to 67%
+    expect(s.successRatePct).toBe(67);
+  });
+
+  test('lastDelivery is the newest by emittedAt (success or failure)', () => {
+    const subscribers = [sub({ name: 'a' })];
+    const records = [
+      record(WEBHOOK_DELIVERED_EVENT, { eventId: 'old' }, 1000),
+      record(WEBHOOK_FAILED_EVENT, { eventId: 'newest', error: 'x' }, 9000),
+      record(WEBHOOK_DELIVERED_EVENT, { eventId: 'middle' }, 5000),
+    ];
+    const [s] = aggregateSubscriberStatus(subscribers, records);
+    expect(s.lastDelivery?.eventId).toBe('newest');
+    expect(s.lastDelivery?.ok).toBe(false);
+  });
+
+  test('recentFailures are newest-first and capped at 5', () => {
+    const subscribers = [sub({ name: 'a' })];
+    const records: DeliveryRecord[] = [];
+    for (let i = 0; i < 8; i++) {
+      records.push(record(WEBHOOK_FAILED_EVENT, { eventId: `f-${i}`, error: `e-${i}` }, i * 1000));
+    }
+    const [s] = aggregateSubscriberStatus(subscribers, records);
+    expect(s.recentFailures).toHaveLength(5);
+    // Newest first.
+    expect(s.recentFailures[0].eventId).toBe('f-7');
+    expect(s.recentFailures[4].eventId).toBe('f-3');
+  });
+
+  test('error strings are truncated to keep the status output readable', () => {
+    const longError = 'X'.repeat(500);
+    const subscribers = [sub({ name: 'a' })];
+    const records = [record(WEBHOOK_FAILED_EVENT, { error: longError }, 1000)];
+    const [s] = aggregateSubscriberStatus(subscribers, records);
+    expect(s.recentFailures[0].error.length).toBeLessThanOrEqual(200);
+  });
+
+  test('groups by subscriberUrl (subscribers whose URLs do not match get no records)', () => {
+    const subscribers = [
+      sub({ name: 'a', url: 'https://a.test/' }),
+      sub({ name: 'b', url: 'https://b.test/' }),
+    ];
+    const records = [
+      record(WEBHOOK_DELIVERED_EVENT, { subscriberUrl: 'https://a.test/' }, 1000),
+      record(WEBHOOK_DELIVERED_EVENT, { subscriberUrl: 'https://a.test/' }, 2000),
+      record(WEBHOOK_FAILED_EVENT, { subscriberUrl: 'https://b.test/', error: 'oops' }, 1500),
+    ];
+    const [a, b] = aggregateSubscriberStatus(subscribers, records);
+    expect(a.totals).toEqual({ delivered: 2, failed: 0 });
+    expect(b.totals).toEqual({ delivered: 0, failed: 1 });
+  });
+
+  test('preserves subscriber input order', () => {
+    const subscribers = [
+      sub({ name: 'z', url: 'https://z.test/' }),
+      sub({ name: 'a', url: 'https://a.test/' }),
+      sub({ name: 'm', url: 'https://m.test/' }),
+    ];
+    const result = aggregateSubscriberStatus(subscribers, []);
+    expect(result.map((s) => s.label)).toEqual(['z', 'a', 'm']);
+  });
+});
+
+describe('formatStatus', () => {
+  const now = 10_000_000;
+  test('renders a no-subscribers message', () => {
+    expect(formatStatus([], now)).toBe('No subscribers configured.');
+  });
+
+  test('renders no-deliveries-yet for an unused subscriber', () => {
+    const aggregated = aggregateSubscriberStatus([sub({ name: 'fresh' })], []);
+    const out = formatStatus(aggregated, now);
+    expect(out).toContain('deliveries: none yet');
+    expect(out).not.toContain('last delivery');
+  });
+
+  test('renders success rate + last delivery for an active subscriber', () => {
+    const aggregated = aggregateSubscriberStatus(
+      [sub({ name: 'active' })],
+      [
+        record(
+          WEBHOOK_DELIVERED_EVENT,
+          { packageName: '@celilo/cli', packageVersion: '0.4.0' },
+          now - 60_000,
+        ),
+        record(WEBHOOK_DELIVERED_EVENT, {}, now - 300_000),
+      ],
+    );
+    const out = formatStatus(aggregated, now);
+    expect(out).toContain('deliveries: 2/2 ok (100%)');
+    expect(out).toContain('last delivery: ✓ @celilo/cli@0.4.0 (1m ago)');
+  });
+
+  test('renders recent-failures block with truncated errors', () => {
+    const aggregated = aggregateSubscriberStatus(
+      [sub({ name: 'flaky' })],
+      [record(WEBHOOK_FAILED_EVENT, { error: 'HTTP 500: backend wedged' }, now - 30_000)],
+    );
+    const out = formatStatus(aggregated, now);
+    expect(out).toContain('recent failures (1):');
+    expect(out).toContain('HTTP 500: backend wedged');
+    expect(out).toContain('30s ago');
+  });
+});
+
+describe('describeAgo', () => {
+  test('seconds', () => {
+    expect(describeAgo(0)).toBe('0s ago');
+    expect(describeAgo(15_000)).toBe('15s ago');
+  });
+
+  test('minutes', () => {
+    expect(describeAgo(90 * 1000)).toBe('1m ago');
+    expect(describeAgo(45 * 60 * 1000)).toBe('45m ago');
+  });
+
+  test('hours', () => {
+    expect(describeAgo(2 * 60 * 60 * 1000)).toBe('2h ago');
+  });
+
+  test('days', () => {
+    expect(describeAgo(3 * 24 * 60 * 60 * 1000)).toBe('3d ago');
+  });
+
+  test('future deltas (clock skew) → "in the future"', () => {
+    expect(describeAgo(-500)).toBe('in the future');
+  });
+});