@grove-dev/astro 0.5.0-next.2 → 0.5.0

package/src/server/github-repo.test.ts

@@ -0,0 +1,88 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { fetchRepoMetadata } from './github-repo.js';
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  vi.restoreAllMocks();
+});
+
+describe('fetchRepoMetadata', () => {
+  it('returns 400 for invalid owner names', async () => {
+    const result = await fetchRepoMetadata({ owner: '../etc', repo: 'passwd' });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.status).toBe(400);
+  });
+
+  it('returns 400 for invalid repo names', async () => {
+    const result = await fetchRepoMetadata({ owner: 'owner', repo: 'bad name' });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.status).toBe(400);
+  });
+
+  it('returns the parsed repo on a 200 response', async () => {
+    globalThis.fetch = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            name: 'demo',
+            description: 'desc',
+            html_url: 'https://github.com/owner/demo',
+            homepage: 'https://demo.example',
+            language: 'TypeScript',
+            private: false,
+            topics: ['x', 'y'],
+          }),
+          { status: 200 },
+        ),
+    );
+    const result = await fetchRepoMetadata({ owner: 'owner', repo: 'demo' });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.data.name).toBe('demo');
+      expect(result.data.html_url).toBe('https://github.com/owner/demo');
+      expect(result.data.topics).toEqual(['x', 'y']);
+    }
+  });
+
+  it('forwards an Authorization header when a token is provided', async () => {
+    const spy = vi.fn(async () => new Response('{}', { status: 200 }));
+    globalThis.fetch = spy;
+    await fetchRepoMetadata({ owner: 'owner', repo: 'demo', token: 'gh_test_123' });
+    const headers = spy.mock.calls[0]?.[1]?.headers as Record<string, string>;
+    expect(headers.Authorization).toBe('Bearer gh_test_123');
+  });
+
+  it('maps a 404 to a structured error', async () => {
+    globalThis.fetch = vi.fn(async () => new Response('not found', { status: 404 }));
+    const result = await fetchRepoMetadata({ owner: 'owner', repo: 'missing' });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(404);
+      expect(result.message).toMatch(/not found/i);
+    }
+  });
+
+  it('maps a 403 to a rate-limit error', async () => {
+    globalThis.fetch = vi.fn(async () => new Response('forbidden', { status: 403 }));
+    const result = await fetchRepoMetadata({ owner: 'owner', repo: 'demo' });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(403);
+      expect(result.message).toMatch(/rate limit/i);
+    }
+  });
+
+  it('maps network errors to a 502', async () => {
+    globalThis.fetch = vi.fn(async () => {
+      throw new Error('ECONNRESET');
+    });
+    const result = await fetchRepoMetadata({ owner: 'owner', repo: 'demo' });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(502);
+      expect(result.message).toBe('ECONNRESET');
+    }
+  });
+});

package/src/server/github-repo.ts

@@ -0,0 +1,104 @@
+/**
+ * Server-side helper for fetching GitHub repository metadata.
+ *
+ * This exists so consumer pages can wire a thin `/api/github-repo`
+ * endpoint that proxies `api.github.com` requests through their own
+ * server (rather than from the visitor's browser). The visitor's
+ * browser hitting `api.github.com` directly leaks their IP and burns
+ * the per-IP unauthenticated rate limit (60/hour).
+ *
+ * Token handling:
+ *   - If `token` is provided, it's sent as `Authorization: Bearer <token>`.
+ *   - If not, the request goes unauthenticated (5000/hour if the server
+ *     has a shared egress IP, 60/hour per-IP otherwise — much better
+ *     than the per-visitor case).
+ *   - Consumers are expected to source the token from a server-only
+ *     env var (e.g. `process.env.GITHUB_TOKEN`) and never expose it.
+ */
+
+export interface FetchRepoMetadataInput {
+  owner: string;
+  repo: string;
+  token?: string;
+}
+
+export interface FetchRepoMetadataResult {
+  ok: true;
+  data: GitHubRepoMetadata;
+}
+
+export interface FetchRepoMetadataError {
+  ok: false;
+  status: number;
+  message: string;
+}
+
+export interface GitHubRepoMetadata {
+  name: string;
+  full_name: string;
+  description: string | null;
+  html_url: string;
+  homepage: string | null;
+  language: string | null;
+  private: boolean;
+  topics: string[];
+}
+
+const GITHUB_API = 'https://api.github.com';
+
+export async function fetchRepoMetadata(
+  input: FetchRepoMetadataInput,
+): Promise<FetchRepoMetadataResult | FetchRepoMetadataError> {
+  const { owner, repo, token } = input;
+  if (!/^[A-Za-z0-9._-]+$/.test(owner) || !/^[A-Za-z0-9._-]+$/.test(repo)) {
+    return { ok: false, status: 400, message: 'Invalid owner or repo name.' };
+  }
+  const headers: Record<string, string> = {
+    Accept: 'application/vnd.github+json',
+    'User-Agent': 'grove-submission-proxy',
+  };
+  if (token) headers.Authorization = `Bearer ${token}`;
+
+  let response: Response;
+  try {
+    response = await fetch(`${GITHUB_API}/repos/${owner}/${repo}`, { headers });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Network error';
+    return { ok: false, status: 502, message };
+  }
+  if (response.status === 404) {
+    return { ok: false, status: 404, message: 'Repository not found or not public.' };
+  }
+  if (response.status === 403) {
+    return { ok: false, status: 403, message: 'GitHub rate limit reached. Try again shortly.' };
+  }
+  if (!response.ok) {
+    return {
+      ok: false,
+      status: response.status,
+      message: `GitHub returned ${response.status}.`,
+    };
+  }
+  const json = (await response.json()) as {
+    name: string;
+    description: string | null;
+    html_url: string;
+    homepage: string | null;
+    language: string | null;
+    private: boolean;
+    topics?: string[];
+  };
+  return {
+    ok: true,
+    data: {
+      name: json.name,
+      full_name: `${owner}/${repo}`,
+      description: json.description,
+      html_url: json.html_url,
+      homepage: json.homepage,
+      language: json.language,
+      private: json.private,
+      topics: json.topics ?? [],
+    },
+  };
+}

package/src/server/index.ts

@@ -1,3 +1,4 @@
-export * from "./directory.js";
-export * from "./models.js";
-export * from "./collections.js";
+export * from './directory.js';
+export * from './models.js';
+export * from './collections.js';
+export * from './github-repo.js';

package/src/server/models-home.test.ts

@@ -0,0 +1,101 @@
+/**
+ * Real-module tests for `getHomePageModel` — the homepage stack/category
+ * count block.
+ *
+ * `models.ts` transitively imports `@grove/generated/*.json` at module
+ * load, so (like `directory.test.ts`) we mock those build artifacts to
+ * import the actual implementation instead of re-deriving it.
+ *
+ * Regression coverage for the audit's "Python 3 vs 4" drift: the count
+ * block used to iterate `fullItems` (every record, hidden included)
+ * and count only the singular `record.stack`, while browse filtered the
+ * visible index by the primary+supporting union. The fix counts the
+ * visible `items` via `projectStackIds`.
+ */
+import { describe, expect, it, vi } from "vitest";
+
+function indexRecord(
+  slug: string,
+  options: { stack?: string; stacks?: string[]; category?: string } = {},
+) {
+  return {
+    kind: "project",
+    slug,
+    name: slug,
+    description: `${slug} description`,
+    category: options.category ?? "tools",
+    tags: [],
+    stack: options.stack ?? options.stacks?.[0],
+    stacks: options.stacks ?? [],
+    platforms: ["linux"],
+    projectType: "real-app",
+    bestFor: [],
+    whyListed: [],
+    caveats: [],
+    links: {},
+    distribution: { channels: [] },
+    source: { type: "manual" },
+    curation: { reviewed: true, labels: [], lenses: [] },
+    visibility: "keep",
+  };
+}
+
+// The generated index payload is visible-only by contract; the hidden
+// record exists ONLY in the full payload. If the model ever goes back
+// to counting `fullItems`, the hidden "rust" stack would reappear.
+const visible = [
+  indexRecord("a", { stacks: ["python"] }),
+  indexRecord("b", { stacks: ["python", "go"] }),
+  indexRecord("c", { stacks: ["typescript"] }),
+  // Primary diverges from supporting (the open-webui shape): must
+  // count as python via the union.
+  indexRecord("d", { stack: "typescript", stacks: ["typescript", "python"] }),
+];
+const hidden = { ...indexRecord("ghost", { stacks: ["rust"] }), visibility: "hide" };
+
+vi.mock("@grove/generated/records.full.json", () => ({
+  default: { records: [...visible, hidden] },
+}));
+vi.mock("@grove/generated/records.index.json", () => ({ default: { records: visible } }));
+vi.mock("@grove/generated/site-config.json", () => ({ default: {} }));
+
+const { getHomePageModel } = await import("./models.js");
+
+const site = {
+  name: "Test Directory",
+  blueprintConfig: {
+    id: "project-directory",
+    kind: "project",
+    routeSlug: "projects",
+    itemSlug: "project",
+    labelSingular: "project",
+    labelPlural: "projects",
+  },
+};
+
+describe("getHomePageModel stack counts", () => {
+  it("counts primary AND supporting stacks via the canonical union", () => {
+    const home = getHomePageModel(site as Parameters<typeof getHomePageModel>[0]);
+    const counts = new Map(home.stacks.map((s) => [s.slug, s.count]));
+    expect(counts.get("python")).toBe(3); // a, b, d — d only via supporting
+    expect(counts.get("typescript")).toBe(2);
+    expect(counts.get("go")).toBe(1); // b's supporting stack
+  });
+
+  it("excludes hidden records from homepage counts", () => {
+    const home = getHomePageModel(site as Parameters<typeof getHomePageModel>[0]);
+    expect(home.stacks.find((s) => s.slug === "rust")).toBeUndefined();
+    const categoryTotal = home.categories.reduce((sum, c) => sum + c.count, 0);
+    expect(categoryTotal).toBe(visible.length);
+  });
+
+  it("agrees with the browse facet counts for the same records", async () => {
+    const { buildFacets } = await import("@grove-dev/core");
+    const facets = buildFacets(visible as Parameters<typeof buildFacets>[0]);
+    const facetCounts = new Map(facets.stacks.map((f) => [f.value, f.count]));
+    const home = getHomePageModel(site as Parameters<typeof getHomePageModel>[0]);
+    for (const stack of home.stacks) {
+      expect(facetCounts.get(stack.slug), stack.slug).toBe(stack.count);
+    }
+  });
+});

package/src/server/models.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, it } from "vitest";
+import { applySort, filterRecords, filtersFromSearchParams } from "@grove-dev/core";
+
+/**
+ * Regression tests for the homepage three-lens sectioning logic.
+ *
+ * The audit surfaced a bug where the homepage's "Trending now",
+ * "Recently added", and "Established" panels all echoed the same
+ * record cards because the hot and mature lists were both sliced
+ * from the index-order (alphabetical) and ~95% of mature items
+ * also carried the hot label.
+ *
+ * The fix in `getHomePageModel` is twofold:
+ *   1. Sort each lens by a meaningful key (stars, then date).
+ *   2. Exclude items already surfaced in the previous panels so the
+ *      three sections read as distinct perspectives.
+ *
+ * These tests exercise the underlying primitives the model uses —
+ * applying them in the same order the model does — so the recipe
+ * stays covered without spinning up the full Astro model layer.
+ */
+function record(
+  slug: string,
+  options: { labels?: string[]; stars?: number; reviewedAt?: string } = {},
+) {
+  return {
+    kind: "project" as const,
+    slug,
+    name: slug,
+    description: `${slug} description`,
+    category: "tools",
+    tags: [],
+    stack: "python",
+    stacks: ["python"],
+    platforms: ["linux"],
+    projectType: "real-app",
+    bestFor: [],
+    whyListed: [],
+    caveats: [],
+    links: {},
+    distribution: { channels: [] },
+    source: { type: "manual" as const },
+    visibility: "keep" as const,
+    github: {
+      stars: options.stars ?? 0,
+      forks: 0,
+      openIssues: 0,
+      language: "Python",
+      pushedAt: "2026-01-01T00:00:00Z",
+      archived: false,
+      license: "MIT",
+      fullName: `demo/${slug}`,
+      topics: [],
+    },
+    curation: {
+      reviewed: true,
+      labels: options.labels ?? [],
+      lenses: [],
+      reviewedAt: options.reviewedAt,
+    },
+  };
+}
+
+function sectionLikeModel(records: ReturnType<typeof record>[]) {
+  // Mirrors the filtering, sorting, and exclusion in `getHomePageModel`.
+  const projects = records.filter((r) => r.kind === "project");
+  const hot = applySort(
+    filterRecords(projects, filtersFromSearchParams(new URLSearchParams("label=hot"))),
+    "most-starred",
+  ).slice(0, 6);
+  const hotSlugs = new Set(hot.map((r) => r.slug));
+  const recentlyAdded = applySort(
+    projects.filter((r) => !hotSlugs.has(r.slug)),
+    "recently-added",
+  ).slice(0, 6);
+  const recentSlugs = new Set([...hotSlugs, ...recentlyAdded.map((r) => r.slug)]);
+  const established = applySort(
+    filterRecords(projects, filtersFromSearchParams(new URLSearchParams("label=mature"))).filter(
+      (r) => !recentSlugs.has(r.slug),
+    ),
+    "most-starred",
+  ).slice(0, 6);
+  return {
+    hot: hot.map((r) => r.slug),
+    recentlyAdded: recentlyAdded.map((r) => r.slug),
+    established: established.map((r) => r.slug),
+  };
+}
+
+describe("homepage lens sectioning", () => {
+  it("sorts hot by stars desc and surfaces mature-only items distinct from hot", () => {
+    const records = [
+      record("alpha", { labels: ["hot", "mature"], stars: 1000 }),
+      record("bravo", { labels: ["hot", "mature"], stars: 500 }),
+      record("charlie", { labels: ["mature"], stars: 50 }),
+    ];
+
+    const sections = sectionLikeModel(records);
+    expect(sections.hot).toEqual(["alpha", "bravo"]);
+    // Charlie is the only mature-only item; regardless of which lens
+    // he lands in, he must not also appear in the hot panel.
+    expect(sections.hot).not.toContain("charlie");
+    expect([...sections.recentlyAdded, ...sections.established]).toContain("charlie");
+  });
+
+  it("never repeats a record across the three lens panels", () => {
+    const records = [
+      record("alpha", { labels: ["hot", "mature"], stars: 1000, reviewedAt: "2025-01-01" }),
+      record("bravo", { labels: ["hot", "mature"], stars: 500, reviewedAt: "2025-02-01" }),
+      record("charlie", { labels: ["hot", "mature"], stars: 250, reviewedAt: "2025-03-01" }),
+      record("delta", { labels: ["mature"], stars: 100, reviewedAt: "2024-01-01" }),
+    ];
+
+    const sections = sectionLikeModel(records);
+    const seen = new Set<string>();
+    for (const panel of [sections.hot, sections.recentlyAdded, sections.established]) {
+      for (const slug of panel) {
+        expect(seen.has(slug)).toBe(false);
+        seen.add(slug);
+      }
+    }
+  });
+
+  it("keeps recently-added items out of the hot panel even when they share labels", () => {
+    const records = [
+      record("alpha", { labels: ["hot"], stars: 100, reviewedAt: "2025-06-01" }),
+      record("bravo", { labels: [], stars: 50, reviewedAt: "2026-08-01" }),
+    ];
+
+    const sections = sectionLikeModel(records);
+    expect(sections.hot).toEqual(["alpha"]);
+    expect(sections.recentlyAdded).toEqual(["bravo"]);
+    expect(sections.established).toEqual([]);
+  });
+});