@haverstack/server 0.8.0 → 0.9.1

package/tests/routes/versions.test.ts

@@ -1,177 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { buildTestApp, req, TEST_TOKEN, OTHER_ENTITY_ID, type TestApp } from '../setup.js';
-
-const TYPE_ID = 'com.example.test/doc@1';
-
-describe('Versions', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-    await t.ctx.stack.defineType(TYPE_ID, 'Doc', {
-      body: { kind: 'text' as const, required: true as const },
-    });
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  async function createAndPatch() {
-    const record = await t.ctx.stack.create(TYPE_ID, { body: 'v1' });
-    await req(t.app, 'PATCH', `/records/${record.id}`, {
-      token: TEST_TOKEN,
-      body: { contentPatch: { body: 'v2' } },
-    });
-    return record;
-  }
-
-  it('GET /records/:id/versions returns history', async () => {
-    const record = await createAndPatch();
-    const { status, data } = await req(t.app, 'GET', `/records/${record.id}/versions`, {
-      token: TEST_TOKEN,
-    });
-    expect(status).toBe(200);
-    expect((data as unknown[]).length).toBe(1);
-  });
-
-  it('GET /records/:id/versions/:version returns one version', async () => {
-    const record = await createAndPatch();
-    const { status, data } = await req(t.app, 'GET', `/records/${record.id}/versions/1`, {
-      token: TEST_TOKEN,
-    });
-    expect(status).toBe(200);
-    expect((data as Record<string, unknown>).version).toBe(1);
-  });
-
-  it('POST /records/:id/restore/:version restores content without rewriting history', async () => {
-    const record = await createAndPatch();
-    const { status, data } = await req(t.app, 'POST', `/records/${record.id}/restore/1`, {
-      token: TEST_TOKEN,
-    });
-    expect(status).toBe(200);
-    const d = data as Record<string, unknown>;
-    expect((d.content as Record<string, unknown>).body).toBe('v1');
-    // version 1 was snapshotted, then v2 was applied, then v2 was snapshotted for restore → new version is 3
-    expect(d.version).toBe(3);
-  });
-
-  describe('malformed :version path param', () => {
-    it('GET /records/:id/versions/1abc is rejected rather than silently served as version 1', async () => {
-      const record = await createAndPatch();
-      const { status, data } = await req(t.app, 'GET', `/records/${record.id}/versions/1abc`, {
-        token: TEST_TOKEN,
-      });
-      expect(status).toBe(400);
-      expect((data as { error: { code: string } }).error.code).toBe('bad_request');
-    });
-
-    it('POST /records/:id/restore/1abc is rejected rather than silently restoring version 1', async () => {
-      const record = await createAndPatch();
-      const { status, data } = await req(t.app, 'POST', `/records/${record.id}/restore/1abc`, {
-        token: TEST_TOKEN,
-      });
-      expect(status).toBe(400);
-      expect((data as { error: { code: string } }).error.code).toBe('bad_request');
-    });
-  });
-
-  describe('POST /records/:id/restore/:version — If-Match / optimistic concurrency', () => {
-    it('succeeds when If-Match names the current version', async () => {
-      const record = await createAndPatch();
-      const current = await t.ctx.adapter.getRecord(record.id);
-      const { status } = await req(t.app, 'POST', `/records/${record.id}/restore/1`, {
-        token: TEST_TOKEN,
-        headers: { 'If-Match': `"${current!.version}"` },
-      });
-      expect(status).toBe(200);
-    });
-
-    it('returns 412 version_conflict on an If-Match mismatch', async () => {
-      const record = await createAndPatch();
-      const current = await t.ctx.adapter.getRecord(record.id);
-      const { status, data } = await req(t.app, 'POST', `/records/${record.id}/restore/1`, {
-        token: TEST_TOKEN,
-        headers: { 'If-Match': `"${current!.version + 1}"` },
-      });
-      expect(status).toBe(412);
-      expect((data as { error: { code: string } }).error.code).toBe('version_conflict');
-    });
-  });
-
-  // Version history is now gated at the same level as update() — a
-  // write-holder, or owner/creator — not plain read, per
-  // docs/spec/versioning.md § History access.
-  describe('history access requires write, not read', () => {
-    async function seedShared(write: boolean) {
-      const record = await t.ctx.stack.create(
-        TYPE_ID,
-        { body: 'v1' },
-        {
-          permissions: [{ access: 'entity', entityId: OTHER_ENTITY_ID, read: true, write }],
-        },
-      );
-      await t.ctx.stack.patchContent(record.id, { body: 'v2' });
-      const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
-      return { record, token };
-    }
-
-    it('a read-only requester is refused GET /records/:id/versions', async () => {
-      const { record, token } = await seedShared(false);
-      const { status } = await req(t.app, 'GET', `/records/${record.id}/versions`, { token });
-      expect(status).toBe(403);
-    });
-
-    it('a read-only requester is refused GET /records/:id/versions/:version', async () => {
-      const { record, token } = await seedShared(false);
-      const { status } = await req(t.app, 'GET', `/records/${record.id}/versions/1`, { token });
-      expect(status).toBe(403);
-    });
-
-    it('a write-holder can still read version history', async () => {
-      const { record, token } = await seedShared(true);
-      const { status, data } = await req(t.app, 'GET', `/records/${record.id}/versions`, {
-        token,
-      });
-      expect(status).toBe(200);
-      expect((data as unknown[]).length).toBe(1);
-    });
-  });
-
-  it('strips permissions from a version snapshot for a non-owner write-holder, but keeps entityId', async () => {
-    const record = await t.ctx.stack.create(
-      TYPE_ID,
-      { body: 'v1' },
-      {
-        permissions: [{ access: 'entity', entityId: OTHER_ENTITY_ID, read: true, write: true }],
-      },
-    );
-    await t.ctx.stack.patchContent(record.id, { body: 'v2' });
-    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
-
-    const { data } = await req(t.app, 'GET', `/records/${record.id}/versions`, { token });
-    const versions = data as Array<Record<string, unknown>>;
-    expect(versions[0].permissions).toBeUndefined();
-
-    const { data: ownerData } = await req(t.app, 'GET', `/records/${record.id}/versions`, {
-      token: TEST_TOKEN,
-    });
-    const ownerVersions = ownerData as Array<Record<string, unknown>>;
-    expect(ownerVersions[0].permissions).toBeDefined();
-  });
-
-  it('bumps version on every mutation kind, not just content updates', async () => {
-    const record = await t.ctx.stack.create(TYPE_ID, { body: 'v1' });
-    expect(record.version).toBe(1);
-
-    await t.ctx.stack.associate(record.id, { kind: 'tag', label: 'starred' });
-    expect((await t.ctx.adapter.getRecord(record.id))?.version).toBe(2);
-
-    await t.ctx.stack.mutate(record.id, { permissions: [{ access: 'public' }] });
-    expect((await t.ctx.adapter.getRecord(record.id))?.version).toBe(3);
-
-    await t.ctx.stack.delete(record.id);
-    expect((await t.ctx.adapter.getRecord(record.id))?.version).toBe(4);
-
-    await t.ctx.stack.undelete(record.id);
-    expect((await t.ctx.adapter.getRecord(record.id))?.version).toBe(5);
-  });
-});

package/tests/routes/wellknown.test.ts

@@ -1,71 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { WIRE_PROTOCOL_VERSION } from '@haverstack/wire-types';
-import { buildTestApp, req, TEST_ENTITY_ID, type TestApp } from '../setup.js';
-
-describe('GET /.well-known/stack', () => {
-  let t: TestApp;
-  beforeEach(async () => {
-    t = await buildTestApp();
-  });
-  afterEach(async () => {
-    await t.cleanup();
-  });
-
-  it('returns the discovery document', async () => {
-    const { status, data } = await req(t.app, 'GET', '/.well-known/stack');
-    expect(status).toBe(200);
-    const d = data as Record<string, unknown>;
-    expect(d.version).toBe(WIRE_PROTOCOL_VERSION);
-    expect(d.entityId).toBe(TEST_ENTITY_ID);
-    expect(d.timezone).toBe('UTC');
-    expect(d.capabilities).toBeDefined();
-  });
-
-  it('does not require authentication', async () => {
-    const { status } = await req(t.app, 'GET', '/.well-known/stack');
-    expect(status).toBe(200);
-  });
-
-  it("declares the server's own size ceilings, not the adapter's null", async () => {
-    const { data } = await req(t.app, 'GET', '/.well-known/stack');
-    const capabilities = (data as { capabilities: { limits: Record<string, unknown> } })
-      .capabilities;
-    expect(capabilities.limits.attachmentBytes).toBe(50 * 1024 * 1024);
-    expect(capabilities.limits.contentBytes).toBe(1 * 1024 * 1024);
-  });
-
-  it('advertises path-reach content filtering — spread from the sqlite adapter', async () => {
-    const { data } = await req(t.app, 'GET', '/.well-known/stack');
-    const capabilities = (data as { capabilities: { filter: Record<string, unknown> } })
-      .capabilities;
-    expect(capabilities.filter.content).toBe('path');
-  });
-
-  it('omits timezone entirely when the stack has none configured', async () => {
-    const noTzApp = await buildTestApp({ timezone: undefined });
-    try {
-      const { data } = await req(noTzApp.app, 'GET', '/.well-known/stack');
-      expect('timezone' in (data as Record<string, unknown>)).toBe(false);
-    } finally {
-      await noTzApp.cleanup();
-    }
-  });
-
-  it('advertises the DID challenge-response handshake', async () => {
-    const { data } = await req(t.app, 'GET', '/.well-known/stack');
-    expect((data as { auth?: { methods: string[] } }).auth).toEqual({
-      methods: ['did-challenge'],
-    });
-  });
-
-  it('advertises the change feed', async () => {
-    const { data } = await req(t.app, 'GET', '/.well-known/stack');
-    expect((data as { changes?: unknown }).changes).toEqual({
-      transports: ['sse'],
-      // GET /changes mints and honors resume cursors.
-      resume: true,
-      // GET /changes honors ?include=record unconditionally.
-      records: true,
-    });
-  });
-});

package/tests/setup.ts

@@ -1,154 +0,0 @@
-import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { randomBytes } from 'node:crypto';
-import { rm } from 'node:fs/promises';
-import { mkdirSync } from 'node:fs';
-import { LocalAdapter, NativeTokenStore, defaultTokenStorePath } from '@haverstack/adapter-local';
-import { Stack } from '@haverstack/core';
-import { authOriginFromUrl } from '@haverstack/core/wire';
-import pino from 'pino';
-import { createApp } from '../src/app.js';
-import type { Config } from '../src/config.js';
-import type { StackContext } from '../src/stack.js';
-import { AuthNonceStore, defaultNonceStorePath } from '../src/lib/nonceStore.js';
-import { QueryWorkerPool } from '../src/lib/queryWorker/pool.js';
-import { ChangeStreamRegistry } from '../src/lib/changeStreams.js';
-import type { Hono } from 'hono';
-import type { AppEnv } from '../src/app.js';
-
-export const TEST_ENTITY_ID = 'did:key:test-entity-id-00000001';
-export const TEST_TOKEN = 'test-bearer-token';
-export const OTHER_ENTITY_ID = 'did:key:other-entity-id-00000002';
-// Matches @haverstack/conformance-fixtures' AUTH_FIXTURE_ORIGIN — the auth
-// handshake fixtures carry real signatures over this exact origin, so the
-// test harness must present itself as it.
-export const TEST_BASE_URL = 'https://stack.example.com';
-
-export const logger = pino({ level: 'silent' });
-
-/**
- * Each test gets its own isolated temp directory so the SQLiteAdapter's
- * sibling `attachments/` folder never collides between parallel test runs.
- */
-export function tempDbPath(): string {
-  const dir = join(tmpdir(), `haverstack-test-${randomBytes(8).toString('hex')}`);
-  mkdirSync(dir, { recursive: true });
-  return join(dir, 'stack.db');
-}
-
-export type TestContextOpts = {
-  /**
-   * IANA timezone string, or `undefined` to opt out of one. Note: a plain
-   * default parameter can't tell "omitted" from "explicitly undefined"
-   * (both trigger the default), so this must be an options bag — pass
-   * `{ timezone: undefined }` deliberately, not the bare value.
-   */
-  timezone?: string;
-};
-
-export async function createTestContext(
-  dbPath: string,
-  opts: TestContextOpts = { timezone: 'UTC' },
-): Promise<StackContext> {
-  const adapter = await LocalAdapter.initialize({
-    path: dbPath,
-    entityId: TEST_ENTITY_ID,
-    ...(opts.timezone !== undefined && { timezone: opts.timezone }),
-  });
-  const stack = await Stack.create(adapter);
-  const tokens = await NativeTokenStore.open({ path: defaultTokenStorePath(dbPath) });
-  const nonces = AuthNonceStore.open(defaultNonceStorePath(dbPath));
-  const queryWorker = new QueryWorkerPool({
-    init: { dbPath },
-    poolSize: 1,
-    queueLimit: 64,
-    logger,
-  });
-  return { adapter, stack, tokens, nonces, queryWorker, changeStreams: new ChangeStreamRegistry() };
-}
-
-export function testConfig(dbPath: string, opts: TestContextOpts = { timezone: 'UTC' }): Config {
-  return {
-    port: 3000,
-    dbPath,
-    entityId: TEST_ENTITY_ID,
-    ownerName: null,
-    ownerHandle: null,
-    timezone: opts.timezone,
-    ownerToken: TEST_TOKEN,
-    corsOrigins: '*',
-    baseUrl: TEST_BASE_URL,
-    authOrigin: authOriginFromUrl(TEST_BASE_URL),
-    maxAttachmentBytes: 50 * 1024 * 1024,
-    maxContentBytes: 1 * 1024 * 1024,
-    queryTimeoutMs: 10_000,
-    queryWorkerPoolSize: 1,
-    queryQueueLimit: 64,
-    seedCommonsTypes: false,
-    shutdownTimeoutMs: 10_000,
-  };
-}
-
-export type TestApp = {
-  app: Hono<AppEnv>;
-  ctx: StackContext;
-  dbPath: string;
-  cleanup: () => Promise<void>;
-};
-
-export async function buildTestApp(opts: TestContextOpts = { timezone: 'UTC' }): Promise<TestApp> {
-  const dbPath = tempDbPath();
-  const ctx = await createTestContext(dbPath, opts);
-  const config = testConfig(dbPath, opts);
-  const app = createApp(ctx, config, logger);
-
-  const cleanup = async () => {
-    await ctx.queryWorker.close();
-    await ctx.stack.close();
-    await ctx.tokens.close();
-    ctx.nonces.close();
-    // Remove the whole temp directory (includes the .db file and attachments/).
-    await rm(dirname(dbPath), { recursive: true, force: true }).catch(() => {});
-  };
-
-  return { app, ctx, dbPath, cleanup };
-}
-
-export type ReqOpts = {
-  /** Adds Authorization: Bearer <token> header. */
-  token?: string;
-  /** JSON-serialised as the request body with Content-Type: application/json. */
-  body?: unknown;
-  /** Additional headers merged after auth/content-type. */
-  headers?: Record<string, string>;
-};
-
-/**
- * Fire a request at the Hono test app and return status + parsed JSON body.
- */
-export async function req(
-  app: Hono<AppEnv>,
-  method: string,
-  path: string,
-  opts: ReqOpts = {},
-): Promise<{ status: number; data: unknown }> {
-  const headers: Record<string, string> = {};
-  if (opts.token) headers['Authorization'] = `Bearer ${opts.token}`;
-  if (opts.body !== undefined) headers['Content-Type'] = 'application/json';
-  Object.assign(headers, opts.headers);
-
-  const res = await app.request(path, {
-    method,
-    headers,
-    ...(opts.body !== undefined && { body: JSON.stringify(opts.body) }),
-  });
-
-  const text = await res.text();
-  let data: unknown;
-  try {
-    data = JSON.parse(text);
-  } catch {
-    data = text;
-  }
-  return { status: res.status, data };
-}

package/tests/shutdown.test.ts

@@ -1,121 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import type { Logger } from 'pino';
-import type { StackContext } from '../src/stack.js';
-import { createShutdownHandler, type ShutdownServer } from '../src/shutdown.js';
-import { ChangeStreamRegistry } from '../src/lib/changeStreams.js';
-
-function fakeLogger(): Logger {
-  return { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() } as unknown as Logger;
-}
-
-function fakeCtx(): StackContext {
-  return {
-    adapter: {} as StackContext['adapter'],
-    stack: {
-      flush: vi.fn().mockResolvedValue(undefined),
-      close: vi.fn().mockResolvedValue(undefined),
-    } as unknown as StackContext['stack'],
-    tokens: { close: vi.fn().mockResolvedValue(undefined) } as unknown as StackContext['tokens'],
-    nonces: { close: vi.fn() } as unknown as StackContext['nonces'],
-    queryWorker: {
-      close: vi.fn().mockResolvedValue(undefined),
-    } as unknown as StackContext['queryWorker'],
-    changeStreams: new ChangeStreamRegistry(),
-  };
-}
-
-describe('createShutdownHandler', () => {
-  beforeEach(() => {
-    vi.useFakeTimers();
-  });
-
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  it('runs the full cleanup sequence once close() finishes on its own', async () => {
-    const closeAllConnections = vi.fn();
-    const server: ShutdownServer = { close: (cb) => cb(), closeAllConnections };
-    const ctx = fakeCtx();
-
-    await createShutdownHandler(server, ctx, fakeLogger(), 10_000)('SIGTERM');
-
-    expect(closeAllConnections).not.toHaveBeenCalled();
-    expect(ctx.queryWorker.close).toHaveBeenCalled();
-    expect(ctx.stack.flush).toHaveBeenCalled();
-    expect(ctx.stack.close).toHaveBeenCalled();
-    expect(ctx.tokens.close).toHaveBeenCalled();
-    expect(ctx.nonces.close).toHaveBeenCalled();
-  });
-
-  it('does not force connections closed if close() finishes just under the deadline', async () => {
-    const closeAllConnections = vi.fn();
-    let closeCallback: (() => void) | undefined;
-    const server: ShutdownServer = {
-      close: (cb) => {
-        closeCallback = cb;
-      },
-      closeAllConnections,
-    };
-    const ctx = fakeCtx();
-
-    const done = createShutdownHandler(server, ctx, fakeLogger(), 10_000)('SIGTERM');
-    closeCallback?.();
-    await done;
-
-    expect(closeAllConnections).not.toHaveBeenCalled();
-    expect(ctx.queryWorker.close).toHaveBeenCalled();
-  });
-
-  it('forces connections closed once the deadline elapses, then still finishes cleanup', async () => {
-    // Simulates a real server: destroying the sockets is what lets the
-    // pending close() callback finally fire.
-    let closeCallback: (() => void) | undefined;
-    const closeAllConnections = vi.fn(() => closeCallback?.());
-    const server: ShutdownServer = {
-      close: (cb) => {
-        closeCallback = cb;
-      },
-      closeAllConnections,
-    };
-    const ctx = fakeCtx();
-    const logger = fakeLogger();
-
-    const done = createShutdownHandler(server, ctx, logger, 10_000)('SIGTERM');
-    await vi.advanceTimersByTimeAsync(10_000);
-    await done;
-
-    expect(closeAllConnections).toHaveBeenCalledTimes(1);
-    expect(logger.warn).toHaveBeenCalled();
-    expect(ctx.queryWorker.close).toHaveBeenCalled();
-    expect(ctx.stack.flush).toHaveBeenCalled();
-  });
-
-  it('closes every open change-feed stream before waiting on server.close()', async () => {
-    const server: ShutdownServer = { close: (cb) => cb() };
-    const ctx = fakeCtx();
-    const closeStream = vi.fn();
-    ctx.changeStreams.add(closeStream);
-
-    await createShutdownHandler(server, ctx, fakeLogger(), 10_000)('SIGTERM');
-
-    expect(closeStream).toHaveBeenCalled();
-  });
-
-  it('tolerates a server with no closeAllConnections (e.g. Http2Server typings)', async () => {
-    let closeCallback: (() => void) | undefined;
-    const server: ShutdownServer = {
-      close: (cb) => {
-        closeCallback = cb;
-      },
-    };
-    const ctx = fakeCtx();
-
-    const done = createShutdownHandler(server, ctx, fakeLogger(), 10_000)('SIGTERM');
-    await vi.advanceTimersByTimeAsync(10_000);
-    closeCallback?.();
-    await done;
-
-    expect(ctx.queryWorker.close).toHaveBeenCalled();
-  });
-});