@hot-updater/server 1.0.0-rc.18 → 1.0.0-rc.21

package/src/handler-standalone.integration.spec.ts

@@ -1,321 +0,0 @@
-import { PGlite } from "@electric-sql/pglite";
-import type { Bundle } from "@hot-updater/core";
-import { NIL_UUID } from "@hot-updater/core";
-import { Kysely } from "kysely";
-import { PGliteDialect } from "kysely-pglite-dialect";
-import { HttpResponse, http } from "msw";
-import { setupServer } from "msw/node";
-import { uuidv7 } from "uuidv7";
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
-
-import { standaloneRepository } from "../../../plugins/standalone/src";
-import { kyselyAdapter } from "./adapters/kysely";
-import { createMigrator } from "./db";
-import { createHotUpdater, type RuntimeHotUpdaterAPI } from "./index";
-import { insights } from "./plugins/insights";
-
-const db = new PGlite();
-const kysely = new Kysely<object>({ dialect: new PGliteDialect(db) });
-const clientMountPath = "/hot-updater";
-const api = createHotUpdater({
-  database: kyselyAdapter({ db: kysely, provider: "postgresql" }),
-  plugins: [insights()],
-  clientAccess: "public",
-});
-const baseUrl = "http://localhost:3000";
-const server = setupServer();
-const invokeHandler = async (
-  hotUpdater: RuntimeHotUpdaterAPI,
-  request: Request,
-  clientPath: string,
-) => {
-  const url = new URL(request.url);
-  const adminBasePath = `${clientPath}/admin`;
-  const isAdmin = url.pathname.startsWith(`${adminBasePath}/`);
-  const mountPath = isAdmin ? adminBasePath : clientPath;
-  url.pathname = url.pathname.slice(mountPath.length) || "/";
-  const handler = isAdmin
-    ? hotUpdater.handlers.admin
-    : hotUpdater.handlers.client;
-  const response = await handler(new Request(url, request));
-  // A 204 carries no body, and a Response refuses one.
-  return new HttpResponse(
-    response.status === 204 ? null : await response.text(),
-    { status: response.status, headers: response.headers },
-  );
-};
-
-beforeAll(async () => {
-  const result = await createMigrator(api).migrateToLatest({
-    mode: "from-schema",
-    updateSettings: true,
-  });
-  await result.execute();
-  server.listen({ onUnhandledRequest: "error" });
-  server.use(
-    http.all(`${baseUrl}/hot-updater/*`, ({ request }) =>
-      invokeHandler(api, request, clientMountPath),
-    ),
-  );
-});
-
-afterEach(async () => {
-  // Every table but the settings rows, aggregates included.
-  const { rows } = await db.query<{ tablename: string }>(
-    "SELECT tablename FROM pg_tables WHERE schemaname = 'public' AND tablename <> 'private_hot_updater_settings'",
-  );
-  await db.exec(
-    `TRUNCATE ${rows.map(({ tablename }) => `"${tablename}"`).join(", ")} CASCADE`,
-  );
-});
-
-afterAll(async () => {
-  server.close();
-  await kysely.destroy();
-  await db.close();
-});
-
-const createTestBundle = (overrides?: Partial<Bundle>): Bundle => ({
-  id: NIL_UUID,
-  platform: "ios",
-  gitCommitHash: null,
-  manifestStorageUri: "test://storage/manifest.json",
-  manifestFileHash: "test-manifest-hash",
-  assetBaseStorageUri: "test://assets",
-  ...overrides,
-});
-
-describe("Standalone core API over admin API protocol 2", () => {
-  const core = () =>
-    standaloneRepository({ baseUrl: `${baseUrl}/hot-updater/admin` }).core;
-  const deployment = (bundle: Bundle, channel = "production") => ({
-    bundle,
-    release: {
-      channel,
-      enabled: true,
-      fingerprintHash: null,
-      message: null,
-      shouldForceUpdate: false,
-      targetAppVersion: "1.0.0",
-    },
-  });
-
-  it("deploys, lists by key, and reads bundles, releases, catalogs, and channels", async () => {
-    const remote = core();
-    const bundles = [uuidv7(), uuidv7(), uuidv7()].map((id) =>
-      createTestBundle({ id }),
-    );
-    const deployed = [];
-    for (const bundle of bundles) {
-      deployed.push(...(await remote.deploy([deployment(bundle)])));
-    }
-    const scopeKey = deployed[0]!.catalog.scope_key;
-    const channel = await remote.findChannelByName("production");
-
-    expect(deployed.map(({ catalog }) => catalog.generation)).toEqual([
-      1, 2, 3,
-    ]);
-    expect(channel).toMatchObject({ name: "production" });
-    await expect(remote.listChannels()).resolves.toEqual([channel]);
-    const first = await remote.listBundles({ limit: 2, order: "desc" });
-    const second = await remote.listBundles({
-      limit: 2,
-      order: "desc",
-      after: first.at(-1)!.bundle.id,
-    });
-    expect([...first, ...second].map(({ bundle }) => bundle.id)).toEqual(
-      bundles.map(({ id }) => id).reverse(),
-    );
-    await expect(remote.countBundles()).resolves.toBe(3);
-    await expect(remote.countBundles("android")).resolves.toBe(0);
-    await expect(remote.getBundle(bundles[0]!.id)).resolves.toMatchObject({
-      bundle: { id: bundles[0]!.id },
-      patches: [],
-      childCount: 0,
-    });
-    await expect(remote.getBundle(uuidv7())).resolves.toBeNull();
-    await expect(
-      remote.listReleases({
-        limit: 10,
-        order: "asc",
-        filter: { kind: "scope", scopeKey, enabled: true },
-      }),
-    ).resolves.toHaveLength(3);
-    await expect(
-      remote.listReleases({
-        limit: 10,
-        filter: {
-          kind: "channelPlatform",
-          channelId: channel!.id,
-          platform: "ios",
-          enabled: false,
-        },
-      }),
-    ).resolves.toEqual([]);
-    await expect(remote.getReleaseCatalogRow(scopeKey)).resolves.toMatchObject({
-      generation: 3,
-    });
-    await expect(remote.listReleaseCatalogs({ limit: 10 })).resolves.toEqual([
-      expect.objectContaining({ scope_key: scopeKey }),
-    ]);
-  });
-
-  it("changes, previews, promotes, and deletes releases, and rebuilds catalogs", async () => {
-    const remote = core();
-    const [deployed] = await remote.deploy([
-      deployment(createTestBundle({ id: uuidv7() })),
-    ]);
-    const releaseId = deployed!.release!.id;
-    const scopeKey = deployed!.catalog.scope_key;
-
-    await expect(
-      remote.preflightReleasePolicy({
-        releaseId,
-        patch: { rolloutCohortCount: 100 },
-      }),
-    ).resolves.toMatchObject({
-      expectedReleaseRevision: 1,
-      release: { revision: 2 },
-    });
-    await expect(
-      remote.updateReleasePolicy({
-        releaseId,
-        expectedRevision: 1,
-        patch: { rolloutCohortCount: 100 },
-      }),
-    ).resolves.toMatchObject({ release: { revision: 2 } });
-    await expect(
-      remote.updateReleasePolicy({
-        releaseId,
-        expectedRevision: 1,
-        patch: { enabled: false },
-      }),
-    ).rejects.toMatchObject({
-      name: "ReleaseManagementError",
-      code: "VERSION_CONFLICT",
-    });
-    const promoted = await remote.promoteRelease({
-      releaseId,
-      targetChannel: "beta",
-      action: "move",
-    });
-    expect(promoted.source!.release).toMatchObject({ enabled: false });
-    expect(promoted.target.release).toMatchObject({
-      operation: "PROMOTE",
-      source_release_id: releaseId,
-    });
-    await expect(
-      remote.preflightReleaseCatalogRebuild(scopeKey),
-    ).resolves.toMatchObject({ changed: false });
-    await expect(remote.rebuildReleaseCatalog(scopeKey)).resolves.toMatchObject(
-      { changed: false },
-    );
-    await expect(remote.deleteRelease({ releaseId })).resolves.toMatchObject({
-      release: null,
-    });
-    await expect(remote.getRelease(releaseId)).resolves.toBeNull();
-  });
-
-  it("creates and deletes channels, replaces patches, and refuses to delete a bundle a release uses", async () => {
-    const remote = core();
-    const base = createTestBundle({ id: uuidv7() });
-    const target = createTestBundle({ id: uuidv7() });
-    await remote.deploy([deployment(base)]);
-    await remote.deploy([deployment(target)]);
-    const qa = await remote.ensureChannel("qa");
-
-    await expect(remote.ensureChannel("qa")).resolves.toEqual(qa);
-    await expect(remote.deleteChannel(qa.id)).resolves.toEqual({
-      deleted: true,
-    });
-    const production = await remote.findChannelByName("production");
-    await expect(remote.deleteChannel(production!.id)).resolves.toEqual({
-      deleted: false,
-      reason: "not_empty",
-    });
-    await remote.updateBundle(target.id, {
-      patches: [
-        {
-          baseBundleId: base.id,
-          baseFileHash: "base-hash",
-          byteSize: 10,
-          patchFileHash: "patch-hash",
-          patchStorageUri: "test://patches/1.patch",
-        },
-      ],
-    });
-    await expect(
-      remote.listPatchesFromBase(base.id, { limit: 10 }),
-    ).resolves.toEqual([expect.objectContaining({ bundle_id: target.id })]);
-    await expect(
-      remote.countBundleChildren([base.id, target.id]),
-    ).resolves.toEqual({ [base.id]: 1, [target.id]: 0 });
-    await expect(remote.deleteBundles([base.id])).rejects.toMatchObject({
-      status: 409,
-    });
-  });
-
-  it("fails fast on a server that predates protocol 2, and refuses release filters no index serves", async () => {
-    server.use(
-      http.get(`${baseUrl}/old-server/version`, () =>
-        HttpResponse.json({ error: "Not found" }, { status: 404 }),
-      ),
-    );
-    await expect(
-      standaloneRepository({
-        baseUrl: `${baseUrl}/old-server`,
-      }).core.listChannels(),
-    ).rejects.toThrow("speaks admin API protocol 1, and this CLI needs 2");
-
-    const response = await fetch(
-      `${baseUrl}/hot-updater/admin/releases?v=2&channelId=x`,
-    );
-    expect(response.status).toBe(400);
-  });
-});
-
-describe("Insights through a self-hosted server's admin API", () => {
-  const offPath = "/no-insights";
-  const withoutInsights = createHotUpdater({
-    database: kyselyAdapter({ db: kysely, provider: "postgresql" }),
-    plugins: [],
-    clientAccess: "public",
-  });
-
-  beforeAll(() => {
-    server.use(
-      http.all(`${baseUrl}${offPath}/*`, ({ request }) =>
-        invokeHandler(withoutInsights, request, offPath),
-      ),
-    );
-  });
-
-  it("reads events with the repository's headers, and a server without insights() serves no Insights route", async () => {
-    const on = standaloneRepository({
-      baseUrl: `${baseUrl}/hot-updater/admin`,
-    });
-    const onResponse = await on.fetchAdmin("/events?limit=1");
-    expect(onResponse.status).toBe(200);
-    await expect(onResponse.json()).resolves.toMatchObject({ data: [] });
-
-    const off = standaloneRepository({ baseUrl: `${baseUrl}${offPath}/admin` });
-    const offResponse = await off.fetchAdmin("/events?limit=1");
-    expect(offResponse.status).toBe(404);
-  });
-
-  it("lists the plugins each server runs on its admin /version, as the console reads them", async () => {
-    const plugins = async (adminUrl: string) => {
-      const response = await standaloneRepository({
-        baseUrl: adminUrl,
-      }).fetchAdmin("/version");
-      return ((await response.json()) as { plugins: unknown }).plugins;
-    };
-
-    await expect(plugins(`${baseUrl}/hot-updater/admin`)).resolves.toEqual([
-      "insights",
-    ]);
-    await expect(plugins(`${baseUrl}${offPath}/admin`)).resolves.toEqual([]);
-    const client = await fetch(`${baseUrl}/hot-updater/version`);
-    expect(await client.json()).not.toHaveProperty("plugins");
-  });
-});

package/src/handler.spec.ts

@@ -1,273 +0,0 @@
-import type { ReleaseCatalog } from "@hot-updater/core";
-import { Hono } from "hono";
-import { describe, expect, it, vi } from "vitest";
-
-import { createHotUpdaterHandlers } from "./handler";
-import { createApi, createHandlers } from "./handler.testFixtures";
-import { HOT_UPDATER_INFRASTRUCTURE_GENERATION } from "./handlerVersionRoutes";
-import { HOT_UPDATER_SERVER_VERSION } from "./version";
-
-describe("createHandlers client routes", () => {
-  it("reports the v1 infrastructure generation", async () => {
-    const handler = createHandlers(createApi()).client;
-    const response = await handler(new Request("http://localhost/version"));
-
-    expect(response.status).toBe(200);
-    await expect(response.json()).resolves.toEqual({
-      adminProtocol: 2,
-      infrastructureGeneration: HOT_UPDATER_INFRASTRUCTURE_GENERATION,
-      version: HOT_UPDATER_SERVER_VERSION,
-    });
-  });
-
-  it("keeps the plugins the server runs off the client /version", async () => {
-    const handler = createHotUpdaterHandlers({
-      api: createApi(),
-      plugins: ["insights", "apiKeys"],
-    }).client;
-
-    const response = await handler(new Request("http://localhost/version"));
-
-    await expect(response.json()).resolves.toEqual({
-      adminProtocol: 2,
-      infrastructureGeneration: HOT_UPDATER_INFRASTRUCTURE_GENERATION,
-      version: HOT_UPDATER_SERVER_VERSION,
-    });
-  });
-
-  it.each([
-    "/app-version/ios/1.0.0/production/default/default",
-    "/fingerprint/android/fingerprint-123/production/default/default",
-  ])("does not expose the v0 route %s", async (path) => {
-    const handler = createHandlers(createApi()).client;
-
-    const response = await handler(new Request(`http://localhost${path}`));
-
-    expect(response.status).toBe(404);
-  });
-
-  it.each([
-    "/v2/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0",
-    "/v2/artifacts/target-bundle/from/current-bundle",
-    "/artifacts/target-bundle/from/current-bundle",
-  ])("does not expose the unsupported route %s", async (path) => {
-    const handler = createHandlers(createApi()).client;
-
-    const response = await handler(new Request(`http://localhost${path}`));
-
-    expect(response.status).toBe(404);
-  });
-
-  it("does not match the admin mount namespace", async () => {
-    const handler = createHandlers(createApi()).client;
-
-    const response = await handler(
-      new Request("http://localhost/admin/channels"),
-    );
-
-    expect(response.status).toBe(404);
-  });
-
-  it("returns the stored Catalog identity without accepting identity parameters", async () => {
-    const catalog = {
-      catalogId: "project-a",
-      catalogHash: "sha256:catalog",
-      fallbackPolicy: "BUILTIN_IF_ACTIVE_INELIGIBLE",
-      generation: 1,
-      releases: [],
-      schemaVersion: 1,
-      scopeKey: "v1:fingerprint:android:cHJvZHVjdGlvbg:fingerprint-123",
-    } satisfies ReleaseCatalog;
-    const api = createApi();
-    const getReleaseCatalog = vi
-      .spyOn(api.core, "getReleaseCatalog")
-      .mockResolvedValue(catalog);
-    const handler = createHandlers(api).client;
-    const url =
-      "http://localhost/release-catalogs/fingerprint/android/" +
-      "cHJvZHVjdGlvbg/fingerprint-123";
-
-    const response = await handler(new Request(url));
-
-    expect(response.status).toBe(200);
-    await expect(response.json()).resolves.toMatchObject({
-      catalogId: "project-a",
-    });
-    expect(getReleaseCatalog).toHaveBeenCalledWith({
-      channelKey: "cHJvZHVjdGlvbg",
-      fingerprintHash: "fingerprint-123",
-      platform: "android",
-      strategy: "FINGERPRINT",
-    });
-
-    const legacyAuthorityPath = await handler(
-      new Request(url.replace("/android/", "/project-a/android/")),
-    );
-    expect(legacyAuthorityPath.status).toBe(404);
-    expect(getReleaseCatalog).toHaveBeenCalledOnce();
-  });
-
-  it("serves client-relative storage paths under a framework mount", async () => {
-    const api = createApi();
-    vi.spyOn(api.core, "getArtifactInfo").mockResolvedValue({
-      artifactProtocolVersion: 1,
-      assets: {
-        "index.bundle": {
-          file: {
-            url: "/storage/asset-token/asset-signature",
-          },
-          fileHash: "asset-hash",
-          patch: {
-            algorithm: "bsdiff",
-            baseBundleId: "bundle-1",
-            baseFileHash: "base-hash",
-            patchFileHash: "patch-hash",
-            patchUrl: "/storage/patch-token/patch-signature",
-          },
-        },
-      },
-      manifestFileHash: "manifest-hash",
-      manifestUrl: "/storage/manifest-token/manifest-signature",
-    });
-    const handlers = createHotUpdaterHandlers({
-      api,
-      downloadStorageObject: async () => new Response("bundle archive"),
-    });
-    const app = new Hono();
-    app.mount("/hot-updater", handlers.client);
-
-    const response = await app.request(
-      "/hot-updater/artifacts/v1/bundle-2/from/bundle-1",
-    );
-
-    expect(response.status).toBe(200);
-    const info = (await response.json()) as {
-      assets: Record<
-        string,
-        { file: { url: string }; patch: { patchUrl: string } }
-      >;
-      manifestUrl: string;
-    };
-    expect(info).toMatchObject({
-      assets: {
-        "index.bundle": {
-          file: { url: "/storage/asset-token/asset-signature" },
-          patch: { patchUrl: "/storage/patch-token/patch-signature" },
-        },
-      },
-      manifestUrl: "/storage/manifest-token/manifest-signature",
-    });
-
-    const download = await app.request(
-      `/hot-updater${info.assets["index.bundle"]!.file.url}`,
-    );
-    expect(download.status).toBe(200);
-    await expect(download.text()).resolves.toBe("bundle archive");
-  });
-
-  it("serves artifact protocol v1 on an explicit route", async () => {
-    const api = createApi();
-    const getArtifactInfo = vi
-      .spyOn(api.core, "getArtifactInfo")
-      .mockResolvedValue({
-        artifactProtocolVersion: 1,
-        assets: {
-          "index.ios.bundle": {
-            file: { url: "/storage/file-token/file-signature" },
-            fileHash: "target-hash",
-          },
-        },
-        manifestFileHash: "manifest-hash",
-        manifestUrl: "/storage/manifest-token/manifest-signature",
-      });
-    const handler = createHandlers(api).client;
-
-    const response = await handler(
-      new Request("http://localhost/artifacts/v1/target/from/current"),
-    );
-
-    expect(response.status).toBe(200);
-    expect(response.headers.get("content-type")).toBe(
-      "application/vnd.hot-updater.artifact+json; version=1",
-    );
-    await expect(response.json()).resolves.toMatchObject({
-      artifactProtocolVersion: 1,
-      assets: {
-        "index.ios.bundle": {
-          file: { url: "/storage/file-token/file-signature" },
-        },
-      },
-    });
-    expect(getArtifactInfo).toHaveBeenCalledWith("target", "current", 1);
-  });
-
-  it("authenticates artifact protocol v1 before resolving artifacts", async () => {
-    const api = createApi();
-    const getArtifactInfo = vi
-      .spyOn(api.core, "getArtifactInfo")
-      .mockResolvedValue({
-        artifactProtocolVersion: 1,
-        assets: {},
-        manifestFileHash: "manifest-hash",
-        manifestUrl: "/storage/manifest-token/manifest-signature",
-      });
-    const authenticate = vi.fn(async (request: Request) => {
-      const apiKey = request.headers.get("x-api-key");
-      if (apiKey === "unavailable") {
-        throw new Error("credential storage unavailable");
-      }
-      return apiKey === "valid";
-    });
-    const handler = createHotUpdaterHandlers({
-      api,
-      clientPolicy: { authenticate, varyHeaders: ["x-api-key"] },
-    }).client;
-    const url = "http://localhost/artifacts/v1/target/from/current";
-
-    const missing = await handler(new Request(url));
-    const invalid = await handler(
-      new Request(url, { headers: { "x-api-key": "invalid" } }),
-    );
-    const valid = await handler(
-      new Request(url, { headers: { "x-api-key": "valid" } }),
-    );
-    const unavailable = await handler(
-      new Request(url, { headers: { "x-api-key": "unavailable" } }),
-    );
-
-    expect(missing.status).toBe(401);
-    expect(invalid.status).toBe(401);
-    expect(valid.status).toBe(200);
-    expect(unavailable.status).toBe(503);
-    expect(authenticate).toHaveBeenCalledTimes(4);
-    expect(getArtifactInfo).toHaveBeenCalledOnce();
-    expect(getArtifactInfo).toHaveBeenCalledWith("target", "current", 1);
-  });
-
-  it("does not expose provider errors from the public client handler", async () => {
-    const api = createApi();
-    vi.spyOn(api.core, "getReleaseCatalog").mockRejectedValue(
-      new Error("private database connection details"),
-    );
-    const consoleError = vi
-      .spyOn(console, "error")
-      .mockImplementation(() => {});
-    const handler = createHandlers(api).client;
-
-    const response = await handler(
-      new Request(
-        "http://localhost/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0",
-      ),
-    );
-
-    expect(response.status).toBe(500);
-    await expect(response.json()).resolves.toEqual({
-      error: "Internal server error",
-    });
-    expect(consoleError).toHaveBeenCalledWith(
-      "Hot Updater handler error:",
-      expect.any(Error),
-    );
-    consoleError.mockRestore();
-  });
-});

package/src/handler.testFixtures.ts

@@ -1,25 +0,0 @@
-import type { Bundle } from "@hot-updater/core";
-import { createMemoryAdapter } from "@hot-updater/plugin-core/internal";
-
-import { createInProcessCoreApi } from "./core/api";
-import { createHotUpdaterHandlers, type HandlerAPI } from "./handler";
-
-export const testBundle: Bundle = {
-  id: "bundle-1",
-  platform: "ios",
-  gitCommitHash: null,
-  manifestStorageUri: "s3://test-bucket/bundles/bundle-1/manifest.json",
-  manifestFileHash: "manifest-hash",
-  assetBaseStorageUri: "s3://test-bucket/assets",
-};
-
-/** Core on an empty in-memory database; spy on a method to stub it. */
-export const createApi = (): HandlerAPI => ({
-  core: createInProcessCoreApi(createMemoryAdapter()),
-});
-
-export const createHandlers = (api: HandlerAPI = createApi()) =>
-  createHotUpdaterHandlers({ api });
-
-export const createAdminHandler = (api: HandlerAPI = createApi()) =>
-  createHandlers(api).admin;