@jant/core 0.7.0 → 0.7.1

package/src/services/__tests__/bootstrap-setup-instance.test.ts

@@ -0,0 +1,230 @@
+import { sql } from "drizzle-orm";
+import { beforeEach, describe, expect, it } from "vitest";
+import { createTestDatabase } from "../../__tests__/helpers/db.js";
+import type { Database } from "../../db/index.js";
+import {
+  account,
+  navItems,
+  settings,
+  siteDomains,
+  siteMembers,
+  sites,
+  user,
+} from "../../db/schema.js";
+import { verifyPassword } from "../../lib/password.js";
+import { createBootstrapService } from "../bootstrap.js";
+import { createSiteService, TRANSIENT_SINGLE_SITE_ID } from "../site.js";
+
+const SNAPSHOT_SITE_ID = "sit_01kn8jq3t4famtyg9hjd074ckr";
+const OWNER = { email: "owner@example.com", password: "correct horse" };
+
+async function readSettings(db: Database, siteId: string) {
+  const rows = await db.select().from(settings);
+  return Object.fromEntries(
+    rows
+      .filter((row) => row.siteId === siteId)
+      .map((row) => [row.key, row.value]),
+  );
+}
+
+async function storedPasswordHash(db: Database) {
+  const rows = await db.select({ password: account.password }).from(account);
+  expect(rows).toHaveLength(1);
+  return rows[0]?.password ?? "";
+}
+
+describe("EnsureSingleSiteOptions.id", () => {
+  let db: Database;
+
+  beforeEach(async () => {
+    db = createTestDatabase().db as unknown as Database;
+    await db.run(sql`DELETE FROM "site"`);
+  });
+
+  it("creates the site with the given id", async () => {
+    const { site } = await createSiteService(db).ensureSingleSite({
+      id: SNAPSHOT_SITE_ID,
+    });
+
+    expect(site.id).toBe(SNAPSHOT_SITE_ID);
+  });
+
+  // Like the host and key, the id says what a new site is created with. It is
+  // never a request to rename a site that exists.
+  it("leaves an existing site's id alone", async () => {
+    const { site: existing } = await createSiteService(db).ensureSingleSite();
+    const { site } = await createSiteService(db).ensureSingleSite({
+      id: SNAPSHOT_SITE_ID,
+    });
+
+    expect(site.id).toBe(existing.id);
+    expect(await db.select().from(sites)).toHaveLength(1);
+  });
+});
+
+describe("BootstrapService.setUpInstance", () => {
+  let db: Database;
+
+  function bootstrap(options?: Parameters<typeof createBootstrapService>[2]) {
+    return createBootstrapService(db, TRANSIENT_SINGLE_SITE_ID, options);
+  }
+
+  beforeEach(async () => {
+    db = createTestDatabase().db as unknown as Database;
+    await db.run(sql`DELETE FROM "site"`);
+  });
+
+  it("leaves a fresh install set up, the way both screens would", async () => {
+    const result = await bootstrap().setUpInstance({
+      ...OWNER,
+      siteId: SNAPSHOT_SITE_ID,
+      siteName: "Field Notes",
+      siteLanguage: "zh-Hans",
+      timeZone: "Asia/Shanghai",
+    });
+
+    expect(result).toEqual({ outcome: "created", siteId: SNAPSHOT_SITE_ID });
+
+    const [owner] = await db.select().from(user);
+    expect(owner).toMatchObject({
+      email: OWNER.email,
+      name: "Field Notes",
+      role: "admin",
+    });
+    expect(
+      await verifyPassword({
+        hash: await storedPasswordHash(db),
+        password: OWNER.password,
+      }),
+    ).toBe(true);
+
+    expect(await db.select().from(siteMembers)).toEqual([
+      expect.objectContaining({
+        siteId: SNAPSHOT_SITE_ID,
+        userId: owner?.id,
+        role: "owner",
+      }),
+    ]);
+    expect(await db.select().from(navItems)).toHaveLength(5);
+    expect(await readSettings(db, SNAPSHOT_SITE_ID)).toMatchObject({
+      ONBOARDING_STATUS: "completed",
+      SITE_NAME: "Field Notes",
+      SITE_LANGUAGE: "zh-Hans",
+      TIME_ZONE: "Asia/Shanghai",
+    });
+  });
+
+  // An empty answer on the screens: the base locale and UTC, and no name, so
+  // the site keeps its fallback and the account keeps the address's stand-in.
+  it("gives unanswered questions the screens' defaults", async () => {
+    const result = await bootstrap().setUpInstance(OWNER);
+
+    expect(result.outcome).toBe("created");
+    expect(result.siteId).toMatch(/^sit_/);
+    const stored = await readSettings(db, result.siteId);
+    expect(stored).toMatchObject({
+      ONBOARDING_STATUS: "completed",
+      SITE_LANGUAGE: "en",
+      TIME_ZONE: "UTC",
+    });
+    expect(stored.SITE_NAME).toBeUndefined();
+    expect((await db.select().from(user))[0]?.name).toBe("owner");
+  });
+
+  it("gives the site its configured domain", async () => {
+    await createBootstrapService(db, TRANSIENT_SINGLE_SITE_ID, {
+      bootstrapSite: { host: "notes.example.com" },
+    }).setUpInstance(OWNER);
+
+    expect(await db.select().from(siteDomains)).toEqual([
+      expect.objectContaining({ host: "notes.example.com", kind: "primary" }),
+    ]);
+  });
+
+  // A deployment runs this on every start. The owner may have changed the
+  // password since, and a restart must not quietly put the old one back.
+  it("changes nothing on an install that finished setup", async () => {
+    const first = await bootstrap().setUpInstance({
+      ...OWNER,
+      siteName: "Field Notes",
+    });
+    const hashBefore = await storedPasswordHash(db);
+
+    const second = await bootstrap().setUpInstance({
+      email: "someone-else@example.com",
+      password: "a different password",
+      siteName: "Renamed",
+    });
+
+    expect(second).toEqual({
+      outcome: "already-set-up",
+      siteId: first.siteId,
+    });
+    expect(await storedPasswordHash(db)).toBe(hashBefore);
+    expect(await db.select().from(user)).toHaveLength(1);
+    expect((await readSettings(db, first.siteId)).SITE_NAME).toBe(
+      "Field Notes",
+    );
+  });
+
+  it("refuses a site id that is not the install's", async () => {
+    await bootstrap().setUpInstance(OWNER);
+
+    await expect(
+      bootstrap().setUpInstance({ ...OWNER, siteId: SNAPSHOT_SITE_ID }),
+    ).rejects.toThrow(`not ${SNAPSHOT_SITE_ID}`);
+  });
+
+  describe("after a run that stopped once the account existed", () => {
+    beforeEach(async () => {
+      await bootstrap().setUpInstance(OWNER);
+      // Undo everything past the account, which is where an interrupted run
+      // leaves an install.
+      await db.run(sql`DELETE FROM "site"`);
+    });
+
+    it("finishes with the same address and password", async () => {
+      const result = await bootstrap().setUpInstance({
+        ...OWNER,
+        siteId: SNAPSHOT_SITE_ID,
+        siteName: "Field Notes",
+      });
+
+      expect(result).toEqual({ outcome: "resumed", siteId: SNAPSHOT_SITE_ID });
+      expect(await db.select().from(user)).toHaveLength(1);
+      expect((await db.select().from(user))[0]?.name).toBe("Field Notes");
+      expect((await readSettings(db, SNAPSHOT_SITE_ID)).ONBOARDING_STATUS).toBe(
+        "completed",
+      );
+    });
+
+    it("refuses the wrong password", async () => {
+      await expect(
+        bootstrap().setUpInstance({ ...OWNER, password: "not the password" }),
+      ).rejects.toThrow("does not match");
+      expect(await db.select().from(sites)).toHaveLength(0);
+    });
+
+    it("refuses another address", async () => {
+      await expect(
+        bootstrap().setUpInstance({
+          email: "someone-else@example.com",
+          password: OWNER.password,
+        }),
+      ).rejects.toThrow("already has an account under another address");
+      expect(await db.select().from(user)).toHaveLength(1);
+      expect(await db.select().from(sites)).toHaveLength(0);
+    });
+  });
+
+  // A hosted site's owner arrives through the control plane's handoff, so
+  // this refuses before creating an account in a database every tenant shares.
+  it("refuses a host-based install before writing anything", async () => {
+    await expect(
+      bootstrap({ siteResolutionMode: "host-based" }).setUpInstance(OWNER),
+    ).rejects.toThrow("setUpInstance runs on self-hosted installs only");
+
+    expect(await db.select().from(user)).toHaveLength(0);
+    expect(await db.select().from(sites)).toHaveLength(0);
+  });
+});

package/src/services/__tests__/custom-url.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach } from "vitest";
+import { sql } from "drizzle-orm";
 import {
   createTestDatabase,
   DEFAULT_TEST_SITE_ID,
@@ -96,6 +97,39 @@ describe("CustomUrlService", () => {
     });
   });
 
+  // Postgres gives no order among rows that tie on the sort key, so paging
+  // by created_at alone repeated some custom URLs and never showed others
+  // (482 rows listed, 478 distinct, on a real site).
+  describe("list order", () => {
+    it("orders custom URLs created in the same second by ID", async () => {
+      const created = [];
+      for (const path of ["a-page", "b-page", "c-page"]) {
+        created.push(
+          await customUrlService.create({
+            path,
+            targetType: "redirect",
+            toPath: "/target",
+            redirectType: 301,
+          }),
+        );
+      }
+      await db.run(sql`UPDATE path_registry SET created_at = 1000`);
+
+      const listed = await customUrlService.list();
+      const expected = created
+        .map((url) => url.id)
+        .sort()
+        .reverse();
+      expect(listed.map((url) => url.id)).toEqual(expected);
+
+      const pages = [
+        ...(await customUrlService.list({ limit: 2, offset: 0 })),
+        ...(await customUrlService.list({ limit: 2, offset: 2 })),
+      ];
+      expect(pages.map((url) => url.id)).toEqual(expected);
+    });
+  });
+
   describe("getByPath", () => {
     it("returns custom URL by path", async () => {
       await customUrlService.create({

package/src/services/__tests__/github-app-installations.test.ts

@@ -26,6 +26,23 @@ function insertSecondSite(
     .run(SECOND_SITE_ID, SECOND_SITE_KEY, timestamp, timestamp);
 }
 
+const OWNER_USER_ID = "usr_owner0000000000000000000000000";
+const OTHER_USER_ID = "usr_other0000000000000000000000000";
+
+function addMember(
+  sqlite: ReturnType<typeof createTestDatabase>["sqlite"],
+  siteId: string,
+  userId: string,
+) {
+  const timestamp = Math.floor(Date.now() / 1000);
+  sqlite
+    .prepare(
+      `INSERT INTO site_member (site_id, user_id, role, created_at, updated_at)
+       VALUES (?, ?, 'owner', ?, ?)`,
+    )
+    .run(siteId, userId, timestamp, timestamp);
+}
+
 function makeAccount(
   overrides: Partial<GitHubInstallationAccount> = {},
 ): GitHubInstallationAccount {
@@ -178,4 +195,140 @@ describe("GitHubAppInstallationsService", () => {
       "inst-older",
     ]);
   });
+  describe("user-scoped visibility", () => {
+    it("returns nothing for a user with no sites", async () => {
+      await service.upsertInstallation(
+        "inst-1",
+        DEFAULT_TEST_SITE_ID,
+        makeAccount(),
+      );
+      expect(await service.listInstallationsForUser(OWNER_USER_ID)).toEqual([]);
+    });
+
+    it("surfaces an installation bound to another site the user belongs to", async () => {
+      insertSecondSite(sqlite);
+      addMember(sqlite, DEFAULT_TEST_SITE_ID, OWNER_USER_ID);
+      addMember(sqlite, SECOND_SITE_ID, OWNER_USER_ID);
+
+      // Bound to the first site only — the second site is the one trying
+      // to connect, and GitHub will not install the App twice on one
+      // account, so this row is its only way in.
+      await service.upsertInstallation(
+        "inst-1",
+        DEFAULT_TEST_SITE_ID,
+        makeAccount({ login: "octo", type: "User" }),
+      );
+
+      const visible = await service.listInstallationsForUser(OWNER_USER_ID);
+      expect(visible).toHaveLength(1);
+      expect(visible[0]).toMatchObject({
+        installationId: "inst-1",
+        account: { login: "octo", type: "User" },
+      });
+      expect(await service.listInstallationsForSite(SECOND_SITE_ID)).toEqual(
+        [],
+      );
+    });
+
+    it("hides installations bound to sites the user is not a member of", async () => {
+      insertSecondSite(sqlite);
+      addMember(sqlite, DEFAULT_TEST_SITE_ID, OWNER_USER_ID);
+      addMember(sqlite, SECOND_SITE_ID, OTHER_USER_ID);
+
+      await service.upsertInstallation(
+        "inst-theirs",
+        SECOND_SITE_ID,
+        makeAccount({ login: "somebody-else" }),
+      );
+
+      expect(await service.listInstallationsForUser(OWNER_USER_ID)).toEqual([]);
+      expect(
+        await service.findInstallationForUser("inst-theirs", OWNER_USER_ID),
+      ).toBeNull();
+      expect(
+        await service.findInstallationForUser("inst-theirs", OTHER_USER_ID),
+      ).toMatchObject({ installationId: "inst-theirs" });
+    });
+
+    it("lists an installation once when several of the user's sites share it", async () => {
+      insertSecondSite(sqlite);
+      addMember(sqlite, DEFAULT_TEST_SITE_ID, OWNER_USER_ID);
+      addMember(sqlite, SECOND_SITE_ID, OWNER_USER_ID);
+
+      await service.upsertInstallation(
+        "inst-1",
+        DEFAULT_TEST_SITE_ID,
+        makeAccount(),
+      );
+      await service.upsertInstallation("inst-1", SECOND_SITE_ID, makeAccount());
+
+      const visible = await service.listInstallationsForUser(OWNER_USER_ID);
+      expect(visible.map((entry) => entry.installationId)).toEqual(["inst-1"]);
+    });
+
+    it("removeInstallationForUser clears every binding the user can see", async () => {
+      insertSecondSite(sqlite);
+      addMember(sqlite, DEFAULT_TEST_SITE_ID, OWNER_USER_ID);
+
+      await service.upsertInstallation(
+        "inst-1",
+        DEFAULT_TEST_SITE_ID,
+        makeAccount(),
+      );
+      // A site the user has nothing to do with keeps its binding: only
+      // the App webhook's `installation.deleted` speaks for everyone.
+      await service.upsertInstallation("inst-1", SECOND_SITE_ID, makeAccount());
+
+      await service.removeInstallationForUser("inst-1", OWNER_USER_ID);
+
+      expect(await service.listInstallationsForUser(OWNER_USER_ID)).toEqual([]);
+      expect(await service.listSitesForInstallation("inst-1")).toEqual([
+        SECOND_SITE_ID,
+      ]);
+    });
+    it("reads syncing installations from settings only for the user's own sites", async () => {
+      insertSecondSite(sqlite);
+      addMember(sqlite, DEFAULT_TEST_SITE_ID, OWNER_USER_ID);
+      addMember(sqlite, SECOND_SITE_ID, OTHER_USER_ID);
+      const timestamp = Math.floor(Date.now() / 1000);
+      const setSetting = (siteId: string, key: string, value: string) =>
+        sqlite
+          .prepare(
+            `INSERT INTO site_setting (site_id, key, value, updated_at)
+             VALUES (?, ?, ?, ?)`,
+          )
+          .run(siteId, key, value, timestamp);
+
+      setSetting(
+        DEFAULT_TEST_SITE_ID,
+        "GITHUB_SYNC_APP_INSTALLATION_ID",
+        "inst-mine",
+      );
+      setSetting(
+        SECOND_SITE_ID,
+        "GITHUB_SYNC_APP_INSTALLATION_ID",
+        "inst-theirs",
+      );
+
+      expect(
+        await service.listSyncingInstallationsForUser(OWNER_USER_ID),
+      ).toEqual([
+        { siteId: DEFAULT_TEST_SITE_ID, installationId: "inst-mine" },
+      ]);
+    });
+
+    it("skips a site whose stored installation id was cleared", async () => {
+      addMember(sqlite, DEFAULT_TEST_SITE_ID, OWNER_USER_ID);
+      sqlite
+        .prepare(
+          `INSERT INTO site_setting (site_id, key, value, updated_at)
+           VALUES (?, 'GITHUB_SYNC_APP_INSTALLATION_ID', '', ?)`,
+        )
+        .run(DEFAULT_TEST_SITE_ID, Math.floor(Date.now() / 1000));
+
+      expect(
+        await service.listSyncingInstallationsForUser(OWNER_USER_ID),
+      ).toEqual([]);
+    });
+  });
 });

package/src/services/__tests__/github-sync-push.test.ts

@@ -11,10 +11,12 @@
 
 import { describe, expect, it } from "vitest";
 import type { GitHubTreeItem } from "../../lib/github-api.js";
+import type { ExportFile } from "../export.js";
 import {
   computeManagedDeletions,
   isManagedPath,
   pathMatchesManagedGlob,
+  selectFilesToWrite,
 } from "../github-sync.js";
 
 describe("pathMatchesManagedGlob", () => {
@@ -66,6 +68,50 @@ describe("isManagedPath", () => {
   });
 });
 
+describe("selectFilesToWrite", () => {
+  const generated: ExportFile[] = [
+    { path: "hugo.toml", content: 'baseURL = "/"' },
+    { path: "content/hello/_index.md", content: "---\n---\n" },
+    { path: "wrangler.jsonc", content: "{}", scaffoldOnce: true },
+  ];
+
+  it("writes scaffolding the repository does not have yet", () => {
+    const written = selectFilesToWrite(generated, new Set(["hugo.toml"]));
+
+    expect(written.map((f) => f.path)).toEqual([
+      "hugo.toml",
+      "content/hello/_index.md",
+      "wrangler.jsonc",
+    ]);
+  });
+
+  it("leaves scaffolding alone once the repository has it", () => {
+    // The Worker name in `wrangler.jsonc` defaults to the repository name,
+    // and a user whose Worker is named differently corrects it by hand.
+    // Rewriting it every push would revert that, and every build after it
+    // would fail on the name mismatch.
+    const written = selectFilesToWrite(
+      generated,
+      new Set(["hugo.toml", "wrangler.jsonc"]),
+    );
+
+    expect(written.map((f) => f.path)).toEqual([
+      "hugo.toml",
+      "content/hello/_index.md",
+    ]);
+  });
+
+  it("still rewrites ordinary files the repository already has", () => {
+    const written = selectFilesToWrite(
+      generated,
+      new Set(["hugo.toml", "content/hello/_index.md"]),
+    );
+
+    expect(written.map((f) => f.path)).toContain("hugo.toml");
+    expect(written.map((f) => f.path)).toContain("content/hello/_index.md");
+  });
+});
+
 describe("computeManagedDeletions", () => {
   function blob(path: string): GitHubTreeItem {
     return { path, mode: "100644", type: "blob", sha: "sha-" + path };

package/src/services/__tests__/media.test.ts

@@ -1203,6 +1203,37 @@ describe("MediaService", () => {
       const list = await mediaService.list({ limit: 2 });
       expect(list).toHaveLength(2);
     });
+
+    // The API used to stop at 200 items with no way to ask for the rest.
+    it("pages through every item with an ID cursor", async () => {
+      const created = [];
+      for (let i = 0; i < 5; i++) {
+        created.push(
+          await mediaService.create({
+            ...sampleMedia,
+            storageKey: `page${i}.jpg`,
+          }),
+        );
+      }
+      const newestFirst = created
+        .map((media) => media.id)
+        .sort()
+        .reverse();
+
+      const first = await mediaService.list({ limit: 2 });
+      const second = await mediaService.list({
+        limit: 2,
+        cursor: first.at(-1)?.id,
+      });
+      const third = await mediaService.list({
+        limit: 2,
+        cursor: second.at(-1)?.id,
+      });
+
+      expect([...first, ...second, ...third].map((media) => media.id)).toEqual(
+        newestFirst,
+      );
+    });
   });
 
   describe("attachToPost", () => {

package/src/services/__tests__/path.test.ts

@@ -178,3 +178,59 @@ describe("PathService.getPostAliases", () => {
     expect(after.get(post.id)?.[0]).toBe("/original");
   });
 });
+
+describe("PathService.listStandalonePaths", () => {
+  it("lists redirects and archive URLs, not a post's own addresses", async () => {
+    const testDb = createTestDatabase();
+    const db = testDb.db as unknown as Database;
+    const paths = createPathService(db, DEFAULT_TEST_SITE_ID);
+    const postService = createPostService(
+      db,
+      { slugIdLength: 5 },
+      DEFAULT_TEST_SITE_ID,
+      paths,
+    );
+    const post = await postService.create({
+      format: "note",
+      title: "Kept",
+      slug: "kept",
+      body: JSON.stringify({ type: "doc", content: [{ type: "paragraph" }] }),
+    });
+    await paths.create({ path: "old-kept", kind: "alias", postId: post.id });
+    await paths.create({
+      path: "atom.xml",
+      kind: "redirect",
+      redirectToPath: "feed",
+      redirectType: 301,
+    });
+    await paths.create({
+      path: "links",
+      kind: "archive",
+      archiveQuery: "format=link",
+    });
+
+    const standalone = await paths.listStandalonePaths();
+
+    expect(
+      standalone.map(({ path, kind, redirectToPath, archiveQuery }) => ({
+        path,
+        kind,
+        redirectToPath,
+        archiveQuery,
+      })),
+    ).toEqual([
+      {
+        path: "atom.xml",
+        kind: "redirect",
+        redirectToPath: "feed",
+        archiveQuery: null,
+      },
+      {
+        path: "links",
+        kind: "archive",
+        redirectToPath: null,
+        archiveQuery: "format=link",
+      },
+    ]);
+  });
+});