@lovrozagar/oat 0.1.1 → 0.2.1

package/labs/README.md

@@ -119,7 +119,7 @@ These also live here — there is no top-level `examples/`.
 | `oat.config.ts`          | principals for a labs world (D1)          |
 | `local.config.ts`        | point oat at `oat serve` (the fixture)    |
 | `minimal.config.ts`      | smallest useful config, static API key    |
-| `anyrow.config.ts`       | multi-step login against a stranger API   |
+| `oob-auth.config.ts`     | multi-step login against a stranger API   |
 | `annotated-openapi.yaml` | every `x-*` tag in one document           |
 | `demo.mjs`               | one-process fixture demo (`npm run demo`) |
 

package/labs/annotated-openapi.yaml

@@ -294,6 +294,60 @@ paths:
                   status: { type: string, enum: [pending, running, complete, failed] }
                 required: [export_id, status]
 
+  # ── public catalogue ──────────────────────────────────────────────────────
+  # No x-tenant, and `{template_id}` is not a tenant name. A second principal
+  # GETting a row created by the first is correct: the resource is shared.
+  # tenant.item-not-readable-cross-tenant does not apply here. The workspace
+  # widget above still does — tag → SECURITY, inferred → AMBIGUITY.
+  /v1/templates:
+    get:
+      operationId: template.list
+      summary: List public templates
+      x-entity: { name: template, action: list, identity: id }
+      responses:
+        "200":
+          description: A page of templates
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  templates: { type: array, items: { $ref: "#/components/schemas/Template" } }
+                required: [templates]
+    post:
+      operationId: template.create
+      summary: Publish a template
+      x-entity: { name: template, action: create, identity: id }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              properties:
+                name: { type: string, maxLength: 128 }
+              required: [name]
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/Template" }
+
+  /v1/templates/{template_id}:
+    get:
+      operationId: template.read
+      x-entity: { name: template, action: read, identity: id }
+      parameters:
+        - { name: template_id, in: path, required: true, schema: { type: string } }
+      responses:
+        "200":
+          description: A public template
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/Template" }
+
 components:
   schemas:
     Widget:
@@ -309,3 +363,9 @@ components:
         updated_at: { type: string, format: date-time }
         deleted_at: { type: [string, "null"] }
       required: [id, workspace_id, name, status, priority, created_at, updated_at]
+    Template:
+      type: object
+      properties:
+        id: { type: string }
+        name: { type: string }
+      required: [id, name]

package/labs/{anyrow.config.ts → oob-auth.config.ts}

@@ -6,7 +6,7 @@
  * header carries it, and which path parameters the credential itself identifies. Delete it and
  * oat still runs against any other OpenAPI document.
  *
- *   ANYROW_TESTER_KEY=... oat run --config labs/anyrow.config.ts
+ *   OAT_API_URL=... OAT_TESTER_KEY=... oat run --config labs/oob-auth.config.ts
  *
  * Written as `from "../dist/index.js"` only because this file lives inside the repository —
  * in your own project it is `from "@lovrozagar/oat"`.
@@ -14,13 +14,13 @@
 
 import { defineConfig, type AuthFlow, type OutOfBandRequest } from "../dist/index.js"
 
-const API = process.env.ANYROW_API ?? "https://api.anyrow.ai"
-const TESTER_KEY = process.env.ANYROW_TESTER_KEY ?? ""
+const API = process.env.OAT_API_URL ?? "https://api.example.com"
+const TESTER_KEY = process.env.OAT_TESTER_KEY ?? ""
 const PASSWORD = "OatSpec123!x"
 
 /** A distinct address per principal per run, so tenants never collide between runs. */
 function freshEmail(label: string): string {
-	return `oat-${label}-${Date.now()}-${Math.floor(Math.random() * 10_000)}@anyrow-spec.test`
+	return `oat-${label}-${Date.now()}-${Math.floor(Math.random() * 10_000)}@oat-spec.test`
 }
 
 /**
@@ -36,8 +36,8 @@ function signUp(label: string): AuthFlow {
 		credentialFrom: "$.access_token",
 		expiresInFrom: "$.access_token_expires_in",
 		steps: [
-			/* Raw paths rather than operationIds: this API's published document contains no auth
-			 * operations at all, so there is nothing in the spec to reference. `oat doctor`
+			/* Raw paths rather than operationIds: an API document like this commonly contains no
+			 * auth operations at all, so there is nothing in the spec to reference. `oat doctor`
 			 * reports that as a gap — a document describing a protected API should describe how
 			 * to authenticate to it. */
 			{
@@ -72,7 +72,7 @@ async function resolveOutOfBand({ address, kind }: OutOfBandRequest): Promise<st
 	const url = new URL(`${API}/v1/test/last-token`)
 	url.searchParams.set("email", address)
 	url.searchParams.set("type", kind)
-	const response = await fetch(url, { headers: { "x-ia-tester-key": TESTER_KEY } })
+	const response = await fetch(url, { headers: { "x-oat-tester-key": TESTER_KEY } })
 	if (!response.ok) return null
 	const body = (await response.json()) as { token?: unknown }
 	return typeof body.token === "string" ? body.token : null
@@ -82,13 +82,13 @@ async function resolveOutOfBand({ address, kind }: OutOfBandRequest): Promise<st
 async function teardownPrincipal(address: string): Promise<void> {
 	const url = new URL(`${API}/v1/test/cleanup-user`)
 	url.searchParams.set("email", address)
-	await fetch(url, { headers: { "x-ia-tester-key": TESTER_KEY }, method: "DELETE" })
+	await fetch(url, { headers: { "x-oat-tester-key": TESTER_KEY }, method: "DELETE" })
 }
 
 export default defineConfig({
 	baseUrl: API,
 	/* Sent on every request. Opaque to oat — it never inspects these. */
-	globalHeaders: { "x-ia-tester-key": TESTER_KEY },
+	globalHeaders: { "x-oat-tester-key": TESTER_KEY },
 	hooks: { resolveOutOfBand, teardownPrincipal },
 	principals: [
 		{

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lovrozagar/oat",
-	"version": "0.1.1",
+	"version": "0.2.1",
 	"description": "OpenAPI Tester — matrix-test a live API against its OpenAPI spec",
 	"keywords": [
 		"api",
@@ -37,7 +37,7 @@
 		"labs/annotated-openapi.yaml",
 		"labs/local.config.ts",
 		"labs/minimal.config.ts",
-		"labs/anyrow.config.ts",
+		"labs/oob-auth.config.ts",
 		"labs/demo.mjs",
 		"labs/README.md"
 	],
@@ -54,19 +54,21 @@
 		"access": "public"
 	},
 	"scripts": {
+		"prepare": "git config --get core.hooksPath >/dev/null || git config core.hooksPath .githooks || true",
 		"build": "tsc -p tsconfig.json",
 		"dev": "tsc -p tsconfig.json --watch",
 		"check": "tsc -p tsconfig.json --noEmit",
-		"test": "npm run build && node --experimental-sqlite dist/cli.js conformance",
+		"test": "bun run build && node --experimental-sqlite dist/cli.js conformance",
 		"conformance": "node --experimental-sqlite dist/cli.js conformance",
-		"demo": "npm run build && node labs/demo.mjs",
+		"bisect": "node --experimental-sqlite labs/bisect.mjs",
+		"demo": "bun run build && node labs/demo.mjs",
 		"labs": "node --experimental-strip-types labs/serve.ts",
 		"labs:sweep": "bash labs/sweep.sh",
 		"lint": "oxlint",
 		"lint:fix": "oxlint --fix",
 		"fmt": "oxfmt",
 		"fmt:check": "oxfmt --check",
-		"prepublishOnly": "npm run build"
+		"prepublishOnly": "bun run build"
 	},
 	"dependencies": {
 		"ajv": "^8.17.1",
@@ -74,6 +76,8 @@
 		"yaml": "^2.9.0"
 	},
 	"devDependencies": {
+		"@commitlint/cli": "^21.2.1",
+		"@commitlint/config-conventional": "^21.2.0",
 		"@types/node": "^22.10.0",
 		"oxfmt": "^0.63.0",
 		"oxlint": "^1.78.0",
@@ -82,5 +86,6 @@
 	},
 	"engines": {
 		"node": ">=20"
-	}
+	},
+	"packageManager": "bun@1.3.11"
 }