@mettlecast/domain-cli 0.2.85 → 0.2.87

package/src/__tests__/validate.test.ts

@@ -31,22 +31,24 @@ describe('runValidate error shape', () => {
 });
 
 /**
- * Action-first migration (#4619, Wave 1 Task 1.2):
+ * Action-first migration (#4619, #5090):
  *
  * `runValidate` ultimately delegates to `buildRegistry` for the
  * registry assembly. These tests exercise the action mapping directly
  * through `buildRegistry` (mocked file walker + module loader) so we
- * catch regressions in how legacy `visibility` maps to `backendAccess`
- * and how `exposure` is serialized.
+ * catch regressions in how exposure is validated.
+ *
+ * Issue #5090 — strict registry contract: every action must declare
+ * exposure, backendAccess, and idempotent explicitly. No legacy defaults.
  */
-describe('buildRegistry action mapping (action-first migration)', () => {
+describe('buildRegistry action mapping (strict contract #5090)', () => {
   const DOMAIN_ROOT = '/fake/domains/billing';
 
   beforeEach(() => {
     vi.clearAllMocks();
   });
 
-  it('reads backendAccess directly when raw action exposes it', async () => {
+  it('reads backendAccess and exposure directly when action declares both', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
       webhooks: [],
@@ -93,15 +95,12 @@ describe('buildRegistry action mapping (action-first migration)', () => {
     }
   });
 
-  it('falls back from legacy visibility to backendAccess and collapses workspace -> domain', async () => {
+  it('preserves inputSchema and outputSchema extraction', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
       webhooks: [],
       subscribers: [],
-      actions: [
-        '/fake/domains/billing/actions/verify-token.ts',
-        '/fake/domains/billing/actions/provision-tenant.ts',
-      ],
+      actions: ['/fake/domains/billing/actions/charge-card.ts'],
       schedules: [],
       jobs: [],
       integrations: [],
@@ -111,24 +110,26 @@ describe('buildRegistry action mapping (action-first migration)', () => {
       .mockResolvedValueOnce([
         { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
       ])
-      // First call resolves the actions array (Promise.all maps in order).
       .mockResolvedValueOnce([
-        { _kind: 'action', _exportName: 'verifyToken', id: 'verify-token', visibility: 'workspace', idempotent: false },
-        { _kind: 'action', _exportName: 'provisionTenant', id: 'provision-tenant', visibility: 'domain', idempotent: true },
+        {
+          _kind: 'action',
+          _exportName: 'chargeCard',
+          id: 'charge-card',
+          backendAccess: 'domain',
+          exposure: { type: 'internal' },
+          idempotent: true,
+          input: { type: 'object', properties: { amount: { type: 'number' } } },
+          output: { type: 'object', properties: { id: { type: 'string' } } },
+        },
       ]);
 
     const { registry } = await buildRegistry(DOMAIN_ROOT);
 
-    expect(registry.actions).toHaveLength(2);
-    const verify = registry.actions.find(a => a.id === 'verify-token');
-    const provision = registry.actions.find(a => a.id === 'provision-tenant');
-    expect(verify?.backendAccess).toBe('domain');
-    expect(verify?.exposure).toEqual({ type: 'internal' });
-    expect(provision?.backendAccess).toBe('domain');
-    expect(provision?.exposure).toEqual({ type: 'internal' });
+    expect(registry.actions[0]?.inputSchema).toEqual({ type: 'object', properties: { amount: { type: 'number' } } });
+    expect(registry.actions[0]?.outputSchema).toEqual({ type: 'object', properties: { id: { type: 'string' } } });
   });
 
-  it('defaults missing exposure to { type: internal } for legacy actions', async () => {
+  it('throws on missing exposure (no legacy default) (#5090)', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
       webhooks: [],
@@ -144,21 +145,45 @@ describe('buildRegistry action mapping (action-first migration)', () => {
         { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
       ])
       .mockResolvedValueOnce([
-        { _kind: 'action', _exportName: 'legacy', id: 'legacy', visibility: 'private', idempotent: false },
+        { _kind: 'action', _exportName: 'legacy', id: 'legacy', backendAccess: 'private', idempotent: false },
       ]);
 
-    const { registry } = await buildRegistry(DOMAIN_ROOT);
+    await expect(buildRegistry(DOMAIN_ROOT)).rejects.toThrow(/exposure/i);
+  });
 
-    expect(registry.actions[0]?.exposure).toEqual({ type: 'internal' });
-    expect(registry.actions[0]?.backendAccess).toBe('private');
+  it('throws on missing backendAccess (no legacy visibility fallback) (#5090)', async () => {
+    mockWalkDomainDir.mockResolvedValue({
+      domain: '/fake/domains/billing/domain.config.ts',
+      webhooks: [],
+      subscribers: [],
+      actions: ['/fake/domains/billing/actions/no-backend.ts'],
+      schedules: [],
+      jobs: [],
+      integrations: [],
+      publishes: undefined,
+    });
+    mockLoadModuleExports
+      .mockResolvedValueOnce([
+        { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
+      ])
+      .mockResolvedValueOnce([
+        {
+          _kind: 'action', _exportName: 'noBackend',
+          id: 'no-backend',
+          exposure: { type: 'internal' },
+          idempotent: false,
+        },
+      ]);
+
+    await expect(buildRegistry(DOMAIN_ROOT)).rejects.toThrow(/backendAccess/i);
   });
 
-  it('preserves inputSchema and outputSchema extraction', async () => {
+  it('rejects internal exposure with extra keys (#5090)', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
       webhooks: [],
       subscribers: [],
-      actions: ['/fake/domains/billing/actions/charge-card.ts'],
+      actions: ['/fake/domains/billing/actions/internal-extra.ts'],
       schedules: [],
       jobs: [],
       integrations: [],
@@ -170,34 +195,59 @@ describe('buildRegistry action mapping (action-first migration)', () => {
       ])
       .mockResolvedValueOnce([
         {
-          _kind: 'action',
-          _exportName: 'chargeCard',
-          id: 'charge-card',
-          backendAccess: 'domain',
+          _kind: 'action', _exportName: 'internalExtra',
+          id: 'internal-extra', backendAccess: 'private',
+          exposure: { type: 'internal', path: '/v1/secret' },
+          idempotent: false,
+        },
+      ]);
+
+    await expect(buildRegistry(DOMAIN_ROOT)).rejects.toThrow(/unexpected keys/i);
+  });
+
+  it('accepts a clean internal action with all required fields (#5090)', async () => {
+    mockWalkDomainDir.mockResolvedValue({
+      domain: '/fake/domains/billing/domain.config.ts',
+      webhooks: [],
+      subscribers: [],
+      actions: ['/fake/domains/billing/actions/clean.ts'],
+      schedules: [],
+      jobs: [],
+      integrations: [],
+      publishes: undefined,
+    });
+    mockLoadModuleExports
+      .mockResolvedValueOnce([
+        { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
+      ])
+      .mockResolvedValueOnce([
+        {
+          _kind: 'action', _exportName: 'clean',
+          id: 'clean', backendAccess: 'private',
           exposure: { type: 'internal' },
-          idempotent: true,
-          input: { type: 'object', properties: { amount: { type: 'number' } } },
-          output: { type: 'object', properties: { id: { type: 'string' } } },
+          idempotent: false,
         },
       ]);
 
     const { registry } = await buildRegistry(DOMAIN_ROOT);
-
-    expect(registry.actions[0]?.inputSchema).toEqual({ type: 'object', properties: { amount: { type: 'number' } } });
-    expect(registry.actions[0]?.outputSchema).toEqual({ type: 'object', properties: { id: { type: 'string' } } });
+    expect(registry.actions).toHaveLength(1);
+    expect(registry.actions[0]!.exposure).toEqual({ type: 'internal' });
   });
 });
 
 /**
- * Action-first security validation rules (#4619, Wave 6 Task 6.1).
+ * Action-first security validation rules (#4619, Wave 6 Task 6.1, #5090).
  *
- * These tests exercise the new validation gates added to `runValidate`.
+ * These tests exercise the validation gates added to `runValidate`.
  * Each test mocks `buildRegistry` consumers so the assertions target the
  * rule codes (`ACTION_EXPOSURE_REQUIRED`, `TENANT_API_PATH_REQUIRED`,
  * `AUTH_NONE_REQUIRES_EXCEPTION`, etc.) without needing a real
  * domain on disk.
+ *
+ * Issue #5090 — strict contract: missing exposure now fails build,
+ * and API-exposed actions require input/output schemas.
  */
-describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
+describe('runValidate action-first security rules (#4619 / #5090)', () => {
   const DOMAIN_ROOT = '/fake/domains/billing';
 
   beforeEach(() => {
@@ -225,14 +275,6 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
       integrations: [],
       publishes: undefined,
     });
-    // Mock consumption order inside buildRegistry:
-    //   1. domain (paths.domain)        -> mock #1
-    //   2. webhooks/subscribers/schedules/jobs/integrations -> empty arrays, no calls
-    //   3. actions files (paths.actions)-> mock #N (if any)
-    //   4. publishes (paths.publishes)  -> undefined, no call
-    // Each non-empty slot consumes exactly one mock per file (we
-    // generate one synthetic file path per item so the slot has length
-    // equal to the supplied arrays).
     mockLoadModuleExports.mockResolvedValueOnce([
       { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
     ]);
@@ -244,20 +286,31 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     return { errors: result.errors, warnings: result.warnings, valid: result.valid };
   }
 
-  it('ACTION_EXPOSURE_REQUIRED — fires when a non-private action omits exposure', async () => {
-    const { errors } = await runValidateWith({
-      actions: [
-        // `backendAccess: 'platform'` is the strongest "new-style" signal;
-        // omitting `exposure` should now fail the build.
-        {
-          _kind: 'action', _exportName: 'sysReset',
-          id: 'sys-reset', backendAccess: 'platform', idempotent: false,
-        },
-      ],
+  it('ACTION_EXPOSURE_REQUIRED — buildRegistry throws when an action has no exposure (#5090)', async () => {
+    // buildRegistry now throws on missing exposure — no more legacy default.
+    // This test verifies that the build fails fast instead of silently
+    // defaulting to internal exposure.
+    mockWalkDomainDir.mockResolvedValue({
+      domain: '/fake/domains/billing/domain.config.ts',
+      webhooks: [],
+      subscribers: [],
+      actions: ['/fake/domains/billing/actions/x.ts'],
+      schedules: [],
+      jobs: [],
+      integrations: [],
+      publishes: undefined,
     });
-    const rule = errors.find(e => e.code === 'ACTION_EXPOSURE_REQUIRED');
-    expect(rule).toBeDefined();
-    expect(rule?.message).toContain("'sys-reset'");
+    mockLoadModuleExports.mockResolvedValueOnce([
+      { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
+    ]);
+    mockLoadModuleExports.mockResolvedValueOnce([
+      {
+        _kind: 'action', _exportName: 'sysReset',
+        id: 'sys-reset', backendAccess: 'platform', idempotent: false,
+        // exposure omitted — the strict contract rejects this
+      },
+    ]);
+    await expect(runValidate(DOMAIN_ROOT, false)).rejects.toThrow(/exposure/i);
   });
 
   it('ACTION_EXPOSURE_REQUIRED — does NOT fire for explicit internal exposure', async () => {
@@ -274,21 +327,6 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     expect(errors.find(e => e.code === 'ACTION_EXPOSURE_REQUIRED')).toBeUndefined();
   });
 
-  it('ACTION_EXPOSURE_REQUIRED — silent on legacy private action (migration compatibility)', async () => {
-    // Legacy `visibility: 'private'` actions map to `backendAccess: 'private'`
-    // and default `exposure` to `{ type: 'internal' }`. The rule must not
-    // flag these so the migration window stays unblocked.
-    const { errors } = await runValidateWith({
-      actions: [
-        {
-          _kind: 'action', _exportName: 'legacyPrivate',
-          id: 'legacy-private', visibility: 'private', idempotent: false,
-        },
-      ],
-    });
-    expect(errors.find(e => e.code === 'ACTION_EXPOSURE_REQUIRED')).toBeUndefined();
-  });
-
   it('TENANT_API_PATH_REQUIRED — fires when tenancy is required but path lacks tenant placeholder', async () => {
     const { errors } = await runValidateWith({
       actions: [
@@ -326,26 +364,33 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     expect(errors.find(e => e.code === 'TENANT_API_PATH_REQUIRED')).toBeUndefined();
   });
 
-  it('API_EXPOSURE_AUTH_REQUIRED — fires when auth was defaulted (not declared in source)', async () => {
-    // Source did NOT include `auth` — the builder will default to
-    // 'required' and the validator must surface the omission.
-    const { errors } = await runValidateWith({
-      actions: [
-        {
-          _kind: 'action', _exportName: 'listUsers',
-          id: 'list-users', backendAccess: 'domain',
-          exposure: {
-            type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET',
-            tenancy: 'required',
-            // auth omitted on purpose
-          },
-          idempotent: false,
-        },
-      ],
+  it('API_EXPOSURE_AUTH_REQUIRED — buildRegistry throws when API action has no auth (#5090)', async () => {
+    mockWalkDomainDir.mockResolvedValue({
+      domain: '/fake/domains/billing/domain.config.ts',
+      webhooks: [],
+      subscribers: [],
+      actions: ['/fake/domains/billing/actions/x.ts'],
+      schedules: [],
+      jobs: [],
+      integrations: [],
+      publishes: undefined,
     });
-    const rule = errors.find(e => e.code === 'API_EXPOSURE_AUTH_REQUIRED');
-    expect(rule).toBeDefined();
-    expect(rule?.message).toContain("'list-users'");
+    mockLoadModuleExports.mockResolvedValueOnce([
+      { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
+    ]);
+    mockLoadModuleExports.mockResolvedValueOnce([
+      {
+        _kind: 'action', _exportName: 'listUsers',
+        id: 'list-users', backendAccess: 'domain',
+        exposure: {
+          type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET',
+          tenancy: 'required',
+          // auth omitted — buildRegistry now throws
+        },
+        idempotent: false,
+      },
+    ]);
+    await expect(runValidate(DOMAIN_ROOT, false)).rejects.toThrow(/auth/i);
   });
 
   it('API_EXPOSURE_AUTH_REQUIRED — silent when auth is explicitly declared', async () => {
@@ -393,7 +438,7 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
           exposure: {
             type: 'api', path: '/v1/health', method: 'GET',
             auth: 'none', tenancy: 'none',
-            securityException: { reason: 'public liveness probe; no PII; ticket OPS-123' },
+            securityException: { reason: 'public liveness probe; ticket OPS-123' },
           },
           idempotent: false,
         },
@@ -493,7 +538,44 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     expect(errors.find(e => e.code === 'SYSTEM_API_REQUIRES_ROLE')).toBeUndefined();
   });
 
-  it('combined: well-formed api action passes every rule', async () => {
+  it('API_INPUT_SCHEMA_REQUIRED — fires when API action has no inputSchema', async () => {
+    const { errors } = await runValidateWith({
+      actions: [
+        {
+          _kind: 'action', _exportName: 'listUsers',
+          id: 'list-users', backendAccess: 'domain',
+          exposure: {
+            type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET',
+            auth: 'required', tenancy: 'required',
+          },
+          idempotent: false,
+          // no input/output schema
+        },
+      ],
+    });
+    expect(errors.some(e => e.code === 'API_INPUT_SCHEMA_REQUIRED')).toBe(true);
+  });
+
+  it('API_OUTPUT_SCHEMA_REQUIRED — fires when API action has no outputSchema', async () => {
+    const { errors } = await runValidateWith({
+      actions: [
+        {
+          _kind: 'action', _exportName: 'listUsers',
+          id: 'list-users', backendAccess: 'domain',
+          exposure: {
+            type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET',
+            auth: 'required', tenancy: 'required',
+          },
+          idempotent: false,
+          input: { type: 'object', properties: {} },
+          // no output schema
+        },
+      ],
+    });
+    expect(errors.some(e => e.code === 'API_OUTPUT_SCHEMA_REQUIRED')).toBe(true);
+  });
+
+  it('combined: well-formed api action with input/output schemas passes every rule', async () => {
     const { errors } = await runValidateWith({
       actions: [
         {
@@ -505,6 +587,8 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
             roles: ['billing-admin'],
           },
           idempotent: true,
+          input: { type: 'object', properties: { amount: { type: 'number' } } },
+          output: { type: 'object', properties: { id: { type: 'string' } } },
         },
       ],
     });
@@ -512,28 +596,19 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
       'ACTION_EXPOSURE_REQUIRED', 'API_EXPOSURE_AUTH_REQUIRED',
       'TENANT_API_PATH_REQUIRED', 'AUTH_NONE_REQUIRES_EXCEPTION',
       'TENANCY_NONE_REQUIRES_REASON_WHEN_PUBLIC', 'SYSTEM_API_REQUIRES_ROLE',
+      'API_INPUT_SCHEMA_REQUIRED', 'API_OUTPUT_SCHEMA_REQUIRED',
     ];
     const firedSecurityRules = errors.filter(e => securityCodes.includes(e.code));
     expect(firedSecurityRules).toHaveLength(0);
-    // Non-security rules (e.g. MISSING_HANDLER_FILE on the synthetic
-    // mock file path) may legitimately fire; we only assert that the
-    // Wave 6 security gates are clean.
   });
 });
 
 /**
  * Deployment-time security rules (#4662 Task D, #4689).
  *
- * These mirror the CDK aspect's synth-time checks so CI can gate the
- * build BEFORE synth is attempted. Each rule emits a structured
- * `ValidationError` whose `code` matches the aspect annotation code,
- * making the two layers correlatable.
- *
  * Issue #4689: defineApi and registry.apis were removed. The action-first
  * `TENANT_API_PATH_REQUIRED` rule in the `#4619 / Wave 6` suite now owns
- * the placeholder invariant. The deployment-time rules below assert that
- * no duplicate `SECURITY_MISSING_TENANT_PATH` codes are emitted for the
- * action surface.
+ * the placeholder invariant.
  */
 describe('runValidate deployment-time security rules (#4662 Task D)', () => {
   const DOMAIN_ROOT = '/fake/domains/billing';