@mycadet/assistant 0.12.11 → 0.13.0

package/src/runtime/routes/__tests__/migration-cadet-metadata-reconcile.test.ts

@@ -1,227 +0,0 @@
-/**
- * Tests for the post-import cadet metadata reconciliation helper.
- *
- * After every bundle import, `reconcileCadetMetadataFromCes` walks the
- * cadet credentials the gateway requires and, for each one that
- * CES already holds a value for, ensures `metadata.json` lists a
- * matching entry. This closes the race where a provisioning write to
- * CES completes successfully but its metadata upsert gets clobbered by
- * the import's in-place clear or atomic swap. The reconciled set covers
- * the Django-provisioned credentials (assistant_api_key, webhook_secret).
- *
- * We test the reconcile logic in isolation by mocking the secure-keys
- * and metadata-store modules — the real migration handler wires the
- * same imports, so the behavior under test matches production.
- *
- * Covered:
- * - CES has all 6 fields + metadata empty → all 6 upserted.
- * - CES has all 6 + metadata has 2 → only the missing 4 upserted.
- * - CES has no values → nothing upserted.
- * - CES has values + metadata already has them → no-op (no duplicate
- *   upserts).
- * - upsert throws for one field → warning recorded, loop continues.
- */
-
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
-
-import { credentialKey } from "../../../security/credential-key.js";
-import * as actualMetadataStore from "../../../tools/credentials/metadata-store.js";
-
-type MetadataRecord = {
-  credentialId: string;
-  service: string;
-  field: string;
-  allowedTools: string[];
-  allowedDomains: string[];
-  createdAt: number;
-  updatedAt: number;
-};
-
-const CADET_FIELDS = ["assistant_api_key", "webhook_secret"] as const;
-
-const upsertCalls: Array<{ service: string; field: string }> = [];
-let metadataStore: Map<string, MetadataRecord> = new Map();
-let upsertImpl: (service: string, field: string) => void = (service, field) => {
-  const key = `${service}:${field}`;
-  metadataStore.set(key, {
-    credentialId: `id-${key}`,
-    service,
-    field,
-    allowedTools: [],
-    allowedDomains: [],
-    createdAt: Date.now(),
-    updatedAt: Date.now(),
-  });
-};
-
-// The REAL secure-keys module pinned to a live memory backend; the reconcile
-// reads getSecureKeyAsync(cadet credential keys), which the store serves.
-import { useMemorySecureKeyMap } from "../../../__tests__/helpers/secure-keys.js";
-
-const cesValues = useMemorySecureKeyMap();
-
-// Spread the real module so every export the reconcile handler's transitive
-// graph links (e.g. getCredentialMetadataById, listCredentialMetadata pulled in
-// via the plugin-api hub) stays present; only the two functions under test are
-// overridden. A partial mock replaces the whole namespace and fails to link the
-// unlisted exports.
-mock.module("../../../tools/credentials/metadata-store.js", () => ({
-  ...actualMetadataStore,
-  getCredentialMetadata: (service: string, field: string) =>
-    metadataStore.get(`${service}:${field}`),
-  upsertCredentialMetadata: (
-    service: string,
-    field: string,
-    _policy?: unknown,
-  ) => {
-    upsertCalls.push({ service, field });
-    upsertImpl(service, field);
-    return metadataStore.get(`${service}:${field}`);
-  },
-}));
-
-// Import under test AFTER the mocks are set up.
-const { reconcileCadetMetadataFromCes } =
-  (await import("../migration-routes.js")) as unknown as {
-    reconcileCadetMetadataFromCes: (sink: {
-      warnings: string[];
-    }) => Promise<void>;
-  };
-
-beforeEach(() => {
-  upsertCalls.length = 0;
-  metadataStore = new Map();
-  cesValues.clear();
-  upsertImpl = (service, field) => {
-    const key = `${service}:${field}`;
-    metadataStore.set(key, {
-      credentialId: `id-${key}`,
-      service,
-      field,
-      allowedTools: [],
-      allowedDomains: [],
-      createdAt: Date.now(),
-      updatedAt: Date.now(),
-    });
-  };
-});
-
-afterEach(() => {
-  upsertCalls.length = 0;
-});
-
-function seedAllInCes(): void {
-  for (const field of CADET_FIELDS) {
-    cesValues.set(credentialKey("cadet", field), `value-for-${field}`);
-  }
-}
-
-describe("reconcileCadetMetadataFromCes", () => {
-  test("CES holds all fields, metadata empty → all upserted", async () => {
-    seedAllInCes();
-    const sink = { warnings: [] as string[] };
-
-    await reconcileCadetMetadataFromCes(sink);
-
-    expect(upsertCalls).toHaveLength(CADET_FIELDS.length);
-    expect(new Set(upsertCalls.map((c) => c.field))).toEqual(
-      new Set(CADET_FIELDS),
-    );
-    expect(sink.warnings).toHaveLength(0);
-  });
-
-  test("CES holds all, metadata has 2 → only the missing ones upserted", async () => {
-    seedAllInCes();
-    // Pre-populate metadata for 2 of the fields.
-    const prepopulated = ["assistant_api_key", "webhook_secret"] as const;
-    for (const field of prepopulated) {
-      metadataStore.set(`cadet:${field}`, {
-        credentialId: `id-cadet:${field}`,
-        service: "cadet",
-        field,
-        allowedTools: [],
-        allowedDomains: [],
-        createdAt: 1,
-        updatedAt: 1,
-      });
-    }
-
-    const sink = { warnings: [] as string[] };
-    await reconcileCadetMetadataFromCes(sink);
-
-    const expectedMissing = CADET_FIELDS.filter(
-      (f) => !(prepopulated as readonly string[]).includes(f),
-    );
-    expect(upsertCalls).toHaveLength(expectedMissing.length);
-    expect(new Set(upsertCalls.map((c) => c.field))).toEqual(
-      new Set(expectedMissing),
-    );
-  });
-
-  test("covers both Django-provisioned and client-injected identity fields", async () => {
-    seedAllInCes();
-    const sink = { warnings: [] as string[] };
-    await reconcileCadetMetadataFromCes(sink);
-
-    const reconciled = new Set(upsertCalls.map((c) => c.field));
-    // Django-provisioned trio.
-    expect(reconciled).toContain("assistant_api_key");
-    expect(reconciled).toContain("webhook_secret");
-  });
-
-  test("CES empty → nothing upserted", async () => {
-    const sink = { warnings: [] as string[] };
-    await reconcileCadetMetadataFromCes(sink);
-    expect(upsertCalls).toHaveLength(0);
-    expect(sink.warnings).toHaveLength(0);
-  });
-
-  test("CES has values, metadata already has entries → no duplicate upserts", async () => {
-    seedAllInCes();
-    for (const field of CADET_FIELDS) {
-      metadataStore.set(`cadet:${field}`, {
-        credentialId: `id-cadet:${field}`,
-        service: "cadet",
-        field,
-        allowedTools: [],
-        allowedDomains: [],
-        createdAt: 1,
-        updatedAt: 1,
-      });
-    }
-
-    const sink = { warnings: [] as string[] };
-    await reconcileCadetMetadataFromCes(sink);
-
-    expect(upsertCalls).toHaveLength(0);
-  });
-
-  test("upsert throws for one field → warning recorded, loop continues", async () => {
-    seedAllInCes();
-    let calls = 0;
-    upsertImpl = (service, field) => {
-      calls += 1;
-      if (field === "assistant_api_key") {
-        throw new Error("simulated metadata write failure");
-      }
-      const key = `${service}:${field}`;
-      metadataStore.set(key, {
-        credentialId: `id-${key}`,
-        service,
-        field,
-        allowedTools: [],
-        allowedDomains: [],
-        createdAt: Date.now(),
-        updatedAt: Date.now(),
-      });
-    };
-
-    const sink = { warnings: [] as string[] };
-    await reconcileCadetMetadataFromCes(sink);
-
-    // Every field was attempted (loop did not abort).
-    expect(calls).toBe(CADET_FIELDS.length);
-    expect(sink.warnings).toHaveLength(1);
-    expect(sink.warnings[0]).toContain("cadet:assistant_api_key");
-  });
-});

package/src/runtime/routes/__tests__/migration-export-secrets-redacted.test.ts

@@ -1,54 +0,0 @@
-/**
- * Unit tests for `computeSecretsRedacted`.
- *
- * The helper decides whether the v1 manifest may truthfully claim
- * `secrets_redacted: true`. Three signals feed in:
- *   - credentialCount: number of credentials actually included in the bundle.
- *   - storeUnreachable: top-level `listSecureKeysAsync()` failed — we never
- *     enumerated the accounts.
- *   - perAccountUnreachable: enumeration succeeded, but at least one
- *     `getSecureKeyResultAsync(account)` returned `unreachable: true`. Those
- *     accounts were silently skipped from the credentials array, so a zero
- *     count could be hiding real secrets we just couldn't read.
- *
- * Only the all-clear case (zero credentials, both flags false) may return
- * true. Any failure mode forces false — claiming a clean redaction in those
- * cases would lie about what's in the bundle.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import { computeSecretsRedacted } from "../migration-routes.js";
-
-describe("computeSecretsRedacted", () => {
-  test("genuinely empty store + reachable + no per-account failures → true", () => {
-    expect(computeSecretsRedacted(0, false, false)).toBe(true);
-  });
-
-  test("top-level store unreachable → false (couldn't read at all)", () => {
-    expect(computeSecretsRedacted(0, true, false)).toBe(false);
-  });
-
-  test("per-account read failure → false (partial read failure)", () => {
-    expect(computeSecretsRedacted(0, false, true)).toBe(false);
-  });
-
-  test("both top-level and per-account failures → false", () => {
-    expect(computeSecretsRedacted(0, true, true)).toBe(false);
-  });
-
-  test("credentials included + no failures → false (creds in bundle)", () => {
-    expect(computeSecretsRedacted(3, false, false)).toBe(false);
-  });
-
-  test("credentials included + per-account failure → false (creds + partial failure)", () => {
-    expect(computeSecretsRedacted(3, false, true)).toBe(false);
-  });
-
-  test("credentials included + store unreachable → false", () => {
-    // Defensive: in practice `storeUnreachable` implies zero credentials,
-    // but the helper should still behave correctly if a caller passes a
-    // non-zero count alongside an unreachable flag.
-    expect(computeSecretsRedacted(3, true, false)).toBe(false);
-  });
-});

package/src/runtime/routes/__tests__/migration-import-allowed-hosts-env.test.ts

@@ -1,70 +0,0 @@
-/**
- * Tests for the import-only host-allowlist plumbing derived from the
- * platform-injected `CADET_MIGRATION_IMPORT_ALLOWED_HOSTS` env var.
- *
- * Covers:
- * - `parseMigrationImportAllowedHostsEnv`: unset / empty / whitespace-only
- *   values yield `undefined` (strict default); single + comma-separated
- *   lists are parsed, trimmed, and empties dropped.
- * - `resolveImportValidatorOptions`: an explicit test override wins over the
- *   env allowlist; otherwise the env value is used. This resolver is applied
- *   ONLY by the import handlers — the export upload path stays strict — so it
- *   is the seam that keeps the env allowlist from widening export SSRF.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import {
-  parseMigrationImportAllowedHostsEnv,
-  resolveImportValidatorOptions,
-} from "../migration-routes.js";
-
-describe("parseMigrationImportAllowedHostsEnv", () => {
-  test("returns undefined when unset", () => {
-    expect(parseMigrationImportAllowedHostsEnv(undefined)).toBeUndefined();
-  });
-
-  test("returns undefined for an empty string", () => {
-    expect(parseMigrationImportAllowedHostsEnv("")).toBeUndefined();
-  });
-
-  test("returns undefined for whitespace / commas only", () => {
-    expect(parseMigrationImportAllowedHostsEnv("   ")).toBeUndefined();
-    expect(parseMigrationImportAllowedHostsEnv(" , , ")).toBeUndefined();
-  });
-
-  test("parses a single host", () => {
-    expect(parseMigrationImportAllowedHostsEnv("host.docker.internal")).toEqual(
-      { allowedHosts: ["host.docker.internal"] },
-    );
-  });
-
-  test("parses and trims a comma-separated list, dropping empties", () => {
-    expect(
-      parseMigrationImportAllowedHostsEnv(
-        " host.docker.internal , ,localhost ",
-      ),
-    ).toEqual({ allowedHosts: ["host.docker.internal", "localhost"] });
-  });
-});
-
-describe("resolveImportValidatorOptions", () => {
-  test("uses the env allowlist when no test override is set", () => {
-    expect(
-      resolveImportValidatorOptions(undefined, "host.docker.internal"),
-    ).toEqual({ allowedHosts: ["host.docker.internal"] });
-  });
-
-  test("returns undefined (strict) when neither override nor env is set", () => {
-    expect(resolveImportValidatorOptions(undefined, undefined)).toBeUndefined();
-  });
-
-  test("test override takes precedence over the env allowlist", () => {
-    expect(
-      resolveImportValidatorOptions(
-        { allowedHosts: ["override.example"] },
-        "host.docker.internal",
-      ),
-    ).toEqual({ allowedHosts: ["override.example"] });
-  });
-});

package/src/runtime/routes/__tests__/migration-import-credential-filter.test.ts

@@ -1,257 +0,0 @@
-/**
- * Tests for platform credential filtering during bundle import.
- *
- * `migration-routes.ts` pushes every bundle credential through a filter that
- * must exclude cloud-identity (`cadet:*`) entries so they can't overwrite
- * the target's own Django-provisioned identity. The filter runs against the
- * raw CES account format — `credential/{service}/{field}` — produced by
- * `credentialKey()`, which is what `listSecureKeysAsync()` returns and what
- * `extractCredentialsFromBundle` surfaces back as `account`.
- *
- * The constant is duplicated here (rather than imported) because
- * `migration-routes.ts` has heavy transitive imports that are expensive to
- * resolve in a test and would require wide mocking. Instead we bind the two
- * copies with a regression assertion: if `credentialKey()`'s output format
- * changes, the `startsWith(...)` prefix must change in lockstep. That
- * regression is explicit at the bottom of this file.
- *
- * Covered:
- * - Platform (cadet:*) credentials stored under the real `credential/cadet/...`
- *   key format are excluded.
- * - User credentials (any other prefix) pass through unchanged.
- * - Mixed bundles correctly split platform vs user credentials.
- * - skippedCloud count matches the number of excluded entries.
- * - Regression: the prefix constant matches `credentialKey("cadet", "")`.
- */
-
-import { describe, expect, test } from "bun:test";
-
-import { credentialKey } from "../../../security/credential-key.js";
-import { extractCredentialsFromBundle } from "../../migrations/vbundle-importer.js";
-import type {
-  ManifestType,
-  VBundleTarEntry,
-} from "../../migrations/vbundle-validator.js";
-
-// ---------------------------------------------------------------------------
-// The same constant used by migration-routes.ts — kept in sync via the
-// regression assertion at the bottom of this file.
-// ---------------------------------------------------------------------------
-
-const PLATFORM_CREDENTIAL_PREFIX = credentialKey("cadet", "");
-
-// ---------------------------------------------------------------------------
-// Helpers (same pattern as vbundle-import-credentials.test.ts)
-// ---------------------------------------------------------------------------
-
-function makeTarEntry(data: string): VBundleTarEntry {
-  const encoded = new TextEncoder().encode(data);
-  return { name: "", data: encoded, size: encoded.length };
-}
-
-function makeManifest(paths: string[]): ManifestType {
-  return {
-    schema_version: 1,
-    bundle_id: "00000000-0000-4000-8000-000000000000",
-    created_at: new Date().toISOString(),
-    assistant: { id: "self", name: "Test", runtime_version: "0.0.0-test" },
-    origin: { mode: "self-hosted-local" },
-    compatibility: {
-      min_runtime_version: "0.0.0-test",
-      max_runtime_version: null,
-    },
-    contents: paths.map((path) => ({
-      path,
-      size_bytes: 0,
-      sha256: "test",
-    })),
-    checksum:
-      "0000000000000000000000000000000000000000000000000000000000000000",
-    secrets_redacted: false,
-    export_options: {
-      include_logs: false,
-      include_browser_state: false,
-      include_memory_vectors: false,
-    },
-  } as unknown as ManifestType;
-}
-
-/**
- * Build a bundle archive entry path for a credential whose CES account is
- * `account`. `vbundle-builder.ts` stores credentials under
- * `credentials/<account>`; the importer reverses that split.
- */
-function bundlePathFor(account: string): string {
-  return `credentials/${account}`;
-}
-
-/**
- * Simulate the filtering logic from migration-routes.ts:
- *
- *   const userCredentials = bundleCredentials.filter(
- *     (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
- *   );
- */
-function filterCredentials(
-  bundleCredentials: Array<{ account: string; value: string }>,
-) {
-  const userCredentials = bundleCredentials.filter(
-    (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
-  );
-  const skippedCloud = bundleCredentials.length - userCredentials.length;
-  return { userCredentials, skippedCloud };
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("migration import credential filtering", () => {
-  test("platform (cadet:*) credentials are excluded", () => {
-    const cadetFields = [
-      "assistant_api_key",
-      "cloud_assistant_id",
-      "webhook_secret",
-    ] as const;
-    const cadetPaths = cadetFields.map((f) =>
-      bundlePathFor(credentialKey("cadet", f)),
-    );
-
-    const entries = new Map<string, VBundleTarEntry>();
-    for (const path of cadetPaths) {
-      entries.set(path, makeTarEntry(`value-for-${path}`));
-    }
-
-    const manifest = makeManifest(cadetPaths);
-
-    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedCloud } =
-      filterCredentials(bundleCredentials);
-
-    expect(userCredentials).toHaveLength(0);
-    expect(skippedCloud).toBe(cadetFields.length);
-  });
-
-  test("user credentials pass through unchanged", () => {
-    const openaiAccount = credentialKey("openai", "api_key");
-    const anthropicAccount = credentialKey("anthropic", "api_key");
-
-    const entries = new Map<string, VBundleTarEntry>();
-    entries.set(bundlePathFor(openaiAccount), makeTarEntry("sk-user-123"));
-    entries.set(bundlePathFor(anthropicAccount), makeTarEntry("sk-ant-456"));
-
-    const manifest = makeManifest([
-      bundlePathFor(openaiAccount),
-      bundlePathFor(anthropicAccount),
-    ]);
-
-    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedCloud } =
-      filterCredentials(bundleCredentials);
-
-    expect(userCredentials).toHaveLength(2);
-    expect(userCredentials).toContainEqual({
-      account: openaiAccount,
-      value: "sk-user-123",
-    });
-    expect(userCredentials).toContainEqual({
-      account: anthropicAccount,
-      value: "sk-ant-456",
-    });
-    expect(skippedCloud).toBe(0);
-  });
-
-  test("mixed bundle with both platform and user credentials correctly splits", () => {
-    const cadetApiKey = credentialKey("cadet", "assistant_api_key");
-    const cadetUserId = credentialKey("cadet", "cloud_assistant_id");
-    const openaiKey = credentialKey("openai", "api_key");
-    const anthropicKey = credentialKey("anthropic", "api_key");
-    const githubToken = credentialKey("github", "api_token");
-
-    const entries = new Map<string, VBundleTarEntry>();
-    entries.set(bundlePathFor(cadetApiKey), makeTarEntry("platform-key"));
-    entries.set(bundlePathFor(cadetUserId), makeTarEntry("platform-user"));
-    entries.set(bundlePathFor(openaiKey), makeTarEntry("sk-user-123"));
-    entries.set(bundlePathFor(anthropicKey), makeTarEntry("sk-ant-456"));
-    entries.set(bundlePathFor(githubToken), makeTarEntry("ghp-789"));
-
-    const manifest = makeManifest([
-      bundlePathFor(cadetApiKey),
-      bundlePathFor(cadetUserId),
-      bundlePathFor(openaiKey),
-      bundlePathFor(anthropicKey),
-      bundlePathFor(githubToken),
-    ]);
-
-    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedCloud } =
-      filterCredentials(bundleCredentials);
-
-    // Only user credentials should pass through.
-    expect(userCredentials).toHaveLength(3);
-    const accounts = userCredentials.map((c) => c.account).sort();
-    expect(accounts).toEqual([anthropicKey, githubToken, openaiKey].sort());
-
-    // No platform credentials in the filtered output.
-    const cadetCreds = userCredentials.filter((c) =>
-      c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
-    );
-    expect(cadetCreds).toHaveLength(0);
-
-    expect(skippedCloud).toBe(2);
-  });
-
-  test("skippedCloud count is accurate with mixed credentials", () => {
-    const cadetApiKey = credentialKey("cadet", "assistant_api_key");
-    const cadetAssistantId = credentialKey("cadet", "cloud_assistant_id");
-    const cadetWebhook = credentialKey("cadet", "webhook_secret");
-    const userKey = credentialKey("github", "api_token");
-
-    const entries = new Map<string, VBundleTarEntry>();
-    entries.set(bundlePathFor(cadetApiKey), makeTarEntry("v1"));
-    entries.set(bundlePathFor(cadetAssistantId), makeTarEntry("v2"));
-    entries.set(bundlePathFor(cadetWebhook), makeTarEntry("v3"));
-    entries.set(bundlePathFor(userKey), makeTarEntry("user-val"));
-
-    const manifest = makeManifest([
-      bundlePathFor(cadetApiKey),
-      bundlePathFor(cadetAssistantId),
-      bundlePathFor(cadetWebhook),
-      bundlePathFor(userKey),
-    ]);
-
-    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
-    const { userCredentials, skippedCloud } =
-      filterCredentials(bundleCredentials);
-
-    expect(skippedCloud).toBe(3);
-    expect(userCredentials).toHaveLength(1);
-    expect(userCredentials[0]).toEqual({
-      account: userKey,
-      value: "user-val",
-    });
-
-    // Verify total = user + skipped
-    expect(bundleCredentials.length).toBe(
-      userCredentials.length + skippedCloud,
-    );
-  });
-
-  test("regression: the prefix matches credentialKey('cadet', '') so format changes propagate", () => {
-    // If credentialKey()'s format ever changes (e.g. slash → something else),
-    // this assertion will fail and the duplicated constant in
-    // migration-routes.ts must be updated to stay in sync.
-    expect(PLATFORM_CREDENTIAL_PREFIX).toBe("credential/cadet/");
-    expect(
-      credentialKey("cadet", "assistant_api_key").startsWith(
-        PLATFORM_CREDENTIAL_PREFIX,
-      ),
-    ).toBe(true);
-
-    // The raw "cadet:" string is not a valid CES account prefix — only
-    // the full "credential/cadet/" format from credentialKey() is correct.
-    expect(
-      credentialKey("cadet", "assistant_api_key").startsWith("cadet:"),
-    ).toBe(false);
-  });
-});