@nickmeriano/task 0.8.0 → 0.9.0

package/src/git-serve.test.ts

@@ -0,0 +1,240 @@
+/**
+ * The git surface's contract (TAS-42), checked over real HTTP against real
+ * repositories — the properties that must hold before a board UI is allowed
+ * to run git:
+ *
+ * 1. Board commits are pathspec-scoped: with board AND non-board files dirty,
+ *    committing from the API commits exactly the board files.
+ * 2. Checkout is refused while tracked non-board files are dirty — no
+ *    stashing magic, the refusal says why.
+ * 3. The CSRF gate: a cross-origin browser write is 403 before any handler
+ *    runs; the board's own origin and origin-less clients pass.
+ * 4. Degradation: a repo with no origin advertises no `git` capability and
+ *    404s the whole route group — the self-hiding rule the UI builds on.
+ */
+
+import assert from "node:assert/strict"
+import { after, test } from "node:test"
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { spawnSync } from "node:child_process"
+import type { AddressInfo } from "node:net"
+import type { Server } from "node:http"
+import { initProject } from "./file-store.ts"
+import { compareUrl } from "./git-serve.ts"
+import { createTaskServer } from "./server.ts"
+
+function tempDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "task-git-serve-test-"))
+  process.on("exit", () => rmSync(dir, { recursive: true, force: true }))
+  return dir
+}
+
+function sh(cwd: string, command: string, ...args: string[]): string {
+  const result = spawnSync(command, args, { cwd, encoding: "utf8" })
+  if (result.status !== 0) {
+    throw new Error(`${command} ${args.join(" ")} failed: ${result.stderr}`)
+  }
+  return result.stdout.trim()
+}
+
+/** A clone with a board, its origin bare — the shape `task serve` runs in. */
+function repoWithOrigin(): { clone: string; first: string } {
+  const home = tempDir()
+  const bare = join(home, "origin.git")
+  sh(home, "git", "init", "--quiet", "--bare", "-b", "main", bare)
+  const clone = join(home, "clone")
+  sh(home, "git", "clone", "--quiet", bare, clone)
+  sh(clone, "git", "config", "user.name", "Test")
+  sh(clone, "git", "config", "user.email", "test@example.com")
+  const store = initProject(clone, { name: "git board", prefix: "GIT" })
+  const first = store.create({ title: "First", status: "todo" }).key
+  writeFileSync(join(clone, "code.txt"), "original\n")
+  sh(clone, "git", "add", "-A")
+  sh(clone, "git", "commit", "--quiet", "-m", "board")
+  sh(clone, "git", "push", "--quiet", "-u", "origin", "main")
+  return { clone, first }
+}
+
+const servers: Server[] = []
+after(() => {
+  for (const server of servers) server.close()
+})
+
+async function serve(root: string): Promise<string> {
+  const server = createTaskServer(root)
+  servers.push(server)
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve))
+  const { port } = server.address() as AddressInfo
+  return `http://127.0.0.1:${port}`
+}
+
+async function call(
+  base: string,
+  path: string,
+  init?: RequestInit,
+): Promise<{ status: number; body: Record<string, unknown> }> {
+  const res = await fetch(`${base}${path}`, init)
+  return { status: res.status, body: (await res.json()) as Record<string, unknown> }
+}
+
+function post(body: unknown, headers: Record<string, string> = {}): RequestInit {
+  return {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...headers },
+    body: JSON.stringify(body),
+  }
+}
+
+test("board commits are pathspec-scoped: mixed dirty tree, only board files land", async () => {
+  const { clone: repo, first } = repoWithOrigin()
+  const base = await serve(repo)
+
+  // Board dirt: edit a ticket and add a brand-new (untracked) one. Non-board
+  // dirt: a tracked file edited and an untracked scratch file.
+  const status = await call(base, "/api/git/status")
+  assert.equal(status.status, 200)
+  const patch = await call(
+    base,
+    `/api/tasks/${first}`,
+    Object.assign(post({ status: "in_progress" }), { method: "PATCH" }),
+  )
+  assert.equal(patch.status, 200)
+  const created = await call(base, "/api/tasks", post({ title: "Second" }))
+  assert.equal(created.status, 201)
+  const second = (created.body.task as { key: string }).key
+  writeFileSync(join(repo, "code.txt"), "changed\n")
+  writeFileSync(join(repo, "scratch.txt"), "notes\n")
+
+  const before = await call(base, "/api/git/status")
+  const dirty = before.body.dirty as { path: string; ticket: string | null }[]
+  assert.ok(dirty.length >= 2, JSON.stringify(before.body))
+  assert.ok(dirty.every((f) => f.path.startsWith(".task/")))
+  assert.deepEqual(
+    [...new Set(dirty.map((f) => f.ticket))].sort(),
+    [first, second].sort(),
+  )
+  assert.equal(before.body.otherDirty, 1) // code.txt — tracked; scratch.txt is untracked noise
+
+  const commit = await call(base, "/api/git/commit", post({ message: "chore(board): test" }))
+  assert.equal(commit.status, 200, JSON.stringify(commit.body))
+
+  // The commit holds board files only; the tree keeps its non-board dirt.
+  const committed = sh(repo, "git", "show", "--name-only", "--format=", "HEAD")
+    .split("\n")
+    .filter(Boolean)
+  assert.ok(committed.length >= 2)
+  assert.ok(committed.every((f) => f.startsWith(".task/")), committed.join(","))
+  const remaining = sh(repo, "git", "status", "--porcelain")
+  assert.ok(remaining.includes("code.txt"))
+  assert.ok(remaining.includes("scratch.txt"))
+  assert.ok(!remaining.includes(".task/"))
+
+  const after = await call(base, "/api/git/status")
+  assert.deepEqual(after.body.dirty, [])
+  assert.equal(after.body.ahead, 1) // committed, not pushed
+
+  // Nothing left to commit → clean refusal, not an empty commit.
+  const again = await call(base, "/api/git/commit", post({ message: "chore(board): empty" }))
+  assert.equal(again.status, 400)
+  assert.match(String(again.body.error), /nothing to commit/)
+})
+
+test("commit with newBranch cuts the branch first; checkout back is refused while code is dirty", async () => {
+  const { clone: repo, first } = repoWithOrigin()
+  const base = await serve(repo)
+
+  const patch = await call(
+    base,
+    `/api/tasks/${first}`,
+    Object.assign(post({ tags: ["x"] }), { method: "PATCH" }),
+  )
+  assert.equal(patch.status, 200)
+  writeFileSync(join(repo, "code.txt"), "work in flight\n")
+
+  const commit = await call(
+    base,
+    "/api/git/commit",
+    post({ message: "chore(board): branch it", newBranch: "board/test-1", base: "main" }),
+  )
+  assert.equal(commit.status, 200, JSON.stringify(commit.body))
+  assert.equal(commit.body.branch, "board/test-1")
+  assert.equal(sh(repo, "git", "branch", "--show-current"), "board/test-1")
+
+  // code.txt (tracked, dirty, outside every board dir) blocks the switch.
+  const refused = await call(base, "/api/git/checkout", post({ branch: "main" }))
+  assert.equal(refused.status, 409, JSON.stringify(refused.body))
+  assert.match(String(refused.body.error), /code\.txt/)
+  assert.equal(sh(repo, "git", "branch", "--show-current"), "board/test-1")
+
+  // Clean the code file and the same switch goes through.
+  sh(repo, "git", "checkout", "--", "code.txt")
+  const ok = await call(base, "/api/git/checkout", post({ branch: "main" }))
+  assert.equal(ok.status, 200, JSON.stringify(ok.body))
+  assert.equal(sh(repo, "git", "branch", "--show-current"), "main")
+})
+
+test("cross-origin writes are refused before any handler runs", async () => {
+  const { clone: repo } = repoWithOrigin()
+  const base = await serve(repo)
+
+  // A drive-by page POSTing at localhost: Origin names the attacker.
+  const evil = await call(
+    base,
+    "/api/git/commit",
+    post({ message: "pwn" }, { Origin: "http://evil.example" }),
+  )
+  assert.equal(evil.status, 403)
+  // The board's own pages pass — Origin matches the Host it was served from.
+  const own = await call(
+    base,
+    "/api/tasks",
+    post({ title: "From the board" }, { Origin: base }),
+  )
+  assert.equal(own.status, 201)
+  // And so do origin-less clients (curl, scripts) — the local-trust case.
+  const cli = await call(base, "/api/tasks", post({ title: "From a script" }))
+  assert.equal(cli.status, 201)
+  // Reads are uncontested either way.
+  const read = await call(base, "/api/git/status", { headers: { Origin: "http://evil.example" } })
+  assert.equal(read.status, 200)
+})
+
+test("a repo with no origin serves boards but no git surface at all", async () => {
+  const root = tempDir()
+  sh(root, "git", "init", "--quiet", "-b", "main", root)
+  sh(root, "git", "config", "user.name", "Test")
+  sh(root, "git", "config", "user.email", "test@example.com")
+  const store = initProject(root, { name: "loner", prefix: "LON" })
+  store.create({ title: "Only", status: "todo" })
+  const base = await serve(root)
+
+  const project = await call(base, "/api/project")
+  assert.equal(project.status, 200)
+  assert.equal("git" in project.body, false, JSON.stringify(project.body))
+
+  const status = await call(base, "/api/git/status")
+  assert.equal(status.status, 404)
+  const branches = await call(base, "/api/git/branches")
+  assert.equal(branches.status, 404)
+})
+
+test("a plain directory (no git at all) behaves the same", async () => {
+  const root = tempDir()
+  mkdirSync(join(root, "inner"))
+  const store = initProject(join(root, "inner"), { name: "bare", prefix: "BAR" })
+  store.create({ title: "Only", status: "todo" })
+  // Guard against the test machine's own enclosing repo: this only proves
+  // something when the temp dir is genuinely outside one, which tmpdir() is.
+  const base = await serve(join(root, "inner"))
+  const project = await call(base, "/api/project")
+  assert.equal("git" in project.body, false)
+})
+
+test("the gh-less PR fallback is the exact GitHub compare URL, branches escaped", () => {
+  assert.equal(
+    compareUrl({ owner: "nicmeriano", repo: "nickmeriano.com" }, "main", "board/2026-09-01"),
+    "https://github.com/nicmeriano/nickmeriano.com/compare/main...board%2F2026-09-01?expand=1",
+  )
+})