@oceanum/oceanumlab 4.6.1 → 4.7.0

package/src/__tests__/DatameshWidget.spec.tsx

@@ -0,0 +1,380 @@
+/**
+ * The sidebar against a fake host and a fake backend: whether the Oceanum AI
+ * chat appears, what the capabilities request is signed with, and -- above all
+ * -- that watching for a sign-in runs no commands.
+ *
+ * Every `CommandRegistry.execute` emits `commandExecuted`, and JupyterLab's
+ * modal command palette closes itself on any of those. So the sidebar reads
+ * `isVisible`/`isEnabled` and listens for `commandChanged`, and only asks for
+ * the token when a request needs one.
+ */
+import { ModalCommandPalette } from '@jupyterlab/apputils';
+import { addIcon } from '@jupyterlab/ui-components';
+import { CommandRegistry } from '@lumino/commands';
+import { CommandPalette, Widget } from '@lumino/widgets';
+
+import {
+  ACCESS_TOKEN_COMMAND,
+  SIGN_IN_COMMAND,
+  SIGN_OUT_COMMAND
+} from '../aiBackend';
+import { DatameshConnectWidget } from '../DatameshWidget';
+import { Signal } from '@lumino/signaling';
+
+interface IRequest {
+  url: string;
+  headers: Record<string, string>;
+}
+
+let requests: IRequest[];
+let widget: DatameshConnectWidget | null;
+let palette: ModalCommandPalette | null;
+const settingsChanged = new Signal<unknown, void>({});
+
+beforeAll(() => {
+  // The chat scrolls to its last message; jsdom has no scrollIntoView, and
+  // the error would come back as React unmounting the sidebar.
+  (Element.prototype as any).scrollIntoView = (): void => undefined;
+});
+
+beforeEach(() => {
+  requests = [];
+  window.datameshToken = undefined as unknown as string;
+  (globalThis as any).fetch = jest.fn(
+    async (url: string, init: { headers: Record<string, string> }) => {
+      requests.push({ url, headers: init.headers });
+      return { ok: true, json: async () => ({ code: true }) };
+    }
+  );
+});
+
+afterEach(() => {
+  if (widget) {
+    Widget.detach(widget);
+    widget.dispose();
+    widget = null;
+  }
+  if (palette) {
+    palette.dispose();
+    palette = null;
+  }
+});
+
+interface IHost {
+  commands: CommandRegistry;
+  signIn: jest.Mock;
+  accessToken: jest.Mock;
+  /** Every command the registry reported as executed, in order. */
+  executed: string[];
+  setSignedIn: (signedIn: boolean) => void;
+  setToken: (token: string | null) => void;
+}
+
+/**
+ * A host like Oceanum Notebook: an access-token command, a sign-in command
+ * enabled where the site has sign-in, and a sign-out command visible only
+ * while signed in. `auth: false` is plain JupyterLab, which has none of them.
+ */
+function host({
+  auth = true,
+  signInEnabled = true,
+  signedIn = false,
+  signInRejects = false
+} = {}): IHost {
+  const state = { signedIn, token: 'a-jwt' as string | null };
+  const commands = new CommandRegistry();
+  const executed: string[] = [];
+  commands.commandExecuted.connect((_, args) => executed.push(args.id));
+  const signIn = jest.fn(() =>
+    signInRejects
+      ? Promise.reject(new Error('the sign-in window was blocked'))
+      : undefined
+  );
+  const accessToken = jest.fn(() => (state.signedIn ? state.token : null));
+  if (auth) {
+    commands.addCommand(ACCESS_TOKEN_COMMAND, {
+      execute: () => accessToken() as any
+    });
+    commands.addCommand(SIGN_IN_COMMAND, {
+      execute: signIn,
+      isEnabled: () => signInEnabled
+    });
+    commands.addCommand(SIGN_OUT_COMMAND, {
+      execute: () => undefined,
+      isVisible: () => state.signedIn
+    });
+  }
+  return {
+    commands,
+    signIn,
+    accessToken,
+    executed,
+    setSignedIn: (value: boolean) => {
+      state.signedIn = value;
+      // What the host does on every sign-in and sign-out.
+      commands.notifyCommandChanged();
+    },
+    setToken: (token: string | null) => {
+      state.token = token;
+    }
+  };
+}
+
+function mount(
+  commands: CommandRegistry,
+  { backend = '', pasted = '' } = {}
+): HTMLElement {
+  widget = new DatameshConnectWidget({
+    app: {} as any,
+    name: 'Datamesh Connect',
+    icon: addIcon,
+    openDatameshUI: (): void => undefined,
+    datameshUiUrl: () => '',
+    datameshUiFrame: () => null,
+    datameshToken: () => pasted,
+    aiBackendUrl: () => backend,
+    settingsChanged,
+    commands,
+    getCurrentWidget: () => null as unknown as Widget
+  });
+  Widget.attach(widget, document.body);
+  widget.update();
+  return widget.node;
+}
+
+/** JupyterLab's modal command palette, open with something typed in it. */
+function openPalette(commands: CommandRegistry): ModalCommandPalette {
+  palette = new ModalCommandPalette({
+    commandPalette: new CommandPalette({ commands })
+  });
+  palette.attach();
+  palette.palette.inputNode.value = 'notebook';
+  palette.show();
+  return palette;
+}
+
+/** Waits for `check` to pass: the sidebar renders asynchronously. */
+async function until(check: () => void, timeout = 4000): Promise<void> {
+  const end = Date.now() + timeout;
+  for (;;) {
+    try {
+      check();
+      return;
+    } catch (err) {
+      if (Date.now() > end) {
+        throw err;
+      }
+    }
+    await new Promise(resolve => setTimeout(resolve, 50));
+  }
+}
+
+const settle = (ms = 150): Promise<void> =>
+  new Promise(resolve => setTimeout(resolve, ms));
+
+const chat = (node: HTMLElement) => node.querySelector('.oceanum-ai-chat');
+const notice = (node: HTMLElement) =>
+  node.querySelector('.oceanum-token-config')?.textContent ?? null;
+
+describe('DatameshConnectWidget: Oceanum AI with the host sign-in', () => {
+  it('asks to sign in, then shows the chat once signed in, and hides it on sign-out', async () => {
+    const oceanum = host();
+    const node = mount(oceanum.commands, {
+      backend: 'https://ai.example.test/'
+    });
+
+    await until(() =>
+      expect(notice(node)).toBe(
+        'Sign in to Oceanum.io to use Oceanum AI, or set a Datamesh token.'
+      )
+    );
+    expect(chat(node)).toBeNull();
+    expect(requests).toEqual([]);
+    // Signed out, nothing was run: not even to find out there is no token.
+    expect(oceanum.executed).toEqual([]);
+
+    (node.querySelector('.oceanum-token-config a') as HTMLElement).click();
+    expect(oceanum.signIn).toHaveBeenCalled();
+
+    oceanum.setSignedIn(true);
+    await until(() => expect(chat(node)).not.toBeNull());
+    expect(notice(node)).toBeNull();
+    expect(requests).toEqual([
+      {
+        url: 'https://ai.example.test/api/capabilities',
+        headers: { Authorization: 'Bearer a-jwt' }
+      }
+    ]);
+    // One token request for the capabilities, however many components watch.
+    expect(oceanum.accessToken).toHaveBeenCalledTimes(1);
+
+    oceanum.setSignedIn(false);
+    await until(() => expect(chat(node)).toBeNull());
+    expect(notice(node)).toContain('Sign in to Oceanum.io');
+    expect(requests).toHaveLength(1);
+    // The sign-in token never becomes the pasted one.
+    expect(window.datameshToken).toBeUndefined();
+  }, 15000);
+
+  it('runs no command while it watches, so the command palette stays open', async () => {
+    // The regression this test exists for: a one-second poll that executed the
+    // access-token command closed the palette within half a second, because
+    // ModalCommandPalette hides itself on any commandExecuted.
+    const oceanum = host();
+    const node = mount(oceanum.commands);
+    await until(() => expect(notice(node)).toContain('Sign in to Oceanum.io'));
+
+    const modal = openPalette(oceanum.commands);
+    expect(modal.isHidden).toBe(false);
+
+    await settle(3000);
+
+    expect(oceanum.executed).toEqual([]);
+    expect(oceanum.accessToken).not.toHaveBeenCalled();
+    expect(modal.isHidden).toBe(false);
+    expect(modal.palette.inputNode.value).toBe('notebook');
+
+    // Signing in is a change, not a poll: it may run the token command once.
+    oceanum.setSignedIn(true);
+    await until(() => expect(chat(node)).not.toBeNull());
+    expect(oceanum.executed).toEqual([ACCESS_TOKEN_COMMAND]);
+
+    await settle(2000);
+    expect(oceanum.executed).toEqual([ACCESS_TOKEN_COMMAND]);
+  }, 20000);
+
+  it('does not ask again when only the sign-in token has refreshed', async () => {
+    const oceanum = host({ signedIn: true });
+    const node = mount(oceanum.commands);
+
+    await until(() => expect(chat(node)).not.toBeNull());
+    expect(requests).toHaveLength(1);
+
+    // The host refreshed the token and told the registry, as it does.
+    oceanum.setToken('refreshed-jwt');
+    oceanum.commands.notifyCommandChanged();
+    await settle(500);
+
+    expect(requests).toHaveLength(1);
+    expect(oceanum.accessToken).toHaveBeenCalledTimes(1);
+  }, 15000);
+
+  it('signs with a pasted token rather than the sign-in, running nothing', async () => {
+    const oceanum = host({ signedIn: true });
+    const node = mount(oceanum.commands, { pasted: 'pasted-token' });
+
+    await until(() => expect(chat(node)).not.toBeNull());
+    expect(requests).toEqual([
+      {
+        url: 'https://ai.oceanum.io/api/capabilities',
+        headers: { 'X-Datamesh-Token': 'pasted-token' }
+      }
+    ]);
+    expect(oceanum.executed).toEqual([]);
+  });
+
+  it('uses the sign-in once the pasted token is cleared, as a chat request does', async () => {
+    // window.datameshToken keeps a token after the setting is cleared, until
+    // reload. Signing the capabilities with it would disagree with the chat
+    // requests, which read the setting -- and an expired one would hide the
+    // chat from a user who is signed in.
+    window.datameshToken = 'cleared-token';
+    const oceanum = host({ signedIn: true });
+    const node = mount(oceanum.commands, { pasted: '' });
+
+    await until(() => expect(chat(node)).not.toBeNull());
+    expect(requests).toEqual([
+      {
+        url: 'https://ai.oceanum.io/api/capabilities',
+        headers: { Authorization: 'Bearer a-jwt' }
+      }
+    ]);
+  });
+
+  it('keeps the chat hidden when the capabilities say there is no code', async () => {
+    (globalThis as any).fetch = jest.fn(async () => ({
+      ok: true,
+      json: async () => ({ code: false })
+    }));
+    const oceanum = host({ signedIn: true });
+    const node = mount(oceanum.commands);
+
+    await until(() => expect((globalThis as any).fetch).toHaveBeenCalled());
+    await settle();
+    expect(chat(node)).toBeNull();
+    expect(notice(node)).toBeNull();
+  });
+
+  it('asks for a Datamesh token where the host has no sign-in', async () => {
+    const oceanum = host({ auth: false });
+    const node = mount(oceanum.commands);
+
+    await until(() =>
+      expect(notice(node)).toBe(
+        'Set your Datamesh token to enable Oceanum.io services Get token here'
+      )
+    );
+    expect(chat(node)).toBeNull();
+    expect(requests).toEqual([]);
+  });
+
+  it('asks for a Datamesh token where sign-in is not enabled for the site', async () => {
+    const oceanum = host({ signInEnabled: false });
+    const node = mount(oceanum.commands);
+
+    await until(() =>
+      expect(notice(node)).toBe(
+        'Set your Datamesh token to enable Oceanum.io services Get token here'
+      )
+    );
+    expect(chat(node)).toBeNull();
+  });
+
+  it('says so, rather than failing, when signing in cannot start', async () => {
+    // Node's process, without @types/node in the test tsconfig.
+    const node_ = (globalThis as any).process as {
+      on: (event: string, handler: (reason: unknown) => void) => void;
+      off: (event: string, handler: (reason: unknown) => void) => void;
+    };
+    const rejections: unknown[] = [];
+    const onRejection = (reason: unknown) => rejections.push(reason);
+    node_.on('unhandledRejection', onRejection);
+    const warn = jest
+      .spyOn(console, 'warn')
+      .mockImplementation(() => undefined);
+    const oceanum = host({ signInRejects: true });
+    const node = mount(oceanum.commands);
+
+    try {
+      await until(() =>
+        expect(notice(node)).toContain('Sign in to Oceanum.io')
+      );
+      (node.querySelector('.oceanum-token-config a') as HTMLElement).click();
+      await settle();
+
+      expect(warn).toHaveBeenCalledWith(
+        'Oceanum AI: could not start signing in to Oceanum.io.'
+      );
+      expect(rejections).toEqual([]);
+    } finally {
+      node_.off('unhandledRejection', onRejection);
+      warn.mockRestore();
+    }
+  });
+
+  it('stops watching once it is disposed', async () => {
+    const oceanum = host();
+    const node = mount(oceanum.commands);
+    await until(() => expect(notice(node)).toContain('Sign in to Oceanum.io'));
+
+    Widget.detach(widget!);
+    widget!.dispose();
+    widget = null;
+
+    oceanum.setSignedIn(true);
+    await settle(500);
+
+    expect(oceanum.executed).toEqual([]);
+    expect(requests).toEqual([]);
+  });
+});

package/src/__tests__/aiBackend.spec.ts

@@ -0,0 +1,272 @@
+import schema from '../../schema/datamesh-connect.json';
+import {
+  ACCESS_TOKEN_COMMAND,
+  SIGN_IN_COMMAND,
+  SIGN_OUT_COMMAND,
+  aiBackendUrl,
+  aiCredentialSource,
+  canSignIn,
+  isSignedIn,
+  resolveAiCredential,
+  signInToken,
+  type AuthCommands
+} from '../aiBackend';
+import { OCEANUM_AI_BACKEND_URL } from '../constants';
+import { validHttpUrl } from '../httpUrl';
+
+describe('aiBackendUrl', () => {
+  it('is the default the settings schema offers', () => {
+    expect(schema.properties.aiBackendUrl.default).toBe(OCEANUM_AI_BACKEND_URL);
+    expect(aiBackendUrl(schema.properties.aiBackendUrl.default)).toBe(
+      'https://ai.oceanum.io'
+    );
+  });
+
+  it.each([
+    ['as it is', 'https://ai.oceanum.tech', 'https://ai.oceanum.tech'],
+    [
+      'without a trailing slash',
+      'https://ai.oceanum.tech/',
+      'https://ai.oceanum.tech'
+    ],
+    ['trimmed', '  https://ai.oceanum.tech/  ', 'https://ai.oceanum.tech'],
+    [
+      'over plain http, with a port',
+      'http://localhost:8000/',
+      'http://localhost:8000'
+    ],
+    [
+      'with a path prefix',
+      'https://example.test/ai//',
+      'https://example.test/ai'
+    ],
+    [
+      'without a query or fragment',
+      'https://ai.oceanum.tech/?x=1#y',
+      'https://ai.oceanum.tech'
+    ]
+  ])('takes an http(s) address %s', (_, value, expected) => {
+    expect(aiBackendUrl(value)).toBe(expected);
+  });
+
+  it.each([
+    ['empty', ''],
+    ['blank', '   '],
+    ['missing', undefined],
+    ['null', null],
+    ['not a URL', 'not a url'],
+    ['a relative path', '/api'],
+    ['a javascript: URL', 'javascript:alert(1)'],
+    ['a file: URL', 'file:///etc/passwd']
+  ])('falls back to the default for %s', (_, value) => {
+    expect(aiBackendUrl(value)).toBe('https://ai.oceanum.io');
+  });
+});
+
+describe('validHttpUrl', () => {
+  it('falls back to the fallback it is given', () => {
+    expect(validHttpUrl('ftp://x', 'https://fallback.test').href).toBe(
+      'https://fallback.test/'
+    );
+  });
+});
+
+describe('resolveAiCredential', () => {
+  const never = jest.fn(async (): Promise<unknown> => 'unused');
+
+  beforeEach(() => never.mockClear());
+
+  it('uses a pasted token, trimmed, without asking for the sign-in', async () => {
+    expect(await resolveAiCredential('  a-token \n', never)).toEqual({
+      source: 'datamesh-token',
+      headers: { 'X-Datamesh-Token': 'a-token' }
+    });
+    expect(never).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ['no', undefined],
+    ['a null', null],
+    ['an empty', ''],
+    ['a blank', ' \t ']
+  ])(
+    'uses the sign-in as a bearer token with %s pasted token',
+    async (_, pasted) => {
+      expect(await resolveAiCredential(pasted, async () => ' a-jwt ')).toEqual({
+        source: 'sign-in',
+        headers: { Authorization: 'Bearer a-jwt' }
+      });
+    }
+  );
+
+  it.each([
+    ['signed out', async (): Promise<unknown> => null],
+    ['an empty token', async (): Promise<unknown> => ''],
+    ['a blank token', async (): Promise<unknown> => '   '],
+    ['a non-string', async (): Promise<unknown> => ({ token: 'a-jwt' })],
+    ['a number', async (): Promise<unknown> => 42],
+    [
+      'a rejection',
+      (): Promise<unknown> => Promise.reject(new Error('sign-in failed'))
+    ],
+    [
+      'a throw',
+      (): Promise<unknown> => {
+        throw new Error('sign-in failed');
+      }
+    ]
+  ])('has no credential without a pasted token and %s', async (_, get) => {
+    expect(await resolveAiCredential('', get)).toBeNull();
+  });
+});
+
+/**
+ * A host registry: `commands` are registered, `enabled`/`visible` say what its
+ * queries answer. Queries must never execute anything.
+ */
+const host = (
+  commands: Record<string, () => unknown>,
+  { enabled = [] as string[], visible = [] as string[] } = {}
+) => ({
+  hasCommand: jest.fn((id: string) => id in commands),
+  execute: jest.fn(async (id: string) => commands[id]()),
+  isEnabled: jest.fn((id: string) => enabled.includes(id)),
+  isVisible: jest.fn((id: string) => visible.includes(id))
+});
+
+const asCommands = (commands: ReturnType<typeof host>): AuthCommands =>
+  commands as unknown as AuthCommands;
+
+describe('canSignIn and isSignedIn', () => {
+  const all = {
+    [ACCESS_TOKEN_COMMAND]: () => 'a-jwt',
+    [SIGN_IN_COMMAND]: (): void => undefined,
+    [SIGN_OUT_COMMAND]: (): void => undefined
+  };
+
+  it('reads the queries, and runs nothing', () => {
+    const commands = host(all, {
+      enabled: [SIGN_IN_COMMAND],
+      visible: [SIGN_OUT_COMMAND]
+    });
+
+    expect(canSignIn(asCommands(commands))).toBe(true);
+    expect(isSignedIn(asCommands(commands))).toBe(true);
+    expect(commands.execute).not.toHaveBeenCalled();
+  });
+
+  it('is signed out while the sign-out command is hidden', () => {
+    const commands = host(all, { enabled: [SIGN_IN_COMMAND] });
+
+    expect(canSignIn(asCommands(commands))).toBe(true);
+    expect(isSignedIn(asCommands(commands))).toBe(false);
+  });
+
+  it('cannot sign in where the site has sign-in disabled', () => {
+    const commands = host(all, { visible: [SIGN_OUT_COMMAND] });
+
+    expect(canSignIn(asCommands(commands))).toBe(false);
+  });
+
+  it('is false where the host has no such commands', () => {
+    const commands = host({});
+
+    expect(canSignIn(asCommands(commands))).toBe(false);
+    expect(isSignedIn(asCommands(commands))).toBe(false);
+    expect(commands.execute).not.toHaveBeenCalled();
+  });
+
+  it('is false when a query throws', () => {
+    const commands = {
+      hasCommand: () => true,
+      execute: jest.fn(),
+      isEnabled: () => {
+        throw new Error('no');
+      },
+      isVisible: () => {
+        throw new Error('no');
+      }
+    } as unknown as AuthCommands;
+
+    expect(canSignIn(commands)).toBe(false);
+    expect(isSignedIn(commands)).toBe(false);
+  });
+});
+
+describe('aiCredentialSource', () => {
+  const signedIn = {
+    enabled: [SIGN_IN_COMMAND],
+    visible: [SIGN_OUT_COMMAND]
+  };
+  const all = {
+    [ACCESS_TOKEN_COMMAND]: () => 'a-jwt',
+    [SIGN_IN_COMMAND]: (): void => undefined,
+    [SIGN_OUT_COMMAND]: (): void => undefined
+  };
+
+  it('is the pasted token when there is one', () => {
+    const commands = host(all, signedIn);
+
+    expect(aiCredentialSource('  a-token ', asCommands(commands))).toBe(
+      'datamesh-token'
+    );
+    expect(commands.execute).not.toHaveBeenCalled();
+  });
+
+  it('is the sign-in while signed in, and nothing once signed out', () => {
+    const commands = host(all, signedIn);
+    expect(aiCredentialSource('', asCommands(commands))).toBe('sign-in');
+    expect(commands.execute).not.toHaveBeenCalled();
+
+    const out = host(all, { enabled: [SIGN_IN_COMMAND] });
+    expect(aiCredentialSource('', asCommands(out))).toBeNull();
+  });
+
+  it('is nothing where the host has no access-token command', () => {
+    const commands = host(
+      { [SIGN_OUT_COMMAND]: (): void => undefined },
+      { visible: [SIGN_OUT_COMMAND] }
+    );
+
+    expect(aiCredentialSource('', asCommands(commands))).toBeNull();
+  });
+
+  it.each([
+    ['blank', '   '],
+    ['missing', undefined],
+    ['not a string', 42]
+  ])('treats a %s pasted token as none', (_, value) => {
+    const commands = host(all, signedIn);
+
+    expect(aiCredentialSource(value, asCommands(commands))).toBe('sign-in');
+  });
+});
+
+describe('signInToken', () => {
+  it('is null, without running anything, when the host has no access-token command', async () => {
+    const commands = host({});
+
+    expect(await signInToken(asCommands(commands))()).toBeNull();
+    expect(commands.execute).not.toHaveBeenCalled();
+  });
+
+  it("is what the host's access-token command answers", async () => {
+    let token: string | null = 'a-jwt';
+    const commands = host({ [ACCESS_TOKEN_COMMAND]: () => token });
+    const get = signInToken(asCommands(commands));
+
+    expect(await get()).toBe('a-jwt');
+    token = null;
+    expect(await get()).toBeNull();
+    expect(commands.execute).toHaveBeenCalledWith(ACCESS_TOKEN_COMMAND);
+  });
+
+  it('checks for the command on every call, so a host registering it late is found', async () => {
+    const commands: Record<string, () => unknown> = {};
+    const get = signInToken(asCommands(host(commands)));
+
+    expect(await get()).toBeNull();
+    commands[ACCESS_TOKEN_COMMAND] = () => 'a-jwt';
+    expect(await get()).toBe('a-jwt');
+  });
+});