@oceanum/oceanumlab 4.6.2 → 4.7.1

package/src/__tests__/chatRouter.spec.ts

@@ -1,9 +1,33 @@
+import type { AuthCommands } from '../aiBackend';
 import { ChatRouter } from '../chatRouter';
 import type { INotebookSnapshot } from '../notebookContext';
 
-const settings = {
-  get: () => ({ composite: 'a-token' })
-} as unknown as ConstructorParameters<typeof ChatRouter>[0];
+/** Settings holding `values`; a key not given has no value. */
+const settingsWith = (values: Record<string, unknown>) =>
+  ({
+    get: (key: string) => ({ composite: values[key] })
+  }) as unknown as ConstructorParameters<typeof ChatRouter>[0];
+
+const settings = settingsWith({ datameshToken: 'a-token' });
+
+/**
+ * A host with these commands, each answering with what its function returns.
+ * `enabled` and `visible` are what the registry's queries answer, which is how
+ * the sign-in state is read without running anything.
+ */
+const hostCommands = (
+  commands: Record<string, () => unknown>,
+  { enabled = [] as string[], visible = [] as string[] } = {}
+) =>
+  ({
+    hasCommand: jest.fn((id: string) => id in commands),
+    execute: jest.fn(async (id: string) => commands[id]()),
+    isEnabled: jest.fn((id: string) => enabled.includes(id)),
+    isVisible: jest.fn((id: string) => visible.includes(id))
+  }) as AuthCommands & { execute: jest.Mock };
+
+/** Plain JupyterLab: no Oceanum.io sign-in to lend. */
+const noSignIn = hostCommands({});
 
 const snapshot = (
   cells: INotebookSnapshot['cells'],
@@ -12,6 +36,7 @@ const snapshot = (
 
 let sent: Record<string, unknown> | undefined;
 let sentHeaders: Record<string, string> | undefined;
+let sentUrl: string | undefined;
 
 interface IRequestInit {
   body: string;
@@ -22,9 +47,10 @@ interface IRequestInit {
 /** Answer every request with what `response` builds from it. */
 function answering(response: (init: IRequestInit) => unknown): void {
   (globalThis as any).fetch = jest.fn(
-    async (_url: string, init: IRequestInit) => {
+    async (url: string, init: IRequestInit) => {
       sent = JSON.parse(init.body);
       sentHeaders = init.headers;
+      sentUrl = url;
       return response(init);
     }
   );
@@ -33,6 +59,7 @@ function answering(response: (init: IRequestInit) => unknown): void {
 beforeEach(() => {
   sent = undefined;
   sentHeaders = undefined;
+  sentUrl = undefined;
   answering(() => ({
     ok: true,
     status: 200,
@@ -82,7 +109,7 @@ function streamed(frames: string[], signal?: AbortSignal, hang = false) {
 
 describe('ChatRouter: the notebook sent with a request', () => {
   it('is the conversation notebook, code and markdown', async () => {
-    const router = new ChatRouter(settings, async () =>
+    const router = new ChatRouter(settings, noSignIn, async () =>
       snapshot([
         { kind: 'code', source: 'x = 1' },
         { kind: 'markdown', source: '## Notes' },
@@ -100,7 +127,7 @@ describe('ChatRouter: the notebook sent with a request', () => {
   });
 
   it('carries the selected cell of that notebook, which a code answer may replace', async () => {
-    const router = new ChatRouter(settings, async () =>
+    const router = new ChatRouter(settings, noSignIn, async () =>
       snapshot([{ kind: 'code', source: 'df.head()' }], {
         source: 'df.head()',
         isCode: true
@@ -115,7 +142,7 @@ describe('ChatRouter: the notebook sent with a request', () => {
 
   it('asks for the notebook on every request, so it follows the conversation', async () => {
     let current = snapshot([{ kind: 'code', source: 'a = 1' }]);
-    const router = new ChatRouter(settings, async () => current);
+    const router = new ChatRouter(settings, noSignIn, async () => current);
 
     await router.route('one');
     expect(sent?.notebookCells).toEqual(['a = 1']);
@@ -126,7 +153,7 @@ describe('ChatRouter: the notebook sent with a request', () => {
   });
 
   it('sends no notebook when there is none', async () => {
-    const router = new ChatRouter(settings, async () => null);
+    const router = new ChatRouter(settings, noSignIn, async () => null);
 
     await router.route('hello');
 
@@ -138,7 +165,7 @@ describe('ChatRouter: the notebook sent with a request', () => {
   it('still sends the question when the notebook cannot be read', async () => {
     // Context is best-effort; a notebook that could not be read must not
     // cost the user the answer.
-    const router = new ChatRouter(settings, async () => {
+    const router = new ChatRouter(settings, noSignIn, async () => {
       throw new Error('could not read');
     });
 
@@ -154,7 +181,7 @@ describe('ChatRouter: the streamed answer', () => {
 
   it('asks for the stream only when someone is listening', async () => {
     // Without a listener the request is byte-identical to what it always was.
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     await router.route('hello');
     expect(sentHeaders?.Accept).toBeUndefined();
@@ -179,7 +206,7 @@ describe('ChatRouter: the streamed answer', () => {
       ])
     );
     const progress: unknown[] = [];
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     const result = await router.route('find waves', [], undefined, p =>
       progress.push(p)
@@ -197,7 +224,7 @@ describe('ChatRouter: the streamed answer', () => {
 
   it('reads JSON when the server answers with JSON anyway', async () => {
     // An older backend, or a proxy that buffered the stream away.
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     const result = await router.route('hello', [], undefined, () => undefined);
 
@@ -216,7 +243,7 @@ describe('ChatRouter: the streamed answer', () => {
         })
       ])
     );
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     await expect(
       router.route('hi', [], undefined, () => undefined)
@@ -230,7 +257,7 @@ describe('ChatRouter: the streamed answer', () => {
   it('fails a stream that ends without its answer', async () => {
     // A dropped connection: a failure, not a shorter answer.
     answering(() => streamed([frame('status', { phase: 'generating' })]));
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     await expect(
       router.route('hi', [], undefined, () => undefined)
@@ -261,7 +288,7 @@ describe('ChatRouter: the streamed answer', () => {
         })
       }
     }));
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     await expect(
       router.route('hi', [], undefined, () => undefined)
@@ -280,7 +307,7 @@ describe('ChatRouter: the streamed answer', () => {
       ])
     );
     const progress: unknown[] = [];
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     const response = await router.observe(
       'hi',
@@ -301,7 +328,7 @@ describe('ChatRouter: the streamed answer', () => {
       streamed([frame('status', { phase: 'generating' })], init.signal, true)
     );
     const progress: unknown[] = [];
-    const router = new ChatRouter(settings, noNotebook);
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
 
     const pending = router.route('hi', [], controller.signal, p =>
       progress.push(p)
@@ -313,3 +340,212 @@ describe('ChatRouter: the streamed answer', () => {
     expect(progress).toEqual([{ phase: 'generating' }]);
   });
 });
+
+describe('ChatRouter: where a request goes, and what it is signed with', () => {
+  const noNotebook = async (): Promise<null> => null;
+  /** Oceanum Notebook with sign-in configured, and someone signed in. */
+  const signedIn = (token: () => unknown) =>
+    hostCommands(
+      {
+        'oceanum-auth:access-token': token,
+        'oceanum-auth:sign-in': () => undefined,
+        'oceanum-auth:sign-out': () => undefined
+      },
+      {
+        enabled: ['oceanum-auth:sign-in'],
+        visible: ['oceanum-auth:sign-out']
+      }
+    );
+
+  it('sends a pasted token as X-Datamesh-Token to the default backend', async () => {
+    const router = new ChatRouter(settings, noSignIn, noNotebook);
+
+    await router.route('hello');
+
+    expect(sentUrl).toBe('https://ai.oceanum.io/api/chat');
+    expect(sentHeaders?.['X-Datamesh-Token']).toBe('a-token');
+    expect(sentHeaders?.Authorization).toBeUndefined();
+  });
+
+  it('prefers a pasted token over the sign-in, without asking for it', async () => {
+    // An explicit token is the user's choice, as it is in the kernel.
+    const host = signedIn(() => 'a-jwt');
+    const router = new ChatRouter(settings, host, noNotebook);
+
+    await router.route('hello');
+
+    expect(sentHeaders?.['X-Datamesh-Token']).toBe('a-token');
+    expect(sentHeaders?.Authorization).toBeUndefined();
+    expect(host.execute).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ['no', undefined],
+    ['an empty', ''],
+    ['a blank', '   ']
+  ])(
+    'uses the sign-in as a bearer token with %s pasted token',
+    async (_, token) => {
+      const router = new ChatRouter(
+        settingsWith({ datameshToken: token }),
+        signedIn(() => 'a-jwt'),
+        noNotebook
+      );
+
+      await router.route('hello');
+
+      expect(sentHeaders?.Authorization).toBe('Bearer a-jwt');
+      expect(sentHeaders?.['X-Datamesh-Token']).toBeUndefined();
+    }
+  );
+
+  it('asks for the sign-in on every request, so a refreshed token is used', async () => {
+    let token = 'first-jwt';
+    const router = new ChatRouter(
+      settingsWith({}),
+      signedIn(() => token),
+      noNotebook
+    );
+
+    await router.route('one');
+    expect(sentHeaders?.Authorization).toBe('Bearer first-jwt');
+
+    token = 'second-jwt';
+    await router.observe('two', [], []);
+    expect(sentHeaders?.Authorization).toBe('Bearer second-jwt');
+  });
+
+  it('sends to the configured address, without a double slash', async () => {
+    const router = new ChatRouter(
+      settings,
+      noSignIn,
+      noNotebook,
+      () => ' https://ai.oceanum.tech/ '
+    );
+
+    await router.route('hello');
+    expect(sentUrl).toBe('https://ai.oceanum.tech/api/chat');
+
+    await router.observe('hello', [], []);
+    expect(sentUrl).toBe('https://ai.oceanum.tech/api/chat/observe');
+  });
+
+  it('sends to the default for an invalid address', async () => {
+    const router = new ChatRouter(
+      settings,
+      noSignIn,
+      noNotebook,
+      () => 'javascript:alert(1)'
+    );
+
+    await router.route('hello');
+
+    expect(sentUrl).toBe('https://ai.oceanum.io/api/chat');
+  });
+
+  it('asks the user to sign in when the host can sign in and nobody has', async () => {
+    const router = new ChatRouter(
+      settingsWith({}),
+      signedIn(() => null),
+      noNotebook
+    );
+
+    await expect(router.route('hello')).rejects.toMatchObject({
+      name: 'ChatRouterError',
+      message: expect.stringContaining('Sign in to Oceanum.io')
+    });
+    expect((globalThis as any).fetch).not.toHaveBeenCalled();
+  });
+
+  it('asks for a Datamesh token when the host has no sign-in', async () => {
+    const router = new ChatRouter(settingsWith({}), noSignIn, noNotebook);
+
+    await expect(router.route('hello')).rejects.toThrow(
+      'Datamesh token not configured. Set your token in Settings → Oceanum.io.'
+    );
+    expect((globalThis as any).fetch).not.toHaveBeenCalled();
+  });
+
+  it('asks for a Datamesh token where the site has sign-in disabled', async () => {
+    // The command is there, but the site has no Oceanum.io environment, so
+    // telling the user to sign in would be telling them to do the impossible.
+    const router = new ChatRouter(
+      settingsWith({}),
+      hostCommands({
+        'oceanum-auth:access-token': () => null,
+        'oceanum-auth:sign-in': () => undefined
+      }),
+      noNotebook
+    );
+
+    await expect(router.route('hello')).rejects.toThrow(
+      'Datamesh token not configured. Set your token in Settings → Oceanum.io.'
+    );
+  });
+
+  it.each([
+    ['rejects', () => Promise.reject(new Error('no'))],
+    ['answers with something other than a string', () => ({ token: 'x' })]
+  ])('counts a sign-in command that %s as signed out', async (_, answer) => {
+    const router = new ChatRouter(
+      settingsWith({}),
+      signedIn(answer),
+      noNotebook
+    );
+
+    await expect(router.route('hello')).rejects.toThrow(
+      'Sign in to Oceanum.io'
+    );
+    expect((globalThis as any).fetch).not.toHaveBeenCalled();
+  });
+
+  it('says the sign-in was refused on a 401 with the sign-in', async () => {
+    answering(() => ({ ok: false, status: 401 }));
+    const router = new ChatRouter(
+      settingsWith({}),
+      signedIn(() => 'a-jwt'),
+      noNotebook
+    );
+
+    await expect(router.route('hello')).rejects.toMatchObject({
+      message:
+        'Your Oceanum.io sign-in was not accepted. Sign in to Oceanum.io again.',
+      statusCode: 401
+    });
+  });
+
+  it('says the token was refused on a 401 with a pasted token', async () => {
+    answering(() => ({ ok: false, status: 401 }));
+
+    await expect(
+      new ChatRouter(settings, noSignIn, noNotebook).route('hello')
+    ).rejects.toMatchObject({
+      message: 'Invalid or expired Datamesh token.',
+      statusCode: 401
+    });
+    // Where the host can sign in, the pasted token is what stands in the way.
+    await expect(
+      new ChatRouter(
+        settings,
+        signedIn(() => 'a-jwt'),
+        noNotebook
+      ).route('hello')
+    ).rejects.toThrow('clear it to use your Oceanum.io sign-in');
+  });
+
+  it('names the configured address when it cannot be reached', async () => {
+    (globalThis as any).fetch = jest.fn(async () => {
+      throw new TypeError('Failed to fetch');
+    });
+    const router = new ChatRouter(
+      settings,
+      noSignIn,
+      noNotebook,
+      () => 'http://localhost:8000/'
+    );
+
+    await expect(router.route('hello')).rejects.toThrow(
+      'Could not reach Oceanum AI backend at http://localhost:8000. Is it running?'
+    );
+  });
+});

package/src/__tests__/datameshUiUrl.spec.ts

@@ -1,4 +1,3 @@
-import schema from '../../schema/datamesh-connect.json';
 import { DATAMESH_UI_SERVICE } from '../constants';
 import {
   datameshUiSrc,
@@ -7,8 +6,10 @@ import {
 } from '../datameshUiUrl';
 
 describe('validDatameshUiUrl', () => {
-  it('is the default the settings schema offers', () => {
-    expect(schema.properties.datameshUiUrl.default).toBe(DATAMESH_UI_SERVICE);
+  it('is production when the deployment names no address', () => {
+    expect(validDatameshUiUrl(undefined).href).toBe(
+      new URL(DATAMESH_UI_SERVICE).href
+    );
   });
 
   it('takes an http(s) address as it is', () => {

package/src/__tests__/pluginArity.spec.ts

@@ -0,0 +1,24 @@
+import plugins from '../index';
+
+/**
+ * JupyterLab passes `requires` then `optional` to `activate`, positionally, after the
+ * application. Omitting a parameter for a dependency you do not use does not skip it —
+ * it shifts every later argument along by one, silently handing the wrong object to the
+ * wrong parameter. TypeScript cannot see this: `activate` is typed loosely enough that
+ * the mismatch compiles, and unit tests that never activate the plugin never notice.
+ *
+ * This bit exactly once: adding an optional IOceanumAuth to a plugin whose signature
+ * had quietly omitted its IStateDB meant `auth` received the state database, and the
+ * panel crashed on `auth.userChanged.connect` at application start.
+ */
+describe('plugin activate signatures', () => {
+  it.each(plugins.map(plugin => [plugin.id, plugin] as const))(
+    '%s takes one parameter per declared dependency',
+    (_id, plugin) => {
+      const declared =
+        (plugin.requires?.length ?? 0) + (plugin.optional?.length ?? 0);
+      // +1 for the JupyterFrontEnd itself.
+      expect(plugin.activate.length).toBe(declared + 1);
+    }
+  );
+});