@oceanum/oceanumlab 4.7.0 → 4.7.1

package/src/__tests__/Tabs.spec.tsx

@@ -0,0 +1,168 @@
+import { ReactWidget } from '@jupyterlab/ui-components';
+import { Widget } from '@lumino/widgets';
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import React from 'react';
+
+import { ITab, Tabs } from '../Tabs';
+
+/** A widget whose sole job is to render the tab strip so the DOM can be inspected. */
+class Harness extends ReactWidget {
+  selected = 'one';
+  readonly selections: string[] = [];
+
+  constructor(private readonly _tabs: ITab[]) {
+    super();
+  }
+
+  render(): React.ReactElement {
+    return (
+      <Tabs
+        tabs={this._tabs}
+        selected={this.selected}
+        onSelect={id => {
+          this.selections.push(id);
+          this.selected = id;
+          this.update();
+        }}
+      />
+    );
+  }
+}
+
+const TABS: ITab[] = [
+  { id: 'one', label: 'One', render: () => <p>first pane</p> },
+  { id: 'two', label: 'Two', render: () => <p>second pane</p> },
+  { id: 'three', label: 'Three', render: () => <p>third pane</p> }
+];
+
+async function mount(): Promise<Harness> {
+  const widget = new Harness(TABS);
+  Widget.attach(widget, document.body);
+  // ReactWidget renders on an animation frame, so wait for the first pane rather than
+  // sleeping a fixed 50ms and hoping. That wait was enough on a warm run and not on a cold
+  // one: the first run after a fresh install, with an empty ts-jest cache, rendered nothing
+  // in time and every test here failed at once with zero panes -- which reads like a broken
+  // component rather than a slow one.
+  const deadline = Date.now() + 4000;
+  for (;;) {
+    if (widget.node.querySelector('[role="tabpanel"]')) {
+      return widget;
+    }
+    if (Date.now() > deadline) {
+      throw new Error('Tabs rendered no panes within 4s');
+    }
+    await new Promise(resolve => setTimeout(resolve, 25));
+  }
+}
+
+function strip(widget: Harness): HTMLElement[] {
+  return Array.from(widget.node.querySelectorAll<HTMLElement>('[role="tab"]'));
+}
+
+function panels(widget: Harness): HTMLElement[] {
+  return Array.from(
+    widget.node.querySelectorAll<HTMLElement>('[role="tabpanel"]')
+  );
+}
+
+describe('Tabs', () => {
+  it('marks only the selected tab, and puts only it in the tab order', async () => {
+    const widget = await mount();
+    const tabs = strip(widget);
+
+    expect(tabs.map(t => t.textContent)).toEqual(['One', 'Two', 'Three']);
+    expect(tabs.map(t => t.getAttribute('aria-selected'))).toEqual([
+      'true',
+      'false',
+      'false'
+    ]);
+    // A single tab stop for the strip: Tab moves past it, arrows move within it.
+    expect(tabs.map(t => t.tabIndex)).toEqual([0, -1, -1]);
+
+    widget.dispose();
+  });
+
+  it('keeps every pane mounted and hides the inactive ones', async () => {
+    // Unmounting would discard the AI conversation whenever the user switches away.
+    const widget = await mount();
+    const rendered = panels(widget);
+
+    expect(rendered).toHaveLength(3);
+    expect(rendered.map(p => p.hidden)).toEqual([false, true, true]);
+    expect(widget.node.textContent).toContain('second pane');
+
+    widget.dispose();
+  });
+
+  it('the stylesheet actually hides them', async () => {
+    // `hidden` is only a hint: an author `display` on .oceanum-tabpanel overrides the
+    // user agent's `[hidden] { display: none }`, and asserting the IDL property above
+    // cannot see that. This renders the real stylesheet and asks for the computed value.
+    const css = readFileSync(
+      join(__dirname, '..', '..', 'style', 'index.css'),
+      'utf8'
+    );
+    const style = document.createElement('style');
+    style.textContent = css;
+    document.head.appendChild(style);
+
+    const widget = await mount();
+    const [active, inactive] = panels(widget);
+    expect(getComputedStyle(active).display).not.toBe('none');
+    expect(getComputedStyle(inactive).display).toBe('none');
+
+    widget.dispose();
+    style.remove();
+  });
+
+  it('moves with the arrow keys, wrapping at both ends', async () => {
+    const widget = await mount();
+    // ReactWidget re-renders on an animation frame, so each key has to land on the
+    // render that the previous one produced.
+    const settle = (): Promise<void> =>
+      new Promise(resolve => setTimeout(resolve, 50));
+
+    strip(widget)[0].dispatchEvent(
+      new KeyboardEvent('keydown', { key: 'ArrowRight', bubbles: true })
+    );
+    expect(widget.selections.pop()).toBe('two');
+    await settle();
+
+    strip(widget)[1].dispatchEvent(
+      new KeyboardEvent('keydown', { key: 'ArrowLeft', bubbles: true })
+    );
+    expect(widget.selections.pop()).toBe('one');
+    await settle();
+
+    // Wrapping: left from the first tab reaches the last.
+    strip(widget)[0].dispatchEvent(
+      new KeyboardEvent('keydown', { key: 'ArrowLeft', bubbles: true })
+    );
+    expect(widget.selections.pop()).toBe('three');
+
+    widget.dispose();
+  });
+
+  it('jumps to the ends with Home and End', async () => {
+    const widget = await mount();
+
+    strip(widget)[0].dispatchEvent(
+      new KeyboardEvent('keydown', { key: 'End', bubbles: true })
+    );
+    expect(widget.selections.pop()).toBe('three');
+
+    widget.dispose();
+  });
+
+  it('falls back to the first tab when the selection names no tab', async () => {
+    const widget = new Harness(TABS);
+    widget.selected = 'gone';
+    Widget.attach(widget, document.body);
+    await new Promise(resolve => setTimeout(resolve, 50));
+
+    expect(strip(widget)[0].getAttribute('aria-selected')).toBe('true');
+
+    widget.dispose();
+  });
+});

package/src/__tests__/aiBackend.spec.ts

@@ -1,4 +1,3 @@
-import schema from '../../schema/datamesh-connect.json';
 import {
   ACCESS_TOKEN_COMMAND,
   SIGN_IN_COMMAND,
@@ -15,11 +14,11 @@ import { OCEANUM_AI_BACKEND_URL } from '../constants';
 import { validHttpUrl } from '../httpUrl';
 
 describe('aiBackendUrl', () => {
-  it('is the default the settings schema offers', () => {
-    expect(schema.properties.aiBackendUrl.default).toBe(OCEANUM_AI_BACKEND_URL);
-    expect(aiBackendUrl(schema.properties.aiBackendUrl.default)).toBe(
-      'https://ai.oceanum.io'
-    );
+  it('is production when the deployment names no address', () => {
+    // What index.ts passes when the sign-in environment has no `ai` URL, or there is no
+    // sign-in at all.
+    expect(aiBackendUrl('')).toBe(OCEANUM_AI_BACKEND_URL);
+    expect(aiBackendUrl(undefined)).toBe('https://ai.oceanum.io');
   });
 
   it.each([

package/src/__tests__/chatRouter.spec.ts

@@ -417,12 +417,10 @@ describe('ChatRouter: where a request goes, and what it is signed with', () => {
 
   it('sends to the configured address, without a double slash', async () => {
     const router = new ChatRouter(
-      settingsWith({
-        datameshToken: 'a-token',
-        aiBackendUrl: ' https://ai.oceanum.tech/ '
-      }),
+      settings,
       noSignIn,
-      noNotebook
+      noNotebook,
+      () => ' https://ai.oceanum.tech/ '
     );
 
     await router.route('hello');
@@ -434,12 +432,10 @@ describe('ChatRouter: where a request goes, and what it is signed with', () => {
 
   it('sends to the default for an invalid address', async () => {
     const router = new ChatRouter(
-      settingsWith({
-        datameshToken: 'a-token',
-        aiBackendUrl: 'javascript:alert(1)'
-      }),
+      settings,
       noSignIn,
-      noNotebook
+      noNotebook,
+      () => 'javascript:alert(1)'
     );
 
     await router.route('hello');
@@ -542,12 +538,10 @@ describe('ChatRouter: where a request goes, and what it is signed with', () => {
       throw new TypeError('Failed to fetch');
     });
     const router = new ChatRouter(
-      settingsWith({
-        datameshToken: 'a-token',
-        aiBackendUrl: 'http://localhost:8000/'
-      }),
+      settings,
       noSignIn,
-      noNotebook
+      noNotebook,
+      () => 'http://localhost:8000/'
     );
 
     await expect(router.route('hello')).rejects.toThrow(

package/src/__tests__/datameshUiUrl.spec.ts

@@ -1,4 +1,3 @@
-import schema from '../../schema/datamesh-connect.json';
 import { DATAMESH_UI_SERVICE } from '../constants';
 import {
   datameshUiSrc,
@@ -7,8 +6,10 @@ import {
 } from '../datameshUiUrl';
 
 describe('validDatameshUiUrl', () => {
-  it('is the default the settings schema offers', () => {
-    expect(schema.properties.datameshUiUrl.default).toBe(DATAMESH_UI_SERVICE);
+  it('is production when the deployment names no address', () => {
+    expect(validDatameshUiUrl(undefined).href).toBe(
+      new URL(DATAMESH_UI_SERVICE).href
+    );
   });
 
   it('takes an http(s) address as it is', () => {

package/src/__tests__/pluginArity.spec.ts

@@ -0,0 +1,24 @@
+import plugins from '../index';
+
+/**
+ * JupyterLab passes `requires` then `optional` to `activate`, positionally, after the
+ * application. Omitting a parameter for a dependency you do not use does not skip it —
+ * it shifts every later argument along by one, silently handing the wrong object to the
+ * wrong parameter. TypeScript cannot see this: `activate` is typed loosely enough that
+ * the mismatch compiles, and unit tests that never activate the plugin never notice.
+ *
+ * This bit exactly once: adding an optional IOceanumAuth to a plugin whose signature
+ * had quietly omitted its IStateDB meant `auth` received the state database, and the
+ * panel crashed on `auth.userChanged.connect` at application start.
+ */
+describe('plugin activate signatures', () => {
+  it.each(plugins.map(plugin => [plugin.id, plugin] as const))(
+    '%s takes one parameter per declared dependency',
+    (_id, plugin) => {
+      const declared =
+        (plugin.requires?.length ?? 0) + (plugin.optional?.length ?? 0);
+      // +1 for the JupyterFrontEnd itself.
+      expect(plugin.activate.length).toBe(declared + 1);
+    }
+  );
+});

package/src/__tests__/serverAuth.spec.ts

@@ -0,0 +1,277 @@
+import {
+  AuthRequest,
+  readServerAuthOption,
+  SERVER_AUTH_OPTION,
+  ServerAuth
+} from '../auth/serverAuth';
+import { IOceanumEnvironment } from '../auth/tokens';
+
+const OPTION = JSON.stringify({
+  auth0Domain: 'auth.oceanum.io',
+  clientId: 'a-client',
+  oceanumDomain: 'oceanum.io',
+  urls: {
+    datamesh: 'https://datamesh.oceanum.io/',
+    specs: 'https://specs.oceanum.io',
+    manage: 'https://manage.oceanum.io',
+    ai: 'https://ai.oceanum.io'
+  }
+});
+
+const ENVIRONMENT = readServerAuthOption(
+  OPTION,
+  'localhost'
+) as IOceanumEnvironment;
+
+const CLAIMS = { sub: 'auth0|abc', email: 'ada@example.org', name: 'Ada' };
+const PENDING = {
+  userCode: 'WXYZ-1234',
+  verificationUri: 'https://auth.oceanum.io/activate',
+  verificationUriComplete:
+    'https://auth.oceanum.io/activate?user_code=WXYZ-1234',
+  expiresIn: 900
+};
+
+const SIGNED_OUT = {
+  state: 'signedOut',
+  claims: null as unknown,
+  pending: null as unknown,
+  error: null as string | null
+};
+const WAITING = { ...SIGNED_OUT, state: 'pending', pending: PENDING };
+const SIGNED_IN = { ...SIGNED_OUT, state: 'signedIn', claims: CLAIMS };
+
+/** A Jupyter server whose answers can be changed as the test goes. */
+function server(initial: Record<string, unknown>) {
+  const calls: string[] = [];
+  const state = { status: initial, token: 'jwt-1' as string | null };
+  const request: AuthRequest = async (action, method) => {
+    calls.push(`${method} ${action}`);
+    if (action === 'token') {
+      const signedIn = state.status.state === 'signedIn';
+      return { ...state.status, accessToken: signedIn ? state.token : null };
+    }
+    return state.status;
+  };
+  return { calls, state, request };
+}
+
+const tick = (ms = 0): Promise<void> =>
+  new Promise(resolve => setTimeout(resolve, ms));
+
+async function until(check: () => void, timeout = 2000): Promise<void> {
+  const end = Date.now() + timeout;
+  for (;;) {
+    try {
+      check();
+      return;
+    } catch (err) {
+      if (Date.now() > end) {
+        throw err;
+      }
+    }
+    await tick(10);
+  }
+}
+
+describe('readServerAuthOption', () => {
+  it('reads the page option name the server publishes under', () => {
+    // oceanumlab/__init__.py writes this literal (SERVER_AUTH_OPTION there, pinned by its
+    // own test). Renaming either side alone would silently turn sign-in off everywhere.
+    expect(SERVER_AUTH_OPTION).toBe('oceanumServerAuth');
+  });
+
+  it('builds the environment, normalising URLs and dropping absent optional ones', () => {
+    expect(ENVIRONMENT.urls).toEqual({
+      datamesh: 'https://datamesh.oceanum.io',
+      specs: 'https://specs.oceanum.io',
+      manage: 'https://manage.oceanum.io',
+      ai: 'https://ai.oceanum.io'
+    });
+    // The device grant is indifferent to the page's address, so there is nothing to match.
+    expect(ENVIRONMENT.hosts).toEqual(['localhost']);
+  });
+
+  it('treats a missing or unusable option as no sign-in on offer', () => {
+    expect(readServerAuthOption(undefined, 'localhost')).toBeNull();
+    expect(readServerAuthOption('', 'localhost')).toBeNull();
+    expect(readServerAuthOption('not json', 'localhost')).toBeNull();
+    expect(readServerAuthOption('[]', 'localhost')).toBeNull();
+    const noSpecs = JSON.parse(OPTION);
+    delete noSpecs.urls.specs;
+    expect(
+      readServerAuthOption(JSON.stringify(noSpecs), 'localhost')
+    ).toBeNull();
+    const script = JSON.parse(OPTION);
+    script.urls.specs = 'javascript:alert(1)';
+    expect(
+      readServerAuthOption(JSON.stringify(script), 'localhost')
+    ).toBeNull();
+  });
+});
+
+describe('ServerAuth', () => {
+  it('is inert, and ready, when the server offers no sign-in', async () => {
+    const jupyter = server(SIGNED_OUT);
+    const auth = new ServerAuth({
+      environment: null,
+      request: jupyter.request
+    });
+
+    await auth.ready;
+    await auth.signIn();
+
+    expect(auth.user).toBeNull();
+    expect(await auth.getAccessToken()).toBeNull();
+    expect(jupyter.calls).toEqual([]);
+    auth.dispose();
+  });
+
+  it('finds a session the server already holds, before it says it is ready', async () => {
+    // A page reload, or a second tab: the server signed in earlier and still is.
+    const jupyter = server(SIGNED_IN);
+    const auth = new ServerAuth({
+      environment: ENVIRONMENT,
+      request: jupyter.request
+    });
+
+    await auth.ready;
+
+    expect(auth.user?.email).toBe('ada@example.org');
+    expect(await auth.getAccessToken()).toBe('jwt-1');
+    auth.dispose();
+  });
+
+  it('starts a sign-in, waits on the user, then reports the user and the token', async () => {
+    const jupyter = server(SIGNED_OUT);
+    const auth = new ServerAuth({
+      environment: ENVIRONMENT,
+      request: jupyter.request,
+      pendingPollMs: 10
+    });
+    await auth.ready;
+    const users: (string | null)[] = [];
+    const tokens: (string | null)[] = [];
+    auth.userChanged.connect((_, user) => users.push(user?.email ?? null));
+    auth.tokenChanged.connect((_, token) => tokens.push(token));
+
+    jupyter.state.status = WAITING;
+    await auth.signIn();
+    expect(auth.pending?.userCode).toBe('WXYZ-1234');
+    expect(auth.user).toBeNull();
+
+    // The user confirms the code in their browser; the server's next answer says so.
+    jupyter.state.status = SIGNED_IN;
+    await until(() => expect(auth.user?.email).toBe('ada@example.org'));
+
+    expect(auth.pending).toBeNull();
+    expect(users).toEqual(['ada@example.org']);
+    expect(tokens).toEqual(['jwt-1']);
+    auth.dispose();
+  });
+
+  it('passes on a refreshed token while signed in', async () => {
+    const jupyter = server(SIGNED_IN);
+    const auth = new ServerAuth({
+      environment: ENVIRONMENT,
+      request: jupyter.request,
+      tokenPollMs: 10
+    });
+    await auth.ready;
+    const tokens: (string | null)[] = [];
+    auth.tokenChanged.connect((_, token) => tokens.push(token));
+
+    jupyter.state.token = 'jwt-2';
+    await until(() => expect(tokens).toEqual(['jwt-2']));
+    auth.dispose();
+  });
+
+  it('signs out without calling it a session that ended', async () => {
+    const jupyter = server(SIGNED_IN);
+    const ended: string[] = [];
+    const auth = new ServerAuth({
+      environment: ENVIRONMENT,
+      request: jupyter.request,
+      onSessionEnded: message => ended.push(message)
+    });
+    await auth.ready;
+    const tokens: (string | null)[] = [];
+    auth.tokenChanged.connect((_, token) => tokens.push(token));
+
+    jupyter.state.status = SIGNED_OUT;
+    await auth.signOut();
+
+    expect(jupyter.calls).toContain('POST signout');
+    expect(auth.user).toBeNull();
+    expect(tokens).toEqual([null]);
+    expect(ended).toEqual([]);
+    auth.dispose();
+  });
+
+  it('says so when the server ends the session itself', async () => {
+    const jupyter = server(SIGNED_IN);
+    const ended: string[] = [];
+    const auth = new ServerAuth({
+      environment: ENVIRONMENT,
+      request: jupyter.request,
+      onSessionEnded: message => ended.push(message),
+      tokenPollMs: 10
+    });
+    await auth.ready;
+
+    // The refresh token was revoked: the server's next answer is signed out, with why.
+    jupyter.state.status = {
+      ...SIGNED_OUT,
+      error: 'Your Oceanum.io session has ended.'
+    };
+    await until(() => expect(auth.user).toBeNull());
+
+    expect(ended).toEqual(['Your Oceanum.io session has ended.']);
+    auth.dispose();
+  });
+
+  it('keeps the session when the Jupyter server is briefly unreachable', async () => {
+    const jupyter = server(SIGNED_IN);
+    let failing = false;
+    const warn = jest
+      .spyOn(console, 'warn')
+      .mockImplementation(() => undefined);
+    const auth = new ServerAuth({
+      environment: ENVIRONMENT,
+      request: async (action, method) => {
+        if (failing) {
+          throw new Error('connection refused');
+        }
+        return jupyter.request(action, method);
+      }
+    });
+    await auth.ready;
+
+    failing = true;
+    await auth.refresh();
+
+    // One failed request is not a sign-out.
+    expect(auth.user?.email).toBe('ada@example.org');
+    auth.dispose();
+    warn.mockRestore();
+  });
+
+  it('cancels a sign-in that is waiting', async () => {
+    const jupyter = server(SIGNED_OUT);
+    const auth = new ServerAuth({
+      environment: ENVIRONMENT,
+      request: jupyter.request,
+      pendingPollMs: 10000
+    });
+    await auth.ready;
+    jupyter.state.status = WAITING;
+    await auth.signIn();
+
+    jupyter.state.status = SIGNED_OUT;
+    await auth.cancelSignIn();
+
+    expect(jupyter.calls).toContain('POST cancel');
+    expect(auth.pending).toBeNull();
+    auth.dispose();
+  });
+});

package/src/__tests__/settingsSchema.spec.ts

@@ -0,0 +1,73 @@
+import { readFileSync } from 'fs';
+import { join } from 'path';
+
+import { ISettingRegistry, SettingRegistry } from '@jupyterlab/settingregistry';
+
+const ID = '@oceanum/oceanumlab:datamesh-connect';
+const schema = JSON.parse(
+  readFileSync(join(__dirname, '../../schema/datamesh-connect.json'), 'utf8')
+) as ISettingRegistry.ISchema;
+
+/** A registry whose stored user settings for the plugin are `user`. */
+function registryWith(user: Record<string, unknown>): SettingRegistry {
+  const plugin: ISettingRegistry.IPlugin = {
+    id: ID,
+    data: { user: {}, composite: {} },
+    raw: JSON.stringify(user),
+    schema,
+    version: 'test'
+  };
+  const connector = {
+    fetch: async (): Promise<ISettingRegistry.IPlugin> => plugin,
+    list: async () => ({ ids: [ID], values: [plugin] }),
+    save: async (): Promise<void> => undefined,
+    remove: async (): Promise<void> => undefined
+  };
+  return new SettingRegistry({ connector: connector as any });
+}
+
+/**
+ * `datameshUiUrl` and `aiBackendUrl` were user settings until 4.7.1. They are deployment
+ * configuration now: a user-editable service address is somewhere to send the user's
+ * credential.
+ *
+ * Taking them out of the schema is not enough on its own, and would have been a breaking
+ * release. The schema is `additionalProperties: false`, the registry REJECTS a load whose
+ * stored settings fail validation, and these two keys are stored for every
+ * notebook.oceanum.io user: until this release that site wrote each environment's addresses
+ * into oceanumlab's settings. Every one of them would have lost the whole settings load --
+ * the Datamesh token with it.
+ */
+describe('the datamesh-connect settings schema', () => {
+  it('no longer offers the two service addresses as settings', () => {
+    expect(Object.keys(schema.properties ?? {})).toEqual([
+      'datameshToken',
+      'injectToken',
+      'autoRunCode',
+      'iterate'
+    ]);
+  });
+
+  it('still loads settings stored when they were', async () => {
+    const registry = registryWith({
+      datameshToken: 'a-token',
+      datameshUiUrl: 'https://ui.datamesh.oceanum.tech',
+      aiBackendUrl: 'https://ai.oceanum.tech'
+    });
+
+    const settings = await registry.load(ID);
+
+    expect(settings.get('datameshToken').composite).toBe('a-token');
+  });
+
+  it('stays strict about everything else', async () => {
+    // Tolerating those two must not turn into tolerating typos.
+    const warn = jest
+      .spyOn(console, 'warn')
+      .mockImplementation(() => undefined);
+    const registry = registryWith({ datameshTokn: 'a-typo' });
+
+    await expect(registry.load(ID)).rejects.toBeDefined();
+    warn.mockRestore();
+  });
+});