@omg-dev/server 0.4.24

package/src/test/migrator.test.ts

@@ -0,0 +1,166 @@
+import { describe, it, expect } from "bun:test"
+import { Database } from "bun:sqlite"
+import { defineSchema, collection, fields } from "@omg-dev/schema"
+import { migrate } from "../migrator.ts"
+
+// Reproduces the boot crash a control-plane / generated app hits when a
+// collection that was created while `scope:"global"` is later marked
+// `.scoped("user").index("_owner", …)`. `_owner` is an implicit column (not a
+// declared field), so schemaDiff never emits an add_column for it; the
+// add_index for the `_owner` index then ran against a table with no `_owner`
+// column → `SQLiteError: no such column: _owner`. The default-private flip
+// (schema 0.3.0) made this transition the common case.
+
+function rowCount(db: Database, table: string): number {
+  return (db.prepare(`SELECT COUNT(*) c FROM ${table}`).get() as { c: number }).c
+}
+
+function hasColumn(db: Database, table: string, col: string): boolean {
+  const cols = db.prepare(`PRAGMA table_info(${table})`).all() as { name: string }[]
+  return cols.some(c => c.name === col)
+}
+
+describe("migrate — global→user scope transition", () => {
+  it("adds the implicit _owner column before creating an _owner index (no crash)", () => {
+    const db = new Database(":memory:")
+
+    // v1: global table, no _owner, no index.
+    migrate(
+      db,
+      defineSchema({
+        collections: {
+          mig_posts: collection({ fields: { title: fields.string() } }).scoped("global"),
+        },
+      }),
+    )
+    expect(hasColumn(db, "mig_posts", "_owner")).toBe(false)
+
+    // Seed a historical row written while the table was global.
+    db.prepare(
+      `INSERT INTO mig_posts (id, created_at, updated_at, title) VALUES (?, ?, ?, ?)`,
+    ).run("p1", "2026-01-01", "2026-01-01", "hello")
+
+    // v2: same collection becomes user-scoped WITH an _owner index — the exact
+    // shape that used to crash the migrator on boot.
+    expect(() =>
+      migrate(
+        db,
+        defineSchema({
+          collections: {
+            mig_posts: collection({ fields: { title: fields.string() } })
+              .scoped("user")
+              .index("_owner", "created_at"),
+          },
+        }),
+      ),
+    ).not.toThrow()
+
+    // _owner column added, index created, historical row preserved (NULL owner
+    // until backfilled).
+    expect(hasColumn(db, "mig_posts", "_owner")).toBe(true)
+    expect(rowCount(db, "mig_posts")).toBe(1)
+    const idx = db
+      .prepare(`SELECT name FROM sqlite_master WHERE type='index' AND name = ?`)
+      .get("idx_mig_posts__owner_created_at") as { name: string } | undefined
+    expect(idx?.name).toBe("idx_mig_posts__owner_created_at")
+    const row = db.prepare(`SELECT _owner FROM mig_posts WHERE id = ?`).get("p1") as {
+      _owner: string | null
+    }
+    expect(row._owner).toBeNull()
+
+    db.close()
+  })
+
+  it("adds _owner on a scope transition even when nothing else changed", () => {
+    const db = new Database(":memory:")
+
+    migrate(
+      db,
+      defineSchema({
+        collections: {
+          mig_notes: collection({ fields: { body: fields.string() } }).scoped("global"),
+        },
+      }),
+    )
+    expect(hasColumn(db, "mig_notes", "_owner")).toBe(false)
+
+    // No field change, no index — only the scope flips. schemaDiff returns [],
+    // so without the dedicated _owner pass the column would never be added and
+    // WS owner-filtering would silently break.
+    migrate(
+      db,
+      defineSchema({
+        collections: {
+          mig_notes: collection({ fields: { body: fields.string() } }).scoped("user"),
+        },
+      }),
+    )
+    expect(hasColumn(db, "mig_notes", "_owner")).toBe(true)
+
+    db.close()
+  })
+
+  it("is idempotent — re-running the scoped schema does not re-add or crash", () => {
+    const db = new Database(":memory:")
+    const scoped = defineSchema({
+      collections: {
+        mig_items: collection({ fields: { name: fields.string() } })
+          .scoped("user")
+          .index("_owner"),
+      },
+    })
+    migrate(db, scoped)
+    expect(hasColumn(db, "mig_items", "_owner")).toBe(true)
+    expect(() => migrate(db, scoped)).not.toThrow()
+    // Exactly one _owner column.
+    const owners = (db.prepare(`PRAGMA table_info(mig_items)`).all() as { name: string }[]).filter(
+      c => c.name === "_owner",
+    )
+    expect(owners).toHaveLength(1)
+    db.close()
+  })
+})
+
+describe("migrate — unique indexes", () => {
+  it("creates a unique index that makes duplicate values impossible", () => {
+    const db = new Database(":memory:")
+    migrate(
+      db,
+      defineSchema({
+        collections: {
+          webhookClaims: collection({ fields: { eventId: fields.string() } })
+            .scoped("global")
+            .unique("eventId"),
+        },
+      }),
+    )
+    db.prepare(`INSERT INTO webhookClaims (id, eventId) VALUES (?, ?)`).run("first", "evt_1")
+    expect(() =>
+      db.prepare(`INSERT INTO webhookClaims (id, eventId) VALUES (?, ?)`).run("second", "evt_1"),
+    ).toThrow()
+    db.close()
+  })
+
+  it("adds a unique index when an existing table gains a unique declaration", () => {
+    const db = new Database(":memory:")
+    const v1 = defineSchema({
+      collections: {
+        webhookClaims: collection({ fields: { eventId: fields.string() } }).scoped("global"),
+      },
+    })
+    const v2 = defineSchema({
+      collections: {
+        webhookClaims: collection({ fields: { eventId: fields.string() } })
+          .scoped("global")
+          .unique("eventId"),
+      },
+    })
+    migrate(db, v1)
+    migrate(db, v2)
+    const index = db
+      .prepare(`SELECT name FROM sqlite_master WHERE type = 'index' AND name = ?`)
+      .get("uidx_webhookClaims_eventId") as { name: string } | undefined
+    expect(index?.name).toBe("uidx_webhookClaims_eventId")
+    db.close()
+  })
+})

package/src/test/notifications.test.ts

@@ -0,0 +1,96 @@
+import { afterEach, describe, expect, it } from "bun:test"
+import fs from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { createVibesServer, type VibesServerInstance } from "../index.ts"
+
+let servers: VibesServerInstance[] = []
+let roots: string[] = []
+
+afterEach(() => {
+  for (const server of servers) server.close()
+  servers = []
+  for (const root of roots) fs.rmSync(root, { recursive: true, force: true })
+  roots = []
+})
+
+async function makeServer() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "vibes-notifications-"))
+  fs.mkdirSync(path.join(root, ".vibes"), { recursive: true })
+  roots.push(root)
+  const server = await createVibesServer({
+    root,
+    db: "data.db",
+    auth: async (req) => {
+      const userId = req.headers.get("x-test-user")
+      return userId ? { userId } : null
+    },
+  })
+  servers.push(server)
+  return server
+}
+
+function authed(pathname: string, init?: RequestInit) {
+  const headers = new Headers(init?.headers)
+  headers.set("x-test-user", "user-1")
+  return new Request(`http://x${pathname}`, { ...init, headers })
+}
+
+describe("notifications", () => {
+  it("creates, dedupes, lists, and marks inbox notifications read", async () => {
+    const server = await makeServer()
+
+    const create = await server.fetch(authed("/api/_notifications/create", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        kind: "agent_needs_input",
+        title: "Agent needs input",
+        body: "Pick the next step.",
+        url: "/demo",
+        dedupeKey: "run:1:needs-input",
+      }),
+    }))
+    expect(create.status).toBe(200)
+    const created = await create.json() as { id: string; status: string }
+    expect(created.status).toBe("unread")
+
+    const duplicate = await server.fetch(authed("/api/_notifications/create", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        kind: "agent_needs_input",
+        title: "Duplicate",
+        dedupeKey: "run:1:needs-input",
+      }),
+    }))
+    const dup = await duplicate.json() as { id: string; title: string }
+    expect(dup.id).toBe(created.id)
+    expect(dup.title).toBe("Agent needs input")
+
+    const list = await server.fetch(authed("/api/_notifications/list"))
+    expect(list.status).toBe(200)
+    const rows = await list.json() as Array<{ id: string; title: string }>
+    expect(rows).toHaveLength(1)
+    expect(rows[0].title).toBe("Agent needs input")
+
+    const read = await server.fetch(authed("/api/_notifications/read", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ ids: [created.id] }),
+    }))
+    expect(read.status).toBe(200)
+
+    const unread = await server.fetch(authed("/api/_notifications/list?unread=1"))
+    const unreadRows = await unread.json() as unknown[]
+    expect(unreadRows).toHaveLength(0)
+  })
+
+  it("serves the dedicated push service worker", async () => {
+    const server = await makeServer()
+    const res = await server.fetch(new Request("http://x/__vibes_push/sw.js"))
+    expect(res.status).toBe(200)
+    expect(res.headers.get("content-type")).toContain("text/javascript")
+    expect(await res.text()).toContain("showNotification")
+  })
+})

package/src/test/predicate.test.ts

@@ -0,0 +1,267 @@
+import { describe, it, expect } from "bun:test"
+import { Database } from "bun:sqlite"
+import {
+  validatePredicate,
+  compileToSql,
+  compileToJs,
+  PredicateValidationError,
+  type Predicate,
+} from "../predicate.ts"
+
+// ── Validation ───────────────────────────────────────────────────────────────
+
+describe("predicate — validation", () => {
+  it("accepts well-formed leaf operators", () => {
+    expect(() => validatePredicate({ op: "eq", column: "x", value: 1 })).not.toThrow()
+    expect(() => validatePredicate({ op: "in", column: "tag", values: ["a", "b"] })).not.toThrow()
+    expect(() => validatePredicate({ op: "isNull", column: "name" })).not.toThrow()
+    expect(() => validatePredicate({ op: "like", column: "title", pattern: "foo%" })).not.toThrow()
+  })
+
+  it("rejects an empty and/or", () => {
+    expect(() => validatePredicate({ op: "and", clauses: [] })).toThrow(PredicateValidationError)
+    expect(() => validatePredicate({ op: "or", clauses: [] })).toThrow(PredicateValidationError)
+  })
+
+  it("rejects non-identifier columns (no SQL injection vector)", () => {
+    expect(() => validatePredicate({ op: "eq", column: "x; DROP TABLE y", value: 1 }))
+      .toThrow(PredicateValidationError)
+    expect(() => validatePredicate({ op: "eq", column: "1bad", value: 1 }))
+      .toThrow(PredicateValidationError)
+    expect(() => validatePredicate({ op: "eq", column: "", value: 1 }))
+      .toThrow(PredicateValidationError)
+  })
+
+  it("rejects unsupported literal types", () => {
+    expect(() => validatePredicate({ op: "eq", column: "x", value: { nested: true } as never }))
+      .toThrow(PredicateValidationError)
+    expect(() => validatePredicate({ op: "eq", column: "x", value: [1, 2] as never }))
+      .toThrow(PredicateValidationError)
+    expect(() => validatePredicate({ op: "eq", column: "x", value: Number.NaN as never }))
+      .toThrow(PredicateValidationError)
+    expect(() => validatePredicate({ op: "eq", column: "x", value: Infinity as never }))
+      .toThrow(PredicateValidationError)
+  })
+
+  it("rejects ordering operators against boolean / null", () => {
+    expect(() => validatePredicate({ op: "gt", column: "x", value: true as never }))
+      .toThrow(PredicateValidationError)
+    expect(() => validatePredicate({ op: "lt", column: "x", value: null as never }))
+      .toThrow(PredicateValidationError)
+  })
+
+  it("rejects an unknown op", () => {
+    expect(() => validatePredicate({ op: "regex", column: "x", pattern: ".*" } as never))
+      .toThrow(PredicateValidationError)
+  })
+
+  it("rejects pathologically deep trees", () => {
+    let p: Predicate = { op: "eq", column: "x", value: 1 }
+    for (let i = 0; i < 40; i++) p = { op: "not", clause: p }
+    expect(() => validatePredicate(p)).toThrow(PredicateValidationError)
+  })
+
+  it("rejects pathologically wide and/or", () => {
+    const clauses: Predicate[] = []
+    for (let i = 0; i < 300; i++) clauses.push({ op: "eq", column: "x", value: i })
+    expect(() => validatePredicate({ op: "and", clauses })).toThrow(PredicateValidationError)
+  })
+})
+
+// ── SQL emitter ──────────────────────────────────────────────────────────────
+
+describe("predicate — compileToSql", () => {
+  it("emits parameterized SQL for each operator", () => {
+    expect(compileToSql({ op: "eq", column: "x", value: 42 })).toEqual({
+      sql: "x = ?", params: [42],
+    })
+    expect(compileToSql({ op: "ne", column: "x", value: "hi" })).toEqual({
+      sql: "x != ?", params: ["hi"],
+    })
+    expect(compileToSql({ op: "gt", column: "x", value: 1 })).toEqual({
+      sql: "x > ?", params: [1],
+    })
+    expect(compileToSql({ op: "in", column: "t", values: ["a", "b", "c"] })).toEqual({
+      sql: "t IN (?, ?, ?)", params: ["a", "b", "c"],
+    })
+    expect(compileToSql({ op: "like", column: "n", pattern: "foo%" })).toEqual({
+      sql: "n LIKE ?", params: ["foo%"],
+    })
+    expect(compileToSql({ op: "isNull", column: "n" })).toEqual({
+      sql: "n IS NULL", params: [],
+    })
+    expect(compileToSql({ op: "isNotNull", column: "n" })).toEqual({
+      sql: "n IS NOT NULL", params: [],
+    })
+  })
+
+  it("encodes booleans as 0/1 in bound params (SQLite storage class)", () => {
+    expect(compileToSql({ op: "eq", column: "done", value: true })).toEqual({
+      sql: "done = ?", params: [1],
+    })
+    expect(compileToSql({ op: "eq", column: "done", value: false })).toEqual({
+      sql: "done = ?", params: [0],
+    })
+  })
+
+  it("composes and / or / not", () => {
+    const { sql, params } = compileToSql({
+      op: "and",
+      clauses: [
+        { op: "eq", column: "a", value: 1 },
+        { op: "or", clauses: [
+          { op: "lt", column: "b", value: 10 },
+          { op: "not", clause: { op: "isNull", column: "c" } },
+        ] },
+      ],
+    })
+    expect(sql).toBe("(a = ? AND (b < ? OR (NOT c IS NULL)))")
+    expect(params).toEqual([1, 10])
+  })
+})
+
+// ── SQL ⇔ JS equivalence (the load-bearing test) ─────────────────────────────
+
+describe("predicate — SQL ⇔ JS equivalence on random rows", () => {
+  // The duality between compileToSql and compileToJs is what lets the
+  // server filter the initial snapshot with SQL and decide per-write
+  // delta inclusion with JS. They MUST agree for every row that round-
+  // trips through the snapshot/delta protocol — diverging means a sub
+  // misses or duplicates rows. This test generates random rows AND random
+  // predicates, asks both emitters whether each row passes, and fails if
+  // they disagree.
+
+  // Decoded row shape — matches what auto-crud's REST handlers return.
+  type Row = { id: string; n: number; s: string; b: boolean; nilable: string | null }
+
+  function randRow(rng: () => number, i: number): Row {
+    return {
+      id: `r${i}`,
+      n: Math.floor(rng() * 100) - 50,                          // -50 .. 49
+      s: ["alpha", "beta", "gamma", "delta", ""][Math.floor(rng() * 5)] ?? "",
+      b: rng() < 0.5,
+      nilable: rng() < 0.3 ? null : `v${Math.floor(rng() * 5)}`,
+    }
+  }
+
+  // SQLite-encoded row (booleans as INT 0/1) — what compileToSql expects
+  // the bound row to look like at the storage layer.
+  function encodeRow(r: Row): Record<string, unknown> {
+    return { id: r.id, n: r.n, s: r.s, b: r.b ? 1 : 0, nilable: r.nilable }
+  }
+
+  function randPredicate(rng: () => number, depth: number): Predicate {
+    if (depth > 2 || rng() < 0.4) {
+      const leafOps = ["eq", "ne", "gt", "gte", "lt", "lte", "in", "like", "isNull", "isNotNull"] as const
+      const op = leafOps[Math.floor(rng() * leafOps.length)]
+      const cols = ["n", "s", "b", "nilable"] as const
+      const column = cols[Math.floor(rng() * cols.length)] ?? "n"
+      switch (op) {
+        case "eq":
+        case "ne": {
+          // Pick a value from the same domain as the column to get a mix
+          // of hits and misses; an all-miss predicate proves little.
+          if (column === "n") return { op, column, value: Math.floor(rng() * 100) - 50 }
+          if (column === "s") return { op, column, value: ["alpha", "beta", "gamma", "delta", "", "zzz"][Math.floor(rng() * 6)] ?? "" }
+          if (column === "b") return { op, column, value: rng() < 0.5 }
+          return { op, column, value: rng() < 0.5 ? null : `v${Math.floor(rng() * 5)}` }
+        }
+        case "gt":
+        case "gte":
+        case "lt":
+        case "lte": {
+          if (column === "n") return { op, column, value: Math.floor(rng() * 100) - 50 }
+          // string ordering on s or nilable.
+          const v = ["alpha", "beta", "gamma", "delta"][Math.floor(rng() * 4)] ?? "alpha"
+          return { op, column: column === "b" ? "s" : column, value: v }
+        }
+        case "in": {
+          if (column === "n") return { op, column, values: [1, 2, 3, 4, 5, -1, -2] }
+          return { op, column, values: ["alpha", "beta", "v0", "v1"] }
+        }
+        case "like": {
+          return { op, column: "s", pattern: ["alpha%", "%a", "%e%", "delta", "x_z"][Math.floor(rng() * 5)] ?? "%" }
+        }
+        case "isNull":
+        case "isNotNull":
+          return { op, column }
+      }
+    }
+    const branchOp = rng() < 0.5 ? "and" : "or"
+    const arity = 2 + Math.floor(rng() * 2)
+    const clauses: Predicate[] = []
+    for (let i = 0; i < arity; i++) clauses.push(randPredicate(rng, depth + 1))
+    if (rng() < 0.2) return { op: "not", clause: { op: branchOp, clauses } }
+    return { op: branchOp, clauses }
+  }
+
+  // Tiny LCG so test failures are reproducible.
+  function makeRng(seed: number): () => number {
+    let s = seed >>> 0
+    return () => {
+      s = (s * 1664525 + 1013904223) >>> 0
+      return s / 0xffffffff
+    }
+  }
+
+  const SEEDS = [1, 17, 2025, 0xc0ffee]
+  const ROWS_PER_RUN = 80
+  const PREDICATES_PER_RUN = 60
+
+  for (const seed of SEEDS) {
+    it(`seed=${seed}: SQL and JS emit the same membership for every (row, predicate) pair`, () => {
+      const rng = makeRng(seed)
+      const rows: Row[] = []
+      for (let i = 0; i < ROWS_PER_RUN; i++) rows.push(randRow(rng, i))
+
+      const db = new Database(":memory:")
+      db.exec(`CREATE TABLE t (
+        id TEXT PRIMARY KEY,
+        n INTEGER,
+        s TEXT,
+        b INTEGER,
+        nilable TEXT
+      )`)
+      const insert = db.prepare(
+        "INSERT INTO t (id, n, s, b, nilable) VALUES (?, ?, ?, ?, ?)",
+      )
+      for (const r of rows) {
+        const er = encodeRow(r)
+        insert.run(er.id, er.n, er.s, er.b, er.nilable)
+      }
+
+      for (let i = 0; i < PREDICATES_PER_RUN; i++) {
+        const pred = randPredicate(rng, 0)
+        validatePredicate(pred)
+
+        const { sql, params } = compileToSql(pred)
+        const sqlIds = new Set(
+          (db.prepare(`SELECT id FROM t WHERE ${sql}`).all(...params) as { id: string }[])
+            .map(r => r.id),
+        )
+
+        const jsMatch = compileToJs(pred)
+        const jsIds = new Set(rows.filter(r => jsMatch(r as unknown as Record<string, unknown>)).map(r => r.id))
+
+        // Symmetric difference must be empty.
+        const onlySql = [...sqlIds].filter(id => !jsIds.has(id))
+        const onlyJs = [...jsIds].filter(id => !sqlIds.has(id))
+        if (onlySql.length || onlyJs.length) {
+          // Surface a debuggable failure rather than just "not equal".
+          throw new Error(
+            `predicate divergence (seed=${seed}, i=${i}):\n` +
+            `  predicate: ${JSON.stringify(pred)}\n` +
+            `  sql:       ${sql}\n` +
+            `  params:    ${JSON.stringify(params)}\n` +
+            `  in SQL only: ${JSON.stringify(onlySql)}\n` +
+            `  in JS only:  ${JSON.stringify(onlyJs)}\n` +
+            `  rows:      ${JSON.stringify(rows)}\n`,
+          )
+        }
+      }
+
+      db.close()
+      expect(true).toBe(true) // satisfies bun:test's "at least one assertion"
+    })
+  }
+})