@open-mercato/tillio 0.7.1-develop.7176.1.d229567a50

package/src/modules/tillio/__tests__/operators.test.ts

@@ -0,0 +1,250 @@
+import { createTillioClient } from '../lib/client'
+import { TillioApiError } from '../lib/errors'
+import { TILLIO_INTEGRATION_ID } from '../integration'
+import { TILLIO_OPERATORS_INTEGRATION_ID, type TillioCredentialsService } from '../lib/operators-store'
+import {
+  attachOperator,
+  classifyTillioError,
+  detachOperator,
+  TillioEnvironmentNotReadyError,
+  TillioOperatorLimitError,
+} from '../lib/operators'
+
+jest.mock('../lib/client', () => ({
+  createTillioClient: jest.fn(),
+}))
+
+const createTillioClientMock = createTillioClient as jest.MockedFunction<typeof createTillioClient>
+
+const scope = { tenantId: 'tn', organizationId: 'org' }
+const appUrl = 'https://app.example.com'
+// These cases drive one attach at a time, so the section needs no serialization; the advisory
+// lock itself needs a database and is exercised where the route wires it.
+const passThroughLock = <T>(run: () => Promise<T>): Promise<T> => run()
+const readyEnv = { apiUrl: 'https://a.example.com', apiKey: 'k', tenantSystemId: 'OM-x' }
+
+function fakeStore(initial: Record<string, Record<string, unknown> | null> = {}): {
+  service: TillioCredentialsService
+  store: Record<string, Record<string, unknown> | null>
+} {
+  const store: Record<string, Record<string, unknown> | null> = { ...initial }
+  return {
+    store,
+    service: {
+      getRaw: jest.fn(async (id: string) => store[id] ?? null),
+      save: jest.fn(async (id: string, credentials: Record<string, unknown>) => {
+        store[id] = credentials
+      }),
+    },
+  }
+}
+
+function mockClient(overrides: Partial<{
+  validateConfig: jest.Mock
+  addConfig: jest.Mock
+  deleteConfig: jest.Mock
+}> = {}) {
+  const client = {
+    validateConfig: overrides.validateConfig ?? jest.fn().mockResolvedValue(undefined),
+    addConfig: overrides.addConfig ?? jest.fn().mockResolvedValue({ token: 'tok-1' }),
+    deleteConfig: overrides.deleteConfig ?? jest.fn().mockResolvedValue(undefined),
+  }
+  createTillioClientMock.mockReturnValue(client as unknown as ReturnType<typeof createTillioClient>)
+  return client
+}
+
+beforeEach(() => {
+  createTillioClientMock.mockReset()
+})
+
+describe('attachOperator', () => {
+  it('validates, provisions, and persists the operator with an env fingerprint', async () => {
+    const client = mockClient()
+    const { service, store } = fakeStore({ [TILLIO_INTEGRATION_ID]: { ...readyEnv } })
+
+    const record = await attachOperator({ credentialsService: service, scope, appUrl, withLock: passThroughLock }, {
+      plugin: 'Ringostat',
+      config: { key: 'ringo-key' },
+    })
+
+    expect(client.validateConfig).toHaveBeenCalledWith('Ringostat', { key: 'ringo-key' }, 'app.example.com/OM-x-ringostat-1')
+    expect(client.addConfig).toHaveBeenCalledWith('Ringostat', { key: 'ringo-key' }, 'app.example.com/OM-x-ringostat-1')
+    expect(record.id).toBe('ringostat-1')
+    expect(record.token).toBe('tok-1')
+    expect(record.tenantDomain).toBe('app.example.com/OM-x-ringostat-1')
+    expect(record.envFingerprint).toEqual(expect.any(String))
+
+    const saved = store[TILLIO_OPERATORS_INTEGRATION_ID] as { operators: unknown[]; defaultOperatorId: string }
+    expect(saved.operators).toHaveLength(1)
+    expect(saved.defaultOperatorId).toBe('ringostat-1')
+  })
+
+  it('rejects a second operator (one at a time)', async () => {
+    const client = mockClient()
+    const { service } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: { ...readyEnv },
+      [TILLIO_OPERATORS_INTEGRATION_ID]: {
+        operators: [{ id: 'ringostat-1', plugin: 'Ringostat', config: { key: 'x' }, token: 't', tenantDomain: 'd', envFingerprint: 'fp' }],
+        defaultOperatorId: 'ringostat-1',
+      },
+    })
+
+    await expect(attachOperator({ credentialsService: service, scope, appUrl, withLock: passThroughLock }, { plugin: 'Ringostat', config: { key: 'k' } }))
+      .rejects.toBeInstanceOf(TillioOperatorLimitError)
+    expect(client.validateConfig).not.toHaveBeenCalled()
+  })
+
+  it('rejects when the environment is not ready', async () => {
+    const client = mockClient()
+    const { service } = fakeStore({ [TILLIO_INTEGRATION_ID]: { apiUrl: 'https://a.example.com', apiKey: 'k' } })
+
+    await expect(attachOperator({ credentialsService: service, scope, appUrl, withLock: passThroughLock }, { plugin: 'Ringostat', config: { key: 'k' } }))
+      .rejects.toBeInstanceOf(TillioEnvironmentNotReadyError)
+    expect(client.addConfig).not.toHaveBeenCalled()
+  })
+
+  it('compensates with deleteConfig when persistence fails', async () => {
+    const client = mockClient()
+    const store: Record<string, Record<string, unknown> | null> = { [TILLIO_INTEGRATION_ID]: { ...readyEnv } }
+    const service: TillioCredentialsService = {
+      getRaw: jest.fn(async (id: string) => store[id] ?? null),
+      save: jest.fn(async (id: string) => {
+        if (id === TILLIO_OPERATORS_INTEGRATION_ID) throw new Error('disk full')
+      }),
+    }
+
+    await expect(attachOperator({ credentialsService: service, scope, appUrl, withLock: passThroughLock }, { plugin: 'Ringostat', config: { key: 'k' } }))
+      .rejects.toThrow('disk full')
+    expect(client.deleteConfig).toHaveBeenCalledWith('Ringostat', 'tok-1', 'app.example.com/OM-x-ringostat-1')
+  })
+
+  it('gives up rather than overwriting an operator a concurrent attach stored first', async () => {
+    const client = mockClient()
+    const store: Record<string, Record<string, unknown> | null> = { [TILLIO_INTEGRATION_ID]: { ...readyEnv } }
+    let reads = 0
+    const service: TillioCredentialsService = {
+      getRaw: jest.fn(async (id: string) => {
+        // The second read is the one taken right before the write: by then a concurrent
+        // attach has already stored its operator.
+        if (id === TILLIO_OPERATORS_INTEGRATION_ID && ++reads === 2) {
+          return {
+            operators: [{ id: 'ringostat-1', plugin: 'Ringostat', config: { key: 'other' }, token: 'other-token', tenantDomain: 'd', envFingerprint: 'fp' }],
+            defaultOperatorId: 'ringostat-1',
+          }
+        }
+        return store[id] ?? null
+      }),
+      save: jest.fn(async (id: string, credentials: Record<string, unknown>) => {
+        store[id] = credentials
+      }),
+    }
+
+    await expect(attachOperator({ credentialsService: service, scope, appUrl, withLock: passThroughLock }, { plugin: 'Ringostat', config: { key: 'k' } }))
+      .rejects.toBeInstanceOf(TillioOperatorLimitError)
+    expect(client.deleteConfig).toHaveBeenCalledWith('Ringostat', 'tok-1', 'app.example.com/OM-x-ringostat-1')
+    expect(store[TILLIO_OPERATORS_INTEGRATION_ID]).toBeUndefined()
+  })
+})
+
+describe('detachOperator', () => {
+  it('revokes the token and removes the operator', async () => {
+    const client = mockClient()
+    const { service, store } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: { ...readyEnv },
+      [TILLIO_OPERATORS_INTEGRATION_ID]: {
+        operators: [{ id: 'ringostat-1', plugin: 'Ringostat', config: { key: 'x' }, token: 'tok-1', tenantDomain: 'app.example.com/OM-x-ringostat-1', envFingerprint: 'fp' }],
+        defaultOperatorId: 'ringostat-1',
+      },
+    })
+
+    const result = await detachOperator({ credentialsService: service, scope }, 'ringostat-1')
+
+    expect(result).toEqual({ ok: true, detached: true, revoked: true })
+    expect(client.deleteConfig).toHaveBeenCalledWith('Ringostat', 'tok-1', 'app.example.com/OM-x-ringostat-1')
+    const saved = store[TILLIO_OPERATORS_INTEGRATION_ID] as { operators: unknown[]; defaultOperatorId: string | null }
+    expect(saved.operators).toHaveLength(0)
+    expect(saved.defaultOperatorId).toBeNull()
+  })
+
+  it('is a no-op for an unknown operator id', async () => {
+    const client = mockClient()
+    const { service } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: { ...readyEnv },
+      [TILLIO_OPERATORS_INTEGRATION_ID]: { operators: [], defaultOperatorId: null },
+    })
+
+    const result = await detachOperator({ credentialsService: service, scope }, 'missing')
+
+    expect(result).toEqual({ ok: true, detached: false, revoked: false })
+    expect(client.deleteConfig).not.toHaveBeenCalled()
+  })
+
+  it('keeps the operator when the provider refuses the revocation', async () => {
+    const providerMessage = 'provider response from https://internal.example.invalid: token secret-token'
+    mockClient({ deleteConfig: jest.fn().mockRejectedValue(new TillioApiError(providerMessage, 422, 'invalid')) })
+    const { service, store } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: { ...readyEnv },
+      [TILLIO_OPERATORS_INTEGRATION_ID]: {
+        operators: [{ id: 'ringostat-1', plugin: 'Ringostat', config: { key: 'x' }, token: 'tok-1', tenantDomain: 'd', envFingerprint: 'fp' }],
+        defaultOperatorId: 'ringostat-1',
+      },
+    })
+
+    await expect(detachOperator({ credentialsService: service, scope }, 'ringostat-1'))
+      .rejects.toMatchObject({
+        name: 'TillioRevocationFailedError',
+        environmentMissing: false,
+        message: 'Tillio did not confirm the operator token was revoked.',
+      })
+
+    const saved = store[TILLIO_OPERATORS_INTEGRATION_ID] as { operators: unknown[] }
+    expect(saved.operators).toHaveLength(1)
+  })
+
+  it('keeps the operator when the environment is gone, so the token is not orphaned silently', async () => {
+    const client = mockClient()
+    const { service, store } = fakeStore({
+      [TILLIO_OPERATORS_INTEGRATION_ID]: {
+        operators: [{ id: 'ringostat-1', plugin: 'Ringostat', config: { key: 'x' }, token: 'tok-1', tenantDomain: 'd', envFingerprint: 'fp' }],
+        defaultOperatorId: 'ringostat-1',
+      },
+    })
+
+    await expect(detachOperator({ credentialsService: service, scope }, 'ringostat-1'))
+      .rejects.toMatchObject({ name: 'TillioRevocationFailedError', environmentMissing: true })
+
+    expect(client.deleteConfig).not.toHaveBeenCalled()
+    const saved = store[TILLIO_OPERATORS_INTEGRATION_ID] as { operators: unknown[] }
+    expect(saved.operators).toHaveLength(1)
+  })
+
+  it('removes the operator on a forced detach and reports the token was not revoked', async () => {
+    mockClient({ deleteConfig: jest.fn().mockRejectedValue(new TillioApiError('nope', 422, 'invalid')) })
+    const { service, store } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: { ...readyEnv },
+      [TILLIO_OPERATORS_INTEGRATION_ID]: {
+        operators: [{ id: 'ringostat-1', plugin: 'Ringostat', config: { key: 'x' }, token: 'tok-1', tenantDomain: 'd', envFingerprint: 'fp' }],
+        defaultOperatorId: 'ringostat-1',
+      },
+    })
+
+    const result = await detachOperator({ credentialsService: service, scope }, 'ringostat-1', { force: true })
+
+    expect(result).toEqual({ ok: true, detached: true, revoked: false })
+    const saved = store[TILLIO_OPERATORS_INTEGRATION_ID] as { operators: unknown[] }
+    expect(saved.operators).toHaveLength(0)
+  })
+})
+
+describe('classifyTillioError', () => {
+  it('attributes transport/auth failures to the environment', () => {
+    expect(classifyTillioError(new TillioApiError('x', 0, 'network'))).toBe('environment')
+    expect(classifyTillioError(new TillioApiError('x', 401, 'unauthorized'))).toBe('environment')
+    expect(classifyTillioError(new TillioApiError('x', 403, 'forbidden'))).toBe('environment')
+  })
+
+  it('attributes config failures to the operator', () => {
+    expect(classifyTillioError(new TillioApiError('x', 422, 'invalid'))).toBe('operator')
+    expect(classifyTillioError(new Error('boom'))).toBe('operator')
+  })
+})

package/src/modules/tillio/__tests__/preset.test.ts

@@ -0,0 +1,337 @@
+import { TILLIO_INTEGRATION_ID } from '../integration'
+import { TillioOperatorLimitError } from '../lib/operators'
+import { TILLIO_OPERATORS_INTEGRATION_ID, type TillioCredentialsService } from '../lib/operators-store'
+import { applyTillioEnvPreset, readTillioEnvPreset, TILLIO_ENV_VARS } from '../lib/preset'
+
+jest.mock('../lib/operators', () => ({
+  ...jest.requireActual('../lib/operators'),
+  attachOperator: jest.fn(),
+  detachOperator: jest.fn(),
+}))
+
+const { attachOperator, detachOperator } = jest.requireMock('../lib/operators')
+
+const otherEnvironment = { apiUrl: 'https://other.example.com', apiKey: 'other-key' }
+
+const attachedOperator = {
+  id: 'ringostat-1',
+  plugin: 'Ringostat' as const,
+  config: { key: 'old' },
+  token: 'tok-old',
+  tenantDomain: 'tenant.example.com',
+  envFingerprint: 'fp-old',
+}
+
+const scope = { tenantId: 'tn', organizationId: 'org' }
+
+const completeEnv = {
+  [TILLIO_ENV_VARS.apiUrl]: 'https://api.example.com',
+  [TILLIO_ENV_VARS.apiKey]: 'key-1',
+} as NodeJS.ProcessEnv
+
+function fakeStore(initial: Record<string, Record<string, unknown> | null> = {}): {
+  service: TillioCredentialsService
+  store: Record<string, Record<string, unknown> | null>
+} {
+  const store: Record<string, Record<string, unknown> | null> = { ...initial }
+  return {
+    store,
+    service: {
+      getRaw: jest.fn(async (id: string) => store[id] ?? null),
+      save: jest.fn(async (id: string, credentials: Record<string, unknown>) => {
+        store[id] = credentials
+      }),
+    },
+  }
+}
+
+function fakeServices(healthStatus = 'healthy') {
+  return {
+    integrationStateService: { upsert: jest.fn().mockResolvedValue(undefined) },
+    integrationHealthService: { runHealthCheck: jest.fn().mockResolvedValue({ status: healthStatus }) },
+  }
+}
+
+beforeEach(() => {
+  attachOperator.mockReset()
+  attachOperator.mockResolvedValue({ id: 'ringostat-1' })
+  detachOperator.mockReset()
+  detachOperator.mockResolvedValue({ ok: true, detached: true, revoked: true })
+})
+
+describe('readTillioEnvPreset', () => {
+  it('reports absent when no Tillio variable is set', () => {
+    expect(readTillioEnvPreset({} as NodeJS.ProcessEnv)).toEqual({ status: 'absent' })
+  })
+
+  it('names the missing variable when the preset is half configured', () => {
+    const preset = readTillioEnvPreset({ [TILLIO_ENV_VARS.apiUrl]: 'https://api.example.com' } as NodeJS.ProcessEnv)
+
+    expect(preset).toEqual({ status: 'incomplete', missing: [TILLIO_ENV_VARS.apiKey] })
+  })
+
+  it('treats a blank value as unset', () => {
+    const preset = readTillioEnvPreset({ ...completeEnv, [TILLIO_ENV_VARS.apiKey]: '   ' } as NodeJS.ProcessEnv)
+
+    expect(preset).toEqual({ status: 'incomplete', missing: [TILLIO_ENV_VARS.apiKey] })
+  })
+
+  it('carries a configured time zone into the credentials and rejects an invalid one', () => {
+    const preset = readTillioEnvPreset({ ...completeEnv, [TILLIO_ENV_VARS.timeZone]: 'America/New_York' } as NodeJS.ProcessEnv)
+
+    expect(preset).toMatchObject({ credentials: { timeZone: 'America/New_York' } })
+    expect(() => readTillioEnvPreset({ ...completeEnv, [TILLIO_ENV_VARS.timeZone]: 'Europe/Atlantis' } as NodeJS.ProcessEnv))
+      .toThrow()
+  })
+
+  it('reads a complete preset with the operator key and the force flag', () => {
+    const preset = readTillioEnvPreset({
+      ...completeEnv,
+      [TILLIO_ENV_VARS.ringostatKey]: 'ringostat-key',
+      [TILLIO_ENV_VARS.force]: 'true',
+    } as NodeJS.ProcessEnv)
+
+    expect(preset).toEqual({
+      status: 'ready',
+      credentials: { apiUrl: 'https://api.example.com', apiKey: 'key-1' },
+      ringostatKey: 'ringostat-key',
+      force: true,
+      replaceOperator: false,
+    })
+  })
+})
+
+describe('applyTillioEnvPreset', () => {
+  it('saves credentials, enables the integration and runs the health check', async () => {
+    const { service, store } = fakeStore()
+    const services = fakeServices()
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...services,
+      scope,
+      env: completeEnv,
+    })
+
+    expect(result).toEqual({
+      status: 'applied',
+      credentialsAction: 'saved',
+      health: 'healthy',
+      operator: 'not-requested',
+    })
+    expect(store[TILLIO_INTEGRATION_ID]).toEqual({ apiUrl: 'https://api.example.com', apiKey: 'key-1' })
+    expect(services.integrationStateService.upsert).toHaveBeenCalledWith(
+      TILLIO_INTEGRATION_ID,
+      { isEnabled: true },
+      scope,
+    )
+    expect(services.integrationHealthService.runHealthCheck).toHaveBeenCalledWith(TILLIO_INTEGRATION_ID, scope)
+    expect(attachOperator).not.toHaveBeenCalled()
+  })
+
+  it('attaches the operator through the same call the UI route makes', async () => {
+    const { service } = fakeStore()
+    const services = fakeServices()
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...services,
+      scope,
+      appUrl: 'https://app.example.com',
+      env: { ...completeEnv, [TILLIO_ENV_VARS.ringostatKey]: 'ringostat-key' },
+    })
+
+    expect(result).toMatchObject({ operator: 'attached' })
+    expect(attachOperator).toHaveBeenCalledWith(
+      {
+        credentialsService: service,
+        scope,
+        appUrl: 'https://app.example.com',
+        withLock: expect.any(Function),
+      },
+      { plugin: 'Ringostat', config: { key: 'ringostat-key' } },
+    )
+  })
+
+  it('reports the operator as kept when the slot is already taken', async () => {
+    attachOperator.mockRejectedValue(new TillioOperatorLimitError())
+    const { service } = fakeStore()
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices(),
+      scope,
+      appUrl: 'https://app.example.com',
+      env: { ...completeEnv, [TILLIO_ENV_VARS.ringostatKey]: 'ringostat-key' },
+    })
+
+    expect(result).toMatchObject({ operator: 'kept' })
+  })
+
+  it('does not attach against an environment the health check rejected', async () => {
+    const { service } = fakeStore()
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices('unhealthy'),
+      scope,
+      appUrl: 'https://app.example.com',
+      env: { ...completeEnv, [TILLIO_ENV_VARS.ringostatKey]: 'ringostat-key' },
+    })
+
+    expect(result).toMatchObject({ health: 'unhealthy', operator: 'failed' })
+    expect(attachOperator).not.toHaveBeenCalled()
+  })
+
+  it('writes nothing on an incomplete preset and reports the missing variable', async () => {
+    const { service } = fakeStore()
+    const services = fakeServices()
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...services,
+      scope,
+      env: { [TILLIO_ENV_VARS.apiKey]: 'key-1' } as NodeJS.ProcessEnv,
+    })
+
+    expect(result).toEqual({
+      status: 'skipped',
+      reason: `Incomplete Tillio env preset; missing ${TILLIO_ENV_VARS.apiUrl}.`,
+    })
+    expect(service.save).not.toHaveBeenCalled()
+    expect(services.integrationStateService.upsert).not.toHaveBeenCalled()
+    expect(services.integrationHealthService.runHealthCheck).not.toHaveBeenCalled()
+  })
+
+  it('keeps credentials that already exist unless forced', async () => {
+    const existing = { apiUrl: 'https://rotated.example.com', apiKey: 'rotated' }
+    const { service, store } = fakeStore({ [TILLIO_INTEGRATION_ID]: existing })
+
+    const kept = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices(),
+      scope,
+      env: completeEnv,
+    })
+
+    expect(kept).toMatchObject({ credentialsAction: 'kept' })
+    expect(store[TILLIO_INTEGRATION_ID]).toEqual(existing)
+
+    const forced = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices(),
+      scope,
+      env: { ...completeEnv, [TILLIO_ENV_VARS.force]: 'true' },
+    })
+
+    expect(forced).toMatchObject({ credentialsAction: 'saved' })
+    expect(store[TILLIO_INTEGRATION_ID]).toEqual({ apiUrl: 'https://api.example.com', apiKey: 'key-1' })
+  })
+
+  it('refuses to switch environments while an operator is attached', async () => {
+    const { service, store } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: otherEnvironment,
+      [TILLIO_OPERATORS_INTEGRATION_ID]: { operators: [attachedOperator], defaultOperatorId: attachedOperator.id },
+    })
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices(),
+      scope,
+      appUrl: 'https://app.example.com',
+      env: {
+        ...completeEnv,
+        [TILLIO_ENV_VARS.ringostatKey]: 'ringostat-key',
+        [TILLIO_ENV_VARS.force]: 'true',
+      },
+    })
+
+    expect(result.status).toBe('blocked')
+    expect(detachOperator).not.toHaveBeenCalled()
+    expect(store[TILLIO_INTEGRATION_ID]).toEqual(otherEnvironment)
+  })
+
+  it('revokes the attached operator before the switch once it is confirmed', async () => {
+    const { service, store } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: otherEnvironment,
+      [TILLIO_OPERATORS_INTEGRATION_ID]: { operators: [attachedOperator], defaultOperatorId: attachedOperator.id },
+    })
+    const confirmOperatorReplacement = jest.fn().mockResolvedValue(true)
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices(),
+      scope,
+      appUrl: 'https://app.example.com',
+      confirmOperatorReplacement,
+      env: {
+        ...completeEnv,
+        [TILLIO_ENV_VARS.ringostatKey]: 'ringostat-key',
+        [TILLIO_ENV_VARS.force]: 'true',
+      },
+    })
+
+    expect(confirmOperatorReplacement).toHaveBeenCalledWith(attachedOperator)
+    // Revoked while the old credentials are still stored, otherwise the token cannot be revoked at all.
+    expect(detachOperator.mock.invocationCallOrder[0])
+      .toBeLessThan((service.save as jest.Mock).mock.invocationCallOrder.at(-1) as number)
+    expect(store[TILLIO_INTEGRATION_ID]).toEqual({ apiUrl: 'https://api.example.com', apiKey: 'key-1' })
+    expect(result).toMatchObject({ credentialsAction: 'saved', operator: 'attached' })
+  })
+
+  it('takes the env variable as the answer for unattended runs', async () => {
+    const { service } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: otherEnvironment,
+      [TILLIO_OPERATORS_INTEGRATION_ID]: { operators: [attachedOperator], defaultOperatorId: attachedOperator.id },
+    })
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices(),
+      scope,
+      appUrl: 'https://app.example.com',
+      env: {
+        ...completeEnv,
+        [TILLIO_ENV_VARS.ringostatKey]: 'ringostat-key',
+        [TILLIO_ENV_VARS.force]: 'true',
+        [TILLIO_ENV_VARS.replaceOperator]: 'true',
+      },
+    })
+
+    expect(detachOperator).toHaveBeenCalled()
+    expect(result).toMatchObject({ operator: 'attached' })
+  })
+
+  it('refuses the switch when no key is available to reattach the operator', async () => {
+    const { service } = fakeStore({
+      [TILLIO_INTEGRATION_ID]: otherEnvironment,
+      [TILLIO_OPERATORS_INTEGRATION_ID]: { operators: [attachedOperator], defaultOperatorId: attachedOperator.id },
+    })
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...fakeServices(),
+      scope,
+      env: { ...completeEnv, [TILLIO_ENV_VARS.force]: 'true', [TILLIO_ENV_VARS.replaceOperator]: 'true' },
+    })
+
+    expect(result.status).toBe('blocked')
+    expect(detachOperator).not.toHaveBeenCalled()
+  })
+
+  it('leaves the operator store untouched when no preset is present', async () => {
+    const { service } = fakeStore()
+    const services = fakeServices()
+
+    const result = await applyTillioEnvPreset({
+      credentialsService: service,
+      ...services,
+      scope,
+      env: {} as NodeJS.ProcessEnv,
+    })
+
+    expect(result.status).toBe('skipped')
+    expect(service.save).not.toHaveBeenCalled()
+    expect(service.getRaw).not.toHaveBeenCalledWith(TILLIO_OPERATORS_INTEGRATION_ID, scope)
+  })
+})

package/src/modules/tillio/__tests__/pull-body.test.ts

@@ -0,0 +1,43 @@
+import { pullBodySchema } from '../api/pull/route'
+
+const validBody = { from: '2026-05-01', to: '2026-05-31' }
+
+describe('pullBodySchema', () => {
+  it('accepts a well-formed day range', () => {
+    expect(pullBodySchema.safeParse(validBody).success).toBe(true)
+  })
+
+  it('rejects days that look right but are not on the calendar', () => {
+    for (const day of ['2026-02-30', '2026-04-31', '2026-06-31', '2026-09-31', '2026-11-31']) {
+      expect(pullBodySchema.safeParse({ ...validBody, from: day }).success).toBe(false)
+      expect(pullBodySchema.safeParse({ ...validBody, to: day }).success).toBe(false)
+    }
+  })
+
+  it('rejects out-of-range month and day numbers', () => {
+    for (const day of ['2026-99-99', '2026-13-01', '2026-00-10', '2026-01-00', '2026-01-32']) {
+      expect(pullBodySchema.safeParse({ ...validBody, from: day }).success).toBe(false)
+    }
+  })
+
+  it('follows the leap year rule for February 29th', () => {
+    expect(pullBodySchema.safeParse({ from: '2024-02-29', to: '2024-02-29' }).success).toBe(true)
+    expect(pullBodySchema.safeParse({ from: '2025-02-29', to: '2025-02-29' }).success).toBe(false)
+    expect(pullBodySchema.safeParse({ from: '2000-02-29', to: '2000-02-29' }).success).toBe(true)
+    expect(pullBodySchema.safeParse({ from: '1900-02-29', to: '1900-02-29' }).success).toBe(false)
+  })
+
+  it('rejects shapes that are not a plain day', () => {
+    for (const day of ['2026-5-1', '26-05-01', '2026-05-01T00:00:00Z', '2026-05-01 ', '']) {
+      expect(pullBodySchema.safeParse({ ...validBody, from: day }).success).toBe(false)
+    }
+  })
+
+  it('rejects a range that ends before it starts', () => {
+    expect(pullBodySchema.safeParse({ from: '2026-05-31', to: '2026-05-01' }).success).toBe(false)
+  })
+
+  it('accepts a single-day range', () => {
+    expect(pullBodySchema.safeParse({ from: '2026-05-01', to: '2026-05-01' }).success).toBe(true)
+  })
+})