@openparachute/hub 0.6.4-rc.3 → 0.6.4-rc.5

package/src/__tests__/account-mirror.test.ts

@@ -0,0 +1,156 @@
+/**
+ * Unit tests for the `/account/` per-vault backup (mirror) status fetch +
+ * formatting (`account-mirror.ts`). The fetch mints an admin-scoped token + hits
+ * the vault's loopback `/.parachute/mirror` endpoint; it must be fault-tolerant
+ * (any failure → null) and shape-strict (a malformed body → null, not a render
+ * of `undefined`). Mirrors `account-usage.test.ts`'s posture.
+ */
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  type VaultMirrorStat,
+  fetchVaultMirrorStatus,
+  formatMirrorLine,
+} from "../account-mirror.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+
+interface Harness {
+  db: Database;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-account-mirror-"));
+  const db = openHubDb(hubDbPath(dir));
+  return {
+    db,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+/** A stub signer — no real key needed; the fetch only carries the token string. */
+const stubSign = async () => ({
+  token: "stub.jwt.token",
+  jti: "jti-1",
+  expiresAt: new Date(Date.now() + 60000).toISOString(),
+});
+
+function baseDeps(fetchImpl: typeof fetch) {
+  return {
+    db: harness.db,
+    hubOrigin: "https://hub.test",
+    vaultPort: 1940,
+    userId: "user-1",
+    fetchImpl,
+    signToken: stubSign as never,
+  };
+}
+
+describe("fetchVaultMirrorStatus", () => {
+  test("returns enabled+not-pushing on a backed-up, local-only config", async () => {
+    const fetchImpl = (async () =>
+      new Response(
+        JSON.stringify({
+          config: { enabled: true, location: "internal", auto_push: false },
+          status: { enabled: true, last_commit_sha: "abc", last_error: null },
+        }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      )) as unknown as typeof fetch;
+    const stat = await fetchVaultMirrorStatus("work", baseDeps(fetchImpl));
+    expect(stat).toEqual({ enabled: true, backedUpToRemote: false });
+  });
+
+  test("flags pushing when auto_push is configured", async () => {
+    const fetchImpl = (async () =>
+      new Response(
+        JSON.stringify({ config: { enabled: true, location: "internal", auto_push: true } }),
+        { status: 200 },
+      )) as unknown as typeof fetch;
+    const stat = await fetchVaultMirrorStatus("work", baseDeps(fetchImpl));
+    expect(stat).toEqual({ enabled: true, backedUpToRemote: true });
+  });
+
+  test("returns enabled:false when backup is off", async () => {
+    const fetchImpl = (async () =>
+      new Response(JSON.stringify({ config: { enabled: false, auto_push: false } }), {
+        status: 200,
+      })) as unknown as typeof fetch;
+    const stat = await fetchVaultMirrorStatus("work", baseDeps(fetchImpl));
+    expect(stat).toEqual({ enabled: false, backedUpToRemote: false });
+  });
+
+  test("mints an ADMIN-scoped Bearer + hits the vault's loopback mirror endpoint", async () => {
+    let seenUrl = "";
+    let seenAuth = "";
+    let seenScope: string[] = [];
+    const captureSign = (async (_db: unknown, opts: { scopes: string[] }) => {
+      seenScope = opts.scopes;
+      return { token: "stub.jwt.token", jti: "j", expiresAt: new Date().toISOString() };
+    }) as never;
+    const fetchImpl = (async (url: string, init?: RequestInit) => {
+      seenUrl = url;
+      seenAuth = (init?.headers as Record<string, string>)?.authorization ?? "";
+      return new Response(JSON.stringify({ config: { enabled: true, auto_push: false } }), {
+        status: 200,
+      });
+    }) as unknown as typeof fetch;
+    await fetchVaultMirrorStatus("work", { ...baseDeps(fetchImpl), signToken: captureSign });
+    expect(seenUrl).toBe("http://127.0.0.1:1940/vault/work/.parachute/mirror");
+    expect(seenAuth).toBe("Bearer stub.jwt.token");
+    expect(seenScope).toEqual(["vault:work:admin"]);
+  });
+
+  test("returns null on a non-2xx response (vault down / 403 / 404)", async () => {
+    for (const status of [403, 404, 500]) {
+      const fetchImpl = (async () => new Response("nope", { status })) as unknown as typeof fetch;
+      const stat = await fetchVaultMirrorStatus("work", baseDeps(fetchImpl));
+      expect(stat).toBeNull();
+    }
+  });
+
+  test("returns null when the body is malformed (missing config.enabled)", async () => {
+    const fetchImpl = (async () =>
+      new Response(JSON.stringify({ config: {} }), { status: 200 })) as unknown as typeof fetch;
+    const stat = await fetchVaultMirrorStatus("work", baseDeps(fetchImpl));
+    expect(stat).toBeNull();
+  });
+
+  test("returns null when fetch throws (network error)", async () => {
+    const fetchImpl = (async () => {
+      throw new Error("ECONNREFUSED");
+    }) as unknown as typeof fetch;
+    const stat = await fetchVaultMirrorStatus("work", baseDeps(fetchImpl));
+    expect(stat).toBeNull();
+  });
+});
+
+describe("formatMirrorLine", () => {
+  test("warm plain-language line; GitHub variant when pushing", () => {
+    expect(formatMirrorLine({ enabled: true, backedUpToRemote: false } as VaultMirrorStat)).toBe(
+      "Backed up — full version history",
+    );
+    expect(formatMirrorLine({ enabled: true, backedUpToRemote: true } as VaultMirrorStat)).toBe(
+      "Backed up — version history + GitHub",
+    );
+  });
+
+  test("returns null when backup is off (the tile omits the line, never nags)", () => {
+    expect(
+      formatMirrorLine({ enabled: false, backedUpToRemote: false } as VaultMirrorStat),
+    ).toBeNull();
+  });
+});

package/src/__tests__/api-account.test.ts

@@ -922,7 +922,7 @@ describe("handleAccountHomeGet", () => {
     expect(html).not.toContain('data-testid="vault-usage"');
   });
 
-  test("renders the 'Configure / back up this vault ↗' deep-link button for an assigned vault", async () => {
+  test("renders the 'Advanced vault settings ↗' deep-link button for an assigned vault", async () => {
     await createUser(harness.db, "admin", "admin-passphrase", { passwordChanged: true });
     const friend = await createUser(harness.db, "alice", "alice-passphrase", {
       allowMulti: true,
@@ -936,6 +936,56 @@ describe("handleAccountHomeGet", () => {
     expect(res.status).toBe(200);
     const html = await res.text();
     expect(html).toContain('data-testid="vault-admin-button"');
+    expect(html).toContain("Advanced vault settings");
     expect(html).toContain('action="/account/vault-admin-token/alice"');
   });
+
+  test("renders the backup-state line when the mirror status resolves enabled", async () => {
+    await createUser(harness.db, "admin", "admin-passphrase", { passwordChanged: true });
+    const friend = await createUser(harness.db, "alice", "alice-passphrase", {
+      allowMulti: true,
+      passwordChanged: true,
+      assignedVaults: ["alice"],
+    });
+    const session = createSession(harness.db, { userId: friend.id });
+    const cookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000));
+    const req = new Request(`${HUB_ORIGIN}/account/`, { headers: { cookie } });
+    const res = await handleAccountHomeGet(req, {
+      db: harness.db,
+      hubOrigin: HUB_ORIGIN,
+      resolveVaultPort: () => 1940,
+      // Stub the mirror fetch: resolves to a backed-up, GitHub-pushing config.
+      fetchMirror: async () => ({ enabled: true, backedUpToRemote: true }),
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain('data-testid="backup-state-line"');
+    // Already pushing → the handler threads mirrorPushing=true, so the
+    // "Back up to GitHub ↗" action is suppressed.
+    expect(html).not.toContain('data-testid="backup-github-button"');
+    expect(html).toContain("version history + GitHub");
+  });
+
+  test("omits the backup line gracefully when the mirror fetch fails (null)", async () => {
+    await createUser(harness.db, "admin", "admin-passphrase", { passwordChanged: true });
+    const friend = await createUser(harness.db, "alice", "alice-passphrase", {
+      allowMulti: true,
+      passwordChanged: true,
+      assignedVaults: ["alice"],
+    });
+    const session = createSession(harness.db, { userId: friend.id });
+    const cookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000));
+    const req = new Request(`${HUB_ORIGIN}/account/`, { headers: { cookie } });
+    const res = await handleAccountHomeGet(req, {
+      db: harness.db,
+      hubOrigin: HUB_ORIGIN,
+      resolveVaultPort: () => 1940,
+      fetchMirror: async () => null,
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Tile still renders; just no backup line.
+    expect(html).toContain("<strong>alice</strong>");
+    expect(html).not.toContain('data-testid="backup-state-line"');
+  });
 });

package/src/__tests__/grants.test.ts

@@ -11,6 +11,7 @@ import {
   listGrantsForUser,
   recordGrant,
   revokeGrant,
+  userHasVaultGrant,
 } from "../grants.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { createUser } from "../users.ts";
@@ -177,7 +178,13 @@ describe("findGrantByClientName / isCoveredByGrantForClientName (hub#409)", () =
         redirectUris: ["https://app.example/cb"],
         clientName: "claude-code",
       });
-      recordGrant(h.db, h.userId, reg1.client.clientId, ["a", "b"], new Date("2026-04-10T00:00:00Z"));
+      recordGrant(
+        h.db,
+        h.userId,
+        reg1.client.clientId,
+        ["a", "b"],
+        new Date("2026-04-10T00:00:00Z"),
+      );
       // Second DCR: same client_name="claude-code", fresh client_id, no grant yet
       const reg2 = registerClient(h.db, {
         redirectUris: ["https://app.example/cb"],
@@ -249,8 +256,20 @@ describe("findGrantByClientName / isCoveredByGrantForClientName (hub#409)", () =
         clientName: "claude-code",
       });
       recordGrant(h.db, h.userId, reg1.client.clientId, ["a"], new Date("2026-04-01T00:00:00Z"));
-      recordGrant(h.db, h.userId, reg3.client.clientId, ["a", "c"], new Date("2026-04-15T00:00:00Z"));
-      recordGrant(h.db, h.userId, reg2.client.clientId, ["a", "b"], new Date("2026-04-10T00:00:00Z"));
+      recordGrant(
+        h.db,
+        h.userId,
+        reg3.client.clientId,
+        ["a", "c"],
+        new Date("2026-04-15T00:00:00Z"),
+      );
+      recordGrant(
+        h.db,
+        h.userId,
+        reg2.client.clientId,
+        ["a", "b"],
+        new Date("2026-04-10T00:00:00Z"),
+      );
       const grant = findGrantByClientName(h.db, h.userId, "claude-code");
       // Most recent = reg3's grant (2026-04-15)
       expect(grant?.clientId).toBe(reg3.client.clientId);
@@ -267,9 +286,19 @@ describe("findGrantByClientName / isCoveredByGrantForClientName (hub#409)", () =
         redirectUris: ["https://app.example/cb"],
         clientName: "claude-code",
       });
-      recordGrant(h.db, h.userId, reg.client.clientId, ["vault:default:read", "vault:default:write"]);
-      expect(isCoveredByGrantForClientName(h.db, h.userId, "claude-code", ["vault:default:read"])).toBe(true);
-      expect(isCoveredByGrantForClientName(h.db, h.userId, "claude-code", ["vault:default:read", "vault:default:write"])).toBe(true);
+      recordGrant(h.db, h.userId, reg.client.clientId, [
+        "vault:default:read",
+        "vault:default:write",
+      ]);
+      expect(
+        isCoveredByGrantForClientName(h.db, h.userId, "claude-code", ["vault:default:read"]),
+      ).toBe(true);
+      expect(
+        isCoveredByGrantForClientName(h.db, h.userId, "claude-code", [
+          "vault:default:read",
+          "vault:default:write",
+        ]),
+      ).toBe(true);
     } finally {
       h.cleanup();
     }
@@ -284,8 +313,15 @@ describe("findGrantByClientName / isCoveredByGrantForClientName (hub#409)", () =
       });
       recordGrant(h.db, h.userId, reg.client.clientId, ["vault:default:read"]);
       // Asking for write — not previously granted
-      expect(isCoveredByGrantForClientName(h.db, h.userId, "claude-code", ["vault:default:write"])).toBe(false);
-      expect(isCoveredByGrantForClientName(h.db, h.userId, "claude-code", ["vault:default:read", "vault:default:write"])).toBe(false);
+      expect(
+        isCoveredByGrantForClientName(h.db, h.userId, "claude-code", ["vault:default:write"]),
+      ).toBe(false);
+      expect(
+        isCoveredByGrantForClientName(h.db, h.userId, "claude-code", [
+          "vault:default:read",
+          "vault:default:write",
+        ]),
+      ).toBe(false);
     } finally {
       h.cleanup();
     }
@@ -304,4 +340,58 @@ describe("findGrantByClientName / isCoveredByGrantForClientName (hub#409)", () =
       h.cleanup();
     }
   });
+
+  // --- userHasVaultGrant (onboarding "has connected an AI?" signal) --------
+
+  test("userHasVaultGrant: false when the user has no grants at all", async () => {
+    const h = await harness();
+    try {
+      expect(userHasVaultGrant(h.db, h.userId, "default")).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("userHasVaultGrant: true when a grant's scopes touch the vault", async () => {
+    const h = await harness();
+    try {
+      recordGrant(h.db, h.userId, h.clientId, ["vault:default:read", "vault:default:write"]);
+      expect(userHasVaultGrant(h.db, h.userId, "default")).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("userHasVaultGrant: false when the grant touches a DIFFERENT vault", async () => {
+    const h = await harness();
+    try {
+      recordGrant(h.db, h.userId, h.clientId, ["vault:work:read"]);
+      expect(userHasVaultGrant(h.db, h.userId, "default")).toBe(false);
+      expect(userHasVaultGrant(h.db, h.userId, "work")).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("userHasVaultGrant: non-vault scopes don't count as a connection", async () => {
+    const h = await harness();
+    try {
+      recordGrant(h.db, h.userId, h.clientId, ["parachute:host:auth", "vault:read"]);
+      // `vault:read` (no name segment) is a generic scope, not vault:<name>:.
+      expect(userHasVaultGrant(h.db, h.userId, "default")).toBe(false);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("userHasVaultGrant: prefix isn't substring-fooled (vault:default-2 ≠ default)", async () => {
+    const h = await harness();
+    try {
+      recordGrant(h.db, h.userId, h.clientId, ["vault:default-2:read"]);
+      expect(userHasVaultGrant(h.db, h.userId, "default")).toBe(false);
+      expect(userHasVaultGrant(h.db, h.userId, "default-2")).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
 });