@pikku/core 0.12.79 → 0.12.80

package/src/testing/service-tests/credential-service-tests.ts

@@ -0,0 +1,143 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import type { ServiceTestConfig } from '../service-tests.js'
+
+/** Conformance suite for `credentialService`. Runs only when a backend supplies one. */
+export const defineCredentialServiceTests = (
+  name: string,
+  credentialService: NonNullable<
+    ServiceTestConfig['services']['credentialService']
+  >
+): void => {
+  const factory = credentialService
+  const kek = 'test-key-encryption-key-32chars!'
+
+  describe(`CredentialService [${name}]`, () => {
+    test('set and get (global)', async () => {
+      const service = await factory({ key: kek })
+      await service.set('stripe', { apiKey: 'sk-123' })
+      const result = await service.get<{ apiKey: string }>('stripe')
+      assert.deepEqual(result, { apiKey: 'sk-123' })
+    })
+
+    test('get returns null for missing', async () => {
+      const service = await factory({ key: kek })
+      const result = await service.get('nonexistent')
+      assert.equal(result, null)
+    })
+
+    test('has returns true/false', async () => {
+      const service = await factory({ key: kek })
+      await service.set('exists', { key: 'val' })
+      assert.strictEqual(await service.has('exists'), true)
+      assert.strictEqual(await service.has('nope'), false)
+    })
+
+    test('set upserts existing credential', async () => {
+      const service = await factory({ key: kek })
+      await service.set('upsert', { v: 1 })
+      await service.set('upsert', { v: 2 })
+      const result = await service.get<{ v: number }>('upsert')
+      assert.deepEqual(result, { v: 2 })
+    })
+
+    test('delete removes credential', async () => {
+      const service = await factory({ key: kek })
+      await service.set('to-delete', { bye: true })
+      assert.strictEqual(await service.has('to-delete'), true)
+      await service.delete('to-delete')
+      assert.strictEqual(await service.has('to-delete'), false)
+    })
+
+    test('per-user isolation', async () => {
+      const service = await factory({ key: kek })
+      await service.set('token', { access: 'user1' }, 'user-1')
+      await service.set('token', { access: 'user2' }, 'user-2')
+
+      const u1 = await service.get<{ access: string }>('token', 'user-1')
+      const u2 = await service.get<{ access: string }>('token', 'user-2')
+      assert.deepEqual(u1, { access: 'user1' })
+      assert.deepEqual(u2, { access: 'user2' })
+    })
+
+    test('per-user delete does not affect other users', async () => {
+      const service = await factory({ key: kek })
+      await service.set('cred', { val: 'a' }, 'user-a')
+      await service.set('cred', { val: 'b' }, 'user-b')
+
+      await service.delete('cred', 'user-a')
+      assert.strictEqual(await service.has('cred', 'user-a'), false)
+      assert.strictEqual(await service.has('cred', 'user-b'), true)
+    })
+
+    test('global and per-user are separate', async () => {
+      const service = await factory({ key: kek })
+      await service.set('shared', { scope: 'global' })
+      await service.set('shared', { scope: 'user' }, 'user-1')
+
+      const global = await service.get<{ scope: string }>('shared')
+      const perUser = await service.get<{ scope: string }>('shared', 'user-1')
+      assert.deepEqual(global, { scope: 'global' })
+      assert.deepEqual(perUser, { scope: 'user' })
+    })
+
+    test('getAll returns all credentials for a user', async () => {
+      const service = await factory({ key: kek })
+      await service.set('cred-a', { a: 1 }, 'user-x')
+      await service.set('cred-b', { b: 2 }, 'user-x')
+      await service.set('cred-c', { c: 3 }, 'user-y')
+
+      const all = await service.getAll('user-x')
+      assert.deepEqual(all['cred-a'], { a: 1 })
+      assert.deepEqual(all['cred-b'], { b: 2 })
+      assert.strictEqual(all['cred-c'], undefined)
+    })
+
+    test('getAll returns empty for unknown user', async () => {
+      const service = await factory({ key: kek })
+      const all = await service.getAll('nobody')
+      assert.deepEqual(all, {})
+    })
+
+    test('rotateKEK re-wraps all credentials', async () => {
+      const newKEK = 'new-key-encryption-key-rotated!'
+      const oldService = await factory({ key: kek })
+      await oldService.set('rotate-cred', { important: 'data' }, 'user-r')
+
+      const rotatedService = await factory({
+        key: newKEK,
+        keyVersion: 2,
+        previousKey: kek,
+      })
+
+      const before = await rotatedService.get<{ important: string }>(
+        'rotate-cred',
+        'user-r'
+      )
+      assert.deepEqual(before, { important: 'data' })
+
+      assert.ok(rotatedService.rotateKEK)
+      const count = await rotatedService.rotateKEK!()
+      assert.ok(count > 0)
+
+      const newOnlyService = await factory({
+        key: newKEK,
+        keyVersion: 2,
+      })
+      const after = await newOnlyService.get<{ important: string }>(
+        'rotate-cred',
+        'user-r'
+      )
+      assert.deepEqual(after, { important: 'data' })
+    })
+
+    test('rotateKEK throws without previousKey', async () => {
+      const service = await factory({ key: kek })
+      assert.ok(service.rotateKEK)
+      await assert.rejects(() => service.rotateKEK!(), {
+        message: 'No previousKey configured — nothing to rotate from',
+      })
+    })
+  })
+}

package/src/testing/service-tests/deployment-service-tests.ts

@@ -0,0 +1,33 @@
+import { describe, test, before, after } from 'node:test'
+
+import type { DeploymentService } from '../../services/deployment-service.js'
+import type { ServiceTestConfig } from '../service-tests.js'
+
+/** Conformance suite for `deploymentService`. Runs only when a backend supplies one. */
+export const defineDeploymentServiceTests = (
+  name: string,
+  deploymentService: NonNullable<
+    ServiceTestConfig['services']['deploymentService']
+  >
+): void => {
+  const factory = deploymentService
+  describe(`DeploymentService [${name}]`, () => {
+    let service: DeploymentService & { stop(): Promise<void> }
+
+    before(async () => {
+      service = await factory()
+    })
+
+    after(async () => {
+      await service.stop()
+    })
+
+    test('start registers deployment', async () => {
+      await service.start({
+        deploymentId: 'deploy-1',
+        endpoint: 'http://localhost:3000',
+        functions: ['funcA', 'funcB'],
+      })
+    })
+  })
+}

package/src/testing/service-tests/event-hub-store-tests.ts

@@ -0,0 +1,48 @@
+import { describe, test, before } from 'node:test'
+import assert from 'node:assert/strict'
+
+import type { EventHubStore } from '../../wirings/channel/eventhub-store.js'
+import type { ServiceTestConfig } from '../service-tests.js'
+
+/** Conformance suite for `eventHubStore`. Runs only when a backend supplies one. */
+export const defineEventHubStoreTests = (
+  name: string,
+  eventHubStore: NonNullable<ServiceTestConfig['services']['eventHubStore']>
+): void => {
+  const factory = eventHubStore
+  describe(`EventHubStore [${name}]`, () => {
+    let store: EventHubStore<Record<string, any>>
+
+    before(async () => {
+      store = await factory()
+    })
+
+    test('subscribe and getChannelIdsForTopic', async () => {
+      const result = await store.subscribe('topic-1', 'ch-1')
+      assert.equal(result, true)
+
+      const ids = await store.getChannelIdsForTopic('topic-1')
+      assert.deepEqual(ids, ['ch-1'])
+    })
+
+    test('subscribe duplicate is idempotent', async () => {
+      const result = await store.subscribe('topic-1', 'ch-1')
+      assert.equal(result, true)
+    })
+
+    test('unsubscribe returns true when exists', async () => {
+      const result = await store.unsubscribe('topic-1', 'ch-1')
+      assert.equal(result, true)
+    })
+
+    test('unsubscribe returns false when not exists', async () => {
+      const result = await store.unsubscribe('topic-1', 'ch-1')
+      assert.equal(result, false)
+    })
+
+    test('getChannelIdsForTopic returns empty for unknown topic', async () => {
+      const ids = await store.getChannelIdsForTopic('unknown')
+      assert.deepEqual(ids, [])
+    })
+  })
+}

package/src/testing/service-tests/secret-service-tests.ts

@@ -0,0 +1,105 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import type { ServiceTestConfig } from '../service-tests.js'
+
+/** Conformance suite for `secretService`. Runs only when a backend supplies one. */
+export const defineSecretServiceTests = (
+  name: string,
+  secretService: NonNullable<ServiceTestConfig['services']['secretService']>
+): void => {
+  const factory = secretService
+  const kek = 'test-key-encryption-key-32chars!'
+
+  describe(`SecretService [${name}]`, () => {
+    test('setSecret and getSecret', async () => {
+      const service = await factory({ key: kek })
+      await service.setSecret('api-key', {
+        token: 'sk-123',
+        endpoint: 'https://api.example.com',
+      })
+      const result = await service.getSecret<{
+        token: string
+        endpoint: string
+      }>('api-key')
+      assert.deepEqual(result.reveal(), {
+        token: 'sk-123',
+        endpoint: 'https://api.example.com',
+      })
+    })
+
+    test('getSecret wraps the raw string rather than returning it', async () => {
+      const service = await factory({ key: kek })
+      await service.setSecret('string-secret', 'plain-value')
+      const result = await service.getSecret('string-secret')
+      assert.strictEqual(result.reveal(), 'plain-value')
+    })
+
+    test('hasSecret returns true/false', async () => {
+      const service = await factory({ key: kek })
+      assert.strictEqual(await service.hasSecret('api-key'), true)
+      assert.strictEqual(await service.hasSecret('nonexistent'), false)
+    })
+
+    test('getSecret throws for missing key', async () => {
+      const service = await factory({ key: kek })
+      await assert.rejects(() => service.getSecret('nonexistent'), {
+        message: 'Requested secret not found',
+      })
+    })
+
+    test('setSecret upserts existing key', async () => {
+      const service = await factory({ key: kek })
+      await service.setSecret('upsert-key', { v: 1 })
+      await service.setSecret('upsert-key', { v: 2 })
+      const result = await service.getSecret<{ v: number }>('upsert-key')
+      assert.deepEqual(result.reveal(), { v: 2 })
+    })
+
+    test('deleteSecret removes the key', async () => {
+      const service = await factory({ key: kek })
+      await service.setSecret('to-delete', 'bye')
+      assert.strictEqual(await service.hasSecret('to-delete'), true)
+      await service.deleteSecret('to-delete')
+      assert.strictEqual(await service.hasSecret('to-delete'), false)
+    })
+
+    test('rotateKEK re-wraps all secrets', async () => {
+      const newKEK = 'new-key-encryption-key-rotated!'
+      const oldService = await factory({ key: kek })
+      await oldService.setSecret('rotate-test', { important: 'data' })
+
+      const rotatedService = await factory({
+        key: newKEK,
+        keyVersion: 2,
+        previousKey: kek,
+      })
+
+      const before = await rotatedService.getSecret<{
+        important: string
+      }>('rotate-test')
+      assert.deepEqual(before.reveal(), { important: 'data' })
+
+      assert.ok(rotatedService.rotateKEK)
+      const count = await rotatedService.rotateKEK!()
+      assert.ok(count > 0)
+
+      const newOnlyService = await factory({
+        key: newKEK,
+        keyVersion: 2,
+      })
+      const after = await newOnlyService.getSecret<{
+        important: string
+      }>('rotate-test')
+      assert.deepEqual(after.reveal(), { important: 'data' })
+    })
+
+    test('rotateKEK throws without previousKey', async () => {
+      const service = await factory({ key: kek })
+      assert.ok(service.rotateKEK)
+      await assert.rejects(() => service.rotateKEK!(), {
+        message: 'No previousKey configured — nothing to rotate from',
+      })
+    })
+  })
+}

package/src/testing/service-tests/session-store-tests.ts

@@ -0,0 +1,62 @@
+import { describe, test, before } from 'node:test'
+import assert from 'node:assert/strict'
+
+import type { SessionStore } from '../../services/session-store.js'
+import type { CoreUserSession } from '../../types/core.types.js'
+import type { ServiceTestConfig } from '../service-tests.js'
+
+type AppSession = CoreUserSession & Record<string, unknown>
+
+/** Conformance suite for `sessionStore`. Runs only when a backend supplies one. */
+export const defineSessionStoreTests = (
+  name: string,
+  sessionStore: NonNullable<ServiceTestConfig['services']['sessionStore']>
+): void => {
+  const factory = sessionStore
+  describe(`SessionStore [${name}]`, () => {
+    let store: SessionStore
+
+    before(async () => {
+      store = await factory()
+    })
+
+    test('get returns undefined for unknown user', async () => {
+      const result = await store.get('unknown-user')
+      assert.equal(result, undefined)
+    })
+
+    test('set and get round-trip', async () => {
+      const session: AppSession = {
+        userId: 'user-1',
+        organizationId: 'org-1',
+      }
+      await store.set('user-1', session)
+
+      const result = await store.get('user-1')
+      assert.deepEqual(result, session)
+    })
+
+    test('set overwrites previous session', async () => {
+      const asAdmin: AppSession = { userId: 'user-2', role: 'admin' }
+      const asMember: AppSession = { userId: 'user-2', role: 'member' }
+      await store.set('user-2', asAdmin)
+      await store.set('user-2', asMember)
+
+      const result = await store.get('user-2')
+      assert.deepEqual(result, { userId: 'user-2', role: 'member' })
+    })
+
+    test('clear removes session', async () => {
+      await store.set('user-3', { userId: 'user-3' })
+      assert.ok(await store.get('user-3'))
+
+      await store.clear('user-3')
+      const result = await store.get('user-3')
+      assert.equal(result, undefined)
+    })
+
+    test('clear is no-op for unknown user', async () => {
+      await store.clear('nonexistent')
+    })
+  })
+}

package/src/testing/service-tests/workflow-run-service-tests.ts

@@ -0,0 +1,59 @@
+import { describe, test, before } from 'node:test'
+import assert from 'node:assert/strict'
+
+import type { WorkflowRunService } from '../../wirings/workflow/workflow.types.js'
+import type { ServiceTestConfig } from '../service-tests.js'
+
+/** Conformance suite for `workflowRunService`. Runs only when a backend supplies one. */
+export const defineWorkflowRunServiceTests = (
+  name: string,
+  workflowRunService: NonNullable<
+    ServiceTestConfig['services']['workflowRunService']
+  >
+): void => {
+  const factory = workflowRunService
+  describe(`WorkflowRunService [${name}]`, () => {
+    let runService: WorkflowRunService
+
+    before(async () => {
+      runService = await factory()
+    })
+
+    test('listRuns returns runs', async () => {
+      const runs = await runService.listRuns()
+      assert.ok(Array.isArray(runs))
+      assert.ok(runs.length > 0)
+    })
+
+    test('listRuns with filter', async () => {
+      const runs = await runService.listRuns({
+        workflowName: 'test-workflow',
+      })
+      assert.ok(runs.every((r) => r.workflow === 'test-workflow'))
+    })
+
+    test('getDistinctWorkflowNames', async () => {
+      const names = await runService.getDistinctWorkflowNames()
+      assert.ok(Array.isArray(names))
+      assert.ok(names.includes('test-workflow'))
+    })
+
+    test('deleteRun', async () => {
+      const runs = await runService.listRuns({
+        workflowName: 'status-workflow',
+      })
+      assert.ok(runs.length > 0)
+
+      const deleted = await runService.deleteRun(runs[0]!.id)
+      assert.equal(deleted, true)
+
+      const afterDelete = await runService.getRun(runs[0]!.id)
+      assert.equal(afterDelete, null)
+    })
+
+    test('deleteRun returns false for missing', async () => {
+      const deleted = await runService.deleteRun('non-existent-id')
+      assert.equal(deleted, false)
+    })
+  })
+}