@pikku/inspector 0.12.74 → 0.12.81

package/src/add/addon-bans.test.ts

@@ -1,121 +0,0 @@
-import { strict as assert } from 'node:assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import { ErrorCode } from '../error-codes.js'
-import type { InspectorLogger } from '../types.js'
-
-const recordingLogger = () => {
-  const criticals: Array<{ code: ErrorCode; message: string }> = []
-  const logger: InspectorLogger = {
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    critical: (code, message) => {
-      criticals.push({ code, message })
-    },
-    hasCriticalErrors: () => criticals.length > 0,
-  }
-  return { logger, criticals }
-}
-
-const withTempApp = async (
-  source: string,
-  run: (file: string, rootDir: string) => Promise<void>
-) => {
-  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-addon-bans-'))
-  const file = join(rootDir, 'app.ts')
-  await writeFile(
-    join(rootDir, 'package.json'),
-    JSON.stringify({ name: 'test-addon', type: 'module' }, null, 2)
-  )
-  await writeFile(file, source)
-  try {
-    await run(file, rootDir)
-  } finally {
-    await rm(rootDir, { recursive: true, force: true })
-  }
-}
-
-describe('addon authoring bans', () => {
-  const wireHTTPSource = [
-    "import { wireHTTP } from '@pikku/core/http'",
-    "import { pikkuSessionlessFunc } from '@pikku/core'",
-    'const f = pikkuSessionlessFunc({ func: async () => ({ ok: true }) })',
-    "wireHTTP({ method: 'get', route: '/a', func: f })",
-  ].join('\n')
-
-  const defineWithMiddlewareSource = [
-    "import { defineHTTPRoutes } from '@pikku/core/http'",
-    "import { pikkuSessionlessFunc } from '@pikku/core'",
-    'const f = pikkuSessionlessFunc({ func: async () => ({ ok: true }) })',
-    'const mw = (async (_s: any, _w: any, next: any) => next()) as any',
-    "export const routes = defineHTTPRoutes({ basePath: '/x', routes: { a: { method: 'get', route: '/a', func: f, middleware: [mw] } } })",
-  ].join('\n')
-
-  test('wire* inside an addon is a critical error', async () => {
-    await withTempApp(wireHTTPSource, async (file, rootDir) => {
-      const { logger, criticals } = recordingLogger()
-      await inspect(logger, [file], { rootDir, isAddon: true })
-      assert.ok(
-        criticals.some((c) => c.code === ErrorCode.ADDON_WIRING_NOT_ALLOWED),
-        `expected ADDON_WIRING_NOT_ALLOWED, got ${JSON.stringify(criticals)}`
-      )
-    })
-  })
-
-  test('wire* outside an addon is allowed', async () => {
-    await withTempApp(wireHTTPSource, async (file, rootDir) => {
-      const { logger, criticals } = recordingLogger()
-      await inspect(logger, [file], { rootDir })
-      assert.ok(
-        !criticals.some((c) => c.code === ErrorCode.ADDON_WIRING_NOT_ALLOWED),
-        `expected no addon-wiring ban, got ${JSON.stringify(criticals)}`
-      )
-    })
-  })
-
-  test('define* carrying middleware inside an addon is a critical error', async () => {
-    await withTempApp(defineWithMiddlewareSource, async (file, rootDir) => {
-      const { logger, criticals } = recordingLogger()
-      await inspect(logger, [file], { rootDir, isAddon: true })
-      assert.ok(
-        criticals.some(
-          (c) => c.code === ErrorCode.ADDON_CONTRACT_HANDLERS_NOT_ALLOWED
-        ),
-        `expected ADDON_CONTRACT_HANDLERS_NOT_ALLOWED, got ${JSON.stringify(criticals)}`
-      )
-    })
-  })
-
-  test('define* carrying middleware outside an addon is allowed', async () => {
-    await withTempApp(defineWithMiddlewareSource, async (file, rootDir) => {
-      const { logger, criticals } = recordingLogger()
-      await inspect(logger, [file], { rootDir })
-      assert.ok(
-        !criticals.some(
-          (c) => c.code === ErrorCode.ADDON_CONTRACT_HANDLERS_NOT_ALLOWED
-        ),
-        `expected no contract-handlers ban, got ${JSON.stringify(criticals)}`
-      )
-    })
-  })
-
-  test('defineSecret inside an addon is allowed', async () => {
-    const source = [
-      "import { defineSecret } from '@pikku/core'",
-      "defineSecret({ name: 'example', secretId: 'EXAMPLE' } as any)",
-    ].join('\n')
-    await withTempApp(source, async (file, rootDir) => {
-      const { logger, criticals } = recordingLogger()
-      await inspect(logger, [file], { rootDir, isAddon: true })
-      assert.ok(
-        !criticals.some((c) => c.code === ErrorCode.ADDON_WIRING_NOT_ALLOWED),
-        `expected defineSecret to be allowed, got ${JSON.stringify(criticals)}`
-      )
-    })
-  })
-})

package/src/add/addon-contracts.test.ts

@@ -1,221 +0,0 @@
-import { strict as assert } from 'node:assert'
-import { describe, test } from 'node:test'
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import type { InspectorLogger } from '../types.js'
-
-const logger: InspectorLogger = {
-  debug: () => {},
-  info: () => {},
-  warn: () => {},
-  error: () => {},
-  critical: () => {},
-  hasCriticalErrors: () => false,
-}
-
-describe('addon contract metadata', () => {
-  test('collects exported local define contracts', async () => {
-    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-exported-contracts-'))
-    const file = join(rootDir, 'contracts.ts')
-
-    await writeFile(
-      join(rootDir, 'package.json'),
-      JSON.stringify({ name: 'test-app', type: 'module' }, null, 2)
-    )
-
-    await writeFile(
-      file,
-      [
-        "import { pikkuSessionlessFunc } from '@pikku/core'",
-        "import { defineHTTPRoutes } from '@pikku/core/http'",
-        "import { defineChannelRoutes } from '@pikku/core/channel'",
-        "import { defineCLICommands } from '@pikku/core/cli'",
-        'export const listTodos = pikkuSessionlessFunc({ func: async () => ({ ok: true }) })',
-        'export const subscribeTodo = pikkuSessionlessFunc({ func: async () => ({ ok: true }) })',
-        'export const runSync = pikkuSessionlessFunc({ func: async () => ({ ok: true }) })',
-        "export const httpRoutes = defineHTTPRoutes({ basePath: '/todos', routes: { list: { method: 'get', route: '/', func: listTodos } } })",
-        'export const channelRoutes = defineChannelRoutes({ subscribe: { func: subscribeTodo } })',
-        'export const cliCommands = defineCLICommands({ sync: { func: runSync, options: {} } })',
-      ].join('\n')
-    )
-
-    try {
-      const state = await inspect(logger, [file], { rootDir })
-      assert.equal(
-        state.exportedContracts.http.httpRoutes?.routes.list?.func.pikkuFuncId,
-        'listTodos'
-      )
-      assert.equal(
-        state.exportedContracts.channel.channelRoutes?.subscribe?.pikkuFuncId,
-        'subscribeTodo'
-      )
-      assert.equal(
-        state.exportedContracts.cli.cliCommands?.sync?.pikkuFuncId,
-        'runSync'
-      )
-    } finally {
-      await rm(rootDir, { recursive: true, force: true })
-    }
-  })
-
-  test('expands addon contracts referenced via refHTTP/refChannel/refCLI', async () => {
-    const rootDir = await mkdtemp(join(tmpdir(), 'pikku-addon-refs-app-'))
-    const nodeModulesDir = join(rootDir, 'node_modules', '@test', 'addon')
-    const appFile = join(rootDir, 'app.ts')
-
-    await mkdir(join(nodeModulesDir, '.pikku', 'function'), { recursive: true })
-    await mkdir(join(nodeModulesDir, '.pikku', 'http'), { recursive: true })
-    await mkdir(join(nodeModulesDir, '.pikku', 'cli'), { recursive: true })
-    await mkdir(join(nodeModulesDir, '.pikku', 'channel'), { recursive: true })
-
-    await writeFile(
-      join(rootDir, 'package.json'),
-      JSON.stringify({ name: 'test-app', type: 'module' }, null, 2)
-    )
-    await writeFile(
-      join(nodeModulesDir, 'package.json'),
-      JSON.stringify({ name: '@test/addon', type: 'module' }, null, 2)
-    )
-    await writeFile(
-      join(
-        nodeModulesDir,
-        '.pikku',
-        'function',
-        'pikku-functions-meta.gen.json'
-      ),
-      JSON.stringify(
-        {
-          listTodos: {
-            pikkuFuncId: 'listTodos',
-            inputSchemaName: null,
-            outputSchemaName: null,
-            sessionless: true,
-          },
-          runSync: {
-            pikkuFuncId: 'runSync',
-            inputSchemaName: null,
-            outputSchemaName: null,
-            sessionless: true,
-          },
-          subscribeTodo: {
-            pikkuFuncId: 'subscribeTodo',
-            inputSchemaName: null,
-            outputSchemaName: null,
-            sessionless: true,
-          },
-        },
-        null,
-        2
-      )
-    )
-    await writeFile(
-      join(
-        nodeModulesDir,
-        '.pikku',
-        'http',
-        'pikku-http-contracts-meta.gen.json'
-      ),
-      JSON.stringify(
-        {
-          httpRoutes: {
-            basePath: '/addon',
-            routes: {
-              list: {
-                method: 'get',
-                route: '/todos',
-                func: { pikkuFuncId: 'listTodos' },
-              },
-            },
-          },
-        },
-        null,
-        2
-      )
-    )
-    await writeFile(
-      join(
-        nodeModulesDir,
-        '.pikku',
-        'cli',
-        'pikku-cli-contracts-meta.gen.json'
-      ),
-      JSON.stringify(
-        {
-          cliCommands: {
-            sync: {
-              pikkuFuncId: 'runSync',
-              positionals: [],
-              options: {},
-            },
-          },
-        },
-        null,
-        2
-      )
-    )
-    await writeFile(
-      join(
-        nodeModulesDir,
-        '.pikku',
-        'channel',
-        'pikku-channel-contracts-meta.gen.json'
-      ),
-      JSON.stringify(
-        {
-          channelRoutes: {
-            subscribe: {
-              pikkuFuncId: 'subscribeTodo',
-            },
-          },
-        },
-        null,
-        2
-      )
-    )
-
-    await writeFile(
-      appFile,
-      [
-        "import { wireAddon } from '@pikku/core/addon'",
-        "import { wireHTTPRoutes } from '@pikku/core/http'",
-        "import { wireChannel } from '@pikku/core/channel'",
-        "import { wireCLI } from '@pikku/core/cli'",
-        'declare const refHTTP: (name: string) => any',
-        'declare const refChannel: (name: string) => any',
-        'declare const refCLI: (name: string) => any',
-        "wireAddon({ name: 'addon', package: '@test/addon' })",
-        "wireHTTPRoutes({ basePath: '/api', routes: { keep: refHTTP('addon:httpRoutes'), moved: refHTTP('addon:httpRoutes', { basePath: '/ext' }) } })",
-        "wireChannel({ name: 'live', route: '/live', auth: false, onMessageWiring: { action: refChannel('addon:channelRoutes') } })",
-        "wireCLI({ program: 'app', commands: { ...refCLI('addon:cliCommands') } })",
-      ].join('\n')
-    )
-
-    try {
-      const state = await inspect(logger, [appFile], { rootDir })
-
-      // Default: the addon contract's own basePath ('/addon') is preserved —
-      // the cosmetic slot key ('keep') does not affect the path.
-      const httpEntry = state.http.meta.get['/api/addon/todos']
-      assert.equal(httpEntry?.packageName, '@test/addon')
-      assert.equal(httpEntry?.pikkuFuncId, 'addon:listTodos')
-
-      // Override: the second-arg basePath ('/ext') replaces the addon's own.
-      const overridden = state.http.meta.get['/api/ext/todos']
-      assert.equal(overridden?.packageName, '@test/addon')
-      assert.equal(overridden?.pikkuFuncId, 'addon:listTodos')
-
-      const channelEntry =
-        state.channels.meta.live?.messageWirings.action?.subscribe
-      assert.equal(channelEntry?.packageName, '@test/addon')
-      assert.equal(channelEntry?.pikkuFuncId, 'addon:subscribeTodo')
-
-      const cliEntry = state.cli.meta.programs.app?.commands.sync
-      assert.equal(cliEntry?.packageName, '@test/addon')
-      assert.equal(cliEntry?.pikkuFuncId, 'addon:runSync')
-    } finally {
-      await rm(rootDir, { recursive: true, force: true })
-    }
-  })
-})

package/src/add/allow-escape-hatches.test.ts

@@ -1,144 +0,0 @@
-import { strict as assert } from 'assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import { ErrorCode } from '../error-codes.js'
-import type { InspectorLogger, InspectorOptions } from '../types.js'
-
-function makeLogger(
-  criticals: Array<{ code: string; message: string }>
-): InspectorLogger {
-  return {
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    diagnostic: ({ code, message }: any) => criticals.push({ code, message }),
-    critical: (code: any, message: string) => criticals.push({ code, message }),
-    hasCriticalErrors: () => criticals.length > 0,
-  } as InspectorLogger
-}
-
-async function run(source: string, allow: InspectorOptions['allow'] = {}) {
-  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-allow-'))
-  const file = join(rootDir, 'subject.ts')
-  await writeFile(file, source)
-  const criticals: Array<{ code: string; message: string }> = []
-  const state = await inspect(makeLogger(criticals), [file], {
-    rootDir,
-    allow,
-  })
-  await rm(rootDir, { recursive: true, force: true })
-  return { state, criticals }
-}
-
-const has = (criticals: Array<{ code: string }>, code: ErrorCode) =>
-  criticals.some((c) => c.code === code)
-
-const PERMISSIONS_IN_BODY = [
-  "import { pikkuSessionlessFunc } from '@pikku/core'",
-  'export const stripeWebhook = pikkuSessionlessFunc({',
-  '  expose: true,',
-  '  permissionsInBody: true,',
-  '  func: async () => ({ ok: true }),',
-  '})',
-].join('\n')
-
-const COMPLEX_WORKFLOW = [
-  "import { pikkuWorkflowComplexFunc } from '@pikku/core/workflow'",
-  'export const cleanup = pikkuWorkflowComplexFunc(',
-  '  async (_services, _input, { workflow }: any) => {',
-  '    for (const id of [1, 2, 3]) {',
-  "      await workflow.step('touch', { id })",
-  '    }',
-  '    return { ok: true }',
-  '  }',
-  ')',
-].join('\n')
-
-describe('allow: escape hatches are refused unless opted into', () => {
-  test('permissionsInBody is a critical when not allowed', async () => {
-    const { criticals } = await run(PERMISSIONS_IN_BODY)
-    assert.ok(
-      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
-      `expected PKU576, got ${JSON.stringify(criticals)}`
-    )
-  })
-
-  test('the message names the flag that would permit it', async () => {
-    const { criticals } = await run(PERMISSIONS_IN_BODY)
-    const found = criticals.find(
-      (c) => c.code === ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED
-    )
-    assert.match(found!.message, /allow: \{ permissionsInBody: true \}/)
-    assert.match(found!.message, /stripeWebhook/)
-  })
-
-  test('permissionsInBody is accepted once allowed', async () => {
-    const { criticals, state } = await run(PERMISSIONS_IN_BODY, {
-      permissionsInBody: true,
-    })
-    assert.equal(
-      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
-      false
-    )
-    const meta = Object.values(state.functions.meta) as any[]
-    assert.equal(
-      meta.find((m) => m.name === 'stripeWebhook')?.permissionsInBody,
-      true
-    )
-  })
-
-  test('a refused function is not registered at all', async () => {
-    const { state } = await run(PERMISSIONS_IN_BODY)
-    const meta = Object.values(state.functions.meta) as any[]
-    assert.equal(
-      meta.some((m) => m.name === 'stripeWebhook'),
-      false,
-      'a refused function must not reach the meta, or the build would emit it anyway'
-    )
-  })
-
-  test('complexWorkflows is a critical when not allowed', async () => {
-    const { criticals } = await run(COMPLEX_WORKFLOW)
-    assert.ok(
-      has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED),
-      `expected PKU643, got ${JSON.stringify(criticals)}`
-    )
-  })
-
-  test('the complex-workflow message points at the DSL', async () => {
-    const { criticals } = await run(COMPLEX_WORKFLOW)
-    const found = criticals.find(
-      (c) => c.code === ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED
-    )
-    assert.match(found!.message, /pikkuWorkflowFunc/)
-    assert.match(found!.message, /allow: \{ complexWorkflows: true \}/)
-  })
-
-  test('complexWorkflows is accepted once allowed', async () => {
-    const { criticals } = await run(COMPLEX_WORKFLOW, {
-      complexWorkflows: true,
-    })
-    assert.equal(has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED), false)
-  })
-
-  test('an ordinary function and DSL workflow are unaffected', async () => {
-    const { criticals } = await run(
-      [
-        "import { pikkuFunc } from '@pikku/core'",
-        'export const ordinary = pikkuFunc({',
-        '  expose: true,',
-        '  func: async () => ({ ok: true }),',
-        '})',
-      ].join('\n')
-    )
-    assert.equal(
-      has(criticals, ErrorCode.PERMISSIONS_IN_BODY_NOT_ALLOWED),
-      false
-    )
-    assert.equal(has(criticals, ErrorCode.COMPLEX_WORKFLOW_NOT_ALLOWED), false)
-  })
-})

package/src/add/audit-meta.test.ts

@@ -1,75 +0,0 @@
-import { strict as assert } from 'assert'
-import { describe, test } from 'node:test'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { inspect } from '../inspector.js'
-import type { InspectorLogger } from '../types.js'
-
-const silentLogger = (): InspectorLogger =>
-  ({
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-    diagnostic: () => {},
-    critical: () => {},
-    hasCriticalErrors: () => false,
-  }) as InspectorLogger
-
-async function metaFor(source: string) {
-  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-audit-'))
-  const file = join(rootDir, 'subject.ts')
-  await writeFile(file, source)
-  const state = await inspect(silentLogger(), [file], { rootDir })
-  await rm(rootDir, { recursive: true, force: true })
-  return Object.values(state.functions.meta) as any[]
-}
-
-const func = (name: string, auditLine: string | null) =>
-  [
-    "import { pikkuFunc } from '@pikku/core'",
-    `export const ${name} = pikkuFunc({`,
-    ...(auditLine ? [`  ${auditLine}`] : []),
-    '  func: async () => ({ ok: true }),',
-    '})',
-  ].join('\n')
-
-describe('the audit flag reaches the function meta', () => {
-  test('`audit: true` resolves to best-effort', async () => {
-    const meta = await metaFor(func('cancelInvoice', 'audit: true,'))
-    assert.deepEqual(meta.find((m) => m.name === 'cancelInvoice')?.audit, {
-      durability: 'best-effort',
-    })
-  })
-
-  test('an explicit durability is carried through', async () => {
-    const meta = await metaFor(
-      func('chargeCard', "audit: { durability: 'transactional' },")
-    )
-    assert.deepEqual(meta.find((m) => m.name === 'chargeCard')?.audit, {
-      durability: 'transactional',
-    })
-  })
-
-  test('an object without a durability defaults to best-effort', async () => {
-    const meta = await metaFor(func('refund', 'audit: {},'))
-    assert.deepEqual(meta.find((m) => m.name === 'refund')?.audit, {
-      durability: 'best-effort',
-    })
-  })
-
-  // Absent rather than `false`: an unmarked function drops `auditLog.write()`
-  // with a warning, so "no audit key" has to be the honest reading of it.
-  test('a function with no audit config carries no audit key', async () => {
-    const meta = await metaFor(func('listInvoices', null))
-    const found = meta.find((m) => m.name === 'listInvoices')
-    assert.ok(found, 'the function should still be registered')
-    assert.equal(found.audit, undefined)
-  })
-
-  test('`audit: false` is the same as not declaring it', async () => {
-    const meta = await metaFor(func('healthCheck', 'audit: false,'))
-    assert.equal(meta.find((m) => m.name === 'healthCheck')?.audit, undefined)
-  })
-})