@positronic/spec 0.0.67 → 0.0.69

package/dist/src/api/scoping.js

@@ -0,0 +1,756 @@
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import { BRAIN_EVENTS } from '@positronic/core';
+import { startBrainRun, readSseUntil } from './helpers.js';
+/**
+ * Helper: start a brain run as a specific user's fetch, wait for completion,
+ * and return the brainRunId.
+ */ function runBrainAndWait(fetchFn, brainIdentifier) {
+    return _async_to_generator(function() {
+        var brainRunId, watchResponse, error;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        startBrainRun(fetchFn, brainIdentifier)
+                    ];
+                case 1:
+                    brainRunId = _state.sent();
+                    if (!brainRunId) return [
+                        2,
+                        null
+                    ];
+                    return [
+                        4,
+                        fetchFn(new Request("http://example.com/brains/runs/".concat(brainRunId, "/watch")))
+                    ];
+                case 2:
+                    watchResponse = _state.sent();
+                    if (!watchResponse.ok || !watchResponse.body) {
+                        console.error("GET /brains/runs/".concat(brainRunId, "/watch returned ").concat(watchResponse.status));
+                        return [
+                            2,
+                            null
+                        ];
+                    }
+                    return [
+                        4,
+                        readSseUntil(watchResponse.body, function(event) {
+                            return event.type === BRAIN_EVENTS.COMPLETE || event.type === BRAIN_EVENTS.ERROR;
+                        })
+                    ];
+                case 3:
+                    _state.sent();
+                    return [
+                        2,
+                        brainRunId
+                    ];
+                case 4:
+                    error = _state.sent();
+                    console.error('Failed to run brain and wait:', error);
+                    return [
+                        2,
+                        null
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+export var scoping = {
+    brainRunIsolation: /**
+   * Test that brain runs are isolated between users.
+   *
+   * userA creates a run and waits for completion. Then:
+   * - userB gets 404 on GET /runs/:runId
+   * - root gets 200 on GET /runs/:runId
+   * - userA's history has the run
+   * - userB's history is empty
+   */ function brainRunIsolation(rootFetch, fetchFactory, brainIdentifier) {
+        return _async_to_generator(function() {
+            var userA, userB, brainRunId, responseB, responseRoot, rootRun, historyA, historyDataA, historyB, historyDataB, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            11,
+                            ,
+                            12
+                        ]);
+                        return [
+                            4,
+                            fetchFactory('scoping-alice-run')
+                        ];
+                    case 1:
+                        userA = _state.sent();
+                        return [
+                            4,
+                            fetchFactory('scoping-bob-run')
+                        ];
+                    case 2:
+                        userB = _state.sent();
+                        return [
+                            4,
+                            runBrainAndWait(userA.fetch, brainIdentifier)
+                        ];
+                    case 3:
+                        brainRunId = _state.sent();
+                        if (!brainRunId) {
+                            console.error('Failed to create and complete brain run as userA');
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            userB.fetch(new Request("http://example.com/brains/runs/".concat(brainRunId)))
+                        ];
+                    case 4:
+                        responseB = _state.sent();
+                        if (responseB.status !== 404) {
+                            console.error("Expected userB to get 404 for userA's run, got ".concat(responseB.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            rootFetch(new Request("http://example.com/brains/runs/".concat(brainRunId)))
+                        ];
+                    case 5:
+                        responseRoot = _state.sent();
+                        if (responseRoot.status !== 200) {
+                            console.error("Expected root to get 200 for userA's run, got ".concat(responseRoot.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            responseRoot.json()
+                        ];
+                    case 6:
+                        rootRun = _state.sent();
+                        if (rootRun.brainRunId !== brainRunId) {
+                            console.error("Root returned wrong brainRunId: expected ".concat(brainRunId, ", got ").concat(rootRun.brainRunId));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            userA.fetch(new Request("http://example.com/brains/".concat(encodeURIComponent(brainIdentifier), "/history?limit=50")))
+                        ];
+                    case 7:
+                        historyA = _state.sent();
+                        if (historyA.status !== 200) {
+                            console.error("Expected userA history to return 200, got ".concat(historyA.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            historyA.json()
+                        ];
+                    case 8:
+                        historyDataA = _state.sent();
+                        if (historyDataA.runs.length === 0) {
+                            console.error("userA's history is empty but should have the run");
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            userB.fetch(new Request("http://example.com/brains/".concat(encodeURIComponent(brainIdentifier), "/history?limit=50")))
+                        ];
+                    case 9:
+                        historyB = _state.sent();
+                        if (historyB.status !== 200) {
+                            console.error("Expected userB history to return 200, got ".concat(historyB.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            historyB.json()
+                        ];
+                    case 10:
+                        historyDataB = _state.sent();
+                        if (historyDataB.runs.length !== 0) {
+                            console.error("userB's history should be empty but has ".concat(historyDataB.runs.length, " runs"));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            2,
+                            true
+                        ];
+                    case 11:
+                        error = _state.sent();
+                        console.error('Failed brain run isolation spec:', error);
+                        return [
+                            2,
+                            false
+                        ];
+                    case 12:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    },
+    activeRunIsolation: /**
+   * Test that active runs are isolated between users.
+   *
+   * userA starts a delayed brain (will remain running).
+   * - userA sees it in active-runs
+   * - userB does not see it in active-runs
+   */ function activeRunIsolation(rootFetch, fetchFactory, delayedBrainIdentifier) {
+        return _async_to_generator(function() {
+            var userA, userB, brainRunId, responseB, activeB, responseA, activeA, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            8,
+                            ,
+                            9
+                        ]);
+                        return [
+                            4,
+                            fetchFactory('scoping-alice-active')
+                        ];
+                    case 1:
+                        userA = _state.sent();
+                        return [
+                            4,
+                            fetchFactory('scoping-bob-active')
+                        ];
+                    case 2:
+                        userB = _state.sent();
+                        return [
+                            4,
+                            startBrainRun(userA.fetch, delayedBrainIdentifier)
+                        ];
+                    case 3:
+                        brainRunId = _state.sent();
+                        if (!brainRunId) return [
+                            2,
+                            false
+                        ];
+                        return [
+                            4,
+                            userB.fetch(new Request("http://example.com/brains/".concat(encodeURIComponent(delayedBrainIdentifier), "/active-runs")))
+                        ];
+                    case 4:
+                        responseB = _state.sent();
+                        if (responseB.status !== 200) {
+                            console.error("Expected userB active-runs to return 200, got ".concat(responseB.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            responseB.json()
+                        ];
+                    case 5:
+                        activeB = _state.sent();
+                        if (activeB.runs.length !== 0) {
+                            console.error("userB should see 0 active runs but sees ".concat(activeB.runs.length));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            userA.fetch(new Request("http://example.com/brains/".concat(encodeURIComponent(delayedBrainIdentifier), "/active-runs")))
+                        ];
+                    case 6:
+                        responseA = _state.sent();
+                        if (responseA.status !== 200) {
+                            console.error("Expected userA active-runs to return 200, got ".concat(responseA.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            responseA.json()
+                        ];
+                    case 7:
+                        activeA = _state.sent();
+                        if (activeA.runs.length === 0) {
+                            console.error('userA should see at least 1 active run but sees 0');
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            2,
+                            true
+                        ];
+                    case 8:
+                        error = _state.sent();
+                        console.error('Failed active run isolation spec:', error);
+                        return [
+                            2,
+                            false
+                        ];
+                    case 9:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    },
+    scheduleIsolation: /**
+   * Test that schedules are isolated between users.
+   *
+   * userA creates a schedule. Then:
+   * - userB can't see it in GET /schedules
+   * - userA can see it in GET /schedules
+   * - root can see it in GET /schedules
+   * - userB can't see runs for it in GET /schedules/runs
+   */ function scheduleIsolation(rootFetch, fetchFactory, brainIdentifier) {
+        return _async_to_generator(function() {
+            var userA, userB, createResponse, schedule, listResponseB, listB, listResponseA, listA, listResponseRoot, listRoot, runsResponseB, runsB, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            13,
+                            ,
+                            14
+                        ]);
+                        return [
+                            4,
+                            fetchFactory('scoping-alice-sched')
+                        ];
+                    case 1:
+                        userA = _state.sent();
+                        return [
+                            4,
+                            fetchFactory('scoping-bob-sched')
+                        ];
+                    case 2:
+                        userB = _state.sent();
+                        return [
+                            4,
+                            userA.fetch(new Request('http://example.com/brains/schedules', {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/json'
+                                },
+                                body: JSON.stringify({
+                                    identifier: brainIdentifier,
+                                    cronExpression: '0 6 * * *'
+                                })
+                            }))
+                        ];
+                    case 3:
+                        createResponse = _state.sent();
+                        if (createResponse.status !== 201) {
+                            console.error("POST /brains/schedules returned ".concat(createResponse.status, ", expected 201"));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            createResponse.json()
+                        ];
+                    case 4:
+                        schedule = _state.sent();
+                        if (schedule.runAsUserId !== userA.userId) {
+                            console.error("Expected runAsUserId to be '".concat(userA.userId, "', got '").concat(schedule.runAsUserId, "'"));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            userB.fetch(new Request('http://example.com/brains/schedules'))
+                        ];
+                    case 5:
+                        listResponseB = _state.sent();
+                        if (listResponseB.status !== 200) {
+                            console.error("Expected userB schedule list to return 200, got ".concat(listResponseB.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            listResponseB.json()
+                        ];
+                    case 6:
+                        listB = _state.sent();
+                        if (listB.schedules.some(function(s) {
+                            return s.id === schedule.id;
+                        })) {
+                            console.error("userB should not see userA's schedule in list");
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            userA.fetch(new Request('http://example.com/brains/schedules'))
+                        ];
+                    case 7:
+                        listResponseA = _state.sent();
+                        if (listResponseA.status !== 200) {
+                            console.error("Expected userA schedule list to return 200, got ".concat(listResponseA.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            listResponseA.json()
+                        ];
+                    case 8:
+                        listA = _state.sent();
+                        if (!listA.schedules.some(function(s) {
+                            return s.id === schedule.id;
+                        })) {
+                            console.error("userA should see their own schedule in list");
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            rootFetch(new Request('http://example.com/brains/schedules'))
+                        ];
+                    case 9:
+                        listResponseRoot = _state.sent();
+                        if (listResponseRoot.status !== 200) {
+                            console.error("Expected root schedule list to return 200, got ".concat(listResponseRoot.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            listResponseRoot.json()
+                        ];
+                    case 10:
+                        listRoot = _state.sent();
+                        if (!listRoot.schedules.some(function(s) {
+                            return s.id === schedule.id;
+                        })) {
+                            console.error("root should see userA's schedule in list");
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            userB.fetch(new Request("http://example.com/brains/schedules/runs?scheduleId=".concat(schedule.id)))
+                        ];
+                    case 11:
+                        runsResponseB = _state.sent();
+                        if (runsResponseB.status !== 200) {
+                            console.error("Expected userB schedule runs to return 200, got ".concat(runsResponseB.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            runsResponseB.json()
+                        ];
+                    case 12:
+                        runsB = _state.sent();
+                        if (runsB.runs.length !== 0) {
+                            console.error("userB should see 0 schedule runs but sees ".concat(runsB.runs.length));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            2,
+                            true
+                        ];
+                    case 13:
+                        error = _state.sent();
+                        console.error('Failed schedule isolation spec:', error);
+                        return [
+                            2,
+                            false
+                        ];
+                    case 14:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    },
+    secretsRequireRoot: /**
+   * Test that non-root users get 403 on secrets endpoints.
+   *
+   * A non-root user calling GET/POST/DELETE /secrets gets 403.
+   * (Root access to secrets is already tested by secrets.list spec.)
+   */ function secretsRequireRoot(rootFetch, fetchFactory) {
+        return _async_to_generator(function() {
+            var user, getResponse, getBody, postResponse, deleteResponse, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            6,
+                            ,
+                            7
+                        ]);
+                        return [
+                            4,
+                            fetchFactory('scoping-user-secrets')
+                        ];
+                    case 1:
+                        user = _state.sent();
+                        return [
+                            4,
+                            user.fetch(new Request('http://example.com/secrets'))
+                        ];
+                    case 2:
+                        getResponse = _state.sent();
+                        if (getResponse.status !== 403) {
+                            console.error("Expected non-root GET /secrets to return 403, got ".concat(getResponse.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            getResponse.json()
+                        ];
+                    case 3:
+                        getBody = _state.sent();
+                        if (getBody.error !== 'Root access required') {
+                            console.error("Expected error 'Root access required', got '".concat(getBody.error, "'"));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            user.fetch(new Request('http://example.com/secrets', {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/json'
+                                },
+                                body: JSON.stringify({
+                                    name: 'MY_SECRET',
+                                    value: 'secret-value'
+                                })
+                            }))
+                        ];
+                    case 4:
+                        postResponse = _state.sent();
+                        if (postResponse.status !== 403) {
+                            console.error("Expected non-root POST /secrets to return 403, got ".concat(postResponse.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            4,
+                            user.fetch(new Request('http://example.com/secrets/MY_SECRET', {
+                                method: 'DELETE'
+                            }))
+                        ];
+                    case 5:
+                        deleteResponse = _state.sent();
+                        if (deleteResponse.status !== 403) {
+                            console.error("Expected non-root DELETE /secrets to return 403, got ".concat(deleteResponse.status));
+                            return [
+                                2,
+                                false
+                            ];
+                        }
+                        return [
+                            2,
+                            true
+                        ];
+                    case 6:
+                        error = _state.sent();
+                        console.error('Failed secrets require root spec:', error);
+                        return [
+                            2,
+                            false
+                        ];
+                    case 7:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    }
+};