@powerhousedao/switchboard 6.2.3-dev.5 → 6.2.3-dev.50

package/test/boot-mcp-enabled.test.ts

@@ -0,0 +1,121 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import { startSwitchboard } from "../src/server.mjs";
+
+// `port: 0` would bind a random port the switchboard does not report back, so
+// the test picks a free one and pins it.
+async function freePort(): Promise<number> {
+  const server = createServer();
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  if (!address || typeof address === "string") throw new Error("no port");
+  return address.port;
+}
+
+function stubLogger(): ILogger {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger;
+}
+
+async function withSwitchboard(
+  env: Record<string, string>,
+  mcp: boolean | undefined,
+  run: (
+    switchboard: Awaited<ReturnType<typeof startSwitchboard>>,
+  ) => Promise<void>,
+): Promise<void> {
+  const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-mcp-enabled-"));
+  const names = ["PH_REACTOR_DATABASE_URL", "MCP_ENABLED", ...Object.keys(env)];
+  const previous = names.map((name) => [name, process.env[name]] as const);
+  process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+  delete process.env.MCP_ENABLED;
+  Object.assign(process.env, env);
+  let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+  try {
+    switchboard = await startSwitchboard({
+      workflows: { enabled: false },
+      dbPath: join(tempRoot, "read-model"),
+      port: await freePort(),
+      strictPort: true,
+      mcp,
+      disableLocalPackages: true,
+      identity: { keypairPath: join(tempRoot, "identity.json") },
+      drive: {
+        slug: "default-drive",
+        global: { name: "Default Drive" },
+      },
+      logger: stubLogger(),
+    });
+    await run(switchboard);
+    await switchboard.shutdown();
+    switchboard = undefined;
+  } finally {
+    await switchboard?.shutdown();
+    for (const [name, value] of previous) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+async function postMcp(port: number): Promise<number> {
+  const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+    },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "ping" }),
+  });
+  await response.body?.cancel();
+  return response.status;
+}
+
+describe("booting Switchboard", () => {
+  it("mounts /mcp by default", async () => {
+    await withSwitchboard({}, undefined, async ({ mcpEnabled, port }) => {
+      expect(mcpEnabled).toBe(true);
+      expect(await postMcp(port)).not.toBe(404);
+    });
+  }, 60_000);
+
+  it('leaves /mcp unmounted under MCP_ENABLED="false"', async () => {
+    await withSwitchboard(
+      { MCP_ENABLED: "false" },
+      undefined,
+      async ({ mcpEnabled, port }) => {
+        expect(mcpEnabled).toBe(false);
+        expect(await postMcp(port)).toBe(404);
+      },
+    );
+  }, 60_000);
+
+  it("keeps a host's mcp: false over MCP_ENABLED=true", async () => {
+    await withSwitchboard(
+      { MCP_ENABLED: "true" },
+      false,
+      async ({ mcpEnabled, port }) => {
+        expect(mcpEnabled).toBe(false);
+        expect(await postMcp(port)).toBe(404);
+      },
+    );
+  }, 60_000);
+});

package/test/boot-privacy.test.ts

@@ -0,0 +1,243 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import pg from "pg";
+import { describe, expect, it, vi } from "vitest";
+import { startSwitchboard } from "../src/server.mjs";
+
+const ADMIN = "0xadad00000000000000000000000000000000adad";
+const SECRET = "switchboard-privacy-test-deployment-secret-0123";
+
+function stubLogger(): ILogger & { error: ReturnType<typeof vi.fn> } {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger & { error: ReturnType<typeof vi.fn> };
+}
+
+type Switchboard = Awaited<ReturnType<typeof startSwitchboard>>;
+
+async function withEnv<T>(
+  env: Record<string, string>,
+  run: (tempRoot: string) => Promise<T>,
+): Promise<T> {
+  const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-privacy-"));
+  const names = [
+    "PH_REACTOR_DATABASE_URL",
+    "AUTH_ENABLED",
+    "ADMINS",
+    "PH_PRIVACY_ENABLED",
+    "PH_PRIVACY_DEPLOYMENT_SECRET",
+    ...Object.keys(env),
+  ];
+  const previous = names.map((name) => [name, process.env[name]] as const);
+  for (const name of names) delete process.env[name];
+  process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+  Object.assign(process.env, env);
+  try {
+    return await run(tempRoot);
+  } finally {
+    for (const [name, value] of previous) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+async function freePort(): Promise<number> {
+  const server = createServer();
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  await new Promise((resolve) => server.close(resolve));
+  if (address === null || typeof address === "string") {
+    throw new Error("no port");
+  }
+  return address.port;
+}
+
+async function boot(
+  tempRoot: string,
+  logger: ILogger = stubLogger(),
+): Promise<Switchboard> {
+  return startSwitchboard({
+    workflows: { enabled: false },
+    dbPath: join(tempRoot, "read-model"),
+    port: await freePort(),
+    strictPort: true,
+    mcp: false,
+    disableLocalPackages: true,
+    identity: { keypairPath: join(tempRoot, "identity.json") },
+    logger,
+  });
+}
+
+async function queryErasure(switchboard: Switchboard) {
+  const response = await fetch(`http://127.0.0.1:${switchboard.port}/graphql`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      query: `{ erasureRequest(requestId: "none") { requestId } }`,
+    }),
+  });
+  return (await response.json()) as {
+    errors?: { message: string; extensions?: { code?: string } }[];
+  };
+}
+
+describe("booting Switchboard with the privacy add-on", () => {
+  it("mounts nothing when PH_PRIVACY_ENABLED is off", async () => {
+    await withEnv({}, async (tempRoot) => {
+      const switchboard = await boot(tempRoot);
+      try {
+        expect(switchboard.privacy).toBeUndefined();
+        const result = await queryErasure(switchboard);
+        expect(result.errors?.[0]?.message).toMatch(/erasureRequest/);
+        expect(result.errors?.[0]?.extensions?.code).not.toBe("FORBIDDEN");
+      } finally {
+        await switchboard.shutdown();
+      }
+    });
+  }, 60_000);
+
+  it("serves erasure to admins only when it is on under authentication", async () => {
+    await withEnv(
+      {
+        AUTH_ENABLED: "true",
+        ADMINS: ADMIN,
+        PH_PRIVACY_ENABLED: "true",
+        PH_PRIVACY_DEPLOYMENT_SECRET: SECRET,
+        PH_PRIVACY_INTERVAL_MS: "50",
+      },
+      async (tempRoot) => {
+        const logger = stubLogger();
+        const switchboard = await boot(tempRoot, logger);
+        try {
+          expect(switchboard.privacy).toBeDefined();
+          expect(await switchboard.privacy!.erasure.plan([])).toEqual({
+            maxPurgeOperations: expect.any(Number) as number,
+            items: [],
+          });
+          await vi.waitUntil(
+            async () =>
+              (await queryErasure(switchboard)).errors?.[0]?.extensions
+                ?.code === "FORBIDDEN",
+            { timeout: 20_000, interval: 100 },
+          );
+          const document = await switchboard.reactor.createEmpty(
+            "powerhouse/document-model",
+          );
+          const id = document.header.id;
+          await switchboard.reactor.deleteDocument(id);
+          const erasure = switchboard.privacy!.erasure;
+          const { requestId } = await erasure.request([id], {
+            requestedBy: ADMIN,
+          });
+          await vi.waitUntil(
+            async () => (await erasure.status(requestId)).status === "complete",
+            { timeout: 30_000, interval: 100 },
+          );
+          expect(
+            logger.error.mock.calls.filter(([message]) =>
+              String(message).startsWith("Erasure"),
+            ),
+          ).toEqual([]);
+        } finally {
+          await switchboard.shutdown();
+        }
+      },
+    );
+  }, 60_000);
+
+  it("refuses to boot under the OPEN policy", async () => {
+    await withEnv(
+      {
+        PH_PRIVACY_ENABLED: "true",
+        PH_PRIVACY_DEPLOYMENT_SECRET: SECRET,
+      },
+      async (tempRoot) => {
+        await expect(boot(tempRoot)).rejects.toThrow(/OPEN/);
+      },
+    );
+  }, 60_000);
+
+  it("refuses to boot without a deployment secret", async () => {
+    await withEnv(
+      { AUTH_ENABLED: "true", ADMINS: ADMIN, PH_PRIVACY_ENABLED: "true" },
+      async (tempRoot) => {
+        await expect(boot(tempRoot)).rejects.toThrow(
+          /PH_PRIVACY_DEPLOYMENT_SECRET/,
+        );
+      },
+    );
+  }, 60_000);
+});
+
+const PG_URL = process.env.REACTOR_TEST_PG_URL;
+
+describe.skipIf(!PG_URL)(
+  "the privacy add-on on a Postgres reactor store",
+  () => {
+    it("erases a document end to end", async () => {
+      const name = `sb_privacy_${process.pid}`;
+      const admin = new pg.Pool({ connectionString: PG_URL });
+      await admin.query(`DROP DATABASE IF EXISTS "${name}" WITH (FORCE)`);
+      await admin.query(`CREATE DATABASE "${name}"`);
+      const url = new URL(PG_URL!);
+      url.pathname = `/${name}`;
+      try {
+        await withEnv(
+          {
+            AUTH_ENABLED: "true",
+            ADMINS: ADMIN,
+            PH_PRIVACY_ENABLED: "true",
+            PH_PRIVACY_DEPLOYMENT_SECRET: SECRET,
+            PH_PRIVACY_INTERVAL_MS: "50",
+          },
+          async (tempRoot) => {
+            process.env.PH_REACTOR_DATABASE_URL = url.toString();
+            const logger = stubLogger();
+            const switchboard = await boot(tempRoot, logger);
+            try {
+              const document = await switchboard.reactor.createEmpty(
+                "powerhouse/document-model",
+              );
+              const id = document.header.id;
+              await switchboard.reactor.deleteDocument(id);
+              const erasure = switchboard.privacy!.erasure;
+              const { requestId } = await erasure.request([id], {
+                requestedBy: ADMIN,
+              });
+              await vi.waitUntil(
+                async () =>
+                  (await erasure.status(requestId)).status === "complete",
+                { timeout: 30_000, interval: 100 },
+              );
+              expect(
+                logger.error.mock.calls.filter(([message]) =>
+                  String(message).startsWith("Erasure"),
+                ),
+              ).toEqual([]);
+            } finally {
+              await switchboard.shutdown();
+            }
+          },
+        );
+      } finally {
+        await admin.query(`DROP DATABASE IF EXISTS "${name}" WITH (FORCE)`);
+        await admin.end();
+      }
+    }, 90_000);
+  },
+);

package/test/boot-unsupported-stored-documents.test.ts

@@ -0,0 +1,213 @@
+import { PGlite } from "@electric-sql/pglite";
+import { NodeFS } from "@electric-sql/pglite/nodefs";
+import {
+  JobStatus,
+  ReactorBuilder,
+  type Database,
+} from "@powerhousedao/reactor";
+import { driveDocumentModelModule } from "@powerhousedao/shared/document-drive";
+import {
+  withSignaturePolicy,
+  type PeerCapability,
+} from "@powerhousedao/shared/document-model";
+import type { ILogger } from "document-model";
+import { Kysely } from "kysely";
+import { cp, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from "vitest";
+import { ClosablePGliteDialect } from "../src/pglite-dialect.js";
+import { startSwitchboard } from "../src/server.mjs";
+import { StoredDocumentsRefusedError } from "../src/unsupported-stored-documents.mjs";
+
+const ENV_KEYS = [
+  "PH_REACTOR_DATABASE_URL",
+  "DATABASE_URL",
+  "REACTOR_UNSUPPORTED_STORED_DOCUMENTS",
+] as const;
+
+const BASE_REDUCER_7: PeerCapability = {
+  kind: "protocol",
+  name: "base-reducer",
+  baseline: [1, 2],
+  supported: () => [1, 2, 7],
+  preferred: () => 2,
+  optional: false,
+};
+
+type StubLogger = ILogger & {
+  warn: ReturnType<typeof vi.fn>;
+  error: ReturnType<typeof vi.fn>;
+};
+
+function stubLogger(): StubLogger {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as StubLogger;
+}
+
+/** A reactor store holding one drive created at base-reducer 7. */
+async function seedStore(dir: string): Promise<void> {
+  const db = new Kysely<Database>({
+    dialect: new ClosablePGliteDialect(new PGlite({ fs: new NodeFS(dir) })),
+  });
+  const module = await new ReactorBuilder()
+    .withKysely(db)
+    .withDocumentModelSources([driveDocumentModelModule as never])
+    .withPeerCapabilities([BASE_REDUCER_7])
+    .buildModule();
+  const created = await module.reactor.create(
+    withSignaturePolicy(
+      driveDocumentModelModule.utils.createDocument(),
+      "legacy",
+      {
+        id: "br7-stored",
+        protocolVersions: { "base-reducer": 7 },
+      },
+    ),
+  );
+  await vi.waitUntil(
+    async () => {
+      const { status } = await module.reactor.getJobStatus(created.id);
+      return status === JobStatus.READ_READY || status === JobStatus.FAILED;
+    },
+    // PGlite is several times slower on the Windows runner.
+    { timeout: BOOT_TIMEOUT, interval: 5 },
+  );
+  expect((await module.reactor.getJobStatus(created.id)).status).toBe(
+    JobStatus.READ_READY,
+  );
+  await module.reactor.kill().completed;
+  await db.destroy();
+  // PGlite leaves its lockfile behind after a clean close.
+  await rm(join(dir, "postmaster.pid"), { force: true });
+}
+
+// PGlite boots are several times slower on Windows runners.
+const BOOT_TIMEOUT = 120_000;
+// Windows can briefly keep just-closed store files locked (EBUSY/EPERM).
+const RM_OPTIONS = { recursive: true, force: true, maxRetries: 10 };
+
+describe("booting over documents this build does not run", () => {
+  let seeded: string;
+  let tempRoot: string;
+  let previous: Partial<Record<(typeof ENV_KEYS)[number], string>>;
+
+  beforeAll(async () => {
+    seeded = await mkdtemp(join(tmpdir(), "switchboard-stored-protocol-seed-"));
+    await seedStore(join(seeded, "reactor-storage"));
+  }, BOOT_TIMEOUT);
+
+  afterAll(async () => {
+    await rm(seeded, RM_OPTIONS);
+  }, BOOT_TIMEOUT);
+
+  beforeEach(async () => {
+    tempRoot = await mkdtemp(join(tmpdir(), "switchboard-stored-protocol-"));
+    previous = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    process.env.DATABASE_URL = join(tempRoot, "read-model");
+    delete process.env.REACTOR_UNSUPPORTED_STORED_DOCUMENTS;
+    await cp(
+      join(seeded, "reactor-storage"),
+      process.env.PH_REACTOR_DATABASE_URL,
+      { recursive: true },
+    );
+  }, BOOT_TIMEOUT);
+
+  afterEach(async () => {
+    for (const key of ENV_KEYS) {
+      if (previous[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = previous[key];
+      }
+    }
+    await rm(tempRoot, RM_OPTIONS);
+  }, BOOT_TIMEOUT);
+
+  function boot(logger: ILogger) {
+    return startSwitchboard({
+      workflows: { enabled: false },
+      port: 0,
+      mcp: false,
+      disableLocalPackages: true,
+      identity: { keypairPath: join(tempRoot, "identity.json") },
+      logger,
+    });
+  }
+
+  it(
+    "refuses by default and tells the operator both ways forward",
+    async () => {
+      const logger = stubLogger();
+
+      const booted = boot(logger);
+
+      await expect(booted).rejects.toSatisfy(
+        (error) =>
+          StoredDocumentsRefusedError.isError(error) &&
+          error.documents === 1 &&
+          error.versions.some(
+            ({ protocol, version }) =>
+              protocol === "base-reducer" && version === 7,
+          ),
+      );
+      const message = (await booted.catch((error: Error) => error)) as Error;
+      expect(message.message).toMatch(
+        /1 stored document\(s\) require base-reducer 7/,
+      );
+      expect(message.message).toMatch(
+        /switchboard build that runs base-reducer 7/,
+      );
+      expect(message.message).toMatch(
+        /REACTOR_UNSUPPORTED_STORED_DOCUMENTS=read-only/,
+      );
+      expect(logger.error).toHaveBeenCalledWith(message.message);
+      expect(logger.error).not.toHaveBeenCalledWith(
+        "App crashed: @error",
+        expect.anything(),
+      );
+    },
+    BOOT_TIMEOUT,
+  );
+
+  it(
+    "starts read-only when REACTOR_UNSUPPORTED_STORED_DOCUMENTS says so",
+    async () => {
+      process.env.REACTOR_UNSUPPORTED_STORED_DOCUMENTS = "read-only";
+      const logger = stubLogger();
+
+      const switchboard = await boot(logger);
+      try {
+        expect(logger.warn).toHaveBeenCalledWith(
+          expect.stringContaining("read-only"),
+          expect.stringContaining(
+            "1 stored document(s) require base-reducer 7",
+          ),
+        );
+        const stored = await switchboard.reactor.get("br7-stored");
+        expect(stored.header.id).toBe("br7-stored");
+      } finally {
+        await switchboard.shutdown();
+      }
+    },
+    BOOT_TIMEOUT,
+  );
+});

package/test/boot-without-renown.test.ts

@@ -0,0 +1,81 @@
+import {
+  isDerivedDocumentId,
+  signaturePolicyOf,
+} from "@powerhousedao/shared/document-model";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import type * as RenownModule from "../src/renown.js";
+import { startSwitchboard } from "../src/server.mjs";
+
+vi.mock("../src/renown.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof RenownModule>()),
+  initRenown: vi.fn().mockRejectedValue(new Error("Renown is unreachable")),
+}));
+
+function stubLogger(): ILogger & { warn: ReturnType<typeof vi.fn> } {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger & { warn: ReturnType<typeof vi.fn> };
+}
+
+describe("booting Switchboard without Renown", () => {
+  it("warns and creates legacy documents, which it can write unsigned", async () => {
+    const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-no-renown-"));
+    const previous = process.env.PH_REACTOR_DATABASE_URL;
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    const logger = stubLogger();
+    let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+    try {
+      switchboard = await startSwitchboard({
+        workflows: { enabled: false },
+        dbPath: join(tempRoot, "read-model"),
+        port: 0,
+        mcp: false,
+        disableLocalPackages: true,
+        logger,
+      });
+
+      expect(
+        logger.warn.mock.calls.some(
+          ([message]) =>
+            typeof message === "string" &&
+            message.includes("new documents are created legacy"),
+        ),
+      ).toBe(true);
+
+      const document = await switchboard.reactor.createEmpty(
+        "powerhouse/document-model",
+      );
+      expect(signaturePolicyOf(document.header)).toBe("legacy");
+      expect(isDerivedDocumentId(document.header.id)).toBe(false);
+
+      const renamed = await switchboard.reactor.rename(
+        document.header.id,
+        "Renamed",
+      );
+      expect(renamed.header.name).toBe("Renamed");
+
+      await switchboard.shutdown();
+      switchboard = undefined;
+    } finally {
+      await switchboard?.shutdown();
+      if (previous === undefined) {
+        delete process.env.PH_REACTOR_DATABASE_URL;
+      } else {
+        process.env.PH_REACTOR_DATABASE_URL = previous;
+      }
+      await rm(tempRoot, { recursive: true, force: true });
+    }
+  }, 60_000);
+});