@pplethai/cli 0.7.0 → 0.8.0

package/templates/golden-path/test/service-call.test.ts

@@ -0,0 +1,166 @@
+// serviceCall (ADR-0024). The Identity header is base64url of the UTF-8 JSON,
+// so a Thai name round-trips. encodeIdentityHeader is the one encoder the
+// dev wrapper and callRegistry share; serviceCall undoes it.
+
+import { describe, expect, it } from "vitest";
+import type { Identity } from "../shared/api";
+import { encodeIdentityHeader } from "../src/identity-header";
+import worker from "../src/index";
+import { serviceCall } from "../src/registry";
+
+const IDENTITY: Identity = {
+  actor: {
+    sub: "u-delegate",
+    name: "ชื่อนกทดสอบ",
+    mobile: "0810000014",
+    kyc: {
+      status: "verified",
+      verified: true,
+      verifiedAt: "2024-04-01T00:00:00.000Z",
+      source: "membership",
+    },
+    membership: { memberSince: "2020-05-01" },
+  },
+  effective: {
+    isDelegated: true,
+    sub: "347513243977122153",
+    activeRole: "province",
+    eligibleRoles: ["province"],
+    provinces: ["เชียงใหม่"],
+    extraRoles: ["exco", "province_co"],
+  },
+};
+
+describe("serviceCall", () => {
+  it("round-trips the shared encoder, including a Thai name", () => {
+    const encoded = encodeIdentityHeader(IDENTITY);
+    expect(encoded).toMatch(/^[A-Za-z0-9_-]+$/);
+    expect(encoded).not.toContain("ชื่อ");
+
+    const call = serviceCall(
+      new Request("https://provider.invalid/offices", {
+        headers: {
+          "x-pple-consumer": "brave-purple-lion",
+          "x-pple-entry": "calm-amber-fox/branch-list",
+          "x-pple-identity": encoded,
+          "x-pple-user-token": "raw-token-must-not-surface",
+          authorization: "Bearer raw-token-must-not-surface",
+        },
+      }),
+    );
+
+    expect(call).toEqual({
+      consumer: "brave-purple-lion",
+      entry: "calm-amber-fox/branch-list",
+      identity: IDENTITY,
+    });
+    expect(JSON.stringify(call)).not.toContain("raw-token-must-not-surface");
+  });
+
+  it("round-trips a null effective sub", () => {
+    const identity: Identity = {
+      ...IDENTITY,
+      effective: { ...IDENTITY.effective, sub: null },
+    };
+    const call = serviceCall(
+      new Request("https://provider.invalid/", {
+        headers: {
+          "x-pple-consumer": "brave-purple-lion",
+          "x-pple-entry": "calm-amber-fox/branch-list",
+          "x-pple-identity": encodeIdentityHeader(identity),
+        },
+      }),
+    );
+    expect(call?.identity).toEqual(identity);
+  });
+
+  it("treats an Identity header with no effective sub as no Identity", () => {
+    const effective = {
+      isDelegated: IDENTITY.effective.isDelegated,
+      activeRole: IDENTITY.effective.activeRole,
+      eligibleRoles: IDENTITY.effective.eligibleRoles,
+      provinces: IDENTITY.effective.provinces,
+      extraRoles: IDENTITY.effective.extraRoles,
+    };
+    const call = serviceCall(
+      new Request("https://provider.invalid/", {
+        headers: {
+          "x-pple-consumer": "brave-purple-lion",
+          "x-pple-entry": "calm-amber-fox/branch-list",
+          "x-pple-identity": encodeIdentityHeader({ actor: IDENTITY.actor, effective } as Identity),
+        },
+      }),
+    );
+    expect(call?.identity).toBeNull();
+  });
+
+  it("treats an Identity header with no membership as no Identity", () => {
+    const stale = {
+      actor: {
+        sub: IDENTITY.actor.sub,
+        name: IDENTITY.actor.name,
+        mobile: IDENTITY.actor.mobile,
+        kyc: IDENTITY.actor.kyc,
+      },
+      effective: IDENTITY.effective,
+    };
+    const call = serviceCall(
+      new Request("https://provider.invalid/", {
+        headers: {
+          "x-pple-consumer": "brave-purple-lion",
+          "x-pple-entry": "calm-amber-fox/branch-list",
+          "x-pple-identity": encodeIdentityHeader(stale as Identity),
+        },
+      }),
+    );
+    expect(call?.identity).toBeNull();
+  });
+
+  it("returns the call with no Identity when the entry declares userToken none", () => {
+    expect(
+      serviceCall(
+        new Request("https://provider.invalid/", {
+          headers: {
+            "x-pple-consumer": "brave-purple-lion",
+            "x-pple-entry": "calm-amber-fox/branch-list",
+            "x-pple-user-token": "still-not-a-fact",
+          },
+        }),
+      ),
+    ).toEqual({
+      consumer: "brave-purple-lion",
+      entry: "calm-amber-fox/branch-list",
+      identity: null,
+    });
+  });
+
+  it("returns null when the request is not a platform registry call", () => {
+    expect(serviceCall(new Request("https://app.example/api/notes"))).toBeNull();
+    expect(
+      serviceCall(new Request("https://app.example/api/notes", { headers: { "x-pple-consumer": "only-one" } })),
+    ).toBeNull();
+  });
+
+  it("treats an identity header that is not the encoding as no Identity", () => {
+    expect(
+      serviceCall(
+        new Request("https://provider.invalid/", {
+          headers: {
+            "x-pple-consumer": "brave-purple-lion",
+            "x-pple-entry": "calm-amber-fox/branch-list",
+            "x-pple-identity": "not-json",
+          },
+        }),
+      ),
+    ).toEqual({
+      consumer: "brave-purple-lion",
+      entry: "calm-amber-fox/branch-list",
+      identity: null,
+    });
+  });
+
+  it("puts a registry slot on the Worker default export", () => {
+    expect(worker.registry).toEqual({});
+    expect(typeof worker.fetch).toBe("function");
+  });
+});

package/templates/golden-path/vite.config.ts

@@ -2,13 +2,14 @@ import { fileURLToPath } from "node:url";
 import { cloudflare } from "@cloudflare/vite-plugin";
 import react from "@vitejs/plugin-react";
 import { defineConfig } from "vite";
+import { overlayMtimePlugin } from "./overlay-mtime.mjs";
 
 // The Cloudflare plugin reads wrangler.jsonc, runs the Worker in the real
 // Workers runtime during `vite dev`, and builds a deployable bundle with
 // `vite build`. `vite dev` serves the React app and the /api/* Worker from a
 // single origin, so no CORS or proxy config is needed.
 export default defineConfig({
-  plugins: [react(), cloudflare()],
+  plugins: [overlayMtimePlugin(), react(), cloudflare()],
   resolve: {
     alias: [
       // @pplethai/components ships a "development" export condition pointing at

package/templates/golden-path/vitest.config.ts

@@ -4,6 +4,7 @@ import {
   readD1Migrations,
 } from "@cloudflare/vitest-pool-workers";
 import { defineConfig } from "vitest/config";
+import { overlayMtimePlugin } from "./overlay-mtime.mjs";
 
 // Runs the smoke tests inside the real Workers runtime (workerd) with local
 // D1 and R2, so the tests exercise the same code paths as production. The D1
@@ -12,6 +13,7 @@ export default defineConfig(async () => {
   const migrations = await readD1Migrations(path.join(__dirname, "migrations"));
   return {
     plugins: [
+      overlayMtimePlugin(),
       cloudflareTest({
         wrangler: { configPath: "./wrangler.jsonc" },
         miniflare: {