@readymadeit/mcp 0.0.0-stage → 0.1.0

package/bundle/hkp-frontend/src/runtime/browser/services/tests/crypto-secrets.test.ts

@@ -0,0 +1,196 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  SecretStore,
+  THIS_DEVICE,
+  setSecretStore,
+} from "hkp-frontend/src/core/secrets";
+
+import encrypt from "../Encrypt";
+import decrypt from "../Decrypt";
+import sign from "../Sign";
+
+/**
+ * The services whose credential never leaves this process.
+ *
+ * Their passphrase used to be ordinary state, which meant a saved board carried
+ * it: open a board, save it, share it, and the key travels with it. What is
+ * pinned here is that a reference stays a reference — what the service reports
+ * is what it was configured with — while the value exists only inside the call
+ * that derives a key from it.
+ */
+
+function storeOf(
+  entries: Record<string, { value: string; audience?: string[] }>,
+): SecretStore {
+  return {
+    get: (alias) => entries[alias]?.value ?? null,
+    audience: (alias) => entries[alias]?.audience ?? null,
+    list: () => Object.keys(entries),
+  };
+}
+
+/** Enough of an AppInstance for these three, recording what they report. */
+function testApp() {
+  const notifications: any[] = [];
+  const emitted: any[] = [];
+  return {
+    notifications,
+    emitted,
+    app: {
+      notify: () => {},
+      next: (_svc: unknown, value: unknown) => emitted.push(value),
+      sendAction: (action: any) => notifications.push(action.payload),
+    } as any,
+  };
+}
+
+const make = (descriptor: any, app: any, state: Record<string, unknown> = {}) => {
+  const service = descriptor.create(app, "Board", {} as any, "svc-1");
+  service.configure(state);
+  return service;
+};
+
+afterEach(() => setSecretStore(null));
+
+describe("what a saved board carries", () => {
+  it.each([
+    ["Encrypt", encrypt],
+    ["Decrypt", decrypt],
+    ["Sign", sign],
+  ])("%s reports the reference it was configured with", async (_name, descriptor) => {
+    setSecretStore(storeOf({ pass: { value: "hunter2" } }));
+    const { app } = testApp();
+    const service = make(descriptor, app, { secret: "{{secret.pass}}" });
+
+    const config: any = await service.getConfiguration();
+    expect(config.secret).toBe("{{secret.pass}}");
+    // The value the reference stands for appears nowhere in what is saved.
+    expect(JSON.stringify(config)).not.toContain("hunter2");
+  });
+});
+
+describe("Encrypt and Decrypt", () => {
+  it("round-trip a value through a secret held only by the store", async () => {
+    setSecretStore(storeOf({ pass: { value: "hunter2" } }));
+    const { app } = testApp();
+    const encrypter = make(encrypt, app, { secret: "{{secret.pass}}" });
+    const decrypter = make(decrypt, app, { secret: "{{secret.pass}}" });
+
+    const ciphertext = await encrypter.process({ hello: "world" });
+    expect(typeof ciphertext).toBe("string");
+    expect(await decrypter.process(ciphertext)).toEqual({ hello: "world" });
+  });
+
+  it("still take a passphrase written out, as an older board holds one", async () => {
+    setSecretStore(storeOf({}));
+    const { app } = testApp();
+    const encrypter = make(encrypt, app, { secret: "written out" });
+    const decrypter = make(decrypt, app, { secret: "written out" });
+
+    const ciphertext = await encrypter.process("hello");
+    expect(await decrypter.process(ciphertext)).toBe("hello");
+  });
+
+  it("encrypt nothing with a secret the store does not hold", async () => {
+    setSecretStore(storeOf({}));
+    const { app, notifications } = testApp();
+    const encrypter = make(encrypt, app, { secret: "{{secret.absent}}" });
+
+    expect(await encrypter.process("hello")).toBeNull();
+    expect(JSON.stringify(notifications)).toContain("no value stored for absent");
+  });
+
+  it("encrypt nothing with a secret bound to a host", async () => {
+    // The case the audience exists for: a key pinned to somewhere on the
+    // network is not a key this may quietly reuse.
+    setSecretStore(
+      storeOf({ pass: { value: "hunter2", audience: ["api.example.com"] } }),
+    );
+    const { app, notifications } = testApp();
+    const encrypter = make(encrypt, app, { secret: "{{secret.pass}}" });
+
+    expect(await encrypter.process("hello")).toBeNull();
+    expect(JSON.stringify(notifications)).toContain("may only be sent to");
+  });
+});
+
+describe("Sign", () => {
+  it("signs with a secret held only by the store", async () => {
+    setSecretStore(storeOf({ key: { value: "hunter2" } }));
+    const { app } = testApp();
+    const signer = make(sign, app, { secret: "{{secret.key}}" });
+
+    const signature = await signer.process("payload");
+    expect(signature).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("produces the same signature the written-out key would", async () => {
+    setSecretStore(storeOf({ key: { value: "hunter2" } }));
+    const { app } = testApp();
+
+    const viaReference = await make(sign, app, {
+      secret: "{{secret.key}}",
+    }).process("payload");
+    const viaLiteral = await make(sign, app, { secret: "hunter2" }).process(
+      "payload",
+    );
+    expect(viaReference).toBe(viaLiteral);
+  });
+
+  it("signs nothing, and says why, with a secret the store does not hold", async () => {
+    setSecretStore(storeOf({}));
+    const { app, notifications } = testApp();
+    const signer = make(sign, app, { secret: "{{secret.absent}}" });
+
+    expect(await signer.process("payload")).toBeNull();
+    expect(JSON.stringify(notifications)).toContain("no value stored for absent");
+  });
+
+  it("emits nothing from a progressive run it cannot sign", async () => {
+    // The progressive path signs outside process(), so an unresolvable key has
+    // to stop it there too rather than emitting an unsigned or empty result.
+    setSecretStore(storeOf({}));
+    const { app, emitted } = testApp();
+    const signer = make(sign, app, {
+      method: "HmacSHA256p",
+      secret: "{{secret.absent}}",
+    });
+
+    await signer.process("chunk one");
+    await signer.configure({ finalize: true });
+    await vi.waitFor(() => expect(emitted).toEqual([]));
+  });
+
+  it("emits a signature from a progressive run it can", async () => {
+    setSecretStore(storeOf({ key: { value: "hunter2" } }));
+    const { app, emitted } = testApp();
+    const signer = make(sign, app, {
+      method: "HmacSHA256p",
+      secret: "{{secret.key}}",
+    });
+
+    await signer.process("chunk one");
+    await signer.configure({ finalize: true });
+    await vi.waitFor(() => expect(emitted).toHaveLength(1));
+    expect(emitted[0]).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("refuses a key bound to a host", () => {
+    setSecretStore(
+      storeOf({ key: { value: "hunter2", audience: ["api.example.com"] } }),
+    );
+    const { app } = testApp();
+    const signer = make(sign, app, { secret: "{{secret.key}}" });
+
+    return expect(signer.process("payload")).resolves.toBeNull();
+  });
+});
+
+describe("the device destination", () => {
+  it("is what these services resolve against", () => {
+    // Named here so the constant cannot be changed to something a host could
+    // also be called without a test noticing.
+    expect(THIS_DEVICE).toBe("(this device)");
+  });
+});

package/bundle/hkp-frontend/src/runtime/browser/services/tests/detect-service.test.ts

@@ -0,0 +1,119 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+/**
+ * Detect reports what it finds on every frame — none included — and keeps
+ * the rest of the input, so the pipeline decides what a finding means. The
+ * MediaPipe detector is replaced here: what is under test is the service
+ * around it, not the model.
+ */
+
+const detections = vi.hoisted(() => ({ current: [] as any[] }));
+const created = vi.hoisted(() => ({ count: 0, options: [] as any[] }));
+
+vi.mock("../detect/mediapipe", () => ({
+  createFaceDetector: vi.fn(async () => {
+    created.count++;
+    return {
+      detect: vi.fn(() => ({ detections: detections.current })),
+      setOptions: vi.fn(async (options: any) => created.options.push(options)),
+      close: vi.fn(),
+    };
+  }),
+}));
+
+import DetectDescriptor, { imageOf } from "../Detect";
+
+function makeDetect(state: Record<string, unknown> = {}) {
+  const app = { notify: vi.fn(), next: vi.fn(), sendAction: vi.fn() } as any;
+  const service = DetectDescriptor.create(app, "board", {} as any, "detect-1") as any;
+  service.configure(state);
+  return { service, app };
+}
+
+/** A canvas stands in for a frame: jsdom has no createImageBitmap for Blobs. */
+function frame(width = 200, height = 100) {
+  const canvas = document.createElement("canvas");
+  canvas.width = width;
+  canvas.height = height;
+  return canvas;
+}
+
+const FACE = {
+  categories: [{ score: 0.9 }],
+  boundingBox: { originX: 10, originY: 20, width: 30, height: 40 },
+  keypoints: [{ x: 0.5, y: 0.5 }],
+};
+
+describe("Detect", () => {
+  beforeEach(() => {
+    detections.current = [];
+    created.count = 0;
+    created.options = [];
+  });
+
+  it("reports faces in pixels of the frame, keeping the rest of the input", async () => {
+    detections.current = [FACE];
+    const { service } = makeDetect();
+    const image = frame();
+    const out = await service.process({ image, at: 1 });
+    expect(out).toEqual({
+      image,
+      at: 1,
+      count: 1,
+      frame: { width: 200, height: 100 },
+      faces: [
+        {
+          score: 0.9,
+          box: { x: 10, y: 20, width: 30, height: 40 },
+          keypoints: [{ x: 100, y: 50 }],
+        },
+      ],
+    });
+  });
+
+  it("reports a frame without faces rather than stopping", async () => {
+    const { service } = makeDetect();
+    const out = await service.process(frame());
+    expect(out.count).toBe(0);
+    expect(out.faces).toEqual([]);
+    // A bare image travels on as `image`.
+    expect(out.image).toBeInstanceOf(HTMLCanvasElement);
+  });
+
+  it("stops on an input with no image in it", async () => {
+    const { service } = makeDetect();
+    expect(await service.process({ text: "no picture" })).toBeNull();
+  });
+
+  it("loads the model once, from the first configure, and applies a new confidence to it", async () => {
+    const { service } = makeDetect();
+    await service.process(frame());
+    await service.process(frame());
+    expect(created.count).toBe(1);
+    service.configure({ minConfidence: 0.8 });
+    await vi.waitFor(() => expect(created.options).toEqual([{ minDetectionConfidence: 0.8 }]));
+  });
+
+  it("reports a Blob it cannot decode, and stops, rather than failing the pipeline", async () => {
+    const { service, app } = makeDetect();
+    vi.stubGlobal("createImageBitmap", vi.fn(async () => {
+      throw new Error("The source image could not be decoded.");
+    }));
+    try {
+      await expect(service.process(new Blob(["not an image"]))).resolves.toBeNull();
+      expect(app.sendAction).toHaveBeenCalledWith(
+        expect.objectContaining({ action: "notification" }),
+      );
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+
+  it("finds the image where Camera puts it, or takes the input as one", () => {
+    const blob = new Blob(["x"], { type: "image/png" });
+    expect(imageOf(blob)).toBe(blob);
+    expect(imageOf({ image: blob })).toBe(blob);
+    expect(imageOf({ image: "not an image" })).toBeNull();
+    expect(imageOf(undefined)).toBeNull();
+  });
+});

package/bundle/hkp-frontend/src/runtime/browser/services/tests/download.test.ts

@@ -0,0 +1,100 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import DownloadDescriptor from "../Download";
+import FileSourceDescriptor from "../FileSource";
+
+/** A blob's text; jsdom's Blob has no `text()`. */
+function textOf(blob: Blob): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader();
+    reader.onload = () => resolve(reader.result as string);
+    reader.onerror = () => reject(reader.error);
+    reader.readAsText(blob);
+  });
+}
+
+function create(descriptor: any, state: Record<string, unknown> = {}) {
+  const app = { notify: vi.fn(), log: vi.fn(), next: vi.fn() };
+  const svc: any = descriptor.create(app, "test-board", descriptor, "svc");
+  svc.configure(state);
+  app.notify.mockClear();
+  return { svc, app };
+}
+
+describe("Download", () => {
+  let saved: { name: string; blob: Blob }[] = [];
+  const blobs = new Map<string, Blob>();
+
+  beforeEach(() => {
+    saved = [];
+    let n = 0;
+    URL.createObjectURL = vi.fn((blob: Blob) => {
+      const url = `blob:test/${++n}`;
+      blobs.set(url, blob);
+      return url;
+    }) as any;
+    URL.revokeObjectURL = vi.fn();
+    vi.spyOn(HTMLAnchorElement.prototype, "click").mockImplementation(
+      function (this: HTMLAnchorElement) {
+        saved.push({ name: this.download, blob: blobs.get(this.href)! });
+      },
+    );
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("saves text under its filename and passes it on", async () => {
+    const { svc, app } = create(DownloadDescriptor, { filename: "tennis.sql" });
+    const text = "BEGIN TRANSACTION;\nCOMMIT;\n";
+    expect(svc.process(text)).toBe(text);
+    expect(saved).toHaveLength(1);
+    expect(saved[0].name).toBe("tennis.sql");
+    expect(saved[0].blob.type).toBe("text/plain;charset=utf-8");
+    expect(await textOf(saved[0].blob)).toBe(text);
+    expect(app.notify).toHaveBeenCalledWith(svc, {
+      saved: "tennis.sql",
+      bytes: text.length,
+      error: "",
+    });
+  });
+
+  it("saves anything else as its JSON, and bytes as bytes", async () => {
+    const { svc } = create(DownloadDescriptor, { filename: "rows.json" });
+    svc.process({ rows: [1, 2] });
+    expect(saved[0].blob.type).toBe("application/json");
+    expect(JSON.parse(await textOf(saved[0].blob))).toEqual({ rows: [1, 2] });
+
+    svc.process(new Uint8Array([1, 2, 3]));
+    expect(saved[1].blob.type).toBe("application/octet-stream");
+    expect(saved[1].blob.size).toBe(3);
+  });
+
+  it("uses the configured type when there is one", () => {
+    const { svc } = create(DownloadDescriptor, { mimeType: "application/sql" });
+    svc.process("SELECT 1;");
+    expect(saved[0].blob.type).toBe("application/sql");
+  });
+
+  it("saves nothing when nothing arrives", () => {
+    const { svc } = create(DownloadDescriptor);
+    expect(svc.process(null)).toBeNull();
+    expect(saved).toEqual([]);
+  });
+});
+
+describe("File Source handed a file", () => {
+  it("reads it as text, tells the picker it is done, and passes it on", async () => {
+    const { svc, app } = create(FileSourceDescriptor);
+    const file = new File(["CREATE TABLE t (n);"], "dump.sql", {
+      type: "application/sql",
+    });
+    await svc.send(file);
+    expect(app.notify.mock.calls.map((call) => call[1])).toEqual([
+      { progress: "Reading dump.sql…" },
+      { progress: "" },
+    ]);
+    expect(app.next).toHaveBeenCalledWith(svc, "CREATE TABLE t (n);");
+  });
+});

package/bundle/hkp-frontend/src/runtime/browser/services/tests/expressionEval.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, it } from "vitest";
+
+import { evaluate, parse } from "../base/expressionEval";
+
+/**
+ * The expressions a board writes, and what evaluating one may reach
+ * (base/expressionEval.ts). The same cases are pinned in hkp-node
+ * (tests/expression-eval.test.ts).
+ */
+
+const run = (source: string, scope: Record<string, unknown> = {}) =>
+  evaluate(parse(source), scope);
+
+describe("an expression", () => {
+  it("computes what JavaScript would", () => {
+    expect(run("1 + 2 * 3")).toBe(7);
+    expect(run("(1 + 2) * 3")).toBe(9);
+    expect(run("'a' + 1")).toBe("a1");
+    expect(run("7 % 4 === 3 && !false")).toBe(true);
+    expect(run("x > 2 ? 'big' : 'small'", { x: 3 })).toBe("big");
+    expect(run("[1, x, 3]", { x: 2 })).toEqual([1, 2, 3]);
+    expect(run("-x", { x: 4 })).toBe(-4);
+  });
+
+  it("short-circuits as JavaScript does", () => {
+    let called = false;
+    const touch = () => {
+      called = true;
+      return true;
+    };
+    expect(run("false && touch()", { touch })).toBe(false);
+    expect(run("true || touch()", { touch })).toBe(true);
+    expect(called).toBe(false);
+  });
+
+  it("reads members and calls what the scope gives it", () => {
+    const scope = {
+      params: { name: "Ada", list: [1, 2, 3] },
+      max: Math.max,
+      double: (x: number) => x * 2,
+    };
+    expect(run("params.name", scope)).toBe("Ada");
+    expect(run("params['name']", scope)).toBe("Ada");
+    expect(run("params.list[1]", scope)).toBe(2);
+    expect(run("params.name.toUpperCase()", scope)).toBe("ADA");
+    expect(run("params.list.map(double)", scope)).toEqual([2, 4, 6]);
+    expect(run("max(1, 5)", scope)).toBe(5);
+  });
+
+  it("names only what the scope owns", () => {
+    expect(run("missing")).toBeUndefined();
+    // Inherited from Object.prototype, and not a name here.
+    expect(run("constructor")).toBeUndefined();
+    expect(run("toString")).toBeUndefined();
+    expect(run("hasOwnProperty")).toBeUndefined();
+  });
+
+  it("has no way from a value to the code behind it", () => {
+    const scope = { x: {}, s: "text", f: () => 1 };
+    for (const source of [
+      "x.constructor",
+      "x['constructor']",
+      "x[['constructor']]",
+      "s.constructor.constructor('return process')()",
+      "f.constructor('return process')()",
+      "f.prototype",
+      "x.__proto__",
+      "x['__proto__']",
+      "x.__defineGetter__",
+      "x.__lookupGetter__",
+    ]) {
+      expect(() => run(source, scope), source).toThrow(/disallowed/);
+    }
+  });
+
+  it("cannot assign", () => {
+    expect(() => parse("x = 1")).toThrow();
+    expect(() => parse("x.y = 1")).toThrow();
+  });
+
+  it("refuses to call what is not a function", () => {
+    expect(() => run("x()", { x: 1 })).toThrow(TypeError);
+    expect(() => run("missing()")).toThrow(/missing is not a function/);
+  });
+
+  it("reads a member of nothing as nothing, as hkp-rt and hkp-python do", () => {
+    const scope = { params: { a: { b: 1 }, none: null } };
+    expect(run("params.x", scope)).toBeUndefined();
+    expect(run("params.x.y.z", scope)).toBeUndefined();
+    expect(run("params.none.y", scope)).toBeUndefined();
+    expect(run("params.x.y", {})).toBeUndefined();
+    expect(run("params.x.y || 'fallback'", scope)).toBe("fallback");
+    expect(run("params.a.b", scope)).toBe(1);
+    // A member of nothing is still refused by name.
+    expect(() => run("params.x.constructor", scope)).toThrow(/disallowed/);
+  });
+
+  it("reports the reads that found nothing, once per chain", () => {
+    const scope = { params: { a: { b: 1 }, list: [1], none: null } };
+    const reads = (source: string, s: Record<string, unknown> = scope) => {
+      const missing: string[] = [];
+      evaluate(parse(source), s, (path) => missing.push(path));
+      return missing;
+    };
+    expect(reads("params.a.b")).toEqual([]);
+    expect(reads("params.titel")).toEqual(["params.titel"]);
+    expect(reads("params.x.y.z")).toEqual(["params.x"]);
+    expect(reads("params.a.c")).toEqual(["params.a.c"]);
+    expect(reads("params.list[3]")).toEqual(["params.list[3]"]);
+    expect(reads("params['x y']")).toEqual(['params["x y"]']);
+    expect(reads("params.id || params.link")).toEqual(["params.id", "params.link"]);
+    // Present, if empty, is not missing.
+    expect(reads("params.none")).toEqual([]);
+    // No input at all: the first read of it is what is missing.
+    expect(reads("params.title", { params: undefined })).toEqual(["params.title"]);
+  });
+});

package/bundle/hkp-frontend/src/runtime/browser/services/tests/fetcher-panel.test.tsx

@@ -0,0 +1,35 @@
+import { describe, expect, it, vi } from "vitest";
+import { act, render, screen, waitFor } from "@testing-library/react";
+import FetcherUI from "../FetcherUI";
+
+function service() {
+  return {
+    uuid: "request", serviceId: "hookup.to/service/fetcher", serviceName: "Request", board: "b",
+    app: { registerNotificationTarget: vi.fn(), unregisterNotificationTarget: vi.fn() },
+    configure: vi.fn(async () => {}), process: vi.fn(), destroy: vi.fn(),
+    getConfiguration: vi.fn(async () => ({
+      url: null, method: "GET", headers: {}, body: null, bodyExpression: null, bodyFormat: "text",
+    })),
+  } as any;
+}
+
+describe("the Fetcher panel's empty fields", () => {
+  it("keeps null service values controlled, and clears a previously configured URL", async () => {
+    const errors = vi.spyOn(console, "error");
+    const svc = service();
+    render(<FetcherUI service={svc} onServiceAction={vi.fn()} />);
+    await waitFor(() => expect(svc.getConfiguration).toHaveBeenCalled());
+    const notify = (state: Record<string, unknown>) => {
+      for (const [, target] of svc.app.registerNotificationTarget.mock.calls) target(state);
+    };
+    await act(async () => notify({ url: "https://api.example.test", body: "hello", bodyExpression: "params" }));
+    expect(screen.getByDisplayValue("https://api.example.test")).toBeTruthy();
+    // A partial state update must not clear a configured field.
+    await act(async () => notify({ method: "POST" }));
+    expect(screen.getByDisplayValue("https://api.example.test")).toBeTruthy();
+    // Null explicitly clears the service value; the UI displays an empty string.
+    await act(async () => notify({ url: null, body: null, bodyExpression: null }));
+    expect(screen.queryByDisplayValue("https://api.example.test")).toBeNull();
+    expect(errors).not.toHaveBeenCalled();
+  });
+});

package/bundle/hkp-frontend/src/runtime/browser/services/tests/fetcher-service.test.ts

@@ -0,0 +1,80 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import FetcherDescriptor from "../Fetcher";
+
+/**
+ * The Fetcher's request, as composed from the input it is fetched for: the
+ * `{{params.…}}` references a URL may carry, and the header expressions that
+ * read the input.
+ */
+
+function createService() {
+  const app = {
+    notify: vi.fn(),
+    next: vi.fn(),
+    sendAction: vi.fn(),
+    getRuntimeVariable: vi.fn(() => ({})),
+  };
+  const svc = FetcherDescriptor.create(app as any, "test-board", {} as any, "svc-1");
+  return svc as any;
+}
+
+let fetchMock: ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+  fetchMock = vi.fn(
+    async () =>
+      new Response('{"ok":true}', { headers: { "content-type": "application/json" } }),
+  );
+  vi.stubGlobal("fetch", fetchMock);
+});
+
+describe("the address it fetches", () => {
+  it("fills a reference from the input, encoded as a part of the address", async () => {
+    const svc = createService();
+    await svc.configure({ url: "https://api.example.com/users/{{params.user.id}}?q={{params.q}}" });
+
+    expect(await svc.process({ user: { id: 42 }, q: "a&b c" })).toEqual({ ok: true });
+    expect(fetchMock.mock.calls[0][0]).toBe("https://api.example.com/users/42?q=a%26b%20c");
+  });
+
+  it("takes a reference that is the whole url as the whole address", async () => {
+    const svc = createService();
+    await svc.configure({ url: "{{params.link}}" });
+
+    await svc.process({ link: "https://example.com/a?b=1" });
+    expect(fetchMock.mock.calls[0][0]).toBe("https://example.com/a?b=1");
+  });
+
+  it("leaves nothing where the input has nothing", async () => {
+    const svc = createService();
+    await svc.configure({ url: "https://api.example.com/items/{{params.id}}" });
+
+    await svc.process({});
+    expect(fetchMock.mock.calls[0][0]).toBe("https://api.example.com/items/");
+  });
+
+  it("leaves a url without references as it was written", async () => {
+    const svc = createService();
+    await svc.configure({ url: "https://api.example.com/zen?x={{other}}" });
+
+    await svc.process({ other: "ignored" });
+    expect(fetchMock.mock.calls[0][0]).toBe("https://api.example.com/zen?x={{other}}");
+  });
+});
+
+describe("the headers it sends", () => {
+  it("evaluates a header expression against the input", async () => {
+    const svc = createService();
+    await svc.configure({
+      url: "https://api.example.com/me",
+      headers: { "Authorization=": "concat('Bearer ', params.token)", Accept: "application/json" },
+    });
+
+    await svc.process({ token: "t0k" });
+    expect(fetchMock.mock.calls[0][1].headers).toEqual({
+      Authorization: "Bearer t0k",
+      Accept: "application/json",
+    });
+  });
+});

package/bundle/hkp-frontend/src/runtime/browser/services/tests/filter-service.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it, vi } from "vitest";
+import FilterDescriptor, {
+  normalizeFilterConditions,
+} from "../base/Filter";
+
+function createFilter() {
+  const app = { notify: vi.fn() };
+  const service = new FilterDescriptor.Filter(
+    app as any,
+    "test-board",
+    {} as any,
+    "filter-1",
+  );
+  return { app, service };
+}
+
+describe("Filter condition configuration", () => {
+  it("canonicalizes the documented single-string form to an array", () => {
+    const { app, service } = createFilter();
+
+    service.configure({ conditions: "params.enabled === true" });
+
+    expect(service.conditions).toEqual(["params.enabled === true"]);
+    expect(app.notify).toHaveBeenCalledWith(service, {
+      conditions: ["params.enabled === true"],
+    });
+  });
+
+  it("turns malformed condition state into a safe empty list", () => {
+    expect(normalizeFilterConditions({ expression: "params.enabled" })).toEqual(
+      [],
+    );
+    expect(normalizeFilterConditions(["params.enabled", 42, null])).toEqual([
+      "params.enabled",
+    ]);
+  });
+});