@sleep2agi/commhub-server 0.9.0-preview.13 → 0.9.0-preview.131

package/src/delivered-without-push.test.ts

@@ -0,0 +1,140 @@
+// f015d9d6 症状①：tasks.status 被置为 'delivered'，而 SSE 推送根本没发出。
+//
+// send_task 无条件以字面量 'delivered' 插入 tasks 行，推送却另外被
+// `if (target.state === "online")` 挡着（tools.ts:1432）。同一段代码里给
+// network observer 的事件把同一件事标成 "queued" —— 也就是说代码**知道**
+// 它没投出去，却仍然把 delivered 写进了 tasks.status。
+//
+// 而 "online" 的判据是 resolveDeliveryTarget 里的
+//   stale = now - (last_seen_at || updated_at) > 5 分钟
+// 且 last_seen_at 只在 report_status 时刷新（tools.ts:674/702）。
+// 全网「停发心跳/状态类消息」的省额度规则之下，一个安静的 MCP 会话必然变 stale。
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { db } from "./db.js";
+import { registerTools } from "./tools.js";
+import { __resetSSEClientsForTest, createSSEStream } from "./push.js";
+
+const NET = "net_delivered_push_f015";
+const USER = "user_delivered_push_f015";
+const SENDER = "sender-f015b";
+const TARGET = "quiet-mcp-f015b";
+
+type ToolHandler = (args: any) => Promise<{ content: Array<{ type: "text"; text: string }> }>;
+
+function cleanup() {
+  __resetSSEClientsForTest();
+  for (const t of ["tasks", "inbox", "task_events", "sessions", "api_tokens", "nodes", "rename_txn"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id = ?1`, [NET]); } catch {}
+  }
+  try { db.run("DELETE FROM network_members WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id = ?1", [NET]); } catch {}
+  try { db.run("DELETE FROM users WHERE user_id = ?1", [USER]); } catch {}
+}
+
+/** minutesAgo 控制目标会话的 last_seen_at —— 这是本文件唯一要动的变量。 */
+function seed(minutesAgo: number) {
+  db.run("INSERT INTO users (user_id, username, password_hash, role, created_at) VALUES (?1, ?1, 'x', 'admin', datetime('now'))", [USER]);
+  db.run("INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))", [NET, USER]);
+  db.run("INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))", [USER, NET]);
+  for (const alias of [SENDER, TARGET]) {
+    db.run(
+      "INSERT INTO api_tokens (token_id, token_hash, user_id, network_id, name, scope) VALUES (?1, ?2, ?3, ?4, ?5, 'network')",
+      [`token-${alias}`, `hash-${alias}`, USER, NET, `node:${alias}`],
+    );
+  }
+  db.run(
+    "INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at) VALUES (?1, ?1, 'idle', NULL, ?2, datetime('now'), datetime('now', ?3))",
+    [SENDER, NET, "-1 minutes"],
+  );
+  // 🔴 目标：MCP 挂载的 claude-code 会话形状（node_id NULL），
+  //    status 是 'idle'（不是 offline），只是安静了 minutesAgo 分钟。
+  db.run(
+    "INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at) VALUES (?1, ?2, 'idle', NULL, ?3, datetime('now', ?4), datetime('now', ?4))",
+    [`cc-n_${TARGET}`, TARGET, NET, `-${minutesAgo} minutes`],
+  );
+}
+
+function toolsFor(alias: string): Record<string, ToolHandler> {
+  const server = new McpServer({ name: "delivered-push-f015", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const original = server.tool.bind(server);
+  server.tool = (name: string, description: string, schema: any, handler: ToolHandler) => {
+    tools[name] = handler; return original(name, description, schema, handler);
+  };
+  registerTools(server, undefined, NET, USER, alias, true, `token-${alias}`);
+  return tools;
+}
+
+/** 从订阅者那一侧真正读出字节 —— 地面真相，不是连接计数。 */
+async function readUntil(reader: ReadableStreamDefaultReader<Uint8Array>, needle: string, ms = 1500): Promise<string | null> {
+  const dec = new TextDecoder();
+  let buf = "";
+  const deadline = Date.now() + ms;
+  while (Date.now() < deadline) {
+    const chunk = await Promise.race([
+      reader.read(),
+      new Promise<{ done: true; value: undefined }>((r) => setTimeout(() => r({ done: true, value: undefined }), 200)),
+    ]);
+    if (chunk.value) buf += dec.decode(chunk.value, { stream: true });
+    if (buf.includes(needle)) return buf;
+  }
+  return null;
+}
+
+let sendSeq = 0;
+/** minutesAgo = 目标安静了多久；withSubscriber = 是否真的有人连着。 */
+async function send(minutesAgo: number, withSubscriber = true) {
+  cleanup(); seed(minutesAgo);
+  let reader: ReadableStreamDefaultReader<Uint8Array> | null = null;
+  if (withSubscriber) {
+    const res = createSSEStream(TARGET, NET);
+    reader = res.body!.getReader();
+  }
+  const r = await toolsFor(SENDER).send_task({ alias: TARGET, task: `ping-${++sendSeq}`, priority: "normal" });
+  const out = JSON.parse(r.content[0].text);
+  const row = db.get<{ status: string }>("SELECT status FROM tasks WHERE to_name = ?1 AND network_id = ?2", TARGET, NET);
+  const received = reader ? await readUntil(reader, "new_task") : null;
+  return { out, taskStatus: row?.status ?? null, received };
+}
+
+describe("f015d9d6 症状① — delivered 置位与实际推送不同步", () => {
+  beforeEach(() => cleanup());
+  afterAll(() => cleanup());
+
+  test("对照：目标 1 分钟前还活跃 ⇒ 订阅者收到 new_task", async () => {
+    const { taskStatus, received } = await send(1);
+    expect(taskStatus).toBe("delivered");
+    expect(received).toContain("new_task");
+  });
+
+  test("🔴 核心：目标安静 10 分钟但订阅者连着 ⇒ 仍然收得到（修复前这里收到 null）", async () => {
+    const { taskStatus, received } = await send(10);
+    expect(received).toContain("new_task");
+    expect(taskStatus).toBe("delivered");   // 现在这个 delivered 是真话了
+  });
+
+  test("🔴 可达性判据必须来自订阅者注册表，不是 last_seen_at 的时间戳猜测", async () => {
+    // 安静 10 分钟 = 时间戳判据会说 offline；而实际上有人在听。
+    const quiet = await send(10);
+    expect(quiet.received).toContain("new_task");
+    // 真没人听的时候，pushEvent 本来就是 no-op，不需要额外的闸来保护。
+    const nobody = await send(10, false);
+    expect(nobody.received).toBeNull();
+  });
+
+  test("真的没有订阅者时，tasks 行仍写 delivered —— 本 PR 刻意不改，记录在案", async () => {
+    const { taskStatus, received } = await send(10, false);
+    expect(received).toBeNull();
+    // 这一条钉的是**当前行为**，不是我认为对的行为：没人收到，行仍自称 delivered。
+    expect(taskStatus).toBe("delivered");
+  });
+
+  test("活性判据的输入 last_seen_at 只由 report_status 刷新 —— 发送方不刷新它", async () => {
+    cleanup(); seed(4);
+    const before = db.get<{ last_seen_at: string }>("SELECT last_seen_at FROM sessions WHERE alias = ?1 AND network_id = ?2", TARGET, NET);
+    await toolsFor(SENDER).send_task({ alias: TARGET, task: `ping-${++sendSeq}`, priority: "normal" });
+    const after = db.get<{ last_seen_at: string }>("SELECT last_seen_at FROM sessions WHERE alias = ?1 AND network_id = ?2", TARGET, NET);
+    expect(after?.last_seen_at).toBe(before!.last_seen_at);
+  });
+});

package/src/department-groups-http.test.ts

@@ -0,0 +1,209 @@
+// RFC-042(看板 #457)部门群,第一个 PR:建群 / 查群 / 权限 / 删部门解除关联。
+// HTTP 集成测试(真实 Bun.serve,私有端口,临时库;PostgreSQL 由 test2123 梯子用 COMMHUB_TEST_PG_URL 跑同一个文件)。
+// 钉住:谁能建(owner / admin / Hub 管理员 / 部门(含上级)负责人)、谁能看(群成员 + 管理者,别人 404)、
+// Agent(节点令牌)一律 403、建群时的成员 = 部门子树成员 ∪ 子树负责人、一个部门一个群、删部门只解除关联。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-dept-groups-"));
+let BASE = "";
+let hub: any = null;
+const PW = "DeptGroupsPassw0rd!x";
+let NET = "";
+const U: Record<string, { token: string; id: string }> = {};
+const DEPT: Record<string, string> = {};
+
+async function send(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, { method, headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body) });
+  const text = await res.text();
+  let json: any = null;
+  try { json = JSON.parse(text); } catch {}
+  return { status: res.status, body: json };
+}
+const D = (suffix = "") => `/api/networks/${NET}/departments${suffix}`;
+const G = (deptKey: string) => D(`/${DEPT[deptKey]}/group`);
+const CG = (suffix = "") => `/api/networks/${NET}/chat-groups${suffix}`;
+const ids = (members: Array<{ user_id: string }>) => members.map((m) => m.user_id).sort();
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`dg_owner_${Date.now()}`, PW, undefined, "Owner");
+  expect(a.ok).toBe(true);
+  U.owner = { token: a.token!, id: a.user!.user_id };
+  NET = a.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [U.owner.id]);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  const add = async (username: string, role: string) => {
+    expect((await send(U.owner.token, "POST", "/api/admin/users", { username, password: PW, network_id: NET, role })).status).toBe(200);
+    const login = await send("", "POST", "/api/auth/login", { username, password: PW });
+    expect(login.status).toBe(200);
+    return { token: login.body.token as string, id: login.body.user.user_id as string };
+  };
+  const stamp = Date.now();
+  U.admin = await add(`dg_admin_${stamp}`, "admin");
+  U.head = await add(`dg_head_${stamp}`, "member");     // 研发部负责人
+  U.alice = await add(`dg_alice_${stamp}`, "member");   // 研发部成员
+  U.bob = await add(`dg_bob_${stamp}`, "member");       // 后端组成员 + 后端组负责人
+  U.carol = await add(`dg_carol_${stamp}`, "member");   // 未分配
+  U.viewer = await add(`dg_viewer_${stamp}`, "viewer"); // 研发部成员,只读
+  U.node = { token: createNetworkTokenForNode(U.owner.id, NET, "dg-node", "node_dg").token!, id: "node_dg" };
+  const o = register(`dg_outsider_${stamp}`, PW);
+  U.outsider = { token: o.token!, id: o.user!.user_id };
+
+  const mk = async (name: string, extra: Record<string, unknown> = {}) => {
+    const r = await send(U.owner.token, "POST", D(), { name, ...extra });
+    expect(r.status).toBe(201);
+    return r.body.department.id as string;
+  };
+  DEPT.rd = await mk("研发部", { leader_user_id: U.head.id });
+  DEPT.backend = await mk("后端组", { parent_id: DEPT.rd, leader_user_id: U.bob.id });
+  DEPT.market = await mk("市场部");
+  const place = async (who: string, dept: string | null) =>
+    expect((await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U[who].id}/department`, { department_id: dept })).status).toBe(200);
+  await place("head", DEPT.rd);
+  await place("alice", DEPT.rd);
+  await place("viewer", DEPT.rd);
+  await place("bob", DEPT.backend);
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("who can create a department group", () => {
+  test("members, viewers, outsiders, nodes and unauthenticated callers cannot", async () => {
+    expect((await send(U.carol.token, "POST", G("rd"), {})).body.error).toBe("owner/admin required");
+    expect((await send(U.carol.token, "POST", G("rd"), {})).status).toBe(403);
+    expect((await send(U.alice.token, "POST", G("rd"), {})).status).toBe(403);
+    expect((await send(U.viewer.token, "POST", G("rd"), {})).status).toBe(403);
+    expect((await send(U.outsider.token, "POST", G("rd"), {})).status).toBe(403);
+    const node = await send(U.node.token, "POST", G("rd"), {});
+    expect(node.status).toBe(403);
+    expect(node.body.error).toBe("humans_only");
+    expect((await send("", "POST", G("rd"), {})).status).toBe(401);
+    expect(Number(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM chat_groups WHERE network_id = ?1", NET)?.n ?? 0)).toBe(0);
+  });
+
+  test("a head cannot create one outside their subtree (sub-department head → parent or sibling)", async () => {
+    for (const key of ["rd", "market"]) {
+      const r = await send(U.bob.token, "POST", G(key), {});
+      expect(r.status).toBe(403);
+      expect(r.body.error).toBe("department_scope_denied");
+    }
+  });
+
+  test("owner creates the 研发部 group: name defaults to the department, members = subtree members ∪ subtree heads", async () => {
+    const r = await send(U.owner.token, "POST", G("rd"));
+    expect(r.status).toBe(201);
+    expect(r.body.group.name).toBe("研发部");
+    expect(r.body.group.department_id).toBe(DEPT.rd);
+    expect(r.body.group.id).toMatch(/^grp_[0-9a-f]{20}$/);
+    // 研发部:head / alice / viewer;后端组(下级):bob。未分配的 carol、不在部门里的 owner / admin 不进。
+    expect(ids(r.body.members)).toEqual([U.alice.id, U.bob.id, U.head.id, U.viewer.id].sort());
+    expect(r.body.group.member_count).toBe(4);
+    for (const m of r.body.members) expect(m.source).toBe("department");
+  });
+
+  test("one group per department: a second create → 409 with the existing group_id", async () => {
+    const existing = (await send(U.owner.token, "GET", G("rd"))).body.group.id;
+    for (const who of ["owner", "admin", "head"]) {
+      const r = await send(U[who].token, "POST", G("rd"), { name: "又一个" });
+      expect(r.status).toBe(409);
+      expect(r.body.error).toBe("department_group_exists");
+      expect(r.body.group_id).toBe(existing);
+    }
+  });
+
+  test("a head can create one for a department in their subtree, with a custom name", async () => {
+    const r = await send(U.head.token, "POST", G("backend"), { name: "  后端小群  " });
+    expect(r.status).toBe(201);
+    expect(r.body.group.name).toBe("后端小群");
+    // 后端组只有 bob(他同时是负责人);研发部负责人在上级部门,不在这个子树里。
+    expect(ids(r.body.members)).toEqual([U.bob.id]);
+    const audit = db.get<{ detail: string }>("SELECT detail FROM audit_log WHERE network_id = ?1 AND action = 'department_group_created' ORDER BY id DESC LIMIT 1", NET);
+    expect(JSON.parse(audit!.detail)).toMatchObject({ id: DEPT.backend, via: "leader" });
+  });
+
+  test("admin can create; bad names and unknown departments are rejected", async () => {
+    expect((await send(U.admin.token, "POST", G("market"), { name: 42 })).body.error).toBe("invalid_group_name");
+    expect((await send(U.admin.token, "POST", G("market"), { name: "x".repeat(41) })).status).toBe(400);
+    expect((await send(U.admin.token, "POST", G("market"), { name: "   " })).status).toBe(400);
+    expect((await send(U.admin.token, "POST", D("/dept_nope/group"), {})).status).toBe(404);
+    const r = await send(U.admin.token, "POST", G("market"), { name: "市场部群" });
+    expect(r.status).toBe(201);
+    expect(r.body.members).toEqual([]);
+  });
+});
+
+describe("who can read", () => {
+  test("GET …/departments/:id/group: group members and managers see it; others get 404; nodes 403", async () => {
+    for (const who of ["owner", "admin", "head", "alice", "bob", "viewer"]) {
+      const r = await send(U[who].token, "GET", G("rd"));
+      expect(r.status).toBe(200);
+      expect(ids(r.body.members)).toHaveLength(4);
+    }
+    const carol = await send(U.carol.token, "GET", G("rd"));
+    expect(carol.status).toBe(404);
+    expect(carol.body.error).toBe("department_group_not_found");
+    expect((await send(U.node.token, "GET", G("rd"))).status).toBe(403);
+    expect((await send(U.outsider.token, "GET", G("rd"))).status).toBe(403);
+  });
+
+  test("GET …/chat-groups lists my groups; owner / admin see all", async () => {
+    const names = async (who: string) => (await send(U[who].token, "GET", CG())).body.groups.map((g: any) => g.name).sort();
+    expect(await names("alice")).toEqual(["研发部"]);
+    expect(await names("bob")).toEqual(["后端小群", "研发部"].sort());
+    expect(await names("carol")).toEqual([]);
+    expect(await names("owner")).toEqual(["后端小群", "市场部群", "研发部"].sort());
+    const owner = (await send(U.owner.token, "GET", CG())).body.groups;
+    expect(owner.every((g: any) => g.is_member === false)).toBe(true);
+    expect((await send(U.node.token, "GET", CG())).status).toBe(403);
+    expect((await send(U.outsider.token, "GET", CG())).status).toBe(403);
+    expect((await send(U.alice.token, "POST", CG(), {})).status).toBe(405);
+  });
+
+  test("GET …/chat-groups/:id: members see the roster; a non-member gets 404 (existence not leaked)", async () => {
+    const gid = (await send(U.owner.token, "GET", G("rd"))).body.group.id;
+    const alice = await send(U.alice.token, "GET", CG(`/${gid}`));
+    expect(alice.status).toBe(200);
+    expect(alice.body.is_member).toBe(true);
+    expect(ids(alice.body.members)).toContain(U.alice.id);
+    expect((await send(U.carol.token, "GET", CG(`/${gid}`))).status).toBe(404);
+    expect((await send(U.carol.token, "GET", CG("/grp_doesnotexist"))).status).toBe(404);
+  });
+});
+
+describe("deleting a department unlinks its group", () => {
+  test("group and members stay with department_id = null; the id can get a fresh group later", async () => {
+    // carol 当负责人但不放进部门:部门是空的(能删),而她在 roster 里。(第 2 个 PR 起调出部门会被同步移出群,
+    // 所以「删部门时群里还有人」只会是负责人或手动拉的人。)
+    const tmp = (await send(U.owner.token, "POST", D(), { name: "临时项目组", id: "dept_tmp_dg", leader_user_id: U.carol.id })).body.department.id as string;
+    const created = await send(U.owner.token, "POST", D(`/${tmp}/group`), {});
+    expect(created.status).toBe(201);
+    expect(ids(created.body.members)).toEqual([U.carol.id]);
+    expect((await send(U.owner.token, "DELETE", D(`/${tmp}`))).status).toBe(200);
+
+    const after = await send(U.owner.token, "GET", CG(`/${created.body.group.id}`));
+    expect(after.status).toBe(200);
+    expect(after.body.group.department_id).toBe(null);
+    expect(ids(after.body.members)).toEqual([U.carol.id]);
+    // 解除关联后不再对账:carol 仍是这个群的成员(她已不是任何部门的负责人)。
+    expect((await send(U.carol.token, "GET", CG(`/${created.body.group.id}`))).status).toBe(200);
+
+    // 同一个部门 id 再建:不被已解除关联的旧群挡住(唯一索引允许多个 NULL)。
+    expect((await send(U.owner.token, "POST", D(), { name: "临时项目组", id: "dept_tmp_dg" })).status).toBe(201);
+    const again = await send(U.owner.token, "POST", D(`/${tmp}/group`), {});
+    expect(again.status).toBe(201);
+    expect(again.body.group.id).not.toBe(created.body.group.id);
+  });
+});