@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/api/openapi/tooling/test/projection.test.mjs

@@ -0,0 +1,270 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { canonicalJSON, projectDocument, projectOperationSet, validateDocument, validateRegistry } from '../project.mjs';
+
+test('public projection keeps reachable components and owner evidence while stripping routing metadata', () => {
+  const projected = projectDocument(fixtureDocument(), 'public');
+
+  assert.deepEqual(Object.keys(projected.paths), ['/api/v1/widgets/{id}']);
+  assert.deepEqual(Object.keys(projected.components.schemas), ['Widget']);
+  assert.deepEqual(Object.keys(projected.components.securitySchemes), ['BearerAuth']);
+  assert.equal(projected.paths['/api/v1/widgets/{id}'].get['x-onex-owner'], 'widgets');
+  assert.equal(projected.paths['/api/v1/widgets/{id}'].get['x-onex-audience'], undefined);
+  assert.doesNotThrow(() => validateDocument(projected, { audience: 'public', requireMetadata: false, service: 'fixture' }));
+});
+
+test('projection rejects a stable operation that references a beta component', () => {
+  const document = fixtureDocument();
+  document.components.schemas.Widget['x-onex-stability'] = 'beta';
+
+  assert.throws(() => projectDocument(document, 'public'), /stability is lower than its consumer/);
+});
+
+test('external projection removes complete internal authentication alternatives', () => {
+  const document = fixtureDocument();
+  document.components.securitySchemes.InternalServiceToken = {
+    bearerFormat: 'OneX-IAM-Service-Token',
+    scheme: 'bearer',
+    type: 'http',
+    'x-onex-audience': 'internal',
+    'x-onex-stability': 'stable',
+  };
+  document.paths['/api/v1/widgets/{id}'].get.security = [
+    {},
+    { BearerAuth: [], InternalServiceToken: [] },
+  ];
+
+  const projected = projectDocument(document, 'public');
+
+  assert.deepEqual(projected.paths['/api/v1/widgets/{id}'].get.security, [{}]);
+  assert.equal(projected.components.securitySchemes, undefined);
+});
+
+test('external projection rejects operations secured only by internal authentication', () => {
+  const document = fixtureDocument();
+  document.components.securitySchemes.InternalServiceToken = {
+    bearerFormat: 'OneX-IAM-Service-Token',
+    scheme: 'bearer',
+    type: 'http',
+    'x-onex-audience': 'internal',
+    'x-onex-stability': 'stable',
+  };
+  document.paths['/api/v1/widgets/{id}'].get.security = [{ InternalServiceToken: [] }];
+
+  assert.throws(
+    () => projectDocument(document, 'public'),
+    /GET \/api\/v1\/widgets\/\{id\} has no security alternative available in public projection/,
+  );
+});
+
+test('operation projection keeps only selected operations and reachable components', () => {
+  const projected = projectOperationSet(fixtureDocument(), new Set(['getWidget']));
+
+  assert.deepEqual(Object.keys(projected.paths), ['/api/v1/widgets/{id}']);
+  assert.deepEqual(Object.keys(projected.components.schemas), ['Widget']);
+  assert.deepEqual(Object.keys(projected.components.securitySchemes), ['BearerAuth']);
+});
+
+test('localized projection keeps only navigation groups used by the audience', () => {
+  const projected = projectDocument(localizedFixtureDocument(), 'public');
+
+  assert.deepEqual(projected.tags.map(({ name }) => name), ['组件']);
+  assert.deepEqual(projected['x-tagGroups'], [{ name: '公开能力', tags: ['组件'] }]);
+});
+
+test('localized document validation rejects English copy and incomplete navigation taxonomy', () => {
+  const englishCopy = localizedFixtureDocument();
+  englishCopy.paths['/api/v1/widgets/{id}'].get.summary = 'Get a widget';
+  assert.throws(
+    () => validateDocument(englishCopy, { audience: 'internal', service: 'fixture' }),
+    /documentation text must use Chinese copy/,
+  );
+
+  const leakedHandlerName = localizedFixtureDocument();
+  leakedHandlerName.paths['/api/v1/widgets/{id}'].get.summary = 'GetWidget 查询组件详情';
+  assert.throws(
+    () => validateDocument(leakedHandlerName, { audience: 'internal', service: 'fixture' }),
+    /must not expose a handler or English action prefix/,
+  );
+
+  const incompleteTaxonomy = localizedFixtureDocument();
+  incompleteTaxonomy['x-tagGroups'][1].tags = [];
+  assert.throws(
+    () => validateDocument(incompleteTaxonomy, { audience: 'internal', service: 'fixture' }),
+    /x-tagGroups\[1\] must contain at least one tag/,
+  );
+
+  const multipleTags = localizedFixtureDocument();
+  multipleTags.paths['/api/v1/widgets/{id}'].get.tags.push('内部任务');
+  assert.throws(
+    () => validateDocument(multipleTags, { audience: 'internal', service: 'fixture' }),
+    /must declare exactly one navigation tag/,
+  );
+});
+
+test('document validation rejects nullable and unconstrained external objects', () => {
+  const document = fixtureDocument();
+  document.components.schemas.Widget.properties.name.nullable = true;
+
+  assert.throws(() => validateDocument(document, { audience: 'public', service: 'fixture' }), /nullable keyword/);
+  delete document.components.schemas.Widget.properties.name.nullable;
+  document.components.schemas.Widget.additionalProperties = true;
+  assert.throws(() => validateDocument(document, { audience: 'public', service: 'fixture' }), /unconstrained object/);
+});
+
+test('document validation requires the canonical OneX idempotency header', () => {
+  for (const name of ['Idempotency-Key', 'idempotency-key', 'IDEMPOTENCY-KEY', 'IdEmPoTeNcY-kEy']) {
+    const document = fixtureDocument();
+    document.paths['/internal/v1/jobs'].post.parameters = [{
+      in: 'header',
+      name,
+      required: true,
+      schema: { type: 'string' },
+    }];
+
+    assert.throws(
+      () => validateDocument(document, { audience: 'internal', service: 'fixture' }),
+      /provider idempotency header instead of X-Idempotency-Key/,
+    );
+  }
+
+  const document = fixtureDocument();
+  document.paths['/internal/v1/jobs'].post.parameters = [{
+    in: 'header',
+    name: 'X-Idempotency-Key',
+    required: true,
+    schema: { type: 'string' },
+  }];
+  assert.doesNotThrow(() => validateDocument(document, { audience: 'internal', service: 'fixture' }));
+});
+
+test('document validation reserves trailing slashes for provider webhook contracts', () => {
+  const rejected = fixtureDocument();
+  rejected.paths['/api/v1/widgets/'] = rejected.paths['/api/v1/widgets/{id}'];
+  delete rejected.paths['/api/v1/widgets/{id}'];
+  assert.throws(
+    () => validateDocument(rejected, { audience: 'internal', service: 'fixture' }),
+    /trailing slash outside the provider webhook contract/,
+  );
+
+  const accepted = fixtureDocument();
+  accepted.paths['/api/v1/webhooks/{product_code}/stripe/'] = accepted.paths['/api/v1/widgets/{id}'];
+  delete accepted.paths['/api/v1/widgets/{id}'];
+  assert.doesNotThrow(() => validateDocument(accepted, { audience: 'internal', service: 'fixture' }));
+});
+
+test('registry rejects business route exclusions', () => {
+  assert.throws(() => validateRegistry({
+    schema_version: 1,
+    services: [{
+      display_name: '示例 API',
+      documentation_locale: 'zh-CN',
+      id: 'fixture-api',
+      publications: ['internal'],
+      route_exclusions: ['/api/v1/widgets'],
+      runtime_conformance: 'services/fixture-api/conformance/runtime.arazzo.yaml',
+      source: 'services/fixture-api/openapi.yaml',
+    }],
+  }), /forbidden route exclusion/);
+});
+
+test('canonical serialization is deterministic', () => {
+  assert.equal(canonicalJSON({ z: 1, a: { y: 2, b: 3 } }), '{\n  "a": {\n    "b": 3,\n    "y": 2\n  },\n  "z": 1\n}\n');
+});
+
+function fixtureDocument() {
+  return {
+    components: {
+      schemas: {
+        InternalJob: {
+          properties: { id: { type: 'string' } },
+          type: 'object',
+          'x-onex-audience': 'internal',
+          'x-onex-stability': 'stable',
+        },
+        Widget: {
+          properties: { id: { type: 'string' }, name: { type: 'string' } },
+          required: ['id', 'name'],
+          type: 'object',
+          'x-onex-audience': 'public',
+          'x-onex-stability': 'stable',
+        },
+      },
+      securitySchemes: {
+        BearerAuth: {
+          bearerFormat: 'JWT',
+          scheme: 'bearer',
+          type: 'http',
+          'x-onex-audience': 'public',
+          'x-onex-stability': 'stable',
+        },
+      },
+    },
+    info: { title: 'Fixture API', version: '1.0.0' },
+    jsonSchemaDialect: 'https://json-schema.org/draft/2020-12/schema',
+    openapi: '3.1.1',
+    paths: {
+      '/api/v1/widgets/{id}': {
+        get: {
+          operationId: 'getWidget',
+          parameters: [{ in: 'path', name: 'id', required: true, schema: { type: 'string' } }],
+          responses: {
+            200: {
+              content: { 'application/json': { schema: { $ref: '#/components/schemas/Widget' } } },
+              description: 'OK',
+            },
+          },
+          security: [{ BearerAuth: [] }],
+          summary: 'Get a widget',
+          tags: ['Widgets'],
+          'x-onex-audience': 'public',
+          'x-onex-lifecycle': {
+            deprecated: null,
+            introduced: '2026-07-16',
+            migrationUrl: null,
+            replacementOperationId: null,
+            sunset: null,
+          },
+          'x-onex-owner': 'widgets',
+          'x-onex-stability': 'stable',
+        },
+      },
+      '/internal/v1/jobs': {
+        post: {
+          operationId: 'createInternalJob',
+          responses: { 202: { description: 'Accepted' } },
+          security: [{ ServiceCredential: [] }],
+          summary: 'Create an internal job',
+          tags: ['Jobs'],
+          'x-onex-audience': 'internal',
+          'x-onex-owner': 'jobs',
+          'x-onex-stability': 'stable',
+        },
+      },
+    },
+    servers: [{ url: '/' }],
+    tags: [{ name: 'Jobs' }, { name: 'Widgets' }],
+  };
+}
+
+function localizedFixtureDocument() {
+  const document = fixtureDocument();
+  document.info.title = '示例 API';
+  document.paths['/api/v1/widgets/{id}'].get.responses[200].description = '请求成功';
+  document.paths['/api/v1/widgets/{id}'].get.summary = '查询组件详情';
+  document.paths['/api/v1/widgets/{id}'].get.tags = ['组件'];
+  document.paths['/internal/v1/jobs'].post.responses[202].description = '请求已受理';
+  document.paths['/internal/v1/jobs'].post.summary = '创建内部任务';
+  document.paths['/internal/v1/jobs'].post.tags = ['内部任务'];
+  document.tags = [
+    { description: '内部任务相关接口。', name: '内部任务' },
+    { description: '组件相关接口。', name: '组件' },
+  ];
+  document['x-onex-documentation-locale'] = 'zh-CN';
+  document['x-tagGroups'] = [
+    { name: '内部能力', tags: ['内部任务'] },
+    { name: '公开能力', tags: ['组件'] },
+  ];
+  return document;
+}

package/dist/resources/templates/go-backend/api/openapi/tooling/test/redocly_documentation_rules.test.mjs

@@ -0,0 +1,146 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, resolve } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { parse, stringify } from 'yaml';
+
+const apiRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const publicationConfigPath = resolve(apiRoot, 'redocly.yaml');
+const sourceConfigPath = resolve(apiRoot, 'redocly-source.yaml');
+const redoclyBin = resolve(apiRoot, 'node_modules', '.bin', 'redocly');
+
+const publicationRules = Object.freeze([
+  'operation-description',
+  'parameter-description',
+  'no-invalid-media-type-examples',
+  'no-invalid-parameter-examples',
+  'no-invalid-schema-examples',
+]);
+
+test('documentation profiles are valid and separate source and publication rules', () => {
+  const publication = parse(readFileSync(publicationConfigPath, 'utf8'));
+  const source = parse(readFileSync(sourceConfigPath, 'utf8'));
+
+  for (const configPath of [publicationConfigPath, sourceConfigPath]) {
+    const result = runRedocly(['check-config', '--config', configPath]);
+    assert.equal(result.error, undefined);
+    assert.equal(result.status, 0, redoclyOutput(result));
+  }
+  for (const rule of publicationRules) {
+    assert.equal(publication.rules[rule], 'error', `${rule} must block publication`);
+  }
+  assert.deepEqual(publication.extends, ['./redocly-source.yaml']);
+  assert.deepEqual(source.extends, ['recommended-strict']);
+  assert.deepEqual(
+    {
+      'operation-description': source.rules['operation-description'],
+      'parameter-description': source.rules['parameter-description'],
+    },
+    {
+      'operation-description': 'off',
+      'parameter-description': 'off',
+    },
+  );
+});
+
+test('publication profile rejects invalid media examples and accepts valid described examples', (t) => {
+  const fixtureDirectory = mkdtempSync(resolve(tmpdir(), 'onex-redocly-documentation-'));
+  t.after(() => rmSync(fixtureDirectory, { force: true, recursive: true }));
+
+  const invalidPath = resolve(fixtureDirectory, 'invalid.openapi.yaml');
+  const validPath = resolve(fixtureDirectory, 'valid.openapi.yaml');
+  writeFileSync(invalidPath, stringify(documentationFixture('2026')));
+  writeFileSync(validPath, stringify(documentationFixture(2026)));
+
+  const invalidResult = lint(invalidPath);
+  assert.equal(invalidResult.error, undefined);
+  assert.notEqual(invalidResult.status, 0, redoclyOutput(invalidResult));
+  assert.match(redoclyOutput(invalidResult), /no-invalid-media-type-examples/);
+
+  const validResult = lint(validPath);
+  assert.equal(validResult.error, undefined);
+  assert.equal(validResult.status, 0, redoclyOutput(validResult));
+});
+
+function lint(apiPath) {
+  return runRedocly([
+    'lint',
+    apiPath,
+    '--config',
+    publicationConfigPath,
+    '--format',
+    'stylish',
+    '--lint-config',
+    'error',
+  ]);
+}
+
+function runRedocly(args) {
+  return spawnSync(redoclyBin, args, { cwd: apiRoot, encoding: 'utf8' });
+}
+
+function redoclyOutput(result) {
+  return [result.stdout, result.stderr].filter(Boolean).join('\n');
+}
+
+function documentationFixture(year) {
+  return {
+    openapi: '3.1.1',
+    info: {
+      title: 'Documentation Rules Fixture',
+      version: '1.0.0',
+      license: {
+        name: 'MIT',
+        identifier: 'MIT',
+      },
+    },
+    servers: [{ url: 'https://api.onex.test' }],
+    tags: [{ name: 'Widgets', description: 'Widget operations.' }],
+    paths: {
+      '/widgets': {
+        get: {
+          operationId: 'listWidgets',
+          summary: 'List widgets',
+          description: 'Returns the available widgets.',
+          tags: ['Widgets'],
+          security: [],
+          parameters: [
+            {
+              name: 'limit',
+              in: 'query',
+              description: 'Maximum widgets to return.',
+              schema: { type: 'integer', minimum: 1 },
+              example: 1,
+            },
+          ],
+          responses: {
+            200: {
+              description: 'Widgets returned.',
+              content: {
+                'application/json': {
+                  schema: {
+                    type: 'object',
+                    required: ['year'],
+                    properties: {
+                      year: { type: 'integer', description: 'Publication year.' },
+                    },
+                  },
+                  examples: {
+                    release: {
+                      summary: 'Widget release',
+                      value: { year },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+}

package/dist/resources/templates/go-backend/api/openapi/tooling/test/release_manifest.test.mjs

@@ -0,0 +1,76 @@
+import assert from 'node:assert/strict';
+import { gunzipSync } from 'node:zlib';
+import test from 'node:test';
+
+import { createDeterministicTGZ } from '../deterministic_archive.mjs';
+import { artifactURN, fileArtifactRecord, releaseManifest } from '../manifest.mjs';
+
+const gitRevision = 'a'.repeat(40);
+const toolVersions = Object.freeze({ node: '24.18.0' });
+
+test('release manifest separates logical artifact identity from identical content bytes', () => {
+  const content = '{"openapi":"3.1.1"}\n';
+  const contract = record({ content, kind: 'openapi-contract', path: 'services/platform-api/dist/public.openapi.json' });
+  const raw = record({
+    content,
+    derivedFrom: [artifactURN(contract)],
+    extra: { source_contract_sha256: contract.sha256 },
+    kind: 'raw-openapi',
+    path: 'publish/raw/platform-api/1.0.0/public/openapi.json',
+  });
+
+  assert.equal(contract.sha256, raw.sha256);
+  assert.notEqual(contract.artifact_id, raw.artifact_id);
+  assert.notEqual(artifactURN(contract), artifactURN(raw));
+  const manifest = releaseManifest([raw, contract], {
+    gitRevision,
+    sourceSha256: 'b'.repeat(64),
+    toolVersions,
+  });
+  assert.equal(manifest.schema_version, 2);
+  assert.equal(manifest.reproducible_build.artifact_count, 2);
+  assert.match(manifest.release_id, /^[a-f0-9]{64}$/);
+});
+
+test('release manifest rejects duplicate paths, dangling dependencies, and self-dependencies', () => {
+  const contract = record({ kind: 'openapi-contract', path: 'services/platform-api/dist/public.openapi.json' });
+  const duplicate = record({ kind: 'raw-openapi', path: contract.path });
+  const options = { gitRevision, sourceSha256: 'b'.repeat(64), toolVersions };
+  assert.throws(() => releaseManifest([contract, duplicate], options), /share path/);
+
+  const dangling = { ...record({ kind: 'conformance-matrix', path: 'dist/conformance-matrix.json' }), derived_from: [`urn:onex:artifact:sha256:${'c'.repeat(64)}`] };
+  assert.throws(() => releaseManifest([contract, dangling], options), /unresolved dependency/);
+
+  const self = { ...contract, derived_from: [artifactURN(contract)] };
+  assert.throws(() => releaseManifest([self], options), /derives from itself/);
+});
+
+test('TypeScript SDK archive is a deterministic USTAR gzip with package-prefixed files', () => {
+  const files = new Map([
+    ['README.md', Buffer.from('# SDK\n')],
+    ['package.json', Buffer.from('{"private":true}\n')],
+  ]);
+  const first = createDeterministicTGZ(files);
+  const second = createDeterministicTGZ(new Map([...files].reverse()));
+  assert.deepEqual(first, second);
+
+  const tar = gunzipSync(first);
+  assert.equal(tar.subarray(0, 100).toString('utf8').replaceAll('\0', ''), 'package/README.md');
+  assert.equal(tar.subarray(257, 263).toString('utf8'), 'ustar\0');
+});
+
+function record({ content = '{}\n', derivedFrom = [], extra = {}, kind, path }) {
+  return fileArtifactRecord({
+    api_version: '1.0.0',
+    audience: 'public',
+    content,
+    derived_from: derivedFrom,
+    extra,
+    git_revision: gitRevision,
+    kind,
+    media_type: 'application/json',
+    path,
+    service: 'platform-api',
+    tool_versions: toolVersions,
+  });
+}

package/dist/resources/templates/go-backend/api/openapi/tooling/test/route_contract.test.mjs

@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { routeContract } from '../route_contract.mjs';
+
+test('route contract normalizes operations into deterministic method and path records', () => {
+  const routes = routeContract({
+    paths: {
+      '/api/v1/widgets/{id}': {
+        get: {
+          operationId: 'getWidget',
+          parameters: [{ in: 'path', name: 'id', required: true }],
+        },
+      },
+    },
+  });
+
+  assert.deepEqual(routes, [{ method: 'GET', operation_id: 'getWidget', path: '/api/v1/widgets/{id}' }]);
+});
+
+test('route contract uses the runtime UTF-8 byte ordering for prefixes and Unicode paths', () => {
+  const routes = routeContract({
+    paths: {
+      '/api/onex/account/deletion/cancel': { post: { operationId: 'cancelAccountDeletion' } },
+      '/api/onex/account/deletion': { post: { operationId: 'deleteAccount' } },
+      '/api/v1/\u{10000}': { get: { operationId: 'getAstralPath' } },
+      '/api/v1/\uE000': { get: { operationId: 'getPrivateUsePath' } },
+    },
+  });
+
+  assert.deepEqual(routes.map(({ method, path }) => ({ method, path })), [
+    { method: 'POST', path: '/api/onex/account/deletion' },
+    { method: 'POST', path: '/api/onex/account/deletion/cancel' },
+    { method: 'GET', path: '/api/v1/\uE000' },
+    { method: 'GET', path: '/api/v1/\u{10000}' },
+  ]);
+});
+
+test('route contract rejects undeclared and wildcard parameters', () => {
+  assert.throws(() => routeContract({ paths: { '/api/v1/widgets/{id}': { get: { operationId: 'getWidget' } } } }), /must be declared and required/);
+  assert.throws(() => routeContract({ paths: { '/api/v1/data/*path': { get: { operationId: 'getData' } } } }), /cannot contain a wildcard/);
+});
+
+test('route contract resolves reusable local path parameters', () => {
+  const routes = routeContract({
+    components: {
+      parameters: {
+        WidgetID: pathParameter('id', { type: 'string' }),
+      },
+    },
+    paths: {
+      '/api/v1/widgets/{id}': {
+        get: {
+          operationId: 'getWidget',
+          parameters: [{ $ref: '#/components/parameters/WidgetID' }],
+        },
+      },
+    },
+  });
+
+  assert.deepEqual(routes, [{ method: 'GET', operation_id: 'getWidget', path: '/api/v1/widgets/{id}' }]);
+});
+
+test('route contract rejects method and schema overlapping paths', () => {
+  assert.throws(() => routeContract({
+    paths: {
+      '/api/v1/widgets/{id}/events': {
+        get: { operationId: 'getWidgetEvents', parameters: [pathParameter('id', { type: 'string' })] },
+      },
+      '/api/v1/widgets/special/{event}': {
+        get: { operationId: 'getSpecialEvent', parameters: [pathParameter('event', { type: 'string' })] },
+      },
+    },
+  }), /ambiguous routes:[\s\S]*GET/);
+});
+
+test('route contract accepts method-separated or schema-disjoint paths', () => {
+  assert.equal(routeContract({
+    paths: {
+      '/api/v1/widgets/{id}/events': {
+        get: { operationId: 'getWidgetEvents', parameters: [pathParameter('id', { type: 'integer' })] },
+      },
+      '/api/v1/widgets/special/{event}': {
+        get: { operationId: 'getSpecialEvent', parameters: [pathParameter('event', { type: 'string' })] },
+        post: { operationId: 'createSpecialEvent', parameters: [pathParameter('event', { type: 'string' })] },
+      },
+    },
+  }).length, 3);
+});
+
+test('route contract preserves trailing slash route identities', () => {
+  const document = {
+    paths: {
+      '/api/v1/webhooks/{product_code}/stripe': {
+        post: { operationId: 'postStripeWebhook', parameters: [pathParameter('product_code', { type: 'string' })] },
+      },
+      '/api/v1/webhooks/{product_code}/stripe/': {
+        post: { operationId: 'postStripeWebhookWithSlash', parameters: [pathParameter('product_code', { type: 'string' })] },
+      },
+    },
+  };
+
+  assert.equal(routeContract(document).length, 2);
+});
+
+test('route contract honors explicit static route exclusions', () => {
+  assert.equal(routeContract({
+    paths: {
+      '/api/v1/settings/{key}': {
+        put: { operationId: 'putSetting', parameters: [pathParameter('key', { type: 'string', not: { enum: ['batch'] } })] },
+      },
+      '/api/v1/settings/batch': { put: { operationId: 'putSettings' } },
+    },
+  }).length, 2);
+});
+
+function pathParameter(name, schema) {
+  return { in: 'path', name, required: true, schema };
+}

package/dist/resources/templates/go-backend/api/openapi/tooling/test/runtime_conformance.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  buildRespectChildEnv,
+  parseInputMap,
+  parseServerMap,
+} from '../runtime_conformance.mjs';
+
+test('runtime server map requires one safe URL per registered service', () => {
+  assert.deepEqual(
+    parseServerMap('{"admin-api":"http://127.0.0.1:3003/"}', ['admin-api']),
+    { 'admin-api': 'http://127.0.0.1:3003' },
+  );
+  assert.throws(
+    () => parseServerMap('{}', ['admin-api']),
+    /missing=admin-api/,
+  );
+  assert.throws(
+    () => parseServerMap('{"admin-api":"https://user:secret@example.com"}', ['admin-api']),
+    /without credentials/,
+  );
+});
+
+test('runtime server map rejects unknown service keys', () => {
+  assert.throws(
+    () => parseServerMap('{"admin-api":"http://localhost:3003","other":"http://localhost:4000"}', ['admin-api']),
+    /unknown=other/,
+  );
+});
+
+test('runtime input map isolates credential-bearing workflow inputs by service', () => {
+  assert.deepEqual(
+    parseInputMap(
+      '{"platform-api":{"checkoutProviderReturnSessionToken":"secret","checkoutProviderReturnOperationNo":"cpo_1"}}',
+      ['admin-api', 'platform-api'],
+    ),
+    {
+      'platform-api': {
+        checkoutProviderReturnOperationNo: 'cpo_1',
+        checkoutProviderReturnSessionToken: 'secret',
+      },
+    },
+  );
+  assert.throws(
+    () => parseInputMap('{"other":{}}', ['platform-api']),
+    /unknown services: other/,
+  );
+  assert.throws(
+    () => parseInputMap('{"platform-api":[]}', ['platform-api']),
+    /platform-api conformance inputs must be a JSON object/,
+  );
+});
+
+test('Respect child environment receives only the current service inputs', () => {
+  const childEnv = buildRespectChildEnv(
+    { checkoutProviderReturnSessionToken: 'platform-secret' },
+    {
+      ONEX_OPENAPI_CONFORMANCE_INPUTS: '{"platform-api":{"token":"platform-secret"},"admin-api":{"token":"admin-secret"}}',
+      PATH: '/usr/bin',
+      REDOCLY_CLI_RESPECT_INPUT: '{"token":"stale-secret"}',
+    },
+  );
+
+  assert.equal(childEnv.ONEX_OPENAPI_CONFORMANCE_INPUTS, undefined);
+  assert.equal(childEnv.PATH, '/usr/bin');
+  assert.deepEqual(JSON.parse(childEnv.REDOCLY_CLI_RESPECT_INPUT), {
+    checkoutProviderReturnSessionToken: 'platform-secret',
+  });
+  assert.equal(childEnv.REDOCLY_CLI_RESPECT_INPUT.includes('admin-secret'), false);
+
+  const childWithoutInputs = buildRespectChildEnv(undefined, childEnv);
+  assert.equal(childWithoutInputs.ONEX_OPENAPI_CONFORMANCE_INPUTS, undefined);
+  assert.equal(childWithoutInputs.REDOCLY_CLI_RESPECT_INPUT, undefined);
+});