@studio-foundation/api 0.3.0-beta.1

package/tests/linear-webhook.test.ts

@@ -0,0 +1,390 @@
+import { describe, test, expect, beforeEach, afterEach, vi } from 'vitest';
+import { createHmac } from 'node:crypto';
+import { resolve } from 'node:path';
+import { mkdirSync } from 'node:fs';
+import { buildServer } from '../src/server.js';
+import { InMemoryRunStore } from '@studio-foundation/engine';
+import { WebhookStore } from '../src/webhook-store.js';
+import { IntegrationStore } from '../src/integration-store.js';
+import { IntegrationRuntime } from '../src/integration-runtime.js';
+import type { IntegrationPluginDef } from '@studio-foundation/contracts';
+
+const WEBHOOK_SECRET = 'test-whsec-abc123';
+
+const linearIntegration: IntegrationPluginDef = {
+  name: 'linear',
+  version: 1,
+  webhook: {
+    hmac: {
+      header: 'linear-signature',
+      secret_env: 'LINEAR_WEBHOOK_SECRET',
+    },
+    handler: 'linear-webhook',
+  },
+  on_failure: {
+    handler: 'linear-failure',
+  },
+};
+
+function sign(body: string, secret: string): string {
+  return createHmac('sha256', secret).update(Buffer.from(body)).digest('hex');
+}
+
+function makeServer(opts: { withSecret?: boolean; withApiKey?: boolean; active?: boolean } = {}) {
+  const dir = resolve('/tmp', `.studio-linear-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  mkdirSync(dir, { recursive: true });
+  const dbPath = resolve(dir, 'runs.db');
+  const webhookStore = new WebhookStore(dbPath);
+  const integrationStore = new IntegrationStore(dbPath);
+
+  // Default to active so existing tests trigger launches as before
+  integrationStore.patchConfig('linear', { active: opts.active ?? true });
+
+  const launched: Array<{ pipeline: string; input: Record<string, unknown>; meta?: Record<string, unknown> }> = [];
+  const launcher = {
+    launch: vi.fn(async (cfg: { pipeline: string; input: Record<string, unknown>; meta?: Record<string, unknown>; runId: string }) => {
+      launched.push({ pipeline: cfg.pipeline, input: cfg.input, meta: cfg.meta });
+      return { run_id: cfg.runId };
+    }),
+    cancel: vi.fn(async () => {}),
+    subscribe: vi.fn(() => () => {}),
+  };
+
+  const integrationRuntime = new IntegrationRuntime({
+    integrations: [linearIntegration],
+    store: integrationStore,
+    launcher,
+    configsDir: dir,
+    apiConfig: { ...(opts.withApiKey ? { key: 'sk-studio-test' } : {}) },
+    integrationConfigs: {
+      linear: {
+        ...(opts.withSecret ? { LINEAR_WEBHOOK_SECRET: WEBHOOK_SECRET } : {}),
+      },
+    },
+  });
+
+  const server = buildServer({
+    store: new InMemoryRunStore(),
+    launcher,
+    configsDir: dir,
+    projectName: 'test-project',
+    apiConfig: {
+      ...(opts.withApiKey ? { key: 'sk-studio-test' } : {}),
+    },
+    studioVersion: '0.0.0',
+    maskedConfig: { providers: [] },
+    webhookStore,
+    integrationRuntime,
+    integrationStore,
+  });
+
+  return { server, launched, launcher, integrationStore, cleanup: () => { webhookStore.close(); integrationStore.close(); } };
+}
+
+function inProgressPayload(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    type: 'Issue',
+    action: 'update',
+    data: {
+      id: 'abc-123',
+      identifier: 'STU-42',
+      title: 'Add dark mode toggle',
+      description: 'Users want a dark mode option in the settings.',
+      state: { name: 'In Progress' },
+      ...overrides,
+    },
+  };
+}
+
+describe('POST /api/integrations/linear/webhook — no secret configured', () => {
+  let server: ReturnType<typeof makeServer>['server'];
+  let launched: ReturnType<typeof makeServer>['launched'];
+  let cleanup: () => void;
+
+  beforeEach(() => {
+    ({ server, launched, cleanup } = makeServer());
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  test('accepts "In Progress" transition and launches feature-builder', async () => {
+    const payload = inProgressPayload();
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: JSON.stringify(payload),
+    });
+
+    expect(res.statusCode).toBe(202);
+    const body = res.json<{ run_id: string; stream_url: string }>();
+    expect(body.run_id).toBeDefined();
+    expect(body.stream_url).toMatch(/\/api\/runs\/.+\/stream/);
+
+    expect(launched).toHaveLength(1);
+    expect(launched[0].pipeline).toBe('feature-builder');
+    expect(launched[0].input['brief_summary']).toBe('STU-42 — Add dark mode toggle');
+    expect(launched[0].meta?.['linear_issue_id']).toBe('abc-123');
+    expect(launched[0].meta?.['linear_issue_identifier']).toBe('STU-42');
+    expect(launched[0].meta?.['linear_issue_url']).toBe('https://linear.app/studioag/issue/STU-42');
+  });
+
+  test('ignores non-"In Progress" state transitions', async () => {
+    const payload = inProgressPayload({ state: { name: 'Done' } });
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: JSON.stringify(payload),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ ignored: boolean; reason: string }>();
+    expect(body.ignored).toBe(true);
+    expect(body.reason).toContain('Done');
+    expect(launched).toHaveLength(0);
+  });
+
+  test('ignores non-update actions', async () => {
+    const payload = { ...inProgressPayload(), action: 'create' };
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: JSON.stringify(payload),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ ignored: boolean }>();
+    expect(body.ignored).toBe(true);
+    expect(launched).toHaveLength(0);
+  });
+
+  test('ignores non-Issue types', async () => {
+    const payload = { ...inProgressPayload(), type: 'Comment' };
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: JSON.stringify(payload),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ ignored: boolean }>();
+    expect(body.ignored).toBe(true);
+    expect(launched).toHaveLength(0);
+  });
+
+  test('returns 400 for invalid JSON body', async () => {
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: 'not-json{',
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+});
+
+describe('POST /api/integrations/linear/webhook — with HMAC secret', () => {
+  let server: ReturnType<typeof makeServer>['server'];
+  let launched: ReturnType<typeof makeServer>['launched'];
+  let cleanup: () => void;
+
+  beforeEach(() => {
+    ({ server, launched, cleanup } = makeServer({ withSecret: true }));
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  test('accepts request with valid signature', async () => {
+    const body = JSON.stringify(inProgressPayload());
+    const sig = sign(body, WEBHOOK_SECRET);
+
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json', 'linear-signature': sig },
+      payload: body,
+    });
+
+    expect(res.statusCode).toBe(202);
+    expect(launched).toHaveLength(1);
+  });
+
+  test('rejects request with invalid signature', async () => {
+    const body = JSON.stringify(inProgressPayload());
+
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json', 'linear-signature': 'deadbeef' },
+      payload: body,
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(launched).toHaveLength(0);
+  });
+
+  test('rejects request with missing signature header', async () => {
+    const body = JSON.stringify(inProgressPayload());
+
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: body,
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(launched).toHaveLength(0);
+  });
+
+  test('returns 401 not 500 for tampered body', async () => {
+    const originalBody = JSON.stringify(inProgressPayload());
+    const sig = sign(originalBody, WEBHOOK_SECRET);
+    const tamperedBody = originalBody + ' ';
+
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json', 'linear-signature': sig },
+      payload: tamperedBody,
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(launched).toHaveLength(0);
+  });
+});
+
+describe('POST /api/integrations/linear/webhook — with API key auth enabled', () => {
+  let server: ReturnType<typeof makeServer>['server'];
+  let launched: ReturnType<typeof makeServer>['launched'];
+  let cleanup: () => void;
+
+  beforeEach(() => {
+    ({ server, launched, cleanup } = makeServer({ withApiKey: true }));
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  test('webhook endpoint is exempt from Bearer token auth', async () => {
+    // No Authorization header — should not get 401 from the API key check
+    const payload = inProgressPayload();
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: JSON.stringify(payload),
+    });
+
+    expect(res.statusCode).toBe(202);
+    expect(launched).toHaveLength(1);
+  });
+
+  test('other API routes still require Bearer token', async () => {
+    const res = await server.inject({
+      method: 'GET',
+      url: '/api/runs',
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+});
+
+describe('GET /api/integrations/linear', () => {
+  let server: ReturnType<typeof makeServer>['server'];
+  let integrationStore: ReturnType<typeof makeServer>['integrationStore'];
+  let cleanup: () => void;
+
+  beforeEach(() => {
+    ({ server, integrationStore, cleanup } = makeServer({ active: false }));
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  test('returns default config with empty trigger log', async () => {
+    const res = await server.inject({ method: 'GET', url: '/api/integrations/linear' });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ webhook_url: string; pipeline: null; active: boolean; triggers: unknown[] }>();
+    expect(body.webhook_url).toMatch(/\/api\/integrations\/linear\/webhook$/);
+    expect(body.active).toBe(false);
+    expect(body.triggers).toEqual([]);
+  });
+
+  test('reflects config and trigger records after updates', async () => {
+    integrationStore.patchConfig('linear', { pipeline: 'feature-builder-cc-linear', active: true });
+
+    const res = await server.inject({ method: 'GET', url: '/api/integrations/linear' });
+    const body = res.json<{ pipeline: string; active: boolean }>();
+    expect(body.pipeline).toBe('feature-builder-cc-linear');
+    expect(body.active).toBe(true);
+  });
+});
+
+describe('PATCH /api/integrations/linear', () => {
+  let server: ReturnType<typeof makeServer>['server'];
+  let cleanup: () => void;
+
+  beforeEach(() => {
+    ({ server, cleanup } = makeServer({ active: false }));
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  test('updates pipeline and active flag', async () => {
+    const res = await server.inject({
+      method: 'PATCH',
+      url: '/api/integrations/linear',
+      headers: { 'content-type': 'application/json' },
+      payload: JSON.stringify({ pipeline: 'feature-builder-cc-linear', active: true }),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ pipeline: string; active: boolean }>();
+    expect(body.pipeline).toBe('feature-builder-cc-linear');
+    expect(body.active).toBe(true);
+  });
+});
+
+describe('POST /api/integrations/linear/webhook — active flag', () => {
+  let server: ReturnType<typeof makeServer>['server'];
+  let launched: ReturnType<typeof makeServer>['launched'];
+  let cleanup: () => void;
+
+  beforeEach(() => {
+    ({ server, launched, cleanup } = makeServer({ active: false }));
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  test('ignores webhook when integration is inactive', async () => {
+    const payload = inProgressPayload();
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/integrations/linear/webhook',
+      headers: { 'content-type': 'application/json' },
+      payload: JSON.stringify(payload),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ ignored: boolean; reason: string }>();
+    expect(body.ignored).toBe(true);
+    expect(body.reason).toContain('inactive');
+    expect(launched).toHaveLength(0);
+  });
+});

package/tests/pipelines.test.ts

@@ -0,0 +1,166 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdirSync, writeFileSync, rmSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { buildServer } from '../src/server.js';
+import { InMemoryRunStore } from '@studio-foundation/engine';
+import type { IntegrationRuntime } from '../src/integration-runtime.js';
+import type { IntegrationStore } from '../src/integration-store.js';
+
+const TMP_DIR = resolve('/tmp', `.studio-api-pipelines-test-${Date.now()}`);
+const PIPELINES_DIR = resolve(TMP_DIR, 'pipelines');
+
+const FEATURE_BUILDER_YAML = `name: feature-builder
+stages:
+  - name: analysis
+    agent: analyst
+`;
+
+beforeAll(() => {
+  mkdirSync(PIPELINES_DIR, { recursive: true });
+  writeFileSync(resolve(PIPELINES_DIR, 'feature-builder.pipeline.yaml'), FEATURE_BUILDER_YAML);
+  writeFileSync(resolve(PIPELINES_DIR, 'code-review.pipeline.yaml'), 'name: code-review\nstages: []\n');
+  writeFileSync(resolve(PIPELINES_DIR, 'not-a-pipeline.yaml'), ''); // should be ignored
+});
+
+afterAll(() => {
+  rmSync(TMP_DIR, { recursive: true, force: true });
+});
+
+const nullIntegrationRuntime = { registerRoutes: () => {} } as unknown as IntegrationRuntime;
+const nullIntegrationStore = {} as unknown as IntegrationStore;
+
+function makeServer() {
+  return buildServer({
+    store: new InMemoryRunStore(),
+    launcher: { launch: async () => ({ run_id: 'x' }), cancel: async () => {} },
+    configsDir: TMP_DIR,
+    projectName: 'test-project',
+    apiConfig: {},
+    integrationRuntime: nullIntegrationRuntime,
+    integrationStore: nullIntegrationStore,
+  });
+}
+
+describe('GET /api/pipelines', () => {
+  it('returns all .pipeline.yaml names', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'GET', url: '/api/pipelines' });
+    expect(res.statusCode).toBe(200);
+    const { pipelines } = res.json() as { pipelines: string[] };
+    expect(pipelines).toContain('feature-builder');
+    expect(pipelines).toContain('code-review');
+    expect(pipelines).not.toContain('not-a-pipeline');
+    expect(pipelines).not.toContain('feature-builder.pipeline.yaml');
+  });
+
+  it('returns empty list when no pipelines exist', async () => {
+    const emptyDir = resolve('/tmp', `.studio-api-empty-${Date.now()}`);
+    mkdirSync(emptyDir, { recursive: true });
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: { launch: async () => ({ run_id: 'x' }), cancel: async () => {} },
+      configsDir: emptyDir,
+      projectName: 'empty',
+      apiConfig: {},
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+    const res = await server.inject({ method: 'GET', url: '/api/pipelines' });
+    expect(res.statusCode).toBe(200);
+    expect((res.json() as { pipelines: string[] }).pipelines).toEqual([]);
+    rmSync(emptyDir, { recursive: true, force: true });
+  });
+});
+
+describe('GET /api/pipelines/:name', () => {
+  it('returns the parsed pipeline YAML as JSON', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'GET', url: '/api/pipelines/feature-builder' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as { name: string; stages: unknown[] };
+    expect(body.name).toBe('feature-builder');
+    expect(body.stages).toHaveLength(1);
+  });
+
+  it('returns 404 for unknown pipeline', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'GET', url: '/api/pipelines/nonexistent' });
+    expect(res.statusCode).toBe(404);
+    expect((res.json() as { error: string }).error).toBeTruthy();
+  });
+});
+
+describe('PUT /api/pipelines/:name', () => {
+  it('creates a new pipeline from YAML body', async () => {
+    const server = makeServer();
+    const yaml = 'name: new-pipeline\nstages: []\n';
+    const res = await server.inject({
+      method: 'PUT',
+      url: '/api/pipelines/new-pipeline',
+      headers: { 'content-type': 'text/plain' },
+      payload: yaml,
+    });
+    expect(res.statusCode).toBe(200);
+    expect(existsSync(resolve(PIPELINES_DIR, 'new-pipeline.pipeline.yaml'))).toBe(true);
+  });
+
+  it('updates an existing pipeline from YAML body', async () => {
+    const server = makeServer();
+    const yaml = 'name: feature-builder\nstages: []\n';
+    const res = await server.inject({
+      method: 'PUT',
+      url: '/api/pipelines/feature-builder',
+      headers: { 'content-type': 'text/plain' },
+      payload: yaml,
+    });
+    expect(res.statusCode).toBe(200);
+
+    // Verify content updated
+    const get = await server.inject({ method: 'GET', url: '/api/pipelines/feature-builder' });
+    const body = get.json() as { stages: unknown[] };
+    expect(body.stages).toHaveLength(0);
+  });
+
+  it('creates a pipeline from JSON body', async () => {
+    const server = makeServer();
+    const res = await server.inject({
+      method: 'PUT',
+      url: '/api/pipelines/json-pipeline',
+      headers: { 'content-type': 'application/json' },
+      payload: { name: 'json-pipeline', stages: [] },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(existsSync(resolve(PIPELINES_DIR, 'json-pipeline.pipeline.yaml'))).toBe(true);
+  });
+
+  it('returns 400 for invalid YAML', async () => {
+    const server = makeServer();
+    const res = await server.inject({
+      method: 'PUT',
+      url: '/api/pipelines/bad-pipeline',
+      headers: { 'content-type': 'text/plain' },
+      payload: 'key: [unclosed\n  - item',
+    });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: string }).error).toBeTruthy();
+  });
+});
+
+describe('DELETE /api/pipelines/:name', () => {
+  it('deletes an existing pipeline', async () => {
+    const server = makeServer();
+    // Create a file to delete
+    writeFileSync(resolve(PIPELINES_DIR, 'to-delete.pipeline.yaml'), 'name: to-delete\n');
+
+    const res = await server.inject({ method: 'DELETE', url: '/api/pipelines/to-delete' });
+    expect(res.statusCode).toBe(200);
+    expect(existsSync(resolve(PIPELINES_DIR, 'to-delete.pipeline.yaml'))).toBe(false);
+  });
+
+  it('returns 404 for non-existent pipeline', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'DELETE', url: '/api/pipelines/ghost-pipeline' });
+    expect(res.statusCode).toBe(404);
+    expect((res.json() as { error: string }).error).toBeTruthy();
+  });
+});