@studio-foundation/api 0.3.0-beta.1

package/tests/server.test.ts

@@ -0,0 +1,208 @@
+import { describe, it, expect } from 'vitest';
+import { mkdirSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { buildServer } from '../src/server.js';
+import { InMemoryRunStore } from '@studio-foundation/engine';
+import type { RunLauncher } from '../src/launcher.js';
+import type { IntegrationRuntime } from '../src/integration-runtime.js';
+import type { IntegrationStore } from '../src/integration-store.js';
+import { UserStore, type User } from '../src/user-store.js';
+import { DEFAULT_PLANS } from '../src/plans.js';
+import type { WebhookStore } from '../src/webhook-store.js';
+
+function makeMockLauncher(): RunLauncher {
+  return {
+    launch: async () => ({ run_id: 'mock-run-id' }),
+    cancel: async () => {},
+  };
+}
+
+const nullIntegrationRuntime = { registerRoutes: () => {} } as unknown as IntegrationRuntime;
+const nullIntegrationStore = {} as unknown as IntegrationStore;
+
+function makeTempUserStore(): UserStore {
+  const dir = resolve('/tmp', `.studio-auth-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  mkdirSync(dir, { recursive: true });
+  return new UserStore(resolve(dir, 'runs.db'));
+}
+
+const nullWebhookStore = {} as unknown as WebhookStore;
+
+const proUser: User = {
+  id: 'user-pro-1',
+  email: 'pro@example.com',
+  plan: 'pro',
+  api_key: 'sk-pro-key',
+  created_at: '2026-01-01T00:00:00.000Z',
+};
+
+describe('buildServer — auth', () => {
+  it('no api key configured → requests pass without Authorization', async () => {
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test-project',
+      apiConfig: {},   // no key
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+
+    const res = await server.inject({ method: 'GET', url: '/api/projects' });
+    expect(res.statusCode).not.toBe(401);
+  });
+
+  it('api key configured → missing Authorization → 401', async () => {
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test-project',
+      apiConfig: { key: 'sk-studio-secret' },
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+
+    const res = await server.inject({ method: 'GET', url: '/api/projects' });
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: 'Unauthorized' });
+  });
+
+  it('api key configured → wrong key → 401', async () => {
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test-project',
+      apiConfig: { key: 'sk-studio-secret' },
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/api/projects',
+      headers: { Authorization: 'Bearer sk-studio-wrong' },
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('api key configured → correct key → passes', async () => {
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test-project',
+      apiConfig: { key: 'sk-studio-secret' },
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/api/projects',
+      headers: { Authorization: 'Bearer sk-studio-secret' },
+    });
+    expect(res.statusCode).not.toBe(401);
+  });
+});
+
+describe('buildServer — multi-user auth', () => {
+  it('user api_key → 200', async () => {
+    const userStore = makeTempUserStore();
+    userStore.saveUser(proUser);
+
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test',
+      apiConfig: {},
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+      userStore,
+      plans: DEFAULT_PLANS,
+      hasUsers: true,
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/api/projects',
+      headers: { Authorization: 'Bearer sk-pro-key' },
+    });
+    userStore.close();
+    expect(res.statusCode).not.toBe(401);
+  });
+
+  it('unknown api_key when users exist → 401', async () => {
+    const userStore = makeTempUserStore();
+    userStore.saveUser(proUser);
+
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test',
+      apiConfig: {},
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+      userStore,
+      plans: DEFAULT_PLANS,
+      hasUsers: true,
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/api/projects',
+      headers: { Authorization: 'Bearer sk-unknown' },
+    });
+    userStore.close();
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('legacy api.key works when no users in DB (hasUsers=false)', async () => {
+    const userStore = makeTempUserStore();
+
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test',
+      apiConfig: { key: 'sk-legacy-key' },
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+      userStore,
+      plans: DEFAULT_PLANS,
+      hasUsers: false,
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/api/projects',
+      headers: { Authorization: 'Bearer sk-legacy-key' },
+    });
+    userStore.close();
+    expect(res.statusCode).not.toBe(401);
+  });
+
+  it('no users, no api.key → open dev mode', async () => {
+    const userStore = makeTempUserStore();
+
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: makeMockLauncher(),
+      configsDir: '/tmp/.studio',
+      projectName: 'test',
+      apiConfig: {},
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+      userStore,
+      plans: DEFAULT_PLANS,
+      hasUsers: false,
+    });
+
+    const res = await server.inject({ method: 'GET', url: '/api/projects' });
+    userStore.close();
+    expect(res.statusCode).not.toBe(401);
+  });
+});

package/tests/skills.test.ts

@@ -0,0 +1,149 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { buildServer } from '../src/server.js';
+import { InMemoryRunStore } from '@studio-foundation/engine';
+import type { IntegrationRuntime } from '../src/integration-runtime.js';
+import type { IntegrationStore } from '../src/integration-store.js';
+
+const TMP = resolve('/tmp', `.studio-skills-test-${Date.now()}`);
+const SKILLS_DIR = resolve(TMP, 'skills');
+
+const nullIntegrationRuntime = { registerRoutes: () => {} } as unknown as IntegrationRuntime;
+const nullIntegrationStore = {} as unknown as IntegrationStore;
+
+function makeServer() {
+  return buildServer({
+    store: new InMemoryRunStore(),
+    launcher: { launch: async () => ({ run_id: 'x' }), cancel: async () => {} },
+    configsDir: TMP,
+    projectName: 'test-project',
+    apiConfig: {},
+    studioVersion: '0.0.0-test',
+    maskedConfig: { providers: [] },
+    integrationRuntime: nullIntegrationRuntime,
+    integrationStore: nullIntegrationStore,
+  });
+}
+
+beforeAll(() => {
+  mkdirSync(SKILLS_DIR, { recursive: true });
+  writeFileSync(resolve(SKILLS_DIR, 'commit-conventions.skill.md'), '# Commit Conventions\nUse conventional commits.');
+  writeFileSync(resolve(SKILLS_DIR, 'react-patterns.skill.md'), '# React Patterns\nPrefer hooks over HOCs.');
+  writeFileSync(resolve(SKILLS_DIR, 'ignored.md'), ''); // must be ignored
+});
+
+afterAll(() => {
+  rmSync(TMP, { recursive: true, force: true });
+});
+
+describe('GET /api/skills', () => {
+  it('returns only *.skill.md files as skill names', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'GET', url: '/api/skills' });
+    expect(res.statusCode).toBe(200);
+    const { skills } = res.json() as { skills: string[] };
+    expect(skills).toContain('commit-conventions');
+    expect(skills).toContain('react-patterns');
+    expect(skills).not.toContain('ignored');
+    expect(skills).not.toContain('commit-conventions.skill.md');
+  });
+
+  it('returns empty array when skills dir is missing', async () => {
+    const server = buildServer({
+      store: new InMemoryRunStore(),
+      launcher: { launch: async () => ({ run_id: 'x' }), cancel: async () => {} },
+      configsDir: resolve('/tmp', `.studio-no-skills-${Date.now()}`),
+      projectName: 'test-project',
+      apiConfig: {},
+      studioVersion: '0.0.0-test',
+      maskedConfig: { providers: [] },
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+    const res = await server.inject({ method: 'GET', url: '/api/skills' });
+    expect(res.statusCode).toBe(200);
+    expect((res.json() as { skills: string[] }).skills).toEqual([]);
+  });
+});
+
+describe('GET /api/skills/:name', () => {
+  it('returns skill content as JSON', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'GET', url: '/api/skills/commit-conventions' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as { name: string; content: string };
+    expect(body.name).toBe('commit-conventions');
+    expect(body.content).toContain('conventional commits');
+  });
+
+  it('returns 404 for unknown skill', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'GET', url: '/api/skills/nonexistent' });
+    expect(res.statusCode).toBe(404);
+    expect((res.json() as { error: string }).error).toBe('Skill not found');
+  });
+});
+
+describe('PUT /api/skills/:name', () => {
+  it('creates a new skill file', async () => {
+    const server = makeServer();
+    const res = await server.inject({
+      method: 'PUT',
+      url: '/api/skills/new-skill',
+      payload: { content: '# New Skill\nSome instructions.' },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as { name: string; content: string };
+    expect(body.name).toBe('new-skill');
+    expect(body.content).toContain('New Skill');
+    // Verify it can be read back
+    const getRes = await server.inject({ method: 'GET', url: '/api/skills/new-skill' });
+    expect(getRes.statusCode).toBe(200);
+    expect((getRes.json() as { content: string }).content).toContain('New Skill');
+  });
+
+  it('updates an existing skill', async () => {
+    const server = makeServer();
+    const res = await server.inject({
+      method: 'PUT',
+      url: '/api/skills/react-patterns',
+      payload: { content: '# React Patterns\nUpdated content.' },
+    });
+    expect(res.statusCode).toBe(200);
+    const getRes = await server.inject({ method: 'GET', url: '/api/skills/react-patterns' });
+    expect((getRes.json() as { content: string }).content).toContain('Updated content');
+  });
+
+  it('returns 400 when content field is missing', async () => {
+    const server = makeServer();
+    const res = await server.inject({
+      method: 'PUT',
+      url: '/api/skills/foo',
+      payload: { name: 'foo' },
+    });
+    expect(res.statusCode).toBe(400);
+  });
+});
+
+describe('DELETE /api/skills/:name', () => {
+  it('deletes a skill and returns 204', async () => {
+    const server = makeServer();
+    await server.inject({
+      method: 'PUT',
+      url: '/api/skills/to-delete',
+      payload: { content: '# To Delete' },
+    });
+    const res = await server.inject({ method: 'DELETE', url: '/api/skills/to-delete' });
+    expect(res.statusCode).toBe(204);
+    const getRes = await server.inject({ method: 'GET', url: '/api/skills/to-delete' });
+    expect(getRes.statusCode).toBe(404);
+  });
+
+  it('returns 404 for nonexistent skill', async () => {
+    const server = makeServer();
+    const res = await server.inject({ method: 'DELETE', url: '/api/skills/nonexistent' });
+    expect(res.statusCode).toBe(404);
+    expect((res.json() as { error: string }).error).toBe('Skill not found');
+  });
+});

package/tests/sse.test.ts

@@ -0,0 +1,129 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { buildServer } from '../src/server.js';
+import type { RunLauncher } from '../src/launcher.js';
+import type { IntegrationRuntime } from '../src/integration-runtime.js';
+import type { IntegrationStore } from '../src/integration-store.js';
+
+const TMP = resolve('/tmp', `studio-sse-test-${Date.now()}`);
+mkdirSync(TMP, { recursive: true });
+
+const nullIntegrationRuntime = { registerRoutes: () => {} } as unknown as IntegrationRuntime;
+const nullIntegrationStore = {} as unknown as IntegrationStore;
+
+afterEach(() => {
+  rmSync(TMP, { recursive: true, force: true });
+  mkdirSync(TMP, { recursive: true });
+});
+
+function makeDeps(overrides?: Partial<{
+  runExists: boolean;
+  runStatus: string;
+  logPath: string | null;
+}>) {
+  const { runExists = false, runStatus = 'running', logPath = null } = overrides ?? {};
+
+  const mockStore = {
+    getPipelineRun: vi.fn().mockReturnValue(
+      runExists
+        ? { id: 'run-1', pipeline_name: 'p', status: runStatus, started_at: '', stages: [] }
+        : null
+    ),
+    getLogPath: vi.fn().mockReturnValue(logPath),
+    saveLogPath: vi.fn(),
+    listPipelineRuns: vi.fn().mockReturnValue([]),
+    savePipelineRun: vi.fn(),
+    updatePipelineRun: vi.fn(),
+    saveStageRun: vi.fn(),
+    saveTaskRun: vi.fn(),
+  };
+
+  const mockLauncher: RunLauncher = {
+    launch: vi.fn().mockResolvedValue({ run_id: 'run-1' }),
+    cancel: vi.fn().mockResolvedValue(undefined),
+    subscribe: vi.fn().mockReturnValue(() => {}),
+  };
+
+  return { mockStore, mockLauncher };
+}
+
+describe('GET /api/runs/:id/stream', () => {
+  it('returns 404 for unknown run', async () => {
+    const { mockStore, mockLauncher } = makeDeps({ runExists: false });
+    const fastify = buildServer({
+      store: mockStore as never,
+      launcher: mockLauncher,
+      configsDir: TMP,
+      projectName: 'test',
+      apiConfig: {},
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+
+    const res = await fastify.inject({ method: 'GET', url: '/api/runs/unknown-id/stream' });
+    expect(res.statusCode).toBe(404);
+    expect(JSON.parse(res.body)).toMatchObject({ error: 'Run not found' });
+  });
+
+  it('replays JSONL history and closes for a terminated run', async () => {
+    const logFile = resolve(TMP, 'run.jsonl');
+    writeFileSync(logFile, [
+      JSON.stringify({ ts: '2026-01-01', run_id: 'r1', event: 'stage_complete', stage_name: 'brief-analysis', status: 'success' }),
+      JSON.stringify({ ts: '2026-01-01', run_id: 'r1', event: 'pipeline_complete', status: 'success' }),
+    ].join('\n') + '\n');
+
+    const { mockStore, mockLauncher } = makeDeps({
+      runExists: true,
+      runStatus: 'success',
+      logPath: logFile,
+    });
+
+    const fastify = buildServer({
+      store: mockStore as never,
+      launcher: mockLauncher,
+      configsDir: TMP,
+      projectName: 'test',
+      apiConfig: {},
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+
+    const res = await fastify.inject({ method: 'GET', url: '/api/runs/run-1/stream' });
+    expect(res.headers['content-type']).toContain('text/event-stream');
+    expect(res.body).toContain('event: stage_complete');
+    expect(res.body).toContain('event: pipeline_complete');
+  });
+
+  it('filters events by ?events= query param', async () => {
+    const logFile = resolve(TMP, 'run-filter.jsonl');
+    writeFileSync(logFile, [
+      JSON.stringify({ ts: '2026-01-01', run_id: 'r1', event: 'stage_complete', stage_name: 's1' }),
+      JSON.stringify({ ts: '2026-01-01', run_id: 'r1', event: 'pipeline_complete', status: 'success' }),
+    ].join('\n') + '\n');
+
+    const { mockStore, mockLauncher } = makeDeps({
+      runExists: true,
+      runStatus: 'success',
+      logPath: logFile,
+    });
+
+    const fastify = buildServer({
+      store: mockStore as never,
+      launcher: mockLauncher,
+      configsDir: TMP,
+      projectName: 'test',
+      apiConfig: {},
+      integrationRuntime: nullIntegrationRuntime,
+      integrationStore: nullIntegrationStore,
+    });
+
+    const res = await fastify.inject({
+      method: 'GET',
+      url: '/api/runs/run-1/stream?events=pipeline_complete',
+    });
+
+    expect(res.body).not.toContain('event: stage_complete');
+    expect(res.body).toContain('event: pipeline_complete');
+  });
+});