@things-factory/board-ai 10.0.0-beta.108

package/server/service/styling/text-tools.ts

@@ -0,0 +1,131 @@
+/**
+ * setText / setFont — 컴포넌트의 텍스트 내용 / 폰트 스타일.
+ *
+ * setText: state.text 변경 (내용)
+ * setFont: state.fontFamily / fontSize / fontWeight / fontStyle / fontColor /
+ *          textAlign / textBaseline / lineHeight 변경 (폰트 스타일)
+ *
+ * 두 tool 분리 — 의도가 다름. 내용 변경 vs 시각 스타일.
+ */
+import type { BoardEditOp } from '../types'
+import { normalizeColor, validateColor } from './color-utils'
+
+export interface SetTextInput {
+  refids: number[]
+  text: string
+}
+
+export interface SetFontInput {
+  refids: number[]
+  fontFamily?: string
+  fontSize?: number
+  fontWeight?: 'normal' | 'bold' | 'lighter' | 'bolder' | string | number
+  fontStyle?: 'normal' | 'italic' | 'oblique'
+  fontColor?: string
+  /** Canvas API 표준 — 'justify' 는 Canvas 미지원이라 제외. */
+  textAlign?: 'left' | 'center' | 'right' | 'start' | 'end'
+  textBaseline?: 'top' | 'middle' | 'bottom' | 'hanging' | 'alphabetic' | 'ideographic'
+  lineHeight?: number
+}
+
+// Canvas CanvasRenderingContext2D 가 허용하는 값만.
+// dash / lineCap / lineJoin 과 동일 패턴 — AI 가 비표준 값 ('serif-italic',
+// 'middle-align' 등) 을 보내도 Canvas 가 silent ignore → 효과 없는 op 가 그대로
+// 실행되는 것 방지.
+const VALID_FONT_STYLE = new Set(['normal', 'italic', 'oblique'])
+const VALID_TEXT_ALIGN = new Set(['start', 'end', 'left', 'right', 'center'])
+const VALID_TEXT_BASELINE = new Set([
+  'top',
+  'middle',
+  'bottom',
+  'hanging',
+  'alphabetic',
+  'ideographic'
+])
+
+export interface OpsResult {
+  ops: BoardEditOp[]
+  errors: string[]
+}
+
+export function buildSetTextOps(input: SetTextInput): OpsResult {
+  if (!Array.isArray(input.refids) || input.refids.length === 0) {
+    return { ops: [], errors: ['refids must be a non-empty array'] }
+  }
+  if (typeof input.text !== 'string') {
+    return { ops: [], errors: ['text must be a string'] }
+  }
+  const refids = input.refids.filter(n => typeof n === 'number' && Number.isFinite(n))
+  if (refids.length === 0) return { ops: [], errors: ['No valid numeric refids'] }
+
+  const patch = { text: input.text }
+  return {
+    ops: refids.map(refid => ({ op: 'modify', refid, patch })),
+    errors: []
+  }
+}
+
+export function buildSetFontOps(input: SetFontInput): OpsResult {
+  if (!Array.isArray(input.refids) || input.refids.length === 0) {
+    return { ops: [], errors: ['refids must be a non-empty array'] }
+  }
+  const refids = input.refids.filter(n => typeof n === 'number' && Number.isFinite(n))
+  if (refids.length === 0) return { ops: [], errors: ['No valid numeric refids'] }
+
+  // 어느 인자도 없으면 무의미
+  const noOp = !(
+    input.fontFamily ||
+    input.fontSize !== undefined ||
+    input.fontWeight !== undefined ||
+    input.fontStyle ||
+    input.fontColor ||
+    input.textAlign ||
+    input.textBaseline ||
+    input.lineHeight !== undefined
+  )
+  if (noOp) return { ops: [], errors: ['No font changes specified'] }
+
+  if (input.fontSize !== undefined && (input.fontSize <= 0 || !Number.isFinite(input.fontSize))) {
+    return { ops: [], errors: [`Invalid fontSize: ${input.fontSize}`] }
+  }
+  if (input.lineHeight !== undefined && input.lineHeight <= 0) {
+    return { ops: [], errors: [`Invalid lineHeight: ${input.lineHeight}`] }
+  }
+  if (input.fontColor !== undefined) {
+    const v = validateColor(input.fontColor)
+    if (!v.valid) return { ops: [], errors: [v.error ?? 'Invalid fontColor'] }
+  }
+  if (input.fontStyle !== undefined && !VALID_FONT_STYLE.has(input.fontStyle)) {
+    return {
+      ops: [],
+      errors: [`Unknown fontStyle: '${input.fontStyle}'. Valid: ${[...VALID_FONT_STYLE].join(' / ')}.`]
+    }
+  }
+  if (input.textAlign !== undefined && !VALID_TEXT_ALIGN.has(input.textAlign)) {
+    return {
+      ops: [],
+      errors: [`Unknown textAlign: '${input.textAlign}'. Valid: ${[...VALID_TEXT_ALIGN].join(' / ')}.`]
+    }
+  }
+  if (input.textBaseline !== undefined && !VALID_TEXT_BASELINE.has(input.textBaseline)) {
+    return {
+      ops: [],
+      errors: [`Unknown textBaseline: '${input.textBaseline}'. Valid: ${[...VALID_TEXT_BASELINE].join(' / ')}.`]
+    }
+  }
+
+  const patch: any = {}
+  if (input.fontFamily) patch.fontFamily = input.fontFamily
+  if (input.fontSize !== undefined) patch.fontSize = input.fontSize
+  if (input.fontWeight !== undefined) patch.fontWeight = String(input.fontWeight)
+  if (input.fontStyle) patch.fontStyle = input.fontStyle
+  if (input.fontColor !== undefined) patch.fontColor = normalizeColor(input.fontColor)
+  if (input.textAlign) patch.textAlign = input.textAlign
+  if (input.textBaseline) patch.textBaseline = input.textBaseline
+  if (input.lineHeight !== undefined) patch.lineHeight = input.lineHeight
+
+  return {
+    ops: refids.map(refid => ({ op: 'modify', refid, patch })),
+    errors: []
+  }
+}

package/server/service/styling/tier1-tools.test.ts

@@ -0,0 +1,300 @@
+/**
+ * Tier 1 styling tool 단위 테스트 — setStroke / setText / setFont /
+ * setShadow / setOpacity / setVisible / setMaterial / setShadowProperties /
+ * clearStyle.
+ */
+import { buildSetStrokeOps } from './stroke-tools'
+import { buildSetTextOps, buildSetFontOps } from './text-tools'
+import { buildSetShadowOps, buildSetOpacityOps, buildSetVisibleOps } from './effect-tools'
+import { buildSetMaterialOps, buildSetShadowPropertiesOps } from './material-tools'
+import { buildClearStyleOps } from './clear-tools'
+
+describe('setStroke — top-level flat fields (things-scene 실제 모델)', () => {
+  test('color → strokeStyle 문자열, width → lineWidth top-level', () => {
+    const r = buildSetStrokeOps({ refids: [1], strokeStyle: 'red', lineWidth: 2 })
+    expect(r.ops[0].patch).toEqual({
+      strokeStyle: '#ff0000',
+      lineWidth: 2
+    })
+  })
+
+  test('dash preset alias → things-scene 이름 매핑', () => {
+    expect((buildSetStrokeOps({ refids: [1], dash: 'dashed' }).ops[0] as any).patch.lineDash).toBe('dash')
+    expect((buildSetStrokeOps({ refids: [1], dash: 'dotted' }).ops[0] as any).patch.lineDash).toBe('square-dot')
+    expect((buildSetStrokeOps({ refids: [1], dash: 'dashdot' }).ops[0] as any).patch.lineDash).toBe('dash-dot')
+  })
+
+  test('things-scene 본래 preset 이름도 그대로 받음', () => {
+    expect((buildSetStrokeOps({ refids: [1], dash: 'long-dash' }).ops[0] as any).patch.lineDash).toBe('long-dash')
+    expect((buildSetStrokeOps({ refids: [1], dash: 'round-dot' }).ops[0] as any).patch.lineDash).toBe('round-dot')
+    expect((buildSetStrokeOps({ refids: [1], dash: 'solid' }).ops[0] as any).patch.lineDash).toBe('solid')
+  })
+
+  test('알 수 없는 dash → 에러 + 옵션 안내', () => {
+    const r = buildSetStrokeOps({ refids: [1], dash: 'wavy' })
+    expect(r.ops).toEqual([])
+    expect(r.errors[0]).toMatch(/Unknown dash/)
+    expect(r.errors[0]).toMatch(/long-dash/)
+  })
+
+  test('enabled=false → lineWidth 0', () => {
+    const r = buildSetStrokeOps({ refids: [1], enabled: false, strokeStyle: 'red' })
+    expect((r.ops[0] as any).patch.lineWidth).toBe(0)
+  })
+
+  test('lineCap / lineJoin top-level', () => {
+    const r = buildSetStrokeOps({
+      refids: [1],
+      lineCap: 'round',
+      lineJoin: 'bevel'
+    })
+    expect((r.ops[0] as any).patch).toMatchObject({
+      lineCap: 'round',
+      lineJoin: 'bevel'
+    })
+    // strokeStyle 객체 구조 절대 출력 안 됨
+    expect((r.ops[0] as any).patch.strokeStyle).toBeUndefined()
+  })
+
+  test('multi-target', () => {
+    const r = buildSetStrokeOps({ refids: [1, 2, 3], strokeStyle: 'navy' })
+    expect(r.ops).toHaveLength(3)
+    expect(r.ops.every(o => (o as any).patch.strokeStyle === '#000080')).toBe(true)
+  })
+
+  test('전체 케이스 — 모든 필드 top-level', () => {
+    const r = buildSetStrokeOps({
+      refids: [15],
+      strokeStyle: '#ffffff',
+      lineWidth: 4,
+      dash: 'dashed',
+      lineCap: 'round',
+      lineJoin: 'round'
+    })
+    expect(r.ops[0].patch).toEqual({
+      strokeStyle: '#ffffff',
+      lineWidth: 4,
+      lineDash: 'dash',
+      lineCap: 'round',
+      lineJoin: 'round'
+    })
+  })
+})
+
+describe('setText', () => {
+  test('text 변경', () => {
+    const r = buildSetTextOps({ refids: [1, 2], text: 'OPERATO' })
+    expect(r.ops).toHaveLength(2)
+    expect(r.ops[0].patch).toEqual({ text: 'OPERATO' })
+  })
+
+  test('text 비-string → 에러', () => {
+    const r = buildSetTextOps({ refids: [1], text: 123 as any })
+    expect(r.ops).toEqual([])
+  })
+})
+
+describe('setFont', () => {
+  test('size + weight + color', () => {
+    const r = buildSetFontOps({
+      refids: [1],
+      fontSize: 24,
+      fontWeight: 'bold',
+      fontColor: 'navy'
+    })
+    expect(r.ops[0].patch).toEqual({
+      fontSize: 24,
+      fontWeight: 'bold',
+      fontColor: '#000080'
+    })
+  })
+
+  test('숫자 weight → string 변환', () => {
+    const r = buildSetFontOps({ refids: [1], fontWeight: 700 })
+    expect((r.ops[0] as any).patch.fontWeight).toBe('700')
+  })
+
+  test('잘못된 fontSize → 에러', () => {
+    const r = buildSetFontOps({ refids: [1], fontSize: -5 })
+    expect(r.ops).toEqual([])
+    expect(r.errors[0]).toMatch(/Invalid fontSize/)
+  })
+
+  test('잘못된 fontColor → 에러', () => {
+    const r = buildSetFontOps({ refids: [1], fontColor: 'invalid-color' })
+    expect(r.ops).toEqual([])
+    expect(r.errors[0]).toMatch(/Invalid color/i)
+  })
+
+  test('textAlign / textBaseline', () => {
+    const r = buildSetFontOps({
+      refids: [1],
+      textAlign: 'center',
+      textBaseline: 'middle'
+    })
+    expect((r.ops[0] as any).patch).toMatchObject({
+      textAlign: 'center',
+      textBaseline: 'middle'
+    })
+  })
+})
+
+describe('setShadow — canonical fields (CSS / Canvas 표준)', () => {
+  test('canonical fields → state.shadow.{offsetX,offsetY,blur,color}', () => {
+    const r = buildSetShadowOps({
+      refids: [1],
+      color: 'rgba(0,0,0,0.3)',
+      blur: 8,
+      offsetX: 2,
+      offsetY: 4
+    })
+    expect((r.ops[0] as any).patch.shadow).toEqual({
+      color: '#000000',
+      blur: 8,
+      offsetX: 2,
+      offsetY: 4
+    })
+    // 옛 stale 이름은 출력 안 됨 — backwards-compat 은 things-scene drawer 의 read-side 만
+    expect((r.ops[0] as any).patch.shadow.left).toBeUndefined()
+    expect((r.ops[0] as any).patch.shadow.top).toBeUndefined()
+    expect((r.ops[0] as any).patch.shadow.blurSize).toBeUndefined()
+  })
+
+  test('enabled=false → blur 0 + transparent', () => {
+    const r = buildSetShadowOps({ refids: [1], enabled: false })
+    expect((r.ops[0] as any).patch.shadow).toEqual({
+      blur: 0,
+      color: 'transparent'
+    })
+  })
+
+  test('잘못된 blur → 에러', () => {
+    const r = buildSetShadowOps({ refids: [1], blur: -1 })
+    expect(r.ops).toEqual([])
+    expect(r.errors[0]).toMatch(/Invalid blur/)
+  })
+})
+
+describe('setOpacity', () => {
+  test('alpha 설정', () => {
+    const r = buildSetOpacityOps({ refids: [1, 2], alpha: 0.5 })
+    expect(r.ops).toHaveLength(2)
+    expect(r.ops[0].patch).toEqual({ alpha: 0.5 })
+  })
+
+  test('범위 밖 → 에러', () => {
+    const r = buildSetOpacityOps({ refids: [1], alpha: 1.5 })
+    expect(r.ops).toEqual([])
+    expect(r.errors[0]).toMatch(/alpha must be 0..1/)
+  })
+})
+
+describe('setVisible', () => {
+  test('hidden 토글', () => {
+    const r1 = buildSetVisibleOps({ refids: [1], visible: false })
+    expect(r1.ops[0].patch).toEqual({ hidden: true })
+    const r2 = buildSetVisibleOps({ refids: [1], visible: true })
+    expect(r2.ops[0].patch).toEqual({ hidden: false })
+  })
+
+  test('visible 비-boolean → 에러', () => {
+    const r = buildSetVisibleOps({ refids: [1], visible: 'yes' as any })
+    expect(r.ops).toEqual([])
+  })
+})
+
+describe('setMaterial — 3D PBR', () => {
+  test('preset 만', () => {
+    const r = buildSetMaterialOps({ refids: [1], preset: 'metal' })
+    expect(r.ops[0].patch).toEqual({ material3d: { preset: 'metal' } })
+  })
+
+  test('preset + override', () => {
+    const r = buildSetMaterialOps({
+      refids: [1],
+      preset: 'glass',
+      opacity: 0.4
+    })
+    expect((r.ops[0] as any).patch.material3d).toEqual({
+      preset: 'glass',
+      opacity: 0.4
+    })
+  })
+
+  test('emissive 컬러 + intensity', () => {
+    const r = buildSetMaterialOps({
+      refids: [1],
+      emissive: 'amber',
+      emissiveIntensity: 2
+    })
+    expect((r.ops[0] as any).patch.material3d).toEqual({
+      emissive: '#f59e0b',
+      emissiveIntensity: 2
+    })
+  })
+
+  test('알 수 없는 preset → 에러', () => {
+    const r = buildSetMaterialOps({ refids: [1], preset: 'foobar' as any })
+    expect(r.ops).toEqual([])
+    expect(r.errors[0]).toMatch(/Unknown preset/)
+  })
+
+  test('metalness 범위 밖 → 에러', () => {
+    const r = buildSetMaterialOps({ refids: [1], metalness: 2 })
+    expect(r.ops).toEqual([])
+  })
+
+  test('side 명시', () => {
+    const r = buildSetMaterialOps({ refids: [1], side: 'double' })
+    expect((r.ops[0] as any).patch.material3d.side).toBe('double')
+  })
+})
+
+describe('setShadowProperties — 3D 그림자 동작', () => {
+  test('castShadow + receiveShadow', () => {
+    const r = buildSetShadowPropertiesOps({
+      refids: [1],
+      castShadow: true,
+      receiveShadow: true
+    })
+    expect((r.ops[0] as any).patch.material3d).toEqual({
+      castShadow: true,
+      receiveShadow: true
+    })
+  })
+
+  test('아무것도 없으면 에러', () => {
+    const r = buildSetShadowPropertiesOps({ refids: [1] })
+    expect(r.ops).toEqual([])
+  })
+})
+
+describe('clearStyle', () => {
+  test('fill 만', () => {
+    const r = buildClearStyleOps({ refids: [1], aspects: ['fill'] })
+    expect(r.ops[0].patch).toEqual({ fillStyle: { type: 'none' } })
+  })
+
+  test('여러 aspect 합쳐서 한 patch', () => {
+    const r = buildClearStyleOps({
+      refids: [1],
+      aspects: ['fill', 'stroke', 'shadow']
+    })
+    const patch = (r.ops[0] as any).patch
+    expect(patch.fillStyle).toBeDefined()
+    // stroke clear = lineWidth 0 (색은 유지) — clear-tools.ts:22 참조
+    expect(patch.lineWidth).toBe(0)
+    expect(patch.shadow).toBeDefined()
+  })
+
+  test('알 수 없는 aspect → 에러', () => {
+    const r = buildClearStyleOps({ refids: [1], aspects: ['blink' as any] })
+    expect(r.ops).toEqual([])
+    expect(r.errors[0]).toMatch(/Unknown aspect/)
+  })
+
+  test('opacity reset → alpha 1', () => {
+    const r = buildClearStyleOps({ refids: [1], aspects: ['opacity'] })
+    expect((r.ops[0] as any).patch.alpha).toBe(1)
+  })
+})

package/server/service/subscribe-auth.test.ts

@@ -0,0 +1,57 @@
+/**
+ * 구독 도메인 인증 게이트 — 단위 테스트 (보안 핵심: 도메인 격리).
+ * board-patch / chat-message 양쪽 spine 이 공유하는 게이트.
+ *
+ * 회귀 방지: process.superUserGranted 는 async 다. 동기 `!process.superUserGranted(...)` 로
+ * 평가하면 `!Promise` = 항상 false → membership throw 가 죽는다(fail-open). 게이트는 반드시
+ * await 로 평가해야 한다. 아래 superUser 분기 테스트가 그 회귀를 박는다.
+ */
+import { assertDomainSubscribeAllowed } from './subscribe-auth'
+
+const never = async () => false // superUser 아님 (async — 실제 process.superUserGranted 와 동일)
+const always = async () => true // superUser (async)
+
+const domain = { id: 'd1', subdomain: 'acme' }
+const userInDomain = { email: 'a@x.io', domains: [{ subdomain: 'acme' }, { subdomain: 'other' }] }
+const userOutDomain = { email: 'b@x.io', domains: [{ subdomain: 'other' }] }
+
+describe('assertDomainSubscribeAllowed (도메인 격리 게이트)', () => {
+  it('domain 없으면 → reject (domain required)', async () => {
+    await expect(assertDomainSubscribeAllowed(undefined, userInDomain, never)).rejects.toThrow('domain required')
+    await expect(assertDomainSubscribeAllowed(null, userInDomain, never)).rejects.toThrow('domain required')
+  })
+
+  it('user 가 해당 subdomain 소속 → 통과 (superUser 검사 불필요)', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, userInDomain, never)).resolves.toBeUndefined()
+  })
+
+  it('user 가 미소속 + superUser 아님 → reject (격리 — 핵심)', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, userOutDomain, never)).rejects.toThrow(
+      'domain(acme) is not working for user(b@x.io).'
+    )
+  })
+
+  it('user 가 미소속이어도 superUser(async resolve true) 면 → 통과 (await 회귀 방지)', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, userOutDomain, always)).resolves.toBeUndefined()
+  })
+
+  it('user.domains 없음 + superUser 아님 → reject', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, { email: 'c@x.io' }, never)).rejects.toThrow(
+      'domain(acme) is not working for user(c@x.io).'
+    )
+  })
+
+  it('user.domains 없음 + superUser → 통과', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, { email: 'c@x.io' }, always)).resolves.toBeUndefined()
+  })
+
+  it('isSuperUser 는 domain+user 를 받아 호출되고 await 된다', async () => {
+    const calls: any[] = []
+    const spy = async (d: any, u: any) => {
+      calls.push([d, u])
+      return true
+    }
+    await assertDomainSubscribeAllowed(domain, userOutDomain, spy)
+    expect(calls).toEqual([[domain, userOutDomain]])
+  })
+})

package/server/service/subscribe-auth.ts

@@ -0,0 +1,34 @@
+/*
+ * 구독 도메인 인증 게이트 — 순수 로직 (데코레이터·pubsub 없음 → 테스트 가능).
+ *
+ * 실시간 구독(@Subscription)은 같은 도메인 구성원만 허용해야 한다(도메인 격리 = 보안 핵심).
+ * 이 게이트는 board-patch / chat-message 양쪽 spine 의 subscribe 클로저가 공유한다
+ * (reuse — fork 금지). superUserGranted 는 process 전역 의존이라 주입받아 순수성 유지.
+ */
+
+/**
+ * 구독 허용 여부 단언. 불가 시 throw (graphql-ws 가 구독 거부).
+ * - domain 없음 → 거부.
+ * - user 가 해당 subdomain 의 도메인 소속이 아니고 superUser 도 아니면 → 거부.
+ *
+ * 주의(버그 수정): process.superUserGranted 는 async(Promise<boolean>) 다. 기존 양쪽 spine 은
+ * `!process.superUserGranted(...)` 로 동기 평가해 `!Promise` = 항상 false → membership throw 가
+ * 발동하지 않는 fail-open 상태였다. 여기서는 await 로 제대로 평가한다 → subscribe 는 async.
+ *
+ * @param domain  context.state.domain
+ * @param user    context.state.user (domains[] / email 사용)
+ * @param isSuperUser  (domain, user) → boolean | Promise<boolean> (process.superUserGranted 주입)
+ */
+export async function assertDomainSubscribeAllowed(
+  domain: any,
+  user: any,
+  isSuperUser: (domain: any, user: any) => boolean | Promise<boolean>
+): Promise<void> {
+  if (!domain) {
+    throw new Error('domain required')
+  }
+  const subdomain = domain?.subdomain
+  if (!user?.domains?.find((d: any) => d.subdomain === subdomain) && !(await isSuperUser(domain, user))) {
+    throw new Error(`domain(${subdomain}) is not working for user(${user?.email}).`)
+  }
+}