@webship.co/workspace 1.0.0-alpha1 → 1.0.0-beta2

package/core/workspace-app/tests/unit/ddev-auth-ssh.test.js

@@ -0,0 +1,40 @@
+/**
+ * SSH keys into the agent container every project borrows them from.
+ *
+ * Without it, a `composer install` that needs a private repository fails at the first package nobody
+ * can read — and the fix is a command in a terminal that nothing in the dashboard mentions.
+ *
+ * It is also the ONE verb here that needs a person at the keyboard: `ssh-add` asks for the key's
+ * passphrase. So it runs in a screen session, which this dashboard can already open a terminal onto,
+ * and the menu item says to go and answer it. As a fire-and-forget button it would look like a
+ * command that silently did nothing.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+
+const APP = path.join(__dirname, '../..');
+const ddev = fs.readFileSync(path.join(APP, 'ddev.js'), 'utf8');
+const actions = fs.readFileSync(path.join(APP, 'actions/ddev.js'), 'utf8');
+const server = fs.readFileSync(path.join(APP, 'server.js'), 'utf8');
+
+test('it runs where somebody can answer it', () => {
+  assert.match(ddev, /'\/actions\/ddev-auth-ssh':[^\n]*args: \['auth', 'ssh'\]/);
+  assert.match(ddev, /'\/actions\/ddev-auth-ssh':[^\n]*inScreen: true/,
+    'a prompt in a detached job is a prompt nobody can answer');
+  assert.match(actions, /'\/actions\/ddev-auth-ssh': ddev_verb,/);
+  // It is not tied to one project being up: the agent container is global, and a key added from any
+  // project is a key every project has.
+  assert.ok(!/'\/actions\/ddev-auth-ssh':[^\n]*needsRunning: true/.test(ddev));
+});
+
+test('the item says a passphrase is waiting, and where', () => {
+  const item = server.slice(server.indexOf('Add my SSH keys'), server.indexOf('Add my SSH keys') + 200);
+  assert.match(server, /then answer the passphrase in Screens/);
+  assert.ok(item.length > 0);
+  // The row already raises a hand for a session that is waiting for input, so the two features meet:
+  // this is the one action that will reliably raise it.
+  assert.match(server, /title="Add your SSH keys to the agent container every project borrows them from/);
+});

package/core/workspace-app/tests/unit/ddev-custom-commands.test.js

@@ -0,0 +1,56 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const { customCommands, menuGroupsHtml } = require('../../ddev-custom-commands');
+const composerSrc = fs.readFileSync(path.join(__dirname, '../../actions/composer.js'), 'utf8');
+
+function project({ type = 'drupal', lock = true } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ddev-cmds-'));
+  fs.mkdirSync(path.join(dir, '.ddev', 'commands', 'web', 'libs'), { recursive: true });
+  fs.mkdirSync(path.join(dir, '.ddev', 'commands', 'host'), { recursive: true });
+  fs.writeFileSync(path.join(dir, '.ddev', 'config.yaml'), `name: x\ntype: ${type}\n`);
+  const cmd = (where, name, body, mode = 0o755) => fs.writeFileSync(path.join(dir, '.ddev', 'commands', where, name), body, { mode });
+  cmd('web', 'add-testing-users', '#!/bin/bash\n## Description: Add testing users\n## Usage: add-testing-users\n## Aliases: webship:add-testing-users\n');
+  cmd('web', 'helper.sh', 'echo sourced\n', 0o644);
+  cmd('web', 'README.txt', 'docs\n');
+  cmd('web', 'solrtail.example', '#!/bin/bash\n## Description: example\n');
+  cmd('web', 'wp-only', '#!/bin/bash\n## Description: WordPress only\n## ProjectTypes: wordpress\n');
+  cmd('host', 'open-ide', '#!/bin/bash\n## Description: Open the IDE\n');
+  fs.writeFileSync(path.join(dir, 'composer.json'), JSON.stringify({ scripts: { 'post-install-cmd': 'x', lint: 'phpcs' }, 'scripts-aliases': { lint: ['cs'] } }));
+  if (lock) fs.writeFileSync(path.join(dir, 'composer.lock'), '{}');
+  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ scripts: { build: 'vite build', postinstall: 'x' } }));
+  return dir;
+}
+
+test('every service folder is read, helpers and examples are not commands, ProjectTypes is honoured', () => {
+  const list = customCommands(project());
+  assert.deepStrictEqual(list.map((c) => `${c.service}/${c.name}`), ['web/add-testing-users', 'host/open-ide']);
+  assert.deepStrictEqual(list[0].aliases, ['webship:add-testing-users']);
+  assert.strictEqual(customCommands(project({ type: 'wordpress' })).length, 3);
+});
+
+test('the DDEV menu gets three folding groups: custom commands, composer.json and package.json scripts', () => {
+  const html = menuGroupsHtml({ key: 'dev', project: 'p', projectPath: project(), running: true });
+  for (const h of ['custom commands', 'composer.json scripts', 'package.json scripts']) assert.match(html, new RegExp(`class="uk-nav-header" data-group="${h}"`));
+  assert.match(html, /hx-post="\/actions\/ddev-project-command"[^>]*"command":"add-testing-users"/);
+  assert.match(html, /title="Add testing users — ddev add-testing-users — aliases: webship:add-testing-users">/);
+  assert.match(html, /hx-post="\/actions\/composer-script"[^>]*"script":"lint"/);
+  assert.match(html, /lint <span class="uk-text-meta">· cs/);
+  assert.match(html, /hx-post="\/actions\/node-script"[^>]*"script":"build"/);
+  assert.ok(!/post-install-cmd|postinstall/.test(html), 'hooks run on their own');
+});
+
+test('a stopped project offers host commands and says container ones need a start', () => {
+  const html = menuGroupsHtml({ key: 'dev', project: 'p', projectPath: project(), running: false });
+  assert.match(html, /"command":"open-ide"/);
+  assert.match(html, /ddev add-testing-users · start first/);
+});
+
+test('composer.json scripts are listed only once composer.lock is there, and the route allows them for a DDEV folder', () => {
+  assert.ok(!/composer\.json scripts/.test(menuGroupsHtml({ key: 'dev', project: 'p', projectPath: project({ lock: false }), running: true })));
+  assert.match(composerSrc, /const installedDdev = \(dir\) => isDdevProject\(dir\) && fs\.existsSync\(path\.join\(dir, 'composer\.lock'\)\);/);
+});

package/core/workspace-app/tests/unit/ddev-diagnose.test.js

@@ -0,0 +1,57 @@
+/**
+ * The four questions worth asking before guessing at a broken project.
+ *
+ * Docker and the network, the certificate the browser will not trust, the ports something else is
+ * holding, and whether the database volume on disk is the engine and version the config asks for.
+ * DDEV answers all four and the dashboard offered none of them, so the moment you need them is the
+ * moment you go looking for a command name.
+ *
+ * All four READ. None of them changes anything, which is why they are one group and why none is
+ * behind the confirm dialog — a diagnostic you hesitate to run is not a diagnostic.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+
+const APP = path.join(__dirname, '../..');
+const ddev = fs.readFileSync(path.join(APP, 'ddev.js'), 'utf8');
+const actions = fs.readFileSync(path.join(APP, 'actions/ddev.js'), 'utf8');
+const server = fs.readFileSync(path.join(APP, 'server.js'), 'utf8');
+
+const FOUR = {
+  'ddev-diagnose': ['utility', 'diagnose'],
+  'ddev-tls-diagnose': ['utility', 'tls-diagnose'],
+  'ddev-port-diagnose': ['utility', 'port-diagnose'],
+  'ddev-db-match': ['utility', 'check-db-match'],
+};
+
+test('each is the CLI command it claims to be', () => {
+  // The `utility` namespace, as `ddev utility --help` lists it on v1.25 — not the older `ddev debug`.
+  for (const [action, args] of Object.entries(FOUR)) {
+    const line = ddev.match(new RegExp(`'/actions/${action}':[^\\n]*`))[0];
+    assert.ok(line.includes(`args: ['${args[0]}', '${args[1]}']`), `${action} runs ${args.join(' ')}`);
+    assert.match(actions, new RegExp(`'/actions/${action}': ddev_verb,`), action);
+  }
+});
+
+test('none of them is destructive, and none needs the project running', () => {
+  // They read. And the moment you want them most is when the project will NOT start, so gating them
+  // on a running project would take them away exactly then.
+  for (const action of Object.keys(FOUR)) {
+    const line = ddev.match(new RegExp(`'/actions/${action}':[^\\n]*`))[0];
+    assert.ok(!line.includes('destructive'), `${action} is not destructive`);
+    assert.ok(!line.includes('needsRunning'), `${action} answers even when the project will not start`);
+  }
+});
+
+test('the menu says what each one answers, not what it is called', () => {
+  // "Diagnose the ports" is a question somebody has; `ddev utility port-diagnose` is a command name
+  // they would have to already know.
+  assert.match(server, /Diagnose — Docker, network, HTTPS/);
+  assert.match(server, /Diagnose the certificate/);
+  assert.match(server, /Diagnose the ports/);
+  assert.match(server, /Does the database match the config\?/);
+  assert.match(server, /What else on this machine is holding the ports DDEV needs/);
+});

package/core/workspace-app/tests/unit/ddev-domains.test.js

@@ -0,0 +1,153 @@
+/**
+ * The addresses a DDEV project answers at.
+ *
+ * The bug these were written for: the dashboard read `additional_hostnames` and nothing else, so a
+ * project with a Storybook showed no extra domains at all — Webship writes its Storybook address
+ * into `additional_fqdns`, which is a different key with different rules. Seven projects in the
+ * tree had a Storybook the dashboard never mentioned.
+ */
+
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const { ddevHostnames, ddevExtraDomains } = require('../../ddev-domains');
+const { ROOT } = require('../../workspaces');
+
+/** A throwaway project directory holding one .ddev/config.yaml. */
+function project(yaml) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ddev-domains-'));
+  fs.mkdirSync(path.join(dir, '.ddev'), { recursive: true });
+  fs.writeFileSync(path.join(dir, '.ddev', 'config.yaml'), yaml);
+  return dir;
+}
+
+/* ---------------- the two keys ---------------- */
+
+test('a label takes the TLD, a fqdn does not', () => {
+  // The whole distinction. Folding a fqdn into the label list would give
+  // storybook.blog.ddev.site.ddev.site, which resolves to nothing.
+  const dir = project(`name: blog
+project_tld: ddev.site
+additional_hostnames:
+  - blog-dev
+additional_fqdns:
+  - storybook.blog.ddev.site
+`);
+  assert.deepEqual(ddevExtraDomains(dir).map((d) => d.host),
+    ['blog-dev.ddev.site', 'storybook.blog.ddev.site']);
+});
+
+test('a custom project_tld reaches the labels and leaves the fqdns alone', () => {
+  const dir = project(`name: blog
+project_tld: example.test
+additional_hostnames:
+  - alias
+additional_fqdns:
+  - storybook.blog.ddev.site
+`);
+  assert.deepEqual(ddevExtraDomains(dir).map((d) => d.host),
+    ['alias.example.test', 'storybook.blog.ddev.site']);
+});
+
+test('both keys are read in flow style as well as block style', () => {
+  const dir = project(`name: blog
+additional_hostnames: [one, "two"]
+additional_fqdns: ['storybook.blog.ddev.site']
+`);
+  assert.deepEqual(ddevHostnames(dir).list, ['one', 'two']);
+  assert.deepEqual(ddevHostnames(dir).fqdns, ['storybook.blog.ddev.site']);
+});
+
+test('the two lists stay apart, because one of them is compared against labels', () => {
+  // hostnameOwner compares `list` entries as LABELS. A fqdn in there would be compared against a
+  // label and never match, which is a collision check that silently stops checking.
+  const dir = project(`name: blog
+additional_hostnames:
+  - alias
+additional_fqdns:
+  - storybook.blog.ddev.site
+`);
+  const h = ddevHostnames(dir);
+  assert.deepEqual(h.list, ['alias']);
+  assert.deepEqual(h.fqdns, ['storybook.blog.ddev.site']);
+});
+
+/* ---------------- what must NOT be read ---------------- */
+
+test("DDEV's own commented-out examples are not hostnames", () => {
+  // A stock config.yaml ships these. A parser that reads them hands every project in the tree two
+  // hostnames it never had, and the collision check then reports conflicts that do not exist.
+  const dir = project(`name: blog
+# additional_hostnames:
+#  - somename
+#  - someothername
+# additional_fqdns:
+#  - example.com
+`);
+  assert.deepEqual(ddevExtraDomains(dir), []);
+});
+
+test('a folder that is not a DDEV project answers nothing rather than throwing', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'not-ddev-'));
+  assert.deepEqual(ddevExtraDomains(dir), []);
+  assert.deepEqual(ddevHostnames(dir), { list: [], fqdns: [], tld: 'ddev.site' });
+});
+
+test('an empty list is empty, not a list holding nothing', () => {
+  const dir = project(`name: blog
+additional_hostnames: []
+additional_fqdns:
+  - storybook.blog.ddev.site
+`);
+  assert.deepEqual(ddevExtraDomains(dir).map((d) => d.host), ['storybook.blog.ddev.site']);
+});
+
+test('the same address declared twice is listed once', () => {
+  const dir = project(`name: blog
+additional_fqdns:
+  - storybook.blog.ddev.site
+  - storybook.blog.ddev.site
+`);
+  assert.equal(ddevExtraDomains(dir).length, 1);
+});
+
+/* ---------------- which one is Storybook ---------------- */
+
+test('Storybook is marked, and only Storybook', () => {
+  const dir = project(`name: blog
+additional_fqdns:
+  - storybook.blog.ddev.site
+  - mail.blog.ddev.site
+  - my-storybook-notes.blog.ddev.site
+`);
+  const got = ddevExtraDomains(dir);
+  assert.deepEqual(got.map((d) => d.storybook), [true, false, false],
+    'only a host whose FIRST label is storybook is the component library');
+});
+
+/* ---------------- against the real tree ---------------- */
+
+test('the projects in this tree that ship a Storybook are found', () => {
+  // The regression in one line: before this parsed additional_fqdns, every one of these was absent.
+  const { loadWorkspaces } = require('../../workspaces');
+  const found = [];
+  for (const w of Object.values(loadWorkspaces())) {
+    if (!w.dir) continue;
+    let names = [];
+    try {
+      names = fs.readdirSync(w.dir, { withFileTypes: true })
+        .filter((e) => e.isDirectory() && !e.name.startsWith('.')).map((e) => e.name);
+    } catch (_) { continue; }
+    for (const n of names) {
+      if (ddevExtraDomains(path.join(w.dir, n)).some((d) => d.storybook)) found.push(`${w.key}/${n}`);
+    }
+  }
+  assert.ok(found.length > 0,
+    'no project in the tree declares a Storybook domain — either the tree changed or the fqdn key stopped being read');
+  for (const p of found) assert.ok(p.includes('/'), p);
+});

package/core/workspace-app/tests/unit/ddev-hostnames.test.js

@@ -0,0 +1,143 @@
+/**
+ * Extra hostnames for a project.
+ *
+ * The feature is "the same site at another address", and the whole design rests on
+ * ADDING rather than renaming — so what is asserted here is the parsing (which the
+ * dashboard and the shell each do separately, and must agree on), the validation,
+ * and the collision check, which is the part that prevents a router conflict
+ * nobody would be able to see from one project's page.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+const ROOT = path.join(__dirname, '..', '..', '..', '..');
+const FUN = path.join(ROOT, 'core', 'scripts', 'functions', 'fun-ddev-hostnames.sh');
+const CLI = path.join(ROOT, 'core', 'scripts', 'functions', 'fun-hostnames-cli.sh');
+const ARGS = path.join(ROOT, 'core', 'scripts', 'args', 'arg-hostnames.sh');
+
+function sh(snippet) {
+  return execFileSync('bash', ['-c', `source ${JSON.stringify(FUN)} ; ${snippet}`], { encoding: 'utf8' }).trim();
+}
+
+/** A project directory with the given config.yaml body. */
+function project(body) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'hn-'));
+  fs.mkdirSync(path.join(tmp, '.ddev'), { recursive: true });
+  fs.writeFileSync(path.join(tmp, '.ddev', 'config.yaml'), body);
+  return tmp;
+}
+
+test('the shell files are valid', () => {
+  for (const f of [FUN, CLI, ARGS]) assert.strictEqual(spawnSync('bash', ['-n', f]).status, 0, f);
+});
+
+test('additional_hostnames is read in both legal YAML shapes', () => {
+  const block = project('name: p\nadditional_hostnames:\n  - one\n  - "two"\nphp_version: "8.3"\n');
+  const inline = project('name: p\nadditional_hostnames: [one, "two"]\n');
+  const none = project('name: p\ndocroot: web\n');
+  try {
+    assert.deepStrictEqual(sh(`ddev_hostnames_list ${JSON.stringify(block)}`).split('\n'), ['one', 'two']);
+    assert.deepStrictEqual(sh(`ddev_hostnames_list ${JSON.stringify(inline)}`).split('\n'), ['one', 'two']);
+    assert.strictEqual(sh(`ddev_hostnames_list ${JSON.stringify(none)}`), '');
+  } finally { [block, inline, none].forEach((d) => fs.rmSync(d, { recursive: true, force: true })); }
+});
+
+test('DDEV’s own commented-out examples are not read as real hostnames', () => {
+  // config.yaml ships with `# additional_hostnames:` and `#  - somename` in its
+  // comments. Reading those would hand every project two hostnames it never had.
+  const d = project('name: p\n# additional_hostnames:\n#  - somename\n#  - someothername\n');
+  try {
+    assert.strictEqual(sh(`ddev_hostnames_list ${JSON.stringify(d)}`), '');
+  } finally { fs.rmSync(d, { recursive: true, force: true }); }
+});
+
+test('a hostname is a LABEL: no dots, no empty, no leading hyphen', () => {
+  for (const good of ['staging', 'blog2-dev', 'a', 'x1-2-3']) {
+    assert.strictEqual(sh(`ddev_hostname_valid ${JSON.stringify(good)} && echo yes || echo no`), 'yes', good);
+  }
+  // A dot would silently produce name.example.com.<tld>, which resolves to nothing.
+  for (const bad of ['a.b', 'has space', '-lead', 'trail-', '']) {
+    assert.strictEqual(sh(`ddev_hostname_valid ${JSON.stringify(bad)} && echo yes || echo no`), 'no', bad);
+  }
+});
+
+test('the workspace hostname is <project>-<workspace>, with no trailing junk', () => {
+  assert.strictEqual(sh('ddev_workspace_hostname test3 dev'), 'test3-dev');
+  assert.strictEqual(sh('ddev_workspace_hostname blog2 site-templates'), 'blog2-site-templates');
+  // `tr -c` complements the newline as well, which is how ddev_project_name grew a
+  // trailing hyphen; the \n is in the kept set here and this asserts it stays.
+  assert.ok(!sh('ddev_workspace_hostname test3 dev').endsWith('-'), 'no trailing hyphen');
+  assert.strictEqual(sh('ddev_workspace_hostname "" dev'), '');
+});
+
+test('the dashboard reads hostnames the same way the shell does', () => {
+  // This used to match patterns in server.js, because server.js cannot be required without starting
+  // the server. The parsing now lives in ddev-domains.js, so the behaviour is asserted by CALLING it
+  // — which is how a missing `additional_fqdns` would have been caught the first time.
+  const { ddevHostnames } = require('../../ddev-domains');
+  const os = require('os');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ddev-hostnames-'));
+  fs.mkdirSync(path.join(dir, '.ddev'), { recursive: true });
+  fs.writeFileSync(path.join(dir, '.ddev', 'config.yaml'), `name: blog
+project_tld: example.test
+additional_hostnames: [one, "two"]
+additional_fqdns:
+  - storybook.blog.ddev.site
+`);
+  const h = ddevHostnames(dir);
+  assert.deepEqual(h.list, ['one', 'two'], 'the inline [a, b] shape must be handled');
+  assert.deepEqual(h.fqdns, ['storybook.blog.ddev.site']);
+  assert.strictEqual(h.tld, 'example.test');
+
+  // The important one: no second writer. DDEV owns config.yaml, and the dashboard shells out to
+  // cmd-tools-hostnames.sh so the button and the CLI cannot disagree about the collision check.
+  const mod = fs.readFileSync(path.join(__dirname, '..', '..', 'ddev-domains.js'), 'utf8');
+  assert.ok(!/writeFileSync/.test(mod), 'the dashboard must not write config.yaml itself');
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+  assert.match(src, /cmd-tools-hostnames\.sh/);
+});
+
+test('the five site workspaces carry the command; the code-only ones do not', () => {
+  for (const w of ['dev', 'test', 'sandboxes', 'demos', 'projects']) {
+    assert.ok(fs.existsSync(path.join(ROOT, w, 'cmd-tools-hostnames.sh')), `${w} is missing it`);
+  }
+  for (const w of ['docs', 'videos', 'specs', 'products']) {
+    if (!fs.existsSync(path.join(ROOT, w))) continue;
+    assert.ok(!fs.existsSync(path.join(ROOT, w, 'cmd-tools-hostnames.sh')),
+      `${w} builds no sites and should not carry it`);
+  }
+});
+
+test('clone takes the address options, and --hostname is not the name it uses', () => {
+  const args = fs.readFileSync(path.join(ROOT, 'core', 'scripts', 'args', 'arg-clone.sh'), 'utf8');
+  assert.match(args, /'--extra-hostname'/);
+  assert.match(args, /'--with-workspace-hostname'/);
+  // HOSTNAME is a bash builtin; argparse assigns the dest as a shell variable, so
+  // --hostname would clobber it inside every clone.
+  assert.ok(!/'--hostname'/.test(args), 'must not use --hostname: it would clobber $HOSTNAME');
+});
+
+test('a clone name is checked against folders elsewhere and booked addresses', () => {
+  const fun = fs.readFileSync(path.join(ROOT, 'core', 'scripts', 'functions', 'fun-clone-project.sh'), 'utf8');
+  // `ddev list` is not enough on its own: an unregistered folder is invisible to
+  // it, and an additional hostname is a claim on an address it says nothing about.
+  assert.match(fun, /A folder called '\$\{target_name\}' already exists in this tree/);
+  assert.match(fun, /ddev_hostname_owner "\$\{target_name\}"/);
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+  assert.match(src, /function hostnameOwner/);
+  assert.match(src, /already answered by/);
+  assert.match(src, /a folder called \$\{esc\(to\)\} already exists in/);
+});
+
+test('hostnameOwner skips the project asking, or every project owns its own name', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+  const fn = src.slice(src.indexOf('function hostnameOwner'), src.indexOf('function hostnameOwner') + 1200);
+  assert.match(fn, /skipDir && path\.resolve\(dir\) === path\.resolve\(skipDir\)/);
+  const sh = fs.readFileSync(FUN, 'utf8');
+  assert.match(sh.slice(sh.indexOf('function ddev_hostname_owner')), /skip_real/);
+});

package/core/workspace-app/tests/unit/ddev-import.test.js

@@ -0,0 +1,82 @@
+/**
+ * Putting a database back: the other half of Export the database.
+ *
+ * The row could dump a database into the workspace's backups folder and never put one back, so every
+ * dump it wrote was a one-way trip. Two things make a naive version of this dangerous, and both are
+ * why the module exists: that folder also holds whole-project tarballs, which `ddev import-db` would
+ * accept as if they were SQL; and importing replaces every table in a database that is often the only
+ * copy of an afternoon's work.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const imp = require('../../ddev-import');
+
+const APP = path.join(__dirname, '../..');
+const actions = fs.readFileSync(path.join(APP, 'actions/ddev.js'), 'utf8');
+
+function backups(files) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-dump-'));
+  for (const f of files) fs.writeFileSync(path.join(dir, f), 'x');
+  return dir;
+}
+
+test('a dump is listed; a whole-project archive is not', () => {
+  // `ddev import-db` accepts .tar.gz, .tgz and .zip — and in this folder those are archives of an
+  // entire project. Offering one would hand a tarball of a site to the database.
+  const dir = backups([
+    'ruverify1--db--2026-09-23-10-12.sql.gz',
+    'dev---vp1107lock--2026-09-09_01-02-41-db.sql.gz',
+    'dev---vp1107lock--2026-09-09_01-02-41.tar.gz',
+    'dev---v11x00b1canvasicon--2026-09-13_17-45-34.tar.gz',
+    'notes.txt',
+    '.hidden.sql',
+  ]);
+  const names = imp.listDumps(dir).map((d) => d.name);
+  assert.deepEqual(names.sort(), [
+    'dev---vp1107lock--2026-09-09_01-02-41-db.sql.gz',
+    'ruverify1--db--2026-09-23-10-12.sql.gz',
+  ]);
+  for (const ext of ['a.sql', 'b.sql.gz', 'c.sql.bz2', 'd.sql.xz', 'e.mysql', 'f.mysql.gz']) {
+    assert.ok(imp.DUMP_RE.test(ext), ext);
+  }
+  for (const no of ['x.tar.gz', 'x.tgz', 'x.zip', 'x.txt', 'x.sql.zip']) {
+    assert.equal(imp.DUMP_RE.test(no), false, no);
+  }
+});
+
+test('the dump is named by basename, and matched against what is there', () => {
+  const dir = backups(['real--db--2026.sql.gz']);
+  assert.ok(imp.findDump(dir, 'real--db--2026.sql.gz'));
+  assert.equal(imp.findDump(dir, 'invented.sql.gz'), null);
+  // A name carrying a directory is refused before anything is compared, let alone joined.
+  for (const bad of ['../../../etc/passwd', 'sub/real--db--2026.sql.gz', '/etc/passwd', '']) {
+    assert.equal(imp.findDump(dir, bad), null, bad);
+  }
+});
+
+test('a snapshot is taken first, in the same line', () => {
+  // `&&`, not `;` — nothing is imported if the snapshot fails. The same shape `drush sql:drop`
+  // already uses before it drops. Verified live: the import left `before-import-2026-09-23-10-12`
+  // behind, and said so.
+  const fn = actions.slice(actions.indexOf('async function ddev_import_db'));
+  assert.match(fn, /ddev snapshot --name before-import-\$\{stamp\}`\s*\n\s*\+ ` && ddev import-db --file/);
+  assert.match(fn, /The database as it was is the snapshot before-import-/);
+  assert.match(fn, /if \(form\.confirm !== 'yes'\)/, 'and it is confirmed');
+  assert.match(fn, /ddevImport\.findDump\(backupsDir, form\.dump\)/, 'against the workspace\'s own folder');
+});
+
+test('the panel says what importing costs, and what it will not offer', () => {
+  const html = imp.importPanelHtml({
+    workspace: 'test', project: 'demo', backupsDir: backups(['a--db--1.sql.gz']), backupsLabel: '~/workspace/backups/test',
+  });
+  assert.match(html, /Importing <strong>replaces<\/strong>/);
+  assert.match(html, /A snapshot is taken first/);
+  assert.match(html, /Whole-project archives/);
+  assert.match(html, /hx-trigger="confirmed-remove"/);
+  assert.match(html, /~\/workspace\/backups\/test/, 'and where it is looking');
+});