@worca/ui 0.43.0 → 0.45.0

package/server/settings-merge.js

@@ -81,3 +81,107 @@ export function readLocalSettings(settingsPath) {
     return {};
   }
 }
+
+// Cross-tier merge atomic paths. Entries at these paths replace wholesale
+// when the project tier defines them — they do NOT deep-merge across
+// user-global ↔ project. Within-tier id+env still merges (the settings.json /
+// settings.local.json sibling pair is one logical tier). Mirrors the Python
+// _ATOMIC_LEAF_PATHS list in src/worca/utils/settings.py.
+const ATOMIC_LEAF_PATHS = [
+  ['worca', 'models'],
+  ['worca', 'pricing', 'models'],
+];
+
+function replaceAtomicSubkeys(merged, override, path) {
+  let nodeMerged = merged;
+  let nodeOverride = override;
+  for (const segment of path) {
+    if (
+      !nodeMerged ||
+      typeof nodeMerged !== 'object' ||
+      Array.isArray(nodeMerged) ||
+      !(segment in nodeMerged)
+    )
+      return;
+    if (
+      !nodeOverride ||
+      typeof nodeOverride !== 'object' ||
+      Array.isArray(nodeOverride) ||
+      !(segment in nodeOverride)
+    )
+      return;
+    nodeMerged = nodeMerged[segment];
+    nodeOverride = nodeOverride[segment];
+  }
+  if (
+    !nodeMerged ||
+    typeof nodeMerged !== 'object' ||
+    Array.isArray(nodeMerged) ||
+    !nodeOverride ||
+    typeof nodeOverride !== 'object' ||
+    Array.isArray(nodeOverride)
+  )
+    return;
+  for (const [key, value] of Object.entries(nodeOverride)) {
+    nodeMerged[key] = value;
+  }
+}
+
+/**
+ * Read the full effective settings stack the way the Python runtime resolves
+ * it: user-global base → user-global .local → project base → project .local.
+ * Each layer deep-merges over the previous, EXCEPT entries under
+ * worca.models.* and worca.pricing.models.* which replace wholesale across
+ * tiers (project shadows user shadows builtin per alias). Missing files are
+ * treated as empty objects.
+ *
+ * `globalSettingsPath` is passed in so callers can substitute it during
+ * tests; production callers thread the result of `paths.globalSettingsPath()`.
+ */
+export function readEffectiveSettings(projectSettingsPath, globalSettingsPath) {
+  const userLayers = [];
+  const projectLayers = [];
+  if (globalSettingsPath) {
+    try {
+      userLayers.push(JSON.parse(readFileSync(globalSettingsPath, 'utf8')));
+    } catch {
+      /* missing or invalid — treat as empty */
+    }
+    const globalLocal = localPathFor(globalSettingsPath);
+    if (existsSync(globalLocal)) {
+      try {
+        userLayers.push(JSON.parse(readFileSync(globalLocal, 'utf8')));
+      } catch {
+        /* invalid — skip */
+      }
+    }
+  }
+  if (projectSettingsPath) {
+    try {
+      projectLayers.push(JSON.parse(readFileSync(projectSettingsPath, 'utf8')));
+    } catch {
+      /* missing or invalid — treat as empty */
+    }
+    const projectLocal = localPathFor(projectSettingsPath);
+    if (existsSync(projectLocal)) {
+      try {
+        projectLayers.push(JSON.parse(readFileSync(projectLocal, 'utf8')));
+      } catch {
+        /* invalid — skip */
+      }
+    }
+  }
+  const userMerged = userLayers.reduce(
+    (acc, layer) => deepMerge(acc, layer),
+    {},
+  );
+  const projectMerged = projectLayers.reduce(
+    (acc, layer) => deepMerge(acc, layer),
+    {},
+  );
+  const merged = deepMerge(userMerged, projectMerged);
+  for (const path of ATOMIC_LEAF_PATHS) {
+    replaceAtomicSubkeys(merged, projectMerged, path);
+  }
+  return merged;
+}

package/server/templates-routes.js

@@ -378,6 +378,73 @@ function exportGist(projectRoot, id) {
   return match ? match[0] : null;
 }
 
+function _parseResolutionsHeader(req) {
+  const raw = req.headers['x-resolutions'];
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+    /* fall through */
+  }
+  return null;
+}
+
+function _writeResolutionsFile(dir, resolutions) {
+  if (!resolutions || Object.keys(resolutions).length === 0) return null;
+  const path = join(dir, 'resolutions.json');
+  writeFileSync(path, JSON.stringify(resolutions), 'utf8');
+  return path;
+}
+
+function _baseImportArgs(
+  bundlePath,
+  dstTier,
+  resolutionsPath,
+  onModelConflict,
+  bundleLabel,
+) {
+  const args = [
+    'import',
+    '--from',
+    bundlePath,
+    '--scope',
+    dstTier,
+    '--non-interactive',
+  ];
+  if (resolutionsPath) {
+    args.push('--resolutions', resolutionsPath);
+  }
+  if (onModelConflict) {
+    args.push('--on-model-conflict', onModelConflict);
+  }
+  if (bundleLabel) {
+    // Pass the user-visible filename so `_imported_from` is stamped with
+    // (e.g.) `feature-glm-ds-bundle.zip` instead of the server-side temp
+    // name `bundle.zip`. Optional — falls back to source basename in CLI.
+    args.push('--bundle-label', bundleLabel);
+  }
+  return args;
+}
+
+// Bundle filename is forwarded by the UI as an HTTP header so the
+// imported-from attribution badge shows the user-facing name rather than
+// the server-side temp `bundle.zip`. Sanitize lightly: reject paths /
+// slashes / oversized values to keep argv hygiene.
+const _BUNDLE_LABEL_HEADER = 'x-bundle-filename';
+function _readBundleLabel(req) {
+  const raw = req.headers[_BUNDLE_LABEL_HEADER];
+  if (typeof raw !== 'string' || raw.length === 0 || raw.length > 256) {
+    return null;
+  }
+  if (raw.includes('/') || raw.includes('\\') || raw.includes('\0')) {
+    return null;
+  }
+  return raw;
+}
+
 function handleZipImport(req, res) {
   const dstTier = req.query.dst_tier;
   if (!isValidTier(dstTier)) {
@@ -389,18 +456,25 @@ function handleZipImport(req, res) {
   if (rejectBuiltinWrite(res, dstTier, 'import to')) return;
 
   const zipBuffer = req.body;
-  const tmpPath = join(
-    tmpdir(),
-    `worca-import-${Math.random().toString(36).slice(2)}.zip`,
-  );
+  const resolutions = _parseResolutionsHeader(req);
+  const onModelConflict = req.query.on_model_conflict || null;
+  const bundleLabel = _readBundleLabel(req);
+  const dir = mkdtempSync(join(tmpdir(), 'worca-import-'));
+  const tmpPath = join(dir, 'bundle.zip');
   try {
     writeFileSync(tmpPath, zipBuffer);
+    const resolutionsPath = _writeResolutionsFile(dir, resolutions);
     const stdout = runWorcaTemplates(
       req.project.projectRoot,
-      ['import', '--from', tmpPath, '--scope', dstTier, '--non-interactive'],
+      _baseImportArgs(
+        tmpPath,
+        dstTier,
+        resolutionsPath,
+        onModelConflict,
+        bundleLabel,
+      ),
       { timeout: 60000 },
     );
-    // Best-effort summary: the CLI may print imported template ids to stdout
     const imported = [];
     for (const line of (stdout || '').split('\n')) {
       const m = line.match(/imported[:\s]+([a-z0-9_-]+)/i);
@@ -412,16 +486,76 @@ function handleZipImport(req, res) {
       .status(statusForCliCode(err.cliCode))
       .json({ ok: false, error: err.message, code: err.cliCode });
   } finally {
+    cleanupTemp(dir);
+  }
+}
+
+function handleImportPreview(req, res) {
+  const dstTier = req.query.dst_tier;
+  if (!isValidTier(dstTier)) {
+    return res.status(400).json({
+      ok: false,
+      error: `dst_tier must be one of: ${TIERS.join(', ')}`,
+    });
+  }
+  if (rejectBuiltinWrite(res, dstTier, 'import to')) return;
+
+  const ctype = req.headers['content-type'] || '';
+  const dir = mkdtempSync(join(tmpdir(), 'worca-import-preview-'));
+  try {
+    let bundlePath;
+    if (ctype.startsWith('application/zip')) {
+      bundlePath = join(dir, 'bundle.zip');
+      writeFileSync(bundlePath, req.body);
+    } else {
+      const { bundle } = req.body || {};
+      if (!bundle || typeof bundle !== 'object') {
+        return res
+          .status(400)
+          .json({ ok: false, error: 'bundle must be a JSON object' });
+      }
+      bundlePath = join(dir, 'bundle.json');
+      writeFileSync(bundlePath, JSON.stringify(bundle), 'utf8');
+    }
+    const stdout = runWorcaTemplates(
+      req.project.projectRoot,
+      [
+        'import',
+        '--from',
+        bundlePath,
+        '--scope',
+        dstTier,
+        '--non-interactive',
+        '--preview',
+      ],
+      { timeout: 30000 },
+    );
     try {
-      rmSync(tmpPath, { force: true });
+      const payload = JSON.parse(stdout);
+      res.json({ ok: true, ...payload });
     } catch {
-      /* ignore cleanup errors */
+      res.status(500).json({
+        ok: false,
+        error: 'CLI preview output was not valid JSON',
+        raw: stdout,
+      });
     }
+  } catch (err) {
+    res
+      .status(statusForCliCode(err.cliCode))
+      .json({ ok: false, error: err.message, code: err.cliCode });
+  } finally {
+    cleanupTemp(dir);
   }
 }
 
 function handleJsonImport(req, res) {
-  const { bundle, dst_tier: dstTier } = req.body || {};
+  const {
+    bundle,
+    dst_tier: dstTier,
+    resolutions,
+    on_model_conflict: onModelConflict,
+  } = req.body || {};
   if (!bundle || typeof bundle !== 'object') {
     return res
       .status(400)
@@ -434,8 +568,13 @@ function handleJsonImport(req, res) {
     });
   }
   if (rejectBuiltinWrite(res, dstTier, 'import to')) return;
+  const bundleLabel = _readBundleLabel(req);
   try {
-    const result = importBundle(req.project.projectRoot, bundle, dstTier);
+    const result = importBundle(req.project.projectRoot, bundle, dstTier, {
+      resolutions,
+      onModelConflict,
+      bundleLabel,
+    });
     res.json({ ok: true, ...result });
   } catch (err) {
     res
@@ -444,17 +583,25 @@ function handleJsonImport(req, res) {
   }
 }
 
-function importBundle(projectRoot, bundle, tier) {
+function importBundle(projectRoot, bundle, tier, opts = {}) {
   if (!bundle || !Array.isArray(bundle.templates)) {
     throw new Error('Bundle must contain a "templates" array');
   }
+  const { resolutions, onModelConflict, bundleLabel } = opts;
   const dir = mkdtempSync(join(tmpdir(), 'worca-import-'));
   const bundlePath = join(dir, 'bundle.json');
   try {
     writeFileSync(bundlePath, JSON.stringify(bundle), 'utf8');
+    const resolutionsPath = _writeResolutionsFile(dir, resolutions);
     runWorcaTemplates(
       projectRoot,
-      ['import', '--from', bundlePath, '--scope', tier, '--non-interactive'],
+      _baseImportArgs(
+        bundlePath,
+        tier,
+        resolutionsPath,
+        onModelConflict,
+        bundleLabel,
+      ),
       { timeout: 60000 },
     );
     const targetDir = dirForTier(projectRoot, tier);
@@ -593,6 +740,12 @@ export function createTemplatesRoutes() {
     },
   );
 
+  router.post(
+    '/templates/import/preview',
+    expressRaw({ type: 'application/zip', limit: '1mb' }),
+    (req, res) => handleImportPreview(req, res),
+  );
+
   /**
    * POST /api/projects/:projectId/templates/validate
    * Body: { config }