cabloy 5.1.215 → 5.1.217

package/vona/src/suite-vendor/a-vona/modules/a-metrics/test/middlewareSystem.health.test.ts

@@ -0,0 +1,309 @@
+import assert from 'node:assert/strict';
+import { createHmac } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import { readFileSync } from 'node:fs';
+import { registerHooks } from 'node:module';
+import { describe, test } from 'node:test';
+import ts from 'typescript';
+
+const healthUrl = new URL('../src/bean/middlewareSystem.health.ts?fixture=health', import.meta.url)
+  .href;
+const identityUrl = new URL(
+  '../../../../../../packages-vona/vona-core/src/lib/core/testIsolation.ts',
+  import.meta.url,
+).href;
+let closes = 0;
+const closeKey = Symbol.for('vona.health.test.close');
+(globalThis as Record<symbol, unknown>)[closeKey] = () => closes++;
+const hooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (context.parentURL === healthUrl) {
+      const source = {
+        'vona': `export class BeanBase {} export { assertTestAppIdentity } from ${JSON.stringify(identityUrl)}; export function closeProcessWorker() { globalThis[Symbol.for('vona.health.test.close')](); }`,
+        'vona-module-a-aspect': 'export function MiddlewareSystem() { return () => {}; }',
+      }[specifier];
+      if (source)
+        return { url: `data:text/javascript,${encodeURIComponent(source)}`, shortCircuit: true };
+    }
+    return nextResolve(specifier, context);
+  },
+  load(url, context, nextLoad) {
+    if (url === healthUrl) {
+      return {
+        format: 'module',
+        source: ts.transpileModule(readFileSync(new URL(url), 'utf8'), {
+          compilerOptions: {
+            experimentalDecorators: true,
+            target: ts.ScriptTarget.ESNext,
+            module: ts.ModuleKind.ESNext,
+          },
+        }).outputText,
+        shortCircuit: true,
+      };
+    }
+    return nextLoad(url, context);
+  },
+});
+const { MiddlewareSystemHealth } = await import(healthUrl);
+hooks.deregister();
+
+const runId = '20261014010203-a1b2c3d4';
+const key = 'a'.repeat(64);
+const nonce = 'b'.repeat(32);
+const payload = `${runId}\nPOST\n/health/test-stop\n${nonce}`;
+const sign = (value: string) => createHmac('sha256', key).update(value).digest('hex');
+
+function fixture() {
+  const req = { socket: { remoteAddress: '127.0.0.1' }, url: '/health/test-stop' };
+  const headers: Record<string, string> = {
+    'x-vona-test-stop-nonce': nonce,
+    'x-vona-test-stop-authorization': sign(`vona-test-stop-request-v1\n${payload}`),
+  };
+  const responseHeaders: Record<string, string> = {};
+  const ctx = {
+    path: '/health/test-stop',
+    method: 'POST',
+    req,
+    res: new EventEmitter(),
+    status: 0,
+    type: '',
+    body: undefined as unknown,
+    get: (name: string) => headers[name] ?? '',
+    set: (name: string, value: string) => (responseHeaders[name] = value),
+  };
+  const app = {
+    name: `cabtest${runId}`,
+    meta: { env: { META_MODE: 'test', VONA_TEST_RUN_ID: runId } },
+    config: { server: { workers: 1 } },
+  };
+  let nexts = 0;
+  const healthCalls: string[] = [];
+  const middleware = Object.create(MiddlewareSystemHealth.prototype);
+  Object.assign(middleware, {
+    app,
+    ctx,
+    $scope: {
+      metrics: {
+        service: {
+          health: {
+            async status(path: string) {
+              healthCalls.push(path);
+              return { code: 200, status: 'ok' };
+            },
+          },
+        },
+      },
+    },
+  });
+  return {
+    app,
+    ctx,
+    headers,
+    responseHeaders,
+    healthCalls,
+    execute: () =>
+      middleware.execute({}, async () => {
+        nexts++;
+      }),
+    nexts: () => nexts,
+  };
+}
+
+function withServerEnv(callback: () => Promise<void>) {
+  const names = ['META_MODE', 'VONA_TEST_RUN_ID', 'VONA_TEST_READY_KEY'] as const;
+  const old = names.map(name => process.env[name]);
+  process.env.META_MODE = 'test';
+  process.env.VONA_TEST_RUN_ID = runId;
+  process.env.VONA_TEST_READY_KEY = key;
+  return callback().finally(() => {
+    for (const [index, name] of names.entries()) {
+      if (old[index] === undefined) delete process.env[name];
+      else process.env[name] = old[index];
+    }
+  });
+}
+
+describe('authenticated managed shutdown', { concurrency: false }, () => {
+  test('shutdown acknowledges its distinct domain before close and rejects replay across middleware instances', async () => {
+    await withServerEnv(async () => {
+      const f = fixture();
+      const before = closes;
+      await f.execute();
+      assert.equal(f.ctx.status, 200);
+      assert.deepEqual(f.ctx.body, { status: 'stopping' });
+      assert.equal(
+        f.responseHeaders['x-vona-test-stop-proof'],
+        sign(`vona-test-stop-ack-v1\n${payload}`),
+      );
+      assert.equal(closes, before);
+      const replay = fixture();
+      replay.app = f.app;
+      // A separate request-scoped middleware with the same application must reject.
+      const middleware = Object.create(MiddlewareSystemHealth.prototype);
+      Object.assign(middleware, { app: f.app, ctx: replay.ctx });
+      await middleware.execute({}, async () => assert.fail('not next'));
+      assert.equal(replay.ctx.status, 409);
+      f.ctx.res.emit('finish');
+      f.ctx.res.emit('finish');
+      assert.equal(closes, before + 1);
+      assert.deepEqual(f.healthCalls, []);
+    });
+  });
+
+  const invalidCases: [string, (f: ReturnType<typeof fixture>) => void, number][] = [
+    [
+      'ordinary mode',
+      f => {
+        f.app.meta.env.META_MODE = 'dev';
+      },
+      404,
+    ],
+    [
+      'missing identity',
+      f => {
+        f.app.meta.env.VONA_TEST_RUN_ID = '';
+      },
+      404,
+    ],
+    [
+      'invalid date',
+      f => {
+        f.app.meta.env.VONA_TEST_RUN_ID = '20269999010203-a1b2c3d4';
+      },
+      404,
+    ],
+    [
+      'wrong app identity',
+      f => {
+        f.app.name = 'ordinary-app';
+      },
+      404,
+    ],
+    [
+      'multiple workers',
+      f => {
+        f.app.config.server.workers = 2;
+      },
+      404,
+    ],
+    [
+      'non-loopback socket ignoring forwarded IP',
+      f => {
+        f.ctx.req.socket.remoteAddress = '192.0.2.1';
+        f.headers['x-forwarded-for'] = '127.0.0.1';
+      },
+      404,
+    ],
+    [
+      'wrong method',
+      f => {
+        f.ctx.method = 'GET';
+      },
+      403,
+    ],
+    [
+      'query path',
+      f => {
+        f.ctx.req.url += '?ignored=yes';
+      },
+      403,
+    ],
+    [
+      'missing nonce',
+      f => {
+        delete f.headers['x-vona-test-stop-nonce'];
+      },
+      403,
+    ],
+    [
+      'malformed authorization',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = 'short';
+      },
+      403,
+    ],
+    [
+      'bad signature',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = 'f'.repeat(64);
+      },
+      403,
+    ],
+    [
+      'readiness signature cannot stop',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = sign(nonce);
+      },
+      403,
+    ],
+    [
+      'ack signature cannot stop',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = sign(`vona-test-stop-ack-v1\n${payload}`);
+      },
+      403,
+    ],
+    [
+      'wrong run signature',
+      f => {
+        f.headers['x-vona-test-stop-authorization'] = sign(
+          `vona-test-stop-request-v1\n${payload.replace(runId, '20261014010203-d4e5f6a7')}`,
+        );
+      },
+      403,
+    ],
+    [
+      'different nonce',
+      f => {
+        f.headers['x-vona-test-stop-nonce'] = 'c'.repeat(32);
+      },
+      403,
+    ],
+  ];
+  for (const [name, change, status] of invalidCases) {
+    test(`shutdown rejects ${name} without initiating close`, async () => {
+      await withServerEnv(async () => {
+        const f = fixture();
+        const before = closes;
+        change(f);
+        await f.execute();
+        assert.equal(f.ctx.status, status);
+        assert.equal(f.ctx.res.listenerCount('finish'), 0);
+        f.ctx.res.emit('finish');
+        assert.equal(closes, before);
+        assert.deepEqual(f.responseHeaders, {});
+      });
+    });
+  }
+
+  for (const [name, value] of [
+    ['META_MODE', 'dev'],
+    ['VONA_TEST_RUN_ID', '20261014010203-d4e5f6a7'],
+    ['VONA_TEST_READY_KEY', 'not-a-key'],
+  ] as const) {
+    test(`shutdown requires matching server-only ${name}`, async () => {
+      await withServerEnv(async () => {
+        const f = fixture();
+        process.env[name] = value;
+        await f.execute();
+        assert.equal(f.ctx.status, 404);
+        assert.equal(f.ctx.res.listenerCount('finish'), 0);
+      });
+    });
+  }
+
+  test('existing readiness signing and unrelated health routes remain unchanged', async () => {
+    await withServerEnv(async () => {
+      const f = fixture();
+      f.ctx.path = '/health/ready';
+      f.headers['x-vona-test-challenge'] = nonce;
+      await f.execute();
+      assert.equal(f.responseHeaders['x-vona-test-proof'], sign(nonce));
+      assert.deepEqual(f.healthCalls, ['/health/ready']);
+      assert.equal(f.ctx.res.listenerCount('finish'), 0);
+      f.ctx.path = '/unrelated';
+      await f.execute();
+      assert.equal(f.nexts(), 1);
+    });
+  });
+});

package/vona/src/suite-vendor/a-vona/modules/a-orm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-orm",
-  "version": "5.1.34",
+  "version": "5.1.35",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "db",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-orm/src/service/transactionAsyncLocalStorage_.ts

@@ -18,9 +18,9 @@ export class ServiceTransactionAsyncLocalStorage extends BeanBase {
     return this.transactionStorage.getStore()!;
   }
 
-  async run<RESULT>(fn: FunctionAsync<RESULT>): Promise<RESULT> {
-    // only once
-    if (this.transactionState) {
+  async run<RESULT>(fn: FunctionAsync<RESULT>, isolate = false): Promise<RESULT> {
+    // Delegated calls and datasource switches share state; independent contexts do not.
+    if (!isolate && this.transactionState) {
       return fn();
     }
     const transactionState = this.bean._newBean(ServiceTransactionState);

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.27",
+  "version": "5.1.28",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-static/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-static",
-  "version": "5.1.15",
+  "version": "5.1.16",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-static/src/bean/middlewareSystem.static.ts

@@ -161,7 +161,7 @@ async function _getFullPathInner(
 ): Promise<string | undefined> {
   // trim prefix
   if (options.apiStaticPrefix !== '/') {
-    const filePrefix = path.normalize(options.apiStaticPrefix.replace(/^\//, ''));
+    const filePrefix = path.posix.normalize(options.apiStaticPrefix.replace(/^\//, ''));
     if (filename.indexOf(filePrefix) !== 0) {
       return;
       // cannot throw error
@@ -170,7 +170,7 @@ async function _getFullPathInner(
     filename = filename.slice(filePrefix.length);
   }
   // check
-  const parts = filename.split(path.sep);
+  const parts = filename.split('/');
   const wordFirst = parts.shift();
   // public
   if (wordFirst === 'public') {

package/vona/src/suite-vendor/a-vona/modules/a-static/test/middlewareSystem.static.test.ts

@@ -0,0 +1,101 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { registerHooks } from 'node:module';
+import path from 'node:path';
+import { test } from 'node:test';
+import ts from 'typescript';
+
+for (const platform of ['posix', 'win32'] as const) {
+  const middlewareUrl = new URL(
+    `../src/bean/middlewareSystem.static.ts?fixture=static-${platform}`,
+    import.meta.url,
+  ).href;
+  const hooks = registerHooks({
+    resolve(specifier, context, nextResolve) {
+      if (context.parentURL === middlewareUrl) {
+        const source = {
+          'vona': 'export class BeanBase {} export function compose() {}',
+          'vona-module-a-aspect': 'export function MiddlewareSystem() { return () => {}; }',
+          'node:path': `import {posix,win32} from 'node:path'; export default {...${platform},posix,win32};`,
+          '../.metadata/this.ts': "export const __ThisModule__ = 'a-static';",
+        }[specifier];
+        if (source)
+          return { url: `data:text/javascript,${encodeURIComponent(source)}`, shortCircuit: true };
+      }
+      return nextResolve(specifier, context);
+    },
+    load(url, context, nextLoad) {
+      if (url === middlewareUrl) {
+        return {
+          format: 'module',
+          source: ts.transpileModule(
+            `${readFileSync(new URL(url), 'utf8')}\nexport { getFullPath };`,
+            {
+              compilerOptions: {
+                experimentalDecorators: true,
+                target: ts.ScriptTarget.ESNext,
+                module: ts.ModuleKind.ESNext,
+              },
+            },
+          ).outputText,
+          shortCircuit: true,
+        };
+      }
+      return nextLoad(url, context);
+    },
+  });
+  let getFullPath;
+  try {
+    ({ getFullPath } = await import(middlewareUrl));
+  } finally {
+    hooks.deregister();
+  }
+  const filesystem = path[platform];
+  const root = platform === 'win32' ? 'D:\\app\\public' : '/app/public';
+  const assetRoot = platform === 'win32' ? 'D:\\modules' : '/modules';
+  const ctx = {
+    app: {
+      scope: () => ({ event: { resolvePath: { emit: (data, fallback) => fallback(data) } } }),
+      meta: { modules: { 'home-index': {} } },
+      util: {
+        getAssetPathPhysical: (module: string, scene: string, filename: string) =>
+          filesystem.join(assetRoot, module, scene, filename),
+      },
+    },
+  };
+  const options = { apiStaticPrefix: '/api/static/' };
+
+  test(`${platform}: static URL separators resolve public uploads and module assets to native paths`, async () => {
+    for (const separator of ['/', '\\']) {
+      const publicUrl = 'api/static/public/1/image-native/default/avatar.jpg'.replaceAll(
+        '/',
+        separator,
+      );
+      assert.equal(
+        await getFullPath(ctx, root, publicUrl, options),
+        filesystem.join(root, '1', 'image-native', 'default', 'avatar.jpg'),
+      );
+      const moduleUrl = 'api/static/home/index/img/vona.png'.replaceAll('/', separator);
+      assert.equal(
+        await getFullPath(ctx, root, moduleUrl, options),
+        filesystem.join(assetRoot, 'home-index', 'static', 'img', 'vona.png'),
+      );
+    }
+  });
+
+  test(`${platform}: static resolution preserves root-prefix configuration and rejects unknown routes`, async () => {
+    assert.equal(
+      await getFullPath(ctx, root, 'public/avatar.jpg', { apiStaticPrefix: '/' }),
+      filesystem.join(root, 'avatar.jpg'),
+    );
+    assert.equal(await getFullPath(ctx, root, 'other/public/avatar.jpg', options), undefined);
+    assert.equal(
+      await getFullPath(ctx, root, 'api/static/unknown/module/file.jpg', options),
+      undefined,
+    );
+    await assert.rejects(
+      getFullPath(ctx, root, 'api/static/public/../../outside.jpg', options),
+      /unsafe filename/,
+    );
+  });
+}

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.100",
+  "version": "5.1.101",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-cli",
-  "version": "1.2.113",
+  "version": "1.2.114",
   "gitHead": "6f675a8cc46d596142c591c28a40cc4d82fcc6cc",
   "description": "zova cli",
   "keywords": [
@@ -44,7 +44,7 @@
     "@cabloy/process-helper": "^3.1.8",
     "fs-extra": "^11.3.5",
     "semver": "^7.6.2",
-    "zova-cli-set-front": "^1.2.111"
+    "zova-cli-set-front": "^1.2.112"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/packages-cli/cli-set-front/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-cli-set-front",
-  "version": "1.2.111",
+  "version": "1.2.112",
   "gitHead": "6f675a8cc46d596142c591c28a40cc4d82fcc6cc",
   "description": "zova cli-set-front",
   "keywords": [
@@ -70,7 +70,7 @@
     "vite": "^8.0.14",
     "yaml": "^2.8.3",
     "zova-openapi": "^1.1.17",
-    "zova-vite": "^1.1.47"
+    "zova-vite": "^1.1.48"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/packages-utils/zova-vite/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-vite",
-  "version": "1.1.47",
+  "version": "1.1.48",
   "gitHead": "09d901d17140a80ee0764211b441cda72fd94663",
   "description": "zova vite",
   "keywords": [

package/zova/packages-utils/zova-vite/src/configUtils.ts

@@ -275,7 +275,7 @@ export function createConfigUtils(
     for (const moduleName in modules) {
       const module = modules[moduleName];
       //
-      let test = module.root;
+      let test = module.root.replace(/\\/g, '/');
       let index = test.indexOf(appDir);
       if (index > -1) {
         test = test.substring(index + appDir.length);

package/zova/packages-utils/zova-vite/test/configUtils.test.ts

@@ -0,0 +1,55 @@
+import assert from 'node:assert/strict';
+import { registerHooks } from 'node:module';
+import { test } from 'node:test';
+
+const configUrl = new URL('../src/configUtils.ts?fixture=chunk-paths', import.meta.url).href;
+const hooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (context.parentURL === configUrl) {
+      const source = {
+        '@cabloy/module-glob': `export async function glob({projectPath}) {
+          const separator = projectPath.includes('\\\\') ? '\\\\' : '/';
+          const appDir = projectPath.replaceAll('/', separator);
+          return {modules:{'a-form':{root:appDir+separator+'src/suite-vendor/a-zova/modules/a-form'.replaceAll('/',separator),package:{}},
+            'a-external':{root:appDir+separator+'node_modules/zova-module-a-external'.replaceAll('/',separator),package:{}}}};
+        }`,
+        '@cabloy/dotenv':
+          "export function loadEnvs() { throw Error('Environment loading is not part of chunk grouping'); }",
+      }[specifier];
+      if (source)
+        return { url: `data:text/javascript,${encodeURIComponent(source)}`, shortCircuit: true };
+    }
+    return nextResolve(specifier, context);
+  },
+});
+let createConfigUtils;
+try {
+  ({ createConfigUtils } = await import(configUrl));
+} finally {
+  hooks.deregister();
+}
+
+for (const appDir of ['/checkout/zova', 'D:\\checkout\\zova', 'D:\\checkout/zova']) {
+  test(`module chunk groups match normalized Vite IDs for ${appDir}`, async () => {
+    const config = createConfigUtils(
+      { flavor: 'cabloyBasicAdmin', mode: 'production', appMode: 'ssr' },
+      { appDir },
+    );
+    await config.loadModulesMeta();
+    const groups = config.codeSplittingGroups();
+    const form = groups.find(group => group.name === 'a-form');
+    assert.equal(form.test, '/src/suite-vendor/a-zova/modules/a-form/');
+    assert.ok(
+      `${appDir.replaceAll('\\', '/')}/src/suite-vendor/a-zova/modules/a-form/src/index.ts`.includes(
+        form.test,
+      ),
+    );
+    const external = groups.find(group => group.name === 'a-external');
+    assert.equal(external.test, '/zova-module-a-external/');
+    assert.ok(
+      `${appDir.replaceAll('\\', '/')}/node_modules/zova-module-a-external/src/index.ts`.includes(
+        external.test,
+      ),
+    );
+  });
+}

package/zova/src/suite/a-commerce/modules/commerce-trade/src/model/cart.ts

@@ -29,7 +29,8 @@ export class ModelCart extends BeanModelBase {
       mutationFn: async (body: ApiApiCommerceTradeCartaddItemRequestBody) => {
         return await this.scope.api.commerceTradeCart.addItem(body);
       },
-      onSuccess: async () => {
+      onSuccess: async cart => {
+        this.$setQueryData(['current'], cart);
         await this.$invalidateQueries({ queryKey: ['current'] });
       },
     });
@@ -47,7 +48,8 @@ export class ModelCart extends BeanModelBase {
       }) => {
         return await this.scope.api.commerceTradeCart.updateItem(body, { params: { id } });
       },
-      onSuccess: async () => {
+      onSuccess: async cart => {
+        this.$setQueryData(['current'], cart);
         await this.$invalidateQueries({ queryKey: ['current'] });
       },
     });
@@ -59,7 +61,8 @@ export class ModelCart extends BeanModelBase {
       mutationFn: async (id: string) => {
         return await this.scope.api.commerceTradeCart.deleteItem({ params: { id } });
       },
-      onSuccess: async () => {
+      onSuccess: async cart => {
+        this.$setQueryData(['current'], cart);
         await this.$invalidateQueries({ queryKey: ['current'] });
       },
     });
@@ -93,7 +96,8 @@ export class ModelCart extends BeanModelBase {
       mutationFn: async () => {
         return await this.scope.api.commerceTradeCart.clear();
       },
-      onSuccess: async () => {
+      onSuccess: async cart => {
+        this.$setQueryData(['current'], cart);
         await this.$invalidateQueries({ queryKey: ['current'] });
       },
     });