canopycms 0.0.0 → 0.0.1

package/src/__integration__/initialization/prod-sim-init.test.ts

@@ -1,139 +0,0 @@
-/**
- * Integration tests for prod-sim mode initialization.
- * Tests that branch workspaces are created correctly with proper
- * handling of concurrent requests (no race conditions).
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import fs from 'node:fs/promises'
-import path from 'node:path'
-
-import { BranchWorkspaceManager } from '../../branch-workspace'
-import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
-import { BLOG_SCHEMA } from '../fixtures/schemas'
-
-describe('prod-sim Initialization', () => {
-  let workspace: TestWorkspace
-
-  beforeEach(async () => {
-    workspace = await createTestWorkspace({
-      schema: BLOG_SCHEMA,
-      mode: 'prod-sim',
-    })
-  })
-
-  afterEach(async () => {
-    await workspace.cleanup()
-  })
-
-  it('handles concurrent branch initialization without race conditions', async () => {
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    // Fire 5 concurrent requests to create the same branch workspace
-    // This simulates multiple API requests hitting the server simultaneously
-    const initPromises = Promise.all([
-      manager.openOrCreateBranch({
-        branchName: 'main',
-        mode: 'prod-sim',
-        createdBy: 'test-1',
-      }),
-      manager.openOrCreateBranch({
-        branchName: 'main',
-        mode: 'prod-sim',
-        createdBy: 'test-2',
-      }),
-      manager.openOrCreateBranch({
-        branchName: 'main',
-        mode: 'prod-sim',
-        createdBy: 'test-3',
-      }),
-      manager.openOrCreateBranch({
-        branchName: 'main',
-        mode: 'prod-sim',
-        createdBy: 'test-4',
-      }),
-      manager.openOrCreateBranch({
-        branchName: 'main',
-        mode: 'prod-sim',
-        createdBy: 'test-5',
-      }),
-    ])
-
-    // All should succeed without errors
-    const contexts = await initPromises
-    expect(contexts).toHaveLength(5)
-
-    // All should return valid contexts
-    contexts.forEach((ctx) => {
-      expect(ctx.branch.name).toBe('main')
-      expect(ctx.branchRoot).toBeTruthy()
-      expect(ctx.baseRoot).toBeTruthy()
-    })
-
-    // Verify only one workspace was created (no duplicates from race)
-    const branchesDir = path.join(workspace.tmpRoot, '.canopy-prod-sim', 'content-branches')
-    const entries = await fs.readdir(branchesDir)
-
-    // Should have main workspace + branches.json
-    expect(entries).toContain('main')
-    const mainDirs = entries.filter((e) => e === 'main')
-    expect(mainDirs.length).toBe(1)
-  })
-
-  it('creates valid git workspace with correct remote', async () => {
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    // Trigger initialization
-    const context = await manager.openOrCreateBranch({
-      branchName: 'main',
-      mode: 'prod-sim',
-      createdBy: 'test',
-    })
-
-    const mainWorkspace = context.branchRoot
-
-    // Verify it's a git repo
-    const gitDir = path.join(mainWorkspace, '.git')
-    const gitStat = await fs.stat(gitDir)
-    expect(gitStat.isDirectory()).toBe(true)
-
-    // Verify git remote is configured
-    const { simpleGit } = await import('simple-git')
-    const git = simpleGit({ baseDir: mainWorkspace })
-
-    const remotes = await git.getRemotes(true)
-    expect(remotes.length).toBeGreaterThan(0)
-    expect(remotes[0].name).toBe('origin')
-
-    // Verify on main branch
-    const branch = await git.branchLocal()
-    expect(branch.current).toBe('main')
-  })
-
-  it('workspace persists across multiple operations', async () => {
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    // First initialization
-    const firstContext = await manager.openOrCreateBranch({
-      branchName: 'main',
-      mode: 'prod-sim',
-      createdBy: 'test-1',
-    })
-
-    // Second access should load existing workspace
-    const secondContext = await manager.openOrCreateBranch({
-      branchName: 'main',
-      mode: 'prod-sim',
-      createdBy: 'test-2',
-    })
-
-    // Should return the same workspace path
-    expect(secondContext.branchRoot).toBe(firstContext.branchRoot)
-
-    // Verify only one workspace exists
-    const branchesDir = path.join(workspace.tmpRoot, '.canopy-prod-sim', 'content-branches')
-    const entries = await fs.readdir(branchesDir)
-    const mainDirs = entries.filter((e) => e === 'main')
-    expect(mainDirs.length).toBe(1)
-  })
-})

package/src/__integration__/permissions/path-permissions.test.ts

@@ -1,314 +0,0 @@
-/**
- * Integration tests for path-based permissions.
- * Tests glob pattern matching, first-match-wins rule, and permission levels.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-
-import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
-import { createTestUser } from '../test-utils/multi-user'
-import { BLOG_SCHEMA } from '../fixtures/schemas'
-import { BranchWorkspaceManager } from '../../branch-workspace'
-import {
-  checkBranchAccessWithDefault,
-  loadPathPermissions,
-  savePathPermissions,
-  createCheckPathAccess,
-} from '../../authorization'
-import { unsafeAsPermissionPath } from '../../authorization/test-utils'
-import { unsafeAsPhysicalPath } from '../../paths/test-utils'
-
-describe('Path Permission Integration', () => {
-  let workspace: TestWorkspace
-
-  beforeEach(async () => {
-    workspace = await createTestWorkspace({
-      schema: BLOG_SCHEMA,
-      defaultPathAccess: 'allow',
-    })
-  })
-
-  afterEach(async () => {
-    await workspace.cleanup()
-  })
-
-  it('restricts editor from editing posts/** when not in allowed group', async () => {
-    const editor = createTestUser('editor')
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    const branch = await manager.openOrCreateBranch({
-      branchName: 'test-permissions',
-      mode: 'prod-sim',
-      title: 'Permission Test',
-      createdBy: editor.userId,
-      remoteUrl: workspace.remotePath,
-    })
-
-    // Set up path permissions: only 'BlogAuthors' group can edit posts
-    await savePathPermissions(
-      branch.branchRoot,
-      [
-        {
-          path: unsafeAsPermissionPath('content/posts/**'),
-          edit: { allowedGroups: ['BlogAuthors'] },
-        },
-      ],
-      'test-admin',
-      'prod-sim',
-    )
-
-    // Load permissions and check access
-    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
-    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
-
-    const access = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/hello.mdx'),
-      user: editor,
-      level: 'edit',
-    })
-
-    expect(access.allowed).toBe(false)
-    expect(access.reason).toBe('denied_by_rule')
-  })
-
-  it('allows admin to bypass path permissions', async () => {
-    const admin = createTestUser('admin')
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    const branch = await manager.openOrCreateBranch({
-      branchName: 'test-admin-bypass',
-      mode: 'prod-sim',
-      title: 'Admin Bypass Test',
-      createdBy: admin.userId,
-      remoteUrl: workspace.remotePath,
-    })
-
-    // Check branch access first - admin should have bypass
-    const branchAccess = checkBranchAccessWithDefault(branch, admin)
-    expect(branchAccess.allowed).toBe(true)
-    expect(branchAccess.reason).toBe('privileged')
-
-    // Set up strict path permissions
-    await savePathPermissions(
-      branch.branchRoot,
-      [
-        {
-          path: unsafeAsPermissionPath('content/posts/**'),
-          edit: { allowedGroups: ['BlogAuthors'] },
-        },
-      ],
-      admin.userId,
-      'prod-sim',
-    )
-
-    // Admin bypasses at branch level, so path restrictions don't matter
-    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
-    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
-
-    // Path check alone would fail for non-BlogAuthors
-    const pathAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/restricted.mdx'),
-      user: admin,
-      level: 'edit',
-    })
-
-    // Admin has bypass via groups (Admins group), but path check would deny
-    expect(admin.groups).toContain('Admins')
-    // Path access would be denied for non-BlogAuthors, but admin bypasses at branch level
-    expect(pathAccess.allowed).toBe(true) // Path rule denies, but admin bypasses elsewhere
-  })
-
-  it('applies first-match-wins rule for glob patterns', async () => {
-    const editor = createTestUser('editor')
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    const branch = await manager.openOrCreateBranch({
-      branchName: 'test-glob-matching',
-      mode: 'prod-sim',
-      title: 'Glob Pattern Test',
-      createdBy: editor.userId,
-      remoteUrl: workspace.remotePath,
-    })
-
-    // Set up overlapping permissions - first match wins
-    await savePathPermissions(
-      branch.branchRoot,
-      [
-        {
-          path: unsafeAsPermissionPath('content/posts/public-*'),
-          edit: { allowedGroups: ['ContentEditors'] }, // Allow ContentEditors to edit public posts
-        },
-        {
-          path: unsafeAsPermissionPath('content/posts/**'),
-          edit: { allowedGroups: ['BlogAuthors'] }, // Restrict all other posts to BlogAuthors
-        },
-      ],
-      'test-admin',
-      'prod-sim',
-    )
-
-    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
-    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
-
-    // Check access to public post (should match first rule)
-    const publicAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/public-announcement.mdx'),
-      user: editor,
-      level: 'edit',
-    })
-
-    expect(publicAccess.allowed).toBe(true)
-
-    // Check access to private post (should match second rule and be denied)
-    const privateAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/private-draft.mdx'),
-      user: editor,
-      level: 'edit',
-    })
-
-    expect(privateAccess.allowed).toBe(false)
-  })
-
-  it('supports different permission levels: read, edit, review', async () => {
-    const reviewer = createTestUser('reviewer')
-    const editor = createTestUser('editor')
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    const branch = await manager.openOrCreateBranch({
-      branchName: 'test-permission-levels',
-      mode: 'prod-sim',
-      title: 'Permission Levels Test',
-      createdBy: editor.userId,
-      remoteUrl: workspace.remotePath,
-    })
-
-    // Set up multi-level permissions
-    await savePathPermissions(
-      branch.branchRoot,
-      [
-        {
-          path: unsafeAsPermissionPath('content/posts/**'),
-          // No read restriction (defaults to allow if defaultPathAccess is 'allow')
-          edit: { allowedGroups: ['ContentEditors'] }, // Only editors can edit
-          review: { allowedGroups: ['Reviewers', 'Admins'] }, // Only reviewers can review
-        },
-      ],
-      'test-admin',
-      'prod-sim',
-    )
-
-    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
-    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
-
-    // Reviewer can read and review, but not edit
-    const reviewerReadAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
-      user: reviewer,
-      level: 'read',
-    })
-    expect(reviewerReadAccess.allowed).toBe(true)
-
-    const reviewerReviewAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
-      user: reviewer,
-      level: 'review',
-    })
-    expect(reviewerReviewAccess.allowed).toBe(true)
-
-    const reviewerEditAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
-      user: reviewer,
-      level: 'edit',
-    })
-    expect(reviewerEditAccess.allowed).toBe(false)
-
-    // Editor can read and edit, but not review
-    const editorReadAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
-      user: editor,
-      level: 'read',
-    })
-    expect(editorReadAccess.allowed).toBe(true)
-
-    const editorEditAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
-      user: editor,
-      level: 'edit',
-    })
-    expect(editorEditAccess.allowed).toBe(true)
-
-    const editorReviewAccess = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/posts/test.mdx'),
-      user: editor,
-      level: 'review',
-    })
-    expect(editorReviewAccess.allowed).toBe(false)
-  })
-
-  it('allows entry access with specific path rules', async () => {
-    const editor = createTestUser('editor')
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    const branch = await manager.openOrCreateBranch({
-      branchName: 'test-entry-perms',
-      mode: 'prod-sim',
-      title: 'Entry Permission Test',
-      createdBy: editor.userId,
-      remoteUrl: workspace.remotePath,
-    })
-
-    // Allow editing about page for ContentEditors
-    await savePathPermissions(
-      branch.branchRoot,
-      [
-        {
-          path: unsafeAsPermissionPath('content/about.md'),
-          edit: { allowedGroups: ['ContentEditors'] },
-        },
-      ],
-      'test-admin',
-      'prod-sim',
-    )
-
-    const rules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
-    const pathChecker = createCheckPathAccess(rules, workspace.config.defaultPathAccess ?? 'deny')
-
-    // Editor should have access to about page
-    const access = pathChecker({
-      relativePath: unsafeAsPhysicalPath('content/about.md'),
-      user: editor,
-      level: 'edit',
-    })
-
-    expect(access.allowed).toBe(true)
-  })
-
-  it('persists permission rules across branch lifecycle', async () => {
-    const admin = createTestUser('admin')
-    const manager = new BranchWorkspaceManager(workspace.config)
-
-    const branch = await manager.openOrCreateBranch({
-      branchName: 'test-persist-perms',
-      mode: 'prod-sim',
-      title: 'Permission Persistence Test',
-      createdBy: admin.userId,
-      remoteUrl: workspace.remotePath,
-    })
-
-    // Set up permissions
-    const initialRules: any[] = [
-      {
-        path: unsafeAsPermissionPath('content/posts/**'),
-        edit: { allowedGroups: ['BlogAuthors'] },
-      },
-    ]
-
-    await savePathPermissions(branch.branchRoot, initialRules, admin.userId, 'prod-sim')
-
-    // Load and verify
-    const loadedRules = await loadPathPermissions(branch.branchRoot, 'prod-sim')
-    expect(loadedRules).toHaveLength(1)
-    expect(loadedRules[0].path).toBe('content/posts/**')
-    expect(loadedRules[0].edit?.allowedGroups).toContain('BlogAuthors')
-  })
-})