canopycms 0.0.0 → 0.0.2

package/src/__integration__/settings/groups-api.test.ts

@@ -1,403 +0,0 @@
-/**
- * Integration tests for Groups API endpoints
- *
- * These tests verify that the Groups API works correctly with settings stored
- * in the new settings directory structure across all operating modes.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import path from 'node:path'
-import fs from 'node:fs/promises'
-
-import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
-import { BLOG_SCHEMA } from '../fixtures/schemas'
-import { createTestServices } from '../../config-test'
-import { createMockApiContext } from '../../test-utils/api-test-helpers'
-import { RESERVED_GROUPS, type InternalGroup } from '../../authorization'
-import { GROUP_ROUTES } from '../../api/groups'
-import { operatingStrategy } from '../../operating-mode'
-import { mockConsole } from '../../test-utils/console-spy'
-
-// Extract handlers
-const getInternalGroups = GROUP_ROUTES.getInternal.handler
-const updateInternalGroups = GROUP_ROUTES.updateInternal.handler
-
-describe('Groups API Integration', () => {
-  beforeEach(() => {
-    mockConsole()
-  })
-
-  describe('prod-sim mode', () => {
-    let workspace: TestWorkspace
-
-    beforeEach(async () => {
-      workspace = await createTestWorkspace({
-        schema: BLOG_SCHEMA,
-        mode: 'prod-sim',
-      })
-    })
-
-    afterEach(async () => {
-      await workspace.cleanup()
-    })
-
-    it('should load groups from settings directory', async () => {
-      // Create services
-      const services = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context = createMockApiContext({ services })
-
-      // Call the groups API
-      const result = await getInternalGroups(context, {
-        user: {
-          type: 'authenticated',
-          userId: 'admin-1',
-          groups: [RESERVED_GROUPS.ADMINS],
-        },
-      })
-
-      expect(result.ok).toBe(true)
-      if (result.ok && result.data) {
-        expect(result.data.groups).toBeDefined()
-        expect(Array.isArray(result.data.groups)).toBe(true)
-        // Should have at least Admins and Reviewers groups
-        expect(result.data.groups.length).toBeGreaterThanOrEqual(2)
-
-        const adminsGroup = result.data.groups.find((g) => g.id === RESERVED_GROUPS.ADMINS)
-        expect(adminsGroup).toBeDefined()
-        expect(adminsGroup?.name).toBe(RESERVED_GROUPS.ADMINS)
-      }
-    })
-
-    it('should save groups to settings directory with autogenerated IDs', async () => {
-      const services = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context = createMockApiContext({ services })
-
-      // Create new groups (with empty IDs for new groups, server will generate them)
-      const newGroups: InternalGroup[] = [
-        {
-          id: '',
-          name: RESERVED_GROUPS.ADMINS,
-          description: 'Full access',
-          members: ['admin-1'],
-        },
-        {
-          id: '',
-          name: RESERVED_GROUPS.REVIEWERS,
-          description: 'Can review',
-          members: [],
-        },
-        {
-          id: '', // Empty ID for new group
-          name: 'Editors',
-          description: 'Can edit content',
-          members: ['user-1', 'user-2'],
-        },
-      ]
-
-      // Update groups
-      const result = await updateInternalGroups(
-        context,
-        {
-          user: {
-            type: 'authenticated',
-            userId: 'admin-1',
-            groups: [RESERVED_GROUPS.ADMINS],
-          },
-        },
-        { groups: newGroups },
-      )
-
-      expect(result.ok).toBe(true)
-
-      // Verify file exists at correct path
-      const strategy = operatingStrategy('prod-sim')
-      const settingsRoot = strategy.getSettingsRoot(workspace.tmpRoot)
-      const groupsPath = path.join(settingsRoot, 'groups.json')
-
-      const fileExists = await fs.access(groupsPath).then(
-        () => true,
-        () => false,
-      )
-      expect(fileExists).toBe(true)
-
-      // Verify file content
-      const fileContent = await fs.readFile(groupsPath, 'utf-8')
-      const parsed = JSON.parse(fileContent)
-      expect(parsed.groups).toBeDefined()
-      expect(parsed.groups.length).toBe(3)
-
-      // Verify reserved groups use their names as IDs
-      const adminsGroup = parsed.groups.find(
-        (g: InternalGroup) => g.name === RESERVED_GROUPS.ADMINS,
-      )
-      expect(adminsGroup).toBeDefined()
-      expect(adminsGroup.id).toBe(RESERVED_GROUPS.ADMINS)
-
-      const reviewersGroup = parsed.groups.find(
-        (g: InternalGroup) => g.name === RESERVED_GROUPS.REVIEWERS,
-      )
-      expect(reviewersGroup).toBeDefined()
-      expect(reviewersGroup.id).toBe(RESERVED_GROUPS.REVIEWERS)
-
-      // Verify regular group has generated ID
-      const editorsGroup = parsed.groups.find((g: InternalGroup) => g.name === 'Editors')
-      expect(editorsGroup).toBeDefined()
-      expect(editorsGroup.id).not.toBe('')
-      expect(editorsGroup.id.length).toBeGreaterThan(0)
-      expect(editorsGroup.members).toEqual(['user-1', 'user-2'])
-    })
-
-    it('should handle concurrent group loads without race conditions', async () => {
-      const services = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context = createMockApiContext({ services })
-
-      // Make 5 concurrent requests
-      const promises = Array.from({ length: 5 }, () =>
-        getInternalGroups(context, {
-          user: {
-            type: 'authenticated',
-            userId: 'admin-1',
-            groups: [RESERVED_GROUPS.ADMINS],
-          },
-        }),
-      )
-
-      const results = await Promise.all(promises)
-
-      // All should succeed
-      results.forEach((result) => {
-        expect(result.ok).toBe(true)
-        if (result.ok && result.data) {
-          expect(result.data.groups.length).toBeGreaterThanOrEqual(2)
-        }
-      })
-    })
-
-    it('should preserve groups across service restarts', async () => {
-      // Create services and save groups
-      const services1 = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context1 = createMockApiContext({ services: services1 })
-
-      const customGroups: InternalGroup[] = [
-        {
-          id: '',
-          name: RESERVED_GROUPS.ADMINS,
-          description: 'Admins',
-          members: ['admin-1'],
-        },
-        {
-          id: '',
-          name: RESERVED_GROUPS.REVIEWERS,
-          description: 'Reviewers',
-          members: [],
-        },
-        {
-          id: '', // Empty ID for new group
-          name: 'Custom Group',
-          description: 'A custom group',
-          members: ['user-1', 'user-2', 'user-3'],
-        },
-      ]
-
-      await updateInternalGroups(
-        context1,
-        {
-          user: {
-            type: 'authenticated',
-            userId: 'admin-1',
-            groups: [RESERVED_GROUPS.ADMINS],
-          },
-        },
-        { groups: customGroups },
-      )
-
-      // Create new services instance (simulating restart)
-      const services2 = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context2 = createMockApiContext({ services: services2 })
-
-      // Load groups with new services
-      const result = await getInternalGroups(context2, {
-        user: {
-          type: 'authenticated',
-          userId: 'admin-1',
-          groups: [RESERVED_GROUPS.ADMINS],
-        },
-      })
-
-      expect(result.ok).toBe(true)
-      if (result.ok && result.data) {
-        const customGroup = result.data.groups.find((g) => g.name === 'Custom Group')
-        expect(customGroup).toBeDefined()
-        expect(customGroup?.id).not.toBe('') // Should have generated ID
-        expect(customGroup?.members).toEqual(['user-1', 'user-2', 'user-3'])
-      }
-    })
-  })
-
-  describe('dev mode', () => {
-    let workspace: TestWorkspace
-
-    beforeEach(async () => {
-      workspace = await createTestWorkspace({
-        schema: BLOG_SCHEMA,
-        mode: 'dev',
-      })
-    })
-
-    afterEach(async () => {
-      await workspace.cleanup()
-    })
-
-    it('should load groups from dev settings directory', async () => {
-      const services = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context = createMockApiContext({ services })
-
-      const result = await getInternalGroups(context, {
-        user: {
-          type: 'authenticated',
-          userId: 'admin-1',
-          groups: [RESERVED_GROUPS.ADMINS],
-        },
-      })
-
-      expect(result.ok).toBe(true)
-      if (result.ok && result.data) {
-        expect(result.data.groups).toBeDefined()
-        expect(result.data.groups.length).toBeGreaterThanOrEqual(2)
-      }
-    })
-
-    it('should save groups to .canopy-dev/settings directory', async () => {
-      const services = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context = createMockApiContext({ services })
-
-      const newGroups: InternalGroup[] = [
-        {
-          id: '', // Empty ID for new reserved group
-          name: RESERVED_GROUPS.ADMINS,
-          description: 'Admins',
-          members: ['admin-1'],
-        },
-        {
-          id: '', // Empty ID for new reserved group
-          name: RESERVED_GROUPS.REVIEWERS,
-          description: 'Reviewers',
-          members: [],
-        },
-      ]
-
-      await updateInternalGroups(
-        context,
-        {
-          user: {
-            type: 'authenticated',
-            userId: 'admin-1',
-            groups: [RESERVED_GROUPS.ADMINS],
-          },
-        },
-        { groups: newGroups },
-      )
-
-      // Verify file exists at correct path in dev mode
-      const strategy = operatingStrategy('dev')
-      const settingsRoot = strategy.getSettingsRoot(workspace.tmpRoot)
-      const groupsPath = path.join(settingsRoot, 'groups.json')
-
-      const fileExists = await fs.access(groupsPath).then(
-        () => true,
-        () => false,
-      )
-      expect(fileExists).toBe(true)
-
-      // Verify reserved groups use their names as IDs
-      const fileContent = await fs.readFile(groupsPath, 'utf-8')
-      const parsed = JSON.parse(fileContent)
-      expect(parsed.groups.length).toBe(2)
-      expect(parsed.groups[0].id).toBe(RESERVED_GROUPS.ADMINS)
-      expect(parsed.groups[1].id).toBe(RESERVED_GROUPS.REVIEWERS)
-    })
-  })
-
-  describe('permissions checking', () => {
-    let workspace: TestWorkspace
-
-    beforeEach(async () => {
-      workspace = await createTestWorkspace({
-        schema: BLOG_SCHEMA,
-        mode: 'prod-sim',
-      })
-    })
-
-    afterEach(async () => {
-      await workspace.cleanup()
-    })
-
-    it('should deny access to non-admin users for getting groups', async () => {
-      const services = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context = createMockApiContext({ services })
-
-      const result = await getInternalGroups(context, {
-        user: { type: 'authenticated', userId: 'regular-user', groups: [] },
-      })
-
-      expect(result.ok).toBe(false)
-      expect(result.status).toBe(403)
-    })
-
-    it('should deny access to non-admin users for updating groups', async () => {
-      const services = await createTestServices({
-        ...workspace.config,
-        schema: BLOG_SCHEMA,
-      })
-      const context = createMockApiContext({ services })
-
-      const newGroups: InternalGroup[] = [
-        {
-          id: RESERVED_GROUPS.ADMINS,
-          name: RESERVED_GROUPS.ADMINS,
-          description: 'Admins',
-          members: ['admin-1'],
-        },
-        {
-          id: RESERVED_GROUPS.REVIEWERS,
-          name: RESERVED_GROUPS.REVIEWERS,
-          description: 'Reviewers',
-          members: [],
-        },
-      ]
-
-      const result = await updateInternalGroups(
-        context,
-        { user: { type: 'authenticated', userId: 'regular-user', groups: [] } },
-        { groups: newGroups },
-      )
-
-      expect(result.ok).toBe(false)
-      expect(result.status).toBe(403)
-    })
-  })
-})

package/src/__integration__/test-utils/api-client.ts

@@ -1,167 +0,0 @@
-/**
- * API client helper for integration tests.
- * Creates requests and calls the Canopy HTTP handler.
- */
-
-import type { CanopyRequest } from '../../http/types'
-import { createCanopyRequestHandler } from '../../http/handler'
-import { createTestServices } from '../../config-test'
-import type { CreateCanopyServicesOptions } from '../../services'
-import type { CanopyConfig, RootCollectionConfig } from '../../config'
-import type { AuthPlugin } from '../../auth/plugin'
-import { CanopyApiClient } from '../../api/client'
-
-export interface ApiClientOptions {
-  config: CanopyConfig
-  authPlugin: AuthPlugin
-  /** Pre-resolved schema for tests (bypasses .collection.json loading) */
-  schema?: RootCollectionConfig
-  /** Entry schema registry for resolving .collection.json references */
-  entrySchemaRegistry?: CreateCanopyServicesOptions['entrySchemaRegistry']
-}
-
-/**
- * Create an API client that makes requests through the HTTP handler.
- * This simulates real API calls without needing a server.
- *
- * The client wraps the production CanopyApiClient with a custom fetch
- * that routes through the handler directly instead of making network requests.
- */
-export async function createApiClient(options: ApiClientOptions) {
-  // Use test services with schema
-  const services = await createTestServices(
-    {
-      ...options.config,
-      schema: options.schema ?? { collections: [] },
-    },
-    {
-      entrySchemaRegistry: options.entrySchemaRegistry,
-    },
-  )
-  const handler = createCanopyRequestHandler({
-    services,
-    authPlugin: options.authPlugin,
-    getBranchContext: async (branchName: string, opts?: { loadSchema?: boolean }) => {
-      if (!services.registry) {
-        throw new Error('Branch registry not available in dev mode')
-      }
-      const context = await services.registry.get(branchName)
-      if (!context) {
-        return null
-      }
-
-      // Load per-branch schema if requested
-      if (opts?.loadSchema) {
-        const contentRootName = services.config.contentRoot || 'content'
-        const cached = await services.branchSchemaCache.getSchema(
-          context.branchRoot,
-          services.entrySchemaRegistry,
-          contentRootName,
-        )
-        context.flatSchema = cached.flatSchema
-      }
-
-      return context
-    },
-  })
-
-  /**
-   * Custom fetch that routes through the handler
-   */
-  const testFetch: typeof fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
-    // Handle Request objects by extracting URL
-    const urlStr =
-      typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url
-
-    const path = urlStr.replace(/^http:\/\/[^/]+/, '') // Strip protocol/host
-    const segments = path
-      .replace(/^\/api\/canopycms\/?/, '')
-      .split('/')
-      .filter(Boolean)
-
-    const req: CanopyRequest = {
-      method: init?.method ?? 'GET',
-      url: urlStr,
-      header: (name: string) => {
-        if (!init?.headers) return null
-        if (init.headers instanceof Headers) {
-          return init.headers.get(name)
-        }
-        return (init.headers as Record<string, string>)[name.toLowerCase()] ?? null
-      },
-      json: async () => {
-        if (!init?.body) return undefined
-        if (typeof init.body === 'string') {
-          return JSON.parse(init.body)
-        }
-        return undefined
-      },
-    }
-
-    const response = await handler(req, segments)
-
-    // Return a Response-like object
-    return {
-      status: response.status,
-      ok: response.status >= 200 && response.status < 300,
-      json: async () => response.body,
-    } as Response
-  }
-
-  // Create production client with test fetch
-  const client = new CanopyApiClient({
-    baseUrl: '/api/canopycms',
-    fetch: testFetch,
-  })
-
-  /**
-   * Legacy request function for backward compatibility
-   */
-  async function request(
-    method: string,
-    path: string,
-    body?: any,
-    headers: Record<string, string> = {},
-  ) {
-    const response = await testFetch(path, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : undefined,
-    })
-
-    return {
-      status: response.status,
-      ok: response.ok,
-      json: async <T = unknown>() => response.json() as Promise<T>,
-      body: await response.json(),
-    }
-  }
-
-  return {
-    // Expose all typed client methods
-    ...client,
-
-    // Legacy compatibility: keep old method signatures
-    get: (path: string, headers?: Record<string, string>) =>
-      request('GET', path, undefined, headers),
-
-    post: (path: string, body?: any, headers?: Record<string, string>) =>
-      request('POST', path, body, headers),
-
-    put: (path: string, body?: any, headers?: Record<string, string>) =>
-      request('PUT', path, body, headers),
-
-    patch: (path: string, body?: any, headers?: Record<string, string>) =>
-      request('PATCH', path, body, headers),
-
-    delete: (path: string, headers?: Record<string, string>) =>
-      request('DELETE', path, undefined, headers),
-
-    /**
-     * Access to underlying services for setup/teardown
-     */
-    services,
-  }
-}
-
-export type ApiClient = ReturnType<typeof createApiClient>

package/src/__integration__/test-utils/multi-user.ts

@@ -1,129 +0,0 @@
-import type { AuthPlugin } from '../../auth/plugin'
-import type { AuthenticatedUser } from '../../user'
-import type { UserSearchResult, GroupMetadata, AuthenticationResult } from '../../auth/types'
-import type { CanopyUserId, CanopyGroupId } from '../../types'
-
-export type TestUserRole = 'admin' | 'reviewer' | 'editor'
-
-export interface TestUser {
-  userId: CanopyUserId
-  name: string
-  email: string
-  role: TestUserRole
-  groups: CanopyGroupId[]
-}
-
-/**
- * Predefined test user personas with different permission levels
- */
-export const TEST_USERS: Record<TestUserRole, TestUser> = {
-  admin: {
-    userId: 'test-admin',
-    name: 'Admin User',
-    email: 'admin@test.local',
-    role: 'admin',
-    groups: ['Admins'], // Reserved group with full access
-  },
-  reviewer: {
-    userId: 'test-reviewer',
-    name: 'Reviewer User',
-    email: 'reviewer@test.local',
-    role: 'reviewer',
-    groups: ['Reviewers'], // Reserved group with review access
-  },
-  editor: {
-    userId: 'test-editor',
-    name: 'Editor User',
-    email: 'editor@test.local',
-    role: 'editor',
-    groups: ['ContentEditors'], // Custom group with limited access
-  },
-}
-
-/**
- * Convert test user persona to AuthenticatedUser
- */
-export function createTestUser(role: TestUserRole): AuthenticatedUser {
-  const user = TEST_USERS[role]
-  return {
-    type: 'authenticated',
-    userId: user.userId,
-    email: user.email,
-    name: user.name,
-    groups: user.groups,
-  }
-}
-
-/**
- * Create a mock auth plugin for integration tests.
- * Allows switching between test users to simulate multi-user scenarios.
- */
-export function createMockAuthPlugin(currentRole: TestUserRole): AuthPlugin {
-  return {
-    async authenticate(_context: unknown): Promise<AuthenticationResult> {
-      const testUser = createTestUser(currentRole)
-      return {
-        success: true,
-        user: {
-          userId: testUser.userId,
-          email: testUser.email,
-          name: testUser.name,
-          externalGroups: testUser.groups,
-        },
-      }
-    },
-
-    async searchUsers(query: string, limit = 10): Promise<UserSearchResult[]> {
-      const allUsers = Object.values(TEST_USERS)
-      return allUsers
-        .filter(
-          (u) =>
-            u.name.toLowerCase().includes(query.toLowerCase()) ||
-            u.email.toLowerCase().includes(query.toLowerCase()),
-        )
-        .slice(0, limit)
-        .map((u) => ({
-          id: u.userId,
-          name: u.name,
-          email: u.email,
-        }))
-    },
-
-    async getUserMetadata(userId: CanopyUserId): Promise<UserSearchResult | null> {
-      const user = Object.values(TEST_USERS).find((u) => u.userId === userId)
-      return user
-        ? {
-            id: user.userId,
-            name: user.name,
-            email: user.email,
-          }
-        : null
-    },
-
-    async getGroupMetadata(groupId: CanopyGroupId): Promise<GroupMetadata | null> {
-      const groups: Record<string, GroupMetadata> = {
-        Admins: { id: 'Admins', name: 'Administrators', memberCount: 1 },
-        Reviewers: { id: 'Reviewers', name: 'Reviewers', memberCount: 1 },
-        ContentEditors: {
-          id: 'ContentEditors',
-          name: 'Content Editors',
-          memberCount: 1,
-        },
-      }
-      return groups[groupId] || null
-    },
-
-    async listGroups(limit = 100): Promise<GroupMetadata[]> {
-      return [
-        { id: 'Admins', name: 'Administrators', memberCount: 1 },
-        { id: 'Reviewers', name: 'Reviewers', memberCount: 1 },
-        { id: 'ContentEditors', name: 'Content Editors', memberCount: 1 },
-      ].slice(0, limit)
-    },
-
-    async searchExternalGroups(_query: string) {
-      // Return empty for tests - external groups are optional
-      return []
-    },
-  }
-}