canopycms 0.0.0 → 0.0.2

package/src/__integration__/test-utils/test-workspace.ts

@@ -1,130 +0,0 @@
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-import { simpleGit } from 'simple-git'
-import { vi } from 'vitest'
-import type { CanopyConfig } from '../../config'
-import { defineCanopyTestConfig } from '../../config-test'
-import { initTestRepo } from '../../test-utils'
-
-/**
- * Initialize a bare git repository with the specified default branch.
- * This ensures the bare repo's HEAD points to the correct branch when cloning.
- *
- * @param remotePath - Path where the bare repository should be created
- * @param defaultBranch - The default branch name (defaults to 'main')
- * @returns A simpleGit instance configured for the bare repository
- */
-export async function initBareRepo(remotePath: string, defaultBranch = 'main') {
-  await simpleGit().raw(['init', '--bare', `--initial-branch=${defaultBranch}`, remotePath])
-  return simpleGit({ baseDir: remotePath })
-}
-
-export interface TestWorkspace {
-  /** Root temporary directory for this workspace */
-  tmpRoot: string
-  /** Path to bare git remote */
-  remotePath: string
-  /** Path to seed clone (initial commit) */
-  seedPath: string
-  /** Full Canopy configuration */
-  config: CanopyConfig
-  /** Cleanup function to remove all temp files and restore cwd mock */
-  cleanup: () => Promise<void>
-}
-
-/**
- * Creates an isolated test environment with temp directory and bare git remote.
- *
- * Directory structure created:
- * ```
- * tmpRoot/
- *   ├── remote.git/       (bare git remote)
- *   ├── seed/             (initial clone with content/)
- *   └── branches/         (workspace clones will be created here)
- * ```
- *
- * Based on the pattern from branch-workflow.integration.test.ts
- */
-// Warnings to suppress in integration tests (expected when using local git repos)
-const suppressedWarnings: (string | RegExp)[] = [
-  'CanopyCMS: GitHub token not found',
-  'CanopyCMS: Failed to parse GitHub remote URL',
-  'CanopyCMS: GitHub service requires remoteUrl',
-]
-
-export async function createTestWorkspace(
-  configOverrides?: Partial<Parameters<typeof defineCanopyTestConfig>[0]>,
-): Promise<TestWorkspace> {
-  // Suppress known CanopyCMS warnings that are expected in integration tests
-  const originalWarn = console.warn
-  const warnSpy = vi.spyOn(console, 'warn').mockImplementation((...args) => {
-    const message = String(args[0] ?? '')
-    const shouldSuppress = suppressedWarnings.some((pattern) =>
-      typeof pattern === 'string' ? message.includes(pattern) : pattern.test(message),
-    )
-    if (!shouldSuppress) {
-      originalWarn.apply(console, args)
-    }
-  })
-
-  // Create root temp directory
-  const tmpRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'canopy-test-'))
-  const remotePath = path.join(tmpRoot, 'remote.git')
-  const seedPath = path.join(tmpRoot, 'seed')
-
-  try {
-    // Initialize bare remote
-    await initBareRepo(remotePath)
-
-    // Create and configure seed clone
-    await fs.mkdir(seedPath, { recursive: true })
-    const seedGit = await initTestRepo(seedPath)
-    await seedGit.raw(['branch', '-M', 'main'])
-
-    // Create initial content directory
-    await fs.mkdir(path.join(seedPath, 'content'), { recursive: true })
-
-    // Create initial commit with README
-    await fs.writeFile(path.join(seedPath, 'README.md'), '# Test Repository\n', 'utf8')
-    await seedGit.add(['.'])
-    await seedGit.commit('Initial commit')
-
-    // Push to remote
-    await seedGit.addRemote('origin', remotePath)
-    await seedGit.push('origin', 'main', { '--set-upstream': null })
-
-    // Create config
-    const config = defineCanopyTestConfig({
-      mode: 'prod-sim',
-      defaultBranchAccess: 'allow',
-      defaultPathAccess: 'allow',
-      defaultBaseBranch: 'main',
-      defaultRemoteName: 'origin',
-      defaultRemoteUrl: remotePath,
-      schema: { collections: [] },
-      ...configOverrides,
-    })
-
-    // Mock process.cwd() to return tmpRoot so BranchRegistry uses isolated path
-    // This prevents parallel tests from corrupting shared registry files
-    const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(tmpRoot)
-
-    return {
-      tmpRoot,
-      remotePath,
-      seedPath,
-      config,
-      cleanup: async () => {
-        warnSpy.mockRestore()
-        cwdSpy.mockRestore()
-        await fs.rm(tmpRoot, { recursive: true, force: true })
-      },
-    }
-  } catch (error) {
-    // Cleanup on error
-    warnSpy.mockRestore()
-    await fs.rm(tmpRoot, { recursive: true, force: true }).catch(() => {})
-    throw error
-  }
-}

package/src/__integration__/user/user-context.test.ts

@@ -1,174 +0,0 @@
-/**
- * Integration tests for user context API endpoint.
- * Tests the /whoami endpoint that returns current user info.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-
-import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
-import { createMockAuthPlugin } from '../test-utils/multi-user'
-import { createApiClient } from '../test-utils/api-client'
-import { BLOG_SCHEMA } from '../fixtures/schemas'
-import type { UserInfoResponse } from '../../api/user'
-import type { AuthPlugin } from '../../auth/plugin'
-import type { AuthenticationResult } from '../../auth/types'
-
-/**
- * Helper to create a mock auth plugin with custom userId and groups
- */
-function createCustomAuthPlugin(userId: string, groups: string[]): AuthPlugin {
-  return {
-    async authenticate(_context: unknown): Promise<AuthenticationResult> {
-      return {
-        success: true,
-        user: {
-          userId: `test-${userId}`,
-          email: `${userId}@test.local`,
-          name: `Test ${userId}`,
-          externalGroups: groups,
-        },
-      }
-    },
-    async searchUsers() {
-      return []
-    },
-    async getUserMetadata() {
-      return null
-    },
-    async getGroupMetadata() {
-      return null
-    },
-    async listGroups() {
-      return []
-    },
-    async searchExternalGroups() {
-      return []
-    },
-  }
-}
-
-describe('User Context API Integration', () => {
-  let workspace: TestWorkspace
-  let adminClient: Awaited<ReturnType<typeof createApiClient>>
-  let editorClient: Awaited<ReturnType<typeof createApiClient>>
-  let reviewerClient: Awaited<ReturnType<typeof createApiClient>>
-
-  beforeEach(async () => {
-    workspace = await createTestWorkspace({
-      schema: BLOG_SCHEMA,
-    })
-
-    // Create API clients for different users with different group memberships
-    adminClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('admin'),
-      schema: BLOG_SCHEMA,
-    })
-
-    editorClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('editor'),
-      schema: BLOG_SCHEMA,
-    })
-
-    reviewerClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('reviewer'),
-      schema: BLOG_SCHEMA,
-    })
-  })
-
-  afterEach(async () => {
-    await workspace.cleanup()
-  })
-
-  it('returns correct user info for admin user', async () => {
-    const response = await adminClient.get('/api/canopycms/whoami')
-
-    expect(response.status).toBe(200)
-    expect(response.ok).toBe(true)
-
-    const data = await response.json<UserInfoResponse>()
-    expect(data.ok).toBe(true)
-    expect(data.data?.userId).toBe('test-admin')
-    expect(data.data?.groups).toContain('Admins')
-  })
-
-  it('returns correct user info for editor user', async () => {
-    const response = await editorClient.get('/api/canopycms/whoami')
-
-    expect(response.status).toBe(200)
-    expect(response.ok).toBe(true)
-
-    const data = await response.json<UserInfoResponse>()
-    expect(data.ok).toBe(true)
-    expect(data.data?.userId).toBe('test-editor')
-    expect(data.data?.groups).toContain('ContentEditors')
-  })
-
-  it('returns correct user info for reviewer user', async () => {
-    const response = await reviewerClient.get('/api/canopycms/whoami')
-
-    expect(response.status).toBe(200)
-    expect(response.ok).toBe(true)
-
-    const data = await response.json<UserInfoResponse>()
-    expect(data.ok).toBe(true)
-    expect(data.data?.userId).toBe('test-reviewer')
-    expect(data.data?.groups).toContain('Reviewers')
-  })
-
-  it('returns all groups when user belongs to multiple', async () => {
-    // Create a client for a user with multiple groups
-    const multiGroupClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createCustomAuthPlugin('multi-group-user', ['ContentEditors', 'Reviewers']),
-      schema: BLOG_SCHEMA,
-    })
-
-    const response = await multiGroupClient.get('/api/canopycms/whoami')
-
-    expect(response.status).toBe(200)
-    const data = await response.json<UserInfoResponse>()
-    expect(data.ok).toBe(true)
-    expect(data.data?.userId).toBe('test-multi-group-user')
-    expect(data.data?.groups).toContain('ContentEditors')
-    expect(data.data?.groups).toContain('Reviewers')
-    expect(data.data?.groups).toHaveLength(2)
-  })
-
-  it('endpoint is accessible without special permissions', async () => {
-    // All authenticated users should be able to call /whoami
-    const responses = await Promise.all([
-      adminClient.get('/api/canopycms/whoami'),
-      editorClient.get('/api/canopycms/whoami'),
-      reviewerClient.get('/api/canopycms/whoami'),
-    ])
-
-    // All should succeed
-    responses.forEach((response) => {
-      expect(response.status).toBe(200)
-      expect(response.ok).toBe(true)
-    })
-  })
-
-  it('integrates with BranchManager permissions via user context', async () => {
-    // Create a branch as editor
-    const createResponse = await editorClient.post('/api/canopycms/branches', {
-      branch: 'feature/editor-branch',
-      title: 'Test Branch',
-    })
-    expect(createResponse.status).toBe(200)
-
-    // Verify the branch was created by the correct user
-    const branchData = await createResponse.json<any>()
-    expect(branchData.data?.branch.createdBy).toBe('test-editor')
-
-    // Get user info to confirm it matches
-    const whoamiResponse = await editorClient.get('/api/canopycms/whoami')
-    const whoamiData = await whoamiResponse.json<UserInfoResponse>()
-
-    expect(whoamiData.data?.userId).toBe('test-editor')
-    expect(branchData.data?.branch.createdBy).toBe(whoamiData.data?.userId)
-  })
-})

package/src/__integration__/validation/input-validation.test.ts

@@ -1,166 +0,0 @@
-/**
- * Integration tests for HTTP-level input validation.
- * Tests Zod schema validation that happens in the handler layer.
- * Tests go through the HTTP API layer.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-
-import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
-import { createMockAuthPlugin } from '../test-utils/multi-user'
-import { createApiClient } from '../test-utils/api-client'
-import { BLOG_SCHEMA } from '../fixtures/schemas'
-import type { ApiResponse } from '../../api/types'
-
-describe('Input Validation', () => {
-  let workspace: TestWorkspace
-  let editorClient: Awaited<ReturnType<typeof createApiClient>>
-
-  beforeEach(async () => {
-    workspace = await createTestWorkspace({
-      schema: BLOG_SCHEMA,
-    })
-
-    editorClient = await createApiClient({
-      config: workspace.config,
-      authPlugin: createMockAuthPlugin('editor'),
-      schema: BLOG_SCHEMA,
-    })
-  })
-
-  afterEach(async () => {
-    await workspace.cleanup()
-  })
-
-  describe('Branch Creation', () => {
-    it('rejects missing branch name', async () => {
-      // Try to create branch with empty branch name
-      const response = await editorClient.post('/api/canopycms/branches', {
-        branch: '',
-        title: 'Test Branch',
-      })
-
-      expect(response.status).toBe(400)
-      expect(response.ok).toBe(false)
-      const error = await response.json<ApiResponse>()
-      expect(error.error).toBeDefined()
-      expect(error.error).toContain('branch')
-    })
-  })
-
-  describe('Branch Deletion', () => {
-    it('returns 404 if branch param missing', async () => {
-      // Try to delete with empty branch parameter
-      // Note: Router returns 404 when path params are missing (not matched route)
-      const response = await editorClient.delete('/api/canopycms/')
-
-      expect(response.status).toBe(404)
-      expect(response.ok).toBe(false)
-      const error = await response.json<ApiResponse>()
-      expect(error.error).toBeDefined()
-    })
-  })
-
-  describe('Branch Access Update', () => {
-    it('returns 404 if branch param missing', async () => {
-      // First create a branch
-      await editorClient.post('/api/canopycms/branches', {
-        branch: 'test-branch',
-        title: 'Test Branch',
-      })
-
-      // Try to update access with empty branch parameter
-      // Note: Router returns 404 when path params are missing (not matched route)
-      const response = await editorClient.patch('/api/canopycms//access', {
-        allowedUsers: ['user1'],
-      })
-
-      expect(response.status).toBe(404)
-      expect(response.ok).toBe(false)
-      const error = await response.json<ApiResponse>()
-      expect(error.error).toBeDefined()
-    })
-  })
-
-  describe('Comment Creation', () => {
-    beforeEach(async () => {
-      // Create a test branch for comment tests
-      await editorClient.post('/api/canopycms/branches', {
-        branch: 'feature/comments',
-        title: 'Comments Test',
-      })
-    })
-
-    it('returns 400 if text is missing', async () => {
-      // Try to add comment without text field
-      const response = await editorClient.post('/api/canopycms/feature-comments/comments', {
-        type: 'field',
-        entryPath: 'posts/test',
-        canopyPath: 'title',
-        // Missing: text
-      } as any)
-
-      expect(response.status).toBe(400)
-      expect(response.ok).toBe(false)
-      const error = await response.json<ApiResponse>()
-      expect(error.error).toBeDefined()
-      expect(error.error).toContain('text')
-    })
-
-    it('returns 400 if type is missing', async () => {
-      // Try to add comment without type field
-      const response = await editorClient.post('/api/canopycms/feature-comments/comments', {
-        text: 'This is a test comment',
-        entryPath: 'posts/test',
-        canopyPath: 'title',
-        // Missing: type
-      } as any)
-
-      expect(response.status).toBe(400)
-      expect(response.ok).toBe(false)
-      const error = await response.json<ApiResponse>()
-      expect(error.error).toBeDefined()
-      expect(error.error).toContain('type')
-    })
-  })
-
-  describe('Additional Validation', () => {
-    it('validates comment type enum values', async () => {
-      // Create test branch
-      await editorClient.post('/api/canopycms/branches', {
-        branch: 'feature/enum-test',
-        title: 'Enum Test',
-      })
-
-      // Try to add comment with invalid type
-      const response = await editorClient.post('/api/canopycms/feature-enum-test/comments', {
-        text: 'Test comment',
-        type: 'invalid-type',
-        entryPath: 'posts/test',
-      } as any)
-
-      expect(response.status).toBe(400)
-      expect(response.ok).toBe(false)
-      const error = await response.json<ApiResponse>()
-      expect(error.error).toBeDefined()
-    })
-
-    it('validates required threadId parameter for resolve', async () => {
-      // Create test branch
-      await editorClient.post('/api/canopycms/branches', {
-        branch: 'feature/resolve-test',
-        title: 'Resolve Test',
-      })
-
-      // Try to resolve with empty threadId
-      // Note: Router returns 404 when path params are missing (not matched route)
-      const response = await editorClient.post(
-        '/api/canopycms/feature-resolve-test/comments//resolve',
-        {},
-      )
-
-      expect(response.status).toBe(404)
-      expect(response.ok).toBe(false)
-    })
-  })
-})