canopycms 0.0.0

package/src/__integration__/errors/permission-denied.test.ts

@@ -0,0 +1,220 @@
+/**
+ * Integration tests for permission denied scenarios.
+ * Tests proper error messages and status codes for unauthorized access.
+ * Tests go through the HTTP API layer.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { createMockAuthPlugin } from '../test-utils/multi-user'
+import { createApiClient } from '../test-utils/api-client'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import type { ApiResponse } from '../../api/types'
+
+describe('Permission Denied Errors', () => {
+  let workspace: TestWorkspace
+  let adminClient: Awaited<ReturnType<typeof createApiClient>>
+  let editorClient: Awaited<ReturnType<typeof createApiClient>>
+  let reviewerClient: Awaited<ReturnType<typeof createApiClient>>
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+    })
+
+    adminClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('admin'),
+      schema: BLOG_SCHEMA,
+    })
+
+    editorClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('editor'),
+      schema: BLOG_SCHEMA,
+    })
+
+    reviewerClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('reviewer'),
+      schema: BLOG_SCHEMA,
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  it('returns 403 when editor tries to access restricted branch', async () => {
+    // Admin creates a restricted branch
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'admin-only',
+      title: 'Admin Only Branch',
+    })
+
+    await adminClient.patch('/api/canopycms/admin-only/access', {
+      allowedUsers: ['test-admin'],
+      allowedGroups: [],
+    })
+
+    // Editor tries to access
+    const response = await editorClient.get('/api/canopycms/admin-only/status')
+
+    expect(response.status).toBe(403)
+    expect(response.ok).toBe(false)
+    const error = await response.json<ApiResponse>()
+    expect(error.error).toBeDefined()
+  })
+
+  it('returns 403 when editor tries to access restricted content path', async () => {
+    // Admin creates branch with path restrictions
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'restricted-paths',
+      title: 'Restricted Paths',
+    })
+
+    // Write content as admin
+    await adminClient.put('/api/canopycms/restricted-paths/content/posts/admin-post', {
+      format: 'mdx',
+      data: {
+        title: 'Admin Post',
+        author: 'Admin',
+        date: '2024-01-01',
+        tags: ['admin'],
+      },
+      body: 'Admin only content',
+    })
+
+    // TODO: Once path-level access control is enforced in API, test:
+    // - Editor tries to read restricted path (should be 403)
+    // - Editor tries to write to restricted path (should be 403)
+  })
+
+  it('returns 403 when non-reviewer tries to approve', async () => {
+    // Editor creates and submits branch
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'feature/approval-test',
+      title: 'Approval Test',
+    })
+
+    await editorClient.post('/api/canopycms/feature-approval-test/submit', {
+      message: 'Ready for review',
+    })
+
+    // Editor (not a reviewer) tries to approve
+    const response = await editorClient.post('/api/canopycms/feature-approval-test/approve', {
+      message: 'Trying to approve',
+    })
+
+    expect(response.status).toBe(403)
+    expect(response.ok).toBe(false)
+  })
+
+  it('returns 403 when non-admin tries to delete branch they did not create', async () => {
+    // Admin creates a branch
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'feature/delete-test',
+      title: 'Delete Test',
+    })
+
+    // Editor tries to delete (not their branch, not admin) - should fail
+    const editorDeleteResponse = await editorClient.delete('/api/canopycms/feature-delete-test')
+
+    expect(editorDeleteResponse.status).toBe(403)
+    expect(editorDeleteResponse.ok).toBe(false)
+
+    // Reviewer tries to delete (not their branch, not admin) - should also fail
+    const reviewerDeleteResponse = await reviewerClient.delete('/api/canopycms/feature-delete-test')
+
+    expect(reviewerDeleteResponse.status).toBe(403)
+    expect(reviewerDeleteResponse.ok).toBe(false)
+
+    // Admin can delete (they are the creator and also admin)
+    const adminDeleteResponse = await adminClient.delete('/api/canopycms/feature-delete-test')
+
+    expect(adminDeleteResponse.status).toBe(200)
+    expect(adminDeleteResponse.ok).toBe(true)
+  })
+
+  it('returns 403 when editor tries to modify branch access control on branch they did not create', async () => {
+    // Admin creates a branch
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'feature/access-test',
+      title: 'Access Test',
+    })
+
+    // Editor tries to modify access control (not their branch, not admin) - should fail
+    const response = await editorClient.patch('/api/canopycms/feature-access-test/access', {
+      allowedUsers: ['test-editor'],
+      allowedGroups: [],
+    })
+
+    expect(response.status).toBe(403)
+    expect(response.ok).toBe(false)
+  })
+
+  it('returns proper error message for permission denied', async () => {
+    // Admin creates restricted branch
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'restricted',
+      title: 'Restricted',
+    })
+
+    await adminClient.patch('/api/canopycms/restricted/access', {
+      allowedUsers: ['test-admin'],
+      allowedGroups: [],
+    })
+
+    // Editor tries to access
+    const response = await editorClient.get('/api/canopycms/restricted/status')
+
+    expect(response.status).toBe(403)
+    const error = await response.json<ApiResponse>()
+    expect(error.error).toBeTruthy()
+    expect(typeof error.error).toBe('string')
+    // Error message should be informative
+    expect(error.error!.length).toBeGreaterThan(0)
+  })
+
+  it('returns 403 when reviewer tries to edit content', async () => {
+    // Editor creates branch with content
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'feature/reviewer-test',
+      title: 'Reviewer Test',
+    })
+
+    await editorClient.put('/api/canopycms/feature-reviewer-test/content/posts/test-post', {
+      format: 'mdx',
+      data: {
+        title: 'Test Post',
+        author: 'Editor',
+        date: '2024-01-01',
+        tags: ['test'],
+      },
+      body: 'Original content',
+    })
+
+    // Reviewer can read (view access)
+    const readResponse = await reviewerClient.get(
+      '/api/canopycms/feature-reviewer-test/content/posts/test-post',
+    )
+    expect(readResponse.status).toBe(200)
+
+    // Reviewer tries to edit (should fail - reviewers have read-only access)
+    // TODO: Once role-based write restrictions are enforced, this should be 403
+    await reviewerClient.put('/api/canopycms/feature-reviewer-test/content/posts/test-post', {
+      format: 'mdx',
+      data: {
+        title: 'Modified by Reviewer',
+        author: 'Reviewer',
+        date: '2024-01-01',
+        tags: ['test'],
+      },
+      body: 'Modified content',
+    })
+
+    // This might succeed if defaultPathAccess is 'allow', but eventually should be 403
+    // expect(writeResponse.status).toBe(403)
+  })
+})

package/src/__integration__/fixtures/content-seeds.ts

@@ -0,0 +1,105 @@
+import type { ContentStore } from '../../content-store'
+import { unsafeAsLogicalPath, unsafeAsEntrySlug } from '../../paths/test-utils'
+
+/**
+ * Sample blog posts for seeding test content
+ */
+export const SAMPLE_POSTS = [
+  {
+    slug: 'hello-world',
+    data: {
+      title: 'Hello World',
+      author: 'Test Author',
+      date: '2024-01-01T00:00:00Z',
+      tags: ['intro', 'test'],
+      body: 'Welcome to the test blog! This is the first post.',
+    },
+  },
+  {
+    slug: 'second-post',
+    data: {
+      title: 'Second Post',
+      author: 'Test Author',
+      date: '2024-01-02T00:00:00Z',
+      tags: ['test'],
+      body: 'This is the second post for testing purposes.',
+    },
+  },
+  {
+    slug: 'draft-post',
+    data: {
+      title: 'Draft Post',
+      author: 'Test Author',
+      date: '2024-01-03T00:00:00Z',
+      tags: ['draft'],
+      body: "This is a draft post that hasn't been published yet.",
+    },
+  },
+]
+
+/**
+ * Sample about page content
+ */
+export const SAMPLE_ABOUT = {
+  title: 'About Us',
+  bio: 'This is a test about page for integration testing.',
+}
+
+/**
+ * Sample products for e-commerce schema
+ */
+export const SAMPLE_PRODUCTS = [
+  {
+    slug: 'product-1',
+    data: {
+      name: 'Test Product 1',
+      price: 29.99,
+      description: 'A great test product',
+      inStock: true,
+      images: ['product1.jpg'],
+    },
+  },
+  {
+    slug: 'product-2',
+    data: {
+      name: 'Test Product 2',
+      price: 49.99,
+      description: 'Another test product',
+      inStock: false,
+      images: ['product2.jpg', 'product2-alt.jpg'],
+    },
+  },
+]
+
+/**
+ * Seed blog content into a ContentStore
+ */
+export async function seedBlogContent(store: ContentStore): Promise<void> {
+  // Seed posts
+  for (const post of SAMPLE_POSTS) {
+    await store.write(unsafeAsLogicalPath('content/posts'), unsafeAsEntrySlug(post.slug), {
+      format: 'mdx',
+      data: post.data,
+      body: post.data.body as string,
+    })
+  }
+
+  // Seed about page
+  await store.write(unsafeAsLogicalPath('content/about.md'), '', {
+    format: 'mdx',
+    data: SAMPLE_ABOUT,
+    body: SAMPLE_ABOUT.bio as string,
+  })
+}
+
+/**
+ * Seed e-commerce content into a ContentStore
+ */
+export async function seedEcommerceContent(store: ContentStore): Promise<void> {
+  for (const product of SAMPLE_PRODUCTS) {
+    await store.write(unsafeAsLogicalPath('content/products'), unsafeAsEntrySlug(product.slug), {
+      format: 'json',
+      data: product.data,
+    })
+  }
+}

package/src/__integration__/fixtures/schemas.ts

@@ -0,0 +1,67 @@
+import type { RootCollectionConfig } from '../../config'
+
+/**
+ * Blog schema for testing content workflows
+ * Contains posts collection
+ */
+export const BLOG_SCHEMA: RootCollectionConfig = {
+  collections: [
+    {
+      name: 'posts',
+      path: 'posts',
+      entries: [
+        {
+          name: 'post',
+          format: 'mdx',
+          schema: [
+            { name: 'title', type: 'string', required: true },
+            { name: 'author', type: 'string' },
+            { name: 'date', type: 'datetime' },
+            { name: 'tags', type: 'string', list: true },
+            { name: 'body', type: 'markdown', required: true },
+          ],
+        },
+      ],
+    },
+  ],
+}
+
+/**
+ * E-commerce schema for testing complex permission scenarios
+ * Contains products and categories
+ */
+export const ECOMMERCE_SCHEMA: RootCollectionConfig = {
+  collections: [
+    {
+      name: 'products',
+      path: 'products',
+      entries: [
+        {
+          name: 'product',
+          format: 'json',
+          schema: [
+            { name: 'name', type: 'string', required: true },
+            { name: 'price', type: 'number', required: true },
+            { name: 'description', type: 'markdown' },
+            { name: 'inStock', type: 'boolean' },
+            { name: 'images', type: 'string', list: true },
+          ],
+        },
+      ],
+    },
+    {
+      name: 'categories',
+      path: 'categories',
+      entries: [
+        {
+          name: 'category',
+          format: 'json',
+          schema: [
+            { name: 'name', type: 'string', required: true },
+            { name: 'description', type: 'string' },
+          ],
+        },
+      ],
+    },
+  ],
+}

package/src/__integration__/initialization/prod-sim-init.test.ts

@@ -0,0 +1,139 @@
+/**
+ * Integration tests for prod-sim mode initialization.
+ * Tests that branch workspaces are created correctly with proper
+ * handling of concurrent requests (no race conditions).
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+
+import { BranchWorkspaceManager } from '../../branch-workspace'
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+
+describe('prod-sim Initialization', () => {
+  let workspace: TestWorkspace
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+      mode: 'prod-sim',
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  it('handles concurrent branch initialization without race conditions', async () => {
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    // Fire 5 concurrent requests to create the same branch workspace
+    // This simulates multiple API requests hitting the server simultaneously
+    const initPromises = Promise.all([
+      manager.openOrCreateBranch({
+        branchName: 'main',
+        mode: 'prod-sim',
+        createdBy: 'test-1',
+      }),
+      manager.openOrCreateBranch({
+        branchName: 'main',
+        mode: 'prod-sim',
+        createdBy: 'test-2',
+      }),
+      manager.openOrCreateBranch({
+        branchName: 'main',
+        mode: 'prod-sim',
+        createdBy: 'test-3',
+      }),
+      manager.openOrCreateBranch({
+        branchName: 'main',
+        mode: 'prod-sim',
+        createdBy: 'test-4',
+      }),
+      manager.openOrCreateBranch({
+        branchName: 'main',
+        mode: 'prod-sim',
+        createdBy: 'test-5',
+      }),
+    ])
+
+    // All should succeed without errors
+    const contexts = await initPromises
+    expect(contexts).toHaveLength(5)
+
+    // All should return valid contexts
+    contexts.forEach((ctx) => {
+      expect(ctx.branch.name).toBe('main')
+      expect(ctx.branchRoot).toBeTruthy()
+      expect(ctx.baseRoot).toBeTruthy()
+    })
+
+    // Verify only one workspace was created (no duplicates from race)
+    const branchesDir = path.join(workspace.tmpRoot, '.canopy-prod-sim', 'content-branches')
+    const entries = await fs.readdir(branchesDir)
+
+    // Should have main workspace + branches.json
+    expect(entries).toContain('main')
+    const mainDirs = entries.filter((e) => e === 'main')
+    expect(mainDirs.length).toBe(1)
+  })
+
+  it('creates valid git workspace with correct remote', async () => {
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    // Trigger initialization
+    const context = await manager.openOrCreateBranch({
+      branchName: 'main',
+      mode: 'prod-sim',
+      createdBy: 'test',
+    })
+
+    const mainWorkspace = context.branchRoot
+
+    // Verify it's a git repo
+    const gitDir = path.join(mainWorkspace, '.git')
+    const gitStat = await fs.stat(gitDir)
+    expect(gitStat.isDirectory()).toBe(true)
+
+    // Verify git remote is configured
+    const { simpleGit } = await import('simple-git')
+    const git = simpleGit({ baseDir: mainWorkspace })
+
+    const remotes = await git.getRemotes(true)
+    expect(remotes.length).toBeGreaterThan(0)
+    expect(remotes[0].name).toBe('origin')
+
+    // Verify on main branch
+    const branch = await git.branchLocal()
+    expect(branch.current).toBe('main')
+  })
+
+  it('workspace persists across multiple operations', async () => {
+    const manager = new BranchWorkspaceManager(workspace.config)
+
+    // First initialization
+    const firstContext = await manager.openOrCreateBranch({
+      branchName: 'main',
+      mode: 'prod-sim',
+      createdBy: 'test-1',
+    })
+
+    // Second access should load existing workspace
+    const secondContext = await manager.openOrCreateBranch({
+      branchName: 'main',
+      mode: 'prod-sim',
+      createdBy: 'test-2',
+    })
+
+    // Should return the same workspace path
+    expect(secondContext.branchRoot).toBe(firstContext.branchRoot)
+
+    // Verify only one workspace exists
+    const branchesDir = path.join(workspace.tmpRoot, '.canopy-prod-sim', 'content-branches')
+    const entries = await fs.readdir(branchesDir)
+    const mainDirs = entries.filter((e) => e === 'main')
+    expect(mainDirs.length).toBe(1)
+  })
+})