canopycms 0.0.0

package/src/__integration__/workflows/api-editing-workflow.test.ts

@@ -0,0 +1,244 @@
+/**
+ * API-level integration tests for editing workflows.
+ * These tests go through the HTTP API layer, not calling core code directly.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { createMockAuthPlugin } from '../test-utils/multi-user'
+import { createApiClient } from '../test-utils/api-client'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import type { BranchResponse, BranchListResponse } from '../../api/branch'
+import type { EntriesResponse } from '../../api/entries'
+import type { ApiResponse } from '../../api/types'
+
+describe('API Editing Workflow Integration', () => {
+  let workspace: TestWorkspace
+  let adminClient: Awaited<ReturnType<typeof createApiClient>>
+  let editorClient: Awaited<ReturnType<typeof createApiClient>>
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+    })
+
+    // Create API clients for different users
+    adminClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('admin'),
+      schema: BLOG_SCHEMA,
+    })
+
+    editorClient = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('editor'),
+      schema: BLOG_SCHEMA,
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  it('completes full editing cycle through API: create → edit → save', async () => {
+    // STEP 1: Create branch via API
+    const createResponse = await editorClient.post('/api/canopycms/branches', {
+      branch: 'feature/new-post',
+      title: 'Add new blog post',
+    })
+
+    expect(createResponse.status).toBe(200)
+    expect(createResponse.ok).toBe(true)
+    const createData = await createResponse.json<BranchResponse>()
+    expect(createData.data?.branch.name).toBe('feature-new-post')
+    expect(createData.data?.branch.status).toBe('editing')
+
+    // STEP 2: Write content via API (path-based routing)
+    const writeResponse = await editorClient.put(
+      '/api/canopycms/feature-new-post/content/posts/hello-world',
+      {
+        format: 'mdx',
+        data: {
+          title: 'Hello World',
+          author: 'Test Author',
+          date: '2024-01-01T00:00:00Z',
+          tags: ['intro', 'test'],
+        },
+        body: 'This is my first post!',
+      },
+    )
+
+    if (writeResponse.status !== 200) {
+      console.error('Write content failed:', await writeResponse.json())
+    }
+    expect(writeResponse.status).toBe(200)
+    expect(writeResponse.ok).toBe(true)
+
+    // STEP 3: Read content back via API to verify
+    const readResponse = await editorClient.get(
+      '/api/canopycms/feature-new-post/content/posts/hello-world',
+    )
+
+    if (readResponse.status !== 200) {
+      console.error('Read content failed:', await readResponse.json())
+    }
+    expect(readResponse.status).toBe(200)
+    expect(readResponse.ok).toBe(true)
+    const content = await readResponse.json<
+      ApiResponse<{
+        format: string
+        data: Record<string, unknown>
+        body?: string
+      }>
+    >()
+    // content.data is the ContentDocument: { format, data: {...frontmatter}, body, ... }
+    expect(content.data?.data.title).toBe('Hello World')
+    expect(content.data?.body?.trim()).toBe('This is my first post!')
+
+    // STEP 4: List entries via API
+    const entriesResponse = await editorClient.get('/api/canopycms/feature-new-post/entries')
+
+    expect(entriesResponse.status).toBe(200)
+    const entries = await entriesResponse.json<EntriesResponse>()
+    expect(entries.data?.entries).toBeDefined()
+    expect(entries.data?.entries.length).toBeGreaterThan(0)
+
+    // STEP 5: Get branch status via API
+    const statusResponse = await editorClient.get('/api/canopycms/feature-new-post/status')
+
+    expect(statusResponse.status).toBe(200)
+    const status = await statusResponse.json<BranchResponse>()
+    expect(status.data?.branch.status).toBe('editing')
+  })
+
+  it('enforces permissions at API level', async () => {
+    // STEP 1: Admin creates a branch
+    const createResponse = await adminClient.post('/api/canopycms/branches', {
+      branch: 'admin-only-branch',
+      title: 'Admin Only',
+    })
+
+    expect(createResponse.status).toBe(200)
+
+    // STEP 2: Admin restricts branch access
+    const patchResponse = await adminClient.patch('/api/canopycms/admin-only-branch/access', {
+      allowedUsers: ['test-admin'],
+      allowedGroups: [],
+      managerOrAdminAllowed: true,
+    })
+
+    expect(patchResponse.status).toBe(200)
+
+    // STEP 3: Regular editor tries to access - should be denied
+    const editorAccessResponse = await editorClient.get('/api/canopycms/admin-only-branch/status')
+
+    expect(editorAccessResponse.status).toBe(403)
+    expect(editorAccessResponse.ok).toBe(false)
+
+    // STEP 4: Admin can still access
+    const adminAccessResponse = await adminClient.get('/api/canopycms/admin-only-branch/status')
+
+    expect(adminAccessResponse.status).toBe(200)
+    expect(adminAccessResponse.ok).toBe(true)
+  })
+
+  it('handles concurrent API requests from different users', async () => {
+    // Both users create branches simultaneously
+    const [adminBranchResponse, editorBranchResponse] = await Promise.all([
+      adminClient.post('/api/canopycms/branches', {
+        branch: 'admin-feature',
+        title: 'Admin Feature',
+      }),
+      editorClient.post('/api/canopycms/branches', {
+        branch: 'editor-feature',
+        title: 'Editor Feature',
+      }),
+    ])
+
+    expect(adminBranchResponse.status).toBe(200)
+    expect(editorBranchResponse.status).toBe(200)
+
+    // Both users write content to their own branches (path-based routing)
+    const [adminWriteResponse, editorWriteResponse] = await Promise.all([
+      adminClient.put('/api/canopycms/admin-feature/content/posts/admin-post', {
+        format: 'mdx',
+        data: {
+          title: 'Admin Post',
+          author: 'Admin',
+          date: '2024-01-01',
+          tags: ['admin'],
+        },
+        body: 'Admin content',
+      }),
+      editorClient.put('/api/canopycms/editor-feature/content/posts/editor-post', {
+        format: 'mdx',
+        data: {
+          title: 'Editor Post',
+          author: 'Editor',
+          date: '2024-01-01',
+          tags: ['editor'],
+        },
+        body: 'Editor content',
+      }),
+    ])
+
+    expect(adminWriteResponse.status).toBe(200)
+    expect(editorWriteResponse.status).toBe(200)
+
+    // Verify each user can read their own content
+    const adminReadResponse = await adminClient.get(
+      '/api/canopycms/admin-feature/content/posts/admin-post',
+    )
+    expect(adminReadResponse.status).toBe(200)
+
+    const editorReadResponse = await editorClient.get(
+      '/api/canopycms/editor-feature/content/posts/editor-post',
+    )
+    expect(editorReadResponse.status).toBe(200)
+
+    // Admin restricts their branch to admin-only
+    const restrictResponse = await adminClient.patch('/api/canopycms/admin-feature/access', {
+      allowedUsers: ['test-admin'],
+      allowedGroups: [],
+      managerOrAdminAllowed: true,
+    })
+    expect(restrictResponse.status).toBe(200)
+
+    // Cross-branch access with ACL
+    const adminReadEditorResponse = await adminClient.get(
+      '/api/canopycms/editor-feature/content/posts/editor-post',
+    )
+    expect(adminReadEditorResponse.status).toBe(200) // Admin can access everything
+
+    const editorReadAdminResponse = await editorClient.get(
+      '/api/canopycms/admin-feature/content/posts/admin-post',
+    )
+    expect(editorReadAdminResponse.status).toBe(403) // Editor cannot access restricted admin branch
+  })
+
+  it('lists branches via API with proper filtering', async () => {
+    // Create multiple branches
+    await adminClient.post('/api/canopycms/branches', {
+      branch: 'public-branch',
+      title: 'Public Branch',
+    })
+
+    await editorClient.post('/api/canopycms/branches', {
+      branch: 'editor-branch',
+      title: 'Editor Branch',
+    })
+
+    // List branches as admin - should see all
+    const adminListResponse = await adminClient.get('/api/canopycms/branches')
+    expect(adminListResponse.status).toBe(200)
+    const adminBranches = await adminListResponse.json<BranchListResponse>()
+    expect(adminBranches.data?.branches.length).toBeGreaterThanOrEqual(2)
+
+    // List branches as editor - should see their own + public
+    const editorListResponse = await editorClient.get('/api/canopycms/branches')
+    expect(editorListResponse.status).toBe(200)
+    const editorBranches = await editorListResponse.json<BranchListResponse>()
+    expect(editorBranches.data?.branches.some((b) => b.name === 'editor-branch')).toBe(true)
+  })
+})

package/src/__integration__/workflows/conflict-resolution.test.ts

@@ -0,0 +1,259 @@
+/**
+ * Integration tests for conflict resolution workflows.
+ * Tests merge conflicts, git errors, and recovery scenarios.
+ * Tests go through the HTTP API layer.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+
+import { createTestWorkspace, type TestWorkspace } from '../test-utils/test-workspace'
+import { createMockAuthPlugin } from '../test-utils/multi-user'
+import { createApiClient } from '../test-utils/api-client'
+import { BLOG_SCHEMA } from '../fixtures/schemas'
+import type { BranchResponse } from '../../api/branch'
+import type { ApiResponse } from '../../api/types'
+
+describe('Conflict Resolution Integration', () => {
+  let workspace: TestWorkspace
+  let editor1Client: Awaited<ReturnType<typeof createApiClient>>
+  let editor2Client: Awaited<ReturnType<typeof createApiClient>>
+
+  beforeEach(async () => {
+    workspace = await createTestWorkspace({
+      schema: BLOG_SCHEMA,
+    })
+
+    editor1Client = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('editor'),
+      schema: BLOG_SCHEMA,
+    })
+
+    editor2Client = await createApiClient({
+      config: workspace.config,
+      authPlugin: createMockAuthPlugin('admin'),
+      schema: BLOG_SCHEMA,
+    })
+  })
+
+  afterEach(async () => {
+    await workspace.cleanup()
+  })
+
+  it('detects conflicts when two editors modify the same content', async () => {
+    // Editor 1 creates a branch and writes content
+    await editor1Client.post('/api/canopycms/branches', {
+      branch: 'feature/conflict-test',
+      title: 'Conflict Test',
+    })
+
+    await editor1Client.put('/api/canopycms/feature-conflict-test/content/posts/shared-post', {
+      format: 'mdx',
+      data: {
+        title: 'Shared Post',
+        author: 'Editor 1',
+        date: '2024-01-01',
+        tags: ['test'],
+      },
+      body: 'Original content from Editor 1',
+    })
+
+    // Editor 2 creates a different branch from same base
+    await editor2Client.post('/api/canopycms/branches', {
+      branch: 'feature/conflict-test-2',
+      title: 'Conflict Test 2',
+    })
+
+    await editor2Client.put('/api/canopycms/feature-conflict-test-2/content/posts/shared-post', {
+      format: 'mdx',
+      data: {
+        title: 'Shared Post',
+        author: 'Editor 2',
+        date: '2024-01-01',
+        tags: ['test'],
+      },
+      body: 'Different content from Editor 2',
+    })
+
+    // Both approve and publish
+    // When merging, there should be a conflict
+    // TODO: Once merge API is implemented, test conflict detection
+  })
+
+  it('handles concurrent modifications to different files', async () => {
+    // Create branch
+    await editor1Client.post('/api/canopycms/branches', {
+      branch: 'feature/concurrent-edits',
+      title: 'Concurrent Edits',
+    })
+
+    // Two editors write different files simultaneously
+    const [response1, response2] = await Promise.all([
+      editor1Client.put('/api/canopycms/feature-concurrent-edits/content/posts/post-1', {
+        format: 'mdx',
+        data: {
+          title: 'Post 1',
+          author: 'Editor 1',
+          date: '2024-01-01',
+          tags: ['test'],
+        },
+        body: 'Content 1',
+      }),
+      editor1Client.put('/api/canopycms/feature-concurrent-edits/content/posts/post-2', {
+        format: 'mdx',
+        data: {
+          title: 'Post 2',
+          author: 'Editor 2',
+          date: '2024-01-02',
+          tags: ['test'],
+        },
+        body: 'Content 2',
+      }),
+    ])
+
+    expect(response1.status).toBe(200)
+    expect(response2.status).toBe(200)
+
+    // Both files should exist
+    const read1 = await editor1Client.get(
+      '/api/canopycms/feature-concurrent-edits/content/posts/post-1',
+    )
+    const read2 = await editor1Client.get(
+      '/api/canopycms/feature-concurrent-edits/content/posts/post-2',
+    )
+
+    expect(read1.status).toBe(200)
+    expect(read2.status).toBe(200)
+  })
+
+  it('prevents overwriting uncommitted changes', async () => {
+    // Create branch and write content
+    await editor1Client.post('/api/canopycms/branches', {
+      branch: 'feature/uncommitted-test',
+      title: 'Uncommitted Test',
+    })
+
+    const write1 = await editor1Client.put(
+      '/api/canopycms/feature-uncommitted-test/content/posts/test-post',
+      {
+        format: 'mdx',
+        data: {
+          title: 'Test Post',
+          author: 'Editor 1',
+          date: '2024-01-01',
+          tags: ['test'],
+        },
+        body: 'First version',
+      },
+    )
+
+    expect(write1.status).toBe(200)
+
+    // Write again to same file (should succeed with overwrite)
+    const write2 = await editor1Client.put(
+      '/api/canopycms/feature-uncommitted-test/content/posts/test-post',
+      {
+        format: 'mdx',
+        data: {
+          title: 'Test Post Updated',
+          author: 'Editor 1',
+          date: '2024-01-01',
+          tags: ['test', 'updated'],
+        },
+        body: 'Second version',
+      },
+    )
+
+    expect(write2.status).toBe(200)
+
+    // Verify second version is persisted
+    const read = await editor1Client.get(
+      '/api/canopycms/feature-uncommitted-test/content/posts/test-post',
+    )
+    expect(read.status).toBe(200)
+    const content = await read.json<
+      ApiResponse<{
+        format: string
+        data: Record<string, unknown>
+        body?: string
+      }>
+    >()
+    expect(content.data?.data.title).toBe('Test Post Updated')
+  })
+
+  it('recovers from git errors gracefully', async () => {
+    // Create branch
+    await editor1Client.post('/api/canopycms/branches', {
+      branch: 'feature/git-error-test',
+      title: 'Git Error Test',
+    })
+
+    // Write valid content
+    const writeResponse = await editor1Client.put(
+      '/api/canopycms/feature-git-error-test/content/posts/test-post',
+      {
+        format: 'mdx',
+        data: {
+          title: 'Test Post',
+          author: 'Editor',
+          date: '2024-01-01',
+          tags: ['test'],
+        },
+        body: 'Test content',
+      },
+    )
+
+    expect(writeResponse.status).toBe(200)
+
+    // Try to write to invalid collection (should fail gracefully)
+    const invalidWrite = await editor1Client.put(
+      '/api/canopycms/feature-git-error-test/content/invalid-collection/test',
+      {
+        collection: 'invalid-collection',
+        slug: 'test',
+        format: 'mdx',
+        data: {
+          title: 'Test',
+        },
+        body: 'Should fail',
+      },
+    )
+
+    // Should get error, not crash
+    expect(invalidWrite.status).toBeGreaterThanOrEqual(400)
+
+    // Original content should still be accessible
+    const read = await editor1Client.get(
+      '/api/canopycms/feature-git-error-test/content/posts/test-post',
+    )
+    expect(read.status).toBe(200)
+  })
+
+  it('handles stale branch state after remote updates', async () => {
+    // Create branch
+    await editor1Client.post('/api/canopycms/branches', {
+      branch: 'feature/stale-state',
+      title: 'Stale State Test',
+    })
+
+    // Write content
+    await editor1Client.put('/api/canopycms/feature-stale-state/content/posts/test-post', {
+      format: 'mdx',
+      data: {
+        title: 'Test Post',
+        author: 'Editor',
+        date: '2024-01-01',
+        tags: ['test'],
+      },
+      body: 'Original content',
+    })
+
+    // Get branch status
+    const statusResponse = await editor1Client.get('/api/canopycms/feature-stale-state/status')
+    expect(statusResponse.status).toBe(200)
+    const status = await statusResponse.json<BranchResponse>()
+
+    // Branch should be in editing state
+    expect(status.data?.branch?.status).toBeDefined()
+  })
+})