create-windy 0.5.2 → 0.6.0

package/template/apps/document-server/tests/test_fingerprint.py

@@ -0,0 +1,125 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from southwind_document_server.adapter_errors import SafeDocumentError
+from southwind_document_server.contracts import StartDocumentRunRequest
+from southwind_document_server.fingerprint import (
+    canonical_json,
+    document_request_fingerprint,
+)
+
+FIXTURE = (
+    Path(__file__).resolve().parents[3]
+    / "packages/server-sdk/contracts/document-runtime/v1/fingerprint-fixture.json"
+)
+
+
+def test_shared_bilingual_fingerprint_fixture() -> None:
+    fixture = json.loads(FIXTURE.read_text())
+    request = StartDocumentRunRequest.model_validate(fixture["request"])
+    assert request.run_id is not None
+    expected = fixture["expectedSha256"]
+    assert document_request_fingerprint(request, request.run_id) == expected
+
+    variant = request.model_dump(by_alias=True)
+    excluded = fixture["excludedVariant"]
+    for source, value in zip(
+        variant["sources"],
+        excluded["sourceValues"],
+        strict=True,
+    ):
+        source["value"] = value
+    sink = variant["outputArtifactSink"]
+    sink["scope"] = excluded["scope"]
+    sink["grantGeneration"] = excluded["grantGeneration"]
+    sink["expiresAt"] = excluded["expiresAt"]
+    changed = StartDocumentRunRequest.model_validate(variant)
+    assert changed.run_id is not None
+    assert document_request_fingerprint(changed, changed.run_id) == expected
+
+
+def test_fingerprint_covers_governed_semantics_and_source_order() -> None:
+    fixture = json.loads(FIXTURE.read_text())
+    request = StartDocumentRunRequest.model_validate(fixture["request"])
+    assert request.run_id is not None
+    expected = document_request_fingerprint(request, request.run_id)
+
+    reordered_capabilities = request.model_copy(
+        update={"required_capabilities": list(reversed(request.required_capabilities))}
+    )
+    assert (
+        document_request_fingerprint(reordered_capabilities, request.run_id) == expected
+    )
+    assert (
+        document_request_fingerprint(
+            request.model_copy(update={"sources": list(reversed(request.sources))}),
+            request.run_id,
+        )
+        != expected
+    )
+    assert (
+        document_request_fingerprint(
+            request.model_copy(update={"options": {"语言": "英文"}}),
+            request.run_id,
+        )
+        != expected
+    )
+    assert (
+        document_request_fingerprint(
+            request.model_copy(update={"data_classification": "internal"}),
+            request.run_id,
+        )
+        != expected
+    )
+    assert request.output_artifact_sink is not None
+    changed_sink = request.output_artifact_sink.model_copy(
+        update={"policy_digest": "f" * 64}
+    )
+    assert (
+        document_request_fingerprint(
+            request.model_copy(update={"output_artifact_sink": changed_sink}),
+            request.run_id,
+        )
+        != expected
+    )
+
+
+def test_canonical_numbers_match_json_stringify_boundaries() -> None:
+    assert canonical_json({"values": [1.0, 1e-6, 1e-7]}) == (
+        '{"values":[1,0.000001,1e-7]}'
+    )
+    with pytest.raises(ValueError, match="安全范围"):
+        canonical_json({"unsafe": 2**53})
+    with pytest.raises(ValueError, match="安全范围"):
+        canonical_json({"unsafeFloat": 1e20})
+    with pytest.raises(ValueError, match="Unicode"):
+        canonical_json({"unsafeString": "\ud800"})
+
+
+def test_shared_invalid_canonical_json_fixture_is_rejected() -> None:
+    fixture = json.loads(FIXTURE.read_text())
+    for case in fixture["invalidCanonicalJson"]:
+        with pytest.raises(ValueError):
+            canonical_json(json.loads(case["json"]))
+
+
+async def test_noncanonical_options_map_to_invalid_input() -> None:
+    from southwind_document_server.adapter import DocumentAdapter
+    from southwind_document_server.service import DocumentRunService
+    from southwind_document_server.store import DocumentRunStore
+
+    from .support import document_request, runtime_config
+
+    service = DocumentRunService(
+        DocumentAdapter(runtime_config()),
+        DocumentRunStore(":memory:"),
+    )
+    for options in ({"unsafe": 1e20}, {"unsafe": "\ud800"}):
+        request = document_request().model_copy(update={"options": options})
+        with pytest.raises(SafeDocumentError) as raised:
+            await service.start(request, f"invalid-{len(str(options))}")
+        assert raised.value.code == "INVALID_INPUT"

package/template/apps/document-server/tests/test_grants.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+from southwind_document_server.grants import GrantStateError, OutputGrantCell
+
+from .support import RAW_GRANT
+
+
+async def test_generation_cas_rejects_late_or_conflicting_credentials() -> None:
+    cell = OutputGrantCell()
+    scope = f"outscope_{'2' * 32}"
+    replacement = f"outgrant_v1_{'B' * 43}"
+
+    await cell.install(scope, 1, RAW_GRANT, 0)
+    await cell.install(scope, 1, RAW_GRANT, 1)
+    assert await cell.token(scope) == RAW_GRANT
+
+    for generation, token in ((1, replacement), (0, replacement)):
+        try:
+            await cell.install(scope, generation, token, 1)
+        except GrantStateError:
+            pass
+        else:
+            raise AssertionError("冲突或迟到 generation 不得覆盖 current")
+
+    await cell.install(scope, 2, replacement, 1)
+    assert await cell.token(scope) == replacement
+    try:
+        await cell.install(scope, 1, RAW_GRANT, 1)
+    except GrantStateError:
+        pass
+    else:
+        raise AssertionError("迟到 generation 不得回滚 current")
+
+
+async def test_restart_requires_higher_generation_and_repr_hides_raw() -> None:
+    cell = OutputGrantCell()
+    scope = f"outscope_{'2' * 32}"
+    try:
+        await cell.install(scope, 3, RAW_GRANT, 3)
+    except GrantStateError:
+        pass
+    else:
+        raise AssertionError("进程丢失 raw token 后必须用更高 generation 刷新")
+
+    await cell.install(scope, 4, RAW_GRANT, 3)
+    assert RAW_GRANT not in repr(cell)

package/template/apps/document-server/tests/test_handshake.py

@@ -0,0 +1,154 @@
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import httpx
+import pytest
+
+from southwind_document_server.adapter import DocumentAdapter
+from southwind_document_server.adapter_errors import SafeDocumentError
+from southwind_document_server.artifacts import AdapterExecution, ProducedArtifact
+from southwind_document_server.contracts import (
+    OutputArtifactReference,
+    OutputArtifactSinkDescriptor,
+    StartDocumentRunRequest,
+)
+from southwind_document_server.grants import OutputGrantCell
+from southwind_document_server.service import DocumentRunService
+from southwind_document_server.sink import (
+    OutputArtifactSinkClient,
+    SinkClientError,
+)
+from southwind_document_server.store import DocumentRunStore, RunConflictError
+
+from .support import (
+    RAW_GRANT,
+    RUN_ID,
+    document_output,
+    document_request,
+    runtime_config,
+    sink_descriptor,
+)
+
+
+class CountingAdapter(DocumentAdapter):
+    def __init__(self) -> None:
+        super().__init__(runtime_config())
+        self.executions = 0
+
+    async def execute(self, request: StartDocumentRunRequest) -> AdapterExecution:
+        self.executions += 1
+        return AdapterExecution(document_output())
+
+
+class RejectingAckSink(OutputArtifactSinkClient):
+    def __init__(self, grants: OutputGrantCell) -> None:
+        super().__init__(runtime_config(), grants)
+        self.aborted = 0
+
+    async def accept(self, sink: OutputArtifactSinkDescriptor) -> None:
+        raise SinkClientError
+
+    async def abort(self, sink: OutputArtifactSinkDescriptor) -> bool:
+        return await self.abort_scope(sink.scope, sink.grant_generation)
+
+    async def abort_scope(self, scope: str, generation: int) -> bool:
+        self.aborted += 1
+        return True
+
+    async def publish(
+        self,
+        sink: OutputArtifactSinkDescriptor,
+        artifacts: Sequence[ProducedArtifact],
+    ) -> list[OutputArtifactReference]:
+        raise AssertionError("ACK 失败后不得执行 publish")
+
+
+async def test_ack_failure_or_timeout_never_starts_adapter() -> None:
+    grants = OutputGrantCell()
+    adapter = CountingAdapter()
+    store = DocumentRunStore(":memory:")
+    rejecting_sink = RejectingAckSink(grants)
+    service = DocumentRunService(
+        adapter,
+        store,
+        rejecting_sink,
+        grants,
+    )
+
+    try:
+        await service.start(
+            document_request(sink=sink_descriptor()),
+            "ack-timeout",
+            RAW_GRANT,
+        )
+    except SafeDocumentError as error:
+        assert error.code == "RUNTIME_UNAVAILABLE"
+        assert error.retryable is True
+    else:
+        raise AssertionError("ACK 失败必须 fail closed")
+
+    assert service.tasks == {}
+    assert adapter.executions == 0
+    record = store.get(RUN_ID)
+    assert record is not None
+    assert record.status == "failed"
+    assert record.grant_generation == 1
+    assert record.cleanup_status == "deleted"
+    assert rejecting_sink.aborted == 1
+
+    restarted_grants = OutputGrantCell()
+    restarted = DocumentRunService(
+        adapter,
+        store,
+        RejectingAckSink(restarted_grants),
+        restarted_grants,
+    )
+    try:
+        await restarted.start(
+            document_request(sink=sink_descriptor()),
+            "ack-timeout",
+            RAW_GRANT,
+        )
+    except RunConflictError:
+        pass
+    else:
+        raise AssertionError("ACK 不确定后重启不得复用同 generation")
+
+
+async def test_nonempty_204_ack_is_explicit_rejection_without_adapter_task() -> None:
+    grants = OutputGrantCell()
+    adapter = CountingAdapter()
+    deleted = 0
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        nonlocal deleted
+        if request.method == "DELETE":
+            deleted += 1
+            return httpx.Response(204)
+        if request.url.path.endswith("/accept"):
+            return httpx.Response(204, content=b"not-empty")
+        raise AssertionError(f"unexpected request {request.method} {request.url.path}")
+
+    store = DocumentRunStore(":memory:")
+    service = DocumentRunService(
+        adapter,
+        store,
+        OutputArtifactSinkClient(
+            runtime_config(),
+            grants,
+            httpx.MockTransport(handler),
+        ),
+        grants,
+    )
+    with pytest.raises(SafeDocumentError) as raised:
+        await service.start(
+            document_request(sink=sink_descriptor()),
+            "nonempty-ack",
+            RAW_GRANT,
+        )
+
+    assert raised.value.code == "RUNTIME_UNAVAILABLE"
+    assert adapter.executions == 0
+    assert service.tasks == {}
+    assert deleted == 1

package/template/apps/document-server/tests/test_integration.py

@@ -0,0 +1,192 @@
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import os
+
+import httpx
+
+os.environ.setdefault("DOCUMENT_SERVER_INTERNAL_TOKEN", "test-import-token")
+os.environ.setdefault("DOCUMENT_RUN_STORE_PATH", ":memory:")
+
+from southwind_document_server.app import create_app
+from southwind_document_server.contracts import ArtifactInput
+from southwind_document_server.service import DocumentRunService
+
+from .support import (
+    RAW_GRANT,
+    RUN_ID,
+    adapter_readiness_payload,
+    document_output,
+    document_request,
+    readiness_sink_descriptor,
+    runtime_config,
+    sink_descriptor,
+    sink_readiness_payload,
+)
+
+
+async def test_http_start_acks_empty_body_before_returning_planned_run() -> None:
+    source = b"document-source"
+    source_hash = hashlib.sha256(source).hexdigest()
+    request = document_request(sink=readiness_sink_descriptor()).model_copy(
+        update={
+            "sources": [
+                ArtifactInput(
+                    value="opaque-input-ref",
+                    media_type="application/pdf",
+                    byte_size=len(source),
+                    sha256=source_hash,
+                )
+            ]
+        }
+    )
+    accepted = asyncio.Event()
+    accept_body: bytes | None = None
+
+    async def adapter_handler(incoming: httpx.Request) -> httpx.Response:
+        if incoming.url.path.endswith("/v1/document/readiness"):
+            return httpx.Response(200, json=adapter_readiness_payload())
+        if incoming.url.path.endswith("/api/internal/ai/artifacts"):
+            return httpx.Response(200, content=source)
+        return httpx.Response(
+            200,
+            headers={"content-type": "application/json"},
+            content=json.dumps(document_output()).encode(),
+        )
+
+    async def sink_handler(incoming: httpx.Request) -> httpx.Response:
+        nonlocal accept_body
+        assert incoming.headers["authorization"] == "Bearer internal"
+        if incoming.url.path.endswith("/health/ready"):
+            return httpx.Response(200, json=sink_readiness_payload())
+        assert incoming.headers["x-ai-output-artifact-grant"] == RAW_GRANT
+        if incoming.url.path.endswith("/accept"):
+            accept_body = await incoming.aread()
+            accepted.set()
+            return httpx.Response(204)
+        if incoming.url.path.endswith("/seal"):
+            return httpx.Response(
+                200,
+                json={"contractVersion": 1, "artifacts": []},
+            )
+        if incoming.method == "DELETE":
+            return httpx.Response(204)
+        raise AssertionError(f"unexpected sink request {incoming.url.path}")
+
+    app = create_app(
+        runtime_config(),
+        adapter_transport=httpx.MockTransport(adapter_handler),
+        sink_transport=httpx.MockTransport(sink_handler),
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app),
+        base_url="http://document.internal",
+    ) as client:
+        response = await client.post(
+            "/api/document/runs",
+            headers={
+                "authorization": "Bearer internal",
+                "idempotency-key": "http-ack",
+                "x-ai-output-artifact-grant": RAW_GRANT,
+            },
+            json=request.model_dump(by_alias=True),
+        )
+        assert accepted.is_set()
+        assert accept_body == b""
+        assert response.status_code == 202
+        assert response.json()["runId"] == RUN_ID
+        assert RAW_GRANT not in response.text
+
+        service = app.state.document_service
+        assert isinstance(service, DocumentRunService)
+        await asyncio.gather(*service.tasks.values())
+        result = await client.get(
+            f"/api/document/runs/{RUN_ID}/result",
+            headers={"authorization": "Bearer internal"},
+        )
+        assert result.status_code == 200
+        assert result.json()["output"]["artifacts"] == []
+        assert RAW_GRANT not in result.text
+
+
+async def test_http_sink_missing_grant_and_legacy_extra_grant_fail_closed() -> None:
+    app = create_app(
+        runtime_config(),
+        adapter_transport=httpx.MockTransport(lambda _request: httpx.Response(503)),
+        sink_transport=httpx.MockTransport(lambda _request: httpx.Response(503)),
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app),
+        base_url="http://document.internal",
+    ) as client:
+        missing = await client.post(
+            "/api/document/runs",
+            headers={
+                "authorization": "Bearer internal",
+                "idempotency-key": "missing-grant",
+            },
+            json=document_request(sink=sink_descriptor()).model_dump(by_alias=True),
+        )
+        assert missing.status_code == 409
+        assert missing.json()["code"] == "RUN_CONFLICT"
+
+        legacy = await client.post(
+            "/api/document/runs",
+            headers={
+                "authorization": "Bearer internal",
+                "idempotency-key": "legacy-extra-grant",
+                "x-ai-output-artifact-grant": RAW_GRANT,
+            },
+            json=document_request().model_dump(by_alias=True),
+        )
+        assert legacy.status_code == 400
+        assert legacy.json()["code"] == "INVALID_INPUT"
+        assert RAW_GRANT not in legacy.text
+
+
+async def test_app_lifespan_cancels_and_awaits_reconciler() -> None:
+    app = create_app(runtime_config())
+    service = app.state.document_service
+    assert isinstance(service, DocumentRunService)
+
+    async with app.router.lifespan_context(app):
+        task = service.reconciler_task
+        assert task is not None
+        assert not task.done()
+
+    assert service.reconciler_task is None
+    assert task.done()
+
+
+async def test_health_returns_authenticated_v1_snapshot() -> None:
+    app = create_app(
+        runtime_config(),
+        adapter_transport=httpx.MockTransport(
+            lambda _request: httpx.Response(
+                200,
+                json=adapter_readiness_payload(),
+            )
+        ),
+        sink_transport=httpx.MockTransport(
+            lambda _request: httpx.Response(
+                200,
+                json=sink_readiness_payload(),
+            )
+        ),
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app),
+        base_url="http://document.internal",
+    ) as client:
+        denied = await client.get("/health/ready")
+        ready = await client.get(
+            "/health/ready",
+            headers={"authorization": "Bearer internal"},
+        )
+
+    assert denied.status_code == 403
+    assert ready.status_code == 200
+    assert ready.headers["cache-control"] == "private, no-store"
+    assert ready.json()["downstreamProbe"]["status"] == "passed"