create-windy 0.5.2 → 0.6.0

package/template/apps/document-server/tests/test_service_artifacts.py

@@ -0,0 +1,296 @@
+from __future__ import annotations
+
+import asyncio
+import hashlib
+from collections.abc import Sequence
+from pathlib import Path
+
+from southwind_document_server.adapter import DocumentAdapter
+from southwind_document_server.adapter_errors import SafeDocumentError
+from southwind_document_server.artifacts import AdapterExecution, ProducedArtifact
+from southwind_document_server.contracts import (
+    JsonValue,
+    OutputArtifactReference,
+    OutputArtifactSinkDescriptor,
+    StartDocumentRunRequest,
+)
+from southwind_document_server.grants import OutputGrantCell
+from southwind_document_server.service import DocumentRunService
+from southwind_document_server.sink import OutputArtifactSinkClient
+from southwind_document_server.store import (
+    DocumentRunStore,
+    RunConflictError,
+    RunRecord,
+)
+
+from .support import (
+    RAW_GRANT,
+    RUN_ID,
+    artifact_declaration,
+    document_output,
+    document_request,
+    runtime_config,
+    sink_descriptor,
+)
+
+
+class StaticAdapter(DocumentAdapter):
+    def __init__(self, execution: AdapterExecution) -> None:
+        super().__init__(runtime_config())
+        self.execution = execution
+
+    async def execute(self, request: StartDocumentRunRequest) -> AdapterExecution:
+        return self.execution
+
+
+class FailingAdapter(DocumentAdapter):
+    def __init__(self) -> None:
+        super().__init__(runtime_config())
+
+    async def execute(self, request: StartDocumentRunRequest) -> AdapterExecution:
+        raise SafeDocumentError("RUNTIME_UNAVAILABLE", "safe failure", True)
+
+
+class BlockingAdapter(DocumentAdapter):
+    def __init__(self) -> None:
+        super().__init__(runtime_config())
+        self.started = asyncio.Event()
+
+    async def execute(self, request: StartDocumentRunRequest) -> AdapterExecution:
+        self.started.set()
+        await asyncio.Event().wait()
+        raise AssertionError
+
+
+class FakeSink(OutputArtifactSinkClient):
+    def __init__(self, grants: OutputGrantCell) -> None:
+        super().__init__(runtime_config(), grants)
+        self.grants = grants
+        self.accepted: list[int] = []
+        self.published = 0
+        self.aborted = 0
+
+    async def accept(self, sink: OutputArtifactSinkDescriptor) -> None:
+        await self.grants.token_for(sink.scope, sink.grant_generation)
+        self.accepted.append(sink.grant_generation)
+
+    async def publish(
+        self,
+        sink: OutputArtifactSinkDescriptor,
+        artifacts: Sequence[ProducedArtifact],
+    ) -> list[OutputArtifactReference]:
+        await self.grants.token(sink.scope)
+        self.published += 1
+        return [
+            OutputArtifactReference(
+                contract_version=1,
+                output_key=item.declaration.output_key,
+                value=f"oa1.iv{index}.encrypted.tag",
+                media_type=item.declaration.media_type,
+                byte_size=item.declaration.byte_size,
+                sha256=item.declaration.sha256,
+                expires_at="2030-08-01T00:00:00.000Z",
+            )
+            for index, item in enumerate(artifacts)
+        ]
+
+    async def abort(self, sink: OutputArtifactSinkDescriptor) -> bool:
+        return await self.abort_scope(sink.scope, sink.grant_generation)
+
+    async def abort_scope(self, scope: str, generation: int) -> bool:
+        await self.grants.token_for(scope, generation)
+        self.aborted += 1
+        return True
+
+
+class CompleteFailingStore(DocumentRunStore):
+    def __init__(self) -> None:
+        super().__init__(":memory:")
+        self.failed_once = False
+
+    def complete(
+        self,
+        run_id: str,
+        output: JsonValue,
+    ) -> tuple[RunRecord, bool]:
+        if not self.failed_once:
+            self.failed_once = True
+            raise RuntimeError("terminal persistence unavailable")
+        return super().complete(run_id, output)
+
+
+async def test_planned_run_ack_publish_and_terminal_refs_are_consistent(
+    tmp_path: Path,
+) -> None:
+    execution = artifact_execution(tmp_path)
+    grants = OutputGrantCell()
+    sink_client = FakeSink(grants)
+    store = DocumentRunStore(":memory:")
+    service = DocumentRunService(
+        StaticAdapter(execution),
+        store,
+        sink_client,
+        grants,
+    )
+    request = document_request(sink=sink_descriptor())
+
+    started = await service.start(request, "sink-complete", RAW_GRANT)
+    assert started.run_id == RUN_ID
+    assert sink_client.accepted == [1]
+    await asyncio.gather(*service.tasks.values())
+
+    completed = service.require(RUN_ID)
+    assert completed.status == "completed"
+    assert isinstance(completed.output, dict)
+    artifacts = completed.output["artifacts"]
+    assert isinstance(artifacts, list)
+    reference = artifacts[0]
+    assert isinstance(reference, dict)
+    assert reference["value"] == "oa1.iv0.encrypted.tag"
+    assert sink_client.published == 1
+    replayed = await service.start(request, "sink-complete")
+    assert replayed.status == "completed"
+    assert replayed.output == completed.output
+    after_cancel = await service.cancel(RUN_ID)
+    assert after_cancel.status == "completed"
+    assert sink_client.aborted == 0
+
+
+async def test_semantic_drift_and_lost_sealed_state_fail_closed() -> None:
+    request = document_request(sink=sink_descriptor())
+    grants = OutputGrantCell()
+    service = DocumentRunService(
+        StaticAdapter(AdapterExecution(document_output())),
+        DocumentRunStore(":memory:"),
+        FakeSink(grants),
+        grants,
+    )
+    try:
+        await service.start(request, "missing-state")
+    except RunConflictError:
+        pass
+    else:
+        raise AssertionError("无 grant 且无 durable state 必须失败关闭")
+    assert service.store.get_by_idempotency("missing-state") is None
+
+    await service.start(request, "drift", RAW_GRANT)
+    changed = request.model_copy(update={"options": {"outputs": ["tables"]}})
+    try:
+        await service.start(changed, "drift", RAW_GRANT)
+    except RunConflictError:
+        pass
+    else:
+        raise AssertionError("相同幂等键语义漂移必须冲突")
+    await asyncio.gather(*service.tasks.values())
+
+
+async def test_restart_requires_higher_generation_then_resumes(
+    tmp_path: Path,
+) -> None:
+    database = tmp_path / "restart.sqlite3"
+    scope = sink_descriptor().scope
+    first = DocumentRunStore(str(database))
+    request = document_request(sink=sink_descriptor())
+    from southwind_document_server.fingerprint import document_request_fingerprint
+
+    first.create(
+        RUN_ID,
+        request.operation_key,
+        "restart",
+        document_request_fingerprint(request, RUN_ID),
+        scope,
+    )
+    first.refresh_grant_generation(RUN_ID, 1)
+    first.mark_running(RUN_ID)
+    first.close()
+
+    grants = OutputGrantCell()
+    service = DocumentRunService(
+        StaticAdapter(AdapterExecution(document_output())),
+        DocumentRunStore(str(database)),
+        FakeSink(grants),
+        grants,
+    )
+    try:
+        await service.start(request, "restart", RAW_GRANT)
+    except RunConflictError:
+        pass
+    else:
+        raise AssertionError("重启后同 generation 不得假装恢复 raw token")
+
+    next_request = request.model_copy(
+        update={"output_artifact_sink": sink_descriptor(generation=2)}
+    )
+    replacement = f"outgrant_v1_{'B' * 43}"
+    resumed = await service.start(next_request, "restart", replacement)
+    assert resumed.run_id == RUN_ID
+    await asyncio.gather(*service.tasks.values())
+    assert service.require(RUN_ID).status == "completed"
+
+
+async def test_failure_cancel_and_post_seal_store_failure_cleanup(
+    tmp_path: Path,
+) -> None:
+    request = document_request(sink=sink_descriptor())
+
+    failure_grants = OutputGrantCell()
+    failure_sink = FakeSink(failure_grants)
+    failed = DocumentRunService(
+        FailingAdapter(),
+        DocumentRunStore(":memory:"),
+        failure_sink,
+        failure_grants,
+    )
+    await failed.start(request, "failed", RAW_GRANT)
+    await asyncio.gather(*failed.tasks.values())
+    assert failed.require(RUN_ID).status == "failed"
+    assert failure_sink.aborted == 1
+
+    cancel_grants = OutputGrantCell()
+    cancel_sink = FakeSink(cancel_grants)
+    blocking = BlockingAdapter()
+    cancelled = DocumentRunService(
+        blocking,
+        DocumentRunStore(":memory:"),
+        cancel_sink,
+        cancel_grants,
+    )
+    await cancelled.start(request, "cancelled", RAW_GRANT)
+    await blocking.started.wait()
+    assert (await cancelled.cancel(RUN_ID)).status == "cancelled"
+    await asyncio.gather(*cancelled.tasks.values())
+    assert cancel_sink.aborted >= 1
+
+    terminal_grants = OutputGrantCell()
+    terminal_sink = FakeSink(terminal_grants)
+    terminal = DocumentRunService(
+        StaticAdapter(artifact_execution(tmp_path)),
+        CompleteFailingStore(),
+        terminal_sink,
+        terminal_grants,
+    )
+    await terminal.start(request, "terminal-failure", RAW_GRANT)
+    await asyncio.gather(*terminal.tasks.values())
+    assert terminal_sink.published == 1
+    assert terminal_sink.aborted == 1
+    assert terminal.require(RUN_ID).status == "failed"
+
+
+def artifact_execution(tmp_path: Path) -> AdapterExecution:
+    payload = b"%PDF-service"
+    declaration = artifact_declaration(
+        len(payload),
+        hashlib.sha256(payload).hexdigest(),
+    )
+    path = tmp_path / f"{uuid_name()}.pdf"
+    path.write_bytes(payload)
+    return AdapterExecution(
+        document_output([declaration.model_dump(by_alias=True)]),
+        (ProducedArtifact(declaration, path),),
+    )
+
+
+def uuid_name() -> str:
+    import uuid
+
+    return uuid.uuid4().hex

package/template/apps/document-server/tests/test_sink.py

@@ -0,0 +1,253 @@
+from __future__ import annotations
+
+import hashlib
+from pathlib import Path
+
+import httpx
+
+from southwind_document_server.artifacts import ProducedArtifact
+from southwind_document_server.grants import OutputGrantCell
+from southwind_document_server.sink import (
+    OutputArtifactSinkClient,
+    SinkClientError,
+)
+
+from .support import RAW_GRANT, artifact_declaration, runtime_config, sink_descriptor
+
+
+async def test_sink_ack_lifecycle_uses_current_process_token_per_call(
+    tmp_path: Path,
+) -> None:
+    payload = b"%PDF-1.7\nsink"
+    declaration = artifact_declaration(
+        len(payload),
+        hashlib.sha256(payload).hexdigest(),
+    )
+    path = tmp_path / "searchable.pdf"
+    path.write_bytes(payload)
+    sink = sink_descriptor()
+    grants = OutputGrantCell()
+    replacement = f"outgrant_v1_{'B' * 43}"
+    seen: list[tuple[str, str, bytes]] = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        body = await request.aread()
+        token = request.headers["x-ai-output-artifact-grant"]
+        seen.append((request.url.path, token, body))
+        if request.url.path.endswith("/accept"):
+            return httpx.Response(204)
+        if request.method == "PUT":
+            return httpx.Response(200, json={"contractVersion": 1})
+        if request.url.path.endswith("/artifacts"):
+            return httpx.Response(
+                201,
+                json={
+                    "contractVersion": 1,
+                    "artifactId": f"outartifact_{'3' * 32}",
+                    "status": "uploading",
+                },
+            )
+        if request.url.path.endswith("/complete"):
+            return httpx.Response(
+                200,
+                json={
+                    "contractVersion": 1,
+                    "artifactId": f"outartifact_{'3' * 32}",
+                    "outputKey": declaration.output_key,
+                    "status": "completed",
+                    "mediaType": declaration.media_type,
+                    "byteSize": declaration.byte_size,
+                    "sha256": declaration.sha256,
+                },
+            )
+        if request.url.path.endswith("/seal"):
+            return httpx.Response(
+                200,
+                json={
+                    "contractVersion": 1,
+                    "artifacts": [
+                        {
+                            "contractVersion": 1,
+                            "outputKey": declaration.output_key,
+                            "value": "oa1.iv.encrypted.tag",
+                            "mediaType": declaration.media_type,
+                            "byteSize": declaration.byte_size,
+                            "sha256": declaration.sha256,
+                            "expiresAt": "2030-08-01T00:00:00.000Z",
+                        }
+                    ],
+                },
+            )
+        raise AssertionError(f"unexpected sink request {request.url.path}")
+
+    client = OutputArtifactSinkClient(
+        runtime_config(),
+        grants,
+        httpx.MockTransport(handler),
+    )
+    await grants.install(sink.scope, 1, RAW_GRANT, 0)
+    await client.accept(sink)
+    await grants.install(sink.scope, 2, replacement, 1)
+    references = await client.publish(
+        sink.model_copy(update={"grant_generation": 2}),
+        [ProducedArtifact(declaration, path)],
+    )
+
+    assert references[0].value == "oa1.iv.encrypted.tag"
+    assert seen[0][1] == RAW_GRANT
+    assert all(token == replacement for _, token, _ in seen[1:])
+    assert all(RAW_GRANT.encode() not in body for _, _, body in seen)
+    part = next(item for item in seen if "/parts/0" in item[0])
+    assert part[2] == payload
+
+
+async def test_sink_rejects_reference_drift_and_supports_authorized_delete(
+    tmp_path: Path,
+) -> None:
+    payload = b"artifact"
+    declaration = artifact_declaration(
+        len(payload),
+        hashlib.sha256(payload).hexdigest(),
+    )
+    path = tmp_path / "artifact.pdf"
+    path.write_bytes(payload)
+    sink = sink_descriptor()
+    grants = OutputGrantCell()
+    deleted = False
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        nonlocal deleted
+        if request.method == "DELETE":
+            deleted = True
+            return httpx.Response(204)
+        if request.url.path.endswith("/artifacts"):
+            return httpx.Response(
+                201,
+                json={
+                    "contractVersion": 1,
+                    "artifactId": f"outartifact_{'3' * 32}",
+                    "status": "completed",
+                },
+            )
+        if request.url.path.endswith("/complete"):
+            return httpx.Response(
+                200,
+                json={
+                    "contractVersion": 1,
+                    "artifactId": f"outartifact_{'3' * 32}",
+                    "outputKey": declaration.output_key,
+                    "status": "completed",
+                    "mediaType": declaration.media_type,
+                    "byteSize": declaration.byte_size,
+                    "sha256": declaration.sha256,
+                },
+            )
+        if request.url.path.endswith("/seal"):
+            return httpx.Response(
+                200,
+                json={
+                    "contractVersion": 1,
+                    "artifacts": [
+                        {
+                            "contractVersion": 1,
+                            "outputKey": declaration.output_key,
+                            "value": "oa1.iv.encrypted.tag",
+                            "mediaType": declaration.media_type,
+                            "byteSize": declaration.byte_size + 1,
+                            "sha256": declaration.sha256,
+                            "expiresAt": "2030-08-01T00:00:00.000Z",
+                        }
+                    ],
+                },
+            )
+        raise AssertionError
+
+    client = OutputArtifactSinkClient(
+        runtime_config(),
+        grants,
+        httpx.MockTransport(handler),
+    )
+    await grants.install(sink.scope, 1, RAW_GRANT, 0)
+    try:
+        await client.publish(sink, [ProducedArtifact(declaration, path)])
+    except SinkClientError:
+        pass
+    else:
+        raise AssertionError("Host reference 元数据漂移必须拒绝")
+    assert await client.abort(sink) is True
+    assert deleted is True
+
+
+async def test_sink_recovers_one_ambiguous_begin_response_loss(
+    tmp_path: Path,
+) -> None:
+    payload = b"response-loss"
+    declaration = artifact_declaration(
+        len(payload),
+        hashlib.sha256(payload).hexdigest(),
+    )
+    path = tmp_path / "response-loss.pdf"
+    path.write_bytes(payload)
+    sink = sink_descriptor()
+    grants = OutputGrantCell()
+    begins = 0
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        nonlocal begins
+        if request.url.path.endswith("/artifacts"):
+            begins += 1
+            if begins == 1:
+                raise httpx.ReadError("response lost", request=request)
+            return httpx.Response(
+                201,
+                json={
+                    "contractVersion": 1,
+                    "artifactId": f"outartifact_{'3' * 32}",
+                    "status": "completed",
+                },
+            )
+        if request.url.path.endswith("/complete"):
+            return httpx.Response(
+                200,
+                json={
+                    "contractVersion": 1,
+                    "artifactId": f"outartifact_{'3' * 32}",
+                    "outputKey": declaration.output_key,
+                    "status": "completed",
+                    "mediaType": declaration.media_type,
+                    "byteSize": declaration.byte_size,
+                    "sha256": declaration.sha256,
+                },
+            )
+        if request.url.path.endswith("/seal"):
+            return httpx.Response(
+                200,
+                json={
+                    "contractVersion": 1,
+                    "artifacts": [
+                        {
+                            "contractVersion": 1,
+                            "outputKey": declaration.output_key,
+                            "value": "oa1.iv.encrypted.tag",
+                            "mediaType": declaration.media_type,
+                            "byteSize": declaration.byte_size,
+                            "sha256": declaration.sha256,
+                            "expiresAt": "2030-08-01T00:00:00.000Z",
+                        }
+                    ],
+                },
+            )
+        raise AssertionError
+
+    client = OutputArtifactSinkClient(
+        runtime_config(),
+        grants,
+        httpx.MockTransport(handler),
+    )
+    await grants.install(sink.scope, 1, RAW_GRANT, 0)
+    references = await client.publish(
+        sink,
+        [ProducedArtifact(declaration, path)],
+    )
+    assert begins == 2
+    assert references[0].output_key == declaration.output_key