create-workframe 0.1.11 → 0.1.13

package/workframe-api/test_local_bootstrap.py

@@ -0,0 +1,67 @@
+"""Local bootstrap must require a real owner email — no synthetic placeholders."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+API_DIR = Path(__file__).resolve().parent
+if str(API_DIR) not in sys.path:
+    sys.path.insert(0, str(API_DIR))
+
+os.environ.setdefault("WORKFRAME_API_DATA_DIR", str(API_DIR / ".tmp-test-data"))
+os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
+os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
+os.environ["DEPLOYMENT_MODE"] = "single_user_local"
+
+import server  # noqa: E402
+
+
+class _CaptureHandler(server.Handler):
+    captured: tuple[int, dict] | None = None
+
+    def _json(self, status: int, payload: dict, **kwargs) -> None:  # type: ignore[override]
+        type(self).captured = (status, payload)
+
+
+def test_local_bootstrap_rejects_missing_email() -> None:
+    handler = _CaptureHandler.__new__(_CaptureHandler)
+    with patch.object(server, "DEPLOYMENT_MODE", "single_user_local"), patch.object(
+        server, "_install_window_open", return_value=True,
+    ):
+        handler._route_post_auth_local_bootstrap({})
+    assert _CaptureHandler.captured is not None
+    status, body = _CaptureHandler.captured
+    assert status == 400
+    assert body.get("error") == "email_required"
+
+
+def test_local_bootstrap_uses_submitted_email() -> None:
+    handler = _CaptureHandler.__new__(_CaptureHandler)
+    with patch.object(server, "DEPLOYMENT_MODE", "single_user_local"), patch.object(
+        server, "_install_window_open", return_value=True,
+    ), patch.object(
+        server._zk,
+        "create_session_for_email",
+        return_value={"user_id": "u-test", "session_id": "s-test", "refresh_token": "r-test"},
+    ) as create_session, patch.object(handler, "_ensure_user"), patch.object(
+        handler, "_first_owner_bootstrap",
+    ), patch.object(server, "_session_profile_payload", return_value={"ok": True}), patch.object(
+        server, "_session_cookie_secure", return_value=False,
+    ), patch.object(
+        server._zk, "session_cookie_value", return_value="cookie=test",
+    ):
+        handler._route_post_auth_local_bootstrap(
+            {"email": "Owner@Example.com", "display_name": "Owner"},
+        )
+    create_session.assert_called_once_with("owner@example.com")
+    assert _CaptureHandler.captured is not None
+    assert _CaptureHandler.captured[0] == 200
+
+
+if __name__ == "__main__":
+    test_local_bootstrap_rejects_missing_email()
+    test_local_bootstrap_uses_submitted_email()
+    print("ok")

package/workframe-api/test_mention_helpers.py

@@ -0,0 +1,35 @@
+"""WF-032 mention_helpers self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import mention_helpers  # noqa: E402
+
+
+def test_mention_handle() -> None:
+    assert mention_helpers.mention_handle("Alice Smith") == "alicesmith"
+    assert mention_helpers.mention_handle("", "alice@example.com") == "alice"
+
+
+def test_parse_room_mentions() -> None:
+    agents = [{"id": "a1", "slug": "dev", "display_name": "Dev Agent"}]
+    result = mention_helpers.parse_room_mentions("@dev please review", agents, [])
+    assert len(result["agents"]) == 1
+    assert result["agents"][0]["slug"] == "dev"
+    assert result["users"] == []
+
+
+def test_parse_mentions() -> None:
+    rows = mention_helpers.parse_mentions("hello @architect and @dev")
+    assert [r["slug"] for r in rows] == ["architect", "dev"]
+
+
+if __name__ == "__main__":
+    test_mention_handle()
+    test_parse_room_mentions()
+    test_parse_mentions()
+    print("test_mention_helpers: ok")

package/workframe-api/test_mention_invoke.py

@@ -0,0 +1,26 @@
+"""WF-032 mention_invoke self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import mention_invoke  # noqa: E402
+
+
+def test_invoke_mention_missing_agent() -> None:
+    """No-op when agent row lacks slug/id."""
+    mention_invoke._invoke_room_agent_mention(
+        "room-1",
+        "ws-1",
+        {"slug": "", "id": ""},
+        "",
+        "msg-1",
+    )
+
+
+if __name__ == "__main__":
+    test_invoke_mention_missing_agent()
+    print("test_mention_invoke: ok")

package/workframe-api/test_model_surface_consistency.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""Regression tests for model save/provider surface (WF-034).
+
+Run: python services/workframe-api/test_model_surface_consistency.py
+"""
+import importlib.util
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent
+tmpdir = tempfile.mkdtemp(prefix="wf-model-surface-")
+os.environ["WORKFRAME_AGENTS_DIR"] = tmpdir
+os.environ["WORKFRAME_PROJECT"] = "ModelSurfaceTest"
+os.environ["NATIVE_PROFILE"] = "surface-test-agent"
+
+spec = importlib.util.spec_from_file_location("wf_server_model_surface", ROOT / "server.py")
+server = importlib.util.module_from_spec(spec)
+sys.modules["wf_server_model_surface"] = server
+spec.loader.exec_module(server)
+sys.modules["server"] = server  # ponytail: extracted modules resolve _srv() to this instance
+
+PROF = "surface-test-agent"
+prof_dir = server._profile_dir(PROF)
+prof_dir.mkdir(parents=True, exist_ok=True)
+(prof_dir / "config.yaml").write_text(
+    "model:\n  default: gpt-5.4-medium\n  provider: openai-codex\n",
+    encoding="utf-8",
+)
+cfg_path = prof_dir / "config.yaml"
+before = cfg_path.read_bytes()
+
+# A: GET models must not mutate config.yaml
+server.hermes_models(PROF, user_id="", workspace_id="")
+assert cfg_path.read_bytes() == before, "hermes_models must not rewrite config on read"
+
+# B: reconcile idempotent when routing already matches codex oauth
+assert server._profile_routing_matches_billing(PROF, "codex")
+assert server._reconcile_profile_llm_for_user(PROF, "user-1", "") is False
+
+# C: billing resolution honors prefer= when model exists in that catalog
+connected = {"codex", "openrouter"}
+assert server._resolve_billing_provider_for_model(
+    "gpt-5.4-medium", connected, prefer="codex",
+) == "codex"
+assert server._resolve_billing_provider_for_model(
+    "openrouter/owl-alpha", connected, prefer="openrouter",
+) == "openrouter"
+assert server._resolve_billing_provider_for_model(
+    "openai-codex/gpt-5.4-mini", {"codex", "openrouter"},
+) == "codex"
+
+# D: set with explicit billing_provider returns billing id in response
+applied = server.hermes_model_set(
+    PROF, "gpt-5.4-medium", user_id="", workspace_id="", billing_provider="codex",
+)
+assert applied.get("ok"), applied
+assert applied.get("billing_provider") == "codex"
+assert applied.get("provider") == "codex"
+
+# E: reconcile picks model billing over stale openrouter proxy yaml
+(prof_dir / "config.yaml").write_text(
+    "model:\n  default: openai-codex/gpt-5.4-mini\n  provider: custom\n"
+    "  base_url: http://workframe-api:8080/internal/llm/openrouter/v1\n",
+    encoding="utf-8",
+)
+_orig_picker = server._user_llm_providers_for_picker
+_orig_can = server._user_can_use_llm
+_orig_sync = server._sync_oauth_llm_to_profile
+server._user_llm_providers_for_picker = lambda uid: {"codex"} if uid == "user-1" else set()
+server._user_can_use_llm = lambda uid, ws, prov: uid == "user-1" and prov == "codex"
+server._sync_oauth_llm_to_profile = lambda *a, **k: None
+try:
+    assert server._reconcile_profile_llm_for_user(PROF, "user-1", "") is True
+    block = server._read_model_block(PROF)
+    assert block.get("provider") == "openai-codex"
+    assert block.get("default") == "gpt-5.4-mini"
+    assert not block.get("base_url")
+finally:
+    server._user_llm_providers_for_picker = _orig_picker
+    server._user_can_use_llm = _orig_can
+    server._sync_oauth_llm_to_profile = _orig_sync
+
+# F: runtime disk wins over template in _read_model_block
+runtime_prof = "u-test-user-surface-test-agent"
+runtime_dir = server._profile_dir(runtime_prof)
+runtime_dir.mkdir(parents=True, exist_ok=True)
+(runtime_dir / "config.yaml").write_text(
+    "model:\n  default: gpt-5.4-mini\n  provider: openai-codex\n",
+    encoding="utf-8",
+)
+block = server._read_model_block(runtime_prof)
+assert block.get("default") == "gpt-5.4-mini", block
+assert block.get("provider") == "openai-codex", block
+
+# G: template model save mirrors to runtime (same model id, not stale template re-read)
+runtime_prof = "u-test-user2-surface-test-agent"
+runtime_dir = server._profile_dir(runtime_prof)
+runtime_dir.mkdir(parents=True, exist_ok=True)
+(runtime_dir / "config.yaml").write_text(
+    "model:\n  default: gpt-5.4-medium\n  provider: openai-codex\n",
+    encoding="utf-8",
+)
+_orig_restart = server._restart_runtime_profile_gateway
+server._restart_runtime_profile_gateway = lambda *a, **k: None
+try:
+    applied = server.hermes_model_set(
+        PROF, "gpt-5.4-mini", user_id="test-user2", workspace_id="", billing_provider="codex",
+    )
+finally:
+    server._restart_runtime_profile_gateway = _orig_restart
+assert applied.get("ok"), applied
+runtime_block = server._parse_model_block_from_disk(runtime_prof)
+assert runtime_block.get("default") == "gpt-5.4-mini", runtime_block
+
+print("model surface consistency self-check ok")

package/workframe-api/test_oauth_pending.py

@@ -0,0 +1,41 @@
+"""WF-032 oauth_pending store/take self-check."""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import oauth_pending  # noqa: E402
+import server  # noqa: E402
+
+
+def test_store_take_round_trip() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        server.DATA_DIR = Path(tmp)
+        server.AUTH_DB_PATH = Path(tmp) / "auth.db"
+        server._ensure_workframe_db_schema()
+        oauth_pending.store_pending("state-1", "user-1", "github", "verifier-abc", "ws-1")
+        row = oauth_pending.take_pending("state-1")
+        assert row is not None
+        assert row["user_id"] == "user-1"
+        assert row["provider"] == "github"
+        assert row["code_verifier"] == "verifier-abc"
+        assert oauth_pending.take_pending("state-1") is None
+
+
+def test_pkce_pair() -> None:
+    verifier, challenge = oauth_pending.pkce_pair()
+    assert len(verifier) > 20
+    assert len(challenge) > 20
+    assert verifier != challenge
+
+
+if __name__ == "__main__":
+    test_pkce_pair()
+    test_store_take_round_trip()
+    print("test_oauth_pending: ok")

package/workframe-api/test_profile_model_yaml.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Coalesce corrupt duplicate model blocks + profile_config_yaml writer (WF-033)."""
+import importlib.util
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parent
+os.environ.setdefault("WORKFRAME_AGENTS_DIR", tempfile.mkdtemp(prefix="wf-yaml-test-"))
+os.environ.setdefault("WORKFRAME_PROJECT", "YamlTest")
+os.environ.setdefault("NATIVE_PROFILE", "yaml-test-agent")
+
+spec = importlib.util.spec_from_file_location("wf_server_yaml_test", ROOT / "server.py")
+server = importlib.util.module_from_spec(spec)
+sys.modules["wf_server_yaml_test"] = server
+spec.loader.exec_module(server)
+
+import profile_config_yaml  # noqa: E402
+
+BROKEN = """model:
+  default: gpt-5.4-medium
+  provider: openai-codex
+model:
+  default: gpt-5.4-medium
+  - provider: openai-codex
+fallback_providers:
+  - provider: openai-codex
+    model: gpt-5.4-mini
+toolsets:
+"""
+
+prof = "yaml-test-agent"
+prof_dir = server._profile_dir(prof)
+prof_dir.mkdir(parents=True, exist_ok=True)
+cfg_path = prof_dir / "config.yaml"
+cfg_path.write_text(BROKEN, encoding="utf-8")
+
+server._normalize_profile_config_yaml(prof)
+fixed = cfg_path.read_text(encoding="utf-8")
+assert fixed.count("\nmodel:\n") + fixed.count("model:\n") <= 2, fixed
+assert "  - provider:" not in fixed.split("fallback_providers:")[0], fixed
+parsed = yaml.safe_load(fixed)
+assert isinstance(parsed.get("model"), dict), parsed
+assert parsed["model"]["default"] == "gpt-5.4-medium"
+assert parsed["model"]["provider"] == "openai-codex"
+assert len(parsed.get("fallback_providers") or []) == 1
+assert "toolsets" in parsed
+
+# Round-trip via update_model_surface preserves non-model keys
+round_prof = "yaml-round-trip"
+round_dir = server._profile_dir(round_prof)
+round_dir.mkdir(parents=True, exist_ok=True)
+round_path = round_dir / "config.yaml"
+round_path.write_text(
+    "# picker note\nmodel:\n  default: old-model\n  provider: openrouter\ncron: []\n",
+    encoding="utf-8",
+)
+profile_config_yaml.update_model_surface(
+    round_path, default="new-model", provider="custom", base_url="http://proxy/v1",
+)
+rt = yaml.safe_load(round_path.read_text(encoding="utf-8"))
+assert rt["model"]["default"] == "new-model"
+assert rt["model"]["provider"] == "custom"
+assert rt["model"]["base_url"] == "http://proxy/v1"
+assert rt.get("cron") == []
+assert "# picker note" not in round_path.read_text(encoding="utf-8")  # comments not preserved
+
+# Missing file: writer creates parent dirs + config
+missing_prof = "yaml-missing"
+missing_dir = server._profile_dir(missing_prof)
+missing_path = missing_dir / "config.yaml"
+if missing_path.is_file():
+    missing_path.unlink()
+profile_config_yaml.update_model_surface(
+    missing_path, default="gpt-5.4-mini", provider="openai-codex",
+)
+assert missing_path.is_file()
+loaded = yaml.safe_load(missing_path.read_text(encoding="utf-8"))
+assert loaded["model"]["default"] == "gpt-5.4-mini"
+
+# Coalesce flag drops duplicate blocks
+dup_path = round_dir / "dup.yaml"
+dup_path.write_text(BROKEN, encoding="utf-8")
+profile_config_yaml.update_model_surface(
+    dup_path,
+    default="gpt-5.4-medium",
+    provider="openai-codex",
+    fallback_chain=[{"provider": "openai-codex", "model": "gpt-5.4-mini"}],
+    coalesce=True,
+)
+dup_text = dup_path.read_text(encoding="utf-8")
+assert dup_text.count("\nmodel:\n") + dup_text.count("model:\n") <= 2, dup_text
+dup_parsed = yaml.safe_load(dup_text)
+assert dup_parsed["model"]["default"] == "gpt-5.4-medium"
+
+print("profile model yaml coalesce self-check ok")

package/workframe-api/test_provider_bindings.py

@@ -0,0 +1,52 @@
+"""WF-032 provider_bindings pure helpers self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import provider_bindings  # noqa: E402
+
+
+def test_hermes_oauth_auth_keys() -> None:
+    keys = provider_bindings._hermes_oauth_auth_keys("openai-codex")
+    assert "openai-codex" in keys
+    assert "codex" in keys
+    assert "openai_codex" in keys
+
+
+def test_auth_json_has_oauth_material() -> None:
+    pool_only = {
+        "version": 1,
+        "providers": {},
+        "credential_pool": {"openai-codex": [{"id": "x", "auth_type": "oauth"}]},
+    }
+    assert provider_bindings._auth_json_has_oauth_material(pool_only)
+
+
+def test_merge_oauth_auth_into_profile() -> None:
+    pool_only = {
+        "version": 1,
+        "providers": {},
+        "credential_pool": {"openai-codex": [{"id": "x", "auth_type": "oauth"}]},
+    }
+    merged: dict = {"version": 1, "providers": {}, "credential_pool": {}}
+    assert provider_bindings._merge_oauth_auth_into_profile(merged, pool_only, "openai-codex")
+    assert merged["credential_pool"].get("openai-codex")
+
+
+def test_parse_device_oauth_log() -> None:
+    text = "Open this URL\n  https://auth.openai.com/device\nEnter this code\n  ABCD-1234"
+    parsed = provider_bindings._parse_device_oauth_log(text)
+    assert parsed["verification_uri"] and "openai.com" in parsed["verification_uri"]
+    assert parsed["user_code"] == "ABCD-1234"
+
+
+if __name__ == "__main__":
+    test_hermes_oauth_auth_keys()
+    test_auth_json_has_oauth_material()
+    test_merge_oauth_auth_into_profile()
+    test_parse_device_oauth_log()
+    print("test_provider_bindings: ok")

package/workframe-api/test_provider_catalog.py

@@ -0,0 +1,28 @@
+"""WF-032 provider_catalog self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import provider_catalog  # noqa: E402
+
+
+def test_catalog_lookup() -> None:
+    gh = provider_catalog.catalog_provider("github")
+    assert gh is not None
+    assert gh.get("connect_mode") == "oauth"
+    assert provider_catalog.catalog_provider_for_llm("openai-codex") is not None
+
+
+def test_user_only() -> None:
+    assert provider_catalog.provider_user_only("github")
+    assert not provider_catalog.provider_user_only("openrouter")
+
+
+if __name__ == "__main__":
+    test_catalog_lookup()
+    test_user_only()
+    print("test_provider_catalog: ok")

package/workframe-api/test_public_routes.py

@@ -0,0 +1,41 @@
+"""ponytail self-check: session-less GET policy (WF-031).
+
+Run: python services/workframe-api/test_public_routes.py
+"""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+ALWAYS = "/api/health"
+DATA = "/api/snapshot"
+META = "/api/meta"
+
+
+def allowed(path: str, mode: str, dev: bool = False) -> bool:
+    return server._sessionless_get_allowed(path, deployment_mode=mode, dev_local_unsafe=dev)
+
+
+# Always-public routes work in every deployment mode.
+assert allowed(META, "public_multi_user")
+assert allowed(ALWAYS, "trusted_team")
+assert allowed("/api/public/branding/logo", "public_multi_user")
+
+# Data routes: blocked for multi-user modes without DEV_LOCAL_UNSAFE.
+assert not allowed(DATA, "public_multi_user")
+assert not allowed(DATA, "trusted_team")
+assert not allowed("/api/chat/messages", "public_multi_user")
+assert not allowed("/api/files/list", "trusted_team")
+
+# Data routes: allowed for single_user_local or dev unsafe.
+assert allowed(DATA, "single_user_local")
+assert allowed(DATA, "public_multi_user", dev=True)
+assert allowed("/api/board", "single_user_local")
+
+# _is_public_get composes static/UI paths.
+assert server._is_public_get("/")
+assert server._is_public_get("/assets/app.js")
+
+print("public routes self-check ok")