kennel 0.2.2 → 0.2.5

package/kernel/plugins/mail/test/history.test.mjs

@@ -1,460 +0,0 @@
-import { createHash } from "node:crypto"
-import {
-  mkdir,
-  mkdtemp,
-  readFile,
-  rm,
-  symlink,
-  writeFile,
-} from "node:fs/promises"
-import { tmpdir } from "node:os"
-import { join } from "node:path"
-import { describe, expect, test } from "bun:test"
-
-import { deleteLocalDraftVerified, MailDeleteError } from "../src/history.ts"
-
-function sha256(content) {
-  return createHash("sha256").update(content).digest("hex")
-}
-
-async function fixture() {
-  const base = await mkdtemp(join(tmpdir(), "kennel-history-"))
-  const mailDir = join(base, "drafts")
-  await mkdir(mailDir, { recursive: true })
-  return { base, mailDir }
-}
-
-async function writeDraft(mailDir, id, content) {
-  const filePath = join(mailDir, `${id}.md`)
-  await writeFile(filePath, content)
-  return { filePath, revision: sha256(content), content }
-}
-
-async function cleanup(base) {
-  await rm(base, { recursive: true, force: true })
-}
-
-describe("deleteLocalDraftVerified", () => {
-  test("snapshots byte-exact history then deletes the draft", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const content = "---\nid: d_aaaaaa\nstatus: working\n---\n\nBody\n"
-      const { filePath, revision } = await writeDraft(
-        mailDir,
-        "d_aaaaaa",
-        content,
-      )
-
-      const outcome = await deleteLocalDraftVerified(
-        { id: "d_aaaaaa", filePath, folder: mailDir, revision },
-        mailDir,
-      )
-      expect(outcome).toBe("deleted")
-
-      const snapshot = await readFile(
-        join(mailDir, "history", "d_aaaaaa", `${revision}.md`),
-        "utf8",
-      )
-      expect(snapshot).toBe(content)
-      await expect(readFile(filePath, "utf8")).rejects.toThrow()
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("uses MailOS's lock file layout .locks/<id>.md.lock", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const content = "---\nid: d_lockabc\nstatus: ready\n---\n\nBody\n"
-      const { filePath, revision } = await writeDraft(
-        mailDir,
-        "d_lockabc",
-        content,
-      )
-      await deleteLocalDraftVerified(
-        { id: "d_lockabc", filePath, folder: mailDir, revision },
-        mailDir,
-      )
-      // MailOS holds `.locks/<basename>.lock` with `<basename>` = "<id>.md".
-      const lockPath = join(mailDir, ".locks", "d_lockabc.md.lock")
-      await expect(readFile(lockPath, "utf8")).resolves.toBe("")
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("refuses to delete when the file changed after the loaded revision", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const old = "---\nid: d_bbbbbb\nstatus: working\n---\n\nOld\n"
-      const { filePath, revision } = await writeDraft(mailDir, "d_bbbbbb", old)
-      await writeFile(
-        filePath,
-        "---\nid: d_bbbbbb\nstatus: working\n---\n\nNewer work\n",
-      )
-
-      await expect(
-        deleteLocalDraftVerified(
-          { id: "d_bbbbbb", filePath, folder: mailDir, revision },
-          mailDir,
-        ),
-      ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "changed" })
-      // The newer work must be untouched.
-      const current = await readFile(filePath, "utf8")
-      expect(current).toContain("Newer work")
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("does not unlink when the file is missing", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const { filePath } = await writeDraft(mailDir, "d_cccccc", "content")
-      await rm(filePath)
-      await expect(
-        deleteLocalDraftVerified(
-          {
-            id: "d_cccccc",
-            filePath,
-            folder: mailDir,
-            revision: sha256("content"),
-          },
-          mailDir,
-        ),
-      ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "missing" })
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("rejects traversal or invalid ids", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const { revision } = await writeDraft(mailDir, "d_dddddd", "x")
-      for (const id of ["../d_dddddd", "a/b", "..", "."]) {
-        await expect(
-          deleteLocalDraftVerified(
-            {
-              id,
-              filePath: join(mailDir, `${id}.md`),
-              folder: mailDir,
-              revision,
-            },
-            mailDir,
-          ),
-        ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "invalid" })
-      }
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("rejects a draft path outside the mail folder", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const outside = join(base, "elsewhere.md")
-      await writeFile(outside, "x")
-      await expect(
-        deleteLocalDraftVerified(
-          {
-            id: "d_eeeeee",
-            filePath: outside,
-            folder: mailDir,
-            revision: sha256("x"),
-          },
-          mailDir,
-        ),
-      ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "invalid" })
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("rejects a symlinked draft file instead of following it", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const target = join(base, "secret.md")
-      await writeFile(target, "outside content")
-      const link = join(mailDir, "d_ffffff.md")
-      await symlink(target, link)
-
-      await expect(
-        deleteLocalDraftVerified(
-          {
-            id: "d_ffffff",
-            filePath: link,
-            folder: mailDir,
-            revision: sha256("outside content"),
-          },
-          mailDir,
-        ),
-      ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "invalid" })
-      // The symlink and its target both survive.
-      await expect(readFile(link, "utf8")).resolves.toBe("outside content")
-      await expect(readFile(target, "utf8")).resolves.toBe("outside content")
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("rejects a symlinked history directory instead of following it", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const target = join(base, "elsewhere")
-      await mkdir(target, { recursive: true })
-      await symlink(target, join(mailDir, "history"))
-
-      const content = "---\nid: d_histlink\nstatus: working\n---\n\nBody\n"
-      const { filePath, revision } = await writeDraft(
-        mailDir,
-        "d_histlink",
-        content,
-      )
-      await expect(
-        deleteLocalDraftVerified(
-          { id: "d_histlink", filePath, folder: mailDir, revision },
-          mailDir,
-        ),
-      ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "invalid" })
-      // The draft survives and nothing was written through the symlink.
-      await expect(readFile(filePath, "utf8")).resolves.toBe(content)
-      await expect(
-        readFile(join(target, `${revision}.md`), "utf8"),
-      ).rejects.toThrow()
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("refuses to overwrite corrupt existing history and keeps the draft", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const content = "---\nid: d_corrupt\nstatus: working\n---\n\nBody\n"
-      const { filePath, revision } = await writeDraft(
-        mailDir,
-        "d_corrupt",
-        content,
-      )
-      const historyDir = join(mailDir, "history", "d_corrupt")
-      await mkdir(historyDir, { recursive: true })
-      const historyPath = join(historyDir, `${revision}.md`)
-      await writeFile(historyPath, "corrupted bytes")
-
-      await expect(
-        deleteLocalDraftVerified(
-          { id: "d_corrupt", filePath, folder: mailDir, revision },
-          mailDir,
-        ),
-      ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "changed" })
-      // Neither the draft nor the (corrupt) history is touched.
-      await expect(readFile(filePath, "utf8")).resolves.toBe(content)
-      await expect(readFile(historyPath, "utf8")).resolves.toBe(
-        "corrupted bytes",
-      )
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("serializes concurrent deletes of the same draft through the real lock", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const content = "---\nid: d_111111\nstatus: working\n---\n\nBody\n"
-      const { filePath, revision } = await writeDraft(
-        mailDir,
-        "d_111111",
-        content,
-      )
-      const identity = { id: "d_111111", filePath, folder: mailDir, revision }
-
-      const [first, second] = await Promise.allSettled([
-        deleteLocalDraftVerified(identity, mailDir),
-        deleteLocalDraftVerified(identity, mailDir),
-      ])
-      const outcomes = [first, second].map((result) =>
-        result.status === "fulfilled" ? result.value : result.reason.outcome,
-      )
-      expect(outcomes.sort()).toEqual(["deleted", "missing"])
-      // Exactly one byte-exact snapshot exists.
-      const snapshot = await readFile(
-        join(mailDir, "history", "d_111111", `${revision}.md`),
-        "utf8",
-      )
-      expect(snapshot).toBe(content)
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("waits for a lock held by another process, then deletes", async () => {
-    const { base, mailDir } = await fixture()
-    let child = null
-    try {
-      const content = "---\nid: d_proc\nstatus: ready\n---\n\nBody\n"
-      const { filePath, revision } = await writeDraft(
-        mailDir,
-        "d_proc",
-        content,
-      )
-      const lockPath = join(mailDir, ".locks", "d_proc.md.lock")
-      // The child opens the lock file itself; openSync cannot create the
-      // parent directory, so create the real `.locks` dir first (exactly as
-      // deleteLocalDraftVerified's ensureRealDirChain would).
-      await mkdir(join(mailDir, ".locks"), { recursive: true })
-
-      // A separate OS process takes the MailOS lock for 800ms.
-      const childScript = `
-import { openSync } from "node:fs"
-import { dlopen } from "bun:ffi"
-const lib = dlopen(process.platform === "darwin" ? "/usr/lib/libSystem.B.dylib" : "libc.so.6", { flock: { args: ["int", "int"], returns: "int" } })
-const flock = lib.symbols.flock
-const fd = openSync(${JSON.stringify(lockPath)}, "a+", 0o600)
-flock(fd, 2)
-console.log("CHILD_LOCKED")
-await Bun.sleep(800)
-flock(fd, 8)
-process.exit(0)
-`
-      child = Bun.spawn({
-        cmd: ["bun", "-e", childScript],
-        cwd: import.meta.dirname,
-        stdout: "pipe",
-        stderr: "pipe",
-      })
-
-      // Wait until the foreign process actually holds the flock, otherwise
-      // the delete could legitimately win the race. The decoded streamed
-      // chunks are accumulated: byte-comparing the raw Uint8Array never
-      // matches, and a marker split across chunks only matches once the text
-      // accumulates. Bounded so a silent child cannot hang the suite.
-      await waitForChildSignal(child, "CHILD_LOCKED")
-
-      const startedAt = performance.now()
-      const outcome = await deleteLocalDraftVerified(
-        { id: "d_proc", filePath, folder: mailDir, revision },
-        mailDir,
-      )
-      const elapsed = performance.now() - startedAt
-
-      expect(outcome).toBe("deleted")
-      // The delete had to wait for the foreign holder to release.
-      expect(elapsed).toBeGreaterThanOrEqual(600)
-      const snapshot = await readFile(
-        join(mailDir, "history", "d_proc", `${revision}.md`),
-        "utf8",
-      )
-      expect(snapshot).toBe(content)
-      expect(await childExitedBounded(child)).toBe(0)
-    } finally {
-      if (child) killIfRunning(child)
-      await cleanup(base)
-    }
-  })
-
-  test("rejects a malformed revision", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const { filePath } = await writeDraft(mailDir, "d_222222", "x")
-      await expect(
-        deleteLocalDraftVerified(
-          { id: "d_222222", filePath, folder: mailDir, revision: "not-a-hash" },
-          mailDir,
-        ),
-      ).rejects.toMatchObject({ name: "MailDeleteError", outcome: "invalid" })
-    } finally {
-      await cleanup(base)
-    }
-  })
-
-  test("delete is idempotent for an already-snapshotted revision", async () => {
-    const { base, mailDir } = await fixture()
-    try {
-      const content = "---\nid: d_333333\nstatus: working\n---\n\nBody\n"
-      const { filePath, revision } = await writeDraft(
-        mailDir,
-        "d_333333",
-        content,
-      )
-      const identity = { id: "d_333333", filePath, folder: mailDir, revision }
-      expect(await deleteLocalDraftVerified(identity, mailDir)).toBe("deleted")
-      // Second attempt: no file, no duplicate snapshot overwrite concerns.
-      await expect(
-        deleteLocalDraftVerified(identity, mailDir),
-      ).rejects.toMatchObject({
-        outcome: "missing",
-      })
-    } finally {
-      await cleanup(base)
-    }
-  })
-})
-
-test("MailDeleteError is an Error subclass", () => {
-  const error = new MailDeleteError("changed", "nope")
-  expect(error).toBeInstanceOf(Error)
-  expect(error.outcome).toBe("changed")
-})
-
-/**
- * Read a spawned child's stdout stream and resolve once the decoded,
- * accumulated text contains `marker`. Chunks are decoded incrementally with a
- * streaming TextDecoder and concatenated; byte-comparing the Uint8Array or
- * skipping the accumulation step would never match across chunk boundaries.
- * Bounded so a silent child cannot hang the suite.
- */
-function waitForChildSignal(child, marker) {
-  return new Promise((resolveSignal, rejectSignal) => {
-    const reader = child.stdout.getReader()
-    const decoder = new TextDecoder()
-    let collected = ""
-    const failTimer = setTimeout(
-      () =>
-        rejectSignal(new Error(`timeout waiting for child marker ${marker}`)),
-      10_000,
-    )
-    void (async () => {
-      try {
-        for (;;) {
-          const { done, value } = await reader.read()
-          if (done) break
-          collected += decoder.decode(value, { stream: true })
-          if (collected.includes(marker)) {
-            clearTimeout(failTimer)
-            resolveSignal()
-            return
-          }
-        }
-        clearTimeout(failTimer)
-        rejectSignal(new Error(`child closed stdout without marker ${marker}`))
-      } catch (error) {
-        clearTimeout(failTimer)
-        rejectSignal(error)
-      }
-    })()
-  })
-}
-
-async function childExitedBounded(child, ms = 10_000) {
-  return Promise.race([
-    child.exited,
-    new Promise((_, rejectExited) =>
-      setTimeout(
-        () => rejectExited(new Error("child did not exit in time")),
-        ms,
-      ),
-    ),
-  ]).catch(async (error) => {
-    killIfRunning(child)
-    await child.exited.catch(() => undefined)
-    throw error
-  })
-}
-
-function killIfRunning(child) {
-  try {
-    if (child.exitCode === null) child.kill()
-  } catch {
-    // Already gone.
-  }
-}