okengine 0.1.4

package/src/console/server/console.test.ts

@@ -0,0 +1,338 @@
+/**
+ * Console kernel acceptance:
+ * - every action appears in a trace
+ * - setup wizard cannot be reopened after first operator
+ * - console flow unreachable by an application principal
+ * - Host/Origin + CSP + SameSite=Strict
+ * - structural changes land as diffs, never applied silently
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { issueSession } from "../../auth/index.ts";
+import { createClient } from "../../client/index.ts";
+import { CONSOLE_CSP, PLUGIN_IFRAME_SANDBOX } from "./security-headers.ts";
+import { serveConsole, type ConsoleServerHandle } from "./serve.ts";
+import { startConsoleApp } from "./serve.ts";
+
+describe("console kernel", () => {
+  let cwd: string;
+
+  beforeAll(async () => {
+    cwd = await mkdtemp(join(tmpdir(), "oke-console-"));
+  });
+
+  test("createClient<ConsoleApp> reaches setup.status", async () => {
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-console",
+      silentClaim: true,
+    });
+    try {
+      const api = createClient(handle.app, "http://console.test", {
+        fetch: async (input, init) => {
+          const req = new Request(String(input), init);
+          return handle.app.fetch(req);
+        },
+      }) as {
+        console: {
+          setupStatus: (input?: unknown) => Promise<{
+            data: { setupClosed: boolean; claimRequired: boolean } | null;
+            error: { code: string } | null;
+          }>;
+        };
+      };
+      const { data, error } = await api.console.setupStatus({});
+      expect(error).toBeNull();
+      expect(data?.setupClosed).toBe(false);
+      expect(data?.claimRequired).toBe(true);
+    } finally {
+      await handle.app.stop();
+    }
+  });
+
+  test("claim creates first operator and closes the wizard permanently", async () => {
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-console",
+      silentClaim: true,
+    });
+    try {
+      const code = handle.state.claim.code;
+      const claimRes = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "password123",
+          }),
+        }),
+      );
+      expect(claimRes.status).toBe(200);
+      const claimBody = (await claimRes.json()) as {
+        data: { accessToken: string; operatorId: string };
+        error: null;
+      };
+      expect(claimBody.data.accessToken).toBeTruthy();
+      expect(handle.state.setupClosed).toBe(true);
+
+      const reopen = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: code,
+            email: "other@example.com",
+            name: "Other",
+            password: "password123",
+          }),
+        }),
+      );
+      expect(reopen.status).toBe(400);
+      const reopenBody = (await reopen.json()) as {
+        error: { code: string };
+      };
+      expect(reopenBody.error.code).toBe("SetupClosed");
+
+      const status = await handle.app.fetch(
+        new Request("http://console.test/console/setup/status"),
+      );
+      const statusBody = (await status.json()) as {
+        data: { setupClosed: boolean; claimRequired: boolean };
+      };
+      expect(statusBody.data.setupClosed).toBe(true);
+      expect(statusBody.data.claimRequired).toBe(false);
+    } finally {
+      await handle.app.stop();
+    }
+  });
+
+  test("every console action appears in a trace (runs)", async () => {
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-console",
+      silentClaim: true,
+    });
+    try {
+      const claimRes = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "password123",
+          }),
+        }),
+      );
+      const { data } = (await claimRes.json()) as {
+        data: { accessToken: string };
+      };
+
+      const ping = await handle.app.fetch(
+        new Request("http://console.test/console/action/ping", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${data.accessToken}`,
+          },
+          body: JSON.stringify({ note: "hello-trace" }),
+        }),
+      );
+      expect(ping.status).toBe(200);
+
+      const runs = await handle.state.listRuns();
+      const names = runs.map((r) => r.flow);
+      expect(names).toContain("console.setup.claim");
+      expect(names).toContain("console.action.ping");
+      const pingRun = runs.find((r) => r.flow === "console.action.ping");
+      expect(pingRun?.plane).toBe("operator");
+      expect(pingRun?.logs.some((l) => l.message.includes("console.action.ping"))).toBe(
+        true,
+      );
+    } finally {
+      await handle.app.stop();
+    }
+  });
+
+  test("console flow is unreachable by an application principal", async () => {
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-console",
+      silentClaim: true,
+    });
+    try {
+      // Seed an operator so protected flows require auth (not public).
+      await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "password123",
+          }),
+        }),
+      );
+
+      const userSession = await issueSession(
+        handle.state.sessions,
+        { secret: handle.state.secret, now: handle.state.now },
+        {
+          id: "user-1",
+          plane: "user",
+          scopes: ["bookings:create"],
+        },
+      );
+
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/action/ping", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${userSession.accessToken}`,
+          },
+          body: JSON.stringify({ note: "escalate" }),
+        }),
+      );
+      expect(res.status).toBe(403);
+      const body = (await res.json()) as { error: { code: string } };
+      expect(body.error.code).toBe("Forbidden");
+    } finally {
+      await handle.app.stop();
+    }
+  });
+
+  test("structural propose writes a diff and does not apply it", async () => {
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-console",
+      silentClaim: true,
+    });
+    try {
+      const claimRes = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "password123",
+          }),
+        }),
+      );
+      const { data } = (await claimRes.json()) as {
+        data: { accessToken: string };
+      };
+
+      const propose = await handle.app.fetch(
+        new Request("http://console.test/console/structural/propose", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${data.accessToken}`,
+          },
+          body: JSON.stringify({
+            title: "raise retries",
+            relativePath: "src/signals.ts",
+            contents: "export const retries = 5;\n",
+            reason: "incident response",
+          }),
+        }),
+      );
+      expect(propose.status).toBe(200);
+      const body = (await propose.json()) as {
+        data: { id: string; path: string; applied: boolean };
+      };
+      expect(body.data.applied).toBe(false);
+      const file = Bun.file(body.data.path);
+      expect(await file.exists()).toBe(true);
+      const text = await file.text();
+      expect(text).toContain("status: proposed — not applied");
+      expect(text).toContain("+export const retries = 5;");
+      // Target path must not have been silently written.
+      expect(await Bun.file(join(cwd, "src/signals.ts")).exists()).toBe(false);
+    } finally {
+      await handle.app.stop();
+    }
+  });
+});
+
+describe("console serve security", () => {
+  let server: ConsoleServerHandle;
+  let cwd: string;
+
+  beforeAll(async () => {
+    cwd = await mkdtemp(join(tmpdir(), "oke-console-serve-"));
+    server = await serveConsole({
+      port: 0,
+      hostname: "127.0.0.1",
+      cwd,
+      secret: "serve-secret",
+      silentClaim: true,
+      env: "dev",
+    });
+  });
+
+  afterAll(() => {
+    server.stop(true);
+  });
+
+  test("rejects unexpected Host", async () => {
+    const res = await server.fetch(
+      new Request(`${server.url}console/setup/status`, {
+        headers: { host: "evil.example" },
+      }),
+    );
+    expect(res.status).toBe(403);
+  });
+
+  test("sets CSP with frame-ancestors none", async () => {
+    const res = await server.fetch(
+      new Request(`${server.url}console/setup/status`, {
+        headers: { host: "127.0.0.1" },
+      }),
+    );
+    expect(res.status).toBe(200);
+    const csp = res.headers.get("content-security-policy") ?? "";
+    expect(csp).toContain("frame-ancestors 'none'");
+    expect(csp).toBe(CONSOLE_CSP);
+  });
+
+  test("claim sets SameSite=Strict session cookies", async () => {
+    const res = await server.fetch(
+      new Request(`${server.url}console/setup/claim`, {
+        method: "POST",
+        headers: {
+          host: "127.0.0.1",
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({
+          claimCode: server.console.state.claim.code,
+          email: "ops@example.com",
+          name: "Ops",
+          password: "password123",
+        }),
+      }),
+    );
+    expect(res.status).toBe(200);
+    const cookies = res.headers.getSetCookie?.() ?? [];
+    const joined = cookies.join("\n");
+    expect(joined).toContain("SameSite=Strict");
+    expect(joined).toContain("HttpOnly");
+    expect(joined).toContain("oke_console_at=");
+  });
+
+  test("plugin iframe sandbox omits allow-same-origin", () => {
+    expect(PLUGIN_IFRAME_SANDBOX.includes("allow-same-origin")).toBe(false);
+    expect(PLUGIN_IFRAME_SANDBOX).toContain("allow-scripts");
+  });
+});

package/src/console/server/diff.test.ts

@@ -0,0 +1,299 @@
+/**
+ * Console Manifest Diff projection (console §9.12).
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { Manifest } from "../../manifest/types.ts";
+import type { WideEvent } from "../../runs/types.ts";
+import {
+  countRunsByFlowLastWeek,
+  formatBlastLine,
+  formatRunCount,
+  formatWeeklyBill,
+  projectManifestDiff,
+  weeklyCostDeltaUsd,
+  WEEK_MS,
+} from "./diff.ts";
+
+const NOW = 1_700_000_000_000;
+
+function run(
+  flow: string,
+  startedAt: number,
+  id = `${flow}-${startedAt}`,
+): WideEvent {
+  return {
+    id,
+    flow,
+    trigger: "http",
+    plane: "user",
+    gates: [],
+    cache: "none",
+    effects: [],
+    logs: [],
+    durationMs: 10,
+    startedAt,
+    endedAt: startedAt + 10,
+    dimensions: {},
+  };
+}
+
+const BASELINE: Manifest = {
+  oke: "1.0",
+  app: "diff-console-test",
+  flows: {
+    "orders.notify": {
+      plane: "user",
+      gates: ["member"],
+      effects: {},
+    },
+    "reports.export": {
+      plane: "user",
+      gates: ["staff"],
+      in: { type: "object", properties: { id: { type: "string" } } },
+    },
+  },
+  channels: {
+    "order-shipped": { medium: "email" },
+  },
+};
+
+describe("countRunsByFlowLastWeek", () => {
+  test("counts only the trailing week from the real Runs store", () => {
+    const runs = [
+      run("orders.notify", NOW - 1_000),
+      run("orders.notify", NOW - 2_000),
+      run("orders.notify", NOW - WEEK_MS - 1),
+      run("reports.export", NOW - 500),
+    ];
+    const counts = countRunsByFlowLastWeek(runs, NOW);
+    expect(counts.get("orders.notify")).toBe(2);
+    expect(counts.get("reports.export")).toBe(1);
+  });
+});
+
+describe("formatWeeklyBill", () => {
+  test("is a weekly bill, not a per-call delta", () => {
+    expect(formatWeeklyBill(212)).toBe("+$212 per week");
+    expect(formatWeeklyBill(0.018)).toBe("+$0.02 per week");
+    expect(formatWeeklyBill(-38)).toBe("-$38 per week");
+  });
+});
+
+describe("formatBlastLine", () => {
+  test("multiplies a new send by real traffic", () => {
+    const line = formatBlastLine({
+      flowName: "orders.notify",
+      runCount: 41_208,
+      beforeFlow: { effects: {} },
+      afterFlow: { effects: { sends: ["order-shipped"] } },
+      channels: { "order-shipped": { medium: "email" } },
+    });
+    expect(line).toBe(
+      "this flow ran 41,208 times last week, it sent nothing, and it will now email every caller",
+    );
+    expect(formatRunCount(41208)).toBe("41,208");
+  });
+});
+
+describe("weeklyCostDeltaUsd", () => {
+  test("rate × recent volume — email unit cost × run count", () => {
+    const delta = weeklyCostDeltaUsd({
+      beforeFlow: { effects: {} },
+      afterFlow: { effects: { sends: ["order-shipped"] } },
+      runCount: 41_208,
+      channels: { "order-shipped": { medium: "email" } },
+      costs: { email: 0.0001, any: 0.005 },
+    });
+    // 0.0001 × 41208 = 4.1208
+    expect(delta).toBeCloseTo(4.1208, 4);
+  });
+
+  test("uses estimatePerCall when declared", () => {
+    const delta = weeklyCostDeltaUsd({
+      beforeFlow: { cost: { estimatePerCall: 0.01 } },
+      afterFlow: { cost: { estimatePerCall: 0.02 } },
+      runCount: 1000,
+      channels: undefined,
+      costs: {},
+    });
+    expect(delta).toBe(10);
+  });
+});
+
+describe("projectManifestDiff", () => {
+  test("empty without a baseline — does not invent a diff", () => {
+    const projection = projectManifestDiff({
+      before: null,
+      after: BASELINE,
+      now: NOW,
+    });
+    expect(projection.hasBaseline).toBe(false);
+    expect(projection.changes).toEqual([]);
+  });
+
+  test("uses diffManifest categories — does not reclassify in the projection", () => {
+    const after: Manifest = {
+      ...BASELINE,
+      flows: {
+        ...BASELINE.flows,
+        "orders.notify": {
+          plane: "user",
+          gates: ["member"],
+          effects: { sends: ["order-shipped"] },
+        },
+        "reports.export": {
+          plane: "user",
+          gates: ["member"],
+          in: {
+            type: "object",
+            required: ["id", "format"],
+            properties: {
+              id: { type: "string" },
+              format: { type: "string" },
+            },
+          },
+        },
+      },
+    };
+
+    const runs = Array.from({ length: 100 }, (_, i) =>
+      run("orders.notify", NOW - i * 1000, `n-${i}`),
+    );
+
+    const projection = projectManifestDiff({
+      before: BASELINE,
+      after,
+      runs,
+      now: NOW,
+      costs: { email: 0.0001, any: 0.005 },
+    });
+
+    expect(projection.hasBaseline).toBe(true);
+    expect(
+      projection.changes.some((c) => c.category === "effect-widening"),
+    ).toBe(true);
+    expect(
+      projection.changes.some((c) => c.category === "permission-widening"),
+    ).toBe(true);
+    expect(
+      projection.changes.some((c) => c.category === "contract-breaking"),
+    ).toBe(true);
+
+    const send = projection.changes.find(
+      (c) => c.path.includes("sends") || c.blastLine !== null,
+    );
+    expect(send?.runCountLastWeek).toBe(100);
+    expect(send?.blastLine).toContain("ran 100 times last week");
+    expect(send?.blastLine).toContain("sent nothing");
+    expect(send?.blastLine).toContain("email every caller");
+    expect(send?.weeklyBillLine).toMatch(/per week/);
+  });
+
+  test("CI gate: undeclared break is blocked; breaking: true is acknowledged", () => {
+    const afterBlocked: Manifest = {
+      ...BASELINE,
+      flows: {
+        "orders.notify": BASELINE.flows!["orders.notify"]!,
+        "reports.export": {
+          plane: "user",
+          gates: ["staff"],
+          // required field added — contract-breaking, no acknowledgement
+          in: {
+            type: "object",
+            required: ["id", "format"],
+            properties: {
+              id: { type: "string" },
+              format: { type: "string" },
+            },
+          },
+        },
+      },
+    };
+
+    const blocked = projectManifestDiff({
+      before: BASELINE,
+      after: afterBlocked,
+      now: NOW,
+    });
+    const breakChange = blocked.changes.find(
+      (c) => c.category === "contract-breaking" && c.flowName === "reports.export",
+    );
+    expect(breakChange?.ciGate).toBe("blocked");
+    expect(blocked.blockedCount).toBeGreaterThanOrEqual(1);
+    expect(blocked.acknowledgedCount).toBe(0);
+
+    const afterAck: Manifest = {
+      ...afterBlocked,
+      flows: {
+        ...afterBlocked.flows,
+        "reports.export": {
+          ...afterBlocked.flows!["reports.export"]!,
+          breaking: true,
+        },
+      },
+    };
+
+    const ack = projectManifestDiff({
+      before: BASELINE,
+      after: afterAck,
+      now: NOW,
+    });
+    const ackChange = ack.changes.find(
+      (c) => c.category === "contract-breaking" && c.flowName === "reports.export",
+    );
+    expect(ackChange?.ciGate).toBe("acknowledged");
+    expect(ack.acknowledgedCount).toBeGreaterThanOrEqual(1);
+    expect(ack.blockedCount).toBe(0);
+  });
+
+  test("sorts by blast radius — contract-breaking first", () => {
+    const after: Manifest = {
+      ...BASELINE,
+      flows: {
+        "orders.notify": {
+          plane: "user",
+          // public — permission-widening
+          effects: { sends: ["order-shipped"] },
+        },
+        "reports.export": {
+          plane: "user",
+          gates: ["staff"],
+          in: {
+            type: "object",
+            required: ["id", "format"],
+            properties: {
+              id: { type: "string" },
+              format: { type: "string" },
+            },
+          },
+        },
+        "health.ping": {
+          plane: "user",
+          source: "src/health.ts",
+        },
+      },
+    };
+
+    const projection = projectManifestDiff({
+      before: BASELINE,
+      after,
+      now: NOW,
+    });
+
+    const categories = projection.changes.map((c) => c.category);
+    const firstBreak = categories.indexOf("contract-breaking");
+    const firstWiden = categories.indexOf("permission-widening");
+    const firstEffect = categories.indexOf("effect-widening");
+    const firstNoImpact = categories.indexOf("no-impact");
+    if (firstBreak >= 0 && firstWiden >= 0) {
+      expect(firstBreak).toBeLessThan(firstWiden);
+    }
+    if (firstWiden >= 0 && firstEffect >= 0) {
+      expect(firstWiden).toBeLessThan(firstEffect);
+    }
+    if (firstEffect >= 0 && firstNoImpact >= 0) {
+      expect(firstEffect).toBeLessThan(firstNoImpact);
+    }
+  });
+});