spine-framework 0.4.3 → 0.5.0-rc.4

package/.framework/tests/unit/integration-outbound-credentials.test.ts

@@ -0,0 +1,167 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+// F-065: the stock `generic-http` seed ships
+// `api_token: { source: 'value', value: '' }`. An absent or explicitly-empty
+// credential must mean "call without auth" — the adapter decides whether a
+// key is required. A configured-but-broken env_var entry still throws.
+
+vi.mock('../../functions/_shared/middleware.ts', () => ({
+  createHandler: (fn: any) => fn,
+}))
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: {
+    from: vi.fn(),
+  },
+  getUserDb: vi.fn(() => ({})),
+}))
+
+vi.mock('../../functions/_shared/audit.ts', () => ({
+  emitAudit: vi.fn().mockResolvedValue(undefined),
+  emitLog: vi.fn().mockResolvedValue(undefined),
+  emitSpan: vi.fn().mockResolvedValue(undefined),
+  emitActivity: vi.fn().mockResolvedValue(undefined),
+}))
+
+// admin-data pulls in permissions/trigger-engine — only `get`/`update` are
+// used here, and only when record_id / update_record are set.
+vi.mock('../../functions/admin-data.ts', () => ({
+  get: vi.fn(),
+  update: vi.fn(),
+}))
+
+import { adminDb } from '../../functions/_shared/db.ts'
+import { emitLog } from '../../functions/_shared/audit.ts'
+import { execute } from '../../functions/integration-outbound.ts'
+
+// Chainable query-builder stub — every filter/terminal method returns the
+// builder except single/maybeSingle/await, which resolve to the result.
+function q(result: { data?: any; error?: any }) {
+  const b: any = {}
+  const chainers = ['select', 'eq', 'in', 'is', 'ilike', 'filter', 'not', 'order',
+    'limit', 'update', 'insert', 'upsert', 'delete', 'neq', 'or', 'contains', 'gte', 'lte', 'range']
+  for (const m of chainers) b[m] = vi.fn(() => b)
+  b.single = vi.fn(async () => result)
+  b.maybeSingle = vi.fn(async () => result)
+  b.then = (onF: any, onR: any) => Promise.resolve(result).then(onF, onR)
+  return b
+}
+
+let queue: any[] = []
+
+const fetchMock = vi.fn()
+
+function makeCtx(overrides: any = {}) {
+  return {
+    requestId: 'req-1',
+    principal: {
+      id: 'user-1',
+      type: 'human',
+      accountId: 'acct-1',
+      roles: ['system_admin'],
+    },
+    accountId: 'acct-1',
+    db: adminDb,
+    query: {},
+    ...overrides,
+  }
+}
+
+function queueIntegration(credentials: any, config: any = { outbound_adapter: 'adapters/generic-webhook-outbound' }) {
+  // execute() looks up the account-scoped row first, then the system row.
+  queue.push(q({ data: null, error: null })) // tenant miss
+  queue.push(q({ data: { id: 'int-1', slug: 'generic-http', credentials, config, is_active: true }, error: null })) // system hit
+  queue.push(q({ data: { id: 'del-1' }, error: null })) // webhook_deliveries insert
+  queue.push(q({ data: null, error: null })) // webhook_deliveries update
+}
+
+beforeEach(() => {
+  queue = []
+  vi.clearAllMocks()
+  vi.mocked(adminDb.from).mockImplementation(() => (queue.length ? queue.shift() : q({ data: null, error: null })))
+  fetchMock.mockResolvedValue({
+    ok: true,
+    status: 200,
+    text: async () => '{"ok":true}',
+  })
+  vi.stubGlobal('fetch', fetchMock)
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('integration-outbound optional credentials (F-065)', () => {
+  it('sends the request with no Authorization header when api_token is an empty literal', async () => {
+    queueIntegration({ api_token: { source: 'value', value: '' } })
+
+    const result = await execute(makeCtx(), {
+      integration_slug: 'generic-http',
+      action_config: { url: 'https://hooks.example.com/in' },
+    })
+
+    expect(result.success).toBe(true)
+    expect(fetchMock).toHaveBeenCalledOnce()
+    const headers = fetchMock.mock.calls[0][1].headers
+    expect(headers.Authorization).toBeUndefined()
+
+    // The skip is still audited — same event name, marked skipped.
+    const events = vi.mocked(emitLog).mock.calls.map(c => c[1])
+    expect(events).toContain('integration.credential_empty')
+    const emptyCall = vi.mocked(emitLog).mock.calls.find(c => c[1] === 'integration.credential_empty')!
+    expect(emptyCall[4]).toMatchObject({ skipped: true, field: 'api_token' })
+  })
+
+  it('proceeds unauthenticated when the credentials map has no entry for the field', async () => {
+    queueIntegration({})
+
+    const result = await execute(makeCtx(), {
+      integration_slug: 'generic-http',
+      action_config: { url: 'https://hooks.example.com/in' },
+    })
+
+    expect(result.success).toBe(true)
+    const headers = fetchMock.mock.calls[0][1].headers
+    expect(headers.Authorization).toBeUndefined()
+    const events = vi.mocked(emitLog).mock.calls.map(c => c[1])
+    expect(events).toContain('integration.credential_missing')
+  })
+
+  it('attaches Authorization: Bearer when a literal token is configured', async () => {
+    queueIntegration({ api_token: { source: 'value', value: 'tok-123' } })
+
+    await execute(makeCtx(), {
+      integration_slug: 'generic-http',
+      action_config: { url: 'https://hooks.example.com/in' },
+    })
+
+    const headers = fetchMock.mock.calls[0][1].headers
+    expect(headers.Authorization).toBe('Bearer tok-123')
+  })
+
+  it('still throws when an env_var credential names an unset variable', async () => {
+    queueIntegration({ api_token: { source: 'env_var', value: 'DEFINITELY_UNSET_ENV_VAR' } })
+
+    await expect(
+      execute(makeCtx(), {
+        integration_slug: 'generic-http',
+        action_config: { url: 'https://hooks.example.com/in' },
+      })
+    ).rejects.toThrow('Environment variable DEFINITELY_UNSET_ENV_VAR for api_token is not set')
+    expect(fetchMock).not.toHaveBeenCalled()
+    const events = vi.mocked(emitLog).mock.calls.map(c => c[1])
+    expect(events).toContain('integration.credential_env_missing')
+  })
+
+  it('openai adapter still fails when no credential resolved', async () => {
+    queueIntegration({}, { outbound_adapter: 'adapters/openai-outbound' })
+
+    await expect(
+      execute(makeCtx(), {
+        integration_slug: 'openai',
+        action_config: { endpoint: '/chat/completions', body: {} },
+      })
+    ).rejects.toThrow('OpenAI adapter requires api_token credential')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+})

package/.framework/tests/unit/integrations-audit-redaction.test.ts

@@ -0,0 +1,130 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: {
+    from: vi.fn(),
+  },
+  getUserDb: vi.fn(() => ({})),
+  joins: {
+    app: 'app:apps(id, slug, name)',
+    createdBy: 'created_by:people(id, full_name)',
+  },
+}))
+
+vi.mock('../../functions/_shared/audit.ts', () => ({
+  emitAudit: vi.fn().mockResolvedValue(undefined),
+  emitLog: vi.fn().mockResolvedValue(undefined),
+  emitSpan: vi.fn().mockResolvedValue(undefined),
+  emitActivity: vi.fn().mockResolvedValue(undefined),
+}))
+
+import { adminDb } from '../../functions/_shared/db.ts'
+import { emitLog } from '../../functions/_shared/audit.ts'
+import { update, create } from '../../functions/integrations.ts'
+
+// Chainable query-builder stub — every filter/terminal method returns the
+// builder except single/maybeSingle/await, which resolve to the result.
+function q(result: { data?: any; error?: any }) {
+  const b: any = {}
+  const chainers = ['select', 'eq', 'in', 'is', 'ilike', 'filter', 'not', 'order',
+    'limit', 'update', 'insert', 'upsert', 'delete', 'neq', 'or', 'contains', 'gte', 'lte', 'range']
+  for (const m of chainers) b[m] = vi.fn(() => b)
+  b.single = vi.fn(async () => result)
+  b.maybeSingle = vi.fn(async () => result)
+  b.then = (onF: any, onR: any) => Promise.resolve(result).then(onF, onR)
+  return b
+}
+
+let queue: any[] = []
+let built: any[] = []
+
+beforeEach(() => {
+  queue = []
+  built = []
+  vi.clearAllMocks()
+  vi.mocked(adminDb.from).mockImplementation(() => {
+    const b = queue.length ? queue.shift() : q({ data: null, error: null })
+    built.push(b)
+    return b
+  })
+})
+
+// createHandler-wrapped exports invoke the inner handler directly when the
+// first arg carries requestId + principal (the ctx shortcut used by handler()).
+function makeCtx(overrides: any = {}) {
+  return {
+    requestId: 'req-1',
+    principal: {
+      id: 'user-1',
+      type: 'human',
+      accountId: 'acct-1',
+      roles: ['system_admin'],
+    },
+    accountId: 'acct-1',
+    db: adminDb,
+    query: {},
+    ...overrides,
+  }
+}
+
+describe('integrations update audit redaction (S-005)', () => {
+  it('redacts credentials in the audit after payload while writing them to the DB', async () => {
+    const integration = { id: 'int-1', name: 'OpenAI' }
+    const builder = q({ data: integration, error: null })
+    queue.push(builder)
+
+    const credentials = {
+      api_key: { source: 'value', value: 'sk-super-secret' },
+    }
+
+    const result = await update(makeCtx(), {
+      id: 'int-1',
+      name: 'OpenAI v2',
+      credentials,
+    })
+
+    expect(result).toEqual(integration)
+
+    // The DB write still receives the real credentials.
+    const written = builder.update.mock.calls[0][0]
+    expect(written.credentials).toEqual(credentials)
+    expect(written.is_configured).toBe(true)
+    expect(written.name).toBe('OpenAI v2')
+
+    // The audit payload carries only a redaction marker.
+    expect(emitLog).toHaveBeenCalledOnce()
+    const [, eventType, target, changes] = vi.mocked(emitLog).mock.calls[0]
+    expect(eventType).toBe('integration.updated')
+    expect(target).toEqual({ type: 'integration', id: 'int-1' })
+    expect(changes.after.credentials).toEqual({ __redacted: true })
+    expect(JSON.stringify(changes.after)).not.toContain('sk-super-secret')
+    expect(changes.after.name).toBe('OpenAI v2')
+  })
+
+  it('emits no credentials key in the audit payload when credentials are not updated', async () => {
+    const builder = q({ data: { id: 'int-2' }, error: null })
+    queue.push(builder)
+
+    await update(makeCtx(), { id: 'int-2', description: 'new desc' })
+
+    const [, , , changes] = vi.mocked(emitLog).mock.calls[0]
+    expect(changes.after).not.toHaveProperty('credentials')
+    expect(changes.after.description).toBe('new desc')
+  })
+
+  it('does not leak credentials in the create audit payload', async () => {
+    const builder = q({ data: { id: 'int-3' }, error: null })
+    queue.push(builder)
+
+    await create(makeCtx(), {
+      name: 'Resend',
+      integration_type: 'api',
+      provider: 'resend',
+      credentials: { api_key: { source: 'value', value: 're_secret' } },
+    })
+
+    const [, , , changes] = vi.mocked(emitLog).mock.calls[0]
+    expect(changes.after).not.toHaveProperty('credentials')
+    expect(JSON.stringify(changes.after)).not.toContain('re_secret')
+  })
+})

package/.framework/tests/unit/kb-ingest-lease.test.ts

@@ -93,6 +93,13 @@ function resolveQuery(q: QueryLog, opts: any): any {
   if (q.table === 'items') {
     if (has('update')) return { data: null, error: null }
     if (has('or')) return { data: opts.staleItems ?? [], error: null }
+    // Per-id point reads: a superseded doc has already been archived by
+    // the time kbRevoke's execution-time status fence re-reads it.
+    const idEq = q.ops.find(([n, a]) => n === 'eq' && a?.[0] === 'id')?.[1]?.[1]
+    if (idEq && idEq !== ITEM_ID) {
+      const stale = (opts.staleItems ?? []).find((s: any) => s.id === idEq)
+      if (stale) return { data: { ...stale, status: 'archived' }, error: null }
+    }
     return { data: opts.record ?? null, error: null }
   }
   if (q.table === 'types') {
@@ -273,6 +280,18 @@ describe('kbRevoke — lease clearing', () => {
     expect(leaseDelete.ops.find(([n]) => n === 'eq')?.[1]).toEqual(['document_id', ITEM_ID])
   })
 
+  it('skips revocation when the document is currently published — stale queued work fence', async () => {
+    const queries = setupDb({ record: makeRecord({ status: 'published' }) })
+    const rpcCalls = setupRpc({})
+
+    const res = await kbRevoke(ctx, { id: ITEM_ID })
+
+    expect(res).toMatchObject({ ok: true, skipped: true, count: 0 })
+    expect(rpcNamed(rpcCalls, 'revoke_embeddings_for_item')).toHaveLength(0)
+    expect(queriesWithOp(queries, 'embeddings', 'delete')).toHaveLength(0)
+    expect(queriesWithOp(queries, 'document_leases', 'delete')).toHaveLength(0)
+  })
+
   it('non-published ingest routes through kbRevoke and clears the lease', async () => {
     const queries = setupDb({ record: makeRecord({ status: 'draft' }) })
     setupRpc({})

package/.framework/tests/unit/logging-app-id.test.ts

@@ -0,0 +1,75 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const { mockFrom, mockMaybeSingle } = vi.hoisted(() => ({
+  mockFrom: vi.fn(),
+  mockMaybeSingle: vi.fn(),
+}))
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: { from: mockFrom },
+  getUserDb: vi.fn(),
+}))
+
+vi.mock('../../functions/_shared/middleware.ts', () => ({}))
+
+vi.mock('../../functions/_shared/principal.ts', () => ({
+  formatPrincipalForAudit: vi.fn(() => null),
+}))
+
+const APP_UUID = '5f2c1e9a-3b7d-4a8e-9c6f-1d2e3f4a5b6c'
+
+async function loadLogging() {
+  vi.resetModules()
+  return await import('../../functions/_shared/logging.ts')
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockFrom.mockReturnValue({
+    select: vi.fn(() => ({
+      eq: vi.fn(() => ({ maybeSingle: mockMaybeSingle })),
+    })),
+  })
+})
+
+describe('resolveAppUuid', () => {
+  it('returns a uuid input unchanged without a db call', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    await expect(resolveAppUuid(APP_UUID)).resolves.toBe(APP_UUID)
+    expect(mockFrom).not.toHaveBeenCalled()
+  })
+
+  it('resolves a slug via the apps lookup and caches the hit', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    mockMaybeSingle.mockResolvedValue({ data: { id: APP_UUID }, error: null })
+    await expect(resolveAppUuid('demo')).resolves.toBe(APP_UUID)
+    await expect(resolveAppUuid('demo')).resolves.toBe(APP_UUID)
+    expect(mockFrom).toHaveBeenCalledTimes(1)
+    expect(mockFrom).toHaveBeenCalledWith('apps')
+  })
+
+  it('returns null for an unknown slug and caches the miss', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    mockMaybeSingle.mockResolvedValue({ data: null, error: null })
+    await expect(resolveAppUuid('missing-app')).resolves.toBeNull()
+    await expect(resolveAppUuid('missing-app')).resolves.toBeNull()
+    expect(mockFrom).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns null on lookup error and retries instead of caching', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    mockMaybeSingle.mockResolvedValue({ data: null, error: { message: 'db down' } })
+    await expect(resolveAppUuid('demo')).resolves.toBeNull()
+    mockMaybeSingle.mockResolvedValue({ data: { id: APP_UUID }, error: null })
+    await expect(resolveAppUuid('demo')).resolves.toBe(APP_UUID)
+    expect(mockFrom).toHaveBeenCalledTimes(2)
+  })
+
+  it('returns null for null, undefined, and empty input without a db call', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    await expect(resolveAppUuid(null)).resolves.toBeNull()
+    await expect(resolveAppUuid(undefined)).resolves.toBeNull()
+    await expect(resolveAppUuid('')).resolves.toBeNull()
+    expect(mockFrom).not.toHaveBeenCalled()
+  })
+})

package/.framework/tests/unit/pipeline-runner-background.test.ts

@@ -0,0 +1,120 @@
+// CIL[BEGIN stable_id="~/.framework/tests/unit/pipeline-runner-background.test.ts:module_header:module_header" type="module_header" identity="module_header" parent="none"]
+// CIL[DOC-MACRO purpose="Unit tests for the pipeline-runner-background dispatch function"]
+// CIL[DOC-RESPONSIBILITY responsibility="Verify auth gating, payload validation, and correct runPipeline invocation"]
+// CIL[DOC-CONTEXT module="tests/unit/pipeline-runner-background" layer="test-unit" related_files=".framework/functions/pipeline-runner-background.ts,.framework/functions/_shared/pipeline-runner.ts,.framework/functions/_shared/db.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="test assertions" errors="none" side_effects="Mocks pipeline-runner and db modules"]
+// CIL[DOC-MICRO logic_summary="Stubs INTERNAL_INVOKE_SECRET, mocks runPipeline and sweepStaleExecutions, exercises the raw handler function" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.9" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: { from: vi.fn(), rpc: vi.fn() }
+}))
+
+vi.mock('../../functions/_shared/pipeline-runner.ts', () => ({
+  runPipeline: vi.fn(),
+  sweepStaleExecutions: vi.fn().mockResolvedValue(undefined)
+}))
+
+vi.mock('../../functions/_shared/audit.ts', () => ({
+  emitAudit: vi.fn().mockResolvedValue(undefined),
+  emitSpan: vi.fn().mockResolvedValue(undefined),
+  emitLog: vi.fn().mockResolvedValue(undefined)
+}))
+
+import { handler } from '../../functions/pipeline-runner-background.ts'
+import { runPipeline } from '../../functions/_shared/pipeline-runner.ts'
+// CIL[END stable_id="~/.framework/tests/unit/pipeline-runner-background.test.ts:module_header:module_header"]
+
+function makeEvent(body: any, secret = 'test-secret'): any {
+  return {
+    httpMethod: 'POST',
+    path: '/.netlify/functions/pipeline-runner-background',
+    headers: { 'x-internal-secret': secret },
+    body: JSON.stringify(body),
+    queryStringParameters: {}
+  }
+}
+
+describe('pipeline-runner-background handler', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubEnv('INTERNAL_INVOKE_SECRET', 'test-secret')
+    vi.mocked(runPipeline).mockResolvedValue({
+      executionId: 'exec-1',
+      pipelineId: 'pipe-1',
+      status: 'completed',
+      stages: [],
+      durationMs: 5
+    })
+  })
+
+  it('returns 403 when the internal secret is wrong', async () => {
+    const res = await handler(makeEvent({ pipeline_id: 'pipe-1' }, 'wrong-secret'), {})
+    expect(res.statusCode).toBe(403)
+    expect(runPipeline).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the internal secret is absent', async () => {
+    const event = makeEvent({ pipeline_id: 'pipe-1' })
+    delete event.headers['x-internal-secret']
+    const res = await handler(event, {})
+    expect(res.statusCode).toBe(403)
+    expect(runPipeline).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when pipeline_id is missing from the body', async () => {
+    const res = await handler(makeEvent({ trigger_data: {}, account_id: 'acct-1' }), {})
+    expect(res.statusCode).toBe(400)
+    expect(runPipeline).not.toHaveBeenCalled()
+  })
+
+  it('calls runPipeline with the dispatched pipeline_id and execution_id', async () => {
+    const payload = {
+      pipeline_id: 'pipe-42',
+      trigger_data: { event: 'item_created', entity_id: 'item-9' },
+      account_id: 'acct-7',
+      execution_id: 'exec-queued-99',
+      trigger_id: 'trig-3'
+    }
+    const res = await handler(makeEvent(payload), {})
+
+    expect(runPipeline).toHaveBeenCalledOnce()
+    const [calledPipelineId, calledTriggerData, calledCtx, calledOpts] =
+      vi.mocked(runPipeline).mock.calls[0]
+    expect(calledPipelineId).toBe('pipe-42')
+    expect(calledTriggerData).toMatchObject({ event: 'item_created', entity_id: 'item-9' })
+    expect(calledOpts?.executionId).toBe('exec-queued-99')
+    expect(calledCtx.accountId).toBe('acct-7')
+
+    const body = JSON.parse(res.body)
+    expect(body.ok).toBe(true)
+    expect(body.execution_id).toBe('exec-1')
+    expect(body.status).toBe('completed')
+  })
+
+  it('returns ok:false when the pipeline itself reports failure', async () => {
+    vi.mocked(runPipeline).mockResolvedValue({
+      executionId: 'exec-1',
+      pipelineId: 'pipe-1',
+      status: 'failed',
+      stages: [],
+      durationMs: 5,
+      error: 'stage exploded'
+    })
+    const res = await handler(makeEvent({ pipeline_id: 'pipe-1', execution_id: 'exec-1' }), {})
+    const body = JSON.parse(res.body)
+    expect(body.ok).toBe(false)
+    expect(body.status).toBe('failed')
+  })
+
+  it('returns 500 when runPipeline throws', async () => {
+    vi.mocked(runPipeline).mockRejectedValue(new Error('Pipeline not found'))
+    const res = await handler(makeEvent({ pipeline_id: 'pipe-1', execution_id: 'exec-1' }), {})
+    expect(res.statusCode).toBe(500)
+    const body = JSON.parse(res.body)
+    expect(body.error).toBe('Pipeline not found')
+    expect(body.execution_id).toBe('exec-1')
+  })
+})