upfynai-code 2.9.0 → 2.9.2

package/server/tests/relay-flow.test.js

@@ -0,0 +1,570 @@
+/**
+ * End-to-end tests for Relay AI Chat Flow & Multi-User Isolation
+ *
+ * Tests verify:
+ * 1. Relay message routing (UI → Backend → CLI → AI → Response)
+ * 2. Streaming event translation (relay-stream → content_block_delta)
+ * 3. Multi-user isolation (broadcasts, sessions, projects, relay connections)
+ * 4. Session locking and ownership
+ * 5. Agent abstraction (executeAction dispatch)
+ *
+ * Run: node --test backend/server/tests/relay-flow.test.js
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+// ── Test 1: Relay Connection Isolation ──
+
+describe('Relay Connection Isolation', () => {
+  it('relayConnections map keys by userId — different users get separate entries', () => {
+    const relayConnections = new Map();
+
+    // User A connects
+    relayConnections.set(1, { ws: { readyState: 1 }, user: { userId: 1, username: 'userA' }, connectedAt: Date.now() });
+    // User B connects
+    relayConnections.set(2, { ws: { readyState: 1 }, user: { userId: 2, username: 'userB' }, connectedAt: Date.now() });
+
+    assert.equal(relayConnections.size, 2, 'Two separate relay connections');
+    assert.equal(relayConnections.get(1).user.username, 'userA');
+    assert.equal(relayConnections.get(2).user.username, 'userB');
+
+    // User A's lookup cannot access User B's relay
+    const relayA = relayConnections.get(1);
+    const relayB = relayConnections.get(2);
+    assert.notEqual(relayA.ws, relayB.ws, 'Different users have different WebSocket connections');
+  });
+
+  it('hasActiveRelay returns true only for the correct user', () => {
+    const relayConnections = new Map();
+    relayConnections.set(1, { ws: { readyState: 1 } });
+    relayConnections.set(2, { ws: { readyState: 3 } }); // User 2 disconnected (readyState=3)
+
+    function hasActiveRelay(userId) {
+      if (!userId) return false;
+      const relay = relayConnections.get(Number(userId));
+      return relay && relay.ws.readyState === 1;
+    }
+
+    assert.equal(hasActiveRelay(1), true, 'User 1 has active relay');
+    assert.ok(!hasActiveRelay(2), 'User 2 relay is disconnected');
+    assert.ok(!hasActiveRelay(3), 'User 3 has no relay');
+    assert.ok(!hasActiveRelay(null), 'Null userId returns falsy');
+    assert.ok(!hasActiveRelay(undefined), 'Undefined userId returns falsy');
+  });
+
+  it('sendRelayCommand targets only the correct userId relay', () => {
+    const relayConnections = new Map();
+    const sentMessages = { user1: [], user2: [] };
+
+    relayConnections.set(1, {
+      ws: {
+        readyState: 1,
+        send: (msg) => sentMessages.user1.push(JSON.parse(msg)),
+      }
+    });
+    relayConnections.set(2, {
+      ws: {
+        readyState: 1,
+        send: (msg) => sentMessages.user2.push(JSON.parse(msg)),
+      }
+    });
+
+    // Send command to user 1's relay
+    const relay = relayConnections.get(1);
+    relay.ws.send(JSON.stringify({ type: 'relay-command', action: 'claude-query', command: 'hello' }));
+
+    assert.equal(sentMessages.user1.length, 1, 'User 1 received the command');
+    assert.equal(sentMessages.user2.length, 0, 'User 2 did NOT receive the command');
+    assert.equal(sentMessages.user1[0].action, 'claude-query');
+  });
+});
+
+// ── Test 2: Broadcast User Filtering ──
+
+describe('Broadcast User Filtering', () => {
+  it('relay-status broadcast only reaches clients with matching userId', () => {
+    const connectedClients = new Set();
+    const received = { userA: [], userB: [], noAuth: [] };
+
+    const clientA = {
+      readyState: 1,
+      _wsUser: { userId: 1 },
+      send: (msg) => received.userA.push(JSON.parse(msg)),
+    };
+    const clientB = {
+      readyState: 1,
+      _wsUser: { userId: 2 },
+      send: (msg) => received.userB.push(JSON.parse(msg)),
+    };
+    const clientNoAuth = {
+      readyState: 1,
+      _wsUser: null,
+      send: (msg) => received.noAuth.push(JSON.parse(msg)),
+    };
+
+    connectedClients.add(clientA);
+    connectedClients.add(clientB);
+    connectedClients.add(clientNoAuth);
+
+    // Broadcast relay-status for userId=1
+    const userId = 1;
+    for (const client of connectedClients) {
+      try {
+        if (client.readyState === 1 && client._wsUser?.userId === userId) {
+          client.send(JSON.stringify({ type: 'relay-status', userId, connected: true }));
+        }
+      } catch { /* ignore */ }
+    }
+
+    assert.equal(received.userA.length, 1, 'User A received the broadcast');
+    assert.equal(received.userB.length, 0, 'User B did NOT receive it');
+    assert.equal(received.noAuth.length, 0, 'Unauthenticated client did NOT receive it');
+    assert.equal(received.userA[0].type, 'relay-status');
+    assert.equal(received.userA[0].connected, true);
+  });
+
+  it('projects_updated broadcast only sends user-owned projects', () => {
+    const connectedClients = new Set();
+    const received = { userA: [], userB: [] };
+
+    const clientA = {
+      readyState: 1,
+      _wsUser: { userId: 1 },
+      send: (msg) => received.userA.push(JSON.parse(msg)),
+    };
+    const clientB = {
+      readyState: 1,
+      _wsUser: { userId: 2 },
+      send: (msg) => received.userB.push(JSON.parse(msg)),
+    };
+    connectedClients.add(clientA);
+    connectedClients.add(clientB);
+
+    // Simulate per-user project lists
+    const userProjects = {
+      1: [{ name: 'projectA' }],
+      2: [{ name: 'projectB' }],
+    };
+
+    for (const client of connectedClients) {
+      if (client.readyState !== 1) continue;
+      const uid = client._wsUser?.userId;
+      if (uid && userProjects[uid]) {
+        client.send(JSON.stringify({ type: 'projects_updated', projects: userProjects[uid] }));
+      }
+    }
+
+    assert.equal(received.userA.length, 1);
+    assert.equal(received.userB.length, 1);
+    assert.equal(received.userA[0].projects[0].name, 'projectA', 'User A sees only projectA');
+    assert.equal(received.userB[0].projects[0].name, 'projectB', 'User B sees only projectB');
+  });
+});
+
+// ── Test 3: Streaming Event Translation ──
+
+describe('Streaming Event Translation', () => {
+  it('relay-stream with claude-response translates to content_block_delta', () => {
+    const frontendMessages = [];
+    const writer = {
+      send: (msg) => frontendMessages.push(msg),
+    };
+
+    // Simulate onStream callback from routeViaRelay
+    const responseType = 'claude-response';
+    const sessionId = 'session-123';
+    let fullContent = '';
+
+    function onStream(streamData) {
+      if (streamData.type === 'claude-response') {
+        const chunk = streamData.content || '';
+        if (chunk) {
+          fullContent += chunk;
+          writer.send({
+            type: responseType,
+            data: { type: 'content_block_delta', delta: { text: chunk } },
+            sessionId,
+          });
+        }
+      }
+    }
+
+    // Simulate streaming chunks
+    onStream({ type: 'claude-response', content: 'Hello' });
+    onStream({ type: 'claude-response', content: ', I am Claude.' });
+    onStream({ type: 'claude-response', content: ' How can I help?' });
+
+    assert.equal(frontendMessages.length, 3, 'Three streaming events sent to frontend');
+    assert.equal(frontendMessages[0].data.type, 'content_block_delta');
+    assert.equal(frontendMessages[0].data.delta.text, 'Hello');
+    assert.equal(frontendMessages[1].data.delta.text, ', I am Claude.');
+    assert.equal(frontendMessages[2].data.delta.text, ' How can I help?');
+    assert.equal(fullContent, 'Hello, I am Claude. How can I help?', 'Full content accumulated correctly');
+  });
+
+  it('claude-system event translates to relay-session-id', () => {
+    const frontendMessages = [];
+    const writer = { send: (msg) => frontendMessages.push(msg) };
+    const sessionId = 'session-456';
+    let capturedCliSessionId = null;
+
+    function onStream(streamData) {
+      if (streamData.type === 'claude-system' && streamData.sessionId) {
+        capturedCliSessionId = streamData.sessionId;
+        writer.send({
+          type: 'relay-session-id',
+          sessionId,
+          cliSessionId: capturedCliSessionId,
+          model: streamData.model,
+          cwd: streamData.cwd,
+        });
+      }
+    }
+
+    onStream({ type: 'claude-system', sessionId: 'cli-sess-789', model: 'claude-sonnet-4-6', cwd: '/home/user/project' });
+
+    assert.equal(frontendMessages.length, 1);
+    assert.equal(frontendMessages[0].type, 'relay-session-id');
+    assert.equal(frontendMessages[0].cliSessionId, 'cli-sess-789');
+    assert.equal(frontendMessages[0].model, 'claude-sonnet-4-6');
+    assert.equal(capturedCliSessionId, 'cli-sess-789');
+  });
+
+  it('completion event includes viaRelay: true', () => {
+    const frontendMessages = [];
+    const writer = { send: (msg) => frontendMessages.push(msg) };
+
+    // Simulate routeViaRelay completion
+    writer.send({
+      type: 'claude-complete',
+      sessionId: 'session-123',
+      cliSessionId: 'cli-sess-456',
+      exitCode: 0,
+      isNewSession: true,
+      viaRelay: true,
+    });
+
+    assert.equal(frontendMessages[0].type, 'claude-complete');
+    assert.equal(frontendMessages[0].viaRelay, true, 'Must indicate response came via relay');
+    assert.equal(frontendMessages[0].exitCode, 0);
+  });
+});
+
+// ── Test 4: Session Ownership Isolation ──
+
+describe('Session Ownership Isolation', () => {
+  it('sessionOwners map enforces user isolation', () => {
+    const sessionOwners = new Map();
+
+    // User 1 creates a session
+    sessionOwners.set('session-A', 1);
+    // User 2 creates a session
+    sessionOwners.set('session-B', 2);
+
+    // Simulate getUserSessions filter
+    function getUserSessions(userId, allSessions) {
+      return allSessions.filter(s => {
+        const owner = sessionOwners.get(s.sessionId);
+        return !owner || owner === userId;
+      });
+    }
+
+    const allSessions = [
+      { sessionId: 'session-A', provider: 'claude' },
+      { sessionId: 'session-B', provider: 'claude' },
+      { sessionId: 'session-C', provider: 'cursor' }, // unowned
+    ];
+
+    const user1Sessions = getUserSessions(1, allSessions);
+    const user2Sessions = getUserSessions(2, allSessions);
+
+    assert.equal(user1Sessions.length, 2, 'User 1 sees session-A + unowned session-C');
+    assert.ok(user1Sessions.some(s => s.sessionId === 'session-A'), 'User 1 sees their own session');
+    assert.ok(!user1Sessions.some(s => s.sessionId === 'session-B'), 'User 1 cannot see User 2 session');
+
+    assert.equal(user2Sessions.length, 2, 'User 2 sees session-B + unowned session-C');
+    assert.ok(user2Sessions.some(s => s.sessionId === 'session-B'), 'User 2 sees their own session');
+    assert.ok(!user2Sessions.some(s => s.sessionId === 'session-A'), 'User 2 cannot see User 1 session');
+  });
+
+  it('abort rejects when user does not own the session', () => {
+    const sessionOwners = new Map();
+    sessionOwners.set('session-X', 1); // owned by user 1
+
+    const userId = 2; // user 2 tries to abort
+    const owner = sessionOwners.get('session-X');
+    const canAbort = !owner || owner === userId;
+
+    assert.equal(canAbort, false, 'User 2 cannot abort User 1 session');
+  });
+});
+
+// ── Test 5: Agent Action Dispatch ──
+
+describe('Agent Action Dispatch', () => {
+  it('executeAction routes to correct handler', async () => {
+    const callLog = [];
+    const actionMap = new Map([
+      ['claude-query', async (params) => { callLog.push('claude'); return { exitCode: 0 }; }],
+      ['cursor-query', async (params) => { callLog.push('cursor'); return { exitCode: 0 }; }],
+      ['codex-query', async (params) => { callLog.push('codex'); return { exitCode: 0 }; }],
+      ['shell-exec', async (params) => { callLog.push('shell'); return { output: 'hello' }; }],
+    ]);
+
+    async function executeAction(action, params) {
+      const handler = actionMap.get(action);
+      if (!handler) throw new Error(`Unknown action: ${action}`);
+      return handler(params);
+    }
+
+    await executeAction('claude-query', { command: 'hey' });
+    await executeAction('cursor-query', { command: 'hey' });
+    await executeAction('shell-exec', { command: 'ls' });
+
+    assert.deepEqual(callLog, ['claude', 'cursor', 'shell']);
+
+    // Unknown action throws
+    await assert.rejects(
+      () => executeAction('unknown-action', {}),
+      { message: 'Unknown action: unknown-action' }
+    );
+  });
+
+  it('streaming actions are identified correctly', () => {
+    const streamingActions = new Set(['claude-query', 'claude-task-query', 'codex-query', 'cursor-query']);
+
+    function isStreamingAction(action) {
+      return streamingActions.has(action);
+    }
+
+    assert.equal(isStreamingAction('claude-query'), true);
+    assert.equal(isStreamingAction('codex-query'), true);
+    assert.equal(isStreamingAction('cursor-query'), true);
+    assert.equal(isStreamingAction('shell-exec'), false);
+    assert.equal(isStreamingAction('file-read'), false);
+    assert.equal(isStreamingAction('git-status'), false);
+  });
+});
+
+// ── Test 6: Relay Payload Validation ──
+
+describe('Relay Payload Validation', () => {
+  it('validates action is in allowlist', () => {
+    const ALLOWED_RELAY_ACTIONS = new Set([
+      'claude-query', 'claude-task-query', 'cursor-query', 'codex-query',
+      'shell-exec', 'file-read', 'file-write', 'file-list',
+      'git-status', 'git-diff', 'git-log', 'git-branches',
+      'gitagent-parse', 'detect-agents',
+    ]);
+
+    function validateRelayPayload(action) {
+      if (!ALLOWED_RELAY_ACTIONS.has(action)) {
+        return { valid: false, reason: `Action "${action}" is not allowed` };
+      }
+      return { valid: true };
+    }
+
+    assert.equal(validateRelayPayload('claude-query').valid, true);
+    assert.equal(validateRelayPayload('shell-exec').valid, true);
+    assert.equal(validateRelayPayload('rm-rf-everything').valid, false, 'Unknown action blocked');
+    assert.equal(validateRelayPayload('').valid, false, 'Empty action blocked');
+  });
+});
+
+// ── Test 7: IP Pinning Security ──
+
+describe('IP Pinning Security', () => {
+  it('blocks relay connection from different IP when another is active', () => {
+    const relayConnections = new Map();
+
+    // User 1 connects from IP A
+    relayConnections.set(1, { ws: { readyState: 1 }, clientIp: '1.2.3.4', connectedAt: Date.now() });
+
+    // Same user tries from IP B
+    const existing = relayConnections.get(1);
+    const newIp = '5.6.7.8';
+    const blocked = existing && existing.ws.readyState === 1 && existing.clientIp !== newIp;
+
+    assert.equal(blocked, true, 'Second connection from different IP is blocked');
+  });
+
+  it('allows reconnection from same IP', () => {
+    const relayConnections = new Map();
+    relayConnections.set(1, { ws: { readyState: 1 }, clientIp: '1.2.3.4' });
+
+    const existing = relayConnections.get(1);
+    const sameIp = '1.2.3.4';
+    const blocked = existing && existing.ws.readyState === 1 && existing.clientIp !== sameIp;
+
+    assert.equal(blocked, false, 'Reconnection from same IP is allowed');
+  });
+
+  it('allows new connection when previous relay is disconnected', () => {
+    const relayConnections = new Map();
+    relayConnections.set(1, { ws: { readyState: 3 }, clientIp: '1.2.3.4' }); // disconnected
+
+    const existing = relayConnections.get(1);
+    const newIp = '5.6.7.8';
+    const blocked = existing && existing.ws.readyState === 1 && existing.clientIp !== newIp;
+
+    assert.equal(blocked, false, 'New connection allowed when previous relay is disconnected');
+  });
+});
+
+// ── Test 8: Dashboard Stats Cache ──
+
+describe('Dashboard Stats Cache', () => {
+  it('cache returns fresh data within TTL', () => {
+    const cache = new Map();
+    const CACHE_TTL = 60_000;
+
+    function getCachedStats(userId) {
+      const entry = cache.get(userId);
+      if (entry && Date.now() - entry.ts < CACHE_TTL) return entry.data;
+      return null;
+    }
+
+    function setCachedStats(userId, data) {
+      cache.set(userId, { data, ts: Date.now() });
+    }
+
+    // Set cache
+    const testData = { account: { username: 'testuser' } };
+    setCachedStats(1, testData);
+
+    // Immediately retrieve — should hit
+    const cached = getCachedStats(1);
+    assert.deepEqual(cached, testData, 'Cache hit returns data');
+
+    // Different user — should miss
+    const otherUser = getCachedStats(2);
+    assert.equal(otherUser, null, 'Different user has no cache');
+  });
+
+  it('cache invalidation clears entry for specific user', () => {
+    const cache = new Map();
+
+    cache.set(1, { data: { user: 'A' }, ts: Date.now() });
+    cache.set(2, { data: { user: 'B' }, ts: Date.now() });
+
+    // Invalidate user 1 only
+    cache.delete(1);
+
+    assert.equal(cache.has(1), false, 'User 1 cache invalidated');
+    assert.equal(cache.has(2), true, 'User 2 cache unaffected');
+  });
+});
+
+// ── Test 9: Frontend SessionStorage Stale-While-Revalidate ──
+
+describe('Stale-While-Revalidate Pattern', () => {
+  it('shows cached data immediately then updates with fresh data', () => {
+    // Simulate sessionStorage
+    const storage = {};
+    const setItem = (k, v) => { storage[k] = v; };
+    const getItem = (k) => storage[k] || null;
+
+    // Initial state — no cache
+    let stats = null;
+    let loading = true;
+
+    const cached = getItem('dash_stats');
+    assert.equal(cached, null, 'No cache initially');
+    assert.equal(loading, true, 'Loading state true initially');
+
+    // Simulate first load — data comes from server
+    const serverData = { account: { username: 'user1' }, apiKeys: { keys: [] } };
+    stats = serverData;
+    loading = false;
+    setItem('dash_stats', JSON.stringify(serverData));
+
+    assert.equal(loading, false);
+    assert.deepEqual(stats, serverData);
+
+    // Simulate second page load — cache hit
+    stats = null;
+    loading = true;
+
+    const cachedStr = getItem('dash_stats');
+    if (cachedStr) {
+      stats = JSON.parse(cachedStr);
+      loading = false; // Show cached data immediately
+    }
+
+    assert.equal(loading, false, 'Loading resolved immediately from cache');
+    assert.deepEqual(stats.account.username, 'user1', 'Cached data shown immediately');
+  });
+});
+
+// ── Test 10: Multi-User Chat Isolation (End-to-End) ──
+
+describe('Multi-User Chat Isolation (E2E)', () => {
+  it('two users sending commands simultaneously route to correct relays', () => {
+    const relayConnections = new Map();
+    const relayReceived = { user1: [], user2: [] };
+
+    relayConnections.set(1, {
+      ws: { readyState: 1, send: (msg) => relayReceived.user1.push(JSON.parse(msg)) }
+    });
+    relayConnections.set(2, {
+      ws: { readyState: 1, send: (msg) => relayReceived.user2.push(JSON.parse(msg)) }
+    });
+
+    // User 1 sends a claude-command
+    function routeToRelay(userId, action, command) {
+      const relay = relayConnections.get(userId);
+      if (!relay || relay.ws.readyState !== 1) throw new Error('No relay');
+      relay.ws.send(JSON.stringify({ type: 'relay-command', action, command }));
+    }
+
+    routeToRelay(1, 'claude-query', 'Hey, I am user 1');
+    routeToRelay(2, 'claude-query', 'Hey, I am user 2');
+    routeToRelay(1, 'claude-query', 'Second message from user 1');
+
+    assert.equal(relayReceived.user1.length, 2, 'User 1 relay received 2 commands');
+    assert.equal(relayReceived.user2.length, 1, 'User 2 relay received 1 command');
+    assert.equal(relayReceived.user1[0].command, 'Hey, I am user 1');
+    assert.equal(relayReceived.user2[0].command, 'Hey, I am user 2');
+    assert.equal(relayReceived.user1[1].command, 'Second message from user 1');
+  });
+
+  it('streaming responses go back to the correct frontend client', () => {
+    // Simulate pending relay requests with different userIds
+    const pendingRelayRequests = new Map();
+    const frontendReceived = { user1: [], user2: [] };
+
+    const writer1 = { send: (msg) => frontendReceived.user1.push(msg) };
+    const writer2 = { send: (msg) => frontendReceived.user2.push(msg) };
+
+    pendingRelayRequests.set('req-1', {
+      userId: 1,
+      onStream: (data) => {
+        if (data.type === 'claude-response') {
+          writer1.send({ type: 'claude-response', data: { type: 'content_block_delta', delta: { text: data.content } } });
+        }
+      }
+    });
+    pendingRelayRequests.set('req-2', {
+      userId: 2,
+      onStream: (data) => {
+        if (data.type === 'claude-response') {
+          writer2.send({ type: 'claude-response', data: { type: 'content_block_delta', delta: { text: data.content } } });
+        }
+      }
+    });
+
+    // Relay stream for user 1
+    const pending1 = pendingRelayRequests.get('req-1');
+    pending1.onStream({ type: 'claude-response', content: 'Hello user 1!' });
+
+    // Relay stream for user 2
+    const pending2 = pendingRelayRequests.get('req-2');
+    pending2.onStream({ type: 'claude-response', content: 'Hello user 2!' });
+
+    assert.equal(frontendReceived.user1.length, 1);
+    assert.equal(frontendReceived.user2.length, 1);
+    assert.equal(frontendReceived.user1[0].data.delta.text, 'Hello user 1!');
+    assert.equal(frontendReceived.user2[0].data.delta.text, 'Hello user 2!');
+  });
+});