mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
test: coverage campaign and mutation testing across five packages (#628)
Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.
This commit is contained in:
SnapOtter
@@ -5,6 +5,7 @@
|
||||
* single steps, invalid tools, conflicting steps, and multi-step chains.
|
||||
*/
|
||||
|
||||
import { qpdfAvailable } from "@snapotter/doc-engine";
|
||||
import { ffmpegAvailable } from "@snapotter/media-engine";
|
||||
import { afterAll, beforeAll, describe, expect, it } from "vitest";
|
||||
import { fixtures, readFixture } from "../../fixtures/index.js";
|
||||
@@ -20,6 +21,12 @@ import {
|
||||
// ---------------------------------------------------------------------------
|
||||
const PNG_200x150 = readFixture(fixtures.image.base.png200);
|
||||
const TINY_MP4 = readFixture(fixtures.video.tiny("mp4"));
|
||||
const GARBAGE_IMAGE = readFixture(fixtures.image.hostile.garbage);
|
||||
const SVG_100 = readFixture(fixtures.image.base.svg100);
|
||||
const HEIC_200 = readFixture(fixtures.image.base.heic200);
|
||||
const PSD_SAMPLE = readFixture(fixtures.image.formats("psd"));
|
||||
const PDF_2PAGE = readFixture(fixtures.document.pdf2);
|
||||
const GARBAGE_PDF = readFixture(fixtures.document.hostile.garbagePdf);
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Shared state
|
||||
@@ -56,6 +63,34 @@ function executePipeline(
|
||||
});
|
||||
}
|
||||
|
||||
/** Helper to POST a pipeline batch request with several files. */
|
||||
function executeBatch(
|
||||
files: Array<{ filename: string; content: Buffer }>,
|
||||
pipeline: { steps: Array<{ toolId: string; settings?: Record<string, unknown> }> },
|
||||
) {
|
||||
const { body, contentType } = createMultipartPayload([
|
||||
...files.map((f) => ({
|
||||
name: "file",
|
||||
filename: f.filename,
|
||||
content: f.content,
|
||||
contentType: "application/octet-stream",
|
||||
})),
|
||||
{ name: "pipeline", content: JSON.stringify(pipeline) },
|
||||
]);
|
||||
return app.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/pipeline/batch",
|
||||
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
||||
body,
|
||||
});
|
||||
}
|
||||
|
||||
/** Decode the x-file-results header of a batch ZIP response. */
|
||||
function parseFileResults(res: { headers: Record<string, unknown> }): Record<string, string> {
|
||||
const raw = res.headers["x-file-results"] as string;
|
||||
return JSON.parse(decodeURIComponent(raw)) as Record<string, string>;
|
||||
}
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// EMPTY PIPELINE
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
@@ -839,3 +874,393 @@ describe.skipIf(!ffmpegAvailable())("Non-image pipeline (video)", () => {
|
||||
expect(dlRes.rawPayload.length).toBeGreaterThan(0);
|
||||
}, 60_000);
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// EXECUTE INGRESS PREPROCESSING (validate/decode/sanitize branches)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline execute ingress preprocessing", () => {
|
||||
it("rejects a garbage buffer with an invalid-image error", async () => {
|
||||
const res = await executePipeline(GARBAGE_IMAGE, "garbage.jpg", {
|
||||
steps: [{ toolId: "resize", settings: { width: 100 } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).error).toMatch(/invalid image/i);
|
||||
});
|
||||
|
||||
it("sanitizes SVG input at ingress before step validation runs", async () => {
|
||||
// The unknown second step rejects the pipeline AFTER preprocessing, so the
|
||||
// SVG sanitize path is exercised without a worker round-trip.
|
||||
const res = await executePipeline(SVG_100, "logo.svg", {
|
||||
steps: [
|
||||
{ toolId: "convert", settings: { format: "png" } },
|
||||
{ toolId: "tool-that-does-not-exist" },
|
||||
],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).error).toMatch(/step 2/i);
|
||||
});
|
||||
|
||||
it("decodes HEIC input at ingress, or reports a 422 decode failure", async () => {
|
||||
const res = await executePipeline(HEIC_200, "photo.heic", {
|
||||
steps: [
|
||||
{ toolId: "resize", settings: { width: 50 } },
|
||||
{ toolId: "tool-that-does-not-exist" },
|
||||
],
|
||||
});
|
||||
|
||||
// 400 means the HEIC was decoded and validation reached unknown step 2;
|
||||
// 422 means this environment has no heif decoder binary. Both are the
|
||||
// route's real contract for this input.
|
||||
expect([400, 422]).toContain(res.statusCode);
|
||||
const json = JSON.parse(res.body);
|
||||
if (res.statusCode === 400) {
|
||||
expect(json.error).toMatch(/step 2/i);
|
||||
} else {
|
||||
expect(json.error).toMatch(/heic/i);
|
||||
}
|
||||
});
|
||||
|
||||
it("routes PSD input through the CLI decoder at ingress", async () => {
|
||||
const res = await executePipeline(PSD_SAMPLE, "art.psd", {
|
||||
steps: [
|
||||
{ toolId: "resize", settings: { width: 50 } },
|
||||
{ toolId: "tool-that-does-not-exist" },
|
||||
],
|
||||
});
|
||||
|
||||
expect([400, 422]).toContain(res.statusCode);
|
||||
const json = JSON.parse(res.body);
|
||||
if (res.statusCode === 400) {
|
||||
expect(json.error).toMatch(/step 2/i);
|
||||
} else {
|
||||
expect(json.error).toMatch(/failed to decode psd/i);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// OCR STEP INGRESS GATING (quality resolution + image preparer)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline OCR step ingress gating", () => {
|
||||
it("prepares the image, then rejects Korean fast OCR as incompatible", async () => {
|
||||
const res = await executePipeline(PNG_200x150, "scan.png", {
|
||||
steps: [{ toolId: "ocr", settings: { quality: "fast", language: "ko" } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(501);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.code).toBe("FEATURE_INCOMPATIBLE");
|
||||
expect(json.feature).toBe("ocr");
|
||||
expect(json.requestedQuality).toBe("fast");
|
||||
expect(typeof json.guidance).toBe("string");
|
||||
expect(json.error).toMatch(/incompatible/i);
|
||||
});
|
||||
|
||||
it("rejects best-quality OCR when no accurate runtime is active", async () => {
|
||||
const res = await executePipeline(PNG_200x150, "scan.png", {
|
||||
steps: [{ toolId: "ocr", settings: { quality: "best" } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(501);
|
||||
const json = JSON.parse(res.body);
|
||||
// Hosts without a published runtime report NOT_INSTALLED; hosts the
|
||||
// runtime does not target report INCOMPATIBLE. Both are 501 refusals.
|
||||
expect(["FEATURE_NOT_INSTALLED", "FEATURE_INCOMPATIBLE"]).toContain(json.code);
|
||||
expect(json.requestedQuality).toBe("best");
|
||||
expect(json.compatibilityReason).toBeDefined();
|
||||
});
|
||||
|
||||
it("rejects a garbage image through the OCR ingress preparer", async () => {
|
||||
const res = await executePipeline(GARBAGE_IMAGE, "scan.jpg", {
|
||||
steps: [{ toolId: "ocr", settings: { quality: "fast" } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).error).toMatch(/invalid image/i);
|
||||
});
|
||||
|
||||
it("rejects Korean fast OCR on the batch endpoint too", async () => {
|
||||
const res = await executeBatch([{ filename: "scan.png", content: PNG_200x150 }], {
|
||||
steps: [{ toolId: "ocr", settings: { quality: "fast", language: "ko" } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(501);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.code).toBe("FEATURE_INCOMPATIBLE");
|
||||
expect(typeof json.guidance).toBe("string");
|
||||
});
|
||||
|
||||
it("pre-fails garbage files during batch OCR ingress", async () => {
|
||||
const res = await executeBatch([{ filename: "junk.jpg", content: GARBAGE_IMAGE }], {
|
||||
steps: [{ toolId: "ocr", settings: { quality: "fast" } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(422);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.error).toMatch(/all files failed/i);
|
||||
expect(json.errors).toHaveLength(1);
|
||||
expect(json.errors[0].filename).toBe("junk.jpg");
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// AI STEP BUNDLE GATING (mandatory bundle not installed)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline AI step bundle gating", () => {
|
||||
it("rejects execute when a step needs an AI bundle that is not installed", async () => {
|
||||
const res = await executePipeline(PNG_200x150, "photo.png", {
|
||||
steps: [
|
||||
{ toolId: "resize", settings: { width: 100 } },
|
||||
{ toolId: "remove-background", settings: {} },
|
||||
],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(501);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.code).toBe("FEATURE_NOT_INSTALLED");
|
||||
expect(json.feature).toBe("background-removal");
|
||||
expect(json.error).toMatch(/step 2/i);
|
||||
expect(json.error).toMatch(/not installed/i);
|
||||
});
|
||||
|
||||
it("rejects batch when a step needs an AI bundle that is not installed", async () => {
|
||||
const res = await executeBatch([{ filename: "photo.png", content: PNG_200x150 }], {
|
||||
steps: [{ toolId: "remove-background", settings: {} }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(501);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.code).toBe("FEATURE_NOT_INSTALLED");
|
||||
expect(json.feature).toBe("background-removal");
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// PER-STEP OUTPUT PIXEL LIMIT
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline per-step output pixel limit", () => {
|
||||
// Default MAX_PIPELINE_STEP_PIXELS is 64 MP; 9000x9000 is 81 MP.
|
||||
it("rejects an execute step whose output dimensions exceed the pixel cap", async () => {
|
||||
const res = await executePipeline(PNG_200x150, "big.png", {
|
||||
steps: [{ toolId: "resize", settings: { width: 9000, height: 9000 } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).error).toMatch(/pixel limit/i);
|
||||
});
|
||||
|
||||
it("rejects a batch step whose output dimensions exceed the pixel cap", async () => {
|
||||
const res = await executeBatch([{ filename: "big.png", content: PNG_200x150 }], {
|
||||
steps: [{ toolId: "resize", settings: { width: 9000, height: 9000 } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).error).toMatch(/pixel limit/i);
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// EXECUTE WITH clientJobId (progress reporting branch)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline execute with clientJobId", () => {
|
||||
it("accepts a clientJobId and completes the pipeline", async () => {
|
||||
const { body, contentType } = createMultipartPayload([
|
||||
{ name: "file", filename: "cid.png", content: PNG_200x150, contentType: "image/png" },
|
||||
{
|
||||
name: "pipeline",
|
||||
content: JSON.stringify({ steps: [{ toolId: "resize", settings: { width: 60 } }] }),
|
||||
},
|
||||
{ name: "clientJobId", content: "pipeline-exec-client-id-1" },
|
||||
]);
|
||||
|
||||
const res = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/pipeline/execute",
|
||||
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
||||
body,
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.stepsCompleted).toBe(1);
|
||||
expect(json.jobId).toBeDefined();
|
||||
expect(json.downloadUrl).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// DETERMINISTIC RUNTIME STEP FAILURE (json-xml on malformed JSON)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline deterministic runtime step failure", () => {
|
||||
it("returns 422 with completedSteps when the only step fails in the worker", async () => {
|
||||
const { body, contentType } = createMultipartPayload([
|
||||
{
|
||||
name: "file",
|
||||
filename: "broken.json",
|
||||
content: Buffer.from("{ definitely not json"),
|
||||
contentType: "application/json",
|
||||
},
|
||||
{
|
||||
name: "pipeline",
|
||||
content: JSON.stringify({ steps: [{ toolId: "json-xml", settings: {} }] }),
|
||||
},
|
||||
]);
|
||||
|
||||
const res = await app.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/pipeline/execute",
|
||||
headers: { "content-type": contentType, authorization: `Bearer ${adminToken}` },
|
||||
body,
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(422);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.error).toMatch(/step 1/i);
|
||||
expect(json.error).toMatch(/json/i);
|
||||
expect(Array.isArray(json.completedSteps)).toBe(true);
|
||||
expect(json.completedSteps).toHaveLength(0);
|
||||
}, 30_000);
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// BATCH INGRESS PREPROCESSING (per-file validate/decode/sanitize)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline batch ingress preprocessing", () => {
|
||||
it("skips invalid images as pre-failures and zips the valid ones", async () => {
|
||||
const res = await executeBatch(
|
||||
[
|
||||
{ filename: "broken.jpg", content: GARBAGE_IMAGE },
|
||||
{ filename: "keeper.png", content: PNG_200x150 },
|
||||
],
|
||||
{ steps: [{ toolId: "resize", settings: { width: 50 } }] },
|
||||
);
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.headers["content-type"]).toBe("application/zip");
|
||||
const fileResults = parseFileResults(res);
|
||||
expect(fileResults["0"]).toBeUndefined();
|
||||
expect(fileResults["1"]).toBe("keeper_resize.png");
|
||||
}, 30_000);
|
||||
|
||||
it("sanitizes and converts an SVG through the batch pipeline", async () => {
|
||||
const res = await executeBatch([{ filename: "logo.svg", content: SVG_100 }], {
|
||||
steps: [{ toolId: "convert", settings: { format: "png" } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const fileResults = parseFileResults(res);
|
||||
expect(fileResults["0"]).toMatch(/\.png$/);
|
||||
}, 30_000);
|
||||
|
||||
it("handles HEIC batch input via decode or pre-failure without failing the batch", async () => {
|
||||
const res = await executeBatch(
|
||||
[
|
||||
{ filename: "photo.heic", content: HEIC_200 },
|
||||
{ filename: "keeper.png", content: PNG_200x150 },
|
||||
],
|
||||
{ steps: [{ toolId: "resize", settings: { width: 50 } }] },
|
||||
);
|
||||
|
||||
// The PNG always succeeds, so the batch returns a ZIP whether or not this
|
||||
// environment can decode HEIC.
|
||||
expect(res.statusCode).toBe(200);
|
||||
const fileResults = parseFileResults(res);
|
||||
expect(fileResults["1"]).toBe("keeper_resize.png");
|
||||
}, 30_000);
|
||||
|
||||
it("routes PSD batch input through the CLI decoder without failing the batch", async () => {
|
||||
const res = await executeBatch(
|
||||
[
|
||||
{ filename: "sample.psd", content: PSD_SAMPLE },
|
||||
{ filename: "keeper.png", content: PNG_200x150 },
|
||||
],
|
||||
{ steps: [{ toolId: "resize", settings: { width: 50 } }] },
|
||||
);
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const fileResults = parseFileResults(res);
|
||||
expect(fileResults["1"]).toBe("keeper_resize.png");
|
||||
}, 30_000);
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// BATCH DOCUMENT MODALITY (per-file document handler validation)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe.skipIf(!qpdfAvailable())("Pipeline batch document modality", () => {
|
||||
it("validates PDFs via the document handler and pre-fails garbage", async () => {
|
||||
const res = await executeBatch(
|
||||
[
|
||||
{ filename: "broken.pdf", content: GARBAGE_PDF },
|
||||
{ filename: "alt.pdf", content: PDF_2PAGE },
|
||||
],
|
||||
{ steps: [{ toolId: "rotate-pdf", settings: { angle: 90, range: "1-z" } }] },
|
||||
);
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.headers["content-type"]).toBe("application/zip");
|
||||
const fileResults = parseFileResults(res);
|
||||
expect(fileResults["0"]).toBeUndefined();
|
||||
expect(fileResults["1"]).toMatch(/\.pdf$/);
|
||||
}, 30_000);
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// BATCH RUNTIME FAILURES AND OUTPUT NAME DEDUPLICATION
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline batch runtime failures and name dedupe", () => {
|
||||
it("returns 422 when every file fails during processing", async () => {
|
||||
const res = await executeBatch(
|
||||
[
|
||||
{ filename: "bad1.json", content: Buffer.from("{ nope") },
|
||||
{ filename: "bad2.json", content: Buffer.from("not json at all") },
|
||||
],
|
||||
{ steps: [{ toolId: "json-xml", settings: {} }] },
|
||||
);
|
||||
|
||||
expect(res.statusCode).toBe(422);
|
||||
const json = JSON.parse(res.body);
|
||||
expect(json.error).toMatch(/all files failed/i);
|
||||
expect(json.errors).toHaveLength(2);
|
||||
expect(json.errors[0].error).toMatch(/json/i);
|
||||
expect(json.errors[1].error).toMatch(/json/i);
|
||||
}, 30_000);
|
||||
|
||||
it("deduplicates duplicate output filenames in the ZIP manifest", async () => {
|
||||
const res = await executeBatch(
|
||||
[
|
||||
{ filename: "dup.png", content: PNG_200x150 },
|
||||
{ filename: "dup.png", content: PNG_200x150 },
|
||||
],
|
||||
{ steps: [{ toolId: "resize", settings: { width: 50 } }] },
|
||||
);
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
const fileResults = parseFileResults(res);
|
||||
expect(fileResults["0"]).toBe("dup_resize.png");
|
||||
expect(fileResults["1"]).toBe("dup_resize_1.png");
|
||||
}, 30_000);
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// BATCH SIZE LIMIT
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Pipeline batch size limit", () => {
|
||||
it("rejects a batch larger than MAX_BATCH_SIZE", async () => {
|
||||
// Vitest env pins MAX_BATCH_SIZE=10; send 11 files.
|
||||
const files = Array.from({ length: 11 }, (_, i) => ({
|
||||
filename: `f${i}.png`,
|
||||
content: PNG_200x150,
|
||||
}));
|
||||
|
||||
const res = await executeBatch(files, {
|
||||
steps: [{ toolId: "resize", settings: { width: 50 } }],
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(400);
|
||||
// The multipart parser enforces the file-count limit and rejects before the
|
||||
// route's own "too many files" check, so accept either rejection message.
|
||||
expect(JSON.parse(res.body).error).toMatch(/too many files|failed to parse multipart/i);
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user