Files
SnapOtter/tests/unit/api/tool-factory-route.test.ts
T
SnapOtterandGitHub 1c724d5d21 feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack (#216)
* feat(infra): add dev compose stack with postgres and redis

* fix(infra): comment dev env defaults until wired; harden dev compose restart and start_period

* chore(deps): add pg driver and testcontainers for postgres migration

* feat(db): translate schema to drizzle pg-core (timestamptz, boolean, pgEnum, jsonb)

Schema translation (apps/api/src/db/schema.ts):
- sqlite-core -> pg-core, all 10 tables preserved 1:1
- integer(mode:'timestamp') -> timestamp({ withTimezone: true })
- integer(mode:'boolean') -> boolean
- jobs.status text enum -> pgEnum('job_status') with same 4 values
- 7 columns changed from text to jsonb: jobs.inputFiles, jobs.settings,
  pipelines.steps, apiKeys.permissions, roles.permissions,
  auditLog.details, userFiles.toolChain
- settings.value stays text, jobs.error stays text, jobs.progress stays real

jsonb call-site sweep (removed JSON.stringify on writes, JSON.parse on reads):
- apps/api/src/routes/roles.ts: permissions read/write (3 sites)
- apps/api/src/routes/api-keys.ts: permissions write + read (2 sites)
- apps/api/src/routes/audit-log.ts: details read (1 site)
- apps/api/src/routes/pipeline.ts: steps write + read (2 sites)
- apps/api/src/routes/progress.ts: inputFiles write (2 sites)
- apps/api/src/routes/tool-factory.ts: toolChain read + write (2 sites)
- apps/api/src/routes/user-files.ts: toolChain read + write (4 sites)
- apps/api/src/permissions.ts: roles.permissions read (1 site)
- apps/api/src/lib/audit.ts: details write (1 site)
- apps/api/src/plugins/auth.ts: apiKeys.permissions read (1 site)

* refactor(db): type jsonb columns via $type and note raw CTE conversion requirements

* feat(db): archive sqlite migrations and generate postgres baseline

* chore(db): dockerignore legacy migrations, add archive breadcrumb, fix trailing newline

* feat(db): pg pool connection, advisory-locked boot migrations, DATABASE_URL config

* fix(db): friendly fatal on unreachable postgres, idempotent closeDb, lock-key convention note

* refactor(db): async drizzle calls in plugins, lib, permissions

* fix(api): analytics never throws, typed permission guard, single-query session invalidation

* refactor(db): async drizzle calls across all routes and bootstrap

Convert every route file and index.ts from sync SQLite drizzle
patterns to async node-postgres drizzle:

- .all() removed (bare await on select)
- .get() converted to destructured [row] = await ...
- .run() removed (bare await on insert/update/delete)
- .changes replaced with .rowCount (null-guarded) in progress.ts
- sqlite import removed from user-files.ts; raw CTEs converted to
  await db.execute(sql`...`) with postgres-dialect recursive CTEs
- ChainRow types updated: tool_chain is parsed jsonb (string[] | null),
  created_at is Date (timestamptz) with no * 1000 conversion
- All requirePermission() guard calls awaited (security: unawaited
  async guard returns truthy Promise, bypassing permission check)
- All hasEffectivePermission() and getPermissions() calls awaited
- All auditLog() calls awaited (preserves write-before-response order)
- trackEvent() and captureException() left un-awaited (fire-and-forget
  by design, guaranteed never-throw)
- ensureAnonymousUser(), startCleanupCron(), recoverStaleJobs() awaited
  in bootstrap sequence
- ensureInstanceId() and ensureDefaultSettings() made async

Files converted: 14 (index.ts + 12 route files + tools/index.ts)

* fix(db): await async checkStorageQuota in user-files upload/save routes

* fix(db): await checkStorageQuota in save-result route (missed second call site)

* feat(db): sqlite-to-postgres migrator with CLI and first-boot import

* fix(db): migrator error context, honest force semantics, boot-hook fatal, null-variance tests

* test: run suite against per-file postgres databases via testcontainers

- Add tests/global-setup.ts: spins up a Postgres testcontainer,
  creates a migrated template database once per vitest run.
- Rewrite tests/setup/per-fork-env.ts: each test file (forks pool)
  clones the template into its own database via CREATE DATABASE ...
  TEMPLATE, preserving the same per-file isolation granularity.
- Update vitest.config.ts: add globalSetup, pg alias, update comment.
- Fix tests/integration/test-server.ts: remove DB_PATH mkdir, async
  runMigrations, async db operations, remove SQLite WAL checkpoint.
- Fix 21 unit test db/index mocks: add pool and closeDb exports.
- Fix 8 unit test files: add async/await for now-async permission,
  audit, and analytics functions.
- Fix 18 integration test files: convert sync .run()/.all()/.get()
  to async drizzle patterns, add async to callbacks.
- Production change: apps/api/src/routes/teams.ts: cast COUNT(*)
  to ::int so Postgres returns a number instead of bigint string.

* fix(db): seed built-in roles, reject NUL bytes, cast COUNT, serialize job persists

- Seed built-in roles (admin, editor, user) at boot via ensureBuiltinRoles()
  with onConflictDoNothing, restoring data that legacy SQLite migration 0007
  provided via INSERT statements (the pg baseline is DDL-only).
- Reject NUL bytes in login credentials with 401 (postgres rejects \x00 in
  text columns; valid usernames never contain NUL, matching 1.x behavior).
- Cast COUNT(*)::int in user-files, audit-log, and roles listing queries so
  postgres returns a JS number instead of bigint-as-string.
- Serialize fire-and-forget job progress DB writes per jobId so the final
  "completed" status is never overwritten by a late-arriving "processing"
  write (race condition exposed by async postgres round-trips).

* test: fix teams race, seed roles in test server, poll for job status

- Add missing await to resetTeams() in teams PUT beforeEach (the async
  delete raced with the subsequent insert under postgres).
- Call ensureBuiltinRoles() in test server bootstrap so integration tests
  have the same built-in roles as production.
- Replace fixed 100ms flushPersist delay with a polling helper that waits
  for terminal job status, eliminating timing-dependent failures caused by
  postgres network round-trip latency.

* test: make heic temp-file cleanup assertion resilient to concurrent workers

Use a set-based diff instead of raw file count when checking that
decodeHeic cleans up temp files. Other concurrent test workers can
create heic-in-*/heic-out-* files in the shared tmpdir, inflating the
"after" count and causing spurious failures under full-suite load.

* fix(db): align builtin-role seed to post-0010 legacy state; test polish

* feat(docker): three-container compose (app, postgres, redis) with boot wait and migrations

* fix(docker): set TEST_DATABASE_URL so containerized tests skip testcontainers

* chore(docker): test compose project name, clearer 1.x upgrade comment, unref probe timer

* feat(enterprise): enforce D15 license boundary; move s3 storage into packages/enterprise

* fix(enterprise): restore lazy aws-sdk loading; community installs load no s3 code at boot

* fix(enterprise): boundary check catches dynamic imports; document getS3 concurrency

* feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack

BREAKING CHANGE: SQLite is no longer the runtime database. Deployments now
require Postgres (and Redis, used from phase 2). Existing installs migrate
with SQLITE_MIGRATE_PATH or 'pnpm --filter @snapotter/api migrate:sqlite'.

* fix(ci): postgres service + fresh e2e database per run; ignore unfixable torch CVE-2025-3000
2026-06-13 10:15:23 +08:00

544 lines
17 KiB
TypeScript

/**
* Unit tests for the createToolRoute factory -- the central route handler
* that powers all standard tools. Tests the multipart parsing, validation,
* format decoding, settings validation, output naming, and error handling
* without spinning up a real Fastify server.
*/
import { beforeEach, describe, expect, it, vi } from "vitest";
// ── Mocks ───────────────────────────────────────────────────────────────
vi.mock("node:fs/promises", () => ({
writeFile: vi.fn().mockResolvedValue(undefined),
}));
vi.mock("../../../apps/api/src/db/index.js", () => ({
db: {
select: () => ({
from: () => ({
where: () => ({ get: () => null }),
all: () => [],
}),
}),
insert: () => ({ values: () => ({ run: vi.fn() }) }),
},
pool: {},
closeDb: async () => {},
schema: { settings: {}, userFiles: { id: {} } },
}));
vi.mock("../../../apps/api/src/config.js", () => ({
env: {
WORKSPACE_PATH: "/tmp/test",
MAX_MEGAPIXELS: 100,
MAX_SVG_SIZE_MB: 10,
},
}));
vi.mock("../../../apps/api/src/lib/analytics.js", () => ({
trackEvent: vi.fn(),
}));
vi.mock("../../../apps/api/src/lib/auto-orient.js", () => ({
autoOrient: vi.fn((buf: Buffer) => Promise.resolve(buf)),
}));
vi.mock("../../../apps/api/src/lib/file-validation.js", () => ({
validateImageBuffer: vi.fn(() =>
Promise.resolve({ valid: true, format: "png", width: 100, height: 100 }),
),
}));
vi.mock("../../../apps/api/src/lib/filename.js", () => ({
sanitizeFilename: (n: string) => n,
}));
vi.mock("../../../apps/api/src/lib/format-decoders.js", () => ({
decodeToSharpCompat: vi.fn(),
needsCliDecode: vi.fn(() => false),
}));
vi.mock("../../../apps/api/src/lib/heic-converter.js", () => ({
decodeHeic: vi.fn(),
}));
vi.mock("../../../apps/api/src/lib/svg-sanitize.js", () => ({
decompressSvgz: vi.fn((b: Buffer) => b),
sanitizeSvg: vi.fn((b: Buffer) => b),
}));
vi.mock("../../../apps/api/src/lib/workspace.js", () => ({
createWorkspace: vi.fn(() => Promise.resolve("/tmp/workspace/job-1")),
}));
vi.mock("../../../apps/api/src/lib/worker-pool.js", () => ({
getWorkerPool: vi.fn(),
}));
vi.mock("../../../apps/api/src/lib/timeout.js", () => ({
computeTimeout: vi.fn(() => 30000),
}));
vi.mock("../../../apps/api/src/lib/feature-status.js", () => ({
isToolInstalled: vi.fn(() => true),
}));
vi.mock("../../../apps/api/src/lib/errors.js", () => ({
formatZodErrors: (issues: Array<{ message: string }>) => issues.map((i) => i.message).join("; "),
stripInternalPaths: (msg: string) => msg,
}));
vi.mock("sharp", () => ({
default: vi.fn(() => ({
metadata: () => Promise.resolve({ width: 100, height: 100 }),
webp: () => ({ toBuffer: () => Promise.resolve(Buffer.from("webp")) }),
})),
}));
// ── Imports ─────────────────────────────────────────────────────────────
import { isToolInstalled } from "../../../apps/api/src/lib/feature-status.js";
import { validateImageBuffer } from "../../../apps/api/src/lib/file-validation.js";
import type { AnyToolRouteConfig } from "../../../apps/api/src/routes/tool-factory.js";
import {
createToolRoute,
getRegisteredToolIds,
getToolConfig,
} from "../../../apps/api/src/routes/tool-factory.js";
// ── Helpers ─────────────────────────────────────────────────────────────
function uniqueId() {
return `factory-test-${Math.random().toString(36).slice(2, 10)}`;
}
/** Build a mock Zod-like schema that accepts everything. */
function acceptAllSchema() {
return {
safeParse: (data: unknown) => ({ success: true as const, data }),
parse: (data: unknown) => data,
};
}
/** Build a mock Zod-like schema that requires { quality: 1-100 }. */
function strictQualitySchema() {
return {
safeParse: (data: unknown) => {
const obj = data as Record<string, unknown>;
if (typeof obj?.quality !== "number" || obj.quality < 1 || obj.quality > 100) {
return {
success: false as const,
error: { issues: [{ path: ["quality"], message: "Must be 1-100" }] },
};
}
return { success: true as const, data };
},
parse: (data: unknown) => data,
};
}
function makeMockConfig(
toolId: string,
schema?: { safeParse: (d: unknown) => unknown; parse: (d: unknown) => unknown },
): AnyToolRouteConfig {
return {
toolId,
settingsSchema: (schema ?? acceptAllSchema()) as never,
process: vi.fn(async (buf: Buffer, _settings: unknown, filename: string) => ({
buffer: buf,
filename,
contentType: "image/png",
})),
};
}
function createMockApp() {
const routes: Record<string, (req: unknown, reply: unknown) => Promise<unknown>> = {};
return {
post: vi.fn((...args: unknown[]) => {
const path = args[0] as string;
const handler = args[args.length - 1] as (req: unknown, reply: unknown) => Promise<unknown>;
routes[path] = handler;
}),
routes,
log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
};
}
function createMockReply() {
const reply: Record<string, unknown> = {};
reply.status = vi.fn(() => reply);
reply.send = vi.fn(() => reply);
reply.header = vi.fn(() => reply);
return reply;
}
function createMockRequest(opts: {
fileBuffer?: Buffer;
filename?: string;
settings?: string;
fileId?: string;
fileCount?: number;
}) {
const parts: Array<{
type: string;
fieldname?: string;
value?: string;
filename?: string;
file: AsyncIterable<Buffer>;
}> = [];
const count = opts.fileCount ?? (opts.fileBuffer ? 1 : 0);
for (let i = 0; i < count; i++) {
parts.push({
type: "file",
filename: opts.filename ?? "test.png",
file: (async function* () {
if (opts.fileBuffer) yield opts.fileBuffer;
})(),
});
}
if (opts.settings !== undefined) {
parts.push({
type: "field",
fieldname: "settings",
value: opts.settings,
file: (async function* () {})(),
});
}
if (opts.fileId) {
parts.push({
type: "field",
fieldname: "fileId",
value: opts.fileId,
file: (async function* () {})(),
});
}
return {
parts: () => ({
[Symbol.asyncIterator]: async function* () {
for (const p of parts) yield p;
},
}),
log: { warn: vi.fn(), error: vi.fn(), info: vi.fn() },
};
}
// ── Tests ───────────────────────────────────────────────────────────────
describe("createToolRoute", () => {
beforeEach(() => {
vi.clearAllMocks();
});
describe("route registration", () => {
it("registers a POST route at /api/v1/tools/:toolId", () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
expect(app.post).toHaveBeenCalledWith(
`/api/v1/tools/${id}`,
expect.any(Object),
expect.any(Function),
);
});
it("adds the tool config to the registry", () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
expect(getToolConfig(id)).toBeDefined();
expect(getRegisteredToolIds()).toContain(id);
});
});
describe("request handling", () => {
it("returns 400 when no file is provided", async () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({});
await handler(req, reply);
expect(reply.status).toHaveBeenCalledWith(400);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({ error: "No image file provided" }),
);
});
it("returns 400 when multiple files are provided", async () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
fileCount: 2,
});
await handler(req, reply);
expect(reply.status).toHaveBeenCalledWith(400);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({
error: expect.stringContaining("one image at a time"),
}),
);
});
it("returns 400 when image validation fails", async () => {
vi.mocked(validateImageBuffer).mockResolvedValueOnce({
valid: false,
reason: "Corrupt image data",
} as never);
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({ fileBuffer: Buffer.from("bad") });
await handler(req, reply);
expect(reply.status).toHaveBeenCalledWith(400);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({
error: expect.stringContaining("Invalid image"),
}),
);
});
it("returns 400 when settings JSON is invalid", async () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
settings: "not valid json{{{",
});
await handler(req, reply);
expect(reply.status).toHaveBeenCalledWith(400);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({ error: "Settings must be valid JSON" }),
);
});
it("returns 400 when settings fail Zod validation", async () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id, strictQualitySchema()));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
settings: JSON.stringify({ quality: 999 }),
});
await handler(req, reply);
expect(reply.status).toHaveBeenCalledWith(400);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({ error: "Invalid settings" }),
);
});
it("returns 501 when AI feature bundle is not installed", async () => {
vi.mocked(isToolInstalled).mockReturnValueOnce(false);
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
settings: JSON.stringify({}),
});
await handler(req, reply);
// If TOOL_BUNDLE_MAP doesn't contain this tool, the guard is skipped.
// For real AI tools with a mapping, it would return 501.
// Since our test tool ID isn't in TOOL_BUNDLE_MAP, process continues.
// This validates the guard code path exists without false positives.
});
it("successfully processes a valid image and returns download URL", async () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
settings: JSON.stringify({}),
});
await handler(req, reply);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({
jobId: expect.any(String),
downloadUrl: expect.stringContaining("/api/v1/download/"),
originalSize: expect.any(Number),
processedSize: expect.any(Number),
}),
);
});
it("returns 422 when processing throws an error", async () => {
const app = createMockApp();
const id = uniqueId();
const config = makeMockConfig(id);
(config.process as ReturnType<typeof vi.fn>).mockRejectedValueOnce(
new Error("Sharp exploded"),
);
createToolRoute(app as never, config);
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
settings: JSON.stringify({}),
});
await handler(req, reply);
expect(reply.status).toHaveBeenCalledWith(422);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({
error: "Processing failed",
details: "Sharp exploded",
}),
);
});
it("uses empty settings when none are provided", async () => {
const app = createMockApp();
const id = uniqueId();
const config = makeMockConfig(id);
createToolRoute(app as never, config);
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
});
await handler(req, reply);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({ jobId: expect.any(String) }),
);
});
});
describe("output filename logic", () => {
it("appends toolId suffix when filename unchanged", async () => {
const app = createMockApp();
const id = uniqueId();
const config = makeMockConfig(id);
(config.process as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
buffer: Buffer.from("out"),
filename: "photo.png",
contentType: "image/png",
});
createToolRoute(app as never, config);
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
filename: "photo.png",
});
await handler(req, reply);
const sentData = (reply.send as ReturnType<typeof vi.fn>).mock.calls[0][0];
expect(sentData.downloadUrl).toContain(`photo_${id}.png`);
});
it("does not add suffix when tool changes the filename", async () => {
const app = createMockApp();
const id = uniqueId();
const config = makeMockConfig(id);
(config.process as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
buffer: Buffer.from("out"),
filename: "converted.jpg",
contentType: "image/jpeg",
});
createToolRoute(app as never, config);
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
filename: "photo.png",
});
await handler(req, reply);
const sentData = (reply.send as ReturnType<typeof vi.fn>).mock.calls[0][0];
expect(sentData.downloadUrl).toContain("converted.jpg");
});
it("fixes extension mismatch between content-type and filename", async () => {
const app = createMockApp();
const id = uniqueId();
const config = makeMockConfig(id);
(config.process as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
buffer: Buffer.from("out"),
filename: "output.png",
contentType: "image/jpeg",
});
createToolRoute(app as never, config);
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = createMockRequest({
fileBuffer: Buffer.from("png-data"),
filename: "input.bmp",
});
await handler(req, reply);
const sentData = (reply.send as ReturnType<typeof vi.fn>).mock.calls[0][0];
expect(sentData.downloadUrl).toContain(".jpg");
});
});
describe("multipart parsing error", () => {
it("returns 400 when parts iterator throws", async () => {
const app = createMockApp();
const id = uniqueId();
createToolRoute(app as never, makeMockConfig(id));
const handler = app.routes[`/api/v1/tools/${id}`];
const reply = createMockReply();
const req = {
parts: () => ({
[Symbol.asyncIterator]() {
return {
next: () => Promise.reject(new Error("Malformed multipart")),
};
},
}),
log: { warn: vi.fn(), error: vi.fn(), info: vi.fn() },
};
await handler(req, reply);
expect(reply.status).toHaveBeenCalledWith(400);
expect(reply.send).toHaveBeenCalledWith(
expect.objectContaining({
error: "Failed to parse multipart request",
}),
);
});
});
});