mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
* feat(infra): add dev compose stack with postgres and redis
* fix(infra): comment dev env defaults until wired; harden dev compose restart and start_period
* chore(deps): add pg driver and testcontainers for postgres migration
* feat(db): translate schema to drizzle pg-core (timestamptz, boolean, pgEnum, jsonb)
Schema translation (apps/api/src/db/schema.ts):
- sqlite-core -> pg-core, all 10 tables preserved 1:1
- integer(mode:'timestamp') -> timestamp({ withTimezone: true })
- integer(mode:'boolean') -> boolean
- jobs.status text enum -> pgEnum('job_status') with same 4 values
- 7 columns changed from text to jsonb: jobs.inputFiles, jobs.settings,
pipelines.steps, apiKeys.permissions, roles.permissions,
auditLog.details, userFiles.toolChain
- settings.value stays text, jobs.error stays text, jobs.progress stays real
jsonb call-site sweep (removed JSON.stringify on writes, JSON.parse on reads):
- apps/api/src/routes/roles.ts: permissions read/write (3 sites)
- apps/api/src/routes/api-keys.ts: permissions write + read (2 sites)
- apps/api/src/routes/audit-log.ts: details read (1 site)
- apps/api/src/routes/pipeline.ts: steps write + read (2 sites)
- apps/api/src/routes/progress.ts: inputFiles write (2 sites)
- apps/api/src/routes/tool-factory.ts: toolChain read + write (2 sites)
- apps/api/src/routes/user-files.ts: toolChain read + write (4 sites)
- apps/api/src/permissions.ts: roles.permissions read (1 site)
- apps/api/src/lib/audit.ts: details write (1 site)
- apps/api/src/plugins/auth.ts: apiKeys.permissions read (1 site)
* refactor(db): type jsonb columns via $type and note raw CTE conversion requirements
* feat(db): archive sqlite migrations and generate postgres baseline
* chore(db): dockerignore legacy migrations, add archive breadcrumb, fix trailing newline
* feat(db): pg pool connection, advisory-locked boot migrations, DATABASE_URL config
* fix(db): friendly fatal on unreachable postgres, idempotent closeDb, lock-key convention note
* refactor(db): async drizzle calls in plugins, lib, permissions
* fix(api): analytics never throws, typed permission guard, single-query session invalidation
* refactor(db): async drizzle calls across all routes and bootstrap
Convert every route file and index.ts from sync SQLite drizzle
patterns to async node-postgres drizzle:
- .all() removed (bare await on select)
- .get() converted to destructured [row] = await ...
- .run() removed (bare await on insert/update/delete)
- .changes replaced with .rowCount (null-guarded) in progress.ts
- sqlite import removed from user-files.ts; raw CTEs converted to
await db.execute(sql`...`) with postgres-dialect recursive CTEs
- ChainRow types updated: tool_chain is parsed jsonb (string[] | null),
created_at is Date (timestamptz) with no * 1000 conversion
- All requirePermission() guard calls awaited (security: unawaited
async guard returns truthy Promise, bypassing permission check)
- All hasEffectivePermission() and getPermissions() calls awaited
- All auditLog() calls awaited (preserves write-before-response order)
- trackEvent() and captureException() left un-awaited (fire-and-forget
by design, guaranteed never-throw)
- ensureAnonymousUser(), startCleanupCron(), recoverStaleJobs() awaited
in bootstrap sequence
- ensureInstanceId() and ensureDefaultSettings() made async
Files converted: 14 (index.ts + 12 route files + tools/index.ts)
* fix(db): await async checkStorageQuota in user-files upload/save routes
* fix(db): await checkStorageQuota in save-result route (missed second call site)
* feat(db): sqlite-to-postgres migrator with CLI and first-boot import
* fix(db): migrator error context, honest force semantics, boot-hook fatal, null-variance tests
* test: run suite against per-file postgres databases via testcontainers
- Add tests/global-setup.ts: spins up a Postgres testcontainer,
creates a migrated template database once per vitest run.
- Rewrite tests/setup/per-fork-env.ts: each test file (forks pool)
clones the template into its own database via CREATE DATABASE ...
TEMPLATE, preserving the same per-file isolation granularity.
- Update vitest.config.ts: add globalSetup, pg alias, update comment.
- Fix tests/integration/test-server.ts: remove DB_PATH mkdir, async
runMigrations, async db operations, remove SQLite WAL checkpoint.
- Fix 21 unit test db/index mocks: add pool and closeDb exports.
- Fix 8 unit test files: add async/await for now-async permission,
audit, and analytics functions.
- Fix 18 integration test files: convert sync .run()/.all()/.get()
to async drizzle patterns, add async to callbacks.
- Production change: apps/api/src/routes/teams.ts: cast COUNT(*)
to ::int so Postgres returns a number instead of bigint string.
* fix(db): seed built-in roles, reject NUL bytes, cast COUNT, serialize job persists
- Seed built-in roles (admin, editor, user) at boot via ensureBuiltinRoles()
with onConflictDoNothing, restoring data that legacy SQLite migration 0007
provided via INSERT statements (the pg baseline is DDL-only).
- Reject NUL bytes in login credentials with 401 (postgres rejects \x00 in
text columns; valid usernames never contain NUL, matching 1.x behavior).
- Cast COUNT(*)::int in user-files, audit-log, and roles listing queries so
postgres returns a JS number instead of bigint-as-string.
- Serialize fire-and-forget job progress DB writes per jobId so the final
"completed" status is never overwritten by a late-arriving "processing"
write (race condition exposed by async postgres round-trips).
* test: fix teams race, seed roles in test server, poll for job status
- Add missing await to resetTeams() in teams PUT beforeEach (the async
delete raced with the subsequent insert under postgres).
- Call ensureBuiltinRoles() in test server bootstrap so integration tests
have the same built-in roles as production.
- Replace fixed 100ms flushPersist delay with a polling helper that waits
for terminal job status, eliminating timing-dependent failures caused by
postgres network round-trip latency.
* test: make heic temp-file cleanup assertion resilient to concurrent workers
Use a set-based diff instead of raw file count when checking that
decodeHeic cleans up temp files. Other concurrent test workers can
create heic-in-*/heic-out-* files in the shared tmpdir, inflating the
"after" count and causing spurious failures under full-suite load.
* fix(db): align builtin-role seed to post-0010 legacy state; test polish
* feat(docker): three-container compose (app, postgres, redis) with boot wait and migrations
* fix(docker): set TEST_DATABASE_URL so containerized tests skip testcontainers
* chore(docker): test compose project name, clearer 1.x upgrade comment, unref probe timer
* feat(enterprise): enforce D15 license boundary; move s3 storage into packages/enterprise
* fix(enterprise): restore lazy aws-sdk loading; community installs load no s3 code at boot
* fix(enterprise): boundary check catches dynamic imports; document getS3 concurrency
* feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack
BREAKING CHANGE: SQLite is no longer the runtime database. Deployments now
require Postgres (and Redis, used from phase 2). Existing installs migrate
with SQLITE_MIGRATE_PATH or 'pnpm --filter @snapotter/api migrate:sqlite'.
* fix(ci): postgres service + fresh e2e database per run; ignore unfixable torch CVE-2025-3000
343 lines
11 KiB
TypeScript
343 lines
11 KiB
TypeScript
/**
|
|
* Unit tests for the docs route text generation functions.
|
|
*
|
|
* Tests the isPublic, generateLlmsTxt, and generateLlmsFullTxt helpers
|
|
* that produce llms.txt and llms-full.txt content from the OpenAPI spec.
|
|
*/
|
|
import { describe, expect, it, vi } from "vitest";
|
|
|
|
// ── Mocks ───────────────────────────────────────────────────────────────
|
|
|
|
vi.mock("../../../apps/api/src/db/index.js", () => ({
|
|
db: {},
|
|
pool: {},
|
|
closeDb: async () => {},
|
|
schema: {},
|
|
}));
|
|
|
|
// ── Reproduce helper functions and types from docs.ts ───────────────────
|
|
|
|
interface PathOperation {
|
|
tags?: string[];
|
|
summary?: string;
|
|
description?: string;
|
|
security?: Array<Record<string, string[]>>;
|
|
parameters?: Array<{ name: string; in: string; required?: boolean; schema?: { type: string } }>;
|
|
requestBody?: { content: Record<string, { schema?: SchemaObject }> };
|
|
responses?: Record<string, { description?: string }>;
|
|
}
|
|
|
|
interface SchemaObject {
|
|
type?: string;
|
|
properties?: Record<string, SchemaObject>;
|
|
required?: string[];
|
|
description?: string;
|
|
}
|
|
|
|
interface OpenAPISpec {
|
|
info: { title: string; version: string; description?: string };
|
|
tags?: Array<{ name: string; description?: string }>;
|
|
paths: Record<string, Record<string, PathOperation>>;
|
|
}
|
|
|
|
function isPublic(op: PathOperation): boolean {
|
|
return Array.isArray(op.security) && op.security.length === 0;
|
|
}
|
|
|
|
function generateLlmsTxt(spec: OpenAPISpec): string {
|
|
const lines: string[] = [];
|
|
lines.push(`# ${spec.info.title}`);
|
|
lines.push("");
|
|
lines.push(
|
|
"> Self-hosted image processing API with 50+ tools. Resize, compress, convert, remove backgrounds, upscale, run OCR, and more.",
|
|
);
|
|
lines.push("");
|
|
lines.push("## Docs");
|
|
lines.push("- [Interactive API Reference](/api/docs): Full interactive API documentation");
|
|
lines.push("- [OpenAPI Spec](/api/v1/openapi.yaml): OpenAPI 3.1 specification (YAML)");
|
|
lines.push(
|
|
"- [Full API Docs (LLM-friendly)](/llms-full.txt): Complete API documentation in plain text",
|
|
);
|
|
lines.push("");
|
|
lines.push("## API Sections");
|
|
|
|
for (const tag of spec.tags || []) {
|
|
const count = Object.values(spec.paths).reduce((n, methods) => {
|
|
return n + Object.values(methods).filter((op) => op.tags?.[0] === tag.name).length;
|
|
}, 0);
|
|
lines.push(`- ${tag.name} (${count} endpoints): ${tag.description || ""}`);
|
|
}
|
|
|
|
lines.push("");
|
|
lines.push("## Authentication");
|
|
lines.push("- Session token via `POST /api/auth/login` -> `Authorization: Bearer <token>`");
|
|
lines.push("- API key (prefixed `si_`) -> `Authorization: Bearer si_...`");
|
|
|
|
return lines.join("\n");
|
|
}
|
|
|
|
function generateLlmsFullTxt(spec: OpenAPISpec): string {
|
|
const lines: string[] = [];
|
|
lines.push(`# ${spec.info.title} v${spec.info.version}`);
|
|
lines.push("");
|
|
if (spec.info.description) {
|
|
lines.push(spec.info.description.trim());
|
|
lines.push("");
|
|
}
|
|
|
|
const tagGroups = new Map<string, Array<{ method: string; path: string; op: PathOperation }>>();
|
|
for (const [path, methods] of Object.entries(spec.paths)) {
|
|
for (const [method, op] of Object.entries(methods)) {
|
|
const tag = op.tags?.[0] || "Other";
|
|
if (!tagGroups.has(tag)) tagGroups.set(tag, []);
|
|
tagGroups.get(tag)?.push({ method: method.toUpperCase(), path, op });
|
|
}
|
|
}
|
|
|
|
const tagOrder = (spec.tags || []).map((t) => t.name);
|
|
const allTags = [...new Set([...tagOrder, ...tagGroups.keys()])];
|
|
|
|
for (const tag of allTags) {
|
|
const endpoints = tagGroups.get(tag);
|
|
if (!endpoints) continue;
|
|
|
|
const tagInfo = spec.tags?.find((t) => t.name === tag);
|
|
lines.push(`## ${tag}`);
|
|
if (tagInfo?.description) lines.push(`${tagInfo.description}`);
|
|
lines.push("");
|
|
|
|
for (const { method, path, op } of endpoints) {
|
|
const auth = isPublic(op) ? "(public)" : "(auth required)";
|
|
lines.push(`### ${method} ${path} ${auth}`);
|
|
if (op.summary) lines.push(`**${op.summary}**`);
|
|
if (op.description) lines.push(op.description.trim());
|
|
lines.push("");
|
|
|
|
if (op.parameters?.length) {
|
|
lines.push("**Parameters:**");
|
|
for (const p of op.parameters) {
|
|
lines.push(
|
|
`- \`${p.name}\` (${p.in}${p.required ? ", required" : ""}) — ${p.schema?.type || "string"}`,
|
|
);
|
|
}
|
|
lines.push("");
|
|
}
|
|
|
|
if (op.requestBody) {
|
|
const contentType = Object.keys(op.requestBody.content)[0];
|
|
const schema = op.requestBody.content[contentType]?.schema;
|
|
lines.push(`**Request:** \`${contentType}\``);
|
|
if (schema?.properties) {
|
|
for (const [name, prop] of Object.entries(schema.properties)) {
|
|
const required = schema.required?.includes(name) ? " (required)" : "";
|
|
const desc = prop.description ? ` — ${prop.description.split("\n")[0]}` : "";
|
|
lines.push(`- \`${name}\`${required}: ${prop.type || "string"}${desc}`);
|
|
}
|
|
}
|
|
lines.push("");
|
|
}
|
|
|
|
if (op.responses) {
|
|
lines.push("**Responses:**");
|
|
for (const [code, res] of Object.entries(op.responses)) {
|
|
lines.push(`- \`${code}\` — ${res.description || ""}`);
|
|
}
|
|
lines.push("");
|
|
}
|
|
}
|
|
}
|
|
|
|
return lines.join("\n");
|
|
}
|
|
|
|
// ── Tests ───────────────────────────────────────────────────────────────
|
|
|
|
describe("docs route logic", () => {
|
|
describe("isPublic", () => {
|
|
it("returns true for empty security array", () => {
|
|
expect(isPublic({ security: [] })).toBe(true);
|
|
});
|
|
|
|
it("returns false for non-empty security array", () => {
|
|
expect(isPublic({ security: [{ bearerAuth: [] }] })).toBe(false);
|
|
});
|
|
|
|
it("returns false for undefined security", () => {
|
|
expect(isPublic({})).toBe(false);
|
|
});
|
|
|
|
it("returns false for null-like security", () => {
|
|
expect(isPublic({ security: undefined })).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("generateLlmsTxt", () => {
|
|
const minimalSpec: OpenAPISpec = {
|
|
info: { title: "SnapOtter API", version: "1.0.0" },
|
|
tags: [
|
|
{ name: "Tools", description: "Image processing tools" },
|
|
{ name: "Auth", description: "Authentication" },
|
|
],
|
|
paths: {
|
|
"/api/v1/tools/resize": {
|
|
post: { tags: ["Tools"], summary: "Resize image" },
|
|
},
|
|
"/api/auth/login": {
|
|
post: { tags: ["Auth"], summary: "Login", security: [] },
|
|
},
|
|
},
|
|
};
|
|
|
|
it("starts with the API title", () => {
|
|
const result = generateLlmsTxt(minimalSpec);
|
|
expect(result).toContain("# SnapOtter API");
|
|
});
|
|
|
|
it("includes the Docs section", () => {
|
|
const result = generateLlmsTxt(minimalSpec);
|
|
expect(result).toContain("## Docs");
|
|
expect(result).toContain("[Interactive API Reference]");
|
|
expect(result).toContain("[OpenAPI Spec]");
|
|
});
|
|
|
|
it("lists API sections with endpoint counts", () => {
|
|
const result = generateLlmsTxt(minimalSpec);
|
|
expect(result).toContain("Tools (1 endpoints): Image processing tools");
|
|
expect(result).toContain("Auth (1 endpoints): Authentication");
|
|
});
|
|
|
|
it("includes authentication section", () => {
|
|
const result = generateLlmsTxt(minimalSpec);
|
|
expect(result).toContain("## Authentication");
|
|
});
|
|
|
|
it("handles spec with no tags", () => {
|
|
const specNoTags: OpenAPISpec = {
|
|
info: { title: "Test API", version: "1.0.0" },
|
|
paths: {},
|
|
};
|
|
const result = generateLlmsTxt(specNoTags);
|
|
expect(result).toContain("# Test API");
|
|
expect(result).toContain("## API Sections");
|
|
});
|
|
|
|
it("handles spec with empty paths", () => {
|
|
const specEmpty: OpenAPISpec = {
|
|
info: { title: "Empty API", version: "0.1.0" },
|
|
tags: [{ name: "Tools", description: "desc" }],
|
|
paths: {},
|
|
};
|
|
const result = generateLlmsTxt(specEmpty);
|
|
expect(result).toContain("Tools (0 endpoints): desc");
|
|
});
|
|
});
|
|
|
|
describe("generateLlmsFullTxt", () => {
|
|
const fullSpec: OpenAPISpec = {
|
|
info: {
|
|
title: "SnapOtter API",
|
|
version: "2.0.0",
|
|
description: "Image processing API",
|
|
},
|
|
tags: [{ name: "Tools", description: "Processing tools" }],
|
|
paths: {
|
|
"/api/v1/tools/resize": {
|
|
post: {
|
|
tags: ["Tools"],
|
|
summary: "Resize an image",
|
|
description: "Resize to specified dimensions",
|
|
parameters: [
|
|
{ name: "width", in: "query", required: true, schema: { type: "integer" } },
|
|
],
|
|
requestBody: {
|
|
content: {
|
|
"multipart/form-data": {
|
|
schema: {
|
|
properties: {
|
|
file: { type: "string", description: "Image file to process" },
|
|
},
|
|
required: ["file"],
|
|
},
|
|
},
|
|
},
|
|
},
|
|
responses: {
|
|
"200": { description: "Successful resize" },
|
|
"400": { description: "Invalid input" },
|
|
},
|
|
},
|
|
},
|
|
"/api/health": {
|
|
get: {
|
|
summary: "Health check",
|
|
security: [],
|
|
},
|
|
},
|
|
},
|
|
};
|
|
|
|
it("includes title with version", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("# SnapOtter API v2.0.0");
|
|
});
|
|
|
|
it("includes the description", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("Image processing API");
|
|
});
|
|
|
|
it("groups endpoints by tag", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("## Tools");
|
|
});
|
|
|
|
it("marks auth-required endpoints", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("POST /api/v1/tools/resize (auth required)");
|
|
});
|
|
|
|
it("marks public endpoints", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("GET /api/health (public)");
|
|
});
|
|
|
|
it("includes parameters section", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("**Parameters:**");
|
|
expect(result).toContain("`width` (query, required)");
|
|
});
|
|
|
|
it("includes request body section", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("**Request:** `multipart/form-data`");
|
|
});
|
|
|
|
it("includes responses section", () => {
|
|
const result = generateLlmsFullTxt(fullSpec);
|
|
expect(result).toContain("**Responses:**");
|
|
expect(result).toContain("`200`");
|
|
expect(result).toContain("`400`");
|
|
});
|
|
|
|
it("handles spec with no description", () => {
|
|
const specNoDesc: OpenAPISpec = {
|
|
info: { title: "No Desc API", version: "1.0.0" },
|
|
paths: {},
|
|
};
|
|
const result = generateLlmsFullTxt(specNoDesc);
|
|
expect(result).toContain("# No Desc API v1.0.0");
|
|
});
|
|
|
|
it("puts untagged endpoints under 'Other'", () => {
|
|
const specNoTag: OpenAPISpec = {
|
|
info: { title: "Test", version: "1.0.0" },
|
|
paths: {
|
|
"/health": { get: { summary: "Health" } },
|
|
},
|
|
};
|
|
const result = generateLlmsFullTxt(specNoTag);
|
|
expect(result).toContain("## Other");
|
|
});
|
|
});
|
|
});
|