mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
* feat(infra): add dev compose stack with postgres and redis
* fix(infra): comment dev env defaults until wired; harden dev compose restart and start_period
* chore(deps): add pg driver and testcontainers for postgres migration
* feat(db): translate schema to drizzle pg-core (timestamptz, boolean, pgEnum, jsonb)
Schema translation (apps/api/src/db/schema.ts):
- sqlite-core -> pg-core, all 10 tables preserved 1:1
- integer(mode:'timestamp') -> timestamp({ withTimezone: true })
- integer(mode:'boolean') -> boolean
- jobs.status text enum -> pgEnum('job_status') with same 4 values
- 7 columns changed from text to jsonb: jobs.inputFiles, jobs.settings,
pipelines.steps, apiKeys.permissions, roles.permissions,
auditLog.details, userFiles.toolChain
- settings.value stays text, jobs.error stays text, jobs.progress stays real
jsonb call-site sweep (removed JSON.stringify on writes, JSON.parse on reads):
- apps/api/src/routes/roles.ts: permissions read/write (3 sites)
- apps/api/src/routes/api-keys.ts: permissions write + read (2 sites)
- apps/api/src/routes/audit-log.ts: details read (1 site)
- apps/api/src/routes/pipeline.ts: steps write + read (2 sites)
- apps/api/src/routes/progress.ts: inputFiles write (2 sites)
- apps/api/src/routes/tool-factory.ts: toolChain read + write (2 sites)
- apps/api/src/routes/user-files.ts: toolChain read + write (4 sites)
- apps/api/src/permissions.ts: roles.permissions read (1 site)
- apps/api/src/lib/audit.ts: details write (1 site)
- apps/api/src/plugins/auth.ts: apiKeys.permissions read (1 site)
* refactor(db): type jsonb columns via $type and note raw CTE conversion requirements
* feat(db): archive sqlite migrations and generate postgres baseline
* chore(db): dockerignore legacy migrations, add archive breadcrumb, fix trailing newline
* feat(db): pg pool connection, advisory-locked boot migrations, DATABASE_URL config
* fix(db): friendly fatal on unreachable postgres, idempotent closeDb, lock-key convention note
* refactor(db): async drizzle calls in plugins, lib, permissions
* fix(api): analytics never throws, typed permission guard, single-query session invalidation
* refactor(db): async drizzle calls across all routes and bootstrap
Convert every route file and index.ts from sync SQLite drizzle
patterns to async node-postgres drizzle:
- .all() removed (bare await on select)
- .get() converted to destructured [row] = await ...
- .run() removed (bare await on insert/update/delete)
- .changes replaced with .rowCount (null-guarded) in progress.ts
- sqlite import removed from user-files.ts; raw CTEs converted to
await db.execute(sql`...`) with postgres-dialect recursive CTEs
- ChainRow types updated: tool_chain is parsed jsonb (string[] | null),
created_at is Date (timestamptz) with no * 1000 conversion
- All requirePermission() guard calls awaited (security: unawaited
async guard returns truthy Promise, bypassing permission check)
- All hasEffectivePermission() and getPermissions() calls awaited
- All auditLog() calls awaited (preserves write-before-response order)
- trackEvent() and captureException() left un-awaited (fire-and-forget
by design, guaranteed never-throw)
- ensureAnonymousUser(), startCleanupCron(), recoverStaleJobs() awaited
in bootstrap sequence
- ensureInstanceId() and ensureDefaultSettings() made async
Files converted: 14 (index.ts + 12 route files + tools/index.ts)
* fix(db): await async checkStorageQuota in user-files upload/save routes
* fix(db): await checkStorageQuota in save-result route (missed second call site)
* feat(db): sqlite-to-postgres migrator with CLI and first-boot import
* fix(db): migrator error context, honest force semantics, boot-hook fatal, null-variance tests
* test: run suite against per-file postgres databases via testcontainers
- Add tests/global-setup.ts: spins up a Postgres testcontainer,
creates a migrated template database once per vitest run.
- Rewrite tests/setup/per-fork-env.ts: each test file (forks pool)
clones the template into its own database via CREATE DATABASE ...
TEMPLATE, preserving the same per-file isolation granularity.
- Update vitest.config.ts: add globalSetup, pg alias, update comment.
- Fix tests/integration/test-server.ts: remove DB_PATH mkdir, async
runMigrations, async db operations, remove SQLite WAL checkpoint.
- Fix 21 unit test db/index mocks: add pool and closeDb exports.
- Fix 8 unit test files: add async/await for now-async permission,
audit, and analytics functions.
- Fix 18 integration test files: convert sync .run()/.all()/.get()
to async drizzle patterns, add async to callbacks.
- Production change: apps/api/src/routes/teams.ts: cast COUNT(*)
to ::int so Postgres returns a number instead of bigint string.
* fix(db): seed built-in roles, reject NUL bytes, cast COUNT, serialize job persists
- Seed built-in roles (admin, editor, user) at boot via ensureBuiltinRoles()
with onConflictDoNothing, restoring data that legacy SQLite migration 0007
provided via INSERT statements (the pg baseline is DDL-only).
- Reject NUL bytes in login credentials with 401 (postgres rejects \x00 in
text columns; valid usernames never contain NUL, matching 1.x behavior).
- Cast COUNT(*)::int in user-files, audit-log, and roles listing queries so
postgres returns a JS number instead of bigint-as-string.
- Serialize fire-and-forget job progress DB writes per jobId so the final
"completed" status is never overwritten by a late-arriving "processing"
write (race condition exposed by async postgres round-trips).
* test: fix teams race, seed roles in test server, poll for job status
- Add missing await to resetTeams() in teams PUT beforeEach (the async
delete raced with the subsequent insert under postgres).
- Call ensureBuiltinRoles() in test server bootstrap so integration tests
have the same built-in roles as production.
- Replace fixed 100ms flushPersist delay with a polling helper that waits
for terminal job status, eliminating timing-dependent failures caused by
postgres network round-trip latency.
* test: make heic temp-file cleanup assertion resilient to concurrent workers
Use a set-based diff instead of raw file count when checking that
decodeHeic cleans up temp files. Other concurrent test workers can
create heic-in-*/heic-out-* files in the shared tmpdir, inflating the
"after" count and causing spurious failures under full-suite load.
* fix(db): align builtin-role seed to post-0010 legacy state; test polish
* feat(docker): three-container compose (app, postgres, redis) with boot wait and migrations
* fix(docker): set TEST_DATABASE_URL so containerized tests skip testcontainers
* chore(docker): test compose project name, clearer 1.x upgrade comment, unref probe timer
* feat(enterprise): enforce D15 license boundary; move s3 storage into packages/enterprise
* fix(enterprise): restore lazy aws-sdk loading; community installs load no s3 code at boot
* fix(enterprise): boundary check catches dynamic imports; document getS3 concurrency
* feat(db)!: SnapOtter 2.0 phase 1 foundation: postgres, migrator, compose stack
BREAKING CHANGE: SQLite is no longer the runtime database. Deployments now
require Postgres (and Redis, used from phase 2). Existing installs migrate
with SQLITE_MIGRATE_PATH or 'pnpm --filter @snapotter/api migrate:sqlite'.
* fix(ci): postgres service + fresh e2e database per run; ignore unfixable torch CVE-2025-3000
396 lines
12 KiB
TypeScript
396 lines
12 KiB
TypeScript
/**
|
|
* Unit tests for user file routes helper functions and serialization logic.
|
|
*
|
|
* Tests the formatToMime, extToMime, and serializeFile helpers that are
|
|
* used throughout the user-files route handlers.
|
|
*/
|
|
import { describe, expect, it, vi } from "vitest";
|
|
|
|
// ── Mocks ───────────────────────────────────────────────────────────────
|
|
|
|
vi.mock("../../../apps/api/src/db/index.js", () => ({
|
|
db: {
|
|
select: () => ({
|
|
from: () => ({
|
|
where: () => ({ get: () => null, all: () => [] }),
|
|
all: () => [],
|
|
}),
|
|
}),
|
|
insert: () => ({ values: () => ({ run: vi.fn() }) }),
|
|
delete: () => ({ where: () => ({ run: vi.fn() }) }),
|
|
},
|
|
pool: {},
|
|
closeDb: async () => {},
|
|
schema: {
|
|
userFiles: { id: {}, userId: {}, parentId: {}, createdAt: {}, originalName: {} },
|
|
},
|
|
}));
|
|
|
|
// ── Reproduce helper functions from user-files.ts ──────────────────────
|
|
|
|
function formatToMime(format: string): string {
|
|
const map: Record<string, string> = {
|
|
jpeg: "image/jpeg",
|
|
png: "image/png",
|
|
webp: "image/webp",
|
|
gif: "image/gif",
|
|
bmp: "image/bmp",
|
|
tiff: "image/tiff",
|
|
avif: "image/avif",
|
|
};
|
|
return map[format] ?? "application/octet-stream";
|
|
}
|
|
|
|
function extToMime(ext: string): string {
|
|
const clean = ext.toLowerCase().replace(/^\./, "");
|
|
const map: Record<string, string> = {
|
|
jpg: "image/jpeg",
|
|
jpeg: "image/jpeg",
|
|
png: "image/png",
|
|
webp: "image/webp",
|
|
gif: "image/gif",
|
|
bmp: "image/bmp",
|
|
tiff: "image/tiff",
|
|
tif: "image/tiff",
|
|
avif: "image/avif",
|
|
};
|
|
return map[clean] ?? "application/octet-stream";
|
|
}
|
|
|
|
interface UserFileRow {
|
|
id: string;
|
|
originalName: string;
|
|
mimeType: string;
|
|
size: number;
|
|
width: number | null;
|
|
height: number | null;
|
|
version: number;
|
|
parentId: string | null;
|
|
toolChain: string | null;
|
|
createdAt: Date;
|
|
}
|
|
|
|
function serializeFile(row: UserFileRow) {
|
|
return {
|
|
id: row.id,
|
|
originalName: row.originalName,
|
|
mimeType: row.mimeType,
|
|
size: row.size,
|
|
width: row.width,
|
|
height: row.height,
|
|
version: row.version,
|
|
parentId: row.parentId,
|
|
toolChain: row.toolChain ? JSON.parse(row.toolChain) : [],
|
|
createdAt: row.createdAt.toISOString(),
|
|
};
|
|
}
|
|
|
|
// Reproduce the bulk delete validation logic
|
|
function validateDeleteBody(body: unknown): { success: boolean; ids?: string[] } {
|
|
if (typeof body !== "object" || body === null) return { success: false };
|
|
const obj = body as Record<string, unknown>;
|
|
if (!Array.isArray(obj.ids)) return { success: false };
|
|
if (obj.ids.length === 0) return { success: false };
|
|
if (!obj.ids.every((id: unknown) => typeof id === "string")) return { success: false };
|
|
return { success: true, ids: obj.ids as string[] };
|
|
}
|
|
|
|
// ── Tests ───────────────────────────────────────────────────────────────
|
|
|
|
describe("user files route logic", () => {
|
|
describe("formatToMime", () => {
|
|
it("maps jpeg to image/jpeg", () => {
|
|
expect(formatToMime("jpeg")).toBe("image/jpeg");
|
|
});
|
|
|
|
it("maps png to image/png", () => {
|
|
expect(formatToMime("png")).toBe("image/png");
|
|
});
|
|
|
|
it("maps webp to image/webp", () => {
|
|
expect(formatToMime("webp")).toBe("image/webp");
|
|
});
|
|
|
|
it("maps gif to image/gif", () => {
|
|
expect(formatToMime("gif")).toBe("image/gif");
|
|
});
|
|
|
|
it("maps bmp to image/bmp", () => {
|
|
expect(formatToMime("bmp")).toBe("image/bmp");
|
|
});
|
|
|
|
it("maps tiff to image/tiff", () => {
|
|
expect(formatToMime("tiff")).toBe("image/tiff");
|
|
});
|
|
|
|
it("maps avif to image/avif", () => {
|
|
expect(formatToMime("avif")).toBe("image/avif");
|
|
});
|
|
|
|
it("returns application/octet-stream for unknown format", () => {
|
|
expect(formatToMime("raw")).toBe("application/octet-stream");
|
|
});
|
|
|
|
it("returns application/octet-stream for empty string", () => {
|
|
expect(formatToMime("")).toBe("application/octet-stream");
|
|
});
|
|
});
|
|
|
|
describe("extToMime", () => {
|
|
it("maps .jpg to image/jpeg", () => {
|
|
expect(extToMime(".jpg")).toBe("image/jpeg");
|
|
});
|
|
|
|
it("maps .jpeg to image/jpeg", () => {
|
|
expect(extToMime(".jpeg")).toBe("image/jpeg");
|
|
});
|
|
|
|
it("maps .png to image/png", () => {
|
|
expect(extToMime(".png")).toBe("image/png");
|
|
});
|
|
|
|
it("maps .webp to image/webp", () => {
|
|
expect(extToMime(".webp")).toBe("image/webp");
|
|
});
|
|
|
|
it("maps .gif to image/gif", () => {
|
|
expect(extToMime(".gif")).toBe("image/gif");
|
|
});
|
|
|
|
it("maps .tif to image/tiff", () => {
|
|
expect(extToMime(".tif")).toBe("image/tiff");
|
|
});
|
|
|
|
it("maps .tiff to image/tiff", () => {
|
|
expect(extToMime(".tiff")).toBe("image/tiff");
|
|
});
|
|
|
|
it("maps .avif to image/avif", () => {
|
|
expect(extToMime(".avif")).toBe("image/avif");
|
|
});
|
|
|
|
it("handles uppercase extensions", () => {
|
|
expect(extToMime(".JPG")).toBe("image/jpeg");
|
|
});
|
|
|
|
it("handles extension without leading dot", () => {
|
|
expect(extToMime("png")).toBe("image/png");
|
|
});
|
|
|
|
it("returns application/octet-stream for unknown extension", () => {
|
|
expect(extToMime(".xyz")).toBe("application/octet-stream");
|
|
});
|
|
});
|
|
|
|
describe("serializeFile", () => {
|
|
it("serializes a complete file row", () => {
|
|
const row: UserFileRow = {
|
|
id: "file-1",
|
|
originalName: "photo.jpg",
|
|
mimeType: "image/jpeg",
|
|
size: 12345,
|
|
width: 800,
|
|
height: 600,
|
|
version: 1,
|
|
parentId: null,
|
|
toolChain: null,
|
|
createdAt: new Date("2025-06-01T12:00:00Z"),
|
|
};
|
|
|
|
const result = serializeFile(row);
|
|
expect(result.id).toBe("file-1");
|
|
expect(result.originalName).toBe("photo.jpg");
|
|
expect(result.mimeType).toBe("image/jpeg");
|
|
expect(result.size).toBe(12345);
|
|
expect(result.width).toBe(800);
|
|
expect(result.height).toBe(600);
|
|
expect(result.version).toBe(1);
|
|
expect(result.parentId).toBeNull();
|
|
expect(result.toolChain).toEqual([]);
|
|
expect(result.createdAt).toBe("2025-06-01T12:00:00.000Z");
|
|
});
|
|
|
|
it("parses toolChain JSON when present", () => {
|
|
const row: UserFileRow = {
|
|
id: "file-2",
|
|
originalName: "edited.png",
|
|
mimeType: "image/png",
|
|
size: 54321,
|
|
width: 1920,
|
|
height: 1080,
|
|
version: 3,
|
|
parentId: "file-1",
|
|
toolChain: JSON.stringify(["resize", "compress", "convert"]),
|
|
createdAt: new Date("2025-06-15T08:30:00Z"),
|
|
};
|
|
|
|
const result = serializeFile(row);
|
|
expect(result.toolChain).toEqual(["resize", "compress", "convert"]);
|
|
expect(result.parentId).toBe("file-1");
|
|
expect(result.version).toBe(3);
|
|
});
|
|
|
|
it("returns empty array for null toolChain", () => {
|
|
const row: UserFileRow = {
|
|
id: "file-3",
|
|
originalName: "upload.gif",
|
|
mimeType: "image/gif",
|
|
size: 999,
|
|
width: null,
|
|
height: null,
|
|
version: 1,
|
|
parentId: null,
|
|
toolChain: null,
|
|
createdAt: new Date("2025-01-01"),
|
|
};
|
|
|
|
const result = serializeFile(row);
|
|
expect(result.toolChain).toEqual([]);
|
|
});
|
|
|
|
it("preserves null width and height", () => {
|
|
const row: UserFileRow = {
|
|
id: "file-4",
|
|
originalName: "unknown.bin",
|
|
mimeType: "application/octet-stream",
|
|
size: 100,
|
|
width: null,
|
|
height: null,
|
|
version: 1,
|
|
parentId: null,
|
|
toolChain: null,
|
|
createdAt: new Date(),
|
|
};
|
|
|
|
const result = serializeFile(row);
|
|
expect(result.width).toBeNull();
|
|
expect(result.height).toBeNull();
|
|
});
|
|
});
|
|
|
|
describe("delete schema validation", () => {
|
|
it("accepts valid ids array", () => {
|
|
const result = validateDeleteBody({ ids: ["id-1", "id-2"] });
|
|
expect(result.success).toBe(true);
|
|
});
|
|
|
|
it("rejects empty ids array", () => {
|
|
const result = validateDeleteBody({ ids: [] });
|
|
expect(result.success).toBe(false);
|
|
});
|
|
|
|
it("rejects missing ids field", () => {
|
|
const result = validateDeleteBody({});
|
|
expect(result.success).toBe(false);
|
|
});
|
|
|
|
it("rejects non-array ids", () => {
|
|
const result = validateDeleteBody({ ids: "single-id" });
|
|
expect(result.success).toBe(false);
|
|
});
|
|
|
|
it("accepts single id", () => {
|
|
const result = validateDeleteBody({ ids: ["only-one"] });
|
|
expect(result.success).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("pagination parsing", () => {
|
|
it("defaults to limit 50 and offset 0", () => {
|
|
const limit = parseInt("" || "50", 10) || 50;
|
|
const offset = parseInt("" || "0", 10) || 0;
|
|
expect(limit).toBe(50);
|
|
expect(offset).toBe(0);
|
|
});
|
|
|
|
it("parses custom limit and offset", () => {
|
|
const limit = parseInt("25", 10) || 50;
|
|
const offset = parseInt("10", 10) || 0;
|
|
expect(limit).toBe(25);
|
|
expect(offset).toBe(10);
|
|
});
|
|
|
|
it("falls back to defaults for non-numeric values", () => {
|
|
const limit = parseInt("abc", 10) || 50;
|
|
const offset = parseInt("xyz", 10) || 0;
|
|
expect(limit).toBe(50);
|
|
expect(offset).toBe(0);
|
|
});
|
|
});
|
|
|
|
describe("search escaping", () => {
|
|
it("escapes SQL LIKE wildcards", () => {
|
|
const search = "test%name_file\\special";
|
|
const escaped = search.replace(/[%_\\]/g, "\\$&");
|
|
expect(escaped).toBe("test\\%name\\_file\\\\special");
|
|
});
|
|
|
|
it("does not modify strings without special characters", () => {
|
|
const search = "normal-search";
|
|
const escaped = search.replace(/[%_\\]/g, "\\$&");
|
|
expect(escaped).toBe("normal-search");
|
|
});
|
|
|
|
it("trims search string", () => {
|
|
const search = " hello ";
|
|
const trimmed = search.trim();
|
|
expect(trimmed).toBe("hello");
|
|
});
|
|
});
|
|
|
|
describe("version chain logic", () => {
|
|
it("computes next version from parent", () => {
|
|
const parentVersion = 2;
|
|
const nextVersion = parentVersion + 1;
|
|
expect(nextVersion).toBe(3);
|
|
});
|
|
|
|
it("builds tool chain by appending toolId", () => {
|
|
const existingChain = ["resize", "compress"];
|
|
const toolId = "convert";
|
|
const newChain = [...existingChain, toolId];
|
|
expect(newChain).toEqual(["resize", "compress", "convert"]);
|
|
});
|
|
|
|
it("starts with empty chain for first tool", () => {
|
|
const existingChain: string[] = [];
|
|
const toolId = "resize";
|
|
const newChain = [...existingChain, toolId];
|
|
expect(newChain).toEqual(["resize"]);
|
|
});
|
|
|
|
it("preserves chain when no toolId provided", () => {
|
|
const existingChain = ["resize"];
|
|
const toolId: string | null = null;
|
|
const newChain = toolId ? [...existingChain, toolId] : existingChain;
|
|
expect(newChain).toEqual(["resize"]);
|
|
});
|
|
});
|
|
|
|
describe("filename preservation for results", () => {
|
|
it("preserves parent base name with new extension", () => {
|
|
const parentName = "vacation-photo.jpg";
|
|
const ext = ".png";
|
|
const baseName = parentName.replace(/\.[^.]+$/, "");
|
|
const resultName = `${baseName}${ext}`;
|
|
expect(resultName).toBe("vacation-photo.png");
|
|
});
|
|
|
|
it("handles parent name with multiple dots", () => {
|
|
const parentName = "my.great.photo.jpg";
|
|
const ext = ".webp";
|
|
const baseName = parentName.replace(/\.[^.]+$/, "");
|
|
const resultName = `${baseName}${ext}`;
|
|
expect(resultName).toBe("my.great.photo.webp");
|
|
});
|
|
|
|
it("handles parent name without extension", () => {
|
|
const parentName = "no-extension";
|
|
const ext = ".png";
|
|
const baseName = parentName.replace(/\.[^.]+$/, "");
|
|
const resultName = `${baseName}${ext}`;
|
|
expect(resultName).toBe("no-extension.png");
|
|
});
|
|
});
|
|
});
|