Files
UHD_Media_Tool/apps/server/test/bootstrap.test.ts
T
rootandClaude Opus 5.5 ff230e5da7 feat(server): W2-A login gate, secrets, settings, instances, audit, engine panel API and PG-backed SSE bus
- Admin login gate (docs/design/auth-reference.md): admin_user/admin_session/login_attempt
  (migration 0015), one-time setup token logged once + conditional UPDATE, argon2id via
  hash-wasm (WASM; compiled binary has no --allow-ffi), sha256-stored sessions in HttpOnly
  SameSite=Lax cookie umt_session (fixed 12h TTL, soft revoke), HMAC-derived double-submit
  CSRF, IP (5) + account (15) failure limits per 15 min, password change revokes other
  sessions, optional TOTP with replay counter, AuditAction enum.
- Unified auth middleware: cookie session or Bearer API key -> c.var.actor
  {type: admin|api_key, id, name, scopes}; requireScope works for both; requireAdminSession.
- ctx.secrets: AES-256-GCM, per-secret HKDF-SHA256 key from SECRET_MASTER_KEY, AAD bound
  to (id, purpose); ctx.settings: 30s cache invalidated by settings.changed events.
- Endpoints: /auth/*, /settings, /api-keys, /secrets, /audit-events, library-roots,
  downloader/media-server instances (+test), path-mappings (+verify),
  PUT /sites/{id}/credentials, /engine/runs|stats|cancel (read-only openworkflow schema).
- SSE: PgEventBus (sse_event table, migration 0016, LISTEN/NOTIFY umt_events, catch-up by
  seq, pruning, resync); EventBusPort is now async.
- Tests: login/rate limit/revocation/CSRF/TOTP, secrets round trip and no log leakage,
  admin APIs against mock qB/Emby, SSE across two Deno subprocesses.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-09-27 19:59:54 +08:00

142 lines
5.4 KiB
TypeScript

import { EventType } from "@umt/contracts";
import { type DB, migrateToLatest } from "@umt/db";
import { defineTask } from "@umt/tasks";
import { Kysely, PostgresDialect, sql } from "kysely";
import pg from "pg";
import { afterAll, beforeAll, describe, expect, it } from "vitest";
import { z } from "zod";
import { ConfigSchema } from "../src/config.ts";
import { type Bootstrapped, bootstrap } from "../src/context.ts";
import { EventBus } from "../src/http/sse.ts";
import type { ServerModule } from "../src/modules/types.ts";
import { type RunningWorker, startWorker } from "../src/worker/index.ts";
import { withSchemaLock } from "./auth-settings/harness.ts";
import { memoryLogger } from "./helpers.ts";
// 真实 PG:独立业务 schema + 独立引擎 schema,验证 bootstrap → worker → outbox → 模块任务 的整条装配。
const url = process.env.DATABASE_URL ?? "postgres://umt:umt@localhost:55433/umt";
const uniq = `${process.pid.toString(36)}${Math.random().toString(36).slice(2, 7)}`;
const biz = `server_test_${uniq}`;
const ow = `${biz}_ow`;
async function pgAvailable() {
const c = new pg.Client({ connectionString: url, connectionTimeoutMillis: 2000 });
try {
await c.connect();
await c.end();
return true;
} catch {
return false;
}
}
const hasPg = process.env.UMT_SKIP_DB_TESTS !== "1" && (await pgAvailable());
describe.skipIf(!hasPg)("bootstrap + worker(真实 PG)", () => {
let db: Kysely<DB>;
let booted: Bootstrapped;
let worker: RunningWorker;
const seen: string[] = [];
const probe: ServerModule = {
name: "probe",
registerRoutes() {},
registerTasks(registry, ctx) {
registry.register(
defineTask({
name: "evaluateAcquisition",
version: 1,
inputSchema: z.object({ sourceReleaseId: z.string().optional() }),
handler: async (t) => {
const s = await ctx.settings.get("cache");
seen.push(`${t.input.sourceReleaseId}:${s.hardThresholdPercent}`);
return null;
},
}),
);
},
outboxRoutes: () => ({
[EventType.releaseResolved]: (ev) => ({
task: "evaluateAcquisition",
input: { sourceReleaseId: (ev.payload as { sourceReleaseId: string }).sourceReleaseId },
}),
}),
};
beforeAll(async () => {
const admin = new pg.Client({ connectionString: url });
await admin.connect();
await admin.query(`create schema ${biz}`);
await admin.end();
db = new Kysely<DB>({
dialect: new PostgresDialect({
pool: new pg.Pool({ connectionString: url, max: 5, options: `-c search_path=${biz},public` }),
}),
});
await withSchemaLock(() => migrateToLatest(db, { migrationTableSchema: biz }));
await db
.insertInto("settings")
.values({ key: "cache", value: JSON.stringify({ hardThresholdPercent: 95, resumePercent: 90 }) })
.execute();
const config = ConfigSchema.parse({ DATABASE_URL: url, SECRET_MASTER_KEY: "test-master-key-0123456789" });
const { logger } = memoryLogger();
booted = await bootstrap({
role: "all",
config,
logger,
db,
events: new EventBus(10),
modules: [probe],
engineSchema: ow,
});
worker = await startWorker({
logger,
heartbeatMs: 60_000,
runtime: { ctx: booted.ctx, modules: [probe], setRelay: booted.outbox.setRelay, outboxIntervalMs: 100 },
});
}, 60_000);
afterAll(async () => {
await worker?.stop();
await booted?.engine.stop();
await db?.destroy();
await withSchemaLock(async () => {
const admin = new pg.Client({ connectionString: url });
await admin.connect();
await admin.query(`drop schema if exists ${biz} cascade`);
await admin.query(`drop schema if exists ${ow} cascade`);
await admin.end();
});
}, 60_000);
it("settings 读取合并缺省值", async () => {
const cache = await booted.ctx.settings.get("cache");
expect(cache).toMatchObject({ hardThresholdPercent: 95, resumePercent: 90, checkIntervalSec: 60 });
expect((await booted.ctx.settings.all()).automation.enabled).toBe(true);
await expect(booted.ctx.secrets.resolve("x")).rejects.toThrow(/不存在/);
});
it("业务事务内 emit → 中继路由 → worker 执行模块任务;同幂等键只投一次;非法 payload 拒写", async () => {
const payload = {
sourceReleaseId: "11111111-1111-4111-8111-111111111111",
observationId: null,
mediaEntityId: "22222222-2222-4222-8222-222222222222",
contentUnitIds: [],
evidenceLevel: "rule_confirmed" as const,
};
await db.transaction().execute(async (trx) => {
await booted.ctx.outbox.emit(trx, EventType.releaseResolved, payload, { idempotencyKey: "rr:1" });
await booted.ctx.outbox.emit(trx, EventType.releaseResolved, payload, { idempotencyKey: "rr:1" });
});
await expect(
booted.ctx.outbox.emit(db, EventType.releaseResolved, { ...payload, evidenceLevel: "bogus" } as never),
).rejects.toThrow(/payload/);
expect(booted.ctx.outbox.relay).not.toBeNull();
const deadline = Date.now() + 30_000;
while (seen.length === 0 && Date.now() < deadline) await new Promise((r) => setTimeout(r, 200));
expect(seen).toEqual([`${payload.sourceReleaseId}:95`]);
const rows = await sql<{ status: string }>`select status from outbox_event`.execute(db);
expect(rows.rows).toEqual([{ status: "dispatched" }]);
}, 40_000);
});