+433

tests/server/ai.test.ts

reviewed

··· 1 1 + /** 2 2 + * Tests for AI proxy routes and release info endpoint. 3 3 + * Mocks global fetch to avoid hitting real external services. 4 4 + */ 5 5 + 6 6 + import { describe, it, expect, beforeAll, afterAll, vi, beforeEach } from 'vitest'; 7 7 + import { createServer } from 'http'; 8 8 + import express from 'express'; 9 9 + import type { Server } from 'http'; 10 10 + 11 11 + let baseUrl: string; 12 12 + let server: Server; 13 13 + 14 14 + // Save real fetch before mocking — tests use realFetch for local HTTP, 15 15 + // while route handlers inside Express see the mocked global fetch. 16 16 + const realFetch = globalThis.fetch; 17 17 + const mockFetch = vi.fn(); 18 18 + 19 19 + type Req = express.Request & { tsUser?: { login: string; name: string; profilePic: string | null } | null }; 20 20 + type Res = express.Response; 21 21 + 22 22 + beforeAll(async () => { 23 23 + // Replace global fetch so route handlers call our mock for upstream 24 24 + vi.stubGlobal('fetch', mockFetch); 25 25 + 26 26 + const AI_GATEWAY_URL = 'https://ai.test.local'; 27 27 + 28 28 + // Inline rate limiter (mirrors server/validation.ts) 29 29 + const rateLimitMap = new Map<string, { count: number; resetAt: number }>(); 30 30 + function rlCheck(key: string, max: number, windowMs: number): boolean { 31 31 + const now = Date.now(); 32 32 + const entry = rateLimitMap.get(key); 33 33 + if (!entry || now >= entry.resetAt) { 34 34 + rateLimitMap.set(key, { count: 1, resetAt: now + windowMs }); 35 35 + return true; 36 36 + } 37 37 + if (entry.count >= max) return false; 38 38 + entry.count++; 39 39 + return true; 40 40 + } 41 41 + 42 42 + // Inline sanitizer (mirrors server/validation.ts) 43 43 + const AI_ALLOWED_KEYS = ['model', 'messages', 'temperature', 'max_tokens', 'stream', 'top_p', 'stop', 'presence_penalty', 'frequency_penalty'] as const; 44 44 + function sanitizeAiRequest(body: unknown): Record<string, unknown> | null { 45 45 + if (!body || typeof body !== 'object' || Array.isArray(body)) return null; 46 46 + const sanitized: Record<string, unknown> = {}; 47 47 + for (const key of AI_ALLOWED_KEYS) { 48 48 + if (key in (body as Record<string, unknown>)) { 49 49 + sanitized[key] = (body as Record<string, unknown>)[key]; 50 50 + } 51 51 + } 52 52 + if (!sanitized.messages || !Array.isArray(sanitized.messages)) return null; 53 53 + return sanitized; 54 54 + } 55 55 + 56 56 + const app = express(); 57 57 + app.use(express.json({ limit: '1mb' })); 58 58 + 59 59 + // Simulate Tailscale auth middleware 60 60 + app.use((req: Req, _res, next) => { 61 61 + const login = req.headers['tailscale-user-login'] as string | undefined; 62 62 + if (login) { 63 63 + req.tsUser = { login, name: login, profilePic: null }; 64 64 + } else { 65 65 + req.tsUser = null; 66 66 + } 67 67 + next(); 68 68 + }); 69 69 + 70 70 + // Mirror production AI proxy routes 71 71 + app.post('/api/ai/chat/completions', async (req: Req, res: Res) => { 72 72 + const rlKey = `ai:${req.tsUser?.login || 'anon'}`; 73 73 + if (!rlCheck(rlKey, 30, 60000)) { 74 74 + res.status(429).json({ error: 'AI rate limit exceeded, please slow down' }); 75 75 + return; 76 76 + } 77 77 + 78 78 + const gatewayUrl = `${AI_GATEWAY_URL}/v1/chat/completions`; 79 79 + try { 80 80 + const sanitized = sanitizeAiRequest(req.body); 81 81 + if (!sanitized) { 82 82 + res.status(400).json({ error: 'messages array is required' }); 83 83 + return; 84 84 + } 85 85 + 86 86 + const upstream = await fetch(gatewayUrl, { 87 87 + method: 'POST', 88 88 + headers: { 'Content-Type': 'application/json' }, 89 89 + body: JSON.stringify(sanitized), 90 90 + }); 91 91 + 92 92 + if (!upstream.ok) { 93 93 + const errText = await upstream.text(); 94 94 + res.status(upstream.status).send(errText); 95 95 + return; 96 96 + } 97 97 + 98 98 + res.status(upstream.status); 99 99 + for (const [key, value] of upstream.headers.entries()) { 100 100 + if (['content-type', 'transfer-encoding'].includes(key.toLowerCase())) { 101 101 + res.set(key, value); 102 102 + } 103 103 + } 104 104 + 105 105 + if (upstream.body) { 106 106 + const reader = (upstream.body as ReadableStream<Uint8Array>).getReader(); 107 107 + for (;;) { 108 108 + const { done, value } = await reader.read(); 109 109 + if (done) break; 110 110 + res.write(value); 111 111 + } 112 112 + res.end(); 113 113 + } else { 114 114 + res.end(); 115 115 + } 116 116 + } catch (err: unknown) { 117 117 + const message = err instanceof Error ? err.message : 'Unknown error'; 118 118 + res.status(502).json({ error: { message: `AI gateway unreachable: ${message}` } }); 119 119 + } 120 120 + }); 121 121 + 122 122 + app.get('/api/ai/models', async (_req: Req, res: Res) => { 123 123 + try { 124 124 + const upstream = await fetch(`${AI_GATEWAY_URL}/v1/models`); 125 125 + if (!upstream.ok) { 126 126 + res.status(upstream.status).send(await upstream.text()); 127 127 + return; 128 128 + } 129 129 + res.json(await upstream.json()); 130 130 + } catch (err: unknown) { 131 131 + const message = err instanceof Error ? err.message : 'Unknown error'; 132 132 + res.status(502).json({ error: { message: `AI gateway unreachable: ${message}` } }); 133 133 + } 134 134 + }); 135 135 + 136 136 + // Release info with cache — exposed via test-only reset endpoint 137 137 + let releaseCache: { data: unknown; expires: number } | null = null; 138 138 + const GITEA_RELEASES_URL = 'https://gitea.test.local/api/v1/repos/test/tools/releases'; 139 139 + 140 140 + app.post('/test/reset-release-cache', (_req: Req, res: Res) => { 141 141 + releaseCache = null; 142 142 + res.json({ ok: true }); 143 143 + }); 144 144 + 145 145 + app.get('/api/releases/latest', async (_req: Req, res: Res) => { 146 146 + try { 147 147 + const now = Date.now(); 148 148 + if (releaseCache && now < releaseCache.expires) { 149 149 + return res.json(releaseCache.data); 150 150 + } 151 151 + const upstream = await fetch(`${GITEA_RELEASES_URL}?limit=1`, { signal: AbortSignal.timeout(5000) }); 152 152 + if (!upstream.ok) return res.json({ available: false }); 153 153 + const releases = await upstream.json() as Array<{ 154 154 + tag_name: string; name: string; html_url: string; 155 155 + assets: Array<{ name: string; browser_download_url: string; size: number }>; 156 156 + }>; 157 157 + const release = releases[0]; 158 158 + if (!release) return res.json({ available: false }); 159 159 + const dmg = release.assets?.find((a: { name: string }) => a.name.endsWith('.dmg')); 160 160 + const result = { 161 161 + available: true, 162 162 + version: release.tag_name, 163 163 + name: release.name || release.tag_name, 164 164 + url: release.html_url, 165 165 + dmg: dmg ? { url: dmg.browser_download_url, size: dmg.size } : null, 166 166 + }; 167 167 + releaseCache = { data: result, expires: now + 5 * 60 * 1000 }; 168 168 + res.json(result); 169 169 + } catch { 170 170 + res.json({ available: false }); 171 171 + } 172 172 + }); 173 173 + 174 174 + server = createServer(app); 175 175 + await new Promise<void>((resolve) => { 176 176 + server.listen(0, () => { 177 177 + const addr = server.address(); 178 178 + baseUrl = `http://localhost:${typeof addr === 'object' && addr ? addr.port : 0}`; 179 179 + resolve(); 180 180 + }); 181 181 + }); 182 182 + }); 183 183 + 184 184 + afterAll(() => { 185 185 + server?.close(); 186 186 + vi.unstubAllGlobals(); 187 187 + }); 188 188 + 189 189 + beforeEach(async () => { 190 190 + mockFetch.mockReset(); 191 191 + // Clear release cache between tests so each test gets fresh upstream calls 192 192 + await realFetch(`${baseUrl}/test/reset-release-cache`, { method: 'POST' }); 193 193 + }); 194 194 + 195 195 + // --- Helpers --- 196 196 + 197 197 + function mockUpstreamResponse(body: unknown, status = 200, headers: Record<string, string> = {}) { 198 198 + const responseHeaders = new Headers({ 'content-type': 'application/json', ...headers }); 199 199 + const responseBody = JSON.stringify(body); 200 200 + const encoder = new TextEncoder(); 201 201 + const stream = new ReadableStream({ 202 202 + start(controller) { 203 203 + controller.enqueue(encoder.encode(responseBody)); 204 204 + controller.close(); 205 205 + }, 206 206 + }); 207 207 + 208 208 + mockFetch.mockResolvedValueOnce(new Response(stream, { status, headers: responseHeaders })); 209 209 + } 210 210 + 211 211 + function authHeaders(login: string): Record<string, string> { 212 212 + return { 'tailscale-user-login': login, 'tailscale-user-name': login }; 213 213 + } 214 214 + 215 215 + // --- AI Chat Completions Tests --- 216 216 + 217 217 + describe('POST /api/ai/chat/completions', () => { 218 218 + it('proxies valid request to upstream', async () => { 219 219 + const upstreamReply = { choices: [{ message: { content: 'Hello!' } }] }; 220 220 + mockUpstreamResponse(upstreamReply); 221 221 + 222 222 + const res = await realFetch(`${baseUrl}/api/ai/chat/completions`, { 223 223 + method: 'POST', 224 224 + headers: { 'Content-Type': 'application/json', ...authHeaders('test@user') }, 225 225 + body: JSON.stringify({ 226 226 + model: 'gpt-4', 227 227 + messages: [{ role: 'user', content: 'Hi' }], 228 228 + }), 229 229 + }); 230 230 + 231 231 + expect(res.status).toBe(200); 232 232 + const body = await res.text(); 233 233 + expect(body).toContain('Hello!'); 234 234 + 235 235 + // Verify upstream was called with sanitized request 236 236 + expect(mockFetch).toHaveBeenCalledWith( 237 237 + 'https://ai.test.local/v1/chat/completions', 238 238 + expect.objectContaining({ 239 239 + method: 'POST', 240 240 + }), 241 241 + ); 242 242 + }); 243 243 + 244 244 + it('rejects request without messages', async () => { 245 245 + const res = await realFetch(`${baseUrl}/api/ai/chat/completions`, { 246 246 + method: 'POST', 247 247 + headers: { 'Content-Type': 'application/json' }, 248 248 + body: JSON.stringify({ model: 'gpt-4' }), 249 249 + }); 250 250 + expect(res.status).toBe(400); 251 251 + const body = await res.json() as { error: string }; 252 252 + expect(body.error).toContain('messages'); 253 253 + }); 254 254 + 255 255 + it('rejects non-array messages', async () => { 256 256 + const res = await realFetch(`${baseUrl}/api/ai/chat/completions`, { 257 257 + method: 'POST', 258 258 + headers: { 'Content-Type': 'application/json' }, 259 259 + body: JSON.stringify({ messages: 'not-an-array' }), 260 260 + }); 261 261 + expect(res.status).toBe(400); 262 262 + }); 263 263 + 264 264 + it('strips disallowed fields from request', async () => { 265 265 + mockUpstreamResponse({ choices: [] }); 266 266 + 267 267 + await realFetch(`${baseUrl}/api/ai/chat/completions`, { 268 268 + method: 'POST', 269 269 + headers: { 'Content-Type': 'application/json' }, 270 270 + body: JSON.stringify({ 271 271 + model: 'gpt-4', 272 272 + messages: [{ role: 'user', content: 'Hi' }], 273 273 + dangerous_field: 'should-be-stripped', 274 274 + api_key: 'should-be-stripped', 275 275 + }), 276 276 + }); 277 277 + 278 278 + const upstreamCall = mockFetch.mock.calls[0]; 279 279 + const sentBody = JSON.parse(upstreamCall[1].body as string); 280 280 + expect(sentBody.dangerous_field).toBeUndefined(); 281 281 + expect(sentBody.api_key).toBeUndefined(); 282 282 + expect(sentBody.model).toBe('gpt-4'); 283 283 + expect(sentBody.messages).toBeDefined(); 284 284 + }); 285 285 + 286 286 + it('forwards upstream error status', async () => { 287 287 + mockFetch.mockResolvedValueOnce(new Response('Upstream error', { 288 288 + status: 500, 289 289 + headers: { 'content-type': 'text/plain' }, 290 290 + })); 291 291 + 292 292 + const res = await realFetch(`${baseUrl}/api/ai/chat/completions`, { 293 293 + method: 'POST', 294 294 + headers: { 'Content-Type': 'application/json' }, 295 295 + body: JSON.stringify({ messages: [{ role: 'user', content: 'Hi' }] }), 296 296 + }); 297 297 + expect(res.status).toBe(500); 298 298 + }); 299 299 + 300 300 + it('returns 502 when upstream is unreachable', async () => { 301 301 + mockFetch.mockRejectedValueOnce(new Error('ECONNREFUSED')); 302 302 + 303 303 + const res = await realFetch(`${baseUrl}/api/ai/chat/completions`, { 304 304 + method: 'POST', 305 305 + headers: { 'Content-Type': 'application/json' }, 306 306 + body: JSON.stringify({ messages: [{ role: 'user', content: 'Hi' }] }), 307 307 + }); 308 308 + expect(res.status).toBe(502); 309 309 + const body = await res.json() as { error: { message: string } }; 310 310 + expect(body.error.message).toContain('unreachable'); 311 311 + }); 312 312 + 313 313 + it('rate limits after 30 requests per minute', async () => { 314 314 + // First 30 requests should succeed (or fail upstream, but not 429) 315 315 + for (let i = 0; i < 30; i++) { 316 316 + mockUpstreamResponse({ choices: [] }); 317 317 + } 318 318 + 319 319 + for (let i = 0; i < 30; i++) { 320 320 + await realFetch(`${baseUrl}/api/ai/chat/completions`, { 321 321 + method: 'POST', 322 322 + headers: { 'Content-Type': 'application/json', ...authHeaders('ratelimit-user') }, 323 323 + body: JSON.stringify({ messages: [{ role: 'user', content: `msg${i}` }] }), 324 324 + }); 325 325 + } 326 326 + 327 327 + // 31st request should be rate limited 328 328 + const res = await realFetch(`${baseUrl}/api/ai/chat/completions`, { 329 329 + method: 'POST', 330 330 + headers: { 'Content-Type': 'application/json', ...authHeaders('ratelimit-user') }, 331 331 + body: JSON.stringify({ messages: [{ role: 'user', content: 'too many' }] }), 332 332 + }); 333 333 + expect(res.status).toBe(429); 334 334 + }); 335 335 + }); 336 336 + 337 337 + // --- AI Models Tests --- 338 338 + 339 339 + describe('GET /api/ai/models', () => { 340 340 + it('proxies model list from upstream', async () => { 341 341 + const models = { data: [{ id: 'gpt-4' }, { id: 'claude-3' }] }; 342 342 + mockUpstreamResponse(models); 343 343 + 344 344 + const res = await realFetch(`${baseUrl}/api/ai/models`); 345 345 + expect(res.status).toBe(200); 346 346 + const body = await res.json() as { data: Array<{ id: string }> }; 347 347 + expect(body.data.length).toBe(2); 348 348 + }); 349 349 + 350 350 + it('forwards upstream error', async () => { 351 351 + mockFetch.mockResolvedValueOnce(new Response('Service unavailable', { 352 352 + status: 503, 353 353 + headers: { 'content-type': 'text/plain' }, 354 354 + })); 355 355 + 356 356 + const res = await realFetch(`${baseUrl}/api/ai/models`); 357 357 + expect(res.status).toBe(503); 358 358 + }); 359 359 + 360 360 + it('returns 502 when gateway is unreachable', async () => { 361 361 + mockFetch.mockRejectedValueOnce(new Error('ECONNREFUSED')); 362 362 + 363 363 + const res = await realFetch(`${baseUrl}/api/ai/models`); 364 364 + expect(res.status).toBe(502); 365 365 + const body = await res.json() as { error: { message: string } }; 366 366 + expect(body.error.message).toContain('unreachable'); 367 367 + }); 368 368 + }); 369 369 + 370 370 + // --- Release Info Tests --- 371 371 + 372 372 + describe('GET /api/releases/latest', () => { 373 373 + it('returns release info with .dmg asset', async () => { 374 374 + const releases = [{ 375 375 + tag_name: 'v0.27.0', 376 376 + name: 'Tools v0.27.0', 377 377 + html_url: 'https://gitea.test.local/releases/v0.27.0', 378 378 + assets: [ 379 379 + { name: 'Tools-0.27.0-arm64.dmg', browser_download_url: 'https://gitea.test.local/dl/tools.dmg', size: 100000 }, 380 380 + ], 381 381 + }]; 382 382 + mockUpstreamResponse(releases); 383 383 + 384 384 + const res = await realFetch(`${baseUrl}/api/releases/latest`); 385 385 + expect(res.status).toBe(200); 386 386 + const body = await res.json() as { available: boolean; version: string; dmg: { url: string; size: number } | null }; 387 387 + expect(body.available).toBe(true); 388 388 + expect(body.version).toBe('v0.27.0'); 389 389 + expect(body.dmg).not.toBeNull(); 390 390 + expect(body.dmg!.size).toBe(100000); 391 391 + }); 392 392 + 393 393 + it('returns available false when no releases exist', async () => { 394 394 + mockUpstreamResponse([]); 395 395 + 396 396 + const res = await realFetch(`${baseUrl}/api/releases/latest`); 397 397 + const body = await res.json() as { available: boolean }; 398 398 + expect(body.available).toBe(false); 399 399 + }); 400 400 + 401 401 + it('returns available false when upstream fails', async () => { 402 402 + mockFetch.mockResolvedValueOnce(new Response('error', { status: 500 })); 403 403 + 404 404 + const res = await realFetch(`${baseUrl}/api/releases/latest`); 405 405 + const body = await res.json() as { available: boolean }; 406 406 + expect(body.available).toBe(false); 407 407 + }); 408 408 + 409 409 + it('returns available false when upstream is unreachable', async () => { 410 410 + mockFetch.mockRejectedValueOnce(new Error('ECONNREFUSED')); 411 411 + 412 412 + const res = await realFetch(`${baseUrl}/api/releases/latest`); 413 413 + const body = await res.json() as { available: boolean }; 414 414 + expect(body.available).toBe(false); 415 415 + }); 416 416 + 417 417 + it('returns release without dmg when no .dmg asset present', async () => { 418 418 + const releases = [{ 419 419 + tag_name: 'v0.27.0', 420 420 + name: 'Tools v0.27.0', 421 421 + html_url: 'https://gitea.test.local/releases/v0.27.0', 422 422 + assets: [ 423 423 + { name: 'Tools-0.27.0.tar.gz', browser_download_url: 'https://gitea.test.local/dl/tools.tar.gz', size: 50000 }, 424 424 + ], 425 425 + }]; 426 426 + mockUpstreamResponse(releases); 427 427 + 428 428 + const res = await realFetch(`${baseUrl}/api/releases/latest`); 429 429 + const body = await res.json() as { available: boolean; dmg: null }; 430 430 + expect(body.available).toBe(true); 431 431 + expect(body.dmg).toBeNull(); 432 432 + }); 433 433 + });

+349

tests/server/api-v1.test.ts

reviewed

··· 1 1 + /** 2 2 + * Tests for API v1 routes: paginated document listing and batch resolve. 3 3 + * Uses an in-memory SQLite database mirroring the production schema. 4 4 + */ 5 5 + 6 6 + import { describe, it, expect, beforeAll, afterAll } from 'vitest'; 7 7 + import Database from 'better-sqlite3'; 8 8 + import { randomUUID } from 'crypto'; 9 9 + import { createServer } from 'http'; 10 10 + import express from 'express'; 11 11 + import type { Server } from 'http'; 12 12 + 13 13 + let baseUrl: string; 14 14 + let server: Server; 15 15 + let db: ReturnType<typeof Database>; 16 16 + 17 17 + type Req = express.Request; 18 18 + type Res = express.Response; 19 19 + 20 20 + beforeAll(async () => { 21 21 + db = new Database(':memory:'); 22 22 + db.pragma('journal_mode = WAL'); 23 23 + 24 24 + db.exec(` 25 25 + CREATE TABLE documents ( 26 26 + id TEXT PRIMARY KEY, 27 27 + type TEXT NOT NULL CHECK(type IN ('doc','sheet','form','slide','diagram','calendar')), 28 28 + name_encrypted TEXT, 29 29 + snapshot BLOB, 30 30 + share_mode TEXT DEFAULT 'edit', 31 31 + expires_at TEXT, 32 32 + deleted_at TEXT, 33 33 + tags TEXT, 34 34 + owner TEXT, 35 35 + created_at TEXT DEFAULT (datetime('now')), 36 36 + updated_at TEXT DEFAULT (datetime('now')) 37 37 + ) 38 38 + `); 39 39 + 40 40 + const VALID_TYPES = ['doc', 'sheet', 'form', 'slide', 'diagram', 'calendar'] as const; 41 41 + 42 42 + const listAllStmt = db.prepare( 43 43 + 'SELECT id, type, name_encrypted, created_at, updated_at FROM documents WHERE deleted_at IS NULL ORDER BY updated_at DESC LIMIT ? OFFSET ?' 44 44 + ); 45 45 + const listByTypeStmt = db.prepare( 46 46 + 'SELECT id, type, name_encrypted, created_at, updated_at FROM documents WHERE deleted_at IS NULL AND type = ? ORDER BY updated_at DESC LIMIT ? OFFSET ?' 47 47 + ); 48 48 + const countStmt = db.prepare('SELECT COUNT(*) as count FROM documents WHERE deleted_at IS NULL'); 49 49 + const getOneStmt = db.prepare('SELECT id, type, name_encrypted, created_at, updated_at FROM documents WHERE id = ?'); 50 50 + 51 51 + const resolveStmtCache = new Map<number, ReturnType<typeof db.prepare>>(); 52 52 + function getResolveStmt(count: number) { 53 53 + let stmt = resolveStmtCache.get(count); 54 54 + if (!stmt) { 55 55 + const placeholders = Array.from({ length: count }, () => '?').join(','); 56 56 + stmt = db.prepare(`SELECT id, type, name_encrypted, updated_at FROM documents WHERE id IN (${placeholders}) AND deleted_at IS NULL`); 57 57 + resolveStmtCache.set(count, stmt); 58 58 + } 59 59 + return stmt; 60 60 + } 61 61 + 62 62 + const app = express(); 63 63 + app.use(express.json({ limit: '1mb' })); 64 64 + 65 65 + // Seed helper route (not in production — just for tests) 66 66 + app.post('/test/seed', (req: Req, res: Res) => { 67 67 + const { id, type, name_encrypted, deleted_at } = req.body; 68 68 + db.prepare( 69 69 + 'INSERT INTO documents (id, type, name_encrypted, deleted_at) VALUES (?, ?, ?, ?)' 70 70 + ).run(id, type, name_encrypted || null, deleted_at || null); 71 71 + res.json({ ok: true }); 72 72 + }); 73 73 + 74 74 + // Mirror production api-v1 routes 75 75 + app.get('/api/v1/documents', (req: Req, res: Res) => { 76 76 + const { type, limit: lim, offset: off } = req.query; 77 77 + const limit = Math.min(Math.max(parseInt(lim as string) || 50, 1), 200); 78 78 + const offset = Math.max(parseInt(off as string) || 0, 0); 79 79 + 80 80 + const rows = (type && VALID_TYPES.includes(type as typeof VALID_TYPES[number])) 81 81 + ? listByTypeStmt.all(type, limit, offset) 82 82 + : listAllStmt.all(limit, offset); 83 83 + 84 84 + const total = (countStmt.get() as { count: number }).count; 85 85 + res.json({ data: rows, total, limit, offset }); 86 86 + }); 87 87 + 88 88 + app.get('/api/v1/documents/:id', (req: Req, res: Res) => { 89 89 + const row = getOneStmt.get(req.params.id); 90 90 + if (!row) return res.status(404).json({ error: 'Not found' }); 91 91 + res.json(row); 92 92 + }); 93 93 + 94 94 + app.post('/api/v1/documents/resolve', (req: Req, res: Res) => { 95 95 + const { ids } = req.body; 96 96 + if (!Array.isArray(ids) || ids.length === 0) return res.status(400).json({ error: 'ids array required' }); 97 97 + const capped = ids.slice(0, 50).filter((id: unknown) => typeof id === 'string' && (id as string).length > 0); 98 98 + if (capped.length === 0) return res.status(400).json({ error: 'ids must be non-empty strings' }); 99 99 + const rows = getResolveStmt(capped.length).all(capped); 100 100 + res.json({ data: rows }); 101 101 + }); 102 102 + 103 103 + server = createServer(app); 104 104 + await new Promise<void>((resolve) => { 105 105 + server.listen(0, () => { 106 106 + const addr = server.address(); 107 107 + baseUrl = `http://localhost:${typeof addr === 'object' && addr ? addr.port : 0}`; 108 108 + resolve(); 109 109 + }); 110 110 + }); 111 111 + }); 112 112 + 113 113 + afterAll(() => { 114 114 + server?.close(); 115 115 + db?.close(); 116 116 + }); 117 117 + 118 118 + // --- Helpers --- 119 119 + 120 120 + async function seedDoc(type: string, opts: { name?: string; deleted?: boolean } = {}): Promise<string> { 121 121 + const id = randomUUID(); 122 122 + await fetch(`${baseUrl}/test/seed`, { 123 123 + method: 'POST', 124 124 + headers: { 'Content-Type': 'application/json' }, 125 125 + body: JSON.stringify({ 126 126 + id, 127 127 + type, 128 128 + name_encrypted: opts.name || null, 129 129 + deleted_at: opts.deleted ? '2026-01-01 00:00:00' : null, 130 130 + }), 131 131 + }); 132 132 + return id; 133 133 + } 134 134 + 135 135 + // --- Tests --- 136 136 + 137 137 + describe('GET /api/v1/documents', () => { 138 138 + it('returns paginated results with defaults', async () => { 139 139 + const id = await seedDoc('doc', { name: 'test' }); 140 140 + const res = await fetch(`${baseUrl}/api/v1/documents`); 141 141 + expect(res.status).toBe(200); 142 142 + const body = await res.json() as { data: unknown[]; total: number; limit: number; offset: number }; 143 143 + expect(body.limit).toBe(50); 144 144 + expect(body.offset).toBe(0); 145 145 + expect(body.total).toBeGreaterThanOrEqual(1); 146 146 + expect(body.data.length).toBeGreaterThanOrEqual(1); 147 147 + expect(body.data.some((d: any) => d.id === id)).toBe(true); 148 148 + }); 149 149 + 150 150 + it('respects limit parameter', async () => { 151 151 + // Seed enough docs to test limiting 152 152 + await seedDoc('doc'); 153 153 + await seedDoc('doc'); 154 154 + await seedDoc('doc'); 155 155 + const res = await fetch(`${baseUrl}/api/v1/documents?limit=2`); 156 156 + const body = await res.json() as { data: unknown[]; limit: number }; 157 157 + expect(body.data.length).toBe(2); 158 158 + expect(body.limit).toBe(2); 159 159 + }); 160 160 + 161 161 + it('respects offset parameter', async () => { 162 162 + const res1 = await fetch(`${baseUrl}/api/v1/documents?limit=1&offset=0`); 163 163 + const body1 = await res1.json() as { data: Array<{ id: string }> }; 164 164 + const res2 = await fetch(`${baseUrl}/api/v1/documents?limit=1&offset=1`); 165 165 + const body2 = await res2.json() as { data: Array<{ id: string }> }; 166 166 + // Different items at different offsets (unless there's only 1 doc) 167 167 + if (body1.data.length > 0 && body2.data.length > 0) { 168 168 + expect(body1.data[0].id).not.toBe(body2.data[0].id); 169 169 + } 170 170 + }); 171 171 + 172 172 + it('clamps limit to max 200', async () => { 173 173 + const res = await fetch(`${baseUrl}/api/v1/documents?limit=999`); 174 174 + const body = await res.json() as { limit: number }; 175 175 + expect(body.limit).toBe(200); 176 176 + }); 177 177 + 178 178 + it('treats limit=0 as default (0 is falsy for parseInt||50)', async () => { 179 179 + const res = await fetch(`${baseUrl}/api/v1/documents?limit=0`); 180 180 + const body = await res.json() as { limit: number }; 181 181 + // parseInt('0') || 50 → 50 because 0 is falsy 182 182 + expect(body.limit).toBe(50); 183 183 + }); 184 184 + 185 185 + it('clamps limit=1 to minimum 1', async () => { 186 186 + const res = await fetch(`${baseUrl}/api/v1/documents?limit=1`); 187 187 + const body = await res.json() as { limit: number }; 188 188 + expect(body.limit).toBe(1); 189 189 + }); 190 190 + 191 191 + it('clamps negative offset to 0', async () => { 192 192 + const res = await fetch(`${baseUrl}/api/v1/documents?offset=-5`); 193 193 + const body = await res.json() as { offset: number }; 194 194 + expect(body.offset).toBe(0); 195 195 + }); 196 196 + 197 197 + it('handles non-numeric limit/offset gracefully', async () => { 198 198 + const res = await fetch(`${baseUrl}/api/v1/documents?limit=abc&offset=xyz`); 199 199 + const body = await res.json() as { limit: number; offset: number }; 200 200 + expect(body.limit).toBe(50); // default 201 201 + expect(body.offset).toBe(0); // default 202 202 + }); 203 203 + 204 204 + it('filters by type', async () => { 205 205 + const sheetId = await seedDoc('sheet', { name: 'filterable' }); 206 206 + const res = await fetch(`${baseUrl}/api/v1/documents?type=sheet`); 207 207 + const body = await res.json() as { data: Array<{ id: string; type: string }> }; 208 208 + expect(body.data.every(d => d.type === 'sheet')).toBe(true); 209 209 + expect(body.data.some(d => d.id === sheetId)).toBe(true); 210 210 + }); 211 211 + 212 212 + it('ignores invalid type filter and returns all', async () => { 213 213 + const res = await fetch(`${baseUrl}/api/v1/documents?type=invalid`); 214 214 + const body = await res.json() as { data: unknown[]; total: number }; 215 215 + // Should not filter — returns everything 216 216 + expect(body.total).toBeGreaterThan(0); 217 217 + }); 218 218 + 219 219 + it('excludes soft-deleted documents', async () => { 220 220 + const deletedId = await seedDoc('doc', { deleted: true }); 221 221 + const res = await fetch(`${baseUrl}/api/v1/documents`); 222 222 + const body = await res.json() as { data: Array<{ id: string }> }; 223 223 + expect(body.data.some(d => d.id === deletedId)).toBe(false); 224 224 + }); 225 225 + }); 226 226 + 227 227 + describe('GET /api/v1/documents/:id', () => { 228 228 + it('returns a single document by ID', async () => { 229 229 + const id = await seedDoc('doc', { name: 'single' }); 230 230 + const res = await fetch(`${baseUrl}/api/v1/documents/${id}`); 231 231 + expect(res.status).toBe(200); 232 232 + const body = await res.json() as { id: string; type: string; name_encrypted: string }; 233 233 + expect(body.id).toBe(id); 234 234 + expect(body.type).toBe('doc'); 235 235 + expect(body.name_encrypted).toBe('single'); 236 236 + }); 237 237 + 238 238 + it('returns 404 for non-existent document', async () => { 239 239 + const res = await fetch(`${baseUrl}/api/v1/documents/nonexistent-id`); 240 240 + expect(res.status).toBe(404); 241 241 + }); 242 242 + }); 243 243 + 244 244 + describe('POST /api/v1/documents/resolve', () => { 245 245 + it('resolves multiple document IDs', async () => { 246 246 + const id1 = await seedDoc('doc', { name: 'first' }); 247 247 + const id2 = await seedDoc('sheet', { name: 'second' }); 248 248 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 249 249 + method: 'POST', 250 250 + headers: { 'Content-Type': 'application/json' }, 251 251 + body: JSON.stringify({ ids: [id1, id2] }), 252 252 + }); 253 253 + expect(res.status).toBe(200); 254 254 + const body = await res.json() as { data: Array<{ id: string; type: string }> }; 255 255 + expect(body.data.length).toBe(2); 256 256 + expect(body.data.some(d => d.id === id1)).toBe(true); 257 257 + expect(body.data.some(d => d.id === id2)).toBe(true); 258 258 + }); 259 259 + 260 260 + it('returns empty data for IDs that do not exist', async () => { 261 261 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 262 262 + method: 'POST', 263 263 + headers: { 'Content-Type': 'application/json' }, 264 264 + body: JSON.stringify({ ids: ['nonexistent-1', 'nonexistent-2'] }), 265 265 + }); 266 266 + expect(res.status).toBe(200); 267 267 + const body = await res.json() as { data: unknown[] }; 268 268 + expect(body.data.length).toBe(0); 269 269 + }); 270 270 + 271 271 + it('excludes soft-deleted documents from resolve', async () => { 272 272 + const id = await seedDoc('doc', { deleted: true, name: 'deleted-resolve' }); 273 273 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 274 274 + method: 'POST', 275 275 + headers: { 'Content-Type': 'application/json' }, 276 276 + body: JSON.stringify({ ids: [id] }), 277 277 + }); 278 278 + const body = await res.json() as { data: unknown[] }; 279 279 + expect(body.data.length).toBe(0); 280 280 + }); 281 281 + 282 282 + it('caps batch at 50 IDs', async () => { 283 283 + // Create 51 IDs, only first 50 should be resolved 284 284 + const ids: string[] = []; 285 285 + for (let i = 0; i < 51; i++) { 286 286 + ids.push(await seedDoc('doc')); 287 287 + } 288 288 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 289 289 + method: 'POST', 290 290 + headers: { 'Content-Type': 'application/json' }, 291 291 + body: JSON.stringify({ ids }), 292 292 + }); 293 293 + expect(res.status).toBe(200); 294 294 + const body = await res.json() as { data: Array<{ id: string }> }; 295 295 + // Should resolve at most 50 296 296 + expect(body.data.length).toBeLessThanOrEqual(50); 297 297 + // The 51st ID should not appear 298 298 + expect(body.data.some(d => d.id === ids[50])).toBe(false); 299 299 + }); 300 300 + 301 301 + it('rejects missing ids field', async () => { 302 302 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 303 303 + method: 'POST', 304 304 + headers: { 'Content-Type': 'application/json' }, 305 305 + body: JSON.stringify({}), 306 306 + }); 307 307 + expect(res.status).toBe(400); 308 308 + }); 309 309 + 310 310 + it('rejects empty ids array', async () => { 311 311 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 312 312 + method: 'POST', 313 313 + headers: { 'Content-Type': 'application/json' }, 314 314 + body: JSON.stringify({ ids: [] }), 315 315 + }); 316 316 + expect(res.status).toBe(400); 317 317 + }); 318 318 + 319 319 + it('rejects ids array with only non-string values', async () => { 320 320 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 321 321 + method: 'POST', 322 322 + headers: { 'Content-Type': 'application/json' }, 323 323 + body: JSON.stringify({ ids: [123, null, false] }), 324 324 + }); 325 325 + expect(res.status).toBe(400); 326 326 + }); 327 327 + 328 328 + it('rejects ids array with only empty strings', async () => { 329 329 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 330 330 + method: 'POST', 331 331 + headers: { 'Content-Type': 'application/json' }, 332 332 + body: JSON.stringify({ ids: ['', ''] }), 333 333 + }); 334 334 + expect(res.status).toBe(400); 335 335 + }); 336 336 + 337 337 + it('filters out non-string and empty entries but resolves valid ones', async () => { 338 338 + const id = await seedDoc('doc'); 339 339 + const res = await fetch(`${baseUrl}/api/v1/documents/resolve`, { 340 340 + method: 'POST', 341 341 + headers: { 'Content-Type': 'application/json' }, 342 342 + body: JSON.stringify({ ids: [id, '', 123, null] }), 343 343 + }); 344 344 + expect(res.status).toBe(200); 345 345 + const body = await res.json() as { data: Array<{ id: string }> }; 346 346 + expect(body.data.length).toBe(1); 347 347 + expect(body.data[0].id).toBe(id); 348 348 + }); 349 349 + });