contrail/apps/contrail-e2e/tests/ at changeset-release/main · flo-bit.dev/contrail · Tangled

flo-bit.dev / contrail

0

[READ-ONLY] Mirror of https://github.com/flo-bit/contrail. atproto backend in a bottle flo-bit.dev/contrail/

0

contrail / apps / contrail-e2e / tests /

at changeset-release/main 14 files

Tom Scanlan feat(contrail): community DID provisioning on stock PDS (#31) 7w ago

community-delete.test.ts

feat(contrail): community DID provisioning on stock PDS (#31) * feat(contrail-community): provision schema, types, adapter CRUD * feat(contrail-community): PDS + PLC + service-auth helpers * feat(contrail-community): provision orchestrator + XRPC route + session cache * feat(contrail-community): reap CLI for stuck provisioning rows * test+docs(contrail): provision e2e, docs, changeset, deps * fix(contrail-community): harden provision allowlist + reap (PR #31 review) Security/review follow-ups on the community DID provisioning feature: - Provisioning fails closed: with allowProvisioning=true, an empty/undefined allowlist no longer accepts any caller pdsEndpoint (fail-open). Require a non-empty allowlist, or the explicit, loud allowAnyProvisionPdsEndpoint. Renamed allowedPdsEndpoints -> allowedProvisionPdsEndpoints to scope it to provisioning (Contrail still reads/indexes from every PDS). - reap --all-stuck gains a mandatory age floor (listStuckAttempts(olderThanMs) + --older-than <minutes>, default 30) so a bulk run can't tombstone an in-flight provision. --attempt-id still targets a known row regardless. - reap is reachable: ship it as a contrail-community bin (under pnpm the core contrail CLI can't resolve the community package; the dynamic import there now logs instead of an empty catch). Adds Postgres support via --db/DATABASE_URL alongside the D1 binding. - archiveStuckAttempt is now atomic (db.batch) + idempotent (ON CONFLICT DO NOTHING), so a retry after a partial failure can't PK-conflict. - Minor: export bytesToB64url from plc and reuse in service-auth; drop the duplicate reap mutual-exclusion validator. mint-route allowlist gap (pre-existing on main) tracked separately in om-vyok. * test(contrail-community): drop tautological builder-shape assertions Remove the 'buildTombstoneOp produces the expected shape' case and the two pass-through type/prev assertions in the update-op test: both assert literals the builder just set or args just passed in, exercising object-literal semantics rather than runtime behavior. The real signing behavior (signTombstoneOp / signUpdateOp base64url sig) and the live-PLC CID round-trip remain covered. * docs(contrail-community): document SSRF exposure of allowAnyProvisionPdsEndpoint The accept-any escape hatch bypasses endpoint validation: the caller-supplied pdsEndpoint reaches describeServer + createAccount fetches with no private-IP/metadata guard. Note inline that it must be paired with trusted auth + egress network policy + IMDSv2; the default allowlist path contains this by construction. No behavior change.

1 month ago

community-invites.test.ts

test(contrail-e2e): adopt post-PR30 spaces split + community integration Bring the e2e suite back to green under the package split: - makeSpacesConfig() wraps the old flat { type, serviceDid, resolver } shape under authority / recordHost and generates a fresh signing key per call. The config validator now requires spaces.authority whenever community is set, so this is the minimum viable shape for any test that uses spaces. - setupCommunityContrail() wires the community module via createCommunityIntegration({ db, config: resolveConfig(...) }) and passes the result as communityIntegration to the Contrail constructor. The community config field is now opaque to contrail core; routes are registered through the integration option. - 7 test files updated to use the helpers; 4 community tests pick up a workspace dep on @atmo-dev/contrail-community. 35/35 e2e tests pass against devnet. No source-package changes.

2 months ago

community-lifecycle.test.ts

test(contrail-e2e): adopt post-PR30 spaces split + community integration Bring the e2e suite back to green under the package split: - makeSpacesConfig() wraps the old flat { type, serviceDid, resolver } shape under authority / recordHost and generates a fresh signing key per call. The config validator now requires spaces.authority whenever community is set, so this is the minimum viable shape for any test that uses spaces. - setupCommunityContrail() wires the community module via createCommunityIntegration({ db, config: resolveConfig(...) }) and passes the result as communityIntegration to the Contrail constructor. The community config field is now opaque to contrail core; routes are registered through the integration option. - 7 test files updated to use the helpers; 4 community tests pick up a workspace dep on @atmo-dev/contrail-community. 35/35 e2e tests pass against devnet. No source-package changes.

2 months ago

community-provision-walkthrough.test.ts

feat(contrail): community DID provisioning on stock PDS (#31) * feat(contrail-community): provision schema, types, adapter CRUD * feat(contrail-community): PDS + PLC + service-auth helpers * feat(contrail-community): provision orchestrator + XRPC route + session cache * feat(contrail-community): reap CLI for stuck provisioning rows * test+docs(contrail): provision e2e, docs, changeset, deps * fix(contrail-community): harden provision allowlist + reap (PR #31 review) Security/review follow-ups on the community DID provisioning feature: - Provisioning fails closed: with allowProvisioning=true, an empty/undefined allowlist no longer accepts any caller pdsEndpoint (fail-open). Require a non-empty allowlist, or the explicit, loud allowAnyProvisionPdsEndpoint. Renamed allowedPdsEndpoints -> allowedProvisionPdsEndpoints to scope it to provisioning (Contrail still reads/indexes from every PDS). - reap --all-stuck gains a mandatory age floor (listStuckAttempts(olderThanMs) + --older-than <minutes>, default 30) so a bulk run can't tombstone an in-flight provision. --attempt-id still targets a known row regardless. - reap is reachable: ship it as a contrail-community bin (under pnpm the core contrail CLI can't resolve the community package; the dynamic import there now logs instead of an empty catch). Adds Postgres support via --db/DATABASE_URL alongside the D1 binding. - archiveStuckAttempt is now atomic (db.batch) + idempotent (ON CONFLICT DO NOTHING), so a retry after a partial failure can't PK-conflict. - Minor: export bytesToB64url from plc and reuse in service-auth; drop the duplicate reap mutual-exclusion validator. mint-route allowlist gap (pre-existing on main) tracked separately in om-vyok. * test(contrail-community): drop tautological builder-shape assertions Remove the 'buildTombstoneOp produces the expected shape' case and the two pass-through type/prev assertions in the update-op test: both assert literals the builder just set or args just passed in, exercising object-literal semantics rather than runtime behavior. The real signing behavior (signTombstoneOp / signUpdateOp base64url sig) and the live-PLC CID round-trip remain covered. * docs(contrail-community): document SSRF exposure of allowAnyProvisionPdsEndpoint The accept-any escape hatch bypasses endpoint validation: the caller-supplied pdsEndpoint reaches describeServer + createAccount fetches with no private-IP/metadata guard. Note inline that it must be paired with trusted auth + egress network policy + IMDSv2; the default allowlist path contains this by construction. No behavior change.

1 month ago

community-publishing.test.ts

test(contrail-e2e): adopt post-PR30 spaces split + community integration Bring the e2e suite back to green under the package split: - makeSpacesConfig() wraps the old flat { type, serviceDid, resolver } shape under authority / recordHost and generates a fresh signing key per call. The config validator now requires spaces.authority whenever community is set, so this is the minimum viable shape for any test that uses spaces. - setupCommunityContrail() wires the community module via createCommunityIntegration({ db, config: resolveConfig(...) }) and passes the result as communityIntegration to the Contrail constructor. The community config field is now opaque to contrail core; routes are registered through the integration option. - 7 test files updated to use the helpers; 4 community tests pick up a workspace dep on @atmo-dev/contrail-community. 35/35 e2e tests pass against devnet. No source-package changes.

2 months ago

cursor-resume.test.ts

fix: resolve config defensively in raw runPersistent export The exported runPersistent(db, config, options) from @atmo-dev/contrail silently skipped grouped relation count updates when passed an unresolved ContrailConfig. Internals (applyEvents' buildBatchCountStatements, query planning, etc.) read `config._resolved?.relations[...]?.groups` — if `_resolved` was missing, the grouped-counts loop never ran, so columns like count_rsvp_going stayed at 0 while total count_rsvp updated normally. The Contrail class constructor resolves the config, so callers going through `new Contrail(...).runPersistent()` were fine. Only the raw export was affected — a real footgun for library consumers. Fix: mirror what Contrail's constructor does and defensively call resolveConfig when `_resolved` is absent. resolveConfig is idempotent, so this is a no-op for already-resolved configs. Regression test in packages/contrail/tests/persistent.test.ts passes a raw ContrailConfig with a grouped relation and asserts count_rsvp_going = 1. Confirmed to fail without this patch. Reverts the Contrail.runPersistent() workaround in the postgres-devnet e2e tests — they now call the raw runPersistent export directly, same as any external library consumer would.

3 months ago

add contrail-e2e app with end-to-end tests against a local ATProto stack New app under apps/contrail-e2e that brings up a full sealed local ATProto network (PDS, PLC, Jetstream, TAP, Postgres, maildev) via docker-compose and runs three end-to-end test files against it: - health.test.ts — service health checks - ingest-roundtrip.test.ts — publish → index roundtrip, verifying a calendar event and an RSVP land in the DB and that the grouped rsvpsGoingCount is populated via an in-process XRPC handler - cursor-resume.test.ts — regression for runPersistent's durable cursor. Publishes A, stops the ingester, publishes B + updates B + deletes A, restarts, and asserts the saved cursor replays the gap. The basic roundtrip can't catch a broken cursor because events always arrive while the ingester is live. Each test stands up its own runPersistent and XRPC handler in-process against an isolated pg schema (search_path pinned per test), so the suite works with just pnpm stack:up and doesn't fight a dogfooding ingester writing to public.

3 months ago

test(contrail-e2e): adopt post-PR30 spaces split + community integration Bring the e2e suite back to green under the package split: - makeSpacesConfig() wraps the old flat { type, serviceDid, resolver } shape under authority / recordHost and generates a fresh signing key per call. The config validator now requires spaces.authority whenever community is set, so this is the minimum viable shape for any test that uses spaces. - setupCommunityContrail() wires the community module via createCommunityIntegration({ db, config: resolveConfig(...) }) and passes the result as communityIntegration to the Contrail constructor. The community config field is now opaque to contrail core; routes are registered through the integration option. - 7 test files updated to use the helpers; 4 community tests pick up a workspace dep on @atmo-dev/contrail-community. 35/35 e2e tests pass against devnet. No source-package changes.

2 months ago

ingest-roundtrip.test.ts

Merge remote-tracking branch 'origin/main' into fix/cleanup-and-docs # Conflicts: # pnpm-lock.yaml

3 months ago

provision.test.ts

feat(contrail): community DID provisioning on stock PDS (#31) * feat(contrail-community): provision schema, types, adapter CRUD * feat(contrail-community): PDS + PLC + service-auth helpers * feat(contrail-community): provision orchestrator + XRPC route + session cache * feat(contrail-community): reap CLI for stuck provisioning rows * test+docs(contrail): provision e2e, docs, changeset, deps * fix(contrail-community): harden provision allowlist + reap (PR #31 review) Security/review follow-ups on the community DID provisioning feature: - Provisioning fails closed: with allowProvisioning=true, an empty/undefined allowlist no longer accepts any caller pdsEndpoint (fail-open). Require a non-empty allowlist, or the explicit, loud allowAnyProvisionPdsEndpoint. Renamed allowedPdsEndpoints -> allowedProvisionPdsEndpoints to scope it to provisioning (Contrail still reads/indexes from every PDS). - reap --all-stuck gains a mandatory age floor (listStuckAttempts(olderThanMs) + --older-than <minutes>, default 30) so a bulk run can't tombstone an in-flight provision. --attempt-id still targets a known row regardless. - reap is reachable: ship it as a contrail-community bin (under pnpm the core contrail CLI can't resolve the community package; the dynamic import there now logs instead of an empty catch). Adds Postgres support via --db/DATABASE_URL alongside the D1 binding. - archiveStuckAttempt is now atomic (db.batch) + idempotent (ON CONFLICT DO NOTHING), so a retry after a partial failure can't PK-conflict. - Minor: export bytesToB64url from plc and reuse in service-auth; drop the duplicate reap mutual-exclusion validator. mint-route allowlist gap (pre-existing on main) tracked separately in om-vyok. * test(contrail-community): drop tautological builder-shape assertions Remove the 'buildTombstoneOp produces the expected shape' case and the two pass-through type/prev assertions in the update-op test: both assert literals the builder just set or args just passed in, exercising object-literal semantics rather than runtime behavior. The real signing behavior (signTombstoneOp / signUpdateOp base64url sig) and the live-PLC CID round-trip remain covered. * docs(contrail-community): document SSRF exposure of allowAnyProvisionPdsEndpoint The accept-any escape hatch bypasses endpoint validation: the caller-supplied pdsEndpoint reaches describeServer + createAccount fetches with no private-IP/metadata guard. Note inline that it must be paired with trusted auth + egress network policy + IMDSv2; the default allowlist path contains this by construction. No behavior change.

1 month ago

reap-tombstone.test.ts

feat(contrail): community DID provisioning on stock PDS (#31) * feat(contrail-community): provision schema, types, adapter CRUD * feat(contrail-community): PDS + PLC + service-auth helpers * feat(contrail-community): provision orchestrator + XRPC route + session cache * feat(contrail-community): reap CLI for stuck provisioning rows * test+docs(contrail): provision e2e, docs, changeset, deps * fix(contrail-community): harden provision allowlist + reap (PR #31 review) Security/review follow-ups on the community DID provisioning feature: - Provisioning fails closed: with allowProvisioning=true, an empty/undefined allowlist no longer accepts any caller pdsEndpoint (fail-open). Require a non-empty allowlist, or the explicit, loud allowAnyProvisionPdsEndpoint. Renamed allowedPdsEndpoints -> allowedProvisionPdsEndpoints to scope it to provisioning (Contrail still reads/indexes from every PDS). - reap --all-stuck gains a mandatory age floor (listStuckAttempts(olderThanMs) + --older-than <minutes>, default 30) so a bulk run can't tombstone an in-flight provision. --attempt-id still targets a known row regardless. - reap is reachable: ship it as a contrail-community bin (under pnpm the core contrail CLI can't resolve the community package; the dynamic import there now logs instead of an empty catch). Adds Postgres support via --db/DATABASE_URL alongside the D1 binding. - archiveStuckAttempt is now atomic (db.batch) + idempotent (ON CONFLICT DO NOTHING), so a retry after a partial failure can't PK-conflict. - Minor: export bytesToB64url from plc and reuse in service-auth; drop the duplicate reap mutual-exclusion validator. mint-route allowlist gap (pre-existing on main) tracked separately in om-vyok. * test(contrail-community): drop tautological builder-shape assertions Remove the 'buildTombstoneOp produces the expected shape' case and the two pass-through type/prev assertions in the update-op test: both assert literals the builder just set or args just passed in, exercising object-literal semantics rather than runtime behavior. The real signing behavior (signTombstoneOp / signUpdateOp base64url sig) and the live-PLC CID round-trip remain covered. * docs(contrail-community): document SSRF exposure of allowAnyProvisionPdsEndpoint The accept-any escape hatch bypasses endpoint validation: the caller-supplied pdsEndpoint reaches describeServer + createAccount fetches with no private-IP/metadata guard. Note inline that it must be paired with trusted auth + egress network policy + IMDSv2; the default allowlist path contains this by construction. No behavior change.

1 month ago

spaces-auth.test.ts

test(contrail-e2e): adopt post-PR30 spaces split + community integration Bring the e2e suite back to green under the package split: - makeSpacesConfig() wraps the old flat { type, serviceDid, resolver } shape under authority / recordHost and generates a fresh signing key per call. The config validator now requires spaces.authority whenever community is set, so this is the minimum viable shape for any test that uses spaces. - setupCommunityContrail() wires the community module via createCommunityIntegration({ db, config: resolveConfig(...) }) and passes the result as communityIntegration to the Contrail constructor. The community config field is now opaque to contrail core; routes are registered through the integration option. - 7 test files updated to use the helpers; 4 community tests pick up a workspace dep on @atmo-dev/contrail-community. 35/35 e2e tests pass against devnet. No source-package changes.

2 months ago

spaces-firehose-invisibility.test.ts

test(contrail-e2e): adopt post-PR30 spaces split + community integration Bring the e2e suite back to green under the package split: - makeSpacesConfig() wraps the old flat { type, serviceDid, resolver } shape under authority / recordHost and generates a fresh signing key per call. The config validator now requires spaces.authority whenever community is set, so this is the minimum viable shape for any test that uses spaces. - setupCommunityContrail() wires the community module via createCommunityIntegration({ db, config: resolveConfig(...) }) and passes the result as communityIntegration to the Contrail constructor. The community config field is now opaque to contrail core; routes are registered through the integration option. - 7 test files updated to use the helpers; 4 community tests pick up a workspace dep on @atmo-dev/contrail-community. 35/35 e2e tests pass against devnet. No source-package changes.

2 months ago

spaces-table-isolation.test.ts

test(contrail-e2e): adopt post-PR30 spaces split + community integration Bring the e2e suite back to green under the package split: - makeSpacesConfig() wraps the old flat { type, serviceDid, resolver } shape under authority / recordHost and generates a fresh signing key per call. The config validator now requires spaces.authority whenever community is set, so this is the minimum viable shape for any test that uses spaces. - setupCommunityContrail() wires the community module via createCommunityIntegration({ db, config: resolveConfig(...) }) and passes the result as communityIntegration to the Contrail constructor. The community config field is now opaque to contrail core; routes are registered through the integration option. - 7 test files updated to use the helpers; 4 community tests pick up a workspace dep on @atmo-dev/contrail-community. 35/35 e2e tests pass against devnet. No source-package changes.

2 months ago