Files
ironclaw/tests/wasm_channel_integration.rs
Henry Park 3004583b2a feat(ownership): centralized ownership model with typed identities, DB-backed pairing, and OwnershipCache (#1898)
* feat(ownership): add OwnerId, Identity, UserRole, can_act_on types

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(ownership): private OwnerId field, ResourceScope serde derives, fix doc comment

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* refactor(tenant): replace SystemScope::db() escape hatch with typed workspace_for_user(), fix stale variable names

- Add SystemScope::workspace_for_user() that wraps Workspace::new_with_db
- Remove SystemScope::db() which exposed the raw Arc<dyn Database>
- Update 3 callers (routine_engine.rs x2, heartbeat.rs x1) to use the new method
- Fix stale comment: "admin context" -> "system context" in SystemScope
- Rename `admin` bindings to `system` in agent_loop.rs for clarity

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(tenant): rename stale admin binding to system_store in heartbeat.rs

* refactor(tenant): TenantScope/TenantCtx carry Identity, add with_identity() constructor and bridge new()

- TenantScope: replace `user_id: String` field with `identity: Identity`; add `with_identity()` preferred constructor; keep `new(user_id, db)` as Member-role bridge; add `identity()` accessor; all internal method bodies use `identity.owner_id.as_str()` in place of `&self.user_id`
- TenantCtx: replace `user_id: String` field with `identity: Identity`; update constructor signature; add `identity()` accessor; `user_id()` delegates to `identity.owner_id.as_str()`; cost/rate methods updated accordingly
- agent_loop: split `tenant_ctx(&str)` into bridge + new `tenant_ctx_with_identity(Identity)` which holds the full body; bridge delegates to avoid duplication

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(db): add V16 tool scope, V17 channel_identities, V18 pairing_requests migrations

- PostgreSQL: V16__tool_scope.sql adds scope column to wasm_tools/dynamic_tools
- PostgreSQL: V17__channel_identities.sql creates channel identity resolution table
- PostgreSQL: V18__pairing_requests.sql creates pairing request table replacing file-based store
- libSQL SCHEMA: adds scope column to wasm_tools/dynamic_tools, channel_identities, pairing_requests tables
- libSQL INCREMENTAL_MIGRATIONS: versions 17-19 for existing databases
- IDEMPOTENT_ADD_COLUMN_MIGRATIONS: handles fresh-install/upgrade dual path for scope columns
- Runner updated to check ALL idempotent columns per version before skipping SQL
- Test: test_ownership_model_tables_created verifies all new tables/columns exist after migrations

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(db): use correct RFC3339 timestamp default in libSQL, document version sequence offset

Replace datetime('now') with strftime('%Y-%m-%dT%H:%M:%fZ', 'now') in the
channel_identities and pairing_requests table definitions (both in SCHEMA and
INCREMENTAL_MIGRATIONS) to match the project-standard RFC 3339 timestamp format
with millisecond precision. Also add a comment clarifying that libSQL incremental
migration version numbers are independent from PostgreSQL VN migration numbers.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(ownership): bootstrap_ownership(), migrate_default_owner, V19 FK migration, replace hardcoded 'default' user IDs

- Add V19__ownership_fk.sql (programmatic-only, not in auto-migration sweep)
- Add `migrate_default_owner` to Database trait + both PgBackend and LibSqlBackend
- Add `get_or_create_user` default method to UserStore trait
- Add `bootstrap_ownership()` to app.rs, called in init_database() after connect_with_handles
- Replace hardcoded "default" owner_id in cli/config.rs, cli/mcp.rs, cli/mod.rs, orchestrator/mod.rs
- Add TODO(ownership) comments in llm/session.rs and tools/mcp/client.rs for deferred constructors

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(ownership): atomic get_or_create_user, transactional migrate_default_owner, V19 FK inline constant, fix remaining 'default' user IDs

- Delete migrations/V19__ownership_fk.sql so refinery no longer auto-applies FK constraints before bootstrap_ownership runs; add OWNERSHIP_FK_SQL constant with TODO for future programmatic application
- Remove racy SELECT+INSERT default in UserStore::get_or_create_user; both PostgreSQL (ON CONFLICT DO NOTHING) and libSQL (INSERT OR IGNORE) now use atomic upserts
- Wrap migrate_default_owner in explicit transactions on both backends for atomicity
- Make bootstrap_ownership failure fatal (propagate error instead of warn-and-continue)
- Fix mcp auth/test --user: change from default_value="default" to Option<String> resolved from configured owner_id
- Replace hardcoded "default" user IDs in channels/wasm/setup.rs with config.owner_id
- Replace "default" sentinel in OrchestratorState test helper with "<unset>" to make the test-only nature explicit

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(ownership): remove default user_id from create_job(), change sentinel strings to <unset>

- Gate ContextManager::create_job() behind #[cfg(test)]; production code must
  use create_job_for_user() with an explicit user_id to prevent DB rows with
  user_id = 'default' being silently created on the production write path.
- Change the placeholder user_id in McpClient::new(), new_with_name(), and
  new_with_config() from "default" to "<unset>" so accidental secrets/settings
  lookups surface immediately rather than silently touching the wrong DB partition.
- Same sentinel change for SessionManager::new() and new_async() in session.rs;
  these are overwritten by attach_store() at startup with the real owner_id.
- Update tests that asserted the old "default" sentinel to expect "<unset>", and
  switch test_list_jobs_tool / test_job_status_tool to create_job_for_user("default")
  to keep ownership alignment with JobContext::default().

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(db): add ChannelPairingStore sub-trait with resolve_channel_identity, upsert/approve pairing, PostgreSQL + libSQL implementations

Adds PairingRequestRecord, ChannelPairingStore trait (5 methods), and
generate_pairing_code() to src/db/mod.rs; implements for PgBackend in
postgres.rs and LibSqlBackend in libsql/pairing.rs; wires ChannelPairingStore
into the Database supertrait bound; all 6 libSQL unit tests pass.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(db): atomic libSQL approve_pairing with BEGIN IMMEDIATE, add case-insensitive/expired/double-approve tests

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(ownership): add OwnershipCache for zero-DB-read identity resolution on warm path

Converts src/ownership.rs to src/ownership/ module directory and adds
src/ownership/cache.rs with a write-through in-process cache mapping
(channel, external_id) -> Identity. Wired as Arc<OwnershipCache> on
AppComponents for Task 8 pairing integration. All 7 cache unit tests pass.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* test(e2e): add ownership model E2E tests and extend pairing tests for DB-backed store

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(e2e): remove unused asyncio import, add fallback assertion in test_pairing_response_structure

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* test(tenant): unit tests for TenantScope::with_identity and AdminScope construction

Adds 5 focused unit tests verifying TenantScope::with_identity stores the
full Identity (owner_id + role), TenantScope::new creates a Member-role
identity, and AdminScope::new returns Some for Admin and None for Member.
Uses LibSqlBackend::new_memory() as the test DB stub.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(ownership): recover from RwLock poison instead of expect() in OwnershipCache

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* test(ownership): integration tests for bootstrap, tenant isolation, and ChannelPairingStore

Adds tests/ownership_integration.rs covering migrate_default_owner idempotency,
TenantScope per-user setting isolation (including Admin role bypass check),
and the full ChannelPairingStore lifecycle (upsert, approve, remove, multi-channel isolation).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(test): remove duplicate pairing tests and flaky random-code assertion from integration suite

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(pairing): rewrite PairingStore to DB-backed async with OwnershipCache

Replaces the file-based pairing store (~/.ironclaw/*-pairing.json,
*-allowFrom.json) with a DB-backed async implementation that delegates
to ChannelPairingStore and writes through to OwnershipCache on reads.

- PairingStore::new(db, cache) uses the DB; new_noop() for test/no-DB
- resolve_identity() cache-first lookup via OwnershipCache
- approve(code, owner_id) removes channel arg (DB looks up by code)
- All WASM host functions updated: pairing_upsert_request uses block_in_place,
  pairing-is-allowed renamed to pairing-resolve-identity returning Option<String>,
  pairing-read-allow-from deprecated (returns empty list)
- Signal channel receives PairingStore via new(config, db) constructor
- Web gateway pairing handlers read from state.store (DB) directly
- extensions.rs derive_activation_status drops PairingStore dependency;
  derives status from extension.active and owner_binding flag instead
- All test call sites updated to use new_noop()

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(pairing): add missing pairing_store field to all GatewayState initializers, fix disk-full post-edit compile

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(channels): remove owner_id from IncomingMessage, user_id is the canonical resolved OwnerId

`owner_id` on `IncomingMessage` was always a duplicate of `user_id` —
both fields held the same value at every call site. Remove the field and
`with_owner_id()` builder, update the four WASM-wrapper and HTTP test
assertions to use `user_id`, and drop the redundant struct literal field
in the routine_engine test helper.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(channels): remove stale owner_id param from make_message test helper

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* test(e2e): add browser/Playwright tests for ownership model — auth screen, chat UI, owner login

Adds five Playwright-based browser tests to the ownership model E2E suite
verifying the web UI experience: authenticated owner sees chat input, unauthenticated
browser sees auth screen, owner can send a message and receive a response, settings
tab renders without errors, and basic page structure is correct after login.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(settings): migrate channel credentials from plaintext settings to encrypted secrets store

Moves nearai.session_token from the plaintext DB settings table to the
AES-256-GCM encrypted secrets store (key: nearai_session_token).

- SessionManager gains an `attach_secrets()` method that wires in the
  secrets store; `save_session` writes to it when available and
  `load_session_from_secrets` is called preferentially over settings
- `migrate_session_credential()` runs idempotently on each startup in
  `init_secrets()`, reading the JSON session from settings, writing it
  to secrets, then deleting the plaintext copy
- Wizard's `persist_session_to_db` now writes to secrets first, falling
  back to plaintext settings only when secrets store is unavailable
- Plaintext settings path is preserved as fallback for installs without
  a secrets store (no master key configured)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(settings): settings fallback only when no secrets store, verify decryption before deleting plaintext

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(ownership): ROLLBACK in libSQL migrate_default_owner, shared OwnershipCache across channels, add dynamic_tools to migration, fix doc comment

- libSQL migrate_default_owner: wrap UPDATE loop in async closure + match to emit ROLLBACK on any mid-transaction failure (mirroring approve_pairing pattern)
- Both backends: add dynamic_tools to the migrate_default_owner table list so agent-built tools are migrated on first pairing
- setup_wasm_channels: accept Arc<OwnershipCache> parameter instead of allocating a fresh cache, share the AppComponents cache
- SignalChannel:🆕 accept Arc<OwnershipCache> parameter and pass it to PairingStore instead of allocating a new cache
- PairingStore: fix module-level and struct-level doc comments to accurately describe lazy cache population after approve()

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(web): use can_act_on for authorization in job/routine handlers instead of raw string comparisons

Replace 12 raw `user_id != user.user_id` / `user_id == user.user_id` string comparisons
in jobs.rs and 4 in routines.rs with calls through the canonical `can_act_on` function
from `crate::ownership`, which is the spec-mandated authorization mechanism.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore: include remaining modified files in ownership model branch

* fix: add pairing_store field to test GatewayState initializers, update PairingStore API calls in integration tests

Add missing `pairing_store: None` to all GatewayState struct initializers
in test files. Migrate old file-based PairingStore API calls
(PairingStore::new(), PairingStore::with_base_dir()) to the new DB-backed
API (PairingStore::new_noop()). Rewrite pairing_integration.rs to use
LibSqlBackend with the new async DB-backed PairingStore API.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore: cargo fmt

* fix(pairing): truly no-op PairingStore noop mode, ensure owner user in CLI, fix signal safety comments

- PairingStore::upsert_request now returns a dummy record in noop mode instead of
  erroring, and approve silently succeeds (matching the doc promise of "writes
  are silently discarded").
- PairingStore::approve now accepts a channel parameter, matching the updated
  DB trait signature and propagated to all call sites (CLI, web server, tests).
- CLI run_pairing_command ensures the owner user row exists before approval to
  satisfy the FK constraint on channel_identities.owner_id.
- Signal channel block_in_place safety comments corrected from "WASM channel
  callbacks" to "Signal channel message processing".

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(pairing): thread channel through approve_pairing, add created flag, retry on code collision, remove redundant indexes

Addresses PR review comments:
- approve_pairing validates code belongs to the given channel
- PairingRequestRecord.created replaces timing heuristic
- upsert retries on UNIQUE violation (up to 3 attempts)
- redundant indexes removed (UNIQUE creates implicit index)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(ownership): migrate api_tokens, serialize PG approvals, propagate resolved owner_id

Addresses PR review P1/P2 regressions:

- api_tokens included in migrate_default_owner (both backends)
- PostgreSQL approve_pairing uses FOR UPDATE to prevent concurrent approvals
- Signal resolve_sender_identity returns owner_id, set as IncomingMessage.user_id
  with raw phone number preserved as sender_id for reply routing
- Feishu uses resolved owner_id from pairing_resolve_identity in emitted message
- PairingStore noop mode logs warning when pairing admission is impossible

[skip-regression-check]

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* fix(pr-review): sanitize DB errors in pairing handlers, fix doc comments, add TODO for derive_activation_status

- Pairing list/approve handlers no longer leak DB error details to clients
- NotFound errors return user-friendly 'Invalid or expired pairing code' message
- Module doc in pairing/store.rs corrected (remove -> evict, no insert method)
- wit_compat.rs stub comment corrected to match actual Val shape
- TODO added for derive_activation_status has_paired approximation

* fix(pr-review): propagate libSQL query errors in approve_pairing, round-trip validate session credential migration, fix test doc comment

- libSQL approve_pairing: .ok().flatten() replaced with .map_err() to propagate DB errors
- migrate_session_credential: round-trip compares decrypted secret against plaintext before deleting
- ownership_integration.rs: doc comment corrected to match actual test coverage

* fix(pairing): store meta, wrap upserts in transactions, case-insensitive role/channel, log Signal DB errors, use auth role in handlers

- Store meta JSONB/TEXT column in pairing_requests (PG migration V18, libSQL schema + incremental migration 19)
- Wrap upsert_pairing_request in transactions (PG: client.transaction(), libSQL: BEGIN IMMEDIATE/COMMIT/ROLLBACK)
- Case-insensitive role parsing: eq_ignore_ascii_case("admin") in both backends
- Case-insensitive channel matching in approve_pairing: LOWER(channel) = LOWER($2)
- Log DB errors in Signal resolve_sender_identity instead of silently discarding
- Use auth role from UserIdentity in web handlers (jobs.rs, routines.rs) via identity_from_auth helper
- Fix variable shadowing: rename `let channel` to `let req_channel` in libsql approve_pairing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(security): add auth to pairing list, cache eviction on deactivate, runtime assert in Signal, remove default fallback, warn on noop pairing codes

Addresses zmanian's review:
- #1: pairing_list_handler requires AuthenticatedUser
- #2: OwnershipCache.evict_user() evicts all entries for a user on suspension
- #3: debug_assert! for multi-thread runtime in Signal block_in_place
- #9: Noop PairingStore warns when generating unredeemable codes
- #10: cli/mcp.rs default fallback replaced with <unset>

* fix(pairing): consistent LOWER() channel matching in resolve_channel_identity, fix wizard doc comment, fix E2E test assertion for ActionResponse convention

* fix(pairing): apply LOWER() consistently across all ChannelPairingStore queries (upsert, list_pending, remove)

All channel matching now uses LOWER() in both PostgreSQL and libSQL backends:
- upsert_pairing_request: WHERE LOWER(channel) = LOWER($1)
- list_pending_pairings: WHERE LOWER(channel) = LOWER($1)
- remove_channel_identity: WHERE LOWER(channel) = LOWER($1)

Previously only resolve_channel_identity and approve_pairing used LOWER(),
causing inconsistent matching when channel names differed by case.

* fix(pairing): unify code challenge flow and harden web pairing

* test: harden pairing review follow-ups

* fix: guard wasm pairing callbacks by runtime flavor

* fix(pairing): normalize channel keys and serialize pg upserts

* chore(web): clean up ownership review follow-ups

* Preserve WASM pairing allowlist compatibility

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 17:51:09 -07:00

458 lines
14 KiB
Rust

//! Integration tests for the WASM channel system.
//!
//! These tests verify the full flow of WASM channel operations:
//! - Channel loading from filesystem
//! - HTTP webhook routing
//! - Message emission and delivery
//! - Response handling
use std::collections::HashMap;
use std::sync::Arc;
use ironclaw::channels::Channel;
use ironclaw::channels::wasm::{
ChannelCapabilities, EmitRateLimitConfig, PreparedChannelModule, RegisteredEndpoint,
WasmChannel, WasmChannelRouter, WasmChannelRuntime, WasmChannelRuntimeConfig,
};
use ironclaw::pairing::PairingStore;
use tempfile::TempDir;
/// Create a test runtime for WASM channel operations.
fn create_test_runtime() -> Arc<WasmChannelRuntime> {
let config = WasmChannelRuntimeConfig::for_testing();
Arc::new(WasmChannelRuntime::new(config).expect("Failed to create runtime"))
}
/// Create a test channel with minimal configuration.
fn create_test_channel(
runtime: Arc<WasmChannelRuntime>,
name: &str,
paths: Vec<&str>,
) -> WasmChannel {
let prepared = Arc::new(PreparedChannelModule::for_testing(
name,
format!("Test channel: {}", name),
));
let mut capabilities = ChannelCapabilities::for_channel(name);
for path in paths {
capabilities = capabilities.with_path(path.to_string());
}
WasmChannel::new(
runtime,
prepared,
capabilities,
"default",
"{}".to_string(),
Arc::new(PairingStore::new_noop()),
None,
)
}
mod router_tests {
use super::*;
#[tokio::test]
async fn test_register_and_route_channel() {
let router = WasmChannelRouter::new();
let runtime = create_test_runtime();
let channel = Arc::new(create_test_channel(
runtime,
"test-channel",
vec!["/webhook/test"],
));
let endpoints = vec![RegisteredEndpoint {
channel_name: "test-channel".to_string(),
path: "/webhook/test".to_string(),
methods: vec!["POST".to_string()],
require_secret: false,
}];
router
.register(channel.clone(), endpoints, None, None)
.await;
// Verify channel is found by path
let found = router.get_channel_for_path("/webhook/test").await;
assert!(found.is_some());
assert_eq!(found.unwrap().channel_name(), "test-channel");
// Verify non-existent path returns None
let not_found = router.get_channel_for_path("/webhook/nonexistent").await;
assert!(not_found.is_none());
}
#[tokio::test]
async fn test_secret_validation() {
let router = WasmChannelRouter::new();
let runtime = create_test_runtime();
let channel = Arc::new(create_test_channel(
runtime,
"secure-channel",
vec!["/webhook/secure"],
));
router
.register(channel, vec![], Some("my-secret-123".to_string()), None)
.await;
// Correct secret validates
assert!(
router
.validate_secret("secure-channel", "my-secret-123")
.await
);
// Wrong secret fails
assert!(
!router
.validate_secret("secure-channel", "wrong-secret")
.await
);
// Non-existent channel without secret always validates
assert!(router.validate_secret("nonexistent", "anything").await);
}
#[tokio::test]
async fn test_unregister_channel() {
let router = WasmChannelRouter::new();
let runtime = create_test_runtime();
let channel = Arc::new(create_test_channel(
runtime,
"temp-channel",
vec!["/webhook/temp"],
));
let endpoints = vec![RegisteredEndpoint {
channel_name: "temp-channel".to_string(),
path: "/webhook/temp".to_string(),
methods: vec!["POST".to_string()],
require_secret: false,
}];
router.register(channel, endpoints, None, None).await;
// Channel exists
assert!(router.get_channel_for_path("/webhook/temp").await.is_some());
// Unregister
router.unregister("temp-channel").await;
// Channel no longer exists
assert!(router.get_channel_for_path("/webhook/temp").await.is_none());
}
#[tokio::test]
async fn test_multiple_channels() {
let router = WasmChannelRouter::new();
let runtime = create_test_runtime();
// Register multiple channels
for name in &["slack", "telegram", "discord"] {
let channel = Arc::new(create_test_channel(
Arc::clone(&runtime),
name,
vec![&format!("/webhook/{}", name)],
));
let endpoints = vec![RegisteredEndpoint {
channel_name: name.to_string(),
path: format!("/webhook/{}", name),
methods: vec!["POST".to_string()],
require_secret: false,
}];
router.register(channel, endpoints, None, None).await;
}
// Verify all channels are registered
let channels = router.list_channels().await;
assert_eq!(channels.len(), 3);
assert!(channels.contains(&"slack".to_string()));
assert!(channels.contains(&"telegram".to_string()));
assert!(channels.contains(&"discord".to_string()));
// Verify all paths work
for name in &["slack", "telegram", "discord"] {
let found = router
.get_channel_for_path(&format!("/webhook/{}", name))
.await;
assert!(found.is_some());
assert_eq!(found.unwrap().channel_name(), *name);
}
}
}
mod channel_lifecycle_tests {
use super::*;
#[tokio::test]
async fn test_channel_start_and_shutdown() {
let runtime = create_test_runtime();
let channel = create_test_channel(runtime, "lifecycle-test", vec!["/webhook/lifecycle"]);
// Start channel
let stream = channel.start().await;
assert!(stream.is_ok());
// Health check should pass
assert!(channel.health_check().await.is_ok());
// Shutdown
assert!(channel.shutdown().await.is_ok());
// Health check should fail after shutdown
assert!(channel.health_check().await.is_err());
}
#[tokio::test]
async fn test_channel_http_callback() {
let runtime = create_test_runtime();
let channel = create_test_channel(runtime, "http-test", vec!["/webhook/http"]);
// Start channel
let _stream = channel.start().await.expect("Failed to start channel");
// Call HTTP callback (stub implementation returns 200 OK)
let response = channel
.call_on_http_request(
"POST",
"/webhook/http",
&HashMap::new(),
&HashMap::new(),
b"{}",
true,
)
.await
.expect("HTTP callback failed");
assert_eq!(response.status, 200);
// Cleanup
channel.shutdown().await.expect("Shutdown failed");
}
}
mod loader_tests {
use super::*;
use std::io::Write;
#[tokio::test]
async fn test_discover_channels_empty_dir() {
let dir = TempDir::new().expect("Failed to create temp dir");
let channels = ironclaw::channels::wasm::discover_channels(dir.path())
.await
.expect("Discovery failed");
assert!(channels.is_empty());
}
#[tokio::test]
async fn test_discover_channels_with_wasm_files() {
let dir = TempDir::new().expect("Failed to create temp dir");
// Create fake WASM files
std::fs::File::create(dir.path().join("slack.wasm")).expect("Failed to create file");
std::fs::File::create(dir.path().join("telegram.wasm")).expect("Failed to create file");
let channels = ironclaw::channels::wasm::discover_channels(dir.path())
.await
.expect("Discovery failed");
assert_eq!(channels.len(), 2);
assert!(channels.contains_key("slack"));
assert!(channels.contains_key("telegram"));
}
#[tokio::test]
async fn test_discover_channels_with_capabilities() {
let dir = TempDir::new().expect("Failed to create temp dir");
// Create WASM and capabilities file
std::fs::File::create(dir.path().join("custom.wasm")).expect("Failed to create wasm");
let mut cap_file = std::fs::File::create(dir.path().join("custom.capabilities.json"))
.expect("Failed to create capabilities");
cap_file
.write_all(
br#"{
"name": "custom",
"capabilities": {
"channel": {
"allowed_paths": ["/webhook/custom"]
}
}
}"#,
)
.expect("Failed to write capabilities");
let channels = ironclaw::channels::wasm::discover_channels(dir.path())
.await
.expect("Discovery failed");
assert_eq!(channels.len(), 1);
assert!(channels["custom"].capabilities_path.is_some());
}
#[tokio::test]
async fn test_discover_channels_ignores_non_wasm() {
let dir = TempDir::new().expect("Failed to create temp dir");
// Create various non-WASM files
std::fs::File::create(dir.path().join("readme.md")).expect("Failed to create file");
std::fs::File::create(dir.path().join("config.json")).expect("Failed to create file");
std::fs::File::create(dir.path().join("channel.wasm")).expect("Failed to create file");
let channels = ironclaw::channels::wasm::discover_channels(dir.path())
.await
.expect("Discovery failed");
// Only the .wasm file should be discovered
assert_eq!(channels.len(), 1);
assert!(channels.contains_key("channel"));
}
}
mod capabilities_tests {
use super::*;
#[test]
fn test_capabilities_path_validation() {
let caps = ChannelCapabilities::for_channel("test")
.with_path("/webhook/test")
.with_path("/api/events");
assert!(caps.is_path_allowed("/webhook/test"));
assert!(caps.is_path_allowed("/api/events"));
assert!(!caps.is_path_allowed("/other/path"));
}
#[test]
fn test_capabilities_workspace_prefix() {
let caps = ChannelCapabilities::for_channel("slack");
assert_eq!(caps.workspace_prefix, "channels/slack/");
// Validate path prefixing
let prefixed = caps.prefix_workspace_path("state.json");
assert_eq!(prefixed, "channels/slack/state.json");
}
#[test]
fn test_capabilities_workspace_path_validation() {
let caps = ChannelCapabilities::for_channel("test");
// Valid paths
assert!(caps.validate_workspace_path("state.json").is_ok());
assert!(caps.validate_workspace_path("data/file.txt").is_ok());
// Invalid paths (traversal attempts)
assert!(caps.validate_workspace_path("../escape.txt").is_err());
assert!(caps.validate_workspace_path("/absolute/path").is_err());
assert!(caps.validate_workspace_path("data/../escape").is_err());
}
#[test]
fn test_capabilities_poll_interval_validation() {
let caps = ChannelCapabilities::for_channel("test").with_polling(30_000);
// Valid interval (returns as-is)
let result = caps.validate_poll_interval(60_000);
assert!(result.is_ok());
assert_eq!(result.unwrap(), 60_000);
// Too short interval is clamped to minimum (not rejected)
let result = caps.validate_poll_interval(1_000);
assert!(result.is_ok());
assert_eq!(result.unwrap(), 30_000);
// Minimum interval passes as-is
let result = caps.validate_poll_interval(30_000);
assert!(result.is_ok());
assert_eq!(result.unwrap(), 30_000);
// Polling disabled returns error
let no_poll_caps = ChannelCapabilities::for_channel("no-poll");
assert!(no_poll_caps.validate_poll_interval(60_000).is_err());
}
#[test]
fn test_emit_rate_limit_config() {
let config = EmitRateLimitConfig {
messages_per_minute: 100,
messages_per_hour: 5000,
};
assert_eq!(config.messages_per_minute, 100);
assert_eq!(config.messages_per_hour, 5000);
}
}
mod message_emission_tests {
use super::*;
use ironclaw::channels::wasm::{ChannelHostState, EmittedMessage};
#[test]
fn test_emit_message_basic() {
let caps = ChannelCapabilities::for_channel("test");
let mut state = ChannelHostState::new("test", caps);
let msg = EmittedMessage::new("user123", "Hello, world!");
state.emit_message(msg).expect("Emit should succeed");
assert_eq!(state.emitted_count(), 1);
let messages = state.take_emitted_messages();
assert_eq!(messages.len(), 1);
assert_eq!(messages[0].user_id, "user123");
assert_eq!(messages[0].content, "Hello, world!");
// Queue should be cleared
assert_eq!(state.emitted_count(), 0);
}
#[test]
fn test_emit_message_with_metadata() {
let caps = ChannelCapabilities::for_channel("test");
let mut state = ChannelHostState::new("test", caps);
let msg = EmittedMessage::new("user123", "Hello")
.with_user_name("John Doe")
.with_thread_id("thread-1")
.with_metadata(r#"{"channel": "C123"}"#);
state.emit_message(msg).expect("Emit should succeed");
let messages = state.take_emitted_messages();
assert_eq!(messages[0].user_name, Some("John Doe".to_string()));
assert_eq!(messages[0].thread_id, Some("thread-1".to_string()));
assert!(messages[0].metadata_json.contains("channel"));
}
#[test]
fn test_emit_rate_limiting() {
let caps = ChannelCapabilities::for_channel("test");
let mut state = ChannelHostState::new("test", caps);
// Emit up to the per-execution limit
for i in 0..100 {
let msg = EmittedMessage::new("user", format!("Message {}", i));
state.emit_message(msg).expect("Emit should succeed");
}
// Messages beyond the limit are silently dropped
let msg = EmittedMessage::new("user", "Should be dropped");
state.emit_message(msg).expect("Emit should not fail");
assert_eq!(state.emitted_count(), 100);
assert_eq!(state.emits_dropped(), 1);
}
}