fix: harden workspace schema contracts

backend/test/workspaces-contracts.test.ts

@@ -1,6 +1,6 @@
 import { expect, test } from "vitest";
 import { buildInstallationContract, renderWorkspaceDocs } from "../src/workspaces/contracts.js";
-import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
+import { type CanonicalWorkspace, parseWorkspaceYaml } from "../src/workspaces/schema.js";
 
 const validWorkspace = parseWorkspaceYaml(`workspace:
   schema_version: 1
@@ -66,3 +66,70 @@ test("renders English UI headings and workspace-language Italian prose", () => {
   expect(docs.markdown).toContain("Configurazione dell'installazione");
   expect(docs.envExample).toContain("THT_WS_PSD_CLINICAL_VECTOR_TRANSPORT=");
 });
+
+function withTransports(
+  dwhTransport: CanonicalWorkspace["dwh"]["supported_transports"][number],
+  vectorTransport: CanonicalWorkspace["semantic_index"]["vector_store"]["supported_transports"][number],
+): CanonicalWorkspace {
+  return {
+    ...validWorkspace,
+    dwh: { ...validWorkspace.dwh, supported_transports: [dwhTransport] },
+    semantic_index: {
+      ...validWorkspace.semantic_index,
+      vector_store: {
+        ...validWorkspace.semantic_index.vector_store,
+        supported_transports: [vectorTransport],
+      },
+    },
+  };
+}
+
+test("emits only direct connector bindings for direct transports", () => {
+  const variables = buildInstallationContract(withTransports("postgres_direct", "pgvector_direct")).variables;
+
+  for (const role of ["DWH", "VECTOR"] as const) {
+    const names = variables.filter((variable) => variable.role === role).map((variable) => variable.name);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_HOST`);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_PASSWORD_FILE`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_BASE_URL`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_API_KEY_FILE`);
+    expect(names.some((name) => name.includes("_SSH_"))).toBe(false);
+  }
+});
+
+test("emits only REST connector bindings for REST transports", () => {
+  const variables = buildInstallationContract(withTransports("rest_api", "rest_api")).variables;
+
+  for (const role of ["DWH", "VECTOR"] as const) {
+    const names = variables.filter((variable) => variable.role === role).map((variable) => variable.name);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_BASE_URL`);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_API_KEY_FILE`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_HOST`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_PASSWORD_FILE`);
+    expect(names.some((name) => name.includes("_SSH_"))).toBe(false);
+  }
+});
+
+test("emits SSH bindings only for SSH-tunnel transports", () => {
+  const variables = buildInstallationContract(withTransports("ssh_tunnel", "ssh_tunnel")).variables;
+
+  for (const role of ["DWH", "VECTOR"] as const) {
+    const roleVariables = variables.filter((variable) => variable.role === role);
+    expect(roleVariables.map((variable) => variable.name))
+      .toContain(`THT_WS_PSD_CLINICAL_${role}_SSH_PRIVATE_KEY_FILE`);
+    expect(roleVariables.find((variable) => variable.suffix === "SSH_HOST")?.transports)
+      .toEqual(["ssh_tunnel"]);
+    expect(roleVariables.map((variable) => variable.name))
+      .not.toContain(`THT_WS_PSD_CLINICAL_${role}_BASE_URL`);
+  }
+});
+
+test("validates public contract and documentation inputs at runtime", () => {
+  const unsafeWorkspace = {
+    ...validWorkspace,
+    workspace: { ...validWorkspace.workspace, id: "psd\nclinical" },
+  } as CanonicalWorkspace;
+
+  expect(() => buildInstallationContract(unsafeWorkspace)).toThrow(/id/i);
+  expect(() => renderWorkspaceDocs(unsafeWorkspace)).toThrow(/id/i);
+});

backend/test/workspaces-schema.test.ts

@@ -11,6 +11,8 @@ dwh:
   engine: postgres
   database: postgres
   schema: datawarehouse
+  port: 5432
+  timeout_ms: 5000
   supported_transports:
     - postgres_direct
     - rest_api
@@ -21,6 +23,8 @@ semantic_index:
     collection: clinical_documents
     dimensions: 768
     distance: cosine
+    port: 5432
+    timeout_ms: 5000
     supported_transports:
       - pgvector_direct
       - rest_api
@@ -29,6 +33,7 @@ semantic_index:
     provider: ollama_compatible
     model: nomic-embed-text-v2-moe
     dimensions: 768
+    timeout_ms: 5000
 llm_policy:
   default: zai/glm-5.2
   allowed:
@@ -53,6 +58,16 @@ test("rejects unknown keys and invalid immutable IDs", () => {
     .toThrow(/id/i);
 });
 
+test("accepts optional connection ports and timeouts but rejects unsafe values", () => {
+  expect(parseWorkspaceYaml(validYaml).dwh.port).toBe(5432);
+  expect(() => parseWorkspaceYaml(validYaml.replace("port: 5432", "port: 0")))
+    .toThrow(/port/i);
+  expect(() => parseWorkspaceYaml(validYaml.replace("port: 5432", "port: 65536")))
+    .toThrow(/port/i);
+  expect(() => parseWorkspaceYaml(validYaml.replace("timeout_ms: 5000", "timeout_ms: 0")))
+    .toThrow(/timeout/i);
+});
+
 test("serializes canonical YAML that parses back to the same workspace", () => {
   const workspace = parseWorkspaceYaml(validYaml);
   const serialized = serializeWorkspaceYaml(workspace);