fix: harden workspace schema contracts

backend/test/workspaces-contracts.test.ts

@@ -1,6 +1,6 @@
 import { expect, test } from "vitest";
 import { buildInstallationContract, renderWorkspaceDocs } from "../src/workspaces/contracts.js";
-import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
+import { type CanonicalWorkspace, parseWorkspaceYaml } from "../src/workspaces/schema.js";
 
 const validWorkspace = parseWorkspaceYaml(`workspace:
   schema_version: 1
@@ -66,3 +66,70 @@ test("renders English UI headings and workspace-language Italian prose", () => {
   expect(docs.markdown).toContain("Configurazione dell'installazione");
   expect(docs.envExample).toContain("THT_WS_PSD_CLINICAL_VECTOR_TRANSPORT=");
 });
+
+function withTransports(
+  dwhTransport: CanonicalWorkspace["dwh"]["supported_transports"][number],
+  vectorTransport: CanonicalWorkspace["semantic_index"]["vector_store"]["supported_transports"][number],
+): CanonicalWorkspace {
+  return {
+    ...validWorkspace,
+    dwh: { ...validWorkspace.dwh, supported_transports: [dwhTransport] },
+    semantic_index: {
+      ...validWorkspace.semantic_index,
+      vector_store: {
+        ...validWorkspace.semantic_index.vector_store,
+        supported_transports: [vectorTransport],
+      },
+    },
+  };
+}
+
+test("emits only direct connector bindings for direct transports", () => {
+  const variables = buildInstallationContract(withTransports("postgres_direct", "pgvector_direct")).variables;
+
+  for (const role of ["DWH", "VECTOR"] as const) {
+    const names = variables.filter((variable) => variable.role === role).map((variable) => variable.name);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_HOST`);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_PASSWORD_FILE`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_BASE_URL`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_API_KEY_FILE`);
+    expect(names.some((name) => name.includes("_SSH_"))).toBe(false);
+  }
+});
+
+test("emits only REST connector bindings for REST transports", () => {
+  const variables = buildInstallationContract(withTransports("rest_api", "rest_api")).variables;
+
+  for (const role of ["DWH", "VECTOR"] as const) {
+    const names = variables.filter((variable) => variable.role === role).map((variable) => variable.name);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_BASE_URL`);
+    expect(names).toContain(`THT_WS_PSD_CLINICAL_${role}_API_KEY_FILE`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_HOST`);
+    expect(names).not.toContain(`THT_WS_PSD_CLINICAL_${role}_PASSWORD_FILE`);
+    expect(names.some((name) => name.includes("_SSH_"))).toBe(false);
+  }
+});
+
+test("emits SSH bindings only for SSH-tunnel transports", () => {
+  const variables = buildInstallationContract(withTransports("ssh_tunnel", "ssh_tunnel")).variables;
+
+  for (const role of ["DWH", "VECTOR"] as const) {
+    const roleVariables = variables.filter((variable) => variable.role === role);
+    expect(roleVariables.map((variable) => variable.name))
+      .toContain(`THT_WS_PSD_CLINICAL_${role}_SSH_PRIVATE_KEY_FILE`);
+    expect(roleVariables.find((variable) => variable.suffix === "SSH_HOST")?.transports)
+      .toEqual(["ssh_tunnel"]);
+    expect(roleVariables.map((variable) => variable.name))
+      .not.toContain(`THT_WS_PSD_CLINICAL_${role}_BASE_URL`);
+  }
+});
+
+test("validates public contract and documentation inputs at runtime", () => {
+  const unsafeWorkspace = {
+    ...validWorkspace,
+    workspace: { ...validWorkspace.workspace, id: "psd\nclinical" },
+  } as CanonicalWorkspace;
+
+  expect(() => buildInstallationContract(unsafeWorkspace)).toThrow(/id/i);
+  expect(() => renderWorkspaceDocs(unsafeWorkspace)).toThrow(/id/i);
+});