feat: implement metadata catalog database management

backend/test/catalog-databases-routes.test.ts

@@ -0,0 +1,122 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, expect, test, vi } from "vitest";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+import { MemoryCatalogRepository } from "../src/catalog/memory-repository.js";
+import { WorkspaceSecretStore } from "../src/workspaces/secret-store.js";
+import type { WorkspaceRegistry, WorkspaceRevision } from "../src/workspaces/registry.js";
+import type { WorkspaceDescriptor } from "../src/workspaces/schema.js";
+
+const roots: string[] = [];
+afterEach(() => { for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true }); });
+
+const workspace: WorkspaceDescriptor = {
+  workspace: { schema_version: 3, id: "psd-clinical", name: "Policlinico San Donato", language: "it" },
+  dwh: {
+    engine: "postgres", database: "warehouse", schema: "datawarehouse", port: 5432,
+    supported_transports: ["postgres_direct", "rest_api"],
+  },
+  semantic_index: {
+    vector_store: { engine: "qdrant", collection: "psd", dimensions: 1024, distance: "cosine" },
+    embedding: { provider: "ollama_internal", model: "qwen3-embedding:0.6b", dimensions: 1024 },
+  },
+  llm_policy: { allowed: ["zai/glm-5.2"] },
+  diagnostics: { dwh_rest: { method: "GET", path: "/health", auth: "bearer", response: { database: "database", schema: "schema" } } },
+};
+const revision: WorkspaceRevision = { id: "psd-clinical", commit: "a".repeat(40), blob: "b".repeat(40), snapshotPath: "/tmp/psd.yaml" };
+
+function setup() {
+  const secretRoot = mkdtempSync(join(tmpdir(), "catalog-secret-"));
+  const runtimeRoot = mkdtempSync(join(tmpdir(), "catalog-secret-runtime-"));
+  roots.push(secretRoot, runtimeRoot);
+  const secretStore = new WorkspaceSecretStore({ root: secretRoot, runtimeRoot, installationId: "test" });
+  const repository = new MemoryCatalogRepository();
+  const registry = {
+    list: vi.fn(async () => [revision]),
+    listCatalog: vi.fn(async () => [{ id: "psd-clinical", name: "Policlinico San Donato", configurationState: "ready", revision }]),
+    read: vi.fn(async () => ({ workspace, revision })),
+  } as unknown as WorkspaceRegistry;
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "/missing", NODE_ENV: "test" }), {
+    thtRunner: {} as never,
+    workspaceRegistry: registry,
+    workspaceSecretStore: secretStore,
+    catalogRepository: repository,
+    workspaceDiagnoser: vi.fn(),
+  });
+  return { app, secretStore, repository };
+}
+
+const direct = {
+  workspaceId: "psd-clinical",
+  engine: "postgres",
+  databaseName: "warehouse",
+  schema: "datawarehouse",
+  binding: { transport: "postgres_direct", host: "db.internal", port: 5432, username: "reader" },
+};
+
+test("lists every YAML workspace and creates its one database configuration", async () => {
+  const { app } = setup();
+  const initial = await app.inject({ method: "GET", url: "/catalog/databases" });
+  expect(initial.statusCode).toBe(200);
+  expect(initial.json()).toMatchObject([{ workspaceId: "psd-clinical", configured: false, databaseName: "warehouse" }]);
+
+  const created = await app.inject({ method: "POST", url: "/catalog/databases", payload: direct });
+  expect(created.statusCode).toBe(201);
+  expect(created.json()).toMatchObject({ configured: true, workspaceId: "psd-clinical", version: 1 });
+  expect((await app.inject({ method: "POST", url: "/catalog/databases", payload: direct })).statusCode).toBe(409);
+
+  const listed = await app.inject({ method: "GET", url: "/catalog/databases" });
+  expect(listed.json()).toMatchObject([{ configured: true, binding: { transport: "postgres_direct", host: "db.internal" } }]);
+});
+
+test("lists orphaned records and takes the REST diagnostic path from workspace YAML", async () => {
+  const { app, repository } = setup();
+  await repository.create({
+    workspaceId: "removed-workspace",
+    engine: "postgres",
+    databaseName: "legacy",
+    schema: "public",
+    binding: { transport: "postgres_direct", host: "legacy.internal", port: 5432, username: "reader" },
+  });
+  const created = await app.inject({
+    method: "POST",
+    url: "/catalog/databases",
+    payload: {
+      ...direct,
+      binding: {
+        transport: "rest_api", baseUrl: "https://psd.example/api", restPath: "/client-controlled", restAuth: "bearer",
+      },
+    },
+  });
+  expect(created.statusCode).toBe(201);
+  expect(created.json()).toMatchObject({ binding: { restPath: "/health" } });
+
+  const rows = (await app.inject({ method: "GET", url: "/catalog/databases" })).json();
+  expect(rows).toEqual(expect.arrayContaining([
+    expect.objectContaining({ workspaceId: "removed-workspace", configured: true, workspaceAvailable: false }),
+    expect.objectContaining({ workspaceId: "psd-clinical", configured: true, workspaceAvailable: true }),
+  ]));
+});
+
+test("uses optimistic versions, keeps secrets write-only, and hard-deletes only local configuration", async () => {
+  const { app, secretStore } = setup();
+  const created = (await app.inject({ method: "POST", url: "/catalog/databases", payload: direct })).json();
+  const stale = await app.inject({ method: "PATCH", url: `/catalog/databases/${created.id}`, payload: { ...direct, version: 99 } });
+  expect(stale.statusCode).toBe(409);
+
+  const secret = await app.inject({
+    method: "PUT", url: `/catalog/databases/${created.id}/secrets`,
+    payload: { version: 1, values: { password: "do-not-return-this" } },
+  });
+  expect(secret.statusCode).toBe(200);
+  expect(secret.body).not.toContain("do-not-return-this");
+  expect(secret.json()).toMatchObject({ version: 2, secrets: { password: true } });
+  expect(secretStore.has("psd-clinical", "catalog.dwh.password")).toBe(true);
+
+  const removed = await app.inject({ method: "DELETE", url: `/catalog/databases/${created.id}?version=2` });
+  expect(removed.statusCode).toBe(204);
+  expect(secretStore.has("psd-clinical", "catalog.dwh.password")).toBe(false);
+  expect((await app.inject({ method: "GET", url: "/catalog/databases" })).json()).toMatchObject([{ configured: false }]);
+});