fix: harden workspace registry deployment

2026-08-04 07:42:35 +02:00
parent f71feecaea
commit 802b564200
11 changed files with 132 additions and 14 deletions
@@ -173,6 +173,45 @@ test("new sessions are created through the authenticated principal, not a client
  expect(principal).toMatchObject({ issuer: "portal", subject: "alice" });
 });

+test("new sessions reject the client legacy workspace field unless local legacy mode is explicit", async () => {
+  const sessionNew = vi.fn(async () => ({ id: "legacy" }));
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: { sessionNew, searchPack: async () => {} } as any,
+    readiness: { ensure: async () => ({ ok: true }) } as any,
+    mgr: { get: () => undefined, createFor: () => ({ bridge: { onClientEvent: () => {} } }), configure: async () => {}, start: () => {} } as any,
+    getSettings: () => ({}) as any,
+  });
+
+  const response = await app.inject({
+    method: "POST", url: "/sessions", payload: { question: "q", workspace: "legacy" },
+  });
+
+  expect(response.statusCode).toBe(409);
+  expect(response.json()).toMatchObject({ code: "workspace_revision_unavailable" });
+  expect(sessionNew).not.toHaveBeenCalled();
+});
+
+test("explicit local legacy mode permits the unpinned client workspace request", async () => {
+  const sessionNew = vi.fn(async () => ({ id: "legacy" }));
+  const app = buildApp(loadConfig({
+    THT_HARNESS_DIR: "../harness", THT_LEGACY_WORKSPACE_MODE: "local",
+  }), {
+    thtRunner: { sessionNew, searchPack: async () => {} } as any,
+    readiness: { ensure: async () => ({ ok: true }) } as any,
+    mgr: { get: () => undefined, createFor: () => ({ bridge: { onClientEvent: () => {} } }), configure: async () => {}, start: () => {} } as any,
+    getSettings: () => ({}) as any,
+  });
+
+  const response = await app.inject({
+    method: "POST", url: "/sessions", payload: { question: "q", workspace: "legacy" },
+  });
+
+  expect(response.statusCode).toBe(200);
+  expect(sessionNew).toHaveBeenCalledWith(expect.objectContaining({
+    workspaceConfigPath: undefined, workspaceId: undefined, workspaceRevision: undefined,
+  }));
+});
+
 test("creates a session from the active immutable workspace revision", async () => {
  const sessionNew = vi.fn(async () => ({ id: "pinned" }));
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {