fix: validate workspace drafts and reconcile models
This commit is contained in:
@@ -1,4 +1,4 @@
|
||||
import { expect, test } from "vitest";
|
||||
import { beforeEach, expect, test } from "vitest";
|
||||
import type { CanonicalWorkspace } from "../api/workspaces";
|
||||
import { workspaceDrafts, workspacePreferences } from "./drafts";
|
||||
|
||||
@@ -42,9 +42,10 @@ test("reloads a canonical workspace draft and discards it by workspace ID", () =
|
||||
expect(workspaceDrafts.load("psd-clinical")).toBeUndefined();
|
||||
});
|
||||
|
||||
test("keeps canonical diagnostic configuration but never stores unknown draft fields", () => {
|
||||
test("keeps valid canonical diagnostic configuration", () => {
|
||||
const configured = {
|
||||
...workspace,
|
||||
dwh: { ...workspace.dwh, supported_transports: ["postgres_direct", "rest_api"] },
|
||||
diagnostics: {
|
||||
dwh_rest: {
|
||||
method: "POST",
|
||||
@@ -53,8 +54,7 @@ test("keeps canonical diagnostic configuration but never stores unknown draft fi
|
||||
response: { database: "database", schema: "schema" },
|
||||
},
|
||||
},
|
||||
secret: "must-not-be-persisted",
|
||||
} as CanonicalWorkspace & { secret: string };
|
||||
} satisfies CanonicalWorkspace;
|
||||
workspaceDrafts.save({
|
||||
workspaceId: "psd-clinical",
|
||||
baseCommit: "a".repeat(40),
|
||||
@@ -63,5 +63,49 @@ test("keeps canonical diagnostic configuration but never stores unknown draft fi
|
||||
});
|
||||
|
||||
expect(workspaceDrafts.load("psd-clinical")?.workspace.diagnostics).toEqual(configured.diagnostics);
|
||||
expect(localStorage.getItem("thothii.workspace-registry.v1.draft.psd-clinical")).not.toContain("must-not-be-persisted");
|
||||
});
|
||||
|
||||
beforeEach(() => localStorage.clear());
|
||||
|
||||
test.each([
|
||||
["an unsupported schema version", { ...workspace, workspace: { ...workspace.workspace, schema_version: 1 } }],
|
||||
["an invalid DWH engine", { ...workspace, dwh: { ...workspace.dwh, engine: "mysql" } }],
|
||||
["a diagnostic path with a query", {
|
||||
...workspace,
|
||||
diagnostics: {
|
||||
dwh_rest: {
|
||||
method: "POST", path: "/rpc/ping?token=secret", auth: "bearer",
|
||||
response: { database: "database", schema: "schema" },
|
||||
},
|
||||
},
|
||||
}],
|
||||
["a diagnostic path with a fragment", {
|
||||
...workspace,
|
||||
diagnostics: {
|
||||
dwh_rest: {
|
||||
method: "POST", path: "/rpc/ping#token", auth: "bearer",
|
||||
response: { database: "database", schema: "schema" },
|
||||
},
|
||||
},
|
||||
}],
|
||||
["a diagnostic path outside the declared origin", {
|
||||
...workspace,
|
||||
diagnostics: {
|
||||
dwh_rest: {
|
||||
method: "POST", path: "https://outside.example/rpc/ping", auth: "bearer",
|
||||
response: { database: "database", schema: "schema" },
|
||||
},
|
||||
},
|
||||
}],
|
||||
["an unknown secret field", { ...workspace, secret: "must-not-be-persisted" }],
|
||||
])("rejects a draft with %s", (_reason, invalidWorkspace) => {
|
||||
workspaceDrafts.save({
|
||||
workspaceId: "psd-clinical",
|
||||
baseCommit: "a".repeat(40),
|
||||
workspace: invalidWorkspace as CanonicalWorkspace,
|
||||
updatedAt: "2026-08-04T10:00:00.000Z",
|
||||
});
|
||||
|
||||
expect(workspaceDrafts.load("psd-clinical")).toBeUndefined();
|
||||
expect(localStorage.getItem("thothii.workspace-registry.v1.draft.psd-clinical")).toBeNull();
|
||||
});
|
||||
|
||||
@@ -22,133 +22,216 @@ function record(value: unknown): Record<string, unknown> | undefined {
|
||||
: undefined;
|
||||
}
|
||||
|
||||
function copyRequest(value: unknown): RestDiagnosticRequest | undefined {
|
||||
function exactRecord(value: unknown, keys: readonly string[]): Record<string, unknown> | undefined {
|
||||
const source = record(value);
|
||||
if (
|
||||
!source
|
||||
|| (source.method !== "GET" && source.method !== "POST")
|
||||
|| typeof source.path !== "string"
|
||||
|| (source.auth !== "none" && source.auth !== "bearer" && source.auth !== "x-api-key")
|
||||
) return undefined;
|
||||
return { method: source.method, path: source.path, auth: source.auth };
|
||||
return source && Object.keys(source).every((key) => keys.includes(key)) ? source : undefined;
|
||||
}
|
||||
|
||||
function text(value: unknown): string | undefined {
|
||||
return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
|
||||
}
|
||||
|
||||
function identifier(value: unknown): string | undefined {
|
||||
return typeof value === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(value) ? value : undefined;
|
||||
}
|
||||
|
||||
function workspaceId(value: unknown): string | undefined {
|
||||
return typeof value === "string" && /^[a-z][a-z0-9-]{2,62}$/.test(value) ? value : undefined;
|
||||
}
|
||||
|
||||
function modelReference(value: unknown): `${string}/${string}` | undefined {
|
||||
return typeof value === "string" && /^[^/\s]+\/[^/\s]+$/.test(value) ? value as `${string}/${string}` : undefined;
|
||||
}
|
||||
|
||||
function positiveInteger(value: unknown, max = Number.MAX_SAFE_INTEGER): number | undefined {
|
||||
return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= max ? value : undefined;
|
||||
}
|
||||
|
||||
function oneOf<T extends string>(value: unknown, choices: readonly T[]): T | undefined {
|
||||
return typeof value === "string" && choices.includes(value as T) ? value as T : undefined;
|
||||
}
|
||||
|
||||
function uniqueChoices<T extends string>(value: unknown, choices: readonly T[]): T[] | undefined {
|
||||
if (!Array.isArray(value) || value.length === 0) return undefined;
|
||||
const result: T[] = [];
|
||||
for (const item of value) {
|
||||
const choice = oneOf(item, choices);
|
||||
if (!choice || result.includes(choice)) return undefined;
|
||||
result.push(choice);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
function uniqueModels(value: unknown): `${string}/${string}`[] | undefined {
|
||||
if (!Array.isArray(value) || value.length === 0) return undefined;
|
||||
const result: `${string}/${string}`[] = [];
|
||||
for (const item of value) {
|
||||
const model = modelReference(item);
|
||||
if (!model || result.includes(model)) return undefined;
|
||||
result.push(model);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
function originRelativePath(value: unknown): string | undefined {
|
||||
return typeof value === "string" && /^\/(?!\/)[^\\\u0000-\u001F\u007F?#]*$/.test(value) && !/%5c/i.test(value)
|
||||
? value
|
||||
: undefined;
|
||||
}
|
||||
|
||||
function copyRequest(value: unknown, extraKeys: readonly string[] = []): RestDiagnosticRequest | undefined {
|
||||
const source = exactRecord(value, ["method", "path", "auth", ...extraKeys]);
|
||||
const method = oneOf(source?.method, ["GET", "POST"] as const);
|
||||
const path = originRelativePath(source?.path);
|
||||
const auth = oneOf(source?.auth, ["none", "bearer", "x-api-key"] as const);
|
||||
return method && path && auth ? { method, path, auth } : undefined;
|
||||
}
|
||||
|
||||
function copyDiagnostics(value: unknown): CanonicalDiagnostics | undefined {
|
||||
const source = record(value);
|
||||
const source = exactRecord(value, ["dwh_rest", "vector_rest", "embedding"]);
|
||||
if (!source) return undefined;
|
||||
const diagnostics: CanonicalDiagnostics = {};
|
||||
if (source.dwh_rest !== undefined) {
|
||||
const request = copyRequest(source.dwh_rest);
|
||||
const response = record(record(source.dwh_rest)?.response);
|
||||
if (!request || !response || typeof response.database !== "string" || typeof response.schema !== "string") return undefined;
|
||||
diagnostics.dwh_rest = { ...request, response: { database: response.database, schema: response.schema } };
|
||||
const request = copyRequest(source.dwh_rest, ["response"]);
|
||||
const raw = exactRecord(source.dwh_rest, ["method", "path", "auth", "response"]);
|
||||
const response = exactRecord(raw?.response, ["database", "schema"]);
|
||||
const database = identifier(response?.database);
|
||||
const schema = identifier(response?.schema);
|
||||
if (!request || !database || !schema) return undefined;
|
||||
diagnostics.dwh_rest = { ...request, response: { database, schema } };
|
||||
}
|
||||
if (source.vector_rest !== undefined) {
|
||||
const vector = record(source.vector_rest);
|
||||
const request = copyRequest(vector?.metadata);
|
||||
const response = record(record(vector?.metadata)?.response);
|
||||
if (!vector || !request || !response || typeof response.collection !== "string" || typeof response.dimensions !== "string" || typeof response.distance !== "string") return undefined;
|
||||
const metadata = { ...request, response: { collection: response.collection, dimensions: response.dimensions, distance: response.distance } };
|
||||
const vector = exactRecord(source.vector_rest, ["metadata", "reversible_probe"]);
|
||||
const request = copyRequest(vector?.metadata, ["response"]);
|
||||
const rawMetadata = exactRecord(vector?.metadata, ["method", "path", "auth", "response"]);
|
||||
const response = exactRecord(rawMetadata?.response, ["collection", "dimensions", "distance"]);
|
||||
const collection = identifier(response?.collection);
|
||||
const dimensions = identifier(response?.dimensions);
|
||||
const distance = identifier(response?.distance);
|
||||
if (!vector || !request || !collection || !dimensions || !distance) return undefined;
|
||||
const metadata = { ...request, response: { collection, dimensions, distance } };
|
||||
let reversibleProbe: NonNullable<CanonicalDiagnostics["vector_rest"]>["reversible_probe"] | undefined;
|
||||
if (vector.reversible_probe !== undefined) {
|
||||
const probe = copyRequest(vector.reversible_probe);
|
||||
const probeResponse = record(record(vector.reversible_probe)?.response);
|
||||
if (!probe || probe.method !== "POST" || probe.auth === "none" || !probeResponse || typeof probeResponse.operation !== "string") return undefined;
|
||||
const probe = copyRequest(vector.reversible_probe, ["response"]);
|
||||
const rawProbe = exactRecord(vector.reversible_probe, ["method", "path", "auth", "response"]);
|
||||
const probeResponse = exactRecord(rawProbe?.response, ["operation"]);
|
||||
const operation = identifier(probeResponse?.operation);
|
||||
if (!probe || probe.method !== "POST" || probe.auth === "none" || !operation) return undefined;
|
||||
reversibleProbe = {
|
||||
method: "POST",
|
||||
path: probe.path,
|
||||
auth: probe.auth as "bearer" | "x-api-key",
|
||||
response: { operation: probeResponse.operation },
|
||||
response: { operation },
|
||||
};
|
||||
}
|
||||
diagnostics.vector_rest = { metadata, ...(reversibleProbe ? { reversible_probe: reversibleProbe } : {}) };
|
||||
}
|
||||
if (source.embedding !== undefined) {
|
||||
const request = copyRequest(source.embedding);
|
||||
const response = record(record(source.embedding)?.response);
|
||||
if (!request || !response || typeof response.model !== "string" || typeof response.dimensions !== "string") return undefined;
|
||||
diagnostics.embedding = { ...request, response: { model: response.model, dimensions: response.dimensions } };
|
||||
const request = copyRequest(source.embedding, ["response"]);
|
||||
const raw = exactRecord(source.embedding, ["method", "path", "auth", "response"]);
|
||||
const response = exactRecord(raw?.response, ["model", "dimensions"]);
|
||||
const model = identifier(response?.model);
|
||||
const dimensions = identifier(response?.dimensions);
|
||||
if (!request || !model || !dimensions) return undefined;
|
||||
diagnostics.embedding = { ...request, response: { model, dimensions } };
|
||||
}
|
||||
return diagnostics;
|
||||
}
|
||||
|
||||
function copyWorkspace(value: unknown): CanonicalWorkspace | undefined {
|
||||
const source = record(value);
|
||||
const metadata = record(source?.workspace);
|
||||
const dwh = record(source?.dwh);
|
||||
const semanticIndex = record(source?.semantic_index);
|
||||
const vectorStore = record(semanticIndex?.vector_store);
|
||||
const embedding = record(semanticIndex?.embedding);
|
||||
const policy = record(source?.llm_policy);
|
||||
const source = exactRecord(value, ["workspace", "dwh", "semantic_index", "llm_policy", "diagnostics"]);
|
||||
const metadata = exactRecord(source?.workspace, ["schema_version", "id", "name", "description", "language"]);
|
||||
const dwh = exactRecord(source?.dwh, ["engine", "database", "schema", "port", "timeout_ms", "supported_transports"]);
|
||||
const semanticIndex = exactRecord(source?.semantic_index, ["vector_store", "vector_writer", "embedding"]);
|
||||
const vectorStore = exactRecord(semanticIndex?.vector_store, ["engine", "database", "schema", "collection", "dimensions", "distance", "port", "timeout_ms", "supported_transports"]);
|
||||
const embedding = exactRecord(semanticIndex?.embedding, ["provider", "model", "dimensions", "timeout_ms"]);
|
||||
const policy = exactRecord(source?.llm_policy, ["default", "allowed"]);
|
||||
const diagnostics = source?.diagnostics === undefined ? undefined : copyDiagnostics(source.diagnostics);
|
||||
if (!metadata || !dwh || !semanticIndex || !vectorStore || !embedding || !policy) return undefined;
|
||||
const id = workspaceId(metadata.id);
|
||||
const name = text(metadata.name);
|
||||
const language = oneOf(metadata.language, ["en", "it"] as const);
|
||||
const description = metadata.description === undefined ? undefined : text(metadata.description);
|
||||
const database = identifier(dwh.database);
|
||||
const schema = identifier(dwh.schema);
|
||||
const dwhPort = dwh.port === undefined ? undefined : positiveInteger(dwh.port, 65_535);
|
||||
const dwhTimeout = dwh.timeout_ms === undefined ? undefined : positiveInteger(dwh.timeout_ms);
|
||||
const dwhTransports = uniqueChoices(dwh.supported_transports, ["postgres_direct", "rest_api", "ssh_tunnel"] as const);
|
||||
const vectorDatabase = identifier(vectorStore.database);
|
||||
const vectorSchema = identifier(vectorStore.schema);
|
||||
const collection = identifier(vectorStore.collection);
|
||||
const vectorDimensions = positiveInteger(vectorStore.dimensions, 32_768);
|
||||
const distance = oneOf(vectorStore.distance, ["cosine", "l2", "inner_product"] as const);
|
||||
const vectorPort = vectorStore.port === undefined ? undefined : positiveInteger(vectorStore.port, 65_535);
|
||||
const vectorTimeout = vectorStore.timeout_ms === undefined ? undefined : positiveInteger(vectorStore.timeout_ms);
|
||||
const vectorTransports = uniqueChoices(vectorStore.supported_transports, ["pgvector_direct", "rest_api", "ssh_tunnel"] as const);
|
||||
const embeddingProvider = oneOf(embedding.provider, ["ollama_compatible", "openai_compatible"] as const);
|
||||
const embeddingModel = text(embedding.model);
|
||||
const embeddingDimensions = positiveInteger(embedding.dimensions, 32_768);
|
||||
const embeddingTimeout = embedding.timeout_ms === undefined ? undefined : positiveInteger(embedding.timeout_ms);
|
||||
const allowedModels = uniqueModels(policy.allowed);
|
||||
const defaultModel = policy.default === undefined ? undefined : modelReference(policy.default);
|
||||
if (
|
||||
typeof metadata.schema_version !== "number" || typeof metadata.id !== "string" || typeof metadata.name !== "string"
|
||||
|| typeof metadata.language !== "string" || typeof dwh.database !== "string" || typeof dwh.schema !== "string"
|
||||
|| typeof vectorStore.database !== "string" || typeof vectorStore.schema !== "string"
|
||||
|| typeof vectorStore.collection !== "string" || typeof vectorStore.dimensions !== "number"
|
||||
|| typeof embedding.model !== "string" || typeof embedding.dimensions !== "number"
|
||||
|| !Array.isArray(dwh.supported_transports) || !Array.isArray(vectorStore.supported_transports) || !Array.isArray(policy.allowed)
|
||||
metadata.schema_version !== 2 || !id || !name || !language || (metadata.description !== undefined && !description)
|
||||
|| dwh.engine !== "postgres" || !database || !schema || (dwh.port !== undefined && !dwhPort) || (dwh.timeout_ms !== undefined && !dwhTimeout) || !dwhTransports
|
||||
|| vectorStore.engine !== "pgvector" || !vectorDatabase || !vectorSchema || !collection || !vectorDimensions || !distance || (vectorStore.port !== undefined && !vectorPort) || (vectorStore.timeout_ms !== undefined && !vectorTimeout) || !vectorTransports
|
||||
|| !embeddingProvider || !embeddingModel || !embeddingDimensions || (embedding.timeout_ms !== undefined && !embeddingTimeout) || !allowedModels
|
||||
|| (defaultModel !== undefined && !allowedModels.includes(defaultModel)) || vectorDimensions !== embeddingDimensions
|
||||
|| (semanticIndex.vector_writer !== undefined && !exactRecord(semanticIndex.vector_writer, []))
|
||||
) return undefined;
|
||||
if (source?.diagnostics !== undefined && !diagnostics) return undefined;
|
||||
if (diagnostics?.dwh_rest && !dwhTransports.includes("rest_api")) return undefined;
|
||||
if (diagnostics?.vector_rest && !vectorTransports.includes("rest_api")) return undefined;
|
||||
return {
|
||||
workspace: {
|
||||
schema_version: metadata.schema_version as 2,
|
||||
id: metadata.id,
|
||||
name: metadata.name,
|
||||
...(typeof metadata.description === "string" ? { description: metadata.description } : {}),
|
||||
language: metadata.language as "en" | "it",
|
||||
schema_version: 2,
|
||||
id,
|
||||
name,
|
||||
...(description ? { description } : {}),
|
||||
language,
|
||||
},
|
||||
dwh: {
|
||||
engine: dwh.engine as "postgres",
|
||||
database: dwh.database,
|
||||
schema: dwh.schema,
|
||||
...(typeof dwh.port === "number" ? { port: dwh.port } : {}),
|
||||
...(typeof dwh.timeout_ms === "number" ? { timeout_ms: dwh.timeout_ms } : {}),
|
||||
supported_transports: dwh.supported_transports.filter((transport): transport is "postgres_direct" | "rest_api" | "ssh_tunnel" =>
|
||||
transport === "postgres_direct" || transport === "rest_api" || transport === "ssh_tunnel"),
|
||||
engine: "postgres", database, schema,
|
||||
...(dwhPort ? { port: dwhPort } : {}),
|
||||
...(dwhTimeout ? { timeout_ms: dwhTimeout } : {}),
|
||||
supported_transports: dwhTransports,
|
||||
},
|
||||
semantic_index: {
|
||||
vector_store: {
|
||||
engine: vectorStore.engine as "pgvector",
|
||||
database: vectorStore.database,
|
||||
schema: vectorStore.schema,
|
||||
collection: vectorStore.collection,
|
||||
dimensions: vectorStore.dimensions,
|
||||
distance: vectorStore.distance as "cosine" | "l2" | "inner_product",
|
||||
...(typeof vectorStore.port === "number" ? { port: vectorStore.port } : {}),
|
||||
...(typeof vectorStore.timeout_ms === "number" ? { timeout_ms: vectorStore.timeout_ms } : {}),
|
||||
supported_transports: vectorStore.supported_transports.filter((transport): transport is "pgvector_direct" | "rest_api" | "ssh_tunnel" =>
|
||||
transport === "pgvector_direct" || transport === "rest_api" || transport === "ssh_tunnel"),
|
||||
engine: "pgvector", database: vectorDatabase, schema: vectorSchema, collection, dimensions: vectorDimensions, distance,
|
||||
...(vectorPort ? { port: vectorPort } : {}),
|
||||
...(vectorTimeout ? { timeout_ms: vectorTimeout } : {}),
|
||||
supported_transports: vectorTransports,
|
||||
},
|
||||
...(record(semanticIndex.vector_writer) ? { vector_writer: {} } : {}),
|
||||
...(semanticIndex.vector_writer ? { vector_writer: {} } : {}),
|
||||
embedding: {
|
||||
provider: embedding.provider as "ollama_compatible" | "openai_compatible",
|
||||
model: embedding.model,
|
||||
dimensions: embedding.dimensions,
|
||||
...(typeof embedding.timeout_ms === "number" ? { timeout_ms: embedding.timeout_ms } : {}),
|
||||
provider: embeddingProvider, model: embeddingModel, dimensions: embeddingDimensions,
|
||||
...(embeddingTimeout ? { timeout_ms: embeddingTimeout } : {}),
|
||||
},
|
||||
},
|
||||
llm_policy: {
|
||||
...(typeof policy.default === "string" ? { default: policy.default as `${string}/${string}` } : {}),
|
||||
allowed: policy.allowed.filter((model): model is `${string}/${string}` => typeof model === "string"),
|
||||
...(defaultModel ? { default: defaultModel } : {}), allowed: allowedModels,
|
||||
},
|
||||
...(diagnostics ? { diagnostics } : {}),
|
||||
};
|
||||
}
|
||||
|
||||
function normalize(value: unknown): WorkspaceDraft | undefined {
|
||||
const source = record(value);
|
||||
const source = exactRecord(value, ["workspaceId", "baseCommit", "baseBlob", "workspace", "updatedAt"]);
|
||||
const workspace = copyWorkspace(source?.workspace);
|
||||
if (!source || !workspace || typeof source.workspaceId !== "string" || typeof source.baseCommit !== "string" || typeof source.updatedAt !== "string") {
|
||||
const id = workspaceId(source?.workspaceId);
|
||||
const baseCommit = typeof source?.baseCommit === "string" && /^[0-9a-f]{40}$/.test(source.baseCommit) ? source.baseCommit : undefined;
|
||||
const baseBlob = source?.baseBlob === undefined ? undefined : typeof source.baseBlob === "string" && /^[0-9a-f]{40}$/.test(source.baseBlob) ? source.baseBlob : undefined;
|
||||
const updatedAt = typeof source?.updatedAt === "string" && Number.isFinite(Date.parse(source.updatedAt)) ? source.updatedAt : undefined;
|
||||
if (!source || !workspace || !id || id !== workspace.workspace.id || !baseCommit || (source.baseBlob !== undefined && !baseBlob) || !updatedAt) {
|
||||
return undefined;
|
||||
}
|
||||
return {
|
||||
workspaceId: source.workspaceId,
|
||||
baseCommit: source.baseCommit,
|
||||
...(typeof source.baseBlob === "string" ? { baseBlob: source.baseBlob } : {}),
|
||||
workspaceId: id,
|
||||
baseCommit,
|
||||
...(baseBlob ? { baseBlob } : {}),
|
||||
workspace,
|
||||
updatedAt: source.updatedAt,
|
||||
updatedAt,
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user