refactor: remove legacy workspace runtime branches
This commit is contained in:
@@ -12,32 +12,6 @@ import {
|
||||
import { supportsSessionRuntime } from "../src/workspaces/bindings.js";
|
||||
import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
|
||||
|
||||
const workspace = parseWorkspaceYaml(`workspace:
|
||||
schema_version: 2
|
||||
id: psd-clinical
|
||||
name: Policlinico San Donato
|
||||
language: it
|
||||
dwh:
|
||||
engine: postgres
|
||||
database: postgres
|
||||
schema: datawarehouse
|
||||
supported_transports: [postgres_direct, rest_api]
|
||||
semantic_index:
|
||||
vector_store:
|
||||
engine: pgvector
|
||||
database: postgres
|
||||
schema: vectors
|
||||
collection: clinical_documents
|
||||
dimensions: 768
|
||||
distance: cosine
|
||||
supported_transports: [pgvector_direct, rest_api]
|
||||
embedding:
|
||||
provider: ollama_compatible
|
||||
model: nomic-embed-text-v2-moe
|
||||
dimensions: 768
|
||||
llm_policy:
|
||||
allowed: [zai/glm-5.2]
|
||||
`);
|
||||
const workspaceV3 = parseWorkspaceYaml(`workspace:
|
||||
schema_version: 3
|
||||
id: psd-clinical
|
||||
@@ -47,7 +21,7 @@ dwh:
|
||||
engine: postgres
|
||||
database: postgres
|
||||
schema: datawarehouse
|
||||
supported_transports: [postgres_direct, rest_api]
|
||||
supported_transports: [postgres_direct, rest_api, ssh_tunnel]
|
||||
semantic_index:
|
||||
vector_store:
|
||||
engine: qdrant
|
||||
@@ -59,6 +33,7 @@ semantic_index:
|
||||
model: qwen3-embedding:0.6b
|
||||
dimensions: 1024
|
||||
llm_policy:
|
||||
default: zai/glm-5.2
|
||||
allowed: [zai/glm-5.2]
|
||||
`);
|
||||
const paths: RuntimePaths = {
|
||||
@@ -72,31 +47,6 @@ const semanticRuntime: SemanticRuntimeConfig = {
|
||||
internalEmbeddingModel: "qwen3-embedding:0.6b",
|
||||
internalEmbeddingDimensions: 1024,
|
||||
};
|
||||
const legacyWorkspace = parseWorkspaceYaml(`workspace:
|
||||
schema_version: 1
|
||||
id: psd-clinical
|
||||
name: Policlinico San Donato
|
||||
language: it
|
||||
dwh:
|
||||
engine: postgres
|
||||
database: postgres
|
||||
schema: datawarehouse
|
||||
supported_transports: [postgres_direct]
|
||||
semantic_index:
|
||||
vector_store:
|
||||
engine: pgvector
|
||||
collection: clinical_documents
|
||||
dimensions: 768
|
||||
distance: cosine
|
||||
supported_transports: [pgvector_direct]
|
||||
embedding:
|
||||
provider: ollama_compatible
|
||||
model: nomic-embed-text-v2-moe
|
||||
dimensions: 768
|
||||
llm_policy:
|
||||
allowed: [zai/glm-5.2]
|
||||
`);
|
||||
|
||||
const directBindings: RuntimeBindings = {
|
||||
dwh: {
|
||||
transport: "postgres_direct",
|
||||
@@ -109,44 +59,13 @@ const directBindings: RuntimeBindings = {
|
||||
THT_WS_PSD_CLINICAL_DWH_TLS_CA_FILE: "/run/secrets/dwh-ca.pem",
|
||||
},
|
||||
},
|
||||
vector: {
|
||||
transport: "pgvector_direct",
|
||||
missing: [],
|
||||
values: {
|
||||
THT_WS_PSD_CLINICAL_VECTOR_HOST: "vector.internal",
|
||||
THT_WS_PSD_CLINICAL_VECTOR_PORT: "5432",
|
||||
THT_WS_PSD_CLINICAL_VECTOR_USER: "vector_reader",
|
||||
THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_FILE: "/run/secrets/vector-password",
|
||||
THT_WS_PSD_CLINICAL_VECTOR_TLS_CA_FILE: "/run/secrets/vector-ca.pem",
|
||||
},
|
||||
},
|
||||
vectorWriter: { transport: "rest_api", missing: [], values: {} },
|
||||
embedding: {
|
||||
transport: "rest_api",
|
||||
missing: [],
|
||||
values: { THT_WS_PSD_CLINICAL_EMBEDDING_BASE_URL: "http://embedding.internal:11434" },
|
||||
},
|
||||
evidence: { missing: [], values: {} },
|
||||
};
|
||||
|
||||
test("runtime support stays fail-closed for either SSH connector", () => {
|
||||
expect(supportsSessionRuntime(directBindings)).toBe(true);
|
||||
expect(supportsSessionRuntime({
|
||||
...directBindings,
|
||||
dwh: { ...directBindings.dwh, transport: "ssh_tunnel" },
|
||||
})).toBe(false);
|
||||
expect(supportsSessionRuntime({
|
||||
...directBindings,
|
||||
vector: { ...directBindings.vector, transport: "ssh_tunnel" },
|
||||
})).toBe(false);
|
||||
});
|
||||
|
||||
test("renders a direct PostgreSQL binding to the legacy harness shape", () => {
|
||||
const yaml = renderRuntimeConfig(workspace, directBindings, paths, {
|
||||
workspaceId: "psd-clinical",
|
||||
workspaceRevision: "a".repeat(40),
|
||||
});
|
||||
const rendered = parse(yaml);
|
||||
test("renders only the schema-v3 internal Qdrant and Ollama runtime shape", () => {
|
||||
const rendered = parse(renderRuntimeConfig(workspaceV3, directBindings, paths, {
|
||||
workspaceId: "psd-clinical", workspaceRevision: "a".repeat(40),
|
||||
}, {}, semanticRuntime));
|
||||
|
||||
expect(rendered).toMatchObject({
|
||||
runtime_identity: {
|
||||
@@ -156,151 +75,53 @@ test("renders a direct PostgreSQL binding to the legacy harness shape", () => {
|
||||
},
|
||||
language: "it",
|
||||
database: {
|
||||
host: "dwh.internal",
|
||||
port: 5432,
|
||||
database: "postgres",
|
||||
schema: "datawarehouse",
|
||||
user: "thoth_reader",
|
||||
password_file: "/run/secrets/dwh-password",
|
||||
ssl_ca_file: "/run/secrets/dwh-ca.pem",
|
||||
transport: "direct",
|
||||
host: "dwh.internal", port: 5432, database: "postgres", schema: "datawarehouse",
|
||||
user: "thoth_reader", password_file: "/run/secrets/dwh-password",
|
||||
ssl_ca_file: "/run/secrets/dwh-ca.pem", transport: "direct",
|
||||
},
|
||||
vector_db: {
|
||||
host: "vector.internal",
|
||||
database: "postgres",
|
||||
schema: "vectors",
|
||||
password_file: "/run/secrets/vector-password",
|
||||
ssl_ca_file: "/run/secrets/vector-ca.pem",
|
||||
},
|
||||
embeddings: {
|
||||
base_url: "http://embedding.internal:11434",
|
||||
model: "nomic-embed-text-v2-moe",
|
||||
dim: 768,
|
||||
dwh: { type: "postgres_direct" },
|
||||
resources: {
|
||||
vector: { engine: "qdrant", base_url: "http://qdrant:6333", collection: "psd-clinical" },
|
||||
embeddings: {
|
||||
provider: "ollama_internal", base_url: "http://embedding:11434",
|
||||
model: "qwen3-embedding:0.6b", dimensions: 1024,
|
||||
},
|
||||
},
|
||||
paths,
|
||||
});
|
||||
expect(yaml).toContain("type: postgres_direct");
|
||||
expect(yaml).toContain("schema: datawarehouse");
|
||||
});
|
||||
|
||||
test("refuses to render a v1 descriptor until an explicit migration creates v2", () => {
|
||||
expect(() => renderRuntimeConfig(legacyWorkspace, directBindings, paths)).toThrow(/migrat/i);
|
||||
});
|
||||
|
||||
test("fails closed for v3 runtime rendering and session support", () => {
|
||||
expect(supportsSessionRuntime(directBindings)).toBe(true);
|
||||
const rendered = parse(renderRuntimeConfig(workspaceV3, directBindings, paths, undefined, {}, semanticRuntime));
|
||||
|
||||
expect(rendered.resources).toMatchObject({
|
||||
vector: {
|
||||
engine: "qdrant",
|
||||
base_url: "http://qdrant:6333",
|
||||
collection: "psd-clinical",
|
||||
},
|
||||
embeddings: {
|
||||
provider: "ollama_internal",
|
||||
base_url: "http://embedding:11434",
|
||||
model: "qwen3-embedding:0.6b",
|
||||
dimensions: 1024,
|
||||
},
|
||||
});
|
||||
expect(rendered).not.toHaveProperty("vector_db");
|
||||
expect(rendered).not.toHaveProperty("embeddings");
|
||||
expect(rendered).not.toHaveProperty("vector_rest");
|
||||
});
|
||||
|
||||
test("schema v3 runtime rendering never exposes external semantic endpoints from bindings", () => {
|
||||
test("renders schema-v3 DWH REST without exposing secret contents", () => {
|
||||
const rendered = parse(renderRuntimeConfig(workspaceV3, {
|
||||
...directBindings,
|
||||
vector: {
|
||||
transport: "rest_api",
|
||||
missing: [],
|
||||
values: {
|
||||
THT_WS_PSD_CLINICAL_VECTOR_BASE_URL: "https://vector.example.test",
|
||||
THT_WS_PSD_CLINICAL_VECTOR_API_KEY_FILE: "/run/secrets/vector-api-key",
|
||||
},
|
||||
},
|
||||
embedding: {
|
||||
transport: "rest_api",
|
||||
missing: [],
|
||||
values: {
|
||||
THT_WS_PSD_CLINICAL_EMBEDDING_BASE_URL: "https://embedding.example.test",
|
||||
},
|
||||
},
|
||||
}, paths, undefined, {}, semanticRuntime));
|
||||
|
||||
expect(rendered.resources.vector).toMatchObject({
|
||||
engine: "qdrant",
|
||||
base_url: "http://qdrant:6333",
|
||||
collection: "psd-clinical",
|
||||
});
|
||||
expect(rendered.resources.embeddings).toMatchObject({
|
||||
provider: "ollama_internal",
|
||||
base_url: "http://embedding:11434",
|
||||
model: "qwen3-embedding:0.6b",
|
||||
dimensions: 1024,
|
||||
});
|
||||
expect(rendered).not.toHaveProperty("embeddings");
|
||||
expect(JSON.stringify(rendered)).not.toContain("vector.example.test");
|
||||
expect(JSON.stringify(rendered)).not.toContain("embedding.example.test");
|
||||
});
|
||||
|
||||
test("omits direct TLS fields when binding validation did not retain a file path", () => {
|
||||
const dwhValues = { ...directBindings.dwh.values };
|
||||
const vectorValues = { ...directBindings.vector.values };
|
||||
delete dwhValues.THT_WS_PSD_CLINICAL_DWH_TLS_CA_FILE;
|
||||
delete vectorValues.THT_WS_PSD_CLINICAL_VECTOR_TLS_CA_FILE;
|
||||
const yaml = renderRuntimeConfig(workspace, {
|
||||
...directBindings,
|
||||
dwh: {
|
||||
...directBindings.dwh,
|
||||
values: dwhValues,
|
||||
},
|
||||
vector: {
|
||||
...directBindings.vector,
|
||||
values: vectorValues,
|
||||
},
|
||||
}, paths);
|
||||
const rendered = parse(yaml);
|
||||
|
||||
expect(rendered.database).not.toHaveProperty("ssl_ca_file");
|
||||
expect(rendered.vector_db).not.toHaveProperty("ssl_ca_file");
|
||||
});
|
||||
|
||||
test("renders REST bindings through the legacy rest sections without secret values", () => {
|
||||
const yaml = renderRuntimeConfig(workspace, {
|
||||
...directBindings,
|
||||
dwh: {
|
||||
transport: "rest_api",
|
||||
missing: [],
|
||||
values: {
|
||||
transport: "rest_api", missing: [], values: {
|
||||
THT_WS_PSD_CLINICAL_DWH_BASE_URL: "https://dwh.example.test",
|
||||
THT_WS_PSD_CLINICAL_DWH_API_KEY_FILE: "/run/secrets/dwh-api-key",
|
||||
THT_WS_PSD_CLINICAL_DWH_TLS_CA_FILE: "/run/secrets/ca.pem",
|
||||
},
|
||||
},
|
||||
vector: {
|
||||
transport: "rest_api",
|
||||
missing: [],
|
||||
values: {
|
||||
THT_WS_PSD_CLINICAL_VECTOR_BASE_URL: "https://vector.example.test",
|
||||
THT_WS_PSD_CLINICAL_VECTOR_API_KEY_FILE: "/run/secrets/vector-api-key",
|
||||
},
|
||||
},
|
||||
}, paths);
|
||||
const rendered = parse(yaml);
|
||||
evidence: { missing: [], values: {} },
|
||||
}, paths));
|
||||
|
||||
expect(rendered).toMatchObject({
|
||||
database: { transport: "rest", schema: "datawarehouse" },
|
||||
rest: {
|
||||
base_url: "https://dwh.example.test",
|
||||
api_key_file: "/run/secrets/dwh-api-key",
|
||||
ssl_ca_file: "/run/secrets/ca.pem",
|
||||
},
|
||||
vector_rest: {
|
||||
base_url: "https://vector.example.test",
|
||||
api_key_file: "/run/secrets/vector-api-key",
|
||||
},
|
||||
expect(rendered.rest).toEqual({
|
||||
base_url: "https://dwh.example.test", api_key_file: "/run/secrets/dwh-api-key",
|
||||
});
|
||||
expect(yaml).not.toContain("\n api_key: ");
|
||||
expect(rendered.dwh).toMatchObject({
|
||||
type: "thoth_rest", database: { database: "postgres", schema: "datawarehouse" },
|
||||
});
|
||||
expect(JSON.stringify(rendered)).not.toContain("api_key:");
|
||||
});
|
||||
|
||||
test("runtime support is fail-closed for DWH SSH and incomplete Evidence", () => {
|
||||
expect(supportsSessionRuntime(directBindings)).toBe(true);
|
||||
expect(supportsSessionRuntime({
|
||||
...directBindings, dwh: { ...directBindings.dwh, transport: "ssh_tunnel" },
|
||||
})).toBe(false);
|
||||
expect(supportsSessionRuntime({
|
||||
...directBindings, evidence: { values: {}, missing: ["EVIDENCE_FILE"] },
|
||||
})).toBe(false);
|
||||
});
|
||||
|
||||
const evidenceSecretRoots: string[] = [];
|
||||
|
||||
Reference in New Issue
Block a user