ThothII/backend/test/routes-settings.test.ts

import { test, expect } from "vitest";
import { mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { buildApp } from "../src/app.js";
import { loadConfig } from "../src/config.js";

function appWithTmpSettings(extraEnv: Record<string, string> = {}, deps = {}) {
  const dir = mkdtempSync(join(tmpdir(), "tht-set-route-"));
  const app = buildApp(
    loadConfig({ THT_HARNESS_DIR: "../harness", SETTINGS_FILE: join(dir, "settings.json"), ...extraEnv }),
    { thtRunner: {} as any, ...deps },
  );
  return { app, dir };
}

test("GET /settings returns effective defaults (env provider/model/thinking, first workspace)", async () => {
  const { app, dir } = appWithTmpSettings({ PI_PROVIDER: "zai", PI_MODEL: "glm-5.2", PI_THINKING: "medium" }, {
    listModels: async () => [{ provider: "zai", id: "glm-5.2", name: "GLM 5.2", reasoning: true }],
  });
  try {
    const res = await app.inject({ method: "GET", url: "/settings" });
    expect(res.statusCode).toBe(200);
    const body = res.json();
    expect(body.provider).toBe("zai");
    expect(body.model).toBe("glm-5.2");
    expect(body.thinking).toBe("medium");
    expect(typeof body.workspace).toBe("string"); // first workspace from ../harness/workspaces
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

test("PUT /settings persists and GET reads it back", async () => {
  const { app, dir } = appWithTmpSettings({}, {
    listModels: async () => [{ provider: "zai", id: "glm-5.2", name: "GLM 5.2", reasoning: true }],
  });
  try {
    const put = await app.inject({
      method: "PUT", url: "/settings",
      payload: { workspace: "psd", provider: "zai", model: "glm-5.2", thinking: "high" },
    });
    expect(put.statusCode).toBe(200);
    const got = await app.inject({ method: "GET", url: "/settings" });
    expect(got.json()).toMatchObject({ workspace: "psd", provider: "zai", model: "glm-5.2", thinking: "high" });
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

test("settings are isolated by the authenticated repository principal", async () => {
  const preferences = new Map<string, any>();
  const runner = {
    withPrincipal: (principal: any) => ({
      preferencesGet: async () => preferences.get(principal.subject) ?? {},
      preferencesSet: async (next: any) => { preferences.set(principal.subject, next); },
    }),
  };
  const app = buildApp(loadConfig({ AUTH_MODE: "upstream", THT_HARNESS_DIR: "../harness" }), {
    thtRunner: runner as any,
    listModels: async () => [],
  });
  const headers = (subject: string) => ({
    "x-thoth-principal-issuer": "portal",
    "x-thoth-principal-subject": subject,
    "x-thoth-is-admin": "0",
  });

  await app.inject({
    method: "PUT", url: "/settings", headers: headers("alice"),
    payload: { workspace: "psd", provider: "zai", model: "glm-5.2", thinking: "high" },
  });
  const alice = await app.inject({ method: "GET", url: "/settings", headers: headers("alice") });
  const bob = await app.inject({ method: "GET", url: "/settings", headers: headers("bob") });

  expect(alice.json()).toMatchObject({ workspace: "psd", thinking: "high" });
  expect(bob.json()).not.toMatchObject({ workspace: "psd", thinking: "high" });
});

test("PUT /settings rejects an unknown model when a model list is available", async () => {
  const { app, dir } = appWithTmpSettings({}, {
    listModels: async () => [{ provider: "zai", id: "glm-5.2", name: "GLM 5.2", reasoning: true }],
  });
  try {
    const put = await app.inject({
      method: "PUT", url: "/settings",
      payload: { workspace: "psd", provider: "zai", model: "does-not-exist", thinking: "low" },
    });
    expect(put.statusCode).toBe(400);
    expect(put.json()).toMatchObject({ error: expect.stringMatching(/model/i) });
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

test("PUT /settings validates provider and model as one composite identifier", async () => {
  const { app, dir } = appWithTmpSettings({}, {
    listModels: async () => [
      { provider: "provider-a", id: "shared-id", name: "A", reasoning: false },
    ],
  });
  try {
    const wrongProvider = await app.inject({
      method: "PUT", url: "/settings",
      payload: {
        workspace: "psd", provider: "provider-b", model: "shared-id", thinking: "low",
      },
    });
    expect(wrongProvider.statusCode).toBe(400);

    const exactPair = await app.inject({
      method: "PUT", url: "/settings",
      payload: {
        workspace: "psd", provider: "provider-a", model: "shared-id", thinking: "low",
      },
    });
    expect(exactPair.statusCode).toBe(200);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

test("PUT /settings allows any model when model list is empty (Pi unavailable)", async () => {
  const { app, dir } = appWithTmpSettings({}, { listModels: async () => [] });
  try {
    const put = await app.inject({
      method: "PUT", url: "/settings",
      payload: { workspace: "psd", model: "whatever", thinking: "low" },
    });
    expect(put.statusCode).toBe(200);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

test("CORS preflight allows PUT /settings (browser can save settings)", async () => {
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {} as any,
    listModels: async () => [],
  });
  const res = await app.inject({
    method: "OPTIONS",
    url: "/settings",
    headers: {
      origin: "http://localhost:5173",
      "access-control-request-method": "PUT",
    },
  });
  // @fastify/cors answers the preflight; PUT must be in the allowed methods.
  expect(res.headers["access-control-allow-methods"]).toMatch(/PUT/);
});