ThothII/backend/test/routes-pi-management.test.ts

import { expect, test, vi } from "vitest";
import { buildApp } from "../src/app.js";
import { loadConfig } from "../src/config.js";
import type { PiManagementService } from "../src/pi/management.js";
import { piManagementRoutes } from "../src/routes/pi-management.js";

void piManagementRoutes;

function fakeService(): PiManagementService {
  return {
    status: vi.fn(async () => ({
      version: "0.80.3", ready: true,
      config: { provider: "zai", model: "glm-5.2", reasoning: "medium" },
      checkedAt: "2026-08-05T10:00:00.000Z",
    })),
    options: vi.fn(async () => ({
      providers: ["zai"], models: [{ provider: "zai", id: "glm-5.2" }],
      reasoning: ["low", "medium", "high"], checkedAt: "2026-08-05T10:00:00.000Z",
    })),
    configure: vi.fn(async (value) => ({ ...value, updatedAt: "2026-08-05T10:00:00.000Z" })),
    test: vi.fn(async () => ({ ready: true, checkedAt: "2026-08-05T10:00:00.000Z" })),
    logs: vi.fn(async () => ({ lines: ["Pi smoke check succeeded"], checkedAt: "2026-08-05T10:00:00.000Z" })),
  };
}

function appWith(service: PiManagementService, env: Record<string, string> = {}) {
  return buildApp(loadConfig({ THT_HARNESS_DIR: "../harness", ...env }), {
    thtRunner: {} as any,
    piManagement: service,
  });
}

const adminHeaders = {
  "x-thoth-principal-issuer": "portal",
  "x-thoth-principal-subject": "operator",
  "x-thoth-is-admin": "1",
};

const exposedServerEnv = {
  AUTH_MODE: "upstream",
  THOTH_PUBLIC_EXPOSURE: "true",
  THT_SESSION_STORAGE: "postgres",
  THT_SESSION_DB_HOST: "db.example.invalid",
  THT_SESSION_DB_NAME: "thoth_sessions",
  THT_SESSION_RUNTIME_USER: "thoth_runtime",
  THT_SESSION_RUNTIME_PASSWORD_FILE: "/run/secrets/session-password",
  THT_SESSION_DB_SSLMODE: "verify-full",
  THT_SESSION_DB_SSLROOTCERT: "/run/secrets/session-ca.pem",
};

// Catches a server deployment that lets an ordinary authenticated user inspect or mutate
// installation-wide Pi configuration without the trusted upstream admin claim.
test("exposed upstream deployments reject Pi Management without a trusted admin identity", async () => {
  const service = fakeService();
  const app = appWith(service, exposedServerEnv);
  try {
    const response = await app.inject({
      method: "GET", url: "/pi-management/status",
      headers: { ...adminHeaders, "x-thoth-is-admin": "0" },
    });

    expect(response.statusCode).toBe(403);
    expect(response.json()).toEqual({ code: "pi_management_forbidden", error: "Pi management is not permitted" });
    expect(service.status).not.toHaveBeenCalled();
  } finally {
    await app.close();
  }
});

// Catches an accidental privilege regression that blocks safe loopback-only installations or
// returns fields beyond the sanctioned Pi Management status contract.
test("loopback-only AUTH_MODE=none may read the sanitized Pi status", async () => {
  const app = appWith(fakeService());
  try {
    const response = await app.inject({ method: "GET", url: "/pi-management/status" });

    expect(response.statusCode).toBe(200);
    expect(response.json()).toEqual({
      version: "0.80.3", ready: true,
      config: { provider: "zai", model: "glm-5.2", reasoning: "medium" },
      checkedAt: "2026-08-05T10:00:00.000Z",
    });
  } finally {
    await app.close();
  }
});

// Catches an arbitrary website using browser CORS to mutate a loopback-only installation's Pi
// defaults or trigger provider work with the local user's authority.
test("loopback-only management rejects cross-origin writes", async () => {
  const service = fakeService();
  const app = appWith(service);
  try {
    const configured = await app.inject({
      method: "PUT", url: "/pi-management/config",
      headers: { host: "127.0.0.1:8080", origin: "https://evil.example" },
      payload: { provider: "zai", model: "glm-5.2", reasoning: "high" },
    });
    const smoke = await app.inject({
      method: "POST", url: "/pi-management/test",
      headers: { host: "127.0.0.1:8080", origin: "https://evil.example" },
    });

    expect(configured.statusCode).toBe(403);
    expect(smoke.statusCode).toBe(403);
    expect(service.configure).not.toHaveBeenCalled();
    expect(service.test).not.toHaveBeenCalled();
  } finally {
    await app.close();
  }
});

// Catches an origin guard that also blocks the same-origin Docker frontend or non-browser local
// lifecycle clients that do not send Origin.
test("loopback-only management preserves same-origin frontend and origin-less local writes", async () => {
  const service = fakeService();
  const app = appWith(service);
  try {
    const sameOrigin = await app.inject({
      method: "PUT", url: "/pi-management/config",
      headers: { host: "127.0.0.1:8080", origin: "http://127.0.0.1:8080" },
      payload: { provider: "zai", model: "glm-5.2", reasoning: "high" },
    });
    const lifecycleClient = await app.inject({ method: "POST", url: "/pi-management/test" });

    expect(sameOrigin.statusCode).toBe(200);
    expect(lifecycleClient.statusCode).toBe(200);
  } finally {
    await app.close();
  }
});

// Catches route wiring that bypasses closed service validation or gives the browser a Docker/image
// lifecycle endpoint rather than only installation-default configuration and diagnostics.
test("trusted admins receive only configuration, smoke, options, and log endpoints", async () => {
  const service = fakeService();
  const app = appWith(service, exposedServerEnv);
  try {
    const options = await app.inject({ method: "GET", url: "/pi-management/options", headers: adminHeaders });
    const configured = await app.inject({
      method: "PUT", url: "/pi-management/config", headers: adminHeaders,
      payload: { provider: "zai", model: "glm-5.2", reasoning: "high" },
    });
    const smoke = await app.inject({ method: "POST", url: "/pi-management/test", headers: adminHeaders });
    const logs = await app.inject({ method: "GET", url: "/pi-management/logs", headers: adminHeaders });

    expect(options.statusCode).toBe(200);
    expect(configured.statusCode).toBe(200);
    expect(configured.json()).toMatchObject({ provider: "zai", model: "glm-5.2", reasoning: "high" });
    expect(smoke.statusCode).toBe(200);
    expect(logs.statusCode).toBe(200);
    expect(app.printRoutes()).not.toContain("update");
    expect(app.printRoutes()).not.toContain("rollback");
  } finally {
    await app.close();
  }
});