ThothII/backend/test/workspace-runtime-config-lease.test.ts

import { execFile } from "node:child_process";
import {
  chmodSync,
  existsSync,
  mkdtempSync,
  mkdirSync,
  readFileSync,
  rmSync,
  statSync,
  symlinkSync,
  writeFileSync,
} from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { promisify } from "node:util";
import { afterEach, expect, test, vi } from "vitest";
import { WorkspaceRegistry } from "../src/workspaces/registry.js";
import type { WorkspaceRegistryConfig } from "../src/workspaces/types.js";
import {
  publishDeterministicRuntimeConfigLease,
  renderActiveWorkspaceRuntime,
  renderWorkspaceRuntimeFromSnapshotPath,
} from "../src/workspaces/runtime-config-lease.js";

const runFile = promisify(execFile);
const roots: string[] = [];

afterEach(() => {
  vi.unstubAllEnvs();
  roots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true }));
});

async function git(cwd: string, args: string[]): Promise<string> {
  return (await runFile("git", args, { cwd })).stdout.trim();
}

async function fixture() {
  const root = mkdtempSync(join(tmpdir(), "tht-runtime-lease-"));
  roots.push(root);
  const remote = join(root, "remote.git");
  const source = join(root, "source");
  const registryRoot = join(root, "registry");
  const secretRoot = join(root, "secrets");
  const dataRoot = join(root, "data");
  const harnessDir = join(root, "harness");
  mkdirSync(harnessDir, { recursive: true });
  mkdirSync(join(harnessDir, "config"), { recursive: true });
  writeFileSync(join(harnessDir, "config", "tht.yaml"), `session_storage:
  mode: local
profile: server
`);

  await git(root, ["init", "--bare", "--initial-branch=main", remote]);
  mkdirSync(source);
  await git(source, ["init", "--initial-branch=main"]);
  await git(source, ["config", "user.name", "Runtime Lease Test"]);
  await git(source, ["config", "user.email", "runtime-lease@example.invalid"]);
  writeFileSync(join(source, "thoth-workspaces.yaml"), `schema_version: 1
workspaces: [{id: psd-clinical, name: Runtime Lease}]
`);
  mkdirSync(join(source, "psd-clinical", "evidence"), { recursive: true });
  writeFileSync(join(source, "psd-clinical", "workspace.yaml"), `workspace:
  schema_version: 3
  id: psd-clinical
  name: Runtime Lease
  language: en
dwh:
  engine: postgres
  database: analytics
  schema: mart
  supported_transports: [postgres_direct]
semantic_index:
  vector_store:
    engine: qdrant
    collection: psd-clinical
    dimensions: 1024
    distance: cosine
  embedding:
    provider: ollama_internal
    model: qwen3-embedding:0.6b
    dimensions: 1024
llm_policy:
  allowed: [zai/glm-5.2]
evidence:
  source:
    type: filesystem
    uri: psd-clinical/evidence
`);
  writeFileSync(join(source, "psd-clinical", "evidence", "guide.md"), `# hello
`);
  await git(source, ["add", "."]);
  await git(source, ["commit", "-m", "Canonical workspace"]);
  await git(source, ["remote", "add", "origin", remote]);
  await git(source, ["push", "origin", "main"]);

  mkdirSync(secretRoot);
  const passwordFile = join(secretRoot, "dwh-password");
  writeFileSync(passwordFile, "secret", { mode: 0o600 });
  chmodSync(passwordFile, 0o600);
  mkdirSync(dataRoot);

  const registryConfig: WorkspaceRegistryConfig = {
    root: registryRoot,
    remoteUrl: remote,
    branch: "main",
    gitAuthorName: "Runtime Lease Test",
    gitAuthorEmail: "runtime-lease@example.invalid",
    installationId: "test",
    secretRoots: [secretRoot],
    maxImportBytes: 1024 * 1024,
    maxImportEntries: 16,
  };
  const registry = new WorkspaceRegistry(registryConfig);
  await registry.bootstrap();
  const revision = (await registry.list())[0];

  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_TRANSPORT", "postgres_direct");
  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "warehouse.internal");
  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_PORT", "5432");
  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_USER", "reader");
  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE", passwordFile);

  return {
    dataRoot,
    harnessDir,
    registry,
    registryConfig,
    revision,
  };
}

const semanticRuntime = {
  internalQdrantUrl: "http://qdrant:6333",
  internalEmbeddingUrl: "http://embedding:11434",
  internalEmbeddingModel: "qwen3-embedding:0.6b",
  internalEmbeddingDimensions: 1024,
};

test("active workspace rendering is byte-identical to direct snapshot rendering", async () => {
  const f = await fixture();
  const direct = renderWorkspaceRuntimeFromSnapshotPath({
    snapshotPath: f.revision.snapshotPath,
    harnessDir: f.harnessDir,
    configPath: "config/tht.yaml",
    dataRoot: f.dataRoot,
    secretRoots: f.registryConfig.secretRoots,
    semanticRuntime,
  });
  const active = await renderActiveWorkspaceRuntime({
    workspaceId: "psd-clinical",
    registry: f.registry,
    registryConfig: f.registryConfig,
    harnessDir: f.harnessDir,
    configPath: "config/tht.yaml",
    dataRoot: f.dataRoot,
    secretRoots: f.registryConfig.secretRoots,
    semanticRuntime,
  });

  expect(active.renderedConfig).toBe(direct.renderedConfig);
  expect(active.workspaceRevision).toBe(f.revision.commit);
  expect(active.descriptorBlob).toMatch(/^sha256:[0-9a-f]{64}$/);
  expect(active.catalogBlob).toMatch(/^[0-9a-f]{40}$/);
});

test("deterministic operator leases publish one revision-bound protected config and refuse changed same-revision bytes", async () => {
  const f = await fixture();
  const first = await publishDeterministicRuntimeConfigLease({
    workspaceId: "psd-clinical",
    registry: f.registry,
    registryConfig: f.registryConfig,
    harnessDir: f.harnessDir,
    configPath: "config/tht.yaml",
    dataRoot: f.dataRoot,
    secretRoots: f.registryConfig.secretRoots,
    semanticRuntime,
  });
  const second = await publishDeterministicRuntimeConfigLease({
    workspaceId: "psd-clinical",
    registry: f.registry,
    registryConfig: f.registryConfig,
    harnessDir: f.harnessDir,
    configPath: "config/tht.yaml",
    dataRoot: f.dataRoot,
    secretRoots: f.registryConfig.secretRoots,
    semanticRuntime,
  });

  expect(second.path).toBe(first.path);
  expect(first.path).toBe(join(
    f.dataRoot,
    "sessions",
    "psd-clinical",
    "preprocessing",
    "runtime-config",
    `${f.revision.commit}.yaml`,
  ));
  expect(statSync(first.path).mode & 0o777).toBe(0o400);
  expect(statSync(first.manifestPath).mode & 0o777).toBe(0o600);
  expect(readFileSync(first.path, "utf8")).toContain("collection_lifecycle: require_existing");
  expect(existsSync(first.manifestPath)).toBe(true);

  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "warehouse-two.internal");
  await expect(publishDeterministicRuntimeConfigLease({
    workspaceId: "psd-clinical",
    registry: f.registry,
    registryConfig: f.registryConfig,
    harnessDir: f.harnessDir,
    configPath: "config/tht.yaml",
    dataRoot: f.dataRoot,
    secretRoots: f.registryConfig.secretRoots,
    semanticRuntime,
  })).rejects.toMatchObject({ code: "effective_config_mismatch" });
});

test("runtime rendering rejects untrusted snapshot paths and symlinks", async () => {
  const f = await fixture();
  const outside = join(f.dataRoot, "outside.yaml");
  writeFileSync(outside, readFileSync(f.revision.snapshotPath, "utf8"));
  const symlink = join(f.dataRoot, "alias.yaml");
  symlinkSync(f.revision.snapshotPath, symlink);

  expect(() => renderWorkspaceRuntimeFromSnapshotPath({
    snapshotPath: outside,
    harnessDir: f.harnessDir,
    configPath: "config/tht.yaml",
    dataRoot: f.dataRoot,
    secretRoots: f.registryConfig.secretRoots,
    semanticRuntime,
  })).toThrow(/trusted runtime snapshot/i);
  expect(() => renderWorkspaceRuntimeFromSnapshotPath({
    snapshotPath: symlink,
    harnessDir: f.harnessDir,
    configPath: "config/tht.yaml",
    dataRoot: f.dataRoot,
    secretRoots: f.registryConfig.secretRoots,
    semanticRuntime,
  })).toThrow(/trusted runtime snapshot/i);
});