| 1 | package console |
| 2 | |
| 3 | // Console UI for release pipelines v2 (pipelinepage.go, ladder.go's |
| 4 | // pipeline-aware assembleLadder, app_overview.html's pending card, |
| 5 | // app_releases.html's hidden-vocabulary wrap): the three properties the |
| 6 | // brief pins, in the order they'd hurt if lost — a one-channel app shows |
| 7 | // none of the ladder's vocabulary, a multi-channel pipeline draws its own |
| 8 | // channels (in order, with their own gate sentence) and the settings page |
| 9 | // offers the two starter templates on a still-default pipeline, and the |
| 10 | // pending-changes card shows real quorum progress with working controls. |
| 11 | |
| 12 | import ( |
| 13 | "context" |
| 14 | "net/http" |
| 15 | "net/url" |
| 16 | "strings" |
| 17 | "testing" |
| 18 | "time" |
| 19 | |
| 20 | "github.com/carlosframework/platform/internal/release" |
| 21 | ) |
| 22 | |
| 23 | func TestOneChannelAppHidesChannelVocabulary(t *testing.T) { |
| 24 | fx := newConsoleFixture(t) |
| 25 | token := cliToken(t, fx, "paul@keymail.dev", "code-hide-vocab") |
| 26 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 27 | map[string]string{"name": "solo"}, token); status != http.StatusOK { |
| 28 | t.Fatalf("create app = %d %v", status, out) |
| 29 | } |
| 30 | |
| 31 | c := signInPaul(t, fx) |
| 32 | status, _, body := get(t, c, fx.u("/apps/solo/releases")) |
| 33 | if status != http.StatusOK { |
| 34 | t.Fatalf("app page = %d", status) |
| 35 | } |
| 36 | assertNoChannelVocabulary(t, body) |
| 37 | // The releases list and observed-deployment summary are still there — |
| 38 | // hidden means no CHANNEL vocabulary, not no page. |
| 39 | if !strings.Contains(body, "Nothing shipped yet") { |
| 40 | t.Errorf("one-channel app page does not show the releases list:\n%s", body) |
| 41 | } |
| 42 | if !strings.Contains(body, `aria-label="Release status"`) { |
| 43 | t.Errorf("one-channel app page does not show the deployment summary:\n%s", body) |
| 44 | } |
| 45 | |
| 46 | // Ship TWO builds and land both on the entry channel — still no |
| 47 | // vocabulary. Two promotions, not one, deliberately: the second gives the |
| 48 | // pointer a history, which is the state in which the rollback control |
| 49 | // renders (PR #258 review, I2). Tested with one promotion, this assertion |
| 50 | // passed only because the page had no rollback form to put a channel name |
| 51 | // into, so it never exercised the page a real one-channel app shows. |
| 52 | shipVersion(t, fx, "solo", "v1") |
| 53 | shipVersion(t, fx, "solo", "v2") |
| 54 | seedChannel(t, fx, "solo", "edge", "v1") |
| 55 | seedChannel(t, fx, "solo", "edge", "v2") |
| 56 | _, _, body2 := get(t, c, fx.u("/apps/solo/releases")) |
| 57 | if !strings.Contains(body2, "Roll back") { |
| 58 | t.Fatalf("this app has a rollback control by now — without it the check below proves nothing:\n%s", body2) |
| 59 | } |
| 60 | assertNoChannelVocabulary(t, body2) |
| 61 | } |
| 62 | |
| 63 | // assertNoChannelVocabulary checks the RENDERED CONTENT — <main>...</main>, |
| 64 | // not the shared chrome above it — for the ladder's hidden words. The page's |
| 65 | // one shared stylesheet (layout.html's `<style>`, included on every page via |
| 66 | // "top") names a `.ladder` CSS class and a code comment describing it, on |
| 67 | // EVERY page regardless of this app's pipeline; that is chrome, not content, |
| 68 | // and is not what spec §5's "hide the vocabulary entirely" is about. |
| 69 | // |
| 70 | // It checks the VISIBLE-TEXT projection, not the markup: spec §5 hides the |
| 71 | // vocabulary from the READER, and a form field the browser never renders is |
| 72 | // not something anybody is shown. The rollback control has to name the |
| 73 | // channel it posts to somewhere — that is the door's parameter, not a word on |
| 74 | // the page — and a raw-markup check would force the page to choose between |
| 75 | // showing a rollback button and passing this test (PR #258 review, I2). |
| 76 | func assertNoChannelVocabulary(t *testing.T, body string) { |
| 77 | t.Helper() |
| 78 | _, main, ok := strings.Cut(body, "<main>") |
| 79 | if !ok { |
| 80 | t.Fatalf("page has no <main> to scope the check to:\n%s", body) |
| 81 | } |
| 82 | text := visibleText(main) |
| 83 | for _, forbidden := range []string{"Promote", "edge", "ladder"} { |
| 84 | if strings.Contains(text, forbidden) { |
| 85 | t.Errorf("one-channel app page SHOWS %q, want the vocabulary hidden entirely.\nvisible text:\n%s", forbidden, text) |
| 86 | } |
| 87 | } |
| 88 | } |
| 89 | |
| 90 | // visibleText is the crude tag stripper the assertion above needs: everything |
| 91 | // outside <...> and nothing inside one, so attributes, hidden input values and |
| 92 | // form actions drop out while every word a reader can actually see stays. Good |
| 93 | // enough for a rendered console page (no CDATA, no raw "<" in text — the |
| 94 | // templates escape it), and deliberately not a parser: a dependency-free |
| 95 | // assertion helper that anybody can check by eye is worth more here than |
| 96 | // fidelity to malformed markup. |
| 97 | // |
| 98 | // Known blind spot, named so it is a choice rather than an oversight: text |
| 99 | // that reaches a reader THROUGH an attribute — aria-label, alt, title, |
| 100 | // placeholder — is dropped with the rest of the tag, so vocabulary leaking |
| 101 | // via one of those (most seriously to a screen reader, which is a reader) is |
| 102 | // invisible to this check. If a one-channel surface ever grows such a label, |
| 103 | // it wants asserting directly rather than trusting this projection. |
| 104 | func visibleText(html string) string { |
| 105 | var b strings.Builder |
| 106 | inTag := false |
| 107 | for _, r := range html { |
| 108 | switch { |
| 109 | case r == '<': |
| 110 | inTag = true |
| 111 | case r == '>': |
| 112 | inTag = false |
| 113 | case !inTag: |
| 114 | b.WriteRune(r) |
| 115 | } |
| 116 | } |
| 117 | return b.String() |
| 118 | } |
| 119 | |
| 120 | // TestOneChannelAppKeepsCanariesAndRollback pins the other half of "hide the |
| 121 | // vocabulary": what must NOT be hidden with it. The one-channel guard wrapped |
| 122 | // the whole details block on the Releases tab, so opting into the default |
| 123 | // one-channel pipeline also took away the canary table, the create-canary |
| 124 | // form and the rollback control — none of which is channel vocabulary. |
| 125 | // canary/* is "always allowed" and lives outside the pipeline entirely (spec |
| 126 | // §2), and a rollback is a pointer write every app can need; a one-channel |
| 127 | // app is precisely the app with no promote step to fall back on if a bad |
| 128 | // build lands. The ladder, the promote form and the channel table stay gone. |
| 129 | func TestOneChannelAppKeepsCanariesAndRollback(t *testing.T) { |
| 130 | fx := newConsoleFixture(t) |
| 131 | token := cliToken(t, fx, "paul@keymail.dev", "code-solo-canary") |
| 132 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 133 | map[string]string{"name": "solocan"}, token); status != http.StatusOK { |
| 134 | t.Fatalf("create app = %d %v", status, out) |
| 135 | } |
| 136 | shipVersion(t, fx, "solocan", "v1") |
| 137 | shipVersion(t, fx, "solocan", "v2") |
| 138 | // Two promotions onto the one channel: the second gives the pointer a |
| 139 | // history, which is what a rollback needs to exist at all. |
| 140 | seedChannel(t, fx, "solocan", "edge", "v1") |
| 141 | seedChannel(t, fx, "solocan", "edge", "v2") |
| 142 | seedChannel(t, fx, "solocan", "canary/rc1", "v1") |
| 143 | |
| 144 | c := signInPaul(t, fx) |
| 145 | status, _, body := get(t, c, fx.u("/apps/solocan/releases")) |
| 146 | if status != http.StatusOK { |
| 147 | t.Fatalf("app page = %d", status) |
| 148 | } |
| 149 | _, main, ok := strings.Cut(body, "<main>") |
| 150 | if !ok { |
| 151 | t.Fatalf("page has no <main> to scope the check to:\n%s", body) |
| 152 | } |
| 153 | // The canary table, with the app's live canary in it. |
| 154 | if !strings.Contains(main, "canary/rc1") { |
| 155 | t.Errorf("one-channel app page hides its canary table:\n%s", main) |
| 156 | } |
| 157 | if !strings.Contains(main, `/apps/solocan/canary/retire"`) { |
| 158 | t.Errorf("one-channel app page hides the canary retire control:\n%s", main) |
| 159 | } |
| 160 | if !strings.Contains(main, `/apps/solocan/canary"`) { |
| 161 | t.Errorf("one-channel app page hides the create-canary form:\n%s", main) |
| 162 | } |
| 163 | // The rollback control. |
| 164 | if !strings.Contains(main, `/apps/solocan/rollback"`) { |
| 165 | t.Errorf("one-channel app page hides the rollback control:\n%s", main) |
| 166 | } |
| 167 | if !strings.Contains(main, "Roll back") { |
| 168 | t.Errorf("one-channel app page has no rollback button:\n%s", main) |
| 169 | } |
| 170 | // And still none of the vocabulary the one-channel rule hides: no ladder |
| 171 | // rungs, no promote form, no channel column. Checked on what the page |
| 172 | // SHOWS (visibleText), the same projection assertNoChannelVocabulary |
| 173 | // uses — the rollback form's hidden channel field is the door's |
| 174 | // parameter, not a word on the page. |
| 175 | text := visibleText(main) |
| 176 | for _, forbidden := range []string{"beta", "stable", "Promoting", "Promote", "ladder"} { |
| 177 | if strings.Contains(text, forbidden) { |
| 178 | t.Errorf("one-channel app page SHOWS %q, want the vocabulary still hidden.\nvisible text:\n%s", forbidden, text) |
| 179 | } |
| 180 | } |
| 181 | } |
| 182 | |
| 183 | // TestOneChannelAppOverviewHidesFlowDiagram pins the CRITICAL finding from |
| 184 | // the Task 9 review: the OVERVIEW page (/a/{sqid}/apps/{app}, what spec §5 |
| 185 | // calls "the app page") draws its own release-flow diagram |
| 186 | // (app_overview.html's {{template "flow" .}}, flow.go), completely |
| 187 | // independent of the Releases tab's ladder card — and flow.go hardcoded the |
| 188 | // legacy edge/beta/live path unconditionally. A one-channel pipeline must |
| 189 | // hide it exactly as it hides the ladder card, and with real content on the |
| 190 | // entry channel (a fresh, truly empty app never shows the diagram at all, |
| 191 | // legacy or not — Show only goes true once something is actually held or |
| 192 | // addressed — so this only proves the fix with something to leak). |
| 193 | func TestOneChannelAppOverviewHidesFlowDiagram(t *testing.T) { |
| 194 | fx := newConsoleFixture(t) |
| 195 | token := cliToken(t, fx, "paul@keymail.dev", "code-hide-flow") |
| 196 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 197 | map[string]string{"name": "soloflow"}, token); status != http.StatusOK { |
| 198 | t.Fatalf("create app = %d %v", status, out) |
| 199 | } |
| 200 | shipVersion(t, fx, "soloflow", "v1") |
| 201 | seedChannel(t, fx, "soloflow", "edge", "v1") |
| 202 | |
| 203 | c := signInPaul(t, fx) |
| 204 | status, _, body := get(t, c, fx.u("/apps/soloflow")) |
| 205 | if status != http.StatusOK { |
| 206 | t.Fatalf("app overview page = %d", status) |
| 207 | } |
| 208 | assertNoChannelVocabulary(t, body) |
| 209 | if strings.Contains(body, "Promoting is what moves it") { |
| 210 | t.Errorf("one-channel app overview page still draws the flow diagram:\n%s", body) |
| 211 | } |
| 212 | } |
| 213 | |
| 214 | // TestMultiChannelFlowDrawsPipelineChannels pins the other half of the same |
| 215 | // CRITICAL finding: a MULTI-channel pipelined app's flow diagram must draw |
| 216 | // the app's OWN declared channels, in order — not the frozen edge/beta/live |
| 217 | // path, which a pipeline named edge/production simply does not have. |
| 218 | func TestMultiChannelFlowDrawsPipelineChannels(t *testing.T) { |
| 219 | fx := newConsoleFixture(t) |
| 220 | token := cliToken(t, fx, "paul@keymail.dev", "code-flow-multi") |
| 221 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 222 | map[string]string{"name": "multiflow"}, token); status != http.StatusOK { |
| 223 | t.Fatalf("create app = %d %v", status, out) |
| 224 | } |
| 225 | if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/multiflow/pipeline", |
| 226 | map[string]any{"channels": []map[string]any{ |
| 227 | {"name": "edge"}, |
| 228 | {"name": "production", "bake": "24h"}, |
| 229 | }}, token); status != http.StatusOK { |
| 230 | t.Fatalf("pipeline put = %d %v", status, out) |
| 231 | } |
| 232 | shipVersion(t, fx, "multiflow", "v1") |
| 233 | seedChannel(t, fx, "multiflow", "edge", "v1") |
| 234 | |
| 235 | c := signInPaul(t, fx) |
| 236 | _, _, body := get(t, c, fx.u("/apps/multiflow")) |
| 237 | edgeLabel, prodLabel := `<p class="flow-label">edge</p>`, `<p class="flow-label">production</p>` |
| 238 | if !strings.Contains(body, edgeLabel) { |
| 239 | t.Fatalf("flow diagram does not draw the entry channel:\n%s", body) |
| 240 | } |
| 241 | if !strings.Contains(body, prodLabel) { |
| 242 | t.Fatalf("flow diagram does not draw the app's own second channel:\n%s", body) |
| 243 | } |
| 244 | if strings.Contains(body, `<p class="flow-label">beta</p>`) || strings.Contains(body, `<p class="flow-label">live</p>`) { |
| 245 | t.Fatalf("flow diagram still draws the legacy edge/beta/live path for a pipelined app:\n%s", body) |
| 246 | } |
| 247 | if i, j := strings.Index(body, edgeLabel), strings.Index(body, prodLabel); i < 0 || j < 0 || i > j { |
| 248 | t.Fatalf("channels are not drawn in pipeline order (edge before production):\n%s", body) |
| 249 | } |
| 250 | } |
| 251 | |
| 252 | // TestChannelsTableAndPipelineCardAgreeOnBakeWindow pins IMPORTANT 2 from |
| 253 | // the Task 9 review: the Channels table and the pipeline card read the SAME |
| 254 | // AppView.Channels slice, and used to disagree about how long an |
| 255 | // app-defined channel bakes for — the table read the legacy 72h fallback |
| 256 | // (release.HoldFor(DefaultHolds, "production") — an unrecognized name gets |
| 257 | // the longest standard window, fail closed), the card read the pipeline's |
| 258 | // own declared window via holdWindow. A 1h bake makes the two answers |
| 259 | // impossible to confuse in their rendered form: the correct one is |
| 260 | // minutes-scale ("~59m", no "d"), the legacy-table bug would show a |
| 261 | // multi-day figure ("~2d23h..."). |
| 262 | func TestChannelsTableAndPipelineCardAgreeOnBakeWindow(t *testing.T) { |
| 263 | fx := newConsoleFixture(t) |
| 264 | token := cliToken(t, fx, "paul@keymail.dev", "code-bake-agree") |
| 265 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 266 | map[string]string{"name": "bakeapp"}, token); status != http.StatusOK { |
| 267 | t.Fatalf("create app = %d %v", status, out) |
| 268 | } |
| 269 | if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/bakeapp/pipeline", |
| 270 | map[string]any{"channels": []map[string]any{ |
| 271 | {"name": "edge"}, |
| 272 | {"name": "production", "bake": "1h"}, |
| 273 | }}, token); status != http.StatusOK { |
| 274 | t.Fatalf("pipeline put = %d %v", status, out) |
| 275 | } |
| 276 | shipVersion(t, fx, "bakeapp", "v1") |
| 277 | seedChannel(t, fx, "bakeapp", "edge", "v1") |
| 278 | seedChannel(t, fx, "bakeapp", "production", "v1") |
| 279 | |
| 280 | c := signInPaul(t, fx) |
| 281 | _, _, body := get(t, c, fx.u("/apps/bakeapp/releases")) |
| 282 | |
| 283 | // The Channels table's own "Goes live" cell for production. |
| 284 | _, after, ok := strings.Cut(body, "<td>production</td>") |
| 285 | if !ok { |
| 286 | t.Fatalf("no Channels-table row for production:\n%s", body) |
| 287 | } |
| 288 | rowEnd := strings.Index(after, "</tr>") |
| 289 | if rowEnd < 0 { |
| 290 | t.Fatalf("malformed Channels table row:\n%s", after) |
| 291 | } |
| 292 | row := after[:rowEnd] |
| 293 | i := strings.Index(row, "in ~") |
| 294 | if i < 0 { |
| 295 | t.Fatalf("Channels table shows no live bake countdown for production:\n%s", row) |
| 296 | } |
| 297 | cell := row[i:] |
| 298 | if k := strings.Index(cell, "<"); k >= 0 { |
| 299 | cell = cell[:k] |
| 300 | } |
| 301 | if strings.Contains(cell, "d") { |
| 302 | t.Errorf("Channels table shows a multi-day bake window for a 1h pipeline channel — it read the legacy 72h table, not the pipeline's own window: %q", cell) |
| 303 | } |
| 304 | |
| 305 | // The pipeline card's own rung for production tells the same story. |
| 306 | prodBlock := rungBlock(t, body, "production") |
| 307 | if !strings.Contains(prodBlock, "goes live ~") { |
| 308 | t.Fatalf("pipeline card shows no live bake countdown for production:\n%s", prodBlock) |
| 309 | } |
| 310 | if i := strings.Index(prodBlock, "goes live ~"); i >= 0 { |
| 311 | line := prodBlock[i:] |
| 312 | if j := strings.Index(line, "<"); j >= 0 { |
| 313 | line = line[:j] |
| 314 | } |
| 315 | if strings.Contains(line, "d") { |
| 316 | t.Errorf("pipeline card shows a multi-day bake window for a 1h pipeline channel:\n%s", line) |
| 317 | } |
| 318 | } |
| 319 | } |
| 320 | |
| 321 | func TestPipelineCardAndSettingsTemplates(t *testing.T) { |
| 322 | fx := newConsoleFixture(t) |
| 323 | token := cliToken(t, fx, "paul@keymail.dev", "code-pipeline-card") |
| 324 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 325 | map[string]string{"name": "multi"}, token); status != http.StatusOK { |
| 326 | t.Fatalf("create app = %d %v", status, out) |
| 327 | } |
| 328 | c := signInPaul(t, fx) |
| 329 | |
| 330 | // Still the one-channel default: the settings page shows the form, with |
| 331 | // the single "edge" row, and offers the two starter templates. |
| 332 | _, _, sbody := get(t, c, fx.u("/apps/multi/pipeline")) |
| 333 | for _, want := range []string{ |
| 334 | `action="/a/bab/apps/multi/pipeline"`, |
| 335 | `name="ch.0.name" value="edge"`, |
| 336 | `value="template-edge-production"`, |
| 337 | `value="template-full-ladder"`, |
| 338 | } { |
| 339 | if !strings.Contains(sbody, want) { |
| 340 | t.Errorf("settings page missing %q:\n%s", want, sbody) |
| 341 | } |
| 342 | } |
| 343 | |
| 344 | // PUT a two-channel pipeline: edge, then production behind a passkey. |
| 345 | status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/multi/pipeline", |
| 346 | map[string]any{"channels": []map[string]any{ |
| 347 | {"name": "edge"}, |
| 348 | {"name": "production", "bake": "24h", "rules": map[string]any{"passkey": true}}, |
| 349 | }}, token) |
| 350 | if status != http.StatusOK { |
| 351 | t.Fatalf("pipeline put = %d %v", status, out) |
| 352 | } |
| 353 | |
| 354 | _, _, body := get(t, c, fx.u("/apps/multi/releases")) |
| 355 | if !strings.Contains(body, `id="rung-edge"`) || !strings.Contains(body, `id="rung-production"`) { |
| 356 | t.Fatalf("pipeline card does not show both channels:\n%s", body) |
| 357 | } |
| 358 | if i, j := strings.Index(body, `id="rung-edge"`), strings.Index(body, `id="rung-production"`); i < 0 || j < 0 || i > j { |
| 359 | t.Fatalf("channels are not rendered in pipeline order (edge before production):\n%s", body) |
| 360 | } |
| 361 | prodBlock := rungBlock(t, body, "production") |
| 362 | if !strings.Contains(prodBlock, "Needs a passkey.") { |
| 363 | t.Errorf("production rung does not carry its own gate sentence:\n%s", prodBlock) |
| 364 | } |
| 365 | edgeBlock := rungBlock(t, body, "edge") |
| 366 | if !strings.Contains(edgeBlock, "Anyone on the team promotes here.") { |
| 367 | t.Errorf("edge rung (no rules) does not say anyone promotes there:\n%s", edgeBlock) |
| 368 | } |
| 369 | |
| 370 | // The settings page reflects the write, and — no longer the untouched |
| 371 | // default — stops offering the starter templates. |
| 372 | _, _, sbody2 := get(t, c, fx.u("/apps/multi/pipeline")) |
| 373 | if !strings.Contains(sbody2, `name="ch.1.name" value="production"`) { |
| 374 | t.Errorf("settings page does not show the saved production row:\n%s", sbody2) |
| 375 | } |
| 376 | if strings.Contains(sbody2, `value="template-edge-production"`) { |
| 377 | t.Error("settings page still offers the starter templates once the pipeline is no longer the default") |
| 378 | } |
| 379 | } |
| 380 | |
| 381 | func TestPendingCardShowsQuorumProgress(t *testing.T) { |
| 382 | fx := newConsoleFixture(t) |
| 383 | if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil { |
| 384 | t.Fatal(err) |
| 385 | } |
| 386 | token := cliToken(t, fx, "paul@keymail.dev", "code-pending-card") |
| 387 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 388 | map[string]string{"name": "queue"}, token); status != http.StatusOK { |
| 389 | t.Fatalf("create app = %d %v", status, out) |
| 390 | } |
| 391 | if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/queue/pipeline", |
| 392 | map[string]any{"channels": []map[string]any{ |
| 393 | {"name": "edge"}, |
| 394 | {"name": "prod", "rules": map[string]any{"promote_approvals": 2}}, |
| 395 | }}, token); status != http.StatusOK { |
| 396 | t.Fatalf("pipeline put = %d %v", status, out) |
| 397 | } |
| 398 | shipVersion(t, fx, "queue", "v1") |
| 399 | seedChannel(t, fx, "queue", "edge", "v1") |
| 400 | |
| 401 | c := signInPaul(t, fx) |
| 402 | csrf := sessionToken(t, fx, c) |
| 403 | // The proposer's own step-up earns them the first of the two |
| 404 | // confirmations (spec §4) — postGated walks that round trip. |
| 405 | status, _, _ := postGated(t, fx, c, fx.u("/apps/queue/promote"), |
| 406 | url.Values{"csrf": {csrf}, "channel": {"prod"}, "version": {"v1"}, "confirmed": {"1"}}) |
| 407 | if status != http.StatusSeeOther { |
| 408 | t.Fatalf("propose promote = %d", status) |
| 409 | } |
| 410 | |
| 411 | _, _, body := get(t, c, fx.u("/apps/queue")) |
| 412 | if !strings.Contains(body, "promote v1 to prod") { |
| 413 | t.Fatalf("pending card does not name the proposed change:\n%s", body) |
| 414 | } |
| 415 | if !strings.Contains(body, "1/2 confirmed") { |
| 416 | t.Fatalf("pending card does not show quorum progress:\n%s", body) |
| 417 | } |
| 418 | if !strings.Contains(body, "/confirm") { |
| 419 | t.Fatalf("pending card has no Confirm control:\n%s", body) |
| 420 | } |
| 421 | if !strings.Contains(body, "/reject") { |
| 422 | t.Fatalf("pending card has no Reject control:\n%s", body) |
| 423 | } |
| 424 | |
| 425 | // Confirming as the second member carries it out. |
| 426 | fx.setUser("sam@keymail.dev") |
| 427 | cm := newBrowser(t) |
| 428 | signUp(t, fx, cm, "code-sam-confirm") |
| 429 | _, _, mbody := get(t, cm, fx.u("/apps/queue")) |
| 430 | id := pendingIDFromBody(t, mbody) |
| 431 | status2, _, _ := postGated(t, fx, cm, fx.u("/apps/queue/pending/"+id+"/confirm"), |
| 432 | url.Values{"csrf": {sessionToken(t, fx, cm)}}) |
| 433 | if status2 != http.StatusSeeOther { |
| 434 | t.Fatalf("member confirm = %d", status2) |
| 435 | } |
| 436 | if p := fx.channelVersion(t, "queue", "prod"); p.Version != "v1" { |
| 437 | t.Fatalf("prod = %s after quorum was met, want v1", p.Version) |
| 438 | } |
| 439 | _, _, doneBody := get(t, c, fx.u("/apps/queue")) |
| 440 | if strings.Contains(doneBody, "1/2 confirmed") || strings.Contains(doneBody, "0/2 confirmed") { |
| 441 | t.Fatalf("pending card still shows the change after it was carried out:\n%s", doneBody) |
| 442 | } |
| 443 | } |
| 444 | |
| 445 | // pendingIDFromBody pulls the id out of a pending change's confirm-form |
| 446 | // action, so the second member can act on the exact row the first created — |
| 447 | // the card renders the id in the URL and nowhere else structured enough to |
| 448 | // read back. |
| 449 | func pendingIDFromBody(t *testing.T, body string) string { |
| 450 | t.Helper() |
| 451 | marker := "/pending/" |
| 452 | i := strings.Index(body, marker) |
| 453 | if i < 0 { |
| 454 | t.Fatalf("no pending id in body:\n%s", body) |
| 455 | } |
| 456 | rest := body[i+len(marker):] |
| 457 | j := strings.Index(rest, "/") |
| 458 | if j < 0 { |
| 459 | t.Fatalf("malformed pending action url in body:\n%s", body) |
| 460 | } |
| 461 | return rest[:j] |
| 462 | } |
| 463 | |
| 464 | // TestPipelineSettingsSavePOST is IMPORTANT 5 from the Task 9 review: the |
| 465 | // settings page's own write door had no test. Three properties, in the |
| 466 | // order they'd hurt if lost: |
| 467 | // - requireFreshAuth is enforced even for an ordinary, unguarded edit — |
| 468 | // a plain POST with no step-up redirects into Keymail rather than |
| 469 | // landing anything (postGated walks the round trip that DOES land it). |
| 470 | // - An unguarded save writes the pipeline directly once stepped up. |
| 471 | // - A GUARDED edit (touching a channel the STORED pipeline already |
| 472 | // protects with change_approvals) becomes a pending change instead of |
| 473 | // landing — the same propose flow the API PUT takes, reused rather |
| 474 | // than duplicated (pipelinepage.go's own doc comment). |
| 475 | func TestPipelineSettingsSavePOST(t *testing.T) { |
| 476 | fx := newConsoleFixture(t) |
| 477 | token := cliToken(t, fx, "paul@keymail.dev", "code-settings-post") |
| 478 | if status, out := postJSON(t, fx.ts.URL+"/api/cli/apps/bab/new", |
| 479 | map[string]string{"name": "settle"}, token); status != http.StatusOK { |
| 480 | t.Fatalf("create app = %d %v", status, out) |
| 481 | } |
| 482 | c := signInPaul(t, fx) |
| 483 | csrf := sessionToken(t, fx, c) |
| 484 | |
| 485 | saveForm := url.Values{ |
| 486 | "csrf": {csrf}, "action": {"save"}, |
| 487 | "ch.0.name": {"edge"}, |
| 488 | "ch.1.name": {"production"}, "ch.1.bake": {"24h"}, |
| 489 | } |
| 490 | |
| 491 | // Un-stepped-up: the request is redirected into Keymail, and nothing |
| 492 | // changes yet — the fixture's default pipeline (one channel, "edge") |
| 493 | // is still exactly what it was. |
| 494 | status, loc, _ := postForm(t, c, fx.u("/apps/settle/pipeline"), saveForm) |
| 495 | if status != http.StatusSeeOther || !strings.HasPrefix(loc, fx.fk.srv.URL) { |
| 496 | t.Fatalf("un-stepped-up pipeline save = %d -> %q, want a redirect into Keymail", status, loc) |
| 497 | } |
| 498 | if pipe, err := release.GetPipeline(context.Background(), fx.rel, fx.pub, release.OpsAccount, "settle"); err != nil { |
| 499 | t.Fatal(err) |
| 500 | } else if pipe == nil || len(pipe.Channels) != 1 { |
| 501 | t.Fatalf("pipeline changed before step-up completed: %+v", pipe) |
| 502 | } |
| 503 | |
| 504 | // Completing the step-up carries the unguarded edit straight through. |
| 505 | if status, _, body := completeStepUp(t, fx, c, loc); status != http.StatusSeeOther { |
| 506 | t.Fatalf("resumed pipeline save = %d:\n%s", status, body) |
| 507 | } |
| 508 | pipe, err := release.GetPipeline(context.Background(), fx.rel, fx.pub, release.OpsAccount, "settle") |
| 509 | if err != nil { |
| 510 | t.Fatal(err) |
| 511 | } |
| 512 | if pipe == nil || len(pipe.Channels) != 2 || pipe.Channels[1].Name != "production" || pipe.Channels[1].Bake != "24h" { |
| 513 | t.Fatalf("pipeline = %+v, want edge+production(24h)", pipe) |
| 514 | } |
| 515 | |
| 516 | // Guard production with change_approvals: 2 — via the API PUT, standing |
| 517 | // in for a previous, separately-confirmed console edit — so the NEXT |
| 518 | // edit that touches it must propose rather than land. 2, not 1: a |
| 519 | // quorum of 1 is met by the proposer's own step-up alone (spec §4 — it |
| 520 | // degenerates to a passkey rule and executes in the same request), which |
| 521 | // would prove nothing about the propose PATH specifically; a second |
| 522 | // member (sam) makes 2 a real quorum this account can still reach. |
| 523 | if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil { |
| 524 | t.Fatal(err) |
| 525 | } |
| 526 | if status, out := putJSON(t, fx.ts.URL+"/api/cli/apps/bab/settle/pipeline", |
| 527 | map[string]any{"channels": []map[string]any{ |
| 528 | {"name": "edge"}, |
| 529 | {"name": "production", "bake": "24h", "rules": map[string]any{"change_approvals": 2}}, |
| 530 | }}, token); status != http.StatusOK { |
| 531 | t.Fatalf("pipeline put (add change_approvals) = %d %v", status, out) |
| 532 | } |
| 533 | |
| 534 | guardedForm := url.Values{ |
| 535 | "csrf": {csrf}, "action": {"save"}, |
| 536 | "ch.0.name": {"edge"}, |
| 537 | "ch.1.name": {"production"}, "ch.1.bake": {"48h"}, "ch.1.change_approvals": {"2"}, |
| 538 | } |
| 539 | status, _, body := postGated(t, fx, c, fx.u("/apps/settle/pipeline"), guardedForm) |
| 540 | if status != http.StatusSeeOther { |
| 541 | t.Fatalf("guarded save = %d:\n%s", status, body) |
| 542 | } |
| 543 | // Nothing landed — the STORED pipeline still says 24h. |
| 544 | if pipe, err := release.GetPipeline(context.Background(), fx.rel, fx.pub, release.OpsAccount, "settle"); err != nil { |
| 545 | t.Fatal(err) |
| 546 | } else if pipe == nil || pipe.Channels[1].Bake != "24h" { |
| 547 | t.Fatalf("pipeline = %+v, want the guarded edit to have PROPOSED, not landed", pipe) |
| 548 | } |
| 549 | pending, err := fx.st.PendingChangesFor(OpsAccountID, "settle", time.Now()) |
| 550 | if err != nil { |
| 551 | t.Fatal(err) |
| 552 | } |
| 553 | if len(pending) != 1 || pending[0].Kind != kindPolicy { |
| 554 | t.Fatalf("pending changes = %+v, want exactly one policy proposal", pending) |
| 555 | } |
| 556 | } |
| 557 | |
amadan