Files
sencho/e2e/dossier-doc-drift.spec.ts
T
Anso ba09e6f69e fix: base Git multi-file Compose deploy env and dossier on the effective config (#1391)
* fix: resolve the root .env at deploy and render time for Git context-dir stacks

A Git multi-file source with a context dir set --project-directory to that
dir, so Docker Compose looked for .env there and missed the root .env Sencho
writes. Validation already passed the root .env with --env-file, so a stack
could validate with one effective config but deploy or render another.

Add authoredComposeEnvFileArgs, which appends --env-file <stackDir>/.env when
the applied deploy spec has a context dir and a root .env exists, and wire it
into the deploy/update, image-scan, render, and container-listing compose
invocations so they all resolve env from the same file the validator used. A
non-ENOENT access error surfaces instead of silently dropping the flag.

* fix: base multi-file Git dossier and doc-drift on the effective Compose model

The Stack Dossier and its documentation-drift check parsed only the stored root
compose file. For a multi-file Git source, services, ports, networks, or volumes
that an override file adds were invisible, so the dossier showed incomplete facts
and doc-drift could falsely warn that a documented port is unpublished when an
override actually publishes it.

Add a secret-safe GET /stacks/:name/effective-anatomy that renders the merged
effective model and extracts only structural facts (services, ports, volumes,
networks, restart), never env, label, or command values. StackAnatomyPanel
fetches it for multi-file Git stacks and feeds those facts into the dossier and
doc-drift, falling back to the root-only parse for single-file or non-git stacks
and whenever the render is unavailable.

* fix: add an inline path-injection barrier to the Git env-file resolver

CodeQL js/path-injection flagged the fs.access in authoredComposeEnvFileArgs
because the env path derives from the route-supplied stack name and the only
containment check lived in the callers, not at the sink. Resolve the stack dir
against the compose base and assert containment with startsWith inline, then
derive the .env path from the validated dir, mirroring the existing inline guards
in renderConfig and validateCompose. Valid stack names are unaffected; a name
that escapes the base now yields no --env-file.

* test: stabilize the dossier doc-drift e2e against the dossier-load race

The first assertion filled the access_urls field as soon as the Dossier panel
was visible, but the panel's GET /stacks/:name/dossier resolves by overwriting
the fields from the server (empty access_urls) and only then flips the doc-drift
gate on. When the GET landed after the fill, it clobbered the typed value and the
warning never rendered, so the test failed intermittently under CI timing. Wait
for that GET to land before typing, mirroring the spec's openStack helper.
2026-06-18 18:25:58 -04:00

124 lines
4.8 KiB
TypeScript

/**
* Documentation drift in the Stack Dossier.
*
* The Dossier tab warns when a port written into access_urls is not published by
* the stack's compose. The visual-regression project does not cover the
* stack-detail surface, so this functional flow does. It seeds its own stack and
* compose with a known published port and cleans them up, and does not need a
* running Docker daemon: documentation drift compares the dossier against the
* compose-derived anatomy, not the runtime.
*/
import { test, expect, type Page } from '@playwright/test';
import { loginAs, waitForStacksLoaded } from './helpers';
const STACK = 'e2e-doc-drift-test';
const COMPOSE = `services:
web:
image: nginx:alpine
ports:
- "8080:80"
`;
async function createStackViaApi(page: Page, name: string, content: string): Promise<void> {
await page.evaluate(
async ({ stackName, body }: { stackName: string; body: string }) => {
const createRes = await fetch('/api/stacks', {
method: 'POST',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ stackName }),
});
if (!createRes.ok && createRes.status !== 409) throw new Error(`create failed: ${createRes.status}`);
const writeRes = await fetch(`/api/stacks/${stackName}`, {
method: 'PUT',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ content: body }),
});
if (!writeRes.ok) throw new Error(`write failed: ${writeRes.status}`);
},
{ stackName: name, body: content },
);
}
async function seedDossierAccessUrls(page: Page, name: string, accessUrls: string): Promise<void> {
await page.evaluate(
async ({ stackName, urls }: { stackName: string; urls: string }) => {
const res = await fetch(`/api/stacks/${stackName}/dossier`, {
method: 'PUT',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ access_urls: urls }),
});
if (!res.ok) throw new Error(`dossier seed failed: ${res.status}`);
},
{ stackName: name, urls: accessUrls },
);
}
async function deleteStackViaApi(page: Page, name: string): Promise<void> {
await page.evaluate(async (stackName: string) => {
await fetch(`/api/stacks/${stackName}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
}, name);
}
async function openStack(page: Page, name: string): Promise<void> {
await page.reload();
await waitForStacksLoaded(page);
await Promise.all([
page.waitForResponse(
(r) => r.url().endsWith(`/api/stacks/${name}`) && r.request().method() === 'GET' && r.ok(),
{ timeout: 10_000 },
),
page.getByText(name, { exact: true }).first().click(),
]);
}
test.describe('Dossier documentation drift', () => {
test.beforeEach(async ({ page }) => {
await loginAs(page);
await deleteStackViaApi(page, STACK);
});
test.afterEach(async ({ page }) => {
await deleteStackViaApi(page, STACK);
});
test('warns for an unpublished access-URL port and clears when it matches', async ({ page }) => {
await createStackViaApi(page, STACK, COMPOSE);
await openStack(page, STACK);
// Wait for the dossier GET to land before typing: it resolves by setting
// `fields` from the server (empty access_urls) and only then flips the
// doc-drift gate on, so a fill that races ahead of it would be overwritten.
await Promise.all([
page.waitForResponse(
(r) => r.url().includes(`/api/stacks/${STACK}/dossier`) && r.request().method() === 'GET' && r.ok(),
{ timeout: 10_000 },
),
page.getByRole('tab', { name: 'Dossier' }).click(),
]);
await expect(page.getByTestId('dossier-panel')).toBeVisible();
const field = page.getByTestId('dossier-field-access_urls');
await field.fill('http://localhost:9000');
const warning = page.getByTestId('dossier-doc-drift');
await expect(warning).toBeVisible();
await expect(warning).toContainText(':9000');
// Point the URL at the published port: the warning must clear.
await field.fill('http://localhost:8080');
await expect(page.getByTestId('dossier-doc-drift')).toHaveCount(0);
});
test('shows the warning on the read-only mobile dossier', async ({ page }) => {
await page.setViewportSize({ width: 390, height: 844 });
await createStackViaApi(page, STACK, COMPOSE);
await seedDossierAccessUrls(page, STACK, 'http://localhost:9000');
await openStack(page, STACK);
await page.getByRole('tab', { name: 'Compose' }).click();
await page.getByRole('tab', { name: 'Dossier' }).click();
const warning = page.getByTestId('dossier-doc-drift');
await expect(warning).toBeVisible();
await expect(warning).toContainText(':9000');
});
});