mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
ba09e6f69e
* fix: resolve the root .env at deploy and render time for Git context-dir stacks A Git multi-file source with a context dir set --project-directory to that dir, so Docker Compose looked for .env there and missed the root .env Sencho writes. Validation already passed the root .env with --env-file, so a stack could validate with one effective config but deploy or render another. Add authoredComposeEnvFileArgs, which appends --env-file <stackDir>/.env when the applied deploy spec has a context dir and a root .env exists, and wire it into the deploy/update, image-scan, render, and container-listing compose invocations so they all resolve env from the same file the validator used. A non-ENOENT access error surfaces instead of silently dropping the flag. * fix: base multi-file Git dossier and doc-drift on the effective Compose model The Stack Dossier and its documentation-drift check parsed only the stored root compose file. For a multi-file Git source, services, ports, networks, or volumes that an override file adds were invisible, so the dossier showed incomplete facts and doc-drift could falsely warn that a documented port is unpublished when an override actually publishes it. Add a secret-safe GET /stacks/:name/effective-anatomy that renders the merged effective model and extracts only structural facts (services, ports, volumes, networks, restart), never env, label, or command values. StackAnatomyPanel fetches it for multi-file Git stacks and feeds those facts into the dossier and doc-drift, falling back to the root-only parse for single-file or non-git stacks and whenever the render is unavailable. * fix: add an inline path-injection barrier to the Git env-file resolver CodeQL js/path-injection flagged the fs.access in authoredComposeEnvFileArgs because the env path derives from the route-supplied stack name and the only containment check lived in the callers, not at the sink. Resolve the stack dir against the compose base and assert containment with startsWith inline, then derive the .env path from the validated dir, mirroring the existing inline guards in renderConfig and validateCompose. Valid stack names are unaffected; a name that escapes the base now yields no --env-file. * test: stabilize the dossier doc-drift e2e against the dossier-load race The first assertion filled the access_urls field as soon as the Dossier panel was visible, but the panel's GET /stacks/:name/dossier resolves by overwriting the fields from the server (empty access_urls) and only then flips the doc-drift gate on. When the GET landed after the fill, it clobbered the typed value and the warning never rendered, so the test failed intermittently under CI timing. Wait for that GET to land before typing, mirroring the spec's openStack helper.
124 lines
4.8 KiB
TypeScript
124 lines
4.8 KiB
TypeScript
/**
|
|
* Documentation drift in the Stack Dossier.
|
|
*
|
|
* The Dossier tab warns when a port written into access_urls is not published by
|
|
* the stack's compose. The visual-regression project does not cover the
|
|
* stack-detail surface, so this functional flow does. It seeds its own stack and
|
|
* compose with a known published port and cleans them up, and does not need a
|
|
* running Docker daemon: documentation drift compares the dossier against the
|
|
* compose-derived anatomy, not the runtime.
|
|
*/
|
|
import { test, expect, type Page } from '@playwright/test';
|
|
import { loginAs, waitForStacksLoaded } from './helpers';
|
|
|
|
const STACK = 'e2e-doc-drift-test';
|
|
const COMPOSE = `services:
|
|
web:
|
|
image: nginx:alpine
|
|
ports:
|
|
- "8080:80"
|
|
`;
|
|
|
|
async function createStackViaApi(page: Page, name: string, content: string): Promise<void> {
|
|
await page.evaluate(
|
|
async ({ stackName, body }: { stackName: string; body: string }) => {
|
|
const createRes = await fetch('/api/stacks', {
|
|
method: 'POST',
|
|
credentials: 'include',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ stackName }),
|
|
});
|
|
if (!createRes.ok && createRes.status !== 409) throw new Error(`create failed: ${createRes.status}`);
|
|
const writeRes = await fetch(`/api/stacks/${stackName}`, {
|
|
method: 'PUT',
|
|
credentials: 'include',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ content: body }),
|
|
});
|
|
if (!writeRes.ok) throw new Error(`write failed: ${writeRes.status}`);
|
|
},
|
|
{ stackName: name, body: content },
|
|
);
|
|
}
|
|
|
|
async function seedDossierAccessUrls(page: Page, name: string, accessUrls: string): Promise<void> {
|
|
await page.evaluate(
|
|
async ({ stackName, urls }: { stackName: string; urls: string }) => {
|
|
const res = await fetch(`/api/stacks/${stackName}/dossier`, {
|
|
method: 'PUT',
|
|
credentials: 'include',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ access_urls: urls }),
|
|
});
|
|
if (!res.ok) throw new Error(`dossier seed failed: ${res.status}`);
|
|
},
|
|
{ stackName: name, urls: accessUrls },
|
|
);
|
|
}
|
|
|
|
async function deleteStackViaApi(page: Page, name: string): Promise<void> {
|
|
await page.evaluate(async (stackName: string) => {
|
|
await fetch(`/api/stacks/${stackName}`, { method: 'DELETE', credentials: 'include' }).catch(() => {});
|
|
}, name);
|
|
}
|
|
|
|
async function openStack(page: Page, name: string): Promise<void> {
|
|
await page.reload();
|
|
await waitForStacksLoaded(page);
|
|
await Promise.all([
|
|
page.waitForResponse(
|
|
(r) => r.url().endsWith(`/api/stacks/${name}`) && r.request().method() === 'GET' && r.ok(),
|
|
{ timeout: 10_000 },
|
|
),
|
|
page.getByText(name, { exact: true }).first().click(),
|
|
]);
|
|
}
|
|
|
|
test.describe('Dossier documentation drift', () => {
|
|
test.beforeEach(async ({ page }) => {
|
|
await loginAs(page);
|
|
await deleteStackViaApi(page, STACK);
|
|
});
|
|
test.afterEach(async ({ page }) => {
|
|
await deleteStackViaApi(page, STACK);
|
|
});
|
|
|
|
test('warns for an unpublished access-URL port and clears when it matches', async ({ page }) => {
|
|
await createStackViaApi(page, STACK, COMPOSE);
|
|
await openStack(page, STACK);
|
|
// Wait for the dossier GET to land before typing: it resolves by setting
|
|
// `fields` from the server (empty access_urls) and only then flips the
|
|
// doc-drift gate on, so a fill that races ahead of it would be overwritten.
|
|
await Promise.all([
|
|
page.waitForResponse(
|
|
(r) => r.url().includes(`/api/stacks/${STACK}/dossier`) && r.request().method() === 'GET' && r.ok(),
|
|
{ timeout: 10_000 },
|
|
),
|
|
page.getByRole('tab', { name: 'Dossier' }).click(),
|
|
]);
|
|
await expect(page.getByTestId('dossier-panel')).toBeVisible();
|
|
|
|
const field = page.getByTestId('dossier-field-access_urls');
|
|
await field.fill('http://localhost:9000');
|
|
const warning = page.getByTestId('dossier-doc-drift');
|
|
await expect(warning).toBeVisible();
|
|
await expect(warning).toContainText(':9000');
|
|
|
|
// Point the URL at the published port: the warning must clear.
|
|
await field.fill('http://localhost:8080');
|
|
await expect(page.getByTestId('dossier-doc-drift')).toHaveCount(0);
|
|
});
|
|
|
|
test('shows the warning on the read-only mobile dossier', async ({ page }) => {
|
|
await page.setViewportSize({ width: 390, height: 844 });
|
|
await createStackViaApi(page, STACK, COMPOSE);
|
|
await seedDossierAccessUrls(page, STACK, 'http://localhost:9000');
|
|
await openStack(page, STACK);
|
|
await page.getByRole('tab', { name: 'Compose' }).click();
|
|
await page.getByRole('tab', { name: 'Dossier' }).click();
|
|
const warning = page.getByTestId('dossier-doc-drift');
|
|
await expect(warning).toBeVisible();
|
|
await expect(warning).toContainText(':9000');
|
|
});
|
|
});
|