mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-06 17:08:10 +00:00
52ff0725f4
* feat: add Compose Doctor preflight checks for stacks Add an on-demand, advisory preflight that renders a stack's effective Compose model with `docker compose config` and runs a registry of deterministic checks before deploy, surfacing findings grouped by severity (blocker, high, warning, info) with a remediation for each. Findings cover unset env vars, host-port conflicts on the node, broad 0.0.0.0 exposure, missing bind-mount paths, a mounted Docker socket, privileged and host networking, moving image tags, missing restart policy and healthcheck, Swarm-only deploy fields, missing external networks or volumes, and container_name collisions. The report is node-scoped and stored as the last run per stack, and the route auto-proxies to the active node so a remote stack is checked on the node that owns it. A new Doctor tab on the stack detail panel runs preflight and shows the grouped findings, with a severity dot on the tab when the last run has blocker or high findings. The tab is gated on a compose-doctor capability so older nodes hide it. No environment value is ever stored, returned, or logged: only env key names and structural facts are read, and render failures surface a generic message or the missing required-variable names, never raw stderr. * fix: scroll the stack tab strip when its tabs overflow Adding the Doctor tab can push the per-stack Anatomy tab strip past the panel width on narrower layouts. Make the tab row scroll horizontally with subtle edge fades that appear only while there is more to scroll in that direction, so a panel wide enough to show every tab is unchanged. * fix: add clickable arrows and wheel scroll to the stack tab strip Hiding the scrollbar left mouse users with no way to scroll the overflowing tab row: a vertical wheel does not move a horizontal overflow and native rows do not drag-scroll. Replace the passive edge fades with clickable chevron arrows shown only when the row overflows that edge, and translate a vertical wheel over the row into horizontal scroll. * fix: inline the path-injection barrier in renderConfig CodeQL's path-injection check does not credit the wrapped isPathWithinBase helper as a sanitizer, so move the containment check inline at the spawn cwd sink, matching the canonical barrier used elsewhere in the codebase. Behavior is unchanged: the resolved stack directory must be contained in the compose base and may not be the base itself. * fix: hoist the compose-config spawn into the path-barrier scope The earlier inline barrier sat in a different scope than the spawn cwd sink (separated by the Promise-executor closure) and used a compound guard, so CodeQL did not credit it. Use the exact canonical startsWith barrier and hoist the spawn into the same scope as the check. Behavior is unchanged: the executor runs synchronously in the same tick as the spawn, so handlers still attach before any event can fire.
113 lines
4.9 KiB
TypeScript
113 lines
4.9 KiB
TypeScript
/**
|
|
* Covers the Compose Doctor panel: the never-run empty state, the all-clear and
|
|
* graded-findings summaries, the unrenderable banner, a load-failure retry
|
|
* state, and running preflight on demand.
|
|
*/
|
|
import { describe, it, expect, vi, beforeEach } from 'vitest';
|
|
import { render, screen, fireEvent, waitFor } from '@testing-library/react';
|
|
|
|
vi.mock('@/lib/api', () => ({ apiFetch: vi.fn() }));
|
|
vi.mock('@/components/ui/toast-store', () => ({ toast: { success: vi.fn(), error: vi.fn() } }));
|
|
vi.mock('@/context/NodeContext', () => ({ useNodes: () => ({ activeNode: { id: 1 } }) }));
|
|
|
|
import { apiFetch } from '@/lib/api';
|
|
import { toast } from '@/components/ui/toast-store';
|
|
import PreflightPanel from './PreflightPanel';
|
|
|
|
interface Finding {
|
|
ruleId: string;
|
|
severity: 'blocker' | 'high' | 'warning' | 'info';
|
|
title: string;
|
|
message: string;
|
|
sourcePath?: string;
|
|
remediation?: string;
|
|
service?: string;
|
|
}
|
|
interface Report {
|
|
stack: string;
|
|
ranAt: number | null;
|
|
ranBy: string | null;
|
|
renderable: boolean;
|
|
renderError: string | null;
|
|
status: string;
|
|
highestSeverity: string | null;
|
|
findings: Finding[];
|
|
}
|
|
|
|
function report(partial: Partial<Report>): Report {
|
|
return { stack: 'web', ranAt: 1000, ranBy: 'admin', renderable: true, renderError: null, status: 'pass', highestSeverity: null, findings: [], ...partial };
|
|
}
|
|
|
|
function jsonRes(body: unknown, ok = true) {
|
|
return { ok, status: ok ? 200 : 500, json: async () => body, text: async () => '' } as unknown as Response;
|
|
}
|
|
|
|
beforeEach(() => { vi.clearAllMocks(); });
|
|
|
|
describe('PreflightPanel', () => {
|
|
it('shows the never-run empty state', async () => {
|
|
vi.mocked(apiFetch).mockResolvedValue(jsonRes(report({ status: 'never-run', ranAt: null })));
|
|
render(<PreflightPanel stackName="web" />);
|
|
expect(await screen.findByText(/Run preflight to render the effective model/i)).toBeInTheDocument();
|
|
});
|
|
|
|
it('renders the all-clear summary when there are no findings', async () => {
|
|
vi.mocked(apiFetch).mockResolvedValue(jsonRes(report({ status: 'pass' })));
|
|
render(<PreflightPanel stackName="web" />);
|
|
const status = await screen.findByTestId('preflight-status');
|
|
expect(status).toHaveAttribute('data-status', 'pass');
|
|
expect(status).toHaveTextContent(/all clear/i);
|
|
});
|
|
|
|
it('groups findings and reflects the highest severity', async () => {
|
|
vi.mocked(apiFetch).mockResolvedValue(jsonRes(report({
|
|
status: 'high',
|
|
highestSeverity: 'high',
|
|
findings: [
|
|
{ ruleId: 'privileged', severity: 'high', title: 'Privileged container', message: 'runs privileged', service: 'web' },
|
|
{ ruleId: 'image-latest', severity: 'warning', title: 'Image uses a moving tag', message: 'latest tag', service: 'web' },
|
|
],
|
|
})));
|
|
render(<PreflightPanel stackName="web" />);
|
|
const status = await screen.findByTestId('preflight-status');
|
|
expect(status).toHaveAttribute('data-status', 'high');
|
|
expect(screen.getByText('Privileged container')).toBeInTheDocument();
|
|
expect(screen.getByText('Image uses a moving tag')).toBeInTheDocument();
|
|
});
|
|
|
|
it('surfaces the unrenderable state with the render error', async () => {
|
|
vi.mocked(apiFetch).mockResolvedValue(jsonRes(report({
|
|
renderable: false, status: 'unrenderable', highestSeverity: 'blocker',
|
|
renderError: 'Sencho could not render the effective Compose model.',
|
|
findings: [{ ruleId: 'render-failed', severity: 'blocker', title: 'Compose model could not be rendered', message: 'Sencho could not render the effective Compose model.' }],
|
|
})));
|
|
render(<PreflightPanel stackName="web" />);
|
|
const status = await screen.findByTestId('preflight-status');
|
|
expect(status).toHaveAttribute('data-status', 'unrenderable');
|
|
expect(status).toHaveTextContent(/cannot render/i);
|
|
});
|
|
|
|
it('shows a retry state and toasts when the load fails', async () => {
|
|
vi.mocked(apiFetch).mockResolvedValue(jsonRes(null, false));
|
|
render(<PreflightPanel stackName="web" />);
|
|
expect(await screen.findByText(/Could not load the preflight report/i)).toBeInTheDocument();
|
|
expect(toast.error).toHaveBeenCalled();
|
|
});
|
|
|
|
it('runs preflight on demand and shows the new findings', async () => {
|
|
vi.mocked(apiFetch)
|
|
.mockResolvedValueOnce(jsonRes(report({ status: 'never-run', ranAt: null })))
|
|
.mockResolvedValueOnce(jsonRes(report({
|
|
status: 'blocker', highestSeverity: 'blocker',
|
|
findings: [{ ruleId: 'port-conflict-node', severity: 'blocker', title: 'Host port 8080 is already in use', message: 'taken', service: 'web' }],
|
|
})));
|
|
render(<PreflightPanel stackName="web" />);
|
|
fireEvent.click(await screen.findByTestId('preflight-run-btn'));
|
|
expect(await screen.findByText('Host port 8080 is already in use')).toBeInTheDocument();
|
|
await waitFor(() => {
|
|
const calls = vi.mocked(apiFetch).mock.calls;
|
|
expect(calls.some(([url, opts]) => String(url).includes('/preflight/run') && (opts as RequestInit | undefined)?.method === 'POST')).toBe(true);
|
|
});
|
|
});
|
|
});
|