john
99 lines
3.7 KiB
JavaScript
99 lines
3.7 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { once } from 'node:events';
|
|
import test from 'node:test';
|
|
import express from 'express';
|
|
import { attachMindSpaceImageGenerationRoutes } from './mindspace-image-generation-routes.mjs';
|
|
|
|
async function start(service, requireInternal = null) {
|
|
const app = express();
|
|
app.use(express.json());
|
|
app.use((req, _res, next) => {
|
|
req.currentUser = { id: 'user-1' };
|
|
req.requestId = 'req-1';
|
|
next();
|
|
});
|
|
attachMindSpaceImageGenerationRoutes(app, { getService: () => service, requireInternal });
|
|
const server = app.listen(0, '127.0.0.1');
|
|
await once(server, 'listening');
|
|
return {
|
|
url: `http://127.0.0.1:${server.address().port}`,
|
|
async close() { server.close(); await once(server, 'close'); },
|
|
};
|
|
}
|
|
|
|
test('image generation route passes authenticated user and idempotency key to the service', async () => {
|
|
const calls = [];
|
|
const fixture = await start({
|
|
async generate(input) {
|
|
calls.push(input);
|
|
return { ok: true, asset: { id: 'asset-1', publicUrl: '/image.webp' } };
|
|
},
|
|
});
|
|
try {
|
|
const response = await fetch(`${fixture.url}/mindspace/v1/images/generate`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json', 'idempotency-key': 'imgreq-1' },
|
|
body: JSON.stringify({ purpose: 'hero', prompt: 'calm library' }),
|
|
});
|
|
assert.equal(response.status, 201);
|
|
assert.equal((await response.json()).data.asset.id, 'asset-1');
|
|
assert.deepEqual(calls, [{
|
|
userId: 'user-1',
|
|
purpose: 'hero',
|
|
prompt: 'calm library',
|
|
negativePrompt: undefined,
|
|
consumerRef: 'mindspace:imgreq-1:hero',
|
|
idempotencyKey: 'imgreq-1',
|
|
}]);
|
|
} finally { await fixture.close(); }
|
|
});
|
|
|
|
test('image generation route exposes safe fallback without changing existing flows', async () => {
|
|
const fixture = await start({
|
|
async generate() {
|
|
return { ok: false, fallback: true, code: 'purpose_disabled', message: 'disabled' };
|
|
},
|
|
});
|
|
try {
|
|
const response = await fetch(`${fixture.url}/mindspace/v1/images/generate`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ purpose: 'feed_cover', prompt: 'calm library' }),
|
|
});
|
|
assert.equal(response.status, 409);
|
|
assert.deepEqual(await response.json(), {
|
|
ok: false, fallback: true, code: 'purpose_disabled', message: 'disabled',
|
|
});
|
|
} finally { await fixture.close(); }
|
|
});
|
|
|
|
test('internal image generation route requires its injected secret guard and explicit user', async () => {
|
|
const calls = [];
|
|
const fixture = await start({
|
|
async generate(input) { calls.push(input); return { ok: true, asset: { id: 'asset-1' } }; },
|
|
}, (req, res) => {
|
|
if (req.get('authorization') === 'Bearer internal-secret') return true;
|
|
res.status(401).json({ message: 'invalid secret' });
|
|
return false;
|
|
});
|
|
try {
|
|
const denied = await fetch(`${fixture.url}/agent/mindspace_image_generate`, {
|
|
method: 'POST', headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ user_id: 'user-2', purpose: 'hero', prompt: 'x' }),
|
|
});
|
|
assert.equal(denied.status, 401);
|
|
const allowed = await fetch(`${fixture.url}/agent/mindspace_image_generate`, {
|
|
method: 'POST',
|
|
headers: {
|
|
'content-type': 'application/json',
|
|
authorization: 'Bearer internal-secret',
|
|
'idempotency-key': 'page-hero-1',
|
|
},
|
|
body: JSON.stringify({ user_id: 'user-2', purpose: 'hero', prompt: 'x' }),
|
|
});
|
|
assert.equal(allowed.status, 201);
|
|
assert.equal(calls[0].userId, 'user-2');
|
|
assert.equal(calls[0].consumerRef, 'mindspace-agent:page-hero-1:hero');
|
|
} finally { await fixture.close(); }
|
|
});
|