919a39e49a
* feat(auth): add auth core — identities, sessions, PATs, invites, mode state machine Phase 1 of opt-in authentication + multi-user segregation: - internal/auth: argon2id password hashing (PHC), opaque session/PAT tokens (SHA-256 at rest), login rate limiter, auth-mode state machine (disabled/setup/enabled), setup-wizard promotion of the pre-auth default-user row into the admin account, invites, admin user management with last-admin guard. - internal/auth/store: auth_identities (OIDC-ready), auth_sessions, auth_api_tokens, auth_invites tables (SQLite+Postgres dialects). - internal/auth/authn: request-identity plumbing (gin + plain contexts), RequireAdmin middleware. - users table: display_name/role/status columns via new MigrateLogger wiring; AccountRepository surface (consumer-scoped, keeps existing Repository fakes untouched). - config: AuthConfig.Required/SessionTTLHours/CookieName (KANDEV_AUTH_REQUIRED), FeaturesConfig.Auth; profiles.yaml + runtime flag registry entry for KANDEV_FEATURES_AUTH. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): enforce opt-in auth over HTTP — middleware, auth API, boot payload Phase 2 of opt-in authentication + multi-user segregation: - internal/auth/httpmw: global gin middleware after CORS. Disabled mode injects the synthetic single-user admin identity (behavior unchanged); enabled mode resolves session cookie then PAT bearer, with an explicit allowlist (health, SPA bootstrap reads, credential endpoints, self-authenticating webhooks), deferral for WS/proxy upgrades and office agent JWTs, and SPA shell availability for the login page. - internal/auth/httpapi: full auth surface — setup wizard, login/logout, me, password change, sessions, PATs, invites (mint/preview/accept), auth settings (enable/disable), admin user management. - Boot payload: initialState.auth block always present; unauthenticated visitors on auth-enabled instances get features+auth only (no data). - External MCP: PAT required once auth is enabled (open while disabled). - Admin guards on destructive system routes and runtime-flag overrides. - Startup warning when bound non-loopback with auth disabled (ServerConfig.NonLoopbackBinds fail-closed nudge). - Wiring: auth store in Repositories, auth service in Services, ClaimUnownedWorkspaces backfill on the task repository. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): per-user workspace scoping across HTTP services Phase 3 of opt-in authentication + multi-user segregation: - Task service: workspaces, workflows, repositories, and tasks are scoped to the request identity (owner-only visibility; pre-auth unowned rows stay shared). Denials use *NotFound sentinels - no existence leak. Internal callers and the disabled-mode synthetic identity remain unscoped, preserving behavior exactly when auth is off. - CreateWorkspace stamps the authenticated caller as owner. - Session chokepoint: lifecycle Manager.GetOrEnsureExecution runs a settable session-access check covering shell/files/ports/vscode/LSP. - Secrets: per-user user_id column, scoped CRUD/list, ClaimUnowned wired into the setup-wizard backfills. - Boot payload inherits scoping automatically. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): scope WebSocket gateway to authenticated users Phase 4 of opt-in authentication + multi-user segregation: - Connection auth: /ws, /terminal, /lsp, /vscode, /port-proxy routes are guarded when auth is enabled - session cookie (same-origin upgrade), resolved identity from the HTTP middleware, or ?token=<PAT> for headerless programmatic clients; JSON 401 before any upgrade. - Client identity: every WS client carries its authn.Identity; dispatched RPC actions (workspace.list, task CRUD, ...) run under a context carrying it, so WS RPC gets the same per-user scoping as HTTP. - Subscription checks: task/session subscribe+focus verify workspace visibility via the task service; user topic subscriptions are pinned to the client's own user. - Broadcast routing: new Hub.BroadcastToWorkspace routes workspace-scoped events (task/workflow/repo/office/session-state) to the owner's clients only, with safe fallbacks (unowned/unresolvable -> broadcast) so events never vanish; instance-wide events (executors, environments, agent profiles, system jobs) stay global by design. - Replaced the long-standing discarded-token TODO in HandleConnection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(auth): add feature spec and backend architecture notes for opt-in auth - docs/specs/auth/spec.md: product behavior (opt-in, setup wizard, per-user workspaces, sessions/PATs, invites, public surface, v1 limits) - apps/backend/AGENTS.md: internal/auth package layout + scoping rules for new service entry points and WS broadcast call sites Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(auth): public documentation for opt-in authentication - New docs/public/authentication.md: enabling, users & invites, PATs, public endpoints, limitations, disabling - run-as-a-service.md: network-security note now points at the real authentication boundary instead of reverse-proxy-only guidance - meta.json: nav entry under Configure Kandev Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(auth): ADR for opt-in authentication architecture Records the load-bearing choices: mode state machine + synthetic identity in disabled mode, opaque DB-backed credentials over JWTs, default-user promotion at setup, service-layer scoping with no-admin-bypass, and the explicit public allowlist. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): auth UI — login, setup wizard, invites, users & account settings Adds the frontend half of opt-in authentication: a pre-auth gate in main.tsx that renders the setup wizard or login/invite pages instead of the app shell whenever the boot payload's auth block says so, a new `auth` store slice + feature flag mirroring the backend's StatePayload, credentialed fetch (`credentials: "include"`) with a 401 handler that clears the session and redirects to /login, and a full auth-api.ts client for the /api/v1/auth and /api/v1/users routes. Settings additions: a System > Users page (list/create/disable/promote users, invite-link dialog) and System > Authentication page (enable/ disable with confirm + env-locked banner), gated on the `auth` feature flag and admin role. A new Account sidebar group (Profile & Password, API Tokens) is shown to signed-in users once auth is enabled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auth): E2E lifecycle suite + fix workspace event WS leak it caught New dedicated Playwright auth project (backend restarts with KANDEV_AUTH_REQUIRED=true, isolated from the tokenless default suite): setup-mode boot gating, admin setup wizard, login/logout + bad credentials, PATs, admin-surface authorization, anonymous WS rejection, UI login flow, and the acceptance test - two-user segregation across HTTP, boot payload, and WebSocket. The segregation spec immediately caught a real leak: workspace.* event payloads carry their ID as 'id' (the payload IS the workspace DTO), not 'workspace_id', so BroadcastToWorkspace fell back to broadcast-to-all for workspace create/update/delete. Fixed with action-aware extraction plus a unit regression test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): close cross-user access gaps found in security audit Two independent security audits of the auth branch found several authorization gaps where session/workspace-scoped surfaces were not wired to the new per-user chokepoint. All fixed: - IDOR on reverse-proxy/terminal routes (vscode, port-proxy, terminal): these resolve executions via GetExecutionBySessionID / GetOrEnsureExecutionForEnvironment / EnsurePassthroughExecution, which skipped the session-access check that only GetOrEnsureExecution ran. Added the check inside the env/passthrough resolvers (before the cache short-circuit) and an explicit CheckSessionAccess gate in the two bare-lookup proxy handlers. An authenticated non-owner can no longer reach another user's IDE, forwarded ports, or shell. - Cross-user agent-conversation read: ListMessages / ListMessagesPaginated / SearchMessages now authorize the session. - Cross-user repository-script read/inject: script CRUD now authorizes the parent repository's workspace. - Office HTTP surface: a group middleware enforces workspace ownership on :wsId routes for real users (agent-JWT callers keep their claim scoping). - Login rate-limit bypass: SetTrustedProxies(nil) so a spoofed X-Forwarded-For can't rotate the limiter key on a directly-reachable backend. - Invite double-provisioning race: MarkInviteUsed is now the atomic serialization point (consumed before user creation). - Setup wizard: serialized with a mutex so concurrent first-visitors can't corrupt the promoted admin profile. - Log sanitizer: explicit kandev_pat_ redaction rule. Regression tests added for message/script scoping and the execution-access-before-cache invariant. Auth E2E (incl. two-user segregation) still green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): scope repository active-session-count endpoint GET /api/v1/repositories/:id/active-session-count went through CountActiveSessionsByRepository, which was not identity-scoped - a cross-user info leak of another owner's active session counts. Added the same authorizeRepositoryID gate the script routes use. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): add json tags to auth store models — omit digests, fix token UI The auth store structs (APIToken, Invite, LoginIdentity, Session) had db: tags but no json: tags, so the handlers that serialize them directly sent Go-cased keys (CreatedAt, Name) AND leaked the SHA-256/password digests to clients. Two consequences: - The API-tokens UI showed 'Invalid Date' and an empty name (frontend reads created_at/name). - token_sha256 / password_hash were serialized in list responses. Added json tags with snake_case keys the frontend reads and json:"-" on every credential digest. Regression test asserts digests never serialize and the snake_case timestamp/name keys are present. Also adds the auth-screenshots capture spec (artifacts gitignored). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): move auth enable into feature toggles; show current user in sidebar Remove the standalone Authentication settings page and its dedicated settings/get-auth-settings API surface now that enabling auth lives in the Feature Toggles system, and drop env_required now that /auth/me no longer returns it. Add a current-user chip with a logout action to the sidebar footer, shown only in enabled auth mode. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(auth): make features.auth the single on/off control Per review feedback: authentication configuration now lives entirely in the existing Feature Toggles system rather than a separate Authentication settings section. - The auth mode is derived from the features.auth runtime flag (KANDEV_FEATURES_AUTH): off -> disabled, on+no-admin -> setup, on+admin -> enabled. Removed the parallel auth.mode system setting, the SetEnabled service method, GET/PATCH /api/v1/auth/settings, the AuthConfig.Required field, KANDEV_AUTH_REQUIRED, and the auth service's Settings-store dependency and EnvRequired/env_required. - The features.auth registry entry is re-described as the actual enable switch (high-risk, restart-required) and defaults off in every profile (dev was previously true — that only revealed UI before; now it would enforce, so it must be an explicit opt-in). - Setup no longer persists a mode; completing the wizard creates the admin and the mode auto-derives to enabled. - Startup 'exposed without auth' warning + all docs (public guide, run-as-a-service, spec, ADR, AGENTS.md) point at the feature toggle. - E2E: auth specs use KANDEV_FEATURES_AUTH; screenshot spec captures the Feature Toggles page instead of the removed Authentication page; the member-restriction assertion targets an admin invite route. - Tests updated across service/httpmw/httpapi/profiles for the derived mode; full suite green (only pre-existing sandbox-FS failures remain). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): complete cross-user isolation — integrations, automation, plan/walkthrough, session reads A follow-up isolation audit found that per-user scoping had been wired into the task service, secrets, office, and the WS gateway — but several workspace/task/session-scoped surfaces still resolved a caller-supplied ID with no ownership gate. Closed all of them; cross-user access now returns 404 across the board. - Integrations (jira/linear/sentry/slack/azure-devops/gitlab/github/ workflow-sync): a global middleware authorizes the workspace_id (query, or gitlab's /workspaces/:id/ path) on those route groups. Previously a member who knew another user's workspace ID could read/overwrite their integration connection config and watches. - Automation: workspace-authorizer seam gates get/list/create/update/delete/ enable/disable, triggers, run history, and — critically — the webhook secret. Was fully cross-tenant over WS before. - Task plans (PlanService) and walkthroughs (WalkthroughService): task- authorizer seam on every read/write. These bypassed the task service. - Session reads that hit the repo directly — session turns, task context, git snapshots, file reviews — now call AuthorizeSession/TaskAccess. Internal callers (pollers, schedulers, MCP) carry no identity and stay unscoped; disabled mode is unaffected. Regression tests added (plan/walkthrough scoping, automation authorizer matrix, integration path extraction) and the two-user E2E now asserts integration routes are shielded. Docs (spec, ADR, public guide) updated to state what is isolated and that filesystem/agent-credential isolation remains an OS-level limitation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): current-user chip uses border hover, not accent fill The sidebar current-user chip used hover:bg-accent (a purpleish fill). Switch to the border-hover idiom used elsewhere (border border-transparent -> hover:border-border) with the neutral hover:bg-muted/50 the adjacent workspace picker uses, so the hover reads as a subtle outline instead of a colored background. Screenshot spec now captures the chip hover state. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): right-align current-user chip in the sidebar footer Push the user chip to the far right of the expanded footer (ml-auto) so it sits opposite the left-aligned icon buttons; collapsed mode keeps the centered vertical stack unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): reject synthetic identity on management routes and scope office run broadcasts Address code-review findings on the opt-in authentication PR: - P1: while auth is disabled the middleware injects a synthetic admin (RoleAdmin), and RequireAdmin alone let it through — so anyone hitting a not-yet-enabled instance could mint a PAT or plant an admin that survives enablement and hijacks first-run setup. Add authn.RequireRealIdentity and guard the credential/session/user-management routes with it (public bootstrap routes stay reachable). Responds 404 while disabled. - P1: office run events carry task_id but no workspace_id, so they fell back to a global broadcast and leaked across users. Resolve the workspace from the task and route via the new Hub.BroadcastToWorkspaceOrDrop, which fails closed (drops rather than global-broadcasts) when the workspace is unknown and auth is enforced. - nit: type createAuthSlice as a single-arg creator and call it with just set. Also register the authentication docs page and its settings routes in docs/public/coverage.json so the public-docs validator passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
333 lines
12 KiB
TypeScript
333 lines
12 KiB
TypeScript
import { cleanup, fireEvent, render, screen } from "@testing-library/react";
|
|
import type { ReactNode } from "react";
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
const MAIN_WORKSPACE_ID = "ws-1";
|
|
const ARCHIVE_WORKSPACE_ID = "ws-10";
|
|
const MAIN_WORKSPACE_NAME = "Main Workspace";
|
|
const ARCHIVE_WORKSPACE_NAME = "Archive Workspace";
|
|
|
|
const state = {
|
|
workspaces: {
|
|
activeId: MAIN_WORKSPACE_ID,
|
|
items: [{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME }],
|
|
},
|
|
setActiveWorkspace: vi.fn(),
|
|
settingsAgents: {
|
|
items: [],
|
|
},
|
|
executors: {
|
|
items: [],
|
|
},
|
|
features: {
|
|
office: false,
|
|
plugins: false,
|
|
auth: false,
|
|
},
|
|
auth: {
|
|
mode: "disabled" as const,
|
|
authenticated: true,
|
|
user: null,
|
|
},
|
|
};
|
|
|
|
const integrationAvailability = vi.hoisted(() => ({
|
|
azureDevOps: true,
|
|
github: false,
|
|
gitlab: false,
|
|
jira: false,
|
|
linear: false,
|
|
sentry: false,
|
|
slack: false,
|
|
}));
|
|
|
|
vi.mock("@/components/state-provider", () => ({
|
|
useAppStore: (selector: (s: typeof state) => unknown) => selector(state),
|
|
}));
|
|
|
|
vi.mock("@/hooks/domains/settings/use-available-agents", () => ({
|
|
useAvailableAgents: () => undefined,
|
|
}));
|
|
|
|
vi.mock("@/hooks/domains/azure-devops/use-azure-devops-availability", () => ({
|
|
useAzureDevOpsAvailable: () => integrationAvailability.azureDevOps,
|
|
}));
|
|
vi.mock("@/hooks/domains/github/use-github-status", () => ({
|
|
useGitHubStatus: () => ({
|
|
status: integrationAvailability.github ? { authenticated: true } : null,
|
|
loading: false,
|
|
}),
|
|
}));
|
|
vi.mock("@/hooks/domains/gitlab/use-task-mr", () => ({
|
|
useGitLabAvailable: () => integrationAvailability.gitlab,
|
|
}));
|
|
vi.mock("@/hooks/domains/jira/use-jira-availability", () => ({
|
|
useJiraAuthed: () => integrationAvailability.jira,
|
|
}));
|
|
vi.mock("@/hooks/domains/linear/use-linear-availability", () => ({
|
|
useLinearAuthed: () => integrationAvailability.linear,
|
|
}));
|
|
vi.mock("@/hooks/domains/sentry/use-sentry-availability", () => ({
|
|
useSentryAvailable: () => integrationAvailability.sentry,
|
|
}));
|
|
vi.mock("@/hooks/domains/slack/use-slack-availability", () => ({
|
|
useSlackAuthed: () => integrationAvailability.slack,
|
|
}));
|
|
|
|
vi.mock("@kandev/ui/collapsible", async () => {
|
|
const React = await vi.importActual<typeof import("react")>("react");
|
|
const CollapsibleContext = React.createContext(false);
|
|
return {
|
|
Collapsible: ({ open, children }: { open?: boolean; children: ReactNode }) =>
|
|
React.createElement(CollapsibleContext.Provider, { value: Boolean(open) }, children),
|
|
CollapsibleContent: ({ children, className }: { children: ReactNode; className?: string }) => {
|
|
const open = React.useContext(CollapsibleContext);
|
|
return open ? React.createElement("div", { className }, children) : null;
|
|
},
|
|
};
|
|
});
|
|
|
|
import { SettingsTree } from "./settings-tree";
|
|
import { WorkspacesGroup } from "./workspaces-group";
|
|
|
|
describe("SettingsTree rendering", () => {
|
|
beforeEach(() => {
|
|
state.workspaces.activeId = MAIN_WORKSPACE_ID;
|
|
state.workspaces.items = [{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME }];
|
|
state.setActiveWorkspace.mockClear();
|
|
state.settingsAgents.items = [];
|
|
state.executors.items = [];
|
|
integrationAvailability.azureDevOps = true;
|
|
integrationAvailability.github = false;
|
|
integrationAvailability.gitlab = false;
|
|
integrationAvailability.jira = false;
|
|
integrationAvailability.linear = false;
|
|
integrationAvailability.sentry = false;
|
|
integrationAvailability.slack = false;
|
|
});
|
|
|
|
afterEach(() => cleanup());
|
|
|
|
it("renders workspace repository and workflow links when Workspaces is open", () => {
|
|
render(<WorkspacesGroup pathname="/settings/workspace" expanded />);
|
|
|
|
expect(screen.getByRole("link", { name: "Repositories" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-1/repositories",
|
|
);
|
|
expect(screen.getByRole("link", { name: "Workflows" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-1/workflows",
|
|
);
|
|
expect(screen.getByRole("link", { name: "Automations" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-1/automations",
|
|
);
|
|
expect(screen.getByRole("link", { name: "Integrations" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-1/integrations",
|
|
);
|
|
});
|
|
|
|
it("opens the active workspace by default when the settings tree opens", () => {
|
|
state.workspaces.items = [
|
|
{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME },
|
|
{ id: ARCHIVE_WORKSPACE_ID, name: ARCHIVE_WORKSPACE_NAME },
|
|
];
|
|
|
|
render(<SettingsTree pathname="/settings" />);
|
|
|
|
expect(screen.getByRole("link", { name: `${MAIN_WORKSPACE_NAME} Active` })).toBeTruthy();
|
|
expect(screen.getByRole("link", { name: ARCHIVE_WORKSPACE_NAME })).toBeTruthy();
|
|
expect(screen.queryByText("[active]")).toBeNull();
|
|
expect(screen.getByRole("link", { name: "Repositories" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-1/repositories",
|
|
);
|
|
expect(screen.getByRole("link", { name: "Automations" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-1/automations",
|
|
);
|
|
});
|
|
|
|
it("uses an accordion for workspace subsections", () => {
|
|
state.workspaces.items = [
|
|
{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME },
|
|
{ id: ARCHIVE_WORKSPACE_ID, name: ARCHIVE_WORKSPACE_NAME },
|
|
];
|
|
|
|
render(<WorkspacesGroup pathname="/settings" expanded />);
|
|
|
|
expect(screen.getByRole("link", { name: "Repositories" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-1/repositories",
|
|
);
|
|
|
|
fireEvent.click(screen.getByRole("button", { name: "Expand Archive Workspace" }));
|
|
|
|
expect(screen.getByRole("button", { name: "Expand Main Workspace" })).toBeTruthy();
|
|
expect(screen.getByRole("link", { name: "Repositories" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-10/repositories",
|
|
);
|
|
});
|
|
|
|
it("only opens the routed workspace subsection on workspace detail routes", () => {
|
|
state.workspaces.items = [
|
|
{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME },
|
|
{ id: ARCHIVE_WORKSPACE_ID, name: ARCHIVE_WORKSPACE_NAME },
|
|
];
|
|
|
|
const { rerender } = render(<WorkspacesGroup pathname="/settings/workspace" expanded />);
|
|
|
|
expect(screen.getAllByRole("link", { name: "Repositories" })).toHaveLength(1);
|
|
|
|
rerender(<WorkspacesGroup pathname="/settings/workspace/ws-10/repositories" expanded />);
|
|
|
|
expect(
|
|
screen.getByRole("link", { name: `${MAIN_WORKSPACE_NAME} Active` }).getAttribute("href"),
|
|
).toBe("/settings/workspace/ws-1");
|
|
const repositoryLinks = screen.getAllByRole("link", { name: "Repositories" });
|
|
const workflowLinks = screen.getAllByRole("link", { name: "Workflows" });
|
|
|
|
expect(repositoryLinks).toHaveLength(1);
|
|
expect(workflowLinks).toHaveLength(1);
|
|
expect(repositoryLinks[0].getAttribute("href")).toBe("/settings/workspace/ws-10/repositories");
|
|
expect(workflowLinks[0].getAttribute("href")).toBe("/settings/workspace/ws-10/workflows");
|
|
expect(screen.getByRole("link", { name: ARCHIVE_WORKSPACE_NAME }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-10",
|
|
);
|
|
});
|
|
|
|
it("opens workspace integrations when a workspace integration route is active", () => {
|
|
state.workspaces.items = [
|
|
{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME },
|
|
{ id: ARCHIVE_WORKSPACE_ID, name: ARCHIVE_WORKSPACE_NAME },
|
|
];
|
|
|
|
render(<WorkspacesGroup pathname="/settings/workspace/ws-10/integrations/github" expanded />);
|
|
|
|
expect(screen.getByRole("link", { name: "GitHub" }).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-10/integrations/github",
|
|
);
|
|
expect(screen.getByRole("button", { name: "Expand Main Workspace" })).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
describe("SettingsTree integration status", () => {
|
|
beforeEach(() => {
|
|
state.workspaces.activeId = MAIN_WORKSPACE_ID;
|
|
state.workspaces.items = [{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME }];
|
|
integrationAvailability.azureDevOps = true;
|
|
integrationAvailability.github = false;
|
|
});
|
|
|
|
afterEach(() => cleanup());
|
|
|
|
it("labels configured integrations as enabled", () => {
|
|
render(
|
|
<WorkspacesGroup pathname="/settings/workspace/ws-1/integrations/azure-devops" expanded />,
|
|
);
|
|
|
|
expect(screen.getByRole("link", { name: "Azure DevOps Enabled" })).toBeTruthy();
|
|
expect(screen.getByTestId("azure-devops-icon")).toBeTruthy();
|
|
expect(screen.getByRole("link", { name: "GitHub" })).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
describe("SettingsTree standalone leaves", () => {
|
|
afterEach(() => {
|
|
cleanup();
|
|
state.features.plugins = false;
|
|
});
|
|
|
|
it("keeps Voice Mode in the settings tree as a standalone active leaf", () => {
|
|
render(<SettingsTree pathname="/settings" />);
|
|
|
|
expect(screen.getByRole("link", { name: "Voice Mode" }).getAttribute("href")).toBe(
|
|
"/settings/voice-mode",
|
|
);
|
|
|
|
cleanup();
|
|
|
|
render(<SettingsTree pathname="/settings/voice-mode" />);
|
|
|
|
expect(screen.getByRole("link", { name: "Voice Mode" }).className).toContain(
|
|
"before:bg-primary",
|
|
);
|
|
expect(screen.queryByRole("link", { name: "Appearance" })).toBeNull();
|
|
});
|
|
|
|
it("puts Plugins immediately before System when plugins are enabled", () => {
|
|
state.features.plugins = true;
|
|
|
|
render(<SettingsTree pathname="/settings" />);
|
|
|
|
expect(
|
|
screen
|
|
.getAllByRole("link")
|
|
.slice(-2)
|
|
.map((link) => link.textContent),
|
|
).toEqual(["Plugins", "System"]);
|
|
});
|
|
});
|
|
|
|
describe("WorkspacesGroup active workspace presentation", () => {
|
|
beforeEach(() => {
|
|
state.workspaces.activeId = MAIN_WORKSPACE_ID;
|
|
state.workspaces.items = [
|
|
{ id: ARCHIVE_WORKSPACE_ID, name: ARCHIVE_WORKSPACE_NAME },
|
|
{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME },
|
|
];
|
|
state.setActiveWorkspace.mockClear();
|
|
});
|
|
|
|
afterEach(() => cleanup());
|
|
|
|
it("keeps the active workspace first even when the API returns it later", () => {
|
|
render(<WorkspacesGroup pathname="/settings" expanded />);
|
|
|
|
const workspaceLinks = getWorkspaceRootLinks();
|
|
|
|
expect(workspaceLinks.map((link) => link.textContent)).toEqual([
|
|
`${MAIN_WORKSPACE_NAME}Active`,
|
|
ARCHIVE_WORKSPACE_NAME,
|
|
]);
|
|
});
|
|
|
|
it("expands another workspace without changing the active workspace", () => {
|
|
render(<WorkspacesGroup pathname="/settings" expanded />);
|
|
|
|
fireEvent.click(screen.getByRole("button", { name: "Expand Archive Workspace" }));
|
|
|
|
expect(state.setActiveWorkspace).not.toHaveBeenCalled();
|
|
expect(getWorkspaceRootLinks()[0].textContent).toBe(`${MAIN_WORKSPACE_NAME}Active`);
|
|
expect(screen.getByRole("link", { name: `${MAIN_WORKSPACE_NAME} Active` })).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
describe("WorkspacesGroup integration route sync", () => {
|
|
beforeEach(() => {
|
|
state.workspaces.activeId = MAIN_WORKSPACE_ID;
|
|
state.workspaces.items = [
|
|
{ id: MAIN_WORKSPACE_ID, name: MAIN_WORKSPACE_NAME },
|
|
{ id: ARCHIVE_WORKSPACE_ID, name: ARCHIVE_WORKSPACE_NAME },
|
|
];
|
|
});
|
|
|
|
afterEach(() => cleanup());
|
|
|
|
it("opens workspace integrations after navigating into an integration route", async () => {
|
|
const { rerender } = render(
|
|
<WorkspacesGroup pathname="/settings/workspace/ws-10/repositories" expanded />,
|
|
);
|
|
|
|
expect(screen.queryByRole("link", { name: "GitHub" })).toBeNull();
|
|
|
|
rerender(<WorkspacesGroup pathname="/settings/workspace/ws-10/integrations/github" expanded />);
|
|
|
|
expect((await screen.findByRole("link", { name: "GitHub" })).getAttribute("href")).toBe(
|
|
"/settings/workspace/ws-10/integrations/github",
|
|
);
|
|
});
|
|
});
|
|
|
|
function getWorkspaceRootLinks(): HTMLAnchorElement[] {
|
|
return screen.getAllByRole("link").filter((link): link is HTMLAnchorElement => {
|
|
const href = link.getAttribute("href");
|
|
return Boolean(href?.match(/^\/settings\/workspace\/[^/]+$/));
|
|
});
|
|
}
|