fae2303db3
* feat(plugins): per-plugin settings pages driven by manifest config_schema Settings > Plugins rows now open /settings/plugins/:id — a detail page showing the manifest plus a settings form generated from the plugin author's config_schema. Secret fields (secret: true / format: password) are masked on the operator API and kept on masked re-submits; a running plugin restarts on save and reads its config (cleartext secrets included) through the new Host GetConfig gRPC RPC. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): write plugin config file owner-only (0600) Operator config can now carry cleartext secret values (config_schema fields marked secret), so <id>.config.yml must not be world-readable — match the 0600 mode the record file already uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(plugins): vault-backed plugin secrets — Get/Set/DeleteSecret RPCs and encrypted config secrets Plugins get vault-backed secret primitives on the Host API (GetSecret/SetSecret/DeleteSecret, capability-gated, namespaced to plugin:<id>㊙️<key> so a plugin can only touch its own entries; purged on uninstall). Secret config_schema fields now live in kandev's AES-256-GCM vault too — <id>.config.yml persists only a vault reference, and the Host GetConfig RPC resolves it back to cleartext for the plugin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(plugins): serve PR screenshots from the media/pr-1761-screenshots ref instead of the repo The PR body now points at raw URLs pinned to an unmerged media ref, so the binaries never land in main (PRs are squash-merged; only the branch tip tree merges). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): address review feedback on settings validation and save flow - integer form fields reject non-integral input instead of parseInt-truncating - enum selections keep their schema-declared types (numeric enums round-trip) - backend enum validation normalizes int-vs-float64 before comparison - maskSecrets masks any non-zero secret value regardless of runtime type - save flow splits PATCH from refetch: a refetch failure no longer reports a successful save as an error, and typed secrets are masked on screen - optional enum fields gain a 'Not set' option so they can be cleared - resolveConfigSecrets copies before mutating; restart-failure SetStatus errors are logged; SDK test fake returns a non-nil empty config map - add missing tests: usePluginConfigForm hook, getPluginConfig client, integer/enum regression cases Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): harden secret config invariants from review - reject non-string values on declared secret fields at validation time, closing the path where a numeric/boolean secret bypassed the vault and persisted cleartext in the config file - delete removed secret fields' vault entries only AFTER the config commit succeeds, so a failed SetConfig never leaves the still-current config referencing a deleted vault entry - uninstall fails closed: the plugin's vault namespace is purged before any destructive step, and a cleanup failure aborts the uninstall (retryable) instead of letting a reinstall inherit stale secrets Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): failure-atomic config secrets, quiesced uninstall purge, ctx propagation - UpdateConfig is now failure-atomic for secret overwrites: storeConfigSecrets snapshots each vault entry before writing and returns a rollback that restores prior values (or deletes newly-created ones). A vault.Set failure mid-loop or a failed SetConfig commit rolls back, so a request reported as failed never changes the value a still-current config ref resolves to. - Uninstall stops the plugin process BEFORE purging its vault namespace, so the plugin can no longer race the cleanup with a SetSecret between ListIDs and the deletes; the purge stays fail-closed and retryable. - Thread the request context through Uninstall -> deletePluginSecrets instead of context.Background(), per the pass-context-through-chains convention. - Consolidate the 'secret not found:' prefix check into isSecretNotFound (host.go + service rollback share one definition). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach rollback context, fail closed without a vault, reconcile uninstall status - vault rollback closures now run on context.WithoutCancel(ctx): a request cancelled mid-save (browser closed) can no longer abort the rollback and leave the vault holding new values while the unchanged config still points at them (Greptile P1). - storeConfigSecrets fails closed (errSecretVaultRequired) when a plugin declares secret config fields but no vault is wired, instead of silently persisting the secret in cleartext. - vaultRestoreFunc distinguishes not-found from a genuine Reveal error: a backend read failure aborts the update before writing rather than risk a rollback that deletes a real secret; rollback now returns errors, joined into UpdateConfig's failure so an inconsistent vault is surfaced, not just logged. - Uninstall reconciles lifecycle status when a secret-purge failure aborts after the process was stopped: a previously-running plugin transitions to error and notifies observers instead of being reported active with no process running. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): detach removed-secret cleanup ctx and clear stale save dirty flag - cleanupRemovedConfigSecrets now runs on context.WithoutCancel(ctx), matching the rollback path, so a client disconnect right after the config commit can no longer cancel the delete and orphan now-unreferenced vault entries. - tests: assert GetConfig succeeds before treating an empty map as proof that nothing persisted (a swallowed read error would be a false pass). - web: on a post-save refetch failure, rebase initialValues onto the masked snapshot so the saved form no longer reads as dirty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): fail tests on discarded GetConfig errors, drop setState-in-updater - config_test: capture and fatal on GetConfig errors at the four remaining positive-assertion sites (a nil from a failed read would panic on the next map access instead of giving a clear failure), matching the earlier fix. - web hook: compute the masked post-save snapshot from the current values and apply it to setValues + setInitialValues directly, instead of calling setInitialValues inside a setValues functional updater (a React anti-pattern that runs twice under StrictMode). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(plugins): skip validation of a secret field's own vault ref - validateConfigSchema takes the plugin id and skips a secret field whose value is that field's config vault ref (an internal storage marker, already validated when first set). Without this, a field declaring both secret: true and enum: [...] 400s on every save that keeps the mask, because the enum check saw the vault ref instead of a user value. Freshly entered secret values are still validated; a foreign plugin's ref is not skipped. Covered by unit + service-level regression tests. - surface mid-loop vault rollback failures in storeConfigSecrets via a warning instead of discarding them (double-fault observability). - web: integer inputs get step=1 so browsers flag non-integral input in place (serializeConfigValues remains the backstop). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(plugins): split config secret tests into config_secrets_test.go config_test.go had grown past the 800-line backend file-length limit (revive), failing CI lint. Move the vault-backed config and plugin-scoped secret tests (plus their fake-vault/store helpers) into a sibling file; no test logic changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
239 lines
9.1 KiB
Go
239 lines
9.1 KiB
Go
package pluginsdk
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
)
|
|
|
|
// dataRecordingHost is a fake Go-native Host implementation whose Host data
|
|
// API (ADR 0043) accessors are backed by in-memory fixtures, used to prove
|
|
// grpcHostServer -> grpcHostClient reachability for the read RPCs added in
|
|
// task-03. State/secrets/emit are inherited (unimplemented) from
|
|
// UnimplementedHostData since these tests only exercise the data accessors.
|
|
type dataRecordingHost struct {
|
|
UnimplementedHostData
|
|
|
|
tasks map[string]Task
|
|
taskList []Task
|
|
taskPageInfo *PageInfo
|
|
sessions []Session
|
|
sessionPage *PageInfo
|
|
codeStats []SessionCodeStats
|
|
codeStatsPage *PageInfo
|
|
workspaces []Workspace
|
|
workflows []Workflow
|
|
workflowSteps []WorkflowStep
|
|
agentProfiles []AgentProfile
|
|
repositories []Repository
|
|
|
|
lastTaskFilter TaskFilter
|
|
lastSessionFilter SessionFilter
|
|
lastWorkspaceID string
|
|
lastWorkflowID string
|
|
}
|
|
|
|
func (h *dataRecordingHost) GetState(context.Context, string, string, string) (map[string]any, bool, error) {
|
|
return nil, false, nil
|
|
}
|
|
func (h *dataRecordingHost) SetState(context.Context, string, string, string, map[string]any) error {
|
|
return nil
|
|
}
|
|
func (h *dataRecordingHost) DeleteState(context.Context, string, string, string) error { return nil }
|
|
func (h *dataRecordingHost) ListState(context.Context, string, string) ([]StateEntry, error) {
|
|
return nil, nil
|
|
}
|
|
func (h *dataRecordingHost) GetConfig(context.Context) (map[string]any, error) { return nil, nil }
|
|
func (h *dataRecordingHost) GetSecret(context.Context, string) (string, bool, error) {
|
|
return "", false, nil
|
|
}
|
|
func (h *dataRecordingHost) SetSecret(context.Context, string, string) error { return nil }
|
|
func (h *dataRecordingHost) DeleteSecret(context.Context, string) error { return nil }
|
|
func (h *dataRecordingHost) RevealSecret(context.Context, string) (string, error) { return "", nil }
|
|
func (h *dataRecordingHost) EmitEvent(context.Context, string, map[string]any) error {
|
|
return nil
|
|
}
|
|
|
|
func (h *dataRecordingHost) Tasks() TaskReader { return dataRecordingTaskReader{h} }
|
|
func (h *dataRecordingHost) Sessions() SessionReader { return dataRecordingSessionReader{h} }
|
|
func (h *dataRecordingHost) Workspaces() WorkspaceReader { return dataRecordingWorkspaceReader{h} }
|
|
func (h *dataRecordingHost) Workflows() WorkflowReader { return dataRecordingWorkflowReader{h} }
|
|
func (h *dataRecordingHost) AgentProfiles() AgentProfileReader {
|
|
return dataRecordingAgentProfileReader{h}
|
|
}
|
|
func (h *dataRecordingHost) Repositories() RepositoryReader {
|
|
return dataRecordingRepositoryReader{h}
|
|
}
|
|
|
|
type dataRecordingTaskReader struct{ h *dataRecordingHost }
|
|
|
|
func (r dataRecordingTaskReader) List(_ context.Context, filter TaskFilter, _ Page) ([]Task, *PageInfo, error) {
|
|
r.h.lastTaskFilter = filter
|
|
return r.h.taskList, r.h.taskPageInfo, nil
|
|
}
|
|
|
|
func (r dataRecordingTaskReader) Get(_ context.Context, id string) (*Task, error) {
|
|
task, ok := r.h.tasks[id]
|
|
if !ok {
|
|
return nil, status.Errorf(codes.NotFound, "task %q not found", id)
|
|
}
|
|
return &task, nil
|
|
}
|
|
|
|
type dataRecordingSessionReader struct{ h *dataRecordingHost }
|
|
|
|
func (r dataRecordingSessionReader) List(_ context.Context, filter SessionFilter, _ Page) ([]Session, *PageInfo, error) {
|
|
r.h.lastSessionFilter = filter
|
|
return r.h.sessions, r.h.sessionPage, nil
|
|
}
|
|
|
|
func (r dataRecordingSessionReader) CodeStats(_ context.Context, filter SessionFilter, _ Page) ([]SessionCodeStats, *PageInfo, error) {
|
|
r.h.lastSessionFilter = filter
|
|
return r.h.codeStats, r.h.codeStatsPage, nil
|
|
}
|
|
|
|
type dataRecordingWorkspaceReader struct{ h *dataRecordingHost }
|
|
|
|
func (r dataRecordingWorkspaceReader) List(context.Context, Page) ([]Workspace, *PageInfo, error) {
|
|
return r.h.workspaces, nil, nil
|
|
}
|
|
|
|
type dataRecordingWorkflowReader struct{ h *dataRecordingHost }
|
|
|
|
func (r dataRecordingWorkflowReader) List(_ context.Context, workspaceID string, _ Page) ([]Workflow, *PageInfo, error) {
|
|
r.h.lastWorkspaceID = workspaceID
|
|
return r.h.workflows, nil, nil
|
|
}
|
|
|
|
func (r dataRecordingWorkflowReader) ListSteps(_ context.Context, workflowID string) ([]WorkflowStep, error) {
|
|
r.h.lastWorkflowID = workflowID
|
|
return r.h.workflowSteps, nil
|
|
}
|
|
|
|
type dataRecordingAgentProfileReader struct{ h *dataRecordingHost }
|
|
|
|
func (r dataRecordingAgentProfileReader) List(context.Context, Page) ([]AgentProfile, *PageInfo, error) {
|
|
return r.h.agentProfiles, nil, nil
|
|
}
|
|
|
|
type dataRecordingRepositoryReader struct{ h *dataRecordingHost }
|
|
|
|
func (r dataRecordingRepositoryReader) List(_ context.Context, workspaceID string, _ Page) ([]Repository, *PageInfo, error) {
|
|
r.h.lastWorkspaceID = workspaceID
|
|
return r.h.repositories, nil, nil
|
|
}
|
|
|
|
func TestHostData_TasksListAndGet(t *testing.T) {
|
|
impl := &dataRecordingHost{
|
|
tasks: map[string]Task{
|
|
"task-1": {ID: "task-1", Title: "Fix the bug", State: "todo"},
|
|
},
|
|
taskList: []Task{{ID: "task-1", Title: "Fix the bug", State: "todo"}},
|
|
taskPageInfo: &PageInfo{NextCursor: "next-1", HasMore: true},
|
|
}
|
|
host := dialHostOverBufconn(t, impl)
|
|
|
|
tasks, pageInfo, err := host.Tasks().List(context.Background(), TaskFilter{States: []string{"todo"}}, Page{Limit: 10})
|
|
require.NoError(t, err)
|
|
require.Equal(t, []Task{{ID: "task-1", Title: "Fix the bug", State: "todo"}}, tasks)
|
|
require.Equal(t, &PageInfo{NextCursor: "next-1", HasMore: true}, pageInfo)
|
|
require.Equal(t, TaskFilter{States: []string{"todo"}}, impl.lastTaskFilter)
|
|
|
|
task, err := host.Tasks().Get(context.Background(), "task-1")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "Fix the bug", task.Title)
|
|
|
|
_, err = host.Tasks().Get(context.Background(), "missing")
|
|
require.Error(t, err)
|
|
require.Equal(t, codes.NotFound, status.Code(err))
|
|
}
|
|
|
|
func TestHostData_SessionsListAndCodeStats(t *testing.T) {
|
|
impl := &dataRecordingHost{
|
|
sessions: []Session{{ID: "session-1", TaskID: "task-1", State: "running"}},
|
|
codeStats: []SessionCodeStats{{SessionID: "session-1", LinesAddedCommitted: 10}},
|
|
}
|
|
host := dialHostOverBufconn(t, impl)
|
|
|
|
sessions, _, err := host.Sessions().List(context.Background(), SessionFilter{TaskIDs: []string{"task-1"}}, Page{})
|
|
require.NoError(t, err)
|
|
require.Equal(t, impl.sessions, sessions)
|
|
require.Equal(t, SessionFilter{TaskIDs: []string{"task-1"}}, impl.lastSessionFilter)
|
|
|
|
stats, _, err := host.Sessions().CodeStats(context.Background(), SessionFilter{TaskIDs: []string{"task-1"}}, Page{})
|
|
require.NoError(t, err)
|
|
require.Equal(t, impl.codeStats, stats)
|
|
}
|
|
|
|
func TestHostData_Workspaces(t *testing.T) {
|
|
impl := &dataRecordingHost{workspaces: []Workspace{{ID: "ws-1", Name: "Acme"}}}
|
|
host := dialHostOverBufconn(t, impl)
|
|
|
|
workspaces, _, err := host.Workspaces().List(context.Background(), Page{})
|
|
require.NoError(t, err)
|
|
require.Equal(t, impl.workspaces, workspaces)
|
|
}
|
|
|
|
func TestHostData_WorkflowsAndSteps(t *testing.T) {
|
|
impl := &dataRecordingHost{
|
|
workflows: []Workflow{{ID: "wf-1", WorkspaceID: "ws-1", Name: "Default"}},
|
|
workflowSteps: []WorkflowStep{{ID: "step-1", WorkflowID: "wf-1", Name: "Review"}},
|
|
}
|
|
host := dialHostOverBufconn(t, impl)
|
|
|
|
workflows, _, err := host.Workflows().List(context.Background(), "ws-1", Page{})
|
|
require.NoError(t, err)
|
|
require.Equal(t, impl.workflows, workflows)
|
|
require.Equal(t, "ws-1", impl.lastWorkspaceID)
|
|
|
|
steps, err := host.Workflows().ListSteps(context.Background(), "wf-1")
|
|
require.NoError(t, err)
|
|
require.Equal(t, impl.workflowSteps, steps)
|
|
require.Equal(t, "wf-1", impl.lastWorkflowID)
|
|
}
|
|
|
|
func TestHostData_AgentProfiles(t *testing.T) {
|
|
impl := &dataRecordingHost{agentProfiles: []AgentProfile{{ID: "profile-1", DisplayName: "Claude"}}}
|
|
host := dialHostOverBufconn(t, impl)
|
|
|
|
profiles, _, err := host.AgentProfiles().List(context.Background(), Page{})
|
|
require.NoError(t, err)
|
|
require.Equal(t, impl.agentProfiles, profiles)
|
|
}
|
|
|
|
func TestHostData_Repositories(t *testing.T) {
|
|
impl := &dataRecordingHost{repositories: []Repository{{ID: "repo-1", WorkspaceID: "ws-1", Name: "kdlbs/kandev"}}}
|
|
host := dialHostOverBufconn(t, impl)
|
|
|
|
repos, _, err := host.Repositories().List(context.Background(), "ws-1", Page{})
|
|
require.NoError(t, err)
|
|
require.Equal(t, impl.repositories, repos)
|
|
require.Equal(t, "ws-1", impl.lastWorkspaceID)
|
|
}
|
|
|
|
// TestHostData_UnimplementedHostData_ReturnsUnimplemented proves that a Host
|
|
// implementation embedding UnimplementedHostData (task-03's default for
|
|
// task-04 to override) compiles against the Host interface and, over the
|
|
// wire, returns a gRPC Unimplemented status for every Host data API RPC —
|
|
// so a plugin author calling an unwired accessor gets a clear error rather
|
|
// than a panic or a zero-value success.
|
|
func TestHostData_UnimplementedHostData_ReturnsUnimplemented(t *testing.T) {
|
|
impl := &recordingHost{}
|
|
host := dialHostOverBufconn(t, impl)
|
|
|
|
_, _, err := host.Tasks().List(context.Background(), TaskFilter{}, Page{})
|
|
require.Error(t, err)
|
|
require.Equal(t, codes.Unimplemented, status.Code(err))
|
|
|
|
_, err = host.Tasks().Get(context.Background(), "task-1")
|
|
require.Error(t, err)
|
|
require.Equal(t, codes.Unimplemented, status.Code(err))
|
|
|
|
_, _, err = host.Sessions().CodeStats(context.Background(), SessionFilter{}, Page{})
|
|
require.Error(t, err)
|
|
require.Equal(t, codes.Unimplemented, status.Code(err))
|
|
}
|