|
| 1 | +import { beforeEach, describe, expect, it, vi } from "vitest"; |
| 2 | + |
| 3 | +vi.mock("../../src/db/repositories", async (importOriginal) => { |
| 4 | + const actual = await importOriginal<typeof import("../../src/db/repositories")>(); |
| 5 | + return { |
| 6 | + ...actual, |
| 7 | + getGlobalAgentFrozenState: vi.fn(actual.getGlobalAgentFrozenState), |
| 8 | + setGlobalAgentFrozen: vi.fn(actual.setGlobalAgentFrozen), |
| 9 | + }; |
| 10 | +}); |
| 11 | + |
| 12 | +import { createApp } from "../../src/api/routes"; |
| 13 | +import { createSessionForGitHubUser } from "../../src/auth/security"; |
| 14 | +import { getGlobalAgentFrozenState, setGlobalAgentFrozen } from "../../src/db/repositories"; |
| 15 | +import { createTestEnv } from "../helpers/d1"; |
| 16 | + |
| 17 | +// #2359: setGlobalAgentFrozen previously had zero callers anywhere in src/ — the only way to flip the DB-backed |
| 18 | +// global kill-switch was raw SQL. These tests cover the new operator-only route pair that makes it operable. |
| 19 | + |
| 20 | +function apiHeaders(env: Env): Record<string, string> { |
| 21 | + return { authorization: `Bearer ${env.GITTENSORY_API_TOKEN}`, "content-type": "application/json" }; |
| 22 | +} |
| 23 | + |
| 24 | +async function auditRows(env: Env): Promise<Array<{ actor: string; outcome: string; metadata_json: string }>> { |
| 25 | + const result = (await env.DB.prepare("select actor, outcome, metadata_json from audit_events where event_type = 'operator.kill_switch_set' order by created_at desc").all()) as { |
| 26 | + results: Array<{ actor: string; outcome: string; metadata_json: string }>; |
| 27 | + }; |
| 28 | + return result.results; |
| 29 | +} |
| 30 | + |
| 31 | +describe("kill-switch operator route (#2359)", () => { |
| 32 | + beforeEach(() => { |
| 33 | + vi.mocked(getGlobalAgentFrozenState).mockClear(); |
| 34 | + vi.mocked(setGlobalAgentFrozen).mockClear(); |
| 35 | + }); |
| 36 | + |
| 37 | + it("GET returns the seeded-default unfrozen state for a trusted static token", async () => { |
| 38 | + const app = createApp(); |
| 39 | + const env = createTestEnv(); |
| 40 | + const res = await app.request("/v1/app/kill-switch", { headers: apiHeaders(env) }, env); |
| 41 | + expect(res.status).toBe(200); |
| 42 | + await expect(res.json()).resolves.toMatchObject({ frozen: false, updatedBy: null }); |
| 43 | + }); |
| 44 | + |
| 45 | + it("GET is forbidden for an authenticated session without the operator role", async () => { |
| 46 | + const app = createApp(); |
| 47 | + const env = createTestEnv(); |
| 48 | + const { token } = await createSessionForGitHubUser(env, { login: "not-an-operator", id: 501 }); |
| 49 | + const res = await app.request("/v1/app/kill-switch", { headers: { cookie: `gittensory_session=${token}` } }, env); |
| 50 | + expect(res.status).toBe(403); |
| 51 | + }); |
| 52 | + |
| 53 | + it("GET is unauthorized with no identity at all", async () => { |
| 54 | + const app = createApp(); |
| 55 | + const env = createTestEnv(); |
| 56 | + const res = await app.request("/v1/app/kill-switch", {}, env); |
| 57 | + expect(res.status).toBe(401); |
| 58 | + }); |
| 59 | + |
| 60 | + it("GET surfaces a clear 503 (never a falsely reassuring unfrozen) when the singleton row is missing", async () => { |
| 61 | + const app = createApp(); |
| 62 | + const env = createTestEnv(); |
| 63 | + await env.DB.prepare("DELETE FROM global_agent_controls WHERE id = 'singleton'").run(); |
| 64 | + const res = await app.request("/v1/app/kill-switch", { headers: apiHeaders(env) }, env); |
| 65 | + expect(res.status).toBe(503); |
| 66 | + await expect(res.json()).resolves.toMatchObject({ error: "kill_switch_read_failed" }); |
| 67 | + }); |
| 68 | + |
| 69 | + it("POST freezes and unfreezes the fleet for an operator session, verifying the write and auditing it", async () => { |
| 70 | + const app = createApp(); |
| 71 | + const env = createTestEnv(); |
| 72 | + const { token } = await createSessionForGitHubUser(env, { login: "jsonbored", id: 1 }); |
| 73 | + const headers = { cookie: `gittensory_session=${token}`, "content-type": "application/json" }; |
| 74 | + |
| 75 | + const freeze = await app.request("/v1/app/kill-switch", { method: "POST", headers, body: JSON.stringify({ frozen: true }) }, env); |
| 76 | + expect(freeze.status).toBe(200); |
| 77 | + await expect(freeze.json()).resolves.toMatchObject({ ok: true, frozen: true, updatedBy: "jsonbored" }); |
| 78 | + |
| 79 | + const readBack = await app.request("/v1/app/kill-switch", { headers: apiHeaders(env) }, env); |
| 80 | + await expect(readBack.json()).resolves.toMatchObject({ frozen: true }); |
| 81 | + |
| 82 | + const unfreeze = await app.request("/v1/app/kill-switch", { method: "POST", headers, body: JSON.stringify({ frozen: false }) }, env); |
| 83 | + expect(unfreeze.status).toBe(200); |
| 84 | + await expect(unfreeze.json()).resolves.toMatchObject({ ok: true, frozen: false, updatedBy: "jsonbored" }); |
| 85 | + |
| 86 | + const audits = await auditRows(env); |
| 87 | + expect(audits).toHaveLength(2); |
| 88 | + expect(audits.map((row) => JSON.parse(row.metadata_json).frozen)).toEqual([false, true]); |
| 89 | + expect(audits.every((row) => row.actor === "jsonbored" && row.outcome === "completed")).toBe(true); |
| 90 | + }); |
| 91 | + |
| 92 | + it("POST rejects a schema-invalid body instead of silently coercing it", async () => { |
| 93 | + const app = createApp(); |
| 94 | + const env = createTestEnv(); |
| 95 | + const { token } = await createSessionForGitHubUser(env, { login: "jsonbored", id: 1 }); |
| 96 | + const headers = { cookie: `gittensory_session=${token}`, "content-type": "application/json" }; |
| 97 | + const res = await app.request("/v1/app/kill-switch", { method: "POST", headers, body: JSON.stringify({ frozen: "yes" }) }, env); |
| 98 | + expect(res.status).toBe(400); |
| 99 | + await expect(res.json()).resolves.toMatchObject({ error: "invalid_kill_switch_update" }); |
| 100 | + expect(setGlobalAgentFrozen).not.toHaveBeenCalled(); |
| 101 | + }); |
| 102 | + |
| 103 | + it("POST rejects a body that isn't valid JSON at all", async () => { |
| 104 | + const app = createApp(); |
| 105 | + const env = createTestEnv(); |
| 106 | + const res = await app.request("/v1/app/kill-switch", { method: "POST", headers: apiHeaders(env), body: "{" }, env); |
| 107 | + expect(res.status).toBe(400); |
| 108 | + await expect(res.json()).resolves.toMatchObject({ error: "invalid_kill_switch_update" }); |
| 109 | + expect(setGlobalAgentFrozen).not.toHaveBeenCalled(); |
| 110 | + }); |
| 111 | + |
| 112 | + it("POST is forbidden for a non-operator session and unauthorized with no identity", async () => { |
| 113 | + const app = createApp(); |
| 114 | + const env = createTestEnv(); |
| 115 | + const { token } = await createSessionForGitHubUser(env, { login: "not-an-operator", id: 501 }); |
| 116 | + const forbidden = await app.request( |
| 117 | + "/v1/app/kill-switch", |
| 118 | + { method: "POST", headers: { cookie: `gittensory_session=${token}`, "content-type": "application/json" }, body: JSON.stringify({ frozen: true }) }, |
| 119 | + env, |
| 120 | + ); |
| 121 | + expect(forbidden.status).toBe(403); |
| 122 | + const unauthorized = await app.request("/v1/app/kill-switch", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ frozen: true }) }, env); |
| 123 | + expect(unauthorized.status).toBe(401); |
| 124 | + expect(setGlobalAgentFrozen).not.toHaveBeenCalled(); |
| 125 | + }); |
| 126 | + |
| 127 | + it("POST surfaces a 503 (not a false success) when the post-write verification read fails", async () => { |
| 128 | + const app = createApp(); |
| 129 | + const env = createTestEnv(); |
| 130 | + vi.mocked(getGlobalAgentFrozenState).mockRejectedValueOnce(new Error("D1 hiccup")); |
| 131 | + const res = await app.request("/v1/app/kill-switch", { method: "POST", headers: apiHeaders(env), body: JSON.stringify({ frozen: true }) }, env); |
| 132 | + expect(res.status).toBe(503); |
| 133 | + await expect(res.json()).resolves.toMatchObject({ error: "kill_switch_verify_failed" }); |
| 134 | + expect(setGlobalAgentFrozen).toHaveBeenCalledTimes(1); |
| 135 | + }); |
| 136 | + |
| 137 | + it("POST surfaces a 502 (not a false success) when the read-after-write observes a value that doesn't match the write", async () => { |
| 138 | + const app = createApp(); |
| 139 | + const env = createTestEnv(); |
| 140 | + vi.mocked(getGlobalAgentFrozenState).mockResolvedValueOnce({ frozen: false, updatedAt: null, updatedBy: null }); |
| 141 | + const res = await app.request("/v1/app/kill-switch", { method: "POST", headers: apiHeaders(env), body: JSON.stringify({ frozen: true }) }, env); |
| 142 | + expect(res.status).toBe(502); |
| 143 | + await expect(res.json()).resolves.toMatchObject({ error: "kill_switch_write_unconfirmed", requested: true, observed: false }); |
| 144 | + }); |
| 145 | +}); |
0 commit comments