Lucas WintherandClaude Opus 5.5
777ae2cc37
Contracts and core: - Feature gains auth and stop; FeatureFactory; core composeServer builds the context, runs the factories, then the job queue from the union of their jobs (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI. - AppConfig/loadConfig own the layout and settings: courseDirs include <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir, importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python. resolveConfig derives the same for tests; cachePaths shares the importer's cache layout. - canView: the global author role views every course (R14); the learner, studio and AI packages all call it. - migrate(db, packages): core first, then packages in name order. - Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on an empty file is 416. - courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts. Packages: - import, studio and AI read AppConfig instead of process.env; the importer refuses ids used by studio/repos. - learner migrations run through core migrate; library covers fall back to the importer's cached candidate behind a canView-checked route. - studio preview renders through the learner LessonView (anchors honoured, draft URLs); AI drafts go to the studio draft branch for studio courses (as the requesting user) and to <dataDir>/drafts otherwise, and the generator page says which. Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts imports them by package name; nav.roles hides links by role. Tests: compose, config, canView, media headers, migrations order, covers, preview, nav, SPA bundle without server code, and an end-to-end flow on SQLite and Postgres. Co-Authored-By: Claude Opus 5.5 <[email protected]>
41 lines
2.5 KiB
TypeScript
41 lines
2.5 KiB
TypeScript
import { expect } from "bun:test";
|
|
import { join } from "node:path";
|
|
import { forEachDb } from "./helpers";
|
|
import { FIXTURES, makeApp } from "./app";
|
|
import { extraCourses } from "./courses";
|
|
|
|
const JPEG = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, 0, 0x10, 0x4a, 0x46, 0x49, 0x46, 0, 1, 0xff, 0xd9]);
|
|
|
|
forEachDb("the library falls back to the importer's cover candidate, served only to users who can view the course", async (db) => {
|
|
const dir = await extraCourses();
|
|
const { call, signUp, ctx } = await makeApp(db, [FIXTURES, dir]);
|
|
const covers = (id: string) => join(ctx.config.cacheDir, "covers", id);
|
|
await Bun.write(join(covers("sample"), "deck-d1.jpg"), JPEG);
|
|
await Bun.write(join(covers("sample"), "frame-2.jpg"), JPEG);
|
|
await Bun.write(join(covers("sample"), "frame-10.jpg"), new Uint8Array([1]));
|
|
await Bun.write(join(covers("secret"), "frame-1.jpg"), JPEG);
|
|
await Bun.write(join(covers("sample"), "notes.txt"), "not a cover");
|
|
|
|
const lib = async (cookie?: string) => ((await (await call("GET", "/api/library", { cookie })).json()) as { courses: { id: string; coverUrl: string | null }[] }).courses;
|
|
const sample = (await lib()).find((c) => c.id === "sample")!;
|
|
expect(sample.coverUrl).toBe("/api/courses/sample/cover");
|
|
const r = await call("GET", "/api/courses/sample/cover");
|
|
expect(r.status).toBe(200);
|
|
expect(r.headers.get("content-type")).toBe("image/jpeg");
|
|
expect(r.headers.get("x-content-type-options")).toBe("nosniff");
|
|
expect(new Uint8Array(await r.arrayBuffer())).toEqual(JPEG); // frame-2 (frames first, numeric order), not frame-10 or the deck
|
|
expect((await (await call("GET", "/api/courses/sample")).json()).coverUrl).toBe("/api/courses/sample/cover");
|
|
|
|
// restricted: 404 for anonymous users and learners without access, 200 for the owner
|
|
const owner = await signUp("[email protected]");
|
|
const learner = await signUp("[email protected]");
|
|
expect((await call("GET", "/api/courses/secret/cover")).status).toBe(404);
|
|
expect((await call("GET", "/api/courses/secret/cover", { cookie: learner })).status).toBe(404);
|
|
expect((await call("GET", "/api/courses/secret/cover", { cookie: owner })).status).toBe(200);
|
|
expect((await lib(owner)).find((c) => c.id === "secret")!.coverUrl).toBe("/api/courses/secret/cover");
|
|
// no candidate: no cover, and the route is 404
|
|
expect((await lib(owner)).find((c) => c.id === "gated")!.coverUrl).toBeNull();
|
|
expect((await call("GET", "/api/courses/gated/cover", { cookie: owner })).status).toBe(404);
|
|
expect((await call("GET", "/api/courses/..%2Fsample/cover", { cookie: owner })).status).toBe(404);
|
|
});
|