Lucas WintherandClaude Opus 5.5
777ae2cc37
Contracts and core: - Feature gains auth and stop; FeatureFactory; core composeServer builds the context, runs the factories, then the job queue from the union of their jobs (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI. - AppConfig/loadConfig own the layout and settings: courseDirs include <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir, importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python. resolveConfig derives the same for tests; cachePaths shares the importer's cache layout. - canView: the global author role views every course (R14); the learner, studio and AI packages all call it. - migrate(db, packages): core first, then packages in name order. - Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on an empty file is 416. - courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts. Packages: - import, studio and AI read AppConfig instead of process.env; the importer refuses ids used by studio/repos. - learner migrations run through core migrate; library covers fall back to the importer's cached candidate behind a canView-checked route. - studio preview renders through the learner LessonView (anchors honoured, draft URLs); AI drafts go to the studio draft branch for studio courses (as the requesting user) and to <dataDir>/drafts otherwise, and the generator page says which. Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts imports them by package name; nav.roles hides links by role. Tests: compose, config, canView, media headers, migrations order, covers, preview, nav, SPA bundle without server code, and an end-to-end flow on SQLite and Postgres. Co-Authored-By: Claude Opus 5.5 <[email protected]>
32 lines
2.0 KiB
TypeScript
32 lines
2.0 KiB
TypeScript
import { expect } from "bun:test";
|
|
import { forEachDb } from "./helpers";
|
|
import { FIXTURES, makeApp } from "./app";
|
|
import { extraCourses } from "./courses";
|
|
|
|
forEachDb("one visibility rule (core canView, R14): owner, the global author role and per-course authors open a restricted course; learners do not", async (db) => {
|
|
const dir = await extraCourses();
|
|
const { call, signUp } = await makeApp(db, [FIXTURES, dir]);
|
|
const owner = await signUp("[email protected]");
|
|
const author = await signUp("[email protected]");
|
|
const coAuthor = await signUp("[email protected]");
|
|
const learner = await signUp("[email protected]");
|
|
const users = (await (await call("GET", "/api/admin/users", { cookie: owner })).json()) as { id: string; email: string }[];
|
|
const id = (e: string) => users.find((u) => u.email === e)!.id;
|
|
expect((await call("PUT", `/api/admin/users/${id("[email protected]")}/roles`, { cookie: owner, body: { roles: ["author"] } })).status).toBe(200);
|
|
expect((await call("PUT", "/api/admin/courses/secret/access", { cookie: owner, body: { authors: [id("[email protected]")] } })).status).toBe(200);
|
|
|
|
const paths = ["/api/courses/secret", "/api/courses/secret/lessons/s1", "/api/media/secret/a.md"];
|
|
for (const p of paths) {
|
|
expect([p, (await call("GET", p, { cookie: author })).status]).toEqual([p, 200]);
|
|
expect([p, (await call("GET", p, { cookie: coAuthor })).status]).toEqual([p, 200]);
|
|
expect([p, (await call("GET", p, { cookie: learner })).status]).toEqual([p, 404]);
|
|
expect([p, (await call("GET", p)).status]).toEqual([p, 404]);
|
|
}
|
|
const lib = async (c: string) => ((await (await call("GET", "/api/library", { cookie: c })).json()) as { courses: { id: string }[] }).courses.map((x) => x.id);
|
|
expect(await lib(author)).toContain("secret");
|
|
expect(await lib(coAuthor)).toContain("secret");
|
|
expect(await lib(learner)).not.toContain("secret");
|
|
const search = (await (await call("GET", "/api/library/search?q=hidden", { cookie: learner })).json()) as unknown[];
|
|
expect(search).toEqual([]);
|
|
});
|