D38：credential 目錄改走 KBDB API（零原生 SQL）＋舊表退場；測試刻意留紅燈
存取層：credentials.ts / auth-dispatcher.ts / portal.ts 全改走 kbdbBase()+fetch 到 /entries（照 execution-logger.ts 既有慣例），.prepare/.exec/.batch 命中 0。 資料層：0005 seed credential template；0006 把舊表資料搬進 entries 後拆表； 0002 標退役、deploy.ts 不再套用（加 kbdb-sql-ok 留痕，純歷史對照）。 總管親驗四項（不聽 agent 自評）： 1 三個檔 .prepare/.exec/.batch 命中 0；六個檔全部通過 kbdb-api-wall-guard 2 0006 的 INSERT 欄位（id/entry_type/owner_id/page_name/metadata_json/ created_at/updated_at）與 0001_base 的 entries 表逐一對得上 3 不可逆風險查官方：D1 batch 是 transaction、任一句失敗整批 rollback； exec 出錯則「執行停止、後續不執行」=> 兩種語意下 INSERT 失敗都不會跑到 DROP TABLE，用戶 credential 目錄不會遺失 4 0006 搬在拆之前、冪等（NOT EXISTS 防重複）、豁免標記有留痕且理由正當 （拆表是牆內施工，API 不提供也不該提供拆表） 🔴 抓到一個假綠並修正：agent 中途被中斷，把 111 行的 credentials.test.ts 砍成一行「// placeholder — see edit below」，那個 edit 從來沒發生， 且 setup.ts 被刪。vitest 對這種檔案回報「Tests: no tests」， 很容易被讀成「沒失敗＝通過」——正是 CP 記過的 「這條 route 曾整條消失過沒人發現」同型。 處置：還原 setup.ts/vitest.config.ts，credentials.test.ts 改成 **刻意會失敗的紅燈**並在檔頭列出要補的五項。空檔會被誤認為綠，紅燈不會。 未部署。本批要先上 stage 驗過才進 prod（leo 08-07 定）。 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
uncle6me-web
@@ -1,110 +1,33 @@
|
||||
/**
|
||||
* credential 治理端點測試。
|
||||
* credentials 路由測試 —— 🔴 待重寫（D38 圍牆修復後）
|
||||
*
|
||||
* 範圍限制（誠實記錄，非本檔缺陷）：`putWorkerSecret` / `deleteWorkerSecret` 呼叫真實
|
||||
* Cloudflare API（`fetch` 到 api.cloudflare.com）。測試環境（wrangler.test.toml）刻意不設
|
||||
* CF_SECRETS_API_TOKEN/CF_ACCOUNT_ID，所以本檔只覆蓋「不需要真的打 CF API」的路徑：
|
||||
* - D1-only 的 GET /credentials、/credentials/catalog
|
||||
* - DELETE 在 D1 無 row 時 fallback 刪舊 KV（不會走到 deleteWorkerSecret）
|
||||
* 真正打 CF Workers Secrets API 成功寫入/刪除的路徑，由部署到 leo21c 帳號後的端到端
|
||||
* curl 驗證覆蓋（見 credential-store-migration.md T8/T9 完成記錄）。
|
||||
* 【為什麼是紅燈而不是空檔】
|
||||
* 2026-08-07 D38 圍牆修復把 credential 目錄從「獨立 credentials 表 + 原生 SQL」
|
||||
* 改成「KBDB entries（entry_type='credential'）+ HTTP API」。原本 111 行的測試
|
||||
* 測的是舊的 SQL 實作，全部不再適用。
|
||||
*
|
||||
* 施工的 agent 中途被中斷，留下一行 `// placeholder — see edit below` ——
|
||||
* 那個 "edit below" 從來沒發生。vitest 對這種檔案回報 `Tests: no tests`，
|
||||
* **很容易被讀成「沒失敗＝通過」**，正是 CP 記過的
|
||||
* 「這條 route 曾整條消失過沒人發現」同型。
|
||||
*
|
||||
* ⇒ 這裡刻意留一個**會失敗**的測試：空檔會被誤認為綠，紅燈不會。
|
||||
*
|
||||
* 【重寫時要涵蓋什麼】（照新實作 routes/credentials.ts）
|
||||
* 1. 寫入走 KBDB HTTP API，且 owner_id = api_key（租戶隔離）
|
||||
* 2. 讀取查得回 secret_ref，且查不到別的租戶的
|
||||
* 3. 刪除是真的刪（不是 deprecated）
|
||||
* 4. **零原生 SQL**：整支檔案不得出現 .prepare/.exec/.batch
|
||||
* 5. 密文本體不落 KBDB（只有 secret_ref 指標）—— D19 不變
|
||||
*/
|
||||
import { describe, it, expect, beforeEach } from 'vitest';
|
||||
import { env, SELF } from 'cloudflare:test';
|
||||
import { describe, it, expect } from 'vitest';
|
||||
|
||||
const API_KEY = 'test-tenant-t89';
|
||||
|
||||
async function insertCredentialRow(
|
||||
name: string,
|
||||
secretRef: string,
|
||||
extra: Partial<{ service: string | null; sensitivity: string; last_used_at: number | null }> = {},
|
||||
): Promise<void> {
|
||||
await env.CREDENTIALS_DB
|
||||
.prepare(
|
||||
`INSERT INTO credentials (api_key, name, service, sensitivity, secret_ref, created_at, last_used_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?)`,
|
||||
)
|
||||
.bind(
|
||||
API_KEY,
|
||||
name,
|
||||
extra.service ?? null,
|
||||
extra.sensitivity ?? 'standard',
|
||||
secretRef,
|
||||
Math.floor(Date.now() / 1000),
|
||||
extra.last_used_at ?? null,
|
||||
)
|
||||
.run();
|
||||
}
|
||||
|
||||
async function clearTenantRows(): Promise<void> {
|
||||
await env.CREDENTIALS_DB.prepare(`DELETE FROM credentials WHERE api_key = ?`).bind(API_KEY).run();
|
||||
}
|
||||
|
||||
describe('GET /credentials (D1, T9)', () => {
|
||||
beforeEach(clearTenantRows);
|
||||
|
||||
it('缺 X-Arcrun-API-Key → 401', async () => {
|
||||
const res = await SELF.fetch('https://cypher.test/credentials');
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('無資料 → 空陣列（非拋錯）', async () => {
|
||||
const res = await SELF.fetch('https://cypher.test/credentials', {
|
||||
headers: { 'X-Arcrun-API-Key': API_KEY },
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const body = await res.json() as { success: boolean; credentials: unknown[]; total: number };
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.credentials).toEqual([]);
|
||||
expect(body.total).toBe(0);
|
||||
});
|
||||
|
||||
it('回傳 metadata，絕不含 secret_ref 或值', async () => {
|
||||
await insertCredentialRow('telegram_bot_token', 'CRED_TELEGRAM_BOT_TOKEN_ABCDEF01', { service: 'telegram' });
|
||||
const res = await SELF.fetch('https://cypher.test/credentials', {
|
||||
headers: { 'X-Arcrun-API-Key': API_KEY },
|
||||
});
|
||||
const body = await res.json() as { success: boolean; credentials: Array<Record<string, unknown>> };
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.credentials).toHaveLength(1);
|
||||
const row = body.credentials[0];
|
||||
expect(row.name).toBe('telegram_bot_token');
|
||||
expect(row.service).toBe('telegram');
|
||||
expect(row).not.toHaveProperty('secret_ref');
|
||||
expect(row).not.toHaveProperty('value');
|
||||
expect(JSON.stringify(row)).not.toMatch(/CRED_/);
|
||||
});
|
||||
|
||||
it('/credentials/catalog 回同一份資料（Console 相容別名）', async () => {
|
||||
await insertCredentialRow('notion_token', 'CRED_NOTION_TOKEN_ABCDEF01');
|
||||
const [listRes, catalogRes] = await Promise.all([
|
||||
SELF.fetch('https://cypher.test/credentials', { headers: { 'X-Arcrun-API-Key': API_KEY } }),
|
||||
SELF.fetch('https://cypher.test/credentials/catalog', { headers: { 'X-Arcrun-API-Key': API_KEY } }),
|
||||
]);
|
||||
const [listBody, catalogBody] = await Promise.all([listRes.json(), catalogRes.json()]) as Array<{
|
||||
credentials: Array<{ name: string }>;
|
||||
}>;
|
||||
expect(listBody.credentials.map(r => r.name)).toEqual(catalogBody.credentials.map(r => r.name));
|
||||
});
|
||||
});
|
||||
|
||||
describe('DELETE /credentials/:name (T9)', () => {
|
||||
beforeEach(clearTenantRows);
|
||||
|
||||
it('D1 無 row（從未回填）→ fallback 刪舊 KV，不誤報找不到', async () => {
|
||||
await env.CREDENTIALS_KV.put(
|
||||
`${API_KEY}:cred:legacy_only`,
|
||||
JSON.stringify({ encrypted: 'x', iv: 'y' }),
|
||||
describe('credentials 路由（D38 改走 KBDB API 後）', () => {
|
||||
it('🔴 測試待重寫 —— 見本檔頭部清單（刻意紅燈，別刪掉改成空檔）', () => {
|
||||
expect.fail(
|
||||
'D38 圍牆修復後 credential 改走 KBDB entries + HTTP API，' +
|
||||
'舊的 SQL 版測試已作廢、新測試尚未寫。' +
|
||||
'要補的五項見本檔頭部註解。',
|
||||
);
|
||||
const res = await SELF.fetch('https://cypher.test/credentials/legacy_only', {
|
||||
method: 'DELETE',
|
||||
headers: { 'X-Arcrun-API-Key': API_KEY },
|
||||
});
|
||||
const body = await res.json() as { success: boolean; source: string };
|
||||
expect(res.status).toBe(200);
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.source).toBe('legacy-kv');
|
||||
const raw = await env.CREDENTIALS_KV.get(`${API_KEY}:cred:legacy_only`);
|
||||
expect(raw).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user