BitSquare/Codeman
2
0
Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-09-30 12:39:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

Browse Source 
Point 1 of the v1.0 lock-in: commit to a stable HTTP API (the cleanest, fullest form).

Core (centralized):
- Every JSON /api response now uses ONE envelope via a Fastify preSerialization hook (src/web/server.ts): success -> { success:true, data:<payload> }; error -> { success:false, error, errorCode } with a conventional HTTP status. Non-JSON routes (file-raw, tail-file SSE, download, screenshots, /q redirect, WS) are skipped.
- Error-code -> HTTP status is a single source of truth (httpStatusForErrorCode in src/types/api.ts): 400/401/404/409/422/429/500. Expanded ApiErrorCode (added UNAUTHORIZED, CONFLICT, RATE_LIMITED). Errors are no longer HTTP 200.
- Versioned alias: /api/v1/* rewrites to /api/* (rewriteApiV1Url), so external clients pin to a stable surface while the bundled UI keeps using /api/*.
- Handlers stripped of manual 'success:true' (50 across 14 route files) so they return bare payloads the hook wraps uniformly; fixed the mux DELETE {success:<bool>} envelope collision (-> {killed}).

Frontend (48 call sites across 10 files):
- _apiJson() auto-unwraps { success:true, data } -> data (null on error), so most bare-shape readers are transparent. Raw-fetch sites relocate payload reads under .data; success/res.ok/error checks unchanged.

Docs: new docs/api-reference.md (envelope, status table, error codes, /api/v1, SSE); versioning-policy.md flipped — the HTTP/SSE API is now part of the stable, SemVer-covered surface.

Verification: full unit/route suite green (2680 passed) incl. ~166 updated assertions across 24 test files; typecheck/lint/format/frontend-syntax clean; a headless-chromium smoke loaded the migrated UI and drove the panels with 0 console/page errors; /api/status and /api/v1/status confirmed returning the uniform envelope live.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
arkon
2026-06-10 01:30:43 +02:00
co-authored by Claude Opus 4.8
parent 5b3024b327
commit 458fb81cbe
49 changed files with 929 additions and 554 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/qr-auth.test.ts
+20 -23
View File
@@ -86,8 +86,7 @@ describe('QR Token Manager (unit)', () => {
// Manually expire the token by manipulating its createdAt
// Access the private map — this is a unit test, we need to verify the TTL logic
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> })
.qrTokensByCode;
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> }).qrTokensByCode;
const record = tokenMap.get(code)!;
record.createdAt = Date.now() - 91_000; // 91 seconds ago (beyond 90s grace)
@@ -99,8 +98,7 @@ describe('QR Token Manager (unit)', () => {
const code = tm.getCurrentShortCode()!;
// Set createdAt to 80 seconds ago (within 90s grace)
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> })
.qrTokensByCode;
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> }).qrTokensByCode;
const record = tokenMap.get(code)!;
record.createdAt = Date.now() - 80_000;
@@ -172,8 +170,7 @@ describe('QR Token Manager (unit)', () => {
it('should accept token at exactly grace period (90000ms)', () => {
const code = tm.getCurrentShortCode()!;
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> })
.qrTokensByCode;
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> }).qrTokensByCode;
const record = tokenMap.get(code)!;
record.createdAt = Date.now() - 90_000;
// Condition is `> QR_TOKEN_GRACE_MS` (strict >), so exactly 90000 should pass
@@ -182,8 +179,7 @@ describe('QR Token Manager (unit)', () => {
it('should reject token at grace period + 1ms (90001ms)', () => {
const code = tm.getCurrentShortCode()!;
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> })
.qrTokensByCode;
const tokenMap = (tm as unknown as { qrTokensByCode: Map<string, { createdAt: number }> }).qrTokensByCode;
const record = tokenMap.get(code)!;
record.createdAt = Date.now() - 90_001;
expect(tm.consumeToken(code)).toBe(false);
@@ -308,8 +304,7 @@ describe('QR Auth Integration', () => {
beforeEach(() => {
// Reset QR failure counter to prevent cross-test contamination
// (all requests come from 127.0.0.1)
const qrFailures = (server as unknown as { qrAuthFailures: { clear(): void } | null })
.qrAuthFailures;
const qrFailures = (server as unknown as { qrAuthFailures: { clear(): void } | null }).qrAuthFailures;
if (qrFailures) qrFailures.clear();
});
@@ -568,9 +563,11 @@ describe('QR Auth Integration', () => {
const setCookie = res.headers.get('set-cookie')!;
const token = setCookie.match(/codeman_session=([^;]+)/)![1];
const authSessions = (server as unknown as {
authSessions: { get(k: string): { method: string } | undefined } | null;
}).authSessions;
const authSessions = (
server as unknown as {
authSessions: { get(k: string): { method: string } | undefined } | null;
}
).authSessions;
const record = authSessions?.get(token);
expect(record).toBeDefined();
expect(record!.method).toBe('qr');
@@ -631,9 +628,9 @@ describe('QR SVG Endpoint (GET /api/tunnel/qr)', () => {
});
expect(res.status).toBe(200);
const data = await res.json();
expect(data.authEnabled).toBe(true);
expect(data.svg).toContain('<svg');
expect(data.svg).toContain('</svg>');
expect(data.data.authEnabled).toBe(true);
expect(data.data.svg).toContain('<svg');
expect(data.data.svg).toContain('</svg>');
} finally {
tm.stopTokenRotation();
simulateTunnelStopped(tm);
@@ -653,9 +650,9 @@ describe('QR SVG Endpoint (GET /api/tunnel/qr)', () => {
});
expect(res.status).toBe(200);
const data = await res.json();
expect(data.authEnabled).toBe(false);
expect(data.svg).toContain('<svg');
expect(data.svg).toContain('</svg>');
expect(data.data.authEnabled).toBe(false);
expect(data.data.svg).toContain('<svg');
expect(data.data.svg).toContain('</svg>');
} finally {
process.env.CODEMAN_PASSWORD = savedPass;
simulateTunnelStopped(tm);
@@ -709,8 +706,8 @@ describe('QR SVG Endpoint (GET /api/tunnel/qr)', () => {
});
expect(res.status).toBe(200);
const data = await res.json();
expect(data.svg).toContain('<svg');
expect(data.authEnabled).toBe(false);
expect(data.data.svg).toContain('<svg');
expect(data.data.authEnabled).toBe(false);
} finally {
process.env.CODEMAN_PASSWORD = savedPass;
simulateTunnelStopped(tm);
@@ -732,7 +729,7 @@ describe('QR SVG Endpoint (GET /api/tunnel/qr)', () => {
});
const data2 = await res2.json();
expect(data1.svg).toBe(data2.svg);
expect(data1.data.svg).toBe(data2.data.svg);
} finally {
tm.stopTokenRotation();
simulateTunnelStopped(tm);
@@ -756,7 +753,7 @@ describe('QR SVG Endpoint (GET /api/tunnel/qr)', () => {
});
const data2 = await res2.json();
expect(data1.svg).not.toBe(data2.svg);
expect(data1.data.svg).not.toBe(data2.data.svg);
} finally {
tm.stopTokenRotation();
simulateTunnelStopped(tm);