7179f8a5b2
Security (must-fix):
- /git smart-HTTP gate: an authenticated NON-member of a git-sync space now gets
404 (not 403), so the 403<->404 difference can no longer be used to brute-force
which spaces exist / have git-sync enabled. 403 is reserved for a MEMBER who
lacks the required role (existence already known). New gate input
userIsSpaceMember; decision-table + service specs extended.
Config (must-fix):
- Remove the dead GIT_SYNC_SSH_KEY_PATH knob (getter + validation field + two
.env.example lines) — it had zero consumers and advertised a nonexistent push
capability.
Stability/docs (warnings):
- Wire the lost-lock AbortSignal into runReceivePack -> git http-backend so the
receive-pack child is killed if the per-space lock lapses mid-write.
- Raise the divergent-`docmost` (invariant §5) push refusal from info -> warn and
surface divergentDocmost in the run status (/status).
- Comment the stale read-after-debounced-collab-write updatedAt in
importPageMarkdown (deferred §10 loop-guard must not trust it).
- Fix the Dockerfile comment: the loader uses require.resolve + dynamic import(),
it deliberately does NOT require('@docmost/git-sync').
- Merge the two near-identical space toggle handlers into one parameterized
handler; add the 2 missing en-US i18n keys for the auto-merge switch (ru-RU not
maintained for these git-sync strings, mirrored).
Tests:
- isGitSyncHttpEnabled() default-branch (unset -> isGitSyncEnabled fallback).
- agentSourceFields 'git-sync' case (source stamped, chat key omitted).
- editor-ext name-level schema contract (vendored mirror superset of editor-ext
node/mark types) + the new shared resolver + non-member 404 gate cases.
Architecture:
- Extract resolveRequestWorkspace shared by DomainMiddleware + GitHttpService
(the two real self-hosted/cloud copies; McpService has no cloud branch).
- Document the in-process setInterval multi-replica limitation + BullMQ/fencing
future direction (deferred, not implemented).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
72 lines
2.5 KiB
TypeScript
72 lines
2.5 KiB
TypeScript
import { resolveRequestWorkspace } from './resolve-request-workspace';
|
|
|
|
// Unit tests for the shared self-hosted/cloud workspace resolver deduplicated out
|
|
// of DomainMiddleware + GitHttpService (architecture #11). They must behave
|
|
// identically, so this pins the single source of truth.
|
|
|
|
type AnyMock = jest.Mock;
|
|
|
|
function build(opts: {
|
|
selfHosted: boolean;
|
|
first?: { id: string } | null;
|
|
byHostname?: { id: string } | null;
|
|
}) {
|
|
const env = {
|
|
isSelfHosted: jest.fn(() => opts.selfHosted),
|
|
isCloud: jest.fn(() => !opts.selfHosted),
|
|
};
|
|
const repo = {
|
|
findFirst: jest.fn(async () => opts.first ?? null) as AnyMock,
|
|
findByHostname: jest.fn(async () => opts.byHostname ?? null) as AnyMock,
|
|
};
|
|
return { env, repo };
|
|
}
|
|
|
|
describe('resolveRequestWorkspace', () => {
|
|
it('self-hosted: returns the first/default workspace, ignoring the host', async () => {
|
|
const { env, repo } = build({ selfHosted: true, first: { id: 'ws-1' } });
|
|
const ws = await resolveRequestWorkspace(
|
|
env as any,
|
|
repo as any,
|
|
'anything.example.com',
|
|
);
|
|
expect(ws).toEqual({ id: 'ws-1' });
|
|
expect(repo.findFirst).toHaveBeenCalledTimes(1);
|
|
expect(repo.findByHostname).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('self-hosted: returns null when no workspace is configured', async () => {
|
|
const { env, repo } = build({ selfHosted: true, first: null });
|
|
expect(await resolveRequestWorkspace(env as any, repo as any, 'h')).toBeNull();
|
|
});
|
|
|
|
it('cloud: resolves by the host-header subdomain', async () => {
|
|
const { env, repo } = build({
|
|
selfHosted: false,
|
|
byHostname: { id: 'ws-acme' },
|
|
});
|
|
const ws = await resolveRequestWorkspace(
|
|
env as any,
|
|
repo as any,
|
|
'acme.example.com',
|
|
);
|
|
expect(ws).toEqual({ id: 'ws-acme' });
|
|
expect(repo.findByHostname).toHaveBeenCalledWith('acme');
|
|
expect(repo.findFirst).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('cloud: returns null for a blank/missing host (no throw)', async () => {
|
|
const { env, repo } = build({ selfHosted: false, byHostname: { id: 'x' } });
|
|
expect(await resolveRequestWorkspace(env as any, repo as any, undefined)).toBeNull();
|
|
expect(await resolveRequestWorkspace(env as any, repo as any, '')).toBeNull();
|
|
expect(repo.findByHostname).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('cloud: returns null when the subdomain matches no workspace', async () => {
|
|
const { env, repo } = build({ selfHosted: false, byHostname: null });
|
|
expect(
|
|
await resolveRequestWorkspace(env as any, repo as any, 'ghost.example.com'),
|
|
).toBeNull();
|
|
});
|
|
});
|