,
+>(locales: Locales, entries: Entries) {
+ return Object.fromEntries(
+ locales.map((locale, index) => [
+ locale,
+ Object.fromEntries(Object.entries(entries).map(([id, messages]) => [id, messages[index]])),
+ ]),
+ ) as { [Locale in Locales[number]]: { [Id in keyof Entries]: string } };
+}
diff --git a/packages/everything-dev/src/ui/router-client.tsx b/packages/everything-dev/src/ui/router-client.tsx
index b52f08af..01932e0a 100644
--- a/packages/everything-dev/src/ui/router-client.tsx
+++ b/packages/everything-dev/src/ui/router-client.tsx
@@ -58,6 +58,7 @@ export function createRouter<
cspNonce: opts.context.cspNonce,
}),
session: opts.context.session,
+ locale: opts.context.locale,
},
...(cspNonce ? { ssr: { nonce: cspNonce } } : {}),
defaultPreload: "intent",
diff --git a/packages/everything-dev/src/ui/router-error.tsx b/packages/everything-dev/src/ui/router-error.tsx
index 81fdf84c..6e1d4371 100644
--- a/packages/everything-dev/src/ui/router-error.tsx
+++ b/packages/everything-dev/src/ui/router-error.tsx
@@ -4,7 +4,15 @@
* the app's UI kit, so primitives are plain markup + semantic tokens.
*/
-export function RouterError({ error, reset }: { error: Error; reset?: () => void }) {
+export function RouterError({
+ error,
+ reset,
+ messages,
+}: {
+ error: Error;
+ reset?: () => void;
+ messages?: { title: string; body: string; home: string; retry: string };
+}) {
return (
void
-
This page didn’t load
+
+ {messages?.title ?? "This page didn’t load"}
+
- Something went wrong on our side. Try again, or head back home.
+ {messages?.body ?? "Something went wrong on our side. Try again, or head back home."}
@@ -29,7 +39,7 @@ export function RouterError({ error, reset }: { error: Error; reset?: () => void
data-testid="router-error-home"
className="inline-flex h-9 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground"
>
- Back home
+ {messages?.home ?? "Back home"}
void
data-testid="router-error-retry"
className="inline-flex h-9 items-center justify-center rounded-md border border-border bg-background px-4 text-sm font-medium text-foreground"
>
- Try again
+ {messages?.retry ?? "Try again"}
diff --git a/packages/everything-dev/src/ui/router-server.tsx b/packages/everything-dev/src/ui/router-server.tsx
index f3891b37..96291f26 100644
--- a/packages/everything-dev/src/ui/router-server.tsx
+++ b/packages/everything-dev/src/ui/router-server.tsx
@@ -19,6 +19,7 @@ import {
} from "@tanstack/react-router/ssr/server";
import { createApiClient } from "./api";
import { createAuthClient } from "./auth";
+import { type LocaleOptions, readAcceptLanguage, resolveLocale } from "./locale";
import { collectHeadData } from "./router";
import {
defaultNotFoundComponent,
@@ -46,6 +47,8 @@ export interface ServerRouterModuleOptions QueryClient;
+ /** Locale negotiation for SSR — resolves the request-scoped locale into router context. */
+ locale?: LocaleOptions;
}
type ServerRouterOptions = CreateRouterOptions & {
@@ -86,6 +89,7 @@ export function createServerRouterModule
}),
session: context?.session,
cspNonce,
+ locale: context?.locale,
pluginNav: context?.pluginNav,
},
...(cspNonce ? { ssr: { nonce: cspNonce } } : {}),
@@ -146,6 +150,7 @@ export function createServerRouterModule
authClient:
context?.authClient ?? createAuthClient({ runtimeConfig, cspNonce: context?.cspNonce }),
session: context?.session,
+ locale: context?.locale,
},
});
@@ -181,6 +186,13 @@ export function createServerRouterModule
session: renderOptions.session,
cspNonce: renderOptions.cspNonce,
pluginNav: renderOptions.pluginNav,
+ locale: options.locale
+ ? resolveLocale({
+ ...options.locale,
+ cookie: request.headers.get("cookie") ?? "",
+ browserLocales: readAcceptLanguage(request.headers.get("accept-language")),
+ })
+ : undefined,
},
});
queryClientRef = built.queryClient ?? localQueryClient;
@@ -201,6 +213,8 @@ export function createServerRouterModule
}),
);
+ if (options.locale) response.headers.append("Vary", "Cookie, Accept-Language");
+
return {
stream: response.body!,
statusCode: response.status,
diff --git a/packages/everything-dev/src/ui/runtime.ts b/packages/everything-dev/src/ui/runtime.ts
index 49d8cd1e..095ef24f 100644
--- a/packages/everything-dev/src/ui/runtime.ts
+++ b/packages/everything-dev/src/ui/runtime.ts
@@ -29,6 +29,12 @@ export function getCspNonce() {
return window.__CSP_NONCE__;
}
+export function getAppName(config?: Partial): string {
+ const runtimeConfig =
+ config ?? (typeof window === "undefined" ? undefined : window.__RUNTIME_CONFIG__);
+ return runtimeConfig?.runtime?.title ?? runtimeConfig?.account ?? "";
+}
+
export function buildRuntimeHref(pathname: string, runtimeConfig?: Partial) {
const basePath = runtimeConfig?.runtime?.runtimeBasePath ?? "/";
if (basePath === "/") {
diff --git a/packages/everything-dev/src/ui/tenant.ts b/packages/everything-dev/src/ui/tenant.ts
index 836f4287..d2be4ba9 100644
--- a/packages/everything-dev/src/ui/tenant.ts
+++ b/packages/everything-dev/src/ui/tenant.ts
@@ -112,53 +112,69 @@ export interface TenantUiOverride {
export const INTEGRITY_PATTERN = /^sha384-[A-Za-z0-9+/=]+$/;
-const optionalUrl = z
- .string()
- .trim()
- .url("must be a valid URL")
- .or(z.literal(""))
- .transform((value) => value.trim());
-
-const optionalIntegrity = z
- .string()
- .trim()
- .regex(INTEGRITY_PATTERN, "must look like sha384-… (base64)")
- .or(z.literal(""));
-
-const optionalManifestName = z
- .string()
- .trim()
- .regex(/^versions\/[0-9a-f]{16}\.json$/, "must look like versions/.json")
- .or(z.literal(""));
-
-export const tenantConfigDraftSchema = z
- .object({
- title: z.string().trim().min(1, "title is required"),
- description: z.string().trim().min(1, "description is required"),
- repository: optionalUrl,
- uiProduction: optionalUrl,
- uiIntegrity: optionalIntegrity,
- uiManifest: optionalManifestName,
- uiPinIntegrity: optionalIntegrity,
- ssrUrl: optionalUrl,
- ssrIntegrity: optionalIntegrity,
- })
- .refine((draft) => !!draft.uiProduction === !!(draft.uiIntegrity || draft.uiManifest), {
- message: "a UI bundle needs both its URL and its integrity (direct hash or manifest pin)",
- path: ["uiIntegrity"],
- })
- .refine((draft) => !draft.uiIntegrity || !draft.uiManifest, {
- message: "choose one integrity mode — a direct entry hash or a version-manifest pin, not both",
- path: ["uiManifest"],
- })
- .refine((draft) => !!draft.uiManifest === !!draft.uiPinIntegrity, {
- message: "a version-manifest pin needs both the manifest filename and its integrity",
- path: ["uiPinIntegrity"],
- })
- .refine((draft) => !!draft.ssrUrl === !!draft.ssrIntegrity, {
- message: "an SSR bundle needs both its URL and its integrity hash",
- path: ["ssrIntegrity"],
- });
+export const defaultTenantConfigDraftMessages = {
+ url: "must be a valid URL",
+ integrity: "must look like sha384-… (base64)",
+ manifest: "must look like versions/.json",
+ title: "title is required",
+ description: "description is required",
+ uiPair: "a UI bundle needs both its URL and its integrity (direct hash or manifest pin)",
+ integrityMode:
+ "choose one integrity mode — a direct entry hash or a version-manifest pin, not both",
+ pinPair: "a version-manifest pin needs both the manifest filename and its integrity",
+ ssrPair: "an SSR bundle needs both its URL and its integrity hash",
+};
+
+export function createTenantConfigDraftSchema(
+ messages: Partial = {},
+) {
+ const copy = { ...defaultTenantConfigDraftMessages, ...messages };
+ const optionalUrl = z
+ .string()
+ .trim()
+ .url(copy.url)
+ .or(z.literal(""))
+ .transform((value) => value.trim());
+ const optionalIntegrity = z
+ .string()
+ .trim()
+ .regex(INTEGRITY_PATTERN, copy.integrity)
+ .or(z.literal(""));
+ const optionalManifestName = z
+ .string()
+ .trim()
+ .regex(/^versions\/[0-9a-f]{16}\.json$/, copy.manifest)
+ .or(z.literal(""));
+ return z
+ .object({
+ title: z.string().trim().min(1, copy.title),
+ description: z.string().trim().min(1, copy.description),
+ repository: optionalUrl,
+ uiProduction: optionalUrl,
+ uiIntegrity: optionalIntegrity,
+ uiManifest: optionalManifestName,
+ uiPinIntegrity: optionalIntegrity,
+ ssrUrl: optionalUrl,
+ ssrIntegrity: optionalIntegrity,
+ })
+ .refine((draft) => !!draft.uiProduction === !!(draft.uiIntegrity || draft.uiManifest), {
+ message: copy.uiPair,
+ path: ["uiIntegrity"],
+ })
+ .refine((draft) => !draft.uiIntegrity || !draft.uiManifest, {
+ message: copy.integrityMode,
+ path: ["uiManifest"],
+ })
+ .refine((draft) => !!draft.uiManifest === !!draft.uiPinIntegrity, {
+ message: copy.pinPair,
+ path: ["uiPinIntegrity"],
+ })
+ .refine((draft) => !!draft.ssrUrl === !!draft.ssrIntegrity, {
+ message: copy.ssrPair,
+ path: ["ssrIntegrity"],
+ });
+}
+export const tenantConfigDraftSchema = createTenantConfigDraftSchema();
export type TenantConfigDraft = z.infer;
diff --git a/packages/everything-dev/src/ui/types.ts b/packages/everything-dev/src/ui/types.ts
index 3623aca7..edebdff6 100644
--- a/packages/everything-dev/src/ui/types.ts
+++ b/packages/everything-dev/src/ui/types.ts
@@ -8,6 +8,7 @@ export interface RouterContext {
runtimeConfig?: Partial;
session?: TSession;
cspNonce?: string;
+ locale?: string;
/** nav manifest derived from composed routes' staticData.nav */
pluginNav?: NavManifest;
}
diff --git a/packages/everything-dev/src/utils/theme.ts b/packages/everything-dev/src/utils/theme.ts
index 7ccd6d4b..17370f34 100644
--- a/packages/everything-dev/src/utils/theme.ts
+++ b/packages/everything-dev/src/utils/theme.ts
@@ -11,7 +11,7 @@ const truecolorRamp =
const rgb = (code: string) => [1, 3, 5].map((i) => parseInt(code.slice(i, i + 2), 16));
const [r1, g1, b1] = rgb(from);
const [r2, g2, b2] = rgb(to);
- const chars = [...text];
+ const chars = Array.from(text);
const total = chars.filter((ch) => ch !== "\n").length;
let seen = 0;
return chars
diff --git a/packages/everything-dev/tests/integration/aborted-train.test.ts b/packages/everything-dev/tests/integration/aborted-train.test.ts
index 9ec96dd5..6dee3119 100644
--- a/packages/everything-dev/tests/integration/aborted-train.test.ts
+++ b/packages/everything-dev/tests/integration/aborted-train.test.ts
@@ -204,6 +204,16 @@ describe("an aborted deploy train is a no-op (ticket 05)", () => {
beforeEach(async () => {
storage = new MockStorage();
await storage.ready;
+ const originalFetch = globalThis.fetch.bind(globalThis);
+ vi.stubGlobal("fetch", (input: RequestInfo | URL, init?: RequestInit) => {
+ const inputUrl =
+ typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+ const url = new URL(inputUrl);
+ if (url.origin === "https://cdn.example.test") {
+ return originalFetch(new URL(`${url.pathname}${url.search}`, storage.origin), init);
+ }
+ return originalFetch(input, init);
+ });
configDir = mkdtempSync(join(tmpdir(), "bos-aborted-train-"));
savedEnv = {
BOS_BUNDLE_CDN_ORIGIN: process.env.BOS_BUNDLE_CDN_ORIGIN,
@@ -241,6 +251,7 @@ describe("an aborted deploy train is a no-op (ticket 05)", () => {
});
afterEach(() => {
+ vi.unstubAllGlobals();
storage.close();
rmSync(configDir, { recursive: true, force: true });
for (const [key, value] of Object.entries(savedEnv)) {
diff --git a/packages/everything-dev/tests/ui/api.test.ts b/packages/everything-dev/tests/ui/api.test.ts
index b55d11dc..9e418118 100644
--- a/packages/everything-dev/tests/ui/api.test.ts
+++ b/packages/everything-dev/tests/ui/api.test.ts
@@ -10,8 +10,11 @@ import {
const contextHolder = vi.hoisted(() => ({
context: {} as ClientRouterContext,
+ notifyError: vi.fn(),
}));
+vi.mock("sonner", () => ({ toast: { error: contextHolder.notifyError } }));
+
vi.mock("@tanstack/react-router", () => ({
useRouter: () => ({ options: { context: contextHolder.context } }),
}));
@@ -43,6 +46,7 @@ function pingClient(client: unknown) {
beforeEach(() => {
stubFetch();
+ contextHolder.notifyError.mockClear();
});
afterEach(() => {
@@ -82,6 +86,47 @@ describe("browser singleton", () => {
(globalThis as { window?: unknown }).window = originalWindow;
});
+ it("resolves connection notices when the request fails so language changes are respected", async () => {
+ vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new TypeError("Failed to fetch")));
+ let language = "es";
+ const connectionError = vi.fn(() => ({
+ title: language === "es" ? "Conexión no disponible" : "Connexion indisponible",
+ description: language === "es" ? "Inténtalo de nuevo." : "Réessayez.",
+ }));
+ const client = createApiClient({
+ hostUrl: "https://translated.test",
+ rpcBase: "/api/rpc",
+ connectionError,
+ });
+ expect(connectionError).not.toHaveBeenCalled();
+ await pingClient(client);
+ await vi.waitFor(() =>
+ expect(contextHolder.notifyError).toHaveBeenLastCalledWith("Conexión no disponible", {
+ id: "api-connection-error",
+ description: "Inténtalo de nuevo.",
+ }),
+ );
+ language = "fr";
+ await pingClient(client);
+ await vi.waitFor(() =>
+ expect(contextHolder.notifyError).toHaveBeenLastCalledWith("Connexion indisponible", {
+ id: "api-connection-error",
+ description: "Réessayez.",
+ }),
+ );
+ });
+
+ it("keeps the default connection notice for apps without a message resolver", async () => {
+ vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new TypeError("Failed to fetch")));
+ await pingClient(createApiClient({ hostUrl: "https://offline.test", rpcBase: "/api/rpc" }));
+ await vi.waitFor(() =>
+ expect(contextHolder.notifyError).toHaveBeenCalledWith("Unable to connect to API", {
+ id: "api-connection-error",
+ description: "The API is currently unavailable. Please try again later.",
+ }),
+ );
+ });
+
it("memoizes per endpoint", () => {
const first = createApiClient(cfg);
const second = createApiClient(cfg);
@@ -126,3 +171,35 @@ describe("context hooks", () => {
expect(usePluginClients()).toEqual({});
});
});
+
+describe("rate-limit retry", () => {
+ it("retries a 429 with backoff until the request succeeds", async () => {
+ let calls = 0;
+ globalThis.fetch = vi.fn(async () => {
+ calls += 1;
+ if (calls < 3) {
+ return new Response("{}", { status: 429, headers: { "retry-after": "0" } });
+ }
+ return new Response(JSON.stringify({ json: "pong" }), {
+ status: 200,
+ headers: { "content-type": "application/json" },
+ });
+ }) as unknown as typeof fetch;
+
+ const clients = createServiceClients(cfg, ["api"]);
+ await pingClient(clients.api);
+ expect(calls).toBe(3);
+ });
+
+ it("gives up after the retry budget and surfaces the 429", async () => {
+ let calls = 0;
+ globalThis.fetch = vi.fn(async () => {
+ calls += 1;
+ return new Response("{}", { status: 429, headers: { "retry-after": "0" } });
+ }) as unknown as typeof fetch;
+
+ const clients = createServiceClients(cfg, ["api"]);
+ await expect((clients.api as { ping(): Promise }).ping()).rejects.toThrow();
+ expect(calls).toBe(4);
+ });
+});
diff --git a/packages/everything-dev/tests/ui/auth-guards.test.ts b/packages/everything-dev/tests/ui/auth-guards.test.ts
index 581b08a1..5b2fd0db 100644
--- a/packages/everything-dev/tests/ui/auth-guards.test.ts
+++ b/packages/everything-dev/tests/ui/auth-guards.test.ts
@@ -25,7 +25,7 @@ const bannedSession = {
session: { id: "session-1", activeOrganizationId: null },
} as unknown as SessionData;
-function createAuthClientMock(responses: Array): AuthClient {
+function createAuthClientMock(responses: Array): AuthClient {
let call = 0;
return {
getSession: vi.fn(async () => {
@@ -41,7 +41,7 @@ function createContext(queryClient: QueryClient, authClient: AuthClient) {
queryClient,
authClient,
apiClient: {} as ApiClient,
- session: undefined as SessionData | null | undefined,
+ session: undefined as SessionData,
};
}
diff --git a/packages/everything-dev/tests/ui/hydrate.test.tsx b/packages/everything-dev/tests/ui/hydrate.test.tsx
index c1889b68..64698de1 100644
--- a/packages/everything-dev/tests/ui/hydrate.test.tsx
+++ b/packages/everything-dev/tests/ui/hydrate.test.tsx
@@ -8,6 +8,7 @@ const bootstrap = vi.hoisted(() => ({
createRouter: vi.fn(() => ({ router: {} })),
render: vi.fn(),
hydrateRoot: vi.fn(),
+ toastError: vi.fn(),
coreRouteConfig: {
routeConfigLoaders: {},
rootMeta: { head: () => ({ meta: [{ name: "core", content: "1" }] }) },
@@ -34,6 +35,8 @@ vi.mock("react-dom/client", () => ({
hydrateRoot: bootstrap.hydrateRoot,
}));
+vi.mock("sonner", () => ({ toast: { error: bootstrap.toastError } }));
+
const composeMocks = vi.hoisted(() => ({
loadRemote: vi.fn(),
registerRemotes: vi.fn(),
@@ -121,11 +124,30 @@ const runHydrate = async (config: Record) => {
};
describe("client bootstrap", () => {
+ it("forwards the SSR document language into the composed router context", async () => {
+ const previousLocale = document.documentElement.lang;
+ document.documentElement.lang = "fr";
+ document.documentElement.setAttribute("data-everything-ssr", "");
+ try {
+ await runHydrate(bootstrap.config);
+ expect(bootstrap.createRouter).toHaveBeenCalledWith(
+ expect.objectContaining({
+ context: expect.objectContaining({ locale: "fr" }),
+ }),
+ );
+ } finally {
+ document.documentElement.lang = previousLocale;
+ }
+ });
+
it("rejects missing config before loading the router and can retry", async () => {
bootstrap.config.hostUrl = "";
await expect(runHydrate(bootstrap.config)).rejects.toThrow("Missing hostUrl or rpcBase");
expect(bootstrap.routerLoads).toBe(0);
expect(bootstrap.createRouter).not.toHaveBeenCalled();
+ expect(
+ document.querySelector('[data-testid="application-startup-error"]')?.textContent,
+ ).toContain("Reload");
expect(window.__EVERYTHING_DEV_HYDRATE_PROMISE__).toBeUndefined();
bootstrap.config.hostUrl = "https://example.test";
@@ -333,6 +355,13 @@ describe("client bootstrap", () => {
// the page client-renders the degraded tree.
expect(bootstrap.hydrateRoot).not.toHaveBeenCalled();
expect(bootstrap.render).toHaveBeenCalledOnce();
+ expect(bootstrap.toastError).toHaveBeenCalledWith(
+ "Some application features couldn't load",
+ expect.objectContaining({
+ duration: Number.POSITIVE_INFINITY,
+ action: expect.objectContaining({ label: "Reload" }),
+ }),
+ );
});
it("drops only the failed remote and composes the healthy subset", async () => {
@@ -416,5 +445,6 @@ describe("client bootstrap", () => {
);
expect(bootstrap.hydrateRoot).not.toHaveBeenCalled();
expect(bootstrap.render).toHaveBeenCalledOnce();
+ expect(bootstrap.toastError).toHaveBeenCalledOnce();
});
});
diff --git a/packages/everything-dev/tests/ui/i18n-browser.test.tsx b/packages/everything-dev/tests/ui/i18n-browser.test.tsx
new file mode 100644
index 00000000..53115bef
--- /dev/null
+++ b/packages/everything-dev/tests/ui/i18n-browser.test.tsx
@@ -0,0 +1,112 @@
+// @vitest-environment jsdom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createLocaleRuntime, readLocaleCookie } from "../../src/ui/i18n";
+
+const locales = ["en", "es", "fr", "zh"] as const;
+let container: HTMLDivElement;
+let root: Root;
+let sequence = 0;
+beforeEach(() => {
+ vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
+ container = document.createElement("div");
+ document.body.append(container);
+ root = createRoot(container);
+});
+afterEach(async () => {
+ await act(async () => root.unmount());
+ container.remove();
+ vi.unstubAllGlobals();
+});
+
+describe("language persistence across browser bundles", () => {
+ it("shares account selection with the auth bundle, cookie, and document language", async () => {
+ const cookieName = `bundle_language_${sequence++}`;
+ const main = createLocaleRuntime({ locales, defaultLocale: "en", cookieName });
+ const auth = createLocaleRuntime({ locales, defaultLocale: "en", cookieName });
+ const save = vi.fn(async () => undefined);
+ let select: ReturnType["selectLocale"];
+ function AuthSettings() {
+ const language = auth.useLocale();
+ select = language.selectLocale;
+ return {language.locale} ;
+ }
+ await act(async () =>
+ root.render(
+ ({})}
+ initialLocale="es"
+ preferredLocale="fr"
+ onLocaleChange={save}
+ >
+ ({})}>
+
+ ,
+ ),
+ );
+ expect(container.textContent).toBe("fr");
+ expect(readLocaleCookie(document.cookie, cookieName)).toBe("fr");
+ await act(async () => select("zh"));
+ expect(save).toHaveBeenCalledExactlyOnceWith("zh");
+ expect(container.textContent).toBe("zh");
+ expect(main.getLocale()).toBe("zh");
+ expect(document.documentElement.lang).toBe("zh");
+ expect(readLocaleCookie(document.cookie, cookieName)).toBe("zh");
+ });
+
+ it("keeps the previous language and cookie when saving the account preference fails", async () => {
+ const cookieName = `failed_language_${sequence++}`;
+ const runtime = createLocaleRuntime({ locales, defaultLocale: "en", cookieName });
+ document.cookie = `${cookieName}=es; Path=/`;
+ let select: ReturnType["selectLocale"];
+ function Settings() {
+ const language = runtime.useLocale();
+ select = language.selectLocale;
+ return {language.locale} ;
+ }
+ await act(async () =>
+ root.render(
+ ({})}
+ onLocaleChange={async () => {
+ throw new Error("save failed");
+ }}
+ >
+ ,
+ ),
+ );
+ await act(async () => expect(select("fr")).rejects.toThrow("save failed"));
+ expect(container.textContent).toBe("es");
+ expect(readLocaleCookie(document.cookie, cookieName)).toBe("es");
+ });
+
+ it("keeps the last account language after signing out and remounting", async () => {
+ const cookieName = `signed_out_language_${sequence++}`;
+ const runtime = createLocaleRuntime({ locales, defaultLocale: "en", cookieName });
+ document.cookie = `${cookieName}=es; Path=/`;
+ function Settings() {
+ return {runtime.useLocale().locale} ;
+ }
+ await act(async () =>
+ root.render(
+ ({})} preferredLocale="fr">
+ ,
+ ),
+ );
+ await act(async () =>
+ root.render(
+ ({})}>
+ ,
+ ),
+ );
+ expect(container.textContent).toBe("fr");
+ expect(readLocaleCookie(document.cookie, cookieName)).toBe("fr");
+ const reloaded = createLocaleRuntime({ locales, defaultLocale: "en", cookieName });
+ expect(reloaded.detectLocale()).toBe("fr");
+ });
+});
diff --git a/packages/everything-dev/tests/ui/i18n.test.ts b/packages/everything-dev/tests/ui/i18n.test.ts
index 0b4cfeaf..11e6621d 100644
--- a/packages/everything-dev/tests/ui/i18n.test.ts
+++ b/packages/everything-dev/tests/ui/i18n.test.ts
@@ -4,6 +4,7 @@ import { describe, expect, it } from "vitest";
import {
createLocaleRuntime,
matchLocale,
+ readAcceptLanguage,
readLocaleCookie,
resolveLocale,
serializeLocaleCookie,
@@ -18,24 +19,33 @@ function resolve(overrides: Partial[0]> = {}) {
browserLocales: [],
locales,
defaultLocale: "en",
- cookieName: "app_locale",
+ cookieName: "citynode_locale",
...overrides,
});
}
describe("shared locale resolution", () => {
+ it("honors quality preferences and excludes rejected header languages", () => {
+ expect(readAcceptLanguage("de;q=0, fr-CA;q=0.7, es;q=0.9, en;q=invalid")).toEqual([
+ "es",
+ "fr-CA",
+ ]);
+ expect(resolve({ browserLocales: readAcceptLanguage("fr-CA, es;q=0.8") })).toBe("fr");
+ });
it("uses account preference before cookie and browser language", () => {
expect(
resolve({
preferredLocale: "zh-CN",
- cookie: "app_locale=fr",
+ cookie: "citynode_locale=fr",
browserLocales: ["es-MX"],
}),
).toBe("zh");
});
it("uses a persisted locale before browser language", () => {
- expect(resolve({ cookie: "theme=dark; app_locale=fr", browserLocales: ["es-MX"] })).toBe("fr");
+ expect(resolve({ cookie: "theme=dark; citynode_locale=fr", browserLocales: ["es-MX"] })).toBe(
+ "fr",
+ );
});
it("matches the first supported browser language", () => {
@@ -43,8 +53,8 @@ describe("shared locale resolution", () => {
});
it("falls back to English for unsupported or malformed preferences", () => {
- expect(resolve({ cookie: "app_locale=invalid", browserLocales: ["de-DE"] })).toBe("en");
- expect(resolve({ cookie: "app_locale=%E0%A4%A", browserLocales: [] })).toBe("en");
+ expect(resolve({ cookie: "citynode_locale=invalid", browserLocales: ["de-DE"] })).toBe("en");
+ expect(resolve({ cookie: "citynode_locale=%E0%A4%A", browserLocales: [] })).toBe("en");
});
});
@@ -55,15 +65,61 @@ describe("shared locale persistence", () => {
});
it("reads and serializes the locale cookie", () => {
- expect(readLocaleCookie("theme=dark; app_locale=zh", "app_locale")).toBe("zh");
- expect(serializeLocaleCookie("app_locale", "es", false)).toBe(
- "app_locale=es; Path=/; Max-Age=31536000; SameSite=Lax",
+ expect(readLocaleCookie("theme=dark; citynode_locale=zh", "citynode_locale")).toBe("zh");
+ expect(serializeLocaleCookie("citynode_locale", "es", false)).toBe(
+ "citynode_locale=es; Path=/; Max-Age=31536000; SameSite=Lax",
);
- expect(serializeLocaleCookie("app_locale", "es", true)).toContain("; Secure");
+ expect(serializeLocaleCookie("citynode_locale", "es", true)).toContain("; Secure");
});
});
describe("shared locale provider", () => {
+ it("renders the request locale and account preference without leaking between requests", () => {
+ const runtime = createLocaleRuntime({
+ locales,
+ defaultLocale: "en",
+ cookieName: "server_locale",
+ });
+ function Greeting() {
+ const t = runtime.useTranslation<"greeting">();
+ return createElement("span", null, t("greeting"));
+ }
+ const messages = (locale: string) => ({
+ greeting: locale === "fr" ? "Bonjour" : locale === "es" ? "Hola" : "Hello",
+ });
+ const render = (initialLocale: string, preferredLocale?: string) =>
+ renderToString(
+ createElement(
+ runtime.LocaleProvider,
+ { messages, initialLocale, preferredLocale },
+ createElement(Greeting),
+ ),
+ );
+ expect(render("fr")).toContain("Bonjour");
+ expect(render("fr", "es")).toContain("Hola");
+ expect(render("en")).toContain("Hello");
+ });
+
+ it("shares the server locale across separately configured bundle providers", () => {
+ const main = createLocaleRuntime({ locales, defaultLocale: "en", cookieName: "bundle_locale" });
+ const auth = createLocaleRuntime({ locales, defaultLocale: "en", cookieName: "bundle_locale" });
+ function AuthGreeting() {
+ const t = auth.useTranslation<"greeting">();
+ return createElement("span", null, t("greeting"));
+ }
+ const html = renderToString(
+ createElement(
+ main.LocaleProvider,
+ { initialLocale: "fr", messages: () => ({}) },
+ createElement(
+ auth.LocaleProvider,
+ { messages: (locale) => ({ greeting: locale === "fr" ? "Bonjour" : "Hello" }) },
+ createElement(AuthGreeting),
+ ),
+ ),
+ );
+ expect(html).toContain("Bonjour");
+ });
it("renders when the server runtime exposes navigator without language preferences", () => {
const navigatorDescriptor = Object.getOwnPropertyDescriptor(globalThis, "navigator");
Object.defineProperty(globalThis, "navigator", { configurable: true, value: {} });
@@ -72,7 +128,7 @@ describe("shared locale provider", () => {
const runtime = createLocaleRuntime({
locales,
defaultLocale: "en",
- cookieName: "app_locale",
+ cookieName: "citynode_locale",
});
const html = renderToString(
createElement(
diff --git a/packages/everything-dev/tests/ui/router-locale.test.tsx b/packages/everything-dev/tests/ui/router-locale.test.tsx
new file mode 100644
index 00000000..ff9cf3ef
--- /dev/null
+++ b/packages/everything-dev/tests/ui/router-locale.test.tsx
@@ -0,0 +1,64 @@
+import { createRootRouteWithContext, createRoute, Outlet } from "@tanstack/react-router";
+import { describe, expect, it } from "vitest";
+import { createServerRouterModule } from "../../src/ui/router-server";
+import type { RenderOptionsWithApi, RouterContextWithApi } from "../../src/ui/types";
+
+const root = createRootRouteWithContext()({
+ component: function Document() {
+ const { locale } = root.useRouteContext();
+ return (
+
+
+
+ Home });
+const about = createRoute({
+ getParentRoute: () => root,
+ path: "/about",
+ component: () => About ,
+});
+const module = createServerRouterModule({
+ defaultRouteTree: root.addChildren([home, about]),
+ locale: { locales: ["en", "es", "fr", "zh"], defaultLocale: "en", cookieName: "citynode_locale" },
+});
+const options = {
+ runtimeConfig: {
+ hostUrl: "http://localhost",
+ rpcBase: "/api",
+ authBase: "/api/auth",
+ networkId: "mainnet",
+ auth: { variables: { siwn: { recipient: "app.near" } } },
+ },
+ session: null,
+} as RenderOptionsWithApi;
+
+async function render(path: string, headers: HeadersInit) {
+ const result = await module.renderToStream(
+ new Request(`http://localhost${path}`, { headers }),
+ options,
+ );
+ expect(result.headers.get("Vary")).toContain("Cookie");
+ expect(result.headers.get("Vary")).toContain("Accept-Language");
+ return new Response(result.stream).text();
+}
+
+describe("request-scoped SSR locale", () => {
+ it("renders the requested route and cookie language independently for concurrent requests", async () => {
+ const [french, spanish, chinese] = await Promise.all([
+ render("/about", { cookie: "citynode_locale=fr", "accept-language": "es" }),
+ render("/", { "accept-language": "es-MX, en;q=0.5" }),
+ render("/about", { cookie: "citynode_locale=zh" }),
+ ]);
+ expect(french).toContain(' {
+ it("does not cache a transient failure as a signed-out session and recovers on retry", async () => {
+ const session = { user: { id: "member" }, session: { activeOrganizationId: "org" } };
+ const getSession = vi
+ .fn()
+ .mockResolvedValueOnce({ data: null, error: { message: "Auth temporarily unavailable" } })
+ .mockResolvedValueOnce({ data: session, error: null });
+ const auth = { getSession } as unknown as AuthClient;
+ const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+ await expect(client.fetchQuery(sessionQueryOptions(auth))).rejects.toThrow(
+ "Auth temporarily unavailable",
+ );
+ expect(client.getQueryData(sessionQueryKey)).toBeUndefined();
+ await client.fetchQuery(sessionQueryOptions(auth));
+ expect(client.getQueryData(sessionQueryKey)).toEqual(session);
+ client.clear();
+ });
+
+ it("preserves the current organization when a background session read fails", async () => {
+ const session = { user: { id: "member" }, session: { activeOrganizationId: "org" } };
+ const auth = {
+ getSession: async () => ({ data: null, error: { message: "Network failure" } }),
+ } as unknown as AuthClient;
+ const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+ client.setQueryData(sessionQueryKey, session);
+ await expect(client.fetchQuery({ ...sessionQueryOptions(auth), staleTime: 0 })).rejects.toThrow(
+ "Network failure",
+ );
+ expect(client.getQueryData(sessionQueryKey)).toEqual(session);
+ client.clear();
+ });
+});
diff --git a/packages/everything-dev/tests/ui/tenant.test.ts b/packages/everything-dev/tests/ui/tenant.test.ts
index 66584bcd..a8767425 100644
--- a/packages/everything-dev/tests/ui/tenant.test.ts
+++ b/packages/everything-dev/tests/ui/tenant.test.ts
@@ -6,6 +6,7 @@ import {
computeSsrEntryIntegrity,
computeSubresourceIntegrity,
computeUiEntryIntegrity,
+ createTenantConfigDraftSchema,
diffDraft,
draftUiOverride,
emptyTenantConfigDraft,
@@ -160,6 +161,40 @@ describe("gatewayForAccount", () => {
});
describe("tenantConfigDraftSchema", () => {
+ it("uses localized pin validation while preserving bundle constraints", () => {
+ const schema = createTenantConfigDraftSchema({
+ manifest: "Formato de manifiesto no válido",
+ pinPair: "Falta la integridad del manifiesto",
+ integrityMode: "Elige un modo de integridad",
+ });
+ const draft = {
+ ...emptyTenantConfigDraft,
+ title: "Chicago",
+ description: "Chicago",
+ uiProduction: "https://cdn.example.com/ui",
+ uiManifest: "versions/8f3ac1d2feedbeef.json",
+ };
+ const pin = schema.safeParse(draft);
+ expect(pin.error?.issues).toContainEqual(
+ expect.objectContaining({
+ path: ["uiPinIntegrity"],
+ message: "Falta la integridad del manifiesto",
+ }),
+ );
+ const malformed = schema.safeParse({ ...draft, uiManifest: "versions/invalid.json" });
+ expect(malformed.error?.issues).toContainEqual(
+ expect.objectContaining({ path: ["uiManifest"], message: "Formato de manifiesto no válido" }),
+ );
+ const mixed = schema.safeParse({
+ ...draft,
+ uiPinIntegrity: "sha384-pin",
+ uiIntegrity: "sha384-direct",
+ });
+ expect(mixed.error?.issues).toContainEqual(
+ expect.objectContaining({ path: ["uiManifest"], message: "Elige un modo de integridad" }),
+ );
+ });
+
it("accepts a metadata-only draft", () => {
const result = tenantConfigDraftSchema.safeParse({
...emptyTenantConfigDraft,
@@ -431,7 +466,7 @@ describe("integrity preflight", () => {
const stubBundle = (content: string) => {
const fetchMock = vi.fn(async (input: RequestInfo | URL) => {
- const url = String(input);
+ const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
if (url.includes("remoteEntry.server.js")) return new Response(`${content}-server`);
return new Response(content);
});
@@ -473,7 +508,7 @@ describe("integrity preflight", () => {
it("verifies a pinned slot by SRI-comparing the manifest document", async () => {
const manifestBody = JSON.stringify({ entry: "remoteEntry.aaa.js" });
const fetchMock = vi.fn(async (input: RequestInfo | URL) => {
- const url = String(input);
+ const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
if (url.endsWith("versions/8f3ac1d2feedbeef.json")) {
return new Response(manifestBody);
}
@@ -502,7 +537,7 @@ describe("integrity preflight", () => {
it("rejects the html landing page a bare base url serves", async () => {
const fetchMock = vi.fn(async (input: RequestInfo | URL) => {
- const url = String(input);
+ const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
if (url === "https://cdn.example.com/ui/remoteEntry.js")
return new Response("console.log('hi')");
return new Response("landing page");
diff --git a/packages/everything-dev/tests/unit/auth-login.test.ts b/packages/everything-dev/tests/unit/auth-login.test.ts
index 2b6dc338..b14b6fc0 100644
--- a/packages/everything-dev/tests/unit/auth-login.test.ts
+++ b/packages/everything-dev/tests/unit/auth-login.test.ts
@@ -108,17 +108,21 @@ describe("device login client", () => {
expect(approval.accountId).toBe("alice.near");
const claim = calls.find((call) => call.url.includes("/device-link/claim"));
- expect(JSON.parse(String(claim?.init.body ?? "{}"))).toMatchObject({
- token: "session-token-1",
- client_id: "bos-cli",
- });
+ expect(JSON.parse((await new Response(claim?.init.body ?? null).text()) || "{}")).toMatchObject(
+ {
+ token: "session-token-1",
+ client_id: "bos-cli",
+ },
+ );
const keyCreate = calls.find((call) => call.url.includes("/api-key/create"));
const keyHeaders = new Headers(keyCreate?.init.headers);
expect(keyHeaders.get("cookie")).toBe(CLAIMED_COOKIE);
expect(keyHeaders.get("origin")).toBe(SITE);
- const keyBody = JSON.parse(String(keyCreate?.init.body ?? "{}")) as {
+ const keyBody = JSON.parse(
+ (await new Response(keyCreate?.init.body ?? null).text()) || "{}",
+ ) as {
configId: string;
name: string;
expiresIn: number;
diff --git a/packages/everything-dev/tests/unit/config-resolved.test.ts b/packages/everything-dev/tests/unit/config-resolved.test.ts
index eae92e79..434ba496 100644
--- a/packages/everything-dev/tests/unit/config-resolved.test.ts
+++ b/packages/everything-dev/tests/unit/config-resolved.test.ts
@@ -13,6 +13,7 @@ import {
writeResolvedConfig,
} from "../../src/config";
import { openResolution } from "../../src/resolution/session";
+import { BosConfigInputSchema } from "../../src/types";
vi.mock("../../src/version-manifest-resolve", () => ({
resolveSlotVersion: vi.fn(async () => ({
@@ -55,6 +56,16 @@ vi.mock("../../src/http-client", async (importOriginal) => {
};
});
+describe("authored staging configuration", () => {
+ it("preserves the staging account used by the key publication prompt", () => {
+ const parsed = BosConfigInputSchema.parse({
+ account: "production.near",
+ staging: { domain: "staging.example.test", account: "staging.near" },
+ });
+ expect(parsed.staging).toEqual({ domain: "staging.example.test", account: "staging.near" });
+ });
+});
+
describe("findConfigPath cache", () => {
afterEach(() => {
resetConfigPathCache();
diff --git a/packages/everything-dev/tests/unit/db-run-migrations.test.ts b/packages/everything-dev/tests/unit/db-run-migrations.test.ts
index 8cbf9800..b9e96cfb 100644
--- a/packages/everything-dev/tests/unit/db-run-migrations.test.ts
+++ b/packages/everything-dev/tests/unit/db-run-migrations.test.ts
@@ -1,7 +1,7 @@
import { PGlite } from "@electric-sql/pglite";
import { sql } from "drizzle-orm";
import { drizzle } from "drizzle-orm/pglite";
-import { Effect } from "effect";
+import { Cause, Effect, Exit } from "effect";
import { describe, expect, it } from "vitest";
import { migrate as apiMigrate } from "../../../../api/src/db/migrate";
import { migrate as proposalsMigrate } from "../../../../plugins/proposals/src/db/migrate";
@@ -23,6 +23,8 @@ type Runner = (
schemaName?: string,
) => Effect.Effect;
+const apiMigrationRunner: Runner = apiMigrate;
+
function migration(idx: number, tag: string, statements: string[]): Migration {
return {
idx,
@@ -40,6 +42,17 @@ function makeDb() {
const JOURNAL = { schema: "drizzle", table: "__drizzle_migrations", slug: "test" } as const;
+async function runMigration(effect: Effect.Effect): Promise {
+ const exit = await Effect.runPromiseExit(effect);
+ if (Exit.isSuccess(exit)) return exit.value;
+ throw Cause.squash(exit.cause);
+}
+
+function runApiMigration(db: MigrationDatabase, migrations: Migration[]): Promise {
+ const effect = apiMigrationRunner(db, migrations, JOURNAL);
+ return runMigration(effect);
+}
+
describe("db migration runners (008 characterization)", () => {
it("fresh schema: sequential migrations apply, journal tracks hashes, rerun is a no-op", async () => {
const db = makeDb();
@@ -51,10 +64,10 @@ describe("db migration runners (008 characterization)", () => {
]),
];
- const applied = await Effect.runPromise(apiMigrate(db as never, migrations, JOURNAL) as never);
+ const applied = await runApiMigration(db as unknown as MigrationDatabase, migrations);
expect(applied).toBe(2);
- const rerun = await Effect.runPromise(apiMigrate(db as never, migrations, JOURNAL) as never);
+ const rerun = await runApiMigration(db as unknown as MigrationDatabase, migrations);
expect(rerun).toBe(0);
const rows = (await db.execute(
@@ -76,7 +89,7 @@ describe("db migration runners (008 characterization)", () => {
]),
];
- const applied = await Effect.runPromise(runner(db, migrations, JOURNAL));
+ const applied = await runMigration(runner(db, migrations, JOURNAL));
expect(applied).toBe(1);
const exists = (await db.execute(
@@ -95,7 +108,7 @@ describe("db migration runners (008 characterization)", () => {
migration(1, "fresh", ['CREATE TABLE "t_fresh" (id int)']),
];
- const applied = await Effect.runPromise(apiMigrate(db as never, migrations, JOURNAL) as never);
+ const applied = await runApiMigration(db as unknown as MigrationDatabase, migrations);
expect(applied).toBe(2);
const journal = (await db.execute(
diff --git a/packages/everything-dev/tests/unit/docker-autostart.test.ts b/packages/everything-dev/tests/unit/docker-autostart.test.ts
index 9a82ca7e..eec6e09b 100644
--- a/packages/everything-dev/tests/unit/docker-autostart.test.ts
+++ b/packages/everything-dev/tests/unit/docker-autostart.test.ts
@@ -1,7 +1,29 @@
-import { describe, expect, it } from "vitest";
-import { isDockerTestMode, shouldAutoStartDocker, takeTail } from "../../src/infra/docker";
+import { describe, expect, it, vi } from "vitest";
+import {
+ isDockerTestMode,
+ runDockerComposeUp,
+ shouldAutoStartDocker,
+ takeTail,
+} from "../../src/infra/docker";
import type { PreflightFailure } from "../../src/infra/preflight";
+const command = vi.hoisted(() => vi.fn());
+vi.mock("execa", () => ({ execa: command }));
+
+describe("runDockerComposeUp", () => {
+ it("preserves line boundaries and failure diagnostics from both output streams", async () => {
+ command.mockResolvedValue({
+ exitCode: 1,
+ stdout: "Starting database\n",
+ stderr: "\u001b[31mDatabase failed\u001b[0m\nCheck credentials\n",
+ });
+ expect(await runDockerComposeUp("/test/project")).toEqual({
+ ok: false,
+ tail: "Starting database\nDatabase failed\nCheck credentials",
+ });
+ });
+});
+
const unreachable = (secret: string): PreflightFailure => ({
secret,
host: "localhost",
diff --git a/packages/everything-dev/tests/unit/process-kill.test.ts b/packages/everything-dev/tests/unit/process-kill.test.ts
index bd832a5b..e9d65404 100644
--- a/packages/everything-dev/tests/unit/process-kill.test.ts
+++ b/packages/everything-dev/tests/unit/process-kill.test.ts
@@ -13,7 +13,12 @@ import { killProcessGroupEscalating, reapGroup } from "../../src/process-kill";
import { isPidAlive } from "../../src/process-registry";
let tempDir = mkdtempSync(join(tmpdir(), "process-kill-"));
-const cleanup: string[] = [];
+const cleanup: number[] = [];
+
+function processGroupId(pid: number | undefined): number {
+ if (pid === undefined) throw new Error("Child process did not expose a pid");
+ return -pid;
+}
const fakeLsof = (script: string): string => {
const path = join(tempDir, `lsof-${Math.random().toString(36).slice(2)}`);
@@ -23,7 +28,7 @@ const fakeLsof = (script: string): string => {
const spawnSleeper = (): { pid: number; wait: Promise } => {
const child = spawn("sleep", ["300"], { detached: true, stdio: "ignore" });
- cleanup.push(-child.pid);
+ cleanup.push(processGroupId(child.pid));
return {
pid: child.pid,
wait: new Promise((resolve) => child.once("exit", resolve)),
@@ -119,7 +124,7 @@ describe("process-kill escalation", () => {
const path = join(tempDir, `parent-${Date.now()}.sh`);
writeFileSync(path, script, { mode: 0o755 });
const parent = spawn(path, { detached: true, stdio: "ignore" });
- cleanup.push(-parent.pid);
+ cleanup.push(processGroupId(parent.pid));
await new Promise((resolve) => setTimeout(resolve, 300));
const members = await groupMembersOf(parent.pid);
expect(members.length).toBeGreaterThanOrEqual(2);
@@ -155,7 +160,7 @@ function spawnSleeperWithSigtermIgnored(): { pid: number; wait: Promise }
const path = join(tempDir, `sleeper-${Date.now()}.sh`);
writeFileSync(path, script, { mode: 0o755 });
const child = spawn(path, { detached: true, stdio: "ignore" });
- cleanup.push(-child.pid);
+ cleanup.push(processGroupId(child.pid));
return {
pid: child.pid,
wait: new Promise((resolve) => child.once("exit", resolve)),
diff --git a/packages/everything-dev/tests/unit/publish-pin-verification.test.ts b/packages/everything-dev/tests/unit/publish-pin-verification.test.ts
new file mode 100644
index 00000000..ac501a4f
--- /dev/null
+++ b/packages/everything-dev/tests/unit/publish-pin-verification.test.ts
@@ -0,0 +1,159 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { BosConfig } from "../../src/types";
+
+const {
+ verifyRollbackSnapshotMock,
+ fetchBosConfigFromFastKvMock,
+ resolveSigningStrategyMock,
+ submitRegistryWriteMock,
+ openResolutionMock,
+ buildWorkspaceTargetsMock,
+} = vi.hoisted(() => ({
+ verifyRollbackSnapshotMock: vi.fn(),
+ fetchBosConfigFromFastKvMock: vi.fn(),
+ resolveSigningStrategyMock: vi.fn(),
+ submitRegistryWriteMock: vi.fn(),
+ openResolutionMock: vi.fn(),
+ buildWorkspaceTargetsMock: vi.fn(),
+}));
+
+vi.mock("../../src/rollback", () => ({
+ verifyRollbackSnapshot: verifyRollbackSnapshotMock,
+}));
+
+vi.mock("../../src/fastkv", async (importOriginal) => {
+ const actual = await importOriginal();
+ return { ...actual, fetchBosConfigFromFastKv: fetchBosConfigFromFastKvMock };
+});
+
+vi.mock("../../src/near-signer", async (importOriginal) => {
+ const actual = await importOriginal();
+ return {
+ ...actual,
+ resolveSigningStrategy: resolveSigningStrategyMock,
+ submitRegistryWrite: submitRegistryWriteMock,
+ };
+});
+
+vi.mock("../../src/resolution/session", () => ({
+ openResolution: openResolutionMock,
+}));
+
+vi.mock("../../src/build", async (importOriginal) => {
+ const actual = await importOriginal();
+ return { ...actual, buildWorkspaceTargets: buildWorkspaceTargetsMock };
+});
+
+import { publishToFastKv } from "../../src/publish";
+
+const bosConfig = {
+ account: "dev.everything.near",
+ domain: "dev.everything.dev",
+ cdn: { origin: "https://cdn.example.test" },
+ app: {
+ host: {
+ development: "local:host",
+ production: "https://host.example",
+ pin: { manifest: "versions/aaaaaaaaaaaaaaaa.json", integrity: "sha384-host" },
+ },
+ ui: { development: "local:ui", production: "https://ui.example" },
+ api: { development: "local:api", production: "https://api.example" },
+ },
+ plugins: {
+ votes: {
+ development: "local:plugins/votes",
+ production: "https://votes.example",
+ },
+ },
+} as BosConfig;
+
+const baseInput = {
+ bosConfig,
+ runtimeConfig: null,
+ env: "production" as const,
+ build: false,
+ dryRun: false,
+ verbose: false,
+ packages: "",
+ privateKey: "ed25519:0000000000000000000000000000000000000000000000000000000000000000",
+};
+
+let configDir: string;
+
+describe("publishToFastKv pin verification gate", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ configDir = mkdtempSync(join(tmpdir(), "bos-pin-verify-"));
+ writeFileSync(join(configDir, "bos.config.json"), JSON.stringify(bosConfig, null, 2));
+ buildWorkspaceTargetsMock.mockResolvedValue({ built: [], skipped: [], deployResults: [] });
+ openResolutionMock.mockResolvedValue({ config: bosConfig, rawConfig: bosConfig });
+ fetchBosConfigFromFastKvMock.mockResolvedValue(JSON.parse(JSON.stringify(bosConfig)));
+ resolveSigningStrategyMock.mockResolvedValue({
+ strategy: "near-kit",
+ privateKey: "ed25519:test",
+ source: "provided",
+ });
+ });
+
+ afterEach(() => {
+ rmSync(configDir, { recursive: true, force: true });
+ vi.restoreAllMocks();
+ });
+
+ it("blocks the publish when a pinned slot's bytes fail verification", async () => {
+ verifyRollbackSnapshotMock.mockResolvedValue({
+ verifiable: true,
+ ok: false,
+ slots: [
+ {
+ slot: "plugins.registry",
+ manifest: "versions/309a65a9735d13e7.json",
+ ok: false,
+ reason: "manifest fetch failed: 404",
+ },
+ ],
+ });
+
+ const result = await publishToFastKv({ ...baseInput, configDir });
+
+ expect(result.status).toBe("error");
+ expect(result.error).toContain("Publish blocked");
+ expect(result.error).toContain("plugins.registry");
+ expect(result.error).toContain("manifest fetch failed: 404");
+ expect(verifyRollbackSnapshotMock).toHaveBeenCalledWith(
+ expect.objectContaining({ account: "dev.everything.near" }),
+ );
+ expect(submitRegistryWriteMock).not.toHaveBeenCalled();
+ });
+
+ it("publishes when every pinned slot verifies", async () => {
+ verifyRollbackSnapshotMock.mockResolvedValue({
+ verifiable: true,
+ ok: true,
+ slots: [
+ {
+ slot: "app.host",
+ manifest: "versions/aaaaaaaaaaaaaaaa.json",
+ ok: true,
+ },
+ ],
+ });
+
+ const result = await publishToFastKv({ ...baseInput, configDir });
+
+ expect(result.status).toBe("published");
+ expect(submitRegistryWriteMock).not.toHaveBeenCalled();
+ });
+
+ it("a config with no pins skips the gate", async () => {
+ verifyRollbackSnapshotMock.mockResolvedValue({ verifiable: false, ok: false, slots: [] });
+
+ const result = await publishToFastKv({ ...baseInput, configDir });
+
+ expect(result.status).toBe("published");
+ expect(submitRegistryWriteMock).not.toHaveBeenCalled();
+ });
+});
diff --git a/packages/everything-dev/tests/unit/resolution-session.test.ts b/packages/everything-dev/tests/unit/resolution-session.test.ts
index 91173df2..5b8551e6 100644
--- a/packages/everything-dev/tests/unit/resolution-session.test.ts
+++ b/packages/everything-dev/tests/unit/resolution-session.test.ts
@@ -200,7 +200,7 @@ describe("openResolution", () => {
production: "https://stage.test/host",
pin: {
manifest: `versions/${hostEntry}.json`,
- integrity: `sha384-${await createHash("sha384").update(JSON.stringify(hostManifest)).digest("base64")}`,
+ integrity: `sha384-${createHash("sha384").update(JSON.stringify(hostManifest)).digest("base64")}`,
},
},
},
diff --git a/packages/everything-dev/tests/unit/storage-upload.test.ts b/packages/everything-dev/tests/unit/storage-upload.test.ts
index e1959188..b5f7655c 100644
--- a/packages/everything-dev/tests/unit/storage-upload.test.ts
+++ b/packages/everything-dev/tests/unit/storage-upload.test.ts
@@ -64,7 +64,7 @@ describe("uploadBundle", () => {
const headers = new Headers(captured!.init.headers);
expect(headers.get("x-api-key")).toBe("edk_test");
expect(headers.get("content-type")).toBe("application/json");
- const body = JSON.parse(String(captured!.init.body));
+ const body = JSON.parse(await new Response(captured!.init.body).text());
expect(body.account).toBe("v1.citynode.near");
expect(body.files[0].contentBase64).toBe(Buffer.from("entry").toString("base64"));
expect(result.integrity["remoteEntry.js"]).toBe("sha384-abc");
@@ -219,7 +219,7 @@ describe("uploadWorkspaceDist", () => {
it("batches files across requests under the per-request ceiling and merges integrity", async () => {
const calls: number[][] = [];
globalThis.fetch = (async (_url: string | URL, init?: RequestInit) => {
- const body = JSON.parse(String(init!.body));
+ const body = JSON.parse(await new Response(init!.body).text());
calls.push(body.files.map((f: { path: string }) => f.path.length));
return new Response(
JSON.stringify({
diff --git a/tests/regression/http/security_headers_test.go b/tests/regression/http/security_headers_test.go
index 651c385c..d05fba5f 100644
--- a/tests/regression/http/security_headers_test.go
+++ b/tests/regression/http/security_headers_test.go
@@ -118,46 +118,58 @@ func TestRateLimiting(t *testing.T) {
time.Sleep(1200 * time.Millisecond)
// Fire 150 requests concurrently so they all land inside a single 1000ms
- // sliding window. The regression env sets RATE_LIMIT_MAX=100, so the burst
- // must trip it. 150 > 100 guarantees at least one 429.
+ // window. The regression env pins RATE_LIMIT_WINDOW_MS=1000 and
+ // RATE_LIMIT_MAX=100.
const workers = 10
const perWorker = 15
- var (
- mu sync.Mutex
- got200, got429 bool
- lastRateLimitBody string
- wg sync.WaitGroup
- )
-
- // Use a plain client (no cookie jar) per worker; http.Client is safe for
- // concurrent use but jars are not.
- for w := 0; w < workers; w++ {
- wg.Add(1)
- go func() {
- defer wg.Done()
- plain := &http.Client{}
- for i := 0; i < perWorker; i++ {
- resp, err := plain.Get(baseURL + "/health")
- if err != nil {
- continue
+ // burst fires `path` concurrently with plain (no cookie jar) clients and
+ // records which statuses were observed.
+ burst := func(path string) (got200, got429 bool, lastRateLimitBody string) {
+ var (
+ mu sync.Mutex
+ wg sync.WaitGroup
+ )
+ for w := 0; w < workers; w++ {
+ wg.Add(1)
+ go func() {
+ defer wg.Done()
+ plain := &http.Client{}
+ for i := 0; i < perWorker; i++ {
+ resp, err := plain.Get(baseURL + path)
+ if err != nil {
+ continue
+ }
+ b, _ := io.ReadAll(resp.Body)
+ resp.Body.Close()
+ mu.Lock()
+ if resp.StatusCode == 200 {
+ got200 = true
+ }
+ if resp.StatusCode == 429 {
+ got429 = true
+ lastRateLimitBody = string(b)
+ }
+ mu.Unlock()
}
- b, _ := io.ReadAll(resp.Body)
- resp.Body.Close()
- mu.Lock()
- if resp.StatusCode == 200 {
- got200 = true
- }
- if resp.StatusCode == 429 {
- got429 = true
- lastRateLimitBody = string(b)
- }
- mu.Unlock()
- }
- }()
+ }()
+ }
+ wg.Wait()
+ return got200, got429, lastRateLimitBody
}
- wg.Wait()
+ // Health probes are exempt from the limiter — the burst must never trip
+ // it, no matter how large (Kubernetes probes share the client budget).
+ probe200, probe429, _ := burst("/health")
+ if !probe200 {
+ t.Fatal("expected health probes to answer 200")
+ }
+ if probe429 {
+ t.Fatal("health probes must be exempt from the rate limit")
+ }
+
+ // A regular API endpoint is limited: 150 > 100 guarantees at least one 429.
+ got200, got429, lastRateLimitBody := burst("/api/ping")
if !got200 {
t.Fatal("expected at least one 200 in the burst before the rate limit applies")
}
@@ -170,6 +182,6 @@ func TestRateLimiting(t *testing.T) {
// After the sliding window passes the server must recover.
time.Sleep(1200 * time.Millisecond)
- status, _, body := regtest.GetRaw(t, client, baseURL+"/health")
+ status, _, body := regtest.GetRaw(t, client, baseURL+"/api/ping")
regtest.MustStatus(t, status, 200, body)
-}
\ No newline at end of file
+}