Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
2026-08-09 22:47:43 +02:00
commit 8580c996c3
1285 changed files with 325780 additions and 0 deletions
@@ -0,0 +1,99 @@
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/alexedwards/scs/v2"
+	"github.com/descrybe/descrybe-v2/apps/api/internal/auth"
+	"github.com/descrybe/descrybe-v2/apps/api/internal/config"
+	"github.com/descrybe/descrybe-v2/apps/api/internal/platformsettings"
+	"github.com/google/uuid"
+)
+
+// TestRouterAdminSettingsAIConfigPresent locks GET /api/admin/settings AI surface:
+// legacy openai block always; multi-role ai_roles with all catalog roles masked.
+func TestRouterAdminSettingsAIConfigPresent(t *testing.T) {
+	t.Parallel()
+	sm := scs.New()
+	sm.Cookie.Name = "descrybe_session"
+	uid := uuid.MustParse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+	s := &Server{
+		Config: config.Config{
+			CSRFCookieName: "descrybe_csrf",
+			WebOrigin:      "http://localhost:5173",
+		},
+		Sessions:         sm,
+		Auth:             &auth.Service{},
+		PlatformSettings: platformsettings.NewService(nil, platformsettings.EnvConfig{}),
+		testPlatformAdmin: func(_ context.Context, got uuid.UUID) (bool, error) {
+			return got == uid, nil
+		},
+	}
+
+	var token string
+	seed := LoadSession(sm)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sm.Put(r.Context(), auth.SessionUserIDKey, uid.String())
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	seedRec := httptest.NewRecorder()
+	seed.ServeHTTP(seedRec, httptest.NewRequest(http.MethodGet, "/seed", nil))
+	for _, c := range seedRec.Result().Cookies() {
+		if c.Name == sm.Cookie.Name {
+			token = c.Value
+		}
+	}
+	if token == "" {
+		t.Fatal("expected session cookie from seed request")
+	}
+
+	h := s.Router()
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/admin/settings", nil)
+	req.AddCookie(&http.Cookie{Name: sm.Cookie.Name, Value: token})
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d want 200 body=%s", rec.Code, rec.Body.String())
+	}
+
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode: %v body=%s", err, rec.Body.String())
+	}
+	openai, ok := body["openai"].(map[string]any)
+	if !ok {
+		t.Fatalf("missing openai object: %s", rec.Body.String())
+	}
+	for _, key := range []string{"configured", "has_api_key", "source"} {
+		if _, ok := openai[key]; !ok {
+			t.Fatalf("openai missing %q: %#v", key, openai)
+		}
+	}
+	if raw, exists := openai["api_key"]; exists && raw != nil && raw != "" {
+		t.Fatalf("openai must not leak api_key, got %#v", raw)
+	}
+
+	rawConfigs, hasConfigs := body["ai_roles"]
+	if !hasConfigs || rawConfigs == nil {
+		t.Fatalf("ai_roles missing body=%s", rec.Body.String())
+	}
+	configs, ok := rawConfigs.(map[string]any)
+	if !ok {
+		t.Fatalf("ai_roles type=%T want object body=%s", rawConfigs, rec.Body.String())
+	}
+	for _, role := range platformsettings.AIRoles {
+		slot, ok := configs[role].(map[string]any)
+		if !ok {
+			t.Fatalf("ai_roles missing role %q: %#v", role, configs)
+		}
+		if slot["role"] != role {
+			t.Fatalf("role %q slot.role=%v", role, slot["role"])
+		}
+		if raw, exists := slot["api_key"]; exists && raw != nil && raw != "" {
+			t.Fatalf("ai_roles.%s must not leak api_key", role)
+		}
+	}
+}