1import type { Database } from "bun:sqlite";2import { beforeAll, describe, expect, test } from "bun:test";3import { mkdtemp, writeFile } from "node:fs/promises";4import { tmpdir } from "node:os";5import { join } from "node:path";6import { blake3 } from "@noble/hashes/blake3.js";7import { bytesToHex } from "@noble/hashes/utils.js";8import type { Hono } from "hono";9import { openBucket } from "../src/bucket/reader.ts";10import { type SyncTarget, syncAll } from "../src/bucket/sync.ts";11import { openMirror } from "../src/mirror/store.ts";12import { compareVersions, releaseContentType, visibleReleases } from "../src/releases/releases.ts";13import { createApp } from "../src/server/app.ts";14import { openKeprDb } from "../src/server/db.ts";15import { makeRepos, writeRelease } from "./fixture.ts";1617const bytes = (text: string) => new TextEncoder().encode(text);18const blake3Hex = (text: string) => bytesToHex(blake3(bytes(text)));1920describe("release reading in sync", () => {21 let bucketDir: string;22 let save: string;23 let target: SyncTarget;24 const releases = () =>25 visibleReleases(target.kepr, openMirror(target.mirrorDir, "app"), "app").map((r) => r.version);26 const lastError = () =>27 (target.kepr.query("SELECT last_sync_error FROM repos").get() as { last_sync_error: string })28 .last_sync_error;2930 beforeAll(async () => {31 const repos = await makeRepos(["app"]);32 bucketDir = repos.bucketDir;33 save = repos.saves.app as string;34 const dataDir = await mkdtemp(join(tmpdir(), "kepr-releases-"));35 target = {36 bucket: openBucket({ kind: "folder", path: bucketDir }),37 kepr: openKeprDb(dataDir),38 mirrorDir: join(dataDir, "mirror"),39 };40 for (const version of ["1.9.0", "1.10.0", "1.2.3"]) {41 const files = [{ platform: "linux-x86_64", name: "app", bytes: bytes(version) }];42 await writeRelease(bucketDir, "app", { version, save, files }, version === "1.10.0");43 }44 await syncAll(target);45 });4647 test("reads every release.json, newest first by number", () => {48 expect(lastError()).toBeNull();49 expect(releases()).toEqual(["1.10.0", "1.9.0", "1.2.3"]);50 });5152 test("a version folder without release.json does not exist, and nothing is re-read until latest moves", async () => {53 await writeFile(join(bucketDir, "app/releases/2.0.0.tmp"), "half-written");54 const orphan = join(bucketDir, "app/releases/3.0.0/linux-x86_64");55 await Bun.write(join(orphan, "app"), "no record yet");56 await writeRelease(57 bucketDir,58 "app",59 {60 version: "1.11.0",61 save,62 files: [{ platform: "linux-x86_64", name: "app", bytes: bytes("x") }],63 },64 false,65 );66 await syncAll(target);67 expect(releases()).toEqual(["1.10.0", "1.9.0", "1.2.3"]);68 await writeFile(join(bucketDir, "app/releases/latest"), "1.11.0");69 await syncAll(target);70 expect(releases()).toEqual(["1.11.0", "1.10.0", "1.9.0", "1.2.3"]);71 });7273 test("hidden versions drop out and a notes override replaces the record's notes", () => {74 target.kepr.run(75 "INSERT INTO release_settings (repo, version, hidden, notes) VALUES ('app', '1.11.0', 1, NULL), ('app', '1.9.0', 0, 'Operator notes.')",76 );77 const shown = visibleReleases(target.kepr, openMirror(target.mirrorDir, "app"), "app");78 expect(shown.map((r) => [r.version, r.notes])).toEqual([79 ["1.10.0", ""],80 ["1.9.0", "Operator notes."],81 ["1.2.3", ""],82 ]);83 target.kepr.run("DELETE FROM release_settings");84 });8586 test("a releases/latest that is not a version is a sync error and is not kept", async () => {87 const mirror = openMirror(target.mirrorDir, "app");88 const before = mirror.query("SELECT value FROM state WHERE key = 'releases_latest'").get();89 await writeFile(join(bucketDir, "app/releases/latest"), "../../1.0");90 await syncAll(target);91 expect(lastError()).toContain('app/releases/latest is not a version: "../../1.0"');92 expect(mirror.query("SELECT value FROM state WHERE key = 'releases_latest'").get()).toEqual(93 before,94 );95 await writeFile(join(bucketDir, "app/releases/latest"), "1.11.0");96 await syncAll(target);97 expect(lastError()).toBeNull();98 });99100 test("a release record that breaks §11.2 is the repo's last sync error", async () => {101 await writeRelease(bucketDir, "app", {102 version: "1.12.0",103 save,104 files: [{ platform: "plan9-mips", name: "app", bytes: bytes("x") }],105 });106 await syncAll(target);107 expect(lastError()).toContain("release record does not match");108 await writeRelease(bucketDir, "app", {109 version: "1.12.0",110 save,111 files: [{ platform: "linux-x86_64", name: "../app", bytes: bytes("x") }],112 });113 await syncAll(target);114 expect(lastError()).toContain("release record does not match");115 });116});117118test("versions compare as numbers, segment by segment", () => {119 const sorted = ["1.10.0", "1.9.9", "2", "1.9", "0.0.0", "1.10", "10.0.0"].sort(compareVersions);120 expect(sorted).toEqual(["0.0.0", "1.9", "1.9.9", "1.10", "1.10.0", "2", "10.0.0"]);121 122 expect(compareVersions("10000000000000000", "9999999999999999")).toBeGreaterThan(0);123 expect(compareVersions("1.10000000000000001", "1.10000000000000000")).toBeGreaterThan(0);124 expect(compareVersions("1.010", "1.9")).toBeGreaterThan(0);125 expect(compareVersions("1.007", "1.7")).not.toBe(0);126});127128describe("the builds panel", () => {129 let app: Hono;130 let saves: Record<string, string>;131 const get = (path: string) => app.request(path);132133 beforeAll(async () => {134 const repos = await makeRepos(["tool", "secret"]);135 saves = repos.saves;136 const tool = saves.tool as string;137 const b = repos.bucketDir;138 await writeRelease(b, "tool", {139 version: "0.9.0",140 save: tool,141 notes: "## Fixes\n\n- the *first* fix <script>",142 files: [{ platform: "linux-x86_64", name: "tool", bytes: bytes("old") }],143 });144 await writeRelease(b, "tool", {145 version: "0.10.0",146 save: tool,147 publishedAt: 1790100000,148 files: [149 { platform: "macos-aarch64", name: "Tool.app.zip", bytes: bytes("mac") },150 { platform: "android-arm64", name: "tool-0.10.0.apk", bytes: bytes("apk") },151 ],152 });153 await writeRelease(b, "tool", {154 version: "0.11.0",155 save: "aaaaaaaaaaaa",156 files: [{ platform: "linux-x86_64", name: "tool", bytes: bytes("new") }],157 });158 await writeRelease(b, "secret", {159 version: "1.0.0",160 save: saves.secret as string,161 files: [{ platform: "linux-x86_64", name: "s", bytes: bytes("s") }],162 });163 app = await releaseApp(b, (kepr) => {164 kepr.run("UPDATE repos SET public = 1 WHERE name = 'tool'");165 kepr.run(166 "INSERT INTO downloads (repo, version, platform, count) VALUES ('tool', '0.10.0', 'android-arm64', 7)",167 );168 });169 });170171 test("lists versions newest first with their save, date, notes and files", async () => {172 const res = await get("/tool/releases");173 expect(res.status).toBe(200);174 const body = await res.text();175 const order = ["v0.11.0", "v0.10.0", "v0.9.0"].map((v) => body.indexOf(`>${v}<`));176 expect(order).toEqual([...order].sort((x, y) => x - y));177 expect(order[0]).toBeGreaterThan(0);178 expect(body).toContain('class="release-latest"');179 180 expect(body).toContain('class="archive-row release-row" id="0.10.0"');181 expect(body).toContain("earlier releases");182 const older = body.slice(183 body.indexOf('id="0.10.0"'),184 body.indexOf("<details", body.indexOf('id="0.10.0"')),185 );186 expect(older).toContain('href="/tool/releases/0.10.0/tool-0.10.0.apk"');187 expect(body).toContain(`href="/tool/saves/${saves.tool}"`);188 expect(body).toContain("2026-09-22 18:00");189 expect(body).toContain("<h2>Fixes</h2>");190 expect(body).toContain("<script>");191 192 expect(body).toContain("<p>release tool</p>");193 expect(body).toContain("<p>Release 0.11.0 of tool.</p>");194 });195196 test("each file shows its label, size, SHA-256, download count and install hint", async () => {197 const body = await (await get("/tool/releases")).text();198 expect(body).toContain("Android · ARM64");199 expect(body).toContain("macOS · Apple Silicon");200 expect(body).toContain('href="/tool/releases/0.10.0/tool-0.10.0.apk"');201 expect(body).toContain("3 B · 7 downloads");202 expect(body).toContain(new Bun.CryptoHasher("sha256").update("apk").digest("hex"));203 expect(body).toContain("unzip and drag to Applications");204 expect(body).toContain(205 "open on your device to install — allow installs from this source if prompted",206 );207 });208209 test("hidden versions don't show, and the repo header names the newest visible release", async () => {210 expect(await (await get("/tool")).text()).toContain("v0.11.0 · ");211 const kepr = releaseKepr.get(app);212 kepr?.run("INSERT INTO release_settings (repo, version, hidden) VALUES ('tool', '0.11.0', 1)");213 const body = await (await get("/tool/releases")).text();214 expect(body).not.toContain("0.11.0");215 expect(await (await get("/tool")).text()).toContain("v0.10.0 · ");216 kepr?.run("DELETE FROM release_settings");217 });218219 test("a private repo's builds are a 404", async () => {220 expect((await get("/secret/releases")).status).toBe(404);221 });222});223224describe("the §22.1 release routes", () => {225 let app: Hono;226 let kepr: Database;227 let bucketDir: string;228 let checkpoint: string;229 const get = (path: string, headers?: Record<string, string>) => app.request(path, { headers });230 const downloads = () =>231 kepr.query("SELECT version, platform, count FROM downloads ORDER BY version, platform").all();232233 beforeAll(async () => {234 const repos = await makeRepos(["cli", "hush"]);235 bucketDir = repos.bucketDir;236 const save = repos.saves.cli as string;237 await writeRelease(bucketDir, "cli", {238 version: "1.0.0",239 save,240 notes: 'First </script> & "quoted" / slashed\nline — ok',241 files: [242 { platform: "linux-x86_64", name: "cli", bytes: bytes("linux 1") },243 { platform: "android-arm64", name: "cli-1.0.0.apk", bytes: bytes("apk 1") },244 ],245 });246 await writeRelease(bucketDir, "cli", {247 version: "1.1.0",248 save,249 files: [250 { platform: "macos-aarch64", name: "Cli.app.zip", bytes: bytes("mac") },251 { platform: "linux-x86_64", name: "cli", bytes: bytes("linux 2") },252 ],253 });254 await writeRelease(bucketDir, "hush", {255 version: "1.0.0",256 save: repos.saves.hush as string,257 files: [{ platform: "linux-x86_64", name: "h", bytes: bytes("h") }],258 });259 260 repos.koh("cli", "checkpoint", "after the releases");261 checkpoint = JSON.parse(repos.koh("cli", "view", "--json")).head_id;262 app = await releaseApp(bucketDir, (db) => {263 db.run("UPDATE repos SET public = 1 WHERE name = 'cli'");264 });265 kepr = releaseKepr.get(app) as Database;266 });267268 test("latest.json is the release JSON shape, notes omitted when empty, urls on the configured domain", async () => {269 const res = await get("/cli/releases/latest.json");270 expect(res.status).toBe(200);271 expect(res.headers.get("Content-Type")).toBe("application/json; charset=UTF-8");272 const sha = new Bun.CryptoHasher("sha256").update("mac").digest("hex");273 const body = await res.text();274 expect(275 body.startsWith(276 '{"version":"1.1.0","platforms":{"linux-x86_64":{"url":"https://kepr.example/cli/releases/1.1.0/cli","blake3":"',277 ),278 ).toBe(true);279 expect(body).toContain(280 `"macos-aarch64":{"url":"https://kepr.example/cli/releases/1.1.0/Cli.app.zip",`,281 );282 expect(body).toContain(283 `"sha256":"${sha}","provenance":{"version":"1.1.0","platform":"macos-aarch64","checksum":"blake3:`,284 );285 expect(body.endsWith('"source":"koh-offer"},"signature":""}}}')).toBe(true);286 });287288 test("history.json lists every version with notes escaped as Kepr 2 escaped them", async () => {289 const body = await (await get("/cli/releases/history.json")).text();290 expect(body).toBe(291 '[{"version":"1.1.0","notes":""},{"version":"1.0.0","notes":"First \\u003c\\/script\\u003e & \\"quoted\\" \\/ slashed\\nline — ok"}]',292 );293 expect(JSON.parse(body)[1].notes).toBe('First </script> & "quoted" / slashed\nline — ok');294 });295296 test("version.txt and checksums.txt", async () => {297 const version = await get("/cli/releases/latest/version.txt");298 expect([version.headers.get("Content-Type"), await version.text()]).toEqual([299 "text/plain; charset=UTF-8",300 "1.1.0",301 ]);302 const sums = await (await get("/cli/releases/1.0.0/checksums.txt")).text();303 const sha = (text: string) => new Bun.CryptoHasher("sha256").update(text).digest("hex");304 expect(sums).toBe(305 `# cli 1.0.0\n# built by kepr\n\nsha256:${sha("apk 1")} cli-android-arm64\nsha256:${sha("linux 1")} cli-linux-x86_64\nblake3:${blake3Hex("apk 1")} cli-android-arm64\nblake3:${blake3Hex("linux 1")} cli-linux-x86_64\n`,306 );307 });308309 test("downloads count, then redirect to the stored file", async () => {310 const before = downloads().length;311 expect(before).toBe(0);312 const latest = await get("/cli/releases/latest/linux-x86_64");313 expect(latest.status).toBe(302);314 expect(latest.headers.get("Cache-Control")).toBe("no-store");315 expect(latest.headers.get("Location")).toBe(316 `file://${join(bucketDir, "cli/releases/1.1.0/linux-x86_64/cli")}`,317 );318 319 expect((await get("/cli/releases/latest/android-arm64")).headers.get("Location")).toEndWith(320 "/cli/releases/1.0.0/android-arm64/cli-1.0.0.apk",321 );322 for (const path of [323 "/cli/releases/1.0.0/android-arm64",324 "/cli/releases/1.0.0/cli-android-arm64",325 "/cli/releases/1.0.0/cli-1.0.0.apk",326 ]) {327 expect((await get(path)).status).toBe(302);328 }329 expect(downloads()).toEqual([330 { version: "1.0.0", platform: "android-arm64", count: 4 },331 { version: "1.1.0", platform: "linux-x86_64", count: 1 },332 ]);333 });334335 test("a missing release is a 404 that counts nothing, and a private repo looks unknown", async () => {336 const before = downloads();337 for (const path of [338 "/cli/releases/1.0.0/macos-aarch64",339 "/cli/releases/9.9.9/linux-x86_64",340 "/cli/releases/1.0.0/plan9",341 "/cli/releases/latest/windows-x86_64",342 "/cli/releases/9.9.9/checksums.txt",343 ]) {344 const res = await get(path);345 expect([path, res.status, await res.text()]).toEqual([346 path,347 404,348 '{"error":"not_found","message":"release not found"}',349 ]);350 }351 for (const repo of ["hush", "nowhere"]) {352 for (const suffix of ["/releases/latest.json", "/releases/1.0.0/linux-x86_64", "/meta"]) {353 const res = await get(`/${repo}${suffix}`);354 expect([res.status, await res.text()]).toEqual([355 404,356 '{"error":"repo_not_found","message":"repo not found"}',357 ]);358 }359 }360 expect(downloads()).toEqual(before);361 });362363 test("a hidden version leaves latest, the feeds and its downloads", async () => {364 kepr.run("INSERT INTO release_settings (repo, version, hidden) VALUES ('cli', '1.1.0', 1)");365 expect(await (await get("/cli/releases/latest/version.txt")).text()).toBe("1.0.0");366 expect(await (await get("/cli/releases/history.json")).text()).not.toContain("1.1.0");367 expect((await get("/cli/releases/1.1.0/linux-x86_64")).status).toBe(404);368 expect((await get("/cli/releases/latest/linux-x86_64")).headers.get("Location")).toEndWith(369 "/1.0.0/linux-x86_64/cli",370 );371 kepr.run("DELETE FROM release_settings");372 });373374 test("update-info's head is the head save even when it is a checkpoint", async () => {375 const info = (await (await get("/cli/update-info")).json()) as {376 head: { save_id: string; version: string };377 latest_build: { version: string };378 };379 expect([info.head.save_id, info.head.version]).toEqual([checkpoint, checkpoint]);380 expect(info.latest_build.version).toBe("1.1.0");381 });382383 test("the /api feeds send CORS on their 404s too", async () => {384 for (const path of ["/api/hush/releases/latest", "/api/nowhere/releases/history"]) {385 const res = await get(path);386 expect([res.status, res.headers.get("Access-Control-Allow-Origin")]).toEqual([404, "*"]);387 }388 expect(389 (await get("/hush/releases/latest.json")).headers.get("Access-Control-Allow-Origin"),390 ).toBeNull();391 });392393 test("releases/latest sends old links to the builds panel", async () => {394 const res = await get("/cli/releases/latest");395 expect([res.status, res.headers.get("Location")]).toEqual([302, "/cli/releases"]);396 expect((await get("/hush/releases/latest")).status).toBe(404);397 });398399 test("a Nix fetch of a tarball counts as an install; redirects and other clients don't", async () => {400 const installs = () =>401 (402 kepr.query("SELECT count FROM installs WHERE repo = 'cli'").get() as {403 count: number;404 } | null405 )?.count ?? 0;406 const nix = { "User-Agent": "curl/8.7.1 Nix/2.24.0 nix/2.24.0" };407 const head = await get("/cli/archive/HEAD.tar.gz", nix);408 expect(installs()).toBe(0);409 const tarball = head.headers.get("Location") as string;410 expect((await get(tarball, nix)).status).toBe(200);411 expect((await get(tarball, { "User-Agent": "curl/8.7.1" })).status).toBe(200);412 expect(installs()).toBe(1);413 });414});415416test("release files are served with §22.2's content types", () => {417 expect(releaseContentType("peach-2.9.28-android-arm64.apk")).toBe(418 "application/vnd.android.package-archive",419 );420 expect(releaseContentType("Haven.app.ZIP")).toBe("application/zip");421 expect(releaseContentType("koh")).toBe("application/octet-stream");422});423424const releaseKepr = new WeakMap<Hono, Database>();425426427async function releaseApp(bucketDir: string, setup: (kepr: Database) => void): Promise<Hono> {428 const dataDir = await mkdtemp(join(tmpdir(), "kepr-release-app-"));429 const kepr = openKeprDb(dataDir);430 const bucket = openBucket({ kind: "folder", path: bucketDir });431 await syncAll({432 bucket,433 kepr,434 mirrorDir: join(dataDir, "mirror"),435 });436 setup(kepr);437 const app = createApp(438 {439 domain: "kepr.example",440 dataDir,441 adminPasswordHash: "$argon2id$x",442 bucket: { kind: "folder", path: bucketDir },443 },444 kepr,445 );446 releaseKepr.set(app, kepr);447 return app;448}