1import { beforeAll, describe, expect, test } from "bun:test";2import { existsSync } from "node:fs";3import { chmod, mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";4import { tmpdir } from "node:os";5import { join } from "node:path";6import { gunzipSync } from "node:zlib";7import type { Hono } from "hono";8import { openBucket } from "../src/bucket/reader.ts";9import { type SyncTarget, syncAll, syncRepo } from "../src/bucket/sync.ts";10import { openMirror } from "../src/mirror/store.ts";11import { createApp } from "../src/server/app.ts";12import { openKeprDb } from "../src/server/db.ts";13import { buildTarball, isStripped } from "../src/tarball/tar.ts";14import { type Fixture, makeKohBucket } from "./fixture.ts";1516let fx: Fixture;17let app: Hono;18let target: SyncTarget;19let head: string;20let dataDir: string;21const get = (path: string) => app.request(path);22const bytesOf = async (path: string) => new Uint8Array(await (await get(path)).arrayBuffer());232425const EXTRA: Record<string, string> = {26 "AGENTS.md": "agents\n",27 "CONTINUITY.md": "notes\n",28 "Cargo.lock": "lock\n",29 "koh.build": "build\n",30 ".gitignore": "x\n",31 ".agent/CONTINUITY.md": "state\n",32 ".agentry/keep.txt": "kept\n",33 "flake.nix": "{ outputs = _: { }; }\n",34 "flake.lock": "{}\n",35 "build.zig.zon": ".{}\n",36 "nested/go.sum": "kept\n",37 "run.sh": "#!/bin/sh\necho run\n",38};3940beforeAll(async () => {41 fx = await makeKohBucket("tarry");42 for (const [path, text] of Object.entries(EXTRA)) {43 await mkdir(join(fx.repoDir, path, ".."), { recursive: true });44 await writeFile(join(fx.repoDir, path), text);45 }46 await chmod(join(fx.repoDir, "run.sh"), 0o755);47 const home = join(fx.repoDir, "../../home");48 const env = { PATH: process.env.PATH, HOME: home, NO_COLOR: "1" };49 const save = Bun.spawnSync(["koh3", "save", "add build files"], { cwd: fx.repoDir, env });50 expect(save.exitCode).toBe(0);51 const log = Bun.spawnSync(["koh3", "view", "--json"], { cwd: fx.repoDir, env });52 head = JSON.parse(log.stdout.toString()).head_id;53 dataDir = await mkdtemp(join(tmpdir(), "kepr-tarball-"));54 const kepr = openKeprDb(dataDir);55 target = {56 bucket: openBucket({ kind: "folder", path: fx.bucketDir }),57 kepr,58 mirrorDir: join(dataDir, "mirror"),59 tarballDir: join(dataDir, "tarballs"),60 };61 await syncAll(target);62 kepr.run("UPDATE repos SET public = 1");63 app = createApp(64 {65 domain: "kepr.example",66 dataDir,67 adminPasswordHash: "$argon2id$x",68 bucket: { kind: "folder", path: fx.bucketDir },69 },70 kepr,71 );72});7374function tar(args: string[], input: Uint8Array): string {75 const result = Bun.spawnSync(["tar", ...args], { stdin: input });76 expect(result.exitCode).toBe(0);77 return result.stdout.toString();78}7980describe("the tar format", () => {81 const header = (tarBytes: Uint8Array, index: number) =>82 tarBytes.subarray(index * 512, index * 512 + 512);83 const field = (h: Uint8Array, from: number, to: number) =>84 new TextDecoder().decode(h.subarray(from, to));8586 test("writes Kepr 2's headers: root directory, then files with zero owners and times", () => {87 const gz = buildTarball("r-12345678", [88 { path: "b.txt", bytes: new TextEncoder().encode("hello source") },89 { path: "a.sh", bytes: new Uint8Array() },90 ]);91 expect([...gz.subarray(0, 10)]).toEqual([0x1f, 0x8b, 8, 0, 0, 0, 0, 0, 0, 3]);92 const t = gunzipSync(gz);93 const [root, a, b] = [header(t, 0), header(t, 1), header(t, 2)];94 expect(field(root, 0, 12)).toBe("r-12345678/\0");95 expect(field(root, 100, 156)).toBe(96 `0000755\0${"0000000\0".repeat(2)}${"\0".repeat(12)}00000000000\0${field(root, 148, 156)}`,97 );98 expect(field(root, 156, 157)).toBe("5");99 expect(field(root, 257, 265)).toBe("ustar\u000000");100 expect(field(a, 0, 16)).toBe("r-12345678/a.sh\0");101 102 expect(field(a, 100, 108)).toBe("0000644\0");103 expect(field(b, 100, 108)).toBe("0000644\0");104 expect(field(b, 124, 136)).toBe("00000000014\0");105 expect(field(b, 156, 157)).toBe("0");106 for (const h of [root, a, b]) {107 let sum = 0;108 for (const [i, byte] of h.entries()) sum += i >= 148 && i < 156 ? 32 : byte;109 expect(field(h, 148, 156)).toBe(`${sum.toString(8).padStart(6, "0")}\0 `);110 }111 expect(field(t, 3 * 512, 3 * 512 + 12)).toBe("hello source");112 expect(t.length).toBe(6 * 512);113 });114115 test("writes executable archives at 0755 and plain archives at 0644", () => {116 const executableTar = gunzipSync(117 buildTarball(118 "r",119 [{ path: "run.sh", bytes: new TextEncoder().encode("#!/bin/sh\n") }],120 0o755,121 ),122 );123 const plainTar = gunzipSync(124 buildTarball("r", [{ path: "README.md", bytes: new TextEncoder().encode("read me\n") }]),125 );126 expect(field(header(executableTar, 1), 100, 108)).toBe("0000755\0");127 expect(field(header(plainTar, 1), 100, 108)).toBe("0000644\0");128 });129130 test("splits a long path into the ustar prefix, and refuses one that can't be split", () => {131 const long = `${"d".repeat(40)}/${"x".repeat(85)}`;132 const t = gunzipSync(buildTarball("r", [{ path: long, bytes: new Uint8Array() }]));133 const h = header(t, 1);134 expect(field(h, 345, 500).replace(/\0+$/, "")).toBe(`r/${"d".repeat(40)}`);135 expect(field(h, 0, 100).replace(/\0+$/, "")).toBe("x".repeat(85));136 expect(137 tar(["-tzf", "-"], buildTarball("r", [{ path: long, bytes: new Uint8Array() }])),138 ).toContain(`r/${long}`);139 expect(() => buildTarball("r", [{ path: "y".repeat(120), bytes: new Uint8Array() }])).toThrow(140 "path too long",141 );142 });143144 test("the strip list matches the repo root only", () => {145 for (const path of [146 "koh.build",147 "kepr.build",148 "go.sum",149 "LOG.md",150 ".agent",151 ".agent/a/b.md",152 ".gitignore",153 ])154 expect(isStripped(path)).toBe(true);155 for (const path of [156 "flake.lock",157 "build.zig.zon",158 "nested/go.sum",159 "docs/AGENTS.md",160 ".agentry/x",161 "log.md",162 ])163 expect(isStripped(path)).toBe(false);164 });165});166167describe("the archive routes", () => {168 test("HEAD.tar.gz redirects uncached to the current save, naming it as the immutable link", async () => {169 const response = await get("/tarry/archive/HEAD.tar.gz");170 expect(response.status).toBe(302);171 expect(response.headers.get("location")).toBe(`/tarry/archive/${head}.tar.gz`);172 expect(response.headers.get("cache-control")).toBe("no-cache");173 expect(response.headers.get("link")).toBe(174 `<https://kepr.example/tarry/archive/${head}.tar.gz>; rel="immutable"`,175 );176 });177178 test("a prefix redirects to the full ID; unknown, malformed or private is a 404", async () => {179 const short = await get(`/tarry/archive/${head.slice(0, 7)}.tar.gz`);180 expect(short.status).toBe(302);181 expect(short.headers.get("location")).toBe(`/tarry/archive/${head}.tar.gz`);182 expect((await get("/tarry/archive/abcdef.tar.gz")).status).toBe(404);183 expect((await get("/tarry/archive/abc.tar.gz")).status).toBe(404);184 target.kepr.run("UPDATE repos SET public = 0");185 const hidden = [186 await get("/tarry/archive/HEAD.tar.gz"),187 await get(`/tarry/archive/${head}.tar.gz`),188 ];189 target.kepr.run("UPDATE repos SET public = 1");190 expect(hidden.map((r) => r.status)).toEqual([404, 404]);191 });192193 test("serves the save's files under <repo>-<id8>/ minus the strip list", async () => {194 const response = await get(`/tarry/archive/${head}.tar.gz`);195 expect(response.status).toBe(200);196 expect(response.headers.get("content-type")).toBe("application/gzip");197 expect(response.headers.get("cache-control")).toBe("private, max-age=31536000");198 expect(response.headers.get("content-disposition")).toBe(199 `attachment; filename="tarry-${head.slice(0, 8)}.tar.gz"`,200 );201 const gz = new Uint8Array(await response.arrayBuffer());202 const root = `tarry-${head.slice(0, 8)}`;203 const listed = tar(["-tzf", "-"], gz).trim().split("\n");204 expect(listed).toEqual([205 `${root}/`,206 ...[207 ".agentry/keep.txt",208 "README.md",209 "build.zig.zon",210 "docs/guide.md",211 "docs/logo.png",212 "flake.lock",213 "flake.nix",214 "nested/go.sum",215 "run.sh",216 "secret.txt",217 "src/lib/deep/util.ts",218 "src/main.ts",219 "vendor/big.c",220 ].map((path) => `${root}/${path}`),221 ]);222 const out = await mkdtemp(join(tmpdir(), "kepr-untar-"));223 Bun.spawnSync(["tar", "-xzf", "-", "-C", out], { stdin: gz });224 expect(await readFile(join(out, root, "src/main.ts"), "utf8")).toContain("hello");225 expect(await readFile(join(out, root, "docs/logo.png"))).toEqual(226 await readFile(join(fx.repoDir, "docs/logo.png")),227 );228 expect(tar(["-tvzf", "-"], gz)).toMatch(/-rwxr-xr-x .* tarry-[0-9a-f]{8}\/run\.sh/);229 });230231 test("is the same bytes when rebuilt, and in another process", async () => {232 const first = await bytesOf(`/tarry/archive/${head}.tar.gz`);233 const { dropTarballs } = await import("../src/tarball/cache.ts");234 dropTarballs(target.tarballDir, "tarry");235 expect(await bytesOf(`/tarry/archive/${head}.tar.gz`)).toEqual(first);236 237 238 const script = `import { cachedTarball } from "${join(import.meta.dir, "../src/tarball/cache.ts")}";239import { openMirror } from "${join(import.meta.dir, "../src/mirror/store.ts")}";240const { TARBALL_DIR, MIRROR_DIR, SAVE_ID } = process.env;241process.stdout.write(cachedTarball(TARBALL_DIR, openMirror(MIRROR_DIR, "tarry"), "tarry", SAVE_ID));`;242 const scratch = await mkdtemp(join(tmpdir(), "kepr-tb-"));243 const other = Bun.spawnSync(["bun", "-e", script], {244 cwd: scratch,245 env: {246 PATH: process.env.PATH,247 TARBALL_DIR: join(scratch, "tarballs"),248 MIRROR_DIR: target.mirrorDir,249 SAVE_ID: head,250 },251 });252 expect(other.stderr.toString()).toBe("");253 expect(new Uint8Array(other.stdout)).toEqual(first);254 });255256 test("after a strip, an old cached tarball is never served, even if its cleanup never ran", async () => {257 await get(`/tarry/archive/${head}.tar.gz`);258 const before = join(target.tarballDir, "tarry", "0", `${head}.tar.gz`);259 expect(existsSync(before)).toBe(true);260 await fx.strip("secret.txt");261 262 await syncRepo(target.bucket, openMirror(target.mirrorDir, "tarry"), "tarry");263 expect(existsSync(before)).toBe(true);264 const listed = tar(["-tzf", "-"], await bytesOf(`/tarry/archive/${head}.tar.gz`));265 expect(listed).not.toContain("secret.txt");266 expect(listed).toContain("src/main.ts");267 expect(existsSync(join(target.tarballDir, "tarry", "1", `${head}.tar.gz`))).toBe(true);268 });269270 test("a sync that lands a strip clears the repo's old cached tarballs", async () => {271 await get(`/tarry/archive/${head}.tar.gz`);272 await fx.strip("vendor/big.c");273 await syncAll(target);274 expect(existsSync(join(target.tarballDir, "tarry"))).toBe(false);275 expect(tar(["-tzf", "-"], await bytesOf(`/tarry/archive/${head}.tar.gz`))).not.toContain(276 "big.c",277 );278 });279});280281describe("the archives panel", () => {282 test("lists HEAD and recent saves with tarball links, and nix lines where there is a flake", async () => {283 const response = await get("/tarry/archives");284 expect(response.status).toBe(200);285 expect(response.headers.get("cache-control")).toBe("public, max-age=60");286 const page = await response.text();287 const ids = [...page.matchAll(/class="history-id"[^>]*>([0-9a-f]{12})</g)].map((m) => m[1]);288 expect(ids).toEqual([head, fx.saveIds[0], fx.saveIds[2], fx.saveIds[3]]);289 expect(page).toContain('<span class="archive-head mono">HEAD</span>');290 expect(page).toContain('href="/tarry/archive/HEAD.tar.gz">↓ tarry-HEAD.tar.gz</a>');291 expect(page).toContain(292 'data-copy="nix profile add https://kepr.example/tarry/archive/HEAD.tar.gz"',293 );294 295 expect(page.match(/nix profile add/g)?.length).toBe(2);296 const older = fx.saveIds[0] as string;297 expect(page).toContain(298 `href="/tarry/archive/${older}.tar.gz">↓ tarry-${older.slice(0, 8)}.tar.gz</a>`,299 );300 expect(page).not.toContain(fx.saveIds[1] as string);301 });302303 test("a private repo's panel is a 404", async () => {304 target.kepr.run("UPDATE repos SET public = 0");305 const status = (await get("/tarry/archives")).status;306 target.kepr.run("UPDATE repos SET public = 1");307 expect(status).toBe(404);308 });309});