8b84378fe1
Elevate MiroFish/CrowdSight from single-container dev to a SaaS foundation: - Local memory backend (Zep-compatible): memory services/models, local graph builder + updater, AgentActivity seam, import-boundary isolation; Zep stays default, local is opt-in behind MEMORY_BACKEND. Semantic parity not yet proven. - Durable product persistence: projects/simulations/reports schema (migration 0007) + tenant/owner-scoped ProductRepository + dual-write + scoped_project read-first + ArtifactStore abstraction; durable JobQueue + worker.py. - SaaS hardening: durable RateLimiter (wired to login), UsageService (LLM accounting), redacted AuditService, idempotency, CORS allowlist, safe API errors, single-use PasswordResetService + endpoints (covers invite-pending). - Exactly 3 roles (super_admin/admin/user) with tenant authz policy. - Admin UI: GET/POST/PATCH /api/admin/users + GET/PUT /api/admin/settings (super-admin only, encrypted/masked); AdminView.vue + SettingsView.vue with admin/super-admin route guards, th/en i18n. - Production deploy topology: multi-stage Dockerfile (frontend build + gunicorn wsgi + nginx SPA-proxy + supervisord worker), backend/wsgi.py, gunicorn dep. Backend 197 passed; frontend 10 tests + build green. ruff unavailable (gap). No commit of credentials; secrets handled via env/.env.example. Deferred: Zep semantic A/B parity, object storage cutover, mobile QA, EasyPanel container build of deploy topology.
44 lines
1.3 KiB
JavaScript
44 lines
1.3 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import test from 'node:test'
|
|
|
|
const load = async () => import('../src/api/error.js')
|
|
|
|
test('accepts a bounded structured API message', async () => {
|
|
const { getSafeApiErrorMessage } = await load()
|
|
assert.equal(
|
|
getSafeApiErrorMessage(
|
|
{ response: { data: { error_code: 'project_not_found', message: 'Project not found' } } },
|
|
'Request failed',
|
|
),
|
|
'Project not found',
|
|
)
|
|
})
|
|
|
|
test('rejects raw traceback and filesystem leakage', async () => {
|
|
const { getSafeApiErrorMessage } = await load()
|
|
const error = {
|
|
response: {
|
|
data: {
|
|
error_code: 'internal_error',
|
|
message: 'Traceback: File "/Users/secret/app.py" API_KEY=sk-live-secret',
|
|
},
|
|
},
|
|
}
|
|
assert.equal(getSafeApiErrorMessage(error, 'Request failed'), 'Request failed')
|
|
})
|
|
|
|
test('rejects unstructured Chinese or oversized server text', async () => {
|
|
const { getSafeApiErrorMessage } = await load()
|
|
assert.equal(
|
|
getSafeApiErrorMessage({ response: { data: { error: '项目不存在' } } }, 'Request failed'),
|
|
'Request failed',
|
|
)
|
|
assert.equal(
|
|
getSafeApiErrorMessage(
|
|
{ response: { data: { error_code: 'bad', message: 'x'.repeat(241) } } },
|
|
'Request failed',
|
|
),
|
|
'Request failed',
|
|
)
|
|
})
|