mathiasandClaude Sonnet 5
fb69f4bf3d
hyperguild#125, found in #111's review as a non-blocking observation, decided now rather than left implicit: UpdateNote's merge loop applied every field from the caller's leading frontmatter fragment onto the restamped note, including updated_at/supersedes/supersede_reason. updated_at and supersedes were already safe -- both get unconditionally re-set right after the loop regardless of what the loop did with them -- but supersede_reason is only re-set when opts.Reason is non-empty, so a caller could set it via its own fragment and have it survive even with the Reason option left empty, bypassing the one intended entry point for that field. Decision: these three fields are this function's own output, not caller-settable, full stop -- skip all three in the merge loop rather than lean on the other two happening to be safe via call order. Makes the invariant explicit at the one place it could be silently broken by a future reordering, instead of implicit in which fm.set calls happen to run after the loop. Flip-tested: reverting the skip to just `l.key == ""` lets the caller's supersede_reason survive with Reason empty -- the new test catches it. Full module suite green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
278 lines
10 KiB
Go
278 lines
10 KiB
Go
package api
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// seedNote writes a note directly to disk and returns its relPath.
|
|
func seedNote(t *testing.T, brainDir, rel, content string) string {
|
|
t.Helper()
|
|
full := filepath.Join(brainDir, filepath.FromSlash(rel))
|
|
require.NoError(t, os.MkdirAll(filepath.Dir(full), 0o755))
|
|
require.NoError(t, os.WriteFile(full, []byte(content), 0o644))
|
|
return rel
|
|
}
|
|
|
|
func TestUpdateNoteSupersedesAndStamps(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md",
|
|
"---\nwing: jepa-fx\nhall: facts\ncreated_at: 2026-01-01T00:00:00Z\ncustom: keep-me\n---\n# Old\n\nold body\n")
|
|
|
|
relPath, hash, priorHash, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel,
|
|
Content: "# New\n\nnew body\n",
|
|
Reason: "facts changed",
|
|
})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, rel, relPath)
|
|
assert.NotEmpty(t, hash)
|
|
assert.NotEmpty(t, priorHash)
|
|
assert.NotEqual(t, hash, priorHash)
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
s := string(got)
|
|
// Body replaced.
|
|
assert.Contains(t, s, "# New")
|
|
assert.NotContains(t, s, "old body")
|
|
// Prior fields preserved.
|
|
assert.Contains(t, s, "wing: jepa-fx")
|
|
assert.Contains(t, s, "hall: facts")
|
|
assert.Contains(t, s, "created_at: 2026-01-01T00:00:00Z")
|
|
assert.Contains(t, s, "custom: keep-me")
|
|
// Supersession stamped.
|
|
assert.Contains(t, s, "updated_at:")
|
|
assert.Contains(t, s, "supersedes: "+priorHash)
|
|
assert.Contains(t, s, "supersede_reason: facts changed")
|
|
}
|
|
|
|
func TestUpdateNoteRejectsInvalidEnvelopeAndWritesNothing(t *testing.T) {
|
|
// hyperguild#111: WriteNote validates the claim envelope before create;
|
|
// UpdateNote didn't before supersede, so the same rule must hold on
|
|
// change as on birth, fail-closed, nothing written on rejection.
|
|
brainDir := t.TempDir()
|
|
original := "---\nwing: jepa-fx\nhall: facts\ncreated_at: 2026-01-01T00:00:00Z\n---\n# Old\n\nold body\n"
|
|
rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md", original)
|
|
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel,
|
|
Content: "---\nhalf_life: forever\n---\n# New\n\nnew body\n",
|
|
})
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "claim envelope")
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, original, string(got), "rejected update must leave the note byte-identical")
|
|
}
|
|
|
|
func TestUpdateNoteRejectsAppliesWithoutProvenance(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
original := "---\nwing: jepa-fx\nhall: facts\n---\nold\n"
|
|
rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md", original)
|
|
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel,
|
|
Content: "---\napplies: universal\n---\nnew\n",
|
|
})
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "claim envelope")
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, original, string(got))
|
|
}
|
|
|
|
func TestUpdateNoteAcceptsValidEnvelopeAndMergesIntoFrontmatter(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md",
|
|
"---\nwing: jepa-fx\nhall: facts\ncreated_at: 2026-01-01T00:00:00Z\n---\nold\n")
|
|
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel,
|
|
Content: "---\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\nnew body\n",
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
s := string(got)
|
|
assert.Contains(t, s, "half_life: durable")
|
|
assert.Contains(t, s, "applies: universal")
|
|
assert.Contains(t, s, "claim_provenance: asserted")
|
|
assert.Contains(t, s, "wing: jepa-fx", "prior fields survive")
|
|
assert.Contains(t, s, "new body")
|
|
assert.Equal(t, 2, strings.Count(s, "---\n"),
|
|
"exactly one open+close fence pair — the caller's own fence must not leak in as a second, inert block")
|
|
}
|
|
|
|
func TestUpdateNoteRejectsClearingProvenanceWhileEnvelopeSurvives(t *testing.T) {
|
|
// Found in review, not written speculatively: validating only the
|
|
// caller's fragment (rather than the merged result) let a caller blank
|
|
// out claim_provenance alone while half_life/applies survived from the
|
|
// prior note untouched — each side looks fine on its own, the merged
|
|
// envelope on disk is the unprovenanced one the whole check exists to
|
|
// catch.
|
|
brainDir := t.TempDir()
|
|
original := "---\nwing: jepa-fx\nhall: facts\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\nold\n"
|
|
rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md", original)
|
|
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel,
|
|
Content: "---\nclaim_provenance: \n---\nnew body\n",
|
|
})
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "claim envelope")
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, original, string(got), "rejected update must leave the note byte-identical")
|
|
}
|
|
|
|
func TestUpdateNoteWithoutEnvelopeFieldsIsUnchangedFromToday(t *testing.T) {
|
|
// Regression pin: plain fence-less content (the common case) must behave
|
|
// exactly as it did before the envelope-merge fix.
|
|
brainDir := t.TempDir()
|
|
rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md",
|
|
"---\nwing: jepa-fx\nhall: facts\ncreated_at: 2026-01-01T00:00:00Z\ncustom: keep-me\n---\n# Old\n\nold body\n")
|
|
|
|
relPath, hash, priorHash, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel,
|
|
Content: "# New\n\nnew body\n",
|
|
Reason: "facts changed",
|
|
})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, rel, relPath)
|
|
assert.NotEmpty(t, hash)
|
|
assert.NotEqual(t, hash, priorHash)
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
s := string(got)
|
|
assert.Contains(t, s, "# New")
|
|
assert.Contains(t, s, "custom: keep-me")
|
|
assert.Contains(t, s, "supersedes: "+priorHash)
|
|
}
|
|
|
|
func TestUpdateNoteResolvesByWingHallSlug(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md",
|
|
"---\nwing: jepa-fx\nhall: facts\n---\nold\n")
|
|
|
|
relPath, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Wing: "jepa-fx", Hall: "facts", Slug: "val-vol",
|
|
Content: "new\n",
|
|
})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "wiki/jepa-fx/facts/val-vol.md", relPath)
|
|
}
|
|
|
|
func TestUpdateNoteErrorsOnMissingAndDoesNotCreate(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Wing: "jepa-fx", Hall: "facts", Slug: "ghost",
|
|
Content: "x\n",
|
|
})
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "does not exist")
|
|
|
|
// No file created.
|
|
_, statErr := os.Stat(filepath.Join(brainDir, "wiki/jepa-fx/facts/ghost.md"))
|
|
assert.True(t, os.IsNotExist(statErr), "missing-target update must not create a note")
|
|
}
|
|
|
|
func TestUpdateNoteRejectsTraversal(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: "../escape.md",
|
|
Content: "x\n",
|
|
})
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestReadNoteReturnsFrontmatterBodyHash(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/n.md",
|
|
"---\nwing: jepa-fx\nhall: facts\n---\n# Body\n\ntext\n")
|
|
|
|
fm, body, hash, err := ReadNote(brainDir, rel)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "jepa-fx", fm["wing"])
|
|
assert.Equal(t, "facts", fm["hall"])
|
|
assert.Equal(t, "# Body\n\ntext\n", body)
|
|
|
|
// Hash matches ContentHash of the raw bytes on disk (round-trip).
|
|
raw, _ := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
assert.Equal(t, ContentHash(raw), hash)
|
|
}
|
|
|
|
func TestReadNoteRejectsTraversal(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
_, _, _, err := ReadNote(brainDir, "../../etc/passwd")
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestUpdateThenReadRoundTripsHash(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
|
|
|
|
_, hash, _, err := UpdateNote(brainDir, UpdateNoteOptions{Path: rel, Content: "new\n"})
|
|
require.NoError(t, err)
|
|
|
|
_, _, readHash, err := ReadNote(brainDir, rel)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, hash, readHash, "update content_hash must round-trip through ReadNote")
|
|
}
|
|
|
|
func TestUpdateNoteSupersedeReasonNotSettableViaCallerFragmentWhenReasonOptionEmpty(t *testing.T) {
|
|
// hyperguild#125, found in #111's review: the merge loop applied every
|
|
// field from the caller's leading frontmatter fragment, including
|
|
// supersede_reason -- which is only re-set unconditionally when
|
|
// opts.Reason is non-empty, so a caller could set it via its own
|
|
// fragment and have it survive even with Reason left empty, bypassing
|
|
// the one intended entry point for that field.
|
|
brainDir := t.TempDir()
|
|
rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
|
|
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel,
|
|
Content: "---\nsupersede_reason: snuck in via the fragment\n---\nnew\n",
|
|
// Reason deliberately left empty.
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
assert.NotContains(t, string(got), "supersede_reason",
|
|
"supersede_reason must not appear at all when opts.Reason is empty, regardless of what the fragment tried to set")
|
|
}
|
|
|
|
func TestUpdateNoteSupersedeReasonFromOptionStillWorks(t *testing.T) {
|
|
// Regression pin: the legitimate entry point (opts.Reason) must be
|
|
// completely unaffected by #125's fix.
|
|
brainDir := t.TempDir()
|
|
rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
|
|
|
|
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
|
Path: rel, Content: "new\n", Reason: "facts changed",
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "supersede_reason: facts changed")
|
|
}
|
|
|
|
func TestContentHashStable(t *testing.T) {
|
|
assert.Equal(t, ContentHash([]byte("abc")), ContentHash([]byte("abc")))
|
|
assert.NotEqual(t, ContentHash([]byte("abc")), ContentHash([]byte("abd")))
|
|
assert.True(t, strings.HasPrefix(ContentHash([]byte("")), "")) // hex, non-panicking
|
|
}
|