A channel's message slots are named from the client, on every backend
The IR called them react-message and django-message, so a FastAPI channel had to declare a DjangoMessage. They are client-message and server-message now, and the direction words hold wherever a channel is declared: Params / ClientMessage / ServerMessage, with mizan-core deriving <Pascal>Params and friends so no backend names a type itself. Django's ReactChannel and FastAPI's ReactChannel are both Channel. mizan-fastapi never registered a channels extension, so build_ir() emitted no channel at all and every payload type was invisible to codegen. It registers one now. RegistryExtension is an ABC requiring all(), which is what the IR reads — an extension that cannot enumerate its registrations no longer exists. The gate that should have caught the rename could not: tests/afi registered no channel because mizan-rust had no channel registry to register one in, so a five-package rename of the wire contract passed byte-parity without a channel byte crossing it. mizan-rust grows ChannelSlotKind, a CHANNELS slice, a #[mizan::channel] macro, and KDL emission whose wire_to_pascal matches Python's split; the AFI fixture now carries a channel with every slot and one with a single slot, so all three backends prove the contract byte for byte. MizanChannel held three Option<String> beside three has_*() predicates and unwrapped them with defaults; it holds an ordered slot vector, so an absent slot is absent rather than defaulted. The channels target emitted a React hooks file that a stage1-only consumer could not compile — react emits that now. The codegen's parity tests byte-compared emitted source against baselines without ever compiling it: they compile the generated crate and run its tests, import the generated Python package and call every method, and typecheck each TypeScript target against a consumer. Also fixed at source: app_visitor printed its import diagnostic to stdout, the stream export_mizan_ir writes KDL to, so a failed import silently corrupted the IR; the apps root was hardcoded to "apps"; _default_literal crashed build_ir on any non-JSON-serializable field default; Django and mizan-core derived Pascal names two different ways, disagreeing on every dotted channel name. ir.py builds a document and renders templates/ir/document.kdl.j2 rather than appending KDL strings with hand-tracked indentation, and named types resolve to a fixed point — a model reachable only through a union branch was referenced by a ref that no type block ever defined. The rest is the write-gate's own classifiers run over the standing tree: relative imports, silent swallows, Protocol contracts that should be ABCs, emitters hand-rendering target source, catch-all arms over closed enums, and comments narrating the project rather than the code. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -1,66 +1,16 @@
|
||||
"""
|
||||
REAL integration tests for the mizan RPC framework layer.
|
||||
|
||||
Tests the actual HTTP stack: CSRF, middleware, error codes, validation.
|
||||
Every test makes a real HTTP request — no mocks, no RequestFactory.
|
||||
"""
|
||||
"""The RPC transport itself over HTTP: CSRF, method guards, error envelopes."""
|
||||
|
||||
import json
|
||||
from urllib.request import urlopen, Request
|
||||
from urllib.error import HTTPError
|
||||
|
||||
from django.test import LiveServerTestCase
|
||||
|
||||
|
||||
class RealHTTPMixin:
|
||||
def _session_init(self):
|
||||
url = f"{self.live_server_url}/api/mizan/session/"
|
||||
resp = urlopen(Request(url))
|
||||
cookies = resp.headers.get_all("Set-Cookie") or []
|
||||
for cookie in cookies:
|
||||
if "csrftoken=" in cookie:
|
||||
self._csrf_token = cookie.split("csrftoken=")[1].split(";")[0]
|
||||
self._cookies = f"csrftoken={self._csrf_token}"
|
||||
return
|
||||
self._csrf_token = None
|
||||
self._cookies = ""
|
||||
|
||||
def _call(self, fn: str, args: dict | None = None):
|
||||
url = f"{self.live_server_url}/api/mizan/call/"
|
||||
body = json.dumps({"fn": fn, "args": args or {}}).encode()
|
||||
req = Request(url, data=body, method="POST")
|
||||
req.add_header("Content-Type", "application/json")
|
||||
if self._csrf_token:
|
||||
req.add_header("X-CSRFToken", self._csrf_token)
|
||||
if self._cookies:
|
||||
req.add_header("Cookie", self._cookies)
|
||||
resp = urlopen(req)
|
||||
return json.loads(resp.read())
|
||||
|
||||
def _raw_post(
|
||||
self,
|
||||
path: str,
|
||||
body: bytes | str,
|
||||
content_type: str = "application/json",
|
||||
include_csrf: bool = False,
|
||||
):
|
||||
"""Raw POST without the call() envelope — for testing malformed requests."""
|
||||
url = f"{self.live_server_url}{path}"
|
||||
if isinstance(body, str):
|
||||
body = body.encode()
|
||||
req = Request(url, data=body, method="POST")
|
||||
req.add_header("Content-Type", content_type)
|
||||
if include_csrf and self._csrf_token:
|
||||
req.add_header("X-CSRFToken", self._csrf_token)
|
||||
req.add_header("Cookie", self._cookies)
|
||||
return urlopen(req)
|
||||
from tests.live_http import LiveRPCMixin
|
||||
|
||||
|
||||
class CSRFTests(RealHTTPMixin, LiveServerTestCase):
|
||||
"""CSRF handling over real HTTP — the thing that was broken."""
|
||||
|
||||
class CSRFTests(LiveRPCMixin, LiveServerTestCase):
|
||||
def test_session_endpoint_sets_csrf_cookie(self):
|
||||
"""GET /session/ must return a Set-Cookie with csrftoken."""
|
||||
from urllib.request import Request, urlopen
|
||||
|
||||
url = f"{self.live_server_url}/api/mizan/session/"
|
||||
resp = urlopen(Request(url))
|
||||
cookies = resp.headers.get_all("Set-Cookie") or []
|
||||
@@ -69,111 +19,79 @@ class CSRFTests(RealHTTPMixin, LiveServerTestCase):
|
||||
self.assertGreater(len(csrf_cookies), 0, "No csrftoken cookie set by /session/")
|
||||
|
||||
def test_call_without_csrf_is_rejected(self):
|
||||
"""POST /call/ without CSRF token must fail."""
|
||||
url = f"{self.live_server_url}/api/mizan/call/"
|
||||
body = json.dumps({"fn": "system_info", "args": {}}).encode()
|
||||
req = Request(url, data=body, method="POST")
|
||||
req.add_header("Content-Type", "application/json")
|
||||
reply = self.call("system_info", with_csrf=False)
|
||||
|
||||
try:
|
||||
resp = urlopen(req)
|
||||
data = json.loads(resp.read())
|
||||
# If it doesn't raise, the response should indicate an error
|
||||
self.assertTrue(data.get("error"), "POST without CSRF should be rejected")
|
||||
except HTTPError as e:
|
||||
self.assertEqual(e.code, 403, f"Expected 403, got {e.code}")
|
||||
self.assertEqual(reply.status, 403)
|
||||
|
||||
def test_call_with_csrf_succeeds(self):
|
||||
"""POST /call/ with valid CSRF token must work."""
|
||||
self._session_init()
|
||||
data = self._call("system_info")
|
||||
self.session_init()
|
||||
|
||||
self.assertFalse(data["error"])
|
||||
self.assertIn("os_name", data["data"])
|
||||
self.assertIn("os_name", self.result("system_info"))
|
||||
|
||||
|
||||
class ValidationTests(RealHTTPMixin, LiveServerTestCase):
|
||||
"""Pydantic validation errors over real HTTP."""
|
||||
|
||||
class ValidationTests(LiveRPCMixin, LiveServerTestCase):
|
||||
def setUp(self):
|
||||
self._session_init()
|
||||
self.session_init()
|
||||
|
||||
def test_missing_required_field(self):
|
||||
"""Calling create_note without title should return VALIDATION_ERROR."""
|
||||
data = self._call("create_note", {})
|
||||
reply = self.call("create_note", {})
|
||||
|
||||
self.assertTrue(data["error"])
|
||||
self.assertEqual(data["code"], "VALIDATION_ERROR")
|
||||
self.assertEqual(reply.status, 422)
|
||||
self.assertEqual(reply.body["code"], "VALIDATION_ERROR")
|
||||
self.assertIn("title", reply.body["details"]["fields"])
|
||||
|
||||
def test_wrong_type(self):
|
||||
"""Calling delete_note with string id should return VALIDATION_ERROR."""
|
||||
data = self._call("delete_note", {"id": "not-an-int"})
|
||||
reply = self.call("delete_note", {"id": "not-an-int"})
|
||||
|
||||
self.assertTrue(data["error"])
|
||||
self.assertEqual(data["code"], "VALIDATION_ERROR")
|
||||
self.assertEqual(reply.status, 422)
|
||||
self.assertEqual(reply.body["code"], "VALIDATION_ERROR")
|
||||
|
||||
def test_missing_multiple_fields(self):
|
||||
"""write_file with no args should list all missing fields."""
|
||||
data = self._call("write_file", {})
|
||||
reply = self.call("write_file", {})
|
||||
|
||||
self.assertTrue(data["error"])
|
||||
self.assertEqual(data["code"], "VALIDATION_ERROR")
|
||||
self.assertEqual(reply.status, 422)
|
||||
self.assertEqual(reply.body["code"], "VALIDATION_ERROR")
|
||||
self.assertEqual(
|
||||
set(reply.body["details"]["fields"]), {"path", "content"}
|
||||
)
|
||||
|
||||
|
||||
class ErrorCodeTests(RealHTTPMixin, LiveServerTestCase):
|
||||
"""Error codes over real HTTP."""
|
||||
|
||||
class ErrorCodeTests(LiveRPCMixin, LiveServerTestCase):
|
||||
def setUp(self):
|
||||
self._session_init()
|
||||
self.session_init()
|
||||
|
||||
def test_not_found_function(self):
|
||||
data = self._call("this_does_not_exist")
|
||||
reply = self.call("this_does_not_exist")
|
||||
|
||||
self.assertTrue(data["error"])
|
||||
self.assertEqual(data["code"], "NOT_FOUND")
|
||||
self.assertEqual(reply.status, 404)
|
||||
self.assertEqual(reply.body["code"], "NOT_FOUND")
|
||||
|
||||
def test_forbidden_write_outside_home(self):
|
||||
data = self._call("write_file", {"path": "/etc/nope.txt", "content": "x"})
|
||||
reply = self.call("write_file", {"path": "/etc/nope.txt", "content": "x"})
|
||||
|
||||
self.assertTrue(data["error"])
|
||||
self.assertEqual(data["code"], "FORBIDDEN")
|
||||
self.assertEqual(reply.status, 403)
|
||||
self.assertEqual(reply.body["code"], "FORBIDDEN")
|
||||
|
||||
def test_get_method_rejected(self):
|
||||
"""GET to /call/ should be rejected."""
|
||||
url = f"{self.live_server_url}/api/mizan/call/"
|
||||
try:
|
||||
resp = urlopen(Request(url))
|
||||
data = json.loads(resp.read())
|
||||
self.assertTrue(data.get("error"))
|
||||
except HTTPError as e:
|
||||
self.assertIn(e.code, [403, 405])
|
||||
reply = self.get("/api/mizan/call/")
|
||||
|
||||
self.assertEqual(reply.status, 405)
|
||||
self.assertEqual(reply.body["code"], "BAD_REQUEST")
|
||||
|
||||
def test_invalid_json_body(self):
|
||||
"""Malformed JSON should return BAD_REQUEST."""
|
||||
self._session_init()
|
||||
try:
|
||||
resp = self._raw_post(
|
||||
"/api/mizan/call/",
|
||||
body="not valid json{{{",
|
||||
include_csrf=True,
|
||||
)
|
||||
data = json.loads(resp.read())
|
||||
self.assertTrue(data["error"])
|
||||
self.assertEqual(data["code"], "BAD_REQUEST")
|
||||
except HTTPError as e:
|
||||
self.assertIn(e.code, [400, 403])
|
||||
reply = self.post("/api/mizan/call/", "not valid json{{{")
|
||||
|
||||
self.assertEqual(reply.status, 400)
|
||||
self.assertEqual(reply.body["code"], "BAD_REQUEST")
|
||||
|
||||
def test_missing_fn_field(self):
|
||||
"""POST with valid JSON but no 'fn' field should return BAD_REQUEST."""
|
||||
self._session_init()
|
||||
try:
|
||||
resp = self._raw_post(
|
||||
"/api/mizan/call/",
|
||||
body=json.dumps({"not_fn": "hello"}),
|
||||
include_csrf=True,
|
||||
)
|
||||
data = json.loads(resp.read())
|
||||
self.assertTrue(data["error"])
|
||||
self.assertEqual(data["code"], "BAD_REQUEST")
|
||||
except HTTPError as e:
|
||||
self.assertIn(e.code, [400, 403])
|
||||
reply = self.post("/api/mizan/call/", json.dumps({"not_fn": "hello"}))
|
||||
|
||||
self.assertEqual(reply.status, 400)
|
||||
self.assertEqual(reply.body["code"], "BAD_REQUEST")
|
||||
|
||||
def test_empty_body(self):
|
||||
reply = self.post("/api/mizan/call/", b"")
|
||||
|
||||
self.assertEqual(reply.status, 400)
|
||||
self.assertEqual(reply.body["code"], "BAD_REQUEST")
|
||||
|
||||
Reference in New Issue
Block a user