mirror of
https://github.com/mudler/LocalAI.git
synced 2026-11-05 03:53:11 -05:00
mudler-agentandEttore Di Giacinto
b39d37f559
* Store the folder and its mode on a saved agent
A saved agent gets FolderID, the workspace node of its folder, and
FolderMode, read or write. The folder is kept by node so that a rename
or a move is followed. A mode without a node is an agent whose folder
is not chosen yet; Validate accepts it, and refuses a node without a
mode.
The GORM store adds two columns with defaults, so AutoMigrate fills
the rows of existing agents as agents without a folder. The JSON store
reads a file without the keys the same way. Both stores pass the new
contract case.
Assisted-by: Claude:claude-opus-5-5
* Keep on a chat whether its saved agent had a folder
A chat whose agent is deleted runs today without the agent's grants.
When that agent had a folder, nothing is left to say which folder the
chat may read, so the chat must be refused instead of getting the whole
home. ChatRecord.ScopedAgent records that the agent had a folder.
CreateChat writes the flag and SetScopedAgent changes it. UpdateChat
leaves it alone, like the tool switches, so the loop's stale copy of
the record cannot clear it. Both chat stores read chats stored before
the flag as not scoped; the GORM column has a default, so AutoMigrate
is the migration.
Assisted-by: Claude:claude-opus-5-5
* Add the design and plan for agent folder scope
A saved agent works on the whole home folder of its user. The spec
lets the user give an agent one folder and a mode, read only or read
and write, and confines every chat that runs it to that folder.
The workspace store enforces the folder through a fence on the actor,
so a caller that forgets it gets less access, not more. The spec maps
every caller that builds a user actor today, including the host bash,
the sandbox runner and the add-on workspace operations, and how each
is moved to the chat's access.
The plan splits the work into ten lanes; the store fence and the agent
record come first.
Assisted-by: Claude:claude-opus-5-5
* Resolve the folder of a saved agent by node
A person chooses an agent's folder by its path in their home; the
agent keeps the node, so a rename or a move is followed. The new
FolderResolver turns the path into the node and back, always as the
user. A path is refused when it is not a live folder, when it is
LocalAI/ or Chats/ or inside them, or when it names a parent. The
home itself ("/") is allowed.
The workspace stores cannot find a node by its ID yet. PathOf reads
the newest change sets of the home first, checks the path it finds
with Stat, and else lists the folders the user can read. A store that
implements NodeByID is used instead. Nothing is cached, so every
frontend answers the same.
SaveAgent keeps the stored folder when it replaces an agent, so a
caller that knows nothing of folders cannot widen one.
SaveAgentWithFolder sets or clears it. ImportAgent looks the folder of
a file up in the importer's home, and saves a folder that is not there
as unset: the mode without a node, which does not start.
Assisted-by: Claude:claude-opus-5-5
* Add a fence to the workspace actor
A chat whose saved agent has a folder must reach only that folder and
the chat's own folders. The store needs to know which folders those
are on every call, so the actor carries them.
Actor.Fenced returns a copy that reaches only the given folders, by
node ID, each at most at its mode. The fence is an unexported field:
a copy of the actor keeps it, and only Fenced can set it. Fencing a
fenced actor adds a layer, and a node is reached only when every
layer allows it, so a fence never grows.
The helpers in export.go let both store implementations apply the
same rules: the mode a fence allows on a node, its roots, and the
limit of MaxFenceRoots roots per call.
Assisted-by: Claude:claude-opus-5-5
* Show and choose the folder of an agent in the API
The agent routes carry folder. A write takes {path, mode}: the server
turns the path into the folder's node, and refuses with 400 a path
that is not a folder of the user's home, or is LocalAI or Chats. A
write without folder keeps the agent's folder, so a client that does
not know the field cannot widen the agent; {path: ""} clears it. A
read answers the folder's path now, its name, the mode and a state:
ok, missing or unset. The node never leaves the server.
An agent with a folder exports as version 2, with the folder's path
and mode. A server that reads only version 1 refuses that file, so a
scoped agent is never imported elsewhere as one with all the files.
An agent without a folder still exports as version 1. The import
reads both versions and looks the folder up in the importer's home;
a folder that is not there saves the agent as unset, with a warning.
The Swagger spec, the API instructions and the agents docs page show
the field and the new file version.
Assisted-by: Claude:claude-opus-5-5
* Enforce the actor fence in both workspace stores
The store is the one place every file call of a chat goes through, so
it applies the fence: a caller that forgets the agent's folder gets
"not found", never the whole workspace.
- The mode of a fenced actor on a node is the lower of its grants and
the fence. A root in the Trash counts for nothing, and is back after
Undo, because the fence holds the node ID.
- A fenced actor never takes the administrator shortcut, so it cannot
grant, revoke or list grants, and ReadablePrefixes gives only fence
roots or folders inside them.
- A root cannot be deleted, moved or renamed by the fenced actor, by
any path: Move, Delete, Undo, an upper layer, or a delete of a folder
above a nested root.
- A fence with too many roots or a bad root is ErrInvalid.
The shared suite in wstest runs the new specs against the JSON store
and the GORM store (SQLite and PostgreSQL).
Assisted-by: Claude:claude-opus-5-5
* Map the model's paths through the chat's place
A chat's file tools spelled every path as a path in the user's home.
A chat whose agent has a folder sees that folder at /workspace/home and
its own chat folder at /workspace/chat, so the mapping must come from
the mounts of the chat's view, not from the principal.
session.Place maps a path the model writes to a workspace path: "/x",
"x", "home/x" and "/workspace/home/x" are x in the primary mount,
"/workspace/<name>/x" is x in the mount of that exact name, and the
skill layers keep their names. It refuses "..", NUL, control characters
and invalid UTF-8 wherever they point, and a /workspace path that is no
mount. Encoded and look-alike separators stay part of a name. Place is
only a mapping: the store's fence enforces the access.
session.Access holds a turn's actor, view and place. It has no exported
fields and one constructor, so a tool cannot be built from a principal
string. Owner gives the user's own actor without the fence.
Assisted-by: Claude:claude-opus-5-5
* Build a chat's view from its folders and describe it
BuildView took the home of the principal as the folder at
/workspace/home. A chat whose agent has a folder needs that folder
there, at the agent's mode, and its own chat folder beside it.
BuildView now takes the primary folder and the chat folder. The chat
folder is mounted at /workspace/chat, read and write; the name chat is
reserved like the skill layer names. The store caps each mount at the
actor's mode, and a fenced actor gets the shared folders read only.
Every caller passes the home and no chat folder, so an unscoped chat
keeps today's view.
LayoutPrompt takes a ScopedPrompt. A scoped chat hears only of its
folders: the agent's folder by its name and mode, with a line that it
cannot see the user's other files, the chat folder and where its
working files go, and the shared folders. It gets no hint to build a
page, because pages live outside its folder. An unscoped chat keeps
today's text.
Assisted-by: Claude:claude-opus-5-5
* Find a workspace node by its ID
A caller that keeps a node ID, such as the folder of a saved agent,
had no way to ask the store where that node is now. It had to search
the journal and then list folders, which costs one query per folder
in a large home.
Store.NodeByID returns a live node at its current path, so a rename
or a move of the node or of a folder above it is followed. It answers
ErrNotFound when the node or a folder above it is deleted, and when
the actor cannot read it; a fenced actor finds only nodes inside its
fence. Both stores implement it and the shared suite checks it. The
remote store of the Sandbox add-on refuses it, like its other calls.
Assisted-by: Claude:claude-opus-5-5
* Name the work folder of a scoped chat at /workspace/chat
A chat whose agent has a folder keeps its chat folder in the home, but
sees it as a mount of its own at /workspace/chat. Its work folder is
then /workspace/chat/work, not a path under /workspace/home.
workfiles reads /workspace/chat as the chat folder: a helper file under
its work folder is working, a script beside the attachments is a stray
helper, and a folder named chat in the agent's folder is an ordinary
folder. ScopedPrompt steers the model to that work folder and sends the
deliverables to the agent's folder, or to the chat folder when the
agent may only read. It says nothing of pages or of the settings
folder, which are outside the agent's folder. The chat picks the text
by its view.
Assisted-by: Claude:claude-opus-5-5
* Look up the folder of an agent by node
The folder resolver searched the journal of the home and then listed
folders to find where an agent's folder is now. The stores can now
find a node by its ID, so the resolver asks them directly and the
search is gone.
Assisted-by: Claude:claude-opus-5-5
* Resolve the file and media tools through the chat's access
The file tools mapped paths to the user's home and acted as the chat's
actor, and the media tools did the same through files.HomePath. A chat
whose agent has a folder must reach only its folders, and search must
start in the agent's folder, so the count of documents still being
indexed cannot count files elsewhere in the home.
files.Service.Tools and media.Service.Tools take a session.Access. Every
path goes through its place and every call acts as its actor. A write
to a read-only folder is refused before the store sees it. A search
with no path starts at the primary folder, and in a scoped chat also
looks in the chat folder; the pending count is taken below that root.
files.HomePath is removed.
UnscopedAccess builds today's access of a chat (the home and the
shared folders), and the studio service takes the turn's access from
one function, turnAccess, which gives that access until the chat
access resolver replaces it.
The new specs run the paths that try to leave the folder (parents,
absolute and doubled paths, encoded and look-alike separators, NUL,
other cases) through every file tool and the media tools, and check
that nothing outside the folder is read, named or changed, and that
search counts no pending file outside it.
Assisted-by: Claude:claude-opus-5-5
* Resolve the access of a chat at every turn
A chat whose saved agent has a folder must reach only that folder. Up
to now every chat got the user's actor, which reaches the whole home.
The chat's access is now resolved from the stores at every turn
start. With no agent folder it is the actor and the view of today.
With a folder the actor is fenced to the agent's folder at its mode,
the chat's own folder read and write, and the shared folders and the
skill layers read only; the chat's folder is made before the fence,
because a fenced actor cannot make it. A sub-agent takes the folder
of its parent's agent, and its own agent's folder inside it.
A folder that is deleted, unreadable or not chosen refuses the chat
with ErrAgentFolderMissing; it never falls back to the whole home.
A chat records whether its agent had a folder, so a chat whose agent
was deleted is refused too. CreateAs refuses such an agent at once.
session.Access carries the actor and the view, has no exported fields
and one constructor. Open takes it, the turn tools are built from it,
and an open chat compares the fence as well, so an edit of the agent
restarts the harness at the next turn on any frontend. The person's
uploads and renames use the owner's actor, without the fence. The
files a command changed are read as the chat can read them.
Nothing is kept between turns, so frontends cannot disagree.
Assisted-by: Claude:claude-opus-5-5
* List a scoped chat's files by its place in the prompt
The turn prompt lists the chat's files with the paths the model uses.
For a chat whose agent has a folder those paths come from its mounts,
and a file the chat touched outside its folders, for example before
the agent got a folder, must not be named.
Manager.FilesIn is Files with a place. For a scoped place, each file
is named by its mount (/workspace/home for the agent's folder,
/workspace/chat for the chat folder) and a file outside every mount is
left out. Other places give what Files gives. The prompt's file list
uses the turn's place; the chats API keeps the user-wide list.
Assisted-by: Claude:claude-opus-5-5
* Answer 409 when an agent's folder is missing
A chat with a saved agent whose folder is missing or not chosen does
not start. The chat endpoints now say so with 409 and the type
agent_folder_missing, both when the chat is created and when a
message is sent to an open chat, instead of a server error.
The agent docs say what a chat with a folder reaches, when a change
of the folder applies, and that nothing is kept between turns.
Assisted-by: Claude:claude-opus-5-5
* Point a scoped chat at rules and work folders in its own folders
The rules nudge walked from the chat folder up to the home root and
named AGENTS.md files there, and the stray-helper note named the work
folder under /workspace/home. A chat whose agent has a folder must hear
only of its own folders.
The nudge takes the turn's access: it reads paths through the place,
starts at the primary folder (the agent's folder) and stops there, so
it never points above the folder or into the chat folder mount. The
helper note names /workspace/chat/work/ in a scoped chat, and a
sub-agent of a scoped parent gets the scoped work folder text.
Assisted-by: Claude:claude-opus-5-5
* Find workspace actors built outside the chat access
An actor built from a principal has no fence and reaches the whole
home. A spec now parses the studio service, the command runners, the
add-on host operations and the application wiring, and fails on a
workspace.Actor literal, a files.UserActor call or an Actor(principal)
call in a function that is not on the allowlist. Each allowed entry
says why: a host read of the user's settings, a user surface, or a
caller that a later change moves to the chat's access. An entry that
builds no actor any more fails the spec too, so the list stays exact.
Assisted-by: Claude:claude-opus-5-5
* Build the expected view of a chat with the view's folders
The spec of a chat without an agent folder compared its view with
BuildView called with the old arguments, so the test package did not
compile after the merge of the view builder. It now passes the home
as the primary folder and no chat folder, which is the view of an
unscoped chat.
Assisted-by: Claude:claude-opus-5-5
* Give every file tool of a turn the chat's resolved access
The resolver of a chat's access built the view of a scoped chat
itself, with no shared folders, while every other chat got its view
from the session manager. And the file tools, the media tools, the
chat's file list in the prompt, the rules nudge and the work folder
lines each asked for an access of their own, the view of the whole
home. A chat whose agent has a folder therefore had a fenced actor
but home-relative paths: it reached its folder only through paths
such as /Projects/Acme/a.txt, and its prompt named the home.
The session manager now builds every chat's view: UserAccess mounts
the home, and the new ScopedAccess mounts the agent's folder at home,
capped at the fence's mode, the chat folder at chat and the shared
folders read only. It refuses an actor without a fence, and a folder
outside the fence is an error, never a view of the home. The
resolver calls it with the innermost folder, so a sub-agent of a
saved agent still works in its own folder.
The access that the resolver builds once at the start of the turn
now goes down to every consumer. A sub-agent of a saved agent acts
for its parent chat with the same access (Access.ForChat), and a
generic sub-agent gets its tools from the parent's access. The seam
that gave the unscoped access, and the files service's own view
builder, are removed, so a new consumer cannot build a view by
mistake. A turn whose access has no folder gets no tools rather than
the home.
A scoped chat now sees its folder at /workspace/home and its chat
folder at /workspace/chat in its tools, its search, its prompt and
its work folder lines. A chat whose agent has no folder is unchanged.
Assisted-by: Claude:claude-opus-5-5
* Find chat views built outside the chat access
The turn's access is resolved once and handed down, but nothing
stopped new code from building a view of its own, which shows a
scoped chat the whole home. A second scan now parses the same
sources as the actor scan and fails on a call of BuildView,
SkillLayerMounts, NewAccess, UserAccess or ScopedAccess, or on a
store's View, in a function that is not on its allowlist. The
resolver is the one allowed caller; the host bash, the sandbox
runner and the add-on host operations are listed until they take
the chat's access. A stale entry fails the scan too.
Assisted-by: Claude:claude-opus-5-5
* Keep a sub-agent inside its parent's folder
A saved agent started from a scoped chat could name a folder
outside the chat's own, and the child was made before its first
turn failed with a message about a missing folder. spawn_agent now
checks the agent against the chat's agent from the stores before it
makes the child: no folder is fine, the same folder or one inside
it is fine, anything else fails with "this agent works in another
folder than this chat". The child never has more reach than its
parent, in folder or in mode.
The ScopedAgent flag of a sub-agent was reset to what its own
agent had at each turn. A child of a scoped chat with an agent
without a folder lost the mark, so deleting the parent's agent
would have given that child the whole home. The flag now follows
both folders.
New specs cover a generic child, a saved-agent child outside,
inside and at the parent's folder with the lower mode, a child
without a folder, and the work folder wording of a child of a
read-only or read-write parent.
Assisted-by: Claude:claude-sonnet-5-5
* Show agent folders in list_agents and limit them by scope
list_agents gave a scoped chat every saved agent, including ones
that spawn_agent would refuse, and told the model nothing about
where an agent works. Each entry now carries the name of the
agent's folder and its mode, or folder_missing when the folder is
deleted or not chosen. The path is left out, since it would show
the folders above the chat's own. A chat whose agent has a folder
lists only the agents that fit under that folder, by the same check
spawn_agent makes.
The docs for saved agents as sub-agents and for the agent folder
describe both.
Assisted-by: Claude:claude-sonnet-5-5
* Keep the triggers of a scoped agent to its folder
A chat of an agent with a folder reaches only that folder, but its
triggers still worked on the whole home. A file trigger could watch
any folder, the rules of a run were read from the home root down
with the user's actor, the first message named home paths, and a run
whose agent's folder was gone fell through to a failed chat start
after the host had already read the home's rules. The trigger tools
of a scoped chat could also list, change or propose triggers that
reach the whole home.
The agent's folder now bounds every step:
- Saving a file trigger (create, update, edit, confirm) refuses a
folder outside the agent's folder, and a trigger of an agent whose
folder is missing or not chosen.
- Each run checks the agent's folder before it reads anything. A
missing or unset folder skips the run with "the agent's folder is
missing" and switches the trigger off; a watched folder that is not
inside the agent's folder does the same with its own reason. No
chat is made and the owner is told.
- The folder check and the rules are read with an actor fenced to
the agent's folder, read only, so no AGENTS.md above it is read.
The rules of a schedule run start at the agent's folder. The first
message names folders and the file as the chat sees them, under
/workspace/home, and the rules nudge of the run's chat counts those
rules as given.
- In a scoped chat the trigger tools read folders as paths of the
chat's place, refuse one outside the agent's folder, and see only
the triggers of that agent.
The trigger watcher takes the service's administrator actor, made
once next to the change feed's, and the trigger functions leave the
actor scan's allowlist.
Assisted-by: Claude:claude-opus-5-5
* Send connector replies through the chat's access
The files a connector reply sends were listed from every change made
in the chat's name and read with the user's actor, so a reply of an
agent limited to one folder could send a file from anywhere in the
home that some host-side write had attributed to the chat. A message
to an agent whose folder was missing made or reopened a chat, failed
to start it, and answered with a generic error.
A reply now resolves the chat's access once, lists the turn's files
through its place (a file outside the chat's folders is left out)
and reads each one with its fenced actor. A file the access cannot
reach is skipped without being named. Before it makes a chat, a
message checks the bound agent's folder; when it is missing or not
chosen, the sender gets one reply, "This agent cannot work right
now: its folder is missing.", the refusal is logged and the binding
stays on. The same reply covers a folder that goes away between the
check and the turn. readChatFile leaves the actor scan's allowlist.
Assisted-by: Claude:claude-opus-5-5
* Name a read-only refusal of a commit by its guest path
The store names an upper entry that a read-only mount refused by
its path in the view (/home/x), not by its store path. The note
that a command's output ends with took every path but an
outside-view one for a store path, so it told the model that
"/home/x was not saved", a path the guest does not have. A path
that no mount holds but that starts with a mount name is now taken
as a path of the view and gets the /workspace prefix.
Assisted-by: Claude:claude-opus-5-5
* Take the actor and view of command runners from the chat's access
The host bash and the sandbox runner made their own actor and view:
the host bash a user actor from the principal and the view of the
whole home, the sandbox runner a plain actor by default and the view
from its own mount requests. Neither knew the chat's agent folder,
so a command of a scoped chat could reach the whole home.
The runner now has no default actor or view. Options.Actor takes a
context and returns an error, and Options.View returns the view
itself; both are asked at every call. A view of another actor than
the chat's is refused, and a sandbox whose actor or mounts changed
is made again, so an agent's new folder or mode applies from the
next command. A failing resolver fails the call, also with a sandbox
running.
The server wires both hooks to the chat's resolved access: the new
Service.CommandActor and Service.CommandView, the latter refusing an
actor that is no longer the chat's. Access.SandboxView adds the skill
layers to the turn's view, at the names the file tools use. The host
bash refuses a fenced actor, at the tool and again at each call, as a
command on this machine reads what the server can read. The Sandbox
add-on passes a label actor and its home view: the host binds each
workspace operation to the call's chat.
The lane 5 entries leave the actor and view scan allowlists.
Assisted-by: Claude:claude-opus-5-5
* Offer no host bash to a chat whose agent works in one folder
A command of the built-in bash runs on this machine and reads every
file LocalAI can read. No workspace rule confines it, so a chat whose
agent works in one folder cannot have it, whatever chats_host_exec
says. The tool's build now refuses a fenced actor, so the chat gets
no bash, its prompt says nothing runs commands, and the shell group
of the Tools menu gives the reason: the agent works in one folder
and runs commands only in the Sandbox add-on. Sub-agents of such a
chat have the fenced actor too.
The docs of saved agents and of the commands on this machine state
the rule and the Sandbox layout of a scoped chat.
Assisted-by: Claude:claude-opus-5-5
* Tell a scoped chat where its Sandbox commands start and what they keep
The commands block of the prompt told every chat with the Sandbox
that a command starts in /workspace/home, the user's home, and that
what it saves there or in a writable shared folder is kept. In a
chat whose agent works in one folder, /workspace/home is that folder,
the chat folder is /workspace/chat and the shared folders are read
only. The block now says so, and with a read-only folder it names
only /workspace/chat as kept.
Assisted-by: Claude:claude-opus-5-5
* Name a scoped chat's attachments where its commands see them
The model learns of an attached file by its guest path, which was
always /workspace/home/Chats/<chat>/<file>. In a chat whose agent
works in one folder, /workspace/home is that folder: the file and
media tools still found the file through the place's chat alias, but
a command sees the chat folder only at /workspace/chat, so the path
named nothing for it.
The text the model gets now names a file of the chat folder at
/workspace/chat/<file> in a scoped chat, through the chat's place:
when a message is sent, queued or injected, in the summary of the
chat, and in the model state rebuilt after an edit, a regenerate, a
fork or an import. What is stored keeps the home spelling, which
SplitMessage reads back, and an unscoped chat is unchanged.
Assisted-by: Claude:claude-opus-5-5
* Remove the duplicated allowlist entries of the actor scan
Assisted-by: Claude:claude-opus-5-5
* Read and write the folder of an agent in the agent helpers
The agent API now answers an agent's folder with its path, mode and
state, and a write keeps the stored folder unless it names one. The
page helpers learn that shape: the folder field of a save is sent only
when the person changed it, an empty path clears it, a missing or
unset folder that the person did not replace is kept, and the mode is
read unless write was chosen. Small helpers say whether a listing
entry can be chosen (not a folder LocalAI manages, not a shared
folder), which folders agents use for the Files page marker, and
whether a chat error is the missing-folder conflict.
Assisted-by: Claude:claude-opus-5-5
* Move the folder walk of the Move dialog into a folder picker
The agent editor needs the same walk through the person's folders as
the Move dialog, so the breadcrumb and the folder list move into
FolderPicker, with their styles, and the Move dialog draws it. The
picker can show a folder as one that cannot be chosen, with the
reason next to it, and a folder that cannot be read now offers to try
again; a folder still loading says so instead of an empty list.
Assisted-by: Claude:claude-opus-5-5
* Choose the folder of an agent in the agent form
The agent form gets a Files section after the instructions: All my
files, or One folder chosen in the folder picker, and whether the
agent's chats can read the folder or read and change it. The picker
shows the folders LocalAI manages as ones that cannot be chosen, and
Home itself can be chosen. A folder that was deleted, or an imported
agent whose folder was not found, is said in place with an offer to
choose another; the rest of the form still saves and keeps it.
A save sends the folder only when the person changed it, so editing
another field never touches it. Picking One folder and choosing
nothing stops the save, as it would otherwise save an agent on all
the files. The Export section now downloads the file the server
writes, which names the folder, and says so.
Assisted-by: Claude:claude-opus-5-5
* Show the folder of an agent on the agents list and its page
An agent with a folder shows it in the list's line and on its page,
with its access in words and a lock when its chats can only read it.
A folder that is gone, or an agent with no folder chosen yet, shows
a warning that opens the form; the agent's page also says so above
its facts and offers to choose another folder.
Assisted-by: Claude:claude-opus-5-5
* Mark the folders that agents work in on the Files page
A folder that a saved agent works in gets a small marker with the
agent's name, or the number of agents, and a tooltip that names each
one with its access. Inside such a folder, a line over the list says
the same. The page reads the agent list it can already fetch, so the
files API is unchanged, and the page still shows all the files.
Assisted-by: Claude:claude-opus-5-5
* Show a chat's folder and say when its agent's folder is missing
A chat with an agent that has a folder shows the folder next to the
agent in the message box, with a lock for read only, and the Tools
menu says which files the chat's tools reach. When the folder is
gone, the chip says so and opens the agent's form.
A chat whose agent's folder is missing does not start, and the server
answers with a conflict. The message box now says that in plain words,
keeps the message, and offers Edit agent, instead of the server's
text.
Assisted-by: Claude:claude-opus-5-5
* Test the folder of an agent across the web interface
The agent stubs now list folders by path, read a written folder back
as the server does, export a version 2 file for an agent with a
folder, import one whose folder is not found as unset, and refuse to
start a chat whose agent's folder is missing.
The specs choose a folder and see it on the list, switch the access,
leave an unchanged folder out of the save, clear it, keep and replace
a missing folder, keep Chats and LocalAI out of the picker, retry a
folder that cannot be read, see the Files marker, the chat's chip and
Tools line, the missing-folder chat error with Edit agent, and the
import warning. A render smoke opens the picker on the real server,
and one spec checks that the copy names no internal path.
Assisted-by: Claude:claude-opus-5-5
* Describe the agent's folder in the web interface
The agent docs said what the folder field does in the API. They now
also say where the web interface sets it, how the agents pages, the
Files page and a chat show it, and what a chat whose folder is
missing offers.
Assisted-by: Claude:claude-opus-5-5
* Record the chat an add-on call was made for
An add-on's workspace operations run as the user of the live request,
with no idea which chat made it. Only an action carries a chat, and
only as a key in its resource ID; a read tool such as the Office
add-on's read-docx carries none. So a chat that should reach only one
folder could reach the whole home through an add-on.
The in-flight record of a request now keeps, next to the envelope, a
binding to the chat the request was made for: the user's principal
and the chat ID. It is host-side only and never a field of the
envelope, which installed add-ons decode with unknown fields refused.
A context carries the binding from the chat turn to the place that
records the request. The broker gives each host operation the chat
and the scope of its live request. An operation ID that requests of
two chats share is not live, so neither chat is trusted.
Assisted-by: Claude:claude-opus-5-5
* Keep the chat binding of a runtime call on the host
The runtime client records each call's envelope for the host operation
channel. It now records the chat binding too when the call's context
carries one, so the add-on's host operations know which chat made the
request. The envelope sent to the add-on is the same bytes with or
without a binding: a spec checks that the body of a bound call equals
the body of an unbound one and still decodes with unknown fields
refused.
Assisted-by: Claude:claude-opus-5-5
* Carry the chat binding in a forwarded add-on request
A frontend that is not the add-on owner forwards an add-on call in a
signed request. The chat the call was made for now rides in that
request as a signed field, chat, and the owner puts it back on the
context of the call it serves, where the runtime client records it.
A changed, added or removed binding fails the signature check, and a
signed but incomplete one is refused. A request that no chat made has
no chat field and signs as before.
An owner that does not know the field refuses a forwarded call that a
chat made, so the owner must be upgraded before the frontends.
Assisted-by: Claude:claude-opus-5-5
* Bind every add-on tool call of a chat to the chat
The chats consumer ran an add-on tool with the conversation ID only,
which the owner used to resolve a selection and, for an action, as the
key of the add-on's state. Nothing told the host which chat a read
tool or a change came from.
The tool adapter now has ExecuteChat, which takes a ChatCall (the
chat's user and ID, from the chat turn's own record) and binds the
call to the chat on the host side for every tool kind: a read with no
resource, an action, and a change made at once. The chats adapter
refuses a call that names a conversation without that binding, so a
chat's call cannot be made unbound by mistake. Other consumers, such
as the OpenAI-compatible route, keep calling without a binding.
Assisted-by: Claude:claude-opus-5-5
* Run add-on workspace operations with the chat's access
The workspace operations of add-ons (materialize, commit, changes,
export and import) worked on the whole home of the request's user. A
chat whose agent has a folder could therefore read and write any file
through the Office or Sandbox add-on.
They now resolve their access from the chat binding of the live
request, through a new Access hook that the chats service answers
(Service.AddonAccess). A chat's call gets the chat's access, as its
file tools do: in a chat whose agent has a folder, the add-on's "/" is
that folder, /workspace/chat names the chat folder, the agent's mode
applies, and paths resolve through the chat's place, so a parent
reference is refused and an encoded separator is part of a name. The
mounts go through Access.SubView, which builds a view only inside the
access, for its fenced actor. When an add-on mounts its "/" at home,
the host adds the chat folder at chat, so the Sandbox sees the chat's
layout without a change. Changes list only what the access may read,
and a commit entry outside the view is a conflict.
A call whose chat cannot be resolved is refused and never runs
user-wide. An action request without a binding is resolved by its
chat key, as before, and refused when it names no chat. A call that
no chat made (an add-on page, the OpenAI-compatible route) still works
on the whole home, through Manager.PersonAccess.
The four lane 6 entries leave the actor scan and the view scan.
PersonAccess joins the view scan's matcher, with AddonAccess as its
one allowed caller. An end-to-end spec runs the real Office and
Sandbox add-ons in a scoped chat.
Assisted-by: Claude:claude-opus-5-5
* Build the chat access of the file index route test
files.Service.Tools takes a session.Access since the chat access
change, so the route test of the text index passed a bare actor and
its package did not compile under the auth tag.
The test now builds the access as the chats service does for a chat
whose agent has no folder: the user's home as the primary folder of
the view, then session.NewAccess. The assertions are unchanged.
Assisted-by: Claude:claude-opus-5-5
* Test the folder of an agent through every surface of a chat
The specs of the folder feature each test one surface. This suite
runs one chat of an agent limited to a folder through all of them at
once, on an indexed SQL workspace: the file and media tools, the search
and its pending count, a command of the Sandbox in a fake sandbox, a
read call and an action call of an add-on through the real workspace
operations bound to the chat, a generic and a saved sub-agent, the
trigger tools, a file trigger run, a connector reply, a renamed folder,
a mode change, an edit that narrows the folder (also seen by a second
frontend) and a deleted folder.
The files outside the folder hold a token that the scripted model never
writes. After each spec the suite collects every text a person or a
model can see: tool results and errors, prompts, messages, transcripts
with their cards, live events, chat file lists, tool panels,
notifications, connector replies and files, the add-on's data directory
and the connector log. The token must be in none of them, and the files
outside must be unchanged.
A control spec runs the same probes from an agent without a folder and
checks that they do find the token, so the probes and the collection
cannot pass by seeing nothing.
Assisted-by: Claude:claude-opus-5-5
* Complete the docs of the folder of an agent
Each change of the folder feature documented its own part. This
makes the pages one account of it:
- Saved agents: the missing and unset states in one bullet, what the
folder does not limit (MCP servers, web tools, collections, pages),
that the Files page stays user-wide, when an edit applies, the
downgrade caveat, and the folder as a stateless row of the cluster
table. The Sandbox of a scoped chat mounts the agent's folder and the
chat folder only, as the add-on asks for them; the page said it also
had the shared folders and skills.
- Chats: the chat folder at /workspace/chat for the model, sub-agents
of a scoped chat, and commands only in the Sandbox.
- Add-ons: the Sandbox and Office sections say what / is in a chat whose
agent has a folder.
- First agent: the optional folder step and the "Folder missing" case.
Assisted-by: Claude:claude-opus-5-5
* Draft the PR description and release note of agent folders
No release notes file exists for the next release yet, so the draft
text lives next to the spec and the plan. It carries the release note
paragraph with the downgrade caveat and the upgrade order of a cluster.
Assisted-by: Claude:claude-opus-5-5
* List the chat binding specs in the per-report add-on inventories
The chat binding change added five specs to the gateway and runtime
packages and named them in the case lists of the gateway, artifacts and
apps suites. These three suites also keep one case list per Ginkgo
report, and the verifier compares each report with its own list. The
new names were missing there, so the three suites failed with an
inventory mismatch.
A dry run of every Ginkgo suite's commands now lists the same It names
as each report's inventory, in both directions.
Assisted-by: Claude:claude-opus-5-5
* Hide stale paths from a fenced actor's history
A folder moved into a fence makes its parent identities readable.
Their historical paths can still name locations outside the fence.
Hide each historical side when its readable parent's current path
differs. Reuse the generic title when filtering hides a side. Keep
the journal and unfenced history unchanged so Undo uses identities.
Assisted-by: nib:gpt-6.1-sol
* List the chat binding cases in Tables tools
The Tables tools runner includes every adapter spec in its output.
List the four chat binding cases so the exact inventory accepts them.
Assisted-by: nib:gpt-6.1-sol
* Keep shared agent folders unset in exports
A followed folder outside the home cannot round-trip through a home path.
Export its mode with an empty path so import warns and stays fail-closed.
Responses keep public shared paths without exposing other internal paths.
Distinguish deleted scoped agents from unscoped agents in the guidance.
Assisted-by: nib:gpt-6.1-sol
* Refuse scoped chats over the folder limit
Keep every required shared root in each intersecting fence. Refuse
creation and turn access when the complete set exceeds 32 roots.
Reserve a chat root before its folder exists and fence listings empty
on refusal. Propagate shared enumeration failures instead of omitting
roots.
Map capacity refusals to a fixed 409 response and give connectors a
safe capacity message. Check boundaries, retries, background access,
and HTTP handlers with focused regressions.
Assisted-by: nib:gpt-6.1-sol
* Verify unset imports refuse chat startup
Assert the folder-specific refusal without a harness start or saved chat.
Clarify public response paths and unset exports in the API metadata.
Assisted-by: nib:gpt-6.1-sol
* Keep the folder retry test under user control
A background refresh consumes the one-shot successful response before
this test observes its load error. Isolate the mocked Files page from
the live workspace stream and agents list. Keep reads failing until
the error assertions pass, then allow the actual Retry click to recover.
Check that Retry reads again and removes the error, without changing
the existing assertions or their timeouts.
Assisted-by: nib:gpt-6.1-sol
* Test and document folder capacity refusals
Use the existing Ginkgo suites for capacity regressions. Exercise a
successful turn, refusal after shares change, and a retry through a
second service on the same stores. Check that refusal leaves no claim
or pending message.
Verify that connectors send one fixed refusal and that triggers stay
enabled after capacity failures. Document the 32-root budget and the
all-required-roots-or-refuse contract.
Assisted-by: nib:gpt-6.1-sol
* Control crashes in the restart budget test
The crash fixture exits after 100 ms, before startup necessarily finishes.
A busy runner can fail the readiness handshake instead of testing restarts.
Start a normal fixture and kill each published incarnation explicitly.
Keep the exact restart count and persistent failed-state assertions.
Assisted-by: nib:gpt-6.1-sol
* Check capacity test cleanup errors
Assert service and workspace cleanup through Ginkgo. Keep service cleanup before workspace cleanup and report close failures instead of discarding them.
Assisted-by: nib:gpt-6.1-sol
---------
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
4598 lines
327 KiB
JSON
4598 lines
327 KiB
JSON
{
|
|
"prerequisites": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/prerequisites_test.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"missing-go",
|
|
"old-go",
|
|
"future-go",
|
|
"old-node",
|
|
"wrong-node",
|
|
"wrong-protoc",
|
|
"absent-generated",
|
|
"empty-name",
|
|
"future-suite",
|
|
"empty-selection",
|
|
"failed-child",
|
|
"failed-case-named",
|
|
"failed-tail-kept",
|
|
"zero-tests",
|
|
"skipped-tests",
|
|
"exact-tag-pin",
|
|
"wrong-tag-sum",
|
|
"ginkgo-empty",
|
|
"ginkgo-skipped",
|
|
"ginkgo-missing",
|
|
"ginkgo-failed-spec-named",
|
|
"ginkgo-failure-message",
|
|
"browser-setup-failure",
|
|
"configured-browser-missing",
|
|
"configured-browser-setup",
|
|
"contracts-empty",
|
|
"contracts-skipped",
|
|
"gateway-missing-report",
|
|
"gateway-skipped-report",
|
|
"ui-report-failed",
|
|
"ui-report-skipped",
|
|
"ui-report-flaky",
|
|
"ui-report-empty",
|
|
"ui-report-missing",
|
|
"leak-ignores-command-line",
|
|
"leak-finds-working-directory"
|
|
],
|
|
"readiness": {
|
|
"ginkgo": {
|
|
"command": [
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"<temporary SQLite probe>",
|
|
"-ginkgo.json-report=<unique report>"
|
|
],
|
|
"cases": [
|
|
"sqlite transaction"
|
|
]
|
|
},
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/prepare.sh",
|
|
"--check"
|
|
],
|
|
[
|
|
"tests/e2e-ui/ui-test-server",
|
|
"--mock-backend=<absolute mock-backend>",
|
|
"--port=<isolated port>"
|
|
],
|
|
[
|
|
"core/http/react-ui/node_modules/.bin/playwright",
|
|
"--version"
|
|
],
|
|
[
|
|
"node",
|
|
"--input-type=module",
|
|
"-e",
|
|
"<browser readiness probe>",
|
|
"<healthy server URL>"
|
|
]
|
|
],
|
|
"cases": [
|
|
"toolchain",
|
|
"server health",
|
|
"browser"
|
|
]
|
|
}
|
|
},
|
|
"contracts": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./pkg/addons/contract",
|
|
"-ginkgo.json-report=../../../.cache/addons/logs/contracts.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"accepts independent service tool page and chat capabilities",
|
|
"rejects invalid namespace IDs and executable paths",
|
|
"rejects add-on IDs that the host serves as a route segment",
|
|
"rejects invalid versions ranges and capabilities",
|
|
"rejects unknown duplicate trailing and oversized manifest JSON",
|
|
"rejects incompatible host API protocol SDK data and platform fixtures",
|
|
"validates UI only when declared and rejects inconsistent contributions",
|
|
"uses canonical version one wire fixtures",
|
|
"rejects incomplete expired or forged authority shapes",
|
|
"rejects unknown and oversized wire payloads",
|
|
"validates finite defaults overrides and cross field bounds",
|
|
"validates preview receipt states and output descriptions",
|
|
"accepts the apps surface fields and keeps headless manifests valid",
|
|
"rejects unknown and reserved launch modes",
|
|
"rejects remote data absolute and traversing icon paths",
|
|
"requires the main page to be one of the declared pages",
|
|
"bounds localized titles and descriptions and rejects markup",
|
|
"requires the existence tool of an addon whose resources are created or deleted",
|
|
"reserves the segments of the navigation routes",
|
|
"refuses an add-on that needs a newer SDK than the host provides, and says so",
|
|
"accepts a range that contains the host SDK",
|
|
"accepts a range that spans the host SDK",
|
|
"refuses an add-on built for SDK 1 only on a version 2 host",
|
|
"keeps the generic message for a range that is malformed",
|
|
"accepts a read tool that names no resource",
|
|
"keeps a create tool free of the resource argument",
|
|
"refuses a read tool that offers the resource without requiring it",
|
|
"refuses a write or schema tool without a resource",
|
|
"still accepts a read tool that requires its resource",
|
|
"still accepts a write or schema tool that requires its resource",
|
|
"accepts a pull kind with a declared page",
|
|
"accepts drafts and a preview interval within the bounds",
|
|
"lets an add-on declare nothing but the connector",
|
|
"no kind",
|
|
"a bad kind id",
|
|
"a repeated kind",
|
|
"markup in the title",
|
|
"an unknown delivery",
|
|
"a page the UI does not declare",
|
|
"a preview interval too short",
|
|
"a preview interval too long",
|
|
"is valid when the add-on says it acts",
|
|
"is refused when the add-on does not say it acts",
|
|
"leaves the other kinds alone",
|
|
"cuts a long name on a character boundary",
|
|
"a plain name",
|
|
"a path keeps its last element",
|
|
"a Windows path",
|
|
"control characters and quotes",
|
|
"dots only",
|
|
"empty",
|
|
"a hidden name loses its leading dot",
|
|
"a long name keeps its extension",
|
|
"is a valid scope for an action request",
|
|
"is refused for any other request, and an action request refuses any other scope",
|
|
"has a long timeout of its own that is not part of the limits an add-on receives",
|
|
"accepts an action tool that names no resource, and refuses one that offers it without requiring it",
|
|
"keeps the argument names of identity and approval out of an action tool",
|
|
"round-trip",
|
|
"unknown field",
|
|
"duplicate key",
|
|
"trailing",
|
|
"not an object",
|
|
"empty",
|
|
"refuses an oversized body",
|
|
"finetune.get",
|
|
"quantize.start",
|
|
"finetune.a.b",
|
|
"empty",
|
|
"no dot",
|
|
"leading dot",
|
|
"uppercase",
|
|
"trailing space",
|
|
"slash",
|
|
"trailing newline",
|
|
"hyphen",
|
|
"empty verb",
|
|
"too long",
|
|
"bash is replaceable",
|
|
"web_search and web_fetch are replaceable",
|
|
"a file tool is not",
|
|
"an unknown name is not",
|
|
"a page-only tool cannot shadow",
|
|
"two tools cannot shadow one name",
|
|
"a shadow of bash must be an action tool",
|
|
"a shadow of web_fetch must be a read tool",
|
|
"a shadow of bash must declare command",
|
|
"a shadow keeps the type of a required property",
|
|
"a shadow requires no property the built-in does not",
|
|
"a shadow names no resource",
|
|
"extra optional properties are allowed",
|
|
"lists only the shadows that pass the check",
|
|
"keeps the file tools off the replaceable list",
|
|
"parses skillDefinitions from the manifest",
|
|
"accepts the add-on id and names that start with it",
|
|
"refuses a bad name, naming it",
|
|
"refuses a name declared twice",
|
|
"refuses more than 16 skills",
|
|
"refuses a plain name that does not start with the add-on id",
|
|
"refuses a plain name that is a built-in skill, whatever the add-on id",
|
|
"accepts a skill that replaces a replaceable built-in skill by its name",
|
|
"refuses shadows that does not repeat the name, or names a skill that may not be replaced",
|
|
"keeps the built-in names covered: each is replaceable or protected, never both",
|
|
"keeps the replaceable skills and tools apart, so one pin map holds both",
|
|
"accepts a read tool without a resource",
|
|
"refuses one that works on a resource or is not a read: the page has no resource to name",
|
|
"is resourceless like any read without a resource",
|
|
"has the same IDs as the registry of the React UI",
|
|
"accepts known controls and refuses an unknown or repeated one",
|
|
"reads ui.controls from a manifest and refuses an unknown field in it",
|
|
"draws the network policy only for an add-on granted egress that runs bash",
|
|
"serves a second add-on with the same controls, by its grant and not by its name",
|
|
"draws the tool providers for an add-on that replaces any built-in tool"
|
|
],
|
|
"report": ".cache/addons/logs/contracts.json"
|
|
},
|
|
"catalog": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/catalog",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/catalog.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"fetches private bearer and basic catalogs without OCI credentials",
|
|
"blocks redirects without leaking credentials or error details",
|
|
"reports refresh failures rather than serving stale success",
|
|
"resolves the host platform from a multi platform catalog",
|
|
"selects exact configured owner targets and rejects absent or ambiguous targets",
|
|
"requires authoritative administration for all source edits",
|
|
"persists protected references and removes sources without touching installs",
|
|
"invalidates cached releases on explicit source changes",
|
|
"rejects secret URLs invalid digests duplicate identities and malformed catalogs",
|
|
"refuses a library entry whose add-on ID is a host route segment",
|
|
"lists and gets protected source copies including disabled and empty sources after reload",
|
|
"requires current authoritative administration and context for source reads",
|
|
"serializes source reads with concurrent configuration edits",
|
|
"pins channels and restricts package transport to secure or opted in loopback origins",
|
|
"surfaces optional UI metadata in search results and resolutions without changing plain entries",
|
|
"rejects entries with remote icons, reserved launch modes, markup or overlong display text",
|
|
"lists only releases the configured target platform can install",
|
|
"keeps the compatibility hint of an entry and refuses a malformed range",
|
|
"lists the releases of one add-on for every platform, from the cache, and refuses a failed library",
|
|
"names an unavailable credential reference as a credential failure inside the refresh failure",
|
|
"reads a YAML list of releases with the documented fields",
|
|
"accepts an empty library written as an empty list",
|
|
"refuses a JSON index",
|
|
"refuses an unknown field, at the top and inside ui",
|
|
"refuses a second document, a mapping, an empty body and a duplicate key",
|
|
"refuses duplicate identities",
|
|
"enforces the release count and the size limit",
|
|
"resolves the tag at install and builds the version from the digest",
|
|
"refuses a tag that cannot be resolved or a answer that is not a digest",
|
|
"keeps a pinned entry as it is and never looks it up",
|
|
"refuses an entry that is neither mutable nor pinned, and a mutable one that has a digest",
|
|
"refreshes an index with an unknown kind and reports what it skipped",
|
|
"lists add-ons by default and backends on request",
|
|
"resolves a backend only as a backend",
|
|
"refuses entries that mix the fields of the kinds",
|
|
"accepts an anchored identity pattern and refuses a loose one",
|
|
"has an entry for every enabled platform of every add-on",
|
|
"a release tag",
|
|
"a release candidate",
|
|
"a source build",
|
|
"a commit after a tag",
|
|
"a bare commit",
|
|
"a version that could escape the URL",
|
|
"moves a stored official library to the index of the new build",
|
|
"leaves an official library the admin pointed at another URL",
|
|
"reads an index written before kinds existed, and the entry is an add-on",
|
|
"reads a backend entry on a reader that knows backends",
|
|
"skips a backend entry on an add-on only reader and says so",
|
|
"skips an unknown kind without reading its fields, and keeps the rest",
|
|
"skips the reserved model kind in this phase",
|
|
"reports the id of a skipped entry, written as id or as the legacy addonId",
|
|
"reads a backend entry that still uses the legacy addonId, and refuses one that has both",
|
|
"still refuses an unknown field on an entry of a known kind",
|
|
"refuses a malformed kind",
|
|
"reads every new field and keeps it",
|
|
"keeps the reader strict about an unknown field of the backend kind",
|
|
"refuses a license, urls, tags, icon, mirrors or capabilities on an add-on",
|
|
"refuses a schemaVersion this host does not know",
|
|
"is a URL, and the host does not fetch it",
|
|
"must be an https URL with a host and no credentials",
|
|
"is not the icon of the add-on UI, which stays a path in the package",
|
|
"refuses a url that is not http or https",
|
|
"refuses too many urls and too many tags",
|
|
"refuses a tag or a license with a control character or a length over the bound",
|
|
"keeps the order",
|
|
"refuses a mirror that is not an oci image, a duplicate, the artifact itself, and too many",
|
|
"refuses a malformed capability name or backend name",
|
|
"has capabilities and no artifact, digest or platform, and is listed for every platform",
|
|
"cannot carry an artifact-only field",
|
|
"needs capabilities: an entry with no artifact and none is refused",
|
|
"is not a meta backend when it has an artifact",
|
|
"keeps its tag, has no digest and is listed",
|
|
"is refused with a digest, and an entry with no digest is refused unless it is mutable",
|
|
"is accepted on an add-on without a digest, as on a backend",
|
|
"is refused on an add-on with a digest, without a digest unless mutable, or on an archive",
|
|
"reads an index of more than a thousand entries",
|
|
"encodes and decodes an entry with the new fields unchanged",
|
|
"reads the legacy addonId as id, and refuses an entry that has both",
|
|
"carries the built-in tools an add-on replaces, and refuses one that may not be replaced",
|
|
"carries the built-in skills an add-on replaces, and refuses one that may not be replaced",
|
|
"carries toolCount and tools from the index to the listing",
|
|
"leaves both fields out for an entry without chat tools",
|
|
"keeps a count above the listed names when the names are capped",
|
|
"refuses a malformed hint",
|
|
"lists the first-party add-ons, one entry for each platform, in the library format",
|
|
"is a valid, signature-requiring source",
|
|
"is added when there is no sources.json and is written to it",
|
|
"keeps a sources.json the admin already has",
|
|
"does not add the default again after the admin removed it",
|
|
"seeds only once per instance",
|
|
"refuses an entry two of your sources list, and excludes disabled sources"
|
|
],
|
|
"report": ".cache/addons/logs/catalog.json"
|
|
},
|
|
"packages": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/packages",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/packages.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"stages verified HTTP bytes and commits immutable receipts without activation",
|
|
"rejects untrusted integrity forged releases and digest mismatches",
|
|
"rejects traversal links collisions and excessive extraction",
|
|
"rejects cancellation disk full and preserves existing packages",
|
|
"rejects platform data API SDK and missing asset mismatches",
|
|
"pins and verifies real local OCI distribution bytes without a container runtime",
|
|
"rejects downloaded digest mismatch redirects cancellation and file count limits",
|
|
"accepts optional UI only with real immutable assets and rejects non executable entrypoints",
|
|
"does not allow remote verification policy to replace owner trust",
|
|
"requires source opt in before any plaintext OCI request",
|
|
"bounds compressed OCI PAX expansion before tar parsing",
|
|
"bounds compressed OCI GNU expansion before tar parsing",
|
|
"counts padding trailing bytes and layers at the exact expanded boundary",
|
|
"denies nonloopback plaintext and redirect responses at the transport boundary",
|
|
"bounds expanded bytes cumulatively across real OCI layers",
|
|
"bounds sparse logical output across files and layers preserving old packages",
|
|
"accepts exact sparse output budget and cancels synthesized writes",
|
|
"stages real trusted signatures and rejects signed identity digest and trust mismatches offline",
|
|
"records the digest of a packaged immutable icon in the receipt and refuses unusable icons",
|
|
"installs from the old repository per add-on",
|
|
"installs from the shared repository with an id-prefixed tag",
|
|
"follows a digest-pinned blob redirect without the registry credential",
|
|
"still verifies the digest of the redirected bytes",
|
|
"refuses a plaintext redirect to a host name instead of a loopback address",
|
|
"installs by a digest resolved at install, and the receipt records it",
|
|
"checks the signature against the resolved digest",
|
|
"is refused when the tag cannot be resolved or resolves to something that is not the image",
|
|
"refuses an entry that has no digest and is not mutable",
|
|
"accepts a good skills tree and records every file with its digest",
|
|
"reads the skills back for the copy, checked against the receipt",
|
|
"refuses a file added after commit",
|
|
"has nothing to copy for a package without skills",
|
|
"refuses a declared skill without a folder, and a folder that is not declared",
|
|
"refuses a skills folder when the manifest declares none",
|
|
"refuses a folder without SKILL.md and bad frontmatter",
|
|
"refuses links, executable files and special entries",
|
|
"refuses scripts and other file types",
|
|
"refuses names that are not plain lowercase ASCII",
|
|
"refuses text that is not UTF-8 or holds a NUL",
|
|
"refuses oversize files, deep paths and too many files",
|
|
"is for backend sources only: an add-on install refuses it",
|
|
"installs the darwin/amd64 child of an index with four platforms",
|
|
"installs the darwin/arm64 child of an index with four platforms",
|
|
"installs the linux/amd64 child of an index with four platforms",
|
|
"installs the linux/arm64 child of an index with four platforms",
|
|
"refuses an index that does not list the host platform",
|
|
"refuses a child whose digest differs from the one the index lists",
|
|
"still installs a single manifest and refuses a different digest"
|
|
],
|
|
"report": ".cache/addons/logs/packages.json"
|
|
},
|
|
"lifecycle": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons",
|
|
"-ginkgo.json-report=../../../.cache/addons/logs/lifecycle.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"recovers every durable journal boundary without replaying publication",
|
|
"removes abandoned staging without removing published packages on recovery",
|
|
"keeps immutable history on successful upgrade and reinstallation",
|
|
"excludes competing owners and rejects conflicting durable identities",
|
|
"never opens replica roots or elects an absent owner",
|
|
"binds duplicate operation IDs to actor and command and serializes conflicts",
|
|
"refuses commands and asset reads for an add-on ID the host serves as a route",
|
|
"retains generations identity data and grants across uninstall and restart",
|
|
"preserves old packages and active generation on manager upgrade failure",
|
|
"requires current authoritative administration even for idempotent retries",
|
|
"rejects symlinked package roots without touching external staging",
|
|
"executes enabled owner intent on startup and stops on disable and close without forwarder execution",
|
|
"retries runtime synchronization after canceled disable and generation upgrade",
|
|
"binds lifecycle lookup to current admin and original actor without writes or repair",
|
|
"cancels status lookup while a lifecycle writer holds the journal lock",
|
|
"denies enable and disable for a stale generation without recording anything",
|
|
"lists the identifiers of installed addons, disabled ones included",
|
|
"refuses to list installed identifiers while recovery is required",
|
|
"lists apps by visibility and serves an icon only for a visible app at its generation",
|
|
"reports the supervisor state of an app through a crash and a restart",
|
|
"reads a flat directory in batches and stops at the entry bound",
|
|
"adds up nested files and reports a complete walk as not truncated",
|
|
"never follows or counts a symbolic link",
|
|
"keeps a result for a short time so polling does not walk again",
|
|
"stops at the time bound and reports a truncated size",
|
|
"does not keep a result cut short by the caller",
|
|
"is what the installed view reports for the data directory",
|
|
"resolves a package for the current enabled generation and digest only",
|
|
"answers from the current installed manifest only and follows a generation change",
|
|
"reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
|
|
"refuses a second operation ID for the same transition, in flight or done, and applies it once",
|
|
"runs concurrent requests with one operation ID once and gives each the same answer",
|
|
"serializes conflicting upgrades by the installed digest and refuses the loser without a record",
|
|
"refuses a candidate that is not the one the library resolves now",
|
|
"refuses an upgrade to the digest that is already installed",
|
|
"rechecks compatibility at execution and refuses an incompatible candidate",
|
|
"selects a newer immutable version and treats a rewritten version as an integrity error",
|
|
"keeps the last good generation when the candidate cannot be staged",
|
|
"never switches the library or channel, and a failed check is never up to date",
|
|
"lets an administrator refresh and everyone with the feature read a redacted status",
|
|
"shows the pending update in the apps list from the cache only",
|
|
"does not accept pins without an update checker or on another action",
|
|
"keeps the unpinned typed upgrade of an earlier release working",
|
|
"carries the SDK refusal text to the caller of a failed install and keeps the generic error",
|
|
"installs an add-on whose SDK range contains the host SDK",
|
|
"upgrades an installed add-on through the same path as a manual upgrade",
|
|
"does nothing when no newer version is listed",
|
|
"refuses a candidate whose package no longer matches its listed digest and replaces nothing",
|
|
"refuses a candidate that fails the signature policy of its library and replaces nothing",
|
|
"does not upgrade to a release the host cannot run",
|
|
"does nothing without an update checker",
|
|
"keeps the manual upgrade closed to a caller who is not an administrator",
|
|
"copies them at install, upgrade and owner start, and removes them at uninstall",
|
|
"never fails the operation when the copy fails",
|
|
"fails the install and says the package could not be verified, without installing anything",
|
|
"names a release that the library does not list",
|
|
"names two libraries that list the same add-on",
|
|
"names a library that cannot be read",
|
|
"reads the library on demand when the startup refresh has not filled the cache",
|
|
"reads the library again when the startup refresh failed",
|
|
"writes the owner and storage only, with no address",
|
|
"loads a file written in the old format with an address",
|
|
"loads when only the address changed",
|
|
"refuses a changed owner ID",
|
|
"refuses a changed storage ID",
|
|
"copies every capability field of the manifest, so a new field cannot be forgotten",
|
|
"is offered when the tag moved, pinned to the build the tag names, and upgrades to exactly that build",
|
|
"refuses the upgrade when the tag moved again after the check, and installs nothing",
|
|
"stamps the first install, keeps the time over an upgrade and stamps it again after an uninstall",
|
|
"needs a state root for the owner only",
|
|
"starts the enabled add-ons side by side, so the start takes the slowest ones and not the sum"
|
|
],
|
|
"report": ".cache/addons/logs/lifecycle.json"
|
|
},
|
|
"runtime": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/runtime",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/runtime.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"registers only ready generation bound service headless and UI capabilities",
|
|
"rejects forged registration nonloopback and stale incarnation handshakes",
|
|
"bounds readiness and handles exit during start and stop",
|
|
"withdraws immediately drains boundedly and rejects stale process identities",
|
|
"exhausts restart budget without retaining dead registrations",
|
|
"does not inherit secrets and exits when the private parent channel closes",
|
|
"rejects foreign supervisor handles and numeric PID substitutions",
|
|
"resets restart budget only after sustained authenticated health",
|
|
"authenticates every request and separates trusted authority from model arguments",
|
|
"bounds output streams cancellation deadlines and stop admission",
|
|
"tells a 409 conflict of the add-on from an outage",
|
|
"rejects nonloopback endpoints and bounds oversized streams and concurrency",
|
|
"never reports failed between a launch starting and the restarted process being published",
|
|
"reserves a draining slot against concurrent starts",
|
|
"waits for a restart launch worker before acknowledging stop",
|
|
"exposes a new incarnation client after restart without reviving the old client",
|
|
"kills the exact paused child of a killed owner before launching its replacement",
|
|
"fails closed on ambiguous launch identities and preserves unrelated reused PIDs",
|
|
"retains a canceled restart slot until cleanup completes and rejects duplicate supervisors",
|
|
"refuses a missing established ledger and fences failed cleanup publication",
|
|
"withdraws and initiates every live slot before a cleanup timeout",
|
|
"reports stopped, running, failed, starting and running again across a crash and a restart",
|
|
"keeps reporting failed once the restart budget is exhausted",
|
|
"creates one private data directory per addon and passes its path in the startup object",
|
|
"gives no data directory without a data root and refuses an unsafe root or addon ID",
|
|
"gives an add-on that the host setting names a host endpoint of its own",
|
|
"gives an add-on that the host setting does not name no host endpoint",
|
|
"closes the host endpoint when the incarnation ends",
|
|
"an HTTP 400 answer",
|
|
"an HTTP 422 answer",
|
|
"keeps a bounded, printable reason and nothing else of the body",
|
|
"leaves 503, 500 and 404 as outages",
|
|
"types a withdrawn client, a full slot table, a bad envelope and a missing schema as not sent",
|
|
"keeps a not-sent error an ErrRuntime for callers that do not tell them apart",
|
|
"types a refused connection as not sent",
|
|
"never types a possibly-sent request as not sent",
|
|
"types the add-on's own 'forbidden' answer as a denial of the person, not as an outage",
|
|
"keeps a 403 about the envelope itself an outage: it is a host fault, not a permission",
|
|
"reaches an add-on that declares actions, as the actor of the envelope, under the act scope",
|
|
"never sends a call that is not an act call or has another scope",
|
|
"never sends an act call to an add-on that did not declare actions",
|
|
"stops an act call when the caller gives up",
|
|
"posts the request with the incarnation credential and decodes the answer",
|
|
"is not sent to an add-on that declared no connector",
|
|
"gives it time to release what it owns before it kills the process",
|
|
"kills an add-on that ignores the closing of its startup channel, within the grace period",
|
|
"goes to the log line by line with the add-on ID and a cap per line",
|
|
"records the chat with the envelope of a read and of an action while it runs",
|
|
"sends the add-on an envelope without a new field"
|
|
],
|
|
"report": ".cache/addons/logs/runtime.json"
|
|
},
|
|
"gateway": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/gateway",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/gateway.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/http/endpoints/addons",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/gateway-http.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"serves only declared installed generation assets and rejects traversal",
|
|
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
|
|
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
|
|
"propagates interrupted progress cancellation through the receiving frontend",
|
|
"validates finite relay budgets and prevents disabling polling bounds",
|
|
"builds a carrier only from complete pinned identities",
|
|
"types an unknown mutation outcome as unavailable without losing its operation",
|
|
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
|
|
"alternates pinned frontends and rejects untrusted certificates without local fallback",
|
|
"reports the original operation after lost mutation replies without retrying",
|
|
"rejects a stream longer than its receiving frontend budget",
|
|
"rejects a CA signed peer without a pin on the owner side",
|
|
"refuses an owner whose CA signed certificate is not the pinned owner",
|
|
"returns the artifact status through the owner from every frontend with one denial for the rest",
|
|
"types the owner's refusal and outage of a lookup the same from every frontend",
|
|
"writes an attachment header that cannot be broken out of",
|
|
"rotates the enforced audience on restart and rejects captured requests",
|
|
"never expires the response deadline after the relay returned",
|
|
"returns the owner's forbidden status for an invalid kind and for missing policy",
|
|
"still reports unavailable when the owner is unable to serve and not forbidden",
|
|
"reaches the same decision through both frontends and delivers bytes when allowed",
|
|
"keeps aborting when revocation happens after bytes were written",
|
|
"bounds progress, asset and file relays by their own limit",
|
|
"alternates real owner journal status and terminates coarse progress without submitting again",
|
|
"reports an account store outage as unavailable and a refused account as forbidden",
|
|
"rejects unknown lifecycle argument fields before touching the owner journal",
|
|
"reports a runtime that cannot serve as unavailable through both frontends",
|
|
"reports an output that ends before its first byte as unavailable",
|
|
"fails closed as unavailable for an unclassified owner error",
|
|
"keeps authorization and policy denials forbidden",
|
|
"keeps a mutation unknown when the runtime fails after the owner applied it",
|
|
"keeps a mutation unknown when the owner reports recovery required for its operation",
|
|
"reports a mutation as unknown when the owner cannot serve it at all",
|
|
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
|
|
"lets unavailability win when an error wraps both a denial and an unavailable cause",
|
|
"does not leak attachment headers into an error when the first read fails",
|
|
"treats every action except the known reads as a mutation",
|
|
"keeps resolved resources under admission for JSON and attachment bytes",
|
|
"closes interrupted output and releases admission on disconnect",
|
|
"rechecks revoked credentials during attachment copying",
|
|
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
|
|
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
|
|
"denies private relays without host resolution and admission",
|
|
"serves declared assets of the current enabled generation by package digest only",
|
|
"allows only an exact declared tool name and fails closed otherwise",
|
|
"never contacts the add-on for an undeclared tool and still serves a declared one",
|
|
"denies a repeated key at any depth however it is spelled",
|
|
"denies arguments that are not exactly one object",
|
|
"separates a denial from an unavailable declaration source",
|
|
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
|
|
"is the typed invalid request on the owner for a read, never an outage",
|
|
"is the typed invalid request on the owner for a proposal call",
|
|
"is the typed invalid request on the owner for a json relay",
|
|
"is the same typed answer from a forwarding frontend",
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"crosses the owner's wire as the same typed error, whatever the frontend",
|
|
"does not trust a code the host does not know, and cleans the detail the add-on wrote",
|
|
"is a stale view for a caller that only knows ErrStale, and a denial otherwise",
|
|
"is a mutation on the carrier: a lost answer is an unknown outcome, never a plain outage",
|
|
"runs on the owner for the actor the signature binds, and the typed direct dispatch still refuses it",
|
|
"keeps the answer of a call that outlasts the write timeout of the owner server",
|
|
"is an unknown outcome when the answer is lost",
|
|
"runs the backend-releases check for a pinned frontend without an actor",
|
|
"refuses a system call from a peer that is not pinned",
|
|
"never lets a system call change anything or ride the user-facing route",
|
|
"writes the set with private modes and no CA key",
|
|
"loads both roles into carriers and serves a frontend call from the owner",
|
|
"gives the owner no signing key and the frontend its own",
|
|
"accepts two frontends made from the same set",
|
|
"refuses a frontend from another generation",
|
|
"reads only the files of the role",
|
|
"refuses a key file with group or other access",
|
|
"refuses an unknown role",
|
|
"refuses to overwrite a file and leaves it unchanged",
|
|
"needs an owner host",
|
|
"says nothing was sent when the add-on is not running, instead of an unknown outcome",
|
|
"runs a declared action tool for the calling user, under the act scope, admitted as an add-on call",
|
|
"is not reachable through the typed dispatch of the direct API",
|
|
"refuses what is not a declared action tool",
|
|
"refuses an add-on that did not declare actions",
|
|
"is unavailable when the runtime does not serve action tools, and never runs for an unvalidated user",
|
|
"reports an unknown outcome, not a refusal, when the runtime fails after the call began",
|
|
"runs a resource-less read tool for the calling user only",
|
|
"denies a tool that declares a resource when none is given, and never reaches the add-on",
|
|
"denies a resource-less read when the admission cannot admit an add-on, or the tool is undeclared",
|
|
"keeps its address stable across starts",
|
|
"does not share state between different roots",
|
|
"fails clearly when the port is in use",
|
|
"rejects an invalid port file",
|
|
"rejects a port file with a loose mode",
|
|
"rejects a port file that links outside the root",
|
|
"is not permitted when the add-on denies the person, on the owner and on a forwarding frontend",
|
|
"is an unreachable resource when the policy denies it, on the owner and on a forwarding frontend",
|
|
"types the denial of a read like the denial of a write, on the owner and on a forwarding frontend",
|
|
"crosses the wire of a resource call typed, so a forwarding frontend answers like the owner",
|
|
"keeps any other failure to resolve a resource a plain denial, so nothing more is told",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"returns the same text through a forwarding frontend",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route",
|
|
"carries the chat binding signed and rejects a changed one",
|
|
"signs a request without a binding as before",
|
|
"gives the owner the chat the frontend bound the call to"
|
|
],
|
|
"report": ".cache/addons/logs/gateway.json",
|
|
"reports": [
|
|
{
|
|
"path": ".cache/addons/logs/gateway.json",
|
|
"cases": [
|
|
"serves only declared installed generation assets and rejects traversal",
|
|
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
|
|
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
|
|
"propagates interrupted progress cancellation through the receiving frontend",
|
|
"validates finite relay budgets and prevents disabling polling bounds",
|
|
"builds a carrier only from complete pinned identities",
|
|
"types an unknown mutation outcome as unavailable without losing its operation",
|
|
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
|
|
"alternates pinned frontends and rejects untrusted certificates without local fallback",
|
|
"reports the original operation after lost mutation replies without retrying",
|
|
"rejects a stream longer than its receiving frontend budget",
|
|
"rejects a CA signed peer without a pin on the owner side",
|
|
"refuses an owner whose CA signed certificate is not the pinned owner",
|
|
"returns the artifact status through the owner from every frontend with one denial for the rest",
|
|
"types the owner's refusal and outage of a lookup the same from every frontend",
|
|
"writes an attachment header that cannot be broken out of",
|
|
"rotates the enforced audience on restart and rejects captured requests",
|
|
"never expires the response deadline after the relay returned",
|
|
"returns the owner's forbidden status for an invalid kind and for missing policy",
|
|
"still reports unavailable when the owner is unable to serve and not forbidden",
|
|
"reaches the same decision through both frontends and delivers bytes when allowed",
|
|
"keeps aborting when revocation happens after bytes were written",
|
|
"bounds progress, asset and file relays by their own limit",
|
|
"alternates real owner journal status and terminates coarse progress without submitting again",
|
|
"reports an account store outage as unavailable and a refused account as forbidden",
|
|
"rejects unknown lifecycle argument fields before touching the owner journal",
|
|
"reports a runtime that cannot serve as unavailable through both frontends",
|
|
"reports an output that ends before its first byte as unavailable",
|
|
"fails closed as unavailable for an unclassified owner error",
|
|
"keeps authorization and policy denials forbidden",
|
|
"keeps a mutation unknown when the runtime fails after the owner applied it",
|
|
"keeps a mutation unknown when the owner reports recovery required for its operation",
|
|
"reports a mutation as unknown when the owner cannot serve it at all",
|
|
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
|
|
"lets unavailability win when an error wraps both a denial and an unavailable cause",
|
|
"does not leak attachment headers into an error when the first read fails",
|
|
"treats every action except the known reads as a mutation",
|
|
"keeps resolved resources under admission for JSON and attachment bytes",
|
|
"closes interrupted output and releases admission on disconnect",
|
|
"rechecks revoked credentials during attachment copying",
|
|
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
|
|
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
|
|
"denies private relays without host resolution and admission",
|
|
"serves declared assets of the current enabled generation by package digest only",
|
|
"allows only an exact declared tool name and fails closed otherwise",
|
|
"never contacts the add-on for an undeclared tool and still serves a declared one",
|
|
"denies a repeated key at any depth however it is spelled",
|
|
"denies arguments that are not exactly one object",
|
|
"separates a denial from an unavailable declaration source",
|
|
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
|
|
"is the typed invalid request on the owner for a read, never an outage",
|
|
"is the typed invalid request on the owner for a proposal call",
|
|
"is the typed invalid request on the owner for a json relay",
|
|
"is the same typed answer from a forwarding frontend",
|
|
"crosses the owner's wire as the same typed error, whatever the frontend",
|
|
"does not trust a code the host does not know, and cleans the detail the add-on wrote",
|
|
"is a stale view for a caller that only knows ErrStale, and a denial otherwise",
|
|
"is a mutation on the carrier: a lost answer is an unknown outcome, never a plain outage",
|
|
"runs on the owner for the actor the signature binds, and the typed direct dispatch still refuses it",
|
|
"keeps the answer of a call that outlasts the write timeout of the owner server",
|
|
"is an unknown outcome when the answer is lost",
|
|
"runs the backend-releases check for a pinned frontend without an actor",
|
|
"refuses a system call from a peer that is not pinned",
|
|
"never lets a system call change anything or ride the user-facing route",
|
|
"writes the set with private modes and no CA key",
|
|
"loads both roles into carriers and serves a frontend call from the owner",
|
|
"gives the owner no signing key and the frontend its own",
|
|
"accepts two frontends made from the same set",
|
|
"refuses a frontend from another generation",
|
|
"reads only the files of the role",
|
|
"refuses a key file with group or other access",
|
|
"refuses an unknown role",
|
|
"refuses to overwrite a file and leaves it unchanged",
|
|
"needs an owner host",
|
|
"says nothing was sent when the add-on is not running, instead of an unknown outcome",
|
|
"runs a declared action tool for the calling user, under the act scope, admitted as an add-on call",
|
|
"is not reachable through the typed dispatch of the direct API",
|
|
"refuses what is not a declared action tool",
|
|
"refuses an add-on that did not declare actions",
|
|
"is unavailable when the runtime does not serve action tools, and never runs for an unvalidated user",
|
|
"reports an unknown outcome, not a refusal, when the runtime fails after the call began",
|
|
"runs a resource-less read tool for the calling user only",
|
|
"denies a tool that declares a resource when none is given, and never reaches the add-on",
|
|
"denies a resource-less read when the admission cannot admit an add-on, or the tool is undeclared",
|
|
"keeps its address stable across starts",
|
|
"does not share state between different roots",
|
|
"fails clearly when the port is in use",
|
|
"rejects an invalid port file",
|
|
"rejects a port file with a loose mode",
|
|
"rejects a port file that links outside the root",
|
|
"is not permitted when the add-on denies the person, on the owner and on a forwarding frontend",
|
|
"is an unreachable resource when the policy denies it, on the owner and on a forwarding frontend",
|
|
"types the denial of a read like the denial of a write, on the owner and on a forwarding frontend",
|
|
"crosses the wire of a resource call typed, so a forwarding frontend answers like the owner",
|
|
"keeps any other failure to resolve a resource a plain denial, so nothing more is told",
|
|
"carries the chat binding signed and rejects a changed one",
|
|
"signs a request without a binding as before",
|
|
"gives the owner the chat the frontend bound the call to"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/gateway-http.json",
|
|
"cases": [
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"returns the same text through a forwarding frontend",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"policy": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/policy",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/policy.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"enforces the viewer editor owner matrix on fixture resources",
|
|
"denies installation administrators and unrelated users any access to user data",
|
|
"does not leak resource existence and treats unknown actions as owner mutations",
|
|
"never grants the owner role or a grant to the owner and the synthetic principals",
|
|
"rejects anonymous and legacy synthetic principals in named mode",
|
|
"checks credential and account status on every admission",
|
|
"keeps no current-user state shared between concurrent admissions",
|
|
"disables sharing in explicit local-owner mode and lets every local caller own the resource",
|
|
"refuses a mode switch of populated data without a stopped backed-up migration",
|
|
"retains resources and grants across a restart and an uninstall of the package",
|
|
"refuses a corrupt store and a second opener",
|
|
"stops admitted work of a revoked user and acknowledges only after it ended",
|
|
"lets a racing revocation win against read and write admissions",
|
|
"serializes writes per resource while reads run concurrently",
|
|
"bounds the revocation wait and does not acknowledge a stuck drain",
|
|
"invalidates pending proposals on revoke and downgrade and fails closed when it cannot",
|
|
"requires explicit creation authority and keeps pending registrations inaccessible",
|
|
"reconciles a registration interrupted by a crash from the durable store",
|
|
"keeps a record whose existence cannot be established and settles the rest",
|
|
"never drops a committed resource and counts pending quota unchanged",
|
|
"retries kept records from the loop on a tick and on a kick, and stops on Close",
|
|
"closes a loop that never started without waiting",
|
|
"maps opaque ids to the trusted addon and owner and keeps an absent policy denying",
|
|
"does not acknowledge a retried downgrade while the lowered user's write still runs",
|
|
"retries a failed proposal invalidation after the lowered grant is already durable",
|
|
"keeps the drain owed across a restart",
|
|
"does not cancel work admitted under a later grant when a lowering is retried",
|
|
"still waits for and cancels work admitted before the lowering when the regrant is retried",
|
|
"stops work admitted after a regrant when the role is lowered again",
|
|
"keeps the epoch of the owed drain across a restart",
|
|
"keeps a drain mark that a concurrent lowering replaced while a retry was waiting",
|
|
"maps a store outage to unavailable and a disabled account to forbidden",
|
|
"caps pending and committed registrations per user and in total",
|
|
"applies finite defaults when no limit is configured",
|
|
"denies creation as unavailable when the authority cannot tell",
|
|
"reports an unclassified account or creation check error as unavailable and a definite denial as forbidden",
|
|
"does not start the work when revocation cancels the admission before run",
|
|
"rejects persisted unknown roles and trailing bytes without resetting the store",
|
|
"removes stale temporary files on open",
|
|
"stops accepting writes after a failed directory sync and keeps the applied change",
|
|
"retains resources and grants across a real manager uninstall and restart",
|
|
"stores a pending proposal with its exact effects and never executes it",
|
|
"applies exactly the stored arguments once and answers a repeat from the stored receipt",
|
|
"refuses changed arguments, other actors, unknown identifiers and an unbound digest",
|
|
"never lets an API key, plain text or a boolean approve",
|
|
"accepts the local owner as the confirming principal in local-owner mode only",
|
|
"expires a proposal and refuses a late or repeated confirmation",
|
|
"refuses a proposal made stale by a new generation or a moved revision",
|
|
"cancels a proposal for good and restricts who may propose which action",
|
|
"never accepts sharing, deletion, reads or unclassified actions as proposals",
|
|
"cancels pending proposals when authority is lowered and lets a revocation win the confirmation race",
|
|
"persists every transition atomically before it is reported",
|
|
"does not dispatch when the executing state cannot be made durable",
|
|
"keeps a lost reply unknown, blocks conflicting writes and resolves it by receipt without a replay",
|
|
"reports a lost reply from the owner's own gateway with the original operation",
|
|
"recovers a crash after dispatch by receipt and a crash before dispatch as unknown without replay",
|
|
"keeps pending proposals across a restart and never resets a corrupt store",
|
|
"bounds the pending proposals of one user and the store as a whole",
|
|
"records expiry and collects settled proposals without any read so a quiet clock cannot fill the store",
|
|
"records expiry durably when the owner starts and when it recovers",
|
|
"keeps settled proposals for the retention window only",
|
|
"keeps one user from starving others and never drops another user's live proposal",
|
|
"bounds the stored canonical arguments per user and in total with a typed quota error",
|
|
"looks an unresolved receipt up again with backoff for a finite window and never applies again",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then unblocks writes",
|
|
"records a late receipt of an abandoned outcome instead of hiding it",
|
|
"settles by lookup instead of abandoning when the receipt is final",
|
|
"refuses a stored abandonment that names nobody and keeps looking up in the background",
|
|
"binds the digest to the operation, actor, resource, generation, action, arguments and revision",
|
|
"refuses a stored proposal whose operation, actor, resource, generation or arguments changed at rest",
|
|
"issues resource identifiers the envelope contract accepts",
|
|
"is unavailable until it is attached to a policy and a runtime",
|
|
"keeps executing, outcome-unknown and abandoned records far past retention and still dedupes them",
|
|
"waits for the background run and for lookups in flight before it closes, and writes nothing after",
|
|
"lets the owner role list the unresolved proposals of its resource and abandon one by the listed digest",
|
|
"names the blocking proposal in the denial only to the resource owner",
|
|
"refuses an unbound digest when the owner abandons through the gateway or the broker",
|
|
"answers the same typed outage for a resolution whoever proposed the operation",
|
|
"returns the applied proposal when the owner cannot read it back after a successful apply",
|
|
"does not show another user's blocking operation in a proposal view",
|
|
"denies a proposal for an undeclared tool before any preview and stores nothing",
|
|
"denies a proposal that names a tool when no tool source is installed",
|
|
"rechecks the stored tool at confirmation and never applies a withdrawn tool",
|
|
"denies a proposal whose arguments repeat a key and stores nothing",
|
|
"reports an unavailable declaration source as unavailable, never as a denial",
|
|
"does not apply at confirmation while the declaration source is unavailable, and applies once it recovers",
|
|
"reserves a create proposal as a pending resource that nobody can reach",
|
|
"commits the reservation on confirmation and makes the proposer the private owner",
|
|
"abandons the reservation when a create proposal is cancelled or expires",
|
|
"abandons the reservation when the addon rejects the creation",
|
|
"keeps a lost create reply pending and unknown and settles it by receipt",
|
|
"abandons an unknown create only when the addon confirms the backing is absent",
|
|
"settles reservations at restart by asking the addon and keeps those of live proposals",
|
|
"bounds concurrent create proposals by the pending quota",
|
|
"lets only the proposer confirm, cancel or read a create proposal",
|
|
"denies a create proposal when creation authority is revoked before confirmation",
|
|
"denies a create proposal for an undeclared tool or an existing resource without reserving",
|
|
"does not let reconcile drop the reservation of a creation in flight",
|
|
"commits the reservation at recovery when the crash came after the receipt was stored",
|
|
"never reads an add-on that cannot answer as a backing that is gone",
|
|
"accepts the explicit answer of the declared existence tool, true or false",
|
|
"holds the resources of one add-on and leaves another add-on alone",
|
|
"cancels admitted work and reports a drain that did not finish",
|
|
"restores grants through the account directory and the lowerings since the backup, never beyond them",
|
|
"keeps a bounded durable log of lowered access",
|
|
"keeps a revocation however many later lowerings of another person follow",
|
|
"restores the data but no access when the history may have lost a lowering",
|
|
"reads a store that is full of lowerings as one whose history may be cut",
|
|
"applies a lowering made after the export whatever time the backup is given",
|
|
"refuses a change that was authorized just before the hold began",
|
|
"cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
|
|
"forgets the records of one add-on and no other",
|
|
"maps an owner on a restore to a local-owner store only when nothing named is in it",
|
|
"migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
|
|
"refuses a proposal whose preview the add-on refused, storing nothing",
|
|
"settles a confirmation the add-on refused as rejected, never as an unknown outcome",
|
|
"R34: returns an admission that was refused before the wire to pending, and a repeat applies",
|
|
"R35, R52: a hold that cancels the dispatch before the wire ends the proposal as cancelled, not unknown",
|
|
"R38: records a conflict of the add-on as rejected, not unknown",
|
|
"R39: still records an unknown outcome when the request may have been sent",
|
|
"reports a not-sent confirmation through the gateway as an outage that sent nothing, never as unknown",
|
|
"is a refusal that changed nothing, not an outage, and leaves the ID free",
|
|
"R4, S4: refuses an editor who claims the write action for a schema tool, and stores nothing",
|
|
"R4: refuses an editor who names the schema action for a schema tool",
|
|
"derives the action from the tool, so the owner needs the matching claim and gets the schema action",
|
|
"still lets an editor propose a data write for a write tool",
|
|
"R3: refuses a read tool, a create tool and a tool without a definition",
|
|
"runs the declaration check as well as the kind check",
|
|
"refuses a named tool when the source cannot report kinds",
|
|
"R3: a creation names a create tool, never a schema or data tool",
|
|
"retry-after-not-sent: R34 then R37",
|
|
"addon-conflict-is-rejected: R38",
|
|
"timeout-unknown-then-receipt-committed: R39 then R40",
|
|
"runs the work for a current account",
|
|
"refuses a stale account and does not run the work",
|
|
"refuses an identity that does not fit the mode",
|
|
"refuses a held add-on as unavailable, and serves it again after the release",
|
|
"refuses an empty add-on ID and a nil work function",
|
|
"is reached through the gateway provider"
|
|
],
|
|
"report": ".cache/addons/logs/policy.json"
|
|
},
|
|
"proposals": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/policy",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/proposals.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/http/endpoints/addons",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/proposals-http.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"requires explicit creation authority and keeps pending registrations inaccessible",
|
|
"reconciles a registration interrupted by a crash from the durable store",
|
|
"keeps a record whose existence cannot be established and settles the rest",
|
|
"never drops a committed resource and counts pending quota unchanged",
|
|
"retries kept records from the loop on a tick and on a kick, and stops on Close",
|
|
"closes a loop that never started without waiting",
|
|
"stops admitted work of a revoked user and acknowledges only after it ended",
|
|
"lets a racing revocation win against read and write admissions",
|
|
"serializes writes per resource while reads run concurrently",
|
|
"bounds the revocation wait and does not acknowledge a stuck drain",
|
|
"invalidates pending proposals on revoke and downgrade and fails closed when it cannot",
|
|
"maps a store outage to unavailable and a disabled account to forbidden",
|
|
"maps opaque ids to the trusted addon and owner and keeps an absent policy denying",
|
|
"disables sharing in explicit local-owner mode and lets every local caller own the resource",
|
|
"refuses a mode switch of populated data without a stopped backed-up migration",
|
|
"retains resources and grants across a restart and an uninstall of the package",
|
|
"refuses a corrupt store and a second opener",
|
|
"caps pending and committed registrations per user and in total",
|
|
"applies finite defaults when no limit is configured",
|
|
"denies creation as unavailable when the authority cannot tell",
|
|
"does not acknowledge a retried downgrade while the lowered user's write still runs",
|
|
"retries a failed proposal invalidation after the lowered grant is already durable",
|
|
"keeps the drain owed across a restart",
|
|
"does not start the work when revocation cancels the admission before run",
|
|
"retains resources and grants across a real manager uninstall and restart",
|
|
"rejects persisted unknown roles and trailing bytes without resetting the store",
|
|
"removes stale temporary files on open",
|
|
"stops accepting writes after a failed directory sync and keeps the applied change",
|
|
"enforces the viewer editor owner matrix on fixture resources",
|
|
"denies installation administrators and unrelated users any access to user data",
|
|
"does not leak resource existence and treats unknown actions as owner mutations",
|
|
"never grants the owner role or a grant to the owner and the synthetic principals",
|
|
"does not cancel work admitted under a later grant when a lowering is retried",
|
|
"still waits for and cancels work admitted before the lowering when the regrant is retried",
|
|
"stops work admitted after a regrant when the role is lowered again",
|
|
"keeps the epoch of the owed drain across a restart",
|
|
"keeps a drain mark that a concurrent lowering replaced while a retry was waiting",
|
|
"reports an unclassified account or creation check error as unavailable and a definite denial as forbidden",
|
|
"rejects anonymous and legacy synthetic principals in named mode",
|
|
"checks credential and account status on every admission",
|
|
"keeps no current-user state shared between concurrent admissions",
|
|
"stores a pending proposal with its exact effects and never executes it",
|
|
"applies exactly the stored arguments once and answers a repeat from the stored receipt",
|
|
"refuses changed arguments, other actors, unknown identifiers and an unbound digest",
|
|
"never lets an API key, plain text or a boolean approve",
|
|
"accepts the local owner as the confirming principal in local-owner mode only",
|
|
"expires a proposal and refuses a late or repeated confirmation",
|
|
"refuses a proposal made stale by a new generation or a moved revision",
|
|
"cancels a proposal for good and restricts who may propose which action",
|
|
"never accepts sharing, deletion, reads or unclassified actions as proposals",
|
|
"cancels pending proposals when authority is lowered and lets a revocation win the confirmation race",
|
|
"persists every transition atomically before it is reported",
|
|
"does not dispatch when the executing state cannot be made durable",
|
|
"keeps a lost reply unknown, blocks conflicting writes and resolves it by receipt without a replay",
|
|
"reports a lost reply from the owner's own gateway with the original operation",
|
|
"recovers a crash after dispatch by receipt and a crash before dispatch as unknown without replay",
|
|
"keeps pending proposals across a restart and never resets a corrupt store",
|
|
"bounds the pending proposals of one user and the store as a whole",
|
|
"records expiry and collects settled proposals without any read so a quiet clock cannot fill the store",
|
|
"records expiry durably when the owner starts and when it recovers",
|
|
"keeps settled proposals for the retention window only",
|
|
"keeps one user from starving others and never drops another user's live proposal",
|
|
"bounds the stored canonical arguments per user and in total with a typed quota error",
|
|
"looks an unresolved receipt up again with backoff for a finite window and never applies again",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then unblocks writes",
|
|
"records a late receipt of an abandoned outcome instead of hiding it",
|
|
"settles by lookup instead of abandoning when the receipt is final",
|
|
"refuses a stored abandonment that names nobody and keeps looking up in the background",
|
|
"binds the digest to the operation, actor, resource, generation, action, arguments and revision",
|
|
"refuses a stored proposal whose operation, actor, resource, generation or arguments changed at rest",
|
|
"issues resource identifiers the envelope contract accepts",
|
|
"is unavailable until it is attached to a policy and a runtime",
|
|
"keeps executing, outcome-unknown and abandoned records far past retention and still dedupes them",
|
|
"waits for the background run and for lookups in flight before it closes, and writes nothing after",
|
|
"lets the owner role list the unresolved proposals of its resource and abandon one by the listed digest",
|
|
"names the blocking proposal in the denial only to the resource owner",
|
|
"refuses an unbound digest when the owner abandons through the gateway or the broker",
|
|
"answers the same typed outage for a resolution whoever proposed the operation",
|
|
"returns the applied proposal when the owner cannot read it back after a successful apply",
|
|
"does not show another user's blocking operation in a proposal view",
|
|
"denies a proposal for an undeclared tool before any preview and stores nothing",
|
|
"denies a proposal that names a tool when no tool source is installed",
|
|
"rechecks the stored tool at confirmation and never applies a withdrawn tool",
|
|
"denies a proposal whose arguments repeat a key and stores nothing",
|
|
"reports an unavailable declaration source as unavailable, never as a denial",
|
|
"does not apply at confirmation while the declaration source is unavailable, and applies once it recovers",
|
|
"reserves a create proposal as a pending resource that nobody can reach",
|
|
"commits the reservation on confirmation and makes the proposer the private owner",
|
|
"abandons the reservation when a create proposal is cancelled or expires",
|
|
"abandons the reservation when the addon rejects the creation",
|
|
"keeps a lost create reply pending and unknown and settles it by receipt",
|
|
"abandons an unknown create only when the addon confirms the backing is absent",
|
|
"settles reservations at restart by asking the addon and keeps those of live proposals",
|
|
"bounds concurrent create proposals by the pending quota",
|
|
"lets only the proposer confirm, cancel or read a create proposal",
|
|
"denies a create proposal when creation authority is revoked before confirmation",
|
|
"denies a create proposal for an undeclared tool or an existing resource without reserving",
|
|
"does not let reconcile drop the reservation of a creation in flight",
|
|
"commits the reservation at recovery when the crash came after the receipt was stored",
|
|
"never reads an add-on that cannot answer as a backing that is gone",
|
|
"accepts the explicit answer of the declared existence tool, true or false",
|
|
"holds the resources of one add-on and leaves another add-on alone",
|
|
"cancels admitted work and reports a drain that did not finish",
|
|
"restores grants through the account directory and the lowerings since the backup, never beyond them",
|
|
"keeps a bounded durable log of lowered access",
|
|
"keeps a revocation however many later lowerings of another person follow",
|
|
"restores the data but no access when the history may have lost a lowering",
|
|
"reads a store that is full of lowerings as one whose history may be cut",
|
|
"applies a lowering made after the export whatever time the backup is given",
|
|
"refuses a change that was authorized just before the hold began",
|
|
"cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
|
|
"forgets the records of one add-on and no other",
|
|
"maps an owner on a restore to a local-owner store only when nothing named is in it",
|
|
"migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
|
|
"refuses a proposal whose preview the add-on refused, storing nothing",
|
|
"settles a confirmation the add-on refused as rejected, never as an unknown outcome",
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"R34: returns an admission that was refused before the wire to pending, and a repeat applies",
|
|
"R35, R52: a hold that cancels the dispatch before the wire ends the proposal as cancelled, not unknown",
|
|
"R38: records a conflict of the add-on as rejected, not unknown",
|
|
"R39: still records an unknown outcome when the request may have been sent",
|
|
"reports a not-sent confirmation through the gateway as an outage that sent nothing, never as unknown",
|
|
"is a refusal that changed nothing, not an outage, and leaves the ID free",
|
|
"R4, S4: refuses an editor who claims the write action for a schema tool, and stores nothing",
|
|
"R4: refuses an editor who names the schema action for a schema tool",
|
|
"derives the action from the tool, so the owner needs the matching claim and gets the schema action",
|
|
"still lets an editor propose a data write for a write tool",
|
|
"R3: refuses a read tool, a create tool and a tool without a definition",
|
|
"runs the declaration check as well as the kind check",
|
|
"refuses a named tool when the source cannot report kinds",
|
|
"R3: a creation names a create tool, never a schema or data tool",
|
|
"retry-after-not-sent: R34 then R37",
|
|
"addon-conflict-is-rejected: R38",
|
|
"timeout-unknown-then-receipt-committed: R39 then R40",
|
|
"runs the work for a current account",
|
|
"refuses a stale account and does not run the work",
|
|
"refuses an identity that does not fit the mode",
|
|
"refuses a held add-on as unavailable, and serves it again after the release",
|
|
"refuses an empty add-on ID and a nil work function",
|
|
"is reached through the gateway provider",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"returns the same text through a forwarding frontend",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route"
|
|
],
|
|
"report": ".cache/addons/logs/proposals.json",
|
|
"reports": [
|
|
{
|
|
"path": ".cache/addons/logs/proposals.json",
|
|
"cases": [
|
|
"requires explicit creation authority and keeps pending registrations inaccessible",
|
|
"reconciles a registration interrupted by a crash from the durable store",
|
|
"keeps a record whose existence cannot be established and settles the rest",
|
|
"never drops a committed resource and counts pending quota unchanged",
|
|
"retries kept records from the loop on a tick and on a kick, and stops on Close",
|
|
"closes a loop that never started without waiting",
|
|
"stops admitted work of a revoked user and acknowledges only after it ended",
|
|
"lets a racing revocation win against read and write admissions",
|
|
"serializes writes per resource while reads run concurrently",
|
|
"bounds the revocation wait and does not acknowledge a stuck drain",
|
|
"invalidates pending proposals on revoke and downgrade and fails closed when it cannot",
|
|
"maps a store outage to unavailable and a disabled account to forbidden",
|
|
"maps opaque ids to the trusted addon and owner and keeps an absent policy denying",
|
|
"disables sharing in explicit local-owner mode and lets every local caller own the resource",
|
|
"refuses a mode switch of populated data without a stopped backed-up migration",
|
|
"retains resources and grants across a restart and an uninstall of the package",
|
|
"refuses a corrupt store and a second opener",
|
|
"caps pending and committed registrations per user and in total",
|
|
"applies finite defaults when no limit is configured",
|
|
"denies creation as unavailable when the authority cannot tell",
|
|
"does not acknowledge a retried downgrade while the lowered user's write still runs",
|
|
"retries a failed proposal invalidation after the lowered grant is already durable",
|
|
"keeps the drain owed across a restart",
|
|
"does not start the work when revocation cancels the admission before run",
|
|
"retains resources and grants across a real manager uninstall and restart",
|
|
"rejects persisted unknown roles and trailing bytes without resetting the store",
|
|
"removes stale temporary files on open",
|
|
"stops accepting writes after a failed directory sync and keeps the applied change",
|
|
"enforces the viewer editor owner matrix on fixture resources",
|
|
"denies installation administrators and unrelated users any access to user data",
|
|
"does not leak resource existence and treats unknown actions as owner mutations",
|
|
"never grants the owner role or a grant to the owner and the synthetic principals",
|
|
"does not cancel work admitted under a later grant when a lowering is retried",
|
|
"still waits for and cancels work admitted before the lowering when the regrant is retried",
|
|
"stops work admitted after a regrant when the role is lowered again",
|
|
"keeps the epoch of the owed drain across a restart",
|
|
"keeps a drain mark that a concurrent lowering replaced while a retry was waiting",
|
|
"reports an unclassified account or creation check error as unavailable and a definite denial as forbidden",
|
|
"rejects anonymous and legacy synthetic principals in named mode",
|
|
"checks credential and account status on every admission",
|
|
"keeps no current-user state shared between concurrent admissions",
|
|
"stores a pending proposal with its exact effects and never executes it",
|
|
"applies exactly the stored arguments once and answers a repeat from the stored receipt",
|
|
"refuses changed arguments, other actors, unknown identifiers and an unbound digest",
|
|
"never lets an API key, plain text or a boolean approve",
|
|
"accepts the local owner as the confirming principal in local-owner mode only",
|
|
"expires a proposal and refuses a late or repeated confirmation",
|
|
"refuses a proposal made stale by a new generation or a moved revision",
|
|
"cancels a proposal for good and restricts who may propose which action",
|
|
"never accepts sharing, deletion, reads or unclassified actions as proposals",
|
|
"cancels pending proposals when authority is lowered and lets a revocation win the confirmation race",
|
|
"persists every transition atomically before it is reported",
|
|
"does not dispatch when the executing state cannot be made durable",
|
|
"keeps a lost reply unknown, blocks conflicting writes and resolves it by receipt without a replay",
|
|
"reports a lost reply from the owner's own gateway with the original operation",
|
|
"recovers a crash after dispatch by receipt and a crash before dispatch as unknown without replay",
|
|
"keeps pending proposals across a restart and never resets a corrupt store",
|
|
"bounds the pending proposals of one user and the store as a whole",
|
|
"records expiry and collects settled proposals without any read so a quiet clock cannot fill the store",
|
|
"records expiry durably when the owner starts and when it recovers",
|
|
"keeps settled proposals for the retention window only",
|
|
"keeps one user from starving others and never drops another user's live proposal",
|
|
"bounds the stored canonical arguments per user and in total with a typed quota error",
|
|
"looks an unresolved receipt up again with backoff for a finite window and never applies again",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then unblocks writes",
|
|
"records a late receipt of an abandoned outcome instead of hiding it",
|
|
"settles by lookup instead of abandoning when the receipt is final",
|
|
"refuses a stored abandonment that names nobody and keeps looking up in the background",
|
|
"binds the digest to the operation, actor, resource, generation, action, arguments and revision",
|
|
"refuses a stored proposal whose operation, actor, resource, generation or arguments changed at rest",
|
|
"issues resource identifiers the envelope contract accepts",
|
|
"is unavailable until it is attached to a policy and a runtime",
|
|
"keeps executing, outcome-unknown and abandoned records far past retention and still dedupes them",
|
|
"waits for the background run and for lookups in flight before it closes, and writes nothing after",
|
|
"lets the owner role list the unresolved proposals of its resource and abandon one by the listed digest",
|
|
"names the blocking proposal in the denial only to the resource owner",
|
|
"refuses an unbound digest when the owner abandons through the gateway or the broker",
|
|
"answers the same typed outage for a resolution whoever proposed the operation",
|
|
"returns the applied proposal when the owner cannot read it back after a successful apply",
|
|
"does not show another user's blocking operation in a proposal view",
|
|
"denies a proposal for an undeclared tool before any preview and stores nothing",
|
|
"denies a proposal that names a tool when no tool source is installed",
|
|
"rechecks the stored tool at confirmation and never applies a withdrawn tool",
|
|
"denies a proposal whose arguments repeat a key and stores nothing",
|
|
"reports an unavailable declaration source as unavailable, never as a denial",
|
|
"does not apply at confirmation while the declaration source is unavailable, and applies once it recovers",
|
|
"reserves a create proposal as a pending resource that nobody can reach",
|
|
"commits the reservation on confirmation and makes the proposer the private owner",
|
|
"abandons the reservation when a create proposal is cancelled or expires",
|
|
"abandons the reservation when the addon rejects the creation",
|
|
"keeps a lost create reply pending and unknown and settles it by receipt",
|
|
"abandons an unknown create only when the addon confirms the backing is absent",
|
|
"settles reservations at restart by asking the addon and keeps those of live proposals",
|
|
"bounds concurrent create proposals by the pending quota",
|
|
"lets only the proposer confirm, cancel or read a create proposal",
|
|
"denies a create proposal when creation authority is revoked before confirmation",
|
|
"denies a create proposal for an undeclared tool or an existing resource without reserving",
|
|
"does not let reconcile drop the reservation of a creation in flight",
|
|
"commits the reservation at recovery when the crash came after the receipt was stored",
|
|
"never reads an add-on that cannot answer as a backing that is gone",
|
|
"accepts the explicit answer of the declared existence tool, true or false",
|
|
"holds the resources of one add-on and leaves another add-on alone",
|
|
"cancels admitted work and reports a drain that did not finish",
|
|
"restores grants through the account directory and the lowerings since the backup, never beyond them",
|
|
"keeps a bounded durable log of lowered access",
|
|
"keeps a revocation however many later lowerings of another person follow",
|
|
"restores the data but no access when the history may have lost a lowering",
|
|
"reads a store that is full of lowerings as one whose history may be cut",
|
|
"applies a lowering made after the export whatever time the backup is given",
|
|
"refuses a change that was authorized just before the hold began",
|
|
"cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
|
|
"forgets the records of one add-on and no other",
|
|
"maps an owner on a restore to a local-owner store only when nothing named is in it",
|
|
"migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
|
|
"refuses a proposal whose preview the add-on refused, storing nothing",
|
|
"settles a confirmation the add-on refused as rejected, never as an unknown outcome",
|
|
"R34: returns an admission that was refused before the wire to pending, and a repeat applies",
|
|
"R35, R52: a hold that cancels the dispatch before the wire ends the proposal as cancelled, not unknown",
|
|
"R38: records a conflict of the add-on as rejected, not unknown",
|
|
"R39: still records an unknown outcome when the request may have been sent",
|
|
"reports a not-sent confirmation through the gateway as an outage that sent nothing, never as unknown",
|
|
"is a refusal that changed nothing, not an outage, and leaves the ID free",
|
|
"R4, S4: refuses an editor who claims the write action for a schema tool, and stores nothing",
|
|
"R4: refuses an editor who names the schema action for a schema tool",
|
|
"derives the action from the tool, so the owner needs the matching claim and gets the schema action",
|
|
"still lets an editor propose a data write for a write tool",
|
|
"R3: refuses a read tool, a create tool and a tool without a definition",
|
|
"runs the declaration check as well as the kind check",
|
|
"refuses a named tool when the source cannot report kinds",
|
|
"R3: a creation names a create tool, never a schema or data tool",
|
|
"retry-after-not-sent: R34 then R37",
|
|
"addon-conflict-is-rejected: R38",
|
|
"timeout-unknown-then-receipt-committed: R39 then R40",
|
|
"runs the work for a current account",
|
|
"refuses a stale account and does not run the work",
|
|
"refuses an identity that does not fit the mode",
|
|
"refuses a held add-on as unavailable, and serves it again after the release",
|
|
"refuses an empty add-on ID and a nil work function",
|
|
"is reached through the gateway provider"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/proposals-http.json",
|
|
"cases": [
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"returns the same text through a forwarding frontend",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"artifacts": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/artifacts",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/artifacts.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/gateway",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/artifacts-gateway.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/http/endpoints/addons",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/artifacts-http.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"adopts every output of a result or none, and shows the owner only its own status",
|
|
"sanitizes attachment names and maps media types to a fixed allowlist",
|
|
"applies finite default limits and rejects partial or unbounded overrides",
|
|
"keeps staged bytes behind the object store boundary and publishes only complete writes",
|
|
"never serves an artifact at or after expiry, including during admission and mid-stream",
|
|
"fails a transfer that outlives its artifact",
|
|
"fails a transfer whose source is revoked before completion and denies a revoked download",
|
|
"stops a download stream when the source is revoked mid-stream",
|
|
"requires read access to every source resource at completion and download",
|
|
"denies a disabled or unavailable account at ingestion and download",
|
|
"denies downloads of a disabled addon, keeps the bytes and serves again only while unexpired with current permissions",
|
|
"denies downloads after uninstall and removes the bytes at the next sweep",
|
|
"sweeps expired artifacts, abandoned partials and orphan files without touching live transfers",
|
|
"enforces per-user, total and size limits atomically under concurrent ingestion",
|
|
"bounds concurrent transfers and concurrent downloads",
|
|
"cancels a transfer by its context or by its owner and removes the partial bytes",
|
|
"returns the same artifact for a repeated request without a second transfer",
|
|
"keeps addon handles operation-bound and out of metadata and views",
|
|
"keeps complete artifacts across a restart and settles interrupted transfers",
|
|
"keeps the bytes of a transfer that completes while a sweep is running",
|
|
"never loses the bytes of a complete artifact when sweeps race with several completing transfers",
|
|
"answers a transient storage error as unavailable and keeps the bytes and the record",
|
|
"marks an artifact corrupt only for missing bytes or a size mismatch",
|
|
"answers a download that races with an expiry or a drop like any expired identifier",
|
|
"refuses a corrupt metadata store and stops writing after a failed sync",
|
|
"waits for background transfers before Close returns and writes nothing after",
|
|
"ingests a file result into a private staged artifact with a host-generated identifier",
|
|
"never uses an addon handle, URL or path as an identifier or a file path",
|
|
"answers one denial for an unknown identifier and for another principal's artifact",
|
|
"never serves incomplete, short, long or failed transfers and removes their partial bytes",
|
|
"streams ingestion and download without buffering the whole file",
|
|
"rejects an output declared larger than one artifact may be before reading it",
|
|
"never opens an output for a request that names a tool no source declares",
|
|
"denies an output request whose arguments repeat a key and never opens the output",
|
|
"reports an unavailable declaration source as unavailable and never opens the output",
|
|
"shortens the lifetime and keeps the bounds consistent, and zero keeps the defaults",
|
|
"fails the artifact with a fixed reason that says it was refused, not that the add-on is down",
|
|
"serves only declared installed generation assets and rejects traversal",
|
|
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
|
|
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
|
|
"propagates interrupted progress cancellation through the receiving frontend",
|
|
"validates finite relay budgets and prevents disabling polling bounds",
|
|
"builds a carrier only from complete pinned identities",
|
|
"types an unknown mutation outcome as unavailable without losing its operation",
|
|
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
|
|
"alternates pinned frontends and rejects untrusted certificates without local fallback",
|
|
"reports the original operation after lost mutation replies without retrying",
|
|
"rejects a stream longer than its receiving frontend budget",
|
|
"rejects a CA signed peer without a pin on the owner side",
|
|
"refuses an owner whose CA signed certificate is not the pinned owner",
|
|
"returns the artifact status through the owner from every frontend with one denial for the rest",
|
|
"types the owner's refusal and outage of a lookup the same from every frontend",
|
|
"writes an attachment header that cannot be broken out of",
|
|
"rotates the enforced audience on restart and rejects captured requests",
|
|
"never expires the response deadline after the relay returned",
|
|
"returns the owner's forbidden status for an invalid kind and for missing policy",
|
|
"still reports unavailable when the owner is unable to serve and not forbidden",
|
|
"reaches the same decision through both frontends and delivers bytes when allowed",
|
|
"keeps aborting when revocation happens after bytes were written",
|
|
"bounds progress, asset and file relays by their own limit",
|
|
"alternates real owner journal status and terminates coarse progress without submitting again",
|
|
"reports an account store outage as unavailable and a refused account as forbidden",
|
|
"rejects unknown lifecycle argument fields before touching the owner journal",
|
|
"reports a runtime that cannot serve as unavailable through both frontends",
|
|
"reports an output that ends before its first byte as unavailable",
|
|
"fails closed as unavailable for an unclassified owner error",
|
|
"keeps authorization and policy denials forbidden",
|
|
"keeps a mutation unknown when the runtime fails after the owner applied it",
|
|
"keeps a mutation unknown when the owner reports recovery required for its operation",
|
|
"reports a mutation as unknown when the owner cannot serve it at all",
|
|
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
|
|
"lets unavailability win when an error wraps both a denial and an unavailable cause",
|
|
"does not leak attachment headers into an error when the first read fails",
|
|
"treats every action except the known reads as a mutation",
|
|
"keeps resolved resources under admission for JSON and attachment bytes",
|
|
"closes interrupted output and releases admission on disconnect",
|
|
"rechecks revoked credentials during attachment copying",
|
|
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
|
|
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
|
|
"denies private relays without host resolution and admission",
|
|
"serves declared assets of the current enabled generation by package digest only",
|
|
"allows only an exact declared tool name and fails closed otherwise",
|
|
"never contacts the add-on for an undeclared tool and still serves a declared one",
|
|
"denies a repeated key at any depth however it is spelled",
|
|
"denies arguments that are not exactly one object",
|
|
"separates a denial from an unavailable declaration source",
|
|
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
|
|
"is the typed invalid request on the owner for a read, never an outage",
|
|
"is the typed invalid request on the owner for a proposal call",
|
|
"is the typed invalid request on the owner for a json relay",
|
|
"is the same typed answer from a forwarding frontend",
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"crosses the owner's wire as the same typed error, whatever the frontend",
|
|
"does not trust a code the host does not know, and cleans the detail the add-on wrote",
|
|
"is a stale view for a caller that only knows ErrStale, and a denial otherwise",
|
|
"is a mutation on the carrier: a lost answer is an unknown outcome, never a plain outage",
|
|
"runs on the owner for the actor the signature binds, and the typed direct dispatch still refuses it",
|
|
"keeps the answer of a call that outlasts the write timeout of the owner server",
|
|
"is an unknown outcome when the answer is lost",
|
|
"runs the backend-releases check for a pinned frontend without an actor",
|
|
"refuses a system call from a peer that is not pinned",
|
|
"never lets a system call change anything or ride the user-facing route",
|
|
"writes the set with private modes and no CA key",
|
|
"loads both roles into carriers and serves a frontend call from the owner",
|
|
"gives the owner no signing key and the frontend its own",
|
|
"accepts two frontends made from the same set",
|
|
"refuses a frontend from another generation",
|
|
"reads only the files of the role",
|
|
"refuses a key file with group or other access",
|
|
"refuses an unknown role",
|
|
"refuses to overwrite a file and leaves it unchanged",
|
|
"needs an owner host",
|
|
"says nothing was sent when the add-on is not running, instead of an unknown outcome",
|
|
"runs a declared action tool for the calling user, under the act scope, admitted as an add-on call",
|
|
"is not reachable through the typed dispatch of the direct API",
|
|
"refuses what is not a declared action tool",
|
|
"refuses an add-on that did not declare actions",
|
|
"is unavailable when the runtime does not serve action tools, and never runs for an unvalidated user",
|
|
"reports an unknown outcome, not a refusal, when the runtime fails after the call began",
|
|
"runs a resource-less read tool for the calling user only",
|
|
"denies a tool that declares a resource when none is given, and never reaches the add-on",
|
|
"denies a resource-less read when the admission cannot admit an add-on, or the tool is undeclared",
|
|
"keeps its address stable across starts",
|
|
"does not share state between different roots",
|
|
"fails clearly when the port is in use",
|
|
"rejects an invalid port file",
|
|
"rejects a port file with a loose mode",
|
|
"rejects a port file that links outside the root",
|
|
"is not permitted when the add-on denies the person, on the owner and on a forwarding frontend",
|
|
"is an unreachable resource when the policy denies it, on the owner and on a forwarding frontend",
|
|
"types the denial of a read like the denial of a write, on the owner and on a forwarding frontend",
|
|
"crosses the wire of a resource call typed, so a forwarding frontend answers like the owner",
|
|
"keeps any other failure to resolve a resource a plain denial, so nothing more is told",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"returns the same text through a forwarding frontend",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route",
|
|
"carries the chat binding signed and rejects a changed one",
|
|
"signs a request without a binding as before",
|
|
"gives the owner the chat the frontend bound the call to"
|
|
],
|
|
"report": ".cache/addons/logs/artifacts.json",
|
|
"reports": [
|
|
{
|
|
"path": ".cache/addons/logs/artifacts.json",
|
|
"cases": [
|
|
"adopts every output of a result or none, and shows the owner only its own status",
|
|
"sanitizes attachment names and maps media types to a fixed allowlist",
|
|
"applies finite default limits and rejects partial or unbounded overrides",
|
|
"keeps staged bytes behind the object store boundary and publishes only complete writes",
|
|
"never serves an artifact at or after expiry, including during admission and mid-stream",
|
|
"fails a transfer that outlives its artifact",
|
|
"fails a transfer whose source is revoked before completion and denies a revoked download",
|
|
"stops a download stream when the source is revoked mid-stream",
|
|
"requires read access to every source resource at completion and download",
|
|
"denies a disabled or unavailable account at ingestion and download",
|
|
"denies downloads of a disabled addon, keeps the bytes and serves again only while unexpired with current permissions",
|
|
"denies downloads after uninstall and removes the bytes at the next sweep",
|
|
"sweeps expired artifacts, abandoned partials and orphan files without touching live transfers",
|
|
"enforces per-user, total and size limits atomically under concurrent ingestion",
|
|
"bounds concurrent transfers and concurrent downloads",
|
|
"cancels a transfer by its context or by its owner and removes the partial bytes",
|
|
"returns the same artifact for a repeated request without a second transfer",
|
|
"keeps addon handles operation-bound and out of metadata and views",
|
|
"keeps complete artifacts across a restart and settles interrupted transfers",
|
|
"keeps the bytes of a transfer that completes while a sweep is running",
|
|
"never loses the bytes of a complete artifact when sweeps race with several completing transfers",
|
|
"answers a transient storage error as unavailable and keeps the bytes and the record",
|
|
"marks an artifact corrupt only for missing bytes or a size mismatch",
|
|
"answers a download that races with an expiry or a drop like any expired identifier",
|
|
"refuses a corrupt metadata store and stops writing after a failed sync",
|
|
"waits for background transfers before Close returns and writes nothing after",
|
|
"ingests a file result into a private staged artifact with a host-generated identifier",
|
|
"never uses an addon handle, URL or path as an identifier or a file path",
|
|
"answers one denial for an unknown identifier and for another principal's artifact",
|
|
"never serves incomplete, short, long or failed transfers and removes their partial bytes",
|
|
"streams ingestion and download without buffering the whole file",
|
|
"rejects an output declared larger than one artifact may be before reading it",
|
|
"never opens an output for a request that names a tool no source declares",
|
|
"denies an output request whose arguments repeat a key and never opens the output",
|
|
"reports an unavailable declaration source as unavailable and never opens the output",
|
|
"shortens the lifetime and keeps the bounds consistent, and zero keeps the defaults",
|
|
"fails the artifact with a fixed reason that says it was refused, not that the add-on is down"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/artifacts-gateway.json",
|
|
"cases": [
|
|
"serves only declared installed generation assets and rejects traversal",
|
|
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
|
|
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
|
|
"propagates interrupted progress cancellation through the receiving frontend",
|
|
"validates finite relay budgets and prevents disabling polling bounds",
|
|
"builds a carrier only from complete pinned identities",
|
|
"types an unknown mutation outcome as unavailable without losing its operation",
|
|
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
|
|
"alternates pinned frontends and rejects untrusted certificates without local fallback",
|
|
"reports the original operation after lost mutation replies without retrying",
|
|
"rejects a stream longer than its receiving frontend budget",
|
|
"rejects a CA signed peer without a pin on the owner side",
|
|
"refuses an owner whose CA signed certificate is not the pinned owner",
|
|
"returns the artifact status through the owner from every frontend with one denial for the rest",
|
|
"types the owner's refusal and outage of a lookup the same from every frontend",
|
|
"writes an attachment header that cannot be broken out of",
|
|
"rotates the enforced audience on restart and rejects captured requests",
|
|
"never expires the response deadline after the relay returned",
|
|
"returns the owner's forbidden status for an invalid kind and for missing policy",
|
|
"still reports unavailable when the owner is unable to serve and not forbidden",
|
|
"reaches the same decision through both frontends and delivers bytes when allowed",
|
|
"keeps aborting when revocation happens after bytes were written",
|
|
"bounds progress, asset and file relays by their own limit",
|
|
"alternates real owner journal status and terminates coarse progress without submitting again",
|
|
"reports an account store outage as unavailable and a refused account as forbidden",
|
|
"rejects unknown lifecycle argument fields before touching the owner journal",
|
|
"reports a runtime that cannot serve as unavailable through both frontends",
|
|
"reports an output that ends before its first byte as unavailable",
|
|
"fails closed as unavailable for an unclassified owner error",
|
|
"keeps authorization and policy denials forbidden",
|
|
"keeps a mutation unknown when the runtime fails after the owner applied it",
|
|
"keeps a mutation unknown when the owner reports recovery required for its operation",
|
|
"reports a mutation as unknown when the owner cannot serve it at all",
|
|
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
|
|
"lets unavailability win when an error wraps both a denial and an unavailable cause",
|
|
"does not leak attachment headers into an error when the first read fails",
|
|
"treats every action except the known reads as a mutation",
|
|
"keeps resolved resources under admission for JSON and attachment bytes",
|
|
"closes interrupted output and releases admission on disconnect",
|
|
"rechecks revoked credentials during attachment copying",
|
|
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
|
|
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
|
|
"denies private relays without host resolution and admission",
|
|
"serves declared assets of the current enabled generation by package digest only",
|
|
"allows only an exact declared tool name and fails closed otherwise",
|
|
"never contacts the add-on for an undeclared tool and still serves a declared one",
|
|
"denies a repeated key at any depth however it is spelled",
|
|
"denies arguments that are not exactly one object",
|
|
"separates a denial from an unavailable declaration source",
|
|
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
|
|
"is the typed invalid request on the owner for a read, never an outage",
|
|
"is the typed invalid request on the owner for a proposal call",
|
|
"is the typed invalid request on the owner for a json relay",
|
|
"is the same typed answer from a forwarding frontend",
|
|
"crosses the owner's wire as the same typed error, whatever the frontend",
|
|
"does not trust a code the host does not know, and cleans the detail the add-on wrote",
|
|
"is a stale view for a caller that only knows ErrStale, and a denial otherwise",
|
|
"is a mutation on the carrier: a lost answer is an unknown outcome, never a plain outage",
|
|
"runs on the owner for the actor the signature binds, and the typed direct dispatch still refuses it",
|
|
"keeps the answer of a call that outlasts the write timeout of the owner server",
|
|
"is an unknown outcome when the answer is lost",
|
|
"runs the backend-releases check for a pinned frontend without an actor",
|
|
"refuses a system call from a peer that is not pinned",
|
|
"never lets a system call change anything or ride the user-facing route",
|
|
"writes the set with private modes and no CA key",
|
|
"loads both roles into carriers and serves a frontend call from the owner",
|
|
"gives the owner no signing key and the frontend its own",
|
|
"accepts two frontends made from the same set",
|
|
"refuses a frontend from another generation",
|
|
"reads only the files of the role",
|
|
"refuses a key file with group or other access",
|
|
"refuses an unknown role",
|
|
"refuses to overwrite a file and leaves it unchanged",
|
|
"needs an owner host",
|
|
"says nothing was sent when the add-on is not running, instead of an unknown outcome",
|
|
"runs a declared action tool for the calling user, under the act scope, admitted as an add-on call",
|
|
"is not reachable through the typed dispatch of the direct API",
|
|
"refuses what is not a declared action tool",
|
|
"refuses an add-on that did not declare actions",
|
|
"is unavailable when the runtime does not serve action tools, and never runs for an unvalidated user",
|
|
"reports an unknown outcome, not a refusal, when the runtime fails after the call began",
|
|
"runs a resource-less read tool for the calling user only",
|
|
"denies a tool that declares a resource when none is given, and never reaches the add-on",
|
|
"denies a resource-less read when the admission cannot admit an add-on, or the tool is undeclared",
|
|
"keeps its address stable across starts",
|
|
"does not share state between different roots",
|
|
"fails clearly when the port is in use",
|
|
"rejects an invalid port file",
|
|
"rejects a port file with a loose mode",
|
|
"rejects a port file that links outside the root",
|
|
"is not permitted when the add-on denies the person, on the owner and on a forwarding frontend",
|
|
"is an unreachable resource when the policy denies it, on the owner and on a forwarding frontend",
|
|
"types the denial of a read like the denial of a write, on the owner and on a forwarding frontend",
|
|
"crosses the wire of a resource call typed, so a forwarding frontend answers like the owner",
|
|
"keeps any other failure to resolve a resource a plain denial, so nothing more is told",
|
|
"carries the chat binding signed and rejects a changed one",
|
|
"signs a request without a binding as before",
|
|
"gives the owner the chat the frontend bound the call to"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/artifacts-http.json",
|
|
"cases": [
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"returns the same text through a forwarding frontend",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"apps": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/apps",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/apps.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons",
|
|
"-ginkgo.json-report=../../../.cache/addons/logs/apps-lifecycle.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/services/addons/runtime",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/apps-runtime.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./core/http/endpoints/addons",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/apps-http.json"
|
|
]
|
|
],
|
|
"cases": [
|
|
"lists installed enabled addons for users and adds installed disabled ones only for administrators",
|
|
"derives display fields, the main page and the icon URL from the verified manifest only",
|
|
"bounds the tool summary and coerces unknown process states to failed",
|
|
"shows controls and the management link only to administrators and never leaks owner details",
|
|
"describes the immutable UI assets of an enabled addon by the package digest and never otherwise",
|
|
"denies enable and disable for a stale generation without recording anything",
|
|
"lists the identifiers of installed addons, disabled ones included",
|
|
"refuses to list installed identifiers while recovery is required",
|
|
"lists apps by visibility and serves an icon only for a visible app at its generation",
|
|
"cancels status lookup while a lifecycle writer holds the journal lock",
|
|
"retries runtime synchronization after canceled disable and generation upgrade",
|
|
"rejects symlinked package roots without touching external staging",
|
|
"recovers every durable journal boundary without replaying publication",
|
|
"removes abandoned staging without removing published packages on recovery",
|
|
"keeps immutable history on successful upgrade and reinstallation",
|
|
"excludes competing owners and rejects conflicting durable identities",
|
|
"never opens replica roots or elects an absent owner",
|
|
"binds duplicate operation IDs to actor and command and serializes conflicts",
|
|
"refuses commands and asset reads for an add-on ID the host serves as a route",
|
|
"retains generations identity data and grants across uninstall and restart",
|
|
"preserves old packages and active generation on manager upgrade failure",
|
|
"requires current authoritative administration even for idempotent retries",
|
|
"executes enabled owner intent on startup and stops on disable and close without forwarder execution",
|
|
"binds lifecycle lookup to current admin and original actor without writes or repair",
|
|
"reports the supervisor state of an app through a crash and a restart",
|
|
"reads a flat directory in batches and stops at the entry bound",
|
|
"adds up nested files and reports a complete walk as not truncated",
|
|
"never follows or counts a symbolic link",
|
|
"keeps a result for a short time so polling does not walk again",
|
|
"stops at the time bound and reports a truncated size",
|
|
"does not keep a result cut short by the caller",
|
|
"is what the installed view reports for the data directory",
|
|
"resolves a package for the current enabled generation and digest only",
|
|
"answers from the current installed manifest only and follows a generation change",
|
|
"reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
|
|
"refuses a second operation ID for the same transition, in flight or done, and applies it once",
|
|
"runs concurrent requests with one operation ID once and gives each the same answer",
|
|
"serializes conflicting upgrades by the installed digest and refuses the loser without a record",
|
|
"refuses a candidate that is not the one the library resolves now",
|
|
"refuses an upgrade to the digest that is already installed",
|
|
"rechecks compatibility at execution and refuses an incompatible candidate",
|
|
"selects a newer immutable version and treats a rewritten version as an integrity error",
|
|
"keeps the last good generation when the candidate cannot be staged",
|
|
"never switches the library or channel, and a failed check is never up to date",
|
|
"lets an administrator refresh and everyone with the feature read a redacted status",
|
|
"shows the pending update in the apps list from the cache only",
|
|
"does not accept pins without an update checker or on another action",
|
|
"keeps the unpinned typed upgrade of an earlier release working",
|
|
"registers only ready generation bound service headless and UI capabilities",
|
|
"rejects forged registration nonloopback and stale incarnation handshakes",
|
|
"bounds readiness and handles exit during start and stop",
|
|
"withdraws immediately drains boundedly and rejects stale process identities",
|
|
"exhausts restart budget without retaining dead registrations",
|
|
"does not inherit secrets and exits when the private parent channel closes",
|
|
"fails closed on ambiguous launch identities and preserves unrelated reused PIDs",
|
|
"retains a canceled restart slot until cleanup completes and rejects duplicate supervisors",
|
|
"rejects nonloopback endpoints and bounds oversized streams and concurrency",
|
|
"reports stopped, running, failed, starting and running again across a crash and a restart",
|
|
"keeps reporting failed once the restart budget is exhausted",
|
|
"rejects foreign supervisor handles and numeric PID substitutions",
|
|
"resets restart budget only after sustained authenticated health",
|
|
"kills the exact paused child of a killed owner before launching its replacement",
|
|
"never reports failed between a launch starting and the restarted process being published",
|
|
"reserves a draining slot against concurrent starts",
|
|
"waits for a restart launch worker before acknowledging stop",
|
|
"exposes a new incarnation client after restart without reviving the old client",
|
|
"refuses a missing established ledger and fences failed cleanup publication",
|
|
"authenticates every request and separates trusted authority from model arguments",
|
|
"bounds output streams cancellation deadlines and stop admission",
|
|
"tells a 409 conflict of the add-on from an outage",
|
|
"withdraws and initiates every live slot before a cleanup timeout",
|
|
"creates one private data directory per addon and passes its path in the startup object",
|
|
"gives no data directory without a data root and refuses an unsafe root or addon ID",
|
|
"gives an add-on that the host setting names a host endpoint of its own",
|
|
"gives an add-on that the host setting does not name no host endpoint",
|
|
"closes the host endpoint when the incarnation ends",
|
|
"an HTTP 400 answer",
|
|
"an HTTP 422 answer",
|
|
"keeps a bounded, printable reason and nothing else of the body",
|
|
"leaves 503, 500 and 404 as outages",
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"types a withdrawn client, a full slot table, a bad envelope and a missing schema as not sent",
|
|
"keeps a not-sent error an ErrRuntime for callers that do not tell them apart",
|
|
"types a refused connection as not sent",
|
|
"never types a possibly-sent request as not sent",
|
|
"carries the SDK refusal text to the caller of a failed install and keeps the generic error",
|
|
"installs an add-on whose SDK range contains the host SDK",
|
|
"returns the same text through a forwarding frontend",
|
|
"carries the install time to the list and the management view, and none for an old record",
|
|
"lists the host controls an add-on is entitled to, whatever its ID",
|
|
"copies them at install, upgrade and owner start, and removes them at uninstall",
|
|
"never fails the operation when the copy fails",
|
|
"fails the install and says the package could not be verified, without installing anything",
|
|
"names a release that the library does not list",
|
|
"names two libraries that list the same add-on",
|
|
"names a library that cannot be read",
|
|
"reads the library on demand when the startup refresh has not filled the cache",
|
|
"reads the library again when the startup refresh failed",
|
|
"writes the owner and storage only, with no address",
|
|
"loads a file written in the old format with an address",
|
|
"loads when only the address changed",
|
|
"refuses a changed owner ID",
|
|
"refuses a changed storage ID",
|
|
"copies every capability field of the manifest, so a new field cannot be forgotten",
|
|
"is offered when the tag moved, pinned to the build the tag names, and upgrades to exactly that build",
|
|
"refuses the upgrade when the tag moved again after the check, and installs nothing",
|
|
"stamps the first install, keeps the time over an upgrade and stamps it again after an uninstall",
|
|
"needs a state root for the owner only",
|
|
"upgrades an installed add-on through the same path as a manual upgrade",
|
|
"does nothing when no newer version is listed",
|
|
"refuses a candidate whose package no longer matches its listed digest and replaces nothing",
|
|
"refuses a candidate that fails the signature policy of its library and replaces nothing",
|
|
"does not upgrade to a release the host cannot run",
|
|
"does nothing without an update checker",
|
|
"keeps the manual upgrade closed to a caller who is not an administrator",
|
|
"starts the enabled add-ons side by side, so the start takes the slowest ones and not the sum",
|
|
"types the add-on's own 'forbidden' answer as a denial of the person, not as an outage",
|
|
"keeps a 403 about the envelope itself an outage: it is a host fault, not a permission",
|
|
"reaches an add-on that declares actions, as the actor of the envelope, under the act scope",
|
|
"never sends a call that is not an act call or has another scope",
|
|
"never sends an act call to an add-on that did not declare actions",
|
|
"stops an act call when the caller gives up",
|
|
"posts the request with the incarnation credential and decodes the answer",
|
|
"is not sent to an add-on that declared no connector",
|
|
"gives it time to release what it owns before it kills the process",
|
|
"kills an add-on that ignores the closing of its startup channel, within the grace period",
|
|
"goes to the log line by line with the add-on ID and a cap per line",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route",
|
|
"records the chat with the envelope of a read and of an action while it runs",
|
|
"sends the add-on an envelope without a new field"
|
|
],
|
|
"report": ".cache/addons/logs/apps.json",
|
|
"reports": [
|
|
{
|
|
"path": ".cache/addons/logs/apps.json",
|
|
"cases": [
|
|
"lists installed enabled addons for users and adds installed disabled ones only for administrators",
|
|
"derives display fields, the main page and the icon URL from the verified manifest only",
|
|
"bounds the tool summary and coerces unknown process states to failed",
|
|
"shows controls and the management link only to administrators and never leaks owner details",
|
|
"describes the immutable UI assets of an enabled addon by the package digest and never otherwise",
|
|
"carries the install time to the list and the management view, and none for an old record",
|
|
"lists the host controls an add-on is entitled to, whatever its ID"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/apps-lifecycle.json",
|
|
"cases": [
|
|
"denies enable and disable for a stale generation without recording anything",
|
|
"lists the identifiers of installed addons, disabled ones included",
|
|
"refuses to list installed identifiers while recovery is required",
|
|
"lists apps by visibility and serves an icon only for a visible app at its generation",
|
|
"cancels status lookup while a lifecycle writer holds the journal lock",
|
|
"retries runtime synchronization after canceled disable and generation upgrade",
|
|
"rejects symlinked package roots without touching external staging",
|
|
"recovers every durable journal boundary without replaying publication",
|
|
"removes abandoned staging without removing published packages on recovery",
|
|
"keeps immutable history on successful upgrade and reinstallation",
|
|
"excludes competing owners and rejects conflicting durable identities",
|
|
"never opens replica roots or elects an absent owner",
|
|
"binds duplicate operation IDs to actor and command and serializes conflicts",
|
|
"refuses commands and asset reads for an add-on ID the host serves as a route",
|
|
"retains generations identity data and grants across uninstall and restart",
|
|
"preserves old packages and active generation on manager upgrade failure",
|
|
"requires current authoritative administration even for idempotent retries",
|
|
"executes enabled owner intent on startup and stops on disable and close without forwarder execution",
|
|
"binds lifecycle lookup to current admin and original actor without writes or repair",
|
|
"reports the supervisor state of an app through a crash and a restart",
|
|
"reads a flat directory in batches and stops at the entry bound",
|
|
"adds up nested files and reports a complete walk as not truncated",
|
|
"never follows or counts a symbolic link",
|
|
"keeps a result for a short time so polling does not walk again",
|
|
"stops at the time bound and reports a truncated size",
|
|
"does not keep a result cut short by the caller",
|
|
"is what the installed view reports for the data directory",
|
|
"resolves a package for the current enabled generation and digest only",
|
|
"answers from the current installed manifest only and follows a generation change",
|
|
"reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
|
|
"refuses a second operation ID for the same transition, in flight or done, and applies it once",
|
|
"runs concurrent requests with one operation ID once and gives each the same answer",
|
|
"serializes conflicting upgrades by the installed digest and refuses the loser without a record",
|
|
"refuses a candidate that is not the one the library resolves now",
|
|
"refuses an upgrade to the digest that is already installed",
|
|
"rechecks compatibility at execution and refuses an incompatible candidate",
|
|
"selects a newer immutable version and treats a rewritten version as an integrity error",
|
|
"keeps the last good generation when the candidate cannot be staged",
|
|
"never switches the library or channel, and a failed check is never up to date",
|
|
"lets an administrator refresh and everyone with the feature read a redacted status",
|
|
"shows the pending update in the apps list from the cache only",
|
|
"does not accept pins without an update checker or on another action",
|
|
"keeps the unpinned typed upgrade of an earlier release working",
|
|
"carries the SDK refusal text to the caller of a failed install and keeps the generic error",
|
|
"installs an add-on whose SDK range contains the host SDK",
|
|
"copies them at install, upgrade and owner start, and removes them at uninstall",
|
|
"never fails the operation when the copy fails",
|
|
"fails the install and says the package could not be verified, without installing anything",
|
|
"names a release that the library does not list",
|
|
"names two libraries that list the same add-on",
|
|
"names a library that cannot be read",
|
|
"reads the library on demand when the startup refresh has not filled the cache",
|
|
"reads the library again when the startup refresh failed",
|
|
"writes the owner and storage only, with no address",
|
|
"loads a file written in the old format with an address",
|
|
"loads when only the address changed",
|
|
"refuses a changed owner ID",
|
|
"refuses a changed storage ID",
|
|
"copies every capability field of the manifest, so a new field cannot be forgotten",
|
|
"is offered when the tag moved, pinned to the build the tag names, and upgrades to exactly that build",
|
|
"refuses the upgrade when the tag moved again after the check, and installs nothing",
|
|
"stamps the first install, keeps the time over an upgrade and stamps it again after an uninstall",
|
|
"needs a state root for the owner only",
|
|
"upgrades an installed add-on through the same path as a manual upgrade",
|
|
"does nothing when no newer version is listed",
|
|
"refuses a candidate whose package no longer matches its listed digest and replaces nothing",
|
|
"refuses a candidate that fails the signature policy of its library and replaces nothing",
|
|
"does not upgrade to a release the host cannot run",
|
|
"does nothing without an update checker",
|
|
"keeps the manual upgrade closed to a caller who is not an administrator",
|
|
"starts the enabled add-ons side by side, so the start takes the slowest ones and not the sum"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/apps-runtime.json",
|
|
"cases": [
|
|
"registers only ready generation bound service headless and UI capabilities",
|
|
"rejects forged registration nonloopback and stale incarnation handshakes",
|
|
"bounds readiness and handles exit during start and stop",
|
|
"withdraws immediately drains boundedly and rejects stale process identities",
|
|
"exhausts restart budget without retaining dead registrations",
|
|
"does not inherit secrets and exits when the private parent channel closes",
|
|
"fails closed on ambiguous launch identities and preserves unrelated reused PIDs",
|
|
"retains a canceled restart slot until cleanup completes and rejects duplicate supervisors",
|
|
"rejects nonloopback endpoints and bounds oversized streams and concurrency",
|
|
"reports stopped, running, failed, starting and running again across a crash and a restart",
|
|
"keeps reporting failed once the restart budget is exhausted",
|
|
"rejects foreign supervisor handles and numeric PID substitutions",
|
|
"resets restart budget only after sustained authenticated health",
|
|
"kills the exact paused child of a killed owner before launching its replacement",
|
|
"never reports failed between a launch starting and the restarted process being published",
|
|
"reserves a draining slot against concurrent starts",
|
|
"waits for a restart launch worker before acknowledging stop",
|
|
"exposes a new incarnation client after restart without reviving the old client",
|
|
"refuses a missing established ledger and fences failed cleanup publication",
|
|
"authenticates every request and separates trusted authority from model arguments",
|
|
"bounds output streams cancellation deadlines and stop admission",
|
|
"tells a 409 conflict of the add-on from an outage",
|
|
"withdraws and initiates every live slot before a cleanup timeout",
|
|
"creates one private data directory per addon and passes its path in the startup object",
|
|
"gives no data directory without a data root and refuses an unsafe root or addon ID",
|
|
"gives an add-on that the host setting names a host endpoint of its own",
|
|
"gives an add-on that the host setting does not name no host endpoint",
|
|
"closes the host endpoint when the incarnation ends",
|
|
"an HTTP 400 answer",
|
|
"an HTTP 422 answer",
|
|
"keeps a bounded, printable reason and nothing else of the body",
|
|
"leaves 503, 500 and 404 as outages",
|
|
"types a withdrawn client, a full slot table, a bad envelope and a missing schema as not sent",
|
|
"keeps a not-sent error an ErrRuntime for callers that do not tell them apart",
|
|
"types a refused connection as not sent",
|
|
"never types a possibly-sent request as not sent",
|
|
"types the add-on's own 'forbidden' answer as a denial of the person, not as an outage",
|
|
"keeps a 403 about the envelope itself an outage: it is a host fault, not a permission",
|
|
"reaches an add-on that declares actions, as the actor of the envelope, under the act scope",
|
|
"never sends a call that is not an act call or has another scope",
|
|
"never sends an act call to an add-on that did not declare actions",
|
|
"stops an act call when the caller gives up",
|
|
"posts the request with the incarnation credential and decodes the answer",
|
|
"is not sent to an add-on that declared no connector",
|
|
"gives it time to release what it owns before it kills the process",
|
|
"kills an add-on that ignores the closing of its startup channel, within the grace period",
|
|
"goes to the log line by line with the add-on ID and a cap per line",
|
|
"records the chat with the envelope of a read and of an action while it runs",
|
|
"sends the add-on an envelope without a new field"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/apps-http.json",
|
|
"cases": [
|
|
"rejects anonymous and forged forwarding authority through real authentication",
|
|
"lets callers through only when the deployment selected local-owner mode",
|
|
"keeps authentication, the feature gate and administration when accounts exist",
|
|
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
|
|
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
|
|
"serves the verified icon through the host route and denies it identically otherwise",
|
|
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
|
|
"documents the apps routes and every field of the app view in the Swagger spec",
|
|
"rejects anonymous callers and forged forwarding headers",
|
|
"gates the feature and then administration for named keys",
|
|
"requires same-origin browser requests for cookie mutations",
|
|
"registers only the dispatch, relay and proposal mutations",
|
|
"reserves every first path segment the host registers under /api/addons",
|
|
"gates the artifact routes by authentication and feature",
|
|
"lists every registered addon route in the feature registry",
|
|
"gates the apps routes by authentication, feature and administration",
|
|
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
|
|
"checks browser CSRF feature and admin access with real stored keys",
|
|
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
|
|
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
|
|
"denies sharing and deletion proposals and an unauthenticated caller",
|
|
"serves the local owner's confirmation only from a same-origin fetch of the host page",
|
|
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
|
|
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
|
|
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
|
|
"tells an editor of a blocked write only that it is denied",
|
|
"returns the applied proposal when the confirmed operation committed",
|
|
"answers an owner outage by the owner's state with the same type from every frontend",
|
|
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
|
|
"documents the proposal routes and the proposal schema in the Swagger spec",
|
|
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
|
|
"documents every field the error responses emit in the Swagger schema",
|
|
"reports an unavailable read as plain unavailability",
|
|
"reports a denial as forbidden",
|
|
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
|
|
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
|
|
"serves a private file result as a safe attachment over real HTTP",
|
|
"never renders hostile names or active media types inline",
|
|
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
|
|
"denies the download of a disabled addon and serves it again after enable",
|
|
"relays the same bytes, headers and denials through two forwarding frontends",
|
|
"keeps a file result of a read denied whole without an artifact store",
|
|
"serves the local owner's file only in local-owner mode",
|
|
"documents the artifact routes and the artifact schema in the Swagger spec",
|
|
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
|
|
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
|
|
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
|
|
"refuses every management call of the owner itself for a caller that is not an administrator",
|
|
"saves, refreshes and removes a library by reference and leaves installed addons alone",
|
|
"upgrades an installed addon through the typed action and keeps its earlier generation",
|
|
"reports a lost source change as an unknown outcome and a lost read as unavailable",
|
|
"documents the management actions and every emitted field of the installed view",
|
|
"serves the declared files of the current package through every frontend with immutable headers",
|
|
"lists the same URLs the route serves, and only for an enabled addon",
|
|
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"refuses a declared file that is not a regular file of the package",
|
|
"documents the asset route and its binary response in the Swagger spec",
|
|
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
|
|
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"checks only for an administrator's own browser session, and applies nothing",
|
|
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
|
|
"returns the same text through a forwarding frontend",
|
|
"Sec-Fetch-Site cross-site is refused even with a Referer on the same host",
|
|
"Sec-Fetch-Site same-origin passes",
|
|
"Sec-Fetch-Site same-site is refused",
|
|
"a request without a session cookie is not guarded",
|
|
"no Sec-Fetch-Site and no Origin or Referer is refused",
|
|
"no Sec-Fetch-Site with a Referer on the same host passes",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused",
|
|
"no Sec-Fetch-Site with a foreign Origin is refused even with a Referer on the same host",
|
|
"no Sec-Fetch-Site with a foreign Referer is refused",
|
|
"no Sec-Fetch-Site with a null Origin is refused",
|
|
"no Sec-Fetch-Site with an Origin on the same host passes",
|
|
"no Sec-Fetch-Site with the same host on another port is refused",
|
|
"matches the host without regard to letter case",
|
|
"gives no pins to an account created after the upgrade",
|
|
"round-trips pins for the local owner",
|
|
"drops IDs the caller cannot see",
|
|
"an object",
|
|
"numbers",
|
|
"not JSON",
|
|
"empty",
|
|
"null",
|
|
"rejects a list over the hard limit",
|
|
"does not show Studio and Talk as pins without the add-ons",
|
|
"lists add-ons by default, and takes a kind that this host reads",
|
|
"is empty because Studio and Talk are packaged add-ons",
|
|
"lists every entry without an account database",
|
|
"strict same-origin fetch",
|
|
"same-origin without destination",
|
|
"same-host Referer, no Sec-Fetch headers",
|
|
"same-host Origin, no Sec-Fetch headers",
|
|
"foreign Referer",
|
|
"same host, other port",
|
|
"foreign Origin wins over same-host Referer",
|
|
"no Origin and no Referer",
|
|
"cross-site with same-host Referer",
|
|
"same-site with same-host Origin",
|
|
"same-host Referer but navigation destination",
|
|
"same-host Referer but no-cors mode",
|
|
"still refuses a same-host Referer with an API key",
|
|
"returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
|
|
"logs the cause of a failed install and types it for the client",
|
|
"logs the reason behind a generic denial and leaves the response unchanged",
|
|
"names every typed cause of a failed install in the 403 of the dispatch route"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gallery-ui": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/gallery_ui.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: query normalization bounds text, library and page",
|
|
"unit: an operation book keeps one identity per action until it is done",
|
|
"unit: responses classify the same way everywhere",
|
|
"unit: polling backs off on failure, slows when hidden and stays bounded",
|
|
"unit: library drafts accept references and refuse secrets before sending",
|
|
"unit: tabs: the server decides, the page only avoids showing what it will refuse",
|
|
"unit: the installed list puts what needs a person first and filters by state",
|
|
"unit: an add-on without an icon gets a stable letter and hue, and a dev build says so",
|
|
"unit: app chips never turn an unknown state into running",
|
|
"unit: titles follow the language, then the default text, then the id",
|
|
"unit: update status comes only from an authoritative check",
|
|
"unit: the api sends one dispatch shape and classifies refusals",
|
|
"unit: an unknown outcome is read with the original identity and never resubmitted",
|
|
"unit: a denial is not retried and an exhausted read is reported as unknown",
|
|
"unit: an action book binds one identity to one click and its retries",
|
|
"unit: an action book mints a fresh identity once an action is resolved",
|
|
"unit: an action book blocks another action on a subject with an unknown outcome until it is resolved or dismissed",
|
|
"unit: a completed status that left the add-on unchanged is not reported as done",
|
|
"apps: lists enabled apps with state chips, the icon route and Open only for a main page",
|
|
"apps: a headless add-on shows its tools and no Open action",
|
|
"apps: a reader gets no start, stop, manage or management tabs",
|
|
"apps: an administrator starts an app with a fresh operation ID and the listed generation",
|
|
"apps: a lost start is read with the same operation ID and never submitted again",
|
|
"apps: an unknown start is resolved or dismissed before the next action and never replays its ID",
|
|
"apps: dismissing an unknown outcome lets the next click mint a new operation",
|
|
"apps: a completed status that left the app unchanged is not shown as done",
|
|
"apps: a refused start shows the server denial and refreshes the list",
|
|
"apps: the list refreshes on a bounded interval, backs off on errors and stops when left",
|
|
"apps: an add-on that contributes UI keeps the list current off the page and its disable stops the reads",
|
|
"apps: a viewer without the add-ons feature never requests the list",
|
|
"browse: searches the libraries, pages and shows trust and platform facts",
|
|
"browse: Install and turn on asks once, installs and turns the add-on on",
|
|
"browse: a failed turn on keeps the install, says why in the dialog and can be tried again",
|
|
"browse: an add-on that is installed but off offers Turn on and nothing else",
|
|
"installed: health is separate from enabled and the details show trust, compatibility and storage",
|
|
"installed: an update is shown only from the owner update field and upgrade sends that version",
|
|
"installed: removing warns that data is kept before anything is submitted",
|
|
"installed: Escape cancels the remove dialog only, then closes the pane, and focus returns to the card",
|
|
"installed: a headless add-on keeps its details, health and tools",
|
|
"installed: a refusal of the installed list leaves the pane without Details",
|
|
"installed: an old Installed address lands on Installed and the management link opens the details",
|
|
"libraries: a private library is saved by credential reference and never carries a secret",
|
|
"libraries: removing a library says installed add-ons stay and leaves them installed",
|
|
"libraries: a refresh reports its result and a failed fetch is shown as failed",
|
|
"keyboard: the tab list moves with the arrow keys and actions are reachable",
|
|
"narrow: at 400 px the apps page is one column without sideways scrolling",
|
|
"theme: the apps page follows the light and dark tokens",
|
|
"i18n: the page follows the interface language",
|
|
"regression: the backends catalog still searches, pages and shows its empty state",
|
|
"unit: the add-on browse list drops backend entries and keeps entries with no kind",
|
|
"unit: a refusal shows the server reason and falls back to the generic text",
|
|
"unit: the add-on list drops a backend entry, and the backend route still installs one",
|
|
"unit: a library signer is named exactly or by a pattern, never both",
|
|
"unit: a backend install follows its job through the steps and ends with the result",
|
|
"unit: a failed backend install job throws the reason and keeps the step that failed",
|
|
"unit: install steps: left steps are done, the reported one runs, the rest wait",
|
|
"unit: backends page: a library backend shows its library and the digest it pinned",
|
|
"unit: backends page: a newer build in the library is an update state, and a running job wins over it",
|
|
"unit: the updates route of the host is read as a list and nothing is sent",
|
|
"unit: every locale carries the add-on and navigation keys of English",
|
|
"unit: the chats page has its add-on control strings in English",
|
|
"unit: the add-on labels use one name and one verb pair",
|
|
"unit: what an add-on adds comes from its page and its tools, and nothing is guessed",
|
|
"unit: screenshots appear only when the host lists them and they are served by the host",
|
|
"unit: the list says first run, no match or none, and a search never claims that nothing is installed",
|
|
"unit: featured add-ons are the first three add-on entries that are not installed",
|
|
"unit: install and turn on runs the install, then the turn on, each as its own action",
|
|
"unit: install and turn on stops at a failed install and retries only the turn on",
|
|
"unit: a library entry shows its tool count only when it is above zero, from the installed-view fields",
|
|
"unit: the catalog adapter carries toolCount and tools of a release, and defaults them to none",
|
|
"unit: the English wording is \"Adds 16 tools\" and \"Adds 1 tool\"",
|
|
"unit: addons: the install dialog names each built-in skill the entry replaces, and who already does",
|
|
"unit: addons: the details list the skills of an add-on and which replace a built-in one",
|
|
"hub: under the legacy switch the Add-ons tab appears only for an account that holds the feature"
|
|
]
|
|
},
|
|
"esm-ui": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/esm_ui.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: sdk: compatibility accepts only a range that holds the host SDK version",
|
|
"unit: sdk: the object is a frozen allowlist that carries the host React and no host internals",
|
|
"unit: sdk: hooks run on the host React instance and a wrapper keeps one component type",
|
|
"unit: sdk: icons outside the semantic set fall back and theme tokens are a fixed set",
|
|
"unit: sdk: navigation stays inside the add-on prefix and its declared pages",
|
|
"unit: sdk: api calls carry the add-on and its generation and nothing else is reachable",
|
|
"unit: sdk: after the signal aborts every service refuses and each disposer runs once",
|
|
"unit: sdk: markDirty reports unsaved edits once per change and notifications are bounded",
|
|
"unit: sdk: locale is scoped to the add-on and falls back to the default text",
|
|
"unit: sdk: layers are host wrappers with a bounded spec",
|
|
"unit: css: every selector is scoped to the add-on root and the global ones are neutralised",
|
|
"unit: css: imports, fonts, external urls and unknown at-rules are dropped and keyframes are renamed",
|
|
"unit: css: no value that loads a URL survives anywhere in the sheet",
|
|
"unit: css: harmless values, escapes in strings and nested rules are kept",
|
|
"unit: css: two add-ons that use the same class names get disjoint scopes",
|
|
"unit: loader: asset URLs must be same-origin immutable URLs of the add-on own package",
|
|
"unit: loader: an incompatible SDK range is never imported and leaves a clear error",
|
|
"unit: loader: the module receives only the host SDK, its result is validated and styles are scoped",
|
|
"unit: loader: a module without createAddon, with a bad result or a bare import is a load error",
|
|
"unit: loader: a hanging import times out and an abort cancels and cleans up",
|
|
"unit: loader: dispose runs once, aborts the SDK signal and removes the styles",
|
|
"unit: loader: chat actions are limited to declared ids and carry only the conversation context",
|
|
"unit: registry: disable, uninstall, crash and update withdraw a loaded add-on at once",
|
|
"unit: registry: unsaved edits keep a withdrawn add-on stale until the user reloads",
|
|
"unit: registry: a poll never replaces a withdrawn instance; only reload does",
|
|
"unit: registry: a hold ends with its last holder and a load that was withdrawn leaves no instance behind",
|
|
"unit: registry: navigation and chat actions come only from usable add-ons of the current generation",
|
|
"unit: registry: the legacy Add-ons tab lists page links only when the registry has usable add-ons",
|
|
"unit: registry: the list is read off the Add-ons page only for a viewer with the feature and a UI contribution",
|
|
"go: describes the immutable UI assets of an enabled addon by the package digest and never otherwise",
|
|
"go: resolves a package for the current enabled generation and digest only",
|
|
"go: serves declared assets of the current enabled generation by package digest only",
|
|
"go: serves the declared files of the current package through every frontend with immutable headers",
|
|
"go: lists the same URLs the route serves, and only for an enabled addon",
|
|
"go: denies every other path, digest, addon and credential form with one answer and no immutable caching",
|
|
"go: accepts a same-origin browser session and refuses a cross-site or direct one",
|
|
"go: withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
|
|
"go: refuses a declared file that is not a regular file of the package",
|
|
"go: documents the asset route and its binary response in the Swagger spec",
|
|
"esm: a fixture add-on installed after the host build loads through real authorization and draws in its own root",
|
|
"esm: hooks run on the host React and the add-on keeps its state across renders",
|
|
"esm: the add-on style sheet is scoped to its root and leaves the host and other add-ons alone",
|
|
"esm: a component that throws is contained by the error boundary and the shell keeps working",
|
|
"esm: deep links, the bare add-on address and a proxy path prefix reach the same declared page",
|
|
"esm: a host that does not provide the add-on SDK range never imports its code and says so",
|
|
"esm: a module that imports React by a bare specifier fails to load and no second React is resolved",
|
|
"esm: the server decides asset access: undeclared files, traversal, other add-ons, credentials in URLs and foreign sessions are denied",
|
|
"esm: an add-on navigates only to its own declared pages and the host draws the add-on navigation",
|
|
"esm: dialogs an add-on opens are owned by the host: focus, Escape and the close button",
|
|
"esm: a dialog or panel whose render throws is contained and the host app keeps running",
|
|
"esm: unsaved edits are guarded when leaving the page",
|
|
"esm: the page keeps inside the viewport at 400 px and follows the light and dark themes",
|
|
"esm: a member without the add-ons feature gets no add-on page and no code",
|
|
"esm: disabling an add-on unmounts it, aborts its signal, drops its styles and denies its code at once",
|
|
"esm: a withdrawn add-on with unsaved edits stays on screen until the user decides, and never saves",
|
|
"esm: an update withdraws the old generation, denies its code and loads the new one only on an explicit reload"
|
|
]
|
|
},
|
|
"host-slots": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/host_slots.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: slots: the registry is closed and each slot has a frozen minimal props contract",
|
|
"unit: slots: props carry only the contract and never message text or history",
|
|
"unit: slots: declared component names come from the manifest only and the module cannot add more",
|
|
"unit: slots: the loader hands the host only declared components and never an imperative registration",
|
|
"unit: slots: contributions come only from enabled, usable, current-generation add-ons that are ready",
|
|
"unit: slots: an action appears only in its declared placement and carries its own target",
|
|
"unit: slots: labels follow the language with a safe fallback",
|
|
"unit: slots: a renderer is found only for the addon own declared tool and kind",
|
|
"unit: slots: an action sends its declared tool and the sanitized context, and results are bounded text",
|
|
"unit: slots: disable, crash and update unmount every contribution through the runtime",
|
|
"unit: slots: contributions keep the apps list polled while they exist",
|
|
"unit: slots: the approval frame decides from the stored proposal and never from the renderer",
|
|
"unit: slots: the SDK can present an approval of its own addon only through the host",
|
|
"unit: slots: a page that only needs the list reads it once and never retries a failed read",
|
|
"unit: slots: a file preview is offered for the extensions it declared and gets only the file facts",
|
|
"go: accepts tool and component chat actions, slots and own-tool renderers",
|
|
"go: keeps bare chat action identifiers and every earlier fixture valid",
|
|
"go: rejects every undeclared, unsafe or inconsistent contribution at install",
|
|
"go: keeps the closed slot list and the icon allowlist equal to the host",
|
|
"go: lists actions, slots and renderers for an enabled addon and keeps the identifiers",
|
|
"go: lists no contribution for a disabled addon, whoever asks",
|
|
"go: accepts a file preview slot that names the extensions it handles",
|
|
"go: rejects a file preview slot or extension list that is not safe",
|
|
"slots: an add-on's settings sections are drawn on the Settings tab of its own details and nowhere else",
|
|
"slots: the Settings page lists the add-ons that have settings, each a link to its Settings tab",
|
|
"slots: the old anchor of a section on the Settings page opens the add-on's Settings tab",
|
|
"slots: the add-on page and its details offer the settings to an administrator only",
|
|
"slots: the navigation slot adds its entry below the tile grid of the Add-ons drawer"
|
|
]
|
|
},
|
|
"foundation-acceptance": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/foundation.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"go: fails closed on every frontend while the owner is down, executes nothing locally and recovers the last good package and data on restart",
|
|
"go: refuses a second owner on the same storage and keeps one process per add-on",
|
|
"go: stops an add-on process orphaned by an owner crash before it starts the next one",
|
|
"go: leaves no process behind when a cluster with an orphaned add-on is taken down",
|
|
"go: keeps the last good generation running and its data when an upgrade fails to start",
|
|
"go: keeps the last good code and data when the owner is killed in the middle of an upgrade and recovers on restart",
|
|
"go: keeps retained data and a consistent lifecycle when the owner is killed in the middle of an enable",
|
|
"go: keeps the files of the package of an installed add-on read only",
|
|
"go: keeps the last good generation running and the retained data when the new generation cannot start",
|
|
"go: restores the last good generation and resumes the same operation when the request is canceled during an upgrade start",
|
|
"go: converges on the last good generation after a crash that follows the rollback start and precedes any journal write",
|
|
"go: starts the owner when an enabled add-on cannot become ready and fails only that add-on",
|
|
"go: gives an ordinary account the apps list and no management on any node",
|
|
"go: returns the same typed denial from the owner and from each frontend",
|
|
"go: refuses a session on every node once it was ended through one frontend",
|
|
"go: refuses an API key on every node once it was revoked through one frontend",
|
|
"go: installs the UI, tool and service-only packages from the catalog through a frontend without starting them and leaves the host binary and UI build unchanged",
|
|
"go: activates each package through the other frontend and runs one process per add-on under the owner only",
|
|
"go: lists the same apps from the owner and both frontends and shows only what each declared",
|
|
"go: serves reads of the UI, tool and service-only packages alternately through the owner and both frontends",
|
|
"go: denies an account without the feature, a stranger to the resource and an anonymous caller the same way on every node",
|
|
"go: takes the actor from the authenticated credential only and ignores forged actor and authority headers",
|
|
"go: denies a tool the add-on did not declare and a generation that is not current on every node",
|
|
"go: relays JSON and a private file result and downloads the file through a different frontend than the one that produced it",
|
|
"go: relays lifecycle status and progress of an operation to the administrator who made it and to nobody else",
|
|
"go: serves the immutable UI assets by package digest through a non-owner frontend and refuses everything else",
|
|
"go: applies one confirmed change exactly once through a different frontend than the one that proposed it",
|
|
"go: reports a lost reply as outcome unknown with the original operation ID and settles it by receipt lookup without a second apply",
|
|
"go: upgrades to a new generation, denies the previous generation and its assets, and keeps the retained data",
|
|
"go: disables, removes and reinstalls an add-on while its data and grants remain",
|
|
"go: never changes the host binary or the shipped UI build over the whole lifecycle",
|
|
"regression: model and backend gallery specs (core/gallery)",
|
|
"regression: gallery operation specs (core/services/galleryop)",
|
|
"regression: process adapter specs (pkg/model)",
|
|
"foundation: a member opens the add-on through each non-owner frontend and its module comes from the owner by digest",
|
|
"foundation: the owner and both frontends list the same add-on to the same account",
|
|
"foundation: a member sees the add-on list only and the server refuses every management request",
|
|
"foundation: an account without the add-ons feature gets no apps and no code on any node",
|
|
"foundation: an administrator manages through a frontend and the change is the owner's",
|
|
"foundation: deep links of the add-on page work behind a proxy path prefix on a non-owner frontend",
|
|
"foundation: a session ended through one frontend is refused for add-on assets by the other servers"
|
|
]
|
|
},
|
|
"tables-databases": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./addons/tables/internal/store",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/tables-databases-store.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./tests/addons/tables",
|
|
"-ginkgo.json-report=../../../.cache/addons/logs/tables-databases.json"
|
|
]
|
|
],
|
|
"report": ".cache/addons/logs/tables-databases-store.json",
|
|
"reports": [
|
|
{
|
|
"path": ".cache/addons/logs/tables-databases-store.json",
|
|
"cases": [
|
|
"enforces the size cap on every connection and fails with a typed capacity error",
|
|
"builds a database under a data directory containing percent, question and hash characters",
|
|
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
|
|
"finds the committed receipt after a crash between commit and reply and never applies twice",
|
|
"replays one operation ID to one receipt and refuses another request under the same ID",
|
|
"applies one change once when the same operation arrives concurrently",
|
|
"keeps a rejected change out of the receipts so its ID is not burnt",
|
|
"encodes the receipt payload so the host can read what changed",
|
|
"creates, renames and drops tables with stable internal identifiers and one revision step each",
|
|
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
|
|
"validates labels by length, characters and case-insensitive uniqueness",
|
|
"refuses type changes, unknown operations, expressions and unknown types",
|
|
"encodes typed defaults as literals and survives hostile defaults",
|
|
"enforces required columns and refuses unique defaults that would collide",
|
|
"adds a unique column through a unique index and refuses duplicates atomically",
|
|
"drops a column by rebuilding the table and loses exactly what the preview reported",
|
|
"never hands out a row ID again after a column drop rebuilds the table",
|
|
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
|
|
"leaves the original table, data and revision intact when a rebuild fails midway",
|
|
"previews exact effects and dependent data loss and changes nothing",
|
|
"refuses a stale expected revision with the current revision and applies nothing",
|
|
"keeps finite limits on tables and columns",
|
|
"migrates a database made before the catalog existed on its first schema change",
|
|
"inserts bound rows atomically with defaults, required and unique checks",
|
|
"updates by explicit IDs and by filter and bumps only the data revision",
|
|
"deletes by IDs or filter and refuses broad, empty or oversized selections",
|
|
"previews exact count, sample and conflicts without changing anything",
|
|
"refuses a changed revision and never re-evaluates a filter against new rows",
|
|
"applies exactly one of two proposals made on the same revision",
|
|
"replays a row operation by ID and refuses another request under the same ID",
|
|
"leaves no change when the process dies before commit and finds the receipt after commit",
|
|
"reserves the row id label so no column can shadow it",
|
|
"keeps a row table's data across a column drop that rebuilds it",
|
|
"reads selected columns with stable row IDs and typed JSON values",
|
|
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
|
|
"escapes LIKE wildcards in text filters",
|
|
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
|
|
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
|
|
"counts, sums, averages and bounds groups of aggregates",
|
|
"reports a real sum or average that overflows as the typed arithmetic error",
|
|
"never lets a label, operator or value reach SQL as text",
|
|
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
|
|
"stops a query when the context is cancelled or the deadline passes",
|
|
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
|
|
"orders datetimes chronologically across fractional seconds and offsets",
|
|
"creates one private WAL database file named by the host resource ID",
|
|
"never lets an opaque ID or a name reach outside the storage directory",
|
|
"refuses a symbolic link as storage directory, database file or ledger",
|
|
"is idempotent by operation ID and never creates a second database",
|
|
"serializes concurrent creation of one operation into one database",
|
|
"recovers creation after a crash on either side of the file, and hides half-built files",
|
|
"renames only the named database and replays a renamed operation without effect",
|
|
"reports an unknown database and creates nothing for it",
|
|
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
|
|
"encodes its receipts so the host can read them",
|
|
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
|
|
"prefixes text cells and labels that a spreadsheet would run, never numbers",
|
|
"honours columns, the row identifier column, filter, sort and the row limit of the query",
|
|
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
|
|
"streams a large table row by row with bounded memory",
|
|
"fails cleanly past the row or byte bound and keeps the bound finite by default",
|
|
"stops on cancellation, on its deadline and on a failing destination, and reports each",
|
|
"does not change the database it reads",
|
|
"records the current format of a new store and migrates nothing",
|
|
"migrates every database in its own transaction, records the version last and repeats as a no-op",
|
|
"leaves a database whose step fails exactly as it was and resumes on the next run",
|
|
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
|
|
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
|
|
"records an inverse for an insert and removes exactly those rows on undo",
|
|
"restores the previous values of an update, for the columns it set only",
|
|
"brings deleted rows back with their row IDs and every value, nulls included",
|
|
"is idempotent by operation ID: the same ID returns the same receipt and undoes once",
|
|
"refuses the same operation ID for another change",
|
|
"refuses a stale undo with what changed and overwrites nothing",
|
|
"refuses an undo whose expected revision moved between the read and the apply",
|
|
"unwinds in order: undoing the latest change makes the earlier one undoable again",
|
|
"keeps no change set that is too large and says so at apply time",
|
|
"expires a change set after the retention and drops what it held",
|
|
"keeps the total of change sets of one database bounded by dropping the oldest",
|
|
"answers not found for a change that never existed or belongs to a read",
|
|
"removes a created table again and refuses once it was touched",
|
|
"renames a table or a column back",
|
|
"removes an added column again, with its unique index",
|
|
"restores a dropped column with its data, its type, required and unique flags",
|
|
"restores a dropped table with its columns, rows and row IDs",
|
|
"says a dropped column or table was too large to keep, at apply time",
|
|
"renames the database back only while it still has the new name",
|
|
"undoes a creation only while the database is untouched, and marks that the resource is deleted",
|
|
"keeps the change sets in the database file, so deleting the database removes them"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/tables-databases.json",
|
|
"cases": [
|
|
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
|
|
"creates a database under the host-assigned ID and lists it only for people who may read it",
|
|
"drops the reservation when the addon refuses the name, and leaves no database",
|
|
"drops a reservation at reconcile when the crash came before the database was created",
|
|
"commits a reservation at reconcile when the crash came after the database was created",
|
|
"never exposes a database that has no host record",
|
|
"renames one database by operation, replays safely, and leaves every other database alone",
|
|
"rejects an undeclared tool, a forged addon binding and an unknown resource",
|
|
"keeps databases and operation receipts across an addon restart",
|
|
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
|
|
"creates a database from a chat proposal that only the proposer's session confirms",
|
|
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
|
|
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
|
|
"declares the row tools and refuses a row tool the manifest does not name",
|
|
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
|
|
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
|
|
"declares the schema tools and refuses any schema tool the manifest does not name",
|
|
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
|
|
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
|
|
"applies a change a chat makes at once for the chat's user, leaves no proposal, and still refuses a key",
|
|
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
|
|
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
|
|
"lists at most the bound of pending proposals and refuses more than the user's quota",
|
|
"tells the model and the chat that a data change can be undone, and undoes it from the person's own tab",
|
|
"never lets a key, a tool call, another session or a stranger undo, so a model cannot undo its own work",
|
|
"refuses a stale undo with what changed, and unwinds from the newest change to the oldest",
|
|
"answers not_found for a change nobody recorded",
|
|
"restores a dropped column with its data and puts a dropped table back",
|
|
"undoes the creation of a database only while nothing touched it, and deletes it then",
|
|
"lets an editor undo a data change but not a schema change"
|
|
]
|
|
}
|
|
],
|
|
"cases": [
|
|
"enforces the size cap on every connection and fails with a typed capacity error",
|
|
"builds a database under a data directory containing percent, question and hash characters",
|
|
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
|
|
"finds the committed receipt after a crash between commit and reply and never applies twice",
|
|
"replays one operation ID to one receipt and refuses another request under the same ID",
|
|
"applies one change once when the same operation arrives concurrently",
|
|
"keeps a rejected change out of the receipts so its ID is not burnt",
|
|
"encodes the receipt payload so the host can read what changed",
|
|
"creates, renames and drops tables with stable internal identifiers and one revision step each",
|
|
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
|
|
"validates labels by length, characters and case-insensitive uniqueness",
|
|
"refuses type changes, unknown operations, expressions and unknown types",
|
|
"encodes typed defaults as literals and survives hostile defaults",
|
|
"enforces required columns and refuses unique defaults that would collide",
|
|
"adds a unique column through a unique index and refuses duplicates atomically",
|
|
"drops a column by rebuilding the table and loses exactly what the preview reported",
|
|
"never hands out a row ID again after a column drop rebuilds the table",
|
|
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
|
|
"leaves the original table, data and revision intact when a rebuild fails midway",
|
|
"previews exact effects and dependent data loss and changes nothing",
|
|
"refuses a stale expected revision with the current revision and applies nothing",
|
|
"keeps finite limits on tables and columns",
|
|
"migrates a database made before the catalog existed on its first schema change",
|
|
"inserts bound rows atomically with defaults, required and unique checks",
|
|
"updates by explicit IDs and by filter and bumps only the data revision",
|
|
"deletes by IDs or filter and refuses broad, empty or oversized selections",
|
|
"previews exact count, sample and conflicts without changing anything",
|
|
"refuses a changed revision and never re-evaluates a filter against new rows",
|
|
"applies exactly one of two proposals made on the same revision",
|
|
"replays a row operation by ID and refuses another request under the same ID",
|
|
"leaves no change when the process dies before commit and finds the receipt after commit",
|
|
"reserves the row id label so no column can shadow it",
|
|
"keeps a row table's data across a column drop that rebuilds it",
|
|
"reads selected columns with stable row IDs and typed JSON values",
|
|
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
|
|
"escapes LIKE wildcards in text filters",
|
|
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
|
|
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
|
|
"counts, sums, averages and bounds groups of aggregates",
|
|
"reports a real sum or average that overflows as the typed arithmetic error",
|
|
"never lets a label, operator or value reach SQL as text",
|
|
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
|
|
"stops a query when the context is cancelled or the deadline passes",
|
|
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
|
|
"orders datetimes chronologically across fractional seconds and offsets",
|
|
"creates one private WAL database file named by the host resource ID",
|
|
"never lets an opaque ID or a name reach outside the storage directory",
|
|
"refuses a symbolic link as storage directory, database file or ledger",
|
|
"is idempotent by operation ID and never creates a second database",
|
|
"serializes concurrent creation of one operation into one database",
|
|
"recovers creation after a crash on either side of the file, and hides half-built files",
|
|
"renames only the named database and replays a renamed operation without effect",
|
|
"reports an unknown database and creates nothing for it",
|
|
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
|
|
"encodes its receipts so the host can read them",
|
|
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
|
|
"prefixes text cells and labels that a spreadsheet would run, never numbers",
|
|
"honours columns, the row identifier column, filter, sort and the row limit of the query",
|
|
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
|
|
"streams a large table row by row with bounded memory",
|
|
"fails cleanly past the row or byte bound and keeps the bound finite by default",
|
|
"stops on cancellation, on its deadline and on a failing destination, and reports each",
|
|
"does not change the database it reads",
|
|
"records the current format of a new store and migrates nothing",
|
|
"migrates every database in its own transaction, records the version last and repeats as a no-op",
|
|
"leaves a database whose step fails exactly as it was and resumes on the next run",
|
|
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
|
|
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
|
|
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
|
|
"creates a database under the host-assigned ID and lists it only for people who may read it",
|
|
"drops the reservation when the addon refuses the name, and leaves no database",
|
|
"drops a reservation at reconcile when the crash came before the database was created",
|
|
"commits a reservation at reconcile when the crash came after the database was created",
|
|
"never exposes a database that has no host record",
|
|
"renames one database by operation, replays safely, and leaves every other database alone",
|
|
"rejects an undeclared tool, a forged addon binding and an unknown resource",
|
|
"keeps databases and operation receipts across an addon restart",
|
|
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
|
|
"creates a database from a chat proposal that only the proposer's session confirms",
|
|
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
|
|
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
|
|
"declares the row tools and refuses a row tool the manifest does not name",
|
|
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
|
|
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
|
|
"declares the schema tools and refuses any schema tool the manifest does not name",
|
|
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
|
|
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
|
|
"applies a change a chat makes at once for the chat's user, leaves no proposal, and still refuses a key",
|
|
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
|
|
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
|
|
"lists at most the bound of pending proposals and refuses more than the user's quota",
|
|
"records an inverse for an insert and removes exactly those rows on undo",
|
|
"restores the previous values of an update, for the columns it set only",
|
|
"brings deleted rows back with their row IDs and every value, nulls included",
|
|
"is idempotent by operation ID: the same ID returns the same receipt and undoes once",
|
|
"refuses the same operation ID for another change",
|
|
"refuses a stale undo with what changed and overwrites nothing",
|
|
"refuses an undo whose expected revision moved between the read and the apply",
|
|
"unwinds in order: undoing the latest change makes the earlier one undoable again",
|
|
"keeps no change set that is too large and says so at apply time",
|
|
"expires a change set after the retention and drops what it held",
|
|
"keeps the total of change sets of one database bounded by dropping the oldest",
|
|
"answers not found for a change that never existed or belongs to a read",
|
|
"removes a created table again and refuses once it was touched",
|
|
"renames a table or a column back",
|
|
"removes an added column again, with its unique index",
|
|
"restores a dropped column with its data, its type, required and unique flags",
|
|
"restores a dropped table with its columns, rows and row IDs",
|
|
"says a dropped column or table was too large to keep, at apply time",
|
|
"renames the database back only while it still has the new name",
|
|
"undoes a creation only while the database is untouched, and marks that the resource is deleted",
|
|
"keeps the change sets in the database file, so deleting the database removes them",
|
|
"tells the model and the chat that a data change can be undone, and undoes it from the person's own tab",
|
|
"never lets a key, a tool call, another session or a stranger undo, so a model cannot undo its own work",
|
|
"refuses a stale undo with what changed, and unwinds from the newest change to the oldest",
|
|
"answers not_found for a change nobody recorded",
|
|
"restores a dropped column with its data and puts a dropped table back",
|
|
"undoes the creation of a database only while nothing touched it, and deletes it then",
|
|
"lets an editor undo a data change but not a schema change"
|
|
]
|
|
},
|
|
"tables-schema": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./addons/tables/internal/store",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/tables-schema-store.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./tests/addons/tables",
|
|
"-ginkgo.json-report=../../../.cache/addons/logs/tables-schema.json"
|
|
]
|
|
],
|
|
"report": ".cache/addons/logs/tables-schema-store.json",
|
|
"reports": [
|
|
{
|
|
"path": ".cache/addons/logs/tables-schema-store.json",
|
|
"cases": [
|
|
"enforces the size cap on every connection and fails with a typed capacity error",
|
|
"builds a database under a data directory containing percent, question and hash characters",
|
|
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
|
|
"finds the committed receipt after a crash between commit and reply and never applies twice",
|
|
"replays one operation ID to one receipt and refuses another request under the same ID",
|
|
"applies one change once when the same operation arrives concurrently",
|
|
"keeps a rejected change out of the receipts so its ID is not burnt",
|
|
"encodes the receipt payload so the host can read what changed",
|
|
"creates, renames and drops tables with stable internal identifiers and one revision step each",
|
|
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
|
|
"validates labels by length, characters and case-insensitive uniqueness",
|
|
"refuses type changes, unknown operations, expressions and unknown types",
|
|
"encodes typed defaults as literals and survives hostile defaults",
|
|
"enforces required columns and refuses unique defaults that would collide",
|
|
"adds a unique column through a unique index and refuses duplicates atomically",
|
|
"drops a column by rebuilding the table and loses exactly what the preview reported",
|
|
"never hands out a row ID again after a column drop rebuilds the table",
|
|
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
|
|
"leaves the original table, data and revision intact when a rebuild fails midway",
|
|
"previews exact effects and dependent data loss and changes nothing",
|
|
"refuses a stale expected revision with the current revision and applies nothing",
|
|
"keeps finite limits on tables and columns",
|
|
"migrates a database made before the catalog existed on its first schema change",
|
|
"inserts bound rows atomically with defaults, required and unique checks",
|
|
"updates by explicit IDs and by filter and bumps only the data revision",
|
|
"deletes by IDs or filter and refuses broad, empty or oversized selections",
|
|
"previews exact count, sample and conflicts without changing anything",
|
|
"refuses a changed revision and never re-evaluates a filter against new rows",
|
|
"applies exactly one of two proposals made on the same revision",
|
|
"replays a row operation by ID and refuses another request under the same ID",
|
|
"leaves no change when the process dies before commit and finds the receipt after commit",
|
|
"reserves the row id label so no column can shadow it",
|
|
"keeps a row table's data across a column drop that rebuilds it",
|
|
"reads selected columns with stable row IDs and typed JSON values",
|
|
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
|
|
"escapes LIKE wildcards in text filters",
|
|
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
|
|
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
|
|
"counts, sums, averages and bounds groups of aggregates",
|
|
"reports a real sum or average that overflows as the typed arithmetic error",
|
|
"never lets a label, operator or value reach SQL as text",
|
|
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
|
|
"stops a query when the context is cancelled or the deadline passes",
|
|
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
|
|
"orders datetimes chronologically across fractional seconds and offsets",
|
|
"creates one private WAL database file named by the host resource ID",
|
|
"never lets an opaque ID or a name reach outside the storage directory",
|
|
"refuses a symbolic link as storage directory, database file or ledger",
|
|
"is idempotent by operation ID and never creates a second database",
|
|
"serializes concurrent creation of one operation into one database",
|
|
"recovers creation after a crash on either side of the file, and hides half-built files",
|
|
"renames only the named database and replays a renamed operation without effect",
|
|
"reports an unknown database and creates nothing for it",
|
|
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
|
|
"encodes its receipts so the host can read them",
|
|
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
|
|
"prefixes text cells and labels that a spreadsheet would run, never numbers",
|
|
"honours columns, the row identifier column, filter, sort and the row limit of the query",
|
|
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
|
|
"streams a large table row by row with bounded memory",
|
|
"fails cleanly past the row or byte bound and keeps the bound finite by default",
|
|
"stops on cancellation, on its deadline and on a failing destination, and reports each",
|
|
"does not change the database it reads",
|
|
"records the current format of a new store and migrates nothing",
|
|
"migrates every database in its own transaction, records the version last and repeats as a no-op",
|
|
"leaves a database whose step fails exactly as it was and resumes on the next run",
|
|
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
|
|
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
|
|
"records an inverse for an insert and removes exactly those rows on undo",
|
|
"restores the previous values of an update, for the columns it set only",
|
|
"brings deleted rows back with their row IDs and every value, nulls included",
|
|
"is idempotent by operation ID: the same ID returns the same receipt and undoes once",
|
|
"refuses the same operation ID for another change",
|
|
"refuses a stale undo with what changed and overwrites nothing",
|
|
"refuses an undo whose expected revision moved between the read and the apply",
|
|
"unwinds in order: undoing the latest change makes the earlier one undoable again",
|
|
"keeps no change set that is too large and says so at apply time",
|
|
"expires a change set after the retention and drops what it held",
|
|
"keeps the total of change sets of one database bounded by dropping the oldest",
|
|
"answers not found for a change that never existed or belongs to a read",
|
|
"removes a created table again and refuses once it was touched",
|
|
"renames a table or a column back",
|
|
"removes an added column again, with its unique index",
|
|
"restores a dropped column with its data, its type, required and unique flags",
|
|
"restores a dropped table with its columns, rows and row IDs",
|
|
"says a dropped column or table was too large to keep, at apply time",
|
|
"renames the database back only while it still has the new name",
|
|
"undoes a creation only while the database is untouched, and marks that the resource is deleted",
|
|
"keeps the change sets in the database file, so deleting the database removes them"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/tables-schema.json",
|
|
"cases": [
|
|
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
|
|
"creates a database under the host-assigned ID and lists it only for people who may read it",
|
|
"drops the reservation when the addon refuses the name, and leaves no database",
|
|
"drops a reservation at reconcile when the crash came before the database was created",
|
|
"commits a reservation at reconcile when the crash came after the database was created",
|
|
"never exposes a database that has no host record",
|
|
"renames one database by operation, replays safely, and leaves every other database alone",
|
|
"rejects an undeclared tool, a forged addon binding and an unknown resource",
|
|
"keeps databases and operation receipts across an addon restart",
|
|
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
|
|
"creates a database from a chat proposal that only the proposer's session confirms",
|
|
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
|
|
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
|
|
"declares the row tools and refuses a row tool the manifest does not name",
|
|
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
|
|
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
|
|
"declares the schema tools and refuses any schema tool the manifest does not name",
|
|
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
|
|
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
|
|
"applies a change a chat makes at once for the chat's user, leaves no proposal, and still refuses a key",
|
|
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
|
|
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
|
|
"lists at most the bound of pending proposals and refuses more than the user's quota",
|
|
"tells the model and the chat that a data change can be undone, and undoes it from the person's own tab",
|
|
"never lets a key, a tool call, another session or a stranger undo, so a model cannot undo its own work",
|
|
"refuses a stale undo with what changed, and unwinds from the newest change to the oldest",
|
|
"answers not_found for a change nobody recorded",
|
|
"restores a dropped column with its data and puts a dropped table back",
|
|
"undoes the creation of a database only while nothing touched it, and deletes it then",
|
|
"lets an editor undo a data change but not a schema change"
|
|
]
|
|
}
|
|
],
|
|
"cases": [
|
|
"enforces the size cap on every connection and fails with a typed capacity error",
|
|
"builds a database under a data directory containing percent, question and hash characters",
|
|
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
|
|
"finds the committed receipt after a crash between commit and reply and never applies twice",
|
|
"replays one operation ID to one receipt and refuses another request under the same ID",
|
|
"applies one change once when the same operation arrives concurrently",
|
|
"keeps a rejected change out of the receipts so its ID is not burnt",
|
|
"encodes the receipt payload so the host can read what changed",
|
|
"creates, renames and drops tables with stable internal identifiers and one revision step each",
|
|
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
|
|
"validates labels by length, characters and case-insensitive uniqueness",
|
|
"refuses type changes, unknown operations, expressions and unknown types",
|
|
"encodes typed defaults as literals and survives hostile defaults",
|
|
"enforces required columns and refuses unique defaults that would collide",
|
|
"adds a unique column through a unique index and refuses duplicates atomically",
|
|
"drops a column by rebuilding the table and loses exactly what the preview reported",
|
|
"never hands out a row ID again after a column drop rebuilds the table",
|
|
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
|
|
"leaves the original table, data and revision intact when a rebuild fails midway",
|
|
"previews exact effects and dependent data loss and changes nothing",
|
|
"refuses a stale expected revision with the current revision and applies nothing",
|
|
"keeps finite limits on tables and columns",
|
|
"migrates a database made before the catalog existed on its first schema change",
|
|
"inserts bound rows atomically with defaults, required and unique checks",
|
|
"updates by explicit IDs and by filter and bumps only the data revision",
|
|
"deletes by IDs or filter and refuses broad, empty or oversized selections",
|
|
"previews exact count, sample and conflicts without changing anything",
|
|
"refuses a changed revision and never re-evaluates a filter against new rows",
|
|
"applies exactly one of two proposals made on the same revision",
|
|
"replays a row operation by ID and refuses another request under the same ID",
|
|
"leaves no change when the process dies before commit and finds the receipt after commit",
|
|
"reserves the row id label so no column can shadow it",
|
|
"keeps a row table's data across a column drop that rebuilds it",
|
|
"reads selected columns with stable row IDs and typed JSON values",
|
|
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
|
|
"escapes LIKE wildcards in text filters",
|
|
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
|
|
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
|
|
"counts, sums, averages and bounds groups of aggregates",
|
|
"reports a real sum or average that overflows as the typed arithmetic error",
|
|
"never lets a label, operator or value reach SQL as text",
|
|
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
|
|
"stops a query when the context is cancelled or the deadline passes",
|
|
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
|
|
"orders datetimes chronologically across fractional seconds and offsets",
|
|
"creates one private WAL database file named by the host resource ID",
|
|
"never lets an opaque ID or a name reach outside the storage directory",
|
|
"refuses a symbolic link as storage directory, database file or ledger",
|
|
"is idempotent by operation ID and never creates a second database",
|
|
"serializes concurrent creation of one operation into one database",
|
|
"recovers creation after a crash on either side of the file, and hides half-built files",
|
|
"renames only the named database and replays a renamed operation without effect",
|
|
"reports an unknown database and creates nothing for it",
|
|
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
|
|
"encodes its receipts so the host can read them",
|
|
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
|
|
"prefixes text cells and labels that a spreadsheet would run, never numbers",
|
|
"honours columns, the row identifier column, filter, sort and the row limit of the query",
|
|
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
|
|
"streams a large table row by row with bounded memory",
|
|
"fails cleanly past the row or byte bound and keeps the bound finite by default",
|
|
"stops on cancellation, on its deadline and on a failing destination, and reports each",
|
|
"does not change the database it reads",
|
|
"records the current format of a new store and migrates nothing",
|
|
"migrates every database in its own transaction, records the version last and repeats as a no-op",
|
|
"leaves a database whose step fails exactly as it was and resumes on the next run",
|
|
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
|
|
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
|
|
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
|
|
"creates a database under the host-assigned ID and lists it only for people who may read it",
|
|
"drops the reservation when the addon refuses the name, and leaves no database",
|
|
"drops a reservation at reconcile when the crash came before the database was created",
|
|
"commits a reservation at reconcile when the crash came after the database was created",
|
|
"never exposes a database that has no host record",
|
|
"renames one database by operation, replays safely, and leaves every other database alone",
|
|
"rejects an undeclared tool, a forged addon binding and an unknown resource",
|
|
"keeps databases and operation receipts across an addon restart",
|
|
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
|
|
"creates a database from a chat proposal that only the proposer's session confirms",
|
|
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
|
|
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
|
|
"declares the row tools and refuses a row tool the manifest does not name",
|
|
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
|
|
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
|
|
"declares the schema tools and refuses any schema tool the manifest does not name",
|
|
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
|
|
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
|
|
"applies a change a chat makes at once for the chat's user, leaves no proposal, and still refuses a key",
|
|
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
|
|
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
|
|
"lists at most the bound of pending proposals and refuses more than the user's quota",
|
|
"records an inverse for an insert and removes exactly those rows on undo",
|
|
"restores the previous values of an update, for the columns it set only",
|
|
"brings deleted rows back with their row IDs and every value, nulls included",
|
|
"is idempotent by operation ID: the same ID returns the same receipt and undoes once",
|
|
"refuses the same operation ID for another change",
|
|
"refuses a stale undo with what changed and overwrites nothing",
|
|
"refuses an undo whose expected revision moved between the read and the apply",
|
|
"unwinds in order: undoing the latest change makes the earlier one undoable again",
|
|
"keeps no change set that is too large and says so at apply time",
|
|
"expires a change set after the retention and drops what it held",
|
|
"keeps the total of change sets of one database bounded by dropping the oldest",
|
|
"answers not found for a change that never existed or belongs to a read",
|
|
"removes a created table again and refuses once it was touched",
|
|
"renames a table or a column back",
|
|
"removes an added column again, with its unique index",
|
|
"restores a dropped column with its data, its type, required and unique flags",
|
|
"restores a dropped table with its columns, rows and row IDs",
|
|
"says a dropped column or table was too large to keep, at apply time",
|
|
"renames the database back only while it still has the new name",
|
|
"undoes a creation only while the database is untouched, and marks that the resource is deleted",
|
|
"keeps the change sets in the database file, so deleting the database removes them",
|
|
"tells the model and the chat that a data change can be undone, and undoes it from the person's own tab",
|
|
"never lets a key, a tool call, another session or a stranger undo, so a model cannot undo its own work",
|
|
"refuses a stale undo with what changed, and unwinds from the newest change to the oldest",
|
|
"answers not_found for a change nobody recorded",
|
|
"restores a dropped column with its data and puts a dropped table back",
|
|
"undoes the creation of a database only while nothing touched it, and deletes it then",
|
|
"lets an editor undo a data change but not a schema change"
|
|
]
|
|
},
|
|
"tables-rows": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./addons/tables/internal/store",
|
|
"-ginkgo.json-report=../../../../.cache/addons/logs/tables-rows-store.json"
|
|
],
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./tests/addons/tables",
|
|
"-ginkgo.json-report=../../../.cache/addons/logs/tables-rows.json"
|
|
]
|
|
],
|
|
"report": ".cache/addons/logs/tables-rows-store.json",
|
|
"reports": [
|
|
{
|
|
"path": ".cache/addons/logs/tables-rows-store.json",
|
|
"cases": [
|
|
"enforces the size cap on every connection and fails with a typed capacity error",
|
|
"builds a database under a data directory containing percent, question and hash characters",
|
|
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
|
|
"finds the committed receipt after a crash between commit and reply and never applies twice",
|
|
"replays one operation ID to one receipt and refuses another request under the same ID",
|
|
"applies one change once when the same operation arrives concurrently",
|
|
"keeps a rejected change out of the receipts so its ID is not burnt",
|
|
"encodes the receipt payload so the host can read what changed",
|
|
"creates, renames and drops tables with stable internal identifiers and one revision step each",
|
|
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
|
|
"validates labels by length, characters and case-insensitive uniqueness",
|
|
"refuses type changes, unknown operations, expressions and unknown types",
|
|
"encodes typed defaults as literals and survives hostile defaults",
|
|
"enforces required columns and refuses unique defaults that would collide",
|
|
"adds a unique column through a unique index and refuses duplicates atomically",
|
|
"drops a column by rebuilding the table and loses exactly what the preview reported",
|
|
"never hands out a row ID again after a column drop rebuilds the table",
|
|
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
|
|
"leaves the original table, data and revision intact when a rebuild fails midway",
|
|
"previews exact effects and dependent data loss and changes nothing",
|
|
"refuses a stale expected revision with the current revision and applies nothing",
|
|
"keeps finite limits on tables and columns",
|
|
"migrates a database made before the catalog existed on its first schema change",
|
|
"inserts bound rows atomically with defaults, required and unique checks",
|
|
"updates by explicit IDs and by filter and bumps only the data revision",
|
|
"deletes by IDs or filter and refuses broad, empty or oversized selections",
|
|
"previews exact count, sample and conflicts without changing anything",
|
|
"refuses a changed revision and never re-evaluates a filter against new rows",
|
|
"applies exactly one of two proposals made on the same revision",
|
|
"replays a row operation by ID and refuses another request under the same ID",
|
|
"leaves no change when the process dies before commit and finds the receipt after commit",
|
|
"reserves the row id label so no column can shadow it",
|
|
"keeps a row table's data across a column drop that rebuilds it",
|
|
"reads selected columns with stable row IDs and typed JSON values",
|
|
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
|
|
"escapes LIKE wildcards in text filters",
|
|
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
|
|
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
|
|
"counts, sums, averages and bounds groups of aggregates",
|
|
"reports a real sum or average that overflows as the typed arithmetic error",
|
|
"never lets a label, operator or value reach SQL as text",
|
|
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
|
|
"stops a query when the context is cancelled or the deadline passes",
|
|
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
|
|
"orders datetimes chronologically across fractional seconds and offsets",
|
|
"creates one private WAL database file named by the host resource ID",
|
|
"never lets an opaque ID or a name reach outside the storage directory",
|
|
"refuses a symbolic link as storage directory, database file or ledger",
|
|
"is idempotent by operation ID and never creates a second database",
|
|
"serializes concurrent creation of one operation into one database",
|
|
"recovers creation after a crash on either side of the file, and hides half-built files",
|
|
"renames only the named database and replays a renamed operation without effect",
|
|
"reports an unknown database and creates nothing for it",
|
|
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
|
|
"encodes its receipts so the host can read them",
|
|
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
|
|
"prefixes text cells and labels that a spreadsheet would run, never numbers",
|
|
"honours columns, the row identifier column, filter, sort and the row limit of the query",
|
|
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
|
|
"streams a large table row by row with bounded memory",
|
|
"fails cleanly past the row or byte bound and keeps the bound finite by default",
|
|
"stops on cancellation, on its deadline and on a failing destination, and reports each",
|
|
"does not change the database it reads",
|
|
"records the current format of a new store and migrates nothing",
|
|
"migrates every database in its own transaction, records the version last and repeats as a no-op",
|
|
"leaves a database whose step fails exactly as it was and resumes on the next run",
|
|
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
|
|
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
|
|
"records an inverse for an insert and removes exactly those rows on undo",
|
|
"restores the previous values of an update, for the columns it set only",
|
|
"brings deleted rows back with their row IDs and every value, nulls included",
|
|
"is idempotent by operation ID: the same ID returns the same receipt and undoes once",
|
|
"refuses the same operation ID for another change",
|
|
"refuses a stale undo with what changed and overwrites nothing",
|
|
"refuses an undo whose expected revision moved between the read and the apply",
|
|
"unwinds in order: undoing the latest change makes the earlier one undoable again",
|
|
"keeps no change set that is too large and says so at apply time",
|
|
"expires a change set after the retention and drops what it held",
|
|
"keeps the total of change sets of one database bounded by dropping the oldest",
|
|
"answers not found for a change that never existed or belongs to a read",
|
|
"removes a created table again and refuses once it was touched",
|
|
"renames a table or a column back",
|
|
"removes an added column again, with its unique index",
|
|
"restores a dropped column with its data, its type, required and unique flags",
|
|
"restores a dropped table with its columns, rows and row IDs",
|
|
"says a dropped column or table was too large to keep, at apply time",
|
|
"renames the database back only while it still has the new name",
|
|
"undoes a creation only while the database is untouched, and marks that the resource is deleted",
|
|
"keeps the change sets in the database file, so deleting the database removes them"
|
|
]
|
|
},
|
|
{
|
|
"path": ".cache/addons/logs/tables-rows.json",
|
|
"cases": [
|
|
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
|
|
"creates a database under the host-assigned ID and lists it only for people who may read it",
|
|
"drops the reservation when the addon refuses the name, and leaves no database",
|
|
"drops a reservation at reconcile when the crash came before the database was created",
|
|
"commits a reservation at reconcile when the crash came after the database was created",
|
|
"never exposes a database that has no host record",
|
|
"renames one database by operation, replays safely, and leaves every other database alone",
|
|
"rejects an undeclared tool, a forged addon binding and an unknown resource",
|
|
"keeps databases and operation receipts across an addon restart",
|
|
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
|
|
"creates a database from a chat proposal that only the proposer's session confirms",
|
|
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
|
|
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
|
|
"declares the row tools and refuses a row tool the manifest does not name",
|
|
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
|
|
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
|
|
"declares the schema tools and refuses any schema tool the manifest does not name",
|
|
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
|
|
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
|
|
"applies a change a chat makes at once for the chat's user, leaves no proposal, and still refuses a key",
|
|
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
|
|
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
|
|
"lists at most the bound of pending proposals and refuses more than the user's quota",
|
|
"tells the model and the chat that a data change can be undone, and undoes it from the person's own tab",
|
|
"never lets a key, a tool call, another session or a stranger undo, so a model cannot undo its own work",
|
|
"refuses a stale undo with what changed, and unwinds from the newest change to the oldest",
|
|
"answers not_found for a change nobody recorded",
|
|
"restores a dropped column with its data and puts a dropped table back",
|
|
"undoes the creation of a database only while nothing touched it, and deletes it then",
|
|
"lets an editor undo a data change but not a schema change"
|
|
]
|
|
}
|
|
],
|
|
"cases": [
|
|
"enforces the size cap on every connection and fails with a typed capacity error",
|
|
"builds a database under a data directory containing percent, question and hash characters",
|
|
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
|
|
"finds the committed receipt after a crash between commit and reply and never applies twice",
|
|
"replays one operation ID to one receipt and refuses another request under the same ID",
|
|
"applies one change once when the same operation arrives concurrently",
|
|
"keeps a rejected change out of the receipts so its ID is not burnt",
|
|
"encodes the receipt payload so the host can read what changed",
|
|
"creates, renames and drops tables with stable internal identifiers and one revision step each",
|
|
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
|
|
"validates labels by length, characters and case-insensitive uniqueness",
|
|
"refuses type changes, unknown operations, expressions and unknown types",
|
|
"encodes typed defaults as literals and survives hostile defaults",
|
|
"enforces required columns and refuses unique defaults that would collide",
|
|
"adds a unique column through a unique index and refuses duplicates atomically",
|
|
"drops a column by rebuilding the table and loses exactly what the preview reported",
|
|
"never hands out a row ID again after a column drop rebuilds the table",
|
|
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
|
|
"leaves the original table, data and revision intact when a rebuild fails midway",
|
|
"previews exact effects and dependent data loss and changes nothing",
|
|
"refuses a stale expected revision with the current revision and applies nothing",
|
|
"keeps finite limits on tables and columns",
|
|
"migrates a database made before the catalog existed on its first schema change",
|
|
"inserts bound rows atomically with defaults, required and unique checks",
|
|
"updates by explicit IDs and by filter and bumps only the data revision",
|
|
"deletes by IDs or filter and refuses broad, empty or oversized selections",
|
|
"previews exact count, sample and conflicts without changing anything",
|
|
"refuses a changed revision and never re-evaluates a filter against new rows",
|
|
"applies exactly one of two proposals made on the same revision",
|
|
"replays a row operation by ID and refuses another request under the same ID",
|
|
"leaves no change when the process dies before commit and finds the receipt after commit",
|
|
"reserves the row id label so no column can shadow it",
|
|
"keeps a row table's data across a column drop that rebuilds it",
|
|
"reads selected columns with stable row IDs and typed JSON values",
|
|
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
|
|
"escapes LIKE wildcards in text filters",
|
|
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
|
|
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
|
|
"counts, sums, averages and bounds groups of aggregates",
|
|
"reports a real sum or average that overflows as the typed arithmetic error",
|
|
"never lets a label, operator or value reach SQL as text",
|
|
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
|
|
"stops a query when the context is cancelled or the deadline passes",
|
|
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
|
|
"orders datetimes chronologically across fractional seconds and offsets",
|
|
"creates one private WAL database file named by the host resource ID",
|
|
"never lets an opaque ID or a name reach outside the storage directory",
|
|
"refuses a symbolic link as storage directory, database file or ledger",
|
|
"is idempotent by operation ID and never creates a second database",
|
|
"serializes concurrent creation of one operation into one database",
|
|
"recovers creation after a crash on either side of the file, and hides half-built files",
|
|
"renames only the named database and replays a renamed operation without effect",
|
|
"reports an unknown database and creates nothing for it",
|
|
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
|
|
"encodes its receipts so the host can read them",
|
|
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
|
|
"prefixes text cells and labels that a spreadsheet would run, never numbers",
|
|
"honours columns, the row identifier column, filter, sort and the row limit of the query",
|
|
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
|
|
"streams a large table row by row with bounded memory",
|
|
"fails cleanly past the row or byte bound and keeps the bound finite by default",
|
|
"stops on cancellation, on its deadline and on a failing destination, and reports each",
|
|
"does not change the database it reads",
|
|
"records the current format of a new store and migrates nothing",
|
|
"migrates every database in its own transaction, records the version last and repeats as a no-op",
|
|
"leaves a database whose step fails exactly as it was and resumes on the next run",
|
|
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
|
|
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
|
|
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
|
|
"creates a database under the host-assigned ID and lists it only for people who may read it",
|
|
"drops the reservation when the addon refuses the name, and leaves no database",
|
|
"drops a reservation at reconcile when the crash came before the database was created",
|
|
"commits a reservation at reconcile when the crash came after the database was created",
|
|
"never exposes a database that has no host record",
|
|
"renames one database by operation, replays safely, and leaves every other database alone",
|
|
"rejects an undeclared tool, a forged addon binding and an unknown resource",
|
|
"keeps databases and operation receipts across an addon restart",
|
|
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
|
|
"creates a database from a chat proposal that only the proposer's session confirms",
|
|
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
|
|
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
|
|
"declares the row tools and refuses a row tool the manifest does not name",
|
|
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
|
|
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
|
|
"declares the schema tools and refuses any schema tool the manifest does not name",
|
|
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
|
|
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
|
|
"applies a change a chat makes at once for the chat's user, leaves no proposal, and still refuses a key",
|
|
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
|
|
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
|
|
"lists at most the bound of pending proposals and refuses more than the user's quota",
|
|
"records an inverse for an insert and removes exactly those rows on undo",
|
|
"restores the previous values of an update, for the columns it set only",
|
|
"brings deleted rows back with their row IDs and every value, nulls included",
|
|
"is idempotent by operation ID: the same ID returns the same receipt and undoes once",
|
|
"refuses the same operation ID for another change",
|
|
"refuses a stale undo with what changed and overwrites nothing",
|
|
"refuses an undo whose expected revision moved between the read and the apply",
|
|
"unwinds in order: undoing the latest change makes the earlier one undoable again",
|
|
"keeps no change set that is too large and says so at apply time",
|
|
"expires a change set after the retention and drops what it held",
|
|
"keeps the total of change sets of one database bounded by dropping the oldest",
|
|
"answers not found for a change that never existed or belongs to a read",
|
|
"removes a created table again and refuses once it was touched",
|
|
"renames a table or a column back",
|
|
"removes an added column again, with its unique index",
|
|
"restores a dropped column with its data, its type, required and unique flags",
|
|
"restores a dropped table with its columns, rows and row IDs",
|
|
"says a dropped column or table was too large to keep, at apply time",
|
|
"renames the database back only while it still has the new name",
|
|
"undoes a creation only while the database is untouched, and marks that the resource is deleted",
|
|
"keeps the change sets in the database file, so deleting the database removes them",
|
|
"tells the model and the chat that a data change can be undone, and undoes it from the person's own tab",
|
|
"never lets a key, a tool call, another session or a stranger undo, so a model cannot undo its own work",
|
|
"refuses a stale undo with what changed, and unwinds from the newest change to the oldest",
|
|
"answers not_found for a change nobody recorded",
|
|
"restores a dropped column with its data and puts a dropped table back",
|
|
"undoes the creation of a database only while nothing touched it, and deletes it then",
|
|
"lets an editor undo a data change but not a schema change"
|
|
]
|
|
},
|
|
"tables-tools": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/tables_tools.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: tools: the namespace is the brokered add-on tool names only",
|
|
"unit: tools: a proposal result of an add-on tool gives its identifier and nothing else",
|
|
"unit: tools: other kinds, other tools and malformed identifiers give no card",
|
|
"unit: tools: the stored history keeps the reference of a proposal and no row data",
|
|
"unit: tools: the card facts come from the stored proposal and never from model text",
|
|
"unit: tools: stale, expired, blocked and settled proposals cannot be decided",
|
|
"unit: tools: a confirmation names the displayed proposal and its digest and nothing a model supplied",
|
|
"go: accepts the Tables definitions and classifies every model-facing tool",
|
|
"go: keeps the schema bytes of a parsed manifest equal to what the runtime echoes back",
|
|
"go: rejects a definition that declares an identity, role, approval or operation property",
|
|
"go: rejects an undeclared tool, a repeated tool, an unknown kind and a missing or unbounded schema",
|
|
"go: binds every tool kind of a chat call to the chat",
|
|
"go: refuses a call of the chats adapter that names a conversation without its binding",
|
|
"go: refuses an incomplete chat call",
|
|
"go: leaves the calls of other consumers without a binding",
|
|
"go: binds one actor to an executor and serves tools through the broker only",
|
|
"go: refuses to bind an executor when the owner denies the actor",
|
|
"go: routes the add-on namespace to the broker and never to another executor",
|
|
"go: never offers or runs a tool of an MCP session under the add-on namespace",
|
|
"go: reads the opt-in once and answers a surface that has no broker with a typed rejection",
|
|
"go: takes the actor from the trusted request context only",
|
|
"go: classifies every source file that discovers or executes tools",
|
|
"go: flags source that hands sessions to the agent library without the namespace filter",
|
|
"go: installs the namespace filter wherever sessions reach the agent library",
|
|
"go: names a reason and an enforcement for every rejection and an actor for every route, with real files",
|
|
"go: keeps the table of the Tables documentation in step with the matrix",
|
|
"go: lets only the brokered consumers import the adapter",
|
|
"go: has no add-on tool and no add-on route in the admin assistant catalog",
|
|
"go: discovers namespaced tools with schemas from the manifest for enabled running addons only",
|
|
"go: offers nothing for a disabled, stopped or failed addon and nothing when the owner cannot answer",
|
|
"go: has no tool for sharing, deleting a database, purging retained data or approving",
|
|
"go: drops a definition whose namespaced name is not a valid function name or does not fit",
|
|
"go: reads through the gateway with the immutable actor, the listed generation and the resource taken out of the arguments",
|
|
"go: refuses an oversized result instead of truncating it",
|
|
"go: returns file results as private artifact references with no bytes",
|
|
"go: passes a denial, an outage and an unknown outcome through unchanged",
|
|
"go: turns a row change into a proposal reference and never applies",
|
|
"go: proposes schema changes under the schema action and creation with no resource",
|
|
"go: gives every call its own operation ID so one call can never replay another",
|
|
"go: reports a proposal outage with the typed error and no reference",
|
|
"go: rejects forged identity, role, approval and operation fields before anything reaches the owner",
|
|
"go: rejects approval aliases, undefined tools and names outside the namespace",
|
|
"go: rejects arguments that are not exactly one bounded object with known, typed properties",
|
|
"go: has no way to confirm, cancel or resolve a proposal",
|
|
"go: uses the actor of each call and nothing a previous call left behind",
|
|
"go: refuses an actor without a user or credential before any call",
|
|
"go: serves the real gateway type as its backend",
|
|
"go: lists the caller's own pending proposals the same from the owner and every forwarding frontend",
|
|
"go: offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
|
|
"go: applies a change a chat makes at once for the chat's user, leaves no proposal, and still refuses a key",
|
|
"go: stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
|
|
"go: keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
|
|
"go: lists at most the bound of pending proposals and refuses more than the user's quota",
|
|
"go: gives the model an error result that says the request was invalid, for a read and for a change",
|
|
"go: keeps an outage an error, never the refused result",
|
|
"go: are never offered to a model and are unknown when a model calls them",
|
|
"go: applies a row change for the chat adapter, as the actor, with the digest it just stored",
|
|
"go: says a change can be undone when the add-on kept a change set, with the change ID and what undo does",
|
|
"go: says why a change cannot be undone when the add-on says so, and never trusts an undo note with a bad ID",
|
|
"go: gives a reason when the add-on says nothing about undo",
|
|
"go: keeps the result with the longest undo text small enough for the chat",
|
|
"go: stays under the chat's 2 KiB cap for the tool result even with every excerpt at its largest",
|
|
"go: keeps the result small enough for the chat to store as valid JSON",
|
|
"go: applies a creation and a schema change too",
|
|
"go: never confirms for an adapter that is not the chats one, even over an owner that could",
|
|
"go: keeps a proposal when the owner cannot apply, so nothing is lost",
|
|
"go: withdraws the proposal and reports the error when the apply is refused as stale",
|
|
"go: tells the model the call was invalid when the add-on refuses it, and withdraws the proposal",
|
|
"go: does not withdraw, and does not claim success, when the outcome is unknown",
|
|
"go: does not report a change that the add-on rejected at the apply",
|
|
"go: reads the list of add-ons next to the opt-in and consumes both keys",
|
|
"go: keeps the boolean form unchanged: a nil list offers every add-on",
|
|
"go: offers only the tools of the listed add-ons",
|
|
"go: hides the tools of the named add-ons and refuses a call to them as unknown, whatever the list says",
|
|
"go: offers nothing for an empty list and for ids that match no add-on",
|
|
"go: refuses a call to an add-on that is not listed, as an unknown tool, before the owner is reached",
|
|
"go: applies the list through the provider and keeps the actor binding",
|
|
"go: passes on the reason the add-on gave, such as a missing engine, and not the generic class",
|
|
"go: tells the model a missing permission and an unreachable resource in plain words, for a read and for a change",
|
|
"go: accepts a call whose bound body is exactly 1 MiB, end to end, and refuses one byte more",
|
|
"go: offers an action tool to the chats adapter and to nobody else",
|
|
"go: runs an action tool for the chats adapter as the actor, with the act action, and returns its payload",
|
|
"go: tells an action tool which conversation it runs in, from the chat and never from the model",
|
|
"go: does not run an action tool for any other adapter, and says the tool is unknown",
|
|
"go: is unavailable when the owner cannot act, and never falls back to a read or a proposal",
|
|
"go: keeps the argument rules: an identity argument is refused before anything runs",
|
|
"go: are listed in any state, with the names they replace and whether they run",
|
|
"go: keeps its namespaced name and carries the built-in it shadows, only for a replaceable name"
|
|
]
|
|
},
|
|
"tables-admin": {
|
|
"kind": "ginkgo",
|
|
"commands": [
|
|
[
|
|
"go",
|
|
"test",
|
|
"-count=1",
|
|
"-p",
|
|
"2",
|
|
"-tags",
|
|
"auth",
|
|
"./tests/addons/tablesadmin",
|
|
"-ginkgo.json-report=../../../.cache/addons/logs/tables-admin.json"
|
|
]
|
|
],
|
|
"report": ".cache/addons/logs/tables-admin.json",
|
|
"cases": [
|
|
"keys a reference by user, conversation and add-on, bounds it per user and in total and expires what is unused",
|
|
"is durable, held by one process, never resets a corrupt file and stops writing after a failed sync",
|
|
"serves concurrent users without losing a reference",
|
|
"keeps the newest bounded number, validates them on load and remaps them with the owner",
|
|
"creates private databases by the person's own action, once per operation, and lists them only for their owner",
|
|
"keeps the owner, editor and viewer matrix on the UI routes and shows each person only their own role",
|
|
"shares whole databases by immutable account ID behind a bounded picker that tells nothing else",
|
|
"keeps sharing disabled in local-owner mode with a typed answer and no named users",
|
|
"waits for a revoked user's admitted work and cancels it before acknowledging the revocation",
|
|
"answers every typed denial exactly as the owner does and carries every mutation to the owner",
|
|
"reports an unknown outcome with the original operation ID and leaves reads plainly unavailable when the owner cannot be reached",
|
|
"answers the sharing denial of local-owner mode the same from a frontend",
|
|
"deletes the data, the grants and the pending proposals only on the owner's typed confirmation and keeps the add-on installed",
|
|
"stops and waits for admitted work of every user before it asks the add-on to delete",
|
|
"makes the add-on refuse its delete tool under every action but the host's delete action",
|
|
"never offers the delete tool to a model, a proposal, a typed read or an agent",
|
|
"denies a stale tab: the generation and the revision the owner saw decide, and nothing is removed",
|
|
"finishes or undoes a deletion that a crash interrupted at every step",
|
|
"keeps the delete tool out of the model tools and their definitions",
|
|
"refuses an admin tool that is also a model tool, has a definition, or is not mapped",
|
|
"documents every route, every emitted field and every typed answer in the Swagger spec",
|
|
"lists every route in the instructions registry, the feature registry and the documentation, with no MCP tool for any",
|
|
"keeps one selection per user, conversation and add-on, across people, conversations and restarts",
|
|
"lets a tool call omit the database in a conversation and resolves it at the owner with typed errors",
|
|
"withdraws the management and the tool path while the add-on is disabled and restores them on enable",
|
|
"answers a revoked, deleted or tampered reference like an unknown database and never reuses it",
|
|
"applies schema and row changes under the roles of the host, once per operation, with a receipt and no proposal",
|
|
"refuses crafted writes by a viewer, an editor's schema change, a revoked editor and an installation administrator",
|
|
"carries a UI change to the owner from a forwarding frontend and answers as the owner does",
|
|
"exports a table with exact bytes and attachment headers over real HTTP and shows no one else the file",
|
|
"keeps a shared database's file private, applies the person's own filter and sort, and denies after the grant is withdrawn",
|
|
"serves the same bytes and headers through a forwarding frontend, and fails the same way for a stranger",
|
|
"answers a result past the export limit as data with no file",
|
|
"binds an output handle to its operation, person and database",
|
|
"fails a truncated, grown or vanished stream and never serves it",
|
|
"fails the transfer when the store cannot write, and when the source is revoked before completion",
|
|
"expires the file only, enforces the quota per person and leaves the database as it was"
|
|
]
|
|
},
|
|
"tables-ui": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/tables_ui.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: resources: every call carries this add-on and its generation and nothing the add-on chose",
|
|
"unit: resources: an operation identifier chosen by the caller is kept across a retry",
|
|
"unit: resources: nothing is sent once the add-on is withdrawn",
|
|
"unit: resources: a malformed identifier is refused before any request",
|
|
"unit: resources: the request of each call names the route, the method and the own-session confirmation",
|
|
"unit: resources: an unknown operation and a body the host did not shape are refused",
|
|
"unit: resources: typed answers of the host keep their type for the page",
|
|
"unit: resources: the client of a stale answer is told it is stale",
|
|
"unit: resources: a typed read names the resource the person chose and the client sends it",
|
|
"unit: resources: a typed read always carries an operation identifier the owner accepts",
|
|
"unit: resources: the conversation header goes on a chat request that uses add-on tools, and only a well-formed one",
|
|
"unit: batch: typed rows become wire rows and an untouched optional column is left to its default",
|
|
"unit: batch: every cell error is named by row and column and nothing is sent",
|
|
"unit: batch: steps stay inside the add-on bounds",
|
|
"unit: batch: the selection toggles by row identifier and survives paging",
|
|
"unit: layout: Share is offered only where the installation has named accounts",
|
|
"unit: layout: a table with no rows offers Add rows once, in its empty state",
|
|
"unit: layout: a reader, or a table with no columns, is offered no Add rows",
|
|
"unit: errors: each answer of the host gets its own words and recovery",
|
|
"unit: codecs: text keeps what was typed, bounds it, and null is explicit",
|
|
"unit: codecs: integers are exact up to 64 bits and never silently rounded",
|
|
"unit: codecs: reals are finite numbers",
|
|
"unit: codecs: booleans are true, false or empty for an optional column",
|
|
"unit: codecs: datetimes are read as UTC and sent as RFC 3339",
|
|
"unit: codecs: an unknown column type is refused",
|
|
"unit: codecs: the editor round-trips stored values",
|
|
"unit: codecs: grid text and the unchanged-field test",
|
|
"unit: codecs: a datetime with a fraction of a second is not rewritten by editing another field",
|
|
"unit: codecs: datetimes are compared as instants and offsets are normalised",
|
|
"unit: filters: operators follow the column type",
|
|
"unit: filters: a leaf, a list and the null tests are built from typed values",
|
|
"unit: filters: a condition that cannot be sent is an error, never dropped",
|
|
"unit: query: the arguments are the tool schema and nothing else",
|
|
"unit: query: pages go forward by the add-on cursor and back by the ones kept",
|
|
"unit: query: a column header cycles ascending, descending and none",
|
|
"unit: i18n: every language of the host has every key of the English bundle and nothing else",
|
|
"unit: i18n: a translation keeps the placeholders of the English text and carries no markup",
|
|
"unit: build: the bundle is plain JavaScript that names nothing it does not define",
|
|
"unit: build: the module exports createAddon and imports nothing",
|
|
"unit: render: createAddon returns the page, the declared component, a chat action and dispose",
|
|
"unit: render: the list, one database and the picker draw their loading state without a host",
|
|
"unit: render: what the page read is emptied when the add-on is withdrawn, by signal and by dispose",
|
|
"unit: retry: a read that met an unavailable add-on is tried again and then succeeds",
|
|
"unit: retry: it gives the last error back after the bound and never loops",
|
|
"unit: retry: a refusal, a stale answer or an unknown outcome is never repeated",
|
|
"unit: retry: a withdrawn add-on stops the waiting and the reads",
|
|
"go: applies schema and row changes under the roles of the host, once per operation, with a receipt and no proposal",
|
|
"go: refuses crafted writes by a viewer, an editor's schema change, a revoked editor and an installation administrator",
|
|
"go: carries a UI change to the owner from a forwarding frontend and answers as the owner does",
|
|
"tables-ui: a new database is private to its owner and a second person sees nothing of it",
|
|
"tables-ui: the owner builds a schema and rows, shares by name and each role gets its own controls",
|
|
"tables-ui: typed editors, structured filters, sort, paging and bounded batches work on real rows",
|
|
"tables-ui: editing another column leaves a datetime with a fraction of a second byte-identical",
|
|
"tables-ui: a revoke while a person is editing denies the next save and the page says it is unavailable",
|
|
"tables-ui: an installation administrator sees no database of other people and has no data privilege",
|
|
"tables-ui: deleting a database shows the warnings, needs the typed name and removes data and shares",
|
|
"tables-ui: a tab of an older generation is denied after an upgrade and after a disable",
|
|
"tables-ui: the pages work by keyboard, at 400 pixels and in the light and dark themes",
|
|
"tables-ui: logging out clears what was read and the next person on the same tab sees none of it",
|
|
"tables-ui: in local-owner mode sharing is disabled and the owner still manages databases"
|
|
]
|
|
},
|
|
"tables-csv": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/tables_csv.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: artifacts: only a host identifier names a file, and the only link is the host route",
|
|
"unit: artifacts: the card offers a download only for a complete file that has not expired",
|
|
"unit: artifacts: sizes are written with a binary unit",
|
|
"unit: artifacts: a tool result keeps well formed identifiers of its own kind only, at most four",
|
|
"unit: export: the view becomes the arguments of the tool and nothing a page or a cursor",
|
|
"unit: export: the answer is a file, or the reason there is none",
|
|
"go: writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
|
|
"go: prefixes text cells and labels that a spreadsheet would run, never numbers",
|
|
"go: honours columns, the row identifier column, filter, sort and the row limit of the query",
|
|
"go: reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
|
|
"go: streams a large table row by row with bounded memory",
|
|
"go: fails cleanly past the row or byte bound and keeps the bound finite by default",
|
|
"go: stops on cancellation, on its deadline and on a failing destination, and reports each",
|
|
"go: does not change the database it reads",
|
|
"go: answers with one operation-bound CSV output whose bytes the handle streams exactly once",
|
|
"go: refuses a handle from another user, another operation, another database or after expiry, and removes expired files",
|
|
"go: keeps a handle for a retry until the stream completed",
|
|
"go: reports a result past the limit as data without an output, and leaves no file",
|
|
"go: removes the staged file when the export fails and bounds what stays staged",
|
|
"go: is a read that needs the read action and refuses unknown fields and mutation arguments",
|
|
"go: serves the bytes on the protocol output route to the matching envelope only",
|
|
"go: exports a table with exact bytes and attachment headers over real HTTP and shows no one else the file",
|
|
"go: keeps a shared database's file private, applies the person's own filter and sort, and denies after the grant is withdrawn",
|
|
"go: serves the same bytes and headers through a forwarding frontend, and fails the same way for a stranger",
|
|
"go: answers a result past the export limit as data with no file",
|
|
"go: binds an output handle to its operation, person and database",
|
|
"go: fails a truncated, grown or vanished stream and never serves it",
|
|
"go: fails the transfer when the store cannot write, and when the source is revoked before completion",
|
|
"go: expires the file only, enforces the quota per person and leaves the database as it was",
|
|
"go: serves identical bytes and headers from every replica and denies every other way in",
|
|
"tables-artifacts: the person exports the view they see and downloads exact bytes with attachment headers",
|
|
"tables-artifacts: another person is denied exactly like an unknown file, shared or not",
|
|
"tables-artifacts: a viewer exports what they may read and withdrawing the share ends the download",
|
|
"tables-artifacts: a result past the export limit gives a message and no file",
|
|
"tables-artifacts: a person at the file quota is told so and no file is made",
|
|
"tables-artifacts: in local-owner mode the owner exports and downloads with no account",
|
|
"go: refuses columns-add under a write action, on preview and on apply",
|
|
"go: refuses databases-rename under a write action, on preview and on apply",
|
|
"go: refuses tables-create under a write action, on preview and on apply",
|
|
"go: refuses columns-add under the schema action with the wrong scope or no actor",
|
|
"go: refuses databases-rename under the schema action with the wrong scope or no actor",
|
|
"go: refuses tables-create under the schema action with the wrong scope or no actor",
|
|
"go: still previews and applies a schema change under the schema action",
|
|
"go: says in the receipt of a write that it can be undone, and reads and applies the undo",
|
|
"go: rejects a stale undo with a typed code and the words of what changed",
|
|
"go: rejects an unknown change as not_found and a repeated one as already_undone",
|
|
"go: refuses the undo under any other action or scope, and with no actor",
|
|
"go: does not preview the undo: it is applied against the revision the host just read"
|
|
]
|
|
},
|
|
"recovery": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/recovery.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: recovery: the owner's typed refusals keep their type and nothing else is invented",
|
|
"unit: recovery: the banner never reads an unknown state as ready",
|
|
"unit: recovery: upgrade progress follows the journaled phases",
|
|
"unit: recovery: the verification state is a word before it is a colour",
|
|
"unit: recovery: every refusal has words, and an unknown outcome keeps its own",
|
|
"unit: recovery: every locale carries the same recovery keys as English",
|
|
"unit: recovery: a restore needs a stopped add-on, the typed ID and, from another mode, an account",
|
|
"unit: recovery: a purge needs a scope and an add-on that is not running",
|
|
"unit: recovery: the client sends the operation as the confirmation header and types the refusals",
|
|
"go: backs up, publishes the package, migrates, checks health and publishes the generation in that order",
|
|
"go: undoes a failure at every journal phase before the publication and puts the old generation back on its own data",
|
|
"go: finishes an upgrade whose publication was made when a later step failed",
|
|
"go: applies one rule after a restart at any phase: unpublished is undone, published is finished",
|
|
"go: refuses a changed trusted identity and an older data format before it stops or writes anything",
|
|
"go: keeps the add-on unavailable in needs-recovery after a failed migration to a new format and retains the package and the recovery copy",
|
|
"go: restores the backup itself when a migration that keeps the format fails halfway",
|
|
"go: keeps a running add-on unavailable and recoverable when the backup cannot be verified at rollback",
|
|
"go: copies a WAL database consistently with a manifest, digests, restricted permissions and the owner state",
|
|
"go: holds admission and invalidates pending proposals for the add-on while it copies",
|
|
"go: reports a corrupt backup and refuses to use it",
|
|
"go: stops before copying when the storage is too small and leaves no partial backup",
|
|
"go: leaves no partial backup after a cancellation and starts the add-on again",
|
|
"go: starts the add-on again when the copy fails",
|
|
"go: keeps the only verified copy and the upgrade recovery copy under an explicit retention policy",
|
|
"go: never lets age or count remove the newest verified backup when retention is applied on demand",
|
|
"go: restores a local-owner backup to a named account through an explicit mapping",
|
|
"go: needs an administrator, the typed add-on ID, an explicit scope and an add-on that is not running",
|
|
"go: removes the data and its records but keeps the backups unless they are in the scope",
|
|
"go: touches no other add-on",
|
|
"go: finishes a purge that stopped after its journal was written",
|
|
"go: clears needs-recovery when the data it described is purged",
|
|
"go: refuses a backup when the policy cannot drain admitted work",
|
|
"go: refuses a backup of another add-on and touches neither data nor access",
|
|
"go: never lets a manual backup of half migrated data displace the pinned recovery copy",
|
|
"go: puts the data and the owner state back, warns about lost writes and keeps the replaced data as a recovery copy",
|
|
"go: counts the operations applied after the backup as lost writes",
|
|
"go: does not give back access that was taken away or whose account is gone",
|
|
"go: survives a restart that forgets the in-memory state: the revocation log is durable",
|
|
"go: refuses a running add-on, a stranger, an unknown backup and an invalid mapping without changing anything",
|
|
"go: refuses a backup of another trusted identity or of a newer data format",
|
|
"go: resumes or rolls back a restore that stopped at each phase, by one rule",
|
|
"go: holds the resources of one add-on and leaves another add-on alone",
|
|
"go: cancels admitted work and reports a drain that did not finish",
|
|
"go: restores grants through the account directory and the lowerings since the backup, never beyond them",
|
|
"go: keeps a bounded durable log of lowered access",
|
|
"go: keeps a revocation however many later lowerings of another person follow",
|
|
"go: restores the data but no access when the history may have lost a lowering",
|
|
"go: reads a store that is full of lowerings as one whose history may be cut",
|
|
"go: applies a lowering made after the export whatever time the backup is given",
|
|
"go: refuses a change that was authorized just before the hold began",
|
|
"go: cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
|
|
"go: forgets the records of one add-on and no other",
|
|
"go: maps an owner on a restore to a local-owner store only when nothing named is in it",
|
|
"go: migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
|
|
"go: records the current format of a new store and migrates nothing",
|
|
"go: migrates every database in its own transaction, records the version last and repeats as a no-op",
|
|
"go: leaves a database whose step fails exactly as it was and resumes on the next run",
|
|
"go: refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
|
|
"go: makes a backup only for an administrator's own browser session and lists it",
|
|
"go: restores with warnings and does not give back a share that was revoked after the backup",
|
|
"go: restores only a backup of the add-on in the route and touches nothing otherwise",
|
|
"go: gives a forwarding frontend the same typed answers as the owner",
|
|
"go: purges only with the typed ID, a stopped add-on and an explicit scope, and touches nothing else",
|
|
"go: is never reachable by a model: no tool, no declared name and no route for an API key",
|
|
"go: upgrades an add-on with data through a backup and a migration and keeps its databases",
|
|
"go: undoes an upgrade whose package does not start and runs the old generation on its own data",
|
|
"go: hands retained data only to the same trusted source on a reinstall",
|
|
"go: documents every route and every emitted field in the Swagger spec, the instructions and the feature registry",
|
|
"recovery: an administrator backs up from the manage sheet and the backup is listed as verified",
|
|
"recovery: a person and a key cannot back up, restore or purge, and only the owner session of an administrator can",
|
|
"recovery: the restore dialog warns, asks for the typed ID and a restore does not give back a revoked share",
|
|
"recovery: a second backup, the sole recovery copy is kept and the keyboard reaches every action",
|
|
"recovery: the page shows a needs-recovery banner with restore and purge as the actions (status mocked)",
|
|
"recovery: a purge needs a scope, the typed ID and a stopped add-on, and removes the data and its shares"
|
|
]
|
|
},
|
|
"packaging": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/package_test.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"go: joins every enabled platform leg into one verified index",
|
|
"go: never creates a partial index when an enabled platform has no leg",
|
|
"go: refuses duplicate legs, local-check legs, other versions and extra platforms",
|
|
"go: refuses a merged layout that lost a platform after the merge",
|
|
"go: builds a deterministic platform layout with executable, ui and manifest layers",
|
|
"go: restores the validated executable mode on extraction",
|
|
"go: refuses a platform that the matrix has not enabled unless it is a local check",
|
|
"go: refuses an invalid version, an existing layout and an empty executable",
|
|
"go: rejects a package without its entrypoint",
|
|
"go: rejects a declared UI whose layer or files are missing",
|
|
"go: rejects a package without a required runtime library",
|
|
"go: rejects a manifest whose platform differs from the image",
|
|
"go: rejects an image config or annotation of another platform",
|
|
"go: rejects a manifest version that differs from the release version",
|
|
"go: rejects another artifact type",
|
|
"go: rejects unexpected layers, roles and layer media types",
|
|
"go: rejects an unexpected file in the executable layer",
|
|
"go: rejects a blob whose bytes differ from its digest",
|
|
"go: rejects a receipt that does not match the image",
|
|
"go: rejects invalid extraction permissions",
|
|
"go: rejects a UI file that is executable or outside the declared directory",
|
|
"go: rejects traversal paths, links and duplicates",
|
|
"go: rejects a UI that bundles its own React runtime",
|
|
"go: rejects an icon that is not an image of its type",
|
|
"go: rejects an invalid platform layout marker or index",
|
|
"go: moves development forward and leaves it alone for an older commit",
|
|
"go: accepts a diverged branch head and refuses one commit with two contents",
|
|
"go: moves latest only to a newer stable version",
|
|
"go: refuses reserved or foreign alias names and unpublished digests, leaving aliases unchanged",
|
|
"go: promotes a branch channel under its hashed name",
|
|
"go: treats a force-pushed branch as the new truth for a push to the same ref",
|
|
"go: blocks the alias for anything but a push to the channel's own ref",
|
|
"go: refuses development when its commit is unreachable, even for a push",
|
|
"go: fails on any git error that is not a plain not-ancestor answer",
|
|
"go: tells an unreachable commit from a plain not-ancestor",
|
|
"go: accepts the add-on namespace and refuses every other go-skynet repository",
|
|
"go: reads a YAML list and refuses JSON, unknown fields and a second document",
|
|
"go: refuses missing and backend repositories before any request",
|
|
"go: pushes platform digests then the index, and a retry is digest-identical",
|
|
"go: rejects overwriting an immutable version with different content",
|
|
"go: adopts published content only for the same version and commit",
|
|
"go: refuses reserved aliases and mismatched tags as immutable tags",
|
|
"go: publishes nothing from a partial or local-check layout",
|
|
"go: fails closed when no platform is enabled, the file is absent or empty",
|
|
"go: rejects enabled platforms without a native runner or check, duplicates and unknown fields",
|
|
"go: prints the enabled platforms with their native runners",
|
|
"go: ships the checked-in matrix with every platform disabled until its native check passes",
|
|
"go: renders digest-pinned entries with an explicit add-on signer identity",
|
|
"go: renders an entry for every first-party add-on from its own template",
|
|
"go: refuses missing inputs, backend repositories, bad channels and unknown placeholders",
|
|
"go: carries placeholders only: no fabricated URL, registry or namespace",
|
|
"go: never publishes from a pull request, whatever the ref",
|
|
"go: maps master alone to development and publishes the commit tag",
|
|
"go: never publishes from a branch push, whatever the branch is named",
|
|
"go: keeps reserved names out of the branch namespace",
|
|
"go: separates refs that normalize to the same label",
|
|
"go: bounds empty, Unicode and very long branch names",
|
|
"go: lets a tag push prepare the immutable version and never move latest",
|
|
"go: promotes latest only for a published, stable, non-draft release",
|
|
"go: rejects unknown events and a malformed commit",
|
|
"go: prints the decision as key=value lines",
|
|
"go: accepts the checked-in workflow",
|
|
"go: rejects pull_request_target",
|
|
"go: rejects secrets in a pull request validation job",
|
|
"go: rejects id-token write outside the publishing job",
|
|
"go: rejects a registry login or publish in an untrusted job",
|
|
"go: rejects publish that does not wait for every platform leg",
|
|
"go: rejects publish that can run after a failed leg",
|
|
"go: rejects publish that does not need validate",
|
|
"go: rejects a package leg that does not need validate",
|
|
"go: rejects a validate job that cannot stop the release",
|
|
"go: rejects a package or promote job that runs after a failed validate",
|
|
"go: keeps validate unprivileged on every event",
|
|
"go: rejects promotion that does not wait for signing",
|
|
"go: rejects alias promotion before signing",
|
|
"go: rejects an alias command inside the publishing job",
|
|
"go: rejects a literal latest tag",
|
|
"go: rejects backend registries and backend workflows",
|
|
"go: rejects a signer identity that is a pattern or the backend workflow",
|
|
"go: rejects signing by tag or without referrers and the new bundle format",
|
|
"go: rejects missing serialization per channel",
|
|
"go: rejects publication that is shared between add-ons",
|
|
"go: rejects a workflow that names one add-on by path or skips an add-on in the matrix",
|
|
"go: rejects a plan that does not refuse an add-on without an enabled platform",
|
|
"go: rejects a plan that does not fail closed on missing configuration",
|
|
"go: rejects a plan that does not exit 1 for an add-on without an enabled platform on a publishing event",
|
|
"go: rejects a plan that treats any matrix error as no legs",
|
|
"go: rejects a repository rule that does not keep the configured repository for tables",
|
|
"go: rejects a publish or promote matrix that stops the other add-ons on a failure",
|
|
"go: rejects a publish job that downloads the layouts of other add-ons",
|
|
"go: rejects a promote job that does not check the digest format",
|
|
"go: derives a repository that the add-on tools accept for every add-on from the documented variable",
|
|
"go: fails on a publishing event when an add-on has no enabled platform",
|
|
"go: publishes when every add-on has an enabled platform",
|
|
"go: gives an add-on without an enabled platform no legs on an event that publishes nothing",
|
|
"go: fails on a missing or malformed platform file on every event",
|
|
"go: rejects a checkout of the pull request head or a persisted token",
|
|
"go: rejects write permission at workflow level and a literal platform matrix",
|
|
"go: rejects a publishing job without an environment or a gate",
|
|
"go: does not trust the backend workflow identity in the documented verification",
|
|
"go: installs the package built by package.sh and starts its executable",
|
|
"go: is refused when the signature carries another workflow identity",
|
|
"go: is refused when the owner policy names the backend workflow",
|
|
"go: is refused when the pinned digest is not the published image",
|
|
"go: gives identical digests for two builds of the same inputs",
|
|
"go: refuses a platform the matrix does not enable and a missing executable of another platform",
|
|
"package.sh builds and verifies a local check layout",
|
|
"package.sh refuses a platform the matrix has not enabled",
|
|
"package.sh refuses an existing non-empty layout",
|
|
"package.sh requires its arguments",
|
|
"package.sh refuses an invalid version",
|
|
"package.sh builds and verifies the voice add-on for the host",
|
|
"package.sh refuses a foreign platform without an executable: tables",
|
|
"package.sh refuses a foreign platform without an executable: voice",
|
|
"package.sh refuses a foreign platform without an executable: face",
|
|
"package.sh refuses a foreign platform without an executable: fine-tuning",
|
|
"package.sh refuses a foreign platform without an executable: quantization",
|
|
"package.sh refuses a foreign platform without an executable: studio",
|
|
"package.sh refuses a foreign platform without an executable: talk",
|
|
"package.sh refuses a foreign platform without an executable: telegram",
|
|
"package.sh refuses a foreign platform without an executable: slack",
|
|
"package.sh refuses a foreign platform without an executable for every add-on",
|
|
"package.sh builds Tables with cgo and the pure Go add-ons without",
|
|
"matrix fails closed while no platform is enabled",
|
|
"matrix fails closed without a file",
|
|
"channel.sh: a pull request never publishes",
|
|
"channel.sh: master publishes development",
|
|
"channel.sh: a branch push never publishes, even a branch named latest",
|
|
"channel.sh: a tag push prepares the version and moves no alias",
|
|
"channel.sh: a published stable release promotes latest",
|
|
"channel.sh: a pre-release never promotes latest",
|
|
"channel.sh: a draft release fails",
|
|
"channel.sh: an unknown event fails",
|
|
"channel.sh: a tag that is not a version fails",
|
|
"workflow policy accepts the checked-in workflow",
|
|
"workflow policy rejects pull_request_target",
|
|
"workflow policy rejects a publish job that does not wait for every leg",
|
|
"workflow policy rejects a validate job that cannot stop the release",
|
|
"scripts never push, tag, sign or log in",
|
|
"packaging files never reference backend registries or workflows"
|
|
]
|
|
},
|
|
"updates": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/updates.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"unit: updates: a failed, unknown or unreadable check is never current",
|
|
"unit: updates: an upgrade is offered only for a candidate the owner confirmed, with a digest to pin",
|
|
"unit: updates: the owner's typed refusals keep their type and are final answers",
|
|
"unit: updates: the apps list marks an update beside the process state, never in place of it",
|
|
"unit: updates: times are shown as the reader's own and a bad time as nothing",
|
|
"unit: updates: the client sends check and upgrade as the administrator's own action and types the refusals",
|
|
"unit: updates: every locale carries the same update keys as English, and words for every state, reason and refusal",
|
|
"go: offers a digest-only change of the branch-fix-cache channel with an identical version label",
|
|
"go: offers a digest-only change of the development channel with an identical version label",
|
|
"go: offers a digest-only change of the latest channel with an identical version label",
|
|
"go: is up to date when the channel resolves to the installed digest",
|
|
"go: never switches the channel: another channel and other versions are not offered",
|
|
"go: selects the highest compatible greater version of the same major",
|
|
"go: does not cross a major version",
|
|
"go: does not move a stable install to a pre-release and orders pre-releases below their release",
|
|
"go: treats a lower version as nothing to offer",
|
|
"go: reports the same digest as up to date",
|
|
"go: reports a rewritten immutable version as an integrity error, never an update",
|
|
"go: never reports an update it cannot pin to a digest",
|
|
"go: offers the build the tag names now when it moved, pinned to its digest",
|
|
"go: is up to date when the tag still names the installed build",
|
|
"go: resolves the tag only on an explicit check, and the status read reuses that answer",
|
|
"go: reports a tag that cannot be resolved as check-failed, never as an update",
|
|
"go: resolves the tag again at execution, so the upgrade pins what the tag names then",
|
|
"go: names the host, SDK and data format ranges a candidate does not fit",
|
|
"go: refuses a candidate whose data format ends below the installed one",
|
|
"go: reports a platform that is not offered, and prefers the compatible version over a newer incompatible one",
|
|
"go: does not check the SDK range of a candidate that declares no UI",
|
|
"go: reports a failed library as check-failed with the last success, never as up to date",
|
|
"go: names an unavailable source credential and an unreachable library by class",
|
|
"go: reports an add-on the library no longer lists as check-failed",
|
|
"go: returns an error for an add-on that is not installed and for a canceled caller",
|
|
"go: answers a status read from the cache and never evaluates or fetches",
|
|
"go: serves a fresh answer from the cache and evaluates again when it is stale",
|
|
"go: marks a cached answer older than the time to live as stale",
|
|
"go: refreshes the library only on an explicit refresh and applies nothing",
|
|
"go: limits explicit refreshes to one per interval and says so",
|
|
"go: shares one check among concurrent callers",
|
|
"go: never lets an explicit refresh join a plain evaluation that is already in flight",
|
|
"go: keeps the work of a canceled caller from spoiling the answer of the others",
|
|
"go: bounds the cache and forgets the answer of a replaced package",
|
|
"go: redacts the library, channel and digests for a caller who is not an administrator",
|
|
"go: keeps the compatibility hint of an entry and refuses a malformed range",
|
|
"go: lists the releases of one add-on for every platform, from the cache, and refuses a failed library",
|
|
"go: names an unavailable credential reference as a credential failure inside the refresh failure",
|
|
"go: reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
|
|
"go: refuses a second operation ID for the same transition, in flight or done, and applies it once",
|
|
"go: runs concurrent requests with one operation ID once and gives each the same answer",
|
|
"go: serializes conflicting upgrades by the installed digest and refuses the loser without a record",
|
|
"go: refuses a candidate that is not the one the library resolves now",
|
|
"go: refuses an upgrade to the digest that is already installed",
|
|
"go: rechecks compatibility at execution and refuses an incompatible candidate",
|
|
"go: selects a newer immutable version and treats a rewritten version as an integrity error",
|
|
"go: keeps the last good generation when the candidate cannot be staged",
|
|
"go: never switches the library or channel, and a failed check is never up to date",
|
|
"go: lets an administrator refresh and everyone with the feature read a redacted status",
|
|
"go: shows the pending update in the apps list from the cache only",
|
|
"go: does not accept pins without an update checker or on another action",
|
|
"go: keeps the unpinned typed upgrade of an earlier release working",
|
|
"go: is offered when the tag moved, pinned to the build the tag names, and upgrades to exactly that build",
|
|
"go: refuses the upgrade when the tag moved again after the check, and installs nothing",
|
|
"go: gives every caller with the feature the same status from every frontend, redacted for non-administrators",
|
|
"go: checks only for an administrator's own browser session, and applies nothing",
|
|
"go: upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
|
|
"go: runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
|
|
"go: refuses an incompatible candidate and a library that cannot be read, with a typed answer",
|
|
"go: reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
|
|
"go: keeps the update actions out of the tools and names every field of the status in the Swagger spec",
|
|
"updates: a library with nothing newer is up to date, and a member sees no update mark",
|
|
"updates: a moved channel with the same version label is an update, in the list and as a pending mark",
|
|
"updates: a member, a key and an outsider cannot check or upgrade",
|
|
"updates: the dialog names the library, versions and digests, a cancel sends nothing, and the upgrade backs up and keeps the data",
|
|
"updates: two requests for the same transition under different operations run it once",
|
|
"updates: a page that is behind cannot upgrade over a newer installed package",
|
|
"updates: a candidate this host cannot run shows its reason and has no upgrade",
|
|
"updates: an unreachable library is a failed check, never up to date, and says when it was last read",
|
|
"updates: on a narrow screen the check is reachable and runs from the keyboard",
|
|
"go: ends the checks in flight when it is closed and refuses new ones",
|
|
"go: always names the candidate digest of an update, so the upgrade has something to pin",
|
|
"go: keeps a stale cached notice readable while a plain check says the update is gone"
|
|
]
|
|
},
|
|
"tables-acceptance": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/tables_acceptance.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"go: reports an update only on a check, shows a member no digest, refuses a key and applies one pinned candidate with the data and grants kept",
|
|
"go: refuses a change prepared on an old schema or data revision from two tabs of two people and applies nothing",
|
|
"go: replays an operation ID as one receipt from every node, conflicts on a different request and never applies twice or under a new ID",
|
|
"go: settles a revocation that races a confirmation: one outcome, applied at most once, and no work after the revocation",
|
|
"go: separates owner, editor, viewer, administrator and stranger across the browser routes, the REST routes and the chat tool consumer",
|
|
"go: derives the action of a proposal from the tool kind, so an editor cannot confirm a schema change as a write",
|
|
"go: serves the browser module to every account with the feature and to nobody else, from the owner and each frontend",
|
|
"go: fails every blocked consumer explicitly and never serves add-on tools to it",
|
|
"go: is the administrator's own action on every node and never a key's, a member's or a tool's",
|
|
"go: refuses a corrupt backup and a restore that is not allowed, and leaves the data as it was",
|
|
"go: restores a verified backup: the data goes back, the add-on starts again and access follows the current accounts",
|
|
"go: denies the open tabs of a disabled add-on everywhere and serves them again, with the same data, when it is enabled",
|
|
"go: keeps data and grants when the add-on is removed and installed again, and refuses what the old generation prepared",
|
|
"go: denies the next call of a paused key on every node and accepts it again when resumed",
|
|
"go: denies the browser, the key and the chat everywhere when the add-ons feature is withdrawn",
|
|
"go: lowers an editor to a viewer for the next call everywhere and drops the proposals the editor still held",
|
|
"go: refuses the session and the key of a disabled account on every node",
|
|
"go: ignores actor, forwarding and authority headers and fields on every node",
|
|
"go: denies authority, role and approval fields in the arguments of every consumer and creates nothing",
|
|
"go: applies a proposal only on the confirmation of the proposer's own tab, with its digest, exactly once",
|
|
"go: keeps every acknowledged change and applies no change twice when the Tables process is killed in the middle of a batch",
|
|
"go: keeps every acknowledged change and applies no change twice when the owner is killed in the middle of a batch and restarted",
|
|
"go: blocks every other write while a confirmation is unresolved, keeps reading, and accepts writes again only after the owner role resolves it",
|
|
"go: fails every response type closed with the same typed answer from both frontends, runs nothing there and serves everything again after the restart",
|
|
"go: exports a CSV through a frontend and serves the same bytes from every node to its requester only",
|
|
"go: stops the downloads of a person whose access to the database was revoked, on every node, and keeps the owner's",
|
|
"go: denies downloads while the add-on is disabled and serves a complete file again when it is enabled",
|
|
"go: answers the refusal as invalid_request with status 400 on every route and node and changes nothing",
|
|
"go: does not consume the operation ID of a refused change",
|
|
"go: denies an expired file identically from every node and leaves the data and the backups untouched",
|
|
"go: withdraws a transfer held in flight when the add-on is disabled and leaves no downloadable file",
|
|
"go: reports a change that committed and lost its answer as unknown, finds it by receipt and replays the same receipt once",
|
|
"tables-acceptance: a member opens the databases and a grid through each non-owner frontend and the module comes from the owner by digest",
|
|
"tables-acceptance: deep links keep the proxy path prefix on a non-owner frontend and survive a reload",
|
|
"tables-acceptance: the grid works by keyboard, at 400 pixels and in both themes on a non-owner frontend",
|
|
"tables-acceptance: the page says it is unavailable while the owner is gone and recovers on reload when it is back",
|
|
"manifest: the evidence manifest names the platform, the commands, the package digests and every case"
|
|
]
|
|
},
|
|
"library-sources": {
|
|
"kind": "shell",
|
|
"commands": [
|
|
[
|
|
"sh",
|
|
"scripts/addons/library_ui.sh"
|
|
]
|
|
],
|
|
"cases": [
|
|
"each page lists only its own kind, with a Default badge and no kind filter",
|
|
"adds a model source of your own, which has no Default badge and stays after a reload",
|
|
"turns a default off and removes it: it stays listed as removed, and restoring brings it back",
|
|
"shows the conflict message the store gives next to the source that clashes",
|
|
"turning it off hides the default galleries and shows the defaults as off, and on brings them back"
|
|
]
|
|
}
|
|
}
|