open-gadget-rpc.test.ts

import { abortAllDurableObjects } from "cloudflare:test";
import { exports } from "cloudflare:workers";
import { newWebSocketRpcSession, type RpcStub } from "capnweb";
import {
  createOpenGadgetError,
  getOpenGadgetErrorCode,
  OPEN_GADGET_ERROR_CODES,
  type AuthenticatedApi,
  type OpenGadgetErrorCode,
  type PublicApi,
} from "@gadgets/workshop-shared/api";
import { describe, expect, it } from "vitest";

type CodedError = Error & { code?: unknown };

const PASSWORD_HASH = new Uint8Array([1, 2, 3]);
const EXPECTED_MESSAGES: Record<OpenGadgetErrorCode, string> = {
  [OPEN_GADGET_ERROR_CODES.workspaceNotFound]: "Workspace not found.",
  [OPEN_GADGET_ERROR_CODES.workspaceAccessDenied]: "You don't have access to this workspace.",
};

function username(prefix: string): string {
  return prefix + crypto.randomUUID().replaceAll("-", "");
}

async function rejection(value: PromiseLike<unknown>): Promise<CodedError> {
  try {
    await value;
  } catch (error) {
    if (!(error instanceof Error)) {
      throw new TypeError("Expected RPC to reject with an Error.", { cause: error });
    }
    return error;
  }
  throw new Error("Expected RPC to reject.");
}

function expectRpcCode(error: CodedError, code: OpenGadgetErrorCode): void {
  expect(error.message).toBe(EXPECTED_MESSAGES[code]);
  expect(error.code).toBe(code);
  expect(Object.prototype.propertyIsEnumerable.call(error, "code")).toBe(true);
  expect(getOpenGadgetErrorCode(error)).toBe(code);
}

async function connect(): Promise<RpcStub<PublicApi>> {
  const response = await exports.default.fetch(new Request("https://workshop.invalid/api", {
    headers: { Upgrade: "websocket" },
  }));

  expect(response.status).toBe(101);
  const socket = response.webSocket;
  if (!socket) throw new TypeError("Expected a WebSocket response.");

  socket.accept();
  return newWebSocketRpcSession<PublicApi>(socket);
}

async function createAccount(
    publicApi: RpcStub<PublicApi>, prefix: string): Promise<{ username: string; token: string }> {
  const name = username(prefix);
  const token = await publicApi.createAccount(name, name, PASSWORD_HASH);
  if (token === null) throw new Error(`Failed to create ${name}.`);
  return { username: name, token };
}

async function openRejection(
    authenticated: RpcStub<AuthenticatedApi>,
    id: string): Promise<CodedError> {
  using workspace = authenticated.openGadget(id);
  return await rejection(workspace.getMetadata());
}

// TODO: This test suite keeps timing out in CI, skipping for now.
describe.skip("openGadget errors across native RPC and Cap'n Web", () => {
  it("retains enumerable Error.code at the native Durable Object boundary", async () => {
    const code = OPEN_GADGET_ERROR_CODES.workspaceNotFound;
    const local = createOpenGadgetError(code);

    expect(local.message).toBe(EXPECTED_MESSAGES[code]);
    expect(local.code).toBe(code);
    expect(Object.prototype.propertyIsEnumerable.call(local, "code")).toBe(true);

    const name = username("native");
    const userId = exports.UserDurableObject.idFromName(name).toString();
    const workspaceId = exports.OverseerDurableObject.newUniqueId();
    const error = await rejection(
      exports.OverseerDurableObject.get(workspaceId).open(userId, name, () => {}),
    );

    expectRpcCode(error, code);
  });

  it("maps malformed IDs through AuthenticatedApi", async () => {
    using publicApi = await connect();
    const account = await createAccount(publicApi, "missing");
    using authenticated = await publicApi.authenticate(account.token);

    const error = await openRejection(authenticated, "not-a-durable-object-id");
    expectRpcCode(error, OPEN_GADGET_ERROR_CODES.workspaceNotFound);
  });

  it("maps valid-but-missing IDs through AuthenticatedApi", async () => {
    using publicApi = await connect();
    const account = await createAccount(publicApi, "missing");
    using authenticated = await publicApi.authenticate(account.token);

    const id = exports.OverseerDurableObject.newUniqueId().toString();
    const error = await openRejection(authenticated, id);
    expectRpcCode(error, OPEN_GADGET_ERROR_CODES.workspaceNotFound);
  });

  it("maps an unauthorized existing workspace to access denied", async () => {
    using publicApi = await connect();
    const ownerAccount = await createAccount(publicApi, "owner");
    const intruderAccount = await createAccount(publicApi, "intruder");
    using owner = await publicApi.authenticate(ownerAccount.token);
    using intruder = await publicApi.authenticate(intruderAccount.token);

    using workspace = await owner.newGadget();
    const metadata = await workspace.getMetadata();

    const nativeError = await rejection(
      exports.OverseerDurableObject
        .get(exports.OverseerDurableObject.idFromString(metadata.id))
        .open(
          exports.UserDurableObject.idFromName(intruderAccount.username).toString(),
          intruderAccount.username,
          () => {},
        ),
    );
    expectRpcCode(nativeError, OPEN_GADGET_ERROR_CODES.workspaceAccessDenied);

    const browserError = await openRejection(intruder, metadata.id);
    expectRpcCode(browserError, OPEN_GADGET_ERROR_CODES.workspaceAccessDenied);
  });
});

// The DO-reset recovery contract: a user-DO reset must not poison the API session. E-order is
// per-stub, so the authenticated API shares one user-DO stub per session while it's healthy; a
// reset permanently breaks that stub, so a stub-breaking rejection drops the cache, and a
// rejection that proves the call was never sent (the flagless dead-capability error — the
// flagged one only reaches calls in flight at reset time) is transparently re-issued once on a
// fresh stub. abortAllDurableObjects() is the non-graceful teardown, the local stand-in for the
// storage-timeout/overload resets observed in production. (Deliberately not
// evictDurableObject(): eviction is graceful — it drains in-flight work and never breaks a
// stub — so it cannot reproduce this failure.)
describe("user-DO reset recovery", () => {
  it("recovers on the same session after the user DO is reset", async () => {
    using publicApi = await connect();
    const account = await createAccount(publicApi, "reset");
    using authenticated = await publicApi.authenticate(account.token);

    expect(await authenticated.listModels()).toBeInstanceOf(Array);

    await abortAllDurableObjects();

    // Same socket, same AuthenticatedApiImpl. The cached stub is dead, so this call rejects
    // locally without reaching the DO and is re-issued once on a fresh stub — it must succeed
    // with no client-visible failure. This doubles as the canary for workerd's dead-capability
    // message: if that string drifts, the never-sent retry stops firing and this fails loudly.
    expect(await authenticated.listModels()).toBeInstanceOf(Array);
  });

  it("re-arms the cached stub after recovery instead of churning or staying poisoned", async () => {
    using publicApi = await connect();
    const account = await createAccount(publicApi, "rearm");
    using authenticated = await publicApi.authenticate(account.token);

    expect(await authenticated.listModels()).toBeInstanceOf(Array);

    await abortAllDurableObjects();

    // First call recovers via the never-sent retry; the calls after it must ride the re-armed
    // cached stub (a poisoned or thrashing cache would reject here).
    expect(await authenticated.listModels()).toBeInstanceOf(Array);
    expect(await authenticated.isOnboardingCompleted()).toBeTypeOf("boolean");
    expect(await authenticated.whoami()).toBeTruthy();
  });
});