open-gadget-rpc.test.ts

import { abortAllDurableObjects } from "cloudflare:test";
import { exports } from "cloudflare:workers";
import { newWebSocketRpcSession, type RpcStub } from "capnweb";
import {
  createOpenGadgetError,
  getOpenGadgetErrorCode,
  OPEN_GADGET_ERROR_CODES,
  type AuthenticatedApi,
  type OpenGadgetErrorCode,
  type PublicApi,
} from "@gadgets/workshop-shared/api";
import { describe, expect, it } from "vitest";

type CodedError = Error & { code?: unknown };

const PASSWORD_HASH = new Uint8Array([1, 2, 3]);
const EXPECTED_MESSAGES: Record<OpenGadgetErrorCode, string> = {
  [OPEN_GADGET_ERROR_CODES.workspaceNotFound]: "Workspace not found.",
  [OPEN_GADGET_ERROR_CODES.workspaceAccessDenied]: "You don't have access to this workspace.",
};

function username(prefix: string): string {
  return prefix + crypto.randomUUID().replaceAll("-", "");
}

async function rejection(value: PromiseLike<unknown>): Promise<CodedError> {
  try {
    await value;
  } catch (error) {
    if (!(error instanceof Error)) {
      throw new TypeError("Expected RPC to reject with an Error.", { cause: error });
    }
    return error;
  }
  throw new Error("Expected RPC to reject.");
}

function expectRpcCode(error: CodedError, code: OpenGadgetErrorCode): void {
  expect(error.message).toBe(EXPECTED_MESSAGES[code]);
  expect(error.code).toBe(code);
  expect(Object.prototype.propertyIsEnumerable.call(error, "code")).toBe(true);
  expect(getOpenGadgetErrorCode(error)).toBe(code);
}

async function connect(): Promise<RpcStub<PublicApi>> {
  const response = await exports.default.fetch(new Request("https://workshop.invalid/api", {
    headers: { Upgrade: "websocket" },
  }));

  expect(response.status).toBe(101);
  const socket = response.webSocket;
  if (!socket) throw new TypeError("Expected a WebSocket response.");

  socket.accept();
  return newWebSocketRpcSession<PublicApi>(socket);
}

async function createAccount(
    publicApi: RpcStub<PublicApi>, prefix: string): Promise<{ username: string; token: string }> {
  const name = username(prefix);
  const token = await publicApi.createAccount(name, name, PASSWORD_HASH);
  if (token === null) throw new Error(`Failed to create ${name}.`);
  return { username: name, token };
}

async function openRejection(
    authenticated: RpcStub<AuthenticatedApi>,
    id: string): Promise<CodedError> {
  using workspace = authenticated.openGadget(id);
  return await rejection(workspace.getMetadata());
}

// TODO: This test suite keeps timing out in CI, skipping for now.
describe.skip("openGadget errors across native RPC and Cap'n Web", () => {
  it("retains enumerable Error.code at the native Durable Object boundary", async () => {
    const code = OPEN_GADGET_ERROR_CODES.workspaceNotFound;
    const local = createOpenGadgetError(code);

    expect(local.message).toBe(EXPECTED_MESSAGES[code]);
    expect(local.code).toBe(code);
    expect(Object.prototype.propertyIsEnumerable.call(local, "code")).toBe(true);

    const name = username("native");
    const userId = exports.UserDurableObject.idFromName(name).toString();
    const workspaceId = exports.OverseerDurableObject.newUniqueId();
    const error = await rejection(
      exports.OverseerDurableObject.get(workspaceId).open(userId, name, () => {}),
    );

    expectRpcCode(error, code);
  });

  it("maps malformed IDs through AuthenticatedApi", async () => {
    using publicApi = await connect();
    const account = await createAccount(publicApi, "missing");
    using authenticated = await publicApi.authenticate(account.token);

    const error = await openRejection(authenticated, "not-a-durable-object-id");
    expectRpcCode(error, OPEN_GADGET_ERROR_CODES.workspaceNotFound);
  });

  it("maps valid-but-missing IDs through AuthenticatedApi", async () => {
    using publicApi = await connect();
    const account = await createAccount(publicApi, "missing");
    using authenticated = await publicApi.authenticate(account.token);

    const id = exports.OverseerDurableObject.newUniqueId().toString();
    const error = await openRejection(authenticated, id);
    expectRpcCode(error, OPEN_GADGET_ERROR_CODES.workspaceNotFound);
  });

  it("maps an unauthorized existing workspace to access denied", async () => {
    using publicApi = await connect();
    const ownerAccount = await createAccount(publicApi, "owner");
    const intruderAccount = await createAccount(publicApi, "intruder");
    using owner = await publicApi.authenticate(ownerAccount.token);
    using intruder = await publicApi.authenticate(intruderAccount.token);

    using workspace = await owner.newGadget();
    const metadata = await workspace.getMetadata();

    const nativeError = await rejection(
      exports.OverseerDurableObject
        .get(exports.OverseerDurableObject.idFromString(metadata.id))
        .open(
          exports.UserDurableObject.idFromName(intruderAccount.username).toString(),
          intruderAccount.username,
          () => {},
        ),
    );
    expectRpcCode(nativeError, OPEN_GADGET_ERROR_CODES.workspaceAccessDenied);

    const browserError = await openRejection(intruder, metadata.id);
    expectRpcCode(browserError, OPEN_GADGET_ERROR_CODES.workspaceAccessDenied);
  });
});

// The DO-reset recovery contract: a user-DO reset must not poison the API session. A stub is
// bound to one incarnation of the object and is permanently broken by a reset, so the
// authenticated API re-resolves its user-DO stub per call — the same session recovers on the
// next request with no reconnect. abortAllDurableObjects() is the non-graceful teardown, the
// local stand-in for the storage-timeout/overload resets observed in production. (Deliberately
// not evictDurableObject(): eviction is graceful — it drains in-flight work and never breaks a
// stub — so it cannot reproduce this failure.)
describe("user-DO reset recovery", () => {
  it("recovers on the same session after the user DO is reset", async () => {
    using publicApi = await connect();
    const account = await createAccount(publicApi, "reset");
    using authenticated = await publicApi.authenticate(account.token);

    expect(await authenticated.listModels()).toBeInstanceOf(Array);

    await abortAllDurableObjects();

    // Same socket, same AuthenticatedApiImpl. With the per-call stub getter this reaches the
    // restarted object; with a session-cached stub it would reject with the abort error forever.
    expect(await authenticated.listModels()).toBeInstanceOf(Array);
  });
});