125 lines
4.4 KiB
Python
125 lines
4.4 KiB
Python
"""Executable and static gates for vanilla HUX Wave B runtime extensions."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
RUNTIME = ROOT / "dockerfiles" / "hermes-webui-hux" / "runtime"
|
|
PRODUCTION = (
|
|
RUNTIME / "wave_b_contract.js",
|
|
RUNTIME / "wave_b_projects_modes.js",
|
|
RUNTIME / "wave_b_artifacts_research.js",
|
|
RUNTIME / "wave_b_runtime.js",
|
|
)
|
|
|
|
|
|
def test_hux_wave_b_vanilla_runtime_and_per_source_coverage():
|
|
includes = [
|
|
option
|
|
for path in PRODUCTION
|
|
for option in (
|
|
"--test-coverage-include",
|
|
str(path.relative_to(ROOT)),
|
|
)
|
|
]
|
|
result = subprocess.run(
|
|
[
|
|
"node",
|
|
"--test",
|
|
"--experimental-test-coverage",
|
|
"--test-coverage-lines=95",
|
|
"--test-coverage-functions=95",
|
|
"--test-coverage-branches=95",
|
|
*includes,
|
|
"testing/tests/test_hermes_hux_ui_runtime_wave_b_contract.js",
|
|
"testing/tests/test_hermes_hux_ui_runtime_wave_b_dom.js",
|
|
],
|
|
cwd=ROOT,
|
|
check=False,
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=30,
|
|
)
|
|
assert result.returncode == 0, result.stdout + result.stderr
|
|
|
|
|
|
def test_wave_b_uses_only_canonical_scoped_routes_and_concurrency_headers():
|
|
combined = "\n".join(path.read_text(encoding="utf-8") for path in PRODUCTION)
|
|
for endpoint in (
|
|
"/projects/${projectId}",
|
|
"/conversations?project_id=${projectId}",
|
|
"/conversations/${conversationId}/lineage",
|
|
"/conversations/${conversationId}/branch",
|
|
"/artifacts?conversation_id=${conversationId}&cursor=0",
|
|
"/artifacts/${artifact.id}/versions",
|
|
"/artifacts/${artifact.id}/promote",
|
|
"/messages/${messageId}/citations",
|
|
"/notebooks/${notebook.id}",
|
|
):
|
|
assert endpoint in combined
|
|
assert "'If-Match': String(" in combined
|
|
assert "'Idempotency-Key':" in combined
|
|
assert "context.client.request('/notebooks'" in combined
|
|
assert "require('./wave_a_contract.js')" in combined
|
|
assert "require('../foundation.js')" in combined
|
|
assert "require('../shell.js')" in combined
|
|
|
|
|
|
def test_wave_b_security_accessibility_and_endpoint_gaps_are_explicit():
|
|
combined = "\n".join(path.read_text(encoding="utf-8") for path in PRODUCTION)
|
|
styles = (RUNTIME / "wave_b.css").read_text(encoding="utf-8")
|
|
for forbidden in (
|
|
"React",
|
|
"lucide",
|
|
"tailwind",
|
|
"localStorage",
|
|
"sessionStorage",
|
|
"indexedDB",
|
|
"document.cookie",
|
|
"dangerouslySetInnerHTML",
|
|
"innerHTML",
|
|
"data:text",
|
|
"data:image",
|
|
):
|
|
assert forbidden not in combined
|
|
for gap in (
|
|
"Switchyard remains responsible",
|
|
"Message text is not indexed",
|
|
"Sharing is not exposed",
|
|
"no passage-by-id endpoint",
|
|
"no conversation notebook-list endpoint",
|
|
"no owner identity field",
|
|
):
|
|
assert gap in combined
|
|
assert "parsed.protocol !== 'https:'" in combined
|
|
assert "noopener noreferrer" in combined
|
|
assert "role: 'radiogroup'" in combined
|
|
assert "role: alert ? 'alert' : 'status'" in combined
|
|
assert "aria-live': 'polite'" in combined
|
|
assert "tabindex: '0'" in combined
|
|
assert ".hux-wave-b" in styles
|
|
assert "prefers-reduced-motion" in styles
|
|
assert "body" not in styles and ":root" not in styles
|
|
|
|
|
|
def test_wave_b_files_are_isolated_bounded_and_not_live_wired():
|
|
ours = {
|
|
*PRODUCTION,
|
|
RUNTIME / "wave_b.css",
|
|
ROOT / "testing" / "tests" / "test_hermes_hux_ui_runtime_wave_b_contract.js",
|
|
ROOT / "testing" / "tests" / "test_hermes_hux_ui_runtime_wave_b_dom.js",
|
|
}
|
|
assert all(path.is_file() for path in ours)
|
|
for path in ours:
|
|
assert len(path.read_text(encoding="utf-8").splitlines()) <= 500
|
|
dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
|
|
for path in PRODUCTION:
|
|
assert f"COPY {path.relative_to(ROOT)}" in dockerfile
|
|
bootstrap = (ROOT / "dockerfiles/hermes-webui-hux/bootstrap.js").read_text(encoding="utf-8")
|
|
assert "root.HermesHuxWaveBRuntime.createWaveBRuntime" in bootstrap
|
|
for manifest in (ROOT / "services").rglob("*.yaml"):
|
|
assert "hermes-webui-hux/runtime/wave_b" not in manifest.read_text(encoding="utf-8")
|