mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-19 19:16:17 +00:00
a58ab484a6
* feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash Implements docs/superpowers/specs/2026-09-12-projects-mvp-phase2-design.md (issue #5160, tracker #5129) in the slice order of the spec's §16. Slices: - A: ProjectsConfig + write-time 422 UTF-8 byte cap; PROJECT_CONTEXT_KEY admission pinning (both server-owned sets + worker hoist); latest-only request-scoped <project> block via DynamicContextMiddleware wrap_model_call/awrap_model_call (idempotent reassembly, reserved ID prefix + marker + provenance, never persisted); journal audit fingerprints; Instructions tab. - B: ProjectDocumentRow + migration 0023; ProjectDocumentRepository with locked check-and-set; hash-qualified immutable shelf storage with Paths helpers; upload/list/content/delete-to-trash routes; project delete trashes the shelf in-transaction; request-scoped bounded <documents> index with honest count/shown + actionable overflow note; list_project_documents/read_project_document tools registered only on pinned runs; PAT allowlist + drift guards; blocking-IO anchors. - C: shared thread-upload ingestion service (uploads router refactored to parity); POST from-thread with provenance; attach-to-thread with lock-staged copy (archived source allowed); read-only thread-files view with per-group truncation reporting. - D: restore (restored/merged/not_found/no_target/content_missing; no file moves), purge (continuous row lock across unlink/delete/commit, retryable on FS errors), retention sweep (lazy + startup, 24h orphan guard, row-side reconciliation never deletes). - E: Documents tab (shelf + conversation-files browser, provenance, archived banner, content-missing rows), /workspace/trash route, sidebar entry, composer attach handoff, i18n (en-US/zh-CN), e2e mocks + specs. Review hardening folded in (10 rounds, all with tests): - force active shelf content (HTML/XML family) to download; nosniff on artifact + content responses; unified unsandboxed-iframe PDF preview (fixes the pre-existing Chromium sandbox blank in the artifact viewer) - scope document trash to the URL project under the document lock - atomic no-overwrite filename reservation for ALL ingestion (seeded claims + os.link commit with suffix retry; same-name re-upload now unique-names instead of replacing); hidden staging only, no visible placeholders; lease cleanup on setup failure - serialize conversion under the document lock with post-lock active revalidation; drain locked filesystem work on cancellation; preserve bytes when an insert's commit state is uncertain (including trashed rows) - original-integrity checks before serving text or cached conversions; content_missing surfaced in list responses (UI reads the flag, no 409-probe); downloads always serve original bytes - bounded streaming document reads with cached char counts; shelf limits declared in middleware release identity - thread-root confinement for from-thread sources; config fallback rejects fractional/infinite values; composer counts staged attachments; pending attachments persist until submission or removal; in-flight instruction/rename edits survive save refetches; shelf and trash pagination; conversation-file and thread-files pages stay subscribed to refetches Docs: README/README_zh, backend API.md/ARCHITECTURE.md, AGENTS.md contracts, config.example.yaml projects block. Review follow-ups (head b4807477 → this revision): - The trash retention sweep is split so repeated lazy triggers stay bounded: the indexed expiry purge still runs on every trigger (GET /api/trash/documents, POST /api/trash/purge) while the O(all rows + all files) reconciliation is throttled to one run per user per 15 minutes (process-local, per-user window). The startup sweep now runs as a background task instead of blocking gateway readiness, and shutdown awaits it (bounded). - The export scrub (stripInternalMarkers) is fence- and indentation-aware like the render path, so a pasted, fenced <project>/<documents> snippet survives markdown export while real injected blocks (never fenced) are still removed. Fence regexes moved to a dependency-free leaf module to avoid the messages↔streamdown import cycle. - The artifact viewer's PDF iframe no longer carries an added title attribute (the upstream e2e contract locates it via :not([title])), and the upstream artifact-preview spec now pins the new contract: PDFs render unsandboxed, images keep sandbox="". * fix(projects): round-2 review — cancel an overrun trash sweep, restore the PDF frame title - Shutdown cancelled only the shield around the background startup sweep, so an all-users reconciliation that outlived the 5s budget kept walking rows and files while the document repo and DB engine were disposed underneath it. The wait now lives in `_shutdown_startup_trash_sweep`, which cancels the task and drains it before worker exit: the shield keeps the wait bounded, the cancel makes it final (CancelledError lands at the sweep's next await, and `_run_startup_trash_sweep` only catches `Exception`, so nothing swallows it). - The browser-preview iframe lost `title={getFileName(filepath)}` in the previous fix round, leaving the PDF frame without an accessible name while its siblings keep theirs. Restore it (WCAG frame titles), assert it in the DOM test, and anchor the e2e on `iframe[title="report.pdf"]` instead of `iframe:not([title])`. * fix(projects): round-3 review — report the sweep's late finish, not a phantom cancel `Task.cancel()` returns False when the sweep already finished inside the window between the deadline firing and the cancel, so the shutdown log claimed a cancellation that never happened. Branch on that outcome: the warning stays for a real cancel, a late finish is logged at info, and both paths still reap the task before worker exit. * fix(projects): round-4 review — make Empty trash delete what it confirms `POST /api/trash/purge` only ran the retention sweep, and the sweep's candidate selection is age-gated, so a freshly trashed document survived "Empty trash" even though the confirmation promises that every listed document is permanently deleted. With one trashed row the route answered `{"purged": 0}` and left it in place; `GET /api/trash/documents` sweeps expired rows before listing, so the visible rows were normally ineligible for the action by construction. Empty trash now drives `purge_all_trashed`: the caller's trashed rows (`list_all_trashed`, no age filter) each go through the same guarded, row-locked `purge` as the single-document delete — bytes first, then the row, in one transaction — so a row restored mid-flight is skipped instead of force-deleted, and an unlink failure rolls that row back and answers 500 with a retryable message. Retention expiry stays where it was: the sweep's `purge_candidates` is now the only age-gated selection, and the lazy retention sweep still runs on the listing and at startup. Tests: the router suite replaces the retention-gated expectation with the reviewer's repro (fresh row purged, bytes unlinked, shelf and other users' trash untouched, a failing unlink stays retryable and 500); a blocking-I/O anchor drives the new entry point through the offload; the mocked e2e covers the action end to end; a new real-backend spec performs it against the real gateway and re-reads `GET /api/trash/documents`. README, API, ARCHITECTURE and the phase-2 design docs (en+zh) state the age-independent contract.
485 lines
21 KiB
Python
485 lines
21 KiB
Python
"""Integration tests for the trash API (Phase-2 spec §6.5/§8.2/§8.3/§11).
|
|
|
|
Mirrors the project-documents router tests: a stub auth middleware stamps a
|
|
fake AuthContext per request, so these exercise routing, permission
|
|
decorators, fail-closed 404s, the restore outcome matrix, purge semantics,
|
|
and the lazy retention sweep through the real HTTP stack.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import UTC, datetime, timedelta
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
from typing import Any
|
|
from unittest.mock import MagicMock
|
|
|
|
import anyio
|
|
import pytest
|
|
from fastapi import FastAPI, Request, Response
|
|
from fastapi.testclient import TestClient
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
|
|
from app.gateway.authz import AuthContext, Permissions
|
|
from app.gateway.deps import get_config
|
|
from app.gateway.routers import project_documents, projects, trash
|
|
from deerflow.persistence.engine import close_engine, get_session_factory, init_engine
|
|
from deerflow.persistence.projects import ProjectDocumentRepository, ProjectRepository
|
|
from deerflow.persistence.thread_meta import ThreadMetaRepository
|
|
from deerflow.runtime.user_context import reset_current_user, set_current_user
|
|
|
|
_STUB_PERMISSIONS: list[str] = [
|
|
Permissions.PROJECTS_READ,
|
|
Permissions.PROJECTS_WRITE,
|
|
Permissions.PROJECTS_DELETE,
|
|
]
|
|
|
|
_USER_HEADER = "x-test-user"
|
|
|
|
|
|
class _StubAuthMiddleware(BaseHTTPMiddleware):
|
|
"""Stamp a fake AuthContext and set the user ContextVar per request."""
|
|
|
|
async def dispatch(self, request: Request, call_next: Any) -> Response:
|
|
user_id = request.headers.get(_USER_HEADER, "user-a")
|
|
user = SimpleNamespace(id=user_id, system_role="user")
|
|
request.state.user = user
|
|
request.state.auth = AuthContext(user=user, permissions=list(_STUB_PERMISSIONS))
|
|
token = set_current_user(user)
|
|
try:
|
|
return await call_next(request)
|
|
finally:
|
|
reset_current_user(token)
|
|
|
|
|
|
async def _init_db(tmp_path) -> None:
|
|
await init_engine("sqlite", url=f"sqlite+aiosqlite:///{tmp_path / 'trash.db'}", sqlite_dir=str(tmp_path))
|
|
|
|
|
|
def _build_app(tmp_path, *, document_repo: Any = "default") -> FastAPI:
|
|
anyio.run(_init_db, tmp_path)
|
|
sf = get_session_factory()
|
|
app = FastAPI()
|
|
app.add_middleware(_StubAuthMiddleware)
|
|
app.state.project_repo = ProjectRepository(sf)
|
|
app.state.project_document_repo = ProjectDocumentRepository(sf) if document_repo == "default" else document_repo
|
|
app.state.thread_store = ThreadMetaRepository(sf)
|
|
cfg = MagicMock()
|
|
cfg.uploads = {}
|
|
app.dependency_overrides[get_config] = lambda: cfg
|
|
app.include_router(projects.router)
|
|
app.include_router(project_documents.router)
|
|
app.include_router(trash.router)
|
|
return app
|
|
|
|
|
|
def _as_user(user_id: str) -> dict[str, str]:
|
|
return {_USER_HEADER: user_id}
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _isolate(tmp_path, monkeypatch):
|
|
import deerflow.config.paths as paths_mod
|
|
|
|
monkeypatch.setenv("DEER_FLOW_HOME", str(tmp_path / "home"))
|
|
monkeypatch.setattr(paths_mod, "_paths", None)
|
|
yield
|
|
anyio.run(close_engine)
|
|
|
|
|
|
def _create_project(client: TestClient, name: str = "P", **kwargs) -> dict:
|
|
created = client.post("/api/projects", json={"name": name, **kwargs})
|
|
assert created.status_code == 201
|
|
return created.json()
|
|
|
|
|
|
def _upload(client: TestClient, project_id: str, name: str, data: bytes, **kwargs) -> dict:
|
|
response = client.post(f"/api/projects/{project_id}/documents", files={"file": (name, data)}, **kwargs)
|
|
assert response.status_code == 201
|
|
return response.json()["document"]
|
|
|
|
|
|
def _trash(client: TestClient, project_id: str, document_id: str, **kwargs) -> None:
|
|
assert client.delete(f"/api/projects/{project_id}/documents/{document_id}", **kwargs).status_code == 204
|
|
|
|
|
|
def _get_row(app: FastAPI, document_id: str, *, user_id: str = "user-a") -> dict | None:
|
|
import functools
|
|
|
|
repo: ProjectDocumentRepository = app.state.project_document_repo
|
|
return anyio.run(functools.partial(repo.get, document_id, include_trashed=True, user_id=user_id))
|
|
|
|
|
|
def _set_trashed_at(document_id: str, when: datetime) -> None:
|
|
from sqlalchemy import update as sa_update
|
|
|
|
from deerflow.persistence.projects.model import ProjectDocumentRow
|
|
|
|
async def _run() -> None:
|
|
sf = get_session_factory()
|
|
async with sf() as session:
|
|
await session.execute(sa_update(ProjectDocumentRow).where(ProjectDocumentRow.id == document_id).values(trashed_at=when))
|
|
await session.commit()
|
|
|
|
anyio.run(_run)
|
|
|
|
|
|
def _original_path(app: FastAPI, row: dict, *, user_id: str = "user-a") -> Path:
|
|
from deerflow.config.paths import get_paths
|
|
from deerflow.projects.documents import original_file_path
|
|
|
|
return original_file_path(get_paths(), user_id=user_id, row=row)
|
|
|
|
|
|
class TestTrashListing:
|
|
def test_list_empty_then_populated_with_origin_display_fields(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client, name="Roadmap")
|
|
|
|
empty = client.get("/api/trash/documents").json()
|
|
assert empty == {"documents": [], "total": 0, "limit": 100, "offset": 0}
|
|
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
_trash(client, project["id"], doc["id"])
|
|
|
|
listing = client.get("/api/trash/documents").json()
|
|
assert listing["total"] == 1
|
|
entry = listing["documents"][0]
|
|
assert entry["id"] == doc["id"]
|
|
assert entry["name"] == "a.txt"
|
|
assert entry["trashed_at"]
|
|
assert entry["trash_origin"] == {"project_id": project["id"], "project_name": "Roadmap"}
|
|
# Trashed rows stay invisible to the shelf.
|
|
assert client.get(f"/api/projects/{project['id']}/documents").json()["total"] == 0
|
|
# Foreign users see none of it.
|
|
assert client.get("/api/trash/documents", headers=_as_user("user-b")).json()["total"] == 0
|
|
|
|
def test_project_delete_moves_shelf_into_the_same_trash_listing(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client, name="Doomed")
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
assert client.delete(f"/api/projects/{project['id']}").status_code == 204
|
|
|
|
listing = client.get("/api/trash/documents").json()
|
|
assert [entry["id"] for entry in listing["documents"]] == [doc["id"]]
|
|
assert listing["documents"][0]["trash_origin"] == {"project_id": project["id"], "project_name": "Doomed"}
|
|
|
|
def test_lazy_retention_sweep_runs_before_listing(self, tmp_path):
|
|
"""§8.3: GET /api/trash/documents triggers the sweep; expired rows
|
|
are purged before the listing is assembled."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
doc = _upload(client, project["id"], "old.txt", b"old")
|
|
_trash(client, project["id"], doc["id"])
|
|
_set_trashed_at(doc["id"], datetime.now(UTC) - timedelta(days=31))
|
|
row = _get_row(app, doc["id"])
|
|
original = _original_path(app, row)
|
|
|
|
listing = client.get("/api/trash/documents").json()
|
|
|
|
assert listing["total"] == 0
|
|
assert _get_row(app, doc["id"]) is None
|
|
assert not original.exists()
|
|
|
|
def test_listing_throttles_reconciliation_but_never_the_expiry_purge(self, tmp_path, monkeypatch):
|
|
"""§8.3 debounce: repeated listings within the window skip the
|
|
O(rows + files) reconciliation while every trigger still purges
|
|
retention-eligible rows."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
repo = app.state.project_document_repo
|
|
calls = {"count": 0}
|
|
original = repo.list_all_for_sweep
|
|
|
|
async def counting(*args: Any, **kwargs: Any):
|
|
calls["count"] += 1
|
|
return await original(*args, **kwargs)
|
|
|
|
monkeypatch.setattr(repo, "list_all_for_sweep", counting)
|
|
monkeypatch.setattr(trash, "_LAST_RECONCILIATION", {})
|
|
|
|
project = _create_project(client)
|
|
first_doc = _upload(client, project["id"], "old.txt", b"old")
|
|
_trash(client, project["id"], first_doc["id"])
|
|
_set_trashed_at(first_doc["id"], datetime.now(UTC) - timedelta(days=31))
|
|
|
|
first = client.get("/api/trash/documents")
|
|
assert first.status_code == 200
|
|
assert first.json()["total"] == 0
|
|
assert calls["count"] == 1
|
|
|
|
second_doc = _upload(client, project["id"], "old2.txt", b"old")
|
|
_trash(client, project["id"], second_doc["id"])
|
|
_set_trashed_at(second_doc["id"], datetime.now(UTC) - timedelta(days=31))
|
|
|
|
second = client.get("/api/trash/documents")
|
|
assert second.json()["total"] == 0
|
|
assert calls["count"] == 1
|
|
|
|
monkeypatch.setattr(trash, "_RECONCILIATION_MIN_INTERVAL_SECONDS", 0)
|
|
client.get("/api/trash/documents")
|
|
assert calls["count"] == 2
|
|
|
|
def test_reconciliation_window_is_per_user(self, tmp_path, monkeypatch):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
repo = app.state.project_document_repo
|
|
calls = {"count": 0}
|
|
original = repo.list_all_for_sweep
|
|
|
|
async def counting(*args: Any, **kwargs: Any):
|
|
calls["count"] += 1
|
|
return await original(*args, **kwargs)
|
|
|
|
monkeypatch.setattr(repo, "list_all_for_sweep", counting)
|
|
monkeypatch.setattr(trash, "_LAST_RECONCILIATION", {})
|
|
|
|
client.get("/api/trash/documents", headers=_as_user("user-a"))
|
|
client.get("/api/trash/documents", headers=_as_user("user-b"))
|
|
|
|
assert calls["count"] == 2
|
|
|
|
def test_503_when_repository_unavailable(self, tmp_path):
|
|
app = _build_app(tmp_path, document_repo=None)
|
|
client = TestClient(app)
|
|
assert client.get("/api/trash/documents").status_code == 503
|
|
assert client.post("/api/trash/documents/x/restore").status_code == 503
|
|
assert client.post("/api/trash/documents/x/purge").status_code == 503
|
|
assert client.post("/api/trash/purge").status_code == 503
|
|
|
|
|
|
class TestRestore:
|
|
def test_restore_defaults_to_origin_project(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
_trash(client, project["id"], doc["id"])
|
|
|
|
response = client.post(f"/api/trash/documents/{doc['id']}/restore")
|
|
|
|
assert response.status_code == 200
|
|
payload = response.json()
|
|
assert payload["outcome"] == "restored"
|
|
assert payload["document"]["id"] == doc["id"]
|
|
assert client.get(f"/api/projects/{project['id']}/documents").json()["total"] == 1
|
|
assert client.get("/api/trash/documents").json()["total"] == 0
|
|
|
|
def test_restore_reports_merged_when_target_serves_identical_bytes(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
old = _upload(client, project["id"], "report.txt", b"same bytes")
|
|
_trash(client, project["id"], old["id"])
|
|
new = _upload(client, project["id"], "report.txt", b"same bytes")
|
|
|
|
response = client.post(f"/api/trash/documents/{old['id']}/restore")
|
|
|
|
assert response.status_code == 200
|
|
payload = response.json()
|
|
assert payload["outcome"] == "merged"
|
|
assert payload["document"]["id"] == new["id"]
|
|
assert client.get("/api/trash/documents").json()["total"] == 0
|
|
assert client.get(f"/api/projects/{project['id']}/documents").json()["total"] == 1
|
|
|
|
def test_restore_into_explicit_target(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
origin = _create_project(client, name="Origin")
|
|
target = _create_project(client, name="Target")
|
|
doc = _upload(client, origin["id"], "a.txt", b"hello")
|
|
_trash(client, origin["id"], doc["id"])
|
|
|
|
response = client.post(f"/api/trash/documents/{doc['id']}/restore", json={"project_id": target["id"]})
|
|
|
|
assert response.status_code == 200
|
|
assert response.json()["outcome"] == "restored"
|
|
assert client.get(f"/api/projects/{target['id']}/documents").json()["total"] == 1
|
|
|
|
def test_restore_without_valid_target_is_404(self, tmp_path):
|
|
"""Origin gone or archived + no body ⇒ 404 (the UI offers the picker)."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
gone = _create_project(client, name="Gone")
|
|
archived = _create_project(client, name="Archived")
|
|
doc_gone = _upload(client, gone["id"], "a.txt", b"a")
|
|
doc_arch = _upload(client, archived["id"], "b.txt", b"b")
|
|
_trash(client, gone["id"], doc_gone["id"])
|
|
_trash(client, archived["id"], doc_arch["id"])
|
|
assert client.delete(f"/api/projects/{gone['id']}").status_code == 204
|
|
assert client.post(f"/api/projects/{archived['id']}/archive").status_code == 200
|
|
|
|
assert client.post(f"/api/trash/documents/{doc_gone['id']}/restore").status_code == 404
|
|
assert client.post(f"/api/trash/documents/{doc_arch['id']}/restore").status_code == 404
|
|
# Explicit valid target still restores them.
|
|
target = _create_project(client, name="T")
|
|
assert client.post(f"/api/trash/documents/{doc_gone['id']}/restore", json={"project_id": target["id"]}).status_code == 200
|
|
|
|
def test_restore_into_foreign_or_archived_target_is_404(self, tmp_path):
|
|
"""§11: a target the caller does not own is indistinguishable from missing."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
origin = _create_project(client)
|
|
doc = _upload(client, origin["id"], "a.txt", b"hello")
|
|
_trash(client, origin["id"], doc["id"])
|
|
foreign = client.post("/api/projects", json={"name": "Foreign"}, headers=_as_user("user-b")).json()
|
|
archived = _create_project(client, name="A")
|
|
assert client.post(f"/api/projects/{archived['id']}/archive").status_code == 200
|
|
|
|
assert client.post(f"/api/trash/documents/{doc['id']}/restore", json={"project_id": foreign["id"]}).status_code == 404
|
|
assert client.post(f"/api/trash/documents/{doc['id']}/restore", json={"project_id": archived["id"]}).status_code == 404
|
|
assert client.post(f"/api/trash/documents/{doc['id']}/restore", json={"project_id": "missing"}).status_code == 404
|
|
# Still trashed after every failed attempt.
|
|
assert client.get("/api/trash/documents").json()["total"] == 1
|
|
|
|
def test_restore_of_missing_or_foreign_document_is_404(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
_trash(client, project["id"], doc["id"])
|
|
|
|
assert client.post("/api/trash/documents/missing/restore").status_code == 404
|
|
assert client.post(f"/api/trash/documents/{doc['id']}/restore", headers=_as_user("user-b")).status_code == 404
|
|
|
|
def test_restore_with_missing_content_is_409_and_row_stays_trashed(self, tmp_path):
|
|
"""§11: 409 content_missing; the row remains trashed, never activated."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
_trash(client, project["id"], doc["id"])
|
|
row = _get_row(app, doc["id"])
|
|
_original_path(app, row).unlink()
|
|
|
|
response = client.post(f"/api/trash/documents/{doc['id']}/restore")
|
|
|
|
assert response.status_code == 409
|
|
assert "content_missing" in response.json()["detail"]
|
|
assert client.get("/api/trash/documents").json()["total"] == 1
|
|
assert client.get(f"/api/projects/{project['id']}/documents").json()["total"] == 0
|
|
|
|
|
|
class TestPurge:
|
|
def test_purge_removes_row_and_bytes_then_404s(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
_trash(client, project["id"], doc["id"])
|
|
row = _get_row(app, doc["id"])
|
|
original = _original_path(app, row)
|
|
|
|
assert client.post(f"/api/trash/documents/{doc['id']}/purge").status_code == 204
|
|
|
|
assert _get_row(app, doc["id"]) is None
|
|
assert not original.exists()
|
|
assert client.get("/api/trash/documents").json()["total"] == 0
|
|
# Second purge: the row is gone — fail-closed 404.
|
|
assert client.post(f"/api/trash/documents/{doc['id']}/purge").status_code == 404
|
|
|
|
def test_purge_rejects_active_foreign_and_missing_documents(self, tmp_path):
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
active = _upload(client, project["id"], "a.txt", b"hello")
|
|
|
|
assert client.post(f"/api/trash/documents/{active['id']}/purge").status_code == 404
|
|
assert client.post("/api/trash/documents/missing/purge").status_code == 404
|
|
|
|
doc = _upload(client, project["id"], "b.txt", b"b")
|
|
_trash(client, project["id"], doc["id"])
|
|
assert client.post(f"/api/trash/documents/{doc['id']}/purge", headers=_as_user("user-b")).status_code == 404
|
|
# Untouched by all of it.
|
|
assert client.get("/api/trash/documents").json()["total"] == 1
|
|
|
|
def test_purge_file_failure_is_500_retryable_and_keeps_row(self, tmp_path, monkeypatch):
|
|
"""§11: a non-FileNotFoundError unlink failure rolls back, keeps the
|
|
trashed row, and answers 500 with a retryable message."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
_trash(client, project["id"], doc["id"])
|
|
|
|
real_unlink = Path.unlink
|
|
|
|
def flaky_unlink(self: Path, *args, **kwargs):
|
|
if self.name == "a.txt":
|
|
raise OSError("disk full")
|
|
return real_unlink(self, *args, **kwargs)
|
|
|
|
monkeypatch.setattr(Path, "unlink", flaky_unlink)
|
|
response = client.post(f"/api/trash/documents/{doc['id']}/purge")
|
|
|
|
assert response.status_code == 500
|
|
assert "retried" in response.json()["detail"].lower()
|
|
assert client.get("/api/trash/documents").json()["total"] == 1
|
|
|
|
def test_empty_trash_purges_every_trashed_row_regardless_of_age(self, tmp_path):
|
|
"""§8.3: Empty trash deletes everything its confirmation listed, so a
|
|
freshly trashed row is purged too — the retention cutoff never gates
|
|
this action (the sweep is the only age-gated purge)."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
fresh = _upload(client, project["id"], "fresh.txt", b"f")
|
|
old = _upload(client, project["id"], "old.txt", b"o")
|
|
kept = _upload(client, project["id"], "kept.txt", b"k")
|
|
_trash(client, project["id"], fresh["id"])
|
|
_trash(client, project["id"], old["id"])
|
|
_set_trashed_at(old["id"], datetime.now(UTC) - timedelta(days=31))
|
|
fresh_path = _original_path(app, _get_row(app, fresh["id"]))
|
|
|
|
assert client.post("/api/trash/purge").json() == {"purged": 2}
|
|
|
|
assert client.get("/api/trash/documents").json()["total"] == 0
|
|
assert _get_row(app, fresh["id"]) is None
|
|
assert _get_row(app, old["id"]) is None
|
|
assert not fresh_path.exists()
|
|
# Only the trash emptied: the shelf keeps its active row and bytes.
|
|
shelf = client.get(f"/api/projects/{project['id']}/documents").json()
|
|
assert [entry["id"] for entry in shelf["documents"]] == [kept["id"]]
|
|
|
|
def test_empty_trash_only_purges_the_callers_rows(self, tmp_path):
|
|
"""§11: the empty is owner-scoped — a foreign user's trash survives it."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
mine = _create_project(client)
|
|
theirs = client.post("/api/projects", json={"name": "Theirs"}, headers=_as_user("user-b")).json()
|
|
mine_doc = _upload(client, mine["id"], "mine.txt", b"m")
|
|
their_doc = _upload(client, theirs["id"], "theirs.txt", b"t", headers=_as_user("user-b"))
|
|
_trash(client, mine["id"], mine_doc["id"])
|
|
_trash(client, theirs["id"], their_doc["id"], headers=_as_user("user-b"))
|
|
|
|
assert client.post("/api/trash/purge").json() == {"purged": 1}
|
|
|
|
assert _get_row(app, mine_doc["id"]) is None
|
|
assert _get_row(app, their_doc["id"], user_id="user-b") is not None
|
|
|
|
def test_empty_trash_file_failure_is_500_and_keeps_the_row(self, tmp_path, monkeypatch):
|
|
"""§11: a non-FileNotFoundError unlink failure rolls that row back and
|
|
answers 500 with a retryable message instead of reporting success."""
|
|
app = _build_app(tmp_path)
|
|
client = TestClient(app)
|
|
project = _create_project(client)
|
|
doc = _upload(client, project["id"], "a.txt", b"hello")
|
|
_trash(client, project["id"], doc["id"])
|
|
|
|
real_unlink = Path.unlink
|
|
|
|
def flaky_unlink(self: Path, *args, **kwargs):
|
|
if self.name == "a.txt":
|
|
raise OSError("disk full")
|
|
return real_unlink(self, *args, **kwargs)
|
|
|
|
monkeypatch.setattr(Path, "unlink", flaky_unlink)
|
|
response = client.post("/api/trash/purge")
|
|
|
|
assert response.status_code == 500
|
|
assert "retried" in response.json()["detail"].lower()
|
|
assert client.get("/api/trash/documents").json()["total"] == 1
|