mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
d57cdb4588
* ✨ Add async test helpers and the with-mocks* macro Backport of the test scaffolding that the persistence retry work needs, taken from staging. Purely additive: no existing helper changes behavior, so the suite result is unchanged (740 tests, 0 failures). - frontend-tests.helpers.async: ->promise, await-response, settle, observe and wait-for. wait-for checks immediately and then polls one macrotask at a time, bounded, so it fails instead of hanging. - mock/with-mocks*: installs mocks with set! and evaluates its body in a generated ^:async fn, so the test reads sequentially and there is no done to thread. Evaluates to a promise. - mock/asap and mock/run-mocked: run-mocked awaits the body and restores the originals always, in that order, reporting a rejection or a non-promise return as an :error. The matching change that made with-mocks defer its body via asap is NOT backported: it would force all 58 existing uses across 14 files into done-chained contexts, which is a separate refactor. AI-assisted-by: space-bunny-free * ✨ Add an error report governor with compact payloads One browser session could emit an unbounded number of identical error reports, and a dropped connection was reported as an application defect with the full payload. Both are fixed here, in one place, because the persistence retry work that follows depends on the new submit-report contract. - A report governor in app.main.errors. Each report carries a fingerprint (report-name|type|code|hint|first stack frame); the first occurrence is always emitted, repeats inside a 2 minute window are counted, and the next emitted report carries them as :occurrences. The cache is bounded by evicting the oldest entry, so memory stays fixed. - flash reserves the report before generating it, so a suppressed occurrence never pays the report-building cost. Its whole body now runs inside one ts/schedule callback, a reporting or notification failure is logged instead of propagating, and it returns a total promise so tests can await it. - generate-report accepts :format :compact|:full. The compact payload keeps the context header plus type, code and uri, and skips the stack, the ex-data dump (it can carry request headers) and the last-events list. - environment-error-types is derived from rp/retryable-types, so the transport classification has a single source of truth. Environment failures are audit-only handled-exceptions and never reach the exception page or the alerts. :offline gets its own handler instead of falling through to :default. :occurrences travels inside the audit event :props, which the backend schema accepts as a free-form map, so no backend change is needed. The dedup governor test file is new: 7 tests over the fingerprint, the pure reservation decision, and the flash pipeline. Relates to #11726, #11743 AI-assisted-by: space-bunny-free * ♻️ Answer commit refusals with an empty stream commit-changes used to return nil when it refused to build a commit, which forced every caller that wanted to observe the outcome to special-case nil. It now returns an empty stream, so a refusal and an empty result look the same and callers can subscribe uniformly. Only the refusal branch changes: the accepted branch already answered with (rx/of commit). Potok treats a nil watch result as "nothing", so both spellings were already correct at the store level. The 57 call sites that wrap this event in rx/of are unaffected. They hold the ::commit-changes event itself, not the value its watch returns, so they keep processing exactly as before. AI-assisted-by: space-bunny-free * ✨ Retry transient saves with backoff and a reconnect notice Any failed update-file landed on the same path: the queue halted in :error, the retained changes were flushed away, and the user was told to reload. A dropped connection and a revoked permission are not the same thing, so they now take different paths. transient-error? splits them, checking :type and :cause-type because persistence-failed wraps the original cause. Transient failures enter a :retrying episode: the head commit stays queued and resends with backoff at 2s, 8s and 20s, then falls through to today's terminal path. Everything else is terminal and keeps the exact :error path. - Resends rotate the ::request-id stamp only once the old request has left active-requests, carry the same :commit-id, and never double send while one request is in flight. - Retry timers carry an episode token; a timer whose episode was superseded stays silent instead of sending or failing. - One tagged reconnect notice per episode, hidden by tag on save and on terminal failure. Recovery is silent. - The browser online event re-enters the runner, but only for a live :retrying episode, guarded by exists? js/window. - wait-persisted-or-error waits through :retrying instead of cutting the wait short. The episode keeps its :run-id, so a new local edit only joins the queue. Re-entering the runner on every edit would bypass the backoff and spend one attempt per batched commit. The retry test namespace is new: 13 tests over the classification, the backoff schedule, stamp rotation, stale tokens and the notice lifecycle. Relates to #11724 AI-assisted-by: space-bunny-free * 🐛 Fix stalled saves that never answer and edits lost on leave Two holes the retry work did not close. An update-file request that never gets an answer kept its attempt stamp forever, so the queue could not move and the user saw a saving state that never resolved. The request now has a 7 minute timeout that fails it as a transient network error, which hands it to the retry path instead of blocking. The timeout is longer than the 5 minute stall threshold on purpose: the stalled report must fire before the retry, not instead of it. The leave-page warning also had gaps. It now tracks unsaved edits directly, through sync-unload-guard, which holds :persistence in st/ongoing-tasks while edits sit in the buffer or the queue. Edits kept in the queue after a failed save keep the guard on too, so closing the tab warns instead of dropping them. store.cljs guards its ongoing-tasks watcher with exists? js/window, because the new tests exercise it without a window. Four new tests: three for the guard across buffering, an in-flight save and a retained edit, and one for a hung request that must resend and save. Closes #12223 AI-assisted-by: space-bunny-free * 🐛 Skip the save when a missing font cannot be remapped fix-deleted-fonts emitted text and typography changes even when no replacement font existed, so opening a page that uses a deleted custom font rewrote identical content and cleared position-data on every visit. Every visit became a save with nothing to save. Both loops now compare the remapped value with the original and emit nothing when they match. The remapped path is unchanged. Two new tests cover the no-replacement case and the remapped case. Closes #12151 AI-assisted-by: space-bunny-free * ✨ Add a debug helper that simulates an intermediary response A save that never reaches the backend is hard to reproduce: you need a proxy, a captive portal or a CDN in the way. This wraps fetch and answers the named API method with a status and a body that carries no Penpot error code, leaving every other request alone. Without a duration the simulation is spent after answering one call. With one it answers every matching call for that long, which is how to watch the save retry, warn, keep retrying and finally recover. debug.simulateHttpError('update-file') debug.simulateHttpError('get-comment-threads', 403) debug.simulateHttpError('update-file', 524, 120) debug.clearHttpErrorSimulation() Dev-only and self-contained: no production path reads it. AI-assisted-by: space-bunny-free * 🌐 Add the save retry and connection error strings Three strings the new persistence and error paths need: - errors.save-retrying, shown once per retry episode while the queue resends a queued save after a connection loss. - workspace.header.retrying, the save indicator state for an episode in progress. - errors.connection-error, shown by the network and offline handlers, which no longer fall through to the generic message. Added to en.po only. The translations script also normalizes every other locale and drops 439 strings that were already stale before this work; that belongs in its own maintenance pass, not in a backport. AI-assisted-by: space-bunny-free * 🐛 Report save failures as unhandled when they are our defect flash-persistence reported every failure it did not delegate as handled-exception, including the ones that are plainly our fault. A validation failure means the client sent something the server refused, yet it landed in the audit log with a name that skips the internal reports and the alerts. Nobody was paged. The report type now follows the cause. :validation, :server-error and :internal report as unhandled-exception, so they alert. The rest are unchanged. Two exclusions are deliberate: - Environment failures stay handled. They reach this point after the retry budget is spent, and the user's connection is not our bug. - :assertion stays handled, because its own handler already reports it that way and the two paths should not disagree. The cause type is read from :cause-type first, since persistence-failed wraps the original under :type :persistence. Reading :type alone would match the wrapper every time and change nothing. The user still gets the same sticky toast and report link; only the audit event name moves. The test that asserted a validation failure is "still notified" now asserts which event name it gets, across the bare and wrapped shapes, the environment types that must stay handled, and an unclassified one. AI-assisted-by: space-bunny-free * 🐛 Unblock persistence when opening a file after a terminal failure A terminal save failure set the state to :error and left the queue alone. recover-persistence only resumed for :save-permission-denied, so for every other terminal code both of its branches were false and it emitted nothing. Leaving and reopening the same file therefore changed nothing: the editor stayed halted until a reload, which rebuilds the whole store and loses the queue anyway. The path had two jobs under one name. initialize-persistence fires when the workspace view mounts and tears down the previous subscription; recover-persistence fires when a file is opened or the role changes. They are now separate: initialization picks up a queue left behind by a previous session, and deliberately does not lift a halt, so undeliverable edits are released when the user acts rather than when the view mounts. Recovery lifts the halt by releasing what can never be saved. release-failed-file drops every queued commit of the file that failed, then resume-persistence clears the error and settles an empty queue to :saved. Retaining them until that point is deliberate: it is what keeps wait-persisted-or-error rejecting, which is what stops workspace/versions.cljs from building a snapshot out of unsaved edits. Releasing at failure time would make waiters resolve instead. Permission loss is treated as permanent too, which the previous exception got wrong. The backend raises :not-found for a missing edit permission, so a resend does not succeed — it routes the user to the exception page. The old branch made that reachable: it resumed the save whenever the cached can-edit flag said yes, and the server disagreed. The only case where the flag can return to true is a team switch, where the queue is gone anyway, so nothing real is lost by releasing. Because the queue is shared, dropping the failed file is also what lets the other files' pending edits drain. One file that cannot be saved no longer blocks everything else. Tests: the failure retains the queue and notifies once, recovery releases it without replaying, a failed file does not block a second one, permission loss is released rather than resumed, and initialization leaves a halt alone. AI-assisted-by: space-bunny-free * ✨ Offer a reload on the save failure toast A terminal save failure stops autosave for the whole session, but the toast asked the user to reload without offering the reload. It listed five implied actions, none of them reachable from the banner, and it never said that the changes could not be saved. flash now takes a :links vector of actions, appended after the download link that :report-link? produces, so a caller can add recovery actions without reaching into the report handling. flash-persistence passes a reload built from labels.reload-page and location.reload, the pattern already used elsewhere in the app for a full restart. The message now says what happened, what is lost, and what to do about it: autosave has stopped for this session, the changes since the last successful save cannot be saved, and either reloading or leaving the file and opening it again restarts it. Naming both matters, because the toast links are easy to miss. Saying the edits are lost is not optional: recovery releases them, so without it the user finds out when they come back to the file. Translated in en.po and es.po only. The translations script would also normalize all 40 locales and drop entries that were already stale, which is a maintenance pass of its own. The reload callback cannot be invoked under the test runner, since js/location does not exist there, so it is covered by its label and by being callable. Whether the reload works is a manual check. AI-assisted-by: space-bunny-free * 🐛 Classify the responses the backend never wrote A reply written by a proxy instead of the backend carries no Penpot error code, so handle-response raised it as :internal. A 504 on a save skipped the retry cycle and stopped autosave at once, and because :internal reports as unhandled, it raised an alert. In a standard deployment this is how a slow save ends: nginx answers 504 after 300s, before the client's 7 minute timeout fires. The status now decides the type: - 504 and the Cloudflare 520-524 family raise :gateway-error, which joins retryable-types. Saves retry with backoff like 502 and 503, GETs retry, and a save that spends its retries reports as handled, because the report rules derive from the same set. - 429 raises :rate-limit, and any other error status :unexpected-response. Neither retries; both show a toast instead of the error page. - :internal is kept for a response below 400 that does not decode. Bodies we cannot read are cut to 500 characters, since proxy error pages run to tens of kilobytes. Tests: classification and retries per status, the transport handlers keep the page, a 504 and a 524 built by the real handle-response go through the save path and land on a retry, and the new types stay handled once the retries are spent. AI-assisted-by: claude-opus-5-5 * ✨ Keep retrying failed saves on a slow cycle Once the three backoff retries were spent, a save that failed on the connection stopped autosave like any terminal failure, and opening a file again dropped its edits. A connection that comes back after a minute lost the work all the same. A transport failure that outlasts the backoff now arms a slow cycle: one silent resend every 30s, until a save lands or 24h have passed since the failure started. The cycle stops when persistence restarts, the queue resumes another way, or the workspace closes. A save that keeps failing slowly is not resent for a day. A gateway that answers 504 after its own timeout may leave the backend applying the save, so each resend can cost the whole save again, and the failing file holds back every other file's queued edits. An attempt that fails after 90s or more counts as a slow failure; at three, the slow cycle stops sending the commit and the save fails as before. Fast failures, such as being offline, never count. - The first failure shows a toast that says the changes are kept and keep being sent, with no reload link, since a reload loses them. A save that lands hides it. - Opening a file sends a queue still inside its retry window once more instead of releasing it. Failures outside the window, and every non-transport failure, are still released. - A freshly loaded file gets back the queued edits of its version, so reopening it shows the changes that are still waiting to be saved. An edit that no longer applies to the loaded data leaves the file as the server sent it, so the file still opens; the edits stay queued. - A commit whose earlier request is no longer in flight is simply sent again under the same commit id: changes are idempotent, so there is no unknown-outcome guard any more. A request still in flight still blocks a parallel send. flash takes a :tag so the save failure toast can be hidden by tag. Tests: the spent backoff arms the slow cycle, a 504 arms it, a terminal failure does not, the cycle stops when the window closes or at the slow failure limit, recovery resends instead of releasing, reopening restores only the loaded file's edits and survives one that no longer applies, and the retrying toast offers no reload. * 🐛 Turn off the leave-page warning when failed edits are released The leave-page warning only followed the queue on appends and discards. Opening a file again releases the edits of a file that failed for good, but that release changed the queue without either event, so the warning stayed on with nothing left to save. Leaving the page asked about unsaved changes until the next save went through. The warning now also follows the release. Tests: releasing the last failed edit turns the warning off. * 🐛 Stop retrying failed saves outside the workspace Leaving the workspace was meant to stop the slow retry cycle, but only a cycle already armed stopped. A backoff timer kept firing after the user left, and a backoff spent outside the workspace armed a slow cycle that kept sending for up to a day from the dashboard. Those sends check the edit permission of whatever team is open, so a switch to a team where the user only views failed the queued edits for good, and the next file they opened dropped them. Leaving the workspace now suspends retries. A pending backoff timer goes stale, and while suspended a transport failure schedules no backoff, a spent backoff arms no slow cycle and the online event sends nothing. The edits stay queued and a request in flight still lands. Opening a file lifts the suspension and resends a retrying save whose backoff was cut short; a role change does not lift it. Tests: leaving stops a pending backoff, a failure after leaving schedules no retry and ignores the online event, a backoff spent outside the workspace arms no slow cycle, and opening a file saves the held edit in each case. --------- Co-authored-by: alonso.torres <alonso.torres@kaleidos.net>
404 lines
21 KiB
Clojure
404 lines
21 KiB
Clojure
;; This Source Code Form is subject to the terms of the Mozilla Public
|
||
;; License, v. 2.0. If a copy of the MPL was not distributed with this
|
||
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||
;;
|
||
;; Copyright (c) KALEIDOS INC Sucursal en España SL
|
||
|
||
(ns frontend-tests.errors-governor-test
|
||
"Unit tests for the error report governor (`app.main.errors`).
|
||
|
||
Tests cover:
|
||
- error fingerprinting – stable identity incl. wrapper stacks
|
||
- reserve-report* – pure window/count/eviction decisions
|
||
- submit-report – governed emission, thunk reports
|
||
- flash report pipeline – reserve-before-generate, totality"
|
||
(:require
|
||
[app.main.data.event :as ev]
|
||
[app.main.errors :as errors]
|
||
[app.main.router :as rt]
|
||
[app.main.store :as st]
|
||
[app.util.timers :as tm]
|
||
[cljs.test :as t :include-macros true]
|
||
[cuerdas.core :as str]
|
||
[frontend-tests.helpers.mock :as mock]
|
||
[potok.v2.core :as ptk]))
|
||
|
||
;; ---------------------------------------------------------------------------
|
||
;; Error report governor
|
||
;;
|
||
;; The governor deduplicates report by fingerprint: the first occurrence is
|
||
;; always emitted, repeats inside a 2 minute window are counted, and the
|
||
;; fingerprint cache is bounded (the oldest entry is evicted when full).
|
||
;; ---------------------------------------------------------------------------
|
||
|
||
(t/use-fixtures :each {:before #(errors/reset-report-governor!)})
|
||
|
||
(defn- error-cause
|
||
[& {:keys [type code hint]}]
|
||
(ex-info (or hint "boom")
|
||
(cond-> {}
|
||
(some? type) (assoc :type type)
|
||
(some? code) (assoc :code code)
|
||
(some? hint) (assoc :hint hint))))
|
||
|
||
(defn- capture-reports!
|
||
"Run `f` capturing the events emitted through `st/emit!`."
|
||
[f]
|
||
(let [events (atom [])]
|
||
(with-redefs [st/emit! (mock/stub (fn [& emitted] (swap! events into emitted)))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")]
|
||
(f)
|
||
@events)))
|
||
|
||
(t/deftest fingerprint-is-stable-for-equivalent-errors
|
||
(let [cause-a (error-cause :type :network :code :fetch-failed :hint "unable to perform fetch operation")
|
||
cause-b (error-cause :type :network :code :fetch-failed :hint "unable to perform fetch operation")]
|
||
(t/is (= (errors/error-fingerprint "handled-exception" cause-a)
|
||
(errors/error-fingerprint "handled-exception" cause-b)))))
|
||
|
||
(t/deftest fingerprint-changes-with-error-identity
|
||
(let [base (error-cause :type :network :code :fetch-failed :hint "boom")]
|
||
(t/is (not= (errors/error-fingerprint "handled-exception" base)
|
||
(errors/error-fingerprint "handled-exception"
|
||
(error-cause :type :network :code :fetch-failed :hint "other"))))
|
||
(t/is (not= (errors/error-fingerprint "handled-exception" base)
|
||
(errors/error-fingerprint "handled-exception"
|
||
(error-cause :type :validation :code :fetch-failed :hint "boom"))))
|
||
(t/is (not= (errors/error-fingerprint "handled-exception" base)
|
||
(errors/error-fingerprint "handled-exception"
|
||
(error-cause :type :network :code :other :hint "boom"))))))
|
||
|
||
(t/deftest fingerprint-includes-the-report-name
|
||
(let [cause (error-cause :type :network :hint "boom")]
|
||
(t/is (not= (errors/error-fingerprint "handled-exception" cause)
|
||
(errors/error-fingerprint "unhandled-exception" cause)))
|
||
(t/is (not= (errors/error-fingerprint "handled-exception" cause)
|
||
(errors/error-fingerprint "exception-page" cause)))))
|
||
|
||
(t/deftest fingerprint-handles-missing-type-and-code
|
||
(let [fingerprint (errors/error-fingerprint "handled-exception" (js/Error. "plain failure"))]
|
||
(t/is (string? fingerprint))
|
||
(t/is (str/starts-with? fingerprint "handled-exception|unknown|unknown|"))))
|
||
|
||
(t/deftest fingerprint-skips-non-frame-preamble-lines
|
||
;; Scenario: a bundler/polyfill wrapper prepends extra non-frame lines
|
||
;; before the real frames. Positional indexing would take the preamble
|
||
;; as the frame and fragment the grouping; matching the first frame
|
||
;; line keeps the identity equal to the plain equivalent. Proves:
|
||
;; grouping survives wrapper-prepended stacks.
|
||
(let [plain (doto (ex-info "boom" {:type :internal :hint "boom"})
|
||
(unchecked-set "stack" "Error: boom\n at call-site-a (app.js:1)"))
|
||
wrapped (doto (ex-info "boom" {:type :internal :hint "boom"})
|
||
(unchecked-set "stack" "Error: boom\nWrapped by polyfill\n at call-site-a (app.js:1)"))]
|
||
(t/is (= (errors/error-fingerprint "handled-exception" plain)
|
||
(errors/error-fingerprint "handled-exception" wrapped)))))
|
||
|
||
(t/deftest environment-fingerprints-ignore-the-stack-frame
|
||
(let [cause-a (doto (ex-info "http error" {:type :offline :hint "http error"})
|
||
(unchecked-set "stack" "Error: http error\n at call-site-a (app.js:1)"))
|
||
cause-b (doto (ex-info "http error" {:type :offline :hint "http error"})
|
||
(unchecked-set "stack" "Error: http error\n at call-site-b (app.js:2)"))
|
||
defect-a (doto (ex-info "boom" {:type :internal :hint "boom"})
|
||
(unchecked-set "stack" "Error: boom\n at call-site-a (app.js:1)"))
|
||
defect-b (doto (ex-info "boom" {:type :internal :hint "boom"})
|
||
(unchecked-set "stack" "Error: boom\n at call-site-b (app.js:2)"))]
|
||
(t/testing "environment failures group across internal call sites"
|
||
(t/is (= (errors/error-fingerprint "handled-exception" cause-a)
|
||
(errors/error-fingerprint "handled-exception" cause-b))))
|
||
(t/testing "application defects keep the stack frame in their identity"
|
||
(t/is (not= (errors/error-fingerprint "handled-exception" defect-a)
|
||
(errors/error-fingerprint "handled-exception" defect-b))))))
|
||
|
||
(t/deftest governor-emits-first-occurrence-and-suppresses-repeats
|
||
(let [d1 (errors/reserve-report* (errors/initial-report-state) "fp" 1000)
|
||
d2 (errors/reserve-report* d1 "fp" 2000)
|
||
d3 (errors/reserve-report* d2 "fp" 3000)
|
||
d4 (errors/reserve-report* d3 "fp" (+ 1000 errors/report-window-ms))]
|
||
(t/is (true? (::errors/emit d1)))
|
||
(t/is (= 1 (::errors/occurrences d1)))
|
||
(t/is (false? (::errors/emit d2)))
|
||
(t/is (nil? (::errors/occurrences d2)))
|
||
(t/is (false? (::errors/emit d3)))
|
||
(t/is (nil? (::errors/occurrences d3)))
|
||
(t/is (true? (::errors/emit d4)))
|
||
(t/is (= 3 (::errors/occurrences d4)))))
|
||
|
||
(t/deftest governor-evicts-oldest-entry-when-cache-is-full
|
||
(let [base (reduce (fn [state i]
|
||
(errors/reserve-report* state (str "fp-" i) (* 1000 i)))
|
||
(errors/initial-report-state)
|
||
(range errors/max-tracked-fingerprints))
|
||
state (errors/reserve-report* base
|
||
"fp-new"
|
||
(* 1000 errors/max-tracked-fingerprints))]
|
||
(t/is (= errors/max-tracked-fingerprints (count (:entries state))))
|
||
(t/is (= errors/max-tracked-fingerprints (count (:order state))))
|
||
(t/is (true? (::errors/emit state)))
|
||
(t/is (nil? (get-in state [:entries "fp-0"])))
|
||
(t/is (= "fp-1" (peek (:order state))))
|
||
(t/is (some? (get-in state [:entries "fp-new"])))))
|
||
|
||
(t/deftest governor-evicts-by-insertion-order-not-by-last-emission
|
||
(let [base (reduce (fn [state i]
|
||
(errors/reserve-report* state (str "fp-" i) (* 1000 i)))
|
||
(errors/initial-report-state)
|
||
(range errors/max-tracked-fingerprints))
|
||
;; fp-0 re-emits after the window, so its :emitted-at becomes the
|
||
;; most recent one, but it keeps its insertion position.
|
||
re-emitted (errors/reserve-report* base
|
||
"fp-0"
|
||
(+ (* 1000 errors/max-tracked-fingerprints)
|
||
errors/report-window-ms))
|
||
state (errors/reserve-report* re-emitted
|
||
"fp-new"
|
||
(+ (* 1000 errors/max-tracked-fingerprints)
|
||
errors/report-window-ms
|
||
1000))]
|
||
(t/is (true? (::errors/emit state)))
|
||
;; FIFO: the first inserted one goes, even though it was the last
|
||
;; emitted and fp-1 is the oldest by :emitted-at.
|
||
(t/is (nil? (get-in state [:entries "fp-0"])))
|
||
(t/is (some? (get-in state [:entries "fp-1"])))
|
||
(t/is (= errors/max-tracked-fingerprints (count (:entries state))))
|
||
(t/is (= errors/max-tracked-fingerprints (count (:order state))))))
|
||
|
||
(t/deftest submit-report-is-governed-and-reports-occurrences
|
||
(let [cause (error-cause :type :network :code :fetch-failed :hint "boom")
|
||
events (capture-reports!
|
||
(fn []
|
||
(dotimes [_ 5]
|
||
(errors/submit-report :event-name "handled-exception"
|
||
:report "report"
|
||
:hint "boom"
|
||
:cause cause))))]
|
||
(t/is (= 1 (count events)))
|
||
(t/is (= 1 (:occurrences (deref (first events)))))))
|
||
|
||
(t/deftest invalid-report-does-not-consume-a-reservation
|
||
(let [cause (error-cause :type :network :hint "boom")
|
||
events (capture-reports!
|
||
(fn []
|
||
(errors/submit-report :event-name "handled-exception"
|
||
:report nil :hint "boom" :cause cause)
|
||
(errors/submit-report :event-name "handled-exception"
|
||
:report "report" :hint "boom" :cause cause)))]
|
||
(t/is (= 1 (count events)))
|
||
(t/is (= 1 (:occurrences (deref (first events)))))))
|
||
|
||
(t/deftest submit-report-evaluates-thunk-reports-lazily
|
||
;; Scenario: the same failure is submitted twice with the report as a
|
||
;; thunk. The first occurrence is granted and builds the report; the
|
||
;; second is suppressed and must never run the thunk. Proves: suppressed
|
||
;; occurrences skip the report-building cost entirely.
|
||
(let [calls (atom 0)
|
||
report (fn [] (swap! calls inc) "report")
|
||
cause (error-cause :type :network :hint "boom")
|
||
events (capture-reports!
|
||
(fn []
|
||
(errors/submit-report :event-name "handled-exception"
|
||
:report report
|
||
:hint "boom"
|
||
:cause cause)
|
||
(errors/submit-report :event-name "handled-exception"
|
||
:report report
|
||
:hint "boom"
|
||
:cause cause)))]
|
||
(t/is (= 1 (count events)))
|
||
(t/is (= 1 @calls) "only the granted occurrence builds the report")
|
||
(t/is (= "report" (:report (deref (first events)))))))
|
||
|
||
(t/deftest governor-applies-to-every-report-name
|
||
(let [events (capture-reports!
|
||
(fn []
|
||
(doseq [event-name ["handled-exception" "unhandled-exception" "exception-page"]]
|
||
(let [cause (error-cause :type :internal :hint event-name)]
|
||
(errors/submit-report :event-name event-name
|
||
:report "report"
|
||
:hint event-name
|
||
:cause cause)
|
||
(errors/submit-report :event-name event-name
|
||
:report "report"
|
||
:hint event-name
|
||
:cause cause)))))]
|
||
(t/is (= 3 (count events)))))
|
||
|
||
(t/deftest submit-report-without-cause-is-ignored
|
||
(let [events (capture-reports!
|
||
(fn []
|
||
(errors/submit-report :event-name "exception-page" :report "report" :hint "boom")
|
||
(errors/submit-report :event-name "exception-page"
|
||
:report "report"
|
||
:hint "boom"
|
||
:cause (error-cause :type :internal :hint "boom"))))]
|
||
;; The cause-less call is ignored and must not consume the reservation
|
||
;; of the cause-based report.
|
||
(t/is (= 1 (count events)))
|
||
(t/is (= 1 (:occurrences (deref (first events)))))))
|
||
|
||
(t/deftest governor-bounds-an-incident-like-loop
|
||
(let [cause (error-cause :type :network :hint "unable to perform fetch operation")
|
||
events (capture-reports!
|
||
(fn []
|
||
(dotimes [_ 10000]
|
||
(errors/submit-report :event-name "handled-exception"
|
||
:report "report"
|
||
:hint "unable to perform fetch operation"
|
||
:cause cause))))]
|
||
(t/is (= 1 (count events)))))
|
||
|
||
(defn- report-events
|
||
"The audit events (report emissions) out of everything collected through
|
||
the `st/emit!` double. Toasts are ungoverned by design — one per `flash`
|
||
call — so only the events typed as audit events count for emission
|
||
bounds. Discriminates by `ptk/type`, which is total (never throws),
|
||
because toasts are not derefable."
|
||
[events]
|
||
(filter #(= ::ev/event (ptk/type %)) events))
|
||
|
||
(t/deftest ^:async flash-suppressed-occurrence-does-not-build-a-report
|
||
;; Scenario: the same failure flashes 3 times inside the governor window.
|
||
;; Only the first occurrence reserves emission; the suppressed ones skip
|
||
;; generation entirely. Proves: one audit event and a single report build
|
||
;; for the whole burst; each `flash` is awaited to completion, so no
|
||
;; timer reasoning is involved.
|
||
(let [generated (atom 0)
|
||
cause (error-cause :type :internal :hint "unable to perform fetch operation")
|
||
events (atom [])]
|
||
(await
|
||
(mock/with-mocks*
|
||
{st/format-last-events (mock/stub (fn [& _] (swap! generated inc) "report"))
|
||
st/emit! (mock/stub (fn [& emitted] (swap! events into emitted)))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")
|
||
tm/schedule (mock/stub (fn [f] (mock/asap f)))}
|
||
(dotimes [_ 3]
|
||
(await (errors/flash :cause cause :type :handled)))
|
||
(t/is (= 1 (count (report-events @events))))
|
||
(t/is (= 1 @generated))))))
|
||
|
||
(t/deftest ^:async flash-bounds-an-incident-like-loop
|
||
;; Scenario: 10 000 identical flashes, replaying the incident loop. Every
|
||
;; flash is awaited (all 10 000 scheduled at once, one wait for all of
|
||
;; them), but the governor emits only the first occurrence. Proves: the
|
||
;; burst produces exactly one audit event and one report build.
|
||
(let [generated (atom 0)
|
||
cause (error-cause :type :internal :hint "unable to perform fetch operation")
|
||
events (atom [])]
|
||
(await
|
||
(mock/with-mocks*
|
||
{st/format-last-events (mock/stub (fn [& _] (swap! generated inc) "report"))
|
||
st/emit! (mock/stub (fn [& emitted] (swap! events into emitted)))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")
|
||
tm/schedule (mock/stub (fn [f] (mock/asap f)))}
|
||
(await (js/Promise.all
|
||
(into-array
|
||
(map (fn [_] (errors/flash :cause cause :type :handled))
|
||
(range 10000)))))
|
||
(t/is (= 1 (count (report-events @events))))
|
||
(t/is (= 1 @generated))))))
|
||
|
||
(t/deftest generate-report-is-total-when-formatting-fails
|
||
(with-redefs [st/format-last-events (mock/stub (fn [& _] (throw (ex-info "formatting failed" {}))))]
|
||
(let [report (errors/generate-report (error-cause :type :network :hint "boom"))]
|
||
(t/is (string? report)))))
|
||
|
||
(t/deftest ^:async flash-emits-a-fallback-report-when-generation-fails
|
||
;; Scenario: the full-report formatter throws. `generate-report` stays
|
||
;; total and the fallback string is what gets emitted. Proves: a
|
||
;; formatting failure still produces exactly one audit event carrying a
|
||
;; string report, with the `flash` awaited to completion.
|
||
(let [events (atom [])]
|
||
(await
|
||
(mock/with-mocks*
|
||
{st/format-last-events (mock/stub (fn [& _] (throw (ex-info "formatting failed" {}))))
|
||
st/emit! (mock/stub (fn [& emitted] (swap! events into emitted)))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")
|
||
tm/schedule (mock/stub (fn [f] (mock/asap f)))}
|
||
(await (errors/flash :cause (error-cause :type :internal :hint "boom") :type :handled))
|
||
(let [reports (report-events @events)]
|
||
(t/is (= 1 (count reports)))
|
||
(t/is (string? (:report (deref (first reports))))))))))
|
||
|
||
(t/deftest ^:async flash-emits-nothing-synchronously
|
||
;; Scenario: a single handled failure. Nothing report- or toast-related
|
||
;; may run on the error handler's stack: the whole `flash` body executes
|
||
;; inside one scheduled callback. Proves: zero events right after the
|
||
;; call returns; report + toast once the returned promise completes.
|
||
(errors/reset-report-governor!)
|
||
(let [events (atom [])
|
||
cause (error-cause :type :internal :hint "async flash probe")]
|
||
(await
|
||
(mock/with-mocks*
|
||
{st/emit! (mock/stub (fn [& emitted] (swap! events into emitted)))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")
|
||
tm/schedule (mock/stub (fn [f] (mock/asap f)))}
|
||
(let [completed (errors/flash :cause cause :type :handled)]
|
||
(t/is (empty? @events) "nothing emitted synchronously")
|
||
(await completed)
|
||
(t/is (= 2 (count @events)) "report + toast once completed"))))))
|
||
|
||
(t/deftest ^:async flash-report-failure-neither-propagates-nor-kills-the-toast
|
||
;; Scenario: the report emission itself throws (audit sink down). The
|
||
;; failure is logged and swallowed at the schedule boundary while the
|
||
;; toast is still attempted, so the user keeps the banner. Proves:
|
||
;; `flash` never throws, its promise still completes, and a reporting
|
||
;; failure still leaves the toast emitted.
|
||
(errors/reset-report-governor!)
|
||
(let [events (atom [])
|
||
calls (atom 0)
|
||
cause (error-cause :type :internal :hint "emit failure probe")]
|
||
(await
|
||
(mock/with-mocks*
|
||
{st/emit! (mock/stub (fn [& emitted]
|
||
(if (zero? @calls)
|
||
(do (swap! calls inc)
|
||
(throw (ex-info "sink down" {})))
|
||
(swap! events into emitted))))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")
|
||
tm/schedule (mock/stub (fn [f] (mock/asap f)))}
|
||
(await (errors/flash :cause cause :type :handled))
|
||
(t/is (= 1 (count @events)) "only the toast survives a reporting failure")))))
|
||
|
||
(defn- toast-links
|
||
"The download links of every toast collected through the `st/emit!`
|
||
double, one entry per toast."
|
||
[events]
|
||
(->> events
|
||
(remove #(= ::ev/event (ptk/type %)))
|
||
(map #(get-in (ptk/update % {}) [:notification :links]))))
|
||
|
||
(t/deftest ^:async repeated-flash-keeps-the-report-download-link
|
||
;; Scenario: the same save failure flashes twice inside the governor
|
||
;; window with a report link. The repeat is not emitted, but its toast
|
||
;; still offers the report. Proves: the governor bounds emission, never
|
||
;; the user's download.
|
||
(let [generated (atom 0)
|
||
cause (error-cause :type :validation :hint "save failed")
|
||
events (atom [])]
|
||
(await
|
||
(mock/with-mocks*
|
||
{st/format-last-events (mock/stub (fn [& _] (swap! generated inc) "report"))
|
||
st/emit! (mock/stub (fn [& emitted] (swap! events into emitted)))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")
|
||
tm/schedule (mock/stub (fn [f] (mock/asap f)))}
|
||
(dotimes [_ 2]
|
||
(await (errors/flash :cause cause :type :handled :report-link? true)))
|
||
(t/is (= 1 (count (report-events @events))) "the repeat is not emitted")
|
||
(t/is (= [1 1] (map count (toast-links @events))) "both toasts carry the link")
|
||
(t/is (= 2 @generated) "the repeat builds its report for the link only")))))
|
||
|
||
(t/deftest ^:async unreportable-flash-keeps-the-report-download-link
|
||
;; Scenario: a failure with an empty hint flashes with a report link. It
|
||
;; cannot be emitted, but its toast still offers the report. Proves: the
|
||
;; link does not depend on emission.
|
||
(let [cause (ex-info "" {:type :validation})
|
||
events (atom [])]
|
||
(await
|
||
(mock/with-mocks*
|
||
{st/format-last-events (mock/stub (fn [& _] "report"))
|
||
st/emit! (mock/stub (fn [& emitted] (swap! events into emitted)))
|
||
rt/get-current-href (constantly "https://penpot.example.com/#/workspace")
|
||
tm/schedule (mock/stub (fn [f] (mock/asap f)))}
|
||
(await (errors/flash :cause cause :type :handled :report-link? true))
|
||
(t/is (empty? (report-events @events)) "nothing is emitted")
|
||
(t/is (= [1] (map count (toast-links @events))) "the toast carries the link")))))
|