mirror of
https://github.com/MoonshotAI/kimi-code.git
synced 2026-07-26 17:45:08 +00:00
* test(server): add API surface snapshot guardrail
Boot startServer on port 0 and snapshot the documented v1 route table derived from /openapi.json paths, plus the reachability of doc/meta endpoints (/healthz, /openapi.json, /asyncapi.json, /). Gives later auth/--host phases an intentional diff when routes change. M0 makes no production behavior change.
* test(server): add e2e server harness with token support
Add test/helpers/serverHarness.ts: boot() wraps startServer with an isolated lock + home dir and returns a handle (server, address, baseUrl, wsUrl, token, close) plus authedFetch/authedWs that carry Authorization: Bearer <token> (and the kimi-code.bearer.<token> WS subprotocol). serviceOverrides is the generic DI seam later phases use to inject a fixed-token auth service; IAuthTokenService is not referenced yet. closeAll() tears down every booted server and socket. M0 makes no production behavior change; typecheck-only gate.
* feat(server): add privateFiles 0600 atomic write/read utility
* feat(server): add per-start tokenStore
* feat(server): add env-based bcrypt password hash utility
* feat(server): add IAuthTokenService DI seam
* feat(server): add global onRequest auth hook with bypass + redaction
* fix(server): stop reflecting Host header in /asyncapi.json
* feat(server): add WS bearer subprotocol constant and parser
* feat(server): enforce bearer token auth on WS upgrade
* feat(server): add Host header allowlist middleware
* feat(server): add Origin/CORS middleware
* feat(server): wire Host/Origin checks into HTTP and WS
* feat(server): wire token auth, Host/Origin, and WS auth into start.ts
* fix(server): create lock file with 0600 permissions
* fix(server): suppress debug routes on non-loopback binds
* feat(kimi-code): read server token and send Authorization on CLI calls
* feat(kimi-code): inject server token into /web URL fragment
* feat(server): add bindClassify for loopback/lan/public classification
* feat(kimi-code): register --host flag and pass it through the daemon
* feat(server): require password and TLS opt-out on non-loopback binds
* feat(server): rate-limit repeated auth failures on non-loopback binds
* feat(server): disable shutdown and terminals on public binds by default
* feat(server): add security response headers on non-loopback binds
* test(server): cover LAN/public host-exposure hardening end to end
* docs(server): add deployment security and threat-model guide
* changeset: minor kimi-code for server auth and host exposure
* feat(kimi-web): add server bearer-token auth support
* fix: repair CI for server auth and host exposure
- Replace native @node-rs/bcrypt with pure-JS bcryptjs so the ESM CLI
bundle and the SEA native bundle both build without native-addon
require issues (node-rs/bcrypt broke the ESM smoke and the SEA
check-bundle allowlist).
- Remove dead cleanup references (stopSpinner, authLogoBlinkTimer) in
apps/kimi-web App.vue that failed vue-tsc.
- Fix lint: drop empty spread fallbacks in the e2e auth-header merge,
void the intentionally-async WS upgrade listener, add missing
assertions to satisfy jest/expect-expect, and convert a ternary
statement to if/else.
- Send the bearer token in the snapshot perf/smoke tests so they pass
under the new global auth hook.
- Refresh the pnpmDeps hash in flake.nix for the updated lockfile.
* feat(server): persist bearer token and add rotate-token command
- persist the server bearer token in <home>/server.token (0600) and reuse it across restarts instead of per-start server-<pid>.token
- add `kimi server rotate-token` to regenerate the token; the token store reloads on mtime/inode change so rotation applies without restart
- print the token and Vite-style Local/Network URLs in the startup banner
- allow non-loopback binds with bearer-token-only auth (password now optional) and update SECURITY.md
- surface daemon boot failures immediately with the exit reason and log tail instead of waiting for the spawn timeout
* feat(server): print full token URLs and re-print links after rotate
- Drop the ready-panel border so token URLs print in full for copying; keep the Kimi sprite beside the title.
- Re-print Local/Network access links after `server rotate-token` (host/port from the lock).
- Extract shared access-URL helpers into access-urls.ts.
- Unify link and token colors between the banner and rotate-token.
* feat(server): dim URL #token= fragment and de-highlight token
- Render the `#token=…` fragment in a dim gray so the host/port stands out in the banner and rotate-token links.
- De-highlight the standalone token; set it off with surrounding whitespace instead of color.
- Add splitTokenFragment helper.
* refactor(cli): polish server ready banner and rotate-token output
- move version onto the ready banner title line; drop the separate
Ready:/Version: rows and the startup-time metric
- reorder rotate-token output so the new token sits between the
invalidation note and the access links
- update server CLI tests for the new layout
* feat(server): warn on reuse and refine ready banner
- Warn when `server run` reuses an already-running daemon (its options are not applied) and show the running server's actual URLs.
- Show a `Network: off use --host 0.0.0.0 to enable` hint on loopback binds.
- Move the version onto the title line and drop the startup-time metric.
* fix(web): relabel auth dialog to token and cover full page
- Relabel the server auth dialog from "password" to "token"; the server accepts the bearer token, with the password only as a fallback.
- Make the auth dialog overlay fully opaque so it covers the whole page instead of revealing the login page underneath.
* fix: resolve CI failures on web auth PR
- Replace chalk.yellow named color with chalk.hex(darkColors.warning)
in the server reuse notice to satisfy the chalk named color guard.
- Update pnpmDeps hash in flake.nix to match the regenerated
pnpm-lock.yaml so the Nix build succeeds.
- Retry rmSync in ws-broadcast e2e teardown to ride out EBUSY /
ENOTEMPTY races while the server flushes files after close().
* test(server): update API surface snapshot for warnings route
The feat/web-auth branch adds GET /api/v1/sessions/{session_id}/warnings
(packages/server/src/routes/sessions.ts), so the API surface guardrail
snapshot needs to record the new documented v1 route.
296 lines
9.3 KiB
TypeScript
296 lines
9.3 KiB
TypeScript
/**
|
|
* Background Tasks end-to-end tests (W9.2 / Chain 8 / P1.8).
|
|
*
|
|
* Covers REST.md §3.7:
|
|
* - GET /api/v1/sessions/{sid}/tasks → envelope + items[]
|
|
* - GET /api/v1/sessions/{sid}/tasks/{tid} → BackgroundTask, 40406 unknown
|
|
* - POST /api/v1/sessions/{sid}/tasks/{tid}:cancel → {cancelled:true},
|
|
* 40406 unknown id,
|
|
* 40904 already finished
|
|
* - Negative: session_id unknown → 40401
|
|
* - Negative: bare {tid} POST (no :cancel) → 40001 unsupported action
|
|
*
|
|
* **Bootstrap strategy**: spawn the server and inject a fake background task
|
|
* directly into the in-process KimiCore via the bridge. Agent-core's
|
|
* `getBackground` / `stopBackground` operate against the same registrar.
|
|
*
|
|
* Because directly seeding a `BackgroundTask` requires constructing a real
|
|
* KimiCore session and inserting into the agent-core background-task manager
|
|
* (out-of-band of the REST surface), we cover the positive list/get/cancel
|
|
* paths via empty state + the negative tests. The 40904 already-finished
|
|
* path is covered by the services unit tests; the server-side mapping is
|
|
* verified here by seeding a TaskAlreadyFinishedError via a stubbed
|
|
* ITaskService override.
|
|
*/
|
|
|
|
import { mkdtempSync, rmSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
|
|
import { pino } from 'pino';
|
|
import { afterEach, beforeEach, describe, expect, it } from 'vitest';
|
|
|
|
import {
|
|
ITaskService,
|
|
TaskAlreadyFinishedError,
|
|
TaskNotFoundError,
|
|
} from '@moonshot-ai/agent-core';
|
|
import {
|
|
listTasksResponseSchema,
|
|
} from '@moonshot-ai/protocol';
|
|
|
|
import { IRestGateway, startServer, type ServerStartOptions, type RunningServer } from '../src';
|
|
import { fixedTokenAuth } from './helpers/serverHarness';
|
|
|
|
let tmpDir: string;
|
|
let lockPath: string;
|
|
let bridgeHome: string;
|
|
let server: RunningServer | undefined;
|
|
|
|
beforeEach(() => {
|
|
tmpDir = mkdtempSync(join(tmpdir(), 'kimi-server-tasks-test-'));
|
|
lockPath = join(tmpDir, 'lock');
|
|
bridgeHome = mkdtempSync(join(tmpdir(), 'kimi-server-tasks-home-'));
|
|
});
|
|
|
|
afterEach(async () => {
|
|
try {
|
|
await server?.close();
|
|
} catch {
|
|
// ignore
|
|
}
|
|
server = undefined;
|
|
rmSync(tmpDir, { recursive: true, force: true });
|
|
rmSync(bridgeHome, { recursive: true, force: true });
|
|
});
|
|
|
|
async function bootDaemon(
|
|
serviceOverrides?: ServerStartOptions['serviceOverrides'],
|
|
): Promise<RunningServer> {
|
|
server = await startServer({
|
|
host: '127.0.0.1',
|
|
port: 0,
|
|
lockPath,
|
|
logger: pino({ level: 'silent' }),
|
|
coreProcessOptions: { homeDir: bridgeHome },
|
|
serviceOverrides: [fixedTokenAuth(), ...(serviceOverrides ?? [])],
|
|
});
|
|
return server;
|
|
}
|
|
|
|
function appOf(r: RunningServer): {
|
|
inject: (req: unknown) => Promise<{ statusCode: number; json: () => unknown }>;
|
|
} {
|
|
const app = r.services.invokeFunction((a) => {
|
|
const gw = a.get(IRestGateway);
|
|
return gw.app as unknown as {
|
|
inject: (req: unknown) => Promise<{ statusCode: number; json: () => unknown }>;
|
|
};
|
|
});
|
|
// Auto-attach the fixed bearer token so the M5.1 auth hook passes. A
|
|
// caller-supplied `authorization` header wins, so explicit token tests keep
|
|
// working; every other header (Range, content-type, …) is preserved.
|
|
return {
|
|
inject(req: unknown) {
|
|
const q = req as { headers?: Record<string, string | string[] | undefined> };
|
|
return app.inject({
|
|
...q,
|
|
headers: { authorization: 'Bearer test-token', ...q.headers },
|
|
});
|
|
},
|
|
};
|
|
}
|
|
|
|
function envelopeOf<T>(body: unknown): {
|
|
code: number;
|
|
msg: string;
|
|
data: T | null;
|
|
request_id: string;
|
|
details?: unknown;
|
|
} {
|
|
return body as {
|
|
code: number;
|
|
msg: string;
|
|
data: T | null;
|
|
request_id: string;
|
|
details?: unknown;
|
|
};
|
|
}
|
|
|
|
async function createSession(r: RunningServer): Promise<string> {
|
|
const res = await appOf(r).inject({
|
|
method: 'POST',
|
|
url: '/api/v1/sessions',
|
|
payload: { metadata: { cwd: join(tmpDir, 'workspace') } },
|
|
});
|
|
const env = envelopeOf<{ id: string }>(res.json());
|
|
if (env.code !== 0 || env.data === null) {
|
|
throw new Error(`create session failed: ${JSON.stringify(env)}`);
|
|
}
|
|
return env.data.id;
|
|
}
|
|
|
|
/**
|
|
* Build an `ITaskService` stub. Used to drive the
|
|
* 40904 / 40406 envelope mapping paths without seeding real background
|
|
* tasks.
|
|
*/
|
|
function createTaskServiceOverride(
|
|
stub: Partial<ITaskService>,
|
|
): ITaskService {
|
|
const defaultImpl: ITaskService = {
|
|
_serviceBrand: undefined,
|
|
list: async () => [],
|
|
get: async () => {
|
|
throw new TaskNotFoundError('s', 't');
|
|
},
|
|
cancel: async () => ({ cancelled: true as const }),
|
|
};
|
|
return { ...defaultImpl, ...stub };
|
|
}
|
|
|
|
describe('GET /api/v1/sessions/{sid}/tasks', () => {
|
|
it('returns 40401 for an unknown session_id', async () => {
|
|
const r = await bootDaemon();
|
|
const res = await appOf(r).inject({
|
|
method: 'GET',
|
|
url: '/api/v1/sessions/does-not-exist/tasks',
|
|
});
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(40401);
|
|
});
|
|
|
|
it('returns an envelope with {items:[]} for a session with no tasks', async () => {
|
|
const r = await bootDaemon();
|
|
const sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'GET',
|
|
url: `/api/v1/sessions/${sid}/tasks`,
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(0);
|
|
const parsed = listTasksResponseSchema.parse(env.data);
|
|
expect(parsed.items).toEqual([]);
|
|
});
|
|
|
|
it('rejects unknown status filter with 40001', async () => {
|
|
const r = await bootDaemon();
|
|
const sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'GET',
|
|
url: `/api/v1/sessions/${sid}/tasks?status=pending`,
|
|
});
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(40001);
|
|
});
|
|
});
|
|
|
|
describe('GET /api/v1/sessions/{sid}/tasks/{tid}', () => {
|
|
it('returns 40406 for an unknown task_id (real session, empty tasks)', async () => {
|
|
const r = await bootDaemon();
|
|
const sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'GET',
|
|
url: `/api/v1/sessions/${sid}/tasks/does-not-exist`,
|
|
});
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(40406);
|
|
});
|
|
|
|
it('returns 40401 for an unknown session', async () => {
|
|
const r = await bootDaemon();
|
|
const res = await appOf(r).inject({
|
|
method: 'GET',
|
|
url: `/api/v1/sessions/unknown/tasks/anything`,
|
|
});
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(40401);
|
|
});
|
|
});
|
|
|
|
describe('POST /api/v1/sessions/{sid}/tasks/{tid}:cancel', () => {
|
|
it('returns 40406 for an unknown task_id', async () => {
|
|
const r = await bootDaemon();
|
|
const sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'POST',
|
|
url: `/api/v1/sessions/${sid}/tasks/nope:cancel`,
|
|
payload: {},
|
|
});
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(40406);
|
|
});
|
|
|
|
it('rejects bare {tid} with 40001 (no :cancel suffix → not a defined action)', async () => {
|
|
const r = await bootDaemon();
|
|
const sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'POST',
|
|
url: `/api/v1/sessions/${sid}/tasks/abc123`,
|
|
payload: {},
|
|
});
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(40001);
|
|
expect(env.msg).toMatch(/unsupported action/);
|
|
});
|
|
|
|
it('rejects unknown action with 40001', async () => {
|
|
const r = await bootDaemon();
|
|
const sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'POST',
|
|
url: `/api/v1/sessions/${sid}/tasks/abc:bogus`,
|
|
payload: {},
|
|
});
|
|
const env = envelopeOf<unknown>(res.json());
|
|
expect(env.code).toBe(40001);
|
|
});
|
|
|
|
it("emits 40904 envelope with data:{cancelled:false} when service throws TaskAlreadyFinishedError", async () => {
|
|
let sid = '';
|
|
const r = await bootDaemon([
|
|
[
|
|
ITaskService,
|
|
createTaskServiceOverride({
|
|
cancel: async () => {
|
|
throw new TaskAlreadyFinishedError(sid, 't_finished', 'completed');
|
|
},
|
|
}),
|
|
],
|
|
]);
|
|
sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'POST',
|
|
url: `/api/v1/sessions/${sid}/tasks/t_finished:cancel`,
|
|
payload: {},
|
|
});
|
|
const env = envelopeOf<{ cancelled: false }>(res.json());
|
|
expect(env.code).toBe(40904);
|
|
expect(env.data).toEqual({ cancelled: false });
|
|
expect(env.msg).toMatch(/already finished/);
|
|
expect((env.details as { current_status?: string } | undefined)?.current_status).toBe(
|
|
'completed',
|
|
);
|
|
});
|
|
|
|
it('returns {cancelled:true} when service succeeds (stub override)', async () => {
|
|
const r = await bootDaemon([
|
|
[
|
|
ITaskService,
|
|
createTaskServiceOverride({
|
|
cancel: async () => ({ cancelled: true as const }),
|
|
}),
|
|
],
|
|
]);
|
|
const sid = await createSession(r);
|
|
const res = await appOf(r).inject({
|
|
method: 'POST',
|
|
url: `/api/v1/sessions/${sid}/tasks/t_running:cancel`,
|
|
payload: {},
|
|
});
|
|
const env = envelopeOf<{ cancelled: true }>(res.json());
|
|
expect(env.code).toBe(0);
|
|
expect(env.data).toEqual({ cancelled: true });
|
|
});
|
|
});
|