mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 13:36:48 +00:00
mauriceboe
14b348581a
Every plugin now runs in its own forked child process with a scrubbed env (no JWT_SECRET, no db path, nothing inherited). It talks to TREK only over a JSON-RPC channel, and the host's capability router registers ONLY the methods a plugin's granted permissions unlock — so an ungranted call is unreachable, not merely refused. The plugin's own data lives in a separate sqlite file it can never open directly; core reads (trips/users) go through membership-checked, column-projected host methods; ws broadcasts are force-namespaced. - protocol/envelope: the wire types + method→permission map (pure, shared by host and the isolated child) - host/rpc-host: the capability router = the enforcement point (dispatch, BAD_PARAMS / PERMISSION_DENIED / RESOURCE_FORBIDDEN / UNKNOWN_METHOD) - host/plugin-data: the per-plugin sqlite file (db:own), guarded against ATTACH/PRAGMA escape, idempotent migrations - host/create-rpc-host: wires the router to the real db/websocket (host-only) - runtime/plugin-sdk + plugin-host-entry: the child bootstrap + definePlugin ctx; turns each ctx call into an RPC, never imports a privileged module - supervisor: spawn on activate, heartbeat/reap, crash backoff + auto-disable, graceful shutdown — a plugin crash/OOM/hang can never reach the Nest loop - paths: code/data layout, dist-vs-tsx child entry resolution Nothing is wired into activation yet (that's the next slice); exercised by unit tests for the router/sdk/data and an integration test that forks a real child.
79 lines
3.2 KiB
TypeScript
79 lines
3.2 KiB
TypeScript
/**
|
|
* The child-side SDK (#plugins, M1). Pure plumbing: every ctx method turns into
|
|
* an RPC call, config is frozen, and log is a fire-and-forget event. Runs
|
|
* in-process against a fake transport (no fork needed).
|
|
*/
|
|
import { describe, it, expect, vi } from 'vitest';
|
|
import { createPluginContext, definePlugin, type ChildTransport } from '../../../src/nest/plugins/runtime/plugin-sdk';
|
|
|
|
function fakeTransport() {
|
|
const rpc = vi.fn(async () => ({ ok: true }));
|
|
const emit = vi.fn();
|
|
const transport = { rpc, emit } as unknown as ChildTransport;
|
|
return { transport, rpc, emit };
|
|
}
|
|
|
|
describe('createPluginContext', () => {
|
|
it('maps each ctx method onto the right RPC call', async () => {
|
|
const { transport, rpc } = fakeTransport();
|
|
const ctx = createPluginContext('p', {}, transport);
|
|
|
|
await ctx.db.query('SELECT 1', 'a');
|
|
expect(rpc).toHaveBeenCalledWith('db.query', { sql: 'SELECT 1', args: ['a'] });
|
|
|
|
await ctx.db.migrate('001', 'CREATE TABLE t (x)');
|
|
expect(rpc).toHaveBeenCalledWith('db.migrate', { id: '001', sql: 'CREATE TABLE t (x)' });
|
|
|
|
await ctx.trips.getById(1, 42);
|
|
expect(rpc).toHaveBeenCalledWith('trips.getById', { tripId: 1, asUserId: 42 });
|
|
|
|
await ctx.ws.broadcastToTrip(1, 'ping', { a: 1 });
|
|
expect(rpc).toHaveBeenCalledWith('ws.broadcastToTrip', { tripId: 1, event: 'ping', data: { a: 1 } });
|
|
|
|
await ctx.users.getById(3);
|
|
expect(rpc).toHaveBeenCalledWith('users.getById', { id: 3 });
|
|
|
|
await ctx.db.exec('DELETE FROM t');
|
|
expect(rpc).toHaveBeenCalledWith('db.exec', { sql: 'DELETE FROM t', args: [] });
|
|
|
|
await ctx.trips.getPlaces(1, 42);
|
|
expect(rpc).toHaveBeenCalledWith('trips.getPlaces', { tripId: 1, asUserId: 42 });
|
|
|
|
await ctx.trips.getReservations(1, 42);
|
|
expect(rpc).toHaveBeenCalledWith('trips.getReservations', { tripId: 1, asUserId: 42 });
|
|
|
|
await ctx.ws.broadcastToUser(9, 'poke', { x: 2 });
|
|
expect(rpc).toHaveBeenCalledWith('ws.broadcastToUser', { userId: 9, event: 'poke', data: { x: 2 } });
|
|
});
|
|
|
|
it('log warn and error also emit events', () => {
|
|
const { transport, emit } = fakeTransport();
|
|
const ctx = createPluginContext('p', {}, transport);
|
|
ctx.log.warn('careful');
|
|
ctx.log.error('bad', { code: 1 });
|
|
expect(emit).toHaveBeenCalledWith('log', { level: 'warn', msg: 'careful', meta: undefined });
|
|
expect(emit).toHaveBeenCalledWith('log', { level: 'error', msg: 'bad', meta: { code: 1 } });
|
|
});
|
|
|
|
it('freezes config so a plugin cannot mutate its instance settings object', () => {
|
|
const ctx = createPluginContext('p', { api_key: 'secret' }, fakeTransport().transport);
|
|
expect(ctx.config.api_key).toBe('secret');
|
|
expect(() => {
|
|
(ctx.config as Record<string, unknown>).api_key = 'tampered';
|
|
}).toThrow();
|
|
});
|
|
|
|
it('log is a fire-and-forget event, not an RPC round-trip', () => {
|
|
const { transport, rpc, emit } = fakeTransport();
|
|
const ctx = createPluginContext('p', {}, transport);
|
|
ctx.log.info('hello', { n: 1 });
|
|
expect(emit).toHaveBeenCalledWith('log', { level: 'info', msg: 'hello', meta: { n: 1 } });
|
|
expect(rpc).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('definePlugin returns the definition unchanged', () => {
|
|
const def = { onLoad: async () => {} };
|
|
expect(definePlugin(def)).toBe(def);
|
|
});
|
|
});
|