mirror of
https://github.com/hanzoai/insights.git
synced 2026-10-30 16:15:31 +00:00
zeekay
19fdf55ceb
A key now opens with what it is allowed to touch. `pk-` is publishable and safe in a browser; `sk-` is secret and never leaves a server. The five marks it replaces all began `ph` -- the upstream's initials -- and they were the last of its brand a customer read back to us, in every SDK snippet. No word rule could reach them, because `ph` is not a word. The marks were also not telling the truth. The constant said `phc_` while every live project token said `hi_`, so the middleware that routes on the constant matched no real token at all. Two spellings existed and one was fiction. Minting now happens in exactly one function and reading in exactly one, so a second spelling has nowhere to live. `phx_` (personal) and `phs_` (project secret) both become `sk-`. The mark now says only that a value is secret; which store holds it is settled by asking. That was already how personal keys worked -- keys minted before the marks carry none, so the store always decided -- and both secret resolvers already returned None on a miss and fell through, so one shared extractor replaces the two that could drift apart. OAuth's access and refresh tokens stay distinguishable as `at-` and `rt-`, because the parser tells them apart before either is looked up, and the domain-verification token becomes `vt-` rather than keeping a sixth mint of its own. `bin/debrand --check` now refuses the marks as a shape, so a seventh cannot be coined. Two rules that were about to rename things that are not ours to spell are bounded: `Lemon` no longer eats `LemonSqueezy`, and the `hog_flow` rules no longer reach a Postgres table, a Datastore table or a route. Keys are stored hashed, so a mark cannot be rewritten in place: the three live project tokens have to be reminted.
339 lines
13 KiB
TypeScript
339 lines
13 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from 'vitest'
|
|
|
|
const { mockMe, mockApiClientCtor } = vi.hoisted(() => {
|
|
const mockMe = vi.fn()
|
|
const mockApiClientCtor = vi.fn().mockImplementation(function () {
|
|
return {
|
|
users: () => ({ me: mockMe }),
|
|
}
|
|
})
|
|
return { mockMe, mockApiClientCtor }
|
|
})
|
|
|
|
vi.mock('@/api/client', () => ({
|
|
ApiClient: mockApiClientCtor,
|
|
}))
|
|
|
|
import type { RedisLike } from '@/hono/cache/RedisCache'
|
|
import { RequestContext } from '@/hono/request-context'
|
|
import type { RequestProperties } from '@/lib/request-properties'
|
|
|
|
import { makeRedisRateLimitStubs } from './helpers/redis-rate-limit-stubs'
|
|
|
|
function fakeRedis(): RedisLike {
|
|
const store = new Map<string, string>()
|
|
return {
|
|
get: async (key) => store.get(key) ?? null,
|
|
set: async (key, value) => {
|
|
store.set(key, String(value))
|
|
return 'OK'
|
|
},
|
|
del: async (...keys) => {
|
|
let n = 0
|
|
for (const k of keys) {
|
|
if (store.delete(k)) {
|
|
n++
|
|
}
|
|
}
|
|
return n
|
|
},
|
|
scan: async () => ['0', [...store.keys()]],
|
|
...makeRedisRateLimitStubs(),
|
|
}
|
|
}
|
|
|
|
function spyRedis(): RedisLike {
|
|
return {
|
|
get: vi.fn(async () => null),
|
|
set: vi.fn(async () => 'OK'),
|
|
del: vi.fn(async () => 0),
|
|
scan: vi.fn(async () => ['0', []] as [string, string[]]),
|
|
...makeRedisRateLimitStubs(),
|
|
}
|
|
}
|
|
|
|
const env = {} as any
|
|
|
|
function makeProps(overrides: Partial<RequestProperties> = {}): RequestProperties {
|
|
return {
|
|
userHash: 'test-user',
|
|
apiToken: 'sk-test',
|
|
sessionId: 'sess-1',
|
|
mcpClientName: 'test-client',
|
|
mcpClientVersion: '1.0',
|
|
mcpProtocolVersion: '2025-03-26',
|
|
transport: 'streamable-http',
|
|
requestStartTime: Date.now(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
describe('RequestContext', () => {
|
|
describe('ApiClient construction', () => {
|
|
const originalEnv = { ...process.env }
|
|
|
|
afterEach(() => {
|
|
process.env = { ...originalEnv }
|
|
mockApiClientCtor.mockClear()
|
|
mockMe.mockClear()
|
|
})
|
|
|
|
it('passes INSIGHTS_PUBLIC_URL as publicBaseUrl to the ApiClient', async () => {
|
|
process.env.INSIGHTS_API_BASE_URL = 'http://insights-web-django.insights.svc.cluster.local:8000'
|
|
process.env.INSIGHTS_PUBLIC_URL = 'https://us.hanzo.ai'
|
|
|
|
mockMe.mockResolvedValue({ success: true, data: { distinct_id: 'user-1' } })
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
await ctx.getDistinctId()
|
|
|
|
expect(mockApiClientCtor).toHaveBeenCalledTimes(1)
|
|
const config = mockApiClientCtor.mock.calls[0]![0]
|
|
expect(config.baseUrl).toBe('http://insights-web-django.insights.svc.cluster.local:8000')
|
|
expect(config.publicBaseUrl).toBe('https://us.hanzo.ai')
|
|
})
|
|
|
|
it('falls back to INSIGHTS_API_BASE_URL when INSIGHTS_PUBLIC_URL is not set', async () => {
|
|
process.env.INSIGHTS_API_BASE_URL = 'https://us.hanzo.ai'
|
|
delete process.env.INSIGHTS_PUBLIC_URL
|
|
|
|
mockMe.mockResolvedValue({ success: true, data: { distinct_id: 'user-1' } })
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
await ctx.getDistinctId()
|
|
|
|
const config = mockApiClientCtor.mock.calls[0]![0]
|
|
expect(config.baseUrl).toBe('https://us.hanzo.ai')
|
|
expect(config.publicBaseUrl).toBe('https://us.hanzo.ai')
|
|
})
|
|
|
|
it.each([
|
|
{ label: 'cached OAuth client name', cached: 'Claude', expected: 'Claude' },
|
|
{ label: 'no cached OAuth client name', cached: undefined, expected: undefined },
|
|
])('passes $label through as oauthClientName', async ({ cached, expected }) => {
|
|
const redis = fakeRedis()
|
|
if (cached) {
|
|
await redis.set('mcp:token:test-user:clientName', JSON.stringify(cached))
|
|
}
|
|
mockMe.mockResolvedValue({ success: true, data: { distinct_id: 'user-1' } })
|
|
|
|
const ctx = new RequestContext(redis, env, makeProps())
|
|
await ctx.getDistinctId()
|
|
|
|
expect(mockApiClientCtor.mock.calls[0]![0].oauthClientName).toBe(expected)
|
|
})
|
|
})
|
|
|
|
describe('getDistinctId', () => {
|
|
it('deduplicates concurrent calls into a single API request', async () => {
|
|
mockMe.mockResolvedValue({ success: true, data: { distinct_id: 'user-123' } })
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
|
|
const [a, b, c] = await Promise.all([ctx.getDistinctId(), ctx.getDistinctId(), ctx.getDistinctId()])
|
|
|
|
expect(a).toBe('user-123')
|
|
expect(b).toBe('user-123')
|
|
expect(c).toBe('user-123')
|
|
expect(mockMe).toHaveBeenCalledTimes(1)
|
|
})
|
|
|
|
it('returns cached distinctId without calling API', async () => {
|
|
const redis = fakeRedis()
|
|
await redis.set('mcp:token:test-user:distinctId', JSON.stringify('cached-id'))
|
|
mockMe.mockClear()
|
|
|
|
const ctx = new RequestContext(redis, env, makeProps())
|
|
const result = await ctx.getDistinctId()
|
|
|
|
expect(result).toBe('cached-id')
|
|
expect(mockMe).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('caches the resolved distinctId for subsequent calls', async () => {
|
|
mockMe.mockResolvedValueOnce({ success: true, data: { distinct_id: 'fresh-id' } })
|
|
const redis = fakeRedis()
|
|
const ctx = new RequestContext(redis, env, makeProps())
|
|
|
|
await ctx.getDistinctId()
|
|
const cached = await redis.get('mcp:token:test-user:distinctId')
|
|
expect(JSON.parse(cached!)).toBe('fresh-id')
|
|
})
|
|
|
|
it('throws when API returns an error', async () => {
|
|
mockMe.mockResolvedValue({ success: false, error: { message: 'Unauthorized' } })
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
|
|
await expect(ctx.getDistinctId()).rejects.toThrow('Failed to get user')
|
|
})
|
|
})
|
|
|
|
describe('getSessionUuid', () => {
|
|
it('returns undefined when sessionId is undefined', async () => {
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
expect(await ctx.getSessionUuid(undefined)).toBeUndefined()
|
|
})
|
|
|
|
it('returns a stable UUID for the same sessionId', async () => {
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
const first = await ctx.getSessionUuid('sess-abc')
|
|
const second = await ctx.getSessionUuid('sess-abc')
|
|
|
|
expect(first).toBe(second)
|
|
expect(first).toMatch(/^[0-9a-f-]{36}$/)
|
|
})
|
|
|
|
it('returns different UUIDs for different sessionIds', async () => {
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
const a = await ctx.getSessionUuid('sess-1')
|
|
const b = await ctx.getSessionUuid('sess-2')
|
|
|
|
expect(a).not.toBe(b)
|
|
})
|
|
})
|
|
|
|
describe('getEffectiveSessionUuid', () => {
|
|
it.each([
|
|
{ sessionId: 'sess-1', mcpSessionId: 'mcp-1', expectedKey: 'sess-1' },
|
|
{ sessionId: undefined, mcpSessionId: 'mcp-1', expectedKey: 'mcp-1' },
|
|
{ sessionId: undefined, mcpSessionId: undefined, expectedKey: undefined },
|
|
])(
|
|
'sessionId=$sessionId mcpSessionId=$mcpSessionId → resolves via expectedKey=$expectedKey',
|
|
async ({ sessionId, mcpSessionId, expectedKey }) => {
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
const effective = await ctx.getEffectiveSessionUuid({ sessionId, mcpSessionId } as any)
|
|
|
|
expect(effective).toBe(expectedKey ? await ctx.getSessionUuid(expectedKey) : undefined)
|
|
if (expectedKey) {
|
|
expect(effective).toMatch(/^[0-9a-f-]{36}$/)
|
|
}
|
|
}
|
|
)
|
|
})
|
|
|
|
describe('buildClientProperties', () => {
|
|
it('includes all request properties', () => {
|
|
const ctx = new RequestContext(
|
|
fakeRedis(),
|
|
env,
|
|
makeProps({
|
|
mcpClientName: 'claude-code',
|
|
mcpClientVersion: '2.0',
|
|
mcpProtocolVersion: '2025-03-26',
|
|
mcpConsumer: 'insights-code',
|
|
transport: 'streamable-http',
|
|
})
|
|
)
|
|
|
|
const result = ctx.buildClientProperties()
|
|
expect(result).toMatchObject({
|
|
$ai_product: 'mcp',
|
|
$mcp_source: 'insights_mcp_analytics',
|
|
$mcp_server_name: 'Insights',
|
|
$mcp_server_version: '1.0.0',
|
|
$mcp_client_name: 'claude-code',
|
|
$mcp_client_version: '2.0',
|
|
$mcp_protocol_version: '2025-03-26',
|
|
$mcp_consumer: 'insights-code',
|
|
$mcp_transport: 'streamable-http',
|
|
mcp_runtime: 'hono',
|
|
})
|
|
})
|
|
|
|
it('adds stable session properties without replacing request properties', () => {
|
|
const ctx = new RequestContext(
|
|
fakeRedis(),
|
|
env,
|
|
makeProps({
|
|
mcpClientName: 'Claude Desktop',
|
|
mcpClientVersion: '2.0',
|
|
mcpProtocolVersion: '2025-03-26',
|
|
mcpConsumer: 'request-consumer',
|
|
mcpVendorClient: 'ClaudeAI',
|
|
transport: 'streamable-http',
|
|
})
|
|
)
|
|
ctx.setMcpContexts(
|
|
{
|
|
sessionId: 'sess-1',
|
|
mcpClientName: 'Claude Desktop',
|
|
mcpClientVersion: '2.0',
|
|
mcpProtocolVersion: '2025-03-26',
|
|
mcpConsumer: 'request-consumer',
|
|
mcpVendorClient: 'ClaudeAI',
|
|
transport: 'streamable-http',
|
|
mode: 'cli',
|
|
},
|
|
{
|
|
mcpClientName: 'claude-code',
|
|
mcpClientVersion: '1.0',
|
|
mcpProtocolVersion: '2025-03-26',
|
|
mcpConsumer: 'session-consumer',
|
|
mcpVendorClient: 'ClaudeCode',
|
|
}
|
|
)
|
|
|
|
const result = ctx.buildClientProperties()
|
|
expect(result).toMatchObject({
|
|
$mcp_client_name: 'Claude Desktop',
|
|
$mcp_client_version: '2.0',
|
|
$mcp_consumer: 'request-consumer',
|
|
mcp_vendor_client: 'ClaudeAI',
|
|
mcp_session_client_name: 'claude-code',
|
|
mcp_session_client_version: '1.0',
|
|
mcp_session_consumer: 'session-consumer',
|
|
mcp_session_vendor_client: 'ClaudeCode',
|
|
})
|
|
})
|
|
|
|
it('omits undefined properties', () => {
|
|
const ctx = new RequestContext(
|
|
fakeRedis(),
|
|
env,
|
|
makeProps({
|
|
mcpClientName: undefined,
|
|
mcpClientVersion: undefined,
|
|
mcpProtocolVersion: undefined,
|
|
mcpConsumer: undefined,
|
|
transport: undefined,
|
|
})
|
|
)
|
|
|
|
const result = ctx.buildClientProperties()
|
|
expect(result).toMatchObject({
|
|
$ai_product: 'mcp',
|
|
$mcp_source: 'insights_mcp_analytics',
|
|
$mcp_server_name: 'Insights',
|
|
$mcp_server_version: '1.0.0',
|
|
mcp_runtime: 'hono',
|
|
})
|
|
expect(result.$mcp_client_name).toBeUndefined()
|
|
expect(result.$mcp_consumer).toBeUndefined()
|
|
expect(result.$mcp_transport).toBeUndefined()
|
|
})
|
|
})
|
|
|
|
describe('cache', () => {
|
|
it('throws when userHash is missing', () => {
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps({ userHash: '' }))
|
|
expect(() => ctx.cache).toThrow('User hash is required')
|
|
})
|
|
|
|
it('returns the same cache instance on repeated access', () => {
|
|
const ctx = new RequestContext(fakeRedis(), env, makeProps())
|
|
expect(ctx.cache).toBe(ctx.cache)
|
|
})
|
|
|
|
it('keeps token cache entries on the default 7 day TTL', async () => {
|
|
const redis = spyRedis()
|
|
const ctx = new RequestContext(redis, env, makeProps())
|
|
|
|
await ctx.tokenCache.set('distinctId', 'user-123')
|
|
|
|
expect(redis.set).toHaveBeenCalledWith(
|
|
'mcp:token:test-user:distinctId',
|
|
JSON.stringify('user-123'),
|
|
'EX',
|
|
7 * 24 * 60 * 60
|
|
)
|
|
})
|
|
})
|
|
})
|