feat: implement durable authenticated chat run coordinator

tests/unit/test_chat_api.py

@@ -0,0 +1,100 @@
+"""Offline durable API qualification using injected Hermes runs adapter."""
+import asyncio
+import time
+import pytest
+from fastapi.testclient import TestClient
+from control.app import Settings, create_app
+
+PASSWORD = 'offline-chat-password'
+
+class Provisioner:
+    async def ensure(self, user):
+        return {'container_name': user['container_name'], 'hermes_url': 'http://127.0.0.1:12345', 'hermes_api_key': 'secret-never-public'}
+    async def ready(self, user):
+        return True
+    async def remove(self, user):
+        pass
+
+class FakeRuns:
+    available = True
+    approvals = False
+    def __init__(self):
+        self.started = []
+        self.stopped = []
+    async def start(self, owner, rid, payload):
+        self.started.append((owner, rid, payload))
+        return {'run_id': 'upstream-' + rid, 'status': 'started'}
+    async def status(self, owner, upstream):
+        return {'status': 'running'}
+    async def events(self, owner, upstream):
+        yield {'event': 'reasoning.delta', 'delta': 'hidden-secret'}
+        yield {'event': 'tool.completed', 'result': 'tool-secret', 'error': 'credential'}
+        yield {'event': 'message.delta', 'delta': 'Hello'}
+        yield {'event': 'run.completed', 'output': 'Hello world'}
+    async def stop(self, owner, upstream):
+        self.stopped.append(upstream)
+
+@pytest.fixture
+def env(tmp_path):
+    adapter = FakeRuns()
+    app = create_app(Settings(db_path=str(tmp_path/'chat.sqlite'), admin_password=PASSWORD, allowed_origins=('https://testserver',), reconcile_interval=3600), Provisioner(), chat_adapter=adapter)
+    with TestClient(app, base_url='https://testserver') as client:
+        result = client.post('/api/auth/login', headers={'Origin':'https://testserver'}, json={'username':'admin','password':PASSWORD})
+        headers = {'Authorization':'Bearer '+result.json()['token']}
+        yield client, app, adapter, headers
+
+def wait_run(client, headers, rid):
+    deadline = time.monotonic()+3
+    while time.monotonic() < deadline:
+        value = client.get('/api/runs/'+rid, headers=headers).json()
+        if value['run']['status'] in ('completed','failed','cancelled'):
+            return value
+    raise AssertionError('Run did not finish')
+
+def test_metadata_crud_revision_and_sync(env):
+    client, app, adapter, headers = env
+    client.cookies.clear()
+    assert client.get('/api/conversations').status_code == 401
+    workspace = client.post('/api/workspaces', headers=headers, json={'name':'Work'}).json()['workspace']
+    conversation = client.post('/api/conversations', headers=headers, json={'title':'Durable','workspace_id':workspace['id']}).json()['conversation']
+    cid = conversation['id']
+    patch = {'revision':conversation['revision'],'pinned':True}
+    assert client.patch('/api/conversations/'+cid, headers=headers, json=patch).status_code == 200
+    assert client.patch('/api/conversations/'+cid, headers=headers, json=patch).status_code == 409
+    assert client.delete('/api/workspaces/'+workspace['id'], headers=headers).status_code == 200
+    assert client.get('/api/conversations/'+cid, headers=headers).json()['conversation']['workspace_id'] is None
+    assert client.delete('/api/conversations/'+cid, headers=headers).status_code == 200
+    assert client.get('/api/conversations/'+cid, headers=headers).status_code == 404
+    assert client.get('/api/sync', headers=headers).json()['changes']
+
+def test_idempotent_send_final_output_and_redacted_replay(env):
+    client, app, adapter, headers = env
+    cid = client.post('/api/conversations', headers=headers, json={}).json()['conversation']['id']
+    url = '/api/conversations/'+cid+'/messages'
+    value = {'content':'Hi','idempotency_key':'same-key'}
+    response = client.post(url, headers=headers, json=value)
+    assert response.status_code == 202, response.text
+    rid = response.json()['run']['id']
+    final = wait_run(client, headers, rid)
+    assert final['run']['status'] == 'completed', final
+    assert any(m['content']=='Hello world' for m in final['messages'])
+    repeat = client.post(url, headers=headers, json=value)
+    assert repeat.json()['run']['id'] == rid
+    assert client.post(url, headers=headers, json={**value,'content':'changed'}).status_code == 409
+    assert len(adapter.started) == 1
+    payload = adapter.started[0][2]
+    assert payload['input'] == 'Hi'
+    assert 'conversation_history' not in payload
+    stream = client.get('/api/runs/'+rid+'/events', headers=headers)
+    assert stream.status_code == 200
+    assert 'event: done' in stream.text
+    assert 'hidden-secret' not in stream.text and 'tool-secret' not in stream.text
+    assert 'secret-never-public' not in stream.text
+
+def test_body_validation_and_honest_capabilities(env):
+    client, app, adapter, headers = env
+    caps = client.get('/api/capabilities', headers=headers).json()
+    assert caps['features']['text_chat'] is True
+    assert caps['features']['attachments'] is True
+    assert client.post('/api/conversations', headers=headers, json={'user_id':'fabricated'}).status_code == 400
+    assert client.put('/api/preferences', headers=headers, json={'revision':True,'palette':'opal','appearance':'dark'}).status_code == 400