"""Offline durable API qualification using injected Hermes runs adapter.""" import asyncio import time import pytest from fastapi.testclient import TestClient from control.app import Settings, create_app PASSWORD = 'offline-chat-password' class Provisioner: async def ensure(self, user): return {'container_name': user['container_name'], 'hermes_url': 'http://127.0.0.1:12345', 'hermes_api_key': 'secret-never-public'} async def ready(self, user): return True async def remove(self, user): pass class FakeRuns: available = True approvals = False def __init__(self): self.started = [] self.stopped = [] async def start(self, owner, rid, payload): self.started.append((owner, rid, payload)) return {'run_id': 'upstream-' + rid, 'status': 'started'} async def status(self, owner, upstream): return {'status': 'running'} async def events(self, owner, upstream): yield {'event': 'reasoning.delta', 'delta': 'hidden-secret'} yield {'event': 'tool.completed', 'result': 'tool-secret', 'error': 'credential'} yield {'event': 'message.delta', 'delta': 'Hello'} yield {'event': 'run.completed', 'output': 'Hello world'} async def stop(self, owner, upstream): self.stopped.append(upstream) @pytest.fixture def env(tmp_path): adapter = FakeRuns() app = create_app(Settings(db_path=str(tmp_path/'chat.sqlite'), admin_password=PASSWORD, allowed_origins=('https://testserver',), reconcile_interval=3600), Provisioner(), chat_adapter=adapter) with TestClient(app, base_url='https://testserver') as client: result = client.post('/api/auth/login', headers={'Origin':'https://testserver'}, json={'username':'admin','password':PASSWORD}) headers = {'Authorization':'Bearer '+result.json()['token']} yield client, app, adapter, headers def wait_run(client, headers, rid): deadline = time.monotonic()+3 while time.monotonic() < deadline: value = client.get('/api/runs/'+rid, headers=headers).json() if value['run']['status'] in ('completed','failed','cancelled'): return value raise AssertionError('Run did not finish') def test_metadata_crud_revision_and_sync(env): client, app, adapter, headers = env client.cookies.clear() assert client.get('/api/conversations').status_code == 401 workspace = client.post('/api/workspaces', headers=headers, json={'name':'Work'}).json()['workspace'] conversation = client.post('/api/conversations', headers=headers, json={'title':'Durable','workspace_id':workspace['id']}).json()['conversation'] cid = conversation['id'] patch = {'revision':conversation['revision'],'pinned':True} assert client.patch('/api/conversations/'+cid, headers=headers, json=patch).status_code == 200 assert client.patch('/api/conversations/'+cid, headers=headers, json=patch).status_code == 409 assert client.delete('/api/workspaces/'+workspace['id'], headers=headers).status_code == 200 assert client.get('/api/conversations/'+cid, headers=headers).json()['conversation']['workspace_id'] is None assert client.delete('/api/conversations/'+cid, headers=headers).status_code == 200 assert client.get('/api/conversations/'+cid, headers=headers).status_code == 404 assert client.get('/api/sync', headers=headers).json()['changes'] def test_idempotent_send_final_output_and_redacted_replay(env): client, app, adapter, headers = env cid = client.post('/api/conversations', headers=headers, json={}).json()['conversation']['id'] url = '/api/conversations/'+cid+'/messages' value = {'content':'Hi','idempotency_key':'same-key'} response = client.post(url, headers=headers, json=value) assert response.status_code == 202, response.text rid = response.json()['run']['id'] final = wait_run(client, headers, rid) assert final['run']['status'] == 'completed', final assert any(m['content']=='Hello world' for m in final['messages']) repeat = client.post(url, headers=headers, json=value) assert repeat.json()['run']['id'] == rid assert client.post(url, headers=headers, json={**value,'content':'changed'}).status_code == 409 assert len(adapter.started) == 1 payload = adapter.started[0][2] assert payload['input'] == 'Hi' assert 'conversation_history' not in payload stream = client.get('/api/runs/'+rid+'/events', headers=headers) assert stream.status_code == 200 assert 'event: done' in stream.text assert 'hidden-secret' not in stream.text and 'tool-secret' not in stream.text assert 'secret-never-public' not in stream.text # Capacity limits never prevent retrieval of an already accepted operation. async def fill(): app.state.chat_runs.tasks.update({str(i): asyncio.create_task(asyncio.sleep(100)) for i in range(256)}) client.portal.call(fill) replay = client.post(url, headers=headers, json=value) assert replay.status_code == 202 assert replay.json()['run']['id'] == rid def test_body_validation_and_honest_capabilities(env): client, app, adapter, headers = env caps = client.get('/api/capabilities', headers=headers).json() assert caps['features']['text_chat'] is True assert caps['features']['attachments'] is True assert client.post('/api/conversations', headers=headers, json={'user_id':'fabricated'}).status_code == 400 assert client.put('/api/preferences', headers=headers, json={'revision':True,'palette':'opal','appearance':'dark'}).status_code == 400