AgentHub/server/__tests__/me-prefs.test.js

/**
 * @file me-prefs.test.js
 * @description `/api/me` (docs/plans/onboarding): an account's own UI
 * preferences and first-run flag — local mode is the one account `local`;
 * in server mode each account reads and writes only its own row, only known
 * keys and short strings are kept, `null` deletes one; an S3 member's
 * dark/light mode becomes their Claude Code theme, written as them.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const { describe, it, before, after } = require("node:test");
const assert = require("node:assert/strict");
const path = require("node:path");
const fs = require("node:fs");
const os = require("node:os");

const TMP = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "me-prefs-")));
const USERS = path.join(TMP, "users");
process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
process.env.DASHBOARD_LIVENESS_PROBE = "0";
process.env.LANES_ROOT = path.join(TMP, "lanes");
process.env.AGENTHUB_SERVER_CONF = path.join(TMP, "server.conf");
process.env.AGENTHUB_PASSWD = path.join(TMP, "passwd");

const { createApp, startServer } = require("../index");
const auth = require("../lib/auth");
const linux = require("../lib/linux-accounts");
const runAs = require("../lib/run-as");
const { fakeSudo } = require("./fixtures/fake-sudo");

let server;
let BASE;

const call = (method, p, { body, cookie } = {}) =>
  fetch(BASE + p, {
    method,
    headers: { "Content-Type": "application/json", ...(cookie ? { cookie } : {}) },
    body: body ? JSON.stringify(body) : undefined,
  }).then(async (r) => ({ status: r.status, body: await r.json().catch(() => null) }));

async function login(username, password) {
  const r = await fetch(`${BASE}/api/auth/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ username, password }),
  });
  return r.headers.get("set-cookie").split(";")[0];
}

before(async () => {
  server = await startServer(createApp(), 0);
  BASE = `http://127.0.0.1:${server.address().port}`;
});

after(() => {
  delete process.env.AGENTHUB_MODE;
  server?.close();
  fs.rmSync(TMP, { recursive: true, force: true });
});

describe("local mode: one account", () => {
  it("starts empty, keeps known keys, deletes on null, refuses the rest", async () => {
    assert.deepEqual((await call("GET", "/api/me/prefs")).body, { prefs: {}, onboardedAt: null });
    let r = await call("PUT", "/api/me/prefs", {
      body: { prefs: { theme: "light", "agenthub.theme.light": "canvas" } },
    });
    assert.equal(r.status, 200);
    r = await call("PUT", "/api/me/prefs", { body: { prefs: { theme: null } } });
    assert.deepEqual(r.body.prefs, { "agenthub.theme.light": "canvas" });
    for (const prefs of [{ evil: "x" }, { theme: 1 }, { theme: "x".repeat(9000) }, []]) {
      r = await call("PUT", "/api/me/prefs", { body: { prefs } });
      assert.equal(r.status, 400, JSON.stringify(prefs));
      assert.equal(r.body.error.code, "EBADPREFS");
    }
  });

  it("keeps the account's own agent instructions, capped, blank clears", async () => {
    let r = await call("GET", "/api/me/instructions");
    assert.deepEqual(r.body, { instructions: "", max: 16000, tools: ["claude", "codex"] });
    r = await call("PUT", "/api/me/instructions", {
      body: { instructions: "- answer in Vietnamese\r\n" },
    });
    assert.equal(r.status, 200);
    assert.equal(r.body.instructions, "- answer in Vietnamese\n");
    r = await call("PUT", "/api/me/instructions", { body: { instructions: 1 } });
    assert.equal(r.body.error.code, "EBADFIELD");
    r = await call("PUT", "/api/me/instructions", { body: { instructions: "x".repeat(16001) } });
    assert.equal(r.status, 413);
    r = await call("PUT", "/api/me/instructions", { body: { instructions: "  " } });
    assert.equal(r.body.instructions, "");
  });

  it("marks the first-run setup done, once", async () => {
    const r = await call("POST", "/api/me/onboarded");
    assert.match(r.body.onboardedAt, /^\d{4}-/);
    const again = await call("POST", "/api/me/onboarded");
    assert.equal(again.body.onboardedAt, r.body.onboardedAt);
  });
});

describe("server mode: per account", () => {
  let mia;
  let max;
  before(async () => {
    const uid = process.getuid();
    fs.writeFileSync(process.env.AGENTHUB_PASSWD, `ah-mia:x:${uid}:${uid}::/:/bin/sh\n`);
    fs.writeFileSync(
      process.env.AGENTHUB_SERVER_CONF,
      `HOST_USER=h\nHOST_UID=1\nUSERS_ROOT=${USERS}\nPORT=4820\n`
    );
    linux.__resetConfCache();
    runAs.__resetCache();
    linux.__setRunImpl(() => "ok");
    process.env.AGENTHUB_MODE = "server";
    await auth.createUser("mia", "member-pass-1", "developer");
    await auth.createUser("max", "member-pass-2", "developer");
    fs.mkdirSync(path.join(USERS, "mia"), { recursive: true });
    mia = await login("mia", "member-pass-1");
    max = await login("max", "member-pass-2");
  });

  it("needs a login", async () => {
    assert.equal((await call("GET", "/api/me/prefs")).status, 401);
  });

  it("keeps each account's own, apart from local mode's and each other's", async () => {
    await call("PUT", "/api/me/prefs", { cookie: mia, body: { prefs: { i18nextLng: "vi" } } });
    await call("PUT", "/api/me/prefs", { cookie: max, body: { prefs: { i18nextLng: "en" } } });
    assert.deepEqual((await call("GET", "/api/me/prefs", { cookie: mia })).body.prefs, {
      i18nextLng: "vi",
    });
    const m = (await call("GET", "/api/me/prefs", { cookie: max })).body;
    assert.deepEqual(m, { prefs: { i18nextLng: "en" }, onboardedAt: null });
  });

  it("keeps each account's own agent instructions", async () => {
    assert.equal((await call("GET", "/api/me/instructions")).status, 401);
    await call("PUT", "/api/me/instructions", { cookie: mia, body: { instructions: "mia's" } });
    assert.equal(
      (await call("GET", "/api/me/instructions", { cookie: mia })).body.instructions,
      "mia's"
    );
    assert.equal(
      (await call("GET", "/api/me/instructions", { cookie: max })).body.instructions,
      ""
    );
  });

  it("puts an S3 member's mode into their Claude Code theme, as them", async () => {
    const sudo = fakeSudo();
    runAs.__setExecImpl(sudo.exec);
    const settings = path.join(USERS, "mia", ".claude", "settings.json");
    fs.mkdirSync(path.dirname(settings), { recursive: true });
    fs.writeFileSync(settings, JSON.stringify({ model: "opus" }));
    await call("PUT", "/api/me/prefs", { cookie: mia, body: { prefs: { theme: "light" } } });
    assert.deepEqual(JSON.parse(fs.readFileSync(settings, "utf8")), {
      model: "opus",
      theme: "light",
    });
    assert.ok(sudo.calls.some((c) => c.includes("ah-mia") && c.includes(settings)));
    // "system" is the browser's to resolve: Claude's file is left as it is.
    await call("PUT", "/api/me/prefs", { cookie: mia, body: { prefs: { theme: "system" } } });
    assert.equal(JSON.parse(fs.readFileSync(settings, "utf8")).theme, "light");
  });
});