Files
optimclaw/tests/workspace_integration.rs
T
45ec691f4c Improve test infrastructure: StubChannel, gateway helpers, security tests, search edge cases (#623)
* feat(testing): add StubChannel test double for Channel trait

Adds StubChannel to src/testing.rs alongside StubLlm. Supports message
injection via mpsc sender, response/status capture, and configurable
health check toggling. Includes handle methods for use after ownership
transfer to ChannelManager.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* feat(testing): wire StubChannel into TestHarnessBuilder

Add with_stub_channel() builder method that creates a StubChannel
pre-registered in a ChannelManager. Tests can inject messages via
the sender and verify routing through the manager. The channel field
on TestHarness is Optional, defaulting to None for backward compat.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* test: gate external-service tests behind integration feature flag

Replace silent try_connect() skip pattern with explicit feature gating.
cargo test now runs only self-contained tests.
cargo test --features integration runs tests requiring PostgreSQL.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* test(channels): add ChannelManager unit tests using StubChannel

Cover add/start_all stream merging, respond routing, unknown channel
errors, health_check_all with mixed health, empty-channels error path,
and injection channel merging -- all via StubChannel test double.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* docs: document test tier separation (unit/integration/live)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* ci: add architecture boundary check script

Grep-based checks for three architecture boundaries:
- Direct database driver usage (tokio_postgres/libsql) outside src/db/
- .unwrap()/.expect() in production code (warning only)
- Direct std::env::var reads outside config layer (warning only)

The DB driver check is a hard violation; the other two are warnings
for gradual cleanup. Run with: bash scripts/check-boundaries.sh

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* test(search): add RRF edge case tests for empty inputs, limits, and config modes

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* test(security): add regression tests for skill installer ZIP and SSRF protections

Add 11 regression tests covering the security controls in skill_tools:

ZIP extraction safety:
- Valid SKILL.md extraction works correctly
- Non-SKILL.md entries are ignored (returns error)
- Path traversal entries (../../SKILL.md) do not match
- Nested path entries (subdir/SKILL.md) do not match
- Oversized entries (>1MB uncompressed) are rejected

SSRF prevention:
- Loopback addresses (127.0.0.1) are blocked
- Private ranges (10.x, 172.16.x, 192.168.x) are blocked
- Link-local addresses (169.254.x) are blocked
- Public IPs (8.8.8.8, 1.1.1.1) are allowed
- IPv4-mapped IPv6 unwrapping logic works correctly
- Metadata endpoints and .internal/.local hostnames are blocked
- Normal hostnames (github.com, clawhub.dev) are allowed

Also documents a known gap: url::Url::host_str() returns bracketed
IPv6 addresses that std::net::IpAddr cannot parse, so IPv4-mapped
IPv6 URLs currently bypass IP-based checks in validate_fetch_url.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* refactor(testing): extract TestGatewayBuilder to eliminate gateway test duplication

Both ws_gateway_integration.rs and openai_compat_integration.rs manually
constructed GatewayState with 19+ fields. Extracted to a shared builder in
src/channels/web/test_helpers.rs that provides sensible defaults and lets
tests override only what they need.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* docs: add implementation plans for testing batches 1 and 2

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix(security): close IPv6 SSRF bypass in validate_fetch_url

validate_fetch_url used host_str() which returns bracketed IPv6
(e.g. "[::ffff:7f00:1]") that IpAddr::parse() cannot handle,
silently skipping IP-based SSRF checks for all IPv6 URLs.

Switch to url::Host enum matching to extract proper IpAddr values
without string parsing. IPv4-mapped IPv6 addresses like
::ffff:127.0.0.1 are now correctly unwrapped and blocked.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* test(skills): add activation criteria limits enforcement tests

Adds test_activation_criteria_enforce_limits to verify that
enforce_limits() correctly trims excess patterns (>5), keywords (>20),
and tags (>10), and filters out short keywords/tags (<3 chars).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* test(wasm): add security regression tests for WASM tool loader

Add 6 tests covering: tool name path separator rejection, empty name
rejection, nonexistent file handling, invalid WASM bytes rejection,
dotfile discovery behavior, and subdirectory non-recursion.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* refactor: address PR review feedback

- Remove plan files from repo (ilblackdragon review)
- Replace CLAUDE.md test tier rules with pointer to check-boundaries.sh
- Add Check 4 to check-boundaries.sh: enforces integration tests are
  gated behind the 'integration' feature flag

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* ci: add try_connect silent-skip pattern check to check-boundaries.sh

Check 5 catches try_connect() and similar silent-skip patterns in
integration tests. Tests should use feature gates to fail loudly
when prerequisites are missing, not silently return.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix(security): harden skill fetch SSRF checks

* fix(scripts): use bash arrays in check-boundaries.sh tier violation check

Refactor Check 4 in check-boundaries.sh to use bash arrays and printf
instead of string concatenation with echo -e. This is more robust with
special characters in filenames and avoids portability concerns with
echo -e. [skip-regression-check]

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>
2026-03-07 08:30:47 +00:00

368 lines
10 KiB
Rust

#![cfg(all(feature = "postgres", feature = "integration"))]
//! Integration tests for the workspace module.
//!
//! Requires a running PostgreSQL with pgvector extension.
//! Set DATABASE_URL=postgres://localhost/ironclaw_test
use std::sync::Arc;
use ironclaw::workspace::{MockEmbeddings, SearchConfig, Workspace, paths};
fn get_pool() -> deadpool_postgres::Pool {
let database_url = std::env::var("DATABASE_URL")
.unwrap_or_else(|_| "postgres://localhost/ironclaw_test".to_string());
let config: tokio_postgres::Config = database_url.parse().expect("Invalid DATABASE_URL");
let mgr = deadpool_postgres::Manager::new(config, tokio_postgres::NoTls);
deadpool_postgres::Pool::builder(mgr)
.max_size(4)
.build()
.expect("Failed to create pool")
}
async fn cleanup_user(pool: &deadpool_postgres::Pool, user_id: &str) {
let conn = pool.get().await.expect("Failed to get connection");
conn.execute(
"DELETE FROM memory_documents WHERE user_id = $1",
&[&user_id],
)
.await
.ok();
}
#[tokio::test]
async fn test_workspace_write_and_read() {
let pool = get_pool();
let user_id = "test_write_read";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Write a file
let doc = workspace
.write("README.md", "# Hello World\n\nThis is a test.")
.await
.expect("Failed to write");
assert_eq!(doc.path, "README.md");
assert!(doc.content.contains("Hello World"));
// Read it back
let doc2 = workspace.read("README.md").await.expect("Failed to read");
assert_eq!(doc2.content, "# Hello World\n\nThis is a test.");
// Cleanup
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_append() {
let pool = get_pool();
let user_id = "test_append";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Write initial content
workspace
.write("notes.md", "Line 1")
.await
.expect("Failed to write");
// Append more
workspace
.append("notes.md", "Line 2")
.await
.expect("Failed to append");
// Read and verify
let doc = workspace.read("notes.md").await.expect("Failed to read");
assert_eq!(doc.content, "Line 1\nLine 2");
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_nested_paths() {
let pool = get_pool();
let user_id = "test_nested";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Write nested files
workspace
.write("projects/alpha/README.md", "# Alpha")
.await
.expect("Failed to write alpha");
workspace
.write("projects/alpha/notes.md", "Notes here")
.await
.expect("Failed to write notes");
workspace
.write("projects/beta/README.md", "# Beta")
.await
.expect("Failed to write beta");
// List root
let root = workspace.list("").await.expect("Failed to list root");
assert_eq!(root.len(), 1); // just "projects/"
assert!(root[0].is_directory);
assert_eq!(root[0].name(), "projects");
// List projects
let projects = workspace
.list("projects")
.await
.expect("Failed to list projects");
assert_eq!(projects.len(), 2); // alpha/, beta/
// List alpha
let alpha = workspace
.list("projects/alpha")
.await
.expect("Failed to list alpha");
assert_eq!(alpha.len(), 2); // README.md, notes.md
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_delete() {
let pool = get_pool();
let user_id = "test_delete";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Write and verify exists
workspace
.write("temp.md", "temporary")
.await
.expect("Failed to write");
assert!(workspace.exists("temp.md").await.expect("exists failed"));
// Delete
workspace.delete("temp.md").await.expect("Failed to delete");
// Verify gone
assert!(!workspace.exists("temp.md").await.expect("exists failed"));
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_memory_operations() {
let pool = get_pool();
let user_id = "test_memory_ops";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Append to memory
workspace
.append_memory("User prefers dark mode")
.await
.expect("Failed to append memory");
workspace
.append_memory("User's timezone is PST")
.await
.expect("Failed to append memory");
// Read memory
let memory = workspace.memory().await.expect("Failed to get memory");
assert!(memory.content.contains("dark mode"));
assert!(memory.content.contains("PST"));
// Entries should be separated by double newline
assert!(memory.content.contains("\n\n"));
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_daily_log() {
let pool = get_pool();
let user_id = "test_daily_log";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Append to daily log (timestamped)
workspace
.append_daily_log("Started working on feature X")
.await
.expect("Failed to append daily log");
// Read today's log
let log = workspace
.today_log()
.await
.expect("Failed to get today log");
assert!(log.content.contains("feature X"));
// Should have timestamp prefix like [HH:MM:SS]
assert!(log.content.contains("["));
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_fts_search() {
let pool = get_pool();
let user_id = "test_fts_search";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Write some documents
workspace
.write(
"docs/authentication.md",
"# Authentication\n\nThe system uses JWT tokens for authentication.",
)
.await
.expect("write failed");
workspace
.write(
"docs/database.md",
"# Database\n\nWe use PostgreSQL with pgvector for vector search.",
)
.await
.expect("write failed");
workspace
.write(
"docs/api.md",
"# API\n\nThe REST API uses JSON for request and response bodies.",
)
.await
.expect("write failed");
// Search for JWT (FTS only since no embeddings)
let results = workspace
.search_with_config("JWT authentication", SearchConfig::default().fts_only())
.await
.expect("search failed");
assert!(!results.is_empty(), "Should find results for JWT");
assert!(
results[0].content.contains("JWT"),
"Top result should contain JWT"
);
// Search for PostgreSQL
let results = workspace
.search_with_config("PostgreSQL database", SearchConfig::default().fts_only())
.await
.expect("search failed");
assert!(!results.is_empty(), "Should find results for PostgreSQL");
assert!(
results[0].content.contains("PostgreSQL"),
"Top result should contain PostgreSQL"
);
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_hybrid_search_with_mock_embeddings() {
let pool = get_pool();
let user_id = "test_hybrid_search";
cleanup_user(&pool, user_id).await;
// Create workspace with mock embeddings (1536 dimensions to match OpenAI)
let embeddings = Arc::new(MockEmbeddings::new(1536));
let workspace = Workspace::new(user_id, pool.clone()).with_embeddings(embeddings);
// Write documents
workspace
.write(
"memory.md",
"The user prefers dark mode and vim keybindings.",
)
.await
.expect("write failed");
workspace
.write(
"prefs.md",
"Settings: theme=dark, editor=vim, font=monospace",
)
.await
.expect("write failed");
// Hybrid search
let results = workspace
.search("dark theme preference", 5)
.await
.expect("search failed");
assert!(!results.is_empty(), "Should find results");
// At least one result should be a hybrid match (found by both FTS and vector)
// or we should have results from either method
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_list_all() {
let pool = get_pool();
let user_id = "test_list_all";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Write files at various depths
workspace.write("README.md", "root").await.unwrap();
workspace.write("docs/intro.md", "intro").await.unwrap();
workspace.write("docs/api/rest.md", "rest").await.unwrap();
workspace.write("src/main.md", "main").await.unwrap();
// List all
let all = workspace.list_all().await.expect("list_all failed");
assert_eq!(all.len(), 4);
assert!(all.contains(&"README.md".to_string()));
assert!(all.contains(&"docs/intro.md".to_string()));
assert!(all.contains(&"docs/api/rest.md".to_string()));
assert!(all.contains(&"src/main.md".to_string()));
cleanup_user(&pool, user_id).await;
}
#[tokio::test]
async fn test_workspace_system_prompt() {
let pool = get_pool();
let user_id = "test_system_prompt";
cleanup_user(&pool, user_id).await;
let workspace = Workspace::new(user_id, pool.clone());
// Write identity files
workspace
.write(paths::AGENTS, "You are a helpful assistant.")
.await
.unwrap();
workspace
.write(paths::SOUL, "Be kind and thorough.")
.await
.unwrap();
workspace.write(paths::USER, "Name: Alice").await.unwrap();
// Get system prompt
let prompt = workspace
.system_prompt()
.await
.expect("system_prompt failed");
assert!(
prompt.contains("helpful assistant"),
"Should include AGENTS.md"
);
assert!(
prompt.contains("kind and thorough"),
"Should include SOUL.md"
);
assert!(prompt.contains("Alice"), "Should include USER.md");
cleanup_user(&pool, user_id).await;
}