tandem-server 0.6.6

HTTP server for Tandem engine APIs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167

// Regression coverage for TAN-541: incident-monitor state files must be written
// atomically and a corrupt file must be quarantined (preserved) on load rather
// than silently discarded and overwritten with empty state.

use crate::IncidentMonitorPostRecord;

use super::{test_state_with_path, tmp_resource_file};

#[test]
fn constant_time_str_eq_matches_only_identical_values() {
    // TAN-558: secret/token/hash comparisons use a constant-time helper.
    assert!(crate::constant_time_str_eq("token-abc", "token-abc"));
    assert!(!crate::constant_time_str_eq("token-abc", "token-abd"));
    assert!(!crate::constant_time_str_eq(
        "token-abc",
        "token-abc-longer"
    ));
    assert!(!crate::constant_time_str_eq("", "x"));
    assert!(crate::constant_time_str_eq("", ""));
}

fn sample_post(post_id: &str) -> IncidentMonitorPostRecord {
    IncidentMonitorPostRecord {
        post_id: post_id.to_string(),
        draft_id: "draft-1".to_string(),
        fingerprint: "fingerprint-1".to_string(),
        repo: "frumu-ai/tandem".to_string(),
        operation: "create_issue".to_string(),
        status: "posted".to_string(),
        idempotency_key: format!("idem-{post_id}"),
        created_at_ms: 1,
        updated_at_ms: 1,
        ..Default::default()
    }
}

#[tokio::test]
async fn incident_monitor_posts_round_trip_persists_atomically() {
    let mut state = test_state_with_path(tmp_resource_file("im-posts-roundtrip"));
    let posts_path = tmp_resource_file("im-posts-roundtrip-posts");
    state.incident_monitor_posts_path = posts_path.clone();

    state
        .incident_monitor_posts
        .write()
        .await
        .insert("p1".to_string(), sample_post("p1"));
    state
        .persist_incident_monitor_posts()
        .await
        .expect("persist posts");

    // The persisted file is valid JSON and the temp file used for the atomic
    // write did not linger.
    assert!(posts_path.exists());
    assert!(
        !posts_path.with_extension("tmp").exists(),
        "temp file leaked"
    );

    // A fresh state pointed at the same file rehydrates the receipt.
    let mut reloaded = test_state_with_path(tmp_resource_file("im-posts-roundtrip-2"));
    reloaded.incident_monitor_posts_path = posts_path.clone();
    reloaded
        .load_incident_monitor_posts()
        .await
        .expect("load posts");
    let posts = reloaded.incident_monitor_posts.read().await;
    assert_eq!(posts.len(), 1);
    assert!(posts.contains_key("p1"));
}

#[tokio::test]
async fn corrupt_incident_monitor_posts_file_is_quarantined_not_discarded() {
    let mut state = test_state_with_path(tmp_resource_file("im-posts-corrupt"));
    let posts_path = tmp_resource_file("im-posts-corrupt-posts");
    state.incident_monitor_posts_path = posts_path.clone();

    // Simulate a torn/corrupt state file left behind by a crash mid-write.
    tokio::fs::write(&posts_path, b"{ this is not valid json")
        .await
        .expect("write corrupt file");

    // Load must not error and must not leave the corrupt bytes where the next
    // persist would overwrite (and permanently lose) them.
    state
        .load_incident_monitor_posts()
        .await
        .expect("load must not fail on corrupt file");
    assert!(state.incident_monitor_posts.read().await.is_empty());

    // The corrupt file was moved aside, not left in place to be overwritten.
    assert!(
        !posts_path.exists(),
        "corrupt file should have been quarantined away from the canonical path"
    );

    // A `.corrupt-` sibling preserves the original bytes for recovery.
    let dir = posts_path.parent().expect("temp dir");
    let original_name = posts_path
        .file_name()
        .and_then(|name| name.to_str())
        .expect("file name")
        .to_string();
    let mut found_quarantine = false;
    let mut entries = tokio::fs::read_dir(dir).await.expect("read temp dir");
    while let Some(entry) = entries.next_entry().await.expect("dir entry") {
        let name = entry.file_name();
        let name = name.to_str().unwrap_or_default();
        if name.starts_with(&original_name) && name.contains(".corrupt-") {
            let contents = tokio::fs::read_to_string(entry.path())
                .await
                .expect("read quarantined file");
            assert!(
                contents.contains("not valid json"),
                "quarantined file should preserve the original bytes"
            );
            found_quarantine = true;
        }
    }
    assert!(
        found_quarantine,
        "expected a quarantined .corrupt- sibling preserving the corrupt bytes"
    );
}

#[tokio::test]
async fn retention_prune_removes_stale_receipts_but_keeps_fresh() {
    // TAN-556: safety_defaults.retention_days must actually prune old receipts /
    // incidents instead of letting them accumulate unbounded.
    let mut state = test_state_with_path(tmp_resource_file("im-retention"));
    state.incident_monitor_posts_path = tmp_resource_file("im-retention-posts");
    state.incident_monitor_incidents_path = tmp_resource_file("im-retention-incidents");

    let now = crate::now_ms();
    let day_ms = 24 * 60 * 60 * 1_000u64;

    let mut stale = sample_post("stale");
    stale.updated_at_ms = now.saturating_sub(30 * day_ms);
    let mut fresh = sample_post("fresh");
    fresh.updated_at_ms = now;
    {
        let mut guard = state.incident_monitor_posts.write().await;
        guard.insert("stale".to_string(), stale);
        guard.insert("fresh".to_string(), fresh);
    }

    // A zero window prunes nothing.
    assert_eq!(
        state
            .prune_incident_monitor_retention(0)
            .await
            .expect("no-op prune"),
        (0, 0, 0)
    );
    assert_eq!(state.incident_monitor_posts.read().await.len(), 2);

    // A 7-day window drops the 30-day-old receipt and keeps the fresh one.
    let (posts, _incidents, _artifacts) = state
        .prune_incident_monitor_retention(7)
        .await
        .expect("prune");
    assert_eq!(posts, 1, "the stale receipt should have been pruned");
    let guard = state.incident_monitor_posts.read().await;
    assert!(guard.contains_key("fresh"));
    assert!(!guard.contains_key("stale"));
}