Files
Ekklesia/core/tests/dashboard-flat-modules.test.ts
T
ekklesiaandClaude Opus 5 baa689b2a7
CI / verify (pull_request) Successful in 35s
CI / infrastructure-smoke (pull_request) Successful in 21s
CI / migration-smoke (pull_request) Successful in 46s
feat: add the module configuration and secrets contract
Modules had no way to be told anything. Announcements — the first real
product Ekklesia will absorb — has zero environment variables and compiles
a LAN IP address into its source, so this is the contract standing between
it and the module system.

- A module declares what it needs in its manifest, using six bounded types
  (string, integer, boolean, enum, url, secret) with no nesting and no
  regular expressions. Static declaration is what lets the platform validate
  configuration *before* deciding whether a module may start: an enabled
  module missing a required value is reported `blocked ·
  configuration_missing · <key>` rather than taking startup down from inside
  its own `start` hook, and Doctor reports the same while still importing no
  module code. That forces `manifestVersion: 5`, a hard cutover.
- Ordinary values persist in one Core table (migration 0005), one row per
  (module_id, key), stored as text until validated against the declaring
  module's current manifest. Nothing is coerced; an invalid stored value
  blocks the module rather than falling back to the default. A key the
  manifest no longer declares is retained and ignored.
- Secrets are never persisted. There is no encryption at rest in this
  repository, so a `secret` key is deployment-supplied and mapped in by the
  host under a name the module never sees. A secret declaration has no
  `default` field, the write API refuses secret material, and the HTTP view
  has no `value` field for one — absent by construction, not filtered.
- Modules receive a frozen `context.config` on the registration, runtime,
  and HTTP handler contexts: the same object identity, per module, beside
  `services` rather than inside it (services is deliberately one shared
  instance). No environment access, no database reference, no way to reach
  another module's values.
- Configuration decides eligibility through ADR 0028's existing resolver:
  three new blocked reasons, each with a distinct operator fix, propagating
  to required dependents through the same mechanism as a disabled module.
- Changes take effect at the next restart; both resources report
  restartRequired. New restricted permission
  `core.modules.configuration.manage`, separate from lifecycle, at the
  sibling prefix `/api/v1/module-configuration`.
- Migration participation stays independent of configuration validity.
  Endpoints and credentials for shared infrastructure stay platform
  concerns; a module declares which bucket it needs, not an S3 endpoint.

See ADR 0029.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-22 21:44:43 -05:00

248 lines
9.4 KiB
TypeScript

import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import path from "node:path";
import { afterEach, describe, expect, it } from "vitest";
import { type DashboardConfiguration, resolveDashboardNavigation } from "../src/dashboard/index.js";
import {
createModuleUiPublicationRegistry,
type DiscoveredModule,
discoverModules,
} from "../src/modules/index.js";
/**
* The executable form of the architecture's central rule: **Dashboard grouping is presentation
* configuration and can never become module structure** (ADR 0021, ADR 0027).
*
* These run real discovery over real fixtures, including a genuine module dependency, and then
* arrange those modules into folders in several different ways. Everything discovery decides —
* which modules exist, what depends on what, and the order they must start in — has to come out
* byte-identical every time. A future change that let a group influence any of that fails here.
*/
const temporaryDirectories: string[] = [];
afterEach(async () => {
await Promise.all(
temporaryDirectories
.splice(0)
.map((directory) => rm(directory, { force: true, recursive: true })),
);
});
interface ModuleFixture {
readonly id: string;
readonly name: string;
/** A *real* technical dependency — one module calling another's functionality — expressed through
* the existing module dependency contract, which is the only kind of module relationship that
* exists. */
readonly dependsOn?: string;
}
async function createModule(modulesDirectory: string, fixture: ModuleFixture): Promise<void> {
const moduleDirectory = path.join(modulesDirectory, fixture.id);
await mkdir(path.join(moduleDirectory, "dist/server"), { recursive: true });
await mkdir(path.join(moduleDirectory, "dist/ui"), { recursive: true });
await writeFile(
path.join(moduleDirectory, "package.json"),
JSON.stringify({
ekklesia: { layer: "module" },
name: `@test/module-${fixture.id}`,
type: "module",
version: "1.0.0",
}),
);
await writeFile(
path.join(moduleDirectory, "ekklesia.module.json"),
JSON.stringify({
compatibility: { moduleSdk: "^0.1.0", platform: "^0.1.0" },
...(fixture.dependsOn
? { dependencies: { modules: { required: { [fixture.dependsOn]: "^1.0.0" } } } }
: {}),
entrypoints: { server: "./dist/server/index.js", ui: "./dist/ui/index.js" },
id: fixture.id,
manifestVersion: 5,
name: fixture.name,
version: "1.0.0",
}),
);
await writeFile(
path.join(moduleDirectory, "dist/server/index.js"),
`export default { id: ${JSON.stringify(fixture.id)}, version: "1.0.0" };`,
);
await writeFile(
path.join(moduleDirectory, "dist/ui/index.js"),
`export default { id: ${JSON.stringify(fixture.id)}, version: "1.0.0", mount() {} };\n`,
);
}
/** Livestream genuinely depends on Video — it calls Video's functionality — so discovery must order
* Video first. Calendar depends on nothing. This is the *only* kind of relationship modules have. */
async function discoverFixtures(): Promise<readonly DiscoveredModule[]> {
const modulesDirectory = await mkdtemp(path.join(tmpdir(), "ekklesia-flat-modules-"));
temporaryDirectories.push(modulesDirectory);
await createModule(modulesDirectory, { id: "video", name: "Video" });
await createModule(modulesDirectory, {
dependsOn: "video",
id: "livestream",
name: "Livestream",
});
await createModule(modulesDirectory, { id: "calendar", name: "Calendar" });
return discoverModules({
moduleSdkVersion: "0.1.0",
modulesDirectory,
platformVersion: "0.1.0",
});
}
/**
* Four arrangements of the same three modules, including the one the architecture warns about:
* Livestream and Video together under "Media", which must **not** create a Media module or a
* dependency between them.
*/
const arrangements: ReadonlyArray<readonly [string, DashboardConfiguration]> = [
["nothing configured", { groups: [], placements: [] }],
[
"Media over Planning",
{
groups: [
{ id: "media", label: "Media", sortOrder: 10 },
{ id: "planning", label: "Planning", sortOrder: 20 },
],
placements: [
{ groupId: "media", moduleId: "livestream", sortOrder: 10 },
{ groupId: "media", moduleId: "video", sortOrder: 20 },
{ groupId: "planning", moduleId: "calendar", sortOrder: 10 },
],
},
],
[
"Livestream moved to Sunday Production, away from Video",
{
groups: [
{ id: "media", label: "Media", sortOrder: 10 },
{ id: "sunday-production", label: "Sunday Production", sortOrder: 5 },
],
placements: [
{ groupId: "sunday-production", moduleId: "livestream", sortOrder: 10 },
{ groupId: "media", moduleId: "video", sortOrder: 10 },
],
},
],
[
"the dependency inverted in presentation: Video grouped under Livestream's folder alone",
{
groups: [{ id: "streaming", label: "Streaming", sortOrder: 1 }],
placements: [{ groupId: "streaming", moduleId: "video", sortOrder: 10 }],
},
],
];
describe("Dashboard grouping never becomes module structure", () => {
it("orders discovery by real dependencies, which is the only module relationship", async () => {
const discovered = await discoverFixtures();
// Video before Livestream because Livestream *depends* on it — not because of any folder.
expect(discovered.map((module) => module.manifest.id)).toEqual([
"calendar",
"video",
"livestream",
]);
expect(
discovered.find((module) => module.manifest.id === "livestream")?.manifest.dependencies,
).toMatchObject({ modules: { required: { video: "^1.0.0" } } });
});
it("leaves discovery, dependencies, and start order identical under every arrangement", async () => {
const discovered = await discoverFixtures();
const registry = createModuleUiPublicationRegistry(discovered);
// The exact facts the runtime consumes, captured before any Dashboard configuration exists.
const baseline = JSON.stringify(
discovered.map((module) => ({
capabilities: module.manifest.capabilities,
dependencies: module.manifest.dependencies,
id: module.manifest.id,
permissions: module.manifest.permissions,
version: module.manifest.version,
})),
);
for (const [label, configuration] of arrangements) {
const view = resolveDashboardNavigation(
configuration,
registry.list().map((entry) => ({ id: entry.moduleId, name: entry.name })),
);
// Discovery order — which is module *startup* order — is untouched by presentation.
expect(
discovered.map((module) => module.manifest.id),
label,
).toEqual(["calendar", "video", "livestream"]);
// So is every fact the runtime reads.
expect(
JSON.stringify(
discovered.map((module) => ({
capabilities: module.manifest.capabilities,
dependencies: module.manifest.dependencies,
id: module.manifest.id,
permissions: module.manifest.permissions,
version: module.manifest.version,
})),
),
label,
).toBe(baseline);
// And every module is still rendered exactly once, whatever the folders say.
expect(
[...view.groups.flatMap((group) => group.modules), ...view.ungrouped]
.map((entry) => entry.id)
.sort(),
label,
).toEqual(["calendar", "livestream", "video"]);
}
});
it("never invents a module for a group, however the group is named", async () => {
const discovered = await discoverFixtures();
const registry = createModuleUiPublicationRegistry(discovered);
const [, mediaArrangement] = arrangements[1] as readonly [string, DashboardConfiguration];
const view = resolveDashboardNavigation(
mediaArrangement,
registry.list().map((entry) => ({ id: entry.moduleId, name: entry.name })),
);
// "Media" and "Planning" are group labels. There is no `media` module, no manifest for one, no
// artifact, no API root, no permission, and nothing depends on one.
const moduleIds = discovered.map((module) => module.manifest.id);
expect(moduleIds).toEqual(["calendar", "video", "livestream"]);
for (const groupId of view.groups.map((group) => group.id)) {
expect(moduleIds).not.toContain(groupId);
expect(registry.resolve(groupId, "1.0.0")).toBeUndefined();
}
});
it("keeps the publication record free of any grouping, ordering, or navigation field", async () => {
const registry = createModuleUiPublicationRegistry(await discoverFixtures());
const published = registry.resolve("livestream", "1.0.0");
// The record a host mounts from carries identity, the validated artifact, declared permissions,
// and the module's own name — never a group, an order, a parent, or a folder.
expect(Object.keys(published ?? {}).sort()).toEqual([
"artifactPath",
"moduleId",
"name",
"permissions",
"version",
]);
});
it("takes the display name from the module's own manifest, not from any folder", async () => {
const registry = createModuleUiPublicationRegistry(await discoverFixtures());
expect(registry.list().map((entry) => [entry.moduleId, entry.name])).toEqual([
["calendar", "Calendar"],
["video", "Video"],
["livestream", "Livestream"],
]);
});
});