apps/server/tests · scn-chat · Tangled

ATProto-based AI Assistant Chat interface.

scn-chat apps server tests

13 folders · 9 files

at admin-config-export

· Add site-config export / import via CLI. · 1w ago

Add site-config export / import via CLI.

Port the chat sidebar from design-reference. The server answers GET /api/me/profile with the display name and Bluesky's CDN avatar thumbnail, read from the PDS on each request, and the browser store lists each chat's pending reply and newest complete reply and records when the index last synced. The sidebar puts New chat beside a search toggle, the tags as a folding filter, the chats under date headings with a dot for a reply in progress or one not yet seen on this device, a menu on each to rename, tag, or delete it in place, search results grouped by chat with their Markdown inline, and the account at the foot with a sync dot and a menu of where the chats live, their sync, Settings, Admin, and Sign out. New chat still creates the chat until the empty composer arrives.

A file in a sent message shows as the chip it was in the composer, with its icon, name, and kind and size, as "PDF · 1.2 MB", rather than a bare link holding its name. The chip moves to src/shared/ui as FileChip, which the composer and the message share. The whole chip is a link: a PDF opens in a new tab in the browser's own viewer, ending in an arrow out, and any other file downloads under its name, ending in a download arrow. Files side by side share a row that wraps toward the message's edge. The blob routes, the owner's and the shared one, serve a PDF inline and take application/pdf as a type, so a spaces user's PDF reaches the browser as one. The attachments, web UI, and styling specs say so.

Add the admin area for settings to replace config.yml.

Add the admin area for settings to replace config.yml.

Add site-config export / import via CLI.

A secret the server can no longer decrypt, as after a lost SECRET_KEY, reads as unset and is flagged, rather than failing the page that reads it or, for an admin plugin's options, the server's startup. The settings page's web search, the admin plugin forms, and every other schema form say on each secret field that its saved value can't be read and to enter it again, and an admin can tick Clear to discard it. A BYO key that can't be read says so on the API keys page in place of its last four characters, found from its key ID without decrypting it, and a turn that uses it ends with an error asking for the key again. The unreadable value is kept until a new secret is entered, cleared, or reset, so restoring the old key in SECRET_KEYS_OLD brings it back. SecretBox gains tryDecrypt and hasKeyFor, and a value that fails authentication now throws SecretDecryptError too.

Retry busy providers. Don't retry spent keys. Add messaging for users.

The app has a description, set in the admin area beside its name, which the login page shows under the name in place of its fixed tagline. Every page carries it as its meta description and in Open Graph tags for link previews, with robots noindex, since each page is someone's own. A page's title is its route's staticData.title, such as Settings, Admin, or Shared chat, before the app name. The login page is the one page search engines may list: it overrides robots and names its canonical URL and og:url under PUBLIC_URL, which the server now passes with each request. /robots.txt keeps crawlers out of /api, /oauth, and /xrpc. shared/app-name.ts becomes shared/site.ts, which reads the name and description from the rendered page in the browser.

A file in a sent message shows as the chip it was in the composer, with its icon, name, and kind and size, as "PDF · 1.2 MB", rather than a bare link holding its name. The chip moves to src/shared/ui as FileChip, which the composer and the message share. The whole chip is a link: a PDF opens in a new tab in the browser's own viewer, ending in an arrow out, and any other file downloads under its name, ending in a download arrow. Files side by side share a row that wraps toward the message's edge. The blob routes, the owner's and the shared one, serve a PDF inline and take application/pdf as a type, so a spaces user's PDF reaches the browser as one. The attachments, web UI, and styling specs say so.

The conversation:created and conversation:deleted plugin hooks run once for each conversation created or deleted, whichever client made the change, where before only the app's own routes ran them. fireChatHooks, wired in server.ts, runs them from the in-process event bus. ChatService announces the conversations the app creates and deletes, through a listener in place of its onWrite callback. Sync announces one another client created when an index sync finds a new conversationRef, whose op has no previous CID, and one another client deleted through the engine's new conversationDeleted, which the deleted index entry, the missing space, and notifySpaceDeleted all go through. RecentWrites remembers the spaces the server deleted for ten minutes, so sync noticing the server's own deletion doesn't announce it again. The first index sync after sign-in, and any while the index is empty, announces nothing. The routes no longer wait for the hooks before answering, and open tabs now hear about deletions made through the app too. The plugins spec and guide describe it, with tests and an acceptance criterion.

The conversation:created and conversation:deleted plugin hooks run once for each conversation created or deleted, whichever client made the change, where before only the app's own routes ran them. fireChatHooks, wired in server.ts, runs them from the in-process event bus. ChatService announces the conversations the app creates and deletes, through a listener in place of its onWrite callback. Sync announces one another client created when an index sync finds a new conversationRef, whose op has no previous CID, and one another client deleted through the engine's new conversationDeleted, which the deleted index entry, the missing space, and notifySpaceDeleted all go through. RecentWrites remembers the spaces the server deleted for ten minutes, so sync noticing the server's own deletion doesn't announce it again. The first index sync after sign-in, and any while the index is empty, announces nothing. The routes no longer wait for the hooks before answering, and open tabs now hear about deletions made through the app too. The plugins spec and guide describe it, with tests and an acceptance criterion.

Retry busy providers. Don't retry spent keys. Add messaging for users.

The app has a description, set in the admin area beside its name, which the login page shows under the name in place of its fixed tagline. Every page carries it as its meta description and in Open Graph tags for link previews, with robots noindex, since each page is someone's own. A page's title is its route's staticData.title, such as Settings, Admin, or Shared chat, before the app name. The login page is the one page search engines may list: it overrides robots and names its canonical URL and og:url under PUBLIC_URL, which the server now passes with each request. /robots.txt keeps crawlers out of /api, /oauth, and /xrpc. shared/app-name.ts becomes shared/site.ts, which reads the name and description from the rendered page in the browser.

pnpm preview builds the web app and runs the production build on this machine, at http://127.0.0.1:3000, where before production refused any PUBLIC_URL that wasn't HTTPS. A loopback PUBLIC_URL now passes in production, and needs no OAUTH_PRIVATE_KEYS, since sign-in there uses the loopback client, as in development. Any other plain-HTTP URL is still refused. pnpm start stays the command a deployment runs, serving the build it was given. The README, the foundation spec's scripts, and the auth and admin settings specs describe it, with a test.

Add API key interface and a cron route. Improve the role membership hooks.

lex-errors.test.ts

Add the admin area for settings to replace config.yml.

Crash and privacy fixes, request validation, login CSRF, SSRF guard, handover race, and cleanup.

When the app runs on this machine and its port is taken, the server moves to the next free one, trying up to twenty, and PUBLIC_URL with it, since the OAuth redirect and the app's links name that address, and logs a warning saying so. It moves only when PUBLIC_URL is loopback on that same port, so a deployment, or a loopback URL that names another port, keeps its port and fails to start as before, since a reverse proxy points at it. A port counts as taken when it is at every address or at 127.0.0.1 or ::1 alone, since macOS lets a listener on every address share a port with one on 127.0.0.1, which then still gets the requests for http://127.0.0.1:3000. The tunnel picks the free port itself and points both ssh and the server at it. The foundation spec and .env.example describe it, and the tests cover the probe and when the environment moves.

secrets.test.ts

A secret the server can no longer decrypt, as after a lost SECRET_KEY, reads as unset and is flagged, rather than failing the page that reads it or, for an admin plugin's options, the server's startup. The settings page's web search, the admin plugin forms, and every other schema form say on each secret field that its saved value can't be read and to enter it again, and an admin can tick Clear to discard it. A BYO key that can't be read says so on the API keys page in place of its last four characters, found from its key ID without decrypting it, and a turn that uses it ends with an error asking for the key again. The unreadable value is kept until a new secret is entered, cleared, or reset, so restoring the old key in SECRET_KEYS_OLD brings it back. SecretBox gains tryDecrypt and hasKeyFor, and a value that fails authentication now throws SecretDecryptError too.

Add the admin area for settings to replace config.yml.

Small settings, admin, and sidebar fixes. Renaming a chat from the sidebar won't save an empty title, which marked the chat user-titled and kept it from ever being titled automatically; EditForm takes required, and form.SubmitButton takes disabled. Secret fields use secretInput (autocomplete="new-password" and the password managers' ignore attributes), since a filled-in password would replace the saved secret, and model IDs, handles, base URLs, and slugs use literalInput, so phone keyboards don't capitalize or correct them; both live in shared/ui/controls.tsx. Removing a role member asks to confirm in place. Add user, Add member, Add model, and Create role return their mutation from onSubmit, so the button stays busy until it finishes and can't send twice, and a listed model can't be ticked twice while it is being added. Every settings and admin route has a staticData title, and pageTitle joins them deepest first, as "API keys · Settings · SCN Chat", with a page opened from a section taking that section's title.