stoke/test/cli.test.js

const { test } = require('node:test');
const assert = require('node:assert/strict');
const { execFileSync, spawn, spawnSync } = require('node:child_process');
const fs = require('node:fs');
const http = require('node:http');
const os = require('node:os');
const path = require('node:path');

const CLI = path.join(__dirname, '..', 'src', 'cli.js');
const pkg = require('../package.json');

function run(args, env = {}) {
  return spawnSync(process.execPath, [CLI, ...args], {
    encoding: 'utf8',
    env: { ...process.env, ...env },
  });
}

test('--version matches package.json', () => {
  const out = execFileSync(process.execPath, [CLI, '--version'], { encoding: 'utf8' });
  assert.equal(out.trim(), pkg.version);
});

test('--help lists every top-level command', () => {
  const out = execFileSync(process.execPath, [CLI, '--help'], { encoding: 'utf8' });
  for (const cmd of ['auth', 'repo', 'issue', 'pr', 'release', 'label', 'branch', 'collaborator', 'org', 'user', 'api']) {
    assert.match(out, new RegExp(`^\\s+${cmd}`, 'm'), `missing command: ${cmd}`);
  }
});

test('unauthenticated commands fail with a login hint', () => {
  const missing = path.join(os.tmpdir(), `stoke-none-${process.pid}.json`);
  const res = run(['repo', 'list'], { STOKE_CONFIG_FILE: missing });
  assert.equal(res.status, 1);
  assert.match(res.stderr, /stoke auth login/);
});

test('global --config flag overrides the config location', () => {
  // Point --config at a nonexistent file: auth status must report
  // "Not authenticated" instead of silently using the default config.
  const missing = path.join(os.tmpdir(), `stoke-missing-${process.pid}.json`);
  const res = run(['--config', missing, 'auth', 'status']);
  assert.equal(res.status, 0);
  assert.match(res.stdout, /Not authenticated/);
});

test('invalid --limit is rejected before any network call', () => {
  const res = run(['repo', 'list', '-l', 'abc']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Limit must be a non-negative integer/);
});

test('invalid --team-id is rejected before any network call', () => {
  const res = run(['org', 'team', 'member-add', '--team-id', 'zero', '-u', 'x']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Id must be a positive integer/);
});

test('pr merge validates --number before any network call', () => {
  const res = run(['pr', 'merge', '-o', 'o', '-r', 'r', '-n', 'seven']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Id must be a positive integer/);
});

test('issue create --body-file reports unreadable files cleanly', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(
      ['issue', 'create', '-o', 'o', '-r', 'r', '-t', 't', '--body-file', '/nonexistent/body.md'],
      { STOKE_CONFIG_FILE: cfg },
    );
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Could not read body file/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr show validates --number before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'show', '-o', 'o', '-r', 'r', '-n', 'zero'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Id must be a positive integer/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr comment rejects a missing body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'comment', '-o', 'o', '-r', 'r', '-n', '1'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Comment body is required/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr comment rejects a whitespace-only body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'comment', '-o', 'o', '-r', 'r', '-n', '1', '-b', '   '], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Comment body is required/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review rejects an invalid event before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'nope'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Invalid review event/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review accepts approved as an alias for approve before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    // Network fails; must not fail at event validation.
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'APPROVED'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.doesNotMatch(res.stderr, /Invalid review event/);
    assert.doesNotMatch(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review request-changes rejects a missing body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'request-changes'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review comment rejects a whitespace-only body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'comment', '-b', '   '], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review approve allows an empty body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'approve'], { STOKE_CONFIG_FILE: cfg });
    // It fails at the network call, not at validation.
    assert.equal(res.status, 1);
    assert.doesNotMatch(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('label create rejects an invalid color before any network call', () => {
  const res = run(['label', 'create', '-o', 'o', '-r', 'r', '--name', 'x', '--color', 'red']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Color must be 6 hex digits/);
});

test('label delete requires one of --id or --name before any network call', () => {
  const res = run(['label', 'delete', '-o', 'o', '-r', 'r']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /One of --id or --name is required/);
});

test('api rejects an endpoint without a leading slash before any network call', () => {
  const res = run(['api', 'repos/o/r']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Endpoint must start with \//);
});

test('api rejects an unsupported method before any network call', () => {
  const res = run(['api', '/user', '-X', 'HEAD']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Unsupported method/);
});

test('api rejects --paginate with a non-GET method before any network call', () => {
  const res = run(['api', '/user', '-X', 'POST', '--paginate']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /--paginate only works with GET/);
});

test('api rejects GET with --input before any network call', () => {
  const res = run(['api', '/user', '-X', 'GET', '--input', '{}']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /GET requests cannot carry a body/);
});

test('label delete rejects --id and --name together before any network call', () => {
  const res = run(['label', 'delete', '-o', 'o', '-r', 'r', '--id', '3', '--name', 'x']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /either --id or --name, not both/);
});

test('api rejects invalid JSON input before any network call', () => {
  const res = run(['api', '/user', '--input', '{nope']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /not valid JSON/);
});

test('api sends the token and prints the JSON response', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-api.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    let authHeader = null;
    const server = http.createServer((req, res) => {
      authHeader = req.headers.authorization;
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ login: 'bot' }));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(['api', '/user'], { STOKE_CONFIG_FILE: cfg });
        clearTimeout(timer);
        server.close(() => resolve({ res, authHeader }));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.res.status, 0, result.res.stderr);
    assert.equal(result.authHeader, 'token tok');
    assert.deepEqual(JSON.parse(result.res.stdout), { login: 'bot' });
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('label add fails closed on an unknown label name', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-lbl.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const server = http.createServer((req, res) => {
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify([{ id: 1, name: 'bug', color: 'd73a4a' }]));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(
          ['label', 'add', '-o', 'o', '-r', 'r', '-n', '7', '--name', 'ghost'],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve(res));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.status, 1);
    assert.match(result.stderr, /Label not found in o\/r: ghost/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

function spawnAsync(args, env = {}) {
  return new Promise((resolve, reject) => {
    const child = spawn(process.execPath, [CLI, ...args], {
      env: { ...process.env, ...env },
    });
    let stdout = '';
    let stderr = '';
    child.stdout.setEncoding('utf8');
    child.stderr.setEncoding('utf8');
    child.stdout.on('data', (chunk) => { stdout += chunk; });
    child.stderr.on('data', (chunk) => { stderr += chunk; });
    child.on('error', reject);
    child.on('close', (status) => resolve({ status, stdout, stderr }));
  });
}

test('pr review preserves exact body-file whitespace through the CLI boundary', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  const bodyFile = path.join(os.tmpdir(), `stoke-body-${process.pid}.md`);
  const rawBody = '    leading spaces\nline\ntrailing newline\n';

  fs.writeFileSync(bodyFile, rawBody, 'utf8');

  const TIMEOUT_MS = 5000;
  let timer;
  const captured = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };

    const server = http.createServer((req, res) => {
      let data = '';
      req.setEncoding('utf8');
      req.on('data', (chunk) => { data += chunk; });
      req.on('end', () => {
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ id: 99, html_url: 'https://forge.test/reviews/99' }));
        clearTimeout(timer);
        server.close(() => resolve({ url: req.url, body: data, cliStatus: null }));
      });
    });

    timer = setTimeout(() => fail(new Error(`CLI boundary test timed out after ${TIMEOUT_MS}ms`)), TIMEOUT_MS);

    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(
          ['pr', 'review', '-o', 'o', '-r', 'r', '-n', '7', '--event', 'request-changes', '--body-file', bodyFile],
          { STOKE_CONFIG_FILE: cfg },
        );
        if (res.status !== 0) {
          fail(new Error(`CLI failed (status ${res.status}): ${res.stderr}`));
          return;
        }
        // Capture is resolved from the HTTP handler; assert exit 0 here via side channel.
        // If the handler already resolved, attach status for the outer asserts.
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(captured.url, '/api/v1/repos/o/r/pulls/7/reviews');
    const json = JSON.parse(captured.body);
    assert.equal(json.event, 'REQUEST_CHANGES');
    assert.equal(json.body, rawBody);
  } finally {
    fs.unlinkSync(cfg);
    fs.unlinkSync(bodyFile);
  }
});

test('pr review prints the review URL from the API response', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-url.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const server = http.createServer((req, res) => {
      let data = '';
      req.on('data', (c) => { data += c; });
      req.on('end', () => {
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ id: 42, html_url: 'https://forge.test/pulls/7#issuecomment-42' }));
      });
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(
          ['pr', 'review', '-o', 'o', '-r', 'r', '-n', '7', '--event', 'approve', '-b', 'LGTM'],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve(res));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.status, 0, result.stderr);
    assert.match(result.stdout, /Review submitted on !7: APPROVED/);
    assert.match(result.stdout, /URL: https:\/\/forge\.test\/pulls\/7#issuecomment-42/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

// Runs `auth login` against a stub Forgejo server and captures the body of
// the token-creation request. GETs answer as /user; the POST to
// /users/{name}/tokens is what carries the scopes under test.
function runLoginWithServer(extraArgs) {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-${runLoginWithServer.n}.json`);
  runLoginWithServer.n += 1;
  const TIMEOUT_MS = 5000;
  let timer;
  return new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    let tokenBody = null;
    const server = http.createServer((req, res) => {
      if (req.method === 'POST' && req.url.startsWith('/api/v1/users/')) {
        let data = '';
        req.on('data', (c) => { data += c; });
        req.on('end', () => {
          tokenBody = JSON.parse(data);
          res.writeHead(201, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ id: 1, name: tokenBody.name, sha1: 'tok123' }));
        });
        return;
      }
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ login: 'alice', username: 'alice', email: 'alice@forge.test' }));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      try {
        const res = await spawnAsync(
          ['auth', 'login', '-u', `http://127.0.0.1:${port}`, '-n', 'alice', '-p', 'secret', ...extraArgs],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve({ res, tokenBody, cfg }));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));
}
runLoginWithServer.n = 0;

test('auth login creates a token with the reduced default scopes', async () => {
  const { res, tokenBody, cfg } = await runLoginWithServer([]);
  try {
    assert.equal(res.status, 0, res.stderr);
    assert.deepEqual(tokenBody.scopes, [
      'read:issue', 'write:issue',
      'read:repository', 'write:repository',
      'read:user',
      'read:organization',
    ]);
    assert.match(res.stdout, /Scopes: read:issue, write:issue, read:repository, write:repository, read:user, read:organization/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth login --full-scopes restores the full scope set', async () => {
  const { res, tokenBody, cfg } = await runLoginWithServer(['--full-scopes']);
  try {
    assert.equal(res.status, 0, res.stderr);
    assert.deepEqual(tokenBody.scopes, [
      'read:activitypub', 'write:activitypub',
      'read:issue', 'write:issue',
      'read:misc', 'write:misc',
      'read:organization', 'write:organization',
      'read:package', 'write:package',
      'read:repository', 'write:repository',
      'read:user', 'write:user',
    ]);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth login --scopes parses a comma-separated list', async () => {
  const { res, tokenBody, cfg } = await runLoginWithServer(['--scopes', 'read:issue, write:repository ,read:user']);
  try {
    assert.equal(res.status, 0, res.stderr);
    assert.deepEqual(tokenBody.scopes, ['read:issue', 'write:repository', 'read:user']);
    assert.match(res.stdout, /Scopes: read:issue, write:repository, read:user/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth login rejects --full-scopes together with --scopes before any network call', () => {
  const res = run(['auth', 'login', '--full-scopes', '--scopes', 'read:issue']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /either --full-scopes or --scopes, not both/);
});