nullkey
6d8c8650cd
Two intertwined agent safety nets that share the same files:
1. --dry-run flag for offline preview of mutation commands
2. Risk: metadata + SetRisk helper for destructive command surfaces
Coverage (19 mutation commands with --dry-run):
kb.create/edit/delete agent.create/edit/delete
doc.create/upload/fetch/delete doc.delete_all (special variant)
session.delete chunk.delete profile.add/remove
auth.refresh/logout link unlink
api.{post,put,patch,delete} (api.get + --dry-run rejected, exit 2)
Envelope additions (omitempty in non-dry-run paths):
meta.dry_run: bool true when --dry-run was used
meta.plan: map {action, args} per the per-command taxonomy
Risk: metadata
--------------
cmdutil.SetRisk(cmd, action) stamps cobra.Annotations with
risk.level=destructive + risk.action=<action> on the 9 destructive
commands. The SetAgentHelp wrapper prepends a "Risk: <action>
(destructive)" line in the default text help path so agents see a clear
warning before parsing Usage. WEKNORA_AGENT_HELP=1 JSON path stays
unchanged — structured agent-help already carries warnings[].
Validation parity with the live path
------------------------------------
Every pure-local validation (flag presence, mutual exclusion, enum
bounds, URL/regex format, ResolveKBLocal for KB resolution that does not
require an SDK call) runs BEFORE the dry-run gate. This matches the
industry-standard "preview shows what live would do" contract:
--dry-run accepts exactly the same invocations the live path accepts and
rejects exactly the same invocations the live path rejects, modulo the
side-effecting work itself.
The side-effecting work (SDK calls, file writes, keyring writes, server-
side name → id resolution) is what --dry-run actually gates. Each
mutation file pairs its RunE validation block with a regression test
under *_dry_run_test.go / dryrun_validation_test.go so future refactors
don't reintroduce the gap.
Helper surface
--------------
- HandleDryRun(cmd, dryRun, plan) extracts the early-return so the
19 RunE call sites stay 3 lines each.
- EmitDryRun routes through FormatOptions.Emit, inheriting _notice /
TTY indent / --jq filtering for free.
- ResolveKBLocal mirrors ResolveKB but never calls the SDK; dry-run
paths use it so the plan reports the raw --kb value (UUID or name)
without a name → id lookup.
Streaming commands (chat, session ask, session continue-stream) are
deliberately excluded: a buffered plan makes no sense for an event
stream.
Lock semantics in the dry-run path:
- destructive + --dry-run: exit 0, no exit-10 confirmation prompt
- --dry-run + -y: byte-identical envelope to --dry-run alone
- --dry-run + --jq: filter applies to the preview envelope normally
106 lines
4.0 KiB
Go
106 lines
4.0 KiB
Go
// Package profilecmd — dryrun_validation_test.go asserts that --dry-run on
|
|
// profile subcommands rejects identically to the live path. Before the
|
|
// surrounding fix, validation lived in runX() and was reached only after
|
|
// HandleDryRun short-circuited, so --dry-run accepted invocations the live
|
|
// path would reject.
|
|
package profilecmd
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/spf13/cobra"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/Tencent/WeKnora/cli/internal/cmdutil"
|
|
"github.com/Tencent/WeKnora/cli/internal/config"
|
|
"github.com/Tencent/WeKnora/cli/internal/iostreams"
|
|
"github.com/Tencent/WeKnora/cli/internal/prompt"
|
|
"github.com/Tencent/WeKnora/cli/internal/secrets"
|
|
sdk "github.com/Tencent/WeKnora/client"
|
|
)
|
|
|
|
// profileDryRunFactory builds a Factory whose Client closure panics if
|
|
// invoked — dry-run must early-exit before any SDK call.
|
|
func profileDryRunFactory(t *testing.T) *cmdutil.Factory {
|
|
t.Helper()
|
|
return &cmdutil.Factory{
|
|
Client: func() (*sdk.Client, error) {
|
|
t.Fatal("dry-run path must not call Factory.Client(); SDK side effect leaked")
|
|
return nil, nil
|
|
},
|
|
Prompter: func() prompt.Prompter {
|
|
t.Fatal("dry-run path must not call Factory.Prompter(); confirm-prompt side effect leaked")
|
|
return nil
|
|
},
|
|
Secrets: func() (secrets.Store, error) { return secrets.NewMemStore(), nil },
|
|
}
|
|
}
|
|
|
|
// withRootHarnessProfile wraps a profile subcommand under a synthetic root
|
|
// cmd that registers the global persistent flags.
|
|
func withRootHarnessProfile(sub *cobra.Command, args ...string) *cobra.Command {
|
|
root := &cobra.Command{Use: "weknora"}
|
|
pf := root.PersistentFlags()
|
|
pf.BoolP("yes", "y", false, "")
|
|
pf.String("format", "", "")
|
|
pf.StringP("jq", "q", "", "")
|
|
root.AddCommand(sub)
|
|
root.SetArgs(append([]string{sub.Name()}, args...))
|
|
root.SetContext(context.Background())
|
|
root.SilenceErrors = true
|
|
root.SilenceUsage = true
|
|
return root
|
|
}
|
|
|
|
// TestProfileAdd_DryRun_RejectsDuplicate: profile already exists → live path
|
|
// returns resource.already_exists; --dry-run must do the same.
|
|
func TestProfileAdd_DryRun_RejectsDuplicate(t *testing.T) {
|
|
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
|
|
iostreams.SetForTest(t)
|
|
require.NoError(t, config.Save(&config.Config{
|
|
CurrentProfile: "prod",
|
|
Profiles: map[string]config.Profile{"prod": {Host: "https://prod"}},
|
|
}))
|
|
|
|
root := withRootHarnessProfile(NewCmdAdd(profileDryRunFactory(t)),
|
|
"prod", "--host", "https://other.example.com", "--dry-run", "--format", "json")
|
|
err := root.Execute()
|
|
require.Error(t, err, "dry-run must reject duplicate profile name")
|
|
var typed *cmdutil.Error
|
|
require.True(t, errors.As(err, &typed), "expected *cmdutil.Error, got %T %v", err, err)
|
|
assert.Equal(t, cmdutil.CodeResourceAlreadyExists, typed.Code)
|
|
}
|
|
|
|
// TestProfileAdd_DryRun_RejectsInvalidName: shell-unsafe profile name → live
|
|
// path returns input.invalid_argument; --dry-run must do the same.
|
|
func TestProfileAdd_DryRun_RejectsInvalidName(t *testing.T) {
|
|
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
|
|
iostreams.SetForTest(t)
|
|
|
|
root := withRootHarnessProfile(NewCmdAdd(profileDryRunFactory(t)),
|
|
"bad name", "--host", "https://x.example.com", "--dry-run", "--format", "json")
|
|
err := root.Execute()
|
|
require.Error(t, err, "dry-run must reject invalid profile name")
|
|
}
|
|
|
|
// TestProfileRemove_DryRun_RejectsUnknownName: removing a nonexistent profile
|
|
// returns local.profile_not_found on the live path; --dry-run must too.
|
|
func TestProfileRemove_DryRun_RejectsUnknownName(t *testing.T) {
|
|
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
|
|
iostreams.SetForTest(t)
|
|
require.NoError(t, config.Save(&config.Config{
|
|
Profiles: map[string]config.Profile{"prod": {Host: "https://prod"}},
|
|
}))
|
|
|
|
root := withRootHarnessProfile(NewCmdRemove(profileDryRunFactory(t)),
|
|
"ghost", "--dry-run", "--format", "json")
|
|
err := root.Execute()
|
|
require.Error(t, err, "dry-run must reject unknown profile name")
|
|
var typed *cmdutil.Error
|
|
require.True(t, errors.As(err, &typed), "expected *cmdutil.Error, got %T %v", err, err)
|
|
assert.Equal(t, cmdutil.CodeLocalProfileNotFound, typed.Code)
|
|
}
|