feat: enhance host API authentication handling and add regression tests

tests/app-router-host-api-auth-regression.test.tsx

@@ -0,0 +1,118 @@
+import React from 'react';
+import { render, screen, waitFor } from '@testing-library/react';
+import { HashRouter } from 'react-router-dom';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { setLocale } from '../src/i18n';
+
+const mocks = vi.hoisted(() => ({
+  invoke: vi.fn(),
+}));
+
+vi.mock('../src/pages/Login', async () => {
+  const ReactModule = await import('react');
+  return {
+    default: function LoginPageMock() {
+      return ReactModule.createElement('div', null, 'login-page');
+    },
+  };
+});
+
+vi.mock('../src/pages/Setting', async () => {
+  const ReactModule = await import('react');
+
+  return {
+    default: function SettingPageMock() {
+      ReactModule.useEffect(() => {
+        void import('../src/lib/host-api').then(({ hostApiFetch }) => {
+          void hostApiFetch('/api/gateway/status').catch(() => {});
+        });
+      }, []);
+
+      return ReactModule.createElement('div', null, 'protected-setting-page');
+    },
+  };
+});
+
+import { AppRouter } from '../src/router';
+
+describe('AppRouter host api auth regression', () => {
+  function renderProtectedRoute() {
+    render(
+      <HashRouter>
+        <AppRouter />
+      </HashRouter>,
+    );
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setLocale('en');
+    window.sessionStorage.clear();
+    window.localStorage.clear();
+    document.cookie = 'token=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/';
+    window.location.hash = '#/setting';
+    window.sessionStorage.setItem('token', JSON.stringify('access-token'));
+
+    (window as typeof window & { api?: unknown }).api = {
+      invoke: mocks.invoke,
+      platform: 'darwin',
+    };
+
+    mocks.invoke.mockImplementation(async (channel: string) => {
+      if (channel === 'hostapi:fetch') {
+        return {
+          success: false,
+          ok: false,
+          status: 401,
+          code: 'HOST_API_UNAUTHORIZED',
+          error: 'Host API authentication failed',
+        };
+      }
+
+      throw new Error(`Unexpected IPC channel: ${channel}`);
+    });
+  });
+
+  it('keeps the user on a protected route when local host api auth fails', async () => {
+    renderProtectedRoute();
+
+    expect(await screen.findByText('protected-setting-page')).toBeTruthy();
+
+    await waitFor(() => {
+      expect(mocks.invoke).toHaveBeenCalledWith('hostapi:fetch', expect.objectContaining({
+        path: '/api/gateway/status',
+      }));
+    });
+
+    await waitFor(() => {
+      expect(screen.queryByText('login-page')).toBeNull();
+      expect(screen.getByText('protected-setting-page')).toBeTruthy();
+      expect(window.sessionStorage.getItem('token')).toBe(JSON.stringify('access-token'));
+    });
+  });
+
+  it('keeps the user on a protected route when upstream api returns unauthorized', async () => {
+    mocks.invoke.mockResolvedValueOnce({
+      success: false,
+      ok: false,
+      status: 401,
+      error: 'Unauthorized',
+    });
+
+    renderProtectedRoute();
+
+    expect(await screen.findByText('protected-setting-page')).toBeTruthy();
+
+    await waitFor(() => {
+      expect(mocks.invoke).toHaveBeenCalledWith('hostapi:fetch', expect.objectContaining({
+        path: '/api/gateway/status',
+      }));
+    });
+
+    await waitFor(() => {
+      expect(screen.queryByText('login-page')).toBeNull();
+      expect(screen.getByText('protected-setting-page')).toBeTruthy();
+      expect(window.sessionStorage.getItem('token')).toBe(JSON.stringify('access-token'));
+    });
+  });
+});

tests/gateway-rpc-dispatch.test.ts

@@ -0,0 +1,149 @@
+// @vitest-environment node
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  handleChatSend: vi.fn(),
+  handleChatHistory: vi.fn(),
+  handleChatAbort: vi.fn(),
+  handleSessionList: vi.fn(),
+  handleSessionDelete: vi.fn(),
+  handleProviderList: vi.fn(),
+  handleProviderGetDefault: vi.fn(),
+  handleSkillsStatus: vi.fn(),
+  handleSkillsUpdate: vi.fn(),
+}));
+
+vi.mock('../electron/gateway/handlers/chat', () => ({
+  handleChatSend: mocks.handleChatSend,
+  handleChatHistory: mocks.handleChatHistory,
+  handleChatAbort: mocks.handleChatAbort,
+  handleSessionList: mocks.handleSessionList,
+  handleSessionDelete: mocks.handleSessionDelete,
+}));
+
+vi.mock('../electron/gateway/handlers/provider', () => ({
+  handleProviderList: mocks.handleProviderList,
+  handleProviderGetDefault: mocks.handleProviderGetDefault,
+}));
+
+vi.mock('../electron/gateway/handlers/skills', () => ({
+  handleSkillsStatus: mocks.handleSkillsStatus,
+  handleSkillsUpdate: mocks.handleSkillsUpdate,
+}));
+
+describe('dispatchGatewayRpcMethod', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('routes chat history to the local chat handler', async () => {
+    const messages = [{ role: 'user', content: 'hello' }];
+    mocks.handleChatHistory.mockReturnValue(messages);
+
+    const { dispatchGatewayRpcMethod } = await import('../electron/gateway/rpc-dispatch');
+
+    const result = dispatchGatewayRpcMethod(
+      'chat.history',
+      { sessionKey: 'agent:test:main', limit: 20 },
+      vi.fn(),
+    );
+
+    expect(result).toEqual({ handled: true, result: messages });
+    expect(mocks.handleChatHistory).toHaveBeenCalledWith({
+      sessionKey: 'agent:test:main',
+      limit: 20,
+    });
+  });
+
+  it('routes chat send locally and forwards the broadcast callback', async () => {
+    mocks.handleChatSend.mockReturnValue({ runId: 'run-1' });
+
+    const { dispatchGatewayRpcMethod } = await import('../electron/gateway/rpc-dispatch');
+    const broadcast = vi.fn();
+
+    const result = dispatchGatewayRpcMethod(
+      'chat.send',
+      {
+        sessionKey: 'agent:test:main',
+        message: { role: 'user', content: 'hello' },
+      },
+      broadcast,
+    );
+
+    expect(result).toEqual({ handled: true, result: { runId: 'run-1' } });
+    expect(mocks.handleChatSend).toHaveBeenCalledTimes(1);
+    expect(mocks.handleChatSend.mock.calls[0]?.[1]).toBe(broadcast);
+  });
+
+  it('prevents deleting the main session', async () => {
+    const { dispatchGatewayRpcMethod } = await import('../electron/gateway/rpc-dispatch');
+
+    const result = dispatchGatewayRpcMethod(
+      'session.delete',
+      { sessionKey: 'agent:test:main' },
+      vi.fn(),
+    );
+
+    expect(result).toEqual({ handled: true, result: { success: false } });
+    expect(mocks.handleSessionDelete).not.toHaveBeenCalled();
+  });
+
+  it('routes non-main session deletion and session listing locally', async () => {
+    mocks.handleSessionDelete.mockReturnValue({ success: true });
+    mocks.handleSessionList.mockReturnValue(['agent:test:main', 'agent:test:secondary']);
+
+    const { dispatchGatewayRpcMethod } = await import('../electron/gateway/rpc-dispatch');
+
+    expect(
+      dispatchGatewayRpcMethod('session.list', {}, vi.fn()),
+    ).toEqual({
+      handled: true,
+      result: ['agent:test:main', 'agent:test:secondary'],
+    });
+    expect(
+      dispatchGatewayRpcMethod(
+        'session.delete',
+        { sessionKey: 'agent:test:secondary' },
+        vi.fn(),
+      ),
+    ).toEqual({
+      handled: true,
+      result: { success: true },
+    });
+    expect(mocks.handleSessionDelete).toHaveBeenCalledWith({
+      sessionKey: 'agent:test:secondary',
+    });
+  });
+
+  it('routes provider and skills methods locally and leaves unknown methods unhandled', async () => {
+    mocks.handleProviderGetDefault.mockReturnValue({ accountId: 'provider-1' });
+    mocks.handleSkillsStatus.mockReturnValue({ skills: [] });
+    mocks.handleSkillsUpdate.mockReturnValue({ success: true });
+
+    const { dispatchGatewayRpcMethod } = await import('../electron/gateway/rpc-dispatch');
+
+    expect(
+      dispatchGatewayRpcMethod('provider.getDefault', {}, vi.fn()),
+    ).toEqual({
+      handled: true,
+      result: { accountId: 'provider-1' },
+    });
+    expect(
+      dispatchGatewayRpcMethod('skills.status', {}, vi.fn()),
+    ).toEqual({
+      handled: true,
+      result: { skills: [] },
+    });
+    expect(
+      dispatchGatewayRpcMethod('skills.update', { skillKey: 'demo' }, vi.fn()),
+    ).toEqual({
+      handled: true,
+      result: { success: true },
+    });
+    expect(
+      dispatchGatewayRpcMethod('gateway.ping', {}, vi.fn()),
+    ).toEqual({
+      handled: false,
+    });
+  });
+});

tests/host-api-auth.test.ts

@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  logout: vi.fn(),
+  readPersistedAuthToken: vi.fn(),
+  invoke: vi.fn(),
+}));
+
+vi.mock('../src/router/auth-session', () => ({
+  logout: mocks.logout,
+  readPersistedAuthToken: mocks.readPersistedAuthToken,
+}));
+
+const HOST_API_UNAUTHORIZED_CODE = 'HOST_API_UNAUTHORIZED';
+
+describe('hostApiFetch auth handling', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    mocks.logout.mockReset();
+    mocks.readPersistedAuthToken.mockReset();
+    mocks.invoke.mockReset();
+    mocks.readPersistedAuthToken.mockReturnValue('access-token');
+    (window as typeof window & { api?: unknown }).api = {
+      invoke: mocks.invoke,
+    };
+  });
+
+  afterEach(() => {
+    delete (window as typeof window & { api?: unknown }).api;
+  });
+
+  it('does not log out when local Host API authentication fails', async () => {
+    mocks.invoke.mockResolvedValue({
+      success: false,
+      ok: false,
+      status: 401,
+      code: HOST_API_UNAUTHORIZED_CODE,
+      error: 'Host API authentication failed',
+    });
+
+    const { hostApiFetch } = await import('../src/lib/host-api');
+
+    await expect(hostApiFetch('/api/gateway/status')).rejects.toThrow('Host API authentication failed');
+    expect(mocks.logout).not.toHaveBeenCalled();
+  });
+
+  it('keeps auth state when upstream business API returns unauthorized', async () => {
+    mocks.invoke.mockResolvedValue({
+      success: false,
+      ok: false,
+      status: 401,
+      error: 'Unauthorized',
+    });
+
+    const { hostApiFetch } = await import('../src/lib/host-api');
+
+    await expect(hostApiFetch('/api/providers')).rejects.toThrow('Unauthorized');
+    expect(mocks.logout).not.toHaveBeenCalled();
+  });
+});