docs: rank the destructive generator as item 0

It was written up in 4.7 but never made the work order, which is exactly how it stayed dangerous in the first place. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-09 11:18:45 +05:30
parent 790b81330a
commit 247f360ae7
79 changed files with 2759 additions and 146 deletions
@@ -0,0 +1,80 @@
+import { afterEach, expect, test } from "bun:test";
+import { implement } from "../../../../../packages/rpc/src/index.ts";
+import { handleRpcRequest } from "../../../../../packages/dev-server/src/rpc-dispatch.ts";
+import { catalogService } from "../../../packages/shared/src/index.ts";
+import { GET } from "../app/api/product.ts";
+
+const secret = process.env.WRNEXUS_RPC_SECRET;
+const app = process.env.WRNEXUS_APP_NAME;
+const origins = process.env.WRNEXUS_INTERNAL_ORIGINS;
+afterEach(() => {
+  if (secret === undefined) delete process.env.WRNEXUS_RPC_SECRET;
+  else process.env.WRNEXUS_RPC_SECRET = secret;
+  if (app === undefined) delete process.env.WRNEXUS_APP_NAME;
+  else process.env.WRNEXUS_APP_NAME = app;
+  if (origins === undefined) delete process.env.WRNEXUS_INTERNAL_ORIGINS;
+  else process.env.WRNEXUS_INTERNAL_ORIGINS = origins;
+});
+
+function startAdmin(allowed: boolean) {
+  const service = implement(
+    catalogService,
+    { getProduct: ({ sku }) => ({ sku, name: "WRNexus Starter", priceCents: 4900 }) },
+    {
+      selfApp: "admin",
+      checkPermission: (permission, subject) =>
+        allowed && permission === "catalog:read" && subject?.subjectId === "demo-user",
+    },
+  );
+  return Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    async fetch(request) {
+      return (
+        (await handleRpcRequest(request, new URL(request.url), new Map([["catalog", service]]))) ??
+        new Response("Not found", { status: 404 })
+      );
+    },
+  });
+}
+
+test("web calls admin through private RPC when permitted", async () => {
+  process.env.WRNEXUS_RPC_SECRET = "test-rpc-secret-at-least-32-chars-long";
+  process.env.WRNEXUS_APP_NAME = "web";
+  const server = startAdmin(true);
+  process.env.WRNEXUS_INTERNAL_ORIGINS = JSON.stringify({
+    admin: `http://127.0.0.1:${server.port}`,
+  });
+  try {
+    const response = await GET({
+      req: new Request("http://web.test/api/product?sku=starter"),
+      user: { id: "demo-user" },
+      locals: {},
+    } as never);
+    expect(await response.json()).toEqual({
+      product: { sku: "starter", name: "WRNexus Starter", priceCents: 4900 },
+    });
+  } finally {
+    server.stop(true);
+  }
+});
+
+test("web returns 403 when admin denies catalog:read", async () => {
+  process.env.WRNEXUS_RPC_SECRET = "test-rpc-secret-at-least-32-chars-long";
+  process.env.WRNEXUS_APP_NAME = "web";
+  const server = startAdmin(false);
+  process.env.WRNEXUS_INTERNAL_ORIGINS = JSON.stringify({
+    admin: `http://127.0.0.1:${server.port}`,
+  });
+  try {
+    const response = await GET({
+      req: new Request("http://web.test/api/product"),
+      user: { id: "not-allowed" },
+      locals: {},
+    } as never);
+    expect(response.status).toBe(403);
+    expect(await response.json()).toEqual({ error: "Forbidden" });
+  } finally {
+    server.stop(true);
+  }
+});
@@ -0,0 +1,15 @@
+import { expect, test } from "bun:test";
+import { parseOrThrow } from "@wrnexus/validation";
+import { contactSchema } from "../app/schemas/contact.ts";
+
+test("starter validation schema accepts a contact request", () => {
+  expect(
+    parseOrThrow(contactSchema, {
+      email: "hello@example.com",
+      message: "Hello from the generated application.",
+    }),
+  ).toEqual({
+    email: "hello@example.com",
+    message: "Hello from the generated application.",
+  });
+});