feat: generate image metadata and expose public search API

tests/searchApi.test.js

@@ -0,0 +1,132 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import fs from 'node:fs/promises';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createStore } from '../src/store.js';
+import { encodePng } from '../src/png.js';
+import { normalizeToWebp } from '../src/normalize.js';
+
+const projectRoot = fileURLToPath(new URL('../', import.meta.url));
+const adminToken = 'test-admin-token-000000000000';
+
+test('public search/read and admin-only metadata mutations work end to end', { timeout: 20_000 }, async (t) => {
+  const probe = net.createServer();
+  try {
+    await new Promise((resolve, reject) => { probe.once('error', reject); probe.listen(0, '127.0.0.1', resolve); });
+  } catch (error) {
+    if (error.code === 'EPERM') { t.skip('loopback listeners are disabled in this sandbox'); return; }
+    throw error;
+  }
+  const port = probe.address().port;
+  await new Promise((resolve) => probe.close(resolve));
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'meme-search-api-'));
+  const store = await createStore({ dataDir: dir });
+  await store.addTag('cats');
+  await store.addTag('work');
+  const png = encodePng(16, 16, () => [0, 220, 40, 255]);
+  const normalized = await normalizeToWebp(png);
+  const approved = await store.save({ ...normalized, originalName: 'cat.png', caption: 'An angry cat at work', tags: ['cats', 'work'] });
+  const pendingImage = await normalizeToWebp(encodePng(16, 16, () => [10, 150, 40, 255]));
+  const pending = await store.save({ ...pendingImage, originalName: 'pending.png', caption: 'A pending cat', tags: ['cats'], status: 'pending' });
+  const mockPath = path.join(dir, 'mock-ai.mjs');
+  await fs.writeFile(mockPath, `globalThis.fetch = async () => ({ ok: true, json: async () => ({ status: 'completed', output_text: JSON.stringify({ decision: 'approved', score: 99, reason: 'A good meme', caption: 'AI caption: a sleeping cat at work', tags: ['cats', 'invented'] }) }) });`);
+  const child = spawn(process.execPath, ['--import', mockPath, 'server.js'], {
+    cwd: projectRoot,
+    env: { ...process.env, ADMIN_TOKEN: adminToken, OPENAI_API_KEY: 'test-key', AUTO_APPROVE_MIN_SCORE: '80', DATA_DIR: dir,
+      HOST: '127.0.0.1', PORT: String(port), SEED_DEMO_MEMES: 'false', SITE_URL: `http://127.0.0.1:${port}` },
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+  t.after(async () => {
+    if (child.exitCode === null && child.signalCode === null) { child.kill(); await once(child, 'exit'); }
+    await fs.rm(dir, { recursive: true, force: true });
+  });
+  await new Promise((resolve, reject) => {
+    let output = '';
+    const timeout = setTimeout(() => finish(new Error(`Server startup timed out: ${output}`)), 10_000);
+    const onData = (chunk) => { output += chunk; if (output.includes('The Meme Protocol listening')) finish(); };
+    const onExit = () => finish(new Error(`Server failed to start: ${output}`));
+    const finish = (error) => {
+      clearTimeout(timeout); child.stdout.off('data', onData); child.stderr.off('data', onData); child.off('exit', onExit);
+      error ? reject(error) : resolve();
+    };
+    child.stdout.on('data', onData); child.stderr.on('data', onData); child.once('exit', onExit);
+  });
+  const base = `http://127.0.0.1:${port}`;
+  const request = (url, method = 'GET', body, authenticated = false) => fetch(`${base}${url}`, {
+    method, headers: { ...(authenticated ? { 'X-Admin-Token': adminToken } : {}), ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
+    ...(body !== undefined ? { body: typeof body === 'string' ? body : JSON.stringify(body) } : {})
+  });
+  const publicList = await (await request('/api/memes?q=ANGRY%20catt&tag=cats&tag=work')).json();
+  assert.equal(publicList.total, 1);
+  assert.equal(publicList.memes[0].id, approved.id);
+  assert.equal(publicList.memes[0].caption, 'An angry cat at work');
+  assert.deepEqual(publicList.memes[0].tags, ['cats', 'work']);
+  assert.equal('storageKey' in publicList.memes[0], false);
+  assert.equal('metadataVersion' in publicList.memes[0], false);
+  assert.deepEqual((await (await request('/api/tags')).json()).tags, ['cats', 'work']);
+  assert.equal((await request(`/api/memes/${pending.id}`)).status, 404);
+  assert.equal((await request('/api/memes?q=' + 'a'.repeat(201))).status, 400);
+  assert.equal((await request('/api/memes?tag=%3Cscript%3E')).status, 400);
+  assert.equal((await request('/api/memes?' + Array(21).fill('tag=cats').join('&'))).status, 400);
+
+  for (const [url, method, body] of [
+    ['/api/admin/memes', 'GET'], ['/api/admin/tags', 'GET'], ['/api/admin/pending', 'GET'],
+    ['/api/admin/tags', 'POST', { name: 'dogs' }], ['/api/admin/tags/cats', 'DELETE'],
+    [`/api/admin/memes/${approved.id}`, 'PATCH', { caption: 'Malicious overwrite', tags: [] }],
+    [`/api/admin/memes/${approved.id}/generate`, 'POST'],
+    ['/api/admin/approve', 'POST', { ids: [pending.id] }], ['/api/admin/delete', 'POST', { ids: [approved.id] }]
+  ]) assert.equal((await request(url, method, body)).status, 404, `${method} ${url} must require admin auth`);
+  assert.equal((await request(`/api/memes/${approved.id}`, 'PATCH', { caption: 'Public write' })).status, 404);
+  assert.equal((await request('/api/tags', 'POST', { name: 'public-tag' })).status, 404);
+  const all = await request('/api/admin/memes?status=all', 'GET', undefined, true);
+  assert.equal(all.headers.get('cache-control'), 'no-store');
+  assert.equal((await all.json()).total, 2);
+  assert.equal((await request('/api/admin/memes?status=bad', 'GET', undefined, true)).status, 400);
+  assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', '{bad json', true)).status, 400);
+  assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', null, true)).status, 400);
+  assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', { tags: ['invented'] }, true)).status, 400);
+  assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', { status: 'pending' }, true)).status, 400);
+  assert.equal((await request('/api/admin/tags', 'POST', { name: ' Dogs ' }, true)).status, 201);
+  assert.equal((await request('/api/admin/tags', 'POST', { name: 'dogs' }, true)).status, 409);
+  const edited = await request(`/api/admin/memes/${approved.id}`, 'PATCH', { caption: 'Admin caption', tags: ['dogs'] }, true);
+  assert.equal(edited.status, 200);
+  const metadata = await (await request(`/api/memes/${approved.id}`)).json();
+  assert.equal(metadata.meme.caption, 'Admin caption');
+  assert.deepEqual(metadata.meme.tags, ['dogs']);
+
+  const skipped = await (await request(`/api/admin/memes/${approved.id}/generate`, 'POST', { onlyMissing: true }, true)).json();
+  assert.equal(skipped.skipped, true);
+  assert.equal(skipped.meme.caption, 'Admin caption');
+  const generated = await (await request(`/api/admin/memes/${pending.id}/generate`, 'POST', {}, true)).json();
+  assert.equal(generated.meme.caption, 'AI caption: a sleeping cat at work');
+  assert.deepEqual(generated.meme.tags, ['cats']);
+  assert.equal(generated.meme.status, 'pending');
+  assert.equal((await request(`/api/memes/${pending.id}`)).status, 404);
+
+  const form = new FormData();
+  form.append('meme', new Blob([encodePng(16, 16, () => [200, 40, 90, 255])], { type: 'image/png' }), 'upload.png');
+  form.append('caption', 'Client injected caption');
+  form.append('tags', 'invented');
+  const upload = await fetch(`${base}/api/memes`, { method: 'POST', body: form });
+  assert.equal(upload.status, 201);
+  const uploaded = (await upload.json()).meme;
+  assert.equal(uploaded.caption, 'AI caption: a sleeping cat at work');
+  assert.deepEqual(uploaded.tags, ['cats']);
+  const view = await (await request(`/api/memes/${uploaded.id}/view`, 'POST')).json();
+  assert.equal(view.meme.caption, uploaded.caption);
+  const deletedTag = await request('/api/admin/tags/cats', 'DELETE', undefined, true);
+  assert.equal(deletedTag.status, 200);
+  assert.deepEqual((await (await request(`/api/memes/${uploaded.id}`)).json()).meme.tags, []);
+  const spec = await (await request('/openapi.json')).json();
+  assert.ok(spec.paths['/api/tags']);
+  assert.ok(spec.components.schemas.Meme.properties.caption);
+  assert.ok(!Object.keys(spec.paths).some((url) => url.startsWith('/api/admin')));
+  const reloaded = await createStore({ dataDir: dir });
+  assert.equal(reloaded.get(approved.id).caption, 'Admin caption');
+  assert.deepEqual(reloaded.get(pending.id).tags, []);
+});