CI & Build / Python lint (push) Successful in 3s
CI & Build / TypeScript typecheck (push) Successful in 8s
CI & Build / Python tests (push) Successful in 14s
Desktop (Tauri) / Tauri desktop (Linux) (push) Failing after 42s
CI & Build / Build & push image (push) Successful in 36s
Desktop (Tauri) / Windows installer (cross-compiled) (push) Successful in 1m34s
Version the sync WIRE PROTOCOL separately from either program's release
version, so a self-hosted server and the desktop app can sit on different
releases and still work out whether they can talk.
Each side declares two numbers — what it speaks, and the oldest counterpart
it accepts. Either side can therefore mark a change breaking without the
other shipping in step, which is the whole point: no app↔server lockstep.
Server advertises on the existing public /api/config (a client must be able
to ask "can I talk to you?" before it holds a device token, or even has an
account): sync_protocol_version, min_client_protocol_version, sync_features.
sync_features exists because a version number can only say newer/older. An
ADDITIVE change earns a capability name instead of a minimum bump, so a
newer client meeting an older server drops that one feature and syncs the
rest, rather than refusing. Raising a minimum is reserved for genuinely
breaking changes — it's the switch that hard-blocks the other side.
Client half is pure decision logic (sync/compat.rs), no I/O, so every branch
is unit-testable — there's no live-server lane in CI. Three outcomes: ok /
degraded{unavailable} / incompatible{reason, client_must_update}. The last
names which side can fix it, so the message is actionable. A server that
predates the handshake sends no protocol fields at all; that reads as
"update the server", deliberately not as a parse error, which would look to
the user like they mistyped the URL.
normalize_base_url defaults a bare host to https://, never http:// —
silently downgrading would put a long-lived device token on the wire in
cleartext because someone omitted five characters. Plain HTTP on a trusted
LAN stays supported; the user types http:// and thereby chooses it.
Transport (the actual fetch) lands next, separately: it needs an HTTP/TLS
stack, and that's a real risk to the Windows cross-compile lane, so it gets
its own CI run to bisect against rather than riding along with this.
No UI here by design — the link/settings surface it feeds is M10.7's, per
this task's own sequencing.
Policy documented in docs/sync.md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi
114 lines
3.7 KiB
Python
114 lines
3.7 KiB
Python
from datetime import datetime, timezone
|
|
|
|
import pytest
|
|
|
|
from thoughtsync.app import create_app
|
|
from thoughtsync.sync import (
|
|
DEFAULT_LIMIT,
|
|
MAX_LIMIT,
|
|
MIN_CLIENT_PROTOCOL_VERSION,
|
|
SYNC_FEATURES,
|
|
SYNC_PROTOCOL_VERSION,
|
|
_clamp_limit,
|
|
_page_cursor,
|
|
_parse_since,
|
|
client_wins,
|
|
protocol_advertisement,
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def app():
|
|
return create_app()
|
|
|
|
|
|
async def test_changes_requires_auth(app):
|
|
client = app.test_client()
|
|
resp = await client.get("/api/sync/changes")
|
|
assert resp.status_code == 401
|
|
|
|
|
|
async def test_push_requires_auth(app):
|
|
client = app.test_client()
|
|
resp = await client.post("/api/sync/push", json={"changes": []})
|
|
assert resp.status_code == 401
|
|
|
|
|
|
def test_client_wins():
|
|
older = datetime(2026, 7, 20, tzinfo=timezone.utc)
|
|
newer = datetime(2026, 7, 22, tzinfo=timezone.utc)
|
|
assert client_wins(newer, older) is True # newer client edit wins
|
|
assert client_wins(older, newer) is False # older client edit loses (server kept)
|
|
assert client_wins(older, older) is True # tie → client applies (idempotent)
|
|
assert client_wins(None, older) is False # unknown client time can't overwrite a real edit
|
|
assert client_wins(older, None) is True # new/unknown server side yields
|
|
assert client_wins(None, None) is True
|
|
|
|
|
|
def test_parse_since():
|
|
assert _parse_since(None) == 0
|
|
assert _parse_since("42") == 42
|
|
assert _parse_since("-5") == 0 # negative clamps to 0
|
|
assert _parse_since("garbage") == 0
|
|
|
|
|
|
def test_clamp_limit():
|
|
assert _clamp_limit(None) == DEFAULT_LIMIT
|
|
assert _clamp_limit("10") == 10
|
|
assert _clamp_limit("0") == 1 # floor of 1
|
|
assert _clamp_limit("999999") == MAX_LIMIT
|
|
assert _clamp_limit("nope") == DEFAULT_LIMIT
|
|
|
|
|
|
def test_page_cursor_all_drained():
|
|
# Neither stream is full → cursor is the max revision seen; nothing more to page.
|
|
cursor, more = _page_cursor([1, 3, 5], [2, 4], since=0, limit=500)
|
|
assert cursor == 5
|
|
assert more is False
|
|
|
|
|
|
def test_page_cursor_empty():
|
|
# No changes since the cursor → cursor stays put, no more pages.
|
|
cursor, more = _page_cursor([], [], since=7, limit=500)
|
|
assert cursor == 7
|
|
assert more is False
|
|
|
|
|
|
def test_page_cursor_one_stream_full_advances_to_its_boundary():
|
|
# Notes came back full (limit=3) → truncate at its boundary; later labels defer.
|
|
cursor, more = _page_cursor([1, 2, 3], [4, 5], since=0, limit=3)
|
|
assert cursor == 3
|
|
assert more is True
|
|
|
|
|
|
def test_page_cursor_both_full_uses_min_boundary():
|
|
# Both full → advance only to the SMALLER boundary so neither stream skips a gap.
|
|
cursor, more = _page_cursor([1, 2, 10], [3, 4, 5], since=0, limit=3)
|
|
assert cursor == 5
|
|
assert more is True
|
|
|
|
|
|
# --- protocol handshake (M10.6) ---------------------------------------------
|
|
|
|
|
|
def test_protocol_advertisement_shape():
|
|
ad = protocol_advertisement()
|
|
assert ad["sync_protocol_version"] == SYNC_PROTOCOL_VERSION
|
|
assert ad["min_client_protocol_version"] == MIN_CLIENT_PROTOCOL_VERSION
|
|
# A list, not a tuple — it has to survive jsonify as a JSON array.
|
|
assert isinstance(ad["sync_features"], list)
|
|
assert ad["sync_features"] == list(SYNC_FEATURES)
|
|
|
|
|
|
def test_protocol_floor_never_exceeds_current():
|
|
# A server can't demand a client protocol newer than the one it speaks itself —
|
|
# that would lock out every client, including a perfectly current one.
|
|
assert MIN_CLIENT_PROTOCOL_VERSION <= SYNC_PROTOCOL_VERSION
|
|
|
|
|
|
def test_protocol_features_are_unique_nonempty_names():
|
|
# Clients match capabilities by exact name, so duplicates or blanks would make
|
|
# a feature check silently meaningless.
|
|
assert all(f and f.strip() == f for f in SYNC_FEATURES)
|
|
assert len(set(SYNC_FEATURES)) == len(SYNC_FEATURES)
|