feat(session,web): 会话角色不可变 — PATCH 拒 personaId + 移除前端换角色入口
design/22 §8-1（主人 2026-10-03 拍板）：会话角色在创建时确定、之后不可变，
要换角色必须新开会话。
后端：
- PATCH /api/v1/sessions/{id} 的 personaId 改为 json.RawMessage 判「键出现」，
出现即 400（null/""/未知 id 一律拒），且先于会话存在性检查；错误消息点名 personaId
- 删除 Server.setSessionPersona 与 PATCH 的 501 分支；title/pinned 行为逐字不变
- sessionPersonaWriter 接口与 history.Store.SetSessionPersona 保留（存储能力）
前端：
- 移除会话行「切换角色」入口与面板「挂角色」下拉（含 setSessionPersona action、
lib/sessionPersona.ts）；保留「新建会话选角色」；面板「角色」列改为只读展示
契约：Docs/api-client.md -> v0.46（破坏性：依赖 PATCH 换角色的客户端须改为新建会话）
验证：go build/vet ./... 绿；gateway+history 包测试绿（-count=1）；前端 npm run build
（tsc --noEmit + vite build）绿；9 个前端逻辑测试全绿。
变异验证：改回「静默忽略」/「写绑定」两种反向实现，新断言均 FAIL。
This commit is contained in:
AskaEth committed
1 parent
f9430dee81
commit
c7ecc3a249
10 files changed
+193
-448
No files matched your search
@@ -4,6 +4,7 @@ import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
|
||||
@@ -91,8 +92,10 @@ func gatewayAgentFor(t *testing.T, instructions string, ad model.Adapter) *agent
|
||||
|
||||
// TestChatTurnAnswersAsTheBoundRole is design/22 acceptance 3 seen from the process
|
||||
// boundary: a sub session created and bound to role Y answers as Y (the first system
|
||||
// message is Y's prompt and the persisted messages carry Y), and once the session is
|
||||
// rebound to "inherit the default" the next turn answers as the default role again.
|
||||
// message is Y's prompt and the persisted messages carry Y). Its role is fixed at
|
||||
// creation (§8-1), so the PATCH that used to unbind it is refused and the session
|
||||
// keeps answering as Y; the only way to get the default role is a session created
|
||||
// without a binding.
|
||||
func TestChatTurnAnswersAsTheBoundRole(t *testing.T) {
|
||||
t.Parallel()
|
||||
ctx := context.Background()
|
||||
@@ -140,16 +143,30 @@ func TestChatTurnAnswersAsTheBoundRole(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// Unbind the role: the session inherits the global default, so the next turn is
|
||||
// the default role's again.
|
||||
// Unbinding is refused (design/22 §8-1): a session's role is decided when it is
|
||||
// created, so this PATCH answers 400 and the very next turn still answers as Y.
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+sub, map[string]any{"personaId": ""}, tok)
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("unbind status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
||||
if resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("unbind status = %d, want 400 (a session's role is immutable; body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
resp, body = doReq(t, http.MethodPost, ts.URL+"/api/v1/chat", map[string]any{"sessionId": sub, "text": "再说一句"}, tok)
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("second chat status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
if got := firstSystemText(ad.reqs[len(ad.reqs)-1]); got != "你是由纪。" {
|
||||
t.Fatalf("prompt after the refused unbind = %q, want role Y's prompt", got)
|
||||
}
|
||||
|
||||
// The default role is reached by a session created WITHOUT a binding — the only
|
||||
// way to change role now.
|
||||
unbound, err := st.NewSubSession(ctx, "owner")
|
||||
if err != nil {
|
||||
t.Fatalf("NewSubSession: %v", err)
|
||||
}
|
||||
resp, body = doReq(t, http.MethodPost, ts.URL+"/api/v1/chat", map[string]any{"sessionId": unbound, "text": "你好"}, tok)
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("default-role chat status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
if got := firstSystemText(ad.reqs[len(ad.reqs)-1]); got != "你是昔涟。" {
|
||||
t.Fatalf("unbound session prompt = %q, want the default role's prompt", got)
|
||||
}
|
||||
@@ -170,10 +187,12 @@ func firstSystemText(req model.Request) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
// TestSessionPersonaHTTPContract covers the REST contract of design/22 §4.5: create
|
||||
// with a personaId binds it, the session list reports it, PATCH rebinds and clears
|
||||
// it, an unknown personaId is rejected (400) instead of binding a role that cannot
|
||||
// answer, and a PATCH with none of title/pinned/personaId is still a 400.
|
||||
// TestSessionPersonaHTTPContract covers the REST contract of design/22 §4.5 as
|
||||
// amended by §8-1: create with a personaId binds it, the session list reports it, an
|
||||
// unknown personaId on create is rejected (400) instead of binding a role that cannot
|
||||
// answer, a PATCH with neither title nor pinned is a 400, and PATCH REFUSES the
|
||||
// personaId key for every value — a session's role is fixed at creation, so there is
|
||||
// no supported rebind and the refusal can never be mistaken for a silent no-op.
|
||||
func TestSessionPersonaHTTPContract(t *testing.T) {
|
||||
t.Parallel()
|
||||
st := personaTestStore(t)
|
||||
@@ -210,15 +229,11 @@ func TestSessionPersonaHTTPContract(t *testing.T) {
|
||||
t.Fatalf("listed persona_id = %q, want yuki (sessions=%+v)", found, sessions)
|
||||
}
|
||||
|
||||
// An unknown role is refused rather than silently ignored.
|
||||
// An unknown role on create is refused rather than silently ignored.
|
||||
resp, body = doReq(t, http.MethodPost, ts.URL+"/api/v1/sessions", map[string]any{"personaId": "nobody"}, tok)
|
||||
if resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("create with unknown personaId status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"personaId": "nobody"}, tok)
|
||||
if resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("patch with unknown personaId status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
// A body with none of the supported fields stays a 400.
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{}, tok)
|
||||
@@ -226,20 +241,69 @@ func TestSessionPersonaHTTPContract(t *testing.T) {
|
||||
t.Fatalf("empty patch status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
// Rebind to the other role, then clear the binding; both echo only the changed field.
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"personaId": "xilian"}, tok)
|
||||
// PATCH refuses the personaId key for EVERY value (design/22 §8-1): the role is
|
||||
// fixed when the session is created, so a rebind — to another role, to the bound
|
||||
// role, to "", or to null — is not a supported operation. Each refusal must name
|
||||
// personaId (so a client can tell it from "no field given") and must leave the
|
||||
// stored binding exactly as it was.
|
||||
for _, bad := range []any{"xilian", "yuki", "nobody", "", " ", nil} {
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"personaId": bad}, tok)
|
||||
if resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("patch personaId=%#v status = %d, want 400 (body=%s)", bad, resp.StatusCode, body)
|
||||
}
|
||||
if !strings.Contains(string(body), "personaId") {
|
||||
t.Fatalf("patch personaId=%#v body = %s, want it to name personaId", bad, body)
|
||||
}
|
||||
if got := personaBindingOf(t, st, created.SessionID); got != "yuki" {
|
||||
t.Fatalf("patch personaId=%#v moved the binding to %q, want it left at yuki", bad, got)
|
||||
}
|
||||
}
|
||||
|
||||
// The refusal beats a legal field in the same body: a client cannot smuggle a
|
||||
// rebind alongside a rename, and the rename must not land either.
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"title": "偷偷改名", "personaId": "xilian"}, tok)
|
||||
if resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("rename+personaId status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
if got := personaBindingOf(t, st, created.SessionID); got != "yuki" {
|
||||
t.Fatalf("rename+personaId moved the binding to %q, want yuki", got)
|
||||
}
|
||||
metas, err := st.ListSessions(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("ListSessions: %v", err)
|
||||
}
|
||||
for _, m := range metas {
|
||||
if m.ID == created.SessionID && m.Title != "" {
|
||||
t.Fatalf("the refused patch applied title %q, want the row untouched", m.Title)
|
||||
}
|
||||
}
|
||||
|
||||
// The personaId check runs BEFORE the session lookup: an unknown session carrying
|
||||
// the key answers 400 (immutable role), not 404 — while a title-only patch for the
|
||||
// very same unknown id is still the store's 404, which is what proves the 400 above
|
||||
// comes from the persona rule rather than from a missing session. An empty body is
|
||||
// the third corner of the same table: 400 for a missing field, again without ever
|
||||
// looking the session up.
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/web:missing", map[string]any{"personaId": "xilian"}, tok)
|
||||
if resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("unknown session + personaId status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/web:missing", map[string]any{}, tok)
|
||||
if resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("unknown session + empty body status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/web:missing", map[string]any{"title": "x"}, tok)
|
||||
if resp.StatusCode != http.StatusNotFound {
|
||||
t.Fatalf("unknown session + title status = %d, want 404 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
// title/pinned are untouched by the refusal.
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"title": "新名字"}, tok)
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("rebind status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
||||
t.Fatalf("title-only patch status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
if got := personaBindingOf(t, st, created.SessionID); got != "xilian" {
|
||||
t.Fatalf("after rebind persona_id = %q, want xilian", got)
|
||||
}
|
||||
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"personaId": ""}, tok)
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("unbind status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
||||
}
|
||||
if got := personaBindingOf(t, st, created.SessionID); got != "" {
|
||||
t.Fatalf("after unbind persona_id = %q, want '' (inherit the default)", got)
|
||||
if got := personaBindingOf(t, st, created.SessionID); got != "yuki" {
|
||||
t.Fatalf("title-only patch moved the binding to %q, want yuki", got)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user