AskaEth
c7ecc3a249
design/22 §8-1（主人 2026-10-03 拍板）：会话角色在创建时确定、之后不可变，
要换角色必须新开会话。
后端：
- PATCH /api/v1/sessions/{id} 的 personaId 改为 json.RawMessage 判「键出现」，
出现即 400（null/""/未知 id 一律拒），且先于会话存在性检查；错误消息点名 personaId
- 删除 Server.setSessionPersona 与 PATCH 的 501 分支；title/pinned 行为逐字不变
- sessionPersonaWriter 接口与 history.Store.SetSessionPersona 保留（存储能力）
前端：
- 移除会话行「切换角色」入口与面板「挂角色」下拉（含 setSessionPersona action、
lib/sessionPersona.ts）；保留「新建会话选角色」；面板「角色」列改为只读展示
契约：Docs/api-client.md -> v0.46（破坏性：依赖 PATCH 换角色的客户端须改为新建会话）
验证：go build/vet ./... 绿；gateway+history 包测试绿（-count=1）；前端 npm run build
（tsc --noEmit + vite build）绿；9 个前端逻辑测试全绿。
变异验证：改回「静默忽略」/「写绑定」两种反向实现，新断言均 FAIL。
379 lines
15 KiB
Go
379 lines
15 KiB
Go
package gateway
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/db"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/persona/loader"
|
|
personareg "git.yeij.top/AskaEth/Cyrene_v2/internal/persona/registry"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/agent"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/history"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/loop"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
|
|
)
|
|
|
|
// This file covers the gateway half of design/22 (多角色并存 + 按会话选角): the REST
|
|
// contract for binding a session to a role, and the resolver that turns a
|
|
// sessionID into the loop environment the turn runs under. The chain asserted end to
|
|
// end is: sessionID → chat_sessions.persona_id → turnEnvResolver → loop.SessionEnv →
|
|
// per-role agent (system prompt), so a regression at any hop shows up as the wrong
|
|
// role answering.
|
|
|
|
// personaAdapter records every request the loop built, so a test can assert which
|
|
// role's system prompt actually reached the model.
|
|
type personaAdapter struct {
|
|
reqs []model.Request
|
|
}
|
|
|
|
func (p *personaAdapter) Name() string { return "persona-test" }
|
|
|
|
func (p *personaAdapter) Chat(_ context.Context, req model.Request, _ model.Options) (model.Response, error) {
|
|
p.reqs = append(p.reqs, req)
|
|
return model.Response{Content: "好呀"}, nil
|
|
}
|
|
|
|
func (p *personaAdapter) ChatStream(ctx context.Context, req model.Request, _ func(model.StreamEvent)) (model.Response, error) {
|
|
return p.Chat(ctx, req, model.Options{})
|
|
}
|
|
|
|
// personaTestRegistry registers two roles (one default) so the gateway can validate
|
|
// personaId values and resolve the default role.
|
|
func personaTestRegistry(t *testing.T) *personareg.Registry {
|
|
t.Helper()
|
|
reg := personareg.New()
|
|
for _, p := range []*loader.Persona{
|
|
{ID: "xilian", Name: "昔涟"},
|
|
{ID: "yuki", Name: "由纪"},
|
|
} {
|
|
if err := reg.RegisterPersona(p); err != nil {
|
|
t.Fatalf("RegisterPersona(%s): %v", p.ID, err)
|
|
}
|
|
}
|
|
if err := reg.RegisterCharacter(&personareg.Character{ID: "xilian", Name: "昔涟", Default: true, PersonaID: "xilian"}); err != nil {
|
|
t.Fatalf("RegisterCharacter(xilian): %v", err)
|
|
}
|
|
if err := reg.RegisterCharacter(&personareg.Character{ID: "yuki", Name: "由纪", PersonaID: "yuki"}); err != nil {
|
|
t.Fatalf("RegisterCharacter(yuki): %v", err)
|
|
}
|
|
return reg
|
|
}
|
|
|
|
// personaTestStore opens an in-memory chat-history store.
|
|
func personaTestStore(t *testing.T) *history.Store {
|
|
t.Helper()
|
|
ctx := context.Background()
|
|
conn, err := db.Open(ctx, ":memory:", testLogger())
|
|
if err != nil {
|
|
t.Fatalf("db.Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { _ = conn.Close() })
|
|
st, err := history.NewStore(ctx, conn, testLogger())
|
|
if err != nil {
|
|
t.Fatalf("history.NewStore: %v", err)
|
|
}
|
|
return st
|
|
}
|
|
|
|
// gatewayAgentFor builds the per-role agent the composition root would build: the
|
|
// same adapter, a role-specific instruction string.
|
|
func gatewayAgentFor(t *testing.T, instructions string, ad model.Adapter) *agent.Agent {
|
|
t.Helper()
|
|
ag, err := agent.New(instructions, nil, nil, agent.WithModel(ad, nil))
|
|
if err != nil {
|
|
t.Fatalf("agent.New(%q): %v", instructions, err)
|
|
}
|
|
return ag
|
|
}
|
|
|
|
// TestChatTurnAnswersAsTheBoundRole is design/22 acceptance 3 seen from the process
|
|
// boundary: a sub session created and bound to role Y answers as Y (the first system
|
|
// message is Y's prompt and the persisted messages carry Y). Its role is fixed at
|
|
// creation (§8-1), so the PATCH that used to unbind it is refused and the session
|
|
// keeps answering as Y; the only way to get the default role is a session created
|
|
// without a binding.
|
|
func TestChatTurnAnswersAsTheBoundRole(t *testing.T) {
|
|
t.Parallel()
|
|
ctx := context.Background()
|
|
st := personaTestStore(t)
|
|
reg := personaTestRegistry(t)
|
|
sub, err := st.NewSubSessionFor(ctx, "owner", "yuki")
|
|
if err != nil {
|
|
t.Fatalf("NewSubSessionFor: %v", err)
|
|
}
|
|
|
|
ad := &personaAdapter{}
|
|
xilian := gatewayAgentFor(t, "你是昔涟。", ad)
|
|
yuki := gatewayAgentFor(t, "你是由纪。", ad)
|
|
l := loop.New(loop.Options{
|
|
Agent: xilian,
|
|
Agents: map[string]*agent.Agent{"xilian": xilian, "yuki": yuki},
|
|
PersonaID: "xilian",
|
|
})
|
|
_, ts, jwt := buildEnv(t, cfgDefault(), Deps{History: st, Personas: reg, Loop: l})
|
|
tok := signAny(t, jwt, "acct", auth.RoleOwner)
|
|
|
|
resp, body := doReq(t, http.MethodPost, ts.URL+"/api/v1/chat", map[string]any{"sessionId": sub, "text": "你好呀"}, tok)
|
|
if resp.StatusCode != http.StatusOK {
|
|
t.Fatalf("chat status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
if len(ad.reqs) == 0 {
|
|
t.Fatal("the model adapter saw no request")
|
|
}
|
|
if got := firstSystemText(ad.reqs[len(ad.reqs)-1]); got != "你是由纪。" {
|
|
t.Fatalf("bound session prompt = %q, want role Y's prompt", got)
|
|
}
|
|
|
|
// The orchestrator files both the user turn and the reply under the turn's role,
|
|
// which is what makes the stored transcript readable role-by-role (design/22 §7-5).
|
|
msgs, err := st.List(ctx, sub, 0, 10, "")
|
|
if err != nil {
|
|
t.Fatalf("list messages: %v", err)
|
|
}
|
|
if len(msgs) != 2 {
|
|
t.Fatalf("persisted %d messages, want 2 (user + assistant)", len(msgs))
|
|
}
|
|
for _, m := range msgs {
|
|
if m.PersonaID != "yuki" {
|
|
t.Fatalf("%s message persona_id = %q, want yuki", m.Role, m.PersonaID)
|
|
}
|
|
}
|
|
|
|
// Unbinding is refused (design/22 §8-1): a session's role is decided when it is
|
|
// created, so this PATCH answers 400 and the very next turn still answers as Y.
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+sub, map[string]any{"personaId": ""}, tok)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("unbind status = %d, want 400 (a session's role is immutable; body=%s)", resp.StatusCode, body)
|
|
}
|
|
resp, body = doReq(t, http.MethodPost, ts.URL+"/api/v1/chat", map[string]any{"sessionId": sub, "text": "再说一句"}, tok)
|
|
if resp.StatusCode != http.StatusOK {
|
|
t.Fatalf("second chat status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
if got := firstSystemText(ad.reqs[len(ad.reqs)-1]); got != "你是由纪。" {
|
|
t.Fatalf("prompt after the refused unbind = %q, want role Y's prompt", got)
|
|
}
|
|
|
|
// The default role is reached by a session created WITHOUT a binding — the only
|
|
// way to change role now.
|
|
unbound, err := st.NewSubSession(ctx, "owner")
|
|
if err != nil {
|
|
t.Fatalf("NewSubSession: %v", err)
|
|
}
|
|
resp, body = doReq(t, http.MethodPost, ts.URL+"/api/v1/chat", map[string]any{"sessionId": unbound, "text": "你好"}, tok)
|
|
if resp.StatusCode != http.StatusOK {
|
|
t.Fatalf("default-role chat status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
if got := firstSystemText(ad.reqs[len(ad.reqs)-1]); got != "你是昔涟。" {
|
|
t.Fatalf("unbound session prompt = %q, want the default role's prompt", got)
|
|
}
|
|
}
|
|
|
|
// firstSystemText returns the text of the first system message of req.
|
|
func firstSystemText(req model.Request) string {
|
|
for _, m := range req.Messages {
|
|
if m.Role != model.RoleSystem {
|
|
continue
|
|
}
|
|
text := ""
|
|
for _, part := range m.Content {
|
|
text += part.Text
|
|
}
|
|
return text
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// TestSessionPersonaHTTPContract covers the REST contract of design/22 §4.5 as
|
|
// amended by §8-1: create with a personaId binds it, the session list reports it, an
|
|
// unknown personaId on create is rejected (400) instead of binding a role that cannot
|
|
// answer, a PATCH with neither title nor pinned is a 400, and PATCH REFUSES the
|
|
// personaId key for every value — a session's role is fixed at creation, so there is
|
|
// no supported rebind and the refusal can never be mistaken for a silent no-op.
|
|
func TestSessionPersonaHTTPContract(t *testing.T) {
|
|
t.Parallel()
|
|
st := personaTestStore(t)
|
|
reg := personaTestRegistry(t)
|
|
_, ts, jwt := buildEnv(t, cfgDefault(), Deps{History: st, Personas: reg})
|
|
tok := signAny(t, jwt, "acct", auth.RoleOwner)
|
|
|
|
resp, body := doReq(t, http.MethodPost, ts.URL+"/api/v1/sessions", map[string]any{"personaId": "yuki"}, tok)
|
|
if resp.StatusCode != http.StatusCreated {
|
|
t.Fatalf("create status = %d, want 201 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
var created struct {
|
|
SessionID string `json:"sessionId"`
|
|
PersonaID string `json:"personaId"`
|
|
}
|
|
if err := json.Unmarshal(decodeBody(t, body)["data"], &created); err != nil {
|
|
t.Fatalf("decode create: %v (body=%s)", err, body)
|
|
}
|
|
if created.PersonaID != "yuki" {
|
|
t.Fatalf("create echoed personaId = %q, want yuki", created.PersonaID)
|
|
}
|
|
|
|
// The session list surfaces the binding (the client renders the active role from it).
|
|
var sessions []historySessionSummary
|
|
_, body = doReq(t, http.MethodGet, ts.URL+"/api/v1/sessions", nil, tok)
|
|
decodeDataSlice(t, body, &sessions)
|
|
found := ""
|
|
for _, s := range sessions {
|
|
if s.ID == created.SessionID {
|
|
found = s.PersonaID
|
|
}
|
|
}
|
|
if found != "yuki" {
|
|
t.Fatalf("listed persona_id = %q, want yuki (sessions=%+v)", found, sessions)
|
|
}
|
|
|
|
// An unknown role on create is refused rather than silently ignored.
|
|
resp, body = doReq(t, http.MethodPost, ts.URL+"/api/v1/sessions", map[string]any{"personaId": "nobody"}, tok)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("create with unknown personaId status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
|
|
// A body with none of the supported fields stays a 400.
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{}, tok)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("empty patch status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
|
|
// PATCH refuses the personaId key for EVERY value (design/22 §8-1): the role is
|
|
// fixed when the session is created, so a rebind — to another role, to the bound
|
|
// role, to "", or to null — is not a supported operation. Each refusal must name
|
|
// personaId (so a client can tell it from "no field given") and must leave the
|
|
// stored binding exactly as it was.
|
|
for _, bad := range []any{"xilian", "yuki", "nobody", "", " ", nil} {
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"personaId": bad}, tok)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("patch personaId=%#v status = %d, want 400 (body=%s)", bad, resp.StatusCode, body)
|
|
}
|
|
if !strings.Contains(string(body), "personaId") {
|
|
t.Fatalf("patch personaId=%#v body = %s, want it to name personaId", bad, body)
|
|
}
|
|
if got := personaBindingOf(t, st, created.SessionID); got != "yuki" {
|
|
t.Fatalf("patch personaId=%#v moved the binding to %q, want it left at yuki", bad, got)
|
|
}
|
|
}
|
|
|
|
// The refusal beats a legal field in the same body: a client cannot smuggle a
|
|
// rebind alongside a rename, and the rename must not land either.
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"title": "偷偷改名", "personaId": "xilian"}, tok)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("rename+personaId status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
if got := personaBindingOf(t, st, created.SessionID); got != "yuki" {
|
|
t.Fatalf("rename+personaId moved the binding to %q, want yuki", got)
|
|
}
|
|
metas, err := st.ListSessions(context.Background())
|
|
if err != nil {
|
|
t.Fatalf("ListSessions: %v", err)
|
|
}
|
|
for _, m := range metas {
|
|
if m.ID == created.SessionID && m.Title != "" {
|
|
t.Fatalf("the refused patch applied title %q, want the row untouched", m.Title)
|
|
}
|
|
}
|
|
|
|
// The personaId check runs BEFORE the session lookup: an unknown session carrying
|
|
// the key answers 400 (immutable role), not 404 — while a title-only patch for the
|
|
// very same unknown id is still the store's 404, which is what proves the 400 above
|
|
// comes from the persona rule rather than from a missing session. An empty body is
|
|
// the third corner of the same table: 400 for a missing field, again without ever
|
|
// looking the session up.
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/web:missing", map[string]any{"personaId": "xilian"}, tok)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("unknown session + personaId status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/web:missing", map[string]any{}, tok)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("unknown session + empty body status = %d, want 400 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/web:missing", map[string]any{"title": "x"}, tok)
|
|
if resp.StatusCode != http.StatusNotFound {
|
|
t.Fatalf("unknown session + title status = %d, want 404 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
|
|
// title/pinned are untouched by the refusal.
|
|
resp, body = doReq(t, http.MethodPatch, ts.URL+"/api/v1/sessions/"+created.SessionID, map[string]any{"title": "新名字"}, tok)
|
|
if resp.StatusCode != http.StatusOK {
|
|
t.Fatalf("title-only patch status = %d, want 200 (body=%s)", resp.StatusCode, body)
|
|
}
|
|
if got := personaBindingOf(t, st, created.SessionID); got != "yuki" {
|
|
t.Fatalf("title-only patch moved the binding to %q, want yuki", got)
|
|
}
|
|
}
|
|
|
|
// personaBindingOf reads a session's bound role straight from the store, so the test
|
|
// asserts the persisted state rather than only the response echo.
|
|
func personaBindingOf(t *testing.T, st *history.Store, sessionID string) string {
|
|
t.Helper()
|
|
personaID, err := st.SessionPersona(context.Background(), sessionID)
|
|
if err != nil {
|
|
t.Fatalf("SessionPersona(%s): %v", sessionID, err)
|
|
}
|
|
return personaID
|
|
}
|
|
|
|
// TestTurnEnvResolver covers the resolver itself (design/22 §4.5): the session's
|
|
// binding wins, an unknown/unbound session yields "" (so the loop falls back to the
|
|
// global default), and the identity/memory fields stay the owner-full ones — the
|
|
// role never changes what a turn is allowed to do.
|
|
func TestTurnEnvResolver(t *testing.T) {
|
|
t.Parallel()
|
|
ctx := context.Background()
|
|
st := personaTestStore(t)
|
|
bound, err := st.NewSubSessionFor(ctx, "owner", "yuki")
|
|
if err != nil {
|
|
t.Fatalf("NewSubSessionFor: %v", err)
|
|
}
|
|
|
|
r := turnEnvResolver{history: st, personas: personaTestRegistry(t), log: testLogger()}
|
|
|
|
env := r.owner(ctx, bound)
|
|
if env.PersonaID != "yuki" {
|
|
t.Fatalf("bound session env persona = %q, want yuki", env.PersonaID)
|
|
}
|
|
if env.ActorEnv != loop.OwnerEnv().ActorEnv || !env.MemWritable {
|
|
t.Fatalf("resolver changed the identity lane: %+v", env)
|
|
}
|
|
|
|
unbound, err := st.NewSubSession(ctx, "owner")
|
|
if err != nil {
|
|
t.Fatalf("NewSubSession: %v", err)
|
|
}
|
|
if got := r.owner(ctx, unbound).PersonaID; got != "" {
|
|
t.Fatalf("unbound session env persona = %q, want '' (inherit the default)", got)
|
|
}
|
|
if got := r.owner(ctx, "sess-unknown").PersonaID; got != "" {
|
|
t.Fatalf("unknown session env persona = %q, want '' (inherit the default)", got)
|
|
}
|
|
|
|
// A gateway without a history store cannot resolve a binding and must not fail.
|
|
bare := turnEnvResolver{log: testLogger()}
|
|
if got := bare.owner(ctx, "web").PersonaID; got != "" {
|
|
t.Fatalf("no-store env persona = %q, want ''", got)
|
|
}
|
|
if !bare.owner(ctx, "web").MemWritable {
|
|
t.Fatal("no-store env lost the owner memory lane")
|
|
}
|
|
}
|
|
|
|
// TestDefaultPersonaIDFromRegistry locks the admin fallback design/22 §4.5 asks for:
|
|
// the default role is read from the library's default character instead of a
|
|
// hardcoded "cyrene", and an unwired registry reports none.
|
|
func TestDefaultPersonaIDFromRegistry(t *testing.T) {
|
|
t.Parallel()
|
|
srv, _, _ := buildEnv(t, cfgDefault(), Deps{Personas: personaTestRegistry(t)})
|
|
if got := srv.defaultPersonaID(); got != "xilian" {
|
|
t.Fatalf("defaultPersonaID = %q, want xilian (the default character's persona)", got)
|
|
}
|
|
bare, _, _ := buildEnv(t, cfgDefault(), Deps{})
|
|
if got := bare.defaultPersonaID(); got != "" {
|
|
t.Fatalf("defaultPersonaID without a registry = %q, want ''", got)
|
|
}
|
|
}
|