feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)

plugins/fleets/tests/backend/helpers.ts

@@ -0,0 +1,159 @@
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+import { fileURLToPath } from "node:url";
+import express, { type Router } from "express";
+import {
+  createMockCtx,
+  createTestDb,
+  type MockPluginContext,
+  type TestDb,
+} from "@termix/plugin-sdk/testing";
+import type { PluginManifest } from "@termix/plugin-sdk/manifest";
+import manifestJson from "../../manifest.json";
+
+export const pluginDir = fileURLToPath(new URL("../..", import.meta.url));
+export const manifest = manifestJson as unknown as PluginManifest;
+
+export interface TestServer {
+  db: TestDb;
+  mock: MockPluginContext;
+  request: (
+    method: string,
+    path: string,
+    options?: { user?: string; body?: unknown },
+    // Route bodies vary per test; asserting on them is the point.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ) => Promise<{ status: number; body: any }>;
+  close: () => Promise<void>;
+}
+
+/**
+ * The plugin activated against a real in-memory database, its router mounted
+ * on an express app the way core mounts it: JSON parsed, the acting user set
+ * from the request, everything else left to the plugin.
+ */
+export async function startServer(
+  options: {
+    permissions?: string[];
+    users?: string[];
+    hosts?: Array<{
+      id: number;
+      userId: string;
+      name?: string;
+      ip?: string;
+      tags?: string | null;
+    }>;
+  } = {},
+): Promise<TestServer> {
+  const hosts = options.hosts ?? [
+    { id: 10, userId: "user-1", name: "host-a", ip: "10.0.0.1" },
+    { id: 11, userId: "user-1", name: "host-b", ip: "10.0.0.2" },
+  ];
+
+  const db = await createTestDb(pluginDir, {
+    before: (sqlite) => {
+      for (const user of options.users ?? ["user-1", "user-2"]) {
+        sqlite
+          .prepare("INSERT INTO users (id, username) VALUES (?, ?)")
+          .run(user, user);
+      }
+      // The plugin's fleet_members/fleet_inventory tables FK to ssh_data,
+      // which ctx.hosts (faked below) never touches - seed it directly so
+      // the constraint is satisfied the way it is against the real table.
+      for (const host of hosts) {
+        sqlite.prepare("INSERT INTO ssh_data (id) VALUES (?)").run(host.id);
+      }
+    },
+  });
+
+  let router: Router | null = null;
+  const mock = createMockCtx({
+    pluginId: manifest.id,
+    manifest,
+    capabilities: manifest.capabilities,
+    db: db.database,
+    router: () => (router = express.Router()),
+    permissions: options.permissions ?? [
+      "fleets.view",
+      "fleets.manage",
+      "fleets.execute",
+    ],
+  });
+
+  // ctx.hosts is capability-checked separately from ctx.db; seed it with the
+  // same fixture hosts a real deployment would resolve through core.
+  mock.ctx.hosts.list = async () =>
+    hosts.map((h) => ({
+      id: h.id,
+      userId: h.userId,
+      name: h.name ?? null,
+      ip: h.ip ?? "",
+      port: 22,
+      username: "root",
+      tags: h.tags ?? null,
+      folder: null,
+      authType: "password",
+    }));
+  mock.ctx.hosts.get = async (hostId) => {
+    const found = hosts.find((h) => h.id === hostId);
+    if (!found) return null;
+    return {
+      id: found.id,
+      userId: found.userId,
+      name: found.name ?? null,
+      ip: found.ip ?? "",
+      port: 22,
+      username: "root",
+      tags: found.tags ?? null,
+      folder: null,
+      authType: "password",
+    };
+  };
+  mock.ctx.hosts.checkAccess = async (hostId) => {
+    const found = hosts.find((h) => h.id === hostId);
+    if (!found) return { hasAccess: false, isOwner: false, isShared: false };
+    return {
+      hasAccess: true,
+      isOwner: true,
+      isShared: false,
+      permissionLevel: "manage",
+    };
+  };
+
+  const { activate } = await import("../../src/backend/index.js");
+  await activate(mock.ctx);
+
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    mock.setActor(req.header("x-test-user") ?? undefined);
+    next();
+  });
+  app.use((req, res, next) => router!(req, res, next));
+
+  const server = http.createServer(app);
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  const { port } = server.address() as AddressInfo;
+
+  return {
+    db,
+    mock,
+    async request(method, path, { user = "user-1", body: given } = {}) {
+      const body = method === "GET" ? undefined : given;
+      const response = await fetch(`http://127.0.0.1:${port}${path}`, {
+        method,
+        headers: {
+          "x-test-user": user,
+          ...(body !== undefined ? { "content-type": "application/json" } : {}),
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+      });
+      const text = await response.text();
+      return { status: response.status, body: text ? JSON.parse(text) : null };
+    },
+    async close() {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+      db.close();
+    },
+  };
+}

plugins/fleets/tests/backend/migrations.test.ts

@@ -0,0 +1,191 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { createTestDb, type TestDb } from "@termix/plugin-sdk/testing";
+import { pluginDir } from "./helpers";
+
+// fleets/fleet_members/fleet_inventory as core's SQLite bootstrap created
+// them before 2.9.0, plus the indexes performance-indexes.ts added.
+const LEGACY_DDL = `
+  CREATE TABLE fleets (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    description TEXT,
+    color TEXT,
+    icon TEXT,
+    tag_rules TEXT,
+    sync_id TEXT UNIQUE,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+  );
+  CREATE TABLE fleet_members (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    fleet_id INTEGER NOT NULL REFERENCES fleets(id) ON DELETE CASCADE,
+    host_id INTEGER NOT NULL REFERENCES ssh_data(id) ON DELETE CASCADE,
+    added_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+  );
+  CREATE UNIQUE INDEX idx_fleet_members_fleet_host ON fleet_members(fleet_id, host_id);
+  CREATE INDEX idx_fleet_members_host ON fleet_members(host_id);
+  CREATE TABLE fleet_inventory (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    host_id INTEGER NOT NULL REFERENCES ssh_data(id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    os_pretty_name TEXT,
+    kernel TEXT,
+    architecture TEXT,
+    hostname TEXT,
+    uptime_seconds INTEGER,
+    ip TEXT,
+    package_manager TEXT,
+    collected_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+  );
+  CREATE UNIQUE INDEX idx_fleet_inventory_host ON fleet_inventory(host_id, user_id);
+  CREATE INDEX idx_fleet_inventory_user ON fleet_inventory(user_id);
+`;
+
+let db: TestDb | null = null;
+
+afterEach(() => {
+  db?.close();
+  db = null;
+});
+
+const tableExists = (name: string) =>
+  !!db!.sqlite
+    .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
+    .get(name);
+
+const indexOn = (table: string) =>
+  (
+    db!.sqlite
+      .prepare(
+        "SELECT name FROM sqlite_master WHERE type = 'index' AND tbl_name = ? AND name NOT LIKE 'sqlite_%'",
+      )
+      .all(table) as { name: string }[]
+  )
+    .map((row) => row.name)
+    .sort();
+
+describe("adopting fleets, fleet_members, fleet_inventory", () => {
+  it("keeps every existing row when the legacy tables are there", async () => {
+    db = await createTestDb(pluginDir, {
+      before: (sqlite) => {
+        sqlite.exec("INSERT INTO users (id) VALUES ('user-1'), ('user-2')");
+        sqlite.exec("INSERT INTO ssh_data (id) VALUES (1), (2)");
+        sqlite.exec(LEGACY_DDL);
+        sqlite
+          .prepare(
+            "INSERT INTO fleets (user_id, name, tag_rules, sync_id) VALUES (?, ?, ?, ?)",
+          )
+          .run("user-1", "Web fleet", '["prod-web"]', "sync-a");
+        sqlite
+          .prepare(
+            "INSERT INTO fleet_members (fleet_id, host_id) VALUES (1, 1)",
+          )
+          .run();
+        sqlite
+          .prepare(
+            "INSERT INTO fleet_inventory (host_id, user_id, os_pretty_name) VALUES (1, 'user-1', 'Debian')",
+          )
+          .run();
+      },
+    });
+
+    expect(db.applied).toEqual(["0001_adopt_fleets"]);
+    expect(tableExists("fleets")).toBe(false);
+    expect(tableExists("fleet_members")).toBe(false);
+    expect(tableExists("fleet_inventory")).toBe(false);
+    expect(tableExists("p_fleets_fleets")).toBe(true);
+    expect(tableExists("p_fleets_members")).toBe(true);
+    expect(tableExists("p_fleets_inventory")).toBe(true);
+
+    const fleetRows = db.sqlite
+      .prepare("SELECT user_id, name, tag_rules, sync_id FROM p_fleets_fleets")
+      .all();
+    expect(fleetRows).toEqual([
+      {
+        user_id: "user-1",
+        name: "Web fleet",
+        tag_rules: '["prod-web"]',
+        sync_id: "sync-a",
+      },
+    ]);
+
+    const memberRows = db.sqlite
+      .prepare("SELECT fleet_id, host_id FROM p_fleets_members")
+      .all();
+    expect(memberRows).toEqual([{ fleet_id: 1, host_id: 1 }]);
+
+    const inventoryRows = db.sqlite
+      .prepare(
+        "SELECT host_id, user_id, os_pretty_name FROM p_fleets_inventory",
+      )
+      .all();
+    expect(inventoryRows).toEqual([
+      { host_id: 1, user_id: "user-1", os_pretty_name: "Debian" },
+    ]);
+
+    expect(indexOn("p_fleets_members")).toEqual(
+      ["idx_fleet_members_fleet_host", "idx_fleet_members_host"].sort(),
+    );
+    expect(indexOn("p_fleets_inventory")).toEqual(
+      ["idx_fleet_inventory_host", "idx_fleet_inventory_user"].sort(),
+    );
+  });
+
+  it("creates the tables fresh when there are no legacy ones", async () => {
+    db = await createTestDb(pluginDir);
+
+    expect(tableExists("fleets")).toBe(false);
+    expect(tableExists("p_fleets_fleets")).toBe(true);
+    expect(tableExists("p_fleets_members")).toBe(true);
+    expect(tableExists("p_fleets_inventory")).toBe(true);
+    expect(db.sqlite.prepare("SELECT * FROM p_fleets_fleets").all()).toEqual(
+      [],
+    );
+  });
+
+  it("cascades a fleet delete onto its member rows via the fleet_id FK", async () => {
+    db = await createTestDb(pluginDir, {
+      before: (sqlite) => {
+        sqlite.exec("INSERT INTO users (id) VALUES ('user-1')");
+        sqlite.exec("INSERT INTO ssh_data (id) VALUES (1)");
+      },
+    });
+    db.sqlite
+      .prepare(
+        "INSERT INTO p_fleets_fleets (id, user_id, name) VALUES (1, 'user-1', 'Fleet')",
+      )
+      .run();
+    db.sqlite
+      .prepare("INSERT INTO p_fleets_members (fleet_id, host_id) VALUES (1, 1)")
+      .run();
+
+    db.sqlite.exec("DELETE FROM p_fleets_fleets WHERE id = 1");
+
+    expect(db.sqlite.prepare("SELECT * FROM p_fleets_members").all()).toEqual(
+      [],
+    );
+  });
+
+  it("removes a user's fleets when the user is deleted", async () => {
+    db = await createTestDb(pluginDir, {
+      before: (sqlite) => {
+        sqlite.exec("INSERT INTO users (id) VALUES ('user-1'), ('user-2')");
+      },
+    });
+    const insert = db.sqlite.prepare(
+      "INSERT INTO p_fleets_fleets (user_id, name) VALUES (?, ?)",
+    );
+    insert.run("user-1", "Mine");
+    insert.run("user-2", "Theirs");
+
+    db.sqlite.exec("DELETE FROM users WHERE id = 'user-1'");
+
+    const names = (
+      db.sqlite.prepare("SELECT name FROM p_fleets_fleets").all() as {
+        name: string;
+      }[]
+    ).map((row) => row.name);
+    expect(names).toEqual(["Theirs"]);
+  });
+});

plugins/fleets/tests/backend/repositories/fleet-repository.test.ts

@@ -1,103 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import { TestSqliteDatabase } from "../../../../../src/backend/tests/database/repositories/test-support.js";
-import { FleetRepository } from "../../../../../src/backend/database/repositories/fleet-repository.js";
-
-describe("FleetRepository", () => {
-  let adapter: TestSqliteDatabase | null = null;
-
-  afterEach(async () => {
-    if (adapter) {
-      await adapter.close();
-      adapter = null;
-    }
-  });
-
-  async function createRepository(
-    onWrite?: () => void | Promise<void>,
-  ): Promise<{ repository: FleetRepository }> {
-    adapter = new TestSqliteDatabase();
-    const context = await adapter.connect();
-    await adapter.exec(`
-      INSERT INTO users (id, username, password_hash)
-      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
-      INSERT INTO ssh_data (id, user_id, name, ip, port, username, auth_type, tags)
-      VALUES
-        (1, 'user-1', 'web-1', '10.0.0.1', 22, 'root', 'password', 'prod-web,edge'),
-        (2, 'user-1', 'web-2', '10.0.0.2', 22, 'root', 'password', 'prod-web'),
-        (3, 'user-1', 'db-1', '10.0.0.3', 22, 'root', 'password', 'prod-db'),
-        (4, 'user-1', 'static-only', '10.0.0.4', 22, 'root', 'password', NULL),
-        (5, 'user-2', 'other-user-host', '10.0.0.5', 22, 'root', 'password', 'prod-web');
-    `);
-
-    return { repository: new FleetRepository(context, onWrite) };
-  }
-
-  it("unions static membership and tag-matched hosts, deduplicated by id", async () => {
-    let writes = 0;
-    const { repository } = await createRepository(() => {
-      writes += 1;
-    });
-
-    const fleet = await repository.create("user-1", {
-      name: "web fleet",
-      tagRules: ["prod-web"],
-    });
-    // host 1 matches by tag AND is added statically - must appear once.
-    await repository.addMember(fleet.id, 1);
-    // host 4 has no tags - only reachable via static membership.
-    await repository.addMember(fleet.id, 4);
-
-    const members = await repository.listEffectiveMembers("user-1", fleet.id);
-    const ids = members.map((m) => m.id).sort((a, b) => a - b);
-
-    expect(ids).toEqual([1, 2, 4]);
-    expect(writes).toBeGreaterThan(0);
-  });
-
-  it("never returns another user's hosts even if tags match", async () => {
-    const { repository } = await createRepository();
-
-    const fleet = await repository.create("user-1", {
-      name: "web fleet",
-      tagRules: ["prod-web"],
-    });
-
-    const members = await repository.listEffectiveMembers("user-1", fleet.id);
-    expect(members.map((m) => m.id)).not.toContain(5);
-  });
-
-  it("returns only static members when a fleet has no tag rules", async () => {
-    const { repository } = await createRepository();
-
-    const fleet = await repository.create("user-1", { name: "static fleet" });
-    await repository.addMember(fleet.id, 3);
-
-    const members = await repository.listEffectiveMembers("user-1", fleet.id);
-    expect(members.map((m) => m.id)).toEqual([3]);
-  });
-
-  it("removeMember only drops the static row, not tag-based membership", async () => {
-    const { repository } = await createRepository();
-
-    const fleet = await repository.create("user-1", {
-      name: "web fleet",
-      tagRules: ["prod-web"],
-    });
-    await repository.addMember(fleet.id, 1);
-
-    await expect(repository.removeMember(fleet.id, 1)).resolves.toBe(true);
-
-    // host 1 still matches the tag rule, so it remains an effective member.
-    const members = await repository.listEffectiveMembers("user-1", fleet.id);
-    expect(members.map((m) => m.id)).toContain(1);
-  });
-
-  it("returns an empty list for a fleet the caller does not own", async () => {
-    const { repository } = await createRepository();
-    const fleet = await repository.create("user-1", { name: "private" });
-
-    await expect(
-      repository.listEffectiveMembers("user-2", fleet.id),
-    ).resolves.toEqual([]);
-  });
-});

plugins/fleets/tests/backend/repository.test.ts

@@ -0,0 +1,209 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { createTestDb, type TestDb } from "@termix/plugin-sdk/testing";
+import type {
+  PluginHostSummary,
+  PluginHosts,
+} from "@termix/plugin-sdk/backend";
+import { pluginDir } from "./helpers";
+import {
+  fleets,
+  fleetMembers,
+  fleetInventory,
+} from "../../src/backend/tables.js";
+import { createFleetRepository } from "../../src/backend/repository.js";
+
+let db: TestDb | null = null;
+
+afterEach(() => {
+  db?.close();
+  db = null;
+});
+
+function fakeHosts(hosts: PluginHostSummary[]): PluginHosts {
+  return {
+    list: async () => hosts,
+    get: async (hostId) => hosts.find((h) => h.id === hostId) ?? null,
+    checkAccess: async (hostId) => {
+      const found = hosts.find((h) => h.id === hostId);
+      return found
+        ? {
+            hasAccess: true,
+            isOwner: true,
+            isShared: false,
+            permissionLevel: "manage",
+          }
+        : { hasAccess: false, isOwner: false, isShared: false };
+    },
+    share: async (hostId) => ({ hostId, shared: true }),
+    listUsers: async () => [],
+    listRoles: async () => [],
+  };
+}
+
+async function setup(hosts: PluginHostSummary[]) {
+  db = await createTestDb(pluginDir, {
+    before: (sqlite) => {
+      sqlite.exec("INSERT INTO users (id) VALUES ('user-1'), ('user-2')");
+      sqlite.exec(
+        `INSERT INTO ssh_data (id) VALUES ${hosts.map((h) => `(${h.id})`).join(", ")}`,
+      );
+    },
+  });
+
+  const fleetsTable = await db.database.define(fleets);
+  const membersTable = await db.database.define(fleetMembers);
+  const inventoryTable = await db.database.define(fleetInventory);
+  const repo = createFleetRepository(
+    db.database,
+    fakeHosts(hosts),
+    fleetsTable,
+    membersTable,
+    inventoryTable,
+  );
+  return repo;
+}
+
+function host(
+  id: number,
+  overrides: Partial<PluginHostSummary> = {},
+): PluginHostSummary {
+  return {
+    id,
+    userId: "user-1",
+    name: `host-${id}`,
+    ip: `10.0.0.${id}`,
+    port: 22,
+    username: "root",
+    tags: null,
+    folder: null,
+    authType: "password",
+    ...overrides,
+  };
+}
+
+describe("FleetRepository.listEffectiveMembers", () => {
+  it("unions static membership and tag-matched hosts, deduplicated by id", async () => {
+    const repo = await setup([
+      host(1, { tags: "prod-web,edge" }),
+      host(2, { tags: "prod-web" }),
+      host(3, { tags: "prod-db" }),
+      host(4, { tags: null }),
+      host(5, { userId: "user-2", tags: "prod-web" }),
+    ]);
+
+    const fleet = await repo.create("user-1", {
+      name: "web fleet",
+      tagRules: ["prod-web"],
+    });
+    // host 1 matches by tag AND is added statically - must appear once.
+    await repo.addMember(fleet.id, 1);
+    // host 4 has no tags - only reachable via static membership.
+    await repo.addMember(fleet.id, 4);
+
+    const members = await repo.listEffectiveMembers("user-1", fleet.id);
+    const ids = members.map((m) => m.id).sort((a, b) => a - b);
+
+    expect(ids).toEqual([1, 2, 4]);
+  });
+
+  it("never returns another user's hosts even if tags match", async () => {
+    const repo = await setup([
+      host(1, { tags: "prod-web" }),
+      host(5, { userId: "user-2", tags: "prod-web" }),
+    ]);
+
+    const fleet = await repo.create("user-1", {
+      name: "web fleet",
+      tagRules: ["prod-web"],
+    });
+
+    const members = await repo.listEffectiveMembers("user-1", fleet.id);
+    expect(members.map((m) => m.id)).not.toContain(5);
+  });
+
+  it("returns only static members when a fleet has no tag rules", async () => {
+    const repo = await setup([host(3, { tags: "prod-db" })]);
+
+    const fleet = await repo.create("user-1", { name: "static fleet" });
+    await repo.addMember(fleet.id, 3);
+
+    const members = await repo.listEffectiveMembers("user-1", fleet.id);
+    expect(members.map((m) => m.id)).toEqual([3]);
+  });
+
+  it("removeMember only drops the static row, not tag-based membership", async () => {
+    const repo = await setup([host(1, { tags: "prod-web" })]);
+
+    const fleet = await repo.create("user-1", {
+      name: "web fleet",
+      tagRules: ["prod-web"],
+    });
+    await repo.addMember(fleet.id, 1);
+
+    await expect(repo.removeMember(fleet.id, 1)).resolves.toBe(true);
+
+    // host 1 still matches the tag rule, so it remains an effective member.
+    const members = await repo.listEffectiveMembers("user-1", fleet.id);
+    expect(members.map((m) => m.id)).toContain(1);
+  });
+
+  it("returns an empty list for a fleet the caller does not own", async () => {
+    const repo = await setup([host(1)]);
+    const fleet = await repo.create("user-1", { name: "private" });
+
+    await expect(
+      repo.listEffectiveMembers("user-2", fleet.id),
+    ).resolves.toEqual([]);
+  });
+});
+
+describe("FleetRepository CRUD", () => {
+  it("creates, updates and deletes a fleet", async () => {
+    const repo = await setup([host(1)]);
+    const created = await repo.create("user-1", {
+      name: "Fleet",
+      tagRules: ["a"],
+    });
+    expect(created.name).toBe("Fleet");
+    expect(created.tagRules).toBe('["a"]');
+
+    const updated = await repo.update("user-1", created.id, {
+      name: "Renamed",
+    });
+    expect(updated?.name).toBe("Renamed");
+
+    await expect(repo.delete("user-1", created.id)).resolves.toBe(true);
+    await expect(repo.findById("user-1", created.id)).resolves.toBeNull();
+  });
+
+  it("upserts and lists inventory per host", async () => {
+    const repo = await setup([host(1)]);
+    await repo.upsertInventory("user-1", 1, {
+      osPrettyName: "Debian",
+      kernel: "6.1.0",
+      architecture: "x86_64",
+      hostname: "web-1",
+      uptimeSeconds: 100,
+      ip: "10.0.0.1",
+      packageManager: "apt",
+    });
+
+    const rows = await repo.listInventoryForHosts("user-1", [1]);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toMatchObject({ hostId: 1, osPrettyName: "Debian" });
+
+    // Refreshing overwrites the latest-only snapshot rather than adding a row.
+    await repo.upsertInventory("user-1", 1, {
+      osPrettyName: "Ubuntu",
+      kernel: "6.2.0",
+      architecture: "x86_64",
+      hostname: "web-1",
+      uptimeSeconds: 200,
+      ip: "10.0.0.1",
+      packageManager: "apt",
+    });
+    const refreshed = await repo.listInventoryForHosts("user-1", [1]);
+    expect(refreshed).toHaveLength(1);
+    expect(refreshed[0].osPrettyName).toBe("Ubuntu");
+  });
+});

plugins/fleets/tests/backend/routes.test.ts

@@ -1,388 +1,125 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import type { Request, Response, Router } from "express";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { startServer, type TestServer } from "./helpers";
+import { parseInventoryProbe } from "../../src/backend/routes.js";
 
-const state = vi.hoisted(() => ({
-  currentUserId: "user-1",
-  fleets: new Map<number, { id: number; userId: string; name: string }>(),
-  members: new Map<number, { id: number; name: string }[]>(),
-  hostAccess: new Map<string, { hasAccess: boolean; isOwner: boolean }>(),
-  hosts: new Map<number, Record<string, unknown>>(),
-}));
+let server: TestServer;
 
-vi.mock("../../../../src/backend/database/db/index.js", () => ({ db: {} }));
-
-vi.mock("../../../../src/backend/utils/logger.js", () => ({
-  authLogger: {
-    error: vi.fn(),
-    warn: vi.fn(),
-    info: vi.fn(),
-    success: vi.fn(),
-  },
-  databaseLogger: {
-    error: vi.fn(),
-    warn: vi.fn(),
-    info: vi.fn(),
-    success: vi.fn(),
-  },
-}));
-
-vi.mock("../../../../src/backend/utils/auth-manager.js", () => ({
-  AuthManager: {
-    getInstance: () => ({
-      createAuthMiddleware:
-        () =>
-        (req: Record<string, unknown>, _res: unknown, next: () => void) => {
-          req.userId = state.currentUserId;
-          next();
-        },
-      createDataAccessMiddleware:
-        () => (_req: unknown, _res: unknown, next: () => void) =>
-          next(),
-    }),
-  },
-}));
-
-vi.mock("../../../../src/backend/utils/permission-manager.js", () => ({
-  PermissionManager: {
-    getInstance: () => ({
-      canAccessHost: async (userId: string, hostId: number, level: string) => {
-        const key = `${userId}:${hostId}:${level}`;
-        const found = state.hostAccess.get(key);
-        if (found) return found;
-        // default: full access unless a test explicitly denies it
-        return { hasAccess: true, isOwner: true, permissionLevel: "manage" };
-      },
-    }),
-  },
-}));
-
-vi.mock("../../../../src/backend/hosts/host-resolver.js", () => ({
-  resolveHostById: async (hostId: number) => state.hosts.get(hostId) ?? null,
-}));
-
-vi.mock("../../src/backend/ssh.js", () => ({
-  withSshConnection: async (
-    _host: unknown,
-    _options: unknown,
-    fn: (client: unknown) => unknown,
-  ) => fn({}),
-}));
-
-vi.mock("../../../../src/backend/hosts/metrics-shared/common-utils.js", () => ({
-  execCommand: vi.fn(async () => ({ stdout: "ok", stderr: "", code: 0 })),
-}));
-
-vi.mock("../../../../src/backend/hosts/metrics-shared/platform.js", () => ({
-  detectPlatform: vi.fn(async () => ({ pkg: "apt", osPrettyName: "Debian" })),
-}));
-
-vi.mock(
-  "../../../../src/backend/hosts/metrics-shared/exec-elevated.js",
-  async () => {
-    class ElevationError extends Error {
-      code: string;
-      constructor(code: string, message: string) {
-        super(message);
-        this.code = code;
-      }
-    }
-    return {
-      execElevated: vi.fn(),
-      ElevationError,
-    };
-  },
-);
-
-vi.mock(
-  "../../../../src/backend/hosts/metrics-shared/package-commands.js",
-  () => ({
-    buildPackageActionCommand: vi.fn(() => "apt-get install -y foo"),
-  }),
-);
-
-vi.mock("../../../../src/backend/hosts/metrics-shared/validation.js", () => ({
-  isValidPackageName: (v: unknown) => typeof v === "string" && v.length > 0,
-}));
-
-vi.mock(
-  "../../../../src/backend/database/routes/snippets-execution.js",
-  () => ({
-    resolveSnippetCommand: (command: string) => command,
-  }),
-);
-
-vi.mock("../../../../src/backend/database/routes/rbac.js", () => ({
-  isSharePermissionLevel: (v: unknown) =>
-    ["connect", "view", "edit", "manage"].includes(v as string),
-  expiryFromDuration: () => null,
-  parseShareTargets: () => null,
-}));
-
-vi.mock("../../../../src/backend/database/repositories/factory.js", () => ({
-  createCurrentFleetRepository: () => ({
-    findById: async (userId: string, fleetId: number) => {
-      const fleet = state.fleets.get(fleetId);
-      return fleet && fleet.userId === userId ? fleet : null;
-    },
-    listEffectiveMembers: async (_userId: string, fleetId: number) =>
-      state.members.get(fleetId) ?? [],
-    listStaticMemberIds: async () => [],
-    listByUser: async (userId: string) =>
-      [...state.fleets.values()].filter((f) => f.userId === userId),
-  }),
-  createCurrentFleetInventoryRepository: () => ({
-    listForHosts: async () => [],
-    upsert: async () => ({}),
-  }),
-  createCurrentRbacAccessRepository: () => ({}),
-  createCurrentRoleRepository: () => ({}),
-  createCurrentUserRepository: () => ({}),
-}));
-
-vi.mock("../../../../src/backend/database/routes/fleet-dispatch.js", () => ({
-  registerFleetsRouter: vi.fn(),
-  unregisterFleetsRouter: vi.fn(),
-}));
-
-const { router, parseInventoryProbe, buildRemoveCommand } =
-  await import("../../src/backend/routes.js");
-
-function findLayer(method: string, path: string) {
-  const stack = (router as unknown as Router).stack as Array<{
-    route?: {
-      path: string;
-      methods: Record<string, boolean>;
-      stack: Array<{ handle: (req: Request, res: Response) => unknown }>;
-    };
-  }>;
-  const layer = stack.find(
-    (l) => l.route?.path === path && l.route?.methods[method],
-  );
-  if (!layer?.route) throw new Error(`No route for ${method} ${path}`);
-  return layer.route.stack[layer.route.stack.length - 1].handle;
-}
-
-function makeReqRes(overrides: {
-  body?: Record<string, unknown>;
-  params?: Record<string, unknown>;
-}) {
-  const req = {
-    userId: state.currentUserId,
-    body: overrides.body ?? {},
-    params: overrides.params ?? {},
-    headers: {},
-  } as unknown as Request;
-
-  const res = {
-    statusCode: 200,
-    jsonBody: null as unknown,
-    status(code: number) {
-      (this as unknown as { statusCode: number }).statusCode = code;
-      return this;
-    },
-    json(payload: unknown) {
-      (this as unknown as { jsonBody: unknown }).jsonBody = payload;
-      return this;
-    },
-  } as unknown as Response & { statusCode: number; jsonBody: unknown };
-
-  return { req, res };
-}
-
-async function invoke(
-  method: string,
-  path: string,
-  overrides: {
-    body?: Record<string, unknown>;
-    params?: Record<string, unknown>;
-  } = {},
-) {
-  const handler = findLayer(method, path);
-  const { req, res } = makeReqRes(overrides);
-  await handler(req, res);
-  return res as unknown as {
-    statusCode: number;
-    jsonBody: Record<string, unknown> | null;
-  };
-}
-
-beforeEach(() => {
-  state.currentUserId = "user-1";
-  state.fleets = new Map([[1, { id: 1, userId: "user-1", name: "web fleet" }]]);
-  state.members = new Map([
-    [
-      1,
-      [
-        { id: 10, name: "host-a" },
-        { id: 11, name: "host-b" },
-      ],
-    ],
-  ]);
-  state.hostAccess = new Map();
-  state.hosts = new Map([
-    [
-      10,
-      {
-        id: 10,
-        userId: "user-1",
-        name: "host-a",
-        ip: "10.0.0.1",
-        port: 22,
-        username: "root",
-        sudoPassword: "secret",
-      },
-    ],
-    [
-      11,
-      {
-        id: 11,
-        userId: "user-1",
-        name: "host-b",
-        ip: "10.0.0.2",
-        port: 22,
-        username: "root",
-        sudoPassword: "secret",
-      },
-    ],
-  ]);
+afterEach(async () => {
+  await server?.close();
 });
 
-describe("GET /:id/members", () => {
-  it("404s for a fleet the caller does not own", async () => {
-    const res = await invoke("get", "/:id/members", {
-      params: { id: "999" },
+async function createFleet(
+  server: TestServer,
+  body: Record<string, unknown> = { name: "Web fleet" },
+) {
+  const res = await server.request("POST", "/", { body });
+  expect(res.status).toBe(200);
+  return res.body;
+}
+
+describe("fleet CRUD routes", () => {
+  beforeEach(async () => {
+    server = await startServer();
+  });
+
+  it("creates and lists fleets with member counts", async () => {
+    const created = await createFleet(server);
+    expect(created).toMatchObject({ name: "Web fleet", tagRules: [] });
+
+    const list = await server.request("GET", "/");
+    expect(list.status).toBe(200);
+    expect(list.body).toHaveLength(1);
+    expect(list.body[0]).toMatchObject({ id: created.id, memberCount: 0 });
+  });
+
+  it("400s on a missing name", async () => {
+    const res = await server.request("POST", "/", { body: {} });
+    expect(res.status).toBe(400);
+  });
+
+  it("updates and deletes a fleet", async () => {
+    const created = await createFleet(server);
+    const updated = await server.request("PATCH", `/${created.id}`, {
+      body: { name: "Renamed" },
     });
-    expect(res.statusCode).toBe(404);
+    expect(updated.status).toBe(200);
+    expect(updated.body.name).toBe("Renamed");
+
+    const deleted = await server.request("DELETE", `/${created.id}`);
+    expect(deleted.status).toBe(200);
+    expect((await server.request("GET", "/")).body).toHaveLength(0);
+  });
+
+  it("404s for a fleet the caller does not own", async () => {
+    const res = await server.request("GET", "/999/members");
+    expect(res.status).toBe(404);
   });
 
   it("400s on a non-numeric fleet id", async () => {
-    const res = await invoke("get", "/:id/members", {
-      params: { id: "not-a-number" },
-    });
-    expect(res.statusCode).toBe(400);
+    const res = await server.request("GET", "/not-a-number/members");
+    expect(res.status).toBe(400);
   });
 });
 
-describe("POST /:id/execute", () => {
-  it("400s when command is missing", async () => {
-    const res = await invoke("post", "/:id/execute", {
-      params: { id: "1" },
-      body: {},
-    });
-    expect(res.statusCode).toBe(400);
+describe("fleet membership routes", () => {
+  beforeEach(async () => {
+    server = await startServer();
   });
 
-  it("reports per-host success with the {hostId, hostName, success} shape", async () => {
-    const res = await invoke("post", "/:id/execute", {
-      params: { id: "1" },
-      body: { command: "uptime" },
-    });
-    expect(res.statusCode).toBe(200);
-    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
-    expect(results).toHaveLength(2);
-    expect(results[0]).toMatchObject({
-      hostId: 10,
-      hostName: "host-a",
-      success: true,
+  it("adds and lists members, then removes one", async () => {
+    const fleet = await createFleet(server);
+    const added = await server.request("POST", `/${fleet.id}/members`, {
+      body: { hostId: 10 },
     });
+    expect(added.status).toBe(200);
+
+    const members = await server.request("GET", `/${fleet.id}/members`);
+    expect(members.status).toBe(200);
+    expect(members.body).toHaveLength(1);
+    expect(members.body[0]).toMatchObject({ id: 10, static: true });
+
+    const removed = await server.request("DELETE", `/${fleet.id}/members/10`);
+    expect(removed.status).toBe(200);
+    expect(
+      (await server.request("GET", `/${fleet.id}/members`)).body,
+    ).toHaveLength(0);
   });
 
-  it("isolates one host's access denial - the other host still succeeds", async () => {
-    state.hostAccess.set("user-1:10:edit", {
-      hasAccess: false,
-      isOwner: false,
+  it("404s when adding a host outside the fixture host list", async () => {
+    const fleet = await createFleet(server);
+    const res = await server.request("POST", `/${fleet.id}/members`, {
+      body: { hostId: 999 },
     });
-
-    const res = await invoke("post", "/:id/execute", {
-      params: { id: "1" },
-      body: { command: "uptime" },
-    });
-
-    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
-    const denied = results.find((r) => r.hostId === 10);
-    const allowed = results.find((r) => r.hostId === 11);
-    expect(denied).toMatchObject({ success: false });
-    expect(String(denied?.error)).toMatch(/edit/);
-    expect(allowed).toMatchObject({ success: true });
-  });
-
-  it("404s for a fleet the caller does not own", async () => {
-    const res = await invoke("post", "/:id/execute", {
-      params: { id: "999" },
-      body: { command: "uptime" },
-    });
-    expect(res.statusCode).toBe(404);
+    expect(res.status).toBe(404);
   });
 });
 
-describe("POST /:id/packages", () => {
-  it("400s on an invalid action", async () => {
-    const res = await invoke("post", "/:id/packages", {
-      params: { id: "1" },
-      body: { action: "reformat-disk" },
+describe("permission gates", () => {
+  it("view routes 403 without fleets.view", async () => {
+    server = await startServer({
+      permissions: ["fleets.manage", "fleets.execute"],
     });
-    expect(res.statusCode).toBe(400);
+    const res = await server.request("GET", "/");
+    expect(res.status).toBe(403);
   });
 
-  it("surfaces an ElevationError as a per-host error, not a request failure", async () => {
-    const { execElevated, ElevationError } =
-      await import("../../../../src/backend/hosts/metrics-shared/exec-elevated.js");
-    (execElevated as ReturnType<typeof vi.fn>).mockRejectedValue(
-      new ElevationError("SUDO_REQUIRED", "sudo password required"),
-    );
-
-    const res = await invoke("post", "/:id/packages", {
-      params: { id: "1" },
-      body: { action: "install", package: "curl" },
+  it("manage routes 403 without fleets.manage", async () => {
+    server = await startServer({
+      permissions: ["fleets.view", "fleets.execute"],
     });
-
-    expect(res.statusCode).toBe(200);
-    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
-    expect(results.every((r) => r.success === false)).toBe(true);
-    expect(results[0].error).toMatch(/sudo password required/);
+    const res = await server.request("POST", "/", { body: { name: "x" } });
+    expect(res.status).toBe(403);
   });
 
-  it("requires manage-level access, not just edit", async () => {
-    state.hostAccess.set("user-1:10:manage", {
-      hasAccess: false,
-      isOwner: false,
+  it("execute routes 403 without fleets.execute", async () => {
+    server = await startServer({
+      permissions: ["fleets.view", "fleets.manage"],
     });
-    state.hostAccess.set("user-1:11:manage", {
-      hasAccess: false,
-      isOwner: false,
+    const fleet = await createFleet(server);
+    const res = await server.request("POST", `/${fleet.id}/execute`, {
+      body: { command: "uptime" },
     });
-
-    const { execElevated } =
-      await import("../../../../src/backend/hosts/metrics-shared/exec-elevated.js");
-    (execElevated as ReturnType<typeof vi.fn>).mockResolvedValue({
-      code: 0,
-      stdout: "done",
-      stderr: "",
-    });
-
-    const res = await invoke("post", "/:id/packages", {
-      params: { id: "1" },
-      body: { action: "upgrade-all" },
-    });
-
-    const results = res.jsonBody?.results as Array<Record<string, unknown>>;
-    expect(results.every((r) => r.success === false)).toBe(true);
-    expect(String(results[0].error)).toMatch(/manage/);
-  });
-});
-
-describe("POST /:id/members", () => {
-  it("404s when the caller cannot access the target host", async () => {
-    state.hostAccess.set("user-1:99:connect", {
-      hasAccess: false,
-      isOwner: false,
-    });
-
-    const res = await invoke("post", "/:id/members", {
-      params: { id: "1" },
-      body: { hostId: 99 },
-    });
-    expect(res.statusCode).toBe(404);
+    expect(res.status).toBe(403);
   });
 });
 
@@ -413,8 +150,7 @@ describe("parseInventoryProbe", () => {
   });
 
   it("nulls uptimeSeconds when the value is not a bare integer", () => {
-    const out = "uptime_seconds=";
-    expect(parseInventoryProbe(out).uptimeSeconds).toBeNull();
+    expect(parseInventoryProbe("uptime_seconds=").uptimeSeconds).toBeNull();
   });
 
   it("ignores lines with no '=' separator", () => {
@@ -423,19 +159,18 @@ describe("parseInventoryProbe", () => {
   });
 });
 
-describe("buildRemoveCommand", () => {
-  it("builds the correct remove command per package manager", () => {
-    expect(buildRemoveCommand("apt", "curl")).toContain(
-      "apt-get -y remove curl",
-    );
-    expect(buildRemoveCommand("dnf", "curl")).toBe("dnf -y remove curl");
-    expect(buildRemoveCommand("yum", "curl")).toBe("yum -y remove curl");
-    expect(buildRemoveCommand("pacman", "curl")).toBe(
-      "pacman -R --noconfirm curl",
-    );
+describe("share target pickers", () => {
+  beforeEach(async () => {
+    server = await startServer();
   });
 
-  it("returns null when no package manager was detected", () => {
-    expect(buildRemoveCommand(null, "curl")).toBeNull();
+  it("lists users and roles through ctx.hosts", async () => {
+    const users = await server.request("GET", "/share-targets/users");
+    expect(users.status).toBe(200);
+    expect(users.body).toEqual({ users: [] });
+
+    const roles = await server.request("GET", "/share-targets/roles");
+    expect(roles.status).toBe(200);
+    expect(roles.body).toEqual({ roles: [] });
   });
 });