feat: move network topology into a first-party plugin

src/backend/tests/plugins/bundled-plugin.test.ts

@@ -324,3 +324,53 @@ describe("bundled automations plugin", () => {
     expect(source).toMatch(/export async function deactivate/);
   });
 });
+
+describe("bundled network-topology plugin", () => {
+  it("ships a directory with a manifest and both entry points", () => {
+    const dir = path.join(getBundledPluginsDir(), "network-topology");
+
+    expect(fs.existsSync(path.join(dir, "manifest.json"))).toBe(true);
+    expect(fs.existsSync(path.join(dir, "backend", "index.mjs"))).toBe(true);
+    expect(fs.existsSync(path.join(dir, "frontend", "index.mjs"))).toBe(true);
+  });
+
+  it("has a manifest that passes the real validator", () => {
+    const { manifest, errors } = parseManifest(
+      readBundledManifest("network-topology"),
+    );
+
+    expect(errors).toEqual([]);
+    expect(manifest?.id).toBe("network-topology");
+    expect(manifest?.category).toBe("Infrastructure");
+  });
+
+  it("declares the transport-owner capability and qualifies for the tier", () => {
+    const { manifest } = parseManifest(readBundledManifest("network-topology"));
+
+    expect(manifest?.permissions).toContain(TRANSPORT_OWNER_CAPABILITY);
+    expect(isFirstParty("network-topology")).toBe(true);
+    expect(runsInProcess("network-topology", manifest!.permissions)).toBe(true);
+  });
+
+  it("contributes the network_graph tab the shell registers", () => {
+    const { manifest } = parseManifest(readBundledManifest("network-topology"));
+    const tab = manifest?.contributes?.tabs?.[0];
+
+    // The shell keys tab content off this id, so it has to stay "network_graph".
+    expect(tab?.id).toBe("network_graph");
+    expect(tab?.openFrom).toContain("rail");
+  });
+
+  it("exports activate and deactivate from its backend entry", () => {
+    const entry = path.join(
+      getBundledPluginsDir(),
+      "network-topology",
+      "backend",
+      "index.mjs",
+    );
+    const source = fs.readFileSync(entry, "utf8");
+
+    expect(source).toMatch(/export async function activate/);
+    expect(source).toMatch(/export async function deactivate/);
+  });
+});

src/backend/tests/plugins/first-party.test.ts

@@ -39,20 +39,21 @@ function manifest(overrides: Record<string, unknown> = {}) {
 }
 
 describe("first-party allowlist", () => {
-  it("contains only ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop, fleets and automations", () => {
+  it("contains only ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop, fleets, automations and network-topology", () => {
     expect([...FIRST_PARTY_PLUGIN_IDS].sort()).toEqual([
       "ai",
       "automations",
       "docker",
       "fleets",
       "host-metrics",
+      "network-topology",
       "proxmox",
       "remote-desktop",
       "ssh-terminal",
     ]);
   });
 
-  it("recognises ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop, fleets and automations and nothing else", () => {
+  it("recognises ssh-terminal, docker, host-metrics, ai, proxmox, remote-desktop, fleets, automations and network-topology and nothing else", () => {
     expect(isFirstParty("ssh-terminal")).toBe(true);
     expect(isFirstParty("docker")).toBe(true);
     expect(isFirstParty("host-metrics")).toBe(true);
@@ -61,6 +62,7 @@ describe("first-party allowlist", () => {
     expect(isFirstParty("remote-desktop")).toBe(true);
     expect(isFirstParty("fleets")).toBe(true);
     expect(isFirstParty("automations")).toBe(true);
+    expect(isFirstParty("network-topology")).toBe(true);
     expect(isFirstParty("ssh-terminal-pro")).toBe(false);
     expect(isFirstParty("community-plugin")).toBe(false);
     expect(isFirstParty("")).toBe(false);
@@ -85,6 +87,9 @@ describe("runsInProcess", () => {
     expect(runsInProcess("automations", [TRANSPORT_OWNER_CAPABILITY])).toBe(
       true,
     );
+    expect(
+      runsInProcess("network-topology", [TRANSPORT_OWNER_CAPABILITY]),
+    ).toBe(true);
 
     // On the list but not asking for it: stays in a worker, so the manifest
     // remains an honest description of what the plugin does.
@@ -96,6 +101,7 @@ describe("runsInProcess", () => {
     expect(runsInProcess("remote-desktop", ["hosts.read"])).toBe(false);
     expect(runsInProcess("fleets", ["hosts.read"])).toBe(false);
     expect(runsInProcess("automations", ["hosts.read"])).toBe(false);
+    expect(runsInProcess("network-topology", ["hosts.read"])).toBe(false);
 
     // Asking for it but not on the list.
     expect(
@@ -199,6 +205,18 @@ describe("manifest gate on the reserved capability", () => {
     expect(parsed?.id).toBe("automations");
   });
 
+  it("allows it for network-topology", () => {
+    const { manifest: parsed, errors } = parseManifest(
+      manifest({
+        id: "network-topology",
+        permissions: [TRANSPORT_OWNER_CAPABILITY],
+      }),
+    );
+
+    expect(errors).toEqual([]);
+    expect(parsed?.id).toBe("network-topology");
+  });
+
   it("still accepts an ordinary manifest that never mentions it", () => {
     const { manifest: parsed, errors } = parseManifest(
       manifest({ permissions: ["hosts.read"] }),

src/backend/tests/plugins/network-topology/routes.test.ts

@@ -0,0 +1,152 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import type { Request, Response, Router } from "express";
+
+const state = vi.hoisted(() => ({
+  currentUserId: "user-1" as string | undefined,
+  records: new Map<string, { userId: string; topology: string | null }>(),
+}));
+
+vi.mock("../../../database/db/index.js", () => ({ db: {} }));
+
+vi.mock("../../../utils/logger.js", () => ({
+  databaseLogger: {
+    error: vi.fn(),
+    warn: vi.fn(),
+    info: vi.fn(),
+    success: vi.fn(),
+  },
+}));
+
+vi.mock("../../../utils/auth-manager.js", () => ({
+  AuthManager: {
+    getInstance: () => ({
+      createAuthMiddleware:
+        () =>
+        (req: Record<string, unknown>, _res: unknown, next: () => void) => {
+          req.userId = state.currentUserId;
+          next();
+        },
+    }),
+  },
+}));
+
+vi.mock("../../../database/repositories/factory.js", () => ({
+  createCurrentNetworkTopologyRepository: () => ({
+    findByUserId: async (userId: string) => state.records.get(userId) ?? null,
+    upsertForUser: async (userId: string, topology: string) => {
+      state.records.set(userId, { userId, topology });
+    },
+  }),
+}));
+
+vi.mock("../../../database/routes/network-topology-dispatch.js", () => ({
+  registerNetworkTopologyRouter: vi.fn(),
+  unregisterNetworkTopologyRouter: vi.fn(),
+}));
+
+const { router } =
+  await import("../../../../../plugins/network-topology/backend/routes.js");
+
+function findLayer(method: string, path: string) {
+  const stack = (router as unknown as Router).stack as Array<{
+    route?: {
+      path: string;
+      methods: Record<string, boolean>;
+      stack: Array<{ handle: (req: Request, res: Response) => unknown }>;
+    };
+  }>;
+  const layer = stack.find(
+    (l) => l.route?.path === path && l.route?.methods[method],
+  );
+  if (!layer?.route) throw new Error(`No route for ${method} ${path}`);
+  return layer.route.stack[layer.route.stack.length - 1].handle;
+}
+
+function makeReqRes(overrides: { body?: Record<string, unknown> }) {
+  const req = {
+    userId: state.currentUserId,
+    body: overrides.body ?? {},
+    headers: {},
+  } as unknown as Request;
+
+  const res = {
+    statusCode: 200,
+    jsonBody: null as unknown,
+    status(code: number) {
+      (this as unknown as { statusCode: number }).statusCode = code;
+      return this;
+    },
+    json(payload: unknown) {
+      (this as unknown as { jsonBody: unknown }).jsonBody = payload;
+      return this;
+    },
+  } as unknown as Response & { statusCode: number; jsonBody: unknown };
+
+  return { req, res };
+}
+
+async function invoke(
+  method: string,
+  path: string,
+  overrides: { body?: Record<string, unknown> } = {},
+) {
+  const handler = findLayer(method, path);
+  const { req, res } = makeReqRes(overrides);
+  await handler(req, res);
+  return res as unknown as {
+    statusCode: number;
+    jsonBody: Record<string, unknown> | null;
+  };
+}
+
+beforeEach(() => {
+  state.currentUserId = "user-1";
+  state.records = new Map();
+});
+
+describe("GET /network-topology", () => {
+  it("returns null when the user has no saved topology", async () => {
+    const res = await invoke("get", "/");
+    expect(res.jsonBody).toBeNull();
+  });
+
+  it("returns the parsed topology when one exists", async () => {
+    state.records.set("user-1", {
+      userId: "user-1",
+      topology: JSON.stringify({ nodes: [{ id: "host-1" }], edges: [] }),
+    });
+
+    const res = await invoke("get", "/");
+    expect(res.jsonBody).toEqual({ nodes: [{ id: "host-1" }], edges: [] });
+  });
+
+  it("rejects an unauthenticated request", async () => {
+    state.currentUserId = undefined;
+    const res = await invoke("get", "/");
+    expect(res.statusCode).toBe(401);
+  });
+});
+
+describe("POST /network-topology", () => {
+  it("saves the topology and returns success", async () => {
+    const res = await invoke("post", "/", {
+      body: { topology: { nodes: [], edges: [] } },
+    });
+
+    expect(res.jsonBody).toEqual({ success: true });
+    expect(state.records.get("user-1")?.topology).toBe(
+      JSON.stringify({ nodes: [], edges: [] }),
+    );
+  });
+
+  it("rejects a request with no topology", async () => {
+    const res = await invoke("post", "/", { body: {} });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("rejects an unauthenticated request", async () => {
+    state.currentUserId = undefined;
+    const res = await invoke("post", "/", { body: { topology: {} } });
+    expect(res.statusCode).toBe(401);
+  });
+});