fix(session): tighten http error contracts (#27308)

2026-05-13 16:48:18 +05:30
parent d488e3fd2a
commit 5b2b300602
4 changed files with 104 additions and 42 deletions
@@ -212,6 +212,14 @@ describe("session HttpApi", () => {
        expect(get.status).toBe(404)
        expect(yield* responseJson(get)).toEqual(missingSessionBody)

+        const children = yield* request(pathFor(SessionPaths.children, { sessionID: missingSession }), { headers })
+        expect(children.status).toBe(404)
+        expect(yield* responseJson(children)).toEqual(missingSessionBody)
+
+        const todo = yield* request(pathFor(SessionPaths.todo, { sessionID: missingSession }), { headers })
+        expect(todo.status).toBe(404)
+        expect(yield* responseJson(todo)).toEqual(missingSessionBody)
+
        const messages = yield* request(pathFor(SessionPaths.messages, { sessionID: missingSession }), { headers })
        expect(messages.status).toBe(404)
        expect(yield* responseJson(messages)).toEqual(missingSessionBody)
@@ -223,6 +231,21 @@ describe("session HttpApi", () => {
        expect(remove.status).toBe(404)
        expect(yield* responseJson(remove)).toEqual(missingSessionBody)

+        const prompt = yield* request(pathFor(SessionPaths.prompt, { sessionID: missingSession }), {
+          headers: { ...headers, "content-type": "application/json" },
+          method: "POST",
+          body: JSON.stringify({ agent: "build", noReply: true, parts: [{ type: "text", text: "hello" }] }),
+        })
+        expect(prompt.status).toBe(404)
+        expect(yield* responseJson(prompt)).toEqual(missingSessionBody)
+
+        const abort = yield* request(pathFor(SessionPaths.abort, { sessionID: missingSession }), {
+          headers,
+          method: "POST",
+        })
+        expect(abort.status).toBe(200)
+        expect(yield* responseJson(abort)).toBe(true)
+
        const session = yield* createSession({ title: "missing message" })
        const missingMessage = MessageID.ascending()
        const message = yield* request(
@@ -530,6 +553,32 @@ describe("session HttpApi", () => {
    { git: true, config: { formatter: false, lsp: false } },
  )

+  it.instance(
+    "rejects part updates whose path and body ids disagree",
+    () =>
+      Effect.gen(function* () {
+        const test = yield* TestInstance
+        const headers = { "x-opencode-directory": test.directory, "content-type": "application/json" }
+        const session = yield* createSession({ title: "part mismatch" })
+        const message = yield* createTextMessage(session.id, "first")
+        const response = yield* request(
+          pathFor(SessionPaths.updatePart, {
+            sessionID: session.id,
+            messageID: message.info.id,
+            partID: message.part.id,
+          }),
+          {
+            method: "PATCH",
+            headers,
+            body: JSON.stringify({ ...message.part, id: PartID.ascending() }),
+          },
+        )
+
+        expect(response.status).toBe(400)
+      }),
+    { git: true, config: { formatter: false, lsp: false } },
+  )
+
  it.instance(
    "serves remaining non-LLM session mutation routes",
    () =>