2026-04-29 19:49:06 +02:00
|
|
|
{
|
|
|
|
|
"name": "mike-backend",
|
|
|
|
|
"version": "1.0.0",
|
|
|
|
|
"private": true,
|
|
|
|
|
"scripts": {
|
|
|
|
|
"dev": "tsx watch src/index.ts",
|
|
|
|
|
"build": "tsc",
|
2026-07-20 10:42:28 -07:00
|
|
|
"start": "node dist/index.js",
|
test: route-level integration tests + app/index split
Ports the backend route-level integration suites from the amal66 fork
(index: Open-Legal-Products/mike#205), adapted from the fork's
apps/api modules/services layout to this repo's monolithic
backend/src/routes/*.ts layout.
app/index split (the only production change; mechanical, zero behavior
change): backend/src/index.ts previously built the express app and
called app.listen at the bottom. Everything except the listen call
moved verbatim into backend/src/app.ts, which now exports `app` (same
middleware order, same routes, same rate-limiter setup, dotenv/config
still imported first). index.ts is now a tiny entry that imports
{ app } and calls listen with the same log line. `npm run build` still
emits dist/index.js and the `start` script is unchanged.
New suites under backend/src/__tests__/integration/ (94 tests):
- health.test.ts (5): /health, requireAuth 401 paths, 404 fallthrough
- chat.routes.test.ts (6): POST /chat validation + SSE happy/error paths
- projects.routes.test.ts (18): overview/create/detail/patch/delete,
sharing normalisation, ownership guards
- projectChat.routes.test.ts (3): project access guard + SSE paths
- tabular.routes.test.ts (31): review CRUD, access guards,
document-access filtering, missing_api_key guards
- user.routes.test.ts (27): profile, API-key crypto boundary, MFA
guards, export/deletion endpoints
- documentsUpload.routes.test.ts (4): upload validation + download-zip
bounds/access
- access.supabase.test.ts (1) + stack.supabase.test.ts (4): gated on
SUPABASE_TEST_URL / SUPABASE_TEST_SERVICE_ROLE_KEY (stack suite also
needs SUPABASE_TEST_ANON_KEY); describe.skip otherwise
- scripts/test-stack.sh + `npm run test:stack`: reads a running
`supabase status -o json` and runs the gated suites
Adds supertest + @types/supertest as devDependencies.
Dropped relative to the fork (subjects that do not exist in this repo):
- orgs.routes, credits.concurrency.supabase, dmsConnectors suites
(fork-only features)
- all credit-reservation cases (429 CREDIT_LIMIT_EXCEEDED,
reserve-then-refund) in chat/projectChat: no credit system here
- health /ready case: no /ready endpoint here
- org-membership project access case: no org model here
- upload magic-byte validation cases: this repo validates extension
only (the fork adds content sniffing; replaced with a missing-file
400 case)
- download-zip 50-document cap case: no cap here (replaced with a
no-accessible-documents 404 case)
- stack.supabase PUBLIC_TABLES updated to this repo's schema; the
fork's credit-RPC coverage is n/a
Verified locally: backend `npm test` -> 8 files passed, 2 skipped;
106 tests passed, 5 skipped (gated suites skip without env).
`npm run build` passes. The gated suites were additionally run against
a live local Supabase stack: 2 files, 5/5 tests passed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 11:00:01 -07:00
|
|
|
"test": "vitest run",
|
2026-07-22 10:22:26 -07:00
|
|
|
"test:stack": "bash scripts/test-stack.sh",
|
test: unit tests for access, storage, userApiKeys, chat doc resolution
Ported from the amal66 fork (see index Open-Legal-Products/mike#205)
onto current main, adapted to this repo's backend/ layout
(apps/api/src/lib -> backend/src/lib), plus a v8 coverage ratchet.
Suites ported (51 new tests, verified locally):
- access.test.ts (7): owner/shared/private project access, doc access,
review sharing, document-ID filtering. Dropped the fork's "org RBAC"
describe block (7 cases) — org_id/org_members multi-tenancy and the
role/canManage fields do not exist in this repo's access.ts.
- storage.test.ts (25): filename normalization/sanitization, RFC 5987
encoding, Content-Disposition, storage key helpers. Dropped the fork's
vi.mock of lib/env — this repo has no env module; storage reads
process.env directly and the tested helpers are pure.
- userApiKeys.test.ts (10): normalizeApiKeyProvider + hasEnvApiKey.
Added a beforeEach env clear so shell-exported API keys can't leak
into assertions.
- chatTypes.test.ts (9): resolveDoc/resolveDocLabel, which live in
lib/chat/types.ts here (the fork's lib/chatTools.ts equivalent).
Dropped generateSpotlightNonce cases (2) — no such export here.
Suites dropped entirely (subject not present in this repo):
- upload.test.ts — tested hasMagicBytes; this repo's lib/upload.ts is
only the multer middleware and exports no magic-byte checker.
- userSettings.test.ts — tested resolveTabularModel (fork-only keyed-
provider fallback); this repo resolves tabular_model via
resolveModel with a static default.
Coverage ratchet: vitest.config.mts adds v8 coverage over src/lib/**
with floors measured against this tree (2.58% stmts, 2.00% branches,
4.61% funcs, 2.58% lines -> floors 2/2/4/2). Full suite: 5 files,
63 tests passing (incl. the pre-existing 12 in downloadTokens.test.ts);
npm run test:coverage and npm run build both pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 10:48:53 -07:00
|
|
|
"test:coverage": "vitest run --coverage"
|
2026-04-29 19:49:06 +02:00
|
|
|
},
|
|
|
|
|
"dependencies": {
|
|
|
|
|
"@anthropic-ai/sdk": "^0.90.0",
|
|
|
|
|
"@aws-sdk/client-s3": "^3.787.0",
|
|
|
|
|
"@aws-sdk/s3-request-presigner": "^3.787.0",
|
|
|
|
|
"@google/genai": "^1.50.1",
|
2026-06-15 17:34:58 +08:00
|
|
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
2026-04-29 19:49:06 +02:00
|
|
|
"@supabase/supabase-js": "^2.49.4",
|
|
|
|
|
"cors": "^2.8.5",
|
|
|
|
|
"docx": "^9.5.0",
|
|
|
|
|
"dotenv": "^17.4.1",
|
|
|
|
|
"express": "^4.21.2",
|
2026-05-08 20:45:16 +08:00
|
|
|
"express-rate-limit": "^8.5.1",
|
2026-04-29 19:49:06 +02:00
|
|
|
"fast-diff": "^1.3.0",
|
|
|
|
|
"fast-xml-parser": "^5.7.1",
|
2026-05-08 20:45:16 +08:00
|
|
|
"helmet": "^8.1.0",
|
2026-04-29 19:49:06 +02:00
|
|
|
"jszip": "^3.10.1",
|
|
|
|
|
"libreoffice-convert": "^1.6.0",
|
|
|
|
|
"mammoth": "^1.9.0",
|
|
|
|
|
"multer": "^1.4.5-lts.2",
|
|
|
|
|
"pdfjs-dist": "^4.10.38",
|
2026-06-15 17:34:58 +08:00
|
|
|
"resend": "^4.5.1",
|
2026-07-04 23:24:31 +08:00
|
|
|
"xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
|
2026-06-15 17:34:58 +08:00
|
|
|
"zod": "^3.25.76"
|
2026-04-29 19:49:06 +02:00
|
|
|
},
|
|
|
|
|
"devDependencies": {
|
|
|
|
|
"@types/cors": "^2.8.17",
|
|
|
|
|
"@types/express": "^4.17.21",
|
|
|
|
|
"@types/multer": "^1.4.12",
|
|
|
|
|
"@types/node": "^22.14.1",
|
test: route-level integration tests + app/index split
Ports the backend route-level integration suites from the amal66 fork
(index: Open-Legal-Products/mike#205), adapted from the fork's
apps/api modules/services layout to this repo's monolithic
backend/src/routes/*.ts layout.
app/index split (the only production change; mechanical, zero behavior
change): backend/src/index.ts previously built the express app and
called app.listen at the bottom. Everything except the listen call
moved verbatim into backend/src/app.ts, which now exports `app` (same
middleware order, same routes, same rate-limiter setup, dotenv/config
still imported first). index.ts is now a tiny entry that imports
{ app } and calls listen with the same log line. `npm run build` still
emits dist/index.js and the `start` script is unchanged.
New suites under backend/src/__tests__/integration/ (94 tests):
- health.test.ts (5): /health, requireAuth 401 paths, 404 fallthrough
- chat.routes.test.ts (6): POST /chat validation + SSE happy/error paths
- projects.routes.test.ts (18): overview/create/detail/patch/delete,
sharing normalisation, ownership guards
- projectChat.routes.test.ts (3): project access guard + SSE paths
- tabular.routes.test.ts (31): review CRUD, access guards,
document-access filtering, missing_api_key guards
- user.routes.test.ts (27): profile, API-key crypto boundary, MFA
guards, export/deletion endpoints
- documentsUpload.routes.test.ts (4): upload validation + download-zip
bounds/access
- access.supabase.test.ts (1) + stack.supabase.test.ts (4): gated on
SUPABASE_TEST_URL / SUPABASE_TEST_SERVICE_ROLE_KEY (stack suite also
needs SUPABASE_TEST_ANON_KEY); describe.skip otherwise
- scripts/test-stack.sh + `npm run test:stack`: reads a running
`supabase status -o json` and runs the gated suites
Adds supertest + @types/supertest as devDependencies.
Dropped relative to the fork (subjects that do not exist in this repo):
- orgs.routes, credits.concurrency.supabase, dmsConnectors suites
(fork-only features)
- all credit-reservation cases (429 CREDIT_LIMIT_EXCEEDED,
reserve-then-refund) in chat/projectChat: no credit system here
- health /ready case: no /ready endpoint here
- org-membership project access case: no org model here
- upload magic-byte validation cases: this repo validates extension
only (the fork adds content sniffing; replaced with a missing-file
400 case)
- download-zip 50-document cap case: no cap here (replaced with a
no-accessible-documents 404 case)
- stack.supabase PUBLIC_TABLES updated to this repo's schema; the
fork's credit-RPC coverage is n/a
Verified locally: backend `npm test` -> 8 files passed, 2 skipped;
106 tests passed, 5 skipped (gated suites skip without env).
`npm run build` passes. The gated suites were additionally run against
a live local Supabase stack: 2 files, 5/5 tests passed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 11:00:01 -07:00
|
|
|
"@types/supertest": "^7.2.1",
|
test: unit tests for access, storage, userApiKeys, chat doc resolution
Ported from the amal66 fork (see index Open-Legal-Products/mike#205)
onto current main, adapted to this repo's backend/ layout
(apps/api/src/lib -> backend/src/lib), plus a v8 coverage ratchet.
Suites ported (51 new tests, verified locally):
- access.test.ts (7): owner/shared/private project access, doc access,
review sharing, document-ID filtering. Dropped the fork's "org RBAC"
describe block (7 cases) — org_id/org_members multi-tenancy and the
role/canManage fields do not exist in this repo's access.ts.
- storage.test.ts (25): filename normalization/sanitization, RFC 5987
encoding, Content-Disposition, storage key helpers. Dropped the fork's
vi.mock of lib/env — this repo has no env module; storage reads
process.env directly and the tested helpers are pure.
- userApiKeys.test.ts (10): normalizeApiKeyProvider + hasEnvApiKey.
Added a beforeEach env clear so shell-exported API keys can't leak
into assertions.
- chatTypes.test.ts (9): resolveDoc/resolveDocLabel, which live in
lib/chat/types.ts here (the fork's lib/chatTools.ts equivalent).
Dropped generateSpotlightNonce cases (2) — no such export here.
Suites dropped entirely (subject not present in this repo):
- upload.test.ts — tested hasMagicBytes; this repo's lib/upload.ts is
only the multer middleware and exports no magic-byte checker.
- userSettings.test.ts — tested resolveTabularModel (fork-only keyed-
provider fallback); this repo resolves tabular_model via
resolveModel with a static default.
Coverage ratchet: vitest.config.mts adds v8 coverage over src/lib/**
with floors measured against this tree (2.58% stmts, 2.00% branches,
4.61% funcs, 2.58% lines -> floors 2/2/4/2). Full suite: 5 files,
63 tests passing (incl. the pre-existing 12 in downloadTokens.test.ts);
npm run test:coverage and npm run build both pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 10:48:53 -07:00
|
|
|
"@vitest/coverage-v8": "^4.1.9",
|
2026-04-29 19:49:06 +02:00
|
|
|
"prettier": "^3.8.1",
|
test: route-level integration tests + app/index split
Ports the backend route-level integration suites from the amal66 fork
(index: Open-Legal-Products/mike#205), adapted from the fork's
apps/api modules/services layout to this repo's monolithic
backend/src/routes/*.ts layout.
app/index split (the only production change; mechanical, zero behavior
change): backend/src/index.ts previously built the express app and
called app.listen at the bottom. Everything except the listen call
moved verbatim into backend/src/app.ts, which now exports `app` (same
middleware order, same routes, same rate-limiter setup, dotenv/config
still imported first). index.ts is now a tiny entry that imports
{ app } and calls listen with the same log line. `npm run build` still
emits dist/index.js and the `start` script is unchanged.
New suites under backend/src/__tests__/integration/ (94 tests):
- health.test.ts (5): /health, requireAuth 401 paths, 404 fallthrough
- chat.routes.test.ts (6): POST /chat validation + SSE happy/error paths
- projects.routes.test.ts (18): overview/create/detail/patch/delete,
sharing normalisation, ownership guards
- projectChat.routes.test.ts (3): project access guard + SSE paths
- tabular.routes.test.ts (31): review CRUD, access guards,
document-access filtering, missing_api_key guards
- user.routes.test.ts (27): profile, API-key crypto boundary, MFA
guards, export/deletion endpoints
- documentsUpload.routes.test.ts (4): upload validation + download-zip
bounds/access
- access.supabase.test.ts (1) + stack.supabase.test.ts (4): gated on
SUPABASE_TEST_URL / SUPABASE_TEST_SERVICE_ROLE_KEY (stack suite also
needs SUPABASE_TEST_ANON_KEY); describe.skip otherwise
- scripts/test-stack.sh + `npm run test:stack`: reads a running
`supabase status -o json` and runs the gated suites
Adds supertest + @types/supertest as devDependencies.
Dropped relative to the fork (subjects that do not exist in this repo):
- orgs.routes, credits.concurrency.supabase, dmsConnectors suites
(fork-only features)
- all credit-reservation cases (429 CREDIT_LIMIT_EXCEEDED,
reserve-then-refund) in chat/projectChat: no credit system here
- health /ready case: no /ready endpoint here
- org-membership project access case: no org model here
- upload magic-byte validation cases: this repo validates extension
only (the fork adds content sniffing; replaced with a missing-file
400 case)
- download-zip 50-document cap case: no cap here (replaced with a
no-accessible-documents 404 case)
- stack.supabase PUBLIC_TABLES updated to this repo's schema; the
fork's credit-RPC coverage is n/a
Verified locally: backend `npm test` -> 8 files passed, 2 skipped;
106 tests passed, 5 skipped (gated suites skip without env).
`npm run build` passes. The gated suites were additionally run against
a live local Supabase stack: 2 files, 5/5 tests passed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 11:00:01 -07:00
|
|
|
"supertest": "^7.2.2",
|
2026-04-29 19:49:06 +02:00
|
|
|
"tsx": "^4.19.3",
|
2026-07-20 10:42:28 -07:00
|
|
|
"typescript": "^5.8.3",
|
|
|
|
|
"vitest": "^4.1.9"
|
2026-05-08 20:45:16 +08:00
|
|
|
},
|
|
|
|
|
"license": "AGPL-3.0-only"
|
2026-04-29 19:49:06 +02:00
|
|
|
}
|