feat(backend): add PUT /api/sources/:sourceId

Add a PUT endpoint that inserts or fully replaces a user's source
config. Unlike PATCH (which deep-merges and requires an existing row),
PUT requires both `enabled` and `config`, performs an upsert via
INSERT ... ON CONFLICT DO UPDATE, and replaces config entirely.

- Add `upsertConfig` to user-sources data layer
- Add `upsertSourceConfig` to UserSessionManager
- Add `addSource` to UserSession for new source registration
- 12 new tests covering insert, replace, validation, and session refresh

Co-authored-by: Ona <no-reply@ona.com>

apps/aelis-backend/src/session/user-session-manager.ts

@@ -5,10 +5,10 @@ import merge from "lodash.merge"
 
 import type { Database } from "../db/index.ts"
 import type { FeedEnhancer } from "../enhancement/enhance-feed.ts"
-import type { FeedSourceProvider } from "./feed-source-provider.ts"
-
 import { InvalidSourceConfigError, SourceNotFoundError } from "../sources/errors.ts"
 import { sources } from "../sources/user-sources.ts"
+import type { FeedSourceProvider } from "./feed-source-provider.ts"
+
 import { UserSession } from "./user-session.ts"
 
 export interface UserSessionManagerConfig {
@@ -104,16 +104,18 @@ export class UserSessionManager {
 		// read stale config. Use SELECT FOR UPDATE or atomic jsonb merge if
 		// this becomes a problem.
 		let mergedConfig: Record<string, unknown> | undefined
-		if (update.config !== undefined && provider.configSchema) {
+		if (update.config !== undefined) {
 			const existing = await sources(this.db, userId).find(sourceId)
 			const existingConfig = (existing?.config ?? {}) as Record<string, unknown>
 			mergedConfig = merge({}, existingConfig, update.config)
 
+			if (provider.configSchema) {
 				const validated = provider.configSchema(mergedConfig)
 				if (validated instanceof type.errors) {
 					throw new InvalidSourceConfigError(sourceId, validated.summary)
 				}
 			}
+		}
 
 		// Throws SourceNotFoundError if the row doesn't exist
 		await sources(this.db, userId).updateConfig(sourceId, {
@@ -146,24 +148,23 @@ export class UserSessionManager {
 	async upsertSourceConfig(
 		userId: string,
 		sourceId: string,
-		data: { enabled: boolean; config?: unknown },
+		data: { enabled: boolean; config: unknown },
 	): Promise<void> {
 		const provider = this.providers.get(sourceId)
 		if (!provider) {
 			throw new SourceNotFoundError(sourceId, userId)
 		}
 
-		if (provider.configSchema && data.config !== undefined) {
+		if (provider.configSchema) {
 			const validated = provider.configSchema(data.config)
 			if (validated instanceof type.errors) {
 				throw new InvalidSourceConfigError(sourceId, validated.summary)
 			}
 		}
 
-		const config = data.config ?? {}
 		await sources(this.db, userId).upsertConfig(sourceId, {
 			enabled: data.enabled,
-			config,
+			config: data.config,
 		})
 
 		const session = this.sessions.get(userId)
@@ -171,7 +172,7 @@ export class UserSessionManager {
 			if (!data.enabled) {
 				session.removeSource(sourceId)
 			} else {
-				const source = await provider.feedSourceForUser(userId, config)
+				const source = await provider.feedSourceForUser(userId, data.config)
 				if (session.hasSource(sourceId)) {
 					session.replaceSource(sourceId, source)
 				} else {

apps/aelis-backend/src/sources/http.test.ts

@@ -217,31 +217,6 @@ describe("PATCH /api/sources/:sourceId", () => {
 		expect(body.error).toContain("Invalid JSON")
 	})
 
-	test("returns 400 when request body contains unknown fields", async () => {
-		activeStore = createInMemoryStore()
-		activeStore.seed(MOCK_USER_ID, "aelis.weather")
-		const { app } = createApp([createStubProvider("aelis.weather", weatherConfig)], MOCK_USER_ID)
-
-		const res = await patch(app, "aelis.weather", {
-			enabled: true,
-			unknownField: "hello",
-		})
-
-		expect(res.status).toBe(400)
-	})
-
-	test("returns 400 when weather config contains unknown fields", async () => {
-		activeStore = createInMemoryStore()
-		activeStore.seed(MOCK_USER_ID, "aelis.weather")
-		const { app } = createApp([createStubProvider("aelis.weather", weatherConfig)], MOCK_USER_ID)
-
-		const res = await patch(app, "aelis.weather", {
-			config: { units: "metric", unknownField: "hello" },
-		})
-
-		expect(res.status).toBe(400)
-	})
-
 	test("returns 400 when weather config fails validation", async () => {
 		activeStore = createInMemoryStore()
 		activeStore.seed(MOCK_USER_ID, "aelis.weather")
@@ -365,7 +340,7 @@ describe("PATCH /api/sources/:sourceId", () => {
 		removeSpy.mockRestore()
 	})
 
-	test("returns 400 when config is provided for source without schema", async () => {
+	test("accepts location source with arbitrary config (no schema)", async () => {
 		activeStore = createInMemoryStore()
 		activeStore.seed(MOCK_USER_ID, "aelis.location")
 		const { app } = createApp([createStubProvider("aelis.location")], MOCK_USER_ID)
@@ -374,19 +349,7 @@ describe("PATCH /api/sources/:sourceId", () => {
 			config: { something: "value" },
 		})
 
-		expect(res.status).toBe(400)
+		expect(res.status).toBe(204)
-	})
-
-	test("returns 400 when empty config is provided for source without schema", async () => {
-		activeStore = createInMemoryStore()
-		activeStore.seed(MOCK_USER_ID, "aelis.location")
-		const { app } = createApp([createStubProvider("aelis.location")], MOCK_USER_ID)
-
-		const res = await patch(app, "aelis.location", {
-			config: {},
-		})
-
-		expect(res.status).toBe(400)
 	})
 
 	test("updates enabled on location source", async () => {
@@ -460,31 +423,6 @@ describe("PUT /api/sources/:sourceId", () => {
 		expect(res.status).toBe(400)
 	})
 
-	test("returns 400 when request body contains unknown fields", async () => {
-		activeStore = createInMemoryStore()
-		const { app } = createApp([createStubProvider("aelis.weather", weatherConfig)], MOCK_USER_ID)
-
-		const res = await put(app, "aelis.weather", {
-			enabled: true,
-			config: { units: "metric" },
-			unknownField: "hello",
-		})
-
-		expect(res.status).toBe(400)
-	})
-
-	test("returns 400 when weather config contains unknown fields", async () => {
-		activeStore = createInMemoryStore()
-		const { app } = createApp([createStubProvider("aelis.weather", weatherConfig)], MOCK_USER_ID)
-
-		const res = await put(app, "aelis.weather", {
-			enabled: true,
-			config: { units: "metric", unknownField: "hello" },
-		})
-
-		expect(res.status).toBe(400)
-	})
-
 	test("returns 400 when config fails schema validation", async () => {
 		activeStore = createInMemoryStore()
 		const { app } = createApp([createStubProvider("aelis.weather", weatherConfig)], MOCK_USER_ID)
@@ -603,7 +541,7 @@ describe("PUT /api/sources/:sourceId", () => {
 		expect(session.hasSource("aelis.weather")).toBe(true)
 	})
 
-	test("returns 400 when config is provided for source without schema", async () => {
+	test("accepts location source with arbitrary config (no schema)", async () => {
 		activeStore = createInMemoryStore()
 		const { app } = createApp([createStubProvider("aelis.location")], MOCK_USER_ID)
 
@@ -612,29 +550,9 @@ describe("PUT /api/sources/:sourceId", () => {
 			config: { something: "value" },
 		})
 
-		expect(res.status).toBe(400)
-	})
-
-	test("returns 400 when empty config is provided for source without schema", async () => {
-		activeStore = createInMemoryStore()
-		const { app } = createApp([createStubProvider("aelis.location")], MOCK_USER_ID)
-
-		const res = await put(app, "aelis.location", {
-			enabled: true,
-			config: {},
-		})
-
-		expect(res.status).toBe(400)
-	})
-
-	test("returns 204 without config field for source without schema", async () => {
-		activeStore = createInMemoryStore()
-		const { app } = createApp([createStubProvider("aelis.location")], MOCK_USER_ID)
-
-		const res = await put(app, "aelis.location", {
-			enabled: true,
-		})
-
 		expect(res.status).toBe(204)
+		const row = activeStore.rows.get(`${MOCK_USER_ID}:aelis.location`)
+		expect(row).toBeDefined()
+		expect(row!.config).toEqual({ something: "value" })
 	})
 })

apps/aelis-backend/src/sources/http.ts

@@ -20,22 +20,15 @@ interface SourcesHttpHandlersDeps {
 }
 
 const UpdateSourceConfigRequestBody = type({
-	"+": "reject",
 	"enabled?": "boolean",
 	"config?": "unknown",
 })
 
 const ReplaceSourceConfigRequestBody = type({
-	"+": "reject",
 	enabled: "boolean",
 	config: "unknown",
 })
 
-const ReplaceSourceConfigNoConfigRequestBody = type({
-	"+": "reject",
-	enabled: "boolean",
-})
-
 export function registerSourcesHttpHandlers(
 	app: Hono,
 	{ sessionManager, authSessionMiddleware }: SourcesHttpHandlersDeps,
@@ -76,10 +69,6 @@ async function handleUpdateSource(c: Context<Env>) {
 		return c.json({ error: parsed.summary }, 400)
 	}
 
-	if (!provider.configSchema && "config" in parsed) {
-		return c.json({ error: `Source "${sourceId}" does not accept config` }, 400)
-	}
-
 	const { enabled, config: newConfig } = parsed
 	const user = c.get("user")!
 
@@ -121,16 +110,12 @@ async function handleReplaceSource(c: Context<Env>) {
 		return c.json({ error: "Invalid JSON" }, 400)
 	}
 
-	const schema = provider.configSchema
+	const parsed = ReplaceSourceConfigRequestBody(body)
-		? ReplaceSourceConfigRequestBody
-		: ReplaceSourceConfigNoConfigRequestBody
-	const parsed = schema(body)
 	if (parsed instanceof type.errors) {
 		return c.json({ error: parsed.summary }, 400)
 	}
 
-	const { enabled } = parsed
+	const { enabled, config } = parsed
-	const config = "config" in parsed ? parsed.config : undefined
 	const user = c.get("user")!
 
 	try {

apps/aelis-backend/src/tfl/provider.ts

@@ -8,7 +8,6 @@ export type TflSourceProviderOptions =
 	| { apiKey?: never; client: ITflApi }
 
 export const tflConfig = type({
-	"+": "reject",
 	"lines?": "string[]",
 })
 

apps/aelis-backend/src/weather/provider.ts

@@ -9,7 +9,6 @@ export interface WeatherSourceProviderOptions {
 }
 
 export const weatherConfig = type({
-	"+": "reject",
 	"units?": "'metric' | 'imperial'",
 	"hourlyLimit?": "number",
 	"dailyLimit?": "number",