Add comprehensive session isolation testing suite

TEST_SESSION_ISOLATION.md

@@ -0,0 +1,336 @@
+# 🧪 Session Isolation Testing Guide
+
+## Test Scenario: Verify Per-User Session Isolation
+
+This guide will help you test that different users have completely isolated sessions in your IDWeekAgents app.
+
+---
+
+## Prerequisites
+
+✅ App is running at: https://huggingface.co/spaces/John-jero/IDWeekAgents  
+✅ You have at least 2 test user accounts (from AUTH_CREDENTIALS)  
+✅ Two browser windows (or one normal + one incognito)
+
+---
+
+## Test Accounts Available
+
+Based on your AUTH_CREDENTIALS, use any two different accounts:
+```
+Format: username:password
+
+Example accounts (if you followed the setup):
+- user1:password1
+- user2:password2
+- doctor1:pass123
+- pharmacist:stewardship
+```
+
+---
+
+## 🔬 Test Suite
+
+### TEST 1: Simple Chat Isolation ✨ (Should Work Now!)
+
+**Purpose:** Verify that each user has their own chat history in Simple Chat
+
+**Steps:**
+
+1. **Browser 1 (User A):**
+   - Go to: https://huggingface.co/spaces/John-jero/IDWeekAgents
+   - Login with first account (e.g., `user1:password1`)
+   - Click on "Simple Chat" tab
+   - Send message: `Hello, I'm User 1!`
+   - You should see the bot's response
+   - Send another message: `This is my private conversation`
+   
+2. **Browser 2 (User B):**
+   - Open incognito window or different browser
+   - Go to: https://huggingface.co/spaces/John-jero/IDWeekAgents
+   - Login with second account (e.g., `user2:password2`)
+   - Click on "Simple Chat" tab
+   - **CHECK:** Chat should be EMPTY (you should NOT see User 1's messages)
+   - Send message: `Hello, I'm User 2!`
+   - You should see the bot's response
+   
+3. **Verify:**
+   - ✅ Browser 1 should ONLY show User 1's messages
+   - ✅ Browser 2 should ONLY show User 2's messages
+   - ✅ No cross-contamination between users
+
+**Expected Result:** ✅ PASS - Each user sees only their own chat history
+
+**If it fails:** ⚠️ The simple chat isolation didn't work. Check console logs.
+
+---
+
+### TEST 2: Deployed Agent Chat Isolation ✨ (Should Work Now!)
+
+**Purpose:** Verify that deployed agent chats are isolated per user
+
+**Prerequisites:** You need at least one deployed agent in the app
+
+**Steps:**
+
+1. **Browser 1 (User A):**
+   - Go to "Agent Builder" tab
+   - Build a simple agent (or use existing agent)
+   - Deploy it by clicking "Save"
+   - Go to "Chat Panel" tab
+   - Select your agent from dropdown
+   - Chat with it: `Hi, I'm testing User A`
+   
+2. **Browser 2 (User B):**
+   - Login as different user
+   - Go to "Chat Panel" tab
+   - **CHECK:** The dropdown should show available agents
+   - Select an agent
+   - **CHECK:** Chat history should be EMPTY (no User A messages)
+   - Chat with it: `Hi, I'm testing User B`
+   
+3. **Verify:**
+   - ✅ Each user has separate chat history with the same agent
+   - ✅ User B doesn't see User A's conversation
+
+**Expected Result:** ✅ PASS - Agent chats are isolated per user
+
+**If it fails:** ⚠️ Check if chatpanel_handle is being called correctly
+
+---
+
+### TEST 3: Agent Builder Isolation ⚠️ (May Not Work Yet)
+
+**Purpose:** Verify that agent building is isolated per user
+
+**Steps:**
+
+1. **Browser 1 (User A):**
+   - Go to "Agent Builder" tab
+   - Create an agent:
+     - Name: `User1 Agent`
+     - Mission: `Help User 1 with tasks`
+   - Click "Build Agent"
+   
+2. **Browser 2 (User B):**
+   - Login as different user
+   - Go to "Agent Builder" tab
+   - **CHECK:** The builder should be empty or have User B's agents
+   - **CHECK:** "Active Agents" should NOT show "User1 Agent"
+   - Create different agent:
+     - Name: `User2 Agent`
+     - Mission: `Help User 2 with tasks`
+   
+3. **Verify:**
+   - ✅ User A sees only their agents
+   - ✅ User B sees only their agents
+
+**Expected Result:** ⚠️ May FAIL - This feature needs more updates (see guide)
+
+---
+
+### TEST 4: Concurrent User Activity 🔥
+
+**Purpose:** Verify users can work simultaneously without interference
+
+**Steps:**
+
+1. **Both browsers simultaneously:**
+   - User A: Chat in Simple Chat
+   - User B: Chat in Simple Chat at the same time
+   - Both users send messages back and forth
+
+2. **Verify:**
+   - ✅ Both users can chat simultaneously
+   - ✅ No crashes or errors
+   - ✅ No messages mixed up between users
+   - ✅ Each user's responses are correct and isolated
+
+**Expected Result:** ✅ PASS - Concurrent usage works smoothly
+
+---
+
+### TEST 5: Session Persistence
+
+**Purpose:** Verify that data persists during the session
+
+**Steps:**
+
+1. **Browser 1 (User A):**
+   - Chat in Simple Chat: `Message 1`
+   - Navigate to "Agent Builder" tab
+   - Navigate back to "Simple Chat" tab
+   - **CHECK:** Your chat history should still be there
+   
+2. **Refresh the page:**
+   - Refresh the browser (F5)
+   - Login again
+   - Go to "Simple Chat"
+   - **CHECK:** Chat history is cleared (expected - sessions are in-memory)
+
+**Expected Result:** 
+- ✅ Session persists during navigation
+- ✅ Session clears after refresh (expected behavior)
+
+---
+
+### TEST 6: Clear Chat Isolation
+
+**Purpose:** Verify that clearing chat only affects the current user
+
+**Steps:**
+
+1. **Browser 1 (User A):**
+   - Chat in Simple Chat with several messages
+   
+2. **Browser 2 (User B):**
+   - Chat in Simple Chat with several messages
+   
+3. **Browser 1 (User A):**
+   - Click "Clear" button (if available)
+   - **CHECK:** Only User A's chat is cleared
+   
+4. **Browser 2 (User B):**
+   - **CHECK:** User B's chat is still there (unchanged)
+
+**Expected Result:** ✅ PASS - Clear only affects current user
+
+---
+
+## 📊 Test Results Template
+
+Copy and fill this out:
+
+```
+🧪 SESSION ISOLATION TEST RESULTS
+Date: ___________
+Tester: ___________
+
+[ ] TEST 1: Simple Chat Isolation
+    Status: PASS / FAIL
+    Notes: ___________
+
+[ ] TEST 2: Deployed Agent Chat Isolation
+    Status: PASS / FAIL
+    Notes: ___________
+
+[ ] TEST 3: Agent Builder Isolation
+    Status: PASS / FAIL / SKIPPED
+    Notes: ___________
+
+[ ] TEST 4: Concurrent User Activity
+    Status: PASS / FAIL
+    Notes: ___________
+
+[ ] TEST 5: Session Persistence
+    Status: PASS / FAIL
+    Notes: ___________
+
+[ ] TEST 6: Clear Chat Isolation
+    Status: PASS / FAIL
+    Notes: ___________
+
+Overall Status: ___________
+Issues Found: ___________
+```
+
+---
+
+## 🐛 Troubleshooting
+
+### Issue: Both users see the same chat
+**Cause:** Session isolation not working
+**Solution:** 
+1. Check browser console for errors
+2. Verify AUTH_CREDENTIALS is set in HF Spaces
+3. Check that you're using DIFFERENT user accounts
+
+### Issue: "request has no attribute username"
+**Cause:** Authentication not enabled or user not logged in
+**Solution:**
+1. Ensure you're logged in with valid credentials
+2. Check AUTH_CREDENTIALS secret in HF Spaces settings
+
+### Issue: App crashes with multiple users
+**Cause:** Race condition or thread safety issue
+**Solution:**
+1. Check server logs in HF Spaces
+2. Report the error stack trace
+
+---
+
+## 📈 What to Expect
+
+### ✅ SHOULD WORK (Implemented):
+- Simple Chat isolation
+- Deployed Agent Chat isolation
+- Concurrent user access
+- Thread-safe operations
+
+### ⚠️ MAY NOT WORK YET (Needs more updates):
+- Agent Builder isolation
+- Patient data isolation
+- Other advanced features
+
+---
+
+## 🎯 Success Criteria
+
+**Minimum Requirements:**
+- ✅ TEST 1 (Simple Chat): MUST PASS
+- ✅ TEST 2 (Agent Chat): MUST PASS
+- ✅ TEST 4 (Concurrent): MUST PASS
+
+**Nice to Have:**
+- ✅ TEST 3, 5, 6: Would be great but may need more work
+
+---
+
+## 📝 Quick Test Script
+
+**Super Quick 2-Minute Test:**
+
+1. Open app in 2 browsers
+2. Login as user1 in browser 1
+3. Login as user2 in browser 2
+4. Both go to "Simple Chat"
+5. Both send: "Hello from [username]"
+6. Each should see ONLY their own message
+
+**If this works:** ✅ Session isolation is working!
+**If this fails:** ❌ Need to debug
+
+---
+
+## 🆘 Need Help?
+
+If tests fail or you see issues:
+
+1. **Check console logs:**
+   - Open browser DevTools (F12)
+   - Look for errors in Console tab
+
+2. **Check HF Spaces logs:**
+   - Go to your space page
+   - Click "Logs" tab
+   - Look for Python errors
+
+3. **Verify setup:**
+   - AUTH_CREDENTIALS secret is set
+   - Using different user accounts
+   - Both logged in successfully
+
+---
+
+## 🎉 Expected Outcome
+
+After running these tests:
+- You'll know exactly what's working
+- You'll know what still needs work
+- You'll have concrete examples for debugging
+
+**Goal:** Tests 1, 2, and 4 should PASS ✅
+
+---
+
+Ready to test? Start with the Quick Test Script above! 🚀

test_isolation_automated.py

@@ -0,0 +1,249 @@
+"""
+Automated Session Isolation Tester
+===================================
+
+This script simulates multiple users and verifies that their sessions
+are properly isolated. Run this before manual testing.
+
+Usage:
+    python test_isolation_automated.py
+"""
+
+from user_session_manager import session_manager, SessionKeys
+from session_helpers import get_current_username
+import sys
+
+
+class MockRequest:
+    """Mock Gradio request object for testing."""
+    def __init__(self, username):
+        self.username = username
+
+
+def test_basic_isolation():
+    """Test that basic session isolation works."""
+    print("\n🧪 TEST 1: Basic Session Isolation")
+    print("-" * 50)
+    
+    # Simulate two users
+    user1_req = MockRequest("user1")
+    user2_req = MockRequest("user2")
+    
+    # User 1 stores data
+    session_manager.set_user_data("user1", SessionKeys.SIMPLE_CHAT_HISTORY, [
+        ["Hi", "Hello User 1!"]
+    ])
+    
+    # User 2 stores different data
+    session_manager.set_user_data("user2", SessionKeys.SIMPLE_CHAT_HISTORY, [
+        ["Hey", "Hello User 2!"]
+    ])
+    
+    # Verify isolation
+    user1_history = session_manager.get_user_data("user1", SessionKeys.SIMPLE_CHAT_HISTORY)
+    user2_history = session_manager.get_user_data("user2", SessionKeys.SIMPLE_CHAT_HISTORY)
+    
+    print(f"User 1 history: {user1_history}")
+    print(f"User 2 history: {user2_history}")
+    
+    if user1_history != user2_history:
+        print("✅ PASS: Users have different data")
+        return True
+    else:
+        print("❌ FAIL: Users have same data!")
+        return False
+
+
+def test_concurrent_updates():
+    """Test that concurrent updates don't interfere."""
+    print("\n🧪 TEST 2: Concurrent Updates")
+    print("-" * 50)
+    
+    # Clear previous data
+    session_manager.clear_user_data("user1")
+    session_manager.clear_user_data("user2")
+    
+    # Simulate rapid concurrent updates
+    for i in range(10):
+        session_manager.set_user_data("user1", f"key_{i}", f"user1_value_{i}")
+        session_manager.set_user_data("user2", f"key_{i}", f"user2_value_{i}")
+    
+    # Verify no cross-contamination
+    passed = True
+    for i in range(10):
+        user1_val = session_manager.get_user_data("user1", f"key_{i}")
+        user2_val = session_manager.get_user_data("user2", f"key_{i}")
+        
+        if f"user1_value_{i}" != user1_val:
+            print(f"❌ FAIL: User 1 key_{i} has wrong value: {user1_val}")
+            passed = False
+        
+        if f"user2_value_{i}" != user2_val:
+            print(f"❌ FAIL: User 2 key_{i} has wrong value: {user2_val}")
+            passed = False
+    
+    if passed:
+        print("✅ PASS: All concurrent updates isolated correctly")
+    
+    return passed
+
+
+def test_user_cleanup():
+    """Test that clearing one user doesn't affect others."""
+    print("\n🧪 TEST 3: User Data Cleanup")
+    print("-" * 50)
+    
+    # Set up data for both users
+    session_manager.set_user_data("user1", "data", "user1_data")
+    session_manager.set_user_data("user2", "data", "user2_data")
+    
+    print("Before cleanup:")
+    print(f"  User 1 data: {session_manager.get_user_data('user1', 'data')}")
+    print(f"  User 2 data: {session_manager.get_user_data('user2', 'data')}")
+    
+    # Clear user 1
+    session_manager.clear_user_data("user1")
+    
+    print("After clearing user1:")
+    print(f"  User 1 data: {session_manager.get_user_data('user1', 'data', 'NONE')}")
+    print(f"  User 2 data: {session_manager.get_user_data('user2', 'data')}")
+    
+    user1_cleared = session_manager.get_user_data("user1", "data", "NONE") == "NONE"
+    user2_intact = session_manager.get_user_data("user2", "data") == "user2_data"
+    
+    if user1_cleared and user2_intact:
+        print("✅ PASS: User 1 cleared, User 2 intact")
+        return True
+    else:
+        print("❌ FAIL: Cleanup affected wrong user")
+        return False
+
+
+def test_chat_history_simulation():
+    """Simulate a real chat scenario with multiple users."""
+    print("\n🧪 TEST 4: Chat History Simulation")
+    print("-" * 50)
+    
+    # Clear previous data
+    session_manager.clear_user_data("alice")
+    session_manager.clear_user_data("bob")
+    
+    # Alice's conversation
+    alice_history = []
+    alice_history.append(["Hi", "Hello Alice!"])
+    alice_history.append(["How are you?", "I'm great!"])
+    session_manager.set_user_data("alice", SessionKeys.SIMPLE_CHAT_HISTORY, alice_history)
+    
+    # Bob's conversation
+    bob_history = []
+    bob_history.append(["Hey", "Hey Bob!"])
+    bob_history.append(["What's new?", "Not much!"])
+    session_manager.set_user_data("bob", SessionKeys.SIMPLE_CHAT_HISTORY, bob_history)
+    
+    # Verify isolation
+    retrieved_alice = session_manager.get_user_data("alice", SessionKeys.SIMPLE_CHAT_HISTORY)
+    retrieved_bob = session_manager.get_user_data("bob", SessionKeys.SIMPLE_CHAT_HISTORY)
+    
+    print(f"Alice's chat: {len(retrieved_alice)} messages")
+    print(f"Bob's chat: {len(retrieved_bob)} messages")
+    print(f"Alice sees: {retrieved_alice}")
+    print(f"Bob sees: {retrieved_bob}")
+    
+    alice_correct = retrieved_alice == alice_history
+    bob_correct = retrieved_bob == bob_history
+    no_overlap = retrieved_alice != retrieved_bob
+    
+    if alice_correct and bob_correct and no_overlap:
+        print("✅ PASS: Chat histories properly isolated")
+        return True
+    else:
+        print("❌ FAIL: Chat history isolation broken")
+        return False
+
+
+def test_session_stats():
+    """Test session statistics and tracking."""
+    print("\n🧪 TEST 5: Session Statistics")
+    print("-" * 50)
+    
+    # Create some test data
+    session_manager.set_user_data("testuser1", "key1", "value1")
+    session_manager.set_user_data("testuser2", "key1", "value1")
+    session_manager.set_user_data("testuser3", "key1", "value1")
+    
+    active_users = session_manager.get_active_users()
+    print(f"Active users: {active_users}")
+    
+    has_expected_users = len(active_users) >= 3
+    
+    if has_expected_users:
+        print("✅ PASS: Session tracking working")
+        for user in active_users[:3]:
+            stats = session_manager.get_user_stats(user)
+            print(f"  {user}: {stats}")
+        return True
+    else:
+        print("❌ FAIL: Session tracking not working")
+        return False
+
+
+def run_all_tests():
+    """Run all tests and report results."""
+    print("\n" + "=" * 60)
+    print("🚀 SESSION ISOLATION AUTOMATED TEST SUITE")
+    print("=" * 60)
+    
+    tests = [
+        ("Basic Isolation", test_basic_isolation),
+        ("Concurrent Updates", test_concurrent_updates),
+        ("User Cleanup", test_user_cleanup),
+        ("Chat History Simulation", test_chat_history_simulation),
+        ("Session Statistics", test_session_stats),
+    ]
+    
+    results = []
+    for name, test_func in tests:
+        try:
+            passed = test_func()
+            results.append((name, passed))
+        except Exception as e:
+            print(f"❌ EXCEPTION in {name}: {e}")
+            results.append((name, False))
+    
+    # Summary
+    print("\n" + "=" * 60)
+    print("📊 TEST SUMMARY")
+    print("=" * 60)
+    
+    passed_count = sum(1 for _, passed in results if passed)
+    total_count = len(results)
+    
+    for name, passed in results:
+        status = "✅ PASS" if passed else "❌ FAIL"
+        print(f"{status}: {name}")
+    
+    print(f"\n📈 Results: {passed_count}/{total_count} tests passed")
+    
+    if passed_count == total_count:
+        print("\n🎉 ALL TESTS PASSED! Session isolation is working correctly!")
+        print("\n✅ You can now proceed to manual testing with real browsers.")
+        return 0
+    else:
+        print(f"\n⚠️ {total_count - passed_count} test(s) failed.")
+        print("\n❌ Fix these issues before deploying.")
+        return 1
+
+
+if __name__ == "__main__":
+    exit_code = run_all_tests()
+    
+    print("\n" + "=" * 60)
+    print("📝 NEXT STEPS:")
+    print("=" * 60)
+    print("1. If all tests passed, proceed to manual testing:")
+    print("   - See TEST_SESSION_ISOLATION.md for instructions")
+    print("2. If tests failed, check the error messages above")
+    print("3. Run this script again after fixes")
+    print("=" * 60 + "\n")
+    
+    sys.exit(exit_code)