2026-02-16 13:31:58 -06:00
|
|
|
import { Router } from "express";
|
2026-03-03 08:45:26 -06:00
|
|
|
import type { Db } from "@paperclipai/db";
|
2026-03-20 08:43:47 -05:00
|
|
|
import { and, count, eq, gt, inArray, isNull, sql } from "drizzle-orm";
|
|
|
|
|
import { heartbeatRuns, instanceUserRoles, invites } from "@paperclipai/db";
|
2026-03-03 08:45:26 -06:00
|
|
|
import type { DeploymentExposure, DeploymentMode } from "@paperclipai/shared";
|
2026-03-20 08:43:47 -05:00
|
|
|
import { readPersistedDevServerStatus, toDevServerHealthStatus } from "../dev-server-status.js";
|
|
|
|
|
import { instanceSettingsService } from "../services/instance-settings.js";
|
2026-03-17 09:33:23 +05:30
|
|
|
import { serverVersion } from "../version.js";
|
2026-02-16 13:31:58 -06:00
|
|
|
|
[codex] harden authenticated routes and issue editor reliability (#3741)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The control plane depends on authenticated routes enforcing company
boundaries and role permissions correctly
> - This branch also touches the issue detail and markdown editing flows
operators use while handling advisory and triage work
> - Partial issue cache seeds and fragile rich-editor parsing could
leave important issue content missing or blank at the moment an operator
needed it
> - Blocked issues becoming actionable again should wake their assignee
automatically instead of silently staying idle
> - This pull request rebases the advisory follow-up branch onto current
`master`, hardens authenticated route authorization, and carries the
issue-detail/editor reliability fixes forward with regression tests
> - The benefit is tighter authz on sensitive routes plus more reliable
issue/advisory editing and wakeup behavior on top of the latest base
## What Changed
- Hardened authenticated route authorization across agent, activity,
approval, access, project, plugin, health, execution-workspace,
portability, and related server paths, with new cross-tenant and
runtime-authz regression coverage.
- Switched issue detail queries from `initialData` to placeholder-based
hydration so list/quicklook seeds still refetch full issue bodies.
- Normalized advisory-style HTML images before mounting the markdown
editor and strengthened fallback behavior when the rich editor silently
fails or rejects the content.
- Woke assigned agents when blocked issues move back to `todo`, with
route coverage for reopen and unblock transitions.
- Rebasing note: this branch now sits cleanly on top of the latest
`master` tip used for the PR base.
## Verification
- `pnpm exec vitest run ui/src/lib/issueDetailQuery.test.tsx
ui/src/components/MarkdownEditor.test.tsx
server/src/__tests__/issue-comment-reopen-routes.test.ts
server/src/__tests__/activity-routes.test.ts
server/src/__tests__/agent-cross-tenant-authz-routes.test.ts`
- Confirmed `pnpm-lock.yaml` is not part of the PR diff.
- Rebased the branch onto current `public-gh/master` before publishing.
## Risks
- Broad authz tightening may expose existing flows that were relying on
permissive board or agent access and now need explicit grants.
- Markdown editor fallback changes could affect focus or rendering in
edge-case content that mixes HTML-like advisory markup with normal
markdown.
- This verification was intentionally scoped to touched regressions and
did not run the full repository suite.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in the Codex CLI environment
with tool use for terminal, git, and GitHub operations. The exact
runtime model identifier is not exposed inside this session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, it is behavior-only and does not
need before/after screenshots
- [x] I have updated relevant documentation to reflect my changes, or no
documentation changes were needed for these internal fixes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-15 08:41:15 -05:00
|
|
|
function shouldExposeFullHealthDetails(
|
|
|
|
|
actorType: "none" | "board" | "agent" | null | undefined,
|
|
|
|
|
deploymentMode: DeploymentMode,
|
|
|
|
|
) {
|
|
|
|
|
if (deploymentMode !== "authenticated") return true;
|
|
|
|
|
return actorType === "board" || actorType === "agent";
|
|
|
|
|
}
|
|
|
|
|
|
2026-02-23 14:40:32 -06:00
|
|
|
export function healthRoutes(
|
|
|
|
|
db?: Db,
|
|
|
|
|
opts: {
|
|
|
|
|
deploymentMode: DeploymentMode;
|
|
|
|
|
deploymentExposure: DeploymentExposure;
|
|
|
|
|
authReady: boolean;
|
2026-03-02 16:43:59 -06:00
|
|
|
companyDeletionEnabled: boolean;
|
2026-02-23 14:40:32 -06:00
|
|
|
} = {
|
|
|
|
|
deploymentMode: "local_trusted",
|
|
|
|
|
deploymentExposure: "private",
|
|
|
|
|
authReady: true,
|
2026-03-02 16:43:59 -06:00
|
|
|
companyDeletionEnabled: true,
|
2026-02-23 14:40:32 -06:00
|
|
|
},
|
|
|
|
|
) {
|
2026-02-16 13:31:58 -06:00
|
|
|
const router = Router();
|
|
|
|
|
|
[codex] harden authenticated routes and issue editor reliability (#3741)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The control plane depends on authenticated routes enforcing company
boundaries and role permissions correctly
> - This branch also touches the issue detail and markdown editing flows
operators use while handling advisory and triage work
> - Partial issue cache seeds and fragile rich-editor parsing could
leave important issue content missing or blank at the moment an operator
needed it
> - Blocked issues becoming actionable again should wake their assignee
automatically instead of silently staying idle
> - This pull request rebases the advisory follow-up branch onto current
`master`, hardens authenticated route authorization, and carries the
issue-detail/editor reliability fixes forward with regression tests
> - The benefit is tighter authz on sensitive routes plus more reliable
issue/advisory editing and wakeup behavior on top of the latest base
## What Changed
- Hardened authenticated route authorization across agent, activity,
approval, access, project, plugin, health, execution-workspace,
portability, and related server paths, with new cross-tenant and
runtime-authz regression coverage.
- Switched issue detail queries from `initialData` to placeholder-based
hydration so list/quicklook seeds still refetch full issue bodies.
- Normalized advisory-style HTML images before mounting the markdown
editor and strengthened fallback behavior when the rich editor silently
fails or rejects the content.
- Woke assigned agents when blocked issues move back to `todo`, with
route coverage for reopen and unblock transitions.
- Rebasing note: this branch now sits cleanly on top of the latest
`master` tip used for the PR base.
## Verification
- `pnpm exec vitest run ui/src/lib/issueDetailQuery.test.tsx
ui/src/components/MarkdownEditor.test.tsx
server/src/__tests__/issue-comment-reopen-routes.test.ts
server/src/__tests__/activity-routes.test.ts
server/src/__tests__/agent-cross-tenant-authz-routes.test.ts`
- Confirmed `pnpm-lock.yaml` is not part of the PR diff.
- Rebased the branch onto current `public-gh/master` before publishing.
## Risks
- Broad authz tightening may expose existing flows that were relying on
permissive board or agent access and now need explicit grants.
- Markdown editor fallback changes could affect focus or rendering in
edge-case content that mixes HTML-like advisory markup with normal
markdown.
- This verification was intentionally scoped to touched regressions and
did not run the full repository suite.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in the Codex CLI environment
with tool use for terminal, git, and GitHub operations. The exact
runtime model identifier is not exposed inside this session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, it is behavior-only and does not
need before/after screenshots
- [x] I have updated relevant documentation to reflect my changes, or no
documentation changes were needed for these internal fixes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-15 08:41:15 -05:00
|
|
|
router.get("/", async (req, res) => {
|
|
|
|
|
const actorType = "actor" in req ? req.actor?.type : null;
|
|
|
|
|
const exposeFullDetails = shouldExposeFullHealthDetails(
|
|
|
|
|
actorType,
|
|
|
|
|
opts.deploymentMode,
|
|
|
|
|
);
|
|
|
|
|
|
2026-02-23 14:40:32 -06:00
|
|
|
if (!db) {
|
[codex] harden authenticated routes and issue editor reliability (#3741)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The control plane depends on authenticated routes enforcing company
boundaries and role permissions correctly
> - This branch also touches the issue detail and markdown editing flows
operators use while handling advisory and triage work
> - Partial issue cache seeds and fragile rich-editor parsing could
leave important issue content missing or blank at the moment an operator
needed it
> - Blocked issues becoming actionable again should wake their assignee
automatically instead of silently staying idle
> - This pull request rebases the advisory follow-up branch onto current
`master`, hardens authenticated route authorization, and carries the
issue-detail/editor reliability fixes forward with regression tests
> - The benefit is tighter authz on sensitive routes plus more reliable
issue/advisory editing and wakeup behavior on top of the latest base
## What Changed
- Hardened authenticated route authorization across agent, activity,
approval, access, project, plugin, health, execution-workspace,
portability, and related server paths, with new cross-tenant and
runtime-authz regression coverage.
- Switched issue detail queries from `initialData` to placeholder-based
hydration so list/quicklook seeds still refetch full issue bodies.
- Normalized advisory-style HTML images before mounting the markdown
editor and strengthened fallback behavior when the rich editor silently
fails or rejects the content.
- Woke assigned agents when blocked issues move back to `todo`, with
route coverage for reopen and unblock transitions.
- Rebasing note: this branch now sits cleanly on top of the latest
`master` tip used for the PR base.
## Verification
- `pnpm exec vitest run ui/src/lib/issueDetailQuery.test.tsx
ui/src/components/MarkdownEditor.test.tsx
server/src/__tests__/issue-comment-reopen-routes.test.ts
server/src/__tests__/activity-routes.test.ts
server/src/__tests__/agent-cross-tenant-authz-routes.test.ts`
- Confirmed `pnpm-lock.yaml` is not part of the PR diff.
- Rebased the branch onto current `public-gh/master` before publishing.
## Risks
- Broad authz tightening may expose existing flows that were relying on
permissive board or agent access and now need explicit grants.
- Markdown editor fallback changes could affect focus or rendering in
edge-case content that mixes HTML-like advisory markup with normal
markdown.
- This verification was intentionally scoped to touched regressions and
did not run the full repository suite.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in the Codex CLI environment
with tool use for terminal, git, and GitHub operations. The exact
runtime model identifier is not exposed inside this session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, it is behavior-only and does not
need before/after screenshots
- [x] I have updated relevant documentation to reflect my changes, or no
documentation changes were needed for these internal fixes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-15 08:41:15 -05:00
|
|
|
res.json(
|
|
|
|
|
exposeFullDetails
|
|
|
|
|
? { status: "ok", version: serverVersion }
|
|
|
|
|
: { status: "ok", deploymentMode: opts.deploymentMode },
|
|
|
|
|
);
|
2026-02-23 14:40:32 -06:00
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-30 13:17:34 -05:00
|
|
|
try {
|
|
|
|
|
await db.execute(sql`SELECT 1`);
|
|
|
|
|
} catch {
|
|
|
|
|
res.status(503).json({
|
|
|
|
|
status: "unhealthy",
|
|
|
|
|
version: serverVersion,
|
|
|
|
|
error: "database_unreachable",
|
|
|
|
|
});
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
2026-02-23 14:40:32 -06:00
|
|
|
let bootstrapStatus: "ready" | "bootstrap_pending" = "ready";
|
2026-03-09 15:30:08 -05:00
|
|
|
let bootstrapInviteActive = false;
|
2026-02-23 14:40:32 -06:00
|
|
|
if (opts.deploymentMode === "authenticated") {
|
|
|
|
|
const roleCount = await db
|
|
|
|
|
.select({ count: count() })
|
|
|
|
|
.from(instanceUserRoles)
|
|
|
|
|
.where(sql`${instanceUserRoles.role} = 'instance_admin'`)
|
|
|
|
|
.then((rows) => Number(rows[0]?.count ?? 0));
|
|
|
|
|
bootstrapStatus = roleCount > 0 ? "ready" : "bootstrap_pending";
|
2026-03-09 15:30:08 -05:00
|
|
|
|
|
|
|
|
if (bootstrapStatus === "bootstrap_pending") {
|
|
|
|
|
const now = new Date();
|
|
|
|
|
const inviteCount = await db
|
|
|
|
|
.select({ count: count() })
|
|
|
|
|
.from(invites)
|
|
|
|
|
.where(
|
|
|
|
|
and(
|
|
|
|
|
eq(invites.inviteType, "bootstrap_ceo"),
|
|
|
|
|
isNull(invites.revokedAt),
|
|
|
|
|
isNull(invites.acceptedAt),
|
|
|
|
|
gt(invites.expiresAt, now),
|
|
|
|
|
),
|
|
|
|
|
)
|
|
|
|
|
.then((rows) => Number(rows[0]?.count ?? 0));
|
|
|
|
|
bootstrapInviteActive = inviteCount > 0;
|
|
|
|
|
}
|
2026-02-23 14:40:32 -06:00
|
|
|
}
|
|
|
|
|
|
2026-03-20 08:43:47 -05:00
|
|
|
const persistedDevServerStatus = readPersistedDevServerStatus();
|
|
|
|
|
let devServer: ReturnType<typeof toDevServerHealthStatus> | undefined;
|
[codex] harden authenticated routes and issue editor reliability (#3741)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The control plane depends on authenticated routes enforcing company
boundaries and role permissions correctly
> - This branch also touches the issue detail and markdown editing flows
operators use while handling advisory and triage work
> - Partial issue cache seeds and fragile rich-editor parsing could
leave important issue content missing or blank at the moment an operator
needed it
> - Blocked issues becoming actionable again should wake their assignee
automatically instead of silently staying idle
> - This pull request rebases the advisory follow-up branch onto current
`master`, hardens authenticated route authorization, and carries the
issue-detail/editor reliability fixes forward with regression tests
> - The benefit is tighter authz on sensitive routes plus more reliable
issue/advisory editing and wakeup behavior on top of the latest base
## What Changed
- Hardened authenticated route authorization across agent, activity,
approval, access, project, plugin, health, execution-workspace,
portability, and related server paths, with new cross-tenant and
runtime-authz regression coverage.
- Switched issue detail queries from `initialData` to placeholder-based
hydration so list/quicklook seeds still refetch full issue bodies.
- Normalized advisory-style HTML images before mounting the markdown
editor and strengthened fallback behavior when the rich editor silently
fails or rejects the content.
- Woke assigned agents when blocked issues move back to `todo`, with
route coverage for reopen and unblock transitions.
- Rebasing note: this branch now sits cleanly on top of the latest
`master` tip used for the PR base.
## Verification
- `pnpm exec vitest run ui/src/lib/issueDetailQuery.test.tsx
ui/src/components/MarkdownEditor.test.tsx
server/src/__tests__/issue-comment-reopen-routes.test.ts
server/src/__tests__/activity-routes.test.ts
server/src/__tests__/agent-cross-tenant-authz-routes.test.ts`
- Confirmed `pnpm-lock.yaml` is not part of the PR diff.
- Rebased the branch onto current `public-gh/master` before publishing.
## Risks
- Broad authz tightening may expose existing flows that were relying on
permissive board or agent access and now need explicit grants.
- Markdown editor fallback changes could affect focus or rendering in
edge-case content that mixes HTML-like advisory markup with normal
markdown.
- This verification was intentionally scoped to touched regressions and
did not run the full repository suite.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in the Codex CLI environment
with tool use for terminal, git, and GitHub operations. The exact
runtime model identifier is not exposed inside this session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, it is behavior-only and does not
need before/after screenshots
- [x] I have updated relevant documentation to reflect my changes, or no
documentation changes were needed for these internal fixes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-15 08:41:15 -05:00
|
|
|
if (persistedDevServerStatus && typeof (db as { select?: unknown }).select === "function") {
|
2026-03-20 08:43:47 -05:00
|
|
|
const instanceSettings = instanceSettingsService(db);
|
|
|
|
|
const experimentalSettings = await instanceSettings.getExperimental();
|
|
|
|
|
const activeRunCount = await db
|
|
|
|
|
.select({ count: count() })
|
|
|
|
|
.from(heartbeatRuns)
|
|
|
|
|
.where(inArray(heartbeatRuns.status, ["queued", "running"]))
|
|
|
|
|
.then((rows) => Number(rows[0]?.count ?? 0));
|
|
|
|
|
|
|
|
|
|
devServer = toDevServerHealthStatus(persistedDevServerStatus, {
|
|
|
|
|
autoRestartEnabled: experimentalSettings.autoRestartDevServerWhenIdle ?? false,
|
|
|
|
|
activeRunCount,
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
|
[codex] harden authenticated routes and issue editor reliability (#3741)
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The control plane depends on authenticated routes enforcing company
boundaries and role permissions correctly
> - This branch also touches the issue detail and markdown editing flows
operators use while handling advisory and triage work
> - Partial issue cache seeds and fragile rich-editor parsing could
leave important issue content missing or blank at the moment an operator
needed it
> - Blocked issues becoming actionable again should wake their assignee
automatically instead of silently staying idle
> - This pull request rebases the advisory follow-up branch onto current
`master`, hardens authenticated route authorization, and carries the
issue-detail/editor reliability fixes forward with regression tests
> - The benefit is tighter authz on sensitive routes plus more reliable
issue/advisory editing and wakeup behavior on top of the latest base
## What Changed
- Hardened authenticated route authorization across agent, activity,
approval, access, project, plugin, health, execution-workspace,
portability, and related server paths, with new cross-tenant and
runtime-authz regression coverage.
- Switched issue detail queries from `initialData` to placeholder-based
hydration so list/quicklook seeds still refetch full issue bodies.
- Normalized advisory-style HTML images before mounting the markdown
editor and strengthened fallback behavior when the rich editor silently
fails or rejects the content.
- Woke assigned agents when blocked issues move back to `todo`, with
route coverage for reopen and unblock transitions.
- Rebasing note: this branch now sits cleanly on top of the latest
`master` tip used for the PR base.
## Verification
- `pnpm exec vitest run ui/src/lib/issueDetailQuery.test.tsx
ui/src/components/MarkdownEditor.test.tsx
server/src/__tests__/issue-comment-reopen-routes.test.ts
server/src/__tests__/activity-routes.test.ts
server/src/__tests__/agent-cross-tenant-authz-routes.test.ts`
- Confirmed `pnpm-lock.yaml` is not part of the PR diff.
- Rebased the branch onto current `public-gh/master` before publishing.
## Risks
- Broad authz tightening may expose existing flows that were relying on
permissive board or agent access and now need explicit grants.
- Markdown editor fallback changes could affect focus or rendering in
edge-case content that mixes HTML-like advisory markup with normal
markdown.
- This verification was intentionally scoped to touched regressions and
did not run the full repository suite.
## Model Used
- OpenAI Codex, GPT-5-based coding agent in the Codex CLI environment
with tool use for terminal, git, and GitHub operations. The exact
runtime model identifier is not exposed inside this session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, it is behavior-only and does not
need before/after screenshots
- [x] I have updated relevant documentation to reflect my changes, or no
documentation changes were needed for these internal fixes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-04-15 08:41:15 -05:00
|
|
|
if (!exposeFullDetails) {
|
|
|
|
|
res.json({
|
|
|
|
|
status: "ok",
|
|
|
|
|
deploymentMode: opts.deploymentMode,
|
|
|
|
|
bootstrapStatus,
|
|
|
|
|
bootstrapInviteActive,
|
|
|
|
|
});
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
2026-02-23 14:40:32 -06:00
|
|
|
res.json({
|
|
|
|
|
status: "ok",
|
2026-03-17 09:33:23 +05:30
|
|
|
version: serverVersion,
|
2026-02-23 14:40:32 -06:00
|
|
|
deploymentMode: opts.deploymentMode,
|
|
|
|
|
deploymentExposure: opts.deploymentExposure,
|
|
|
|
|
authReady: opts.authReady,
|
|
|
|
|
bootstrapStatus,
|
2026-03-09 15:30:08 -05:00
|
|
|
bootstrapInviteActive,
|
2026-03-02 16:43:59 -06:00
|
|
|
features: {
|
|
|
|
|
companyDeletionEnabled: opts.companyDeletionEnabled,
|
|
|
|
|
},
|
2026-03-20 08:43:47 -05:00
|
|
|
...(devServer ? { devServer } : {}),
|
2026-02-23 14:40:32 -06:00
|
|
|
});
|
2026-02-16 13:31:58 -06:00
|
|
|
});
|
|
|
|
|
|
|
|
|
|
return router;
|
|
|
|
|
}
|