mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-15 10:30:37 +09:00
Harden API route authorization boundaries (#4122)
## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies. > - The REST API is the control-plane boundary for companies, agents, plugins, adapters, costs, invites, and issue mutations. > - Several routes still relied on broad board or company access checks without consistently enforcing the narrower actor, company, and active-checkout boundaries those operations require. > - That can allow agents or non-admin users to mutate sensitive resources outside the intended governance path. > - This pull request hardens the route authorization layer and adds regression coverage for the audited API surfaces. > - The benefit is tighter multi-company isolation, safer plugin and adapter administration, and stronger enforcement of active issue ownership. ## What Changed - Added route-level authorization checks for budgets, plugin administration/scoped routes, adapter management, company import/export, direct agent creation, invite test resolution, and issue mutation/write surfaces. - Enforced active checkout ownership for agent-authenticated issue mutations, while preserving explicit management overrides for permitted managers. - Restricted sensitive adapter and plugin management operations to instance-admin or properly scoped actors. - Tightened company portability and invite probing routes so agents cannot cross company boundaries. - Updated access constants and the Company Access UI copy for the new active-checkout management grant. - Added focused regression tests covering cross-company denial, agent self-mutation denial, admin-only operations, and active checkout ownership. - Rebased the branch onto `public-gh/master` and fixed validation fallout from the rebase: heartbeat-context route ordering and a company import/export e2e fixture that now opts out of direct-hire approval before using direct agent creation. - Updated onboarding and signoff e2e setup to create seed agents through `/agent-hires` plus board approval, so they remain compatible with the approval-gated new-agent default. - Addressed Greptile feedback by removing a duplicate company export API alias, avoiding N+1 reporting-chain lookups in active-checkout override checks, allowing agent mutations on unassigned `in_progress` issues, and blocking NAT64 invite-probe targets. ## Verification - `pnpm exec vitest run server/src/__tests__/issues-goal-context-routes.test.ts cli/src/__tests__/company-import-export-e2e.test.ts` - `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts server/src/__tests__/adapter-routes-authz.test.ts server/src/__tests__/agent-permissions-routes.test.ts server/src/__tests__/company-portability-routes.test.ts server/src/__tests__/costs-service.test.ts server/src/__tests__/invite-test-resolution-route.test.ts server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts server/src/__tests__/agent-adapter-validation-routes.test.ts` - `pnpm exec vitest run server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts` - `pnpm exec vitest run server/src/__tests__/invite-test-resolution-route.test.ts` - `pnpm -r typecheck` - `pnpm --filter server typecheck` - `pnpm --filter ui typecheck` - `pnpm build` - `pnpm test:e2e -- tests/e2e/onboarding.spec.ts tests/e2e/signoff-policy.spec.ts` - `pnpm test:e2e -- tests/e2e/signoff-policy.spec.ts` - `pnpm test:run` was also run. It failed under default full-suite parallelism with two order-dependent failures in `plugin-routes-authz.test.ts` and `routines-e2e.test.ts`; both files passed when rerun directly together with `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts server/src/__tests__/routines-e2e.test.ts`. ## Risks - Medium risk: this changes authorization behavior across multiple sensitive API surfaces, so callers that depended on broad board/company access may now receive `403` or `409` until they use the correct governance path. - Direct agent creation now respects the company-level board-approval requirement; integrations that need pending hires should use `/api/companies/:companyId/agent-hires`. - Active in-progress issue mutations now require checkout ownership or an explicit management override, which may reveal workflow assumptions in older automation. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex, GPT-5 coding agent, tool-using workflow with local shell, Git, GitHub CLI, and repository tests. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [ ] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta
GitHub
parent
549ef11c14
commit
7a329fb8bb
22 changed files with 1903 additions and 138 deletions
255
server/src/__tests__/adapter-routes-authz.test.ts
Normal file
255
server/src/__tests__/adapter-routes-authz.test.ts
Normal file
|
|
@ -0,0 +1,255 @@
|
|||
import express from "express";
|
||||
import request from "supertest";
|
||||
import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import type { ServerAdapterModule } from "../adapters/index.js";
|
||||
|
||||
const mocks = vi.hoisted(() => {
|
||||
const externalRecords = new Map<string, any>();
|
||||
|
||||
return {
|
||||
externalRecords,
|
||||
execFile: vi.fn((_file: string, _args: string[], optionsOrCallback: unknown, maybeCallback?: unknown) => {
|
||||
const callback = typeof optionsOrCallback === "function" ? optionsOrCallback : maybeCallback;
|
||||
if (typeof callback === "function") {
|
||||
callback(null, "", "");
|
||||
}
|
||||
return {
|
||||
kill: vi.fn(),
|
||||
on: vi.fn(),
|
||||
};
|
||||
}),
|
||||
listAdapterPlugins: vi.fn(),
|
||||
addAdapterPlugin: vi.fn((record: any) => {
|
||||
externalRecords.set(record.type, record);
|
||||
}),
|
||||
removeAdapterPlugin: vi.fn((type: string) => {
|
||||
externalRecords.delete(type);
|
||||
}),
|
||||
getAdapterPluginByType: vi.fn((type: string) => externalRecords.get(type)),
|
||||
getAdapterPluginsDir: vi.fn(),
|
||||
getDisabledAdapterTypes: vi.fn(),
|
||||
setAdapterDisabled: vi.fn(),
|
||||
loadExternalAdapterPackage: vi.fn(),
|
||||
buildExternalAdapters: vi.fn(async () => []),
|
||||
reloadExternalAdapter: vi.fn(),
|
||||
getUiParserSource: vi.fn(),
|
||||
getOrExtractUiParserSource: vi.fn(),
|
||||
};
|
||||
});
|
||||
|
||||
vi.mock("node:child_process", () => ({
|
||||
execFile: mocks.execFile,
|
||||
}));
|
||||
|
||||
vi.mock("../services/adapter-plugin-store.js", () => ({
|
||||
listAdapterPlugins: mocks.listAdapterPlugins,
|
||||
addAdapterPlugin: mocks.addAdapterPlugin,
|
||||
removeAdapterPlugin: mocks.removeAdapterPlugin,
|
||||
getAdapterPluginByType: mocks.getAdapterPluginByType,
|
||||
getAdapterPluginsDir: mocks.getAdapterPluginsDir,
|
||||
getDisabledAdapterTypes: mocks.getDisabledAdapterTypes,
|
||||
setAdapterDisabled: mocks.setAdapterDisabled,
|
||||
}));
|
||||
|
||||
vi.mock("../adapters/plugin-loader.js", () => ({
|
||||
buildExternalAdapters: mocks.buildExternalAdapters,
|
||||
loadExternalAdapterPackage: mocks.loadExternalAdapterPackage,
|
||||
getUiParserSource: mocks.getUiParserSource,
|
||||
getOrExtractUiParserSource: mocks.getOrExtractUiParserSource,
|
||||
reloadExternalAdapter: mocks.reloadExternalAdapter,
|
||||
}));
|
||||
|
||||
const EXTERNAL_ADAPTER_TYPE = "external_admin_test";
|
||||
const EXTERNAL_PACKAGE_NAME = "paperclip-external-adapter";
|
||||
let adapterRoutes: typeof import("../routes/adapters.js").adapterRoutes;
|
||||
let errorHandler: typeof import("../middleware/index.js").errorHandler;
|
||||
let registerServerAdapter: typeof import("../adapters/registry.js").registerServerAdapter;
|
||||
let unregisterServerAdapter: typeof import("../adapters/registry.js").unregisterServerAdapter;
|
||||
let setOverridePaused: typeof import("../adapters/registry.js").setOverridePaused;
|
||||
|
||||
function createAdapter(type = EXTERNAL_ADAPTER_TYPE): ServerAdapterModule {
|
||||
return {
|
||||
type,
|
||||
models: [],
|
||||
execute: async () => ({ exitCode: 0, signal: null, timedOut: false }),
|
||||
testEnvironment: async () => ({
|
||||
adapterType: type,
|
||||
status: "pass",
|
||||
checks: [],
|
||||
testedAt: new Date(0).toISOString(),
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
function installedRecord(type = EXTERNAL_ADAPTER_TYPE) {
|
||||
return {
|
||||
packageName: EXTERNAL_PACKAGE_NAME,
|
||||
type,
|
||||
installedAt: new Date(0).toISOString(),
|
||||
};
|
||||
}
|
||||
|
||||
function createApp(actor: Express.Request["actor"]) {
|
||||
if (!adapterRoutes || !errorHandler) {
|
||||
throw new Error("adapter route test dependencies were not loaded");
|
||||
}
|
||||
|
||||
const app = express();
|
||||
app.use(express.json());
|
||||
app.use((req, _res, next) => {
|
||||
req.actor = actor;
|
||||
next();
|
||||
});
|
||||
app.use("/api", adapterRoutes());
|
||||
app.use(errorHandler);
|
||||
return app;
|
||||
}
|
||||
|
||||
function boardMember(membershipRole: "admin" | "operator" | "viewer"): Express.Request["actor"] {
|
||||
return {
|
||||
type: "board",
|
||||
userId: `${membershipRole}-user`,
|
||||
userName: null,
|
||||
userEmail: null,
|
||||
source: "session",
|
||||
isInstanceAdmin: false,
|
||||
companyIds: ["company-1"],
|
||||
memberships: [
|
||||
{
|
||||
companyId: "company-1",
|
||||
membershipRole,
|
||||
status: "active",
|
||||
},
|
||||
],
|
||||
};
|
||||
}
|
||||
|
||||
const instanceAdmin: Express.Request["actor"] = {
|
||||
type: "board",
|
||||
userId: "instance-admin",
|
||||
userName: null,
|
||||
userEmail: null,
|
||||
source: "session",
|
||||
isInstanceAdmin: true,
|
||||
companyIds: [],
|
||||
memberships: [],
|
||||
};
|
||||
|
||||
function sendMutatingRequest(app: express.Express, name: string) {
|
||||
switch (name) {
|
||||
case "install":
|
||||
return request(app)
|
||||
.post("/api/adapters/install")
|
||||
.send({ packageName: EXTERNAL_PACKAGE_NAME });
|
||||
case "disable":
|
||||
return request(app)
|
||||
.patch(`/api/adapters/${EXTERNAL_ADAPTER_TYPE}`)
|
||||
.send({ disabled: true });
|
||||
case "override":
|
||||
return request(app)
|
||||
.patch("/api/adapters/claude_local/override")
|
||||
.send({ paused: true });
|
||||
case "delete":
|
||||
return request(app).delete(`/api/adapters/${EXTERNAL_ADAPTER_TYPE}`);
|
||||
case "reload":
|
||||
return request(app).post(`/api/adapters/${EXTERNAL_ADAPTER_TYPE}/reload`);
|
||||
case "reinstall":
|
||||
return request(app).post(`/api/adapters/${EXTERNAL_ADAPTER_TYPE}/reinstall`);
|
||||
default:
|
||||
throw new Error(`Unknown mutating adapter route: ${name}`);
|
||||
}
|
||||
}
|
||||
|
||||
function seedInstalledExternalAdapter() {
|
||||
mocks.externalRecords.set(EXTERNAL_ADAPTER_TYPE, installedRecord());
|
||||
unregisterServerAdapter(EXTERNAL_ADAPTER_TYPE);
|
||||
registerServerAdapter(createAdapter());
|
||||
}
|
||||
|
||||
describe("adapter management route authorization", () => {
|
||||
beforeAll(async () => {
|
||||
const [routes, middleware, registry] = await Promise.all([
|
||||
import("../routes/adapters.js"),
|
||||
import("../middleware/index.js"),
|
||||
import("../adapters/registry.js"),
|
||||
]);
|
||||
adapterRoutes = routes.adapterRoutes;
|
||||
errorHandler = middleware.errorHandler;
|
||||
registerServerAdapter = registry.registerServerAdapter;
|
||||
unregisterServerAdapter = registry.unregisterServerAdapter;
|
||||
setOverridePaused = registry.setOverridePaused;
|
||||
}, 20_000);
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
mocks.externalRecords.clear();
|
||||
|
||||
unregisterServerAdapter(EXTERNAL_ADAPTER_TYPE);
|
||||
setOverridePaused("claude_local", false);
|
||||
mocks.listAdapterPlugins.mockImplementation(() => [...mocks.externalRecords.values()]);
|
||||
mocks.getAdapterPluginsDir.mockReturnValue("/tmp/paperclip-adapter-route-authz-test");
|
||||
mocks.getDisabledAdapterTypes.mockReturnValue([]);
|
||||
mocks.setAdapterDisabled.mockReturnValue(true);
|
||||
mocks.buildExternalAdapters.mockResolvedValue([]);
|
||||
mocks.loadExternalAdapterPackage.mockResolvedValue(createAdapter());
|
||||
mocks.reloadExternalAdapter.mockImplementation(async (type: string) => createAdapter(type));
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
unregisterServerAdapter(EXTERNAL_ADAPTER_TYPE);
|
||||
setOverridePaused("claude_local", false);
|
||||
});
|
||||
|
||||
it.each([
|
||||
"install",
|
||||
"disable",
|
||||
"override",
|
||||
"delete",
|
||||
"reload",
|
||||
"reinstall",
|
||||
])("rejects %s for a non-instance-admin board user with company membership", async (routeName) => {
|
||||
seedInstalledExternalAdapter();
|
||||
const app = createApp(boardMember("admin"));
|
||||
|
||||
const res = await sendMutatingRequest(app, routeName);
|
||||
|
||||
expect(res.status, JSON.stringify(res.body)).toBe(403);
|
||||
});
|
||||
|
||||
it.each([
|
||||
["install", 201],
|
||||
["disable", 200],
|
||||
["override", 200],
|
||||
["delete", 200],
|
||||
["reload", 200],
|
||||
["reinstall", 200],
|
||||
] as const)("allows instance admins to reach %s", async (routeName, expectedStatus) => {
|
||||
if (routeName !== "install") {
|
||||
seedInstalledExternalAdapter();
|
||||
}
|
||||
const app = createApp(instanceAdmin);
|
||||
|
||||
const res = await sendMutatingRequest(app, routeName);
|
||||
|
||||
expect(res.status, JSON.stringify(res.body)).toBe(expectedStatus);
|
||||
});
|
||||
|
||||
it.each(["viewer", "operator"] as const)(
|
||||
"does not let a company %s trigger adapter npm install or reload",
|
||||
async (membershipRole) => {
|
||||
seedInstalledExternalAdapter();
|
||||
const app = createApp(boardMember(membershipRole));
|
||||
|
||||
const install = await request(app)
|
||||
.post("/api/adapters/install")
|
||||
.send({ packageName: EXTERNAL_PACKAGE_NAME });
|
||||
const reload = await request(app).post(`/api/adapters/${EXTERNAL_ADAPTER_TYPE}/reload`);
|
||||
|
||||
expect(install.status, JSON.stringify(install.body)).toBe(403);
|
||||
expect(reload.status, JSON.stringify(reload.body)).toBe(403);
|
||||
expect(mocks.execFile).not.toHaveBeenCalled();
|
||||
expect(mocks.loadExternalAdapterPackage).not.toHaveBeenCalled();
|
||||
expect(mocks.reloadExternalAdapter).not.toHaveBeenCalled();
|
||||
},
|
||||
);
|
||||
});
|
||||
|
|
@ -131,7 +131,19 @@ async function createApp() {
|
|||
};
|
||||
next();
|
||||
});
|
||||
app.use("/api", agentRoutes({} as any));
|
||||
const db = {
|
||||
select: vi.fn(() => ({
|
||||
from: vi.fn(() => ({
|
||||
where: vi.fn(async () => [
|
||||
{
|
||||
id: "company-1",
|
||||
requireBoardApprovalForNewAgents: false,
|
||||
},
|
||||
]),
|
||||
})),
|
||||
})),
|
||||
};
|
||||
app.use("/api", agentRoutes(db as any));
|
||||
app.use(errorHandler);
|
||||
return app;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -119,23 +119,25 @@ function registerModuleMocks() {
|
|||
}));
|
||||
}
|
||||
|
||||
function createDbStub() {
|
||||
function createDbStub(options: { requireBoardApprovalForNewAgents?: boolean } = {}) {
|
||||
return {
|
||||
select: vi.fn().mockReturnValue({
|
||||
from: vi.fn().mockReturnValue({
|
||||
where: vi.fn().mockReturnValue({
|
||||
then: vi.fn().mockResolvedValue([{
|
||||
id: companyId,
|
||||
name: "Paperclip",
|
||||
requireBoardApprovalForNewAgents: false,
|
||||
}]),
|
||||
then: vi.fn((resolve) =>
|
||||
Promise.resolve(resolve([{
|
||||
id: companyId,
|
||||
name: "Paperclip",
|
||||
requireBoardApprovalForNewAgents: options.requireBoardApprovalForNewAgents ?? false,
|
||||
}])),
|
||||
),
|
||||
}),
|
||||
}),
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
async function createApp(actor: Record<string, unknown>) {
|
||||
async function createApp(actor: Record<string, unknown>, dbOptions: { requireBoardApprovalForNewAgents?: boolean } = {}) {
|
||||
const [{ errorHandler }, { agentRoutes }] = await Promise.all([
|
||||
vi.importActual<typeof import("../middleware/index.js")>("../middleware/index.js"),
|
||||
vi.importActual<typeof import("../routes/agents.js")>("../routes/agents.js"),
|
||||
|
|
@ -146,7 +148,7 @@ async function createApp(actor: Record<string, unknown>) {
|
|||
(req as any).actor = actor;
|
||||
next();
|
||||
});
|
||||
app.use("/api", agentRoutes(createDbStub() as any));
|
||||
app.use("/api", agentRoutes(createDbStub(dbOptions) as any));
|
||||
app.use(errorHandler);
|
||||
return app;
|
||||
}
|
||||
|
|
@ -398,6 +400,97 @@ describe("agent permission routes", () => {
|
|||
expect(mockLogActivity).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("blocks direct agent creation for authenticated company members without agent create permission", async () => {
|
||||
mockAccessService.canUser.mockResolvedValue(false);
|
||||
|
||||
const app = await createApp({
|
||||
type: "board",
|
||||
userId: "member-user",
|
||||
source: "session",
|
||||
isInstanceAdmin: false,
|
||||
companyIds: [companyId],
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post(`/api/companies/${companyId}/agents`)
|
||||
.send({
|
||||
name: "Backdoor",
|
||||
role: "engineer",
|
||||
adapterType: "process",
|
||||
adapterConfig: {},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(res.body.error).toContain("agents:create");
|
||||
expect(mockAgentService.create).not.toHaveBeenCalled();
|
||||
expect(mockLogActivity).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows direct agent creation for authenticated board users with agent create permission when approval is not required", async () => {
|
||||
mockAccessService.canUser.mockResolvedValue(true);
|
||||
|
||||
const app = await createApp({
|
||||
type: "board",
|
||||
userId: "agent-admin-user",
|
||||
source: "session",
|
||||
isInstanceAdmin: false,
|
||||
companyIds: [companyId],
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post(`/api/companies/${companyId}/agents`)
|
||||
.send({
|
||||
name: "Builder",
|
||||
role: "engineer",
|
||||
adapterType: "process",
|
||||
adapterConfig: {},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(201);
|
||||
expect(mockAgentService.create).toHaveBeenCalledWith(
|
||||
companyId,
|
||||
expect.objectContaining({
|
||||
status: "idle",
|
||||
}),
|
||||
);
|
||||
expect(mockAccessService.setPrincipalPermission).toHaveBeenCalledWith(
|
||||
companyId,
|
||||
"agent",
|
||||
agentId,
|
||||
"tasks:assign",
|
||||
true,
|
||||
"agent-admin-user",
|
||||
);
|
||||
});
|
||||
|
||||
it("rejects direct agent creation when new agents require board approval", async () => {
|
||||
const app = await createApp(
|
||||
{
|
||||
type: "board",
|
||||
userId: "board-user",
|
||||
source: "local_implicit",
|
||||
isInstanceAdmin: true,
|
||||
companyIds: [companyId],
|
||||
},
|
||||
{ requireBoardApprovalForNewAgents: true },
|
||||
);
|
||||
|
||||
const res = await request(app)
|
||||
.post(`/api/companies/${companyId}/agents`)
|
||||
.send({
|
||||
name: "Builder",
|
||||
role: "engineer",
|
||||
adapterType: "process",
|
||||
adapterConfig: {},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(409);
|
||||
expect(res.body.error).toContain("/agent-hires");
|
||||
expect(mockAgentService.create).not.toHaveBeenCalled();
|
||||
expect(mockApprovalService.create).not.toHaveBeenCalled();
|
||||
expect(mockLogActivity).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("grants tasks:assign by default when board creates a new agent", async () => {
|
||||
const app = await createApp({
|
||||
type: "board",
|
||||
|
|
|
|||
|
|
@ -77,6 +77,32 @@ async function createApp(actor: Record<string, unknown>) {
|
|||
return app;
|
||||
}
|
||||
|
||||
const companyId = "11111111-1111-4111-8111-111111111111";
|
||||
|
||||
const exportRequest = {
|
||||
include: { company: true, agents: true, projects: true },
|
||||
};
|
||||
|
||||
function createExportResult() {
|
||||
return {
|
||||
rootPath: "paperclip",
|
||||
manifest: {
|
||||
agents: [],
|
||||
skills: [],
|
||||
projects: [],
|
||||
issues: [],
|
||||
envInputs: [],
|
||||
includes: { company: true, agents: true, projects: true, issues: false, skills: false },
|
||||
company: null,
|
||||
schemaVersion: 1,
|
||||
generatedAt: "2026-01-01T00:00:00.000Z",
|
||||
source: null,
|
||||
},
|
||||
files: {},
|
||||
warnings: [],
|
||||
};
|
||||
}
|
||||
|
||||
describe("company portability routes", () => {
|
||||
beforeEach(() => {
|
||||
vi.resetModules();
|
||||
|
|
@ -90,30 +116,53 @@ describe("company portability routes", () => {
|
|||
it("rejects non-CEO agents from CEO-safe export preview routes", async () => {
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
companyId: "11111111-1111-4111-8111-111111111111",
|
||||
companyId,
|
||||
role: "engineer",
|
||||
});
|
||||
const app = await createApp({
|
||||
type: "agent",
|
||||
agentId: "agent-1",
|
||||
companyId: "11111111-1111-4111-8111-111111111111",
|
||||
companyId,
|
||||
source: "agent_key",
|
||||
runId: "run-1",
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/companies/11111111-1111-4111-8111-111111111111/exports/preview")
|
||||
.send({ include: { company: true, agents: true, projects: true } });
|
||||
.post(`/api/companies/${companyId}/exports/preview`)
|
||||
.send(exportRequest);
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(res.body.error).toContain("Only CEO agents");
|
||||
expect(mockCompanyPortabilityService.previewExport).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("rejects non-CEO agents from legacy and CEO-safe export bundle routes", async () => {
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
companyId,
|
||||
role: "engineer",
|
||||
});
|
||||
const app = await createApp({
|
||||
type: "agent",
|
||||
agentId: "agent-1",
|
||||
companyId,
|
||||
source: "agent_key",
|
||||
runId: "run-1",
|
||||
});
|
||||
|
||||
for (const path of [`/api/companies/${companyId}/export`, `/api/companies/${companyId}/exports`]) {
|
||||
const res = await request(app).post(path).send(exportRequest);
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(res.body.error).toContain("Only CEO agents");
|
||||
}
|
||||
expect(mockCompanyPortabilityService.exportBundle).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows CEO agents to use company-scoped export preview routes", async () => {
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
companyId: "11111111-1111-4111-8111-111111111111",
|
||||
companyId,
|
||||
role: "ceo",
|
||||
});
|
||||
mockCompanyPortabilityService.previewExport.mockResolvedValue({
|
||||
|
|
@ -128,19 +177,64 @@ describe("company portability routes", () => {
|
|||
const app = await createApp({
|
||||
type: "agent",
|
||||
agentId: "agent-1",
|
||||
companyId: "11111111-1111-4111-8111-111111111111",
|
||||
companyId,
|
||||
source: "agent_key",
|
||||
runId: "run-1",
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/companies/11111111-1111-4111-8111-111111111111/exports/preview")
|
||||
.send({ include: { company: true, agents: true, projects: true } });
|
||||
.post(`/api/companies/${companyId}/exports/preview`)
|
||||
.send(exportRequest);
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.rootPath).toBe("paperclip");
|
||||
});
|
||||
|
||||
it("allows CEO agents to export through legacy and CEO-safe bundle routes", async () => {
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
companyId,
|
||||
role: "ceo",
|
||||
});
|
||||
mockCompanyPortabilityService.exportBundle.mockResolvedValue(createExportResult());
|
||||
const app = await createApp({
|
||||
type: "agent",
|
||||
agentId: "agent-1",
|
||||
companyId,
|
||||
source: "agent_key",
|
||||
runId: "run-1",
|
||||
});
|
||||
|
||||
for (const path of [`/api/companies/${companyId}/export`, `/api/companies/${companyId}/exports`]) {
|
||||
const res = await request(app).post(path).send(exportRequest);
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.rootPath).toBe("paperclip");
|
||||
}
|
||||
expect(mockCompanyPortabilityService.exportBundle).toHaveBeenCalledTimes(2);
|
||||
expect(mockCompanyPortabilityService.exportBundle).toHaveBeenNthCalledWith(1, companyId, exportRequest);
|
||||
expect(mockCompanyPortabilityService.exportBundle).toHaveBeenNthCalledWith(2, companyId, exportRequest);
|
||||
});
|
||||
|
||||
it("allows board users to export through legacy and CEO-safe bundle routes", async () => {
|
||||
mockCompanyPortabilityService.exportBundle.mockResolvedValue(createExportResult());
|
||||
const app = await createApp({
|
||||
type: "board",
|
||||
userId: "user-1",
|
||||
companyIds: [companyId],
|
||||
source: "session",
|
||||
isInstanceAdmin: false,
|
||||
});
|
||||
|
||||
for (const path of [`/api/companies/${companyId}/export`, `/api/companies/${companyId}/exports`]) {
|
||||
const res = await request(app).post(path).send(exportRequest);
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.rootPath).toBe("paperclip");
|
||||
}
|
||||
expect(mockCompanyPortabilityService.exportBundle).toHaveBeenCalledTimes(2);
|
||||
});
|
||||
|
||||
it("rejects replace collision strategy on CEO-safe import routes", async () => {
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
|
|
|
|||
|
|
@ -147,6 +147,13 @@ beforeEach(() => {
|
|||
budgetMonthlyCents: 100,
|
||||
spentMonthlyCents: 0,
|
||||
});
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
companyId: "company-1",
|
||||
name: "Budget Agent",
|
||||
budgetMonthlyCents: 100,
|
||||
spentMonthlyCents: 0,
|
||||
});
|
||||
mockAgentService.update.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
companyId: "company-1",
|
||||
|
|
@ -216,13 +223,6 @@ describe("cost routes", () => {
|
|||
});
|
||||
|
||||
it("rejects agent budget updates for board users outside the agent company", async () => {
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
id: "agent-1",
|
||||
companyId: "company-1",
|
||||
name: "Budget Agent",
|
||||
budgetMonthlyCents: 100,
|
||||
spentMonthlyCents: 0,
|
||||
});
|
||||
const app = await createAppWithActor({
|
||||
type: "board",
|
||||
userId: "board-user",
|
||||
|
|
@ -238,6 +238,92 @@ describe("cost routes", () => {
|
|||
expect(res.status).toBe(403);
|
||||
expect(mockAgentService.update).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("rejects agent budget updates from the target agent without changing the budget policy", async () => {
|
||||
const app = await createAppWithActor({
|
||||
type: "agent",
|
||||
agentId: "agent-1",
|
||||
companyId: "company-1",
|
||||
runId: "run-1",
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.patch("/api/agents/agent-1/budgets")
|
||||
.send({ budgetMonthlyCents: 2500 });
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(res.body).toEqual({ error: "Board access required" });
|
||||
expect(mockAgentService.update).not.toHaveBeenCalled();
|
||||
expect(mockBudgetService.upsertPolicy).not.toHaveBeenCalled();
|
||||
expect(mockLogActivity).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("rejects agent budget updates from another same-company agent without changing the budget policy", async () => {
|
||||
const app = await createAppWithActor({
|
||||
type: "agent",
|
||||
agentId: "agent-2",
|
||||
companyId: "company-1",
|
||||
runId: "run-2",
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.patch("/api/agents/agent-1/budgets")
|
||||
.send({ budgetMonthlyCents: 2500 });
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(res.body).toEqual({ error: "Board access required" });
|
||||
expect(mockAgentService.update).not.toHaveBeenCalled();
|
||||
expect(mockBudgetService.upsertPolicy).not.toHaveBeenCalled();
|
||||
expect(mockLogActivity).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows authorized board users to update an agent budget and budget policy", async () => {
|
||||
mockAgentService.update.mockResolvedValueOnce({
|
||||
id: "agent-1",
|
||||
companyId: "company-1",
|
||||
name: "Budget Agent",
|
||||
budgetMonthlyCents: 2500,
|
||||
spentMonthlyCents: 0,
|
||||
});
|
||||
const app = await createAppWithActor({
|
||||
type: "board",
|
||||
userId: "board-user",
|
||||
source: "session",
|
||||
isInstanceAdmin: false,
|
||||
companyIds: ["company-1"],
|
||||
memberships: [{ companyId: "company-1", status: "active", membershipRole: "admin" }],
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.patch("/api/agents/agent-1/budgets")
|
||||
.send({ budgetMonthlyCents: 2500 });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(mockAgentService.update).toHaveBeenCalledWith("agent-1", { budgetMonthlyCents: 2500 });
|
||||
expect(mockBudgetService.upsertPolicy).toHaveBeenCalledWith(
|
||||
"company-1",
|
||||
{
|
||||
scopeType: "agent",
|
||||
scopeId: "agent-1",
|
||||
amount: 2500,
|
||||
windowKind: "calendar_month_utc",
|
||||
},
|
||||
"board-user",
|
||||
);
|
||||
expect(mockLogActivity).toHaveBeenCalledWith(
|
||||
expect.anything(),
|
||||
expect.objectContaining({
|
||||
companyId: "company-1",
|
||||
actorType: "user",
|
||||
actorId: "board-user",
|
||||
agentId: null,
|
||||
action: "agent.budget_updated",
|
||||
entityType: "agent",
|
||||
entityId: "agent-1",
|
||||
details: { budgetMonthlyCents: 2500 },
|
||||
}),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
|
||||
|
|
|
|||
190
server/src/__tests__/invite-test-resolution-route.test.ts
Normal file
190
server/src/__tests__/invite-test-resolution-route.test.ts
Normal file
|
|
@ -0,0 +1,190 @@
|
|||
import express from "express";
|
||||
import request from "supertest";
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
|
||||
import {
|
||||
accessRoutes,
|
||||
setInviteResolutionNetworkForTest,
|
||||
} from "../routes/access.js";
|
||||
import { errorHandler } from "../middleware/index.js";
|
||||
|
||||
function createSelectChain(rows: unknown[]) {
|
||||
const query = {
|
||||
then(resolve: (value: unknown[]) => unknown) {
|
||||
return Promise.resolve(rows).then(resolve);
|
||||
},
|
||||
where() {
|
||||
return query;
|
||||
},
|
||||
};
|
||||
return {
|
||||
from() {
|
||||
return query;
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function createDbStub(inviteRows: unknown[]) {
|
||||
return {
|
||||
select() {
|
||||
return createSelectChain(inviteRows);
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function createInvite(overrides: Record<string, unknown> = {}) {
|
||||
return {
|
||||
id: "invite-1",
|
||||
companyId: "company-1",
|
||||
inviteType: "company_join",
|
||||
allowedJoinTypes: "agent",
|
||||
tokenHash: "hash",
|
||||
defaultsPayload: null,
|
||||
expiresAt: new Date("2027-03-07T00:10:00.000Z"),
|
||||
invitedByUserId: null,
|
||||
revokedAt: null,
|
||||
acceptedAt: null,
|
||||
createdAt: new Date("2026-03-07T00:00:00.000Z"),
|
||||
updatedAt: new Date("2026-03-07T00:00:00.000Z"),
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function createApp(db: Record<string, unknown>) {
|
||||
const app = express();
|
||||
app.use((req, _res, next) => {
|
||||
(req as any).actor = { type: "anon" };
|
||||
next();
|
||||
});
|
||||
app.use(
|
||||
"/api",
|
||||
accessRoutes(db as any, {
|
||||
deploymentMode: "local_trusted",
|
||||
deploymentExposure: "private",
|
||||
bindHost: "127.0.0.1",
|
||||
allowedHostnames: [],
|
||||
}),
|
||||
);
|
||||
app.use(errorHandler);
|
||||
return app;
|
||||
}
|
||||
|
||||
describe("GET /invites/:token/test-resolution", () => {
|
||||
const lookup = vi.fn();
|
||||
const requestHead = vi.fn();
|
||||
|
||||
beforeEach(() => {
|
||||
lookup.mockReset();
|
||||
requestHead.mockReset();
|
||||
setInviteResolutionNetworkForTest({ lookup, requestHead });
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
setInviteResolutionNetworkForTest(null);
|
||||
});
|
||||
|
||||
it.each([
|
||||
["localhost", "http://localhost:3100/api/health", "127.0.0.1"],
|
||||
["IPv4 loopback", "http://127.0.0.1:3100/api/health", "127.0.0.1"],
|
||||
["IPv6 loopback", "http://[::1]:3100/api/health", "::1"],
|
||||
["IPv4-mapped IPv6 loopback hex", "http://[::ffff:7f00:1]/api/health", "::ffff:7f00:1"],
|
||||
["IPv4-mapped IPv6 RFC1918 hex", "http://[::ffff:c0a8:101]/api/health", "::ffff:c0a8:101"],
|
||||
["RFC1918 10/8", "http://10.0.0.5/api/health", "10.0.0.5"],
|
||||
["RFC1918 172.16/12", "http://172.16.10.5/api/health", "172.16.10.5"],
|
||||
["RFC1918 192.168/16", "http://192.168.1.10/api/health", "192.168.1.10"],
|
||||
["link-local metadata", "http://169.254.169.254/latest/meta-data", "169.254.169.254"],
|
||||
["multicast", "http://224.0.0.1/probe", "224.0.0.1"],
|
||||
["NAT64 well-known prefix", "https://gateway.example.test/health", "64:ff9b::0a00:0001"],
|
||||
["NAT64 local-use prefix", "https://gateway.example.test/health", "64:ff9b:1::0a00:0001"],
|
||||
])("rejects %s targets before probing", async (_label, url, address) => {
|
||||
lookup.mockResolvedValue([{ address, family: address.includes(":") ? 6 : 4 }]);
|
||||
const app = createApp(createDbStub([createInvite()]));
|
||||
|
||||
const res = await request(app)
|
||||
.get("/api/invites/pcp_invite_test/test-resolution")
|
||||
.query({ url });
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toBe(
|
||||
"url resolves to a private, local, multicast, or reserved address",
|
||||
);
|
||||
expect(requestHead).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("rejects hostnames that resolve to private addresses", async () => {
|
||||
lookup.mockResolvedValue([{ address: "10.1.2.3", family: 4 }]);
|
||||
const app = createApp(createDbStub([createInvite()]));
|
||||
|
||||
const res = await request(app)
|
||||
.get("/api/invites/pcp_invite_test/test-resolution")
|
||||
.query({ url: "https://gateway.example.test/health" });
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toBe(
|
||||
"url resolves to a private, local, multicast, or reserved address",
|
||||
);
|
||||
expect(lookup).toHaveBeenCalledWith("gateway.example.test");
|
||||
expect(requestHead).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("rejects hostnames when any resolved address is private", async () => {
|
||||
lookup.mockResolvedValue([
|
||||
{ address: "93.184.216.34", family: 4 },
|
||||
{ address: "127.0.0.1", family: 4 },
|
||||
]);
|
||||
const app = createApp(createDbStub([createInvite()]));
|
||||
|
||||
const res = await request(app)
|
||||
.get("/api/invites/pcp_invite_test/test-resolution")
|
||||
.query({ url: "https://mixed.example.test/health" });
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(requestHead).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows public HTTPS targets through the resolved and pinned probe path", async () => {
|
||||
lookup.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
|
||||
requestHead.mockResolvedValue({ httpStatus: 204 });
|
||||
const app = createApp(createDbStub([createInvite()]));
|
||||
|
||||
const res = await request(app)
|
||||
.get("/api/invites/pcp_invite_test/test-resolution")
|
||||
.query({ url: "https://gateway.example.test/health", timeoutMs: "2500" });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body).toMatchObject({
|
||||
inviteId: "invite-1",
|
||||
requestedUrl: "https://gateway.example.test/health",
|
||||
timeoutMs: 2500,
|
||||
status: "reachable",
|
||||
method: "HEAD",
|
||||
httpStatus: 204,
|
||||
});
|
||||
expect(requestHead).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
resolvedAddress: "93.184.216.34",
|
||||
resolvedAddresses: ["93.184.216.34"],
|
||||
hostHeader: "gateway.example.test",
|
||||
tlsServername: "gateway.example.test",
|
||||
}),
|
||||
2500,
|
||||
);
|
||||
});
|
||||
|
||||
it.each([
|
||||
["missing invite", []],
|
||||
["revoked invite", [createInvite({ revokedAt: new Date("2026-03-07T00:05:00.000Z") })]],
|
||||
["expired invite", [createInvite({ expiresAt: new Date("2020-03-07T00:10:00.000Z") })]],
|
||||
])("returns not found for %s tokens before DNS lookup", async (_label, inviteRows) => {
|
||||
const app = createApp(createDbStub(inviteRows));
|
||||
|
||||
const res = await request(app)
|
||||
.get("/api/invites/pcp_invite_test/test-resolution")
|
||||
.query({ url: "https://gateway.example.test/health" });
|
||||
|
||||
expect(res.status).toBe(404);
|
||||
expect(res.body.error).toBe("Invite not found");
|
||||
expect(lookup).not.toHaveBeenCalled();
|
||||
expect(requestHead).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,375 @@
|
|||
import { Readable } from "node:stream";
|
||||
import express from "express";
|
||||
import request from "supertest";
|
||||
import { beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import { errorHandler } from "../middleware/index.js";
|
||||
import { issueRoutes } from "../routes/issues.js";
|
||||
|
||||
const issueId = "11111111-1111-4111-8111-111111111111";
|
||||
const companyId = "22222222-2222-4222-8222-222222222222";
|
||||
const ownerAgentId = "33333333-3333-4333-8333-333333333333";
|
||||
const peerAgentId = "44444444-4444-4444-8444-444444444444";
|
||||
const ownerRunId = "55555555-5555-4555-8555-555555555555";
|
||||
|
||||
const mockIssueService = vi.hoisted(() => ({
|
||||
addComment: vi.fn(),
|
||||
assertCheckoutOwner: vi.fn(),
|
||||
getAttachmentById: vi.fn(),
|
||||
getByIdentifier: vi.fn(),
|
||||
getById: vi.fn(),
|
||||
getRelationSummaries: vi.fn(),
|
||||
getWakeableParentAfterChildCompletion: vi.fn(),
|
||||
listAttachments: vi.fn(),
|
||||
listWakeableBlockedDependents: vi.fn(),
|
||||
remove: vi.fn(),
|
||||
removeAttachment: vi.fn(),
|
||||
update: vi.fn(),
|
||||
findMentionedAgents: vi.fn(),
|
||||
}));
|
||||
|
||||
const mockAccessService = vi.hoisted(() => ({
|
||||
canUser: vi.fn(),
|
||||
hasPermission: vi.fn(),
|
||||
}));
|
||||
|
||||
const mockAgentService = vi.hoisted(() => ({
|
||||
getById: vi.fn(),
|
||||
list: vi.fn(),
|
||||
resolveByReference: vi.fn(),
|
||||
}));
|
||||
|
||||
const mockDocumentService = vi.hoisted(() => ({
|
||||
upsertIssueDocument: vi.fn(),
|
||||
}));
|
||||
|
||||
const mockWorkProductService = vi.hoisted(() => ({
|
||||
getById: vi.fn(),
|
||||
update: vi.fn(),
|
||||
}));
|
||||
|
||||
const mockStorageService = vi.hoisted(() => ({
|
||||
provider: "local_disk",
|
||||
putFile: vi.fn(),
|
||||
getObject: vi.fn(),
|
||||
headObject: vi.fn(),
|
||||
deleteObject: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("@paperclipai/shared/telemetry", () => ({
|
||||
trackAgentTaskCompleted: vi.fn(),
|
||||
trackErrorHandlerCrash: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("../telemetry.js", () => ({
|
||||
getTelemetryClient: vi.fn(() => ({ track: vi.fn() })),
|
||||
}));
|
||||
|
||||
vi.mock("../services/index.js", () => ({
|
||||
accessService: () => mockAccessService,
|
||||
agentService: () => mockAgentService,
|
||||
documentService: () => mockDocumentService,
|
||||
executionWorkspaceService: () => ({}),
|
||||
feedbackService: () => ({
|
||||
listIssueVotesForUser: vi.fn(async () => []),
|
||||
saveIssueVote: vi.fn(async () => ({ vote: null, consentEnabledNow: false, sharingEnabled: false })),
|
||||
}),
|
||||
goalService: () => ({}),
|
||||
heartbeatService: () => ({
|
||||
wakeup: vi.fn(async () => undefined),
|
||||
reportRunActivity: vi.fn(async () => undefined),
|
||||
getRun: vi.fn(async () => null),
|
||||
getActiveRunForAgent: vi.fn(async () => null),
|
||||
cancelRun: vi.fn(async () => null),
|
||||
}),
|
||||
instanceSettingsService: () => ({
|
||||
get: vi.fn(async () => ({
|
||||
id: "instance-settings-1",
|
||||
general: {
|
||||
censorUsernameInLogs: false,
|
||||
feedbackDataSharingPreference: "prompt",
|
||||
},
|
||||
})),
|
||||
listCompanyIds: vi.fn(async () => [companyId]),
|
||||
}),
|
||||
issueApprovalService: () => ({}),
|
||||
issueService: () => mockIssueService,
|
||||
logActivity: vi.fn(async () => undefined),
|
||||
projectService: () => ({}),
|
||||
routineService: () => ({
|
||||
syncRunStatusForIssue: vi.fn(async () => undefined),
|
||||
}),
|
||||
workProductService: () => mockWorkProductService,
|
||||
}));
|
||||
|
||||
function makeIssue(overrides: Record<string, unknown> = {}) {
|
||||
return {
|
||||
id: issueId,
|
||||
companyId,
|
||||
status: "in_progress",
|
||||
priority: "high",
|
||||
projectId: null,
|
||||
goalId: null,
|
||||
parentId: null,
|
||||
assigneeAgentId: ownerAgentId,
|
||||
assigneeUserId: null,
|
||||
createdByUserId: "board-user",
|
||||
identifier: "PAP-1649",
|
||||
title: "Owned active issue",
|
||||
executionPolicy: null,
|
||||
executionState: null,
|
||||
hiddenAt: null,
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function makeAgent(id: string, overrides: Record<string, unknown> = {}) {
|
||||
return {
|
||||
id,
|
||||
companyId,
|
||||
role: "engineer",
|
||||
reportsTo: null,
|
||||
permissions: { canCreateAgents: false },
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function createApp(actor: Record<string, unknown>) {
|
||||
const app = express();
|
||||
app.use(express.json());
|
||||
app.use((req, _res, next) => {
|
||||
(req as any).actor = actor;
|
||||
next();
|
||||
});
|
||||
app.use("/api", issueRoutes({} as any, mockStorageService as any));
|
||||
app.use(errorHandler);
|
||||
return app;
|
||||
}
|
||||
|
||||
function peerActor(overrides: Record<string, unknown> = {}) {
|
||||
return {
|
||||
type: "agent",
|
||||
agentId: peerAgentId,
|
||||
companyId,
|
||||
source: "agent_key",
|
||||
runId: "66666666-6666-4666-8666-666666666666",
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function ownerActor() {
|
||||
return {
|
||||
type: "agent",
|
||||
agentId: ownerAgentId,
|
||||
companyId,
|
||||
source: "agent_key",
|
||||
runId: ownerRunId,
|
||||
};
|
||||
}
|
||||
|
||||
function boardActor() {
|
||||
return {
|
||||
type: "board",
|
||||
userId: "board-user",
|
||||
companyIds: [companyId],
|
||||
source: "local_implicit",
|
||||
isInstanceAdmin: false,
|
||||
};
|
||||
}
|
||||
|
||||
describe("agent issue mutation checkout ownership", () => {
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
mockAccessService.canUser.mockResolvedValue(true);
|
||||
mockAccessService.hasPermission.mockResolvedValue(false);
|
||||
mockAgentService.getById.mockImplementation(async (id: string) => {
|
||||
if (id === ownerAgentId) return makeAgent(ownerAgentId);
|
||||
if (id === peerAgentId) return makeAgent(peerAgentId);
|
||||
return null;
|
||||
});
|
||||
mockAgentService.list.mockResolvedValue([
|
||||
makeAgent(ownerAgentId),
|
||||
makeAgent(peerAgentId),
|
||||
]);
|
||||
mockAgentService.resolveByReference.mockResolvedValue({ ambiguous: false, agent: null });
|
||||
mockIssueService.getById.mockResolvedValue(makeIssue());
|
||||
mockIssueService.getByIdentifier.mockResolvedValue(null);
|
||||
mockIssueService.assertCheckoutOwner.mockResolvedValue({ adoptedFromRunId: null });
|
||||
mockIssueService.getRelationSummaries.mockResolvedValue({ blockedBy: [], blocks: [] });
|
||||
mockIssueService.listWakeableBlockedDependents.mockResolvedValue([]);
|
||||
mockIssueService.getWakeableParentAfterChildCompletion.mockResolvedValue(null);
|
||||
mockIssueService.findMentionedAgents.mockResolvedValue([]);
|
||||
mockIssueService.update.mockImplementation(async (_id: string, patch: Record<string, unknown>) => ({
|
||||
...makeIssue(),
|
||||
...patch,
|
||||
}));
|
||||
mockIssueService.addComment.mockResolvedValue({
|
||||
id: "77777777-7777-4777-8777-777777777777",
|
||||
issueId,
|
||||
companyId,
|
||||
body: "comment",
|
||||
});
|
||||
mockIssueService.listAttachments.mockResolvedValue([]);
|
||||
mockIssueService.remove.mockResolvedValue(makeIssue({ status: "cancelled" }));
|
||||
mockIssueService.getAttachmentById.mockResolvedValue({
|
||||
id: "attachment-1",
|
||||
issueId,
|
||||
companyId,
|
||||
objectKey: "issues/attachment-1/report.txt",
|
||||
contentType: "text/plain",
|
||||
byteSize: 6,
|
||||
originalFilename: "report.txt",
|
||||
});
|
||||
mockIssueService.removeAttachment.mockResolvedValue({
|
||||
id: "attachment-1",
|
||||
issueId,
|
||||
companyId,
|
||||
objectKey: "issues/attachment-1/report.txt",
|
||||
});
|
||||
mockDocumentService.upsertIssueDocument.mockResolvedValue({
|
||||
created: false,
|
||||
document: {
|
||||
id: "document-1",
|
||||
key: "plan",
|
||||
title: "Plan",
|
||||
format: "markdown",
|
||||
latestRevisionNumber: 2,
|
||||
},
|
||||
});
|
||||
mockWorkProductService.getById.mockResolvedValue({
|
||||
id: "product-1",
|
||||
issueId,
|
||||
companyId,
|
||||
type: "artifact",
|
||||
});
|
||||
mockWorkProductService.update.mockResolvedValue({
|
||||
id: "product-1",
|
||||
issueId,
|
||||
companyId,
|
||||
type: "artifact",
|
||||
title: "Updated",
|
||||
});
|
||||
mockStorageService.putFile.mockResolvedValue({
|
||||
provider: "local_disk",
|
||||
objectKey: "issues/upload.txt",
|
||||
contentType: "text/plain",
|
||||
byteSize: 6,
|
||||
sha256: "sha256",
|
||||
originalFilename: "upload.txt",
|
||||
});
|
||||
mockStorageService.getObject.mockResolvedValue({
|
||||
stream: Readable.from(Buffer.from("report")),
|
||||
contentLength: 6,
|
||||
});
|
||||
mockStorageService.deleteObject.mockResolvedValue(undefined);
|
||||
});
|
||||
|
||||
it.each([
|
||||
["patch", (app: express.Express) => request(app).patch(`/api/issues/${issueId}`).send({ title: "Blocked" })],
|
||||
["delete", (app: express.Express) => request(app).delete(`/api/issues/${issueId}`)],
|
||||
["comment", (app: express.Express) => request(app).post(`/api/issues/${issueId}/comments`).send({ body: "blocked" })],
|
||||
[
|
||||
"document upsert",
|
||||
(app: express.Express) =>
|
||||
request(app).put(`/api/issues/${issueId}/documents/plan`).send({ format: "markdown", body: "# blocked" }),
|
||||
],
|
||||
["work product update", (app: express.Express) => request(app).patch("/api/work-products/product-1").send({ title: "Blocked" })],
|
||||
[
|
||||
"attachment upload",
|
||||
(app: express.Express) =>
|
||||
request(app)
|
||||
.post(`/api/companies/${companyId}/issues/${issueId}/attachments`)
|
||||
.attach("file", Buffer.from("report"), { filename: "report.txt", contentType: "text/plain" }),
|
||||
],
|
||||
["attachment delete", (app: express.Express) => request(app).delete("/api/attachments/attachment-1")],
|
||||
])("rejects peer agent %s on another agent's active checkout", async (_name, sendRequest) => {
|
||||
const res = await sendRequest(createApp(peerActor()));
|
||||
|
||||
expect(res.status, JSON.stringify(res.body)).toBe(409);
|
||||
expect(res.body.error).toBe("Issue is checked out by another agent");
|
||||
expect(mockIssueService.assertCheckoutOwner).not.toHaveBeenCalled();
|
||||
expect(mockIssueService.update).not.toHaveBeenCalled();
|
||||
expect(mockIssueService.addComment).not.toHaveBeenCalled();
|
||||
expect(mockDocumentService.upsertIssueDocument).not.toHaveBeenCalled();
|
||||
expect(mockWorkProductService.update).not.toHaveBeenCalled();
|
||||
expect(mockStorageService.putFile).not.toHaveBeenCalled();
|
||||
expect(mockStorageService.deleteObject).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows the checked-out owner with the matching run id to patch and update documents", async () => {
|
||||
const app = createApp(ownerActor());
|
||||
|
||||
await request(app).patch(`/api/issues/${issueId}`).send({ title: "Updated" }).expect(200);
|
||||
await request(app)
|
||||
.put(`/api/issues/${issueId}/documents/plan`)
|
||||
.send({ format: "markdown", body: "# updated" })
|
||||
.expect(200);
|
||||
|
||||
expect(mockIssueService.assertCheckoutOwner).toHaveBeenCalledWith(issueId, ownerAgentId, ownerRunId);
|
||||
expect(mockIssueService.update).toHaveBeenCalled();
|
||||
expect(mockDocumentService.upsertIssueDocument).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
issueId,
|
||||
key: "plan",
|
||||
createdByAgentId: ownerAgentId,
|
||||
createdByRunId: ownerRunId,
|
||||
}),
|
||||
);
|
||||
});
|
||||
|
||||
it("preserves board mutations on active checkouts", async () => {
|
||||
const app = createApp(boardActor());
|
||||
|
||||
await request(app).patch(`/api/issues/${issueId}`).send({ title: "Board update" }).expect(200);
|
||||
await request(app)
|
||||
.put(`/api/issues/${issueId}/documents/plan`)
|
||||
.send({ format: "markdown", body: "# board" })
|
||||
.expect(200);
|
||||
|
||||
expect(mockIssueService.assertCheckoutOwner).not.toHaveBeenCalled();
|
||||
expect(mockIssueService.update).toHaveBeenCalled();
|
||||
expect(mockDocumentService.upsertIssueDocument).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows agents with the active-checkout management grant to mutate active checkouts", async () => {
|
||||
mockAccessService.hasPermission.mockImplementation(async (
|
||||
_companyId: string,
|
||||
_principalType: string,
|
||||
principalId: string,
|
||||
permissionKey: string,
|
||||
) => principalId === peerAgentId && permissionKey === "tasks:manage_active_checkouts");
|
||||
|
||||
const res = await request(createApp(peerActor())).patch(`/api/issues/${issueId}`).send({ title: "Managed update" });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(mockIssueService.assertCheckoutOwner).not.toHaveBeenCalled();
|
||||
expect(mockIssueService.update).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows same-company agent mutations when the issue is not in progress", async () => {
|
||||
mockIssueService.getById.mockResolvedValue(makeIssue({ status: "todo", assigneeAgentId: ownerAgentId }));
|
||||
mockIssueService.update.mockImplementation(async (_id: string, patch: Record<string, unknown>) => ({
|
||||
...makeIssue({ status: "todo", assigneeAgentId: ownerAgentId }),
|
||||
...patch,
|
||||
}));
|
||||
|
||||
const res = await request(createApp(peerActor())).patch(`/api/issues/${issueId}`).send({ title: "Todo update" });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(mockIssueService.assertCheckoutOwner).not.toHaveBeenCalled();
|
||||
expect(mockIssueService.update).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows same-company agent mutations on unassigned in-progress issues", async () => {
|
||||
mockIssueService.getById.mockResolvedValue(makeIssue({ assigneeAgentId: null }));
|
||||
mockIssueService.update.mockImplementation(async (_id: string, patch: Record<string, unknown>) => ({
|
||||
...makeIssue({ assigneeAgentId: null }),
|
||||
...patch,
|
||||
}));
|
||||
|
||||
const res = await request(createApp(peerActor())).patch(`/api/issues/${issueId}`).send({ title: "Claimable update" });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(mockIssueService.assertCheckoutOwner).not.toHaveBeenCalled();
|
||||
expect(mockIssueService.update).toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
|
@ -35,7 +35,12 @@ vi.mock("../services/live-events.js", () => ({
|
|||
async function createApp(
|
||||
actor: Record<string, unknown>,
|
||||
loaderOverrides: Record<string, unknown> = {},
|
||||
bridgeDeps?: Record<string, unknown>,
|
||||
routeOverrides: {
|
||||
db?: unknown;
|
||||
jobDeps?: unknown;
|
||||
toolDeps?: unknown;
|
||||
bridgeDeps?: unknown;
|
||||
} = {},
|
||||
) {
|
||||
const [{ pluginRoutes }, { errorHandler }] = await Promise.all([
|
||||
import("../routes/plugins.js"),
|
||||
|
|
@ -53,12 +58,58 @@ async function createApp(
|
|||
req.actor = actor as typeof req.actor;
|
||||
next();
|
||||
});
|
||||
app.use("/api", pluginRoutes({} as never, loader as never, undefined, undefined, undefined, bridgeDeps as never));
|
||||
app.use("/api", pluginRoutes(
|
||||
(routeOverrides.db ?? {}) as never,
|
||||
loader as never,
|
||||
routeOverrides.jobDeps as never,
|
||||
undefined,
|
||||
routeOverrides.toolDeps as never,
|
||||
routeOverrides.bridgeDeps as never,
|
||||
));
|
||||
app.use(errorHandler);
|
||||
|
||||
return { app, loader };
|
||||
}
|
||||
|
||||
function createSelectQueueDb(rows: Array<Array<Record<string, unknown>>>) {
|
||||
return {
|
||||
select: vi.fn(() => ({
|
||||
from: vi.fn(() => ({
|
||||
where: vi.fn(() => ({
|
||||
limit: vi.fn(() => Promise.resolve(rows.shift() ?? [])),
|
||||
})),
|
||||
})),
|
||||
})),
|
||||
};
|
||||
}
|
||||
|
||||
const companyA = "22222222-2222-4222-8222-222222222222";
|
||||
const companyB = "33333333-3333-4333-8333-333333333333";
|
||||
const agentA = "44444444-4444-4444-8444-444444444444";
|
||||
const runA = "55555555-5555-4555-8555-555555555555";
|
||||
const projectA = "66666666-6666-4666-8666-666666666666";
|
||||
const pluginId = "11111111-1111-4111-8111-111111111111";
|
||||
|
||||
function boardActor(overrides: Record<string, unknown> = {}) {
|
||||
return {
|
||||
type: "board",
|
||||
userId: "user-1",
|
||||
source: "session",
|
||||
isInstanceAdmin: false,
|
||||
companyIds: [companyA],
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function readyPlugin() {
|
||||
mockRegistry.getById.mockResolvedValue({
|
||||
id: pluginId,
|
||||
pluginKey: "paperclip.example",
|
||||
version: "1.0.0",
|
||||
status: "ready",
|
||||
});
|
||||
}
|
||||
|
||||
describe("plugin install and upgrade authz", () => {
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
|
|
@ -244,7 +295,7 @@ describe("scoped plugin API routes", () => {
|
|||
companyIds: ["company-1"],
|
||||
},
|
||||
{},
|
||||
{ workerManager },
|
||||
{ bridgeDeps: { workerManager } },
|
||||
);
|
||||
|
||||
const res = await request(app)
|
||||
|
|
@ -265,3 +316,227 @@ describe("scoped plugin API routes", () => {
|
|||
);
|
||||
}, 20_000);
|
||||
});
|
||||
|
||||
describe("plugin tool and bridge authz", () => {
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
});
|
||||
|
||||
it("rejects tool execution when the board user cannot access runContext.companyId", async () => {
|
||||
const executeTool = vi.fn();
|
||||
const getTool = vi.fn();
|
||||
const { app } = await createApp(boardActor(), {}, {
|
||||
toolDeps: {
|
||||
toolDispatcher: {
|
||||
listToolsForAgent: vi.fn(),
|
||||
getTool,
|
||||
executeTool,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/plugins/tools/execute")
|
||||
.send({
|
||||
tool: "paperclip.example:search",
|
||||
parameters: {},
|
||||
runContext: {
|
||||
agentId: agentA,
|
||||
runId: runA,
|
||||
companyId: companyB,
|
||||
projectId: projectA,
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(getTool).not.toHaveBeenCalled();
|
||||
expect(executeTool).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it.each([
|
||||
[
|
||||
"agentId",
|
||||
[
|
||||
[{ companyId: companyB }],
|
||||
],
|
||||
],
|
||||
[
|
||||
"runId company",
|
||||
[
|
||||
[{ companyId: companyA }],
|
||||
[{ companyId: companyB, agentId: agentA }],
|
||||
],
|
||||
],
|
||||
[
|
||||
"runId agent",
|
||||
[
|
||||
[{ companyId: companyA }],
|
||||
[{ companyId: companyA, agentId: "77777777-7777-4777-8777-777777777777" }],
|
||||
],
|
||||
],
|
||||
[
|
||||
"projectId",
|
||||
[
|
||||
[{ companyId: companyA }],
|
||||
[{ companyId: companyA, agentId: agentA }],
|
||||
[{ companyId: companyB }],
|
||||
],
|
||||
],
|
||||
])("rejects tool execution when runContext.%s is outside the company scope", async (_case, rows) => {
|
||||
const executeTool = vi.fn();
|
||||
const { app } = await createApp(boardActor(), {}, {
|
||||
db: createSelectQueueDb(rows),
|
||||
toolDeps: {
|
||||
toolDispatcher: {
|
||||
listToolsForAgent: vi.fn(),
|
||||
getTool: vi.fn(() => ({ name: "paperclip.example:search" })),
|
||||
executeTool,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/plugins/tools/execute")
|
||||
.send({
|
||||
tool: "paperclip.example:search",
|
||||
parameters: {},
|
||||
runContext: {
|
||||
agentId: agentA,
|
||||
runId: runA,
|
||||
companyId: companyA,
|
||||
projectId: projectA,
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(executeTool).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows tool execution when agent, run, and project all belong to runContext.companyId", async () => {
|
||||
const executeTool = vi.fn().mockResolvedValue({ content: "ok" });
|
||||
const { app } = await createApp(boardActor(), {}, {
|
||||
db: createSelectQueueDb([
|
||||
[{ companyId: companyA }],
|
||||
[{ companyId: companyA, agentId: agentA }],
|
||||
[{ companyId: companyA }],
|
||||
]),
|
||||
toolDeps: {
|
||||
toolDispatcher: {
|
||||
listToolsForAgent: vi.fn(),
|
||||
getTool: vi.fn(() => ({ name: "paperclip.example:search" })),
|
||||
executeTool,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/plugins/tools/execute")
|
||||
.send({
|
||||
tool: "paperclip.example:search",
|
||||
parameters: { q: "test" },
|
||||
runContext: {
|
||||
agentId: agentA,
|
||||
runId: runA,
|
||||
companyId: companyA,
|
||||
projectId: projectA,
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(executeTool).toHaveBeenCalledWith(
|
||||
"paperclip.example:search",
|
||||
{ q: "test" },
|
||||
{
|
||||
agentId: agentA,
|
||||
runId: runA,
|
||||
companyId: companyA,
|
||||
projectId: projectA,
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
it.each([
|
||||
["legacy data", "post", `/api/plugins/${pluginId}/bridge/data`, { key: "health" }],
|
||||
["legacy action", "post", `/api/plugins/${pluginId}/bridge/action`, { key: "sync" }],
|
||||
["url data", "post", `/api/plugins/${pluginId}/data/health`, {}],
|
||||
["url action", "post", `/api/plugins/${pluginId}/actions/sync`, {}],
|
||||
] as const)("rejects %s bridge calls without companyId for non-admin users", async (_name, _method, path, body) => {
|
||||
readyPlugin();
|
||||
const call = vi.fn();
|
||||
const { app } = await createApp(boardActor(), {}, {
|
||||
bridgeDeps: {
|
||||
workerManager: { call },
|
||||
},
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post(path)
|
||||
.send(body);
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(call).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows omitted-company bridge calls for instance admins as global plugin actions", async () => {
|
||||
readyPlugin();
|
||||
const call = vi.fn().mockResolvedValue({ ok: true });
|
||||
const { app } = await createApp(boardActor({
|
||||
userId: "admin-1",
|
||||
isInstanceAdmin: true,
|
||||
companyIds: [],
|
||||
}), {}, {
|
||||
bridgeDeps: {
|
||||
workerManager: { call },
|
||||
},
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post(`/api/plugins/${pluginId}/actions/sync`)
|
||||
.send({});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body).toEqual({ data: { ok: true } });
|
||||
expect(call).toHaveBeenCalledWith(pluginId, "performAction", {
|
||||
key: "sync",
|
||||
params: {},
|
||||
renderEnvironment: null,
|
||||
});
|
||||
});
|
||||
|
||||
it("rejects manual job triggers for non-admin board users", async () => {
|
||||
const scheduler = { triggerJob: vi.fn() };
|
||||
const jobStore = { getJobByIdForPlugin: vi.fn() };
|
||||
const { app } = await createApp(boardActor(), {}, {
|
||||
jobDeps: { scheduler, jobStore },
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post(`/api/plugins/${pluginId}/jobs/job-1/trigger`)
|
||||
.send({});
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
expect(scheduler.triggerJob).not.toHaveBeenCalled();
|
||||
expect(jobStore.getJobByIdForPlugin).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("allows manual job triggers for instance admins", async () => {
|
||||
readyPlugin();
|
||||
const scheduler = { triggerJob: vi.fn().mockResolvedValue({ runId: "run-1", jobId: "job-1" }) };
|
||||
const jobStore = { getJobByIdForPlugin: vi.fn().mockResolvedValue({ id: "job-1" }) };
|
||||
const { app } = await createApp(boardActor({
|
||||
userId: "admin-1",
|
||||
isInstanceAdmin: true,
|
||||
companyIds: [],
|
||||
}), {}, {
|
||||
jobDeps: { scheduler, jobStore },
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post(`/api/plugins/${pluginId}/jobs/job-1/trigger`)
|
||||
.send({});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body).toEqual({ runId: "run-1", jobId: "job-1" });
|
||||
expect(scheduler.triggerJob).toHaveBeenCalledWith("job-1", "manual");
|
||||
});
|
||||
});
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue