@agent-native/dispatch 0.0.0-beta-20260819155526

package/src/server/lib/vault-boot-resync.spec.ts

@@ -0,0 +1,68 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  resyncAllVaultSecretsToCredentialStore: vi.fn(),
+}));
+
+vi.mock("./vault-store.js", () => ({
+  resyncAllVaultSecretsToCredentialStore:
+    mocks.resyncAllVaultSecretsToCredentialStore,
+}));
+
+import {
+  __resetVaultBootResyncGuardForTests,
+  scheduleVaultBootResync,
+} from "./vault-boot-resync.js";
+
+describe("scheduleVaultBootResync", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    __resetVaultBootResyncGuardForTests();
+    mocks.resyncAllVaultSecretsToCredentialStore.mockResolvedValue({
+      groups: 0,
+      failedGroups: 0,
+      syncedKeys: 0,
+    });
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    mocks.resyncAllVaultSecretsToCredentialStore.mockReset();
+  });
+
+  it("does not run the resync synchronously — it waits for the boot delay", () => {
+    scheduleVaultBootResync();
+    expect(mocks.resyncAllVaultSecretsToCredentialStore).not.toHaveBeenCalled();
+  });
+
+  it("runs the resync exactly once after the boot delay elapses", async () => {
+    scheduleVaultBootResync();
+    await vi.runAllTimersAsync();
+    expect(mocks.resyncAllVaultSecretsToCredentialStore).toHaveBeenCalledTimes(
+      1,
+    );
+  });
+
+  it("only schedules one timer per process even if called repeatedly", async () => {
+    scheduleVaultBootResync();
+    scheduleVaultBootResync();
+    scheduleVaultBootResync();
+    await vi.runAllTimersAsync();
+    expect(mocks.resyncAllVaultSecretsToCredentialStore).toHaveBeenCalledTimes(
+      1,
+    );
+  });
+
+  it("swallows a resync failure instead of throwing", async () => {
+    mocks.resyncAllVaultSecretsToCredentialStore.mockRejectedValue(
+      new Error("boom"),
+    );
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    scheduleVaultBootResync();
+    await vi.runAllTimersAsync();
+
+    expect(warnSpy).toHaveBeenCalled();
+    warnSpy.mockRestore();
+  });
+});

package/src/server/lib/vault-boot-resync.ts

@@ -0,0 +1,50 @@
+import { resyncAllVaultSecretsToCredentialStore } from "./vault-store.js";
+
+/**
+ * Give the process a moment to finish booting (migrations, DB pool warmup,
+ * etc.) before touching every vault secret. This is a self-heal, not a
+ * hot-path dependency, so there is no urgency to run it immediately.
+ */
+const BOOT_RESYNC_DELAY_MS = 8000;
+
+/** Guards against scheduling more than one resync per process — see
+ * `scheduleVaultBootResync` below. */
+let scheduled = false;
+
+/**
+ * Schedule a one-time, best-effort re-sync of every vault secret (across
+ * every tenant) into the shared credential store, a few seconds after boot.
+ *
+ * Why this exists: `syncSecretsToCredentialStore` only runs when a vault
+ * secret is created or updated, so it only re-encrypts rows a user happens
+ * to touch. When the shared `app_secrets` encryption format changes under
+ * it — e.g. the `shared_encrypted_value` dual-write, or hosted workspaces
+ * deriving shared key material from `A2A_SECRET` — existing rows are stuck
+ * on the old format until someone manually re-saves each vault secret,
+ * which breaks sibling apps reading them. Re-running the sync for every row
+ * at boot self-heals that without any manual step.
+ *
+ * Fires at most once per process (`scheduled` guard) so calling this again
+ * — e.g. if the owning plugin module re-runs under dev's `*-plugin.ts` HMR
+ * reload — doesn't stack duplicate timers. Runs fully non-blocking: it
+ * never delays startup, and any failure is caught and logged rather than
+ * thrown, since a stale-encryption row is a degraded state, not a crash.
+ */
+export function scheduleVaultBootResync(): void {
+  if (scheduled) return;
+  scheduled = true;
+
+  setTimeout(() => {
+    void resyncAllVaultSecretsToCredentialStore().catch((error) => {
+      console.warn(
+        "[dispatch] vault boot resync failed to run",
+        error instanceof Error ? error.message : error,
+      );
+    });
+  }, BOOT_RESYNC_DELAY_MS);
+}
+
+/** Test-only: reset the once-per-process guard between spec runs. */
+export function __resetVaultBootResyncGuardForTests(): void {
+  scheduled = false;
+}

package/src/server/lib/vault-store.spec.ts

@@ -0,0 +1,541 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  currentOrgId: vi.fn(),
+  currentOwnerEmail: vi.fn(),
+  deleteAppSecret: vi.fn(),
+  discoverAgents: vi.fn(),
+  getDbExec: vi.fn(),
+  getDb: vi.fn(),
+  getOrgSetting: vi.fn(),
+  getUserSetting: vi.fn(),
+  listAppSecretsForScope: vi.fn(),
+  readAppSecret: vi.fn(),
+  recordAudit: vi.fn(),
+  writeAppSecret: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/secrets", () => ({
+  deleteAppSecret: mocks.deleteAppSecret,
+  listAppSecretsForScope: mocks.listAppSecretsForScope,
+  readAppSecret: mocks.readAppSecret,
+  writeAppSecret: mocks.writeAppSecret,
+}));
+
+vi.mock("@agent-native/core/db", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@agent-native/core/db")>()),
+  getDbExec: mocks.getDbExec,
+}));
+
+vi.mock("@agent-native/core/server/agent-discovery", () => ({
+  discoverAgents: mocks.discoverAgents,
+}));
+
+vi.mock("@agent-native/core/settings", () => ({
+  getOrgSetting: mocks.getOrgSetting,
+  getUserSetting: mocks.getUserSetting,
+  putOrgSetting: vi.fn(),
+  putUserSetting: vi.fn(),
+}));
+
+vi.mock("./dispatch-store.js", () => ({
+  currentOrgId: mocks.currentOrgId,
+  currentOwnerEmail: mocks.currentOwnerEmail,
+  recordAudit: mocks.recordAudit,
+}));
+
+vi.mock("../../db/index.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../db/index.js")>();
+  return {
+    ...actual,
+    getDb: mocks.getDb,
+  };
+});
+
+import { readAppSecret } from "@agent-native/core/secrets";
+
+import {
+  assertCanManageVault,
+  cleanupSyncedCredentialKeysIfUnused,
+  credentialStoreScopeForVaultCtx,
+  isTrustedEnvVarSyncAgentUrl,
+  getGrant,
+  listGrants,
+  resyncAllVaultSecretsToCredentialStore,
+  syncGrantsToApp,
+  syncSecretsToCredentialStore,
+} from "./vault-store.js";
+
+afterEach(() => {
+  vi.clearAllMocks();
+  vi.unstubAllEnvs();
+});
+
+describe("credentialStoreScopeForVaultCtx", () => {
+  it("uses org scope when vault sync runs inside an org", () => {
+    expect(
+      credentialStoreScopeForVaultCtx({
+        ownerEmail: "admin@example.test",
+        orgId: "org_123",
+      }),
+    ).toEqual({ scope: "org", scopeId: "org_123" });
+  });
+
+  it("uses workspace solo scope when no org is active", () => {
+    expect(
+      credentialStoreScopeForVaultCtx({
+        ownerEmail: "owner@example.test",
+        orgId: null,
+      }),
+    ).toEqual({
+      scope: "workspace",
+      scopeId: "solo:owner@example.test",
+    });
+  });
+});
+
+describe("vault authorization", () => {
+  it("rejects an organization member before reading shared vault values", async () => {
+    mocks.currentOrgId.mockReturnValue("org_123");
+    mocks.currentOwnerEmail.mockReturnValue("member@example.test");
+    mocks.getDbExec.mockReturnValue({
+      execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
+    });
+
+    await expect(assertCanManageVault()).rejects.toMatchObject({
+      message:
+        "Only organization owners and admins can manage the workspace vault.",
+      statusCode: 403,
+    });
+  });
+
+  it("rejects organization members before listing or reading grants", async () => {
+    mocks.currentOrgId.mockReturnValue("org_123");
+    mocks.currentOwnerEmail.mockReturnValue("member@example.test");
+    mocks.getDbExec.mockReturnValue({
+      execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
+    });
+
+    await expect(listGrants()).rejects.toThrow(
+      "Only organization owners and admins can manage the workspace vault.",
+    );
+    await expect(getGrant("grant-1")).rejects.toThrow(
+      "Only organization owners and admins can manage the workspace vault.",
+    );
+    expect(mocks.getDb).not.toHaveBeenCalled();
+  });
+
+  it.each(["owner", "admin"])(
+    "allows an organization %s to manage shared vault values",
+    async (role) => {
+      mocks.currentOrgId.mockReturnValue("org_123");
+      mocks.currentOwnerEmail.mockReturnValue(`${role}@example.test`);
+      mocks.getDbExec.mockReturnValue({
+        execute: vi.fn().mockResolvedValue({ rows: [{ role }] }),
+      });
+
+      await expect(assertCanManageVault()).resolves.toBeUndefined();
+    },
+  );
+
+  it("allows a solo workspace owner to manage their own vault", async () => {
+    mocks.currentOrgId.mockReturnValue(null);
+
+    await expect(assertCanManageVault()).resolves.toBeUndefined();
+    expect(mocks.getDbExec).not.toHaveBeenCalled();
+  });
+});
+
+describe("isTrustedEnvVarSyncAgentUrl", () => {
+  it("allows localhost development app URLs", () => {
+    expect(isTrustedEnvVarSyncAgentUrl("http://localhost:9201")).toBe(true);
+    expect(isTrustedEnvVarSyncAgentUrl("http://127.0.0.1:9201")).toBe(true);
+  });
+
+  it("allows same-origin workspace app URLs from deploy metadata", () => {
+    vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://workspace.example.test");
+
+    expect(
+      isTrustedEnvVarSyncAgentUrl("https://workspace.example.test/slides"),
+    ).toBe(true);
+  });
+
+  it("rejects remote custom agent origins", () => {
+    vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://workspace.example.test");
+
+    expect(isTrustedEnvVarSyncAgentUrl("https://attacker.example.test")).toBe(
+      false,
+    );
+  });
+});
+
+describe("syncSecretsToCredentialStore", () => {
+  it("writes vault secrets into app_secrets without returning values", async () => {
+    const result = await syncSecretsToCredentialStore(
+      [
+        {
+          name: "OpenAI API Key",
+          credentialKey: "OPENAI_API_KEY",
+          value: "sk-test-key",
+        } as any,
+      ],
+      { ownerEmail: "admin@example.test", orgId: "org_123" },
+    );
+
+    expect(mocks.writeAppSecret).toHaveBeenCalledWith({
+      key: "OPENAI_API_KEY",
+      value: "sk-test-key",
+      scope: "org",
+      scopeId: "org_123",
+      description: "Synced from Dispatch vault: OpenAI API Key",
+    });
+    expect(result).toEqual({
+      scope: "org",
+      scopeId: "org_123",
+      keys: ["OPENAI_API_KEY"],
+    });
+  });
+});
+
+describe("cleanupSyncedCredentialKeysIfUnused", () => {
+  function mockVaultSecretLookup(rows: Array<{ id: string }> = []) {
+    const query = {
+      select: vi.fn(() => query),
+      from: vi.fn(() => query),
+      where: vi.fn(() => query),
+      limit: vi.fn(async () => rows),
+    };
+    mocks.getDb.mockReturnValue(query);
+    return query;
+  }
+
+  it("deletes a candidate synced credential when no vault secret still uses it", async () => {
+    mockVaultSecretLookup([]);
+
+    await cleanupSyncedCredentialKeysIfUnused(
+      { ownerEmail: "admin@example.test", orgId: "org_123" },
+      ["OLD_API_KEY"],
+    );
+
+    expect(mocks.deleteAppSecret).toHaveBeenCalledWith({
+      key: "OLD_API_KEY",
+      scope: "org",
+      scopeId: "org_123",
+    });
+  });
+
+  it("uses the secret row scope for personal vault cleanup", async () => {
+    mockVaultSecretLookup([]);
+
+    await cleanupSyncedCredentialKeysIfUnused(
+      { ownerEmail: "owner@example.test", orgId: null },
+      ["PERSONAL_API_KEY"],
+    );
+
+    expect(mocks.deleteAppSecret).toHaveBeenCalledWith({
+      key: "PERSONAL_API_KEY",
+      scope: "workspace",
+      scopeId: "solo:owner@example.test",
+    });
+  });
+
+  it("keeps a candidate synced credential when another vault secret still uses it", async () => {
+    mockVaultSecretLookup([{ id: "secret_1" }]);
+
+    await cleanupSyncedCredentialKeysIfUnused(
+      { ownerEmail: "admin@example.test", orgId: "org_123" },
+      ["SHARED_API_KEY"],
+    );
+
+    expect(mocks.deleteAppSecret).not.toHaveBeenCalled();
+  });
+
+  it("can scan synced app secrets to recover stale keys after a retry", async () => {
+    mockVaultSecretLookup([]);
+    mocks.listAppSecretsForScope.mockResolvedValue([
+      {
+        key: "STALE_KEY",
+        description: "Synced from Dispatch vault: Old key",
+      },
+      {
+        key: "HAND_WRITTEN_KEY",
+        description: "Created manually",
+      },
+    ]);
+
+    await cleanupSyncedCredentialKeysIfUnused({
+      ownerEmail: "admin@example.test",
+      orgId: "org_123",
+    });
+
+    expect(mocks.listAppSecretsForScope).toHaveBeenCalledWith("org", "org_123");
+    expect(mocks.deleteAppSecret).toHaveBeenCalledTimes(1);
+    expect(mocks.deleteAppSecret).toHaveBeenCalledWith({
+      key: "STALE_KEY",
+      scope: "org",
+      scopeId: "org_123",
+    });
+  });
+});
+
+describe("resyncAllVaultSecretsToCredentialStore", () => {
+  function mockVaultSecretsRows(rows: Array<Record<string, unknown>>) {
+    mocks.getDb.mockReturnValue({
+      select: () => ({
+        from: () => Promise.resolve(rows),
+      }),
+    });
+  }
+
+  /** In-memory stand-in for the shared credential store, keyed the same way
+   * the real app_secrets table is: scope + scopeId + key. */
+  function fakeCredentialStore() {
+    const store = new Map<string, string>();
+    mocks.writeAppSecret.mockImplementation(async (args: any) => {
+      store.set(`${args.scope}:${args.scopeId}:${args.key}`, args.value);
+      return "app-secret-id";
+    });
+    mocks.readAppSecret.mockImplementation(async (ref: any) => {
+      const value = store.get(`${ref.scope}:${ref.scopeId}:${ref.key}`);
+      return value === undefined ? null : { value, updatedAt: Date.now() };
+    });
+    return store;
+  }
+
+  afterEach(() => {
+    mocks.writeAppSecret.mockReset();
+    mocks.readAppSecret.mockReset();
+  });
+
+  it("syncs vault secrets from different tenants into their own credential-store scopes", async () => {
+    fakeCredentialStore();
+    mockVaultSecretsRows([
+      {
+        id: "secret_org",
+        ownerEmail: "admin@example.test",
+        orgId: "org_123",
+        name: "OpenAI API Key",
+        credentialKey: "OPENAI_API_KEY",
+        value: "sk-org-key",
+      },
+      {
+        id: "secret_solo",
+        ownerEmail: "owner@example.test",
+        orgId: null,
+        name: "Personal API Key",
+        credentialKey: "PERSONAL_API_KEY",
+        value: "sk-personal-key",
+      },
+    ]);
+
+    const result = await resyncAllVaultSecretsToCredentialStore();
+
+    expect(result).toEqual({ groups: 2, failedGroups: 0, syncedKeys: 2 });
+
+    const orgScope = credentialStoreScopeForVaultCtx({
+      ownerEmail: "admin@example.test",
+      orgId: "org_123",
+    });
+    const soloScope = credentialStoreScopeForVaultCtx({
+      ownerEmail: "owner@example.test",
+      orgId: null,
+    });
+
+    await expect(
+      readAppSecret({ key: "OPENAI_API_KEY", ...orgScope }),
+    ).resolves.toMatchObject({ value: "sk-org-key" });
+    await expect(
+      readAppSecret({ key: "PERSONAL_API_KEY", ...soloScope }),
+    ).resolves.toMatchObject({ value: "sk-personal-key" });
+  });
+
+  it("logs and skips a group that fails without blocking the other groups", async () => {
+    const store = fakeCredentialStore();
+    const writeImpl = mocks.writeAppSecret.getMockImplementation();
+    mocks.writeAppSecret.mockImplementation(async (args: any) => {
+      if (args.key === "BROKEN_KEY") {
+        throw new Error("simulated credential-store write failure");
+      }
+      return writeImpl!(args);
+    });
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    mockVaultSecretsRows([
+      {
+        id: "secret_broken",
+        ownerEmail: "admin@broken.test",
+        orgId: "org_broken",
+        name: "Broken Key",
+        credentialKey: "BROKEN_KEY",
+        value: "sk-broken-value",
+      },
+      {
+        id: "secret_solo",
+        ownerEmail: "owner@example.test",
+        orgId: null,
+        name: "Personal API Key",
+        credentialKey: "PERSONAL_API_KEY",
+        value: "sk-personal-key",
+      },
+    ]);
+
+    const result = await resyncAllVaultSecretsToCredentialStore();
+
+    expect(result).toEqual({ groups: 2, failedGroups: 1, syncedKeys: 1 });
+
+    // The failed org's key never landed in the credential store.
+    expect(store.get("org:org_broken:BROKEN_KEY")).toBeUndefined();
+
+    // The other tenant's group still synced successfully.
+    const soloScope = credentialStoreScopeForVaultCtx({
+      ownerEmail: "owner@example.test",
+      orgId: null,
+    });
+    await expect(
+      readAppSecret({ key: "PERSONAL_API_KEY", ...soloScope }),
+    ).resolves.toMatchObject({ value: "sk-personal-key" });
+
+    // Exactly one warning, naming the key but never the plaintext value.
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const [warnMessage] = warnSpy.mock.calls[0]!;
+    expect(String(warnMessage)).toContain("BROKEN_KEY");
+    expect(String(warnMessage)).not.toContain("sk-broken-value");
+
+    warnSpy.mockRestore();
+  });
+});
+
+describe("syncGrantsToApp", () => {
+  /** In-memory stand-in for app_secrets, keyed scope + scopeId + key. */
+  function fakeCredentialStore() {
+    const store = new Map<string, string>();
+    mocks.writeAppSecret.mockImplementation(async (args: any) => {
+      store.set(`${args.scope}:${args.scopeId}:${args.key}`, args.value);
+      return "app-secret-id";
+    });
+    return store;
+  }
+
+  /**
+   * `all-apps` vault access, one discovered app, and a caller whose active org
+   * is deliberately NOT the org that owns the secrets. The app URL is remote so
+   * the best-effort env-var push is skipped and no network call is attempted.
+   */
+  function mockWorkspace(
+    caller: { ownerEmail: string; orgId: string | null },
+    secretRows: Array<Record<string, unknown>>,
+  ) {
+    mocks.currentOwnerEmail.mockReturnValue(caller.ownerEmail);
+    mocks.currentOrgId.mockReturnValue(caller.orgId);
+    mocks.getOrgSetting.mockResolvedValue(null);
+    mocks.getUserSetting.mockResolvedValue(null);
+    mocks.discoverAgents.mockResolvedValue([
+      { id: "coach", url: "https://coach.example.test" },
+    ]);
+    mocks.getDb.mockReturnValue({
+      select: () => ({
+        from: () => ({
+          where: () => ({ orderBy: async () => secretRows }),
+        }),
+      }),
+      insert: () => ({ values: async () => undefined }),
+    });
+  }
+
+  afterEach(() => {
+    mocks.writeAppSecret.mockReset();
+  });
+
+  // The regression: `all-apps` mode lists secrets across orgs, and syncing them
+  // under the caller's ctx upserts copies of another org's credentials into
+  // whichever org the person clicking Sync happened to be in. Because
+  // writeAppSecret upserts, that copies rather than moves, so credential
+  // material accumulates permanently in the wrong org.
+  it("writes each secret under its own org, not the caller's active org", async () => {
+    const store = fakeCredentialStore();
+    mockWorkspace({ ownerEmail: "clicker@example.test", orgId: "org_caller" }, [
+      {
+        id: "secret_builder",
+        ownerEmail: "admin@example.test",
+        orgId: "org_owner",
+        name: "Academy Site URL",
+        credentialKey: "ACADEMY_CONVEX_SITE_URL",
+        value: "https://academy.example.test",
+      },
+      {
+        id: "secret_solo",
+        ownerEmail: "owner@example.test",
+        orgId: null,
+        name: "Personal API Key",
+        credentialKey: "PERSONAL_API_KEY",
+        value: "sk-test-personal",
+      },
+    ]);
+
+    const result = await syncGrantsToApp("coach");
+
+    expect(store.get("org:org_owner:ACADEMY_CONVEX_SITE_URL")).toBe(
+      "https://academy.example.test",
+    );
+    expect(
+      store.get("workspace:solo:owner@example.test:PERSONAL_API_KEY"),
+    ).toBe("sk-test-personal");
+
+    // Nothing may be written under the caller's org.
+    const callerScoped = [...store.keys()].filter((key) =>
+      key.startsWith("org:org_caller:"),
+    );
+    expect(callerScoped).toEqual([]);
+
+    expect(result.credentialStores).toEqual([
+      { scope: "org", scopeId: "org_owner", synced: 1 },
+      {
+        scope: "workspace",
+        scopeId: "solo:owner@example.test",
+        synced: 1,
+      },
+    ]);
+    expect(result.synced).toBe(2);
+  });
+
+  it("still syncs the caller's own org secrets into that org", async () => {
+    const store = fakeCredentialStore();
+    mockWorkspace({ ownerEmail: "clicker@example.test", orgId: "org_caller" }, [
+      {
+        id: "secret_own",
+        ownerEmail: "clicker@example.test",
+        orgId: "org_caller",
+        name: "Shared API Key",
+        credentialKey: "SHARED_API_KEY",
+        value: "sk-test-shared",
+      },
+    ]);
+
+    const result = await syncGrantsToApp("coach");
+
+    expect(store.get("org:org_caller:SHARED_API_KEY")).toBe("sk-test-shared");
+    expect(result.credentialStores).toEqual([
+      { scope: "org", scopeId: "org_caller", synced: 1 },
+    ]);
+  });
+
+  // A row with no ownerEmail cannot name its own tenant, so the caller's ctx is
+  // the only scope available — the pre-existing ctxForSecretRow fallback.
+  it("falls back to the caller ctx for a secret row with no owner", async () => {
+    const store = fakeCredentialStore();
+    mockWorkspace({ ownerEmail: "clicker@example.test", orgId: "org_caller" }, [
+      {
+        id: "secret_ownerless",
+        ownerEmail: "",
+        orgId: null,
+        name: "Legacy Key",
+        credentialKey: "LEGACY_KEY",
+        value: "sk-test-legacy",
+      },
+    ]);
+
+    await syncGrantsToApp("coach");
+
+    expect(store.get("org:org_caller:LEGACY_KEY")).toBe("sk-test-legacy");
+  });
+});