@agent-native/dispatch 0.13.13 → 0.14.0

package/src/actions/provider-api-request.ts

@@ -7,6 +7,7 @@ import {
   DISPATCH_APP_ID,
   executeProviderApiRequest,
 } from "../server/lib/provider-api.js";
+import { buildProviderApiAuditSummary } from "./provider-api-audit.js";
 
 const MethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]);
 
@@ -197,6 +198,15 @@ export default defineAction({
       ),
   }),
   http: false,
+  audit: {
+    recordInputs: false,
+    target: (args) => ({
+      type: "provider-api",
+      id: String(args.provider),
+      visibility: "private",
+    }),
+    summary: (args) => buildProviderApiAuditSummary(args),
+  },
   run: async (args) => {
     if (args.stageAs) {
       const ctx = getCredentialContext();

package/src/actions/send-platform-message.spec.ts

@@ -0,0 +1,108 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getInstallation: vi.fn(),
+  resolveTokenBundle: vi.fn(),
+  resolveSecret: vi.fn(),
+  sendMessageToTarget: vi.fn(),
+  getDestinationById: vi.fn(),
+  slackAdapter: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/integrations", () => ({
+  listIntegrationInstallations: mocks.getInstallation,
+  resolveIntegrationTokenBundle: mocks.resolveTokenBundle,
+}));
+
+vi.mock("@agent-native/core/server", () => ({
+  getRequestUserEmail: () => "member@example.com",
+  getRequestOrgId: () => "org-a",
+  resolveSecret: mocks.resolveSecret,
+  isEmailConfigured: vi.fn(),
+  slackAdapter: mocks.slackAdapter,
+  telegramAdapter: vi.fn(),
+  emailAdapter: vi.fn(),
+}));
+
+vi.mock("../server/lib/dispatch-store.js", () => ({
+  getDestinationById: mocks.getDestinationById,
+}));
+
+const action = (await import("./send-platform-message.js")).default;
+
+describe("send-platform-message tenant scoping", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.getDestinationById.mockResolvedValue(null);
+    mocks.resolveSecret.mockResolvedValue(null);
+    mocks.slackAdapter.mockImplementation(
+      (options: { resolveBotToken: () => Promise<string | undefined> }) => ({
+        formatAgentResponse: (text: string) => ({
+          text,
+          platformContext: {},
+        }),
+        sendMessageToTarget: async (...args: unknown[]) => {
+          expect(await options.resolveBotToken()).toBe("own-managed-token");
+          return mocks.sendMessageToTarget(...args);
+        },
+      }),
+    );
+  });
+
+  it("resolves and uses only the caller org's Slack installation", async () => {
+    mocks.getInstallation.mockResolvedValue([
+      {
+        id: "installation-a",
+        installationKey: "team:T1:app:A1",
+        teamId: "T1",
+        enterpriseId: null,
+      },
+    ]);
+    mocks.resolveTokenBundle.mockResolvedValue({
+      accessToken: "own-managed-token",
+    });
+
+    await action.run(
+      {
+        platform: "slack",
+        destination: "C1",
+        tenantId: "T1",
+        text: "hello",
+      },
+      {} as never,
+    );
+
+    expect(mocks.getInstallation).toHaveBeenCalledWith(
+      {
+        userEmail: "member@example.com",
+        orgId: "org-a",
+      },
+      "slack",
+    );
+    expect(mocks.resolveTokenBundle).toHaveBeenCalledWith(
+      "slack",
+      "team:T1:app:A1",
+    );
+    expect(mocks.sendMessageToTarget).toHaveBeenCalledOnce();
+  });
+
+  it("does not use another org's managed installation", async () => {
+    mocks.getInstallation.mockResolvedValue([]);
+
+    await expect(
+      action.run(
+        {
+          platform: "slack",
+          destination: "C1",
+          tenantId: "T-other",
+          text: "hello",
+        },
+        {} as never,
+      ),
+    ).rejects.toThrow("That Slack workspace is not connected");
+
+    expect(mocks.resolveTokenBundle).not.toHaveBeenCalled();
+    expect(mocks.slackAdapter).not.toHaveBeenCalled();
+    expect(mocks.sendMessageToTarget).not.toHaveBeenCalled();
+  });
+});

package/src/actions/send-platform-message.ts

@@ -1,5 +1,11 @@
 import { defineAction } from "@agent-native/core";
 import {
+  listIntegrationInstallations,
+  resolveIntegrationTokenBundle,
+} from "@agent-native/core/integrations";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
   slackAdapter,
   telegramAdapter,
   emailAdapter,
@@ -8,21 +14,52 @@ import {
 } from "@agent-native/core/server";
 import { z } from "zod";
 
-import {
-  getDestinationById,
-  recordAudit,
-} from "../server/lib/dispatch-store.js";
+import { getDestinationById } from "../server/lib/dispatch-store.js";
 
-function getAdapter(platform: "slack" | "telegram" | "email") {
+function getAdapter(
+  platform: "slack" | "telegram" | "email",
+  slackToken?: string,
+) {
   if (platform === "email") return emailAdapter();
-  return platform === "slack" ? slackAdapter() : telegramAdapter();
+  return platform === "slack"
+    ? slackAdapter({ resolveBotToken: async () => slackToken })
+    : telegramAdapter();
 }
 
 async function assertOutboundConfigured(
   platform: "slack" | "telegram" | "email",
-) {
-  if (platform === "slack" && !(await resolveSecret("SLACK_BOT_TOKEN"))) {
-    throw new Error("Slack outbound messaging is not configured");
+  tenantId?: string,
+): Promise<string | undefined> {
+  if (platform === "slack") {
+    const userEmail = getRequestUserEmail();
+    if (!userEmail) throw new Error("An authenticated user is required");
+    const installations = tenantId
+      ? await listIntegrationInstallations(
+          { userEmail, orgId: getRequestOrgId() ?? null },
+          "slack",
+        )
+      : [];
+    const installation =
+      installations.find(
+        (candidate) =>
+          candidate.teamId === tenantId || candidate.enterpriseId === tenantId,
+      ) ?? null;
+    const managed = installation
+      ? await resolveIntegrationTokenBundle(
+          "slack",
+          installation.installationKey,
+        )
+      : null;
+    const token =
+      managed?.accessToken ?? (await resolveSecret("SLACK_BOT_TOKEN"));
+    if (!token) {
+      throw new Error(
+        tenantId
+          ? "That Slack workspace is not connected"
+          : "Select a Slack workspace for managed outbound messaging",
+      );
+    }
+    return token;
   }
   if (platform === "telegram" && !(await resolveSecret("TELEGRAM_BOT_TOKEN"))) {
     throw new Error("Telegram outbound messaging is not configured");
@@ -45,9 +82,29 @@ export default defineAction({
     destinationId: z.string().optional().describe("Saved destination id"),
     destination: z.string().optional().describe("Raw platform destination id"),
     threadRef: z.string().optional().describe("Optional thread reference"),
+    tenantId: z
+      .string()
+      .optional()
+      .describe("Slack workspace/team id for managed installations"),
     text: z.string().describe("Message to send"),
   }),
-  run: async ({ platform, destinationId, destination, threadRef, text }) => {
+  audit: {
+    recordInputs: false,
+    target: (args) => ({
+      type: "destination",
+      id: args.destinationId || args.destination || "unknown",
+      visibility: "private",
+    }),
+    summary: (args) => `Sent proactive ${args.platform || "saved"} message`,
+  },
+  run: async ({
+    platform,
+    destinationId,
+    destination,
+    threadRef,
+    tenantId,
+    text,
+  }) => {
     const saved = destinationId
       ? await getDestinationById(destinationId)
       : null;
@@ -63,9 +120,12 @@ export default defineAction({
       throw new Error("A platform and destination are required");
     }
 
-    await assertOutboundConfigured(resolvedPlatform);
+    const slackToken = await assertOutboundConfigured(
+      resolvedPlatform,
+      tenantId,
+    );
 
-    const adapter = getAdapter(resolvedPlatform);
+    const adapter = getAdapter(resolvedPlatform, slackToken);
     if (!adapter.sendMessageToTarget) {
       throw new Error(
         `Platform ${resolvedPlatform} does not support proactive outbound messaging`,
@@ -76,19 +136,7 @@ export default defineAction({
       destination: resolvedDestination,
       threadRef: resolvedThreadRef,
       label: saved?.name || undefined,
-    });
-
-    await recordAudit({
-      action: "message.sent",
-      targetType: "destination",
-      targetId: destinationId || resolvedDestination,
-      summary: `Sent proactive ${resolvedPlatform} message${saved?.name ? ` to ${saved.name}` : ""}`,
-      metadata: {
-        platform: resolvedPlatform,
-        destination: resolvedDestination,
-        threadRef: resolvedThreadRef,
-        text,
-      },
+      tenantId,
     });
 
     return {

package/src/components/messaging-setup-panel.spec.tsx

@@ -0,0 +1,191 @@
+// @vitest-environment happy-dom
+import React, { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { MessagingSetupPanel } from "./messaging-setup-panel";
+import { TooltipProvider } from "./ui/tooltip";
+
+const clientState = vi.hoisted(() => ({
+  statuses: [] as any[],
+  envStatuses: [] as any[],
+}));
+
+vi.mock("@agent-native/core/client", () => ({
+  disconnectManagedIntegrationInstallation: vi.fn(() => Promise.resolve()),
+  listManagedIntegrationBudgets: vi.fn(() => Promise.resolve([])),
+  listManagedIntegrationInstallations: vi.fn(() => Promise.resolve([])),
+  listManagedIntegrationScopes: vi.fn(() => Promise.resolve([])),
+  listIntegrationStatuses: vi.fn(() => Promise.resolve(clientState.statuses)),
+  listIntegrationEnvStatuses: vi.fn(() =>
+    Promise.resolve(clientState.envStatuses),
+  ),
+  managedIntegrationOAuthUrl: vi.fn(
+    (platform: string) => `/_agent-native/integrations/${platform}/oauth/start`,
+  ),
+  managedSlackAgentManifestUrl: vi.fn(
+    () => "/_agent-native/integrations/slack/manifest",
+  ),
+  saveIntegrationEnvVars: vi.fn(),
+  saveManagedIntegrationBudget: vi.fn(() => Promise.resolve()),
+  saveManagedIntegrationScope: vi.fn(() => Promise.resolve()),
+  setIntegrationEnabled: vi.fn(),
+  setupIntegration: vi.fn(),
+  testManagedIntegrationInstallation: vi.fn(() => Promise.resolve()),
+  useFormatters: () => ({
+    formatDate: (value: Date | number | string) =>
+      new Date(value).toLocaleDateString("en-US"),
+  }),
+  useT: () => (key: string) =>
+    (
+      ({
+        "messaging.managed.agentManifest": "Agent manifest",
+        "messaging.managed.agentManifestDescription":
+          "The Agent manifest enables Slack's Agent view and direct messages.",
+        "messaging.managed.addToSlack": "Add to Slack",
+        "messaging.managed.requiredCredentials":
+          "Save the required Slack app credentials below to enable Add to Slack.",
+      }) as Record<string, string>
+    )[key] ?? key,
+}));
+
+vi.mock("@agent-native/core/integrations", () => ({
+  listBuiltInChannelIntegrations: () => [
+    {
+      id: "slack",
+      name: "Slack",
+      iconKey: "slack",
+      description: "Slack description",
+      documentation: { href: "/docs/messaging#slack" },
+      setup: { steps: ["Create a Slack app."] },
+      credentialRequirements: [
+        { key: "SLACK_BOT_TOKEN", label: "Slack Bot Token", required: true },
+      ],
+    },
+    {
+      id: "email",
+      name: "Email",
+      iconKey: "email",
+      description: "Email description",
+      documentation: { href: "/docs/messaging#email" },
+      setup: { steps: ["Choose a provider."] },
+      credentialRequirements: [
+        {
+          key: "RESEND_API_KEY",
+          label: "Resend API Key",
+          required: true,
+          alternativeGroup: "email-provider",
+        },
+        {
+          key: "SENDGRID_API_KEY",
+          label: "SendGrid API Key",
+          required: true,
+          alternativeGroup: "email-provider",
+        },
+      ],
+    },
+  ],
+}));
+
+describe("MessagingSetupPanel", () => {
+  let container: HTMLDivElement;
+  let root: Root;
+
+  beforeEach(() => {
+    vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
+    clientState.statuses = [];
+    clientState.envStatuses = [];
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = createRoot(container);
+  });
+
+  afterEach(() => {
+    act(() => root.unmount());
+    container.remove();
+    vi.unstubAllGlobals();
+  });
+
+  it("renders catalog-backed channel cards", async () => {
+    await act(async () => {
+      root.render(
+        <TooltipProvider>
+          <MessagingSetupPanel />
+        </TooltipProvider>,
+      );
+      await Promise.resolve();
+    });
+
+    expect(container.textContent).toContain("Slack");
+    expect(container.textContent).toContain("Slack description");
+    expect(container.textContent).toContain("Email");
+    expect(container.textContent).toContain("Email description");
+    expect(container.textContent).not.toContain("Discord");
+    expect(
+      container.querySelector(
+        'a[href="/_agent-native/integrations/slack/manifest"]',
+      )?.textContent,
+    ).toContain("Agent manifest");
+    expect(container.textContent).toContain(
+      "enables Slack's Agent view and direct messages",
+    );
+    expect(
+      container.querySelector(
+        'a[href="/_agent-native/integrations/slack/oauth/start"]',
+      ),
+    ).toBeNull();
+    expect(
+      [...container.querySelectorAll("button")].find((button) =>
+        button.textContent?.includes("Add to Slack"),
+      )?.disabled,
+    ).toBe(true);
+    expect(container.textContent).toContain(
+      "Save the required Slack app credentials below",
+    );
+  });
+
+  it("shows connected and alternative credential states", async () => {
+    clientState.statuses = [
+      { platform: "slack", label: "Slack", configured: true, enabled: true },
+    ];
+    clientState.envStatuses = [
+      {
+        key: "SLACK_BOT_TOKEN",
+        label: "Slack Bot Token",
+        required: true,
+        configured: true,
+      },
+      {
+        key: "RESEND_API_KEY",
+        label: "Resend API Key",
+        required: true,
+        configured: true,
+      },
+      {
+        key: "SENDGRID_API_KEY",
+        label: "SendGrid API Key",
+        required: true,
+        configured: false,
+      },
+    ];
+
+    await act(async () => {
+      root.render(
+        <TooltipProvider>
+          <MessagingSetupPanel />
+        </TooltipProvider>,
+      );
+      await Promise.resolve();
+    });
+
+    expect(container.textContent).toContain("Connected");
+    expect(container.textContent).toContain("Saved");
+    expect(
+      container.querySelector(
+        'a[href="/_agent-native/integrations/slack/oauth/start"]',
+      ),
+    ).not.toBeNull();
+    expect(container.querySelectorAll("button").length).toBeGreaterThan(0);
+    expect(container.textContent).not.toContain("Save credentials");
+  });
+});