@agent-native/dispatch 0.14.2 → 0.14.3

package/src/actions/provider-api-register.ts

@@ -1,13 +1,50 @@
 import { defineAction } from "@agent-native/core";
+import { getDbExec } from "@agent-native/core/db";
 import {
   upsertCustomProvider,
   deleteCustomProvider,
   listCustomProviders,
   getCustomProvider,
+  assertCanMutateCustomProviderScope,
 } from "@agent-native/core/provider-api";
 import { getCredentialContext } from "@agent-native/core/server";
 import { z } from "zod";
 
+/**
+ * Resolve the caller's role in a specific org, straight from `org_members`.
+ *
+ * `getCredentialContext()` (from `@agent-native/core/server`) only exposes
+ * `{ userEmail, orgId }` — no role. `getOrgContext()` (from
+ * `@agent-native/core/org`) resolves role but requires an `H3Event`, which
+ * `defineAction` handlers are not given. This mirrors the established
+ * no-event role-lookup idiom already used for org-admin gating inside
+ * agent-callable/background code (see `isCurrentUserOrgAdmin` in
+ * `packages/core/src/jobs/tools.ts`, `getViewerOrgRole` in
+ * `packages/dispatch/src/server/lib/usage-metrics-store.ts`, and the same
+ * query in `packages/core/src/mcp/actions/service-token-access.ts`) — same
+ * SQL, same fail-closed-to-null-on-error semantics. Returns null (never an
+ * org role) on any lookup error or when the caller has no membership row in
+ * this org.
+ */
+async function resolveCallerOrgRole(
+  orgId: string | null,
+  email: string,
+): Promise<string | null> {
+  if (!orgId) return null;
+  try {
+    const client = getDbExec();
+    const { rows } = await client.execute({
+      sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+      args: [orgId, email.toLowerCase()],
+    });
+    if (rows.length === 0) return null;
+    const role = (rows[0] as { role?: unknown }).role;
+    return typeof role === "string" && role ? role : null;
+  } catch {
+    return null;
+  }
+}
+
 const AuthSchema = z.discriminatedUnion("type", [
   z.object({
     type: z.literal("none"),
@@ -138,6 +175,33 @@ After registration the provider appears in provider-api-catalog and can be used
     const scopeId =
       scope === "org" ? (ctx.orgId ?? ctx.userEmail) : ctx.userEmail;
 
+    // Only upsert/delete mutate state; list/get remain readable by any org
+    // member (scoping org-scoped reads is left as a follow-up — see plan
+    // 014). Resolve the caller's role in the *target* org (`scopeId`, which
+    // for scope === "org" is exactly `ctx.orgId`) and enforce owner/admin
+    // before allowing an org-scoped write. `assertCanMutateCustomProviderScope`
+    // is the single source of truth for this check and is also enforced a
+    // second time inside `upsertCustomProvider`/`deleteCustomProvider`
+    // themselves (defense in depth) — calling it here too gives a clear,
+    // early error before any other work happens.
+    //
+    // When the caller has no active org (`ctx.orgId` is null — a solo user,
+    // or an app that hasn't wired `resolveOrgId` at all), `scopeId` above
+    // already collapsed to `ctx.userEmail`: there is no shared org resource
+    // to protect, and no *other* caller can ever address that same scopeId
+    // (every other request's fallback is scoped to *its own* email). Treat
+    // that case like sole ownership of a personal bucket — consistent with
+    // `org/context.ts`'s auto-created personal org, which also assigns the
+    // user role "owner" — rather than hard-rejecting scope: "org" (the
+    // action's own default) for every solo user or org-less app.
+    let orgRole: string | null = null;
+    if ((operation === "upsert" || operation === "delete") && scope === "org") {
+      orgRole = ctx.orgId
+        ? await resolveCallerOrgRole(ctx.orgId, ctx.userEmail)
+        : "owner";
+      assertCanMutateCustomProviderScope(scope, scopeId, orgRole);
+    }
+
     if (operation === "list") {
       const providers = await listCustomProviders(scope, scopeId);
       return {
@@ -165,7 +229,7 @@ After registration the provider appears in provider-api-catalog and can be used
 
     if (operation === "delete") {
       if (!id) throw new Error("id is required for delete operation.");
-      const deleted = await deleteCustomProvider(scope, scopeId, id);
+      const deleted = await deleteCustomProvider(scope, scopeId, id, orgRole);
       return { deleted, id };
     }
 
@@ -186,6 +250,7 @@ After registration the provider appears in provider-api-catalog and can be used
       allowedHostSuffixes,
       defaultHeaders,
       notes,
+      orgRole,
     });
 
     return {

package/src/server/lib/approval-fencing.spec.ts

@@ -0,0 +1,309 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Each test runs real migrations against a fresh SQLite file; under full
+// workspace concurrency that setup can exceed the 5s default timeout.
+vi.setConfig({ testTimeout: 30_000 });
+
+const ownerEmail = "owner+approval-fencing@example.test";
+const orgId = "org_approval_fencing";
+
+const originalEnv = {
+  APP_NAME: process.env.APP_NAME,
+  DATABASE_URL: process.env.DATABASE_URL,
+  DATABASE_AUTH_TOKEN: process.env.DATABASE_AUTH_TOKEN,
+  DISPATCH_DATABASE_URL: process.env.DISPATCH_DATABASE_URL,
+  DISPATCH_DATABASE_AUTH_TOKEN: process.env.DISPATCH_DATABASE_AUTH_TOKEN,
+};
+
+let tempDir: string | null = null;
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(originalEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+}
+
+beforeEach(async () => {
+  tempDir = fs.mkdtempSync(
+    path.join(os.tmpdir(), "dispatch-approval-fencing-"),
+  );
+  process.env.DATABASE_URL = `file:${path.join(tempDir, "app.db")}`;
+  delete process.env.APP_NAME;
+  delete process.env.DATABASE_AUTH_TOKEN;
+  delete process.env.DISPATCH_DATABASE_URL;
+  delete process.env.DISPATCH_DATABASE_AUTH_TOKEN;
+  vi.resetModules();
+
+  const [{ runMigrations }, { dispatchMigrations }] = await Promise.all([
+    import("@agent-native/core/db"),
+    import("../../db/migrations.js"),
+  ]);
+  await runMigrations(dispatchMigrations, {
+    table: "dispatch_migrations",
+  })({});
+});
+
+afterEach(async () => {
+  try {
+    const { closeDbExec } = await import("@agent-native/core/db");
+    await closeDbExec();
+  } catch {}
+  restoreEnv();
+  if (tempDir) {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+    tempDir = null;
+  }
+});
+
+describe("dispatch approval request status fencing", () => {
+  it("applies the change once when approveRequest is called twice on the same request", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./dispatch-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      const created = await dispatchStore.createApprovalRequest({
+        changeType: "approval-policy.update",
+        targetType: "dispatch-settings",
+        targetId: "dispatch-approval-policy",
+        summary: "Enable approval policy",
+        payload: { enabled: true, approverEmails: ["reviewer@example.test"] },
+      });
+      const requestId = (created as any).id;
+
+      const first = await dispatchStore.approveRequest(requestId);
+      expect(first.status).toBe("approved");
+      expect(first.reviewedBy).toBe(ownerEmail);
+      expect(first.reviewedAt).toBeTruthy();
+
+      expect(await dispatchStore.getApprovalPolicy()).toEqual({
+        enabled: true,
+        approverEmails: ["reviewer@example.test"],
+      });
+
+      const approvedAuditCount = async () => {
+        const rows = await exec.execute({
+          sql: "SELECT COUNT(*) as count FROM dispatch_audit_events WHERE action = 'approval.approved' AND target_id = ?",
+          args: [requestId],
+        });
+        return Number((rows.rows[0] as any).count);
+      };
+      expect(await approvedAuditCount()).toBe(1);
+
+      // A concurrent second approve landing after the first already won the
+      // race must find the row no longer 'pending': the fenced UPDATE
+      // affects zero rows, so it must not re-apply the change.
+      const second = await dispatchStore.approveRequest(requestId);
+      expect(second.status).toBe("approved");
+      expect(second.reviewedAt).toBe(first.reviewedAt);
+      expect(await approvedAuditCount()).toBe(1);
+    });
+  });
+
+  it("reclaims a stale applying lease after a worker crash", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./dispatch-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      const created = await dispatchStore.createApprovalRequest({
+        changeType: "approval-policy.update",
+        targetType: "dispatch-settings",
+        targetId: "dispatch-approval-policy",
+        summary: "Enable approval policy after recovery",
+        payload: { enabled: true, approverEmails: ["reviewer@example.test"] },
+      });
+      const requestId = (created as any).id;
+
+      await exec.execute({
+        sql: "UPDATE dispatch_approval_requests SET status = ?, updated_at = ? WHERE id = ?",
+        args: ["applying", Date.now() - 6 * 60 * 1000, requestId],
+      });
+
+      const recovered = await dispatchStore.approveRequest(requestId);
+      expect(recovered.status).toBe("approved");
+      expect(recovered.reviewedBy).toBe(ownerEmail);
+    });
+  });
+
+  it("keeps a failed apply leased instead of returning it to pending", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./dispatch-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      const created = await dispatchStore.createApprovalRequest({
+        changeType: "unsupported.partial-effect",
+        targetType: "test",
+        summary: "Do not immediately retry ambiguous work",
+        payload: {},
+      });
+      const requestId = (created as any).id;
+
+      await expect(dispatchStore.approveRequest(requestId)).rejects.toThrow(
+        "Unsupported approval request type",
+      );
+
+      const rows = await exec.execute({
+        sql: "SELECT status FROM dispatch_approval_requests WHERE id = ?",
+        args: [requestId],
+      });
+      expect(rows.rows[0]).toMatchObject({ status: "applying" });
+    });
+  });
+
+  it("rejects the change once when rejectRequest is called twice on the same request", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./dispatch-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      const created = await dispatchStore.createApprovalRequest({
+        changeType: "approval-policy.update",
+        targetType: "dispatch-settings",
+        targetId: "dispatch-approval-policy",
+        summary: "Disable approval policy",
+        payload: { enabled: false, approverEmails: [] },
+      });
+      const requestId = (created as any).id;
+
+      const first = await dispatchStore.rejectRequest(requestId, "not needed");
+      expect(first?.status).toBe("rejected");
+      expect(first?.reviewedAt).toBeTruthy();
+
+      const rejectedAuditCount = async () => {
+        const rows = await exec.execute({
+          sql: "SELECT COUNT(*) as count FROM dispatch_audit_events WHERE action = 'approval.rejected' AND target_id = ?",
+          args: [requestId],
+        });
+        return Number((rows.rows[0] as any).count);
+      };
+      expect(await rejectedAuditCount()).toBe(1);
+
+      const second = await dispatchStore.rejectRequest(
+        requestId,
+        "still not needed",
+      );
+      expect(second?.status).toBe("rejected");
+      expect(second?.reviewedAt).toBe(first?.reviewedAt);
+      expect(await rejectedAuditCount()).toBe(1);
+    });
+  });
+});
+
+describe("vault request status fencing", () => {
+  it("does not duplicate a grant when createGrant is retried", async () => {
+    const [{ runWithRequestContext }, vaultStore] = await Promise.all([
+      import("@agent-native/core/server"),
+      import("./vault-store.js"),
+    ]);
+
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      const secret = await vaultStore.createSecret({
+        credentialKey: "RETRY_GRANT_API_KEY",
+        value: "secret-value",
+        name: "Retry Grant Secret",
+      });
+      expect(secret).toBeTruthy();
+
+      const first = await vaultStore.createGrant(secret!.id, "test-app");
+      const retry = await vaultStore.createGrant(secret!.id, "test-app");
+
+      expect(retry?.id).toBe(first?.id);
+      expect(await vaultStore.listGrants({ appId: "test-app" })).toHaveLength(
+        1,
+      );
+    });
+  });
+
+  it("creates a single grant when approveRequest is called twice on the same request", async () => {
+    const [{ runWithRequestContext }, vaultStore] = await Promise.all([
+      import("@agent-native/core/server"),
+      import("./vault-store.js"),
+    ]);
+
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      const created = await vaultStore.createRequest({
+        credentialKey: "TEST_API_KEY",
+        appId: "test-app",
+        reason: "needed for tests",
+      });
+      const requestId = (created as any).id;
+
+      const first = await vaultStore.approveRequest(
+        requestId,
+        "secret-value-1",
+        "Test Secret",
+      );
+      expect(first?.status).toBe("approved");
+
+      const grantsAfterFirst = await vaultStore.listGrants({
+        appId: "test-app",
+      });
+      expect(grantsAfterFirst).toHaveLength(1);
+
+      // Loser of the race: the row is already 'approved', so this must not
+      // create a second grant for the same request.
+      const second = await vaultStore.approveRequest(
+        requestId,
+        "secret-value-2",
+        "Test Secret",
+      );
+      expect(second?.status).toBe("approved");
+
+      const grantsAfterSecond = await vaultStore.listGrants({
+        appId: "test-app",
+      });
+      expect(grantsAfterSecond).toHaveLength(1);
+      expect(grantsAfterSecond[0].id).toBe(grantsAfterFirst[0].id);
+    });
+  });
+
+  it("denies once when denyRequest is called twice on the same request", async () => {
+    const [{ runWithRequestContext }, vaultStore] = await Promise.all([
+      import("@agent-native/core/server"),
+      import("./vault-store.js"),
+    ]);
+
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      const created = await vaultStore.createRequest({
+        credentialKey: "OTHER_API_KEY",
+        appId: "test-app",
+        reason: "needed for tests",
+      });
+      const requestId = (created as any).id;
+
+      const first = await vaultStore.denyRequest(requestId, "not approved");
+      expect(first?.status).toBe("denied");
+      expect(first?.reviewedAt).toBeTruthy();
+
+      const second = await vaultStore.denyRequest(
+        requestId,
+        "still not approved",
+      );
+      expect(second?.status).toBe("denied");
+      expect(second?.reviewedAt).toBe(first?.reviewedAt);
+    });
+  });
+});

package/src/server/lib/dispatch-store.ts

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 
-import { and, desc, eq, isNull, or } from "@agent-native/core/db/schema";
+import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import {
   getRequestUserEmail,
   getRequestOrgId,
@@ -11,6 +11,7 @@ import { getDb, schema } from "../../db/index.js";
 
 export const SHARED_DISPATCH_OWNER = "dispatch@shared";
 const APPROVAL_POLICY_KEY = "dispatch-approval-policy";
+const APPROVAL_APPLY_LEASE_MS = 5 * 60 * 1000;
 
 // ─── /link rate limiting ──────────────────────────────────────────────────
 //
@@ -188,8 +189,8 @@ export async function getApprovalPolicy(): Promise<DispatchApprovalPolicy> {
 async function applyApprovalPolicy(
   input: DispatchApprovalPolicy,
   actor = currentOwnerEmail(),
+  orgId = currentOrgId(),
 ) {
-  const orgId = currentOrgId();
   if (!orgId) {
     throw new Error(
       "Dispatch approval settings require an active organization",
@@ -209,7 +210,10 @@ async function applyApprovalPolicy(
     metadata: input,
     actor,
   });
-  return getApprovalPolicy();
+  return {
+    enabled: input.enabled,
+    approverEmails: input.approverEmails,
+  };
 }
 
 export async function setApprovalPolicy(input: DispatchApprovalPolicy) {
@@ -564,6 +568,7 @@ async function applyApprovedRequest(request: DispatchApprovalRequest) {
     return applyApprovalPolicy(
       payload,
       request.reviewedBy || currentOwnerEmail(),
+      requestCtx.orgId,
     );
   }
   if (request.changeType === "dream-proposal.apply") {
@@ -610,22 +615,77 @@ export async function approveRequest(requestId: string) {
   const ctx = requireDispatchCtx();
   const request = await getApprovalRequest(requestId, ctx);
   if (!request) throw new Error("Approval request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending approvals can be approved");
-  }
+
   const timestamp = now();
-  await db
+  const staleApplyingBefore = timestamp - APPROVAL_APPLY_LEASE_MS;
+  // Fence the transition on the current status so a concurrent approve can't
+  // both win. A crashed worker can leave its lease in "applying", so reclaim
+  // only a lease that has been idle for the full lease interval.
+  const claimed = await db
+    .update(schema.dispatchApprovalRequests)
+    .set({
+      status: "applying",
+      updatedAt: timestamp,
+    })
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        ctxScope(schema.dispatchApprovalRequests, ctx),
+        or(
+          eq(schema.dispatchApprovalRequests.status, "pending"),
+          and(
+            eq(schema.dispatchApprovalRequests.status, "applying"),
+            sql`${schema.dispatchApprovalRequests.updatedAt} < ${staleApplyingBefore}`,
+          ),
+        ),
+      ),
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    const current = (await getApprovalRequest(requestId, ctx)) ?? request;
+    if (current.status === "applying") {
+      throw new Error("Approval is already being applied");
+    }
+    return current;
+  }
+
+  const applying = claimed[0];
+  try {
+    await applyApprovedRequest(applying);
+  } catch (error) {
+    // Applying a request can have succeeded partially before throwing. Do not
+    // return it to pending: that would allow an immediate retry to duplicate a
+    // non-idempotent effect. Keep the lease until it becomes stale, which
+    // serializes any recovery attempt behind the same fencing rule.
+    await db
+      .update(schema.dispatchApprovalRequests)
+      .set({ updatedAt: now() })
+      .where(
+        and(
+          eq(schema.dispatchApprovalRequests.id, requestId),
+          ctxScope(schema.dispatchApprovalRequests, ctx),
+          eq(schema.dispatchApprovalRequests.status, "applying"),
+        ),
+      );
+    throw error;
+  }
+  const [updated] = await db
     .update(schema.dispatchApprovalRequests)
     .set({
       status: "approved",
       reviewedBy: currentOwnerEmail(),
       reviewedAt: timestamp,
-      updatedAt: timestamp,
+      updatedAt: now(),
     })
-    .where(eq(schema.dispatchApprovalRequests.id, requestId));
-  const updated = await getApprovalRequest(requestId, ctx);
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        eq(schema.dispatchApprovalRequests.status, "applying"),
+      ),
+    )
+    .returning();
   if (!updated) throw new Error("Approval request disappeared");
-  await applyApprovedRequest(updated);
   await recordAudit({
     action: "approval.approved",
     targetType: updated.targetType,
@@ -638,13 +698,12 @@ export async function approveRequest(requestId: string) {
 
 export async function rejectRequest(requestId: string, reason?: string | null) {
   const db = getDb();
-  const request = await getApprovalRequest(requestId);
+  const ctx = requireDispatchCtx();
+  const request = await getApprovalRequest(requestId, ctx);
   if (!request) throw new Error("Approval request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending approvals can be rejected");
-  }
+
   const timestamp = now();
-  await db
+  const claimed = await db
     .update(schema.dispatchApprovalRequests)
     .set({
       status: "rejected",
@@ -652,15 +711,27 @@ export async function rejectRequest(requestId: string, reason?: string | null) {
       reviewedAt: timestamp,
       updatedAt: timestamp,
     })
-    .where(eq(schema.dispatchApprovalRequests.id, requestId));
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        eq(schema.dispatchApprovalRequests.status, "pending"),
+      ),
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    return (await getApprovalRequest(requestId, ctx)) ?? request;
+  }
+
+  const updated = claimed[0];
   await recordAudit({
     action: "approval.rejected",
-    targetType: request.targetType,
+    targetType: updated.targetType,
     targetId: requestId,
-    summary: `Rejected ${request.summary}`,
-    metadata: { request, reason: reason || null },
+    summary: `Rejected ${updated.summary}`,
+    metadata: { request: updated, reason: reason || null },
   });
-  return getApprovalRequest(requestId);
+  return updated;
 }
 
 export async function createLinkToken(platform: string) {