@agent-native/dispatch 0.14.2 → 0.14.4

package/src/server/lib/dispatch-store.ts

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 
-import { and, desc, eq, isNull, or } from "@agent-native/core/db/schema";
+import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import {
   getRequestUserEmail,
   getRequestOrgId,
@@ -11,6 +11,7 @@ import { getDb, schema } from "../../db/index.js";
 
 export const SHARED_DISPATCH_OWNER = "dispatch@shared";
 const APPROVAL_POLICY_KEY = "dispatch-approval-policy";
+const APPROVAL_APPLY_LEASE_MS = 5 * 60 * 1000;
 
 // ─── /link rate limiting ──────────────────────────────────────────────────
 //
@@ -188,8 +189,8 @@ export async function getApprovalPolicy(): Promise<DispatchApprovalPolicy> {
 async function applyApprovalPolicy(
   input: DispatchApprovalPolicy,
   actor = currentOwnerEmail(),
+  orgId = currentOrgId(),
 ) {
-  const orgId = currentOrgId();
   if (!orgId) {
     throw new Error(
       "Dispatch approval settings require an active organization",
@@ -209,7 +210,10 @@ async function applyApprovalPolicy(
     metadata: input,
     actor,
   });
-  return getApprovalPolicy();
+  return {
+    enabled: input.enabled,
+    approverEmails: input.approverEmails,
+  };
 }
 
 export async function setApprovalPolicy(input: DispatchApprovalPolicy) {
@@ -564,6 +568,7 @@ async function applyApprovedRequest(request: DispatchApprovalRequest) {
     return applyApprovalPolicy(
       payload,
       request.reviewedBy || currentOwnerEmail(),
+      requestCtx.orgId,
     );
   }
   if (request.changeType === "dream-proposal.apply") {
@@ -610,22 +615,78 @@ export async function approveRequest(requestId: string) {
   const ctx = requireDispatchCtx();
   const request = await getApprovalRequest(requestId, ctx);
   if (!request) throw new Error("Approval request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending approvals can be approved");
-  }
+
   const timestamp = now();
-  await db
+  const staleApplyingBefore = timestamp - APPROVAL_APPLY_LEASE_MS;
+  // Fence the transition on the current status so a concurrent approve can't
+  // both win. A crashed worker can leave its lease in "applying", so reclaim
+  // only a lease that has been idle for the full lease interval.
+  const claimed = await db
+    .update(schema.dispatchApprovalRequests)
+    .set({
+      status: "applying",
+      updatedAt: timestamp,
+    })
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        ctxScope(schema.dispatchApprovalRequests, ctx),
+        or(
+          eq(schema.dispatchApprovalRequests.status, "pending"),
+          and(
+            eq(schema.dispatchApprovalRequests.status, "applying"),
+            sql`${schema.dispatchApprovalRequests.updatedAt} < ${staleApplyingBefore}`,
+          ),
+        ),
+      ),
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    const current = (await getApprovalRequest(requestId, ctx)) ?? request;
+    if (current.status === "applying") {
+      throw new Error("Approval is already being applied");
+    }
+    return current;
+  }
+
+  const applying = claimed[0];
+  try {
+    await applyApprovedRequest(applying);
+  } catch (error) {
+    // Applying a request can have succeeded partially before throwing. Do not
+    // return it to pending: that would allow an immediate retry to duplicate a
+    // non-idempotent effect. Keep the lease until it becomes stale, which
+    // serializes any recovery attempt behind the same fencing rule.
+    await db
+      .update(schema.dispatchApprovalRequests)
+      .set({ updatedAt: now() })
+      .where(
+        and(
+          eq(schema.dispatchApprovalRequests.id, requestId),
+          ctxScope(schema.dispatchApprovalRequests, ctx),
+          eq(schema.dispatchApprovalRequests.status, "applying"),
+        ),
+      );
+    throw error;
+  }
+  const [updated] = await db
     .update(schema.dispatchApprovalRequests)
     .set({
       status: "approved",
       reviewedBy: currentOwnerEmail(),
       reviewedAt: timestamp,
-      updatedAt: timestamp,
+      updatedAt: now(),
     })
-    .where(eq(schema.dispatchApprovalRequests.id, requestId));
-  const updated = await getApprovalRequest(requestId, ctx);
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        ctxScope(schema.dispatchApprovalRequests, ctx),
+        eq(schema.dispatchApprovalRequests.status, "applying"),
+      ),
+    )
+    .returning();
   if (!updated) throw new Error("Approval request disappeared");
-  await applyApprovedRequest(updated);
   await recordAudit({
     action: "approval.approved",
     targetType: updated.targetType,
@@ -638,13 +699,12 @@ export async function approveRequest(requestId: string) {
 
 export async function rejectRequest(requestId: string, reason?: string | null) {
   const db = getDb();
-  const request = await getApprovalRequest(requestId);
+  const ctx = requireDispatchCtx();
+  const request = await getApprovalRequest(requestId, ctx);
   if (!request) throw new Error("Approval request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending approvals can be rejected");
-  }
+
   const timestamp = now();
-  await db
+  const claimed = await db
     .update(schema.dispatchApprovalRequests)
     .set({
       status: "rejected",
@@ -652,15 +712,28 @@ export async function rejectRequest(requestId: string, reason?: string | null) {
       reviewedAt: timestamp,
       updatedAt: timestamp,
     })
-    .where(eq(schema.dispatchApprovalRequests.id, requestId));
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        ctxScope(schema.dispatchApprovalRequests, ctx),
+        eq(schema.dispatchApprovalRequests.status, "pending"),
+      ),
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    return (await getApprovalRequest(requestId, ctx)) ?? request;
+  }
+
+  const updated = claimed[0];
   await recordAudit({
     action: "approval.rejected",
-    targetType: request.targetType,
+    targetType: updated.targetType,
     targetId: requestId,
-    summary: `Rejected ${request.summary}`,
-    metadata: { request, reason: reason || null },
+    summary: `Rejected ${updated.summary}`,
+    metadata: { request: updated, reason: reason || null },
   });
-  return getApprovalRequest(requestId);
+  return updated;
 }
 
 export async function createLinkToken(platform: string) {

package/src/server/lib/mcp-access-store.spec.ts

@@ -1,15 +1,42 @@
-import { describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  execute: vi.fn(),
+  getOrgSetting: vi.fn(),
+  getUserSetting: vi.fn(),
+  putOrgSetting: vi.fn(),
+  putUserSetting: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/db", () => ({
+  getDbExec: () => ({ execute: mocks.execute }),
+}));
+
+vi.mock("@agent-native/core/settings", () => ({
+  getOrgSetting: mocks.getOrgSetting,
+  getUserSetting: mocks.getUserSetting,
+  putOrgSetting: mocks.putOrgSetting,
+  putUserSetting: mocks.putUserSetting,
+}));
+
+import { runWithRequestContext } from "@agent-native/core/server";
 
 import {
   isAppAllowedByMcpAccess,
   normalizeMcpAppAccessSettings,
+  setDispatchMcpAppAccessSettings,
 } from "./mcp-access-store.js";
 
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.execute.mockResolvedValue({ rows: [] });
+});
+
 describe("normalizeMcpAppAccessSettings", () => {
-  it("defaults to all apps", () => {
+  it("defaults to Dispatch only", () => {
     expect(normalizeMcpAppAccessSettings(null)).toEqual({
-      mode: "all-apps",
-      selectedAppIds: [],
+      mode: "selected-apps",
+      selectedAppIds: ["dispatch"],
       updatedAt: undefined,
       updatedBy: undefined,
     });
@@ -32,6 +59,91 @@ describe("normalizeMcpAppAccessSettings", () => {
   });
 });
 
+describe("setDispatchMcpAppAccessSettings", () => {
+  it.each(["owner", "admin"])(
+    "lets an organization %s change the app grants",
+    async (role) => {
+      mocks.execute.mockResolvedValue({ rows: [{ role }] });
+
+      const result = await runWithRequestContext(
+        { userEmail: "manager@example.test", orgId: "org-1" },
+        () =>
+          setDispatchMcpAppAccessSettings({
+            mode: "selected-apps",
+            selectedAppIds: ["dispatch", "analytics"],
+          }),
+      );
+
+      expect(mocks.execute).toHaveBeenCalledWith({
+        sql: expect.stringContaining("FROM org_members"),
+        args: ["org-1", "manager@example.test"],
+      });
+      expect(mocks.putOrgSetting).toHaveBeenCalledWith(
+        "org-1",
+        "dispatch-mcp-app-access",
+        expect.objectContaining({
+          mode: "selected-apps",
+          selectedAppIds: ["dispatch", "analytics"],
+          updatedBy: "manager@example.test",
+        }),
+      );
+      expect(result.mode).toBe("selected-apps");
+    },
+  );
+
+  it("rejects an organization member without changing grants", async () => {
+    mocks.execute.mockResolvedValue({ rows: [{ role: "member" }] });
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "member@example.test", orgId: "org-1" },
+        () =>
+          setDispatchMcpAppAccessSettings({
+            mode: "all-apps",
+          }),
+      ),
+    ).rejects.toMatchObject({
+      message: expect.stringMatching(/Only organization owners and admins/),
+      statusCode: 403,
+    });
+    expect(mocks.putOrgSetting).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when organization membership cannot be verified", async () => {
+    mocks.execute.mockRejectedValue(new Error("org lookup unavailable"));
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "owner@example.test", orgId: "org-1" },
+        () =>
+          setDispatchMcpAppAccessSettings({
+            mode: "all-apps",
+          }),
+      ),
+    ).rejects.toThrow(/Only organization owners and admins/);
+    expect(mocks.putOrgSetting).not.toHaveBeenCalled();
+  });
+
+  it("lets an authenticated solo user manage only their own grants", async () => {
+    await runWithRequestContext({ userEmail: "solo@example.test" }, () =>
+      setDispatchMcpAppAccessSettings({
+        mode: "selected-apps",
+        selectedAppIds: [],
+      }),
+    );
+
+    expect(mocks.execute).not.toHaveBeenCalled();
+    expect(mocks.putUserSetting).toHaveBeenCalledWith(
+      "solo@example.test",
+      "dispatch-mcp-app-access",
+      expect.objectContaining({
+        mode: "selected-apps",
+        selectedAppIds: [],
+      }),
+    );
+  });
+});
+
 describe("isAppAllowedByMcpAccess", () => {
   it("allows every app in all-apps mode", () => {
     expect(

package/src/server/lib/mcp-access-store.ts

@@ -1,3 +1,4 @@
+import { getDbExec } from "@agent-native/core/db";
 import {
   getRequestOrgId,
   getRequestUserEmail,
@@ -20,6 +21,16 @@ export interface DispatchMcpAppAccessSettings {
   updatedBy?: string;
 }
 
+class McpAppAccessError extends Error {
+  statusCode: number;
+
+  constructor(message: string, statusCode: number) {
+    super(message);
+    this.name = "McpAppAccessError";
+    this.statusCode = statusCode;
+  }
+}
+
 interface AccessScope {
   kind: "org" | "user";
   id: string;
@@ -45,10 +56,11 @@ export function normalizeMcpAppAccessSettings(
     raw && typeof raw === "object" && !Array.isArray(raw)
       ? (raw as Record<string, unknown>)
       : {};
-  const mode = record.mode === "selected-apps" ? "selected-apps" : "all-apps";
+  const mode = record.mode === "all-apps" ? "all-apps" : "selected-apps";
   return {
     mode,
-    selectedAppIds: uniqueAppIds(record.selectedAppIds),
+    selectedAppIds:
+      raw == null ? ["dispatch"] : uniqueAppIds(record.selectedAppIds),
     updatedAt:
       typeof record.updatedAt === "string" ? record.updatedAt : undefined,
     updatedBy:
@@ -64,6 +76,28 @@ function currentAccessScope(): AccessScope {
   return { kind: "user", id: actor, actor };
 }
 
+async function assertCanManageMcpAppAccess(scope: AccessScope): Promise<void> {
+  if (scope.kind === "user") return;
+
+  let role: unknown = null;
+  try {
+    const { rows } = await getDbExec().execute({
+      sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+      args: [scope.id, scope.actor.toLowerCase()],
+    });
+    role = rows[0]?.role;
+  } catch {
+    // Fail closed when org membership cannot be verified.
+  }
+
+  if (role !== "owner" && role !== "admin") {
+    throw new McpAppAccessError(
+      "Only organization owners and admins can change Dispatch MCP app access.",
+      403,
+    );
+  }
+}
+
 export async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {
   const scope = currentAccessScope();
   const raw =
@@ -78,6 +112,7 @@ export async function setDispatchMcpAppAccessSettings(input: {
   selectedAppIds?: string[];
 }): Promise<DispatchMcpAppAccessSettings> {
   const scope = currentAccessScope();
+  await assertCanManageMcpAppAccess(scope);
   const next: DispatchMcpAppAccessSettings = {
     mode: input.mode,
     selectedAppIds: uniqueAppIds(input.selectedAppIds),

package/src/server/lib/mcp-gateway.spec.ts

@@ -12,6 +12,7 @@ const mocks = vi.hoisted(() => ({
   managerStop: vi.fn(),
   managerCallTool: vi.fn(),
   managerConstructor: vi.fn(),
+  callAgent: vi.fn(),
   signA2AToken: vi.fn(),
   getOrgA2ASecret: vi.fn(),
   getOrgDomain: vi.fn(),
@@ -39,7 +40,7 @@ vi.mock("@agent-native/core/server", async (importOriginal) => {
 });
 
 vi.mock("@agent-native/core/a2a", () => ({
-  callAgent: vi.fn(),
+  callAgent: mocks.callAgent,
   signA2AToken: mocks.signA2AToken,
 }));
 
@@ -74,6 +75,7 @@ import { runWithRequestContext } from "@agent-native/core/server";
 
 import {
   createGrantedDispatchMcpEmbedSession,
+  askGrantedDispatchMcpApp,
   listGrantedDispatchMcpApps,
   listGrantedDispatchMcpAppOrigins,
   openGrantedDispatchMcpApp,
@@ -90,8 +92,8 @@ const analyticsAgent = {
 
 beforeEach(() => {
   mocks.discoverAgents.mockResolvedValue([analyticsAgent]);
-  mocks.getUserSetting.mockResolvedValue(null);
-  mocks.getOrgSetting.mockResolvedValue(null);
+  mocks.getUserSetting.mockResolvedValue({ mode: "all-apps" });
+  mocks.getOrgSetting.mockResolvedValue({ mode: "all-apps" });
   mocks.createEmbedSessionTicket.mockResolvedValue({
     ticket: "ticket-123",
     ticketHash: "hash-123",
@@ -104,6 +106,7 @@ beforeEach(() => {
       startUrl: "http://localhost:8086/_agent-native/embed/start?ticket=remote",
     },
   });
+  mocks.callAgent.mockResolvedValue("Created the requested dashboard.");
   mocks.signA2AToken.mockResolvedValue("signed-token");
   mocks.getOrgA2ASecret.mockResolvedValue(null);
   mocks.getOrgDomain.mockResolvedValue(null);
@@ -115,7 +118,21 @@ afterEach(() => {
 });
 
 describe("Dispatch MCP gateway app discovery", () => {
+  it("defaults to exposing Dispatch only until an owner or admin grants more apps", async () => {
+    mocks.getUserSetting.mockResolvedValue(null);
+    const apps = await runWithRequestContext(
+      {
+        userEmail: "owner@example.test",
+        requestOrigin: "http://localhost:8092",
+      },
+      () => listGrantedDispatchMcpApps(),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch"]);
+  });
+
   it("includes Dispatch itself so agents can target extension routes", async () => {
+    mocks.getUserSetting.mockResolvedValue({ mode: "all-apps" });
     const apps = await runWithRequestContext(
       {
         userEmail: "owner@example.test",
@@ -222,6 +239,7 @@ describe("Dispatch MCP gateway app discovery", () => {
         color: "#111827",
       },
     ]);
+    mocks.getUserSetting.mockResolvedValue({ mode: "all-apps" });
 
     await expect(
       runWithRequestContext(
@@ -235,6 +253,64 @@ describe("Dispatch MCP gateway app discovery", () => {
   });
 });
 
+describe("askGrantedDispatchMcpApp", () => {
+  it("routes the authenticated user and active org identity to the granted app", async () => {
+    mocks.getOrgSetting.mockResolvedValue({
+      mode: "selected-apps",
+      selectedAppIds: ["analytics"],
+    });
+    mocks.getOrgDomain.mockResolvedValue("builder.io");
+    mocks.getOrgA2ASecret.mockResolvedValue("org-specific-secret");
+
+    const result = await runWithRequestContext(
+      {
+        userEmail: "owner@example.test",
+        orgId: "org-1",
+        requestOrigin: "http://localhost:8092",
+      },
+      () =>
+        askGrantedDispatchMcpApp(
+          "analytics",
+          "Build a weekly active users dashboard.",
+        ),
+    );
+
+    expect(mocks.callAgent).toHaveBeenCalledWith(
+      "http://localhost:8086",
+      "Build a weekly active users dashboard.",
+      {
+        userEmail: "owner@example.test",
+        orgDomain: "builder.io",
+        orgSecret: "org-specific-secret",
+        timeoutMs: 5 * 60_000,
+      },
+    );
+    expect(result).toEqual({
+      app: "analytics",
+      routedVia: "a2a",
+      response: "Created the requested dashboard.",
+    });
+  });
+
+  it("rejects delegation to an app outside the grant", async () => {
+    mocks.getUserSetting.mockResolvedValue({
+      mode: "selected-apps",
+      selectedAppIds: ["dispatch"],
+    });
+
+    await expect(
+      runWithRequestContext(
+        {
+          userEmail: "owner@example.test",
+          requestOrigin: "http://localhost:8092",
+        },
+        () => askGrantedDispatchMcpApp("analytics", "Show signups."),
+      ),
+    ).rejects.toThrow(/not granted/);
+    expect(mocks.callAgent).not.toHaveBeenCalled();
+  });
+});
+
 describe("openGrantedDispatchMcpApp", () => {
   it("opens Dispatch extension routes through the Dispatch app id", async () => {
     const result = await runWithRequestContext(