@agent-native/dispatch 0.14.3 → 0.14.5

package/src/server/lib/approval-fencing.spec.ts

@@ -5,11 +5,15 @@ import path from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 // Each test runs real migrations against a fresh SQLite file; under full
-// workspace concurrency that setup can exceed the 5s default timeout.
-vi.setConfig({ testTimeout: 30_000 });
+// workspace concurrency (and a shared machine running other suites) that
+// setup can far exceed the 5s default, so give it generous headroom. The
+// tests themselves complete in a few seconds uncontended.
+vi.setConfig({ testTimeout: 60_000, hookTimeout: 60_000 });
 
 const ownerEmail = "owner+approval-fencing@example.test";
 const orgId = "org_approval_fencing";
+const otherOwnerEmail = "owner+approval-fencing-other@example.test";
+const otherOrgId = "org_approval_fencing_other";
 
 const originalEnv = {
   APP_NAME: process.env.APP_NAME,
@@ -210,6 +214,113 @@ describe("dispatch approval request status fencing", () => {
       expect(await rejectedAuditCount()).toBe(1);
     });
   });
+
+  it("does not let a caller from a different tenant approve another tenant's request", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./dispatch-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    const requestId = await runWithRequestContext(
+      { userEmail: ownerEmail, orgId },
+      async () => {
+        const created = await dispatchStore.createApprovalRequest({
+          changeType: "approval-policy.update",
+          targetType: "dispatch-settings",
+          targetId: "dispatch-approval-policy",
+          summary: "Enable approval policy for tenant A",
+          payload: { enabled: true, approverEmails: ["reviewer@example.test"] },
+        });
+        return (created as any).id as string;
+      },
+    );
+
+    await runWithRequestContext(
+      { userEmail: otherOwnerEmail, orgId: otherOrgId },
+      async () => {
+        await expect(dispatchStore.approveRequest(requestId)).rejects.toThrow(
+          "Approval request not found",
+        );
+      },
+    );
+
+    const rows = await exec.execute({
+      sql: "SELECT status, reviewed_by, reviewed_at FROM dispatch_approval_requests WHERE id = ?",
+      args: [requestId],
+    });
+    expect(rows.rows[0]).toMatchObject({
+      status: "pending",
+      reviewed_by: null,
+      reviewed_at: null,
+    });
+
+    const approvedAuditRows = await exec.execute({
+      sql: "SELECT COUNT(*) as count FROM dispatch_audit_events WHERE action = 'approval.approved' AND target_id = ?",
+      args: [requestId],
+    });
+    expect(Number((approvedAuditRows.rows[0] as any).count)).toBe(0);
+
+    // Confirm no side effect landed either: the policy change must not have
+    // been applied to tenant A's org settings by the foreign-tenant attempt.
+    await runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+      expect(await dispatchStore.getApprovalPolicy()).toEqual({
+        enabled: false,
+        approverEmails: [],
+      });
+    });
+  });
+
+  it("does not let a caller from a different tenant reject another tenant's request", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./dispatch-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    const requestId = await runWithRequestContext(
+      { userEmail: ownerEmail, orgId },
+      async () => {
+        const created = await dispatchStore.createApprovalRequest({
+          changeType: "approval-policy.update",
+          targetType: "dispatch-settings",
+          targetId: "dispatch-approval-policy",
+          summary: "Enable approval policy for tenant A (reject case)",
+          payload: { enabled: true, approverEmails: ["reviewer@example.test"] },
+        });
+        return (created as any).id as string;
+      },
+    );
+
+    await runWithRequestContext(
+      { userEmail: otherOwnerEmail, orgId: otherOrgId },
+      async () => {
+        await expect(
+          dispatchStore.rejectRequest(requestId, "not my call"),
+        ).rejects.toThrow("Approval request not found");
+      },
+    );
+
+    const rows = await exec.execute({
+      sql: "SELECT status, reviewed_by, reviewed_at FROM dispatch_approval_requests WHERE id = ?",
+      args: [requestId],
+    });
+    expect(rows.rows[0]).toMatchObject({
+      status: "pending",
+      reviewed_by: null,
+      reviewed_at: null,
+    });
+
+    const rejectedAuditRows = await exec.execute({
+      sql: "SELECT COUNT(*) as count FROM dispatch_audit_events WHERE action = 'approval.rejected' AND target_id = ?",
+      args: [requestId],
+    });
+    expect(Number((rejectedAuditRows.rows[0] as any).count)).toBe(0);
+  });
 });
 
 describe("vault request status fencing", () => {

package/src/server/lib/dispatch-store.ts

@@ -681,6 +681,7 @@ export async function approveRequest(requestId: string) {
     .where(
       and(
         eq(schema.dispatchApprovalRequests.id, requestId),
+        ctxScope(schema.dispatchApprovalRequests, ctx),
         eq(schema.dispatchApprovalRequests.status, "applying"),
       ),
     )
@@ -714,6 +715,7 @@ export async function rejectRequest(requestId: string, reason?: string | null) {
     .where(
       and(
         eq(schema.dispatchApprovalRequests.id, requestId),
+        ctxScope(schema.dispatchApprovalRequests, ctx),
         eq(schema.dispatchApprovalRequests.status, "pending"),
       ),
     )

package/src/server/lib/mcp-access-store.spec.ts

@@ -1,15 +1,42 @@
-import { describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  execute: vi.fn(),
+  getOrgSetting: vi.fn(),
+  getUserSetting: vi.fn(),
+  putOrgSetting: vi.fn(),
+  putUserSetting: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/db", () => ({
+  getDbExec: () => ({ execute: mocks.execute }),
+}));
+
+vi.mock("@agent-native/core/settings", () => ({
+  getOrgSetting: mocks.getOrgSetting,
+  getUserSetting: mocks.getUserSetting,
+  putOrgSetting: mocks.putOrgSetting,
+  putUserSetting: mocks.putUserSetting,
+}));
+
+import { runWithRequestContext } from "@agent-native/core/server";
 
 import {
   isAppAllowedByMcpAccess,
   normalizeMcpAppAccessSettings,
+  setDispatchMcpAppAccessSettings,
 } from "./mcp-access-store.js";
 
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.execute.mockResolvedValue({ rows: [] });
+});
+
 describe("normalizeMcpAppAccessSettings", () => {
-  it("defaults to all apps", () => {
+  it("defaults to Dispatch only", () => {
     expect(normalizeMcpAppAccessSettings(null)).toEqual({
-      mode: "all-apps",
-      selectedAppIds: [],
+      mode: "selected-apps",
+      selectedAppIds: ["dispatch"],
       updatedAt: undefined,
       updatedBy: undefined,
     });
@@ -32,6 +59,91 @@ describe("normalizeMcpAppAccessSettings", () => {
   });
 });
 
+describe("setDispatchMcpAppAccessSettings", () => {
+  it.each(["owner", "admin"])(
+    "lets an organization %s change the app grants",
+    async (role) => {
+      mocks.execute.mockResolvedValue({ rows: [{ role }] });
+
+      const result = await runWithRequestContext(
+        { userEmail: "manager@example.test", orgId: "org-1" },
+        () =>
+          setDispatchMcpAppAccessSettings({
+            mode: "selected-apps",
+            selectedAppIds: ["dispatch", "analytics"],
+          }),
+      );
+
+      expect(mocks.execute).toHaveBeenCalledWith({
+        sql: expect.stringContaining("FROM org_members"),
+        args: ["org-1", "manager@example.test"],
+      });
+      expect(mocks.putOrgSetting).toHaveBeenCalledWith(
+        "org-1",
+        "dispatch-mcp-app-access",
+        expect.objectContaining({
+          mode: "selected-apps",
+          selectedAppIds: ["dispatch", "analytics"],
+          updatedBy: "manager@example.test",
+        }),
+      );
+      expect(result.mode).toBe("selected-apps");
+    },
+  );
+
+  it("rejects an organization member without changing grants", async () => {
+    mocks.execute.mockResolvedValue({ rows: [{ role: "member" }] });
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "member@example.test", orgId: "org-1" },
+        () =>
+          setDispatchMcpAppAccessSettings({
+            mode: "all-apps",
+          }),
+      ),
+    ).rejects.toMatchObject({
+      message: expect.stringMatching(/Only organization owners and admins/),
+      statusCode: 403,
+    });
+    expect(mocks.putOrgSetting).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when organization membership cannot be verified", async () => {
+    mocks.execute.mockRejectedValue(new Error("org lookup unavailable"));
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "owner@example.test", orgId: "org-1" },
+        () =>
+          setDispatchMcpAppAccessSettings({
+            mode: "all-apps",
+          }),
+      ),
+    ).rejects.toThrow(/Only organization owners and admins/);
+    expect(mocks.putOrgSetting).not.toHaveBeenCalled();
+  });
+
+  it("lets an authenticated solo user manage only their own grants", async () => {
+    await runWithRequestContext({ userEmail: "solo@example.test" }, () =>
+      setDispatchMcpAppAccessSettings({
+        mode: "selected-apps",
+        selectedAppIds: [],
+      }),
+    );
+
+    expect(mocks.execute).not.toHaveBeenCalled();
+    expect(mocks.putUserSetting).toHaveBeenCalledWith(
+      "solo@example.test",
+      "dispatch-mcp-app-access",
+      expect.objectContaining({
+        mode: "selected-apps",
+        selectedAppIds: [],
+      }),
+    );
+  });
+});
+
 describe("isAppAllowedByMcpAccess", () => {
   it("allows every app in all-apps mode", () => {
     expect(

package/src/server/lib/mcp-access-store.ts

@@ -1,3 +1,4 @@
+import { getDbExec } from "@agent-native/core/db";
 import {
   getRequestOrgId,
   getRequestUserEmail,
@@ -20,6 +21,16 @@ export interface DispatchMcpAppAccessSettings {
   updatedBy?: string;
 }
 
+class McpAppAccessError extends Error {
+  statusCode: number;
+
+  constructor(message: string, statusCode: number) {
+    super(message);
+    this.name = "McpAppAccessError";
+    this.statusCode = statusCode;
+  }
+}
+
 interface AccessScope {
   kind: "org" | "user";
   id: string;
@@ -45,10 +56,11 @@ export function normalizeMcpAppAccessSettings(
     raw && typeof raw === "object" && !Array.isArray(raw)
       ? (raw as Record<string, unknown>)
       : {};
-  const mode = record.mode === "selected-apps" ? "selected-apps" : "all-apps";
+  const mode = record.mode === "all-apps" ? "all-apps" : "selected-apps";
   return {
     mode,
-    selectedAppIds: uniqueAppIds(record.selectedAppIds),
+    selectedAppIds:
+      raw == null ? ["dispatch"] : uniqueAppIds(record.selectedAppIds),
     updatedAt:
       typeof record.updatedAt === "string" ? record.updatedAt : undefined,
     updatedBy:
@@ -64,6 +76,28 @@ function currentAccessScope(): AccessScope {
   return { kind: "user", id: actor, actor };
 }
 
+async function assertCanManageMcpAppAccess(scope: AccessScope): Promise<void> {
+  if (scope.kind === "user") return;
+
+  let role: unknown = null;
+  try {
+    const { rows } = await getDbExec().execute({
+      sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+      args: [scope.id, scope.actor.toLowerCase()],
+    });
+    role = rows[0]?.role;
+  } catch {
+    // Fail closed when org membership cannot be verified.
+  }
+
+  if (role !== "owner" && role !== "admin") {
+    throw new McpAppAccessError(
+      "Only organization owners and admins can change Dispatch MCP app access.",
+      403,
+    );
+  }
+}
+
 export async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {
   const scope = currentAccessScope();
   const raw =
@@ -78,6 +112,7 @@ export async function setDispatchMcpAppAccessSettings(input: {
   selectedAppIds?: string[];
 }): Promise<DispatchMcpAppAccessSettings> {
   const scope = currentAccessScope();
+  await assertCanManageMcpAppAccess(scope);
   const next: DispatchMcpAppAccessSettings = {
     mode: input.mode,
     selectedAppIds: uniqueAppIds(input.selectedAppIds),

package/src/server/lib/mcp-gateway.spec.ts

@@ -12,6 +12,7 @@ const mocks = vi.hoisted(() => ({
   managerStop: vi.fn(),
   managerCallTool: vi.fn(),
   managerConstructor: vi.fn(),
+  callAgent: vi.fn(),
   signA2AToken: vi.fn(),
   getOrgA2ASecret: vi.fn(),
   getOrgDomain: vi.fn(),
@@ -39,7 +40,7 @@ vi.mock("@agent-native/core/server", async (importOriginal) => {
 });
 
 vi.mock("@agent-native/core/a2a", () => ({
-  callAgent: vi.fn(),
+  callAgent: mocks.callAgent,
   signA2AToken: mocks.signA2AToken,
 }));
 
@@ -74,6 +75,7 @@ import { runWithRequestContext } from "@agent-native/core/server";
 
 import {
   createGrantedDispatchMcpEmbedSession,
+  askGrantedDispatchMcpApp,
   listGrantedDispatchMcpApps,
   listGrantedDispatchMcpAppOrigins,
   openGrantedDispatchMcpApp,
@@ -90,8 +92,8 @@ const analyticsAgent = {
 
 beforeEach(() => {
   mocks.discoverAgents.mockResolvedValue([analyticsAgent]);
-  mocks.getUserSetting.mockResolvedValue(null);
-  mocks.getOrgSetting.mockResolvedValue(null);
+  mocks.getUserSetting.mockResolvedValue({ mode: "all-apps" });
+  mocks.getOrgSetting.mockResolvedValue({ mode: "all-apps" });
   mocks.createEmbedSessionTicket.mockResolvedValue({
     ticket: "ticket-123",
     ticketHash: "hash-123",
@@ -104,6 +106,7 @@ beforeEach(() => {
       startUrl: "http://localhost:8086/_agent-native/embed/start?ticket=remote",
     },
   });
+  mocks.callAgent.mockResolvedValue("Created the requested dashboard.");
   mocks.signA2AToken.mockResolvedValue("signed-token");
   mocks.getOrgA2ASecret.mockResolvedValue(null);
   mocks.getOrgDomain.mockResolvedValue(null);
@@ -115,7 +118,21 @@ afterEach(() => {
 });
 
 describe("Dispatch MCP gateway app discovery", () => {
+  it("defaults to exposing Dispatch only until an owner or admin grants more apps", async () => {
+    mocks.getUserSetting.mockResolvedValue(null);
+    const apps = await runWithRequestContext(
+      {
+        userEmail: "owner@example.test",
+        requestOrigin: "http://localhost:8092",
+      },
+      () => listGrantedDispatchMcpApps(),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch"]);
+  });
+
   it("includes Dispatch itself so agents can target extension routes", async () => {
+    mocks.getUserSetting.mockResolvedValue({ mode: "all-apps" });
     const apps = await runWithRequestContext(
       {
         userEmail: "owner@example.test",
@@ -222,6 +239,7 @@ describe("Dispatch MCP gateway app discovery", () => {
         color: "#111827",
       },
     ]);
+    mocks.getUserSetting.mockResolvedValue({ mode: "all-apps" });
 
     await expect(
       runWithRequestContext(
@@ -235,6 +253,64 @@ describe("Dispatch MCP gateway app discovery", () => {
   });
 });
 
+describe("askGrantedDispatchMcpApp", () => {
+  it("routes the authenticated user and active org identity to the granted app", async () => {
+    mocks.getOrgSetting.mockResolvedValue({
+      mode: "selected-apps",
+      selectedAppIds: ["analytics"],
+    });
+    mocks.getOrgDomain.mockResolvedValue("builder.io");
+    mocks.getOrgA2ASecret.mockResolvedValue("org-specific-secret");
+
+    const result = await runWithRequestContext(
+      {
+        userEmail: "owner@example.test",
+        orgId: "org-1",
+        requestOrigin: "http://localhost:8092",
+      },
+      () =>
+        askGrantedDispatchMcpApp(
+          "analytics",
+          "Build a weekly active users dashboard.",
+        ),
+    );
+
+    expect(mocks.callAgent).toHaveBeenCalledWith(
+      "http://localhost:8086",
+      "Build a weekly active users dashboard.",
+      {
+        userEmail: "owner@example.test",
+        orgDomain: "builder.io",
+        orgSecret: "org-specific-secret",
+        timeoutMs: 5 * 60_000,
+      },
+    );
+    expect(result).toEqual({
+      app: "analytics",
+      routedVia: "a2a",
+      response: "Created the requested dashboard.",
+    });
+  });
+
+  it("rejects delegation to an app outside the grant", async () => {
+    mocks.getUserSetting.mockResolvedValue({
+      mode: "selected-apps",
+      selectedAppIds: ["dispatch"],
+    });
+
+    await expect(
+      runWithRequestContext(
+        {
+          userEmail: "owner@example.test",
+          requestOrigin: "http://localhost:8092",
+        },
+        () => askGrantedDispatchMcpApp("analytics", "Show signups."),
+      ),
+    ).rejects.toThrow(/not granted/);
+    expect(mocks.callAgent).not.toHaveBeenCalled();
+  });
+});
+
 describe("openGrantedDispatchMcpApp", () => {
   it("opens Dispatch extension routes through the Dispatch app id", async () => {
     const result = await runWithRequestContext(

package/src/styles/dispatch.css

@@ -20,7 +20,7 @@
 .dispatch-chat-panel [data-agent-empty-state="centered"] .dispatch-chat-intro {
   display: grid;
   width: 100%;
-  max-width: min(760px, 90%);
+  max-width: min(570px, 90%);
   gap: 0.5rem;
   margin: 0 auto 1rem;
   text-align: center;
@@ -50,12 +50,12 @@
 
 .dispatch-chat-panel [data-agent-empty-state="centered"] .agent-composer-area {
   width: 100%;
-  max-width: min(760px, 90%);
+  max-width: min(570px, 90%);
   padding: 0;
 }
 
 .dispatch-chat-panel [data-agent-empty-state="centered"] .agent-composer-root {
-  min-height: 10.5rem;
+  min-height: 7.875rem;
   border-color: hsl(var(--border));
   border-radius: 1rem;
   background: hsl(var(--card));
@@ -72,7 +72,7 @@
 .dispatch-chat-panel
   [data-agent-empty-state="centered"]
   .agent-composer-prosemirror {
-  min-height: 6.75rem;
+  min-height: 5.0625rem;
   font-size: 1rem;
   line-height: 1.625rem;
 }
@@ -103,6 +103,6 @@
   .dispatch-chat-panel
     [data-agent-empty-state="centered"]
     .agent-composer-root {
-    min-height: 9rem;
+    min-height: 6.75rem;
   }
 }