@agent-native/dispatch 0.18.0 → 0.19.0

package/src/server/lib/approval-fencing.spec.ts

@@ -50,6 +50,43 @@ beforeEach(async () => {
   await runMigrations(dispatchMigrations, {
     table: "dispatch_migrations",
   })({});
+
+  const { getDbExec } = await import("@agent-native/core/db");
+  const exec = getDbExec();
+  await exec.execute({
+    sql: `CREATE TABLE IF NOT EXISTS org_members (
+      id TEXT PRIMARY KEY,
+      org_id TEXT NOT NULL,
+      email TEXT NOT NULL,
+      role TEXT NOT NULL,
+      joined_at INTEGER NOT NULL
+    )`,
+    args: [],
+  });
+  await exec.execute({
+    sql: "INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)",
+    args: ["approval-owner", orgId, ownerEmail, "owner", Date.now()],
+  });
+  await exec.execute({
+    sql: "INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)",
+    args: [
+      "approval-other-owner",
+      otherOrgId,
+      otherOwnerEmail,
+      "owner",
+      Date.now(),
+    ],
+  });
+  await exec.execute({
+    sql: "INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)",
+    args: [
+      "approval-owner-other-org",
+      otherOrgId,
+      ownerEmail,
+      "owner",
+      Date.now(),
+    ],
+  });
 });
 
 afterEach(async () => {
@@ -65,6 +102,38 @@ afterEach(async () => {
 });
 
 describe("dispatch approval request status fencing", () => {
+  it("does not approve a request through an owner-email match from another org", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, vaultStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./vault-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    const created = await runWithRequestContext(
+      { userEmail: ownerEmail, orgId },
+      () =>
+        vaultStore.createRequest({
+          credentialKey: "CROSS_ORG_KEY",
+          appId: "test-app",
+          reason: "must stay in the request org",
+        }),
+    );
+
+    await expect(
+      runWithRequestContext({ userEmail: ownerEmail, orgId: otherOrgId }, () =>
+        vaultStore.approveRequest((created as any).id, "secret-value"),
+      ),
+    ).rejects.toThrow("Request not found");
+
+    const rows = await exec.execute({
+      sql: "SELECT status FROM vault_requests WHERE id = ?",
+      args: [(created as any).id],
+    });
+    expect(rows.rows[0]).toMatchObject({ status: "pending" });
+  });
+
   it("applies the change once when approveRequest is called twice on the same request", async () => {
     const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
       await Promise.all([

package/src/server/lib/thread-debug-store.spec.ts

@@ -390,9 +390,13 @@ describe("thread-debug-store", () => {
   it("keeps explicit remote sources admin-only", async () => {
     vi.stubEnv("REMOTE_DATABASE_URL", "libsql://remote");
 
-    await expect(listAgentRunFailures({ sourceId: "remote" })).rejects.toThrow(
-      "Only Dispatch admins",
-    );
+    await expect(
+      listAgentRunFailures({ sourceId: "remote" }),
+    ).rejects.toMatchObject({
+      statusCode: 403,
+      message:
+        "Only Dispatch admins can inspect thread databases from other apps.",
+    });
     expect(mocks.createDbExec).not.toHaveBeenCalled();
   });
 

package/src/server/lib/thread-debug-store.ts

@@ -3,6 +3,7 @@ import {
   type AgentFailureRegime,
 } from "@agent-native/core/agent/engine";
 import { createDbExec, getDbExec, type DbExec } from "@agent-native/core/db";
+import { ForbiddenError } from "@agent-native/core/sharing";
 
 import { currentOrgId, currentOwnerEmail } from "./dispatch-store.js";
 
@@ -496,7 +497,7 @@ function assertSourceAccess(
 ) {
   if (source.kind === "current") return;
   if (!access.canInspectAll) {
-    throw new Error(
+    throw new ForbiddenError(
       "Only Dispatch admins can inspect thread databases from other apps.",
     );
   }

package/src/server/lib/vault-store.spec.ts

@@ -5,6 +5,7 @@ const mocks = vi.hoisted(() => ({
   currentOwnerEmail: vi.fn(),
   deleteAppSecret: vi.fn(),
   discoverAgents: vi.fn(),
+  getDbExec: vi.fn(),
   getDb: vi.fn(),
   getOrgSetting: vi.fn(),
   getUserSetting: vi.fn(),
@@ -21,6 +22,11 @@ vi.mock("@agent-native/core/secrets", () => ({
   writeAppSecret: mocks.writeAppSecret,
 }));
 
+vi.mock("@agent-native/core/db", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@agent-native/core/db")>()),
+  getDbExec: mocks.getDbExec,
+}));
+
 vi.mock("@agent-native/core/server/agent-discovery", () => ({
   discoverAgents: mocks.discoverAgents,
 }));
@@ -49,9 +55,12 @@ vi.mock("../../db/index.js", async (importOriginal) => {
 import { readAppSecret } from "@agent-native/core/secrets";
 
 import {
+  assertCanManageVault,
   cleanupSyncedCredentialKeysIfUnused,
   credentialStoreScopeForVaultCtx,
   isTrustedEnvVarSyncAgentUrl,
+  getGrant,
+  listGrants,
   resyncAllVaultSecretsToCredentialStore,
   syncGrantsToApp,
   syncSecretsToCredentialStore,
@@ -85,6 +94,56 @@ describe("credentialStoreScopeForVaultCtx", () => {
   });
 });
 
+describe("vault authorization", () => {
+  it("rejects an organization member before reading shared vault values", async () => {
+    mocks.currentOrgId.mockReturnValue("org_123");
+    mocks.currentOwnerEmail.mockReturnValue("member@example.test");
+    mocks.getDbExec.mockReturnValue({
+      execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
+    });
+
+    await expect(assertCanManageVault()).rejects.toThrow(
+      "Only organization owners and admins can manage the workspace vault.",
+    );
+  });
+
+  it("rejects organization members before listing or reading grants", async () => {
+    mocks.currentOrgId.mockReturnValue("org_123");
+    mocks.currentOwnerEmail.mockReturnValue("member@example.test");
+    mocks.getDbExec.mockReturnValue({
+      execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
+    });
+
+    await expect(listGrants()).rejects.toThrow(
+      "Only organization owners and admins can manage the workspace vault.",
+    );
+    await expect(getGrant("grant-1")).rejects.toThrow(
+      "Only organization owners and admins can manage the workspace vault.",
+    );
+    expect(mocks.getDb).not.toHaveBeenCalled();
+  });
+
+  it.each(["owner", "admin"])(
+    "allows an organization %s to manage shared vault values",
+    async (role) => {
+      mocks.currentOrgId.mockReturnValue("org_123");
+      mocks.currentOwnerEmail.mockReturnValue(`${role}@example.test`);
+      mocks.getDbExec.mockReturnValue({
+        execute: vi.fn().mockResolvedValue({ rows: [{ role }] }),
+      });
+
+      await expect(assertCanManageVault()).resolves.toBeUndefined();
+    },
+  );
+
+  it("allows a solo workspace owner to manage their own vault", async () => {
+    mocks.currentOrgId.mockReturnValue(null);
+
+    await expect(assertCanManageVault()).resolves.toBeUndefined();
+    expect(mocks.getDbExec).not.toHaveBeenCalled();
+  });
+});
+
 describe("isTrustedEnvVarSyncAgentUrl", () => {
   it("allows localhost development app URLs", () => {
     expect(isTrustedEnvVarSyncAgentUrl("http://localhost:9201")).toBe(true);

package/src/server/lib/vault-store.ts

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 
+import { getDbExec } from "@agent-native/core/db";
 import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import { ssrfSafeFetch } from "@agent-native/core/extensions/url-safety";
 import {
@@ -72,6 +73,15 @@ function ctxScope<T extends { ownerEmail: any; orgId: any }>(
   return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));
 }
 
+/** Scope an approval operation to the active tenant, never just the owner email. */
+function tenantScope<T extends { ownerEmail: any; orgId: any }>(
+  table: T,
+  ctx: VaultCtx,
+) {
+  if (ctx.orgId) return eq(table.orgId, ctx.orgId);
+  return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));
+}
+
 /** Build a ctx that scopes to a specific row's owner/org (used when a
  * request approver acts on behalf of the original requester so the
  * created secret lands in the request's org). */
@@ -140,6 +150,45 @@ function scopedFilter<T extends { ownerEmail: any; orgId: any }>(table: T) {
   return ctxScope(table, requireVaultCtx());
 }
 
+/**
+ * Shared vault values and grants are organization administration data. Keep
+ * the member path available for request creation and safe key metadata, but
+ * fail closed before a member can read or mutate a raw secret.
+ */
+export async function assertCanManageVault(): Promise<void> {
+  const orgId = currentOrgId();
+  if (!orgId) return;
+
+  const email = currentOwnerEmail().trim().toLowerCase();
+  let role: unknown = null;
+  try {
+    const result = await getDbExec().execute({
+      sql: "SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1",
+      args: [orgId, email],
+    });
+    role = result.rows[0]?.role;
+  } catch {
+    // coercion-ok: unknown membership is treated as unauthorized below.
+    // A failed membership check must not become an authorization bypass.
+  }
+
+  if (role !== "owner" && role !== "admin") {
+    throw new Error(
+      "Only organization owners and admins can manage the workspace vault.",
+    );
+  }
+}
+
+export async function canManageVault(): Promise<boolean> {
+  try {
+    await assertCanManageVault();
+    return true;
+  } catch {
+    // coercion-ok: the UI must treat an authorization lookup failure as no access.
+    return false;
+  }
+}
+
 function normalizeCredentialKey(value: string) {
   return value.trim();
 }
@@ -169,6 +218,7 @@ export async function getVaultAccessSettings(): Promise<VaultAccessSettings> {
 export async function setVaultAccessSettings(input: {
   mode: VaultAccessMode;
 }): Promise<VaultAccessSettings> {
+  await assertCanManageVault();
   const scope = vaultAccessScope();
   const next = { mode: parseVaultAccessMode(input.mode) };
   if (scope.scope === "org") {
@@ -215,6 +265,7 @@ export async function recordVaultAudit(input: {
 }
 
 export async function listVaultAudit(limit = 50) {
+  await assertCanManageVault();
   const db = getDb();
   return db
     .select()
@@ -227,6 +278,7 @@ export async function listVaultAudit(limit = 50) {
 // ─── Secrets ──────────────────────────────────────────────────────
 
 export async function listSecrets() {
+  await assertCanManageVault();
   const db = getDb();
   return db
     .select()
@@ -235,7 +287,24 @@ export async function listSecrets() {
     .orderBy(desc(schema.vaultSecrets.updatedAt));
 }
 
+/** Safe metadata for app creation and integration readiness checks. */
+export async function listSecretOptions() {
+  const db = getDb();
+  return db
+    .select({
+      id: schema.vaultSecrets.id,
+      name: schema.vaultSecrets.name,
+      credentialKey: schema.vaultSecrets.credentialKey,
+      provider: schema.vaultSecrets.provider,
+      description: schema.vaultSecrets.description,
+    })
+    .from(schema.vaultSecrets)
+    .where(scopedFilter(schema.vaultSecrets))
+    .orderBy(desc(schema.vaultSecrets.updatedAt));
+}
+
 export async function getSecret(secretId: string, ctx: VaultCtx) {
+  await assertCanManageVault();
   const db = getDb();
   const [row] = await db
     .select()
@@ -260,6 +329,7 @@ export async function createSecret(
   },
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
   const timestamp = now();
   const credentialKey = normalizeCredentialKey(input.credentialKey);
@@ -372,6 +442,7 @@ export async function updateSecret(
       },
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
   const existing = await getSecret(secretId, ctx);
   if (!existing) throw new Error("Secret not found");
@@ -478,6 +549,7 @@ export async function deleteSecret(
   secretId: string,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
   const existing = await getSecret(secretId, ctx);
   if (!existing) throw new Error("Secret not found");
@@ -524,6 +596,7 @@ export async function listGrants(filter?: {
   secretId?: string;
   appId?: string;
 }) {
+  await assertCanManageVault();
   const db = getDb();
   const conditions = [scopedFilter(schema.vaultGrants)];
   if (filter?.secretId) {
@@ -543,6 +616,7 @@ export async function getGrant(
   grantId: string,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
   const [row] = await db
     .select()
@@ -562,6 +636,7 @@ export async function createGrant(
   appId: string,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
   const secret = await getSecret(secretId, ctx);
   if (!secret) throw new Error("Secret not found");
@@ -657,6 +732,7 @@ export async function grantSecretsToApp(
   appId: string,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const access = await getVaultAccessSettings();
   const uniqueSecretIds = Array.from(new Set(secretIds));
   if (access.mode === "all-apps") {
@@ -695,6 +771,7 @@ export async function revokeGrant(
   grantId: string,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
   const grant = await getGrant(grantId, ctx);
   if (!grant) throw new Error("Grant not found");
@@ -878,6 +955,7 @@ export async function syncGrantsToApp(
   appId: string,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
   const access = await getVaultAccessSettings();
   const agents = await discoverAgents("dispatch");
@@ -1023,7 +1101,13 @@ export async function syncGrantsToApp(
 
 export async function listRequests(filter?: { status?: string }) {
   const db = getDb();
-  const conditions = [scopedFilter(schema.vaultRequests)];
+  const ctx = requireVaultCtx();
+  const isAdmin = await canManageVault();
+  const conditions = [
+    isAdmin
+      ? ctxScope(schema.vaultRequests, ctx)
+      : eq(schema.vaultRequests.ownerEmail, ctx.ownerEmail),
+  ];
   if (filter?.status) {
     conditions.push(eq(schema.vaultRequests.status, filter.status) as any);
   }
@@ -1052,6 +1136,21 @@ export async function getRequest(
   return row ?? null;
 }
 
+async function getRequestForTenant(requestId: string, ctx: VaultCtx) {
+  const db = getDb();
+  const [row] = await db
+    .select()
+    .from(schema.vaultRequests)
+    .where(
+      and(
+        eq(schema.vaultRequests.id, requestId),
+        tenantScope(schema.vaultRequests, ctx),
+      ),
+    )
+    .limit(1);
+  return row ?? null;
+}
+
 export async function createRequest(input: {
   credentialKey: string;
   appId: string;
@@ -1095,8 +1194,9 @@ export async function approveRequest(
   secretName?: string,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
-  const request = await getRequest(requestId, ctx);
+  const request = await getRequestForTenant(requestId, ctx);
   if (!request) throw new Error("Request not found");
 
   const timestamp = now();
@@ -1119,7 +1219,7 @@ export async function approveRequest(
     .where(
       and(
         eq(schema.vaultRequests.id, requestId),
-        ctxScope(schema.vaultRequests, ctx),
+        tenantScope(schema.vaultRequests, ctx),
         or(
           eq(schema.vaultRequests.status, "pending"),
           and(
@@ -1132,7 +1232,7 @@ export async function approveRequest(
     .returning();
 
   if (claimed.length === 0) {
-    const current = await getRequest(requestId, ctx);
+    const current = await getRequestForTenant(requestId, ctx);
     if (current?.status === "applying") {
       throw new Error("Vault request is already being applied");
     }
@@ -1180,7 +1280,7 @@ export async function approveRequest(
       .where(
         and(
           eq(schema.vaultRequests.id, requestId),
-          ctxScope(schema.vaultRequests, ctx),
+          tenantScope(schema.vaultRequests, ctx),
           eq(schema.vaultRequests.status, "applying"),
         ),
       );
@@ -1198,7 +1298,7 @@ export async function approveRequest(
     .where(
       and(
         eq(schema.vaultRequests.id, requestId),
-        ctxScope(schema.vaultRequests, ctx),
+        tenantScope(schema.vaultRequests, ctx),
         eq(schema.vaultRequests.status, "applying"),
       ),
     );
@@ -1210,7 +1310,7 @@ export async function approveRequest(
     metadata: { requestId, reviewer },
   });
 
-  return getRequest(requestId, ctx);
+  return getRequestForTenant(requestId, ctx);
 }
 
 export async function denyRequest(
@@ -1218,8 +1318,9 @@ export async function denyRequest(
   reason?: string | null,
   ctx: VaultCtx = requireVaultCtx(),
 ) {
+  await assertCanManageVault();
   const db = getDb();
-  const request = await getRequest(requestId, ctx);
+  const request = await getRequestForTenant(requestId, ctx);
   if (!request) throw new Error("Request not found");
 
   const timestamp = now();
@@ -1236,14 +1337,14 @@ export async function denyRequest(
     .where(
       and(
         eq(schema.vaultRequests.id, requestId),
-        ctxScope(schema.vaultRequests, ctx),
+        tenantScope(schema.vaultRequests, ctx),
         eq(schema.vaultRequests.status, "pending"),
       ),
     )
     .returning();
 
   if (claimed.length === 0) {
-    return getRequest(requestId, ctx);
+    return getRequestForTenant(requestId, ctx);
   }
 
   const claimedRequest = claimed[0];
@@ -1255,7 +1356,7 @@ export async function denyRequest(
     metadata: { requestId, reviewer, reason },
   });
 
-  return getRequest(requestId, ctx);
+  return getRequestForTenant(requestId, ctx);
 }
 
 // ─── Integrations Catalog ────────────────────────────────────────
@@ -1282,8 +1383,8 @@ export interface AppIntegrations {
 export async function listIntegrationsCatalog(): Promise<AppIntegrations[]> {
   const access = await getVaultAccessSettings();
   const agents = await discoverAgents("dispatch");
-  const grants = await listGrants();
-  const secrets = await listSecrets();
+  const grants = (await canManageVault()) ? await listGrants() : [];
+  const secrets = await listSecretOptions();
 
   const secretByKey = new Map(secrets.map((s) => [s.credentialKey, s]));
 
@@ -1366,9 +1467,10 @@ export async function listIntegrationsCatalog(): Promise<AppIntegrations[]> {
 // ─── Vault Overview (for dashboard) ──────────────────────────────
 
 export async function listVaultOverview() {
+  const isAdmin = await canManageVault();
   const [secrets, grants, requests, access] = await Promise.all([
-    listSecrets(),
-    listGrants(),
+    listSecretOptions(),
+    isAdmin ? listGrants() : Promise.resolve([]),
     listRequests(),
     getVaultAccessSettings(),
   ]);
@@ -1378,8 +1480,12 @@ export async function listVaultOverview() {
     accessMode: access.mode,
     secretCount: secrets.length,
     activeGrantCount:
-      access.mode === "all-apps" ? secrets.length : manualGrantCount,
-    manualGrantCount,
+      access.mode === "all-apps"
+        ? secrets.length
+        : isAdmin
+          ? manualGrantCount
+          : 0,
+    manualGrantCount: isAdmin ? manualGrantCount : 0,
     pendingRequestCount: requests.filter((r) => r.status === "pending").length,
   };
 }