@agent-native/dispatch 0.36.0-nightly-20260909183543 → 0.36.0

package/src/server/lib/app-creation-store.ts

@@ -1450,7 +1450,7 @@ async function filterWorkspaceAppsByAccess(
     }
     if (app.isDispatch) {
       if (
-        await isWorkspaceAppAccessAllowed(app.id, {
+        await isWorkspaceAppAccessAllowed("dispatch", {
           email: userEmail,
           orgId,
         })

package/src/server/lib/app-roles.spec.ts

@@ -0,0 +1,120 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  assertAny: vi.fn(),
+  getRequestOrgId: vi.fn(),
+  getRequestUserEmail: vi.fn(),
+  isStandaloneDispatchRuntime: vi.fn(),
+  validateFederatedOrganizationMembershipForCurrentRequest: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/org", () => ({
+  defineAppRoles: () => ({ assertAny: mocks.assertAny }),
+  isMissingOrganizationTableError: (error: unknown) =>
+    /(?:organizations|org_members).*does not exist/i.test(String(error)),
+  isStandaloneDispatchRuntime: mocks.isStandaloneDispatchRuntime,
+  validateFederatedOrganizationMembershipForCurrentRequest:
+    mocks.validateFederatedOrganizationMembershipForCurrentRequest,
+}));
+
+vi.mock("@agent-native/core/server", () => ({
+  getRequestOrgId: mocks.getRequestOrgId,
+  getRequestUserEmail: mocks.getRequestUserEmail,
+}));
+
+import { ForbiddenError } from "@agent-native/core/sharing";
+
+import { authorizeDispatchAdmin } from "./app-roles.js";
+
+const context = {
+  caller: "http" as const,
+  orgId: "org-1",
+  userEmail: "member@example.test",
+};
+
+describe("authorizeDispatchAdmin", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockResolvedValue(
+      { active: true, role: "member" },
+    );
+    mocks.assertAny.mockResolvedValue("admin");
+    mocks.getRequestOrgId.mockReturnValue(undefined);
+    mocks.getRequestUserEmail.mockReturnValue(undefined);
+    mocks.isStandaloneDispatchRuntime.mockReturnValue(false);
+  });
+
+  it("denies an organization member without the Dispatch admin role", async () => {
+    mocks.assertAny.mockRejectedValue(
+      new ForbiddenError("Requires dispatch role admin"),
+    );
+
+    await expect(authorizeDispatchAdmin({}, context)).rejects.toThrow(
+      "Requires dispatch role admin",
+    );
+    expect(
+      mocks.validateFederatedOrganizationMembershipForCurrentRequest,
+    ).toHaveBeenCalledWith({
+      orgId: "org-1",
+      email: "member@example.test",
+    });
+    expect(mocks.assertAny).toHaveBeenCalledWith(["admin"], {
+      orgId: "org-1",
+      userEmail: "member@example.test",
+    });
+  });
+
+  it("allows an organization admin without an app-role assignment", async () => {
+    mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockResolvedValue(
+      { active: true, role: "admin" },
+    );
+
+    await expect(authorizeDispatchAdmin({}, context)).resolves.toBeUndefined();
+    expect(mocks.assertAny).not.toHaveBeenCalled();
+  });
+
+  it("denies a stale linked organization admin", async () => {
+    mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockResolvedValue(
+      { active: false, role: null },
+    );
+
+    await expect(authorizeDispatchAdmin({}, context)).rejects.toThrow(
+      "active organization membership",
+    );
+    expect(mocks.assertAny).not.toHaveBeenCalled();
+  });
+
+  it("allows standalone administration when the org schema is absent", async () => {
+    mocks.isStandaloneDispatchRuntime.mockReturnValue(true);
+    mocks.validateFederatedOrganizationMembershipForCurrentRequest.mockRejectedValue(
+      new Error('relation "org_members" does not exist'),
+    );
+
+    await expect(authorizeDispatchAdmin({}, context)).resolves.toBeUndefined();
+    expect(mocks.assertAny).not.toHaveBeenCalled();
+  });
+
+  it("allows a member with the Dispatch admin role", async () => {
+    await expect(authorizeDispatchAdmin({}, context)).resolves.toBeUndefined();
+    expect(mocks.assertAny).toHaveBeenCalledWith(["admin"], {
+      orgId: "org-1",
+      userEmail: "member@example.test",
+    });
+  });
+
+  it("allows authenticated personal-mode administration", async () => {
+    await expect(
+      authorizeDispatchAdmin({}, { ...context, orgId: null }),
+    ).resolves.toBeUndefined();
+    expect(
+      mocks.validateFederatedOrganizationMembershipForCurrentRequest,
+    ).not.toHaveBeenCalled();
+    expect(mocks.assertAny).not.toHaveBeenCalled();
+  });
+
+  it("denies an unauthenticated caller", async () => {
+    await expect(
+      authorizeDispatchAdmin({}, { ...context, userEmail: undefined }),
+    ).rejects.toBeInstanceOf(ForbiddenError);
+  });
+});

package/src/server/lib/app-roles.ts

@@ -0,0 +1,67 @@
+import type { ActionRunContext } from "@agent-native/core/action";
+import {
+  defineAppRoles,
+  isMissingOrganizationTableError,
+  isStandaloneDispatchRuntime,
+  type AppRoles,
+  validateFederatedOrganizationMembershipForCurrentRequest,
+} from "@agent-native/core/org";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { ForbiddenError } from "@agent-native/core/sharing";
+
+import { dispatchAccessDescriptor } from "../../shared/app-roles.js";
+
+let dispatchAccess: AppRoles<"admin"> | undefined;
+
+function getDispatchAccess(): AppRoles<"admin"> {
+  return (dispatchAccess ??= defineAppRoles(dispatchAccessDescriptor));
+}
+
+/**
+ * Keep the Dispatch shell open to every signed-in member while protecting
+ * workspace-wide administration operations for org or Dispatch admins.
+ */
+export async function authorizeDispatchAdmin(
+  _args: unknown,
+  ctx?: ActionRunContext,
+): Promise<void> {
+  const email =
+    ctx?.userEmail !== undefined ? ctx.userEmail : getRequestUserEmail();
+  const orgId = ctx?.orgId !== undefined ? ctx.orgId : getRequestOrgId();
+  if (!email?.trim()) {
+    throw new ForbiddenError(
+      "Dispatch administration requires an authenticated user.",
+    );
+  }
+  if (!orgId?.trim()) return;
+  let membership;
+  try {
+    membership = await validateFederatedOrganizationMembershipForCurrentRequest(
+      {
+        orgId,
+        email,
+      },
+    );
+  } catch (error) {
+    if (
+      isMissingOrganizationTableError(error) &&
+      isStandaloneDispatchRuntime()
+    ) {
+      return;
+    }
+    throw error;
+  }
+  if (!membership.active) {
+    throw new ForbiddenError(
+      "Dispatch administration requires active organization membership.",
+    );
+  }
+  if (membership.role === "owner" || membership.role === "admin") return;
+  await getDispatchAccess().assertAny(["admin"], {
+    userEmail: email,
+    orgId,
+  });
+}

package/src/server/lib/approval-fencing.spec.ts

@@ -340,6 +340,45 @@ describe("dispatch approval request status fencing", () => {
     });
   });
 
+  it("does not let the same email approve a request from another organization", async () => {
+    const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
+      await Promise.all([
+        import("@agent-native/core/server"),
+        import("@agent-native/core/db"),
+        import("./dispatch-store.js"),
+      ]);
+    const exec = getDbExec();
+
+    const requestId = await runWithRequestContext(
+      { userEmail: ownerEmail, orgId },
+      async () => {
+        const created = await dispatchStore.createApprovalRequest({
+          changeType: "approval-policy.update",
+          targetType: "dispatch-settings",
+          targetId: "dispatch-approval-policy",
+          summary: "Keep this request in its organization",
+          payload: { enabled: true, approverEmails: [] },
+        });
+        return (created as any).id as string;
+      },
+    );
+
+    await runWithRequestContext(
+      { userEmail: ownerEmail, orgId: otherOrgId },
+      async () => {
+        await expect(dispatchStore.approveRequest(requestId)).rejects.toThrow(
+          "Approval request not found",
+        );
+      },
+    );
+
+    const rows = await exec.execute({
+      sql: "SELECT status FROM dispatch_approval_requests WHERE id = ?",
+      args: [requestId],
+    });
+    expect(rows.rows[0]).toMatchObject({ status: "pending" });
+  });
+
   it("does not let a caller from a different tenant reject another tenant's request", async () => {
     const [{ runWithRequestContext }, { getDbExec }, dispatchStore] =
       await Promise.all([

package/src/server/lib/dispatch-store.ts

@@ -157,7 +157,10 @@ function ctxScope<T extends { ownerEmail: any; orgId: any }>(
   if (!ctx.orgId) {
     return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));
   }
-  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));
+  return or(
+    and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId)),
+    eq(table.orgId, ctx.orgId),
+  );
 }
 
 function id() {

package/src/server/lib/dreams-store.spec.ts

@@ -4,6 +4,7 @@ const mocks = vi.hoisted(() => ({
   getDb: vi.fn(),
   currentOwnerEmail: vi.fn(() => "owner@example.test"),
   currentOrgId: vi.fn(() => null),
+  authorizeDispatchAdmin: vi.fn(),
   getApprovalPolicy: vi.fn(),
   createApprovalRequest: vi.fn(),
   recordAudit: vi.fn(),
@@ -42,6 +43,10 @@ vi.mock("./dispatch-store.js", () => ({
   recordAudit: mocks.recordAudit,
 }));
 
+vi.mock("./app-roles.js", () => ({
+  authorizeDispatchAdmin: mocks.authorizeDispatchAdmin,
+}));
+
 vi.mock("./thread-debug-store.js", () => ({
   searchAgentThreads: mocks.searchAgentThreads,
   getAgentThreadDebug: mocks.getAgentThreadDebug,
@@ -72,6 +77,7 @@ import { schema } from "../../db/index.js";
 import {
   applyApprovedDreamProposal,
   applyDreamProposal,
+  authorizeDreamProposalMutation,
   buildProposalInputs,
   ensureDreamJob,
   getDreamSettings,
@@ -301,6 +307,78 @@ afterEach(() => {
   vi.clearAllMocks();
 });
 
+describe("authorizeDreamProposalMutation", () => {
+  it("allows an owner to change a personal-memory proposal", async () => {
+    mocks.getDb.mockReturnValue(createDbMock(pendingProposal()));
+
+    await expect(
+      authorizeDreamProposalMutation(
+        { id: "proposal-1" },
+        {
+          caller: "http",
+          orgId: null,
+          userEmail: "owner@example.test",
+        },
+      ),
+    ).resolves.toBeUndefined();
+    expect(mocks.authorizeDispatchAdmin).not.toHaveBeenCalled();
+  });
+
+  it("requires Dispatch admin authorization for shared proposals", async () => {
+    mocks.getDb.mockReturnValue(
+      createDbMock(
+        pendingProposal({
+          orgId: "org-1",
+          targetType: "shared-learnings",
+          targetPath: "LEARNINGS.md",
+        }),
+      ),
+    );
+    mocks.authorizeDispatchAdmin.mockResolvedValue(undefined);
+
+    await expect(
+      authorizeDreamProposalMutation(
+        { id: "proposal-1" },
+        {
+          caller: "http",
+          orgId: "org-1",
+          userEmail: "member@example.test",
+        },
+      ),
+    ).resolves.toBeUndefined();
+    expect(mocks.authorizeDispatchAdmin).toHaveBeenCalledWith(
+      { id: "proposal-1" },
+      expect.objectContaining({
+        orgId: "org-1",
+        userEmail: "member@example.test",
+      }),
+    );
+  });
+
+  it("does not let an organization member change another user's personal proposal", async () => {
+    mocks.getDb.mockReturnValue(
+      createDbMock(
+        pendingProposal({
+          ownerEmail: "other@example.test",
+          orgId: "org-1",
+        }),
+      ),
+    );
+
+    await expect(
+      authorizeDreamProposalMutation(
+        { id: "proposal-1" },
+        {
+          caller: "http",
+          orgId: "org-1",
+          userEmail: "member@example.test",
+        },
+      ),
+    ).rejects.toThrow("can only be changed by their owner");
+    expect(mocks.authorizeDispatchAdmin).not.toHaveBeenCalled();
+  });
+});
+
 describe("listDreamCandidates", () => {
   it("scores grounded thread signals and keeps per-thread debug errors isolated", async () => {
     mocks.searchAgentThreads.mockResolvedValue({

package/src/server/lib/dreams-store.ts

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 
+import type { ActionRunContext } from "@agent-native/core/action";
 import {
   and,
   desc,
@@ -20,8 +21,10 @@ import {
   putOrgSetting,
   putUserSetting,
 } from "@agent-native/core/settings";
+import { ForbiddenError } from "@agent-native/core/sharing";
 
 import { getDb, schema } from "../../db/index.js";
+import { authorizeDispatchAdmin } from "./app-roles.js";
 import {
   createApprovalRequest,
   currentOrgId,
@@ -444,7 +447,10 @@ function scopeFor<T extends { ownerEmail: any; orgId: any }>(
   if (!ctx.orgId) {
     return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));
   }
-  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));
+  return or(
+    and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId)),
+    eq(table.orgId, ctx.orgId),
+  );
 }
 
 function safeJson(value: unknown): string {
@@ -2394,6 +2400,36 @@ async function getProposalRow(
   return row ?? null;
 }
 
+export async function authorizeDreamProposalMutation(
+  args: { id: string },
+  ctx?: ActionRunContext,
+): Promise<void> {
+  const ownerEmail =
+    ctx?.userEmail !== undefined ? ctx.userEmail : currentOwnerEmail();
+  const orgId = ctx?.orgId !== undefined ? ctx.orgId : currentOrgId();
+  const proposal = await getProposalRow(args.id, {
+    ownerEmail,
+    orgId: orgId?.trim() || null,
+  });
+  if (!proposal) {
+    throw new ForbiddenError("Dream proposal not found");
+  }
+
+  if (proposal.targetType === "personal-memory") {
+    if (
+      proposal.ownerEmail.trim().toLowerCase() !==
+      ownerEmail.trim().toLowerCase()
+    ) {
+      throw new ForbiddenError(
+        "Personal memory proposals can only be changed by their owner",
+      );
+    }
+    return;
+  }
+
+  await authorizeDispatchAdmin(args, ctx);
+}
+
 export async function createDreamReport(input: {
   sourceId?: string;
   sourceIds?: string[];