@agent-native/dispatch 0.40.30-nightly-20261021064625 → 0.40.30

package/src/server/lib/app-creation-store.spec.ts

@@ -10,15 +10,21 @@ import {
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import {
+  archiveWorkspaceApp,
   generateWorkspaceAppDescription,
   getAppCreationSettings,
   listAvailableWorkspaceTemplates,
+  listOrganizationVisibleWorkspaceApps,
   listWorkspaceApps,
   scaffoldWorkspaceAppFromTemplate,
   setAppCreationSettings,
   startWorkspaceAppCreation,
   updateWorkspaceAppMetadata,
 } from "./app-creation-store.js";
+import {
+  orgAppsDirectoryAccessCache,
+  orgAppsDirectoryCache,
+} from "./org-apps-directory-cache.js";
 
 const originalFetch = globalThis.fetch;
 const settingsKey = "dispatch-app-creation-settings:user:dev@example.test";
@@ -27,6 +33,7 @@ const mocks = vi.hoisted(() => {
   const settings = new Map<string, unknown>();
   const state = {
     orgRole: "admin" as string | null,
+    workspaceApps: [] as Record<string, unknown>[],
   };
   const executedSql: string[] = [];
   return {
@@ -62,6 +69,20 @@ const mocks = vi.hoisted(() => {
             ? statement
             : String((statement as { sql?: unknown })?.sql ?? "");
         executedSql.push(sql);
+        if (sql.includes("SELECT id, org_id, visibility, org_enabled")) {
+          const args = (statement as { args?: unknown[] }).args ?? [];
+          return {
+            rows: state.workspaceApps.filter((app) => args.includes(app.id)),
+            rowsAffected: 0,
+          };
+        }
+        if (sql.includes("SELECT id, owner_email, org_id, visibility")) {
+          const args = (statement as { args?: unknown[] }).args ?? [];
+          return {
+            rows: state.workspaceApps.filter((app) => args.includes(app.id)),
+            rowsAffected: 0,
+          };
+        }
         if (sql.includes("SELECT id FROM workspace_apps")) {
           return { rows: [], rowsAffected: 0 };
         }
@@ -71,6 +92,22 @@ const mocks = vi.hoisted(() => {
         };
       }),
     })),
+    getDb: vi.fn(() => ({
+      select: vi.fn(() => ({
+        from: vi.fn(() => ({
+          where: vi.fn(async () =>
+            state.workspaceApps
+              .filter(
+                (app) =>
+                  app.org_id === "org-123" &&
+                  app.visibility === "org" &&
+                  app.org_enabled === 1,
+              )
+              .map((app) => ({ id: String(app.id) })),
+          ),
+        })),
+      })),
+    })),
     resolveBuilderCredentialsDetailed: vi.fn(async () => ({
       privateKey: null as string | null,
       publicKey: null as string | null,
@@ -94,6 +131,11 @@ const mocks = vi.hoisted(() => {
   };
 });
 
+vi.mock("../../db/index.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../db/index.js")>();
+  return { ...actual, getDb: mocks.getDb };
+});
+
 vi.mock("@agent-native/core/secrets", async (importOriginal) => {
   const actual =
     await importOriginal<typeof import("@agent-native/core/secrets")>();
@@ -187,6 +229,9 @@ afterEach(() => {
     },
   );
   mocks.state.orgRole = "admin";
+  mocks.state.workspaceApps = [];
+  orgAppsDirectoryCache.clear();
+  orgAppsDirectoryAccessCache.clear();
   mocks.getDbExec.mockReset();
   mocks.getDbExec.mockImplementation(() => ({
     execute: vi.fn(async (statement: unknown) => {
@@ -195,6 +240,24 @@ afterEach(() => {
           ? statement
           : String((statement as { sql?: unknown })?.sql ?? "");
       mocks.executedSql.push(sql);
+      if (sql.includes("SELECT id, org_id, visibility, org_enabled")) {
+        const args = (statement as { args?: unknown[] }).args ?? [];
+        return {
+          rows: mocks.state.workspaceApps.filter((app) =>
+            args.includes(app.id),
+          ),
+          rowsAffected: 0,
+        };
+      }
+      if (sql.includes("SELECT id, owner_email, org_id, visibility")) {
+        const args = (statement as { args?: unknown[] }).args ?? [];
+        return {
+          rows: mocks.state.workspaceApps.filter((app) =>
+            args.includes(app.id),
+          ),
+          rowsAffected: 0,
+        };
+      }
       if (sql.includes("SELECT id FROM workspace_apps")) {
         return { rows: [], rowsAffected: 0 };
       }
@@ -373,6 +436,71 @@ describe("listWorkspaceApps", () => {
     ]);
   });
 
+  it("lists only ready org-visible apps for an organization principal", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+      { id: "qr", name: "QR", path: "/qr" },
+      { id: "private-app", name: "Private", path: "/private-app" },
+      { id: "disabled-app", name: "Disabled", path: "/disabled-app" },
+      { id: "foreign-app", name: "Foreign", path: "/foreign-app" },
+    ]);
+    mocks.settings.set("dispatch-app-creation-settings:org:org-123", {
+      pendingApps: [pendingApp("pending-app")],
+    });
+    mocks.state.workspaceApps = [
+      {
+        id: "dispatch",
+        owner_email: "owner@example.test",
+        org_id: "org-123",
+        visibility: "org",
+        org_enabled: 1,
+      },
+      {
+        id: "qr",
+        owner_email: "owner@example.test",
+        org_id: "org-123",
+        visibility: "org",
+        org_enabled: 1,
+      },
+      {
+        id: "private-app",
+        owner_email: "dev@example.test",
+        org_id: "org-123",
+        visibility: "private",
+        org_enabled: 1,
+      },
+      {
+        id: "disabled-app",
+        owner_email: "owner@example.test",
+        org_id: "org-123",
+        visibility: "org",
+        org_enabled: 0,
+      },
+      {
+        id: "foreign-app",
+        owner_email: "owner@example.test",
+        org_id: "another-org",
+        visibility: "org",
+        org_enabled: 1,
+      },
+    ];
+
+    const apps = await runWithRequestContext({ orgId: "org-123" }, () =>
+      listOrganizationVisibleWorkspaceApps(),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch", "qr"]);
+    expect(mocks.executedSql.some((sql) => sql.includes("INSERT INTO"))).toBe(
+      false,
+    );
+    expect(
+      mocks.executedSql.some((sql) =>
+        sql.includes("INSERT INTO workspace_apps"),
+      ),
+    ).toBe(false);
+  });
+
   it.each([401, 403])(
     "keeps a local gateway denial on the unverified fallback path (%i)",
     async (status) => {
@@ -1508,6 +1636,51 @@ describe("listWorkspaceApps", () => {
     );
   });
 
+  it("keeps the curated source id on a pending app summary", async () => {
+    stubNoPendingContext();
+    stubManifest();
+    mocks.settings.set(settingsKey, {
+      pendingApps: [
+        pendingApp("community-qr", {
+          communitySourceId: "community-qr",
+        }),
+      ],
+    });
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.find((app) => app.id === "community-qr")).toMatchObject({
+      status: "pending",
+      communitySourceId: "community-qr",
+    });
+  });
+
+  it("keeps the curated source id on ready app metadata", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+      { id: "community-qr", name: "QR", path: "/community-qr" },
+    ]);
+    mocks.settings.set("workspace-app-metadata:user:dev@example.test", {
+      apps: {
+        "community-qr": { communitySourceId: "community-qr" },
+      },
+    });
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.find((app) => app.id === "community-qr")).toMatchObject({
+      status: "ready",
+      communitySourceId: "community-qr",
+    });
+  });
+
   it("keeps unscoped legacy pending rows visible when there is no deploy context", async () => {
     stubNoPendingContext();
     stubManifest();
@@ -1643,7 +1816,7 @@ describe("listWorkspaceApps", () => {
     expect(apps.find((app) => app.id === "mail")?.status).toBe("ready");
   });
 
-  it("lets workspace admins update app display metadata", async () => {
+  it("lets workspace admins update app profile metadata", async () => {
     stubNoPendingContext();
     stubManifest([
       { id: "dispatch", name: "Dispatch", path: "/dispatch" },
@@ -1662,24 +1835,26 @@ describe("listWorkspaceApps", () => {
           appId: "todo",
           name: "Todo Board",
           description: "Tracks team work.",
+          whenToUse: ["Create a task from a meeting note"],
         }),
     );
 
     expect(updated.name).toBe("Todo Board");
     expect(updated.description).toBe("Tracks team work.");
+    expect(updated.whenToUse).toEqual(["Create a task from a meeting note"]);
     expect(mocks.settings.get("workspace-app-metadata:org:org-123")).toEqual({
       apps: {
         todo: expect.objectContaining({
           name: "Todo Board",
           description: "Tracks team work.",
+          whenToUse: ["Create a task from a meeting note"],
           updatedBy: "dev@example.test",
         }),
       },
     });
   });
 
-  it("lets workspace members update app display metadata", async () => {
-    mocks.state.orgRole = "member";
+  it("does not overwrite app profile metadata when its settings are unreadable", async () => {
     stubNoPendingContext();
     stubManifest([
       {
@@ -1689,30 +1864,262 @@ describe("listWorkspaceApps", () => {
         path: "/todo",
       },
     ]);
+    const key = "workspace-app-metadata:org:org-123";
+    const existing = { apps: { other: { name: "Preserve me" } } };
+    mocks.settings.set(key, existing);
+    let metadataReads = 0;
+    mocks.getSetting.mockImplementation(async (settingKey: string) => {
+      if (settingKey === key && ++metadataReads === 2) {
+        throw new Error("metadata settings unavailable");
+      }
+      return mocks.settings.get(settingKey) ?? null;
+    });
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "dev@example.test", orgId: "org-123" },
+        () => updateWorkspaceAppMetadata({ appId: "todo", name: "Updated" }),
+      ),
+    ).rejects.toThrow("metadata settings unavailable");
+
+    expect(metadataReads).toBe(2);
+    expect(mocks.putSetting).not.toHaveBeenCalled();
+    expect(mocks.settings.get(key)).toEqual(existing);
+  });
+
+  it("does not overwrite workspace settings when archiving after a read failure", async () => {
+    const key = "dispatch-app-creation-settings:org:org-123";
+    const existing = {
+      builderProjectId: "project-123",
+      pendingCommunityReservations: ["community-qr"],
+      archivedAppIds: [],
+    };
+    mocks.settings.set(key, existing);
+    mocks.getSetting.mockRejectedValueOnce(
+      new Error("workspace settings unavailable"),
+    );
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "dev@example.test", orgId: "org-123" },
+        () => archiveWorkspaceApp({ appId: "todo" }),
+      ),
+    ).rejects.toThrow("workspace settings unavailable");
+
+    expect(mocks.putSetting).not.toHaveBeenCalled();
+    expect(mocks.settings.get(key)).toEqual(existing);
+  });
+
+  it("preserves generated name and description when only examples change", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      {
+        id: "todo",
+        name: "Todo",
+        description: "Manifest description",
+        path: "/todo",
+      },
+    ]);
+    mocks.settings.set("workspace-app-metadata:org:org-123", {
+      apps: {
+        todo: {
+          description: "Generated description",
+          generated: true,
+        },
+      },
+    });
 
     const updated = await runWithRequestContext(
       { userEmail: "dev@example.test", orgId: "org-123" },
       () =>
         updateWorkspaceAppMetadata({
           appId: "todo",
-          name: "Todo Board",
-          description: "Tracks team work.",
+          whenToUse: ["Create a task from a meeting note"],
         }),
     );
 
-    expect(updated).toMatchObject({
-      name: "Todo Board",
-      description: "Tracks team work.",
-    });
+    expect(updated.name).toBe("Todo");
+    expect(updated.description).toBe("Manifest description");
+    expect(updated.whenToUse).toEqual(["Create a task from a meeting note"]);
     expect(mocks.settings.get("workspace-app-metadata:org:org-123")).toEqual({
       apps: {
         todo: expect.objectContaining({
-          name: "Todo Board",
-          description: "Tracks team work.",
+          description: "Generated description",
+          generated: true,
+          whenToUse: ["Create a task from a meeting note"],
           updatedBy: "dev@example.test",
         }),
       },
     });
+    expect(
+      (mocks.settings.get("workspace-app-metadata:org:org-123") as any).apps
+        .todo,
+    ).not.toHaveProperty("name");
+  });
+
+  it("invalidates org directory discovery after a profile edit", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "todo", name: "Todo", description: "Tasks", path: "/todo" },
+    ]);
+    const load = vi.fn(async () => [
+      {
+        id: "todo",
+        name: "Old profile",
+        url: "https://todo.example.test",
+      },
+    ]);
+    await orgAppsDirectoryCache.get("org-123|organization", load);
+    const loadAccess = vi.fn(async () => new Set(["todo"]));
+    await orgAppsDirectoryAccessCache.get("org-123|organization", loadAccess);
+
+    await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "org-123" },
+      () =>
+        updateWorkspaceAppMetadata({
+          appId: "todo",
+          description: "Updated profile",
+        }),
+    );
+
+    const refreshedLoad = vi.fn(async () => [
+      {
+        id: "todo",
+        name: "Updated profile",
+        url: "https://todo.example.test",
+      },
+    ]);
+    await expect(
+      orgAppsDirectoryCache.get("org-123|organization", refreshedLoad),
+    ).resolves.toEqual([
+      {
+        id: "todo",
+        name: "Updated profile",
+        url: "https://todo.example.test",
+      },
+    ]);
+    expect(refreshedLoad).toHaveBeenCalledOnce();
+
+    const refreshedAccess = vi.fn(async () => new Set(["todo"]));
+    await expect(
+      orgAppsDirectoryAccessCache.get("org-123|organization", refreshedAccess),
+    ).resolves.toEqual(new Set(["todo"]));
+    expect(refreshedAccess).toHaveBeenCalledOnce();
+  });
+
+  it("clears explicit null metadata and preserves an empty when-to-use list", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      {
+        id: "todo",
+        name: "Manifest name",
+        description: "Manifest description",
+        path: "/todo",
+      },
+    ]);
+    mocks.settings.set("workspace-app-metadata:org:org-123", {
+      apps: {
+        todo: {
+          name: "Override name",
+          description: "Override description",
+          whenToUse: ["Old example"],
+        },
+      },
+    });
+
+    await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "org-123" },
+      () =>
+        updateWorkspaceAppMetadata({
+          appId: "todo",
+          name: null,
+          description: null,
+          whenToUse: [],
+        }),
+    );
+
+    expect(mocks.settings.get("workspace-app-metadata:org:org-123")).toEqual({
+      apps: {
+        todo: expect.objectContaining({ whenToUse: [] }),
+      },
+    });
+  });
+
+  it("reports owner-role lookup failures as unavailable instead of unauthorized", async () => {
+    stubNoPendingContext();
+    stubManifest([{ id: "todo", name: "Todo", path: "/todo" }]);
+    mocks.getDbExec.mockReturnValue({
+      execute: vi.fn(async () => {
+        throw new Error("database unavailable");
+      }),
+    } as any);
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "dev@example.test", orgId: "org-123" },
+        () => updateWorkspaceAppMetadata({ appId: "todo", name: "Updated" }),
+      ),
+    ).rejects.toMatchObject({
+      name: "AppCreationOwnerRoleUnavailableError",
+      statusCode: 503,
+    });
+    expect(mocks.settings.has("workspace-app-metadata:org:org-123")).toBe(
+      false,
+    );
+  });
+
+  it("rejects malformed profile examples before writing", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "todo", name: "Todo", description: "Tasks", path: "/todo" },
+    ]);
+    const tooManyExamples = Array.from(
+      { length: 7 },
+      (_, index) => `Example ${index}`,
+    );
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "dev@example.test", orgId: "org-123" },
+        () =>
+          updateWorkspaceAppMetadata({
+            appId: "todo",
+            whenToUse: tooManyExamples,
+          }),
+      ),
+    ).rejects.toThrow(/up to 6 non-empty examples/);
+    expect(mocks.settings.has("workspace-app-metadata:org:org-123")).toBe(
+      false,
+    );
+  });
+
+  it("rejects workspace member updates to app profile metadata", async () => {
+    mocks.state.orgRole = "member";
+    stubNoPendingContext();
+    stubManifest([
+      {
+        id: "todo",
+        name: "Todo",
+        description: "Original description",
+        path: "/todo",
+      },
+    ]);
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "dev@example.test", orgId: "org-123" },
+        () =>
+          updateWorkspaceAppMetadata({
+            appId: "todo",
+            name: "Todo Board",
+            description: "Tracks team work.",
+            whenToUse: ["Create a task from a meeting note"],
+          }),
+      ),
+    ).rejects.toMatchObject({ statusCode: 403 });
+    expect(mocks.settings.has("workspace-app-metadata:org:org-123")).toBe(
+      false,
+    );
   });
 
   it("generates a concise seed description from an app prompt", () => {
@@ -1812,6 +2219,82 @@ describe("startWorkspaceAppCreation", () => {
     });
   });
 
+  it("persists the curated source id for local-agent app creation", async () => {
+    const result = await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "org-123" },
+      () =>
+        startWorkspaceAppCreation({
+          prompt: "Install the curated QR template",
+          appId: "community-qr",
+          communitySourceId: "community-qr",
+          attachments: [
+            {
+              type: "upload",
+              contentType: "text/plain",
+              name: "community-qr/README.md",
+              text: "Pinned template source",
+              dataUrl: "",
+              id: "community-qr:README.md",
+            },
+          ],
+        }),
+    );
+
+    expect(result).toMatchObject({
+      mode: "local-agent",
+      attachments: [
+        {
+          type: "file",
+          contentType: "text/plain",
+          name: "community-qr/README.md",
+          text: "Pinned template source",
+        },
+      ],
+    });
+    expect(
+      mocks.settings.get("workspace-app-metadata:org:org-123"),
+    ).toMatchObject({
+      apps: {
+        "community-qr": { communitySourceId: "community-qr" },
+      },
+    });
+    expect(
+      mocks.settings.get("dispatch-app-creation-settings:org:org-123"),
+    ).toMatchObject({
+      pendingApps: [
+        expect.objectContaining({
+          id: "community-qr",
+          communitySourceId: "community-qr",
+          createdBy: "dev@example.test",
+        }),
+      ],
+    });
+  });
+
+  it("atomically reserves local community installs against duplicate requests", async () => {
+    const input = {
+      prompt: "Install the curated QR template",
+      appId: "community-qr",
+      communitySourceId: "community-qr",
+    };
+    const context = { userEmail: "dev@example.test", orgId: "org-123" };
+
+    const first = await runWithRequestContext(context, () =>
+      startWorkspaceAppCreation(input),
+    );
+    const duplicate = await runWithRequestContext(context, () =>
+      startWorkspaceAppCreation(input),
+    );
+
+    expect(first.mode).toBe("local-agent");
+    expect(duplicate).toMatchObject({
+      mode: "app-id-taken",
+      appId: "community-qr",
+      conflict: "pending",
+      owner: "dev@example.test",
+    });
+  });
+
   it("rejects a cross-member collision with an active pending app id", async () => {
     stubHostedRuntime();
     stubBuilderProjectConfigured();
@@ -1961,6 +2444,51 @@ describe("startWorkspaceAppCreation", () => {
     expect(mocks.mutateSetting).toHaveBeenCalled();
   });
 
+  it("persists the curated source id with a hosted pending reservation", async () => {
+    stubHostedRuntime();
+    stubBuilderProjectConfigured();
+    mocks.resolveBuilderCredentialsDetailed.mockResolvedValue(
+      credentials({
+        privateKey: "priv",
+        publicKey: "pub",
+        userId: "builder-user-42",
+      }),
+    );
+    mocks.runBuilderAgent.mockResolvedValue({
+      branchName: "community-qr1",
+      url: "https://builder.io/app/projects/project-1/community-qr1",
+      status: "processing",
+    });
+
+    await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "org-123" },
+      () =>
+        startWorkspaceAppCreation({
+          prompt: "Install the curated QR template",
+          appId: "community-qr",
+          communitySourceId: "community-qr",
+        }),
+    );
+
+    expect(
+      mocks.settings.get("dispatch-app-creation-settings:org:org-123"),
+    ).toMatchObject({
+      pendingApps: [
+        expect.objectContaining({
+          id: "community-qr",
+          communitySourceId: "community-qr",
+        }),
+      ],
+    });
+    expect(
+      mocks.settings.get("workspace-app-metadata:org:org-123"),
+    ).toMatchObject({
+      apps: {
+        "community-qr": { communitySourceId: "community-qr" },
+      },
+    });
+  });
+
   it("releases the reservation when Builder handoff fails", async () => {
     stubHostedRuntime();
     stubBuilderProjectConfigured();