@agent-native/dispatch 0.40.30 → 0.40.33

package/src/server/lib/usage-metrics-store.spec.ts

@@ -9,6 +9,7 @@ const mocks = vi.hoisted(() => ({
   listWorkspaceApps: vi.fn(),
   currentOrgId: vi.fn((): string | null => null),
   currentOwnerEmail: vi.fn(() => "owner@example.test"),
+  delegatedOrgMember: false,
   registerBuiltinEngines: vi.fn(),
   dispatchConfig: {
     adminEmails: [] as string[],
@@ -40,6 +41,25 @@ vi.mock("@agent-native/core/settings", () => ({
 
 vi.mock("@agent-native/core/server", () => ({
   getAppConfig: () => ({ dispatch: mocks.dispatchConfig }),
+  getRequestContext: () =>
+    mocks.delegatedOrgMember
+      ? {
+          a2aIdentityAssurance: "org-member",
+          userEmail: mocks.currentOwnerEmail(),
+          orgId: mocks.currentOrgId(),
+        }
+      : undefined,
+  readOrgMemberRole: async (orgId: string, email: string) => {
+    const result = await mocks.execute({
+      sql: "SELECT role FROM org_members",
+      args: [orgId, email.toLowerCase()],
+    });
+    const role = result.rows[0]?.role;
+    if (mocks.delegatedOrgMember && (role === "owner" || role === "admin")) {
+      return "member";
+    }
+    return typeof role === "string" ? role : null;
+  },
 }));
 
 vi.mock("@agent-native/core/usage", () => ({
@@ -104,6 +124,7 @@ afterEach(() => {
   vi.clearAllMocks();
   mocks.currentOrgId.mockReturnValue(null);
   mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+  mocks.delegatedOrgMember = false;
   mocks.dispatchConfig.adminEmails = [];
   mocks.dispatchConfig.workspaceOwnerEmails = [];
   mocks.dispatchConfig.defaultOwnerEmail = undefined;
@@ -127,6 +148,49 @@ describe("listDispatchUsageMetrics", () => {
     expect(mocks.listWorkspaceApps).not.toHaveBeenCalled();
   });
 
+  it("does not let a delegated org member read workspace usage as an owner", async () => {
+    mocks.currentOrgId.mockReturnValue("org-a");
+    mocks.currentOwnerEmail.mockReturnValue("member@example.test");
+    mocks.delegatedOrgMember = true;
+    mocks.execute.mockResolvedValue({ rows: [{ role: "owner" }] });
+
+    await expect(
+      listDispatchUsageMetrics({ scope: "workspace" }),
+    ).rejects.toMatchObject({
+      name: "ForbiddenError",
+      statusCode: 403,
+      message:
+        "Only organization owners and admins can view workspace usage metrics.",
+    });
+    expect(
+      mocks.execute.mock.calls.some(([query]) =>
+        String((query as { sql?: string }).sql).includes(
+          "SELECT email, role, joined_at",
+        ),
+      ),
+    ).toBe(false);
+    expect(mocks.getUsageSummary).not.toHaveBeenCalled();
+  });
+
+  it("does not let an environment admin assertion read workspace usage as an org member", async () => {
+    mocks.currentOrgId.mockReturnValue("org-a");
+    mocks.currentOwnerEmail.mockReturnValue("platform-admin@example.test");
+    mocks.delegatedOrgMember = true;
+    mocks.dispatchConfig.adminEmails = ["platform-admin@example.test"];
+    mocks.execute.mockResolvedValue({ rows: [{ role: "owner" }] });
+
+    await expect(
+      listDispatchUsageMetrics({ scope: "workspace" }),
+    ).rejects.toMatchObject({
+      name: "ForbiddenError",
+      statusCode: 403,
+      message:
+        "Only organization owners and admins can view workspace usage metrics.",
+    });
+    expect(mocks.getUsageSummary).not.toHaveBeenCalled();
+    expect(mocks.listWorkspaceApps).not.toHaveBeenCalled();
+  });
+
   it("allows a configured deployment admin to view workspace metrics", async () => {
     mocks.currentOrgId.mockReturnValue("org-a");
     mocks.currentOwnerEmail.mockReturnValue("owner@example.test");

package/src/server/lib/usage-metrics-store.ts

@@ -8,6 +8,7 @@ import {
   registerBuiltinEngines,
 } from "@agent-native/core/agent/engine";
 import { getDbExec } from "@agent-native/core/db";
+import { readOrgMemberRole } from "@agent-native/core/server";
 import { ForbiddenError } from "@agent-native/core/sharing";
 import {
   builderCreditsFromCostCents,
@@ -428,22 +429,6 @@ async function initializeUsageMetricsTable(sinceMs: number): Promise<void> {
   }
 }
 
-async function getViewerOrgRole(
-  orgId: string | null,
-  email: string,
-): Promise<string | null> {
-  if (!orgId) return null;
-  const rows = await queryRows<{ role?: string }>(
-    `SELECT role FROM org_members
-     WHERE org_id = ? AND LOWER(email) = ?
-       AND federation_removal_pending_at IS NULL
-     LIMIT 1`,
-    [orgId, email.toLowerCase()],
-  );
-  const role = rows[0]?.role;
-  return typeof role === "string" ? role : null;
-}
-
 async function listOrgMembers(orgId: string | null): Promise<MemberRecord[]> {
   if (!orgId) return [];
   const result = await getDbExec().execute({
@@ -950,7 +935,7 @@ async function assertCanViewMetrics(viewScope: UsageMetricsScope): Promise<{
 }> {
   const viewerEmail = currentOwnerEmail();
   const orgId = currentOrgId();
-  const role = await getViewerOrgRole(orgId, viewerEmail);
+  const role = orgId ? await readOrgMemberRole(orgId, viewerEmail) : null;
   if (
     viewScope === "me" ||
     isDispatchEnvironmentAdmin(viewerEmail) ||

package/src/server/lib/vault-store.spec.ts

@@ -12,6 +12,7 @@ const mocks = vi.hoisted(() => ({
   listAppSecretsForScope: vi.fn(),
   readAppSecret: vi.fn(),
   recordAudit: vi.fn(),
+  readOrgMemberRole: vi.fn(),
   writeAppSecret: vi.fn(),
 }));
 
@@ -28,6 +29,11 @@ vi.mock("@agent-native/core/db", async (importOriginal) => ({
   getDbExec: mocks.getDbExec,
 }));
 
+vi.mock("@agent-native/core/server", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@agent-native/core/server")>()),
+  readOrgMemberRole: (...args: unknown[]) => mocks.readOrgMemberRole(...args),
+}));
+
 vi.mock("@agent-native/core/server/agent-discovery", () => ({
   discoverAgents: mocks.discoverAgents,
 }));
@@ -100,9 +106,7 @@ describe("vault authorization", () => {
   it("rejects an organization member before reading shared vault values", async () => {
     mocks.currentOrgId.mockReturnValue("org_123");
     mocks.currentOwnerEmail.mockReturnValue("member@example.test");
-    mocks.getDbExec.mockReturnValue({
-      execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
-    });
+    mocks.readOrgMemberRole.mockResolvedValue("member");
 
     await expect(assertCanManageVault()).rejects.toMatchObject({
       message:
@@ -114,9 +118,7 @@ describe("vault authorization", () => {
   it("rejects organization members before listing or reading grants", async () => {
     mocks.currentOrgId.mockReturnValue("org_123");
     mocks.currentOwnerEmail.mockReturnValue("member@example.test");
-    mocks.getDbExec.mockReturnValue({
-      execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
-    });
+    mocks.readOrgMemberRole.mockResolvedValue("member");
 
     await expect(listGrants()).rejects.toThrow(
       "Only organization owners and admins can manage the workspace vault.",
@@ -132,14 +134,28 @@ describe("vault authorization", () => {
     async (role) => {
       mocks.currentOrgId.mockReturnValue("org_123");
       mocks.currentOwnerEmail.mockReturnValue(`${role}@example.test`);
-      mocks.getDbExec.mockReturnValue({
-        execute: vi.fn().mockResolvedValue({ rows: [{ role }] }),
-      });
+      mocks.readOrgMemberRole.mockResolvedValue(role);
 
       await expect(assertCanManageVault()).resolves.toBeUndefined();
     },
   );
 
+  it("caps a delegated owner before vault management", async () => {
+    mocks.currentOrgId.mockReturnValue("org_123");
+    mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+    mocks.readOrgMemberRole.mockResolvedValue("member");
+
+    await expect(assertCanManageVault()).rejects.toMatchObject({
+      statusCode: 403,
+      message:
+        "Only organization owners and admins can manage the workspace vault.",
+    });
+    expect(mocks.readOrgMemberRole).toHaveBeenCalledWith(
+      "org_123",
+      "owner@example.test",
+    );
+  });
+
   it("allows a solo workspace owner to manage their own vault", async () => {
     mocks.currentOrgId.mockReturnValue(null);
 
@@ -587,6 +603,7 @@ describe("syncGrantsToApp", () => {
   ) {
     mocks.currentOwnerEmail.mockReturnValue(caller.ownerEmail);
     mocks.currentOrgId.mockReturnValue(caller.orgId);
+    mocks.readOrgMemberRole.mockResolvedValue("owner");
     mocks.getOrgSetting.mockResolvedValue(null);
     mocks.getUserSetting.mockResolvedValue(null);
     mocks.discoverAgents.mockResolvedValue([

package/src/server/lib/vault-store.ts

@@ -1,6 +1,5 @@
 import crypto from "node:crypto";
 
-import { getDbExec } from "@agent-native/core/db";
 import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import { ssrfSafeFetch } from "@agent-native/core/extensions/url-safety";
 import {
@@ -11,6 +10,7 @@ import {
   writeAppSecret,
   type SecretScope,
 } from "@agent-native/core/secrets";
+import { readOrgMemberRole } from "@agent-native/core/server";
 import { discoverAgents } from "@agent-native/core/server/agent-discovery";
 import {
   getOrgSetting,
@@ -148,16 +148,9 @@ export async function assertCanManageVault(): Promise<void> {
   if (!orgId) return;
 
   const email = currentOwnerEmail().trim().toLowerCase();
-  let role: unknown = null;
+  let role: string | null = null;
   try {
-    const result = await getDbExec().execute({
-      sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-      args: [orgId, email],
-    });
-    role = result.rows[0]?.role;
+    role = await readOrgMemberRole(orgId, email);
   } catch {
     // coercion-ok: unknown membership is treated as unauthorized below.
     // A failed membership check must not become an authorization bypass.

package/src/server/lib/workspace-app-action-auth.spec.ts

@@ -212,6 +212,7 @@ describe("workspace app action auth", () => {
         owner: "steve@builder.io",
         anonymous: false,
         orgId: "org-builder",
+        identityAssurance: "user",
       });
       expect(mocks.verifyA2AToken).toHaveBeenCalledWith(
         "verified",
@@ -221,11 +222,41 @@ describe("workspace app action auth", () => {
       expect(mocks.isOrgMember).toHaveBeenCalledWith(
         "org-builder",
         "steve@builder.io",
+        { requestEvent: expect.anything() },
       );
       expect(mocks.resolveOrgIdForEmail).not.toHaveBeenCalled();
     },
   );
 
+  it("preserves delegated member assurance through the registry action resolver", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "owner@builder.io",
+      orgDomain: "builder.io",
+      orgId: "org-builder",
+      identityAssurance: "org-member",
+    });
+    mocks.resolveOrgByDomain.mockResolvedValue({
+      orgId: "org-builder",
+      orgName: "Builder.io",
+    });
+    mocks.isOrgMember.mockResolvedValue(true);
+    const event = eventFor(WORKSPACE_APP_CLAIM_ACTION_PATH, "Bearer delegated");
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(event),
+    ).resolves.toEqual({
+      owner: "owner@builder.io",
+      anonymous: false,
+      orgId: "org-builder",
+      identityAssurance: "org-member",
+    });
+    expect(mocks.isOrgMember).toHaveBeenCalledWith(
+      "org-builder",
+      "owner@builder.io",
+      { requestEvent: event },
+    );
+  });
+
   it("uses the original mounted pathname after the route prefix is stripped", async () => {
     mocks.verifyA2AToken.mockResolvedValue({
       email: "steve@builder.io",
@@ -276,14 +307,14 @@ describe("workspace app action auth", () => {
     });
     mocks.isOrgMember.mockResolvedValue(true);
 
+    const event = eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer scoped");
     await expect(
-      workspaceAppActionRouteAuth.resolveCaller?.(
-        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer scoped"),
-      ),
+      workspaceAppActionRouteAuth.resolveCaller?.(event),
     ).resolves.toMatchObject({ orgId: "org-builder" });
     expect(mocks.isOrgMember).toHaveBeenCalledWith(
       "org-builder",
       "steve@builder.io",
+      { requestEvent: event },
     );
     expect(mocks.resolveOrgIdForEmail).not.toHaveBeenCalled();
   });
@@ -332,14 +363,14 @@ describe("workspace app action auth", () => {
     });
     mocks.isOrgMember.mockResolvedValue(false);
 
+    const event = eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer global-token");
     await expect(
-      workspaceAppActionRouteAuth.resolveCaller?.(
-        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer global-token"),
-      ),
+      workspaceAppActionRouteAuth.resolveCaller?.(event),
     ).rejects.toThrow("Invalid workspace registry authorization");
     expect(mocks.isOrgMember).toHaveBeenCalledWith(
       "org-builder",
       "outsider@example.com",
+      { requestEvent: event },
     );
   });
 });

package/src/server/lib/workspace-app-action-auth.ts

@@ -119,14 +119,22 @@ export const workspaceAppActionRouteAuth: ActionRouteAuthAdapter = {
           refuseRegistryCaller("org-mismatch");
         }
       }
-      if (!(await isOrgMember(claimedOrgId, identity.email))) {
+      if (
+        !(await isOrgMember(claimedOrgId, identity.email, {
+          requestEvent: event,
+        }))
+      ) {
         refuseRegistryCaller("not-org-member");
       }
       orgId = claimedOrgId;
     } else if (orgDomain) {
       const org = await resolveOrgByDomain(orgDomain);
       if (!org) refuseRegistryCaller("org-unknown");
-      if (!(await isOrgMember(org.orgId, identity.email))) {
+      if (
+        !(await isOrgMember(org.orgId, identity.email, {
+          requestEvent: event,
+        }))
+      ) {
         refuseRegistryCaller("not-org-member");
       }
       orgId = org.orgId;
@@ -138,6 +146,8 @@ export const workspaceAppActionRouteAuth: ActionRouteAuthAdapter = {
       owner: identity.email,
       anonymous: false,
       orgId,
+      identityAssurance:
+        identity.identityAssurance === "org-member" ? "org-member" : "user",
     };
   },
 };

package/src/server/plugins/agent-chat.spec.ts

@@ -45,4 +45,18 @@ describe("Dispatch agent chat plugin", () => {
       }),
     );
   });
+
+  it("routes customer credit questions to the owning workspace app", async () => {
+    await import("./agent-chat.js");
+
+    const options = mocks.createAgentChatPlugin.mock.calls[0]?.[0] as {
+      systemPrompt?: string;
+    };
+    expect(options.systemPrompt).toContain(
+      "External customer, account, or company usage, credits, activity, or product data belongs to the relevant app",
+    );
+    expect(options.systemPrompt).toContain(
+      "Do not use this action for external customer/account/company data.",
+    );
+  });
 });

package/src/server/plugins/agent-chat.ts

@@ -92,7 +92,7 @@ Use the standard workspace primitives:
 - Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.
 - Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.
 - For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.
-- For Builder.io or AI credit spend, LLM usage by workspace member or month, or workspace app/Builder branch creation history, call list-dispatch-usage-metrics with scope=workspace and the requested sinceDays. Its monthlyByUser and workspaceAppCreationsByUserMonth fields are the authoritative shared-database result; do not ask for a user export or BigQuery schema. For app adoption, call it with scope=app and appId: app creators can see aggregate daily/weekly active users and tracked actions for their own app, while organization owners/admins can inspect any accessible app. App scope omits individual users and prompt previews.
+- Use list-dispatch-usage-metrics only for this workspace's own members' agent/LLM usage and spend, or aggregate adoption of an accessible workspace app. For agent/LLM usage or spend, call it with scope=workspace and the requested sinceDays; it reports workspace-member usage only. For app adoption, call it with scope=app and appId; app creators can see aggregate daily/weekly active users and tracked actions for their own app, while organization owners/admins can inspect any accessible app. App scope omits individual users and prompt previews. External customer, account, or company usage, credits, activity, or product data belongs to the relevant app: use its identity in <relevant-apps> when clear, or call describe-workspace-apps with a query when ownership is unclear. Do not use this action for external customer/account/company data.
 
 When a user asks for something like a digest, reminder, routing rule, or saved behavior:
 - First decide whether it should be a resource, a recurring job, a destination, or a delegated task.