@agent-native/dispatch 0.40.33 → 0.40.36

package/src/server/lib/usage-metrics-store.spec.ts

@@ -10,6 +10,9 @@ const mocks = vi.hoisted(() => ({
   currentOrgId: vi.fn((): string | null => null),
   currentOwnerEmail: vi.fn(() => "owner@example.test"),
   delegatedOrgMember: false,
+  isOrgMember: vi.fn(async (_orgId: string, email: string) =>
+    email.toLowerCase().endsWith("@example.test"),
+  ),
   registerBuiltinEngines: vi.fn(),
   dispatchConfig: {
     adminEmails: [] as string[],
@@ -39,6 +42,11 @@ vi.mock("@agent-native/core/settings", () => ({
   getSetting: (...args: any[]) => mocks.getSetting(...args),
 }));
 
+vi.mock("@agent-native/core/org", () => ({
+  isOrgMember: (orgId: string, email: string) =>
+    mocks.isOrgMember(orgId, email),
+}));
+
 vi.mock("@agent-native/core/server", () => ({
   getAppConfig: () => ({ dispatch: mocks.dispatchConfig }),
   getRequestContext: () =>
@@ -148,6 +156,48 @@ describe("listDispatchUsageMetrics", () => {
     expect(mocks.listWorkspaceApps).not.toHaveBeenCalled();
   });
 
+  it.each(["customer@customer.example", "other@example.test"])(
+    "gives a non-admin the same lookup error whether or not %s is a member",
+    async (userEmail) => {
+      mocks.currentOrgId.mockReturnValue("org-a");
+      mocks.currentOwnerEmail.mockReturnValue("member@example.test");
+      mocks.execute.mockResolvedValue({ rows: [{ role: "member" }] });
+
+      const error = await listDispatchUsageMetrics({
+        sinceDays: 7,
+        scope: "workspace",
+        userEmail,
+      }).catch((caught: unknown) => caught);
+
+      expect(error).toMatchObject({
+        errorCode: "usage_user_lookup_forbidden",
+        statusCode: 403,
+      });
+      expect((error as Error).message).toContain("<relevant-apps>");
+      expect(mocks.isOrgMember).not.toHaveBeenCalled();
+      expect(mocks.getUsageSummary).not.toHaveBeenCalled();
+    },
+  );
+
+  it("treats a delegated owner as a member for another person's usage instead of reporting them outside the org", async () => {
+    mocks.currentOrgId.mockReturnValue("org-a");
+    mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+    mocks.delegatedOrgMember = true;
+    mocks.execute.mockResolvedValue({ rows: [{ role: "owner" }] });
+
+    const error = await listDispatchUsageMetrics({
+      sinceDays: 7,
+      scope: "workspace",
+      userEmail: "member@example.test",
+    }).catch((caught: unknown) => caught);
+
+    expect(error).toMatchObject({
+      errorCode: "usage_user_lookup_forbidden",
+      statusCode: 403,
+    });
+    expect(mocks.isOrgMember).not.toHaveBeenCalled();
+  });
+
   it("does not let a delegated org member read workspace usage as an owner", async () => {
     mocks.currentOrgId.mockReturnValue("org-a");
     mocks.currentOwnerEmail.mockReturnValue("member@example.test");
@@ -447,6 +497,43 @@ describe("listDispatchUsageMetrics", () => {
     ).toBe(true);
   });
 
+  it("redirects a non-member userEmail to the app that owns customer data with a typed error", async () => {
+    mocks.currentOrgId.mockReturnValue("org-a");
+    mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+    mocks.getUsageSummary.mockResolvedValue(null);
+    mocks.listWorkspaceApps.mockResolvedValue([]);
+    mocks.execute.mockImplementation(async ({ sql }: { sql: string }) => {
+      if (sql.includes("SELECT role FROM org_members")) {
+        return { rows: [{ role: "owner" }] };
+      }
+      if (sql.includes("SELECT email, role, joined_at")) {
+        return {
+          rows: [
+            { email: "owner@example.test", role: "owner", joined_at: null },
+            { email: "member@example.test", role: "member", joined_at: null },
+          ],
+        };
+      }
+      return { rows: [] };
+    });
+
+    const error = await listDispatchUsageMetrics({
+      sinceDays: 7,
+      scope: "workspace",
+      userEmail: "customer@customer.example",
+    }).catch((caught: unknown) => caught);
+
+    expect(error).toMatchObject({
+      errorCode: "usage_user_not_org_member",
+      statusCode: 404,
+    });
+    expect((error as Error).message).toContain(
+      "customer@customer.example is not a member of this organization",
+    );
+    expect((error as Error).message).toContain("<relevant-apps>");
+    expect((error as Error).message).toContain("describe-workspace-apps");
+  });
+
   it("lets an app owner inspect aggregate adoption for their own app", async () => {
     const now = Date.now();
     mocks.currentOrgId.mockReturnValue("org-a");

package/src/server/lib/usage-metrics-store.ts

@@ -1,3 +1,4 @@
+import { fail } from "@agent-native/core/action";
 import {
   detectEngineFromEnv,
   detectEngineFromUserSecrets,
@@ -8,6 +9,7 @@ import {
   registerBuiltinEngines,
 } from "@agent-native/core/agent/engine";
 import { getDbExec } from "@agent-native/core/db";
+import { isOrgMember } from "@agent-native/core/org";
 import { readOrgMemberRole } from "@agent-native/core/server";
 import { ForbiddenError } from "@agent-native/core/sharing";
 import {
@@ -952,6 +954,13 @@ async function assertCanViewMetrics(viewScope: UsageMetricsScope): Promise<{
   );
 }
 
+function failUserNotOrgMember(email: string): never {
+  fail(
+    `${email} is not a member of this organization. list-dispatch-usage-metrics only covers this workspace's own agent usage; usage, credits, or activity for customers, accounts, or companies belongs to the app that owns that data (see <relevant-apps> or run describe-workspace-apps with a query).`,
+    { errorCode: "usage_user_not_org_member", statusCode: 404 },
+  );
+}
+
 export async function listDispatchUsageMetrics(input: {
   sinceDays?: number;
   scope?: UsageMetricsScope;
@@ -960,6 +969,33 @@ export async function listDispatchUsageMetrics(input: {
 }): Promise<DispatchUsageMetrics> {
   const viewScope: UsageMetricsScope =
     input.scope === "me" ? "me" : input.scope === "app" ? "app" : "workspace";
+  // Another person's usage: unauthorized callers get one answer whether or not
+  // the email is a member, so the lookup cannot probe the roster; authorized
+  // callers asking about an outside email are pointed at the owning app.
+  const requestedEmail =
+    viewScope === "workspace" ? input.userEmail?.trim() || null : null;
+  const callerEmail = currentOwnerEmail();
+  const callerOrgId = currentOrgId();
+  if (
+    requestedEmail &&
+    callerOrgId &&
+    requestedEmail.toLowerCase() !== callerEmail.toLowerCase()
+  ) {
+    const callerRole = await readOrgMemberRole(callerOrgId, callerEmail);
+    if (
+      !isDispatchEnvironmentAdmin(callerEmail) &&
+      callerRole !== "owner" &&
+      callerRole !== "admin"
+    ) {
+      fail(
+        "Only organization owners and admins can look up another person's usage with list-dispatch-usage-metrics. Usage, credits, or activity for customers, accounts, or companies belongs to the app that owns that data (see <relevant-apps> or run describe-workspace-apps with a query).",
+        { errorCode: "usage_user_lookup_forbidden", statusCode: 403 },
+      );
+    }
+    if (!(await isOrgMember(callerOrgId, requestedEmail))) {
+      failUserNotOrgMember(requestedEmail);
+    }
+  }
   const { viewerEmail, orgId, role } = await assertCanViewMetrics(
     viewScope === "app" ? "me" : viewScope,
   );
@@ -1020,9 +1056,7 @@ export async function listDispatchUsageMetrics(input: {
           )?.email ?? null)
         : null;
   if (viewScope === "workspace" && requestedUserEmail && !selectedUserEmail) {
-    throw new ForbiddenError(
-      "The selected user is not available in this workspace.",
-    );
+    failUserNotOrgMember(requestedUserEmail);
   }
   const memberEmails = selectedUserEmail
     ? [selectedUserEmail]