@agent-native/dispatch 0.40.6 → 0.40.7

package/src/server/lib/thread-debug-store.ts

@@ -5,6 +5,7 @@ import {
 import { createDbExec, getDbExec, type DbExec } from "@agent-native/core/db";
 import { ForbiddenError } from "@agent-native/core/sharing";
 
+import { isDispatchEnvironmentAdmin } from "./admin-config.js";
 import { currentOrgId, currentOwnerEmail } from "./dispatch-store.js";
 
 const CONFIG_ENV_KEY = "AGENT_NATIVE_THREAD_DEBUG_DATABASES";
@@ -108,26 +109,10 @@ class UnsupportedThreadDebugSchemaError extends Error {
   }
 }
 
-function envEmails(name: string): string[] {
-  return (process.env[name] ?? "")
-    .split(",")
-    .map((value) => value.trim().toLowerCase())
-    .filter(Boolean);
-}
-
 function escapeLike(value: string): string {
   return value.replace(/([\\%_])/g, "\\$1");
 }
 
-function isEnvAdmin(email: string): boolean {
-  const normalized = email.trim().toLowerCase();
-  return [
-    ...envEmails("DISPATCH_ADMIN_EMAILS"),
-    ...envEmails("WORKSPACE_OWNER_EMAIL"),
-    ...envEmails("DISPATCH_DEFAULT_OWNER_EMAIL"),
-  ].includes(normalized);
-}
-
 function missingTableName(error: unknown): string | null {
   const message = String((error as Error)?.message ?? error);
   const patterns = [
@@ -457,7 +442,7 @@ async function resolveDebugAccess(): Promise<DebugAccess> {
   const viewerEmail = currentOwnerEmail();
   const orgId = currentOrgId();
   const role = await viewerOrgRole(orgId, viewerEmail);
-  const envAdmin = isEnvAdmin(viewerEmail);
+  const envAdmin = isDispatchEnvironmentAdmin(viewerEmail);
   const canInspectAll = envAdmin || role === "owner" || role === "admin";
   const memberEmails = canInspectAll
     ? await currentOrgMembers(orgId)

package/src/server/lib/usage-metrics-store.spec.ts

@@ -10,6 +10,11 @@ const mocks = vi.hoisted(() => ({
   currentOrgId: vi.fn((): string | null => null),
   currentOwnerEmail: vi.fn(() => "owner@example.test"),
   registerBuiltinEngines: vi.fn(),
+  dispatchConfig: {
+    adminEmails: [] as string[],
+    workspaceOwnerEmails: [] as string[],
+    defaultOwnerEmail: undefined as string | undefined,
+  },
 }));
 
 vi.mock("@agent-native/core/agent/engine", () => ({
@@ -33,6 +38,10 @@ vi.mock("@agent-native/core/settings", () => ({
   getSetting: (...args: any[]) => mocks.getSetting(...args),
 }));
 
+vi.mock("@agent-native/core/server", () => ({
+  getAppConfig: () => ({ dispatch: mocks.dispatchConfig }),
+}));
+
 vi.mock("@agent-native/core/usage", () => ({
   builderCreditsFromCostCents: (cents: number) => cents / 4,
   getUsageSummary: (...args: any[]) => mocks.getUsageSummary(...args),
@@ -75,6 +84,9 @@ afterEach(() => {
   vi.clearAllMocks();
   mocks.currentOrgId.mockReturnValue(null);
   mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+  mocks.dispatchConfig.adminEmails = [];
+  mocks.dispatchConfig.workspaceOwnerEmails = [];
+  mocks.dispatchConfig.defaultOwnerEmail = undefined;
 });
 
 describe("listDispatchUsageMetrics", () => {
@@ -95,6 +107,20 @@ describe("listDispatchUsageMetrics", () => {
     expect(mocks.listWorkspaceApps).not.toHaveBeenCalled();
   });
 
+  it("allows a configured deployment admin to view workspace metrics", async () => {
+    mocks.currentOrgId.mockReturnValue("org-a");
+    mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+    mocks.dispatchConfig.workspaceOwnerEmails = ["Owner@Example.Test"];
+    mocks.execute.mockResolvedValue({ rows: [{ role: "member" }] });
+    mocks.getUsageSummary.mockResolvedValue(null);
+    mocks.listWorkspaceApps.mockResolvedValue([]);
+
+    const metrics = await listDispatchUsageMetrics({ sinceDays: 30 });
+
+    expect(metrics.access.viewerEmail).toBe("owner@example.test");
+    expect(metrics.access.role).toBe("member");
+  });
+
   it("returns empty metrics when usage storage bootstrap and reads fail", async () => {
     mocks.getUsageSummary.mockRejectedValue(
       new Error("could not serialize access due to concurrent update"),

package/src/server/lib/usage-metrics-store.ts

@@ -18,6 +18,7 @@ import {
   type UsageBillingMode,
 } from "@agent-native/core/usage";
 
+import { isDispatchEnvironmentAdmin } from "./admin-config.js";
 import {
   listWorkspaceApps,
   type WorkspaceAppSummary,
@@ -373,22 +374,6 @@ function appOwner(app: WorkspaceAppSummary): string | null {
   return owner || null;
 }
 
-function envEmails(name: string): string[] {
-  return (process.env[name] ?? "")
-    .split(",")
-    .map((value) => value.trim().toLowerCase())
-    .filter(Boolean);
-}
-
-function isEnvAdmin(email: string): boolean {
-  const normalized = email.trim().toLowerCase();
-  return [
-    ...envEmails("DISPATCH_ADMIN_EMAILS"),
-    ...envEmails("WORKSPACE_OWNER_EMAIL"),
-    ...envEmails("DISPATCH_DEFAULT_OWNER_EMAIL"),
-  ].includes(normalized);
-}
-
 async function detectUsageEngineName(): Promise<string | null> {
   try {
     const stored = (await readDefaultAgentEngineSetting()) as {
@@ -939,7 +924,7 @@ async function assertCanViewMetrics(viewScope: UsageMetricsScope): Promise<{
   const role = await getViewerOrgRole(orgId, viewerEmail);
   if (
     viewScope === "me" ||
-    isEnvAdmin(viewerEmail) ||
+    isDispatchEnvironmentAdmin(viewerEmail) ||
     role === "owner" ||
     role === "admin"
   ) {
@@ -985,7 +970,9 @@ export async function listDispatchUsageMetrics(input: {
   }
   const selectedAppOwner = selectedApp ? appOwner(selectedApp) : null;
   const isMetricsAdmin = Boolean(
-    isEnvAdmin(viewerEmail) || role === "owner" || role === "admin",
+    isDispatchEnvironmentAdmin(viewerEmail) ||
+    role === "owner" ||
+    role === "admin",
   );
   if (
     viewScope === "app" &&