@app-vitals/agent-admin 0.4.0 → 0.6.0

package/src/agent-provisioner.unit.test.ts

@@ -21,6 +21,7 @@ import {
   type KubernetesAgentProvisionerConfig,
   NoopAgentProvisioner,
   perAgentFederation,
+  podIdentityPatch,
   policyDrifted,
 } from "./agent-provisioner.ts";
 import type { AgentTokenService } from "./agent-tokens.ts";
@@ -1138,6 +1139,7 @@ function manifestWith(
   overrides: {
     imageTag?: string;
     anthropicFederation?: AgentAnthropicFederation;
+    podServiceAccountName?: string;
   } = {},
 ) {
   return buildAgentDeploymentManifest({
@@ -1151,6 +1153,7 @@ function manifestWith(
     tokenSecretKey: "token",
     claudePolicy,
     anthropicFederation: overrides.anthropicFederation,
+    podServiceAccountName: overrides.podServiceAccountName,
   });
 }
 
@@ -1898,3 +1901,136 @@ describe("KubernetesAgentProvisioner — pod service account (COS-48.1)", () =>
     ).toBeUndefined();
   });
 });
+
+// ─── Pod ServiceAccount drift (COS-49.1) ────────────────────────────────────
+
+describe("podIdentityPatch()", () => {
+  const withSa = (name?: string) =>
+    manifestWith(undefined, { podServiceAccountName: name });
+
+  it("patches the desired ServiceAccount when the live one differs", () => {
+    expect(podIdentityPatch(withSa(), withSa("agent-sa"))).toEqual({
+      serviceAccountName: "agent-sa",
+    });
+    expect(podIdentityPatch(withSa("old-sa"), withSa("agent-sa"))).toEqual({
+      serviceAccountName: "agent-sa",
+    });
+  });
+
+  it("is undefined when already in sync", () => {
+    expect(
+      podIdentityPatch(withSa("agent-sa"), withSa("agent-sa")),
+    ).toBeUndefined();
+  });
+
+  it("clears serviceAccountName and serviceAccount when live equals the previous value", () => {
+    expect(podIdentityPatch(withSa("agent-sa"), withSa(), "agent-sa")).toEqual({
+      serviceAccountName: null,
+      serviceAccount: null,
+    });
+  });
+
+  it("leaves a foreign ServiceAccount alone when clearing", () => {
+    expect(
+      podIdentityPatch(withSa("hand-set"), withSa(), "agent-sa"),
+    ).toBeUndefined();
+  });
+
+  it("never clears when the previous value is unknown", () => {
+    expect(podIdentityPatch(withSa("agent-sa"), withSa())).toBeUndefined();
+    expect(
+      podIdentityPatch(withSa("agent-sa"), withSa(), null),
+    ).toBeUndefined();
+  });
+
+  it("defers to federationPatch when the desired Deployment has federation", () => {
+    expect(
+      podIdentityPatch(withSa("x"), fedManifest(FED_A), "x"),
+    ).toBeUndefined();
+  });
+});
+
+describe("KubernetesAgentProvisioner.reconcile() — pod ServiceAccount drift (COS-49.1)", () => {
+  const live = (sa?: string) =>
+    new RecordedKubernetesClient({
+      deployments: {
+        [`${NAMESPACE}/${POLICY_RESOURCE}`]: manifestWith(undefined, {
+          podServiceAccountName: sa,
+        }),
+      },
+      secrets: {},
+      pvcs: {},
+    });
+  const provisioner = (client: KubernetesClient, enabled = true) =>
+    new KubernetesAgentProvisioner(client, stubTokens() as AgentTokenService, {
+      ...BASE_CONFIG,
+      podServiceAccount: { enabled },
+    });
+  const sa = async (rec: RecordedKubernetesClient) =>
+    (await rec.getDeployment(NAMESPACE, POLICY_RESOURCE)).spec.template.spec
+      .serviceAccountName;
+
+  for (const policyOnly of [false, true]) {
+    it(`patches the desired ServiceAccount when live differs (policyOnly=${policyOnly})`, async () => {
+      const rec = live("old-sa");
+      const { client, patches } = patchSpy(rec);
+      const result = await provisioner(client).reconcile(
+        [{ id: POLICY_AGENT_ID, podServiceAccountName: "agent-sa" }],
+        { policyOnly },
+      );
+      expect(result.updated).toEqual([POLICY_AGENT_ID]);
+      expect(patches).toHaveLength(1);
+      expect(await sa(rec)).toBe("agent-sa");
+    });
+  }
+
+  it("clears a previously managed ServiceAccount", async () => {
+    const rec = live("agent-sa");
+    const result = await provisioner(rec).reconcile([
+      {
+        id: POLICY_AGENT_ID,
+        podServiceAccountName: null,
+        previousPodServiceAccountName: "agent-sa",
+      },
+    ]);
+    expect(result.updated).toEqual([POLICY_AGENT_ID]);
+    expect(await sa(rec)).toBeUndefined();
+  });
+
+  it("leaves a hand-set ServiceAccount on an unmanaged Deployment alone", async () => {
+    const rec = live("hand-set");
+    const { client, patches } = patchSpy(rec);
+    const result = await provisioner(client).reconcile(
+      [
+        {
+          id: POLICY_AGENT_ID,
+          podServiceAccountName: null,
+          previousPodServiceAccountName: "agent-sa",
+        },
+      ],
+      { policyOnly: true },
+    );
+    expect(result.updated).toEqual([]);
+    expect(patches).toHaveLength(0);
+    expect(await sa(rec)).toBe("hand-set");
+  });
+
+  it("does nothing for a clear without a previous value (startup pass)", async () => {
+    const rec = live("agent-sa");
+    const { client, patches } = patchSpy(rec);
+    await provisioner(client).reconcile(
+      [{ id: POLICY_AGENT_ID, podServiceAccountName: null }],
+      { policyOnly: true },
+    );
+    expect(patches).toHaveLength(0);
+  });
+
+  it("does not patch when the flag is off", async () => {
+    const rec = live("hand-set");
+    const { client, patches } = patchSpy(rec);
+    await provisioner(client, false).reconcile([
+      { id: POLICY_AGENT_ID, podServiceAccountName: "agent-sa" },
+    ]);
+    expect(patches).toHaveLength(0);
+  });
+});

package/src/agents-api.integration.test.ts

@@ -703,3 +703,150 @@ describeOrSkip("admin CRUD API (integration)", () => {
     expect((await fleet.json()).totals.input).toBe(510);
   });
 });
+
+// ─── COS-49.1: PATCH /agents/:id podServiceAccountName ──────────────────────────
+
+describeOrSkip("PATCH /agents/:id podServiceAccountName (integration)", () => {
+  let prisma: PrismaClient;
+  let agentId: string;
+  let cookie: string;
+  const reconciled: Array<Record<string, unknown>> = [];
+
+  const provisioner: AgentProvisioner = {
+    canProvision: true,
+    provision: async () => ({
+      resourceName: "r",
+      secretName: "s",
+      deploymentName: "d",
+    }),
+    deprovision: async () => {},
+    reconcile: async (targets: Array<{ id: string }>) => {
+      for (const t of targets) reconciled.push(t as Record<string, unknown>);
+      return {
+        recreated: [],
+        updated: [],
+        migrated: [],
+        noOwner: [],
+        orphans: [],
+        failed: [],
+        dryRun: false,
+      };
+    },
+  } as unknown as AgentProvisioner;
+
+  const patch = (
+    app: ReturnType<typeof createAdminApp>,
+    body: unknown,
+    headers: Record<string, string> = { Cookie: `admin_session=${cookie}` },
+  ) =>
+    app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify(body),
+      headers: { "Content-Type": "application/json", ...headers },
+    });
+
+  beforeEach(async () => {
+    prisma = makePrisma();
+    await prisma.agentWorkQueueSnapshot.deleteMany();
+    await prisma.agentPlugin.deleteMany();
+    await prisma.agentPhaseMethodology.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agentMember.deleteMany();
+    await prisma.agent.deleteMany();
+    agentId = await createAgent(prisma);
+    cookie = await makeSessionCookie();
+    reconciled.length = 0;
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  const appWith = (enabled: boolean) =>
+    createAdminApp({
+      ...makeDeps(prisma, provisioner),
+      podServiceAccountEnabled: enabled,
+    });
+
+  it("409 when the flag is off; the column is untouched", async () => {
+    const res = await patch(appWith(false), {
+      podServiceAccountName: "sa",
+    });
+    expect(res.status).toBe(409);
+    const row = await prisma.agent.findUniqueOrThrow({
+      where: { id: agentId },
+    });
+    expect(row.podServiceAccountName).toBeNull();
+    expect(reconciled).toEqual([]);
+  });
+
+  it("403 for a non-admin session", async () => {
+    const memberCookie = await sign(
+      {
+        isAdmin: false,
+        userId: "user-m",
+        email: "member@example.com",
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      },
+      SESSION_SECRET,
+      "HS256",
+    );
+    await prisma.agentMember.create({
+      data: { agentId, email: "member@example.com" },
+    });
+    const res = await patch(
+      appWith(true),
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${memberCookie}` },
+    );
+    expect(res.status).toBe(403);
+    expect(reconciled).toEqual([]);
+  });
+
+  it("422 for an agent with a per-agent federated identity", async () => {
+    await prisma.agent.update({
+      where: { id: agentId },
+      data: {
+        ownerEmail: "jane.doe@example.com",
+        anthropicIdentityName: "id-49-1",
+        anthropicServiceAccountId: "svac_1",
+        anthropicFederationRuleId: "fdrl_1",
+        k8sServiceAccountName: "agent-sa",
+      },
+    });
+    const res = await patch(appWith(true), { podServiceAccountName: "sa" });
+    expect(res.status).toBe(422);
+    expect(reconciled).toEqual([]);
+  });
+
+  it("200 persists the value, serializes it and reconciles once; null clears", async () => {
+    const app = appWith(true);
+    const res = await patch(app, { podServiceAccountName: "agent-pod-sa" });
+    expect(res.status).toBe(200);
+    expect((await res.json()).podServiceAccountName).toBe("agent-pod-sa");
+    expect(reconciled).toHaveLength(1);
+    expect(reconciled[0]).toMatchObject({
+      id: agentId,
+      podServiceAccountName: "agent-pod-sa",
+      previousPodServiceAccountName: null,
+    });
+
+    const get = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect((await get.json()).podServiceAccountName).toBe("agent-pod-sa");
+
+    const clear = await patch(app, { podServiceAccountName: null });
+    expect(clear.status).toBe(200);
+    expect((await clear.json()).podServiceAccountName).toBeNull();
+    expect(reconciled).toHaveLength(2);
+    expect(reconciled[1]).toMatchObject({
+      podServiceAccountName: null,
+      previousPodServiceAccountName: "agent-pod-sa",
+    });
+  });
+});

package/src/agents-api.smoke.test.ts

@@ -6,7 +6,7 @@
  * Services are injected as in-memory mocks.
  */
 
-import { beforeAll, describe, expect, it } from "bun:test";
+import { beforeAll, describe, expect, it, spyOn } from "bun:test";
 import { sign } from "hono/jwt";
 import type { Prisma } from "../prisma/client/client.ts";
 import { getSelfServeSpecialty } from "./account-agent-create.ts";
@@ -199,6 +199,7 @@ function makeInMemoryGitHubInstallationsService(): AdminDeps["agentGitHubInstall
       agentId: string;
       reportedAt: Date;
       installations: Prisma.JsonValue;
+      repoAccess: Prisma.JsonValue;
       createdAt: Date;
     }
   >();
@@ -210,6 +211,9 @@ function makeInMemoryGitHubInstallationsService(): AdminDeps["agentGitHubInstall
         agentId,
         reportedAt: input.reportedAt,
         installations: input.installations as Prisma.JsonValue,
+        repoAccess: (input.repoAccess === undefined
+          ? (existing?.repoAccess ?? null)
+          : input.repoAccess) as Prisma.JsonValue,
         createdAt: existing?.createdAt ?? new Date("2024-01-01"),
       };
       rows.set(agentId, row);
@@ -1262,6 +1266,66 @@ describe("admin API — GitHub installations snapshot", () => {
     ]);
   });
 
+  const REPOS = [
+    {
+      repo: "agent",
+      owner: "app-vitals",
+      read: true,
+      write: false,
+      checkedAt: "2026-01-01T00:00:00.000Z",
+    },
+    {
+      repo: "gone",
+      owner: "app-vitals",
+      read: false,
+      write: false,
+      checkedAt: "2026-01-01T00:00:00.000Z",
+      error: "not_found",
+    },
+  ];
+
+  it("PUT accepts repos and GET returns them as repoAccess (COS-44.1)", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await put(app, { ...BODY, repos: REPOS });
+    expect(res.status).toBe(200);
+    expect((await res.json()).snapshot.repoAccess).toEqual(REPOS);
+    const getRes = await app.request(
+      `/agents/${AGENT_ID}/github-installations`,
+      { headers: { Cookie: `admin_session=${cookie}` } },
+    );
+    expect((await getRes.json()).snapshot.repoAccess).toEqual(REPOS);
+  });
+
+  it("repoAccess is null until reported, and a push without repos keeps it", async () => {
+    const app = createAdminApp(makeMockDeps());
+    expect(
+      (await (await put(app, BODY)).json()).snapshot.repoAccess,
+    ).toBeNull();
+    await put(app, { ...BODY, repos: REPOS });
+    const again = await put(app, BODY);
+    expect((await again.json()).snapshot.repoAccess).toEqual(REPOS);
+  });
+
+  it("rejects an unknown key or error class on a repos entry (400)", async () => {
+    const app = createAdminApp(makeMockDeps());
+    expect(
+      (
+        await put(app, {
+          ...BODY,
+          repos: [{ ...REPOS[0], token: "ghs_secret" }],
+        })
+      ).status,
+    ).toBe(400);
+    expect(
+      (
+        await put(app, {
+          ...BODY,
+          repos: [{ ...REPOS[1], error: "kaboom" }],
+        })
+      ).status,
+    ).toBe(400);
+  });
+
   it("rejects an extra top-level field (400)", async () => {
     const app = createAdminApp(makeMockDeps());
     const res = await put(app, { ...BODY, token: "ghs_secret" });
@@ -5451,6 +5515,229 @@ describe("admin API — PATCH /agents/:id accountId (SSP-5.3)", () => {
   });
 });
 
+// ─── COS-49.1: PATCH /agents/:id podServiceAccountName ───────────────────────
+
+describe("admin API — PATCH /agents/:id podServiceAccountName (COS-49.1)", () => {
+  const patch = (
+    app: ReturnType<typeof createAdminApp>,
+    body: unknown,
+    headers: Record<string, string>,
+  ) =>
+    app.request(`/agents/${AGENT_ID}`, {
+      method: "PATCH",
+      body: JSON.stringify(body),
+      headers: { "Content-Type": "application/json", ...headers },
+    });
+
+  const FEDERATED = {
+    ownerEmail: "jane.doe@example.com",
+    anthropicIdentityName: "id",
+    anthropicServiceAccountId: "svac_1",
+    anthropicFederationRuleId: "fdrl_1",
+    k8sServiceAccountName: "agent-sa",
+  };
+
+  function depsFor(opts: {
+    provisioner: RecordingProvisioner;
+    enabled?: boolean;
+    existing?: Record<string, unknown>;
+    updated?: Array<Record<string, unknown>>;
+  }): AdminDeps {
+    const base = makeMockDeps();
+    return {
+      ...base,
+      provisioner: opts.provisioner,
+      podServiceAccountEnabled: opts.enabled ?? true,
+      agentService: {
+        ...base.agentService,
+        getDetail: async (id: string) => {
+          const d = await base.agentService.getDetail(id);
+          return d ? ({ ...d, ...opts.existing } as typeof d) : d;
+        },
+        updateSelfHosted: async (id, input) => {
+          opts.updated?.push(input as Record<string, unknown>);
+          return {
+            ...(await base.agentService.updateSelfHosted(id, input)),
+            podServiceAccountName:
+              (input as { podServiceAccountName?: string | null })
+                .podServiceAccountName ?? null,
+          };
+        },
+      },
+    };
+  }
+
+  it("admin sets the value: 200, serialized, and reconcile invoked once with the previous value", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(
+      depsFor({
+        provisioner,
+        existing: { podServiceAccountName: "old-sa" },
+      }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: "new-sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect(
+      ((await res.json()) as { podServiceAccountName: string })
+        .podServiceAccountName,
+    ).toBe("new-sa");
+    expect(provisioner.reconciled).toHaveLength(1);
+    expect(provisioner.reconciled[0]).toMatchObject({
+      id: AGENT_ID,
+      podServiceAccountName: "new-sa",
+      previousPodServiceAccountName: "old-sa",
+    });
+  });
+
+  it("null clears the value and passes the previous one", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(
+      depsFor({ provisioner, existing: { podServiceAccountName: "old-sa" } }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: null },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect(provisioner.reconciled[0]).toMatchObject({
+      podServiceAccountName: null,
+      previousPodServiceAccountName: "old-sa",
+    });
+  });
+
+  it("409 naming the flag when it is off; nothing written or reconciled", async () => {
+    const provisioner = new RecordingProvisioner();
+    const updated: Array<Record<string, unknown>> = [];
+    const app = createAdminApp(
+      depsFor({ provisioner, enabled: false, updated }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(409);
+    expect(JSON.stringify(await res.json())).toContain(
+      "SHIPWRIGHT_K8S_AGENT_POD_SERVICE_ACCOUNT_ENABLED",
+    );
+    expect(updated).toEqual([]);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("422 for an agent with a per-agent federated identity", async () => {
+    const provisioner = new RecordingProvisioner();
+    const updated: Array<Record<string, unknown>> = [];
+    const app = createAdminApp(
+      depsFor({ provisioner, existing: FEDERATED, updated }),
+    );
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(422);
+    expect(updated).toEqual([]);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("403 for a non-admin session member", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp({
+      ...depsFor({ provisioner }),
+      callerScopeResolver: async () => ({
+        kind: "scoped",
+        accountId: "acct-a",
+        agentIds: [AGENT_ID],
+      }),
+    });
+    const cookie = await sign(
+      {
+        isAdmin: false,
+        userId: "user-acct",
+        email: "owner@acct-a.example.com",
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      },
+      SESSION_SECRET,
+      "HS256",
+    );
+    const res = await patch(
+      app,
+      { podServiceAccountName: "sa" },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(403);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+
+  it("rejects a value that is not an RFC 1123 label (400)", async () => {
+    const app = createAdminApp(
+      depsFor({ provisioner: new RecordingProvisioner() }),
+    );
+    const cookie = await makeSessionCookie();
+    for (const bad of ["Bad_Name", "-lead", "a".repeat(64), ""]) {
+      const res = await patch(
+        app,
+        { podServiceAccountName: bad },
+        { Cookie: `admin_session=${cookie}` },
+      );
+      expect(res.status).toBe(400);
+    }
+  });
+
+  it("logs an audit line with agent, old, new and caller name but never the key", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp({
+      ...depsFor({
+        provisioner,
+        existing: { podServiceAccountName: "old-sa" },
+      }),
+      adminApiKeys: parseAdminApiKeys(`ops-key-name:${ADMIN_API_KEY}:*`),
+    });
+    const spy = spyOn(console, "info").mockImplementation(() => {});
+    try {
+      const res = await patch(
+        app,
+        { podServiceAccountName: "new-sa" },
+        { Authorization: `Bearer ${ADMIN_API_KEY}` },
+      );
+      expect(res.status).toBe(200);
+      const lines = spy.mock.calls.map((c) => String(c[0]));
+      const line = lines.find((l) => l.includes("podServiceAccountName"));
+      expect(line).toBeDefined();
+      expect(line).toContain(AGENT_ID);
+      expect(line).toContain("old-sa");
+      expect(line).toContain("new-sa");
+      expect(line).toContain("ops-key-name");
+      expect(lines.join("\n")).not.toContain(ADMIN_API_KEY);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  it("does not touch the provisioner when the field is absent", async () => {
+    const provisioner = new RecordingProvisioner();
+    const app = createAdminApp(depsFor({ provisioner, enabled: false }));
+    const cookie = await makeSessionCookie();
+    const res = await patch(
+      app,
+      { repos: ["org/repo"] },
+      { Cookie: `admin_session=${cookie}` },
+    );
+    expect(res.status).toBe(200);
+    expect(provisioner.reconciled).toEqual([]);
+  });
+});
+
 // ─── WIF-2.1: Anthropic credential guards under federation ───────────────────
 
 describe("admin API — Anthropic credential guards (WIF-2.1)", () => {