@bugmole/cli 0.4.0 → 0.6.0

package/src/registry-worker/jira/connection.ts

@@ -0,0 +1,111 @@
+// A project's Jira Cloud connection: the stored row, its sealed credentials,
+// and the client that acts with them.
+//
+// Credentials are sealed under the same root key as project secrets
+// (PROJECT_SECRETS_KEY) with their own HKDF info, "bugmole:jira:<projectId>",
+// and additional data binding each value to its project, connection and
+// field. They are opened only here, to make a Jira call, and never leave the
+// registry: no route returns them and no log line includes them.
+import type { Env } from "../core.js";
+import { openInContext, sealInContext, secretsConfigured, type SealContext, type SealedSecret } from "../secrets/crypto.js";
+import { ApiTokenAuth, JiraClient, type JiraAuthProvider, type JiraFetchEnv } from "../../integrations/jira.js";
+
+export type ConnectionRow = {
+  id: string;
+  project_id: string;
+  site_url: string;
+  jira_project_key: string;
+  auth_type: "api_token" | "oauth";
+  account_email: string | null;
+  account_id: string | null;
+  credential_ciphertext: string;
+  credential_iv: string;
+  credential_key_version: number;
+  webhook_secret_ciphertext: string;
+  webhook_secret_iv: string;
+  webhook_key_version: number;
+  mention_keyword: string;
+  execution_mode: "self" | "cloud";
+  environment_id: string | null;
+  enabled: number;
+  last_error: string | null;
+  created_by: string;
+  updated_by: string;
+  created_at: string;
+  updated_at: string;
+};
+
+export type SecretField = "credential" | "webhook";
+
+export const JIRA_UNCONFIGURED =
+  "The Jira integration needs PROJECT_SECRETS_KEY on the registry to store credentials. Nothing was stored.";
+
+export function jiraConfigured(env: Env): boolean {
+  return secretsConfigured(env);
+}
+
+export function sealContext(projectId: string, connectionId: string, field: SecretField): SealContext {
+  return { info: `bugmole:jira:${projectId}`, aad: `${projectId}|jira|${connectionId}|${field}` };
+}
+
+export function sealField(env: Env, projectId: string, connectionId: string, field: SecretField, value: string): Promise<SealedSecret> {
+  return sealInContext(env, sealContext(projectId, connectionId, field), value);
+}
+
+export function openField(env: Env, row: ConnectionRow, field: SecretField): Promise<string> {
+  const sealed = field === "credential"
+    ? { ciphertext: row.credential_ciphertext, iv: row.credential_iv, keyVersion: row.credential_key_version }
+    : { ciphertext: row.webhook_secret_ciphertext, iv: row.webhook_secret_iv, keyVersion: row.webhook_key_version };
+  return openInContext(env, sealContext(row.project_id, row.id, field), sealed);
+}
+
+export async function connectionOf(env: Env, projectId: string): Promise<ConnectionRow | null> {
+  return env.DB.prepare("SELECT * FROM project_jira_connections WHERE project_id = ?").bind(projectId).first<ConnectionRow>();
+}
+
+export async function connectionById(env: Env, id: string): Promise<ConnectionRow | null> {
+  return env.DB.prepare("SELECT * FROM project_jira_connections WHERE id = ?").bind(id).first<ConnectionRow>();
+}
+
+/** The auth provider for a stored connection. 3LO connections need an Atlassian app (see integrations/jira.ts). */
+export async function authFor(env: Env, row: ConnectionRow): Promise<JiraAuthProvider> {
+  if (row.auth_type !== "api_token") throw new Error(`Jira ${row.auth_type} connections aren't available yet`);
+  return new ApiTokenAuth(row.site_url, row.account_email ?? "", await openField(env, row, "credential"));
+}
+
+export async function clientFor(env: Env, row: ConnectionRow): Promise<JiraClient> {
+  return new JiraClient(env as Env & JiraFetchEnv, await authFor(env, row));
+}
+
+export function dashboardUrl(env: Env): string {
+  return (env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "");
+}
+
+export function webhookUrl(env: Env, connectionId: string): string {
+  return `${(env.REGISTRY_PUBLIC_URL || "https://api.bugmole.com").replace(/\/$/, "")}/api/jira/webhook?connection=${encodeURIComponent(connectionId)}`;
+}
+
+export function issueUrl(row: Pick<ConnectionRow, "site_url">, key: string): string {
+  return `${row.site_url}/browse/${encodeURIComponent(key)}`;
+}
+
+/** What a browser may see of a connection: never a credential or the webhook secret. */
+export function connectionView(env: Env, row: ConnectionRow) {
+  return {
+    id: row.id,
+    siteUrl: row.site_url,
+    projectKey: row.jira_project_key,
+    authType: row.auth_type,
+    accountEmail: row.account_email,
+    mentionKeyword: row.mention_keyword,
+    executionMode: row.execution_mode,
+    environmentId: row.environment_id,
+    enabled: Boolean(row.enabled),
+    lastError: row.last_error,
+    webhookUrl: webhookUrl(env, row.id),
+    createdBy: row.created_by,
+    updatedBy: row.updated_by,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}

package/src/registry-worker/jira/jira.test.ts

@@ -0,0 +1,404 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { Env } from "../core.js";
+import { call, createTestEnv, seedPlan, seedProject } from "../testing/harness.js";
+import { drainOutbox } from "../notifications/outbox.js";
+import { commentText, normalizeJiraSite } from "../../integrations/jira.js";
+import { asksForRetest, parseCommentEvent } from "./routes.js";
+
+const KEY = Buffer.alloc(32, 5).toString("base64");
+const TOKEN = "ATATT-super-secret-jira-token-value";
+const EMAIL = "qa-bot@acme.test";
+const BOT = "acct-bugmole-bot";
+
+type FakeIssue = {
+  id: string;
+  key: string;
+  fields: { summary: string; labels: string[]; status: { name: string; statusCategory: { key: string } }; assignee: any; reporter: any; description?: unknown };
+};
+
+const STATUSES: Record<string, { name: string; statusCategory: { key: string } }> = {
+  "11": { name: "To Do", statusCategory: { key: "new" } },
+  "21": { name: "In Progress", statusCategory: { key: "indeterminate" } },
+  "31": { name: "Done", statusCategory: { key: "done" } },
+  "41": { name: "Blocked", statusCategory: { key: "indeterminate" } },
+};
+
+function fakeJira() {
+  const state = {
+    issues: new Map<string, FakeIssue>(),
+    comments: [] as Array<{ key: string; body: any }>,
+    transitioned: [] as Array<{ key: string; id: string }>,
+    creates: 0,
+    /** Issues whose workflow has no Blocked status. */
+    noBlocked: new Set<string>(),
+    authHeaders: new Set<string>(),
+  };
+  const expected = `Basic ${Buffer.from(`${EMAIL}:${TOKEN}`).toString("base64")}`;
+  const doFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = new URL(String(input));
+    const method = init?.method ?? "GET";
+    const headers = new Headers(init?.headers);
+    state.authHeaders.add(headers.get("authorization") ?? "");
+    if (url.origin !== "https://acme.atlassian.net") return new Response("wrong host", { status: 500 });
+    if (headers.get("authorization") !== expected) return Response.json({ errorMessages: ["Unauthorized"] }, { status: 401 });
+    const body = init?.body ? JSON.parse(String(init.body)) : null;
+    const path = url.pathname;
+    if (path === "/rest/api/3/myself") return Response.json({ accountId: BOT, displayName: "Bugmole" });
+    const project = path.match(/^\/rest\/api\/3\/project\/([^/]+)$/);
+    if (project) return project[1] === "QA" ? Response.json({ id: "10000", key: "QA", name: "QA" }) : Response.json({ errorMessages: ["No project"] }, { status: 404 });
+    if (path === "/rest/api/3/issue" && method === "POST") {
+      state.creates += 1;
+      const key = `QA-${state.issues.size + 1}`;
+      state.issues.set(key, {
+        id: String(20000 + state.issues.size),
+        key,
+        fields: { summary: body.fields.summary, labels: body.fields.labels ?? [], status: STATUSES["11"], assignee: null, reporter: { accountId: BOT, displayName: "Bugmole" }, description: body.fields.description },
+      });
+      return Response.json({ id: state.issues.get(key)!.id, key }, { status: 201 });
+    }
+    if (path === "/rest/api/3/search/jql") {
+      const jql = url.searchParams.get("jql") ?? "";
+      const labels = [...jql.matchAll(/labels = "([^"]+)"/g)].map((match) => match[1]);
+      const issues = [...state.issues.values()].filter((issue) => labels.every((label) => issue.fields.labels.includes(label)));
+      return Response.json({ issues });
+    }
+    const issuePath = path.match(/^\/rest\/api\/3\/issue\/([A-Z]+-\d+)(\/transitions|\/comment)?$/);
+    const issue = issuePath ? state.issues.get(issuePath[1]) : undefined;
+    if (!issuePath || !issue) return Response.json({ errorMessages: ["Issue does not exist"] }, { status: 404 });
+    if (!issuePath[2] && method === "GET") return Response.json(issue);
+    if (!issuePath[2] && method === "PUT") {
+      if (body.fields) Object.assign(issue.fields, body.fields);
+      for (const operation of body.update?.labels ?? []) {
+        if (operation.add && !issue.fields.labels.includes(operation.add)) issue.fields.labels.push(operation.add);
+        if (operation.remove) issue.fields.labels = issue.fields.labels.filter((label) => label !== operation.remove);
+      }
+      return new Response(null, { status: 204 });
+    }
+    if (issuePath[2] === "/transitions" && method === "GET") {
+      const ids = Object.keys(STATUSES).filter((id) => !(id === "41" && state.noBlocked.has(issue.key)));
+      return Response.json({ transitions: ids.map((id) => ({ id, name: id === "41" ? "Block" : STATUSES[id].name, to: STATUSES[id] })) });
+    }
+    if (issuePath[2] === "/transitions" && method === "POST") {
+      state.transitioned.push({ key: issue.key, id: body.transition.id });
+      issue.fields.status = STATUSES[body.transition.id];
+      return new Response(null, { status: 204 });
+    }
+    if (issuePath[2] === "/comment" && method === "POST") {
+      state.comments.push({ key: issue.key, body: body.body });
+      return Response.json({ id: String(state.comments.length) }, { status: 201 });
+    }
+    return new Response("unhandled", { status: 500 });
+  }) as unknown as typeof fetch;
+  return { state, doFetch };
+}
+
+const loginCase = (title: string, nodeId = "screen:/login") => ({
+  title, nodeId, intent: "Prove a person can sign in.",
+  steps: ["Open /login", "Sign in"], expected: ["The dashboard opens"], confidence: "high", basis: ["spec"],
+});
+
+/** A managed project with a published plan and a case set for its journey; logs are captured. */
+async function setup() {
+  const jira = fakeJira();
+  const created = createTestEnv({ PROJECT_SECRETS_KEY: KEY, JIRA_FETCH: jira.doFetch, DASHBOARD_URL: "https://dash.test", REGISTRY_PUBLIC_URL: "https://registry.test" } as Partial<Env>);
+  const project = await seedProject(created.env, { storageProvider: "bugmole" });
+  await seedPlan(created.env, project.projectId, project.owner, "checkout");
+  await created.artifacts.put(`projects/${project.projectId}/test-cases/checkout-cases.json`, JSON.stringify({
+    schemaVersion: 1, caseSetId: "checkout-cases", journeyId: "checkout", journeyRevision: 1, cases: [],
+  }));
+  const connect = (body: Record<string, unknown> = {}, as = project.owner) => call(created.env, "PUT", `/api/projects/${project.projectId}/jira`, {
+    as, body: { siteUrl: "acme.atlassian.net", email: EMAIL, apiToken: TOKEN, projectKey: "QA", ...body },
+  });
+  const propose = (caseId: string, title: string) => call(created.env, "POST", `/api/projects/${project.projectId}/proposals`, {
+    as: project.owner, body: { action: "add", caseSetId: "checkout-cases", caseId, case: loginCase(title, `screen:/${caseId}`), summary: `Cover ${title}`, source: "mcp" },
+  });
+  const drain = () => drainOutbox(created.env, new Date(Date.now() + 24 * 60 * 60_000));
+  return { ...created, ...project, jira, connect, propose, drain };
+}
+
+function captureLogs() {
+  const lines: string[] = [];
+  const originals = { log: console.log, warn: console.warn, error: console.error, info: console.info };
+  for (const name of Object.keys(originals) as Array<keyof typeof originals>) {
+    console[name] = (...args: unknown[]) => {
+      lines.push(args.map((arg) => (arg instanceof Error ? `${arg.message} ${arg.stack}` : typeof arg === "string" ? arg : JSON.stringify(arg))).join(" "));
+    };
+  }
+  return { lines, restore: () => Object.assign(console, originals) };
+}
+
+async function hubSignature(secret: string, body: string): Promise<string> {
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body));
+  return `sha256=${Buffer.from(signature).toString("hex")}`;
+}
+
+function commentEvent(issueKey: string, text: string, authorId = "acct-dev-1", id = "9001") {
+  return { webhookEvent: "comment_created", issue: { key: issueKey, fields: { project: { key: "QA" } } }, comment: { id, author: { accountId: authorId }, body: text } };
+}
+
+/** A run that finished, with the given verdicts written to Bugmole storage the way a worker writes them. */
+async function finishRun(context: Awaited<ReturnType<typeof setup>>, runId: string, status: string, verdicts: Array<{ caseId: string; status: string; detail: string }> | null) {
+  const { env, owner, projectId, artifacts } = context;
+  assert.equal((await call(env, "POST", `/api/runs/${runId}/claim`, { as: owner, body: { workerId: "w1" } })).status, 200);
+  if (verdicts) {
+    await artifacts.put(`projects/${projectId}/test-case-results/checkout-cases.json`, JSON.stringify({
+      schemaVersion: 1, caseSetId: "checkout-cases", projectId, journeyId: "checkout", runId, recordedAt: new Date().toISOString(), results: verdicts,
+    }));
+  }
+  assert.equal((await call(env, "POST", `/api/runs/${runId}`, { as: owner, body: { workerId: "w1", status, stepsPassed: 1, stepsFailed: status === "success" ? 0 : 1 } })).status, 200);
+}
+
+test("site URLs are Jira Cloud only, and comment text and mentions are read from ADF and wiki markup", () => {
+  assert.equal(normalizeJiraSite("acme.atlassian.net"), "https://acme.atlassian.net");
+  assert.equal(normalizeJiraSite("https://Acme.atlassian.net/jira/software"), "https://acme.atlassian.net");
+  assert.equal(normalizeJiraSite("http://acme.atlassian.net"), null, "https only");
+  assert.equal(normalizeJiraSite("https://evil.example.com"), null, "no arbitrary hosts");
+  assert.equal(normalizeJiraSite("https://user:pw@acme.atlassian.net"), null);
+  const body = { type: "doc", version: 1, content: [{ type: "paragraph", content: [{ type: "mention", attrs: { id: BOT, text: "@Bugmole" } }, { type: "text", text: " fixed, please retest" }] }] };
+  assert.match(commentText(body), /@Bugmole fixed, please retest/);
+  assert.equal(asksForRetest({ mention_keyword: "bugmole retest", account_id: BOT }, body), true, "an @mention of Bugmole's account counts");
+  assert.equal(asksForRetest({ mention_keyword: "@Bugmole", account_id: null }, "Fixed. @bugmole please look"), true, "the keyword, any case");
+  assert.equal(asksForRetest({ mention_keyword: "@Bugmole", account_id: BOT }, "Fixed, thanks"), false);
+  assert.equal(asksForRetest({ mention_keyword: "@Bugmole", account_id: BOT }, `[~accountid:${BOT}] retest`), true, "wiki markup mentions");
+  assert.equal(parseCommentEvent({ webhookEvent: "comment_updated" }), null);
+  assert.equal(parseCommentEvent({ webhookEvent: "comment_created", issue: { key: "not a key" }, comment: { id: "1" } }), null);
+});
+
+test("connecting verifies the token, stores it sealed and write-only, and never returns or logs it", async () => {
+  const logs = captureLogs();
+  try {
+    const context = await setup();
+    const { env, db, owner, projectId, workspaceId, connect } = context;
+    assert.equal((await connect({ siteUrl: "https://evil.example.com" })).status, 422);
+    const wrong = await connect({ apiToken: "not-the-token" });
+    assert.equal(wrong.status, 422);
+    assert.match(wrong.json.error, /didn't accept/);
+    assert.equal((await connect({ projectKey: "NOPE" })).status, 422, "a project the account can't see");
+    assert.equal(db.db.prepare("SELECT COUNT(*) AS n FROM project_jira_connections").get()!.n, 0, "nothing stored before it works");
+
+    const connected = await connect();
+    assert.equal(connected.status, 201, JSON.stringify(connected.json));
+    assert.ok(connected.json.webhookSecret, "the webhook secret is shown once");
+    assert.match(connected.json.connection.webhookUrl, /^https:\/\/registry\.test\/api\/jira\/webhook\?connection=jira_/);
+    const got = await call(env, "GET", `/api/projects/${projectId}/jira`, { as: owner });
+    assert.equal(got.status, 200);
+    assert.equal(got.json.connection.siteUrl, "https://acme.atlassian.net");
+    assert.equal(got.json.connection.mentionKeyword, "@Bugmole");
+    assert.equal(got.json.webhookSecret, undefined);
+
+    const stored = db.db.prepare("SELECT * FROM project_jira_connections").get() as Record<string, unknown>;
+    assert.ok(!JSON.stringify(stored).includes(TOKEN), "sealed at rest");
+    assert.ok(!JSON.stringify(stored).includes(connected.json.webhookSecret), "the webhook secret too");
+    assert.equal(stored.account_id, BOT);
+
+    // Updating without a token keeps the stored one; a stranger or member can't touch it.
+    const updated = await connect({ apiToken: undefined, mentionKeyword: "bugmole retest" });
+    assert.equal(updated.status, 200, JSON.stringify(updated.json));
+    assert.equal(updated.json.connection.mentionKeyword, "bugmole retest");
+    assert.equal((await connect({ apiToken: undefined, email: "someone-else@acme.test" })).status, 422, "a new email needs its token");
+    assert.equal((await connect({}, "user_stranger")).status, 403);
+    const invited = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, { as: owner, body: { email: "member@example.com", role: "member" } });
+    await call(env, "POST", `/api/invitations/${invited.json.invitation.acceptUrl.split("/invite/")[1]}/accept`, { as: "user_member" });
+    assert.equal((await connect({}, "user_member")).status, 403, "only managers connect");
+    assert.equal((await call(env, "GET", `/api/projects/${projectId}/jira`, { as: "user_member" })).status, 200, "members see the status");
+
+    const audit = db.db.prepare("SELECT action, data_json AS data FROM audit_log WHERE action LIKE 'jira.%'").all() as Array<{ action: string; data: string }>;
+    assert.deepEqual(audit.map((row) => row.action), ["jira.connected", "jira.updated"]);
+    for (const text of [JSON.stringify(got.json), JSON.stringify(updated.json), JSON.stringify(audit), logs.lines.join("\n")]) {
+      assert.ok(!text.includes(TOKEN), "the token is in no response, audit row or log line");
+    }
+    assert.ok(!logs.lines.join("\n").includes(Buffer.from(`${EMAIL}:${TOKEN}`).toString("base64")), "nor its Basic header");
+  } finally {
+    logs.restore();
+  }
+});
+
+test("the plan goes to Jira, approval creates one ticket per test idempotently, and the plan issue shows the decision", async () => {
+  const context = await setup();
+  const { env, db, owner, projectId, jira, connect, propose, drain } = context;
+  assert.equal((await call(env, "POST", `/api/projects/${projectId}/jira/plan`, { as: owner })).status, 404, "not connected yet");
+  assert.equal((await connect()).status, 201);
+  assert.equal((await call(env, "POST", `/api/projects/${projectId}/jira/plan`, { as: owner })).status, 422, "nothing proposed");
+
+  const first = (await propose("TC-login", "Sign in works")).json.proposal.id;
+  const second = (await propose("TC-logout", "Sign out works")).json.proposal.id;
+  const plan = await call(env, "POST", `/api/projects/${projectId}/jira/plan`, { as: owner });
+  assert.equal(plan.status, 201, JSON.stringify(plan.json));
+  const planIssue = jira.state.issues.get(plan.json.planIssue.key)!;
+  assert.deepEqual(planIssue.fields.labels, ["bugmole-plan"]);
+  assert.match(planIssue.fields.summary, /Proposed test plan .*2 test cases/);
+  assert.match(JSON.stringify(planIssue.fields.description), /Sign in works.*Sign out works/s);
+  assert.equal(plan.json.planIssue.url, `https://acme.atlassian.net/browse/${plan.json.planIssue.key}`);
+  const again = await call(env, "POST", `/api/projects/${projectId}/jira/plan`, { as: owner });
+  assert.deepEqual([again.status, again.json.planIssue.key], [200, plan.json.planIssue.key], "the same proposals aren't posted twice");
+
+  // Approve in Bugmole: tickets follow through the outbox.
+  assert.equal((await call(env, "POST", `/api/proposals/${first}/accept`, { as: owner })).status, 200);
+  assert.equal((await call(env, "POST", `/api/proposals/${second}/accept`, { as: owner })).status, 200);
+  await drain();
+  const tickets = [...jira.state.issues.values()].filter((issue) => issue.fields.labels.includes("bugmole-test"));
+  assert.equal(tickets.length, 2);
+  assert.ok(tickets.every((ticket) => ticket.fields.labels.some((label) => /^bugmole-case-[0-9a-f]{16}$/.test(label))));
+  assert.match(JSON.stringify(tickets[0].fields.description), /Open \/login.*The dashboard opens.*https:\/\/dash\.test\/plans\?project=shop/s);
+  assert.equal(planIssue.fields.status.name, "Done", "the plan issue closes once every proposal is decided");
+  assert.ok(jira.state.comments.some((comment) => comment.key === planIssue.key && /approved in Bugmole: 2 of 2/.test(JSON.stringify(comment.body))));
+
+  // Syncing again creates nothing; losing the link finds the same ticket by its case label.
+  const creates = jira.state.creates;
+  const resync = await call(env, "POST", `/api/projects/${projectId}/jira/tickets`, { as: owner, body: {} });
+  assert.equal(resync.status, 200, JSON.stringify(resync.json));
+  assert.deepEqual(resync.json.created, []);
+  db.db.prepare("UPDATE jira_issue_links SET jira_issue_key = NULL, jira_issue_id = NULL WHERE case_id = 'TC-login'").run();
+  const relinked = await call(env, "POST", `/api/projects/${projectId}/jira/tickets`, { as: owner, body: {} });
+  assert.deepEqual(relinked.json.created, []);
+  assert.equal(relinked.json.linked.length, 1);
+  assert.equal(jira.state.creates, creates, "no duplicate ticket");
+
+  const links = await call(env, "GET", `/api/projects/${projectId}/jira/links`, { as: owner });
+  assert.deepEqual(links.json.links.map((link: { caseId: string; caseRevision: number }) => [link.caseId, link.caseRevision]), [["TC-login", 1], ["TC-logout", 1]]);
+  assert.match(links.json.links[0].issueUrl, /^https:\/\/acme\.atlassian\.net\/browse\/QA-\d+$/);
+});
+
+async function withTickets() {
+  const context = await setup();
+  const { env, owner, projectId, jira, connect, propose, drain } = context;
+  const connected = await connect();
+  for (const [caseId, title] of [["TC-login", "Sign in works"], ["TC-logout", "Sign out works"], ["TC-reset", "Reset password works"]]) {
+    const id = (await propose(caseId, title)).json.proposal.id;
+    await call(env, "POST", `/api/proposals/${id}/accept`, { as: owner });
+  }
+  await drain();
+  const keyOf = (caseId: string) => (context.db.db.prepare("SELECT jira_issue_key AS key FROM jira_issue_links WHERE case_id = ?").get(caseId) as { key: string }).key;
+  const keys = { login: keyOf("TC-login"), logout: keyOf("TC-logout"), reset: keyOf("TC-reset") };
+  for (const key of Object.values(keys)) {
+    const issue = jira.state.issues.get(key)!;
+    issue.fields.assignee = { accountId: "acct-dev-1", displayName: "Dana Dev" };
+    issue.fields.reporter = { accountId: "acct-pm-1", displayName: "Pat PM" };
+  }
+  jira.state.noBlocked.add(keys.reset);
+  return { ...context, keys, webhookSecret: connected.json.webhookSecret as string, connectionId: connected.json.connection.id as string };
+}
+
+test("run results move passed tickets to Done and failed ones to Blocked, mentioning the people on them", async () => {
+  const context = await withTickets();
+  const { env, owner, projectId, jira, keys, drain } = context;
+  const run = await call(env, "POST", `/api/projects/${projectId}/runs`, { as: owner, body: { planId: "checkout", idempotencyKey: "full-1" } });
+  await finishRun(context, run.json.run.id, "partial", [
+    { caseId: "TC-login", status: "passed", detail: "Signed in." },
+    { caseId: "TC-logout", status: "failed", detail: "The sign-out button did nothing." },
+    { caseId: "TC-reset", status: "failed", detail: "No reset email." },
+  ]);
+  await drain();
+
+  assert.equal(jira.state.issues.get(keys.login)!.fields.status.name, "Done");
+  assert.equal(jira.state.issues.get(keys.logout)!.fields.status.name, "Blocked");
+  const reset = jira.state.issues.get(keys.reset)!;
+  assert.equal(reset.fields.status.name, "To Do", "no Blocked status in this workflow…");
+  assert.ok(reset.fields.labels.includes("bugmole-blocked"), "…so it gets the bugmole-blocked label");
+
+  const failedComment = jira.state.comments.find((comment) => comment.key === keys.logout)!;
+  const mentions = JSON.stringify(failedComment.body).match(/"type":"mention","attrs":\{"id":"([^"]+)"/g) ?? [];
+  assert.deepEqual(mentions.map((match) => match.split('"id":"')[1].replace('"', "")), ["acct-dev-1", "acct-pm-1"], "assignee and reporter, never Bugmole itself");
+  assert.match(JSON.stringify(failedComment.body), /Bugmole: failed\..*sign-out button did nothing.*https:\/\/dash\.test\/runs\?project=shop&run=run_/s);
+  const passedComment = jira.state.comments.find((comment) => comment.key === keys.login)!;
+  assert.match(JSON.stringify(passedComment.body), /Bugmole: passed\./);
+  assert.ok(!JSON.stringify(passedComment.body).includes('"type":"mention"'), "a pass bothers no one");
+
+  // A redelivered report changes nothing.
+  const comments = jira.state.comments.length;
+  const { reportRun } = await import("./workflow.js");
+  assert.deepEqual((await reportRun(env, run.json.run.id)).reported, []);
+  assert.equal(jira.state.comments.length, comments);
+});
+
+test("the webhook rejects a wrong secret and ignores its own comments; a mention retests only that ticket's case", async () => {
+  const context = await withTickets();
+  const { env, db, owner, projectId, jira, keys, drain, webhookSecret, connectionId } = context;
+  // First, the logout ticket fails.
+  const full = await call(env, "POST", `/api/projects/${projectId}/runs`, { as: owner, body: { planId: "checkout", idempotencyKey: "full-2" } });
+  await finishRun(context, full.json.run.id, "partial", [
+    { caseId: "TC-login", status: "passed", detail: "" },
+    { caseId: "TC-logout", status: "failed", detail: "Broken." },
+    { caseId: "TC-reset", status: "passed", detail: "" },
+  ]);
+  await drain();
+  assert.equal(jira.state.issues.get(keys.logout)!.fields.status.name, "Blocked");
+
+  const post = (payload: unknown, options: { secret?: string; header?: "hub" | "plain" | "query"; connection?: string } = {}) => {
+    const raw = JSON.stringify(payload);
+    const secret = options.secret ?? webhookSecret;
+    const connection = options.connection ?? connectionId;
+    const query = options.header === "query" ? `&token=${encodeURIComponent(secret)}` : "";
+    return (async () => call(env, "POST", `/api/jira/webhook?connection=${connection}${query}`, {
+      body: raw,
+      headers: options.header === "plain" ? { "x-bugmole-webhook-secret": secret } : options.header === "query" ? {} : { "x-hub-signature": await hubSignature(secret, raw) },
+    }))();
+  };
+
+  assert.equal((await post(commentEvent(keys.logout, "@Bugmole retest"), { connection: "jira_nope" })).status, 404);
+  assert.equal((await post(commentEvent(keys.logout, "@Bugmole retest"), { secret: "wrong-secret" })).status, 401);
+  assert.equal((await post(commentEvent(keys.logout, "@Bugmole retest"), { secret: "wrong-secret", header: "plain" })).status, 401);
+  assert.equal((await call(env, "POST", `/api/jira/webhook?connection=${connectionId}`, { body: JSON.stringify(commentEvent(keys.logout, "@Bugmole")) })).status, 401, "no secret at all");
+  const rejected = db.db.prepare("SELECT actor_type AS actorType, actor_id AS actorId FROM audit_log WHERE action = 'jira.webhook_rejected'").all() as any[];
+  assert.equal(rejected.length, 1, "rejections are audited, once a minute per connection");
+  assert.deepEqual({ ...rejected[0] }, { actorType: "webhook", actorId: `jira:${connectionId}` });
+
+  assert.equal((await post(commentEvent(keys.logout, "Bugmole: failed. mention @Bugmole", BOT))).json.ignored, "own_comment");
+  assert.equal((await post(commentEvent(keys.logout, "Looking into it"))).json.ignored, "no_mention");
+  assert.equal((await post({ ...commentEvent(keys.logout, "@Bugmole"), issue: { key: "OPS-1", fields: { project: { key: "OPS" } } } })).json.ignored, "other_project");
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS n FROM runs WHERE trigger_source = 'jira'").get()!.n, 0);
+
+  const queued = await post(commentEvent(keys.logout, "Fixed in #42, @Bugmole please retest"));
+  assert.equal(queued.status, 202, JSON.stringify(queued.json));
+  const run = db.db.prepare("SELECT id, plan_id AS planId, trigger_source AS trigger, case_scope_json AS scope FROM runs WHERE id = ?").get(queued.json.runId) as any;
+  assert.equal(run.planId, "checkout");
+  assert.equal(run.trigger, "jira");
+  assert.deepEqual(JSON.parse(run.scope), { caseSetId: "checkout-cases", caseIds: ["TC-logout"], jiraIssueKey: keys.logout }, "scoped to that ticket's case only");
+  const worker = await call(env, "POST", `/api/runs/${run.id}/claim`, { as: owner, body: { workerId: "w9" } });
+  assert.deepEqual(worker.json.caseScope.caseIds, ["TC-logout"], "the worker is told the scope");
+  await call(env, "POST", `/api/runs/${run.id}`, { as: owner, body: { workerId: "w9", status: "running" } });
+  assert.equal((await post(commentEvent(keys.logout, "@Bugmole please retest"), { header: "plain" })).json.runId, run.id, "a redelivered comment doesn't start a second run");
+  assert.equal((await post(commentEvent(keys.logout, "@Bugmole please retest"), { header: "query" })).status, 202, "the token may also be in the URL");
+  const accepted = db.db.prepare("SELECT data_json AS data FROM audit_log WHERE action = 'jira.retest_requested'").all() as Array<{ data: string }>;
+  assert.equal(JSON.parse(accepted[0].data).runId, run.id);
+
+  await drain();
+  assert.ok(jira.state.comments.some((comment) => comment.key === keys.logout && /retesting checkout-cases\/TC-logout/.test(commentText(comment.body))), "the ticket hears the retest is queued");
+
+  // The retest judges only its case; other tickets keep their state.
+  const loginComments = jira.state.comments.filter((comment) => comment.key === keys.login).length;
+  await context.artifacts.put(`projects/${projectId}/test-case-results/checkout-cases.json`, JSON.stringify({
+    caseSetId: "checkout-cases", runId: run.id, recordedAt: new Date().toISOString(),
+    results: [{ caseId: "TC-login", status: "failed", detail: "stale" }, { caseId: "TC-logout", status: "passed", detail: "Sign-out works now." }],
+  }));
+  await call(env, "POST", `/api/runs/${run.id}`, { as: owner, body: { workerId: "w9", status: "success", stepsPassed: 2, stepsFailed: 0 } });
+  await drain();
+  const logout = jira.state.issues.get(keys.logout)!;
+  assert.equal(logout.fields.status.name, "Done");
+  assert.ok(jira.state.comments.some((comment) => comment.key === keys.logout && /Bugmole: passed\..*Sign-out works now/.test(commentText(comment.body))));
+  assert.equal(jira.state.issues.get(keys.login)!.fields.status.name, "Done", "out of scope: untouched");
+  assert.equal(jira.state.comments.filter((comment) => comment.key === keys.login).length, loginComments);
+  const link = db.db.prepare("SELECT last_result AS result, last_run_id AS runId FROM jira_issue_links WHERE case_id = 'TC-logout'").get() as any;
+  assert.deepEqual({ ...link }, { result: "passed", runId: run.id });
+});
+
+test("a scoped retest on a project's own storage is judged by the run itself", async () => {
+  const context = await withTickets();
+  const { env, db, owner, projectId, jira, keys, drain, webhookSecret, connectionId } = context;
+  db.db.prepare("UPDATE projects SET storage_mode = 'byo' WHERE id = ?").run(projectId);
+  const raw = JSON.stringify(commentEvent(keys.reset, "@bugmole retest"));
+  const queued = await call(env, "POST", `/api/jira/webhook?connection=${connectionId}`, { body: raw, headers: { "x-hub-signature": await hubSignature(webhookSecret, raw) } });
+  assert.equal(queued.status, 202, JSON.stringify(queued.json));
+  await finishRun(context, queued.json.runId, "error", null);
+  await drain();
+  const reset = jira.state.issues.get(keys.reset)!;
+  assert.ok(reset.fields.labels.includes("bugmole-blocked"));
+  assert.ok(jira.state.comments.some((comment) => comment.key === keys.reset && /Bugmole: failed\./.test(commentText(comment.body)) && /acct-dev-1/.test(JSON.stringify(comment.body))));
+
+  // Disconnecting forgets the links (tickets stay in Jira) and stops the webhook.
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/jira`, { as: owner })).status, 200);
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS n FROM jira_issue_links").get()!.n, 0);
+  assert.equal((await call(env, "POST", `/api/jira/webhook?connection=${connectionId}`, { body: raw, headers: { "x-hub-signature": await hubSignature(webhookSecret, raw) } })).status, 404);
+});