@desplega.ai/agent-swarm 1.83.1 → 1.84.0

package/src/tests/user-token-routes.test.ts

@@ -0,0 +1,221 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, createUser, getDb, initDb } from "../be/db";
+import { fingerprintApiKey } from "../be/users";
+import { handleCore } from "../http/core";
+import { handleUsers } from "../http/users";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+
+const TEST_DB_PATH = "./test-user-token-routes.sqlite";
+const API_KEY = "test-user-token-key";
+const ORIGINAL_API_KEY = process.env.AGENT_SWARM_API_KEY;
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(path + suffix);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+async function listen(server: Server): Promise<number> {
+  const port = 15174;
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const addr = server.address();
+  if (!addr || typeof addr === "string") throw new Error("no port");
+  return addr.port;
+}
+
+function createTestServer(apiKey: string): Server {
+  return createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    const handled = await handleCore(req, res, myAgentId, apiKey);
+    if (handled) return;
+    const pathSegments = getPathSegments(req.url || "");
+    const queryParams = parseQueryParams(req.url || "");
+    const ok = await handleUsers(req, res, pathSegments, queryParams);
+    if (!ok) {
+      res.writeHead(404);
+      res.end("Not Found");
+    }
+  });
+}
+
+let server: Server;
+let port: number;
+
+beforeAll(async () => {
+  await removeDbFiles(TEST_DB_PATH);
+  initDb(TEST_DB_PATH);
+  process.env.AGENT_SWARM_API_KEY = API_KEY;
+  server = createTestServer(API_KEY);
+  port = await listen(server);
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+  await removeDbFiles(TEST_DB_PATH);
+  if (ORIGINAL_API_KEY === undefined) {
+    delete process.env.AGENT_SWARM_API_KEY;
+  } else {
+    process.env.AGENT_SWARM_API_KEY = ORIGINAL_API_KEY;
+  }
+});
+
+beforeEach(() => {
+  const db = getDb();
+  db.run("DELETE FROM user_identity_events");
+  db.run("DELETE FROM user_tokens");
+  db.run("DELETE FROM users");
+});
+
+function url(path: string): string {
+  return `http://127.0.0.1:${port}${path}`;
+}
+
+function authedFetch(path: string, init: RequestInit = {}): Promise<Response> {
+  const headers: Record<string, string> = {
+    Authorization: `Bearer ${API_KEY}`,
+    "Content-Type": "application/json",
+    ...((init.headers as Record<string, string>) ?? {}),
+  };
+  return fetch(url(path), { ...init, headers });
+}
+
+type TokenSummary = {
+  id: string;
+  userId: string;
+  label: string | null;
+  tokenPreview: string;
+  createdAt: string;
+  lastUsedAt: string | null;
+  revokedAt: string | null;
+};
+
+describe("operator MCP token routes", () => {
+  test("POST mints an aswt_ plaintext once and persists only hash + preview", async () => {
+    const user = createUser({ name: "Token User", email: "token@example.com" });
+
+    const response = await authedFetch(`/api/users/${user.id}/mcp-tokens`, {
+      method: "POST",
+      body: JSON.stringify({ label: "laptop" }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as {
+      plaintext: string;
+      token: TokenSummary;
+      user: { id: string; tokens: TokenSummary[]; recentEvents: Array<{ eventType: string }> };
+    };
+    expect(body.plaintext.startsWith("aswt_")).toBe(true);
+    expect(body.token.label).toBe("laptop");
+    expect(body.token.tokenPreview).toBe(body.plaintext.slice(-4));
+    expect(body.token.userId).toBe(user.id);
+    expect(body.user.tokens).toContainEqual(body.token);
+    expect(body.user.recentEvents.map((event) => event.eventType)).toContain("token_minted");
+
+    const stored = getDb()
+      .prepare<{ tokenHash: string; tokenPreview: string }, string>(
+        "SELECT tokenHash, tokenPreview FROM user_tokens WHERE id = ?",
+      )
+      .get(body.token.id);
+    expect(stored).toBeTruthy();
+    expect(stored!.tokenHash).not.toBe(body.plaintext);
+    expect(stored!.tokenHash).toHaveLength(64);
+    expect(stored!.tokenPreview).toBe(body.plaintext.slice(-4));
+
+    const reread = await authedFetch(`/api/users/${user.id}`);
+    const rereadBody = (await reread.json()) as {
+      user: { tokens: TokenSummary[]; recentEvents: Array<{ eventType: string }> };
+    };
+    expect(JSON.stringify(rereadBody)).not.toContain(body.plaintext);
+    expect(rereadBody.user.tokens[0]!.tokenPreview).toBe(body.plaintext.slice(-4));
+  });
+
+  test("DELETE revokes a token and records token_revoked", async () => {
+    const user = createUser({ name: "Revoked User" });
+    const mintResponse = await authedFetch(`/api/users/${user.id}/mcp-tokens`, {
+      method: "POST",
+      body: JSON.stringify({ label: null }),
+    });
+    const minted = (await mintResponse.json()) as { token: TokenSummary };
+
+    const revokeResponse = await authedFetch(
+      `/api/users/${user.id}/mcp-tokens/${minted.token.id}`,
+      { method: "DELETE" },
+    );
+
+    expect(revokeResponse.status).toBe(200);
+    const body = (await revokeResponse.json()) as {
+      user: { tokens: TokenSummary[]; recentEvents: Array<{ eventType: string }> };
+    };
+    expect(body.user.tokens[0]!.id).toBe(minted.token.id);
+    expect(body.user.tokens[0]!.revokedAt).toBeTruthy();
+    expect(body.user.recentEvents.map((event) => event.eventType)).toEqual(
+      expect.arrayContaining(["token_minted", "token_revoked"]),
+    );
+  });
+
+  test("POST and DELETE reject without the swarm key", async () => {
+    const user = createUser({ name: "Auth User" });
+
+    const post = await fetch(url(`/api/users/${user.id}/mcp-tokens`), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ label: "missing-auth" }),
+    });
+    expect(post.status).toBe(401);
+
+    const deleteResponse = await fetch(url(`/api/users/${user.id}/mcp-tokens/unknown`), {
+      method: "DELETE",
+    });
+    expect(deleteResponse.status).toBe(401);
+  });
+
+  test("DELETE unknown token returns 404", async () => {
+    const user = createUser({ name: "Unknown Token User" });
+    const response = await authedFetch(`/api/users/${user.id}/mcp-tokens/not-a-token`, {
+      method: "DELETE",
+    });
+    expect(response.status).toBe(404);
+  });
+
+  test("POST unknown user returns 404", async () => {
+    const response = await authedFetch("/api/users/not-a-user/mcp-tokens", {
+      method: "POST",
+      body: JSON.stringify({ label: "nope" }),
+    });
+    expect(response.status).toBe(404);
+  });
+
+  test("operator events are tagged with the API-key fingerprint", async () => {
+    const user = createUser({ name: "Actor User" });
+    const response = await authedFetch(`/api/users/${user.id}/mcp-tokens`, {
+      method: "POST",
+      body: JSON.stringify({ label: "actor" }),
+    });
+    expect(response.status).toBe(200);
+
+    const row = getDb()
+      .prepare<{ actor: string }, string>(
+        "SELECT actor FROM user_identity_events WHERE userId = ? AND eventType = 'token_minted'",
+      )
+      .get(user.id);
+    expect(row?.actor).toBe(`operator:${fingerprintApiKey(API_KEY)}`);
+  });
+});

package/src/tools/cancel-task.ts

@@ -1,4 +1,5 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import * as z from "zod";
 import {
   cancelTask,
@@ -7,107 +8,160 @@ import {
   getTaskById,
   updateAgentStatusFromCapacity,
 } from "@/be/db";
+import { assertOwnsTask, ownerCtx, type ToolCtx } from "@/tools/task-tool-ctx";
 import { createToolRegistrar } from "@/tools/utils";
 import type { AgentTask } from "@/types";
 import { AgentTaskSchema } from "@/types";
 
-export const registerCancelTaskTool = (server: McpServer) => {
-  createToolRegistrar(server)(
-    "cancel-task",
-    {
-      title: "Cancel Task",
-      description:
-        "Cancel a task that is pending or in progress. Only the lead or task creator can cancel tasks. The worker will be notified via hooks.",
-      annotations: { destructiveHint: true },
+export const cancelTaskInputSchema = z.object({
+  taskId: z.uuid().describe("The ID of the task to cancel."),
+  reason: z.string().optional().describe("Reason for cancellation."),
+});
 
-      inputSchema: z.object({
-        taskId: z.uuid().describe("The ID of the task to cancel."),
-        reason: z.string().optional().describe("Reason for cancellation."),
-      }),
-      outputSchema: z.object({
-        yourAgentId: z.string().uuid().optional(),
-        success: z.boolean(),
-        message: z.string(),
-        task: AgentTaskSchema.optional(),
-      }),
-    },
-    async (input, requestInfo, _meta) => {
-      const { taskId, reason } = input;
+export const cancelTaskOutputSchema = z.object({
+  yourAgentId: z.string().uuid().optional(),
+  success: z.boolean(),
+  message: z.string(),
+  task: AgentTaskSchema.optional(),
+});
+
+type CancelTaskArgs = z.infer<typeof cancelTaskInputSchema>;
+
+export async function cancelTaskHandler(
+  ctx: ToolCtx,
+  { taskId, reason }: CancelTaskArgs,
+): Promise<CallToolResult> {
+  if (ctx.kind === "owner" && !ctx.agentId) {
+    return {
+      content: [{ type: "text", text: 'Agent ID not found. Set the "X-Agent-ID" header.' }],
+      structuredContent: {
+        success: false,
+        message: 'Agent ID not found. Set the "X-Agent-ID" header.',
+      },
+    };
+  }
+
+  const agentId = ctx.kind === "owner" ? ctx.agentId : undefined;
 
-      if (!requestInfo.agentId) {
+  const txn = getDb().transaction(() => {
+    if (ctx.kind === "owner") {
+      const ownerAgentId = ctx.agentId;
+      if (!ownerAgentId) {
         return {
-          content: [{ type: "text", text: 'Agent ID not found. Set the "X-Agent-ID" header.' }],
-          structuredContent: {
-            success: false,
-            message: 'Agent ID not found. Set the "X-Agent-ID" header.',
-          },
+          success: false,
+          message: 'Agent ID not found. Set the "X-Agent-ID" header.',
         };
       }
+      const callerAgent = getAgentById(ownerAgentId);
 
-      const agentId = requestInfo.agentId;
-
-      const txn = getDb().transaction(() => {
-        const callerAgent = getAgentById(agentId);
-
-        if (!callerAgent) {
-          return {
-            success: false,
-            message: "Caller agent not found.",
-          };
-        }
-
-        const existingTask = getTaskById(taskId);
-
-        if (!existingTask) {
-          return {
-            success: false,
-            message: `Task "${taskId}" not found.`,
-          };
-        }
-
-        // Verify the requester has permission (lead or task creator)
-        const canCancel = callerAgent.isLead || existingTask.creatorAgentId === agentId;
-        if (!canCancel) {
-          return {
-            success: false,
-            message: "Only the lead or task creator can cancel tasks.",
-          };
-        }
-
-        const cancelled = cancelTask(taskId, reason);
-
-        if (!cancelled) {
-          return {
-            success: false,
-            message: `Cannot cancel task in status "${existingTask.status}". Only pending/in_progress tasks can be cancelled.`,
-          };
-        }
-
-        // Update agent status based on capacity
-        if (cancelled.agentId) {
-          updateAgentStatusFromCapacity(cancelled.agentId);
-        }
+      if (!callerAgent) {
+        return {
+          success: false,
+          message: "Caller agent not found.",
+        };
+      }
 
+      const existingTask = getTaskById(taskId);
+
+      if (!existingTask) {
         return {
-          success: true,
-          message: `Task "${taskId}" has been cancelled.`,
-          task: cancelled,
+          success: false,
+          message: `Task "${taskId}" not found.`,
         };
-      });
+      }
 
-      const result = txn() as {
-        success: boolean;
-        message: string;
-        task?: AgentTask;
+      // Verify the requester has permission (lead or task creator)
+      const canCancel = callerAgent.isLead || existingTask.creatorAgentId === ownerAgentId;
+      if (!canCancel) {
+        return {
+          success: false,
+          message: "Only the lead or task creator can cancel tasks.",
+        };
+      }
+
+      const cancelled = cancelTask(taskId, reason);
+
+      if (!cancelled) {
+        return {
+          success: false,
+          message: `Cannot cancel task in status "${existingTask.status}". Only pending/in_progress tasks can be cancelled.`,
+        };
+      }
+
+      // Update agent status based on capacity
+      if (cancelled.agentId) {
+        updateAgentStatusFromCapacity(cancelled.agentId);
+      }
+
+      return {
+        success: true,
+        message: `Task "${taskId}" has been cancelled.`,
+        task: cancelled,
+      };
+    }
+
+    const existingTask = getTaskById(taskId);
+
+    if (!existingTask) {
+      return {
+        success: false,
+        message: `Task "${taskId}" not found.`,
       };
+    }
 
+    const ownershipError = assertOwnsTask(ctx, existingTask);
+    if (ownershipError) return ownershipError;
+
+    const cancelled = cancelTask(taskId, reason);
+
+    if (!cancelled) {
       return {
-        content: [{ type: "text", text: result.message }],
-        structuredContent: {
-          yourAgentId: agentId,
-          ...result,
-        },
+        success: false,
+        message: `Cannot cancel task in status "${existingTask.status}". Only pending/in_progress tasks can be cancelled.`,
       };
+    }
+
+    if (cancelled.agentId) {
+      updateAgentStatusFromCapacity(cancelled.agentId);
+    }
+
+    return {
+      success: true,
+      message: `Task "${taskId}" has been cancelled.`,
+      task: cancelled,
+    };
+  });
+
+  const result = txn() as
+    | {
+        success: boolean;
+        message: string;
+        task?: AgentTask;
+      }
+    | CallToolResult;
+
+  if ("content" in result) return result;
+
+  return {
+    content: [{ type: "text", text: result.message }],
+    structuredContent: {
+      yourAgentId: agentId,
+      ...result,
+    },
+  };
+}
+
+export const registerCancelTaskTool = (server: McpServer) => {
+  createToolRegistrar(server)(
+    "cancel-task",
+    {
+      title: "Cancel Task",
+      description:
+        "Cancel a task that is pending or in progress. Only the lead or task creator can cancel tasks. The worker will be notified via hooks.",
+      annotations: { destructiveHint: true },
+      inputSchema: cancelTaskInputSchema,
+      outputSchema: cancelTaskOutputSchema,
     },
+    async (args, info, _meta) => cancelTaskHandler(ownerCtx(info), args),
   );
 };

package/src/tools/get-task-details.ts

@@ -1,4 +1,5 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import * as z from "zod";
 import {
   getLogsByTaskIdChronological,
@@ -6,9 +7,78 @@ import {
   getTaskById,
   getUserById,
 } from "@/be/db";
+import { assertOwnsTask, ownerCtx, type ToolCtx } from "@/tools/task-tool-ctx";
 import { createToolRegistrar } from "@/tools/utils";
 import { AgentLogSchema, AgentTaskSchema, TaskAttachmentSchema } from "@/types";
 
+export const getTaskDetailsInputSchema = z.object({
+  taskId: z.uuid().describe("The ID of the task to get details for."),
+});
+
+export const getTaskDetailsOutputSchema = z.object({
+  yourAgentId: z.string().uuid().optional(),
+  success: z.boolean(),
+  message: z.string(),
+  task: AgentTaskSchema.optional(),
+  requestedBy: z
+    .object({ name: z.string(), email: z.string().optional() })
+    .optional()
+    .describe("Resolved user who requested this task"),
+  logs: z.array(AgentLogSchema).optional(),
+  attachments: z
+    .array(TaskAttachmentSchema)
+    .optional()
+    .describe(
+      "Pointer-based artifacts attached to this task via store-progress, ordered by created_at.",
+    ),
+});
+
+type GetTaskDetailsArgs = z.infer<typeof getTaskDetailsInputSchema>;
+
+export async function getTaskDetailsHandler(
+  ctx: ToolCtx,
+  { taskId }: GetTaskDetailsArgs,
+): Promise<CallToolResult> {
+  const task = getTaskById(taskId);
+  const agentId = ctx.kind === "owner" ? ctx.agentId : undefined;
+
+  if (!task) {
+    return {
+      content: [{ type: "text", text: `Task with ID "${taskId}" not found.` }],
+      structuredContent: {
+        yourAgentId: agentId,
+        success: false,
+        message: `Task with ID "${taskId}" not found.`,
+      },
+    };
+  }
+
+  const ownershipError = assertOwnsTask(ctx, task);
+  if (ownershipError) return ownershipError;
+
+  const logs = getLogsByTaskIdChronological(taskId);
+  const attachments = getTaskAttachments(taskId);
+
+  // Resolve requesting user details if available
+  const requestedByUser = task.requestedByUserId ? getUserById(task.requestedByUserId) : undefined;
+  const requestedBy = requestedByUser
+    ? { name: requestedByUser.name, email: requestedByUser.email }
+    : undefined;
+
+  return {
+    content: [{ type: "text", text: `Task "${taskId}" details retrieved.` }],
+    structuredContent: {
+      yourAgentId: agentId,
+      success: true,
+      message: `Task "${taskId}" details retrieved.`,
+      task,
+      requestedBy,
+      logs,
+      attachments,
+    },
+  };
+}
+
 export const registerGetTaskDetailsTool = (server: McpServer) => {
   createToolRegistrar(server)(
     "get-task-details",
@@ -17,65 +87,9 @@ export const registerGetTaskDetailsTool = (server: McpServer) => {
       description:
         "Returns detailed information about a specific task, including output, failure reason, and log history.",
       annotations: { readOnlyHint: true },
-
-      inputSchema: z.object({
-        taskId: z.uuid().describe("The ID of the task to get details for."),
-      }),
-      outputSchema: z.object({
-        yourAgentId: z.string().uuid().optional(),
-        success: z.boolean(),
-        message: z.string(),
-        task: AgentTaskSchema.optional(),
-        requestedBy: z
-          .object({ name: z.string(), email: z.string().optional() })
-          .optional()
-          .describe("Resolved user who requested this task"),
-        logs: z.array(AgentLogSchema).optional(),
-        attachments: z
-          .array(TaskAttachmentSchema)
-          .optional()
-          .describe(
-            "Pointer-based artifacts attached to this task via store-progress, ordered by created_at.",
-          ),
-      }),
-    },
-    async ({ taskId }, requestInfo, _meta) => {
-      const task = getTaskById(taskId);
-
-      if (!task) {
-        return {
-          content: [{ type: "text", text: `Task with ID "${taskId}" not found.` }],
-          structuredContent: {
-            yourAgentId: requestInfo.agentId,
-            success: false,
-            message: `Task with ID "${taskId}" not found.`,
-          },
-        };
-      }
-
-      const logs = getLogsByTaskIdChronological(taskId);
-      const attachments = getTaskAttachments(taskId);
-
-      // Resolve requesting user details if available
-      const requestedByUser = task.requestedByUserId
-        ? getUserById(task.requestedByUserId)
-        : undefined;
-      const requestedBy = requestedByUser
-        ? { name: requestedByUser.name, email: requestedByUser.email }
-        : undefined;
-
-      return {
-        content: [{ type: "text", text: `Task "${taskId}" details retrieved.` }],
-        structuredContent: {
-          yourAgentId: requestInfo.agentId,
-          success: true,
-          message: `Task "${taskId}" details retrieved.`,
-          task,
-          requestedBy,
-          logs,
-          attachments,
-        },
-      };
+      inputSchema: getTaskDetailsInputSchema,
+      outputSchema: getTaskDetailsOutputSchema,
     },
+    async (args, info, _meta) => getTaskDetailsHandler(ownerCtx(info), args),
   );
 };