@desplega.ai/agent-swarm 2.7.0 → 2.7.1

package/src/tests/agent-fs-provision-seeder.test.ts

@@ -4,10 +4,12 @@ import {
   closeDb,
   createAgent,
   createUser,
+  deleteSwarmConfigByKey,
   getSwarmConfigs,
   initDb,
   upsertSwarmConfig,
 } from "../be/db";
+import { attachRole, detachRole, ensureRbacSeedsSynced } from "../be/rbac-roles";
 import { runSeeder } from "../be/seed";
 import {
   agentFsProvisionSeeder,
@@ -62,13 +64,38 @@ function restoreEnv(): void {
   }
 }
 
+async function makeRbacViewer(userId: string): Promise<void> {
+  await attachRole(userId, "viewer");
+  await detachRole(userId, "admin");
+}
+
+async function seedSharedConfig(): Promise<void> {
+  await upsertSwarmConfig({
+    scope: "global",
+    key: "API_AGENT_FS_API_KEY",
+    value: "example-afs-admin-key",
+    isSecret: true,
+  });
+  await upsertSwarmConfig({ scope: "global", key: "AGENT_FS_DEFAULT_ORG_ID", value: "shared-org" });
+  await upsertSwarmConfig({
+    scope: "global",
+    key: "AGENT_FS_DEFAULT_DRIVE_ID",
+    value: "shared-drive",
+  });
+}
+
 async function configValue(key: string): Promise<string | undefined> {
   return (await getSwarmConfigs({ scope: "global", key }))[0]?.value;
 }
 
 function createFetchStub(
   records: RequestRecord[],
-  options: { members?: StubMember[]; registerConflictEmail?: string } = {},
+  options: {
+    members?: StubMember[];
+    registerConflictEmail?: string;
+    /** A body to send, or a function of the invited email (undefined: the default). */
+    inviteResponse?: Record<string, unknown> | ((email: string) => Response | undefined);
+  } = {},
 ): typeof fetch {
   return (async (input, init) => {
     const url = new URL(String(input));
@@ -135,7 +162,10 @@ function createFetchStub(
       return Response.json({ members: options.members ?? [] });
     }
     if (url.pathname === "/orgs/shared-org/members/invite" && method === "POST") {
-      return Response.json({ ok: true });
+      const invite = options.inviteResponse;
+      if (typeof invite !== "function") return Response.json(invite ?? { ok: true });
+      const email = body && typeof body === "object" && "email" in body ? String(body.email) : "";
+      return invite(email) ?? Response.json({ ok: true });
     }
 
     return Response.json(
@@ -149,6 +179,7 @@ describe("agent-fs provisioning seeder", () => {
   beforeAll(async () => {
     await removeDbFiles(TEST_DB_PATH);
     initDb(TEST_DB_PATH);
+    ensureRbacSeedsSynced({ quiet: true });
   });
 
   afterEach(() => {
@@ -197,11 +228,12 @@ describe("agent-fs provisioning seeder", () => {
       email: `operator-${suffix}@example.test`,
       role: "Operator",
     });
-    await createUser({
+    const viewer = await createUser({
       name: "Explicit Viewer User",
       email: `viewer-${suffix}@example.test`,
       role: "read-only contractor",
     });
+    await makeRbacViewer(viewer.id);
     const records: RequestRecord[] = [];
     setAgentFsProvisionFetchForTests(createFetchStub(records));
 
@@ -249,46 +281,35 @@ describe("agent-fs provisioning seeder", () => {
     expect(records).toEqual([]);
   });
 
-  test("classifies arbitrary non-viewer human roles as agent-fs editors", async () => {
+  test("follows the RBAC grant, not the free-text profile role", async () => {
     const suffix = crypto.randomUUID().slice(0, 8);
     process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
     process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
-    await upsertSwarmConfig({
-      scope: "global",
-      key: "API_AGENT_FS_API_KEY",
-      value: "example-afs-admin-key",
-      isSecret: true,
-    });
-    await upsertSwarmConfig({
-      scope: "global",
-      key: "AGENT_FS_DEFAULT_ORG_ID",
-      value: "shared-org",
-    });
-    await upsertSwarmConfig({
-      scope: "global",
-      key: "AGENT_FS_DEFAULT_DRIVE_ID",
-      value: "shared-drive",
-    });
+    await seedSharedConfig();
 
+    // Default trigger role is admin (grant-all): editor even with a "Viewer" profile role.
     await createUser({
-      name: "Taras Founder",
-      email: `taras-founder-${suffix}@example.test`,
-      role: "co-founder, CTO",
+      name: "Admin With Viewer Title",
+      email: `admin-viewer-title-${suffix}@example.test`,
+      role: "Viewer",
     });
-    await createUser({
-      name: "Eze Founder",
-      email: `eze-founder-${suffix}@example.test`,
-      role: "co-founder, CEO",
+    const requester = await createUser({
+      name: "Requester Human",
+      email: `requester-${suffix}@example.test`,
+      role: "guest",
     });
-    await createUser({
-      name: "Designer Human",
-      email: `designer-${suffix}@example.test`,
-      role: "designer",
+    await attachRole(requester.id, "requester");
+    await detachRole(requester.id, "admin");
+    const viewer = await createUser({
+      name: "RBAC Viewer",
+      email: `rbac-viewer-${suffix}@example.test`,
+      role: "co-founder, CTO",
     });
+    await makeRbacViewer(viewer.id);
     await createUser({
-      name: "Unknown Human",
-      email: `whatever-${suffix}@example.test`,
-      role: "whatever",
+      name: "Padded Email",
+      email: `  padded-${suffix}@example.test `,
+      role: "designer",
     });
 
     const records: RequestRecord[] = [];
@@ -301,59 +322,31 @@ describe("agent-fs provisioning seeder", () => {
       .filter((r) => r.path === "/orgs/shared-org/members/invite")
       .map((r) => r.body);
     expect(invites).toContainEqual({
-      email: `taras-founder-${suffix}@example.test`,
-      role: "editor",
-    });
-    expect(invites).toContainEqual({
-      email: `eze-founder-${suffix}@example.test`,
-      role: "editor",
-    });
-    expect(invites).toContainEqual({
-      email: `designer-${suffix}@example.test`,
-      role: "editor",
-    });
-    expect(invites).toContainEqual({
-      email: `whatever-${suffix}@example.test`,
+      email: `admin-viewer-title-${suffix}@example.test`,
       role: "editor",
     });
+    expect(invites).toContainEqual({ email: `requester-${suffix}@example.test`, role: "editor" });
+    expect(invites).toContainEqual({ email: `rbac-viewer-${suffix}@example.test`, role: "viewer" });
+    expect(invites).toContainEqual({ email: `padded-${suffix}@example.test`, role: "editor" });
   });
 
-  test("classifies explicitly viewer human roles as agent-fs viewers", async () => {
+  test("does not invite invited or suspended users", async () => {
     const suffix = crypto.randomUUID().slice(0, 8);
     process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
     process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
-    await upsertSwarmConfig({
-      scope: "global",
-      key: "API_AGENT_FS_API_KEY",
-      value: "example-afs-admin-key",
-      isSecret: true,
-    });
-    await upsertSwarmConfig({
-      scope: "global",
-      key: "AGENT_FS_DEFAULT_ORG_ID",
-      value: "shared-org",
-    });
-    await upsertSwarmConfig({
-      scope: "global",
-      key: "AGENT_FS_DEFAULT_DRIVE_ID",
-      value: "shared-drive",
-    });
+    await seedSharedConfig();
 
     await createUser({
-      name: "Viewer Human",
-      email: `viewer-${suffix}@example.test`,
-      role: "Viewer",
-    });
-    await createUser({
-      name: "Read Only Human",
-      email: `read-only-${suffix}@example.test`,
-      role: "read only",
+      name: "Pending",
+      email: `pending-${suffix}@example.test`,
+      status: "invited",
     });
     await createUser({
-      name: "Guest Human",
-      email: `guest-${suffix}@example.test`,
-      role: "guest",
+      name: "Suspended",
+      email: `suspended-${suffix}@example.test`,
+      status: "suspended",
     });
+    await createUser({ name: "Active", email: `active-${suffix}@example.test` });
 
     const records: RequestRecord[] = [];
     setAgentFsProvisionFetchForTests(createFetchStub(records));
@@ -361,21 +354,106 @@ describe("agent-fs provisioning seeder", () => {
     const result = await runSeeder(agentFsProvisionSeeder, { quiet: true });
 
     expect(result.failed).toEqual([]);
-    const invites = records
+    const invited = records
       .filter((r) => r.path === "/orgs/shared-org/members/invite")
-      .map((r) => r.body);
-    expect(invites).toContainEqual({
-      email: `viewer-${suffix}@example.test`,
-      role: "viewer",
-    });
-    expect(invites).toContainEqual({
-      email: `read-only-${suffix}@example.test`,
-      role: "viewer",
-    });
-    expect(invites).toContainEqual({
-      email: `guest-${suffix}@example.test`,
-      role: "viewer",
-    });
+      .map((r) => (r.body as { email: string }).email);
+    expect(invited).toContain(`active-${suffix}@example.test`);
+    expect(invited).not.toContain(`pending-${suffix}@example.test`);
+    expect(invited).not.toContain(`suspended-${suffix}@example.test`);
+  });
+
+  test("a transient invite failure keeps org and drive rows and retries on the next boot", async () => {
+    const suffix = crypto.randomUUID().slice(0, 8);
+    const flaky = `flaky-${suffix}@example.test`;
+    process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
+    process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
+    delete process.env.AGENT_FS_DEFAULT_ORG_ID;
+    delete process.env.AGENT_FS_SHARED_ORG_ID;
+    delete process.env.AGENT_FS_DEFAULT_DRIVE_ID;
+    // Fresh-install shape: no hash and no org or drive rows yet.
+    for (const key of [
+      "AGENT_FS_PROVISION_HASH",
+      "AGENT_FS_DEFAULT_ORG_ID",
+      "AGENT_FS_SHARED_ORG_ID",
+      "AGENT_FS_DEFAULT_DRIVE_ID",
+    ]) {
+      await deleteSwarmConfigByKey("global", null, key);
+    }
+    await createUser({ name: "Flaky", email: flaky });
+
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      const records: RequestRecord[] = [];
+      setAgentFsProvisionFetchForTests(
+        createFetchStub(records, {
+          inviteResponse: (email) =>
+            email === flaky ? Response.json({ error: "busy" }, { status: 503 }) : undefined,
+        }),
+      );
+
+      const failed = await runSeeder(agentFsProvisionSeeder, { quiet: true });
+
+      expect(failed.failed).toHaveLength(1);
+      expect(failed.failed[0]?.error).toContain("will retry on next boot");
+      expect(await configValue("AGENT_FS_DEFAULT_ORG_ID")).toBe("shared-org");
+      expect(await configValue("AGENT_FS_SHARED_ORG_ID")).toBe("shared-org");
+      expect(await configValue("AGENT_FS_DEFAULT_DRIVE_ID")).toBe("shared-drive");
+      const [item] = await agentFsProvisionSeeder.items();
+      expect(await configValue("AGENT_FS_PROVISION_HASH")).not.toBe(item?.contentHash);
+
+      records.length = 0;
+      setAgentFsProvisionFetchForTests(createFetchStub(records));
+      const retried = await runSeeder(agentFsProvisionSeeder, { quiet: true });
+
+      expect(retried.failed).toEqual([]);
+      expect(
+        records.filter((r) => r.path === "/orgs/shared-org/members/invite").map((r) => r.body),
+      ).toContainEqual({ email: flaky, role: "editor" });
+      expect(await configValue("AGENT_FS_PROVISION_HASH")).toBe(item?.contentHash);
+
+      records.length = 0;
+      const unchanged = await runSeeder(agentFsProvisionSeeder, { quiet: true });
+      expect(unchanged.failed).toEqual([]);
+      expect(unchanged.skippedUnchanged).toBe(1);
+      expect(records).toEqual([]);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  test("an invite for an unregistered email (500 not found) still stores the hash", async () => {
+    const suffix = crypto.randomUUID().slice(0, 8);
+    const unregistered = `unregistered-${suffix}@example.test`;
+    process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
+    process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
+    await seedSharedConfig();
+    await createUser({ name: "Unregistered", email: unregistered });
+
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      const records: RequestRecord[] = [];
+      setAgentFsProvisionFetchForTests(
+        createFetchStub(records, {
+          inviteResponse: (email) =>
+            email === unregistered
+              ? Response.json({ error: `User with email ${email} not found` }, { status: 500 })
+              : undefined,
+        }),
+      );
+
+      const result = await runSeeder(agentFsProvisionSeeder, { quiet: true });
+
+      expect(result.failed).toEqual([]);
+      const [item] = await agentFsProvisionSeeder.items();
+      expect(await configValue("AGENT_FS_PROVISION_HASH")).toBe(item?.contentHash);
+
+      records.length = 0;
+      const second = await runSeeder(agentFsProvisionSeeder, { quiet: true });
+      expect(second.skippedUnchanged).toBe(1);
+      expect(records).toEqual([]);
+    } finally {
+      warn.mockRestore();
+    }
   });
 
   test("does not invite existing members when provisioning would keep or lower their role", async () => {
@@ -406,7 +484,12 @@ describe("agent-fs provisioning seeder", () => {
     await createUser({ name: "Existing Admin", email: existingAdmin, role: "Customer" });
     await createUser({ name: "Existing Editor", email: existingEditor, role: "Designer" });
     await createUser({ name: "Existing Viewer", email: existingViewer, role: "Whatever" });
-    await createUser({ name: "Explicit Viewer", email: explicitViewer, role: "Guest" });
+    const explicitViewerUser = await createUser({
+      name: "Explicit Viewer",
+      email: explicitViewer,
+      role: "Guest",
+    });
+    await makeRbacViewer(explicitViewerUser.id);
 
     const records: RequestRecord[] = [];
     setAgentFsProvisionFetchForTests(
@@ -645,7 +728,8 @@ describe("agent-fs provisioning seeder", () => {
 
     const result = await inviteEmailToSharedOrg("Customer@Example.test ", "admin");
 
-    expect(result).toEqual({ orgId: "shared-org", invited: true });
+    // Default stub answers like pre-0.18.9 agent-fs: a bare `{ ok: true }`.
+    expect(result).toEqual({ orgId: "shared-org", invited: true, status: "added" });
     const invite = records.find((r) => r.path === "/orgs/shared-org/members/invite");
     expect(invite?.method).toBe("POST");
     expect(invite?.body).toEqual({ email: "Customer@Example.test", role: "admin" });
@@ -665,7 +749,92 @@ describe("agent-fs provisioning seeder", () => {
 
     const result = await inviteEmailToSharedOrg("customer@example.test", "editor");
 
-    expect(result).toEqual({ orgId: "shared-org", invited: false });
+    expect(result).toEqual({ orgId: "shared-org", invited: false, status: "already_member" });
     expect(records.filter((r) => r.path === "/orgs/shared-org/members/invite")).toEqual([]);
   });
+
+  test("reports an email with an agent-fs account as added, with no accept link", async () => {
+    process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
+    process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
+
+    const records: RequestRecord[] = [];
+    setAgentFsProvisionFetchForTests(
+      createFetchStub(records, {
+        inviteResponse: {
+          ok: true,
+          status: "added",
+          userId: "customer-user",
+          email: "customer@example.test",
+          drives: [{ driveId: "shared-drive", role: "editor" }],
+        },
+      }),
+    );
+
+    const result = await inviteEmailToSharedOrg("customer@example.test", "editor");
+
+    expect(result).toEqual({ orgId: "shared-org", invited: true, status: "added" });
+  });
+
+  test("returns the pending invite and accept link for an email with no agent-fs account", async () => {
+    process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
+    process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
+
+    const token = "a".repeat(43);
+    const records: RequestRecord[] = [];
+    setAgentFsProvisionFetchForTests(
+      createFetchStub(records, {
+        inviteResponse: {
+          ok: true,
+          status: "pending",
+          inviteId: "invite-1",
+          email: "new@example.test",
+          token,
+          expiresAt: "2026-11-03T00:00:00.000Z",
+          drives: [{ driveId: "shared-drive", role: "editor" }],
+          acceptUrl: `https://live.agent-fs.example.test/invite/${token}`,
+        },
+      }),
+    );
+
+    const result = await inviteEmailToSharedOrg("new@example.test", "editor");
+
+    expect(result).toEqual({
+      orgId: "shared-org",
+      invited: true,
+      status: "pending",
+      inviteId: "invite-1",
+      expiresAt: "2026-11-03T00:00:00.000Z",
+      acceptUrl: `https://live.agent-fs.example.test/invite/${token}`,
+    });
+  });
+
+  test("omits acceptUrl on a pending invite when agent-fs has no app URL", async () => {
+    process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
+    process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
+
+    const records: RequestRecord[] = [];
+    setAgentFsProvisionFetchForTests(
+      createFetchStub(records, {
+        inviteResponse: {
+          ok: true,
+          status: "pending",
+          inviteId: "invite-2",
+          email: "new@example.test",
+          token: "b".repeat(43),
+          expiresAt: "2026-11-03T00:00:00.000Z",
+          drives: [],
+        },
+      }),
+    );
+
+    const result = await inviteEmailToSharedOrg("new@example.test", "viewer");
+
+    expect(result).toEqual({
+      orgId: "shared-org",
+      invited: true,
+      status: "pending",
+      inviteId: "invite-2",
+      expiresAt: "2026-11-03T00:00:00.000Z",
+    });
+  });
 });