@indigoai-us/hq-cli 5.47.6 → 5.47.8

package/src/commands/files-browse.test.ts

@@ -42,11 +42,13 @@ import {
   pinFilePath,
   runSharedWithMe,
   formatSharedWithMeTable,
+  createCompanyPresignClient,
   type BrowseVendResult,
   type FilesBrowseS3Client,
   type FilesBrowseVaultClient,
   type FilesSharedWithMeVaultClient,
   type S3ClientFactory,
+  type CompanyBrowseClientFactory,
 } from "./files-browse.js";
 import type { ExplicitGrant } from "@indigoai-us/hq-cloud";
 import {
@@ -143,6 +145,14 @@ interface StubS3Opts {
 
 function makeStubS3Factory(opts: StubS3Opts): {
   factory: S3ClientFactory;
+  /**
+   * The SAME stub typed as a company-mode client factory. Company browse/cat/
+   * get/search now inject `companyClient` (the presign/list seam) instead of
+   * `s3Factory`; the stub ignores its factory arg either way, so one stub
+   * serves both. Personal-mode tests use `factory`; company-mode tests use
+   * `companyFactory`.
+   */
+  companyFactory: CompanyBrowseClientFactory;
   sendSpy: ReturnType<typeof vi.fn>;
   factorySpy: ReturnType<typeof vi.fn>;
 } {
@@ -163,7 +173,12 @@ function makeStubS3Factory(opts: StubS3Opts): {
         send: sendSpy,
       }) as unknown as FilesBrowseS3Client,
   );
-  return { factory: factorySpy as unknown as S3ClientFactory, sendSpy, factorySpy };
+  return {
+    factory: factorySpy as unknown as S3ClientFactory,
+    companyFactory: factorySpy as unknown as CompanyBrowseClientFactory,
+    sendSpy,
+    factorySpy,
+  };
 }
 
 // ── parseCompanySlugFromPath ────────────────────────────────────────────────
@@ -359,22 +374,22 @@ describe("formatBrowseTable", () => {
 // ── runBrowse ───────────────────────────────────────────────────────────────
 
 describe("runBrowse", () => {
-  it("vends via /sts/vend (company) and lists the company-relative prefix", async () => {
+  it("company mode lists via the presign/list client (no STS vend) on the company-relative prefix", async () => {
     const { client, spies } = makeStubVaultClient({});
-    const { factory, sendSpy } = makeStubS3Factory({
+    const { companyFactory, sendSpy } = makeStubS3Factory({
       listResponses: [{ Contents: [] }],
     });
     await runBrowse({
       pathPrefix: "companies/indigo/scratch/",
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
     });
-    // Vend through the multi-tenant STS route — NOT the legacy POST /vend.
-    expect(spies.stsVend).toHaveBeenCalledTimes(1);
-    expect(spies.stsVend.mock.calls[0][0]).toEqual({ companyUid: "cmp_indigo" });
+    // HQ-59: company browse no longer vends STS creds — it goes through the
+    // server-side list API, so NEITHER vend route is touched.
+    expect(spies.stsVend).not.toHaveBeenCalled();
     expect(spies.vendSelf).not.toHaveBeenCalled();
-    // S3 list prefix is company-relative (the bug: was anchored → 0 results).
+    // List prefix is company-relative (the bug: was anchored → 0 results).
     const listCmd = sendSpy.mock.calls[0][0] as ListObjectsV2Command;
     expect(listCmd.input.Prefix).toBe("scratch/");
   });
@@ -384,8 +399,8 @@ describe("runBrowse", () => {
       // Real grants are glob/anchored; normalization folds this to "scratch/".
       grants: [fakeGrant("companies/indigo/scratch/*")],
     });
-    const { factory, sendSpy } = makeStubS3Factory({
-      // S3 keys are company-relative (no companies/<slug>/ prefix).
+    const { companyFactory, sendSpy } = makeStubS3Factory({
+      // List objects are company-relative (no companies/<slug>/ prefix).
       listResponses: [
         {
           Contents: [
@@ -422,7 +437,7 @@ describe("runBrowse", () => {
     const result = await runBrowse({
       pathPrefix: "companies/indigo/scratch/",
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
     });
     expect(sendSpy).toHaveBeenCalledTimes(2); // pagination
@@ -600,9 +615,9 @@ describe("runBrowse", () => {
 // ── runCat ──────────────────────────────────────────────────────────────────
 
 describe("runCat", () => {
-  it("vends via /sts/vend and GetObjects the company-relative key", async () => {
+  it("company mode fetches the company-relative key via presign (no STS vend)", async () => {
     const { client, spies } = makeStubVaultClient({});
-    const { factory, sendSpy } = makeStubS3Factory({
+    const { companyFactory, sendSpy } = makeStubS3Factory({
       getResponse: {
         Body: Readable.from(Buffer.from("hello world")),
       } as GetObjectCommandOutput,
@@ -612,25 +627,25 @@ describe("runCat", () => {
     await runCat({
       key: "companies/indigo/scratch/a.txt",
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
       hqRoot: tmpRoot,
       stdout: sink,
     });
-    expect(spies.stsVend).toHaveBeenCalledTimes(1);
-    expect(spies.stsVend.mock.calls[0][0]).toEqual({ companyUid: "cmp_indigo" });
+    // HQ-59: company cat goes through the presign API — no STS vend.
+    expect(spies.stsVend).not.toHaveBeenCalled();
+    expect(spies.vendSelf).not.toHaveBeenCalled();
     // GetObject key is company-relative (anchor stripped).
     const getCmd = sendSpy.mock.calls.find(
       (c) => c[0] instanceof GetObjectCommand,
     )?.[0] as GetObjectCommand;
-    expect(getCmd.input.Bucket).toBe("hq-vault-cmp-indigo");
     expect(getCmd.input.Key).toBe("scratch/a.txt");
   });
 
   it("writes to --out when outside the companies tree and reports byte count", async () => {
     const { client } = makeStubVaultClient({});
     const payload = Buffer.from("safe-payload");
-    const { factory } = makeStubS3Factory({
+    const { companyFactory } = makeStubS3Factory({
       getResponse: {
         Body: Readable.from(payload),
       } as GetObjectCommandOutput,
@@ -640,7 +655,7 @@ describe("runCat", () => {
       key: "companies/indigo/scratch/a.txt",
       out: outFile,
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
       hqRoot: tmpRoot,
     });
@@ -651,7 +666,7 @@ describe("runCat", () => {
 
   it("refuses --out under <hqRoot>/companies/ BEFORE vending (no leak)", async () => {
     const { client, spies } = makeStubVaultClient({});
-    const { factory, sendSpy } = makeStubS3Factory({
+    const { companyFactory, sendSpy } = makeStubS3Factory({
       getResponse: { Body: Readable.from(Buffer.from("nope")) } as GetObjectCommandOutput,
     });
     const badOut = path.join(tmpRoot, "companies", "indigo", "leaked.txt");
@@ -660,13 +675,13 @@ describe("runCat", () => {
         key: "companies/indigo/scratch/a.txt",
         out: badOut,
         vaultClient: client,
-        s3Factory: factory,
+        companyClient: companyFactory,
         region: "us-east-1",
         hqRoot: tmpRoot,
       }),
     ).rejects.toThrow(/Refusing to write/);
-    // Critically: no vend was issued (guard runs first) and no S3 call
-    // was made — failing closed is the whole point of the guard.
+    // Critically: the guard runs FIRST — no vend, and no list/presign/S3 call
+    // was made. Failing closed is the whole point of the guard.
     expect(spies.stsVend).not.toHaveBeenCalled();
     expect(spies.vendSelf).not.toHaveBeenCalled();
     expect(sendSpy).not.toHaveBeenCalled();
@@ -843,7 +858,7 @@ describe("runSharedWithMe", () => {
 describe("runSearch", () => {
   it("filters the company listing by case-insensitive substring on the key", async () => {
     const { client, spies } = makeStubVaultClient({});
-    const { factory } = makeStubS3Factory({
+    const { companyFactory } = makeStubS3Factory({
       listResponses: [
         {
           Contents: [
@@ -858,20 +873,21 @@ describe("runSearch", () => {
       query: "roadmap", // lower-case query matches mixed-case key
       companySlug: "indigo",
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
     });
     // Keys are re-anchored for display; only the matching one survives.
     expect(rows.map((r) => r.key)).toEqual([
       "companies/indigo/knowledge/Roadmap.md",
     ]);
-    // Vends via the multi-tenant route (inherited from runBrowse).
-    expect(spies.stsVend).toHaveBeenCalledTimes(1);
+    // HQ-59: search lists via the presign/list API (inherited from runBrowse) —
+    // no STS vend.
+    expect(spies.stsVend).not.toHaveBeenCalled();
   });
 
   it("returns an empty array when nothing matches", async () => {
     const { client } = makeStubVaultClient({});
-    const { factory } = makeStubS3Factory({
+    const { companyFactory } = makeStubS3Factory({
       listResponses: [
         { Contents: [{ Key: "knowledge/a.md", Size: 1, LastModified: new Date() }] },
       ],
@@ -880,7 +896,7 @@ describe("runSearch", () => {
       query: "zzz-no-match",
       companySlug: "indigo",
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
     });
     expect(rows).toEqual([]);
@@ -922,7 +938,7 @@ describe("pin set", () => {
 function makeGetStubS3(opts: {
   listKeys: Array<{ Key: string; Size: number }>;
   bodyFor: (key: string) => Buffer;
-}): { factory: S3ClientFactory; sendSpy: ReturnType<typeof vi.fn> } {
+}): { companyFactory: CompanyBrowseClientFactory; sendSpy: ReturnType<typeof vi.fn> } {
   const sendSpy = vi.fn(async (cmd: unknown) => {
     if (cmd instanceof ListObjectsV2Command) {
       return {
@@ -937,16 +953,17 @@ function makeGetStubS3(opts: {
     }
     throw new Error(`unexpected command: ${cmd}`);
   });
-  const factory = vi.fn(
+  // `get` is company-only now, so the stub is the presign/list seam.
+  const companyFactory = vi.fn(
     () => ({ send: sendSpy }) as unknown as FilesBrowseS3Client,
-  ) as unknown as S3ClientFactory;
-  return { factory, sendSpy };
+  ) as unknown as CompanyBrowseClientFactory;
+  return { companyFactory, sendSpy };
 }
 
 describe("runGet", () => {
   it("materializes a prefix in-place under companies/<slug>/ and registers a pin", async () => {
     const { client, spies } = makeStubVaultClient({});
-    const { factory, sendSpy } = makeGetStubS3({
+    const { companyFactory, sendSpy } = makeGetStubS3({
       listKeys: [
         { Key: "knowledge/a.md", Size: 3 },
         { Key: "knowledge/sub/b.md", Size: 3 },
@@ -959,12 +976,12 @@ describe("runGet", () => {
       hqRoot: tmpRoot,
       companySlug: "indigo",
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
     });
 
-    // Vends via the multi-tenant company route.
-    expect(spies.stsVend).toHaveBeenCalledWith({ companyUid: "cmp_indigo" });
+    // HQ-59: get materializes through the presign/list API — no STS vend.
+    expect(spies.stsVend).not.toHaveBeenCalled();
     expect(result.filesWritten).toBe(2);
 
     // Files landed in place under companies/<slug>/.
@@ -995,7 +1012,7 @@ describe("runGet", () => {
   it("--into writes outside companies/ and registers NO pin", async () => {
     const into = path.join(tmpRoot, "extract");
     const { client } = makeStubVaultClient({});
-    const { factory } = makeGetStubS3({
+    const { companyFactory } = makeGetStubS3({
       listKeys: [{ Key: "knowledge/a.md", Size: 3 }],
       bodyFor: () => Buffer.from("AAA"),
     });
@@ -1006,7 +1023,7 @@ describe("runGet", () => {
       hqRoot: tmpRoot,
       companySlug: "indigo",
       vaultClient: client,
-      s3Factory: factory,
+      companyClient: companyFactory,
       region: "us-east-1",
     });
 
@@ -1019,7 +1036,7 @@ describe("runGet", () => {
 
   it("throws when no objects exist under the path", async () => {
     const { client } = makeStubVaultClient({});
-    const { factory } = makeGetStubS3({
+    const { companyFactory } = makeGetStubS3({
       listKeys: [],
       bodyFor: () => Buffer.from(""),
     });
@@ -1029,7 +1046,7 @@ describe("runGet", () => {
         hqRoot: tmpRoot,
         companySlug: "indigo",
         vaultClient: client,
-        s3Factory: factory,
+        companyClient: companyFactory,
         region: "us-east-1",
       }),
     ).rejects.toThrow(/No objects under/);
@@ -1083,3 +1100,150 @@ describe("--company parent binding (optsWithGlobals)", () => {
     expect(local).toBeUndefined();
   });
 });
+
+// ── createCompanyPresignClient (HQ-59 list/presign translation) ─────────────
+//
+// The company-mode browse client. Verifies it translates the S3-shaped
+// commands the orchestrators issue into the server-side list/presign API:
+//   - ListObjectsV2Command → GET  /v1/files/list  (company-relative objects)
+//   - GetObjectCommand     → POST /v1/files/presign → fetch(url) → Body
+// fetch is the single network seam (vaultApiFetch uses it; the presigned
+// download uses it), so we spy on globalThis.fetch and route by URL.
+
+describe("createCompanyPresignClient", () => {
+  let fetchSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    fetchSpy = vi.spyOn(globalThis, "fetch");
+  });
+  afterEach(() => {
+    fetchSpy.mockRestore();
+  });
+
+  function json(status: number, body: unknown): Response {
+    return new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    });
+  }
+
+  it("ListObjectsV2 → GET /v1/files/list, mapping objects + cursor onto the S3 shape", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      json(200, {
+        prefix: "scratch/",
+        objects: [
+          {
+            key: "scratch/a.txt",
+            size: 12,
+            lastModified: "2026-01-01T00:00:00.000Z",
+            etag: "abc123",
+            permission: "read",
+          },
+        ],
+        cursor: "next-page",
+        truncated: true,
+      }),
+    );
+
+    const client = createCompanyPresignClient({ token: "tok", companyUid: "cmp_indigo" });
+    const out = await client.send(
+      new ListObjectsV2Command({
+        Bucket: "ignored",
+        Prefix: "scratch/",
+        ContinuationToken: undefined,
+      }),
+    );
+
+    // Request: GET to /v1/files/list with company + prefix query, bearer token.
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/v1/files/list");
+    expect(String(url)).toContain("company=cmp_indigo");
+    expect(String(url)).toContain("prefix=scratch%2F");
+    expect((init?.headers as Record<string, string>).Authorization).toBe("Bearer tok");
+
+    // Response mapped onto the ListObjectsV2 shape the orchestrators read.
+    expect(out.Contents).toHaveLength(1);
+    expect(out.Contents?.[0].Key).toBe("scratch/a.txt");
+    expect(out.Contents?.[0].Size).toBe(12);
+    expect(out.Contents?.[0].ETag).toBe('"abc123"');
+    expect(out.Contents?.[0].LastModified?.toISOString()).toBe("2026-01-01T00:00:00.000Z");
+    expect(out.NextContinuationToken).toBe("next-page");
+    expect(out.IsTruncated).toBe(true);
+  });
+
+  it("ListObjectsV2 forwards the ContinuationToken as the cursor query param", async () => {
+    fetchSpy.mockResolvedValueOnce(json(200, { objects: [], cursor: null, truncated: false }));
+    const client = createCompanyPresignClient({ token: "tok", companyUid: "cmp_indigo" });
+    await client.send(new ListObjectsV2Command({ Bucket: "b", Prefix: "k/", ContinuationToken: "page2" }));
+    expect(String(fetchSpy.mock.calls[0][0])).toContain("cursor=page2");
+  });
+
+  it("ListObjectsV2 throws on a non-2xx list response", async () => {
+    fetchSpy.mockResolvedValueOnce(json(403, { error: "Forbidden", code: "X" }));
+    const client = createCompanyPresignClient({ token: "tok", companyUid: "cmp_indigo" });
+    await expect(
+      client.send(new ListObjectsV2Command({ Bucket: "b", Prefix: "k/" })),
+    ).rejects.toThrow(/Forbidden/);
+  });
+
+  it("GetObject → POST /v1/files/presign then fetches the URL and returns a Body", async () => {
+    // 1) presign POST → returns a URL; 2) the URL fetch → returns the bytes.
+    fetchSpy
+      .mockResolvedValueOnce(
+        json(200, { results: [{ key: "scratch/a.txt", op: "get", url: "https://s3.example/presigned" }] }),
+      )
+      .mockResolvedValueOnce(new Response("file-bytes-here", { status: 200 }));
+
+    const client = createCompanyPresignClient({ token: "tok", companyUid: "cmp_indigo" });
+    const out = await client.send(
+      new GetObjectCommand({ Bucket: "ignored", Key: "scratch/a.txt" }),
+    );
+
+    // First call: POST presign with the right body.
+    const [presignUrl, presignInit] = fetchSpy.mock.calls[0];
+    expect(String(presignUrl)).toContain("/v1/files/presign");
+    expect(presignInit?.method).toBe("POST");
+    expect(JSON.parse(presignInit?.body as string)).toEqual({
+      company: "cmp_indigo",
+      key: "scratch/a.txt",
+      op: "get",
+    });
+    // Second call: fetch the presigned URL.
+    expect(String(fetchSpy.mock.calls[1][0])).toBe("https://s3.example/presigned");
+
+    // Body is a readable stream of the downloaded bytes.
+    const chunks: Buffer[] = [];
+    for await (const c of out.Body as unknown as AsyncIterable<Buffer>) {
+      chunks.push(Buffer.from(c));
+    }
+    expect(Buffer.concat(chunks).toString("utf-8")).toBe("file-bytes-here");
+  });
+
+  it("GetObject throws the per-key error when presign denies the key (no URL)", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      json(200, {
+        results: [
+          { key: "secret/x", op: "get", error: "Caller lacks read permission on 'secret/x'", code: "FILES_PRESIGN_FORBIDDEN" },
+        ],
+      }),
+    );
+    const client = createCompanyPresignClient({ token: "tok", companyUid: "cmp_indigo" });
+    await expect(
+      client.send(new GetObjectCommand({ Bucket: "b", Key: "secret/x" })),
+    ).rejects.toThrow(/lacks read permission/);
+    // The denial short-circuits BEFORE any download fetch.
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("GetObject throws when the presigned download itself fails", async () => {
+    fetchSpy
+      .mockResolvedValueOnce(
+        json(200, { results: [{ key: "k", op: "get", url: "https://s3.example/x" }] }),
+      )
+      .mockResolvedValueOnce(new Response("nope", { status: 500 }));
+    const client = createCompanyPresignClient({ token: "tok", companyUid: "cmp_indigo" });
+    await expect(
+      client.send(new GetObjectCommand({ Bucket: "b", Key: "k" })),
+    ).rejects.toThrow(/Failed to download 'k'/);
+  });
+});