@memberjunction/server 6.2.0-edge.1 → 6.2.0-edge.3

package/src/__tests__/MeetingResolver.test.ts

@@ -0,0 +1,374 @@
+import 'reflect-metadata';
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import type {
+  MJMeetingEntity,
+  MJMeetingParticipantEntity,
+  MJPhoneNumberEntity,
+  MJInteractionEntity,
+  MJInteractionEventEntity,
+} from '@memberjunction/core-entities';
+
+const mocks = vi.hoisted(() => ({
+  mintClientToken: vi.fn(async (roomName: string, identity: string, name?: string) => ({
+    Token: `token-for-${roomName}-${identity}`,
+    Identity: identity,
+    ServerUrl: 'wss://livekit.example.com',
+  })),
+  startAgentRoomSession: vi.fn(async () => ({
+    SessionBridgeID: 'bridge-123',
+    RoomName: 'room-123',
+  })),
+  stopAllAgentsInRoom: vi.fn(async () => undefined),
+  startRoomRecording: vi.fn(async (params: { RoomName: string }) => ({
+    EgressID: 'egress-456',
+    RoomName: params.RoomName,
+    Status: 'EGRESS_STARTING',
+  })),
+  stopRecording: vi.fn(async (egressID: string) => ({
+    EgressID: egressID,
+    RoomName: 'room-123',
+    Status: 'EGRESS_COMPLETE',
+  })),
+  sendNotification: vi.fn(async () => ({ success: true })),
+  notificationConfig: vi.fn(async () => undefined),
+  createSession: vi.fn(async () => ({ ID: 'agent-session-789' })),
+}));
+
+vi.mock('@memberjunction/livekit-room-server', () => ({
+  LiveKitTokenService: class {
+    MintClientToken = mocks.mintClientToken;
+  },
+  LiveKitAgentRoomCoordinator: {
+    Instance: {
+      StartAgentRoomSession: mocks.startAgentRoomSession,
+      StopAllAgentsInRoom: mocks.stopAllAgentsInRoom,
+    },
+  },
+  LiveKitEgressService: class {
+    StartRoomRecording = mocks.startRoomRecording;
+    StopRecording = mocks.stopRecording;
+  },
+  LiveKitUserIdentity: (id: string) => `user_${id.toLowerCase()}`,
+}));
+
+vi.mock('@memberjunction/notifications', () => ({
+  NotificationEngine: {
+    Instance: {
+      Config: mocks.notificationConfig,
+      SendNotification: mocks.sendNotification,
+    },
+  },
+}));
+
+import {
+  MeetingResolver,
+  type CreateMeetingInput,
+  type UpdateMeetingInput,
+  type RSVPMeetingInput,
+} from '../resolvers/MeetingResolver.js';
+import type { AppContext } from '../types.js';
+
+class MockEntityBase {
+  public ID: string = `mock-${Date.now()}-${Math.random()}`;
+  public LatestResult?: { CompleteMessage?: string };
+  public async Save(): Promise<boolean> {
+    return true;
+  }
+}
+
+class MockMeetingEntity extends MockEntityBase {
+  public Title: string = '';
+  public Description: string | null = null;
+  public HostUserID: string = '';
+  public HostUser: string = 'Host User';
+  public RoomName: string = '';
+  public Status: MJMeetingEntity['Status'] = 'Scheduled';
+  public ScheduledStartAt: Date | null = null;
+  public ScheduledEndAt: Date | null = null;
+  public StartedAt: Date | null = null;
+  public EndedAt: Date | null = null;
+  public AllowPhoneDialIn: boolean = false;
+  public DialInPhoneNumberID: string | null = null;
+  public DialInCode: string | null = null;
+  public RecordingPolicy: MJMeetingEntity['RecordingPolicy'] = 'Off';
+  public ConversationID: string | null = null;
+  public __mj_CreatedAt: Date = new Date();
+  public __mj_UpdatedAt: Date = new Date();
+}
+
+class MockMeetingParticipantEntity extends MockEntityBase {
+  public MeetingID: string = '';
+  public UserID: string | null = null;
+  public User: string | null = null;
+  public AgentID: string | null = null;
+  public Agent: string | null = null;
+  public ExternalName: string | null = null;
+  public ExternalEmail: string | null = null;
+  public ExternalPhone: string | null = null;
+  public Role: MJMeetingParticipantEntity['Role'] = 'Attendee';
+  public InviteStatus: MJMeetingParticipantEntity['InviteStatus'] = 'Invited';
+  public JoinedAt: Date | null = null;
+  public LeftAt: Date | null = null;
+}
+
+class MockPhoneNumberEntity extends MockEntityBase {
+  public Number: string = '+15551234567';
+  public Status: MJPhoneNumberEntity['Status'] = 'Active';
+  public Label: string | null = 'Main Dial-In';
+  public __mj_CreatedAt: Date = new Date();
+}
+
+class MockInteractionEntity extends MockEntityBase {
+  public Channel: MJInteractionEntity['Channel'] = 'Meeting';
+  public Direction: MJInteractionEntity['Direction'] = 'Inbound';
+  public Status: MJInteractionEntity['Status'] = 'Active';
+  public RoomName: string | null = null;
+  public StartedAt: Date = new Date();
+  public AnsweredAt: Date | null = new Date();
+  public EndedAt: Date | null = null;
+  public RecordingEnabled: boolean = false;
+}
+
+class MockInteractionEventEntity extends MockEntityBase {
+  public InteractionID: string = '';
+  public EventType: MJInteractionEventEntity['EventType'] = 'Created';
+  public ActorUserID: string | null = null;
+  public OccurredAt: Date = new Date();
+  public Details: string | null = null;
+}
+
+class TestableMeetingResolver extends MeetingResolver {
+  public user: UserInfo | undefined = { ID: 'user-host-1', Name: 'Alice Host', Email: 'alice@example.com' } as unknown as UserInfo;
+
+  public mockMeetings: MockMeetingEntity[] = [];
+  public mockParticipants: MockMeetingParticipantEntity[] = [];
+  public mockPhoneNumbers: MockPhoneNumberEntity[] = [];
+  public mockInteractions: MockInteractionEntity[] = [];
+  public mockEvents: MockInteractionEventEntity[] = [];
+
+  protected override GetUserFromPayload(): UserInfo | undefined {
+    return this.user;
+  }
+
+  public getMockProvider(): IMetadataProvider {
+    return {
+      RunView: async () => ({ Success: true, Results: [] }),
+      GetEntityObject: async <T>(entityName: string) => {
+        if (entityName === 'MJ: Meetings') {
+          const m = new MockMeetingEntity() as unknown as T;
+          this.mockMeetings.push(m as unknown as MockMeetingEntity);
+          return m;
+        }
+        if (entityName === 'MJ: Meeting Participants') {
+          const p = new MockMeetingParticipantEntity() as unknown as T;
+          this.mockParticipants.push(p as unknown as MockMeetingParticipantEntity);
+          return p;
+        }
+        if (entityName === 'MJ: Interactions') {
+          const i = new MockInteractionEntity() as unknown as T;
+          this.mockInteractions.push(i as unknown as MockInteractionEntity);
+          return i;
+        }
+        if (entityName === 'MJ: Interaction Events') {
+          const e = new MockInteractionEventEntity() as unknown as T;
+          this.mockEvents.push(e as unknown as MockInteractionEventEntity);
+          return e;
+        }
+        throw new Error(`Unknown entity: ${entityName}`);
+      },
+    } as unknown as IMetadataProvider;
+  }
+}
+
+describe('MeetingResolver', () => {
+  let resolver: TestableMeetingResolver;
+  let mockProvider: IMetadataProvider;
+  let ctx: AppContext;
+
+  beforeEach(() => {
+    resolver = new TestableMeetingResolver();
+    mockProvider = resolver.getMockProvider();
+    ctx = {
+      providers: [{ type: 'Read-Write', provider: mockProvider }],
+    } as unknown as AppContext;
+    mocks.mintClientToken.mockClear();
+    mocks.startAgentRoomSession.mockClear();
+    mocks.stopAllAgentsInRoom.mockClear();
+    mocks.startRoomRecording.mockClear();
+    mocks.sendNotification.mockClear();
+  });
+
+  describe('CreateMeeting', () => {
+    it('creates a scheduled meeting with generated unguessable room name and adds host participant', async () => {
+      const input: CreateMeetingInput = {
+        Title: 'Sprint Planning',
+        Description: 'Bi-weekly sprint planning meeting',
+        ScheduledStartAt: new Date(Date.now() + 3600000),
+        ScheduledEndAt: new Date(Date.now() + 7200000),
+        Participants: [
+          { UserID: 'user-guest-2', Role: 'Attendee' },
+          { AgentID: 'agent-bot-1', Role: 'Agent' },
+        ],
+      };
+
+      const result = await resolver.CreateMeeting(input, ctx);
+      expect(result.Success).toBe(true);
+      expect(result.Meeting).toBeDefined();
+      expect(result.Meeting?.Title).toBe('Sprint Planning');
+      expect(result.Meeting?.RoomName).toMatch(/^mj-mtg-[a-f0-9-]+$/);
+      expect(result.Meeting?.Status).toBe('Scheduled');
+      expect(result.Meeting?.HostUserID).toBe('user-host-1');
+
+      // Verify participants were created: host + 2 invitees
+      expect(resolver.mockParticipants.length).toBe(3);
+      const hostPart = resolver.mockParticipants.find((p) => p.UserID === 'user-host-1');
+      expect(hostPart).toBeDefined();
+      expect(hostPart?.Role).toBe('Host');
+      expect(hostPart?.InviteStatus).toBe('Accepted');
+
+      const agentPart = resolver.mockParticipants.find((p) => p.AgentID === 'agent-bot-1');
+      expect(agentPart).toBeDefined();
+      expect(agentPart?.Role).toBe('Agent');
+
+      // Notification sent to invited user
+      expect(mocks.sendNotification).toHaveBeenCalled();
+    });
+
+    it('validates required title', async () => {
+      const result = await resolver.CreateMeeting({ Title: '   ' }, ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toContain('title is required');
+    });
+
+    it('validates scheduled end time is after scheduled start time', async () => {
+      const start = new Date(Date.now() + 7200000);
+      const end = new Date(Date.now() + 3600000);
+      const result = await resolver.CreateMeeting({ Title: 'Invalid Times', ScheduledStartAt: start, ScheduledEndAt: end }, ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toContain('must be after');
+    });
+  });
+
+  describe('UpdateMeeting authorization and validation', () => {
+    it('refuses update from non-host/co-host users', async () => {
+      // Mock existing meeting where HostUserID is different
+      const m = new MockMeetingEntity();
+      m.ID = 'mtg-existing-1';
+      m.HostUserID = 'other-user';
+      m.Title = 'Existing';
+      resolver.mockMeetings.push(m);
+
+      // Spy on loadMeetingEntity and isUserHostOrCoHost
+      vi.spyOn(resolver as unknown as { loadMeetingEntity: Function }, 'loadMeetingEntity').mockResolvedValue(m);
+      vi.spyOn(resolver as unknown as { isUserHostOrCoHost: Function }, 'isUserHostOrCoHost').mockResolvedValue(false);
+
+      const updateInput: UpdateMeetingInput = {
+        MeetingID: 'mtg-existing-1',
+        Title: 'Hacked Title',
+      };
+
+      const result = await resolver.UpdateMeeting(updateInput, ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toContain('Unauthorized');
+    });
+
+    it('allows host to update title and details', async () => {
+      const m = new MockMeetingEntity();
+      m.ID = 'mtg-existing-1';
+      m.HostUserID = 'user-host-1';
+      m.Title = 'Old Title';
+      resolver.mockMeetings.push(m);
+
+      vi.spyOn(resolver as unknown as { loadMeetingEntity: Function }, 'loadMeetingEntity').mockResolvedValue(m);
+      vi.spyOn(resolver as unknown as { isUserHostOrCoHost: Function }, 'isUserHostOrCoHost').mockResolvedValue(true);
+      vi.spyOn(resolver as unknown as { loadParticipants: Function }, 'loadParticipants').mockResolvedValue([]);
+
+      const updateInput: UpdateMeetingInput = {
+        MeetingID: 'mtg-existing-1',
+        Title: 'Updated Title',
+        Description: 'New agenda',
+      };
+
+      const result = await resolver.UpdateMeeting(updateInput, ctx);
+      expect(result.Success).toBe(true);
+      expect(m.Title).toBe('Updated Title');
+      expect(m.Description).toBe('New agenda');
+    });
+  });
+
+  describe('StartMeeting and EndMeeting lifecycle', () => {
+    it('starts meeting, creates interaction, spins up agent participants, and mints token', async () => {
+      const m = new MockMeetingEntity();
+      m.ID = 'mtg-live-1';
+      m.HostUserID = 'user-host-1';
+      m.Title = 'Team Standup';
+      m.RoomName = 'mj-mtg-standup-1';
+      m.Status = 'Scheduled';
+      m.RecordingPolicy = 'Automatic';
+      resolver.mockMeetings.push(m);
+
+      const agentPart = new MockMeetingParticipantEntity();
+      agentPart.Role = 'Agent';
+      agentPart.AgentID = 'agent-co-1';
+
+      vi.spyOn(resolver as unknown as { loadMeetingEntity: Function }, 'loadMeetingEntity').mockResolvedValue(m);
+      vi.spyOn(resolver as unknown as { isUserHostOrCoHost: Function }, 'isUserHostOrCoHost').mockResolvedValue(true);
+      vi.spyOn(resolver as unknown as { loadParticipants: Function }, 'loadParticipants').mockResolvedValue([
+        { ID: 'p-1', MeetingID: m.ID, Role: 'Agent', AgentID: 'agent-co-1', InviteStatus: 'Accepted' },
+      ]);
+      vi.spyOn((resolver as unknown as { sessionManager: { CreateSession: Function } }).sessionManager, 'CreateSession').mockResolvedValue({
+        ID: 'agent-session-789',
+      });
+
+      const result = await resolver.StartMeeting(m.ID, ctx);
+      expect(result.Success).toBe(true);
+      expect(result.RoomName).toBe('mj-mtg-standup-1');
+      expect(result.ClientToken).toBeDefined();
+      expect(m.Status).toBe('Live');
+      expect(m.StartedAt).toBeDefined();
+
+      // Check agent session coordinator was called
+      expect(mocks.startAgentRoomSession).toHaveBeenCalledWith(
+        expect.objectContaining({
+          RoomName: 'mj-mtg-standup-1',
+          AgentID: 'agent-co-1',
+        }),
+      );
+
+      // Check automatic recording initiated
+      expect(mocks.startRoomRecording).toHaveBeenCalledWith({ RoomName: 'mj-mtg-standup-1' });
+
+      // Check client token minted
+      expect(mocks.mintClientToken).toHaveBeenCalled();
+    });
+
+    it('ends meeting, stops agents in room, and marks status Ended', async () => {
+      const m = new MockMeetingEntity();
+      m.ID = 'mtg-live-1';
+      m.HostUserID = 'user-host-1';
+      m.RoomName = 'mj-mtg-standup-1';
+      m.Status = 'Live';
+      resolver.mockMeetings.push(m);
+
+      vi.spyOn(resolver as unknown as { loadMeetingEntity: Function }, 'loadMeetingEntity').mockResolvedValue(m);
+      vi.spyOn(resolver as unknown as { isUserHostOrCoHost: Function }, 'isUserHostOrCoHost').mockResolvedValue(true);
+      vi.spyOn(resolver as unknown as { loadParticipants: Function }, 'loadParticipants').mockResolvedValue([]);
+
+      const result = await resolver.EndMeeting(m.ID, ctx);
+      expect(result.Success).toBe(true);
+      expect(m.Status).toBe('Ended');
+      expect(m.EndedAt).toBeDefined();
+      expect(mocks.stopAllAgentsInRoom).toHaveBeenCalledWith('mj-mtg-standup-1', 'Explicit', resolver.user, mockProvider);
+    });
+  });
+
+  describe('RSVPMeeting', () => {
+    it('validates RSVP response values', async () => {
+      const result = await resolver.RSVPMeeting({ MeetingID: 'mtg-1', InviteStatus: 'Maybe' }, ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toContain('Invalid RSVP status');
+    });
+  });
+});

package/src/__tests__/RealtimeBridgeResolver.test.ts

@@ -13,8 +13,17 @@ const h = vi.hoisted(() => ({
     Identity: identity,
     RoomName: room,
   })),
+  startAgentRoomSession: vi.fn(async () => ({ SessionBridgeID: 'bridge-std', RoomName: 'room-std', ServerUrl: 'wss://x.livekit.cloud' })),
+  handoffDeps: { AgentStarter: undefined as undefined | ((req: Record<string, unknown>) => Promise<{ SessionBridgeID: string }>) },
   startRecording: vi.fn(async () => ({ EgressID: 'eg-1', RoomName: 'room-1', Status: 'EGRESS_ACTIVE' })),
+  getRoomTurnState: vi.fn((room: string): unknown => (room === 'busy-room' ? { RoomId: room, Agents: [] } : null)),
+  setTurnToolBinder: vi.fn(),
+  getBridgeRuntime: vi.fn(),
   stopRecording: vi.fn(async () => ({ EgressID: 'eg-1', RoomName: 'room-1', Status: 'EGRESS_COMPLETE' })),
+  getRoomForEgress: vi.fn(async (_id: string): Promise<string | undefined> => 'room-1'),
+  stopAgentRoomSession: vi.fn(async () => true),
+  stopAllAgentsInRoom: vi.fn(async () => 1),
+  getRoomForBridge: vi.fn((_id: string): string | undefined => 'room-1'),
 }));
 
 // These two are instantiated with `new` by the resolver, so they must be constructible. They were
@@ -25,11 +34,40 @@ vi.mock('@memberjunction/livekit-room-server', () => ({
     MintClientToken = h.mintClientToken;
   },
   // SetSessionFactory is exercised by the resolver's module-load binding of the realtime-session factory.
-  LiveKitAgentRoomCoordinator: { Instance: { StartAgentRoomSession: vi.fn(), SetSessionFactory: vi.fn() } },
+  LiveKitAgentRoomCoordinator: {
+    Instance: {
+      StartAgentRoomSession: h.startAgentRoomSession,
+      SetSessionFactory: vi.fn(),
+      SetTurnToolBinder: h.setTurnToolBinder,
+      GetRoomTurnState: h.getRoomTurnState,
+      StopAgentRoomSession: h.stopAgentRoomSession,
+      StopAllAgentsInRoom: h.stopAllAgentsInRoom,
+      GetRoomForBridge: h.getRoomForBridge,
+    },
+  },
+  LiveKitUserIdentity: (id: string) => `user-${id}`.toLowerCase(),
+  RoomHandoffEngine: { Instance: { Deps: h.handoffDeps } },
   LiveKitEgressService: class {
     StartRoomRecording = h.startRecording;
     StopRecording = h.stopRecording;
+    GetRoomForEgress = h.getRoomForEgress;
   },
+  RoomAuthorizationService: (() => {
+    let testAuthorizer: ((roomName: string, user: unknown, provider?: unknown) => Promise<{ Authorized: boolean; Reason?: string }>) | undefined = undefined;
+    return {
+      Instance: {
+        AuthorizeRoomAccess: vi.fn(async (roomName: string, user: unknown, provider?: unknown) => {
+          if (testAuthorizer) {
+            return await testAuthorizer(roomName, user, provider);
+          }
+          return { Authorized: true };
+        }),
+        SetAuthorizerForTesting: vi.fn((fn?: (roomName: string, user: unknown, provider?: unknown) => Promise<{ Authorized: boolean; Reason?: string }>) => {
+          testAuthorizer = fn;
+        }),
+      },
+    };
+  })(),
 }));
 
 // Mock the agent factory so importing the resolver doesn't pull the heavy @memberjunction/ai-agents graph
@@ -39,6 +77,7 @@ vi.mock('@memberjunction/ai-agents', () => ({
   FinalizeBridgeCoAgentRuns: vi.fn(),
   GetRealtimeModelVoices: vi.fn(),
   CreateBridgeRoomTranscriptSink: vi.fn(),
+  GetBridgeRealtimeRuntime: h.getBridgeRuntime,
   // SessionManager's constructor defaults to `new RealtimeClientSessionService()` when this resolver
   // doesn't inject one (it never finalizes client-direct co-agent runs itself) — the mock must still
   // export the class so that default construction doesn't throw.
@@ -56,7 +95,8 @@ vi.mock('../resolvers/meetingRecordingRegistration', () => ({
     get correlateRecordingStart() { return this.CorrelateRecordingStart; },
 }));
 
-import { RealtimeBridgeResolver, MintLiveKitClientTokenInput, LiveKitRecordingInput } from '../resolvers/RealtimeBridgeResolver';
+import { RealtimeBridgeResolver, MintLiveKitClientTokenInput, LiveKitRecordingInput, StartLiveKitAgentRoomSessionInput } from '../resolvers/RealtimeBridgeResolver';
+import { RoomAuthorizationService } from '@memberjunction/livekit-room-server';
 import type { AppContext } from '../types.js';
 
 /** A resolver subclass that supplies a fake authenticated user (GetUserFromPayload is protected). */
@@ -69,11 +109,17 @@ class TestableResolver extends RealtimeBridgeResolver {
 
 const ctx = {} as AppContext;
 
+// The resolver module installs the binder once, as it loads. `restoreMocks` clears call history before each test,
+// so take it now rather than reading `mock.calls` inside a test.
+type TurnToolBinderFn = (session: object, handler: object) => void;
+const installedTurnToolBinder = h.setTurnToolBinder.mock.calls[0]?.[0] as TurnToolBinderFn | undefined;
+
 describe('RealtimeBridgeResolver', () => {
   let resolver: TestableResolver;
 
   beforeEach(() => {
     resolver = new TestableResolver();
+    RoomAuthorizationService.Instance.SetAuthorizerForTesting(async () => ({ Authorized: true }));
   });
 
   describe('MintLiveKitClientToken', () => {
@@ -97,6 +143,53 @@ describe('RealtimeBridgeResolver', () => {
     });
   });
 
+  describe('GetLiveKitRoomTurnState', () => {
+    it('serves a room\'s snapshot as JSON for the typed client to parse', async () => {
+      const result = await resolver.GetLiveKitRoomTurnState('busy-room', ctx);
+      expect(result.Success).toBe(true);
+      expect(JSON.parse(result.StateJSON as string)).toEqual({ RoomId: 'busy-room', Agents: [] });
+    });
+
+    it('reports success with no state when the room holds no agents', async () => {
+      const result = await resolver.GetLiveKitRoomTurnState('empty-room', ctx);
+      expect(result).toEqual({ Success: true, StateJSON: undefined });
+    });
+
+    it('requires an authenticated user', async () => {
+      resolver.user = undefined;
+      const result = await resolver.GetLiveKitRoomTurnState('busy-room', ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toMatch(/current user/i);
+    });
+
+    it('turns a failure into a structured error instead of throwing', async () => {
+      h.getRoomTurnState.mockImplementationOnce(() => {
+        throw new Error('boom');
+      });
+      const result = await resolver.GetLiveKitRoomTurnState('busy-room', ctx);
+      expect(result).toMatchObject({ Success: false, ErrorMessage: 'boom' });
+    });
+  });
+
+  describe('turn-taking tool binding', () => {
+    it('installs the engine\'s tool handler as the model session runtime\'s local tool handler', () => {
+      const binder = installedTurnToolBinder!;
+      const setLocalToolHandler = vi.fn();
+      h.getBridgeRuntime.mockReturnValueOnce({ SetLocalToolHandler: setLocalToolHandler });
+      const session = {};
+      const handler = {};
+      binder(session, handler);
+      expect(h.getBridgeRuntime).toHaveBeenCalledWith(session);
+      expect(setLocalToolHandler).toHaveBeenCalledWith(handler);
+    });
+
+    it('does not throw when the session has no bridge runtime', () => {
+      const binder = installedTurnToolBinder!;
+      h.getBridgeRuntime.mockReturnValueOnce(undefined);
+      expect(() => binder({}, {})).not.toThrow();
+    });
+  });
+
   describe('recording', () => {
     it('starts a recording and maps the result', async () => {
       const input = Object.assign(new LiveKitRecordingInput(), { RoomName: 'room-1', Layout: 'grid' });
@@ -114,6 +207,23 @@ describe('RealtimeBridgeResolver', () => {
       expect(result.RecordingFileID).toBe('file-1');
     });
 
+    it('refuses to stop a recording when user is unauthorized for the room', async () => {
+      RoomAuthorizationService.Instance.SetAuthorizerForTesting(async () => ({
+        Authorized: false,
+        Reason: 'Not allowed to access this room',
+      }));
+      const result = await resolver.StopLiveKitRecording('eg-1', ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toMatch(/Not allowed to access this room/);
+    });
+
+    it('refuses to stop a recording when room cannot be determined for egress ID', async () => {
+      h.getRoomForEgress.mockResolvedValueOnce(undefined);
+      const result = await resolver.StopLiveKitRecording('unknown-egress', ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toMatch(/Unable to determine room/);
+    });
+
     it('requires an authenticated user to record', async () => {
       resolver.user = undefined;
       const input = Object.assign(new LiveKitRecordingInput(), { RoomName: 'room-1' });
@@ -122,4 +232,132 @@ describe('RealtimeBridgeResolver', () => {
       expect(result.ErrorMessage).toMatch(/current user/i);
     });
   });
+  describe('StartLiveKitAgentRoomSession with handoff', () => {
+    const input = (over: Partial<StartLiveKitAgentRoomSessionInput> = {}) =>
+      Object.assign(new StartLiveKitAgentRoomSessionInput(), { RoomName: 'room-h', AgentID: 'co-agent', TargetAgentID: 'target-agent', AgentName: 'Sage', AgentSessionID: 'AS1', ...over });
+
+    beforeEach(() => {
+      h.startAgentRoomSession.mockClear();
+      h.mintClientToken.mockClear();
+      h.handoffDeps.AgentStarter = undefined;
+    });
+
+    it('starts the agent through the handoff-capable starter when asked, naming the signed-in user as the caller, and returns a token for the same room', async () => {
+      const starter = vi.fn(async () => ({ SessionBridgeID: 'bridge-h' }));
+      h.handoffDeps.AgentStarter = starter;
+      const result = await resolver.StartLiveKitAgentRoomSession(input({ EnableHandoff: true, RealtimeVoice: 'echo' }), ctx);
+      expect(result).toMatchObject({ Success: true, SessionBridgeID: 'bridge-h', RoomName: 'room-h', ClientToken: 'jwt-user-u1', Identity: 'user-u1' });
+      expect(starter).toHaveBeenCalledWith(
+        expect.objectContaining({ RoomName: 'room-h', AgentID: 'target-agent', AgentName: 'Sage', CallerLabel: 'Amith', RealtimeVoice: 'echo' }),
+      );
+      expect(h.startAgentRoomSession).not.toHaveBeenCalled();
+    });
+
+    it('falls back to the standard room start when handoff is requested but the server cannot do it', async () => {
+      const result = await resolver.StartLiveKitAgentRoomSession(input({ EnableHandoff: true }), ctx);
+      expect(result).toMatchObject({ Success: true, SessionBridgeID: 'bridge-std' });
+      expect(h.startAgentRoomSession).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not touch the handoff starter unless asked', async () => {
+      const starter = vi.fn(async () => ({ SessionBridgeID: 'bridge-h' }));
+      h.handoffDeps.AgentStarter = starter;
+      await resolver.StartLiveKitAgentRoomSession(input(), ctx);
+      expect(starter).not.toHaveBeenCalled();
+      expect(h.startAgentRoomSession).toHaveBeenCalledTimes(1);
+    });
+
+    it('reports a failure to start the handoff-capable agent instead of silently starting a plain one', async () => {
+      h.handoffDeps.AgentStarter = vi.fn(async () => {
+        throw new Error('All agent lines are busy right now.');
+      });
+      const result = await resolver.StartLiveKitAgentRoomSession(input({ EnableHandoff: true }), ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toContain('busy');
+      expect(h.startAgentRoomSession).not.toHaveBeenCalled();
+    });
+
+    it('requires an authenticated user', async () => {
+      resolver.user = undefined;
+      const result = await resolver.StartLiveKitAgentRoomSession(input({ EnableHandoff: true }), ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toMatch(/current user/i);
+    });
+  });
+
+  describe('Per-room authorization enforcement', () => {
+    beforeEach(() => {
+      vi.clearAllMocks();
+      RoomAuthorizationService.Instance.SetAuthorizerForTesting(async () => ({
+        Authorized: false,
+        Reason: 'User is not authorized for this room.',
+      }));
+    });
+
+    it('MintLiveKitClientToken rejects unauthorized room access', async () => {
+      const input = Object.assign(new MintLiveKitClientTokenInput(), { RoomName: 'private-room' });
+      const result = await resolver.MintLiveKitClientToken(input, ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toBe('User is not authorized for this room.');
+      expect(h.mintClientToken).not.toHaveBeenCalled();
+    });
+
+    it('StartLiveKitAgentRoomSession rejects unauthorized room access', async () => {
+      const input = Object.assign(new StartLiveKitAgentRoomSessionInput(), {
+        RoomName: 'private-room',
+        AgentID: 'agent-1',
+      });
+      const result = await resolver.StartLiveKitAgentRoomSession(input, ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toBe('User is not authorized for this room.');
+      expect(h.startAgentRoomSession).not.toHaveBeenCalled();
+    });
+
+    it('StopLiveKitAgentRoomSession rejects unauthorized room access', async () => {
+      h.getRoomForBridge.mockReturnValueOnce('private-room');
+      const result = await resolver.StopLiveKitAgentRoomSession('bridge-1', ctx);
+      expect(result).toBe(false);
+      expect(h.stopAgentRoomSession).not.toHaveBeenCalled();
+    });
+
+    it('StopLiveKitAgentRoomSession proceeds when room access is authorized', async () => {
+      RoomAuthorizationService.Instance.SetAuthorizerForTesting(async () => ({ Authorized: true }));
+      h.getRoomForBridge.mockReturnValueOnce('private-room');
+      const result = await resolver.StopLiveKitAgentRoomSession('bridge-1', ctx);
+      expect(result).toBe(true);
+      expect(h.stopAgentRoomSession).toHaveBeenCalledWith('bridge-1', 'Explicit', resolver.user, null);
+    });
+
+    it('EndLiveKitRoom rejects unauthorized room access', async () => {
+      const result = await resolver.EndLiveKitRoom('private-room', ctx);
+      expect(result).toBe(false);
+      expect(h.stopAllAgentsInRoom).not.toHaveBeenCalled();
+    });
+
+    it('EndLiveKitRoom proceeds when room access is authorized', async () => {
+      RoomAuthorizationService.Instance.SetAuthorizerForTesting(async () => ({ Authorized: true }));
+      const result = await resolver.EndLiveKitRoom('private-room', ctx);
+      expect(result).toBe(true);
+      expect(h.stopAllAgentsInRoom).toHaveBeenCalledWith('private-room', 'Explicit', resolver.user, null);
+    });
+
+    it('GetLiveKitRoomTurnState rejects unauthorized room access', async () => {
+      const result = await resolver.GetLiveKitRoomTurnState('private-room', ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toBe('User is not authorized for this room.');
+    });
+
+    it('InviteUsersToLiveKitRoom rejects unauthorized room access', async () => {
+      const result = await resolver.InviteUsersToLiveKitRoom('private-room', ['user-2'], ctx);
+      expect(result).toBe(false);
+    });
+
+    it('StartLiveKitRecording rejects unauthorized room access', async () => {
+      const input = Object.assign(new LiveKitRecordingInput(), { RoomName: 'private-room' });
+      const result = await resolver.StartLiveKitRecording(input, ctx);
+      expect(result.Success).toBe(false);
+      expect(result.ErrorMessage).toBe('User is not authorized for this room.');
+      expect(h.startRecording).not.toHaveBeenCalled();
+    });
+  });
 });