@newheap/platform-ai-chat 0.21.0 → 0.22.0

package/fesm2022/newheap-platform-ai-chat-testing.mjs

@@ -65,7 +65,8 @@ const statusTable = {
         'assistant-forbidden',
         'assistant-mcp-credential-mismatch',
         'assistant-mcp-initiator-only',
-        'assistant-file-forbidden'
+        'assistant-file-forbidden',
+        'assistant-not-allowed-while-impersonating'
     ],
     404: [
         'assistant-disabled',
@@ -1687,6 +1688,10 @@ class NhAssistantMockAdminMcp {
                     stored.organization?.status === 'issuer-changed') {
                     stored.organization = { ...stored.organization, status: 'active' };
                 }
+                if (!keepsSecret(before, input)) {
+                    // As on the server: a stored secret never follows the server to another destination.
+                    stored.secret = null;
+                }
                 if (!secretModes.includes(input.authMode)) {
                     stored.secret = null;
                     stored.server.secretReference = null;
@@ -2247,17 +2252,20 @@ class NhAssistantMockAdminMcp {
         if (input.secret && input.secretReference) {
             add('secretReference', 'invalid');
         }
+        // As on the server: a stored secret and reference serve only the destination they were given for.
+        const keeps = keepsSecret(stored?.server, input);
         const reference = input.secretReference === undefined || input.secretReference === null
-            ? (input.secret ? null : stored?.server.secretReference ?? null)
+            ? (input.secret || !keeps ? null : stored?.server.secretReference ?? null)
             : input.secretReference || null;
         if (reference !== null && (!secretReference.test(reference) || reference.includes('..'))) {
             add('secretReference', 'invalid');
         }
         if (secretModes.includes(input.authMode)) {
             // As on the server: bearer, api-key and basic need a stored secret or a reference. A new stored
-            // secret replaces a reference, a new reference a stored secret.
+            // secret replaces a reference, a new reference a stored secret, and another destination needs
+            // either again.
             const storedSecret = input.secret === undefined || input.secret === null
-                ? !!stored?.secret && !input.secretReference
+                ? keeps && !!stored?.secret && !input.secretReference
                 : input.secret.length > 0;
             if (!storedSecret && (reference === null || !!input.secret)) {
                 add('secret', 'required');
@@ -2331,10 +2339,32 @@ class NhAssistantMockAdminMcp {
         };
     }
 }
+/**
+ * Whether a stored secret and reference stay with the server after the input, as on the server: the
+ * URL keeps its origin (scheme, host and port), and the authentication mode and the `api-key` header,
+ * in any letter case, stay the same.
+ */
+function keepsSecret(stored, input) {
+    const before = stored ? originOf(stored.url) : null;
+    if (!stored || before === null || stored.authMode !== input.authMode || before !== originOf(input.url)) {
+        return false;
+    }
+    return input.authMode !== 'api-key'
+        || (stored.headerName || 'X-Api-Key').toLowerCase() === (input.headerName || 'X-Api-Key').toLowerCase();
+}
+/** The origin of an absolute URL in lowercase, or `null` for an invalid one. */
+function originOf(url) {
+    try {
+        return new URL(url.trim()).origin.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
 function toServerFields(input, stored) {
     const usesSecret = secretModes.includes(input.authMode);
     const reference = input.secretReference === undefined || input.secretReference === null
-        ? (input.secret ? null : stored?.secretReference ?? null)
+        ? (input.secret || !keepsSecret(stored, input) ? null : stored?.secretReference ?? null)
         : input.secretReference || null;
     const certificate = input.clientCertificateReference === undefined || input.clientCertificateReference === null
         ? stored?.clientCertificateReference ?? null
@@ -7224,8 +7254,9 @@ class NhAssistantMockAgentRuns {
     }
     /**
      * `POST runs/{id}/retry`: resumes a failed or cancelled run (`queued`), or restarts the agent in the
-     * same thread like a start by hand; needs the approver role on the thread. The mock's resumed
-     * attempt ends at once as the scenario's `runNow` says.
+     * same thread like a start by hand; needs the approver role on the thread, and a restart also passes
+     * the start checks of `POST threads/start`. The mock's resumed attempt ends at once as the
+     * scenario's `runNow` says.
      */
     retry(runId, body, language) {
         const mode = body?.mode ?? 'resume';
@@ -7251,7 +7282,17 @@ class NhAssistantMockAgentRuns {
             return mockFailure('assistant-agent-not-found');
         }
         if (mode === 'restart') {
-            return this.startNow(agent, found.thread.subject);
+            // A restart starts the agent again for the caller: the rule of a start by hand decides, with the
+            // caller's live role.
+            const subject = this.subjects.describe(found.thread.subject.subjectType, found.thread.subject.subjectId, language, this.context.administers());
+            if (!subject) {
+                return mockFailure('assistant-subject-access-denied');
+            }
+            const refusal = this.refusal(agent, subject);
+            if (refusal) {
+                return mockFailure(refusal);
+            }
+            return this.startNow(agent, subject);
         }
         const runNow = this.scenario.runNow?.[agent.id] ?? {};
         const status = runNow.status ?? 'completed';