@open-mercato/ai-assistant 0.5.1-develop.3036.f02c281f23 → 0.5.1-develop.3045.b4b3320cc2

package/src/modules/ai_assistant/__tests__/integration/ws-c-attachment-bridge.test.ts

@@ -0,0 +1,235 @@
+/**
+ * Step 3.13 — Phase 1 WS-C integration tests (attachment bridge).
+ *
+ * Asserts the Step 3.7 attachment-to-model bridge upholds two invariants that
+ * matter to every downstream agent turn:
+ *
+ *   1. Cross-tenant attachment ids passed by the caller are silently dropped —
+ *      they MUST NOT surface in the resolved parts array and MUST NOT leak any
+ *      metadata about the foreign tenant.
+ *   2. An oversized image (> DEFAULT_MAX_INLINE_BYTES = 4 MB) with no
+ *      `attachmentSigner` registered falls back to `source: 'metadata-only'`
+ *      instead of failing the turn — the model is informed that the file
+ *      exists without getting any raw bytes.
+ *
+ * The underlying `resolveAttachmentParts` implementation is unit-tested in
+ * `packages/ai-assistant/src/modules/ai_assistant/lib/__tests__/
+ * attachment-parts.test.ts`. This integration suite re-exercises the bridge
+ * through higher-level fixtures that mimic how the chat dispatcher calls it
+ * (two tenants, a signer slot, a real-ish attachment row shape).
+ */
+
+import type { AiChatRequestContext } from '../../lib/attachment-bridge-types'
+import type { AttachmentSigner } from '../../lib/attachment-parts'
+
+const findOneWithDecryptionMock = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findOneWithDecryption: (...args: unknown[]) => findOneWithDecryptionMock(...args),
+}))
+
+jest.mock('@open-mercato/core/modules/attachments/data/entities', () => ({
+  Attachment: class AttachmentStub {},
+}))
+
+const resolveAttachmentAbsolutePathMock = jest.fn(
+  (_partition: string, storagePath: string) => `/fake/root/${storagePath}`,
+)
+
+jest.mock('@open-mercato/core/modules/attachments/lib/storage', () => ({
+  resolveAttachmentAbsolutePath: (...args: unknown[]) =>
+    resolveAttachmentAbsolutePathMock(...(args as [string, string, string?])),
+}))
+
+const fsReadFileMock = jest.fn()
+jest.mock('fs', () => {
+  const actual = jest.requireActual('fs')
+  return {
+    ...actual,
+    promises: {
+      ...actual.promises,
+      readFile: (...args: unknown[]) => fsReadFileMock(...args),
+    },
+  }
+})
+
+import { resolveAttachmentParts } from '../../lib/attachment-parts'
+
+type AttachmentRowOverrides = {
+  id?: string
+  fileName?: string
+  mimeType?: string
+  fileSize?: number
+  storagePath?: string
+  storageDriver?: string
+  partitionCode?: string
+  tenantId?: string | null
+  organizationId?: string | null
+  content?: string | null
+  entityId?: string
+}
+
+function makeRow(overrides: AttachmentRowOverrides = {}): Record<string, unknown> {
+  return {
+    id: 'attachment-1',
+    entityId: 'attachments:attachment',
+    fileName: 'file.bin',
+    mimeType: 'application/octet-stream',
+    fileSize: 1024,
+    storagePath: 'path/to/file',
+    storageDriver: 'local',
+    partitionCode: 'default',
+    tenantId: 'tenant-a',
+    organizationId: 'org-a',
+    content: null,
+    ...overrides,
+  }
+}
+
+function makeContainer(options?: { signer?: AttachmentSigner | null; omitEm?: boolean }) {
+  const registry: Record<string, unknown> = {}
+  if (!options?.omitEm) {
+    registry.em = { __label: 'em-stub' }
+  }
+  if (options?.signer) {
+    registry.attachmentSigner = options.signer
+  }
+  return {
+    resolve: jest.fn((name: string) => {
+      if (!(name in registry)) {
+        throw new Error(`Unknown registration: ${name}`)
+      }
+      return registry[name] as never
+    }),
+  } as unknown as Parameters<typeof resolveAttachmentParts>[0]['container']
+}
+
+function makeAuth(overrides: Partial<AiChatRequestContext> = {}): AiChatRequestContext {
+  return {
+    tenantId: 'tenant-a',
+    organizationId: 'org-a',
+    userId: 'user-a',
+    features: [],
+    isSuperAdmin: false,
+    ...overrides,
+  }
+}
+
+describe('WS-C integration — attachment bridge', () => {
+  let warnSpy: jest.SpyInstance
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    warnSpy.mockRestore()
+  })
+
+  it('drops cross-tenant attachments without leaking foreign metadata', async () => {
+    // Simulated tenants: caller is tenant-a; foreign-attachment belongs to tenant-b.
+    // findOneWithDecryption accepts the scope tuple but its mock returns the row
+    // as-if the query were scope-unaware, so the in-process row scope check is
+    // the gate that MUST drop this.
+    findOneWithDecryptionMock.mockImplementation(
+      async (_em: unknown, _entity: unknown, where: Record<string, unknown>) => {
+        if (where.id === 'own-attachment') {
+          return makeRow({ id: 'own-attachment', tenantId: 'tenant-a', organizationId: 'org-a' })
+        }
+        if (where.id === 'foreign-attachment') {
+          // The attachment belongs to tenant-b; the resolver should drop it.
+          return makeRow({
+            id: 'foreign-attachment',
+            tenantId: 'tenant-b',
+            organizationId: 'org-b',
+            mimeType: 'image/png',
+            fileSize: 1024,
+          })
+        }
+        return null
+      },
+    )
+    fsReadFileMock.mockResolvedValue(Buffer.from([1, 2, 3]))
+
+    const auth = makeAuth()
+    const parts = await resolveAttachmentParts({
+      attachmentIds: ['own-attachment', 'foreign-attachment', 'not-found'],
+      authContext: auth,
+      container: makeContainer(),
+    })
+
+    const ids = parts.map((part) => part.attachmentId)
+    expect(ids).toEqual(['own-attachment'])
+    expect(ids).not.toContain('foreign-attachment')
+    expect(ids).not.toContain('not-found')
+
+    // The warn for the foreign attachment MUST NOT reveal tenant-b or org-b.
+    const warnCalls = warnSpy.mock.calls.map((call) => call.join(' '))
+    const foreignWarn = warnCalls.find((message) => message.includes('foreign-attachment'))
+    expect(foreignWarn).toBeDefined()
+    expect(foreignWarn).not.toMatch(/tenant-b/)
+    expect(foreignWarn).not.toMatch(/org-b/)
+  })
+
+  it('oversized image with no attachment signer falls back to source=metadata-only', async () => {
+    findOneWithDecryptionMock.mockResolvedValue(
+      makeRow({
+        id: 'huge-image',
+        tenantId: 'tenant-a',
+        organizationId: 'org-a',
+        mimeType: 'image/png',
+        fileSize: 8 * 1024 * 1024,
+      }),
+    )
+
+    const parts = await resolveAttachmentParts({
+      attachmentIds: ['huge-image'],
+      authContext: makeAuth(),
+      container: makeContainer(),
+    })
+
+    expect(parts).toHaveLength(1)
+    expect(parts[0].attachmentId).toBe('huge-image')
+    expect(parts[0].source).toBe('metadata-only')
+    // `fs.readFile` MUST NOT be consulted for oversized images — that would
+    // blow past the default 4 MB inline ceiling before the downgrade fires.
+    expect(fsReadFileMock).not.toHaveBeenCalled()
+  })
+
+  it('oversized image WITH a signer is promoted to source=signed-url', async () => {
+    findOneWithDecryptionMock.mockResolvedValue(
+      makeRow({
+        id: 'huge-image',
+        tenantId: 'tenant-a',
+        organizationId: 'org-a',
+        mimeType: 'image/png',
+        fileSize: 8 * 1024 * 1024,
+      }),
+    )
+    const signer: AttachmentSigner = {
+      sign: jest.fn().mockResolvedValue('https://example.com/signed/huge-image'),
+    }
+
+    const parts = await resolveAttachmentParts({
+      attachmentIds: ['huge-image'],
+      authContext: makeAuth(),
+      container: makeContainer({ signer }),
+    })
+
+    expect(parts).toHaveLength(1)
+    expect(parts[0].source).toBe('signed-url')
+    expect((parts[0] as { url?: string }).url).toBe('https://example.com/signed/huge-image')
+    expect(signer.sign).toHaveBeenCalledTimes(1)
+  })
+
+  it('missing DI container returns [] with a warn and never throws', async () => {
+    const parts = await resolveAttachmentParts({
+      attachmentIds: ['any-id'],
+      authContext: makeAuth(),
+      // container omitted deliberately
+    })
+    expect(parts).toEqual([])
+    expect(warnSpy).toHaveBeenCalled()
+  })
+})

package/src/modules/ai_assistant/__tests__/integration/ws-c-policy-and-tools.test.ts

@@ -0,0 +1,330 @@
+/**
+ * Step 3.13 — Phase 1 WS-C integration tests (policy gate + tool resolution).
+ *
+ * These tests sit between the per-module unit tests (under each pack's own
+ * `__tests__/`) and the HTTP Playwright coverage under `.ai/qa/tests/ai-framework/`.
+ * The goal is to exercise the full runtime pipeline — agent registry → policy
+ * gate → tool resolution → AI SDK adapter — against realistic fixtures and
+ * assert the cross-cutting invariants that neither layer alone can catch.
+ *
+ * Why mock the AI SDK at the module boundary instead of a true HTTP e2e:
+ * the Vercel AI SDK model factory tries to reach a real LLM provider by
+ * default. The existing `agent-runtime-parity.test.ts` contract suite adopted
+ * the same mock stance; this integration suite mirrors that choice so we
+ * remain deterministic, hermetic, and provider-agnostic.
+ */
+
+import { z } from 'zod'
+import type { AiAgentDefinition } from '../../lib/ai-agent-definition'
+import type { AiChatRequestContext } from '../../lib/attachment-bridge-types'
+import type { AiToolDefinition } from '../../lib/types'
+
+// --- SDK mocks (mirrors agent-runtime-parity.test.ts) ---------------------
+
+const streamTextMock = jest.fn()
+const generateObjectMock = jest.fn()
+const streamObjectMock = jest.fn()
+
+jest.mock('ai', () => {
+  const actual = jest.requireActual('ai')
+  return {
+    ...actual,
+    streamText: (...args: unknown[]) => streamTextMock(...args),
+    generateObject: (...args: unknown[]) => generateObjectMock(...args),
+    streamObject: (...args: unknown[]) => streamObjectMock(...args),
+  }
+})
+
+const createModelMock = jest.fn(
+  (options: { modelId: string; apiKey: string }) => ({ id: options.modelId, apiKey: options.apiKey }),
+)
+const resolveApiKeyMock = jest.fn(() => 'test-api-key')
+
+jest.mock('@open-mercato/shared/lib/ai/llm-provider-registry', () => ({
+  llmProviderRegistry: {
+    resolveFirstConfigured: () => ({
+      id: 'test-provider',
+      defaultModel: 'provider-default-model',
+      resolveApiKey: resolveApiKeyMock,
+      createModel: createModelMock,
+    }),
+  },
+}))
+
+import {
+  resetAgentRegistryForTests,
+  seedAgentRegistryForTests,
+} from '../../lib/agent-registry'
+import { toolRegistry, registerMcpTool } from '../../lib/tool-registry'
+import { resolveAiAgentTools, AgentPolicyError } from '../../lib/agent-tools'
+import { checkAgentPolicy } from '../../lib/agent-policy'
+import { runAiAgentText } from '../../lib/agent-runtime'
+
+function makeAgent(
+  overrides: Partial<AiAgentDefinition> & Pick<AiAgentDefinition, 'id' | 'moduleId'>,
+): AiAgentDefinition {
+  return {
+    label: `${overrides.id} label`,
+    description: `${overrides.id} description`,
+    systemPrompt: 'System prompt base.',
+    allowedTools: [],
+    ...overrides,
+  }
+}
+
+function makeTool(
+  overrides: Partial<AiToolDefinition> & Pick<AiToolDefinition, 'name'>,
+): AiToolDefinition {
+  return {
+    description: `${overrides.name} description`,
+    inputSchema: z.object({}),
+    handler: async () => ({ ok: true }),
+    ...overrides,
+  }
+}
+
+function makeAuth(overrides: Partial<AiChatRequestContext> = {}): AiChatRequestContext {
+  return {
+    tenantId: 'tenant-a',
+    organizationId: 'org-a',
+    userId: 'user-a',
+    features: [],
+    isSuperAdmin: false,
+    ...overrides,
+  }
+}
+
+function fakeStreamTextResult() {
+  return {
+    toTextStreamResponse: jest.fn(
+      () =>
+        new Response('ok', {
+          status: 200,
+          headers: { 'Content-Type': 'text/event-stream' },
+        }),
+    ),
+    toUIMessageStreamResponse: jest.fn(
+      () =>
+        new Response('ok', {
+          status: 200,
+          headers: { 'Content-Type': 'text/event-stream' },
+        }),
+    ),
+  }
+}
+
+describe('WS-C integration — agent policy gate + tool resolution', () => {
+  let warnSpy: jest.SpyInstance
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    resetAgentRegistryForTests()
+    toolRegistry.clear()
+    warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    streamTextMock.mockImplementation(() => fakeStreamTextResult())
+  })
+
+  afterEach(() => {
+    warnSpy.mockRestore()
+  })
+
+  afterAll(() => {
+    resetAgentRegistryForTests()
+    toolRegistry.clear()
+  })
+
+  it('unknown agent throws AgentPolicyError(agent_unknown)', async () => {
+    await expect(
+      resolveAiAgentTools({
+        agentId: 'does.not_exist',
+        authContext: makeAuth({ isSuperAdmin: true }),
+      }),
+    ).rejects.toBeInstanceOf(AgentPolicyError)
+
+    await expect(
+      resolveAiAgentTools({
+        agentId: 'does.not_exist',
+        authContext: makeAuth({ isSuperAdmin: true }),
+      }),
+    ).rejects.toMatchObject({ code: 'agent_unknown' })
+  })
+
+  it('forbidden agent (missing requiredFeatures) throws agent_features_denied', async () => {
+    seedAgentRegistryForTests([
+      makeAgent({
+        id: 'customers.assistant',
+        moduleId: 'customers',
+        requiredFeatures: ['customers.assistant.use'],
+      }),
+    ])
+
+    await expect(
+      resolveAiAgentTools({
+        agentId: 'customers.assistant',
+        authContext: makeAuth({ features: ['customers.people.view'] }),
+      }),
+    ).rejects.toMatchObject({
+      name: 'AgentPolicyError',
+      code: 'agent_features_denied',
+    })
+  })
+
+  it('super-admin bypass: agent.requiredFeatures does not block a super-admin caller', async () => {
+    seedAgentRegistryForTests([
+      makeAgent({
+        id: 'customers.assistant',
+        moduleId: 'customers',
+        requiredFeatures: ['customers.assistant.use'],
+      }),
+    ])
+
+    const resolved = await resolveAiAgentTools({
+      agentId: 'customers.assistant',
+      authContext: makeAuth({ isSuperAdmin: true, features: [] }),
+    })
+    expect(resolved.agent.id).toBe('customers.assistant')
+    expect(resolved.tools).toEqual({})
+  })
+
+  it('allowedTools filtering: tools listed in allowedTools are resolved; extras never leak', async () => {
+    seedAgentRegistryForTests([
+      makeAgent({
+        id: 'catalog.assistant',
+        moduleId: 'catalog',
+        allowedTools: ['catalog.list_products'],
+      }),
+    ])
+    registerMcpTool(
+      makeTool({
+        name: 'catalog.list_products',
+        requiredFeatures: ['catalog.products.view'],
+      }),
+    )
+    // A tool that the agent did NOT whitelist. Resolution MUST NOT include it.
+    registerMcpTool(
+      makeTool({
+        name: 'catalog.delete_product',
+        isMutation: true,
+        requiredFeatures: ['catalog.products.manage'],
+      }),
+    )
+
+    const resolved = await resolveAiAgentTools({
+      agentId: 'catalog.assistant',
+      authContext: makeAuth({ isSuperAdmin: true }),
+    })
+
+    expect(Object.keys(resolved.tools).sort()).toEqual(['catalog__list_products'])
+    expect(Object.prototype.hasOwnProperty.call(resolved.tools, 'catalog__delete_product')).toBe(false)
+  })
+
+  it('tool-level requiredFeatures: tool is skipped with a warn when caller lacks the feature; remaining tools still reach the model', async () => {
+    seedAgentRegistryForTests([
+      makeAgent({
+        id: 'catalog.assistant',
+        moduleId: 'catalog',
+        allowedTools: ['catalog.list_products', 'catalog.get_product'],
+      }),
+    ])
+    registerMcpTool(
+      makeTool({
+        name: 'catalog.list_products',
+        requiredFeatures: ['catalog.products.view'],
+      }),
+    )
+    registerMcpTool(
+      makeTool({
+        name: 'catalog.get_product',
+        requiredFeatures: ['catalog.products.secret'],
+      }),
+    )
+
+    const resolved = await resolveAiAgentTools({
+      agentId: 'catalog.assistant',
+      authContext: makeAuth({ features: ['catalog.products.view'], isSuperAdmin: false }),
+    })
+    expect(Object.keys(resolved.tools)).toEqual(['catalog__list_products'])
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining('catalog.get_product'),
+    )
+  })
+
+  it('mutation tool blocked by readOnly agent: checkAgentPolicy returns mutation_blocked_by_readonly', async () => {
+    seedAgentRegistryForTests([
+      makeAgent({
+        id: 'catalog.assistant',
+        moduleId: 'catalog',
+        allowedTools: ['catalog.delete_product'],
+        readOnly: true,
+      }),
+    ])
+    registerMcpTool(
+      makeTool({
+        name: 'catalog.delete_product',
+        isMutation: true,
+      }),
+    )
+
+    const decision = checkAgentPolicy({
+      agentId: 'catalog.assistant',
+      toolName: 'catalog.delete_product',
+      authContext: { userFeatures: ['*'], isSuperAdmin: true },
+    })
+    expect(decision.ok).toBe(false)
+    if (!decision.ok) {
+      expect(decision.code).toBe('mutation_blocked_by_readonly')
+    }
+  })
+
+  it('runAiAgentText end-to-end: unknown agent produces AgentPolicyError before the SDK is called', async () => {
+    await expect(
+      runAiAgentText({
+        agentId: 'missing.agent',
+        messages: [
+          { role: 'user', id: 'm1', parts: [{ type: 'text' as const, text: 'hi' }] } as never,
+        ],
+        authContext: makeAuth({ isSuperAdmin: true }),
+      }),
+    ).rejects.toMatchObject({ name: 'AgentPolicyError', code: 'agent_unknown' })
+    expect(streamTextMock).not.toHaveBeenCalled()
+  })
+
+  it('runAiAgentText end-to-end: allowedTools filter passes through to the SDK tool map', async () => {
+    seedAgentRegistryForTests([
+      makeAgent({
+        id: 'catalog.assistant',
+        moduleId: 'catalog',
+        allowedTools: ['catalog.list_products'],
+      }),
+    ])
+    registerMcpTool(
+      makeTool({
+        name: 'catalog.list_products',
+        requiredFeatures: ['catalog.products.view'],
+      }),
+    )
+    // Tool not whitelisted by the agent; MUST NOT appear in the SDK args.
+    registerMcpTool(
+      makeTool({
+        name: 'catalog.update_product',
+        isMutation: true,
+        requiredFeatures: ['catalog.products.manage'],
+      }),
+    )
+
+    await runAiAgentText({
+      agentId: 'catalog.assistant',
+      messages: [
+        { role: 'user', id: 'm1', parts: [{ type: 'text' as const, text: 'hi' }] } as never,
+      ],
+      authContext: makeAuth({ isSuperAdmin: true }),
+    })
+
+    expect(streamTextMock).toHaveBeenCalledTimes(1)
+    const sdkArg = streamTextMock.mock.calls[0]?.[0] as Record<string, unknown> | undefined
+    expect(sdkArg).toBeDefined()
+    const toolsArg = (sdkArg?.tools ?? {}) as Record<string, unknown>
+    expect(Object.keys(toolsArg)).toEqual(['catalog__list_products'])
+    expect(Object.prototype.hasOwnProperty.call(toolsArg, 'catalog__update_product')).toBe(false)
+  })
+})