@open-mercato/ai-assistant 0.5.1-develop.3036.f02c281f23 → 0.5.1-develop.3045.b4b3320cc2

package/src/modules/ai_assistant/api/ai/actions/[id]/cancel/__tests__/route.test.ts

@@ -0,0 +1,286 @@
+const authMock = jest.fn()
+const loadAclMock = jest.fn()
+const createRequestContainerMock = jest.fn()
+const repoGetByIdMock = jest.fn()
+const repoSetStatusMock = jest.fn()
+const emitEventMock = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/auth/server', () => ({
+  getAuthFromRequest: (...args: unknown[]) => authMock(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: (...args: unknown[]) => createRequestContainerMock(...args),
+}))
+
+jest.mock('../../../../../../data/repositories/AiPendingActionRepository', () => ({
+  AiPendingActionRepository: jest.fn().mockImplementation(() => ({
+    getById: repoGetByIdMock,
+    setStatus: repoSetStatusMock,
+  })),
+}))
+
+import { setGlobalEventBus } from '@open-mercato/shared/modules/events'
+import { POST } from '../route'
+
+function buildRequest(body?: unknown): Request {
+  const init: RequestInit = {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+  }
+  if (body !== undefined) {
+    init.body = typeof body === 'string' ? body : JSON.stringify(body)
+  }
+  return new Request('http://localhost/api/ai_assistant/ai/actions/pa_123/cancel', init)
+}
+
+function buildContext(id: string) {
+  return { params: Promise.resolve({ id }) }
+}
+
+function makeRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 'pa_123',
+    tenantId: 'tenant-1',
+    organizationId: 'org-1',
+    agentId: 'catalog.merchandising_assistant',
+    toolName: 'catalog.update_product',
+    status: 'pending',
+    fieldDiff: [{ field: 'title', before: 'Old', after: 'New' }],
+    records: null,
+    failedRecords: null,
+    sideEffectsSummary: null,
+    recordVersion: 'v-1',
+    attachmentIds: [],
+    normalizedInput: { productId: 'p-1', patch: { title: 'New' } },
+    queueMode: 'inline',
+    executionResult: null,
+    targetEntityType: 'product',
+    targetRecordId: 'p-1',
+    conversationId: null,
+    idempotencyKey: 'idem_1',
+    createdByUserId: 'user-1',
+    createdAt: new Date(Date.now() - 60_000),
+    expiresAt: new Date(Date.now() + 3_600_000),
+    resolvedAt: null,
+    resolvedByUserId: null,
+    ...overrides,
+  }
+}
+
+describe('POST /api/ai/actions/:id/cancel route (Step 5.9)', () => {
+  let consoleErrorSpy: jest.SpyInstance
+  let consoleWarnSpy: jest.SpyInstance
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {})
+    consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+
+    authMock.mockResolvedValue({
+      sub: 'user-1',
+      tenantId: 'tenant-1',
+      orgId: 'org-1',
+    })
+    loadAclMock.mockResolvedValue({
+      features: ['ai_assistant.view'],
+      isSuperAdmin: false,
+    })
+    createRequestContainerMock.mockResolvedValue({
+      resolve: (name: string) => {
+        if (name === 'rbacService') {
+          return {
+            loadAcl: loadAclMock,
+            hasAllFeatures: (required: string[], granted: string[]) =>
+              required.every((feature) => granted.includes(feature)),
+          }
+        }
+        if (name === 'em') return {}
+        if (name === 'eventBus') return { emitEvent: emitEventMock }
+        return null
+      },
+    })
+
+    emitEventMock.mockResolvedValue(undefined)
+    setGlobalEventBus({
+      emit: (eventId, payload, options) => emitEventMock(eventId, payload, options),
+    })
+    repoSetStatusMock.mockImplementation(
+      async (id: string, status: string, _scope: unknown, extra?: any) => {
+        return {
+          ...makeRow({
+            id,
+            status,
+            executionResult: extra?.executionResult ?? null,
+            resolvedAt: extra?.now ?? new Date(),
+            resolvedByUserId: extra?.resolvedByUserId ?? null,
+          }),
+        }
+      },
+    )
+  })
+
+  afterEach(() => {
+    consoleErrorSpy.mockRestore()
+    consoleWarnSpy.mockRestore()
+  })
+
+  it('returns 401 when unauthenticated', async () => {
+    authMock.mockResolvedValueOnce(null)
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(401)
+  })
+
+  it('happy path: pending → cancelled returns 200 with pendingAction.status === cancelled', async () => {
+    repoGetByIdMock.mockResolvedValueOnce(makeRow())
+
+    const response = await POST(buildRequest({ reason: 'Wrong price' }) as any, buildContext('pa_123'))
+    expect(response.status).toBe(200)
+    const body = await response.json()
+    expect(body.ok).toBe(true)
+    expect(body.pendingAction.status).toBe('cancelled')
+    expect(body.pendingAction.executionResult).toEqual({
+      error: { code: 'cancelled_by_user', message: 'Wrong price' },
+    })
+    expect(repoSetStatusMock).toHaveBeenCalledTimes(1)
+    const [, nextStatus, , extra] = repoSetStatusMock.mock.calls[0]
+    expect(nextStatus).toBe('cancelled')
+    expect(extra).toMatchObject({ resolvedByUserId: 'user-1' })
+    expect(emitEventMock).toHaveBeenCalledTimes(1)
+    expect(emitEventMock.mock.calls[0][0]).toBe('ai.action.cancelled')
+  })
+
+  it('idempotent: second cancel on cancelled row returns 200 + same row without re-emitting event', async () => {
+    const cancelledRow = makeRow({
+      status: 'cancelled',
+      resolvedAt: new Date('2026-04-18T10:30:00.000Z'),
+      resolvedByUserId: 'user-1',
+      executionResult: { error: { code: 'cancelled_by_user', message: 'Cancelled by user' } },
+    })
+    repoGetByIdMock.mockResolvedValueOnce(cancelledRow)
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(200)
+    const body = await response.json()
+    expect(body.ok).toBe(true)
+    expect(body.pendingAction.status).toBe('cancelled')
+    expect(repoSetStatusMock).not.toHaveBeenCalled()
+    expect(emitEventMock).not.toHaveBeenCalled()
+  })
+
+  it('409 expired: expiresAt in the past flips to expired and returns 409', async () => {
+    const expiredRow = makeRow({ expiresAt: new Date('2020-01-01T00:00:00.000Z') })
+    repoGetByIdMock.mockResolvedValueOnce(expiredRow)
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(409)
+    const body = await response.json()
+    expect(body.code).toBe('expired')
+    // expired branch performs a setStatus('expired', ...) + emits ai.action.expired
+    expect(repoSetStatusMock).toHaveBeenCalledTimes(1)
+    const [, nextStatus] = repoSetStatusMock.mock.calls[0]
+    expect(nextStatus).toBe('expired')
+    expect(emitEventMock).toHaveBeenCalledTimes(1)
+    expect(emitEventMock.mock.calls[0][0]).toBe('ai.action.expired')
+  })
+
+  it('409 invalid_status: already confirmed', async () => {
+    repoGetByIdMock.mockResolvedValueOnce(makeRow({ status: 'confirmed' }))
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(409)
+    const body = await response.json()
+    expect(body.code).toBe('invalid_status')
+    expect(repoSetStatusMock).not.toHaveBeenCalled()
+    expect(emitEventMock).not.toHaveBeenCalled()
+  })
+
+  it('409 invalid_status: already executing', async () => {
+    repoGetByIdMock.mockResolvedValueOnce(makeRow({ status: 'executing' }))
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(409)
+    const body = await response.json()
+    expect(body.code).toBe('invalid_status')
+  })
+
+  it('409 invalid_status: already failed', async () => {
+    repoGetByIdMock.mockResolvedValueOnce(makeRow({ status: 'failed' }))
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(409)
+    const body = await response.json()
+    expect(body.code).toBe('invalid_status')
+  })
+
+  it('404 pending_action_not_found for cross-tenant / unknown id', async () => {
+    repoGetByIdMock.mockResolvedValueOnce(null)
+
+    const response = await POST(buildRequest() as any, buildContext('pa_missing'))
+    expect(response.status).toBe(404)
+    const body = await response.json()
+    expect(body.code).toBe('pending_action_not_found')
+    expect(repoSetStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('403 forbidden when caller lacks ai_assistant.view', async () => {
+    loadAclMock.mockResolvedValueOnce({ features: ['catalog.view'], isSuperAdmin: false })
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(403)
+    const body = await response.json()
+    expect(body.code).toBe('forbidden')
+    expect(repoGetByIdMock).not.toHaveBeenCalled()
+  })
+
+  it('whitespace-only reason becomes empty → default "Cancelled by user" message', async () => {
+    repoGetByIdMock.mockResolvedValueOnce(makeRow())
+
+    const response = await POST(buildRequest({ reason: '   \t\n  ' }) as any, buildContext('pa_123'))
+    expect(response.status).toBe(200)
+    const body = await response.json()
+    expect(body.pendingAction.executionResult).toEqual({
+      error: { code: 'cancelled_by_user', message: 'Cancelled by user' },
+    })
+  })
+
+  it('400 validation_error when reason exceeds 500 characters', async () => {
+    const longReason = 'x'.repeat(501)
+    const response = await POST(buildRequest({ reason: longReason }) as any, buildContext('pa_123'))
+    expect(response.status).toBe(400)
+    const body = await response.json()
+    expect(body.code).toBe('validation_error')
+    expect(repoGetByIdMock).not.toHaveBeenCalled()
+  })
+
+  it('400 validation_error when body contains unknown fields', async () => {
+    const response = await POST(
+      buildRequest({ reason: 'ok', evil: 'payload' }) as any,
+      buildContext('pa_123'),
+    )
+    expect(response.status).toBe(400)
+    const body = await response.json()
+    expect(body.code).toBe('validation_error')
+  })
+
+  it('accepts an empty body (no reason)', async () => {
+    repoGetByIdMock.mockResolvedValueOnce(makeRow())
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(200)
+    const body = await response.json()
+    expect(body.ok).toBe(true)
+    expect(body.pendingAction.executionResult).toEqual({
+      error: { code: 'cancelled_by_user', message: 'Cancelled by user' },
+    })
+  })
+
+  it('500 cancel_internal_error when the repo throws unexpectedly', async () => {
+    repoGetByIdMock.mockRejectedValueOnce(new Error('db down'))
+
+    const response = await POST(buildRequest() as any, buildContext('pa_123'))
+    expect(response.status).toBe(500)
+    const body = await response.json()
+    expect(body.code).toBe('cancel_internal_error')
+  })
+})

package/src/modules/ai_assistant/api/ai/actions/[id]/cancel/route.ts

@@ -0,0 +1,237 @@
+import { NextResponse, type NextRequest } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { AiPendingActionRepository } from '../../../../../data/repositories/AiPendingActionRepository'
+import { hasRequiredFeatures } from '../../../../../lib/auth'
+import { serializePendingActionForClient } from '../../../../../lib/pending-action-client'
+import { checkStatusAndExpiry } from '../../../../../lib/pending-action-recheck'
+import { executePendingActionCancel } from '../../../../../lib/pending-action-cancel'
+
+/**
+ * POST `/api/ai/actions/:id/cancel` — mutation approval gate cancel
+ * endpoint (spec §9.4, Step 5.9).
+ *
+ * Siblings the Step 5.8 confirm route: flips `pending → cancelled` and
+ * emits `ai.action.cancelled`. The tool handler is NEVER invoked.
+ *
+ * The route re-uses only the `status + expiry + tenant-scope` guards
+ * from `pending-action-recheck.ts` — the agent / tool / attachment /
+ * record-version guards are confirm-only. A caller may cancel even when
+ * they'd be blocked from confirming; cancelling does not touch data.
+ *
+ * Idempotency: calling this endpoint twice on an already-`cancelled`
+ * row returns 200 with the current row without re-emitting the event.
+ */
+
+const REQUIRED_FEATURE = 'ai_assistant.view'
+
+const idParamSchema = z.object({
+  id: z
+    .string()
+    .trim()
+    .min(1, 'id must be a non-empty string')
+    .max(128, 'id exceeds the maximum length of 128 characters'),
+})
+
+const bodySchema = z
+  .object({
+    reason: z
+      .string()
+      .max(500, 'reason must be at most 500 characters')
+      .optional(),
+  })
+  .strict()
+  .optional()
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'AI Assistant',
+  summary: 'Pending action (mutation approval gate) cancel',
+  methods: {
+    POST: {
+      operationId: 'aiAssistantCancelPendingAction',
+      summary: 'Cancel an AI pending action without executing the wrapped tool.',
+      description:
+        'Flips a pending AI action from `pending` to `cancelled` and emits the ' +
+        '`ai.action.cancelled` event. The tool handler is never invoked. Idempotent: ' +
+        'a second call on a row already in `cancelled` status returns 200 with the ' +
+        'current row without re-emitting the event. Rows whose `expiresAt` is in the ' +
+        'past are flipped to `expired` and returned as 409 `expired` so the client can ' +
+        'surface the TTL loss instead of silently masking it as a cancellation.',
+      responses: [
+        {
+          status: 200,
+          description: 'Cancellation complete (or idempotent replay); body includes the serialized pending action with status `cancelled`.',
+          mediaType: 'application/json',
+        },
+      ],
+      errors: [
+        { status: 400, description: 'Invalid cancel request body (unknown field, reason exceeds 500 chars, wrong type).' },
+        { status: 401, description: 'Unauthenticated caller.' },
+        { status: 403, description: 'Caller lacks `ai_assistant.view`.' },
+        { status: 404, description: 'Pending action not found in the caller scope.' },
+        { status: 409, description: 'Pending action is not in `pending` status (already confirmed/failed/executing) or has expired.' },
+        { status: 500, description: 'Unexpected server failure during cancel.' },
+      ],
+    },
+  },
+}
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: [REQUIRED_FEATURE] },
+}
+
+interface RouteContext {
+  params: Promise<{ id: string }>
+}
+
+function jsonError(
+  status: number,
+  message: string,
+  code: string,
+  extra?: Record<string, unknown>,
+): NextResponse {
+  return NextResponse.json({ error: message, code, ...(extra ?? {}) }, { status })
+}
+
+async function readRequestBody(req: NextRequest): Promise<unknown> {
+  try {
+    const text = await req.text()
+    if (!text || text.trim().length === 0) return undefined
+    return JSON.parse(text)
+  } catch {
+    return Symbol.for('ai_assistant.cancel.bad_json')
+  }
+}
+
+export async function POST(req: NextRequest, context: RouteContext): Promise<Response> {
+  const auth = await getAuthFromRequest(req)
+  if (!auth) {
+    return jsonError(401, 'Unauthorized', 'unauthenticated')
+  }
+
+  const rawParams = await context.params
+  const paramResult = idParamSchema.safeParse(rawParams)
+  if (!paramResult.success) {
+    return jsonError(400, 'Invalid pending action id.', 'validation_error', {
+      issues: paramResult.error.issues,
+    })
+  }
+  const pendingActionId = paramResult.data.id
+
+  const rawBody = await readRequestBody(req)
+  if (rawBody === Symbol.for('ai_assistant.cancel.bad_json')) {
+    return jsonError(400, 'Invalid JSON body.', 'validation_error')
+  }
+  const bodyResult = bodySchema.safeParse(rawBody)
+  if (!bodyResult.success) {
+    return jsonError(400, 'Invalid cancel body.', 'validation_error', {
+      issues: bodyResult.error.issues,
+    })
+  }
+  const parsedBody = bodyResult.data ?? {}
+
+  try {
+    const container = await createRequestContainer()
+    const rbacService = container.resolve<RbacService>('rbacService')
+    const acl = await rbacService.loadAcl(auth.sub, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+
+    if (!hasRequiredFeatures([REQUIRED_FEATURE], acl.features, acl.isSuperAdmin, rbacService)) {
+      return jsonError(403, `Caller lacks required feature "${REQUIRED_FEATURE}".`, 'forbidden')
+    }
+
+    if (!auth.tenantId) {
+      return jsonError(
+        404,
+        `No pending action "${pendingActionId}" accessible to the caller.`,
+        'pending_action_not_found',
+      )
+    }
+
+    const em = container.resolve<EntityManager>('em')
+    const repo = new AiPendingActionRepository(em)
+    const row = await repo.getById(pendingActionId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId ?? null,
+      userId: auth.sub,
+    })
+    if (!row) {
+      return jsonError(
+        404,
+        `No pending action "${pendingActionId}" accessible to the caller.`,
+        'pending_action_not_found',
+      )
+    }
+
+    // Idempotent replay: second cancel on an already-cancelled row returns
+    // 200 with the current row and does NOT emit a second event.
+    if (row.status === 'cancelled') {
+      return NextResponse.json({
+        ok: true,
+        pendingAction: serializePendingActionForClient(row),
+      })
+    }
+
+    const statusCheck = checkStatusAndExpiry(row)
+    if (!statusCheck.ok) {
+      // Expired short-circuit: flip to `expired` + emit `ai.action.expired`
+      // so Step 5.12 does not race to do it. Return 409 so the client
+      // surfaces the TTL loss rather than silently cancelling.
+      if (statusCheck.code === 'expired') {
+        const cancelResult = await executePendingActionCancel({
+          action: row,
+          ctx: {
+            tenantId: auth.tenantId,
+            organizationId: auth.orgId ?? null,
+            userId: auth.sub,
+            container,
+          },
+          repo,
+        })
+        return jsonError(409, statusCheck.message, 'expired', {
+          pendingAction: serializePendingActionForClient(cancelResult.row),
+        })
+      }
+      return jsonError(statusCheck.status, statusCheck.message, statusCheck.code, statusCheck.extra)
+    }
+
+    const cancelResult = await executePendingActionCancel({
+      action: row,
+      ctx: {
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId ?? null,
+        userId: auth.sub,
+        container,
+      },
+      reason: parsedBody.reason,
+      repo,
+    })
+
+    if (cancelResult.status === 'expired') {
+      return jsonError(
+        409,
+        'Pending action has expired. The model must re-propose the mutation.',
+        'expired',
+        { pendingAction: serializePendingActionForClient(cancelResult.row) },
+      )
+    }
+
+    return NextResponse.json({
+      ok: true,
+      pendingAction: serializePendingActionForClient(cancelResult.row),
+    })
+  } catch (error) {
+    console.error('[AI Pending Action CANCEL] Failure:', error)
+    return jsonError(
+      500,
+      error instanceof Error ? error.message : 'Failed to cancel pending action.',
+      'cancel_internal_error',
+    )
+  }
+}