@openparachute/agent 0.1.2 → 0.2.2

package/src/modules/permissions/db/pending-channel-approvals.test.ts

@@ -1,86 +0,0 @@
-import fs from 'fs';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-vi.mock('../../../config.js', async () => {
-  const actual = await vi.importActual('../../../config.js');
-  return { ...actual, DATA_DIR: '/tmp/paraclaw-test-pending-channel-approvals' };
-});
-
-const TEST_DIR = '/tmp/paraclaw-test-pending-channel-approvals';
-
-const sampleRow = (messagingGroupId: string) => ({
-  messaging_group_id: messagingGroupId,
-  agent_group_id: 'ag-1',
-  original_message: '{"text":"hi"}',
-  approver_user_id: 'user-1',
-  created_at: new Date().toISOString(),
-  title: 'Card',
-  options_json: '[]',
-});
-
-describe('pending_channel_approvals atomic create', () => {
-  beforeEach(async () => {
-    if (fs.existsSync(TEST_DIR)) fs.rmSync(TEST_DIR, { recursive: true });
-    fs.mkdirSync(TEST_DIR, { recursive: true });
-    vi.resetModules();
-    const { initTestDb, runMigrations } = await import('../../../db/index.js');
-    const db = initTestDb();
-    runMigrations(db);
-    const { createAgentGroup } = await import('../../../db/agent-groups.js');
-    const { createMessagingGroup } = await import('../../../db/messaging-groups.js');
-    createAgentGroup({
-      id: 'ag-1',
-      folder: 'group-1',
-      name: 'G',
-      agent_provider: null,
-      created_at: new Date().toISOString(),
-    });
-    for (const id of ['mg-1', 'mg-2']) {
-      createMessagingGroup({
-        id,
-        channel_type: 'telegram',
-        platform_id: `telegram:bot:${id}`,
-        name: null,
-        is_group: 0,
-        unknown_sender_policy: 'request_approval',
-        created_at: new Date().toISOString(),
-      });
-    }
-    const { upsertUser } = await import('./users.js');
-    upsertUser({
-      id: 'user-1',
-      kind: 'human',
-      display_name: 'User',
-      created_at: new Date().toISOString(),
-    });
-  });
-
-  afterEach(async () => {
-    const { closeDb } = await import('../../../db/index.js');
-    closeDb();
-    if (fs.existsSync(TEST_DIR)) fs.rmSync(TEST_DIR, { recursive: true });
-  });
-
-  it('returns true on first insert, false on duplicate, and never throws', async () => {
-    const { createPendingChannelApproval, getPendingChannelApproval } = await import('./pending-channel-approvals.js');
-
-    const first = createPendingChannelApproval(sampleRow('mg-1'));
-    expect(first).toBe(true);
-
-    // Concurrent inbounds racing past the dedup check used to throw
-    // `UNIQUE constraint failed`. With ON CONFLICT DO NOTHING they
-    // return false silently and the caller skips delivery without an
-    // ERROR-level log line.
-    const second = createPendingChannelApproval(sampleRow('mg-1'));
-    expect(second).toBe(false);
-
-    const stored = getPendingChannelApproval('mg-1');
-    expect(stored?.title).toBe('Card');
-  });
-
-  it('lets a different messaging_group_id through without conflict', async () => {
-    const { createPendingChannelApproval } = await import('./pending-channel-approvals.js');
-    expect(createPendingChannelApproval(sampleRow('mg-1'))).toBe(true);
-    expect(createPendingChannelApproval(sampleRow('mg-2'))).toBe(true);
-  });
-});

package/src/modules/permissions/db/pending-channel-approvals.ts

@@ -1,66 +0,0 @@
-/**
- * CRUD for pending_channel_approvals — the in-flight state for the
- * unknown-channel registration flow. A row exists while an owner-approval
- * card is outstanding; it's deleted on approve (after wiring is created)
- * or deny (after denied_at is set on the messaging_group).
- *
- * PRIMARY KEY on messaging_group_id gives free in-flight dedup. A second
- * mention/DM while a card is pending resolves via
- * `hasInFlightChannelApproval` in the request flow and drops silently
- * instead of spamming the owner.
- */
-import { getDb } from '../../../db/connection.js';
-
-export interface PendingChannelApproval {
-  messaging_group_id: string;
-  agent_group_id: string;
-  original_message: string;
-  approver_user_id: string;
-  created_at: string;
-  /** Card title shown at creation and re-used by getAskQuestionRender on click. */
-  title: string;
-  /** Normalized options (JSON-encoded NormalizedOption[]) — same shape persisted on pending_approvals. */
-  options_json: string;
-}
-
-/**
- * Insert atomically; returns true iff this call won the race and inserted
- * the row. Returns false (without throwing) if a row was already present
- * for this messaging_group_id — the previous non-atomic check+insert pair
- * threw `UNIQUE constraint failed` when concurrent inbounds raced past
- * the dedup check, surfacing as ERROR-level noise on every multi-mention
- * burst even though user-visible behavior was correct.
- */
-export function createPendingChannelApproval(row: PendingChannelApproval): boolean {
-  const result = getDb()
-    .prepare(
-      `INSERT INTO pending_channel_approvals (
-         messaging_group_id, agent_group_id, original_message,
-         approver_user_id, created_at, title, options_json
-       )
-       VALUES (
-         @messaging_group_id, @agent_group_id, @original_message,
-         @approver_user_id, @created_at, @title, @options_json
-       )
-       ON CONFLICT(messaging_group_id) DO NOTHING`,
-    )
-    .run(row);
-  return result.changes > 0;
-}
-
-export function getPendingChannelApproval(messagingGroupId: string): PendingChannelApproval | undefined {
-  return getDb()
-    .prepare('SELECT * FROM pending_channel_approvals WHERE messaging_group_id = ?')
-    .get(messagingGroupId) as PendingChannelApproval | undefined;
-}
-
-export function hasInFlightChannelApproval(messagingGroupId: string): boolean {
-  const row = getDb()
-    .prepare('SELECT 1 AS x FROM pending_channel_approvals WHERE messaging_group_id = ?')
-    .get(messagingGroupId) as { x: number } | undefined;
-  return row !== undefined;
-}
-
-export function deletePendingChannelApproval(messagingGroupId: string): void {
-  getDb().prepare('DELETE FROM pending_channel_approvals WHERE messaging_group_id = ?').run(messagingGroupId);
-}

package/src/modules/permissions/db/pending-sender-approvals.ts

@@ -1,60 +0,0 @@
-/**
- * CRUD for pending_sender_approvals — the in-flight state for the
- * request_approval unknown-sender flow. Rows are created when an unknown
- * sender writes into a wired messaging group with that policy, and are
- * deleted on admin approve (after adding the user as a member) or deny.
- *
- * UNIQUE(messaging_group_id, sender_identity) enforces in-flight dedup:
- * a retry / second message from the same unknown sender while a card is
- * still pending is silently dropped instead of spamming the admin.
- */
-import { getDb } from '../../../db/connection.js';
-
-export interface PendingSenderApproval {
-  id: string;
-  messaging_group_id: string;
-  agent_group_id: string;
-  sender_identity: string;
-  sender_name: string | null;
-  original_message: string;
-  approver_user_id: string;
-  created_at: string;
-  /** Card title shown at creation and re-used by getAskQuestionRender on click. */
-  title: string;
-  /** Normalized options (JSON-encoded NormalizedOption[]) — same shape persisted on pending_approvals. */
-  options_json: string;
-}
-
-export function createPendingSenderApproval(row: PendingSenderApproval): void {
-  getDb()
-    .prepare(
-      `INSERT INTO pending_sender_approvals (
-         id, messaging_group_id, agent_group_id, sender_identity,
-         sender_name, original_message, approver_user_id, created_at,
-         title, options_json
-       )
-       VALUES (
-         @id, @messaging_group_id, @agent_group_id, @sender_identity,
-         @sender_name, @original_message, @approver_user_id, @created_at,
-         @title, @options_json
-       )`,
-    )
-    .run(row);
-}
-
-export function getPendingSenderApproval(id: string): PendingSenderApproval | undefined {
-  return getDb().prepare('SELECT * FROM pending_sender_approvals WHERE id = ?').get(id) as
-    | PendingSenderApproval
-    | undefined;
-}
-
-export function hasInFlightSenderApproval(messagingGroupId: string, senderIdentity: string): boolean {
-  const row = getDb()
-    .prepare('SELECT 1 AS x FROM pending_sender_approvals WHERE messaging_group_id = ? AND sender_identity = ?')
-    .get(messagingGroupId, senderIdentity) as { x: number } | undefined;
-  return row !== undefined;
-}
-
-export function deletePendingSenderApproval(id: string): void {
-  getDb().prepare('DELETE FROM pending_sender_approvals WHERE id = ?').run(id);
-}

package/src/modules/permissions/db/user-dms.ts

@@ -1,58 +0,0 @@
-import type { UserDm } from '../../../types.js';
-import { getDb } from '../../../db/connection.js';
-
-/**
- * Insert or replace a user DM cache row. Migration 026 added the
- * `bot_id` column to the PK; callers may pass `''` (empty string) to
- * write the configurable channel-default slot, or a real bot id for a
- * specific cache.
- */
-export function upsertUserDm(row: UserDm): void {
-  getDb()
-    .prepare(
-      `INSERT INTO user_dms (user_id, channel_type, bot_id, messaging_group_id, resolved_at)
-       VALUES (@user_id, @channel_type, @bot_id, @messaging_group_id, @resolved_at)
-       ON CONFLICT(user_id, channel_type, bot_id) DO UPDATE SET
-         messaging_group_id = excluded.messaging_group_id,
-         resolved_at = excluded.resolved_at`,
-    )
-    .run(row);
-}
-
-/**
- * Look up the cache row for `(user, channel, bot)`. `botId` defaults to
- * `''` so legacy callers that don't yet know about bots get the
- * channel-default slot — which is what they want before
- * `pickApprovalDelivery` was extended to thread the origin bot through.
- */
-export function getUserDm(userId: string, channelType: string, botId: string = ''): UserDm | undefined {
-  return getDb()
-    .prepare('SELECT * FROM user_dms WHERE user_id = ? AND channel_type = ? AND bot_id = ?')
-    .get(userId, channelType, botId) as UserDm | undefined;
-}
-
-/**
- * All cache rows for one user, across every `(channel_type, bot_id)`
- * pair. Order is unspecified — callers that care about a specific bot
- * should use {@link getUserDm} directly.
- */
-export function getUserDmsForUser(userId: string): UserDm[] {
-  return getDb().prepare('SELECT * FROM user_dms WHERE user_id = ?').all(userId) as UserDm[];
-}
-
-export function deleteUserDm(userId: string, channelType: string, botId: string = ''): void {
-  getDb()
-    .prepare('DELETE FROM user_dms WHERE user_id = ? AND channel_type = ? AND bot_id = ?')
-    .run(userId, channelType, botId);
-}
-
-/**
- * List the channel-default rows (`bot_id = ''`) for one user. The
- * settings UI uses this to render "default approval bot per channel"
- * — one row per channel where the user has any DM cached.
- */
-export function getDefaultUserDmsForUser(userId: string): UserDm[] {
-  return getDb()
-    .prepare("SELECT * FROM user_dms WHERE user_id = ? AND bot_id = '' ORDER BY channel_type")
-    .all(userId) as UserDm[];
-}

package/src/modules/permissions/db/user-roles.ts

@@ -1,85 +0,0 @@
-import type { UserRole, UserRoleKind } from '../../../types.js';
-import { getDb } from '../../../db/connection.js';
-
-/**
- * Grant a role. Owner rows must have agent_group_id = null (enforced here,
- * not by schema, so callers get a clean error path).
- */
-export function grantRole(row: UserRole): void {
-  if (row.role === 'owner' && row.agent_group_id !== null) {
-    throw new Error('owner role must be global (agent_group_id = null)');
-  }
-  getDb()
-    .prepare(
-      `INSERT INTO user_roles (user_id, role, agent_group_id, granted_by, granted_at)
-       VALUES (@user_id, @role, @agent_group_id, @granted_by, @granted_at)`,
-    )
-    .run(row);
-}
-
-export function revokeRole(userId: string, role: UserRoleKind, agentGroupId: string | null): void {
-  if (agentGroupId === null) {
-    getDb()
-      .prepare('DELETE FROM user_roles WHERE user_id = ? AND role = ? AND agent_group_id IS NULL')
-      .run(userId, role);
-  } else {
-    getDb()
-      .prepare('DELETE FROM user_roles WHERE user_id = ? AND role = ? AND agent_group_id = ?')
-      .run(userId, role, agentGroupId);
-  }
-}
-
-export function getUserRoles(userId: string): UserRole[] {
-  return getDb().prepare('SELECT * FROM user_roles WHERE user_id = ?').all(userId) as UserRole[];
-}
-
-export function isOwner(userId: string): boolean {
-  const row = getDb()
-    .prepare('SELECT 1 FROM user_roles WHERE user_id = ? AND role = ? AND agent_group_id IS NULL LIMIT 1')
-    .get(userId, 'owner');
-  return !!row;
-}
-
-export function isGlobalAdmin(userId: string): boolean {
-  const row = getDb()
-    .prepare('SELECT 1 FROM user_roles WHERE user_id = ? AND role = ? AND agent_group_id IS NULL LIMIT 1')
-    .get(userId, 'admin');
-  return !!row;
-}
-
-export function isAdminOfAgentGroup(userId: string, agentGroupId: string): boolean {
-  const row = getDb()
-    .prepare('SELECT 1 FROM user_roles WHERE user_id = ? AND role = ? AND agent_group_id = ? LIMIT 1')
-    .get(userId, 'admin', agentGroupId);
-  return !!row;
-}
-
-/** Any admin privilege over this agent group: global admin OR scoped admin. */
-export function hasAdminPrivilege(userId: string, agentGroupId: string): boolean {
-  return isOwner(userId) || isGlobalAdmin(userId) || isAdminOfAgentGroup(userId, agentGroupId);
-}
-
-export function getOwners(): UserRole[] {
-  return getDb()
-    .prepare('SELECT * FROM user_roles WHERE role = ? AND agent_group_id IS NULL ORDER BY granted_at')
-    .all('owner') as UserRole[];
-}
-
-export function hasAnyOwner(): boolean {
-  const row = getDb()
-    .prepare('SELECT 1 FROM user_roles WHERE role = ? AND agent_group_id IS NULL LIMIT 1')
-    .get('owner');
-  return !!row;
-}
-
-export function getGlobalAdmins(): UserRole[] {
-  return getDb()
-    .prepare('SELECT * FROM user_roles WHERE role = ? AND agent_group_id IS NULL ORDER BY granted_at')
-    .all('admin') as UserRole[];
-}
-
-export function getAdminsOfAgentGroup(agentGroupId: string): UserRole[] {
-  return getDb()
-    .prepare('SELECT * FROM user_roles WHERE role = ? AND agent_group_id = ? ORDER BY granted_at')
-    .all('admin', agentGroupId) as UserRole[];
-}

package/src/modules/permissions/db/users.ts

@@ -1,38 +0,0 @@
-import type { User } from '../../../types.js';
-import { getDb } from '../../../db/connection.js';
-
-export function createUser(user: User): void {
-  getDb()
-    .prepare(
-      `INSERT INTO users (id, kind, display_name, created_at)
-       VALUES (@id, @kind, @display_name, @created_at)`,
-    )
-    .run(user);
-}
-
-export function upsertUser(user: User): void {
-  getDb()
-    .prepare(
-      `INSERT INTO users (id, kind, display_name, created_at)
-       VALUES (@id, @kind, @display_name, @created_at)
-       ON CONFLICT(id) DO UPDATE SET
-         display_name = COALESCE(excluded.display_name, users.display_name)`,
-    )
-    .run(user);
-}
-
-export function getUser(id: string): User | undefined {
-  return getDb().prepare('SELECT * FROM users WHERE id = ?').get(id) as User | undefined;
-}
-
-export function getAllUsers(): User[] {
-  return getDb().prepare('SELECT * FROM users ORDER BY created_at').all() as User[];
-}
-
-export function updateDisplayName(id: string, displayName: string): void {
-  getDb().prepare('UPDATE users SET display_name = ? WHERE id = ?').run(displayName, id);
-}
-
-export function deleteUser(id: string): void {
-  getDb().prepare('DELETE FROM users WHERE id = ?').run(id);
-}