@openparachute/agent 0.1.2 → 0.2.2

package/src/modules/permissions/permissions.test.ts

@@ -1,358 +0,0 @@
-/**
- * Tests for the permissions module — canAccessAgentGroup, role helpers, and
- * ensureUserDm. Moved here from src/access.test.ts in PR #7 alongside the
- * approvals re-tier that deleted src/access.ts.
- */
-import { beforeEach, afterEach, describe, expect, it } from 'vitest';
-
-import type { ChannelAdapter, OutboundMessage } from '../../channels/adapter.js';
-import {
-  _resetActiveAdaptersForTest,
-  _setActiveAdapterForTest,
-  initChannelAdapters,
-  registerChannelAdapter,
-  teardownChannelAdapters,
-} from '../../channels/channel-registry.js';
-import { closeDb, createAgentGroup, createMessagingGroup, initTestDb, runMigrations } from '../../db/index.js';
-import { canAccessAgentGroup } from './access.js';
-import { addMember, isMember } from './db/agent-group-members.js';
-import { createUser } from './db/users.js';
-import { grantRole, hasAnyOwner, isOwner } from './db/user-roles.js';
-import { getUserDm } from './db/user-dms.js';
-import { ensureUserDm } from './user-dm.js';
-
-function now(): string {
-  return new Date().toISOString();
-}
-
-beforeEach(() => {
-  const db = initTestDb();
-  runMigrations(db);
-});
-
-afterEach(async () => {
-  await teardownChannelAdapters();
-  _resetActiveAdaptersForTest();
-  closeDb();
-});
-
-/**
- * Inject a bot-pinned mock adapter directly into the active registry.
- * Bypasses `registerChannelAdapter` / `initChannelAdapters` so a single
- * test can mount more than one adapter on the same channel type — the
- * factory-based mount overwrites within a channel.
- */
-function injectBotAdapter(
-  channelType: string,
-  botId: string,
-  openDM?: (handle: string) => Promise<string>,
-): { openDMCalls: string[] } {
-  const openDMCalls: string[] = [];
-  const adapter: ChannelAdapter = {
-    name: `${channelType}:${botId}`,
-    channelType,
-    botId,
-    supportsThreads: false,
-    async setup() {},
-    async teardown() {},
-    isConnected() {
-      return true;
-    },
-    async deliver() {
-      return undefined;
-    },
-  };
-  if (openDM) {
-    adapter.openDM = async (handle: string) => {
-      openDMCalls.push(handle);
-      return openDM(handle);
-    };
-  }
-  _setActiveAdapterForTest(adapter);
-  return { openDMCalls };
-}
-
-async function mountMockAdapter(
-  channelType: string,
-  openDM?: (handle: string) => Promise<string>,
-): Promise<{ delivered: OutboundMessage[]; openDMCalls: string[] }> {
-  const delivered: OutboundMessage[] = [];
-  const openDMCalls: string[] = [];
-  const adapter: ChannelAdapter = {
-    name: channelType,
-    channelType,
-    supportsThreads: false,
-    async setup() {},
-    async teardown() {},
-    isConnected() {
-      return true;
-    },
-    async deliver(_platformId, _threadId, message) {
-      delivered.push(message);
-      return undefined;
-    },
-    async setTyping() {},
-  };
-  if (openDM) {
-    adapter.openDM = async (handle: string) => {
-      openDMCalls.push(handle);
-      return openDM(handle);
-    };
-  }
-  registerChannelAdapter(channelType, { factory: () => adapter });
-  await initChannelAdapters(() => ({
-    conversations: [],
-    onInbound: () => {},
-    onInboundEvent: () => {},
-    onMetadata: () => {},
-    onAction: () => {},
-  }));
-  return { delivered, openDMCalls };
-}
-
-function seedAgentGroup(id: string): void {
-  createAgentGroup({
-    id,
-    name: id.toUpperCase(),
-    folder: id,
-    agent_provider: null,
-    created_at: now(),
-  });
-}
-
-function seedUser(id: string, kind: string): void {
-  createUser({ id, kind, display_name: null, created_at: now() });
-}
-
-describe('canAccessAgentGroup', () => {
-  beforeEach(() => {
-    seedAgentGroup('ag-1');
-    seedAgentGroup('ag-2');
-  });
-
-  it('denies unknown users', () => {
-    const d = canAccessAgentGroup('ghost', 'ag-1');
-    expect(d.allowed).toBe(false);
-    expect(d.allowed === false && d.reason).toBe('unknown_user');
-  });
-
-  it('allows owners globally', () => {
-    seedUser('u-owner', 'telegram');
-    grantRole({ user_id: 'u-owner', role: 'owner', agent_group_id: null, granted_by: null, granted_at: now() });
-    expect(canAccessAgentGroup('u-owner', 'ag-1').allowed).toBe(true);
-    expect(canAccessAgentGroup('u-owner', 'ag-2').allowed).toBe(true);
-  });
-
-  it('allows global admins', () => {
-    seedUser('u-ga', 'telegram');
-    grantRole({ user_id: 'u-ga', role: 'admin', agent_group_id: null, granted_by: null, granted_at: now() });
-    expect(canAccessAgentGroup('u-ga', 'ag-1').allowed).toBe(true);
-    expect(canAccessAgentGroup('u-ga', 'ag-2').allowed).toBe(true);
-  });
-
-  it('scopes admins to their agent group', () => {
-    seedUser('u-sa', 'telegram');
-    grantRole({ user_id: 'u-sa', role: 'admin', agent_group_id: 'ag-1', granted_by: null, granted_at: now() });
-    expect(canAccessAgentGroup('u-sa', 'ag-1').allowed).toBe(true);
-    const denied = canAccessAgentGroup('u-sa', 'ag-2');
-    expect(denied.allowed).toBe(false);
-    expect(denied.allowed === false && denied.reason).toBe('not_member');
-  });
-
-  it('admin @ group is implicitly a member', () => {
-    seedUser('u-sa', 'telegram');
-    grantRole({ user_id: 'u-sa', role: 'admin', agent_group_id: 'ag-1', granted_by: null, granted_at: now() });
-    expect(isMember('u-sa', 'ag-1')).toBe(true);
-  });
-
-  it('allows members of the group', () => {
-    seedUser('u-m', 'telegram');
-    addMember({ user_id: 'u-m', agent_group_id: 'ag-1', added_by: null, added_at: now() });
-    expect(canAccessAgentGroup('u-m', 'ag-1').allowed).toBe(true);
-    expect(canAccessAgentGroup('u-m', 'ag-2').allowed).toBe(false);
-  });
-
-  it('denies known-but-not-member users', () => {
-    seedUser('u-known', 'telegram');
-    const d = canAccessAgentGroup('u-known', 'ag-1');
-    expect(d.allowed).toBe(false);
-    expect(d.allowed === false && d.reason).toBe('not_member');
-  });
-});
-
-describe('role helpers', () => {
-  it('rejects owner rows with a scope', () => {
-    seedUser('u-1', 'telegram');
-    expect(() =>
-      grantRole({
-        user_id: 'u-1',
-        role: 'owner',
-        agent_group_id: 'ag-1',
-        granted_by: null,
-        granted_at: now(),
-      }),
-    ).toThrow();
-  });
-
-  it('hasAnyOwner reflects owner grants', () => {
-    seedUser('u-1', 'telegram');
-    expect(hasAnyOwner()).toBe(false);
-    grantRole({ user_id: 'u-1', role: 'owner', agent_group_id: null, granted_by: null, granted_at: now() });
-    expect(hasAnyOwner()).toBe(true);
-    expect(isOwner('u-1')).toBe(true);
-  });
-});
-
-describe('ensureUserDm', () => {
-  it('adapter without openDM: falls through to using the bare handle as platform_id', async () => {
-    await mountMockAdapter('nodm');
-    seedUser('nodm:123', 'nodm');
-
-    const mg = await ensureUserDm('nodm:123');
-    expect(mg).toBeDefined();
-    expect(mg!.channel_type).toBe('nodm');
-    expect(mg!.platform_id).toBe('123');
-    expect(mg!.is_group).toBe(0);
-
-    const cached = getUserDm('nodm:123', 'nodm');
-    expect(cached?.messaging_group_id).toBe(mg!.id);
-  });
-
-  it('Telegram via chat-sdk-bridge: adapter.openDM returns prefixed platform_id', async () => {
-    const mock = await mountMockAdapter('telegram', async (handle) => `telegram:${handle}`);
-    seedUser('telegram:6037840640', 'telegram');
-
-    const mg = await ensureUserDm('telegram:6037840640');
-    expect(mg).toBeDefined();
-    expect(mg!.platform_id).toBe('telegram:6037840640');
-    expect(mock.openDMCalls).toEqual(['6037840640']);
-
-    const mg2 = await ensureUserDm('telegram:6037840640');
-    expect(mg2!.id).toBe(mg!.id);
-    expect(mock.openDMCalls).toEqual(['6037840640']);
-  });
-
-  it('resolution-required channels: calls adapter.openDM, uses its result, caches', async () => {
-    const mock = await mountMockAdapter('discord', async (handle) => `dm-channel-${handle}`);
-    seedUser('discord:user-1', 'discord');
-
-    const mg = await ensureUserDm('discord:user-1');
-    expect(mg).toBeDefined();
-    expect(mg!.platform_id).toBe('dm-channel-user-1');
-    expect(mock.openDMCalls).toEqual(['user-1']);
-
-    const mg2 = await ensureUserDm('discord:user-1');
-    expect(mg2!.id).toBe(mg!.id);
-    expect(mock.openDMCalls).toEqual(['user-1']);
-  });
-
-  it('returns null when the adapter is not registered', async () => {
-    seedUser('missing:42', 'missing');
-    expect(await ensureUserDm('missing:42')).toBeNull();
-  });
-
-  it('returns null when adapter.openDM throws', async () => {
-    await mountMockAdapter('slack', async () => {
-      throw new Error('openDM boom');
-    });
-    seedUser('slack:u1', 'slack');
-    expect(await ensureUserDm('slack:u1')).toBeNull();
-    expect(getUserDm('slack:u1', 'slack')).toBeUndefined();
-  });
-
-  it('reuses an existing messaging_group row if one already matches', async () => {
-    await mountMockAdapter('telegram');
-    seedUser('telegram:555', 'telegram');
-    const existing = {
-      id: 'mg-preexisting',
-      channel_type: 'telegram',
-      platform_id: '555',
-      name: 'Pre-existing',
-      is_group: 0 as const,
-      unknown_sender_policy: 'strict' as const,
-      created_at: now(),
-    };
-    createMessagingGroup(existing);
-
-    const mg = await ensureUserDm('telegram:555');
-    expect(mg?.id).toBe('mg-preexisting');
-    expect(getUserDm('telegram:555', 'telegram')?.messaging_group_id).toBe('mg-preexisting');
-  });
-
-  describe('bot-aware resolution (migration 026)', () => {
-    it('opts.botId pins cold-resolve to that exact bot, caches under that bot id', async () => {
-      const primary = injectBotAdapter('telegram', 'primary-bot', async (h) => `tg-primary:${h}`);
-      const secondary = injectBotAdapter('telegram', 'secondary-bot', async (h) => `tg-secondary:${h}`);
-      seedUser('telegram:1190596288', 'telegram');
-
-      const mg = await ensureUserDm('telegram:1190596288', { botId: 'secondary-bot' });
-      expect(mg).toBeDefined();
-      expect(mg!.platform_id).toBe('tg-secondary:1190596288');
-
-      // Only the secondary bot's adapter saw the openDM call.
-      expect(primary.openDMCalls).toEqual([]);
-      expect(secondary.openDMCalls).toEqual(['1190596288']);
-
-      // Cache row is keyed under the requested bot id.
-      const cached = getUserDm('telegram:1190596288', 'telegram', 'secondary-bot');
-      expect(cached?.messaging_group_id).toBe(mg!.id);
-
-      // Channel-default slot is untouched.
-      expect(getUserDm('telegram:1190596288', 'telegram', '')).toBeUndefined();
-    });
-
-    it('cache hits scope to the bot id — same user/channel, different bot resolves separately', async () => {
-      const primary = injectBotAdapter('telegram', 'primary-bot', async (h) => `tg-primary:${h}`);
-      const secondary = injectBotAdapter('telegram', 'secondary-bot', async (h) => `tg-secondary:${h}`);
-      seedUser('telegram:42', 'telegram');
-
-      const mg1 = await ensureUserDm('telegram:42', { botId: 'primary-bot' });
-      const mg2 = await ensureUserDm('telegram:42', { botId: 'secondary-bot' });
-      expect(mg1!.platform_id).toBe('tg-primary:42');
-      expect(mg2!.platform_id).toBe('tg-secondary:42');
-      expect(mg1!.id).not.toBe(mg2!.id);
-      expect(primary.openDMCalls).toEqual(['42']);
-      expect(secondary.openDMCalls).toEqual(['42']);
-
-      // Re-resolving each is a pure cache read — no second openDM.
-      await ensureUserDm('telegram:42', { botId: 'primary-bot' });
-      await ensureUserDm('telegram:42', { botId: 'secondary-bot' });
-      expect(primary.openDMCalls).toEqual(['42']);
-      expect(secondary.openDMCalls).toEqual(['42']);
-    });
-
-    it('returns null when the requested bot has no adapter — does not silently fall back', async () => {
-      injectBotAdapter('telegram', 'primary-bot', async (h) => `tg-primary:${h}`);
-      seedUser('telegram:9', 'telegram');
-
-      // secondary-bot's adapter never spawned (e.g. its token is in
-      // secrets but `/wire-channel` hasn't completed). Asking for its
-      // DM specifically must NOT fall through to the primary bot.
-      const mg = await ensureUserDm('telegram:9', { botId: 'secondary-bot' });
-      expect(mg).toBeNull();
-      expect(getUserDm('telegram:9', 'telegram', 'secondary-bot')).toBeUndefined();
-      expect(getUserDm('telegram:9', 'telegram', '')).toBeUndefined();
-    });
-
-    it('returns null when the bot-pinned adapter.openDM throws (Telegram "bots can\'t initiate")', async () => {
-      injectBotAdapter('telegram', 'fresh-bot', async () => {
-        throw new Error("bots can't initiate DMs");
-      });
-      seedUser('telegram:5', 'telegram');
-
-      const mg = await ensureUserDm('telegram:5', { botId: 'fresh-bot' });
-      expect(mg).toBeNull();
-      // No cache row written — caller can retry once the user DMs the bot.
-      expect(getUserDm('telegram:5', 'telegram', 'fresh-bot')).toBeUndefined();
-    });
-
-    it('legacy 1-arg call writes the channel-default slot (bot_id="")', async () => {
-      await mountMockAdapter('telegram', async (h) => `telegram:${h}`);
-      seedUser('telegram:7', 'telegram');
-
-      const mg = await ensureUserDm('telegram:7');
-      expect(mg).toBeDefined();
-      expect(getUserDm('telegram:7', 'telegram', '')?.messaging_group_id).toBe(mg!.id);
-    });
-  });
-});