@pikku/core 0.12.93 → 0.12.95

package/src/wirings/scheduler/scheduler-runner.test.ts

@@ -213,6 +213,97 @@ describe('runScheduledTask', () => {
     assert.deepEqual(receivedSession, session)
   })
 
+  test('a task middleware can set the session the task runs as', async () => {
+    let frozenSession: CoreUserSession | undefined
+    const machineSession: CoreUserSession = {
+      userId: 'cron:machine-session-task',
+    }
+
+    const mockTask: CoreScheduledTask = {
+      name: 'machine-session-task',
+      schedule: '0 0 * * *',
+      middleware: [
+        async (_services: any, wire: any, next: any) => {
+          wire.setSession(machineSession)
+          return next()
+        },
+      ] as any,
+      func: {
+        func: async (_services: any, _data: any, wire: any) => {
+          frozenSession = wire.session
+        },
+        auth: false,
+      },
+    }
+
+    pikkuState(null, 'scheduler', 'meta')['machine-session-task'] = {
+      pikkuFuncId: 'scheduler_machine-session-task',
+      name: 'machine-session-task',
+      schedule: '0 0 * * *',
+    }
+    pikkuState(null, 'function', 'meta')['scheduler_machine-session-task'] = {
+      pikkuFuncId: 'scheduler_machine-session-task',
+      inputSchemaName: null,
+      outputSchemaName: null,
+      sessionless: true,
+    }
+    wireScheduler(mockTask)
+
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: createMockLogger(),
+    } as any)
+
+    await runScheduledTask({ name: 'machine-session-task' })
+
+    assert.deepEqual(frozenSession, machineSession)
+  })
+
+  test('a session-taking task does not warn that auth was disabled', async () => {
+    const mockTask: CoreScheduledTask = {
+      name: 'identified-task',
+      schedule: '0 0 * * *',
+      middleware: [
+        async (_services: any, wire: any, next: any) => {
+          wire.setSession({ userId: 'cron:identified-task' })
+          return next()
+        },
+      ] as any,
+      func: {
+        func: async () => {},
+      },
+    }
+
+    pikkuState(null, 'scheduler', 'meta')['identified-task'] = {
+      pikkuFuncId: 'scheduler_identified-task',
+      name: 'identified-task',
+      schedule: '0 0 * * *',
+    }
+    pikkuState(null, 'function', 'meta')['scheduler_identified-task'] = {
+      pikkuFuncId: 'scheduler_identified-task',
+      inputSchemaName: null,
+      outputSchemaName: null,
+      sessionless: false,
+    }
+    wireScheduler(mockTask)
+
+    const mockLogger = createMockLogger()
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: mockLogger,
+    } as any)
+
+    await runScheduledTask({ name: 'identified-task' })
+
+    assert.deepEqual(
+      mockLogger
+        .getLogs()
+        .filter(
+          (log) =>
+            log.level === 'warn' && /auth was explicitly disabled/.test(log.message)
+        ),
+      []
+    )
+  })
+
   test('should throw ScheduledTaskNotFoundError when task not found', async () => {
     const mockLogger = createMockLogger()
     pikkuState(null, 'package', 'singletonServices', {
@@ -655,3 +746,90 @@ describe('getScheduledTasks', () => {
     assert.equal(tasks.size, 0)
   })
 })
+
+/**
+ * A cron has no caller to authenticate, so the only thing that can give it an
+ * identity is its own wiring. These cover the mechanism the virtual-user
+ * scaffold's `virtualUserPlatformSession` relies on: middleware on the task
+ * sets the session, and the scope gate on the function it drives is enforced
+ * against exactly that session — a tick with no identity, or one holding the
+ * wrong scope, is refused the same way a person would be.
+ */
+describe('a scheduled task authorizes on the session its own middleware sets', () => {
+  const wireGatedTask = (
+    name: string,
+    middleware?: Array<
+      (services: any, wire: any, next: any) => Promise<void> | void
+    >
+  ) => {
+    let seen: CoreUserSession | undefined
+    const task: CoreScheduledTask = {
+      name,
+      schedule: '0 * * * *',
+      func: {
+        func: async (_services: any, _data: any, wire: any) => {
+          seen = await wire.getSession()
+        },
+      } as any,
+      middleware,
+    }
+    pikkuState(null, 'scheduler', 'meta')[name] = {
+      pikkuFuncId: `scheduler_${name}`,
+      name,
+      schedule: '0 * * * *',
+    }
+    pikkuState(null, 'function', 'meta')[`scheduler_${name}`] = {
+      pikkuFuncId: `scheduler_${name}`,
+      inputSchemaName: null,
+      outputSchemaName: null,
+      sessionless: false,
+      scopes: ['virtualUser:run'],
+    }
+    wireScheduler(task)
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: createMockLogger(),
+    } as any)
+    return () => seen
+  }
+
+  const settingSession = (session: CoreUserSession) => [
+    async (_services: any, wire: any, next: any) => {
+      await wire.setSession(session)
+      return next()
+    },
+  ]
+
+  test('is refused outright when nothing gives the tick an identity', async () => {
+    wireGatedTask('unidentified-tick')
+    await assert.rejects(
+      runScheduledTask({ name: 'unidentified-tick' }),
+      /Authentication required/
+    )
+  })
+
+  test('is refused when the identity it sets holds the wrong scope', async () => {
+    wireGatedTask(
+      'misscoped-tick',
+      settingSession({
+        userId: 'pikku-platform',
+        scopes: ['admin'],
+      } as CoreUserSession)
+    )
+    await assert.rejects(
+      runScheduledTask({ name: 'misscoped-tick' }),
+      /virtualUser:run/
+    )
+  })
+
+  test('runs as the platform user its middleware set', async () => {
+    const seen = wireGatedTask(
+      'platform-tick',
+      settingSession({
+        userId: 'pikku-platform',
+        scopes: ['virtualUser:run'],
+      } as CoreUserSession)
+    )
+    await runScheduledTask({ name: 'platform-tick' })
+    assert.equal(seen()?.userId, 'pikku-platform')
+  })
+})

package/src/wirings/scheduler/scheduler-runner.ts

@@ -116,7 +116,6 @@ export async function runScheduledTask({
     await runPikkuFunc('scheduler', meta.name, meta.pikkuFuncId, {
       singletonServices,
       createWireServices,
-      auth: false,
       data: () => undefined,
       inheritedMiddleware: meta.middleware,
       wireMiddleware: task.middleware,

package/src/wirings/virtual-user/index.ts

@@ -85,3 +85,23 @@ export {
   personaVirtualUserTarget,
   type PersonaTargetOptions,
 } from './virtual-user-target.js'
+export {
+  executeVirtualUserRun,
+  logVirtualUserTick,
+  requireVirtualUserRunStore,
+  requireVirtualUserScheduleStore,
+  runnablePersona,
+  serializeVirtualUserRun,
+  serializeVirtualUserSchedule,
+  serializeVirtualUserSteps,
+  signInPathFor,
+  startVirtualUserRun,
+  VIRTUAL_USER_VARIABLES,
+  virtualUserScheduleRunInput,
+  writeVirtualUserSchedule,
+  type ExecuteVirtualUserRunParams,
+  type ScaffoldPersonas,
+  type StartedVirtualUserRun,
+  type StartVirtualUserRunParams,
+  type WriteVirtualUserScheduleParams,
+} from './virtual-user-scaffold.js'

package/src/wirings/virtual-user/virtual-user-derive.test.ts

@@ -396,3 +396,31 @@ describe('driving a virtual user through a signed-in actor', () => {
     assert.match(verdict.reasoning, /no assistant called 'concierge'/)
   })
 })
+
+// An adversarial run's transcript is working exploits against this same app,
+// and a schedule outlives the run that wrote it. Neither belongs in the hands
+// of the thing being run.
+test('a virtual user is never offered the machinery that runs virtual users', () => {
+  const catalogue = deriveCatalogue({
+    runVirtualUser: {
+      name: 'runVirtualUser',
+      expose: true,
+      scopes: ['virtualUser:run'],
+    },
+    getVirtualUserRunSteps: {
+      name: 'getVirtualUserRunSteps',
+      expose: true,
+      scopes: ['virtualUser:read'],
+    },
+    listBookings: {
+      name: 'listBookings',
+      expose: true,
+      scopes: ['bookings:read'],
+    },
+  } as any)
+
+  assert.deepEqual(
+    catalogue.map((entry) => entry.name),
+    ['listBookings']
+  )
+})

package/src/wirings/virtual-user/virtual-user-derive.ts

@@ -35,6 +35,15 @@ export const deriveCatalogue = (
     if (meta.scenario || meta.scenarioStep || meta.scenarioStepKind) continue
     // knowledge: decisions/internals/only-exposed-functions-enter-a-virtual-user-catalogue.md
     if (meta.expose !== true) continue
+    // A virtual user is not offered the machinery that runs virtual users. A
+    // persona whose role carries `virtualUser:*` would otherwise be able to
+    // start further runs, read every run's findings — an adversarial run's
+    // transcript is working exploits against this same app — and put a persona
+    // on a schedule that outlives it. Same reasoning as the scenario-step rule
+    // above: the tool is about the run, not about the product being explored.
+    if (meta.scopes?.some((scope) => scope.split(':')[0] === 'virtualUser')) {
+      continue
+    }
 
     const inputSchema = meta.inputSchemaName
       ? schemas[meta.inputSchemaName]