@salesforce/afv-skills 1.41.0 → 1.43.0

package/skills/service-email-to-case-configure/scripts/tests/test_get_session.py

@@ -0,0 +1,134 @@
+"""Tests for get_session's access-token acquisition and _usable_access_token.
+
+The FakeOrg-based suites patch get_session wholesale, so they never exercise the
+token-selection logic. This module covers it directly:
+
+  * _usable_access_token — accept a live `<orgId>!<secret>` token, reject the
+    `[REDACTED ...]` marker recent CLIs emit, and reject None/empty/non-string.
+  * get_session — prefer `sf org auth show-access-token`; on a redacted or
+    missing primary token, fall back to a `--verbose` `sf org display`; hard-fail
+    when neither yields a usable token.
+
+All `sf` invocations are mocked at the sf_json / sf_json_optional layer — no
+live org required.
+"""
+from __future__ import annotations
+
+import unittest
+from unittest import mock
+
+from . import _bootstrap
+
+apply_mod = _bootstrap.load_apply()
+
+# A value shaped like a live Salesforce session token: <orgId>!<secret>.
+REAL_TOKEN = "00D000000000001AAA!AQ" + "x" * 90
+# The marker recent CLIs return from `sf org display` in place of the token.
+REDACTED = "[REDACTED] Use 'sf org auth show-access-token' to view the token"
+
+DISPLAY = {
+    "instanceUrl": "https://example.my.salesforce.com",
+    "username": "auth@example.com",
+    "apiVersion": "68.0",
+}
+
+
+def _dispatch(show_at, verbose):
+    """Build an sf_json_optional stand-in that returns ``show_at`` for the
+    show-access-token call and ``verbose`` for the `--verbose` display call."""
+    def _impl(args):
+        if "show-access-token" in args:
+            return show_at
+        if "--verbose" in args:
+            return verbose
+        return None
+    return _impl
+
+
+class UsableAccessToken(unittest.TestCase):
+    """_usable_access_token: live token has '!' and is not the redaction marker."""
+
+    def test_real_token(self):
+        self.assertTrue(apply_mod._usable_access_token(REAL_TOKEN))
+
+    def test_redaction_marker_rejected(self):
+        self.assertFalse(apply_mod._usable_access_token(REDACTED))
+
+    def test_none_rejected(self):
+        self.assertFalse(apply_mod._usable_access_token(None))
+
+    def test_empty_rejected(self):
+        self.assertFalse(apply_mod._usable_access_token(""))
+
+    def test_token_without_separator_rejected(self):
+        self.assertFalse(apply_mod._usable_access_token("noseparator" + "x" * 40))
+
+    def test_non_string_rejected(self):
+        self.assertFalse(apply_mod._usable_access_token(12345))
+
+
+class GetSessionTokenAcquisition(unittest.TestCase):
+    """get_session: primary show-access-token, verbose fallback, hard-fail."""
+
+    def setUp(self):
+        # get_session derives API_VERSION from the org unless forced; keep the
+        # derivation path deterministic regardless of test ordering.
+        apply_mod._API_VERSION_EXPLICIT = False
+
+    def _run(self, show_at, verbose):
+        opt = mock.MagicMock(side_effect=_dispatch(show_at, verbose))
+        with mock.patch.object(apply_mod, "sf_json", return_value=dict(DISPLAY)), \
+                mock.patch.object(apply_mod, "sf_json_optional", opt):
+            result = apply_mod.get_session("myorg")
+        return result, opt
+
+    @staticmethod
+    def _verbose_calls(opt):
+        return [c for c in opt.call_args_list if "--verbose" in c.args[0]]
+
+    def test_primary_path_uses_show_access_token(self):
+        (token, md_url, inst, user), opt = self._run(
+            show_at={"accessToken": REAL_TOKEN},
+            verbose={"accessToken": "should-not-be-used!"})
+        self.assertEqual(token, REAL_TOKEN)
+        self.assertEqual(inst, DISPLAY["instanceUrl"])
+        self.assertEqual(user, DISPLAY["username"])
+        self.assertEqual(
+            md_url, f"{DISPLAY['instanceUrl']}/services/Soap/m/68.0")
+        # Happy path must not issue the verbose fallback display.
+        self.assertEqual(self._verbose_calls(opt), [])
+
+    def test_primary_path_accepts_bare_string_result(self):
+        # Defensive: if a CLI version returns the token as a bare string in
+        # `result` (not an {accessToken} object), get_session must still use it.
+        (token, *_), opt = self._run(
+            show_at=REAL_TOKEN,
+            verbose={"accessToken": "should-not-be-used!"})
+        self.assertEqual(token, REAL_TOKEN)
+        self.assertEqual(self._verbose_calls(opt), [])
+
+    def test_redacted_primary_falls_back_to_verbose_display(self):
+        (token, *_), opt = self._run(
+            show_at={"accessToken": REDACTED},
+            verbose={"accessToken": REAL_TOKEN})
+        self.assertEqual(token, REAL_TOKEN)
+        self.assertEqual(len(self._verbose_calls(opt)), 1)
+
+    def test_missing_subcommand_falls_back_to_verbose_display(self):
+        (token, *_), opt = self._run(
+            show_at=None, verbose={"accessToken": REAL_TOKEN})
+        self.assertEqual(token, REAL_TOKEN)
+        self.assertEqual(len(self._verbose_calls(opt)), 1)
+
+    def test_redacted_everywhere_exits(self):
+        with self.assertRaises(SystemExit):
+            self._run(show_at={"accessToken": REDACTED},
+                      verbose={"accessToken": REDACTED})
+
+    def test_no_token_anywhere_exits(self):
+        with self.assertRaises(SystemExit):
+            self._run(show_at=None, verbose=None)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/service-email-to-case-configure/scripts/tests/test_new_capabilities.py

@@ -0,0 +1,193 @@
+"""Tests for the three capabilities added for the Email-to-Case steel thread:
+
+  1. Production-org safety gate (enforce_production_gate / --confirm-production).
+  2. API-version derivation with a 67.0 floor (resolve_api_version).
+  3. Act-3 verify-cases proof step (verify_cases / --verify-cases).
+
+All org I/O is mocked via FakeOrg — no live org required.
+"""
+from __future__ import annotations
+
+import tempfile
+import unittest
+
+from . import _bootstrap
+from ._fakeorg import FakeOrg
+from ._run import Input, run_main, write_input
+
+apply_mod = _bootstrap.load_apply()
+
+ADMIN = "admin@acme.com"
+AUTH = "authuser@fake.example.com"
+
+
+def _fresh(**kw):
+    kw.setdefault("case_settings",
+                  {"fullName": "Case",
+                   "defaultCaseOwner": ADMIN,
+                   "defaultCaseOwnerType": "User",
+                   "defaultCaseUser": ADMIN,
+                   "emailToCase": {"enableEmailToCase": False}})
+    kw.setdefault("active_users", [ADMIN, AUTH])
+    return FakeOrg(**kw)
+
+
+def _apply(org, extra_argv, addr=True):
+    b = Input().with_default_toggles()
+    if addr:
+        b = b.address(addressType="EmailToCase", routingName="Support",
+                      caseOrigin="Email", casePriority="Medium")
+    src = b.build()
+    with tempfile.TemporaryDirectory() as d, org.patch(apply_mod):
+        path = write_input(d, src)
+        argv = ["--target-org", "x", "--input", path]
+        if addr:
+            argv += ["--routing-email", "support@acme.com"]
+        return run_main(apply_mod, argv + extra_argv)
+
+
+class ApiVersionDerivation(unittest.TestCase):
+    """resolve_api_version: floor at DEFAULT_API_VERSION, ride newer orgs."""
+
+    def test_floors_below_default(self):
+        self.assertEqual(apply_mod.resolve_api_version("62.0"), "67.0")
+
+    def test_equal_to_floor(self):
+        self.assertEqual(apply_mod.resolve_api_version("67.0"), "67.0")
+
+    def test_rides_newer_org(self):
+        self.assertEqual(apply_mod.resolve_api_version("68.0"), "68.0")
+
+    def test_rides_much_newer_org(self):
+        self.assertEqual(apply_mod.resolve_api_version("70.0"), "70.0")
+
+    def test_none_falls_back_to_floor(self):
+        self.assertEqual(apply_mod.resolve_api_version(None), "67.0")
+
+    def test_garbage_falls_back_to_floor(self):
+        self.assertEqual(apply_mod.resolve_api_version("not-a-version"), "67.0")
+
+    def test_summary_reports_derived_version(self):
+        org = _fresh(org_api_version="70.0")
+        summary = _apply(org, [])
+        self.assertEqual(summary["apiVersion"], "70.0")
+
+    def test_summary_reports_floored_version(self):
+        org = _fresh(org_api_version="60.0")
+        summary = _apply(org, [])
+        self.assertEqual(summary["apiVersion"], "67.0")
+
+
+class ProductionGate(unittest.TestCase):
+    """enforce_production_gate: block prod writes unless --confirm-production."""
+
+    def test_sandbox_writes_without_confirmation(self):
+        org = _fresh(is_sandbox=True)
+        summary = _apply(org, [])
+        self.assertFalse(summary["orgInfo"]["isProduction"])
+        self.assertEqual(summary["verified"]["routingAddressCount"], 1)
+
+    def test_trial_writes_without_confirmation(self):
+        org = _fresh(is_sandbox=False, is_trial=True, org_type="Trial")
+        summary = _apply(org, [])
+        self.assertFalse(summary["orgInfo"]["isProduction"])
+        self.assertEqual(summary["verified"]["routingAddressCount"], 1)
+
+    def test_production_blocked_without_confirmation(self):
+        org = _fresh(is_sandbox=False, is_trial=False,
+                     org_type="Professional Edition")
+        with self.assertRaises(SystemExit):
+            _apply(org, [])
+        # nothing was written
+        self.assertEqual(org.writes, [])
+
+    def test_production_writes_with_confirmation(self):
+        org = _fresh(is_sandbox=False, is_trial=False,
+                     org_type="Professional Edition")
+        summary = _apply(org, ["--confirm-production"])
+        self.assertTrue(summary["orgInfo"]["isProduction"])
+        self.assertEqual(summary["verified"]["routingAddressCount"], 1)
+
+    def test_unreadable_org_row_blocked_without_confirmation(self):
+        org = _fresh(is_sandbox=None)
+        with self.assertRaises(SystemExit):
+            _apply(org, [])
+        self.assertEqual(org.writes, [])
+
+    def test_unreadable_org_row_writes_with_confirmation(self):
+        org = _fresh(is_sandbox=None)
+        summary = _apply(org, ["--confirm-production"])
+        self.assertEqual(summary["verified"]["routingAddressCount"], 1)
+
+
+class VerifyCasesMode(unittest.TestCase):
+    """verify_cases / --verify-cases: proof requires an Email-origin Case with a
+    linked incoming EmailMessage."""
+
+    def _run_verify(self, org, extra=None):
+        # --verify-cases needs no input write, but main() requires --input; a
+        # throwaway file satisfies argparse (it isn't parsed in this mode).
+        src = Input().with_default_toggles().build()
+        with tempfile.TemporaryDirectory() as d, org.patch(apply_mod):
+            path = write_input(d, src)
+            return run_main(apply_mod, ["--target-org", "x", "--input", path,
+                                        "--verify-cases", *(extra or [])])
+
+    def test_proven_when_case_and_incoming_message(self):
+        org = _fresh(
+            cases=[{"Id": "500x1", "CaseNumber": "00001001", "Origin": "Email",
+                    "SuppliedEmail": "ext@customer.com", "Subject": "Help",
+                    "Status": "New", "CreatedDate": "2026-08-18T10:00:00Z"}],
+            email_messages=[{"Id": "02sx1", "ParentId": "500x1",
+                             "Incoming": True, "FromAddress": "ext@customer.com",
+                             "Subject": "Help",
+                             "MessageDate": "2026-08-18T10:00:00Z"}])
+        summary = self._run_verify(org)
+        self.assertTrue(summary["proven"])
+        self.assertEqual(summary["caseCount"], 1)
+        self.assertEqual(summary["incomingEmailMessageCount"], 1)
+        self.assertTrue(summary["cases"][0]["hasIncomingEmailMessage"])
+
+    def test_no_cases_fails_closed(self):
+        org = _fresh(cases=[], email_messages=[])
+        with self.assertRaises(SystemExit):
+            self._run_verify(org)
+
+    def test_case_without_incoming_message_fails_closed(self):
+        org = _fresh(
+            cases=[{"Id": "500x1", "CaseNumber": "00001001", "Origin": "Email",
+                    "SuppliedEmail": "ext@customer.com", "Subject": "Help",
+                    "Status": "New", "CreatedDate": "2026-08-18T10:00:00Z"}],
+            email_messages=[])  # no linked incoming email
+        with self.assertRaises(SystemExit):
+            self._run_verify(org)
+
+    def test_supplied_email_filter_narrows_cases(self):
+        org = _fresh(
+            cases=[
+                {"Id": "500x1", "CaseNumber": "1", "Origin": "Email",
+                 "SuppliedEmail": "ext@customer.com", "Subject": "A",
+                 "Status": "New", "CreatedDate": "2026-08-18T10:00:00Z"},
+                {"Id": "500x2", "CaseNumber": "2", "Origin": "Email",
+                 "SuppliedEmail": "other@somewhere.com", "Subject": "B",
+                 "Status": "New", "CreatedDate": "2026-08-18T11:00:00Z"}],
+            email_messages=[{"Id": "02sx1", "ParentId": "500x1",
+                             "Incoming": True, "MessageDate": "x"}])
+        summary = self._run_verify(org, ["--supplied-email", "ext@customer.com"])
+        self.assertEqual(summary["caseCount"], 1)
+        self.assertEqual(summary["cases"][0]["suppliedEmail"], "ext@customer.com")
+        self.assertTrue(summary["proven"])
+
+    def test_verify_cases_does_not_write(self):
+        org = _fresh(
+            cases=[{"Id": "500x1", "CaseNumber": "1", "Origin": "Email",
+                    "SuppliedEmail": "ext@customer.com", "Subject": "A",
+                    "Status": "New", "CreatedDate": "x"}],
+            email_messages=[{"Id": "02sx1", "ParentId": "500x1",
+                             "Incoming": True, "MessageDate": "x"}])
+        self._run_verify(org)
+        self.assertEqual(org.writes, [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/service-email-to-case-configure/scripts/tests/test_validate_casesettings.py

@@ -0,0 +1,170 @@
+"""Unit tests for validate-casesettings.py.
+
+The validator checks a CaseSettings SOURCE file (the input to
+apply-casesettings.py) for structural rules that must hold BEFORE applying —
+independent of any org. These are pure, deterministic checks, so they are unit
+tested here rather than covered by evals (evals score the LLM-authored artifact
+against a gold, they do not assert on the validator's fail-closed behavior).
+
+``validate(path)`` returns a list of human-readable error strings — empty means
+the file passed. Each test writes a source file to a temp dir and asserts the
+error list contains (or lacks) the expected message.
+"""
+from __future__ import annotations
+
+import tempfile
+import unittest
+
+from . import _bootstrap
+from ._run import Input, write_input
+
+validate_mod = _bootstrap.load_validate()
+
+
+def _errors(xml: str) -> list:
+    """Write xml to a temp file, run validate(), return the error list."""
+    with tempfile.TemporaryDirectory() as d:
+        path = write_input(d, xml)
+        return validate_mod.validate(path)
+
+
+def _has(errors, needle) -> bool:
+    return any(needle in e for e in errors)
+
+
+# A minimal source file that should PASS: E2C on, on-demand on, one well-formed
+# EmailToCase routing address, no owner fields, no emailAddress.
+def _valid_src(**addr_over) -> str:
+    addr = dict(addressType="EmailToCase", routingName="Support",
+                caseOrigin="Email", casePriority="Medium")
+    addr.update(addr_over)
+    return Input().address(**addr).build()
+
+
+class ValidSourceFile(unittest.TestCase):
+    def test_minimal_valid_file_passes(self):
+        self.assertEqual(_errors(_valid_src()), [])
+
+    def test_valid_with_optional_toggles_passes(self):
+        xml = (Input().with_default_toggles()
+               .address(addressType="EmailToCase", routingName="Support",
+                        caseOrigin="Email", casePriority="Medium").build())
+        self.assertEqual(_errors(xml), [])
+
+    def test_valid_with_user_case_owner_passes(self):
+        self.assertEqual(
+            _errors(_valid_src(caseOwner="agent@acme.com", caseOwnerType="User")),
+            [])
+
+
+class StructuralRules(unittest.TestCase):
+    def test_not_well_formed_xml(self):
+        errors = _errors("<CaseSettings>not closed")
+        self.assertTrue(_has(errors, "not well-formed"))
+
+    def test_wrong_root_element(self):
+        xml = ('<?xml version="1.0" encoding="UTF-8"?>\n'
+               '<Foo xmlns="http://soap.sforce.com/2006/04/metadata"></Foo>\n')
+        self.assertTrue(_has(_errors(xml), "Root element must be CaseSettings"))
+
+    def test_missing_email_to_case_block(self):
+        xml = ('<?xml version="1.0" encoding="UTF-8"?>\n'
+               '<CaseSettings xmlns="http://soap.sforce.com/2006/04/metadata">\n'
+               '</CaseSettings>\n')
+        self.assertTrue(_has(_errors(xml), "Missing <emailToCase> block"))
+
+
+class RequiredToggles(unittest.TestCase):
+    def test_on_demand_must_be_true(self):
+        xml = (Input().e2c(enableOnDemandEmailToCase="false")
+               .address(addressType="EmailToCase", routingName="Support",
+                        caseOrigin="Email", casePriority="Medium").build())
+        self.assertTrue(_has(_errors(xml), "enableOnDemandEmailToCase must be 'true'"))
+
+    def test_enable_email_to_case_must_be_true(self):
+        xml = (Input().e2c(enableEmailToCase="false")
+               .address(addressType="EmailToCase", routingName="Support",
+                        caseOrigin="Email", casePriority="Medium").build())
+        self.assertTrue(_has(_errors(xml), "enableEmailToCase must be 'true'"))
+
+    def test_non_boolean_toggle_flagged(self):
+        xml = (Input().e2c(enableHtmlEmail="yes")
+               .address(addressType="EmailToCase", routingName="Support",
+                        caseOrigin="Email", casePriority="Medium").build())
+        self.assertTrue(_has(_errors(xml),
+                             "emailToCase.enableHtmlEmail must be 'true' or 'false'"))
+
+
+class RoutingAddressRules(unittest.TestCase):
+    def test_no_routing_address_flagged(self):
+        self.assertTrue(_has(_errors(Input().build()), "No <routingAddresses> found"))
+
+    def test_missing_required_address_field(self):
+        # routingName omitted
+        xml = Input().address(addressType="EmailToCase", caseOrigin="Email",
+                              casePriority="Medium").build()
+        self.assertTrue(_has(_errors(xml), "missing required field 'routingName'"))
+
+    def test_email_address_in_source_rejected(self):
+        # emailAddress must never be in the source file — supplied at apply time.
+        xml = _valid_src(emailAddress="support@acme.com")
+        self.assertTrue(_has(_errors(xml), "sets 'emailAddress'"))
+
+    def test_readonly_field_rejected(self):
+        xml = _valid_src(isVerified="true")
+        self.assertTrue(_has(_errors(xml), "read-only field 'isVerified'"))
+
+    def test_e2ceasy_address_type_rejected(self):
+        xml = _valid_src(addressType="E2cEasy")
+        self.assertTrue(_has(_errors(xml), "E2cEasy"))
+
+    def test_invalid_address_type_rejected(self):
+        xml = _valid_src(addressType="Bogus")
+        self.assertTrue(_has(_errors(xml), "addressType 'Bogus' invalid"))
+
+    def test_duplicate_routing_name_flagged(self):
+        xml = (Input()
+               .address(addressType="EmailToCase", routingName="Dup",
+                        caseOrigin="Email", casePriority="Medium")
+               .address(addressType="EmailToCase", routingName="Dup",
+                        caseOrigin="Email", casePriority="High").build())
+        self.assertTrue(_has(_errors(xml), "duplicate routingName 'Dup'"))
+
+
+class PerAddressCaseOwnerRules(unittest.TestCase):
+    def test_case_owner_without_type_rejected(self):
+        xml = _valid_src(caseOwner="agent@acme.com")  # no caseOwnerType
+        self.assertTrue(_has(_errors(xml), "sets caseOwner without caseOwnerType"))
+
+    def test_case_owner_type_without_owner_rejected(self):
+        xml = _valid_src(caseOwnerType="User")  # no caseOwner
+        self.assertTrue(_has(_errors(xml), "sets caseOwnerType without caseOwner"))
+
+    def test_placeholder_case_owner_rejected(self):
+        xml = _valid_src(caseOwner="{CASE_OWNER_USERNAME}", caseOwnerType="User")
+        self.assertTrue(_has(_errors(xml), "still the placeholder"))
+
+    def test_invalid_case_owner_type_rejected(self):
+        xml = _valid_src(caseOwner="agent@acme.com", caseOwnerType="Group")
+        self.assertTrue(_has(_errors(xml),
+                             "caseOwnerType must be 'User' or 'Queue'"))
+
+
+class SupportSettingsRules(unittest.TestCase):
+    def test_system_and_named_user_mutually_exclusive(self):
+        xml = (Input().top(useSystemUserAsDefaultCaseUser="true",
+                           defaultCaseUser="admin@acme.com")
+               .address(addressType="EmailToCase", routingName="Support",
+                        caseOrigin="Email", casePriority="Medium").build())
+        self.assertTrue(_has(_errors(xml), "mutually exclusive"))
+
+    def test_invalid_default_owner_type_rejected(self):
+        xml = (Input().top(defaultCaseOwnerType="Group")
+               .address(addressType="EmailToCase", routingName="Support",
+                        caseOrigin="Email", casePriority="Medium").build())
+        self.assertTrue(_has(_errors(xml),
+                             "defaultCaseOwnerType must be 'User' or 'Queue'"))
+
+
+if __name__ == "__main__":
+    unittest.main()