@shipfox/api-workflows 7.0.2 → 8.0.0

package/src/presentation/routes/next-step.test.ts

@@ -1,5 +1,4 @@
 import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-module';
-import {createLeaseTokenAuthMethod, verifyJobLeaseToken} from '@shipfox/api-auth';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {eq, sql} from 'drizzle-orm';
 import {JobNotFoundError} from '#core/errors.js';
@@ -16,7 +15,11 @@ import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active
 import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
 import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
 import {arrangeJobWithSteps} from '#test/fixtures/job-with-steps.js';
-import {mintLeaseToken} from '#test/fixtures/lease-token.js';
+import {
+  fakeLeaseTokenAuthMethod,
+  getLeaseTokenClaims,
+  mintLeaseToken,
+} from '#test/fixtures/lease-token.js';
 import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
 import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
@@ -58,7 +61,7 @@ describe('POST /runs/jobs/current/steps/next', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod()],
+      auth: [fakeLeaseTokenAuthMethod],
       routes: [
         createLeaseTokenRouteGroup({
           agent: agentTestClient,
@@ -108,57 +111,6 @@ describe('POST /runs/jobs/current/steps/next', () => {
       expect(res.statusCode).toBe(401);
       expect(res.json().code).toBe('unauthorized');
     });
-
-    test('rejects an expired token', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        expiresIn: '-1s',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-      expect(res.json().code).toBe('unauthorized');
-    });
-
-    test('rejects a token signed with the wrong secret', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        secret: 'wrong-secret',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-      expect(res.json().code).toBe('unauthorized');
-    });
-
-    test('rejects a token with the wrong audience (e.g. a user JWT)', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        audience: 'user-session',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-      expect(res.json().code).toBe('unauthorized');
-    });
   });
 
   test('returns the lowest-position pending step and marks it running', async () => {
@@ -177,7 +129,7 @@ describe('POST /runs/jobs/current/steps/next', () => {
     expect(body.step.id).toBe(steps[0]?.id);
     expect(body.step.status).toBe('running');
     expect(body.lease_token).toEqual(expect.any(String));
-    const scopedLease = await verifyJobLeaseToken(body.lease_token);
+    const scopedLease = getLeaseTokenClaims(body.lease_token);
     expect(scopedLease).toMatchObject({
       jobId,
       jobExecutionId: steps[0]?.jobExecutionId,
@@ -228,7 +180,7 @@ describe('POST /runs/jobs/current/steps/next', () => {
       })
       .where(eq(stepsTable.id, steps[0]?.id as string));
     const token = await mintActiveLeaseToken({jobId});
-    const lease = await verifyJobLeaseToken(token);
+    const lease = getLeaseTokenClaims(token);
     if (!lease) throw new Error('Expected minted lease token to verify');
     await setRunnerToolCapabilities(lease.runnerSessionId, {harnesses: {pi: {tools: ['read']}}});
 
@@ -378,7 +330,7 @@ describe('POST /runs/jobs/current/steps/next', () => {
     expect(res.statusCode).toBe(200);
     const body = res.json();
     expect(body.attempt).toBe(2);
-    const scopedLease = await verifyJobLeaseToken(body.lease_token);
+    const scopedLease = getLeaseTokenClaims(body.lease_token);
     expect(scopedLease?.currentStepId).toBe(steps[0]?.id);
     expect(scopedLease?.currentStepAttempt).toBe(body.attempt);
   });

package/src/presentation/routes/project-access.ts

@@ -1,5 +1,5 @@
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
 

package/src/presentation/routes/report-step.test.ts

@@ -1,4 +1,3 @@
-import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {nextStepForJob} from '#core/job-execution.js';
 import {
@@ -13,7 +12,7 @@ import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
 import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
 import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
 import {arrangeJobWithSteps} from '#test/fixtures/job-with-steps.js';
-import {mintLeaseToken} from '#test/fixtures/lease-token.js';
+import {fakeLeaseTokenAuthMethod, mintLeaseToken} from '#test/fixtures/lease-token.js';
 import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
 import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
@@ -32,7 +31,7 @@ describe('POST /runs/jobs/current/steps/:stepId/report', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod()],
+      auth: [fakeLeaseTokenAuthMethod],
       routes: [
         createLeaseTokenRouteGroup({
           agent: agentTestClient,

package/src/presentation/routes/require-accessible-run.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
 import type {WorkflowRun} from '#core/entities/workflow-run.js';

package/src/presentation/routes/rerun-run.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';

package/src/presentation/routes/rerun-run.ts

@@ -1,5 +1,5 @@
 import {requireUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {rerunWorkflowRunBodySchema, workflowRunResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';

package/src/temporal/activities/index.ts

@@ -1,6 +1,6 @@
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import {

package/src/temporal/activities/orchestration-activities.ts

@@ -1,6 +1,6 @@
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {
   type RunnersInterModuleClient,
   runnersInterModuleContract,

package/test/fixtures/agent-inter-module.ts

@@ -1,7 +1,37 @@
-import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
+import {
+  DEFAULT_HARNESS_TOOL_DEPLOYMENT_CONFIG,
+  getModelProviderEntry,
+  listEnabledHarnessTools,
+  listHarnessDescriptors,
+  MODEL_PROVIDER_IDS,
+} from '@shipfox/api-agent-dto';
+import type {
+  AgentInterModuleClient,
+  AgentValidationCatalog,
+} from '@shipfox/api-agent-dto/inter-module';
 import type {AgentDefaultsResolver} from '#core/agent-defaults.js';
 
+export const agentValidationCatalog: AgentValidationCatalog = {
+  version: 1,
+  providers: MODEL_PROVIDER_IDS.map((id) => ({
+    id,
+    support_status: getModelProviderEntry(id)?.support_status ?? 'unsupported',
+  })),
+  harnesses: listHarnessDescriptors().map((harness) => ({
+    id: harness.id,
+    supported_provider_ids: [...harness.supportedProviderIds],
+    thinking_levels: [...harness.thinkingLevels],
+    effective_tools: listEnabledHarnessTools(
+      harness.id,
+      DEFAULT_HARNESS_TOOL_DEPLOYMENT_CONFIG,
+    ).map((tool) => tool.name),
+  })),
+};
+
 export const agentTestClient: AgentInterModuleClient = {
+  getValidationCatalog() {
+    return Promise.resolve(agentValidationCatalog);
+  },
   resolveAgentConfig({config}) {
     return Promise.resolve(resolveTestAgentDefaults(config));
   },

package/test/fixtures/auth-inter-module.ts

@@ -1,22 +1,11 @@
-import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
 import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
-import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
-import {signHs256} from '@shipfox/node-jwt';
-
-const leaseSecret = jobLeaseTokenKey();
+import {mintLeaseToken} from './lease-token.js';
 
 export const workflowsTestAuthClient: AuthInterModuleClient = {
   mintRunnerSessionToken() {
     throw new Error('Runner session token minting is not configured');
   },
   async mintJobLeaseToken(claims) {
-    return {
-      token: await signHs256({
-        payload: claims,
-        secret: leaseSecret,
-        expiresIn: '90m',
-        audience: JOB_LEASE_TOKEN_AUDIENCE,
-      }),
-    };
+    return {token: await mintLeaseToken(claims)};
   },
 };

package/test/fixtures/lease-token.ts

@@ -1,45 +1,59 @@
-import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
-import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
-import {signHs256} from '@shipfox/node-jwt';
+import {AUTH_LEASED_JOB, setLeasedJobContext} from '@shipfox/api-auth-context';
+import {JOB_LEASE_TOKEN_AUDIENCE, type JobLeaseTokenClaims} from '@shipfox/api-auth-dto';
+import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';
 import {getFirstJobExecutionByJobId} from '#db/workflow-runs.js';
 
-// Matches test/env.ts; the lease-token auth method reads this same value from config.
-const SECRET = jobLeaseTokenKey();
+const leaseClaims = new Map<string, JobLeaseTokenClaims>();
 
 export interface MintLeaseTokenParams {
   jobId: string;
   jobExecutionId?: string;
-  // Override informational claims to pair a job with chosen surrounding context.
   workflowRunId?: string;
   workflowRunAttemptId?: string;
   projectId?: string;
   workspaceId?: string;
   runnerSessionId?: string;
-  secret?: string;
-  expiresIn?: string;
-  audience?: string;
+  currentStepId?: string | undefined;
+  currentStepAttempt?: number | undefined;
 }
 
 export async function mintLeaseToken(params: MintLeaseTokenParams): Promise<string> {
-  let jobExecutionId = params.jobExecutionId;
-  if (jobExecutionId === undefined) {
-    const jobExecution = await getFirstJobExecutionByJobId(params.jobId);
-    if (!jobExecution) throw new Error('Expected job execution to exist');
-    jobExecutionId = jobExecution.id;
-  }
-
-  return signHs256({
-    payload: {
-      jobId: params.jobId,
-      jobExecutionId,
-      workflowRunId: params.workflowRunId ?? crypto.randomUUID(),
-      workflowRunAttemptId: params.workflowRunAttemptId ?? crypto.randomUUID(),
-      projectId: params.projectId ?? crypto.randomUUID(),
-      workspaceId: params.workspaceId ?? crypto.randomUUID(),
-      runnerSessionId: params.runnerSessionId ?? crypto.randomUUID(),
-    },
-    secret: params.secret ?? SECRET,
-    expiresIn: params.expiresIn ?? '90m',
-    audience: params.audience ?? JOB_LEASE_TOKEN_AUDIENCE,
+  const jobExecution =
+    params.jobExecutionId === undefined
+      ? await getFirstJobExecutionByJobId(params.jobId)
+      : undefined;
+  const jobExecutionId = params.jobExecutionId ?? jobExecution?.id;
+  if (!jobExecutionId) throw new Error('Expected job execution to exist');
+  const token = `test-auth-${crypto.randomUUID()}`;
+  leaseClaims.set(token, {
+    jobId: params.jobId,
+    jobExecutionId,
+    workflowRunId: params.workflowRunId ?? crypto.randomUUID(),
+    workflowRunAttemptId: params.workflowRunAttemptId ?? crypto.randomUUID(),
+    projectId: params.projectId ?? crypto.randomUUID(),
+    workspaceId: params.workspaceId ?? crypto.randomUUID(),
+    runnerSessionId: params.runnerSessionId ?? crypto.randomUUID(),
+    ...(params.currentStepId && params.currentStepAttempt !== undefined
+      ? {currentStepId: params.currentStepId, currentStepAttempt: params.currentStepAttempt}
+      : {}),
+    aud: JOB_LEASE_TOKEN_AUDIENCE,
+    iat: 0,
+    exp: Number.MAX_SAFE_INTEGER,
   });
+  return token;
+}
+
+export function getLeaseTokenClaims(token: string): JobLeaseTokenClaims | undefined {
+  return leaseClaims.get(token);
 }
+
+export const fakeLeaseTokenAuthMethod: AuthMethod = {
+  name: AUTH_LEASED_JOB,
+  authenticate: (request) => {
+    const token = extractBearerToken(request.headers.authorization);
+    const claims = token ? leaseClaims.get(token) : undefined;
+    if (!claims) throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    setLeasedJobContext(request, claims);
+    return Promise.resolve();
+  },
+};

package/test/fixtures/projects-inter-module.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 
 export const projectsTestClient = {
   getProjectById: async () => ({project: undefined}),