@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/server/index.test.js

@@ -1,6 +1,42 @@
 import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
+import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, configureHttpServerTimeouts, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveHttpServerTimeoutSettings, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, shouldApplyReadOnlyMutationGuard, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
 describe('server index helper policies', () => {
+    it('uses proxy-friendly HTTP server timeouts by default', () => {
+        const settings = resolveHttpServerTimeoutSettings({});
+        expect(settings.keepAliveTimeoutMs).toBe(65_000);
+        expect(settings.headersTimeoutMs).toBe(70_000);
+        expect(settings.requestTimeoutMs).toBe(120_000);
+    });
+    it('keeps headers timeout above keep-alive timeout for reverse proxies', () => {
+        const settings = resolveHttpServerTimeoutSettings({
+            TASKFORCE_HTTP_KEEP_ALIVE_TIMEOUT_MS: '80000',
+            TASKFORCE_HTTP_HEADERS_TIMEOUT_MS: '1000',
+            TASKFORCE_HTTP_REQUEST_TIMEOUT_MS: '150000'
+        });
+        expect(settings.keepAliveTimeoutMs).toBe(80_000);
+        expect(settings.headersTimeoutMs).toBe(85_000);
+        expect(settings.requestTimeoutMs).toBe(150_000);
+    });
+    it('applies resolved HTTP server timeouts to the Node server', () => {
+        const server = {
+            keepAliveTimeout: 0,
+            headersTimeout: 0,
+            requestTimeout: 0
+        };
+        const settings = configureHttpServerTimeouts(server, {
+            TASKFORCE_HTTP_KEEP_ALIVE_TIMEOUT_MS: '61000',
+            TASKFORCE_HTTP_HEADERS_TIMEOUT_MS: '66000',
+            TASKFORCE_HTTP_REQUEST_TIMEOUT_MS: '90000'
+        });
+        expect(settings).toEqual({
+            keepAliveTimeoutMs: 61_000,
+            headersTimeoutMs: 66_000,
+            requestTimeoutMs: 90_000
+        });
+        expect(server.keepAliveTimeout).toBe(61_000);
+        expect(server.headersTimeout).toBe(66_000);
+        expect(server.requestTimeout).toBe(90_000);
+    });
     it('adds webhook path to auth exclusions without duplicates', () => {
         const base = ['/api/taskforce/health', '/api/taskforce/auth'];
         const next = ensureBillingWebhookAuthExclusion(base);
@@ -82,6 +118,12 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/pull')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/push')).toBe(true);
     });
+    it('proxies cloud-owned user avatar context paths only', () => {
+        expect(shouldProxyCloudPath('/api/taskforce/context/users%2Fuser-1%2Fprofile%2Favatar%2Favatar.webp')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/context/users/user-1/profile/avatar/avatar.webp')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset.png')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/context/users%2Fuser-1%2Fexports%2Favatar.webp')).toBe(false);
+    });
     it('proxies admin, billing, and auth routes', () => {
         expect(shouldProxyCloudPath('/api/taskforce/admin/users')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/plans')).toBe(true);
@@ -91,6 +133,11 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
     });
+    it('keeps AI profile workspace mutations local so workspace sync owns replication', () => {
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/avatar')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/archive')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/merge')).toBe(false);
+    });
 });
 describe('proxy cookie helpers', () => {
     it('rewrites mismatched cookie domains for non-loopback local hosts', () => {
@@ -126,7 +173,8 @@ describe('resolveAuthorizedWorkspaceAccess', () => {
             userId: 'user-1',
             workspaceId: 'workspace-personal',
             role: 'member',
-            systemRole: 'user'
+            systemRole: 'user',
+            identityId: null
         }, 'workspace-team');
         expect(core.resolveUserAccess).toHaveBeenCalledWith('user-1', 'workspace-team', 'member');
         expect(next.workspaceId).toBe('workspace-team');
@@ -154,12 +202,67 @@ describe('resolveAuthorizedWorkspaceAccess', () => {
             userId: 'user-1',
             workspaceId: 'workspace-personal',
             role: 'member',
-            systemRole: 'user'
+            systemRole: 'user',
+            identityId: null
         }, 'workspace-team');
         expect(core.resolveUserAccess).toHaveBeenNthCalledWith(1, 'user-1', 'workspace-team', 'member');
         expect(core.resolveUserAccess).toHaveBeenNthCalledWith(2, 'user-1', 'workspace-personal', 'member');
         expect(next.workspaceId).toBe('workspace-personal');
     });
+    it('preserves account and workspace disabled scopes separately', () => {
+        const core = {
+            resolveUserAccess: vi.fn((userId, workspaceId, role) => ({
+                userId,
+                workspaceId,
+                role,
+                permissionMode: 'read-write',
+                disabled: true,
+                accountDisabled: false,
+                workspaceDisabled: true,
+                betaAccess: true
+            })),
+            getSystemRole: vi.fn(() => 'user')
+        };
+        const next = resolveAuthorizedWorkspaceAccess(core, {
+            authenticated: true,
+            sessionId: 'session-1',
+            userId: 'user-1',
+            workspaceId: 'workspace-shared',
+            role: 'member',
+            systemRole: 'user',
+            identityId: null
+        }, 'workspace-shared');
+        expect(next.disabled).toBe(true);
+        expect(next.accountDisabled).toBe(false);
+        expect(next.workspaceDisabled).toBe(true);
+    });
+});
+describe('resolveDisabledAccessError', () => {
+    it('blocks globally disabled accounts outside auth routes', () => {
+        expect(resolveDisabledAccessError({ disabled: true, accountDisabled: true }, '/api/taskforce/workspaces')).toBe('Forbidden: user account is disabled.');
+        expect(resolveDisabledAccessError({ disabled: true, accountDisabled: true }, '/api/taskforce/auth/session')).toBeNull();
+    });
+    it('allows workspace-disabled sessions to reach recovery routes only', () => {
+        const access = { disabled: true, accountDisabled: false, workspaceDisabled: true };
+        expect(resolveDisabledAccessError(access, '/api/taskforce/workspaces')).toBeNull();
+        expect(resolveDisabledAccessError(access, '/api/taskforce/session/workspace')).toBeNull();
+        expect(resolveDisabledAccessError(access, '/api/taskforce/tasks')).toBe('Forbidden: workspace access is not active for this user.');
+    });
+});
+describe('shouldApplyReadOnlyMutationGuard', () => {
+    it('guards ordinary Taskforce mutations', () => {
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/tasks')).toBe(true);
+        expect(shouldApplyReadOnlyMutationGuard('PATCH', '/api/taskforce/task/task-1')).toBe(true);
+        expect(shouldApplyReadOnlyMutationGuard('DELETE', '/api/taskforce/task/task-1')).toBe(true);
+    });
+    it('allows session workspace switching through route-level access validation', () => {
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/session/workspace')).toBe(false);
+    });
+    it('does not guard non-mutations, auth routes, or health checks', () => {
+        expect(shouldApplyReadOnlyMutationGuard('GET', '/api/taskforce/tasks')).toBe(false);
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/auth/login')).toBe(false);
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/health')).toBe(false);
+    });
 });
 describe('resolveEffectiveRequestUserId', () => {
     it('prefers the authenticated access user when present', () => {

package/dist/server/routes/admin.d.ts

@@ -7,6 +7,7 @@
  *
  * Routes registered here:
  *   GET/POST  /api/platform/plans
+ *   GET       /api/platform/onboarding-plan-options
  *   GET/POST  /api/platform/plans/:planId/versions
  *   GET       /api/platform/features
  *   GET/PATCH /api/platform/plans/:planId/versions/:versionId/features
@@ -23,6 +24,8 @@
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
  *   POST      /api/taskforce/admin/email-settings/test
+ *   GET/POST  /api/taskforce/admin/auth-provider-settings
+ *   GET       /api/taskforce/admin/auth-provider-settings/health
  *   GET/POST  /api/taskforce/admin/system-settings
  *   GET/POST  /api/taskforce/admin/object-storage-settings
  *   GET       /api/taskforce/admin/object-storage-telemetry
@@ -49,7 +52,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
 import type { TaskAssetStore } from '../../storage/taskAssetStore.js';
 import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
@@ -99,10 +102,6 @@ export interface AdminRouteDependencies {
     }) => void;
     getCollaborationTelemetry: () => any;
     isCollaborationPolicyEnabled: () => boolean;
-    resolveRuntimeConfigBaseUrl: (req: IncomingMessage) => string;
-    resolvePublicAuthBaseUrl: (req: IncomingMessage) => string;
-    parseFormBody: (req: IncomingMessage, maxBytes?: number) => Promise<Record<string, string>>;
-    escapeHtml: (value: unknown) => string;
     normalizeMcpOauthScopeString: (raw: unknown) => string[];
     MCP_TOKEN_SCOPE_VALUES: Set<string>;
     MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS: Record<string, McpAccessTokenScope>;