@taskforcehq/taskforce 0.3.309 → 0.3.313

package/dist/server/annotatedAttachmentsRoutes.test.js

@@ -1,532 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { Readable, Writable } from 'stream';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { TaskforceCore } from '../core/Taskforce.js';
-import { createRoutes, matchRoute } from './routes.js';
-import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
-import { ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY, APP_GATE_DEFINITIONS, } from '../runtime/appGates.js';
-import { TaskforceRuleError } from '../core/Taskforce.js';
-function createProjectRoot() {
-    return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-annotated-attachment-routes-'));
-}
-function createMockReq(method, url, body, headers) {
-    const req = new Readable();
-    req._read = () => { };
-    if (body === undefined) {
-        req.push(null);
-    }
-    else if (typeof body === 'string') {
-        req.push(body);
-        req.push(null);
-    }
-    else {
-        req.push(JSON.stringify(body));
-        req.push(null);
-    }
-    req.method = method;
-    req.url = url;
-    req.headers = headers || {};
-    return req;
-}
-function createMockRes() {
-    const bodyChunks = [];
-    let writableEnded = false;
-    const headers = new Map();
-    const res = new Writable({
-        write(chunk, _encoding, callback) {
-            bodyChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-            callback();
-        }
-    });
-    res.statusCode = 200;
-    Object.defineProperty(res, 'writableEnded', {
-        configurable: true,
-        get: () => writableEnded,
-    });
-    res.writeHead = ((statusCode, nextHeaders) => {
-        res.statusCode = statusCode;
-        if (nextHeaders) {
-            for (const [key, value] of Object.entries(nextHeaders)) {
-                headers.set(key.toLowerCase(), value);
-            }
-        }
-        return res;
-    });
-    res.setHeader = ((name, value) => {
-        headers.set(name.toLowerCase(), value);
-    });
-    res.getHeader = ((name) => headers.get(name.toLowerCase()));
-    const originalEnd = res.end.bind(res);
-    res.end = ((chunk) => {
-        if (chunk !== undefined) {
-            bodyChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-        }
-        writableEnded = true;
-        return originalEnd();
-    });
-    res.__getBody = () => Buffer.concat(bodyChunks).toString('utf8');
-    return res;
-}
-describe('annotated attachment routes', () => {
-    let previousGateEnabled = false;
-    beforeEach(() => {
-        previousGateEnabled = APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled;
-        APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled = true;
-    });
-    afterEach(() => {
-        APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled = previousGateEnabled;
-    });
-    it('creates, lists, updates, and reads annotated attachment session payloads', async () => {
-        const projectRoot = createProjectRoot();
-        const core = new TaskforceCore({
-            projectRoot,
-            storagePath: path.join(projectRoot, '.taskforce'),
-        });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            const category = core.getCategories()[0]?.value;
-            const type = core.getTypes()[0]?.value;
-            const task = core.createTask({ title: 'Review image', category, type }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
-            const assetStore = core.getWorkspaceAssetStore();
-            assetStore.upsertAsset({
-                assetId: 'asset-image-1',
-                workspaceId: 'workspace-1',
-                kind: 'image',
-                originalFilename: 'ui-review.png',
-                logicalName: 'UI Review',
-                mimeType: 'image/png',
-                storageProvider: 'local',
-                storageKey: 'workspaces/workspace-1/assets/images/asset-image-1-ui-review.png',
-                contentSha256: 'sha-image-1',
-                sizeBytes: 256,
-            });
-            assetStore.upsertLink({
-                workspaceId: 'workspace-1',
-                assetId: 'asset-image-1',
-                taskId: task.id,
-                role: 'attachment',
-            });
-            const routes = createRoutes(core);
-            const createMatch = matchRoute('POST', '/api/taskforce/annotated-attachments/sessions', routes);
-            const createReq = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
-                taskId: task.id,
-                baseImageAssetId: 'asset-image-1',
-                title: 'Homepage review',
-                globalInstruction: 'Answer each marker in order.',
-                annotations: [
-                    {
-                        id: 'marker-1',
-                        kind: 'pin',
-                        order: 0,
-                        markerType: 'question',
-                        instruction: 'What should change here?',
-                        x: 0.2,
-                        y: 0.3,
-                    }
-                ],
-            }, { 'x-taskforce-user-id': 'owner-1' });
-            const createRes = createMockRes();
-            await createMatch?.handler(createReq, createRes, {});
-            expect(createRes.statusCode).toBe(200);
-            const created = JSON.parse(createRes.__getBody());
-            expect(created.success).toBe(true);
-            expect(created.session).toMatchObject({
-                taskId: task.id,
-                baseImageAssetId: 'asset-image-1',
-                title: 'Homepage review',
-                globalInstruction: 'Answer each marker in order.',
-            });
-            const sessionId = String(created.session.id);
-            const listMatch = matchRoute('GET', '/api/taskforce/annotated-attachments/sessions', routes);
-            const listReq = createMockReq('GET', `/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1&taskId=${encodeURIComponent(task.id)}&imageAssetId=asset-image-1`);
-            const listRes = createMockRes();
-            await listMatch?.handler(listReq, listRes, {});
-            const listed = JSON.parse(listRes.__getBody());
-            expect(listRes.statusCode).toBe(200);
-            expect(listed.sessions).toHaveLength(1);
-            expect(listed.sessions[0].id).toBe(sessionId);
-            const patchMatch = matchRoute('PATCH', `/api/taskforce/annotated-attachments/sessions/${sessionId}`, routes);
-            const patchReq = createMockReq('PATCH', `/api/taskforce/annotated-attachments/sessions/${sessionId}?workspaceId=workspace-1`, {
-                title: 'Homepage review revised',
-                annotations: [
-                    {
-                        id: 'marker-1',
-                        kind: 'box',
-                        order: 0,
-                        markerType: 'issue',
-                        instruction: 'Review this whole panel.',
-                        x: 0.1,
-                        y: 0.15,
-                        width: 0.3,
-                        height: 0.2,
-                    }
-                ],
-            }, { 'x-taskforce-user-id': 'owner-1' });
-            const patchRes = createMockRes();
-            await patchMatch?.handler(patchReq, patchRes, { id: sessionId });
-            const patched = JSON.parse(patchRes.__getBody());
-            expect(patchRes.statusCode).toBe(200);
-            expect(patched.session.title).toBe('Homepage review revised');
-            expect(patched.session.annotations[0]).toMatchObject({
-                kind: 'box',
-                instruction: 'Review this whole panel.',
-            });
-            const payloadMatch = matchRoute('GET', `/api/taskforce/annotated-attachments/sessions/${sessionId}/payload`, routes);
-            const payloadReq = createMockReq('GET', `/api/taskforce/annotated-attachments/sessions/${sessionId}/payload?workspaceId=workspace-1`);
-            const payloadRes = createMockRes();
-            await payloadMatch?.handler(payloadReq, payloadRes, { id: sessionId });
-            const payload = JSON.parse(payloadRes.__getBody());
-            expect(payloadRes.statusCode).toBe(200);
-            expect(payload.payload).toMatchObject({
-                taskId: task.id,
-                sessionId,
-                title: 'Homepage review revised',
-                image: {
-                    assetId: 'asset-image-1',
-                    referenceLabel: 'I-1',
-                    apiUrl: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-1-ui-review.png',
-                },
-            });
-            expect(payload.payload.annotations[0].cropHint.x).toBeCloseTo(0.06, 10);
-            expect(payload.payload.annotations[0].cropHint.y).toBeCloseTo(0.11, 10);
-            expect(payload.payload.annotations[0].cropHint.width).toBeCloseTo(0.38, 10);
-            expect(payload.payload.annotations[0].cropHint.height).toBeCloseTo(0.28, 10);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('lists canonical image assets for the Image Notes tray', async () => {
-        const projectRoot = createProjectRoot();
-        const core = new TaskforceCore({
-            projectRoot,
-            storagePath: path.join(projectRoot, '.taskforce'),
-        });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            const category = core.getCategories()[0]?.value;
-            const type = core.getTypes()[0]?.value;
-            const task = core.createTask({ title: 'Review image', category, type }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
-            const assetStore = core.getWorkspaceAssetStore();
-            const asset = assetStore.upsertAsset({
-                assetId: 'asset-image-1',
-                workspaceId: 'workspace-1',
-                kind: 'image',
-                originalFilename: 'ui-review.png',
-                logicalName: 'UI Review',
-                mimeType: 'image/png',
-                storageProvider: 'local',
-                storageKey: 'workspaces/workspace-1/assets/images/asset-image-1-ui-review.png',
-                contentSha256: 'sha-image-1',
-                sizeBytes: 256,
-            });
-            assetStore.upsertLink({
-                workspaceId: 'workspace-1',
-                assetId: asset.assetId,
-                taskId: task.id,
-                role: 'attachment',
-            });
-            core.createAnnotatedAttachmentSession({
-                workspaceId: 'workspace-1',
-                taskId: '',
-                baseImageAssetId: asset.assetId,
-                title: 'UI Review session',
-                actorId: 'owner-1',
-            });
-            const routes = createRoutes(core);
-            const listImagesMatch = matchRoute('GET', '/api/taskforce/annotated-attachments/images', routes);
-            const listImagesReq = createMockReq('GET', '/api/taskforce/annotated-attachments/images?workspaceId=workspace-1');
-            const listImagesRes = createMockRes();
-            await listImagesMatch?.handler(listImagesReq, listImagesRes, {});
-            expect(listImagesRes.statusCode).toBe(200);
-            expect(listImagesRes.getHeader('cache-control')).toBe('no-store');
-            const listed = JSON.parse(listImagesRes.__getBody());
-            expect(listed.images).toHaveLength(1);
-            expect(listed.images[0]).toMatchObject({
-                assetId: asset.assetId,
-                displayName: 'UI Review',
-                path: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-1-ui-review.png',
-                attachmentCount: 1,
-                sessionCount: 1,
-                taskId: task.id,
-                taskReferenceLabel: task.referenceLabel,
-            });
-            expect(listed.images[0].imageReferenceLabel).toMatch(/^I-\d+$/);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('rejects local mutation attribution when only an active workspace user fallback is available', async () => {
-        const projectRoot = createProjectRoot();
-        const core = new TaskforceCore({
-            projectRoot,
-            storagePath: path.join(projectRoot, '.taskforce'),
-        });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            const now = new Date().toISOString();
-            core.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 1, 0, now, now);
-            core.db.prepare(`
-                INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('membership-local-1', core.getTenantId(), 'workspace-1', 'user-local-1', 'owner', 'active', now, now);
-            core.getWorkspaceAssetStore().upsertAsset({
-                assetId: 'asset-image-1',
-                workspaceId: 'workspace-1',
-                kind: 'image',
-                originalFilename: 'ui-review.png',
-                logicalName: 'UI Review',
-                mimeType: 'image/png',
-                storageProvider: 'local',
-                storageKey: 'workspaces/workspace-1/assets/images/asset-image-1-ui-review.png',
-                contentSha256: 'sha-image-1',
-                sizeBytes: 256,
-            });
-            const routes = createRoutes(core, {
-                authConfig: {
-                    runtimeMode: 'local',
-                    enabled: true,
-                    requiredForApi: false,
-                    excludedPaths: [],
-                    defaultRole: 'member',
-                    defaultWorkspaceId: 'default',
-                    sessionCookieName: 'taskforce_session',
-                    sessionSecret: 'test-secret',
-                    sessionTtlSeconds: 3600,
-                    sessionCookieSameSite: 'Lax',
-                    sessionCookieSecure: false,
-                },
-            });
-            const createMatch = matchRoute('POST', '/api/taskforce/annotated-attachments/sessions', routes);
-            const createReq = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
-                taskId: '',
-                baseImageAssetId: 'asset-image-1',
-                title: 'Fallback session',
-                annotations: [],
-            });
-            const createRes = createMockRes();
-            await createMatch?.handler(createReq, createRes, {});
-            expect(createRes.statusCode).toBe(401);
-            expect(JSON.parse(createRes.__getBody())).toMatchObject({
-                success: false,
-                code: 'MUTATION_AUTH_REQUIRED',
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('rejects session creation when mutation identity is unresolved', async () => {
-        const projectRoot = createProjectRoot();
-        const core = new TaskforceCore({
-            projectRoot,
-            storagePath: path.join(projectRoot, '.taskforce'),
-        });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            const routes = [];
-            registerAnnotatedAttachmentRoutes({
-                addRoute: (method, path, handler) => {
-                    const keys = [];
-                    const pattern = new RegExp(`^${`${method}:${path}`.replace(/:([^/]+)/g, (_match, key) => {
-                        keys.push(key);
-                        return '([^/]+)';
-                    })}$`);
-                    routes.push({ pattern, keys, handler });
-                },
-                core,
-                requestWorkspaceId: () => 'workspace-1',
-                resolveAuthenticatedUserId: () => {
-                    throw new TaskforceRuleError('Authenticated user required for mutation attribution.', 401, 'MUTATION_AUTH_REQUIRED');
-                },
-                ensureAppAccess: () => true,
-            });
-            const createMatch = matchRoute('POST', '/api/taskforce/annotated-attachments/sessions', routes);
-            const createReq = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
-                taskId: '',
-                baseImageAssetId: 'asset-image-1',
-                title: 'Should fail',
-                annotations: [],
-            });
-            const createRes = createMockRes();
-            await createMatch?.handler(createReq, createRes, {});
-            expect(createRes.statusCode).toBe(401);
-            expect(JSON.parse(createRes.__getBody())).toMatchObject({
-                success: false,
-                code: 'MUTATION_AUTH_REQUIRED',
-            });
-        }
-        finally {
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('resolves an image target by image reference label', async () => {
-        const projectRoot = createProjectRoot();
-        const core = new TaskforceCore({
-            projectRoot,
-            storagePath: path.join(projectRoot, '.taskforce'),
-        });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            const category = core.getCategories()[0]?.value;
-            const type = core.getTypes()[0]?.value;
-            const task = core.createTask({ title: 'Reference image task', category, type }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
-            const assetStore = core.getWorkspaceAssetStore();
-            assetStore.upsertAsset({
-                assetId: 'asset-image-24',
-                workspaceId: 'workspace-1',
-                kind: 'image',
-                originalFilename: 'reference-image.png',
-                logicalName: 'Reference image',
-                mimeType: 'image/png',
-                storageProvider: 'local',
-                storageKey: 'workspaces/workspace-1/assets/images/asset-image-24-reference-image.png',
-                contentSha256: 'sha-image-24',
-                sizeBytes: 256,
-                referenceNumber: 24,
-            });
-            assetStore.upsertLink({
-                workspaceId: 'workspace-1',
-                assetId: 'asset-image-24',
-                taskId: task.id,
-                role: 'image',
-            });
-            const routes = createRoutes(core);
-            const match = matchRoute('GET', '/api/taskforce/annotated-attachments/images/I-24', routes);
-            const req = createMockReq('GET', '/api/taskforce/annotated-attachments/images/I-24?workspaceId=workspace-1');
-            const res = createMockRes();
-            await match?.handler(req, res, { reference: 'I-24' });
-            expect(res.statusCode).toBe(200);
-            expect(JSON.parse(res.__getBody())).toEqual({
-                target: expect.objectContaining({
-                    assetId: 'asset-image-24',
-                    taskId: task.id,
-                    taskReferenceLabel: task.referenceLabel,
-                    imageReferenceLabel: 'I-24',
-                    path: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-24-reference-image.png',
-                    displayName: 'Reference image',
-                }),
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('resolves an image target by canonical asset id without requiring a task link', async () => {
-        const projectRoot = createProjectRoot();
-        const core = new TaskforceCore({
-            projectRoot,
-            storagePath: path.join(projectRoot, '.taskforce'),
-        });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            core.getWorkspaceAssetStore().upsertAsset({
-                assetId: 'asset-image-42',
-                workspaceId: 'workspace-1',
-                kind: 'image',
-                originalFilename: 'standalone-image.png',
-                logicalName: 'Standalone image',
-                mimeType: 'image/png',
-                storageProvider: 'local',
-                storageKey: 'workspaces/workspace-1/assets/images/asset-image-42-standalone-image.png',
-                contentSha256: 'sha-image-42',
-                sizeBytes: 256,
-                referenceNumber: 42,
-            });
-            const routes = createRoutes(core);
-            const match = matchRoute('GET', '/api/taskforce/annotated-attachments/images/asset-image-42', routes);
-            const req = createMockReq('GET', '/api/taskforce/annotated-attachments/images/asset-image-42?workspaceId=workspace-1');
-            const res = createMockRes();
-            await match?.handler(req, res, { reference: 'asset-image-42' });
-            expect(res.statusCode).toBe(200);
-            expect(JSON.parse(res.__getBody())).toEqual({
-                target: expect.objectContaining({
-                    assetId: 'asset-image-42',
-                    taskId: null,
-                    taskReferenceLabel: null,
-                    imageReferenceLabel: 'I-42',
-                    path: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-42-standalone-image.png',
-                    displayName: 'Standalone image',
-                }),
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('rejects access when the annotated attachments gate is disabled', async () => {
-        APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled = false;
-        const projectRoot = createProjectRoot();
-        const core = new TaskforceCore({
-            projectRoot,
-            storagePath: path.join(projectRoot, '.taskforce'),
-        });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            const routes = createRoutes(core);
-            const match = matchRoute('GET', '/api/taskforce/annotated-attachments/sessions', routes);
-            const req = createMockReq('GET', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1&taskId=task-1');
-            const res = createMockRes();
-            await match?.handler(req, res, {});
-            expect(res.statusCode).toBe(403);
-            const body = JSON.parse(res.__getBody());
-            expect(body.error).toBe('Annotated attachments are unavailable for this workspace.');
-            expect(typeof body.code).toBe('string');
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('uses the authenticated user resolver for created session actors', async () => {
-        const handlers = new Map();
-        const core = {
-            createAnnotatedAttachmentSession: (input) => ({
-                id: 'session-1',
-                workspaceId: input.workspaceId,
-                taskId: input.taskId,
-                baseImageAssetId: input.baseImageAssetId,
-                title: input.title,
-                globalInstruction: input.globalInstruction,
-                annotations: input.annotations,
-                createdByActorId: input.actorId,
-                updatedByActorId: input.actorId,
-            }),
-        };
-        registerAnnotatedAttachmentRoutes({
-            addRoute: (method, routePath, handler) => {
-                handlers.set(`${method} ${routePath}`, handler);
-            },
-            core,
-            requestWorkspaceId: () => 'workspace-1',
-            resolveAuthenticatedUserId: () => 'ross.burke',
-            ensureAppAccess: () => true,
-        });
-        const handler = handlers.get('POST /api/taskforce/annotated-attachments/sessions');
-        expect(handler).toBeDefined();
-        const req = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
-            taskId: 'task-1',
-            baseImageAssetId: 'asset-image-1',
-            title: 'Homepage review',
-            globalInstruction: '',
-            annotations: [],
-        });
-        const res = createMockRes();
-        await handler?.(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const payload = JSON.parse(res.__getBody());
-        expect(payload.session.createdByActorId).toBe('ross.burke');
-        expect(payload.session.updatedByActorId).toBe('ross.burke');
-    });
-});

package/dist/server/auth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/server/auth.test.js

@@ -1,131 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { createClearSessionCookie, createSessionTokenCookie, hasValidSession, isRequestAuthorized, resolveAuthConfigFromEnv, resolveRequestAccess, resolveSessionCookieAttributesForRequest } from './auth';
-function mockReq(url, headers = {}) {
-    return {
-        url,
-        headers,
-        socket: { encrypted: false }
-    };
-}
-describe('server/auth', () => {
-    it('defaults to disabled auth when no explicit config in local mode', () => {
-        const config = resolveAuthConfigFromEnv('local', {});
-        expect(config.enabled).toBe(false);
-        expect(config.requiredForApi).toBe(false);
-        expect(config.sessionCookieSecure).toBe(false);
-        expect(config.excludedPaths).toEqual([
-            '/api/taskforce/health',
-            '/api/taskforce/version',
-            '/api/taskforce/auth',
-            '/api/taskforce/public/pricing',
-            '/api/taskforce/public/site-config',
-            '/api/taskforce/public/site-config-script'
-        ]);
-    });
-    it('defaults to auth-required in cloud mode', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {});
-        expect(config.enabled).toBe(true);
-        expect(config.requiredForApi).toBe(true);
-        expect(config.sessionCookieSecure).toBe(true);
-    });
-    it('infers a shared cookie domain for official cloud environments', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_CLOUD_ENVIRONMENT: 'performance'
-        });
-        expect(config.sessionCookieDomain).toBe('taskforcehq.ai');
-    });
-    it('prefers an explicitly configured session cookie domain', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_CLOUD_ENVIRONMENT: 'performance',
-            TASKFORCE_AUTH_SESSION_DOMAIN: 'performance-app.taskforcehq.ai'
-        });
-        expect(config.sessionCookieDomain).toBe('performance-app.taskforcehq.ai');
-    });
-    it('allows excluded health path without session', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'secret'
-        });
-        const result = isRequestAuthorized(mockReq('/api/taskforce/health'), config);
-        expect(result.allowed).toBe(true);
-    });
-    it('denies protected api path without session', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'secret'
-        });
-        const result = isRequestAuthorized(mockReq('/api/taskforce/tasks'), config);
-        expect(result.allowed).toBe(false);
-        expect(result.reason).toContain('Missing auth session');
-    });
-    it('allows protected api path with valid signed session cookie', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
-        });
-        const cookieHeader = createSessionTokenCookie('session-1', config);
-        const cookieValue = cookieHeader.split(';')[0];
-        const result = isRequestAuthorized(mockReq('/api/taskforce/tasks', { cookie: cookieValue }), config);
-        expect(result.allowed).toBe(true);
-        expect(hasValidSession(mockReq('/api/taskforce/tasks', { cookie: cookieValue }), config)).toBe(true);
-    });
-    it('resolves role/workspace/user from session claims', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
-        });
-        const cookieHeader = createSessionTokenCookie('session-2', config, {
-            role: 'admin',
-            workspaceId: 'workspace-123',
-            userId: 'user-abc'
-        });
-        const cookieValue = cookieHeader.split(';')[0];
-        const access = resolveRequestAccess(mockReq('/api/taskforce/tasks', { cookie: cookieValue }), config);
-        expect(access.authenticated).toBe(true);
-        expect(access.role).toBe('admin');
-        expect(access.workspaceId).toBe('workspace-123');
-        expect(access.userId).toBe('user-abc');
-    });
-    it('uses requested workspace header for unauthenticated access context', () => {
-        const config = resolveAuthConfigFromEnv('local', {});
-        const access = resolveRequestAccess(mockReq('/api/taskforce/tasks', { 'x-taskforce-workspace-id': 'project-acme' }), config);
-        expect(access.authenticated).toBe(false);
-        expect(access.workspaceId).toBe('project-acme');
-    });
-    it('downgrades SameSite=None to Lax when request is HTTP and secure cookies are unavailable', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
-        });
-        const attrs = resolveSessionCookieAttributesForRequest(mockReq('/api/taskforce/auth/login', { 'x-forwarded-proto': 'http' }), config);
-        expect(attrs.secure).toBe(false);
-        expect(attrs.sameSite).toBe('Lax');
-        const cookie = createSessionTokenCookie('session-http', config, attrs);
-        expect(cookie).toContain('SameSite=Lax');
-        expect(cookie).not.toContain('; Secure');
-        const clearCookie = createClearSessionCookie(config, attrs);
-        expect(clearCookie).toContain('SameSite=Lax');
-        expect(clearCookie).not.toContain('; Secure');
-    });
-    it('keeps secure cookie attributes for non-loopback hosts when TLS is terminated upstream', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
-        });
-        const attrs = resolveSessionCookieAttributesForRequest(mockReq('/api/taskforce/auth/login', { host: 'app.taskforcehq.ai' }), config);
-        expect(attrs.secure).toBe(true);
-        expect(attrs.sameSite).toBe('None');
-        const cookie = createSessionTokenCookie('session-proxy', config, attrs);
-        expect(cookie).toContain('SameSite=None');
-        expect(cookie).toContain('; Secure');
-    });
-    it('uses non-secure cookie attributes on loopback hosts without https forwarding headers', () => {
-        const config = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'session-secret'
-        });
-        const attrs = resolveSessionCookieAttributesForRequest(mockReq('/api/taskforce/auth/login', { host: 'localhost:3000' }), config);
-        expect(attrs.secure).toBe(false);
-        expect(attrs.sameSite).toBe('Lax');
-    });
-});

package/dist/server/buildInfo.test.d.ts

@@ -1 +0,0 @@
-export {};