@things-factory/board-import 10.1.25 → 10.1.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/board-import",
-  "version": "10.1.25",
+  "version": "10.1.27",
   "main": "dist-server/index.js",
   "things-factory": true,
   "author": "heartyoh",
@@ -23,13 +23,13 @@
   },
   "dependencies": {
     "@operato/graphql": "^10.0.0",
-    "@things-factory/ai-client-base": "^10.1.25",
-    "@things-factory/attachment-base": "^10.1.24",
-    "@things-factory/auth-base": "^10.1.24",
-    "@things-factory/board-service": "^10.1.24",
+    "@things-factory/ai-client-base": "^10.1.26",
+    "@things-factory/attachment-base": "^10.1.27",
+    "@things-factory/auth-base": "^10.1.27",
+    "@things-factory/board-service": "^10.1.27",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.20",
+    "@things-factory/shell": "^10.1.27",
     "dxf-parser": "^1.1.2"
   },
-  "gitHead": "8407b1e9d1f47f6676af144d4a33c8ac01cb49c4"
+  "gitHead": "d04dc762cacf2aac8ba0b0f5d768eca365fc09da"
 }

package/server/service/import-tools-privilege.test.ts

@@ -0,0 +1,102 @@
+/**
+ * The import tools ask for what their GraphQL doors ask for.
+ *
+ * These tools reach the same service functions as `importBoardAsync` / `importSession` /
+ * `materializeImportSession` in import-session-resolver.ts. They used to run with no check, so a
+ * caller holding only the conversation privilege could create a Board through a chat.
+ */
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+const mockCheckPermission = jest.fn()
+jest.mock('@things-factory/auth-base', () => ({ checkPermission: (...a: any[]) => mockCheckPermission(...a) }), {
+  virtual: true
+})
+const mockMaterializeFromSession = jest.fn(async () => ({ id: 'b1', name: 'New', state: 'draft' }))
+jest.mock('./import-session/materialize-from-session', () => ({ materializeFromSession: (...a: any[]) => (mockMaterializeFromSession as any)(...a) }))
+const mockStartImportJobAsync = jest.fn(async () => ({ id: 's1', status: 'pending' }))
+const mockFetchImportSession = jest.fn(async () => ({ id: 's1', status: 'completed' }))
+jest.mock('./import-session/import-actions', () => ({
+  startImportJobAsync: (...a: any[]) => (mockStartImportJobAsync as any)(...a),
+  fetchImportSession: (...a: any[]) => (mockFetchImportSession as any)(...a),
+  describeAdapter: (a: any) => a
+}))
+jest.mock('./import-session/import-session', () => ({ ImportSession: class ImportSession {} }))
+jest.mock('@things-factory/board-service', () => ({ Board: class Board {}, Group: class Group {} }), { virtual: true })
+jest.mock('@things-factory/shell', () => ({ getRepository: () => ({}) }), { virtual: true })
+
+import { clearToolRegistry, findToolSpec } from '@things-factory/ai-client-base'
+import { IMPORT_TOOL_PRIVILEGE, registerBoardImportTools } from './import-tools'
+
+const state = { domain: { id: 'd1' }, user: { id: 'u1' }, unsafeIP: false, prohibitedPrivileges: [{ category: 'x', privilege: 'y' }] }
+
+beforeEach(() => {
+  clearToolRegistry()
+  registerBoardImportTools()
+  jest.clearAllMocks()
+})
+afterEach(() => clearToolRegistry())
+
+const ARGS: Record<keyof typeof IMPORT_TOOL_PRIVILEGE, any> = {
+  importBoardAsync: { attachmentId: 'a1' },
+  getImportSession: { sessionId: 's1' },
+  materializeImportSession: { sessionId: 's1', name: 'New' }
+}
+const EFFECT: Record<keyof typeof IMPORT_TOOL_PRIVILEGE, jest.Mock> = {
+  importBoardAsync: mockStartImportJobAsync,
+  getImportSession: mockFetchImportSession,
+  materializeImportSession: mockMaterializeFromSession
+}
+
+describe.each(Object.keys(IMPORT_TOOL_PRIVILEGE) as (keyof typeof IMPORT_TOOL_PRIVILEGE)[])('%s', tool => {
+  test('refuses, and does nothing, when the caller lacks the privilege', async () => {
+    mockCheckPermission.mockResolvedValue(false)
+    const spec: any = findToolSpec(tool)
+    await expect(spec.builder(ARGS[tool], { state })).rejects.toThrow(
+      new RegExp(`${IMPORT_TOOL_PRIVILEGE[tool].category}:${IMPORT_TOOL_PRIVILEGE[tool].privilege}`)
+    )
+    expect(EFFECT[tool]).not.toHaveBeenCalled()
+    if (tool === 'materializeImportSession') expect(mockFetchImportSession).not.toHaveBeenCalled()
+  })
+
+  test('asks auth for exactly the declared privilege, with the request state', async () => {
+    mockCheckPermission.mockResolvedValue(true)
+    const spec: any = findToolSpec(tool)
+    await spec.builder(ARGS[tool], { state })
+    expect(mockCheckPermission).toHaveBeenCalledWith(
+      IMPORT_TOOL_PRIVILEGE[tool],
+      state.user,
+      state.domain,
+      state.unsafeIP,
+      state.prohibitedPrivileges
+    )
+    expect(EFFECT[tool]).toHaveBeenCalled()
+  })
+
+  test('declares the same privilege on the spec, for doors that decide what to offer', () => {
+    const spec: any = findToolSpec(tool)
+    expect(spec.privilege).toBe(IMPORT_TOOL_PRIVILEGE[tool])
+  })
+})
+
+test('the table says what the GraphQL doors say', () => {
+  const resolver = readFileSync(join(__dirname, 'import-session', 'import-session-resolver.ts'), 'utf8')
+  const DOOR: Record<keyof typeof IMPORT_TOOL_PRIVILEGE, string> = {
+    importBoardAsync: 'importBoardAsync',
+    getImportSession: 'importSession',
+    materializeImportSession: 'materializeImportSession'
+  }
+  for (const [tool, door] of Object.entries(DOOR) as [keyof typeof IMPORT_TOOL_PRIVILEGE, string][]) {
+    const m = resolver.match(
+      new RegExp(`@Directive\\('@privilege\\(category: "([^"]+)", privilege: "([^"]+)"\\)'\\)\\s*async ${door}\\(`)
+    )
+    expect(m).not.toBeNull()
+    expect({ category: m![1], privilege: m![2] }).toEqual(IMPORT_TOOL_PRIVILEGE[tool])
+  }
+})
+
+test('every tool that touches a domain is in the table', () => {
+  const source = readFileSync(join(__dirname, 'import-tools.ts'), 'utf8')
+  const bare = source.match(/= requireDomainContext\(ctx\?\.state\)/g) ?? []
+  expect(bare).toEqual([])
+})

package/server/service/import-tools.ts

@@ -45,7 +45,10 @@ function getDeps(): any {
     const actionsMod = require('./import-session/import-actions')
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     const materializeMod = require('./import-session/materialize-from-session')
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const authMod = require('@things-factory/auth-base')
     _depsCache = {
+      checkPermission: authMod.checkPermission,
       ImportSession: isMod.ImportSession,
       Board: bsMod.Board,
       Group: bsMod.Group,
@@ -72,6 +75,40 @@ function requireDomainContext(state: any): { domain: any; user: any } {
   return { domain: state.domain, user: state.user }
 }
 
+/*
+ * A tool is a second entrance to a door that already exists, so it asks for what that door asks for.
+ *
+ * `materializeImportSession` and `importBoardAsync` sit behind `board-import:mutation` as GraphQL
+ * mutations, and `importSession` behind `board-import:query` (import-session-resolver.ts). The tools
+ * called the same service functions with no check at all, so whoever could open a conversation —
+ * `ai-assistant:mutation` — could create a Board through it.
+ *
+ * The check lives in the builder rather than in whichever chat door dispatches the tool: there is
+ * more than one such door, and the effect has to be guarded wherever it is reached from. The same
+ * object is also declared on the spec as `privilege`, which is what a door reads to decide whether
+ * to offer the tool at all; declaring and enforcing from one constant keeps the two from drifting.
+ */
+export const IMPORT_TOOL_PRIVILEGE = {
+  importBoardAsync: { category: 'board-import', privilege: 'mutation' },
+  getImportSession: { category: 'board-import', privilege: 'query' },
+  materializeImportSession: { category: 'board-import', privilege: 'mutation' }
+} as const
+
+type GuardedImportTool = keyof typeof IMPORT_TOOL_PRIVILEGE
+
+async function requireImportPrivilege(tool: GuardedImportTool, state: any): Promise<{ domain: any; user: any }> {
+  const { domain, user } = requireDomainContext(state)
+  const required = IMPORT_TOOL_PRIVILEGE[tool]
+  const allowed = await getDeps().checkPermission(required, user, domain, state.unsafeIP, state.prohibitedPrivileges)
+  if (!allowed) {
+    throw new Error(
+      `[board-import] '${tool}' needs ${required.category}:${required.privilege}. ` +
+        'Being allowed to talk to the assistant does not open it.'
+    )
+  }
+  return { domain, user }
+}
+
 const importToolsCategory: ToolCategory = {
   name: 'board-import',
   description: 'Drawing/CAD/IFC/image → Board 변환 파이프라인 (zero-to-twin).',
@@ -112,6 +149,7 @@ const importToolsCategory: ToolCategory = {
     {
       kind: 'external',
       name: 'importBoardAsync',
+      privilege: IMPORT_TOOL_PRIVILEGE.importBoardAsync,
       description:
         'Attachment(도면/조감도/사진) 을 비동기로 보드 모델로 변환 시작. 즉시 ImportSession 을 ' +
         '반환하고 백그라운드에서 진행. status 가 completed 가 될 때까지 getImportSession 으로 ' +
@@ -141,7 +179,7 @@ const importToolsCategory: ToolCategory = {
         required: ['attachmentId']
       },
       builder: async (args, ctx) => {
-        const { domain, user } = requireDomainContext(ctx?.state)
+        const { domain, user } = await requireImportPrivilege('importBoardAsync', ctx?.state)
         const session = await getDeps().startImportJobAsync(
           {
             attachmentId: args.attachmentId,
@@ -163,6 +201,7 @@ const importToolsCategory: ToolCategory = {
     {
       kind: 'read',
       name: 'getImportSession',
+      privilege: IMPORT_TOOL_PRIVILEGE.getImportSession,
       description:
         'ImportSession 의 진행/결과 조회. status 가 queued/parsing/mapping/assembling/binding 인 ' +
         '동안은 progress 와 message 를 반환, completed 면 result.boardModel 까지 포함. failed 면 ' +
@@ -175,7 +214,7 @@ const importToolsCategory: ToolCategory = {
         required: ['sessionId']
       },
       builder: async (args, ctx) => {
-        const { domain, user } = requireDomainContext(ctx?.state)
+        const { domain, user } = await requireImportPrivilege('getImportSession', ctx?.state)
         const session = await getDeps().fetchImportSession(
           args.sessionId,
           { domain, user },
@@ -198,6 +237,7 @@ const importToolsCategory: ToolCategory = {
     {
       kind: 'external',
       name: 'materializeImportSession',
+      privilege: IMPORT_TOOL_PRIVILEGE.materializeImportSession,
       description:
         '완료된 ImportSession 의 결과 boardModel 을 새 Board entity 로 영속화. status 가 ' +
         'completed 인 세션만 처리. 결과 Board 는 state="draft" 로 생성되므로 사용자가 검수 후 ' +
@@ -221,7 +261,7 @@ const importToolsCategory: ToolCategory = {
         required: ['sessionId', 'name']
       },
       builder: async (args, ctx) => {
-        const { domain, user } = requireDomainContext(ctx?.state)
+        const { domain, user } = await requireImportPrivilege('materializeImportSession', ctx?.state)
         const session = await getDeps().fetchImportSession(
           args.sessionId,
           { domain, user },