@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/routes/inbound-stages/acl-enforcement.test.ts

@@ -2,14 +2,14 @@
  * Unit tests for `enforceIngressAcl` consuming the gateway trust verdict.
  *
  * Drives the stage directly with a `sourceMetadata.trustVerdict` and mocks the
- * leaf I/O (contact store, gateway delivery, guardian notification, invite
- * transport) so the ACL decision logic is exercised in isolation.
+ * leaf I/O (contact store, gateway delivery, guardian notification) so the
+ * ACL decision logic is exercised in isolation.
  *
  * Covers: verdict-sourced member resolution, fail-closed deny on an ABSENT
- * verdict, hard-denies for blocked/revoked/policy, and the non-member invite
- * intercept still firing for a present stranger verdict.
+ * verdict, hard-denies for blocked/revoked/policy, and the stranger deny lane
+ * firing for a present stranger verdict.
  */
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { SourceMetadata, TrustVerdict } from "@vellumai/gateway-client";
 
@@ -53,45 +53,34 @@ mock.module("../../gateway-client.js", () => ({
 }));
 
 const accessRequestCalls: unknown[] = [];
+let accessRequestDeniedForTest = false;
+let approvalHandshakeForTest = false;
 mock.module("../../access-request-helper.js", () => ({
   notifyGuardianOfAccessRequest: (params: unknown) => {
     accessRequestCalls.push(params);
     return { notified: true };
   },
+  isAccessRequestDenied: () => accessRequestDeniedForTest,
+  isApprovalHandshakeInProgress: () => approvalHandshakeForTest,
 }));
 
-// Invite transport: by default no adapter (no token). Per-test override below.
-let inviteTokenForTest: string | undefined;
-mock.module("../../channel-invite-transport.js", () => ({
-  getInviteAdapterRegistry: () => ({
-    get: () => ({
-      extractInboundToken: () => inviteTokenForTest,
-    }),
-  }),
-}));
-
-// Invite redemption: default to a successful redeem so the token intercept
-// short-circuits with an earlyResponse.
-mock.module("../../invite-redemption-service.js", () => ({
-  redeemInvite: async () => ({ ok: true, type: "redeemed", memberId: "m-1" }),
-  redeemInviteByCode: async () => ({
-    ok: true,
-    type: "redeemed",
-    memberId: "m-1",
-  }),
-}));
-
-mock.module("../../invite-redemption-templates.js", () => ({
-  getInviteRedemptionReply: () => "redeemed reply",
-}));
-
-mock.module("../../../persistence/delivery-crud.js", () => ({
-  recordInbound: () => ({ duplicate: false, eventId: "evt-1" }),
-  deleteInbound: () => {},
-}));
-
-mock.module("../../../persistence/delivery-status.js", () => ({
-  markProcessed: () => {},
+// Verification session service: track challenge minting so the callback
+// exemption (LUM-2673) can assert no session is created for button presses.
+const createOutboundSessionCalls: unknown[] = [];
+mock.module("../../channel-verification-service.js", () => ({
+  createOutboundSession: (params: unknown) => {
+    createOutboundSessionCalls.push(params);
+    return {
+      sessionId: "session-1",
+      secret: "123456",
+      challengeHash: "hash",
+      expiresAt: Date.now() + 600_000,
+      ttlSeconds: 600,
+    };
+  },
+  findActiveSession: () => null,
+  getPendingSession: () => null,
+  resolveBootstrapToken: () => null,
 }));
 
 import type { AclEnforcementParams } from "./acl-enforcement.js";
@@ -113,7 +102,7 @@ function makeParams(
     actorUsername: "sender_one",
     replyCallbackUrl: "http://localhost/deliver",
     assistantId: "assistant-1",
-    externalMessageId: "msg-1",
+    isCallbackInteraction: false,
     ...overrides,
   };
 }
@@ -141,14 +130,12 @@ beforeEach(() => {
   findContactChannelCalls.length = 0;
   deliverReplyCalls.length = 0;
   accessRequestCalls.length = 0;
-  inviteTokenForTest = undefined;
+  createOutboundSessionCalls.length = 0;
+  accessRequestDeniedForTest = false;
+  approvalHandshakeForTest = false;
   guardianDeliveryList = [];
 });
 
-afterEach(() => {
-  inviteTokenForTest = undefined;
-});
-
 describe("enforceIngressAcl — verdict-sourced member resolution", () => {
   test("active trusted verdict is admitted (resolvedMember threaded, no deny)", async () => {
     const result = await enforceIngressAcl(
@@ -177,6 +164,128 @@ describe("enforceIngressAcl — verdict-sourced member resolution", () => {
     expect(result.resolvedMember!.status).toBe("active");
     expect(findContactChannelCalls.length).toBe(0);
   });
+
+  test("member-less guardian verdict fails safe: denied with no stranger-lane side effects", async () => {
+    // ATL-958 regression: the gateway proves guardian identity via a
+    // same-channel member row, so every guardian verdict carries one. A
+    // guardian verdict with NO member row is contradictory (e.g. a forged
+    // cross-channel classification) and must not be admitted — but it must
+    // not be routed through the stranger lane either, which would fire an
+    // access request carrying the claimed guardian identity.
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict({
+          trustClass: "guardian",
+          canonicalSenderId: "sender-1",
+          guardianPrincipalId: "p-1",
+        }),
+      }),
+    );
+
+    expect(result.earlyResponse).toMatchObject({
+      accepted: true,
+      denied: true,
+      reason: "not_a_member",
+    });
+    expect(result.resolvedMember).toBeNull();
+    expect(accessRequestCalls.length).toBe(0);
+    expect(deliverReplyCalls.length).toBe(0);
+    expect(createOutboundSessionCalls.length).toBe(0);
+  });
+
+  test("guardian verdict with an inactive (pending) member row is still admitted", async () => {
+    // Guardian by principal whose same-channel row is pending: the
+    // inactive-member deny gate must not challenge or deny the guardian.
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict(
+          memberVerdict({
+            trustClass: "guardian",
+            status: "pending",
+            guardianPrincipalId: "p-1",
+          }),
+        ),
+      }),
+    );
+
+    expect(result.earlyResponse).toBeUndefined();
+    expect(result.resolvedMember).not.toBeNull();
+    expect(accessRequestCalls.length).toBe(0);
+    expect(deliverReplyCalls.length).toBe(0);
+  });
+
+  test("guardian verdict with an explicit policy-deny member row is denied, not admitted", async () => {
+    // An explicit per-channel policy deny on the guardian's own row is
+    // honored like blocked/revoked — the guardian short-circuit must not
+    // bypass it. Accurate policy_deny reason, no stranger-lane side effects.
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict(
+          memberVerdict({
+            trustClass: "guardian",
+            policy: "deny",
+            guardianPrincipalId: "p-1",
+          }),
+        ),
+      }),
+    );
+
+    expect(result.earlyResponse).toMatchObject({
+      accepted: true,
+      denied: true,
+      reason: "policy_deny",
+    });
+    expect(accessRequestCalls.length).toBe(0);
+    expect(deliverReplyCalls.length).toBe(0);
+  });
+
+  test("contradictory guardian verdict with a blocked member row fails safe", async () => {
+    // The gateway never classifies a blocked row as guardian; a verdict
+    // claiming both is malformed. Soft-deny with no stranger-lane side
+    // effects.
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict(
+          memberVerdict({
+            trustClass: "guardian",
+            status: "blocked",
+            policy: "deny",
+          }),
+        ),
+      }),
+    );
+
+    expect(result.earlyResponse).toMatchObject({
+      accepted: true,
+      denied: true,
+      reason: "not_a_member",
+    });
+    expect(accessRequestCalls.length).toBe(0);
+    expect(deliverReplyCalls.length).toBe(0);
+  });
+
+  test("unrecognized trust class fails safe: denied with no stranger-lane side effects", async () => {
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict({
+          // Deliberately out-of-contract wire data (version skew / malformed
+          // payload) — the cast is the point of the test.
+          trustClass: "totally_new_class" as TrustVerdict["trustClass"],
+          canonicalSenderId: "sender-1",
+        }),
+      }),
+    );
+
+    expect(result.earlyResponse).toMatchObject({
+      accepted: true,
+      denied: true,
+      reason: "not_a_member",
+    });
+    // Fail-safe, never fail-stranger: no access-request card, no
+    // verification challenge, no canned reply.
+    expect(accessRequestCalls.length).toBe(0);
+    expect(deliverReplyCalls.length).toBe(0);
+  });
 });
 
 describe("enforceIngressAcl — hard denies from the verdict status/policy", () => {
@@ -215,9 +324,8 @@ describe("enforceIngressAcl — hard denies from the verdict status/policy", ()
   });
 });
 
-describe("enforceIngressAcl — present stranger verdict flows through intercepts", () => {
-  test("present unknown/no-member verdict + invite token redeems via intercept", async () => {
-    inviteTokenForTest = "iv_token123";
+describe("enforceIngressAcl — present stranger verdict enters the stranger lane", () => {
+  test("present unknown/no-member verdict is denied via the stranger lane, not fail-closed", async () => {
     const strangerVerdict: TrustVerdict = {
       trustClass: "unknown",
       canonicalSenderId: "stranger-1",
@@ -231,10 +339,16 @@ describe("enforceIngressAcl — present stranger verdict flows through intercept
       }),
     );
 
-    // The invite token intercept fired — NOT a fail-closed deny.
-    expect(result.earlyResponse).toBeDefined();
-    expect(result.earlyResponse!.inviteRedemption).toBe("redeemed");
+    expect(result.earlyResponse).toMatchObject({
+      accepted: true,
+      denied: true,
+      reason: "not_a_member",
+    });
     expect(result.resolvedMember).toBeNull();
+    // Stranger-lane side effects fire (unlike a fail-closed deny): the
+    // guardian is notified and a canned reply is delivered.
+    expect(accessRequestCalls.length).toBe(1);
+    expect(deliverReplyCalls.length).toBe(1);
   });
 });
 
@@ -268,8 +382,7 @@ describe("enforceIngressAcl — fail-closed on absent verdict", () => {
 });
 
 describe("enforceIngressAcl — fail-closed on resolutionFailed verdict", () => {
-  test("resolutionFailed verdict → not_a_member deny, does not flow to intercepts", async () => {
-    inviteTokenForTest = "iv_token123";
+  test("resolutionFailed verdict → not_a_member deny with no stranger-lane side effects", async () => {
     const result = await enforceIngressAcl(
       makeParams({
         sourceMetadata: withVerdict({
@@ -284,16 +397,13 @@ describe("enforceIngressAcl — fail-closed on resolutionFailed verdict", () =>
     expect(result.earlyResponse).toBeDefined();
     expect(result.earlyResponse!.reason).toBe("not_a_member");
     expect(result.resolvedMember).toBeNull();
-    // Distinct from a stranger: no invite redemption, onboarding, or
-    // guardian notification fires.
-    expect(result.earlyResponse!.inviteRedemption).toBeUndefined();
+    // Distinct from a stranger: no onboarding or guardian notification fires.
     expect(deliverReplyCalls.length).toBe(0);
     expect(accessRequestCalls.length).toBe(0);
     expect(findContactChannelCalls.length).toBe(0);
   });
 
-  test("real unknown stranger (no resolutionFailed) still redeems via intercept", async () => {
-    inviteTokenForTest = "iv_token123";
+  test("real unknown stranger (no resolutionFailed) still enters the stranger lane", async () => {
     const result = await enforceIngressAcl(
       makeParams({
         sourceMetadata: withVerdict({
@@ -303,8 +413,11 @@ describe("enforceIngressAcl — fail-closed on resolutionFailed verdict", () =>
       }),
     );
 
-    expect(result.earlyResponse!.inviteRedemption).toBe("redeemed");
+    expect(result.earlyResponse!.reason).toBe("not_a_member");
     expect(result.resolvedMember).toBeNull();
+    // Stranger-lane side effects fire, unlike the resolutionFailed deny.
+    expect(accessRequestCalls.length).toBe(1);
+    expect(deliverReplyCalls.length).toBe(1);
   });
 });
 
@@ -379,3 +492,263 @@ describe("enforceIngressAcl — fail-closed on malformed member verdict", () =>
     expect(result.resolvedMember).toBeNull();
   });
 });
+
+describe("enforceIngressAcl — a terminal deny suppresses re-prompting, not admission", () => {
+  // Per the Slack-permissions PRD, admission is pure rank-vs-floor: a
+  // guardian-denied sender is persisted as an unverified contact (rank 2) and is
+  // admitted on exactly the same terms as any other unverified contact. The deny
+  // only stops the guardian from being re-prompted; holding a contact out of
+  // every floor is the (separate) block action's job. These matched pairs pin
+  // that the denied flag does NOT change the admission outcome.
+  test("any_contact: a terminally-denied unverified member is still admitted by the floor", async () => {
+    accessRequestDeniedForTest = true;
+
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict(memberVerdict({ status: "unverified" })),
+        effectiveAdmissionPolicy: "any_contact",
+      }),
+    );
+
+    expect(result.earlyResponse).toBeUndefined();
+    expect(result.resolvedMember).not.toBeNull();
+    expect(result.resolvedMember!.status).toBe("unverified");
+  });
+
+  test("any_contact: a non-denied unverified member is admitted identically", async () => {
+    accessRequestDeniedForTest = false;
+
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict(memberVerdict({ status: "unverified" })),
+        effectiveAdmissionPolicy: "any_contact",
+      }),
+    );
+
+    expect(result.earlyResponse).toBeUndefined();
+    expect(result.resolvedMember).not.toBeNull();
+    expect(result.resolvedMember!.status).toBe("unverified");
+  });
+
+  test("strangers: a terminally-denied non-member is still bypassed to the floor", async () => {
+    accessRequestDeniedForTest = true;
+
+    const result = await enforceIngressAcl(
+      makeParams({
+        canonicalSenderId: "stranger-1",
+        rawSenderId: "stranger-1",
+        sourceMetadata: withVerdict({
+          trustClass: "unknown",
+          canonicalSenderId: "stranger-1",
+        }),
+        effectiveAdmissionPolicy: "strangers",
+      }),
+    );
+
+    expect(result.earlyResponse).toBeUndefined();
+    expect(result.resolvedMember).toBeNull();
+  });
+
+  test("strangers: a non-denied stranger is bypassed identically", async () => {
+    accessRequestDeniedForTest = false;
+
+    const result = await enforceIngressAcl(
+      makeParams({
+        canonicalSenderId: "stranger-1",
+        rawSenderId: "stranger-1",
+        sourceMetadata: withVerdict({
+          trustClass: "unknown",
+          canonicalSenderId: "stranger-1",
+        }),
+        effectiveAdmissionPolicy: "strangers",
+      }),
+    );
+
+    expect(result.earlyResponse).toBeUndefined();
+    expect(result.resolvedMember).toBeNull();
+  });
+
+  test("trusted_contacts: a denied unverified member is denied by the floor, not re-admitted", async () => {
+    // Under a strict floor (rank 3) an unverified contact (rank 2) does not clear
+    // the floor and is denied — same as any unverified contact, denied or not.
+    // The floor governs exclusion here; the deny governs only re-prompting.
+    accessRequestDeniedForTest = true;
+
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceMetadata: withVerdict(memberVerdict({ status: "unverified" })),
+        effectiveAdmissionPolicy: "trusted_contacts",
+      }),
+    );
+
+    expect(result.earlyResponse).toBeDefined();
+    expect(result.earlyResponse!.denied).toBe(true);
+    // `unverified` maps to `pending` at the API-facing member layer.
+    expect(result.earlyResponse!.reason).toBe("member_pending");
+  });
+});
+
+describe("enforceIngressAcl — callback interactions never spawn stranger-lane side effects (LUM-2673)", () => {
+  test("a stranger callback is denied without creating an access request", async () => {
+    const result = await enforceIngressAcl(
+      makeParams({
+        canonicalSenderId: "stranger-1",
+        rawSenderId: "stranger-1",
+        trimmedContent: "apr:req-1:approve_once",
+        sourceMetadata: withVerdict({
+          trustClass: "unknown",
+          canonicalSenderId: "stranger-1",
+        }),
+        isCallbackInteraction: true,
+      }),
+    );
+
+    expect(result.earlyResponse).toBeDefined();
+    expect(result.earlyResponse!.reason).toBe("not_a_member");
+    expect(accessRequestCalls.length).toBe(0);
+    expect(createOutboundSessionCalls.length).toBe(0);
+    // The deny reply still goes out so the click isn't a silent no-op.
+    expect(deliverReplyCalls.length).toBe(1);
+  });
+
+  test("a Slack stranger callback initiates no verification challenge", async () => {
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceChannel: "slack",
+        canonicalSenderId: "U123STRANGER",
+        rawSenderId: "U123STRANGER",
+        trimmedContent: "apr:req-1:approve_once",
+        sourceMetadata: withVerdict({
+          trustClass: "unknown",
+          canonicalSenderId: "U123STRANGER",
+        }),
+        isCallbackInteraction: true,
+      }),
+    );
+
+    expect(result.earlyResponse).toBeDefined();
+    expect(result.earlyResponse!.reason).toBe("not_a_member");
+    expect(createOutboundSessionCalls.length).toBe(0);
+    expect(accessRequestCalls.length).toBe(0);
+  });
+
+  test("a Slack unverified-member callback initiates no challenge and no access request", async () => {
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceChannel: "slack",
+        canonicalSenderId: "U123MEMBER",
+        rawSenderId: "U123MEMBER",
+        trimmedContent: "apr:req-1:approve_once",
+        sourceMetadata: withVerdict(
+          memberVerdict({
+            status: "unverified",
+            canonicalSenderId: "U123MEMBER",
+            address: "U123MEMBER",
+            type: "slack",
+          }),
+        ),
+        isCallbackInteraction: true,
+      }),
+    );
+
+    expect(result.earlyResponse).toBeDefined();
+    expect(result.earlyResponse!.reason).toBe("member_pending");
+    expect(createOutboundSessionCalls.length).toBe(0);
+    expect(accessRequestCalls.length).toBe(0);
+  });
+
+  test("a callback inside the approval handshake window gets next-step copy, not a denial", async () => {
+    approvalHandshakeForTest = true;
+
+    const result = await enforceIngressAcl(
+      makeParams({
+        canonicalSenderId: "stranger-1",
+        rawSenderId: "stranger-1",
+        trimmedContent: "apr:req-1:approve_once",
+        sourceMetadata: withVerdict({
+          trustClass: "unknown",
+          canonicalSenderId: "stranger-1",
+        }),
+        isCallbackInteraction: true,
+      }),
+    );
+
+    expect(result.earlyResponse).toBeDefined();
+    expect(result.earlyResponse!.reason).toBe("not_a_member");
+    expect(accessRequestCalls.length).toBe(0);
+    expect(deliverReplyCalls.length).toBe(1);
+    const payload = deliverReplyCalls[0].payload as { text: string };
+    expect(payload.text).toContain("approved");
+    expect(payload.text).toContain("verification code");
+  });
+
+  test("a Slack stranger MESSAGE still gets the challenge + access request (control)", async () => {
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceChannel: "slack",
+        canonicalSenderId: "U123STRANGER",
+        rawSenderId: "U123STRANGER",
+        sourceMetadata: withVerdict({
+          trustClass: "unknown",
+          canonicalSenderId: "U123STRANGER",
+        }),
+      }),
+    );
+
+    expect(result.earlyResponse).toBeDefined();
+    expect(result.earlyResponse!.reason).toBe("verification_challenge_sent");
+    expect(createOutboundSessionCalls.length).toBe(1);
+    expect(accessRequestCalls.length).toBe(1);
+  });
+
+  test("a Slack bot never receives the self-verify challenge — guardian is notified directly", async () => {
+    const result = await enforceIngressAcl(
+      makeParams({
+        sourceChannel: "slack",
+        canonicalSenderId: "U123BOT",
+        rawSenderId: "U123BOT",
+        sourceMetadata: {
+          ...withVerdict({
+            trustClass: "unknown",
+            canonicalSenderId: "U123BOT",
+          }),
+          isBot: true,
+        } as SourceMetadata,
+      }),
+    );
+
+    expect(result.earlyResponse).toBeDefined();
+    // No verification session is minted — a bot cannot return a code.
+    expect(createOutboundSessionCalls.length).toBe(0);
+    expect(accessRequestCalls.length).toBe(1);
+  });
+
+  test("identity signals from sourceMetadata are forwarded to the access request", async () => {
+    await enforceIngressAcl(
+      makeParams({
+        sourceChannel: "slack",
+        canonicalSenderId: "U123BOT",
+        rawSenderId: "U123BOT",
+        sourceMetadata: {
+          ...withVerdict({
+            trustClass: "unknown",
+            canonicalSenderId: "U123BOT",
+          }),
+          isBot: true,
+          isStranger: true,
+          isRestricted: true,
+        } as SourceMetadata,
+      }),
+    );
+
+    expect(accessRequestCalls.length).toBe(1);
+    const call = accessRequestCalls[0] as {
+      isBot?: boolean;
+      isStranger?: boolean;
+      isRestricted?: boolean;
+    };
+    expect(call.isBot).toBe(true);
+    expect(call.isStranger).toBe(true);
+    expect(call.isRestricted).toBe(true);
+  });
+});