@vellumai/assistant 0.3.15 → 0.3.18

package/src/__tests__/trusted-contact-verification.test.ts

@@ -0,0 +1,360 @@
+/**
+ * Tests for M4: Verification success → trusted contact activation.
+ *
+ * When a requester successfully verifies their identity (enters the correct
+ * 6-digit code from an identity-bound outbound session), the system should:
+ * 1. Upsert an active member record in assistant_ingress_members
+ * 2. Allow subsequent messages through the ACL check
+ * 3. Scope the member correctly (no cross-assistant leakage)
+ * 4. Reactivate previously revoked members on re-verification
+ * 5. NOT create a guardian binding (trusted contacts are not guardians)
+ */
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { afterAll, beforeEach, describe, expect, mock, test } from 'bun:test';
+
+// ---------------------------------------------------------------------------
+// Test isolation: in-memory SQLite via temp directory
+// ---------------------------------------------------------------------------
+
+const testDir = mkdtempSync(join(tmpdir(), 'trusted-contact-verify-test-'));
+
+mock.module('../util/platform.js', () => ({
+  getRootDir: () => testDir,
+  getDataDir: () => testDir,
+  isMacOS: () => process.platform === 'darwin',
+  isLinux: () => process.platform === 'linux',
+  isWindows: () => process.platform === 'win32',
+  getSocketPath: () => join(testDir, 'test.sock'),
+  getPidPath: () => join(testDir, 'test.pid'),
+  getDbPath: () => join(testDir, 'test.db'),
+  getLogPath: () => join(testDir, 'test.log'),
+  ensureDataDir: () => {},
+  normalizeAssistantId: (id: string) => id === 'self' ? 'self' : id,
+  readHttpToken: () => 'test-bearer-token',
+}));
+
+mock.module('../util/logger.js', () => ({
+  getLogger: () => new Proxy({} as Record<string, unknown>, {
+    get: () => () => {},
+  }),
+}));
+
+import {
+  createBinding,
+  getActiveBinding,
+} from '../memory/channel-guardian-store.js';
+import { getDb, initializeDb, resetDb } from '../memory/db.js';
+import {
+  findMember,
+  revokeMember,
+  upsertMember,
+} from '../memory/ingress-member-store.js';
+import {
+  createOutboundSession,
+  validateAndConsumeChallenge,
+} from '../runtime/channel-guardian-service.js';
+
+initializeDb();
+
+afterAll(() => {
+  resetDb();
+  try { rmSync(testDir, { recursive: true }); } catch { /* best effort */ }
+});
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function resetTables(): void {
+  const db = getDb();
+  db.run('DELETE FROM channel_guardian_verification_challenges');
+  db.run('DELETE FROM channel_guardian_bindings');
+  db.run('DELETE FROM channel_guardian_rate_limits');
+  db.run('DELETE FROM assistant_ingress_members');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('trusted contact verification → member activation', () => {
+  beforeEach(() => {
+    resetTables();
+  });
+
+  test('successful verification creates active member with allow policy', () => {
+    // Simulate M3: guardian approves, outbound session created for the requester
+    const session = createOutboundSession({
+      assistantId: 'self',
+      channel: 'telegram',
+      expectedExternalUserId: 'requester-user-123',
+      expectedChatId: 'requester-chat-123',
+      identityBindingStatus: 'bound',
+      destinationAddress: 'requester-chat-123',
+      verificationPurpose: 'trusted_contact',
+    });
+
+    // Requester enters the 6-digit code
+    const result = validateAndConsumeChallenge(
+      'self',
+      'telegram',
+      session.secret,
+      'requester-user-123',
+      'requester-chat-123',
+      'requester_username',
+      'Requester Name',
+    );
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.verificationType).toBe('trusted_contact');
+    }
+
+    // Simulate the member upsert that inbound-message-handler performs on success
+    upsertMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'requester-user-123',
+      externalChatId: 'requester-chat-123',
+      status: 'active',
+      policy: 'allow',
+      displayName: 'Requester Name',
+      username: 'requester_username',
+    });
+
+    // Verify: active member record exists
+    const member = findMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'requester-user-123',
+    });
+
+    expect(member).not.toBeNull();
+    expect(member!.status).toBe('active');
+    expect(member!.policy).toBe('allow');
+    expect(member!.externalUserId).toBe('requester-user-123');
+    expect(member!.externalChatId).toBe('requester-chat-123');
+    expect(member!.displayName).toBe('Requester Name');
+    expect(member!.username).toBe('requester_username');
+    expect(member!.assistantId).toBe('self');
+    expect(member!.sourceChannel).toBe('telegram');
+  });
+
+  test('post-verify message is accepted (ACL check passes)', () => {
+    // Create and verify a trusted contact
+    const session = createOutboundSession({
+      assistantId: 'self',
+      channel: 'telegram',
+      expectedExternalUserId: 'requester-user-456',
+      expectedChatId: 'requester-chat-456',
+      identityBindingStatus: 'bound',
+      destinationAddress: 'requester-chat-456',
+      verificationPurpose: 'trusted_contact',
+    });
+
+    validateAndConsumeChallenge(
+      'self', 'telegram', session.secret,
+      'requester-user-456', 'requester-chat-456',
+    );
+
+    // Simulate member upsert on verification success
+    upsertMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'requester-user-456',
+      externalChatId: 'requester-chat-456',
+      status: 'active',
+      policy: 'allow',
+    });
+
+    // Simulate the ACL check that inbound-message-handler performs
+    const member = findMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'requester-user-456',
+      externalChatId: 'requester-chat-456',
+    });
+
+    expect(member).not.toBeNull();
+    expect(member!.status).toBe('active');
+    expect(member!.policy).toBe('allow');
+    // ACL check passes: member exists, is active, and has allow policy
+  });
+
+  test('no cross-assistant leakage (member scoped correctly)', () => {
+    // Create member for assistant 'self'
+    const session = createOutboundSession({
+      assistantId: 'self',
+      channel: 'telegram',
+      expectedExternalUserId: 'user-cross-test',
+      expectedChatId: 'chat-cross-test',
+      identityBindingStatus: 'bound',
+      destinationAddress: 'chat-cross-test',
+      verificationPurpose: 'trusted_contact',
+    });
+
+    validateAndConsumeChallenge(
+      'self', 'telegram', session.secret,
+      'user-cross-test', 'chat-cross-test',
+    );
+
+    upsertMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'user-cross-test',
+      externalChatId: 'chat-cross-test',
+      status: 'active',
+      policy: 'allow',
+    });
+
+    // Member should be found for 'self'
+    const selfMember = findMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'user-cross-test',
+    });
+    expect(selfMember).not.toBeNull();
+    expect(selfMember!.status).toBe('active');
+
+    // Member should NOT be found for a different assistant
+    const otherMember = findMember({
+      assistantId: 'other-assistant',
+      sourceChannel: 'telegram',
+      externalUserId: 'user-cross-test',
+    });
+    expect(otherMember).toBeNull();
+  });
+
+  test('re-verification of previously revoked member reactivates them', () => {
+    // Create and activate a member
+    const member = upsertMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'user-revoked',
+      externalChatId: 'chat-revoked',
+      status: 'active',
+      policy: 'allow',
+      displayName: 'Revoked User',
+    });
+
+    // Revoke the member
+    const revoked = revokeMember(member.id, 'testing revocation');
+    expect(revoked).not.toBeNull();
+    expect(revoked!.status).toBe('revoked');
+
+    // Verify the member is indeed revoked (ACL would reject)
+    const revokedMember = findMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'user-revoked',
+    });
+    expect(revokedMember).not.toBeNull();
+    expect(revokedMember!.status).toBe('revoked');
+
+    // Guardian re-approves, new outbound session created
+    const session = createOutboundSession({
+      assistantId: 'self',
+      channel: 'telegram',
+      expectedExternalUserId: 'user-revoked',
+      expectedChatId: 'chat-revoked',
+      identityBindingStatus: 'bound',
+      destinationAddress: 'chat-revoked',
+      verificationPurpose: 'trusted_contact',
+    });
+
+    // Requester enters the new code
+    const result = validateAndConsumeChallenge(
+      'self', 'telegram', session.secret,
+      'user-revoked', 'chat-revoked',
+    );
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.verificationType).toBe('trusted_contact');
+    }
+
+    // upsertMember reactivates the existing record
+    upsertMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'user-revoked',
+      externalChatId: 'chat-revoked',
+      status: 'active',
+      policy: 'allow',
+    });
+
+    // Verify: member is now active again
+    const reactivated = findMember({
+      assistantId: 'self',
+      sourceChannel: 'telegram',
+      externalUserId: 'user-revoked',
+    });
+    expect(reactivated).not.toBeNull();
+    expect(reactivated!.status).toBe('active');
+    expect(reactivated!.policy).toBe('allow');
+  });
+
+  test('trusted contact verification does NOT create a guardian binding', () => {
+    // Ensure there's an existing guardian binding we want to preserve
+    createBinding({
+      assistantId: 'self',
+      channel: 'telegram',
+      guardianExternalUserId: 'guardian-user-original',
+      guardianDeliveryChatId: 'guardian-chat-original',
+      verifiedVia: 'challenge',
+      metadataJson: null,
+    });
+
+    // Create an outbound session for a requester (different user than guardian)
+    const session = createOutboundSession({
+      assistantId: 'self',
+      channel: 'telegram',
+      expectedExternalUserId: 'requester-user-789',
+      expectedChatId: 'requester-chat-789',
+      identityBindingStatus: 'bound',
+      destinationAddress: 'requester-chat-789',
+      verificationPurpose: 'trusted_contact',
+    });
+
+    const result = validateAndConsumeChallenge(
+      'self', 'telegram', session.secret,
+      'requester-user-789', 'requester-chat-789',
+    );
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.verificationType).toBe('trusted_contact');
+      // Should NOT have a bindingId — no guardian binding created
+      expect('bindingId' in result).toBe(false);
+    }
+
+    // The original guardian binding should remain intact
+    const binding = getActiveBinding('self', 'telegram');
+    expect(binding).not.toBeNull();
+    expect(binding!.guardianExternalUserId).toBe('guardian-user-original');
+  });
+
+  test('guardian inbound verification still creates binding (backward compat)', () => {
+    // Create an inbound challenge (no expected identity — guardian flow)
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { createVerificationChallenge } = require('../runtime/channel-guardian-service.js');
+    const { secret } = createVerificationChallenge('self', 'telegram');
+
+    const result = validateAndConsumeChallenge(
+      'self', 'telegram', secret,
+      'guardian-user', 'guardian-chat',
+    );
+
+    expect(result.success).toBe(true);
+    if (result.success && result.verificationType === 'guardian') {
+      expect(result.bindingId).toBeDefined();
+    }
+
+    // Guardian binding should be created
+    const binding = getActiveBinding('self', 'telegram');
+    expect(binding).not.toBeNull();
+    expect(binding!.guardianExternalUserId).toBe('guardian-user');
+  });
+});

package/src/__tests__/update-bulletin-format.test.ts

@@ -0,0 +1,119 @@
+import { describe, expect, test } from 'bun:test';
+
+import {
+  appendReleaseBlock,
+  extractReleaseIds,
+  hasReleaseBlock,
+  releaseMarker,
+} from '../config/update-bulletin-format.js';
+
+describe('releaseMarker', () => {
+  test('returns an HTML comment with the version embedded', () => {
+    expect(releaseMarker('1.2.3')).toBe('<!-- vellum-update-release:1.2.3 -->');
+  });
+
+  test('handles pre-release / build-metadata versions', () => {
+    expect(releaseMarker('2.0.0-beta.1+build.42')).toBe(
+      '<!-- vellum-update-release:2.0.0-beta.1+build.42 -->',
+    );
+  });
+});
+
+describe('hasReleaseBlock', () => {
+  const content = [
+    '<!-- vellum-update-release:1.0.0 -->',
+    '## 1.0.0',
+    'Initial release.',
+    '',
+    '<!-- vellum-update-release:1.1.0 -->',
+    '## 1.1.0',
+    'Second release.',
+  ].join('\n');
+
+  test('returns true when the marker is present', () => {
+    expect(hasReleaseBlock(content, '1.0.0')).toBe(true);
+    expect(hasReleaseBlock(content, '1.1.0')).toBe(true);
+  });
+
+  test('returns false when the marker is absent', () => {
+    expect(hasReleaseBlock(content, '2.0.0')).toBe(false);
+  });
+
+  test('returns false for empty content', () => {
+    expect(hasReleaseBlock('', '1.0.0')).toBe(false);
+  });
+});
+
+describe('appendReleaseBlock', () => {
+  test('appends to empty content', () => {
+    const result = appendReleaseBlock('', '1.0.0', '## 1.0.0\nInitial release.');
+    expect(result).toBe(
+      '<!-- vellum-update-release:1.0.0 -->\n## 1.0.0\nInitial release.\n',
+    );
+  });
+
+  test('preserves prior blocks when appending', () => {
+    const existing =
+      '<!-- vellum-update-release:1.0.0 -->\n## 1.0.0\nFirst.\n';
+    const result = appendReleaseBlock(existing, '1.1.0', '## 1.1.0\nSecond.');
+
+    // Prior block is untouched
+    expect(result).toContain('<!-- vellum-update-release:1.0.0 -->');
+    expect(result).toContain('## 1.0.0\nFirst.');
+
+    // New block is appended
+    expect(result).toContain('<!-- vellum-update-release:1.1.0 -->');
+    expect(result).toContain('## 1.1.0\nSecond.');
+
+    // New block comes after old block
+    const oldIdx = result.indexOf('<!-- vellum-update-release:1.0.0 -->');
+    const newIdx = result.indexOf('<!-- vellum-update-release:1.1.0 -->');
+    expect(newIdx).toBeGreaterThan(oldIdx);
+  });
+
+  test('inserts separator when existing content lacks trailing newline', () => {
+    const existing = '<!-- vellum-update-release:1.0.0 -->\nFirst.';
+    const result = appendReleaseBlock(existing, '1.1.0', 'Second.');
+
+    // Double newline separates the blocks when there was no trailing newline
+    expect(result).toContain('First.\n\n<!-- vellum-update-release:1.1.0 -->');
+  });
+});
+
+describe('extractReleaseIds', () => {
+  test('returns all version strings from multiple markers', () => {
+    const content = [
+      '<!-- vellum-update-release:1.0.0 -->',
+      'Block one.',
+      '<!-- vellum-update-release:1.1.0 -->',
+      'Block two.',
+      '<!-- vellum-update-release:2.0.0-rc.1 -->',
+      'Block three.',
+    ].join('\n');
+
+    expect(extractReleaseIds(content)).toEqual([
+      '1.0.0',
+      '1.1.0',
+      '2.0.0-rc.1',
+    ]);
+  });
+
+  test('returns empty array for empty content', () => {
+    expect(extractReleaseIds('')).toEqual([]);
+  });
+
+  test('returns empty array when no markers are present', () => {
+    expect(extractReleaseIds('Just some text\nwith no markers.')).toEqual([]);
+  });
+
+  test('handles duplicate markers', () => {
+    const content = [
+      '<!-- vellum-update-release:1.0.0 -->',
+      'Block one.',
+      '<!-- vellum-update-release:1.0.0 -->',
+      'Duplicate block.',
+    ].join('\n');
+
+    expect(extractReleaseIds(content)).toEqual(['1.0.0', '1.0.0']);
+  });
+});

package/src/__tests__/update-bulletin-state.test.ts

@@ -0,0 +1,129 @@
+import { beforeEach, describe, expect, it, mock } from 'bun:test';
+
+const store = new Map<string, string>();
+
+mock.module('../memory/checkpoints.js', () => ({
+  getMemoryCheckpoint: mock((key: string) => store.get(key) ?? null),
+  setMemoryCheckpoint: mock((key: string, value: string) => store.set(key, value)),
+}));
+
+const {
+  getActiveReleases,
+  setActiveReleases,
+  getCompletedReleases,
+  setCompletedReleases,
+  isReleaseCompleted,
+  markReleasesCompleted,
+  addActiveRelease,
+} = await import('../config/update-bulletin-state.js');
+
+describe('update-bulletin-state', () => {
+  beforeEach(() => {
+    store.clear();
+  });
+
+  describe('empty/default state', () => {
+    it('returns empty array when no active releases checkpoint exists', () => {
+      expect(getActiveReleases()).toEqual([]);
+    });
+
+    it('returns empty array when no completed releases checkpoint exists', () => {
+      expect(getCompletedReleases()).toEqual([]);
+    });
+
+    it('isReleaseCompleted returns false when no completed releases exist', () => {
+      expect(isReleaseCompleted('1.0.0')).toBe(false);
+    });
+  });
+
+  describe('corrupt checkpoint content', () => {
+    it('returns empty array for invalid JSON in active releases', () => {
+      store.set('updates:active_releases', 'not-json{{{');
+      expect(getActiveReleases()).toEqual([]);
+    });
+
+    it('returns empty array for invalid JSON in completed releases', () => {
+      store.set('updates:completed_releases', '}{broken');
+      expect(getCompletedReleases()).toEqual([]);
+    });
+
+    it('returns empty array when checkpoint contains a non-array JSON value', () => {
+      store.set('updates:active_releases', '"just-a-string"');
+      expect(getActiveReleases()).toEqual([]);
+    });
+
+    it('filters out non-string values from the array', () => {
+      store.set('updates:active_releases', '["1.0.0", 42, null, "2.0.0"]');
+      expect(getActiveReleases()).toEqual(['1.0.0', '2.0.0']);
+    });
+  });
+
+  describe('round-trip serialization', () => {
+    it('write then read returns same data for active releases', () => {
+      const releases = ['1.0.0', '2.0.0', '3.0.0'];
+      setActiveReleases(releases);
+      expect(getActiveReleases()).toEqual(releases);
+    });
+
+    it('write then read returns same data for completed releases', () => {
+      const releases = ['0.9.0', '1.0.0'];
+      setCompletedReleases(releases);
+      expect(getCompletedReleases()).toEqual(releases);
+    });
+
+    it('isReleaseCompleted returns true for a completed release', () => {
+      setCompletedReleases(['1.0.0', '2.0.0']);
+      expect(isReleaseCompleted('1.0.0')).toBe(true);
+      expect(isReleaseCompleted('2.0.0')).toBe(true);
+      expect(isReleaseCompleted('3.0.0')).toBe(false);
+    });
+  });
+
+  describe('dedupe behavior', () => {
+    it('setActiveReleases deduplicates entries', () => {
+      setActiveReleases(['1.0.0', '2.0.0', '1.0.0', '2.0.0', '1.0.0']);
+      expect(getActiveReleases()).toEqual(['1.0.0', '2.0.0']);
+    });
+
+    it('setCompletedReleases deduplicates entries', () => {
+      setCompletedReleases(['a', 'b', 'a']);
+      expect(getCompletedReleases()).toEqual(['a', 'b']);
+    });
+
+    it('addActiveRelease does not duplicate an existing release', () => {
+      setActiveReleases(['1.0.0']);
+      addActiveRelease('1.0.0');
+      expect(getActiveReleases()).toEqual(['1.0.0']);
+    });
+
+    it('markReleasesCompleted does not duplicate existing entries', () => {
+      setCompletedReleases(['1.0.0']);
+      markReleasesCompleted(['1.0.0', '2.0.0']);
+      expect(getCompletedReleases()).toEqual(['1.0.0', '2.0.0']);
+    });
+  });
+
+  describe('sort behavior', () => {
+    it('active releases are sorted alphabetically', () => {
+      setActiveReleases(['c-release', 'a-release', 'b-release']);
+      expect(getActiveReleases()).toEqual(['a-release', 'b-release', 'c-release']);
+    });
+
+    it('completed releases are sorted alphabetically', () => {
+      setCompletedReleases(['3.0.0', '1.0.0', '2.0.0']);
+      expect(getCompletedReleases()).toEqual(['1.0.0', '2.0.0', '3.0.0']);
+    });
+
+    it('addActiveRelease maintains sorted order', () => {
+      setActiveReleases(['a', 'c']);
+      addActiveRelease('b');
+      expect(getActiveReleases()).toEqual(['a', 'b', 'c']);
+    });
+
+    it('markReleasesCompleted maintains sorted order', () => {
+      setCompletedReleases(['c']);
+      markReleasesCompleted(['a', 'b']);
+      expect(getCompletedReleases()).toEqual(['a', 'b', 'c']);
+    });
+  });
+});