@vellumai/assistant 0.4.16 → 0.4.18

package/src/__tests__/deterministic-verification-control-plane.test.ts

@@ -9,52 +9,53 @@
  * 4. Channel verification reply templates are non-empty and deterministic.
  */
 
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { afterAll, beforeEach, describe, expect, mock, test } from 'bun:test';
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
 // Test isolation: in-memory SQLite via temp directory
 // ---------------------------------------------------------------------------
 
-const testDir = mkdtempSync(join(tmpdir(), 'deterministic-verify-test-'));
+const testDir = mkdtempSync(join(tmpdir(), "deterministic-verify-test-"));
 
-mock.module('../util/platform.js', () => ({
+mock.module("../util/platform.js", () => ({
   getRootDir: () => testDir,
   getDataDir: () => testDir,
-  isMacOS: () => process.platform === 'darwin',
-  isLinux: () => process.platform === 'linux',
-  isWindows: () => process.platform === 'win32',
-  getSocketPath: () => join(testDir, 'test.sock'),
-  getPidPath: () => join(testDir, 'test.pid'),
-  getDbPath: () => join(testDir, 'test.db'),
-  getLogPath: () => join(testDir, 'test.log'),
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getSocketPath: () => join(testDir, "test.sock"),
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
   ensureDataDir: () => {},
-  readHttpToken: () => 'test-bearer-token',
+  readHttpToken: () => "test-bearer-token",
 }));
 
-mock.module('../util/logger.js', () => ({
-  getLogger: () => new Proxy({} as Record<string, unknown>, {
-    get: () => () => {},
-  }),
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
 }));
 
-mock.module('../config/env.js', () => ({
-  getGatewayInternalBaseUrl: () => 'http://127.0.0.1:7830',
+mock.module("../config/env.js", () => ({
+  isHttpAuthDisabled: () => true,
+  getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",
 }));
 
 // ---------------------------------------------------------------------------
 // Imports (after mocks)
 // ---------------------------------------------------------------------------
 
-import { generateTwiML } from '../calls/twilio-routes.js';
-import { initializeDb } from '../memory/db-init.js';
+import { generateTwiML } from "../calls/twilio-routes.js";
+import { initializeDb } from "../memory/db-init.js";
 import {
   composeChannelVerifyReply,
   GUARDIAN_VERIFY_TEMPLATE_KEYS,
-} from '../runtime/guardian-verification-templates.js';
+} from "../runtime/guardian-verification-templates.js";
 
 // ---------------------------------------------------------------------------
 // DB initialization
@@ -65,39 +66,56 @@ beforeEach(() => {
 });
 
 afterAll(() => {
-  try { rmSync(testDir, { recursive: true, force: true }); } catch { /* best effort */ }
+  try {
+    rmSync(testDir, { recursive: true, force: true });
+  } catch {
+    /* best effort */
+  }
 });
 
 // ---------------------------------------------------------------------------
 // Template tests: channel verification reply templates are deterministic
 // ---------------------------------------------------------------------------
 
-describe('Channel verification reply templates', () => {
-  test('success template returns non-empty deterministic string', () => {
-    const result = composeChannelVerifyReply(GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_SUCCESS);
-    expect(typeof result).toBe('string');
+describe("Channel verification reply templates", () => {
+  test("success template returns non-empty deterministic string", () => {
+    const result = composeChannelVerifyReply(
+      GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_SUCCESS,
+    );
+    expect(typeof result).toBe("string");
     expect(result.length).toBeGreaterThan(0);
     // Calling again yields the same string (deterministic)
-    expect(composeChannelVerifyReply(GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_SUCCESS)).toBe(result);
+    expect(
+      composeChannelVerifyReply(
+        GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_SUCCESS,
+      ),
+    ).toBe(result);
   });
 
-  test('failure template returns non-empty deterministic string', () => {
-    const result = composeChannelVerifyReply(GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_FAILED);
-    expect(typeof result).toBe('string');
+  test("failure template returns non-empty deterministic string", () => {
+    const result = composeChannelVerifyReply(
+      GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_FAILED,
+    );
+    expect(typeof result).toBe("string");
     expect(result.length).toBeGreaterThan(0);
   });
 
-  test('failure template uses provided failureReason', () => {
-    const reason = 'The verification code is invalid or has expired.';
-    const result = composeChannelVerifyReply(GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_FAILED, {
-      failureReason: reason,
-    });
+  test("failure template uses provided failureReason", () => {
+    const reason = "The verification code is invalid or has expired.";
+    const result = composeChannelVerifyReply(
+      GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_FAILED,
+      {
+        failureReason: reason,
+      },
+    );
     expect(result).toBe(reason);
   });
 
-  test('bootstrap bound template returns non-empty deterministic string', () => {
-    const result = composeChannelVerifyReply(GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_BOOTSTRAP_BOUND);
-    expect(typeof result).toBe('string');
+  test("bootstrap bound template returns non-empty deterministic string", () => {
+    const result = composeChannelVerifyReply(
+      GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_BOOTSTRAP_BOUND,
+    );
+    expect(typeof result).toBe("string");
     expect(result.length).toBeGreaterThan(0);
   });
 });
@@ -106,48 +124,48 @@ describe('Channel verification reply templates', () => {
 // TwiML generation: parameter propagation
 // ---------------------------------------------------------------------------
 
-describe('TwiML parameter propagation', () => {
+describe("TwiML parameter propagation", () => {
   const defaultProfile = {
-    language: 'en-US',
-    transcriptionProvider: 'deepgram',
-    ttsProvider: 'google',
-    voice: 'en-US-Standard-A',
+    language: "en-US",
+    transcriptionProvider: "deepgram",
+    ttsProvider: "google",
+    voice: "en-US-Standard-A",
   };
 
-  test('includes guardianVerificationSessionId as Parameter when provided', () => {
+  test("includes guardianVerificationSessionId as Parameter when provided", () => {
     const twiml = generateTwiML(
-      'session-123',
-      'wss://example.com/v1/calls/relay',
+      "session-123",
+      "wss://example.com/v1/calls/relay",
       null,
       defaultProfile,
       undefined,
-      { guardianVerificationSessionId: 'gv-session-456' },
+      { guardianVerificationSessionId: "gv-session-456" },
     );
     expect(twiml).toContain('name="guardianVerificationSessionId"');
     expect(twiml).toContain('value="gv-session-456"');
-    expect(twiml).toContain('<Parameter');
+    expect(twiml).toContain("<Parameter");
   });
 
-  test('omits Parameter elements when no custom parameters', () => {
+  test("omits Parameter elements when no custom parameters", () => {
     const twiml = generateTwiML(
-      'session-123',
-      'wss://example.com/v1/calls/relay',
+      "session-123",
+      "wss://example.com/v1/calls/relay",
       null,
       defaultProfile,
     );
-    expect(twiml).not.toContain('<Parameter');
+    expect(twiml).not.toContain("<Parameter");
   });
 
-  test('omits Parameter elements when custom parameters is undefined', () => {
+  test("omits Parameter elements when custom parameters is undefined", () => {
     const twiml = generateTwiML(
-      'session-123',
-      'wss://example.com/v1/calls/relay',
+      "session-123",
+      "wss://example.com/v1/calls/relay",
       null,
       defaultProfile,
-      'token123',
+      "token123",
       undefined,
     );
-    expect(twiml).not.toContain('<Parameter');
+    expect(twiml).not.toContain("<Parameter");
   });
 });
 
@@ -155,42 +173,48 @@ describe('TwiML parameter propagation', () => {
 // Call session mode metadata: createCallSession persists callMode
 // ---------------------------------------------------------------------------
 
-describe('Call session mode metadata', () => {
-  test('createCallSession persists callMode and guardianVerificationSessionId', async () => {
+describe("Call session mode metadata", () => {
+  test("createCallSession persists callMode and guardianVerificationSessionId", async () => {
     // Dynamic import to avoid circular dependency issues
-    const { createCallSession, getCallSession } = await import('../calls/call-store.js');
-    const { getOrCreateConversation } = await import('../memory/conversation-key-store.js');
+    const { createCallSession, getCallSession } =
+      await import("../calls/call-store.js");
+    const { getOrCreateConversation } =
+      await import("../memory/conversation-key-store.js");
 
-    const { conversationId } = getOrCreateConversation('test-conv-mode');
+    const { conversationId } = getOrCreateConversation("test-conv-mode");
     const session = createCallSession({
       conversationId,
-      provider: 'twilio',
-      fromNumber: '+15551234567',
-      toNumber: '+15559876543',
-      callMode: 'guardian_verification',
-      guardianVerificationSessionId: 'gv-session-test',
+      provider: "twilio",
+      fromNumber: "+15551234567",
+      toNumber: "+15559876543",
+      callMode: "guardian_verification",
+      guardianVerificationSessionId: "gv-session-test",
     });
 
-    expect(session.callMode).toBe('guardian_verification');
-    expect(session.guardianVerificationSessionId).toBe('gv-session-test');
+    expect(session.callMode).toBe("guardian_verification");
+    expect(session.guardianVerificationSessionId).toBe("gv-session-test");
 
     // Verify it persists to DB
     const loaded = getCallSession(session.id);
     expect(loaded).not.toBeNull();
-    expect(loaded!.callMode).toBe('guardian_verification');
-    expect(loaded!.guardianVerificationSessionId).toBe('gv-session-test');
+    expect(loaded!.callMode).toBe("guardian_verification");
+    expect(loaded!.guardianVerificationSessionId).toBe("gv-session-test");
   });
 
-  test('createCallSession defaults callMode to null when not provided', async () => {
-    const { createCallSession, getCallSession } = await import('../calls/call-store.js');
-    const { getOrCreateConversation } = await import('../memory/conversation-key-store.js');
+  test("createCallSession defaults callMode to null when not provided", async () => {
+    const { createCallSession, getCallSession } =
+      await import("../calls/call-store.js");
+    const { getOrCreateConversation } =
+      await import("../memory/conversation-key-store.js");
 
-    const { conversationId } = getOrCreateConversation('test-conv-mode-default');
+    const { conversationId } = getOrCreateConversation(
+      "test-conv-mode-default",
+    );
     const session = createCallSession({
       conversationId,
-      provider: 'twilio',
-      fromNumber: '+15551234567',
-      toNumber: '+15559876543',
+      provider: "twilio",
+      fromNumber: "+15551234567",
+      toNumber: "+15559876543",
     });
 
     expect(session.callMode).toBeNull();
@@ -207,21 +231,21 @@ describe('Call session mode metadata', () => {
 // Guard test: verification commands must not reach processMessage
 // ---------------------------------------------------------------------------
 
-describe('Verification control messages are deterministic (guard)', () => {
-  test('handleChannelInbound does not call processMessage for verification code replies', async () => {
-    const { createHash } = await import('node:crypto');
-    const { handleChannelInbound } = await import('../runtime/routes/inbound-message-handler.js');
-    const {
-      createChallenge,
-    } = await import('../memory/channel-guardian-store.js');
+describe("Verification control messages are deterministic (guard)", () => {
+  test("handleChannelInbound does not call processMessage for verification code replies", async () => {
+    const { createHash } = await import("node:crypto");
+    const { handleChannelInbound } =
+      await import("../runtime/routes/inbound-message-handler.js");
+    const { createChallenge } =
+      await import("../memory/channel-guardian-store.js");
 
     // Set up a pending challenge
-    const secret = '123456';
-    const challengeHash = createHash('sha256').update(secret).digest('hex');
+    const secret = "123456";
+    const challengeHash = createHash("sha256").update(secret).digest("hex");
     createChallenge({
-      id: 'challenge-guard-test',
-      assistantId: 'self',
-      channel: 'telegram',
+      id: "challenge-guard-test",
+      assistantId: "self",
+      channel: "telegram",
       challengeHash,
       expiresAt: Date.now() + 600_000,
     });
@@ -230,44 +254,54 @@ describe('Verification control messages are deterministic (guard)', () => {
     let processMessageCalled = false;
     const processMessage = async () => {
       processMessageCalled = true;
-      return { messageId: 'msg-1' };
+      return { messageId: "msg-1" };
     };
 
     // Track channel replies
     const deliveredReplies: Array<{ chatId: string; text: string }> = [];
     const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
-      const _url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
-      if (init?.method === 'POST' && init.body) {
+    globalThis.fetch = (async (
+      input: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      const _url =
+        typeof input === "string"
+          ? input
+          : input instanceof URL
+            ? input.toString()
+            : input.url;
+      if (init?.method === "POST" && init.body) {
         try {
           const body = JSON.parse(init.body as string);
           if (body.chatId && body.text) {
             deliveredReplies.push({ chatId: body.chatId, text: body.text });
           }
-        } catch { /* not JSON */ }
+        } catch {
+          /* not JSON */
+        }
         return new Response(JSON.stringify({ ok: true }), { status: 200 });
       }
       return originalFetch(input, init as never);
     }) as typeof fetch;
 
     try {
-      const req = new Request('http://localhost/channels/inbound', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+      const req = new Request("http://localhost/channels/inbound", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
-          sourceChannel: 'telegram',
-          interface: 'telegram',
-          conversationExternalId: 'chat-123',
+          sourceChannel: "telegram",
+          interface: "telegram",
+          conversationExternalId: "chat-123",
           externalMessageId: `msg-guard-${Date.now()}`,
           content: secret,
-          actorExternalId: 'user-123',
-          actorDisplayName: 'Test User',
-          replyCallbackUrl: 'http://localhost/callback',
+          actorExternalId: "user-123",
+          actorDisplayName: "Test User",
+          replyCallbackUrl: "http://localhost/callback",
         }),
       });
 
       const response = await handleChannelInbound(req, processMessage);
-      const body = await response.json() as Record<string, unknown>;
+      const body = (await response.json()) as Record<string, unknown>;
 
       // Verification should have been handled
       expect(body.guardianVerification).toBeDefined();
@@ -282,20 +316,24 @@ describe('Verification control messages are deterministic (guard)', () => {
     }
   });
 
-  test('handleChannelInbound does not call processMessage for /start gv_<token> bootstrap commands', async () => {
-    const { createHash, randomBytes } = await import('node:crypto');
-    const { handleChannelInbound } = await import('../runtime/routes/inbound-message-handler.js');
-    const { createOutboundSession } = await import('../runtime/channel-guardian-service.js');
+  test("handleChannelInbound does not call processMessage for /start gv_<token> bootstrap commands", async () => {
+    const { createHash, randomBytes } = await import("node:crypto");
+    const { handleChannelInbound } =
+      await import("../runtime/routes/inbound-message-handler.js");
+    const { createOutboundSession } =
+      await import("../runtime/channel-guardian-service.js");
 
     // Generate a bootstrap token and create a pending_bootstrap session
-    const bootstrapToken = randomBytes(16).toString('hex');
-    const bootstrapTokenHash = createHash('sha256').update(bootstrapToken).digest('hex');
+    const bootstrapToken = randomBytes(16).toString("hex");
+    const bootstrapTokenHash = createHash("sha256")
+      .update(bootstrapToken)
+      .digest("hex");
 
     createOutboundSession({
-      assistantId: 'self',
-      channel: 'telegram',
-      identityBindingStatus: 'pending_bootstrap',
-      destinationAddress: 'test_user',
+      assistantId: "self",
+      channel: "telegram",
+      identityBindingStatus: "pending_bootstrap",
+      destinationAddress: "test_user",
       bootstrapTokenHash,
     });
 
@@ -303,50 +341,60 @@ describe('Verification control messages are deterministic (guard)', () => {
     let processMessageCalled = false;
     const processMessage = async () => {
       processMessageCalled = true;
-      return { messageId: 'msg-1' };
+      return { messageId: "msg-1" };
     };
 
     // Track channel replies (the handler delivers the verification code via fetch)
     const deliveredReplies: Array<{ chatId: string; text: string }> = [];
     const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
-      const _url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
-      if (init?.method === 'POST' && init.body) {
+    globalThis.fetch = (async (
+      input: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      const _url =
+        typeof input === "string"
+          ? input
+          : input instanceof URL
+            ? input.toString()
+            : input.url;
+      if (init?.method === "POST" && init.body) {
         try {
           const body = JSON.parse(init.body as string);
           if (body.chatId && body.text) {
             deliveredReplies.push({ chatId: body.chatId, text: body.text });
           }
-        } catch { /* not JSON */ }
+        } catch {
+          /* not JSON */
+        }
         return new Response(JSON.stringify({ ok: true }), { status: 200 });
       }
       return originalFetch(input, init as never);
     }) as typeof fetch;
 
     try {
-      const req = new Request('http://localhost/channels/inbound', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+      const req = new Request("http://localhost/channels/inbound", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
-          sourceChannel: 'telegram',
-          interface: 'telegram',
-          conversationExternalId: 'chat-bootstrap-123',
+          sourceChannel: "telegram",
+          interface: "telegram",
+          conversationExternalId: "chat-bootstrap-123",
           externalMessageId: `msg-bootstrap-${Date.now()}`,
           content: `/start gv_${bootstrapToken}`,
-          actorExternalId: 'user-bootstrap-123',
-          actorDisplayName: 'Bootstrap User',
-          replyCallbackUrl: 'http://localhost/callback',
+          actorExternalId: "user-bootstrap-123",
+          actorDisplayName: "Bootstrap User",
+          replyCallbackUrl: "http://localhost/callback",
           sourceMetadata: {
-            commandIntent: { type: 'start', payload: `gv_${bootstrapToken}` },
+            commandIntent: { type: "start", payload: `gv_${bootstrapToken}` },
           },
         }),
       });
 
       const response = await handleChannelInbound(req, processMessage);
-      const body = await response.json() as Record<string, unknown>;
+      const body = (await response.json()) as Record<string, unknown>;
 
       // Bootstrap should have been handled deterministically
-      expect(body.guardianVerification).toBe('bootstrap_bound');
+      expect(body.guardianVerification).toBe("bootstrap_bound");
       expect(body.accepted).toBe(true);
 
       // processMessage must NOT have been called — deterministic handling