@vellumai/assistant 0.4.34 → 0.4.36

package/src/__tests__/channel-readiness-routes.test.ts

@@ -0,0 +1,336 @@
+/**
+ * Tests that the channel readiness service returns real readiness snapshots
+ * for email and WhatsApp channels (not unsupported placeholders).
+ *
+ * Uses the same mock approach as channel-readiness-service.test.ts but
+ * exercises the createReadinessService factory to verify probe registration.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mocks — must be set up before importing the service
+// ---------------------------------------------------------------------------
+
+let mockTwilioPhoneNumberEnv: string | undefined;
+let mockRawConfig: Record<string, unknown> | undefined;
+let mockSecureKeys: Record<string, string>;
+let mockHasTwilioCredentials: boolean;
+let mockPrimaryInboxAddress: string | undefined;
+
+mock.module("../calls/twilio-rest.js", () => ({
+  hasTwilioCredentials: () => mockHasTwilioCredentials,
+  getPhoneNumberSid: async () => null,
+  getTollFreeVerificationStatus: async () => null,
+}));
+
+mock.module("../config/env.js", () => ({
+  getTwilioPhoneNumberEnv: () => mockTwilioPhoneNumberEnv,
+}));
+
+mock.module("../config/loader.js", () => ({
+  loadRawConfig: () => mockRawConfig,
+  getConfig: () => {
+    const raw = mockRawConfig ?? {};
+    const wa = (raw.whatsapp ?? {}) as Record<string, unknown>;
+    return { whatsapp: { phoneNumber: (wa.phoneNumber as string) ?? "" } };
+  },
+  invalidateConfigCache: () => {},
+}));
+
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKey: (key: string) => mockSecureKeys[key] ?? null,
+}));
+
+mock.module("../email/service.js", () => ({
+  getEmailService: () => ({
+    getPrimaryInboxAddress: async () => mockPrimaryInboxAddress,
+  }),
+}));
+
+// ---------------------------------------------------------------------------
+// Import under test
+// ---------------------------------------------------------------------------
+
+import { createReadinessService } from "../runtime/channel-readiness-service.js";
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("channel readiness routes — email and WhatsApp probes", () => {
+  beforeEach(() => {
+    mockTwilioPhoneNumberEnv = undefined;
+    mockRawConfig = undefined;
+    mockSecureKeys = {};
+    mockHasTwilioCredentials = false;
+    mockPrimaryInboxAddress = undefined;
+  });
+
+  // -------------------------------------------------------------------------
+  // Email probe
+  // -------------------------------------------------------------------------
+
+  describe("email", () => {
+    test("returns real readiness snapshot (not unsupported)", async () => {
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email");
+
+      expect(snapshot.channel).toBe("email");
+      // Should have real local checks, not the unsupported placeholder
+      expect(snapshot.localChecks.length).toBeGreaterThan(0);
+      expect(
+        snapshot.reasons.some((r) => r.code === "unsupported_channel"),
+      ).toBe(false);
+    });
+
+    test("reports not ready when AgentMail API key is missing", async () => {
+      mockRawConfig = {};
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email");
+
+      expect(snapshot.ready).toBe(false);
+      expect(snapshot.reasons.some((r) => r.code === "agentmail_api_key")).toBe(
+        true,
+      );
+    });
+
+    test("checks invite policy", async () => {
+      mockSecureKeys = { agentmail: "test-key" };
+      mockRawConfig = {
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email");
+
+      const inviteCheck = snapshot.localChecks.find(
+        (c) => c.name === "invite_policy",
+      );
+      expect(inviteCheck).toBeDefined();
+      // Email has codeRedemptionEnabled: true in the channel policy registry
+      expect(inviteCheck!.passed).toBe(true);
+    });
+
+    test("checks ingress configuration", async () => {
+      mockSecureKeys = { agentmail: "test-key" };
+      mockRawConfig = {};
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email");
+
+      const ingressCheck = snapshot.localChecks.find(
+        (c) => c.name === "ingress",
+      );
+      expect(ingressCheck).toBeDefined();
+      expect(ingressCheck!.passed).toBe(false);
+    });
+
+    test("ready when all prerequisites are met (including inbox)", async () => {
+      mockSecureKeys = { agentmail: "test-key" };
+      mockRawConfig = {
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      mockPrimaryInboxAddress = "hello@example.agentmail.to";
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", true);
+
+      expect(snapshot.ready).toBe(true);
+      expect(snapshot.reasons).toHaveLength(0);
+    });
+
+    test("not ready when inbox is missing (remote check)", async () => {
+      mockSecureKeys = { agentmail: "test-key" };
+      mockRawConfig = {
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      mockPrimaryInboxAddress = undefined;
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", true);
+
+      expect(snapshot.ready).toBe(false);
+      expect(snapshot.reasons.some((r) => r.code === "inbox_configured")).toBe(
+        true,
+      );
+    });
+
+    test("local-only readiness still passes without inbox check", async () => {
+      mockSecureKeys = { agentmail: "test-key" };
+      mockRawConfig = {
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      // No inbox configured — explicitly opt out of remote checks
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("email", false);
+
+      // Local checks pass — remote inbox check is not included
+      expect(snapshot.ready).toBe(true);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // WhatsApp probe — Meta WhatsApp Business API credentials
+  // -------------------------------------------------------------------------
+
+  describe("whatsapp", () => {
+    test("returns real readiness snapshot (not unsupported)", async () => {
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("whatsapp");
+
+      expect(snapshot.channel).toBe("whatsapp");
+      expect(snapshot.localChecks.length).toBeGreaterThan(0);
+      expect(
+        snapshot.reasons.some((r) => r.code === "unsupported_channel"),
+      ).toBe(false);
+    });
+
+    test("reports not ready when Meta credentials are missing", async () => {
+      mockRawConfig = {};
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("whatsapp");
+
+      expect(snapshot.ready).toBe(false);
+      expect(
+        snapshot.reasons.some((r) => r.code === "whatsapp_phone_number_id"),
+      ).toBe(true);
+      expect(
+        snapshot.reasons.some((r) => r.code === "whatsapp_access_token"),
+      ).toBe(true);
+    });
+
+    test("reports ready when all Meta credentials and display number are configured", async () => {
+      mockSecureKeys = {
+        "credential:whatsapp:phone_number_id": "123456789",
+        "credential:whatsapp:access_token": "EAAxxxxxx",
+        "credential:whatsapp:app_secret": "abc123",
+        "credential:whatsapp:webhook_verify_token": "my-verify-token",
+      };
+      mockRawConfig = {
+        whatsapp: { phoneNumber: "+15551234567" },
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("whatsapp");
+
+      expect(snapshot.ready).toBe(true);
+      expect(snapshot.reasons).toHaveLength(0);
+    });
+
+    test("reports not ready when display phone number is missing", async () => {
+      mockSecureKeys = {
+        "credential:whatsapp:phone_number_id": "123456789",
+        "credential:whatsapp:access_token": "EAAxxxxxx",
+        "credential:whatsapp:app_secret": "abc123",
+        "credential:whatsapp:webhook_verify_token": "my-verify-token",
+      };
+      mockRawConfig = {
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("whatsapp");
+
+      expect(snapshot.ready).toBe(false);
+      expect(
+        snapshot.reasons.some(
+          (r) => r.code === "whatsapp_display_phone_number",
+        ),
+      ).toBe(true);
+    });
+
+    test("checks each Meta credential individually", async () => {
+      mockSecureKeys = {
+        "credential:whatsapp:phone_number_id": "123456789",
+        // access_token missing
+        "credential:whatsapp:app_secret": "abc123",
+        "credential:whatsapp:webhook_verify_token": "my-verify-token",
+      };
+      mockRawConfig = {
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("whatsapp");
+
+      expect(snapshot.ready).toBe(false);
+
+      const phoneIdCheck = snapshot.localChecks.find(
+        (c) => c.name === "whatsapp_phone_number_id",
+      );
+      expect(phoneIdCheck!.passed).toBe(true);
+
+      const accessTokenCheck = snapshot.localChecks.find(
+        (c) => c.name === "whatsapp_access_token",
+      );
+      expect(accessTokenCheck!.passed).toBe(false);
+
+      const appSecretCheck = snapshot.localChecks.find(
+        (c) => c.name === "whatsapp_app_secret",
+      );
+      expect(appSecretCheck!.passed).toBe(true);
+
+      const webhookCheck = snapshot.localChecks.find(
+        (c) => c.name === "whatsapp_webhook_verify_token",
+      );
+      expect(webhookCheck!.passed).toBe(true);
+    });
+
+    test("checks invite policy", async () => {
+      mockSecureKeys = {
+        "credential:whatsapp:phone_number_id": "123456789",
+        "credential:whatsapp:access_token": "EAAxxxxxx",
+        "credential:whatsapp:app_secret": "abc123",
+        "credential:whatsapp:webhook_verify_token": "my-verify-token",
+      };
+      mockRawConfig = {
+        whatsapp: { phoneNumber: "+15551234567" },
+        ingress: { publicBaseUrl: "https://example.com", enabled: true },
+      };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("whatsapp");
+
+      const inviteCheck = snapshot.localChecks.find(
+        (c) => c.name === "invite_policy",
+      );
+      expect(inviteCheck).toBeDefined();
+      expect(inviteCheck!.passed).toBe(true);
+    });
+
+    test("checks ingress configuration", async () => {
+      mockSecureKeys = {
+        "credential:whatsapp:phone_number_id": "123456789",
+        "credential:whatsapp:access_token": "EAAxxxxxx",
+        "credential:whatsapp:app_secret": "abc123",
+        "credential:whatsapp:webhook_verify_token": "my-verify-token",
+      };
+      mockRawConfig = {
+        whatsapp: { phoneNumber: "+15551234567" },
+      };
+      const service = createReadinessService();
+      const [snapshot] = await service.getReadiness("whatsapp");
+
+      const ingressCheck = snapshot.localChecks.find(
+        (c) => c.name === "ingress",
+      );
+      expect(ingressCheck).toBeDefined();
+      expect(ingressCheck!.passed).toBe(false);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Factory coverage — all channels registered
+  // -------------------------------------------------------------------------
+
+  describe("createReadinessService factory", () => {
+    test("registers probes for all deliverable channels including email and whatsapp", async () => {
+      const service = createReadinessService();
+      const snapshots = await service.getReadiness();
+
+      const channels = snapshots.map((s) => s.channel).sort();
+      expect(channels).toContain("email");
+      expect(channels).toContain("whatsapp");
+
+      // None should be unsupported placeholders
+      for (const s of snapshots) {
+        expect(s.reasons.some((r) => r.code === "unsupported_channel")).toBe(
+          false,
+        );
+      }
+    });
+  });
+});

package/src/__tests__/checker.test.ts

@@ -2570,7 +2570,7 @@ describe("Permission Checker", () => {
         expect(result.reason).toContain("Strict mode");
       });
 
-      test("legacy mode: file_write to skill source still prompts as High risk", async () => {
+      test("workspace mode: file_write to skill source still prompts as High risk", async () => {
         testConfig.permissions.mode = "workspace";
         ensureSkillsDir();
         const skillPath = join(
@@ -2996,7 +2996,7 @@ describe("Permission Checker", () => {
       ensureSkillsDir();
       writeSkill("test-hash-skill", "Test Hash Skill");
 
-      // skill_load is Low risk, so with no trust rule in legacy mode it
+      // skill_load is Low risk, so with no trust rule in workspace mode it
       // auto-allows. We set strict mode and add specific rules to verify
       // the correct candidates are generated.
       testConfig.permissions.mode = "strict";
@@ -3332,7 +3332,7 @@ describe("Permission Checker", () => {
       expect(result.matchedRule!.pattern).toBe("skill_load:pr34-bare-id");
     });
 
-    test("skill_load auto-allows in legacy mode (backward compat)", async () => {
+    test("skill_load auto-allows in workspace mode", async () => {
       testConfig.permissions.mode = "workspace";
       const result = await check("skill_load", { skill: "any-skill" }, "/tmp");
       expect(result.decision).toBe("allow");
@@ -3855,7 +3855,7 @@ describe("Permission Checker", () => {
     //    high-risk allow) if they choose. ────────────────────────────
 
     describe("Invariant 6: user can set broad rules if they choose", () => {
-      test("wildcard allow rule matches any command in legacy mode", async () => {
+      test("wildcard allow rule matches any command in workspace mode", async () => {
         testConfig.permissions.mode = "workspace";
         addRule("bash", "*", "everywhere");
         const result = await check(
@@ -4208,7 +4208,7 @@ describe("Permission Checker", () => {
       });
     }
 
-    test("browser tools are auto-allowed in legacy mode", async () => {
+    test("browser tools are auto-allowed in workspace mode", async () => {
       testConfig.permissions = { mode: "workspace" };
       for (const toolName of browserToolNames) {
         const result = await check(toolName, {}, "/tmp");
@@ -4404,7 +4404,7 @@ describe("computer-use tool permission defaults", () => {
     for (const name of cuToolNames) {
       const risk = await classifyRisk(name, {});
       // CU tools are proxy tools with RiskLevel.Low, but classifyRisk looks them up
-      // in the registry. In legacy mode, Low risk tools are auto-allowed.
+      // in the registry. In workspace mode, Low risk tools are auto-allowed.
       expect(risk).toBe(RiskLevel.Low);
     }
   });