@vellumai/assistant 0.4.49 → 0.4.51

package/src/__tests__/invite-redemption-service.test.ts

@@ -23,7 +23,11 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-import { findContactChannel } from "../contacts/contact-store.js";
+import {
+  findContactChannel,
+  getContact,
+  upsertContact,
+} from "../contacts/contact-store.js";
 import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getSqlite, initializeDb, resetDb } from "../memory/db.js";
 import {
@@ -54,12 +58,19 @@ function resetTables() {
   getSqlite().run("DELETE FROM contacts");
 }
 
+/** Create a throwaway contact and return its ID, for use as the invite's contactId. */
+function createTargetContact(displayName = "Target Contact"): string {
+  return upsertContact({ displayName, role: "contact" }).id;
+}
+
 describe("invite-redemption-service", () => {
   beforeEach(resetTables);
 
   test("redeems a valid invite and returns typed outcome", () => {
+    const targetContactId = createTargetContact();
     const { rawToken, invite } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
     });
 
@@ -79,8 +90,10 @@ describe("invite-redemption-service", () => {
   });
 
   test("marks channel as verified via invite on redemption", () => {
+    const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
     });
 
@@ -104,9 +117,11 @@ describe("invite-redemption-service", () => {
   });
 
   test("marks channel as verified via invite on 6-digit code redemption", () => {
+    const targetContactId = createTargetContact();
     const inviteCode = "123456";
     createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
       inviteCodeHash: hashVoiceCode(inviteCode),
     });
@@ -141,9 +156,11 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns expired for an expired invite", () => {
+    const targetContactId = createTargetContact();
     // Create an invite that expired 1 ms ago
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
       expiresInMs: -1,
     });
@@ -158,8 +175,10 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns revoked for a revoked invite", () => {
+    const targetContactId = createTargetContact();
     const { rawToken, invite } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
     });
     revokeStoreFn(invite.id);
@@ -174,8 +193,10 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns max_uses_reached when invite is fully consumed", () => {
+    const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
     });
 
@@ -198,8 +219,10 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns channel_mismatch when redeeming on wrong channel", () => {
+    const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
     });
 
@@ -213,8 +236,10 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns missing_identity when no externalUserId or externalChatId", () => {
+    const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
     });
 
@@ -227,16 +252,18 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns already_member when user is already an active member", () => {
-    const { rawToken } = createInvite({
+    // Pre-create an active member and find their contact
+    const member = upsertContactChannel({
       sourceChannel: "telegram",
-      maxUses: 5,
+      externalUserId: "existing-user",
+      status: "active",
     });
 
-    // Pre-create an active member
-    upsertContactChannel({
+    // Create an invite targeting the same contact that owns the channel
+    const { rawToken } = createInvite({
       sourceChannel: "telegram",
-      externalUserId: "existing-user",
-      status: "active",
+      contactId: member!.contact.id,
+      maxUses: 5,
     });
 
     const outcome = redeemInvite({
@@ -257,30 +284,145 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns invalid_token for a blocked member to avoid leaking membership status", () => {
+    // Pre-create a blocked member and find their contact
+    const member = upsertContactChannel({
+      sourceChannel: "telegram",
+      externalUserId: "blocked-user",
+      status: "blocked",
+    });
+
+    // Create an invite targeting the same contact that owns the channel
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: member!.contact.id,
       maxUses: 5,
     });
 
-    // Pre-create a blocked member — simulates a guardian-initiated block
-    upsertContactChannel({
+    const outcome = redeemInvite({
+      rawToken,
       sourceChannel: "telegram",
       externalUserId: "blocked-user",
-      status: "blocked",
     });
 
+    expect(outcome).toEqual({ ok: false, reason: "invalid_token" });
+  });
+
+  test("binds redeemer to the invite's target contact, not the guardian", () => {
+    // Pre-create a guardian contact with a revoked telegram channel
+    const guardianContact = upsertContact({
+      displayName: "Guardian",
+      role: "guardian",
+      channels: [
+        {
+          type: "telegram",
+          address: "guardian-tg-id",
+          externalUserId: "guardian-tg-id",
+          status: "revoked",
+        },
+      ],
+    });
+
+    // Create a separate target contact "Mom"
+    const momContact = upsertContact({
+      displayName: "Mom",
+      role: "contact",
+    });
+
+    // Create an invite targeting Mom's contact
+    const { rawToken } = createInvite({
+      sourceChannel: "telegram",
+      contactId: momContact.id,
+      maxUses: 5,
+    });
+
+    // Redeem using the guardian's Telegram identity
     const outcome = redeemInvite({
       rawToken,
       sourceChannel: "telegram",
-      externalUserId: "blocked-user",
+      externalUserId: "guardian-tg-id",
     });
 
-    expect(outcome).toEqual({ ok: false, reason: "invalid_token" });
+    // Should succeed — redeemer's channel is bound to Mom
+    expect(outcome.ok).toBe(true);
+    expect((outcome as { type: string }).type).toBe("redeemed");
+
+    // Verify the redeemer's Telegram ID is now bound to Mom's contact
+    const result = findContactChannel({
+      channelType: "telegram",
+      externalUserId: "guardian-tg-id",
+    });
+    expect(result).not.toBeNull();
+    expect(result!.contact.id).toBe(momContact.id);
+    expect(result!.channel.status).toBe("active");
+
+    // Verify the original guardian contact was NOT modified
+    const guardian = getContact(guardianContact.id);
+    expect(guardian).not.toBeNull();
+    expect(guardian!.role).toBe("guardian");
+  });
+
+  test("binds redeemer to the invite's target contact via 6-digit code, not the guardian", () => {
+    // Pre-create a guardian contact with a revoked telegram channel
+    const guardianContact = upsertContact({
+      displayName: "Guardian",
+      role: "guardian",
+      channels: [
+        {
+          type: "telegram",
+          address: "guardian-code-id",
+          externalUserId: "guardian-code-id",
+          status: "revoked",
+        },
+      ],
+    });
+
+    // Create a separate target contact "Mom"
+    const momContact = upsertContact({
+      displayName: "Mom",
+      role: "contact",
+    });
+
+    // Create an invite targeting Mom's contact with a 6-digit code
+    const code = "123456";
+    const inviteCodeHash = hashVoiceCode(code);
+    createInvite({
+      sourceChannel: "telegram",
+      contactId: momContact.id,
+      maxUses: 5,
+      inviteCodeHash,
+    });
+
+    // Redeem using the guardian's Telegram identity
+    const outcome = redeemInviteByCode({
+      code,
+      sourceChannel: "telegram",
+      externalUserId: "guardian-code-id",
+    });
+
+    // Should succeed — redeemer's channel is bound to Mom
+    expect(outcome.ok).toBe(true);
+    expect((outcome as { type: string }).type).toBe("redeemed");
+
+    // Verify the redeemer's Telegram ID is now bound to Mom's contact
+    const result = findContactChannel({
+      channelType: "telegram",
+      externalUserId: "guardian-code-id",
+    });
+    expect(result).not.toBeNull();
+    expect(result!.contact.id).toBe(momContact.id);
+    expect(result!.channel.status).toBe("active");
+
+    // Verify the original guardian contact was NOT modified
+    const guardian = getContact(guardianContact.id);
+    expect(guardian).not.toBeNull();
+    expect(guardian!.role).toBe("guardian");
   });
 
   test("does not return already_member for a revoked member", () => {
+    const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 5,
     });
 
@@ -306,8 +448,10 @@ describe("invite-redemption-service", () => {
   });
 
   test("raw token is not present in the outcome object", () => {
+    const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 1,
     });
 
@@ -323,7 +467,12 @@ describe("invite-redemption-service", () => {
   });
 
   test("channel enforcement blocks cross-channel redemption (voice invite via slack)", () => {
-    const { rawToken } = createInvite({ sourceChannel: "phone", maxUses: 1 });
+    const targetContactId = createTargetContact();
+    const { rawToken } = createInvite({
+      sourceChannel: "phone",
+      contactId: targetContactId,
+      maxUses: 1,
+    });
 
     const outcome = redeemInvite({
       rawToken,
@@ -353,9 +502,11 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns expired for an active member with an expired invite token", () => {
+    const targetContactId = createTargetContact();
     // Create an expired invite
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
+      contactId: targetContactId,
       maxUses: 5,
       expiresInMs: -1,
     });
@@ -378,9 +529,11 @@ describe("invite-redemption-service", () => {
   });
 
   test("returns channel_mismatch for an active member with a valid token for a different channel", () => {
+    const targetContactId = createTargetContact();
     // Create an invite for voice
     const { rawToken } = createInvite({
       sourceChannel: "phone",
+      contactId: targetContactId,
       maxUses: 5,
     });
 

package/src/__tests__/invite-routes-http.test.ts

@@ -41,16 +41,34 @@ mock.module("../telegram/bot-username.js", () => ({
   getTelegramBotUsername: () => mockTelegramBotUsername,
 }));
 
+// Mock startInviteCall from call-domain — test env lacks Twilio credentials.
+let mockStartInviteCallResult:
+  | { ok: true; callSid: string }
+  | { ok: false; error: string; status?: number } = {
+  ok: true,
+  callSid: "CA_test_sid_123",
+};
+mock.module("../calls/call-domain.js", () => ({
+  startInviteCall: async () => mockStartInviteCallResult,
+}));
+
+import { upsertContact } from "../contacts/contact-store.js";
 import { getSqlite, initializeDb, resetDb } from "../memory/db.js";
 import {
   handleCreateInvite,
   handleListInvites,
   handleRedeemInvite,
   handleRevokeInvite,
+  handleTriggerInviteCall,
 } from "../runtime/routes/invite-routes.js";
 
 initializeDb();
 
+/** Create a throwaway contact and return its ID, for use as the invite's contactId. */
+function createTargetContact(displayName = "Test Contact"): string {
+  return upsertContact({ displayName, role: "contact" }).id;
+}
+
 afterAll(() => {
   resetDb();
   try {
@@ -79,6 +97,7 @@ describe("ingress invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "telegram",
+        contactId: createTargetContact(),
         note: "Test invite",
         maxUses: 5,
       }),
@@ -108,6 +127,7 @@ describe("ingress invite HTTP routes", () => {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           sourceChannel: "telegram",
+          contactId: createTargetContact(),
           note: "Share link test",
         }),
       });
@@ -151,14 +171,20 @@ describe("ingress invite HTTP routes", () => {
       new Request("http://localhost/v1/contacts/invites", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ sourceChannel: "telegram" }),
+        body: JSON.stringify({
+          sourceChannel: "telegram",
+          contactId: createTargetContact(),
+        }),
       }),
     );
     await handleCreateInvite(
       new Request("http://localhost/v1/contacts/invites", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ sourceChannel: "telegram" }),
+        body: JSON.stringify({
+          sourceChannel: "telegram",
+          contactId: createTargetContact(),
+        }),
       }),
     );
 
@@ -177,7 +203,10 @@ describe("ingress invite HTTP routes", () => {
       new Request("http://localhost/v1/contacts/invites", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ sourceChannel: "telegram" }),
+        body: JSON.stringify({
+          sourceChannel: "telegram",
+          contactId: createTargetContact(),
+        }),
       }),
     );
     const created = (await createRes.json()) as { invite: { id: string } };
@@ -202,7 +231,11 @@ describe("ingress invite HTTP routes", () => {
       new Request("http://localhost/v1/contacts/invites", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ sourceChannel: "telegram", maxUses: 1 }),
+        body: JSON.stringify({
+          sourceChannel: "telegram",
+          contactId: createTargetContact(),
+          maxUses: 1,
+        }),
       }),
     );
     const created = (await createRes.json()) as { invite: { token: string } };
@@ -270,7 +303,10 @@ describe("ingress service shared logic", () => {
       new Request("http://localhost/v1/contacts/invites", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ sourceChannel: "telegram" }),
+        body: JSON.stringify({
+          sourceChannel: "telegram",
+          contactId: createTargetContact(),
+        }),
       }),
     );
     const created = (await createRes.json()) as {
@@ -300,6 +336,7 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
+        contactId: createTargetContact(),
         expectedExternalUserId: "+15551234567",
         friendName: "Alice",
         guardianName: "Bob",
@@ -336,6 +373,7 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
+        contactId: createTargetContact(),
         friendName: "Alice",
         guardianName: "Bob",
       }),
@@ -355,6 +393,7 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
+        contactId: createTargetContact(),
         expectedExternalUserId: "not-a-phone-number",
         friendName: "Alice",
         guardianName: "Bob",
@@ -375,6 +414,7 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
+        contactId: createTargetContact(),
         expectedExternalUserId: "+15551234567",
         guardianName: "Bob",
       }),
@@ -394,6 +434,7 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
+        contactId: createTargetContact(),
         expectedExternalUserId: "+15551234567",
         friendName: "Alice",
       }),
@@ -413,6 +454,7 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
+        contactId: createTargetContact(),
         expectedExternalUserId: "+15551234567",
         friendName: "Alice",
         guardianName: "Bob",
@@ -436,6 +478,7 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
+        contactId: createTargetContact(),
         expectedExternalUserId: "+15551234567",
         friendName: "Alice",
         guardianName: "Bob",
@@ -460,6 +503,7 @@ describe("voice invite HTTP routes", () => {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           sourceChannel: "phone",
+          contactId: createTargetContact(),
           expectedExternalUserId: "+15551234567",
           friendName: "Alice",
           guardianName: "Bob",
@@ -517,6 +561,7 @@ describe("voice invite HTTP routes", () => {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           sourceChannel: "phone",
+          contactId: createTargetContact(),
           expectedExternalUserId: "+15551234567",
           friendName: "Alice",
           guardianName: "Bob",
@@ -540,4 +585,120 @@ describe("voice invite HTTP routes", () => {
     expect(res.status).toBe(400);
     expect(body.ok).toBe(false);
   });
+
+  test("voice invite creation returns guardianInstruction with friend name", async () => {
+    const req = new Request("http://localhost/v1/contacts/invites", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        sourceChannel: "phone",
+        contactId: createTargetContact(),
+        expectedExternalUserId: "+15551234567",
+        friendName: "Alice",
+        guardianName: "Bob",
+      }),
+    });
+
+    const res = await handleCreateInvite(req);
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(201);
+    expect(body.ok).toBe(true);
+    const invite = body.invite as Record<string, unknown>;
+    expect(invite.guardianInstruction).toBe(
+      "Alice will need this code when they answer. Share it with them first.",
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Trigger invite call endpoint
+// ---------------------------------------------------------------------------
+
+describe("POST /v1/contacts/invites/:id/call", () => {
+  beforeEach(() => {
+    resetTables();
+    mockStartInviteCallResult = { ok: true, callSid: "CA_test_sid_123" };
+  });
+
+  test("triggers a call for an active phone invite", async () => {
+    const createRes = await handleCreateInvite(
+      new Request("http://localhost/v1/contacts/invites", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          sourceChannel: "phone",
+          contactId: createTargetContact(),
+          expectedExternalUserId: "+15551234567",
+          friendName: "Alice",
+          guardianName: "Bob",
+        }),
+      }),
+    );
+    const created = (await createRes.json()) as { invite: { id: string } };
+
+    const res = await handleTriggerInviteCall(created.invite.id);
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(body.callSid).toBe("CA_test_sid_123");
+  });
+
+  test("returns 400 for non-existent invite", async () => {
+    const res = await handleTriggerInviteCall("nonexistent-id");
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(400);
+    expect(body.ok).toBe(false);
+    expect(body.error).toBe("Invite not found");
+  });
+
+  test("returns 400 for a revoked (non-active) invite", async () => {
+    const createRes = await handleCreateInvite(
+      new Request("http://localhost/v1/contacts/invites", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          sourceChannel: "phone",
+          contactId: createTargetContact(),
+          expectedExternalUserId: "+15551234567",
+          friendName: "Alice",
+          guardianName: "Bob",
+        }),
+      }),
+    );
+    const created = (await createRes.json()) as { invite: { id: string } };
+
+    // Revoke the invite
+    handleRevokeInvite(created.invite.id);
+
+    const res = await handleTriggerInviteCall(created.invite.id);
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(400);
+    expect(body.ok).toBe(false);
+    expect(body.error).toBe("Invite is not active");
+  });
+
+  test("returns 400 for a non-phone invite", async () => {
+    const createRes = await handleCreateInvite(
+      new Request("http://localhost/v1/contacts/invites", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          sourceChannel: "telegram",
+          contactId: createTargetContact(),
+        }),
+      }),
+    );
+    const created = (await createRes.json()) as { invite: { id: string } };
+
+    const res = await handleTriggerInviteCall(created.invite.id);
+    const body = (await res.json()) as Record<string, unknown>;
+
+    expect(res.status).toBe(400);
+    expect(body.ok).toBe(false);
+    expect(body.error).toBe("Only phone invites support call triggering");
+  });
 });

package/src/__tests__/keychain-broker-client.test.ts

@@ -264,7 +264,7 @@ describe("keychain-broker-client", () => {
 
       const client = createBrokerClient();
       const result = await client.set("my-key", "new-value");
-      expect(result).toBe(true);
+      expect(result).toEqual({ status: "ok" });
     });
 
     test("del returns true on success", async () => {
@@ -434,11 +434,11 @@ describe("keychain-broker-client", () => {
       expect(result).toBeNull();
     });
 
-    test("set returns false when socket file does not exist", async () => {
+    test("set returns unreachable when socket file does not exist", async () => {
       writeFileSync(TOKEN_PATH, TEST_TOKEN);
       const client = createBrokerClient();
       const result = await client.set("test-key", "value");
-      expect(result).toBe(false);
+      expect(result).toEqual({ status: "unreachable" });
     });
 
     test("del returns false when socket file does not exist", async () => {
@@ -470,7 +470,7 @@ describe("keychain-broker-client", () => {
       }
       const client = createBrokerClient();
       expect(await client.get("key")).toBeNull();
-      expect(await client.set("key", "val")).toBe(false);
+      expect(await client.set("key", "val")).toEqual({ status: "unreachable" });
       expect(await client.del("key")).toBe(false);
       expect(await client.list()).toEqual([]);
       expect(await client.ping()).toBeNull();