@vellumai/credential-executor 0.10.7-dev.202607102035.64f07ea → 0.10.7-staging.1

package/src/__tests__/managed-integration.test.ts

@@ -21,17 +21,14 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, unlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import {
-  createConnection,
-  createServer as createNetServer,
-  type Socket,
-} from "node:net";
+import { createConnection, createServer as createNetServer, type Socket } from "node:net";
 import { Readable, Writable } from "node:stream";
 
 import {
   CES_PROTOCOL_VERSION,
   CesRpcMethod,
   type HandshakeAck,
+  type ListGrantsResponse,
   type GetCredentialResponse,
   type SetCredentialResponse,
   type DeleteCredentialResponse,
@@ -39,11 +36,13 @@ import {
   type RpcEnvelope,
 } from "@vellumai/service-contracts/credential-rpc";
 
+import { PersistentGrantStore } from "../grants/persistent-store.js";
+import { AuditStore } from "../audit/store.js";
 import {
-  CesRpcServer,
-  type RpcHandlerRegistry,
-  type ServeEndReason,
-} from "../server.js";
+  createListGrantsHandler,
+  createListAuditRecordsHandler,
+} from "../grants/rpc-handlers.js";
+import { CesRpcServer, type RpcHandlerRegistry, type ServeEndReason } from "../server.js";
 import { createLocalSecureKeyBackend } from "../materializers/local-secure-key-backend.js";
 
 // ---------------------------------------------------------------------------
@@ -84,11 +83,40 @@ function restoreEnv(saved: SavedEnv): void {
 // Helpers
 // ---------------------------------------------------------------------------
 
+/**
+ * Build a minimal RPC handler registry with `list_grants` and
+ * `list_audit_records` backed by real stores in a temp directory.
+ */
+function buildMinimalHandlers(dataDir: string): RpcHandlerRegistry {
+  const grantsDir = join(dataDir, "grants");
+  const auditDir = join(dataDir, "audit");
+  mkdirSync(grantsDir, { recursive: true });
+  mkdirSync(auditDir, { recursive: true });
+
+  const persistentGrantStore = new PersistentGrantStore(grantsDir);
+  persistentGrantStore.init();
+
+  const auditStore = new AuditStore(auditDir);
+  auditStore.init();
+
+  const handlers: RpcHandlerRegistry = {};
+
+  handlers[CesRpcMethod.ListGrants] = createListGrantsHandler({
+    persistentGrantStore,
+  }) as typeof handlers[string];
+
+  handlers[CesRpcMethod.ListAuditRecords] = createListAuditRecordsHandler({
+    auditStore,
+  }) as typeof handlers[string];
+
+  return handlers;
+}
+
 /**
  * Build an RPC handler registry with credential CRUD handlers backed by
  * a real SecureKeyBackend using a temp directory for credential storage.
  *
- * Mirrors the handler registration in main.ts.
+ * Mirrors the handler registration in managed-main.ts.
  */
 function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
   const secureKeyBackend = createLocalSecureKeyBackend(vellumRoot);
@@ -97,27 +125,22 @@ function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
   handlers[CesRpcMethod.GetCredential] = (async (req: { account: string }) => {
     const value = await secureKeyBackend.get(req.account);
     return { found: value !== undefined, value };
-  }) as (typeof handlers)[string];
+  }) as typeof handlers[string];
 
-  handlers[CesRpcMethod.SetCredential] = (async (req: {
-    account: string;
-    value: string;
-  }) => {
+  handlers[CesRpcMethod.SetCredential] = (async (req: { account: string; value: string }) => {
     const ok = await secureKeyBackend.set(req.account, req.value);
     return { ok };
-  }) as (typeof handlers)[string];
+  }) as typeof handlers[string];
 
-  handlers[CesRpcMethod.DeleteCredential] = (async (req: {
-    account: string;
-  }) => {
+  handlers[CesRpcMethod.DeleteCredential] = (async (req: { account: string }) => {
     const result = await secureKeyBackend.delete(req.account);
     return { result };
-  }) as (typeof handlers)[string];
+  }) as typeof handlers[string];
 
   handlers[CesRpcMethod.ListCredentials] = (async () => {
     const accounts = await secureKeyBackend.list();
     return { accounts };
-  }) as (typeof handlers)[string];
+  }) as typeof handlers[string];
 
   return handlers;
 }
@@ -126,13 +149,10 @@ function buildCredentialHandlers(vellumRoot: string): RpcHandlerRegistry {
  * Accept a single connection on a Unix socket and return
  * readable/writable streams plus cleanup helpers.
  *
- * Replicates the same accept-one-connection pattern from main.ts
+ * Replicates the same accept-one-connection pattern from managed-main.ts
  * but in a test-friendly form.
  */
-function acceptOneConnection(
-  socketPath: string,
-  signal: AbortSignal,
-): Promise<{
+function acceptOneConnection(socketPath: string, signal: AbortSignal): Promise<{
   readable: Readable;
   writable: Writable;
   socket: Socket;
@@ -142,11 +162,7 @@ function acceptOneConnection(
 
     const cleanup = () => {
       netServer.close();
-      try {
-        unlinkSync(socketPath);
-      } catch {
-        /* ok */
-      }
+      try { unlinkSync(socketPath); } catch { /* ok */ }
     };
 
     if (signal.aborted) {
@@ -154,14 +170,10 @@ function acceptOneConnection(
       return;
     }
 
-    signal.addEventListener(
-      "abort",
-      () => {
-        cleanup();
-        reject(new Error("Aborted while waiting for connection"));
-      },
-      { once: true },
-    );
+    signal.addEventListener("abort", () => {
+      cleanup();
+      reject(new Error("Aborted while waiting for connection"));
+    }, { once: true });
 
     netServer.on("error", (err: Error) => {
       cleanup();
@@ -174,19 +186,11 @@ function acceptOneConnection(
 
     netServer.on("connection", (sock: Socket) => {
       netServer.close();
-      try {
-        unlinkSync(socketPath);
-      } catch {
-        /* ok */
-      }
+      try { unlinkSync(socketPath); } catch { /* ok */ }
 
       const readable = new Readable({ read() {} });
       const writable = new Writable({
-        write(
-          chunk: Buffer,
-          _encoding: string,
-          callback: (err?: Error | null) => void,
-        ) {
+        write(chunk: Buffer, _encoding: string, callback: (err?: Error | null) => void) {
           if (sock.writable) {
             sock.write(chunk, callback);
           } else {
@@ -252,11 +256,7 @@ function connectToSocket(
  * Read newline-delimited JSON messages from a socket, collecting them
  * until the expected count is reached or a timeout fires.
  */
-function readMessages(
-  sock: Socket,
-  expectedCount: number,
-  timeoutMs = 3000,
-): Promise<unknown[]> {
+function readMessages(sock: Socket, expectedCount: number, timeoutMs = 3000): Promise<unknown[]> {
   return new Promise((resolve, reject) => {
     const messages: unknown[] = [];
     let buffer = "";
@@ -329,9 +329,7 @@ afterEach(async () => {
   if (tmpDir) {
     try {
       rmSync(tmpDir, { recursive: true, force: true });
-    } catch {
-      /* ok */
-    }
+    } catch { /* ok */ }
   }
 });
 
@@ -369,7 +367,7 @@ describe("managed CES integration (real Unix socket)", () => {
 
     // -- Start health server ---------------------------------------------------
     // NOTE: This uses a local Bun.serve mock rather than the production
-    // `startHealthServer()` from main.ts. The production function is
+    // `startHealthServer()` from managed-main.ts. The production function is
     // not exported and depends on module-level mutable state (the
     // `rpcConnected` flag) that cannot be controlled from tests.
     //
@@ -379,7 +377,7 @@ describe("managed CES integration (real Unix socket)", () => {
     //   - End-to-end socket + RPC + health plumbing in one integration flow.
     //
     // What this does NOT cover:
-    //   - The actual `startHealthServer()` implementation in main.ts,
+    //   - The actual `startHealthServer()` implementation in managed-main.ts,
     //     including the `rpcConnected` field in the /readyz response. If the
     //     production health handler drifts (changes routes, status codes, or
     //     response shape), this test will not catch it. To close that gap,
@@ -390,9 +388,10 @@ describe("managed CES integration (real Unix socket)", () => {
       fetch(req) {
         const url = new URL(req.url);
         if (url.pathname === "/healthz") {
-          return new Response(JSON.stringify({ status: "ok" }), {
-            headers: { "Content-Type": "application/json" },
-          });
+          return new Response(
+            JSON.stringify({ status: "ok" }),
+            { headers: { "Content-Type": "application/json" } },
+          );
         }
         if (url.pathname === "/readyz") {
           return new Response(
@@ -405,10 +404,7 @@ describe("managed CES integration (real Unix socket)", () => {
     });
 
     // -- Start accept-one-connection on the Unix socket ------------------------
-    const connectionPromise = acceptOneConnection(
-      socketPath,
-      controller.signal,
-    );
+    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
 
     // -- Client connects -------------------------------------------------------
     clientSocket = await connectToSocket(socketPath);
@@ -417,7 +413,7 @@ describe("managed CES integration (real Unix socket)", () => {
     const conn = await connectionPromise;
 
     let observedSessionId = "";
-    const handlers = buildCredentialHandlers(dataDir);
+    const handlers = buildMinimalHandlers(dataDir);
 
     serverRpcServer = new CesRpcServer({
       input: conn.readable,
@@ -458,13 +454,13 @@ describe("managed CES integration (real Unix socket)", () => {
     expect(observedSessionId).toBe(handshakeSessionId);
     expect(serverRpcServer.currentSessionId).toBe(handshakeSessionId);
 
-    // -- Step 2: RPC dispatch (list_credentials) -------------------------------
+    // -- Step 2: RPC dispatch (list_grants) ------------------------------------
     const rpcId = "rpc-1";
     sendMessage(clientSocket, {
       type: "rpc",
       id: rpcId,
       kind: "request",
-      method: CesRpcMethod.ListCredentials,
+      method: CesRpcMethod.ListGrants,
       payload: {},
       timestamp: new Date().toISOString(),
     });
@@ -476,33 +472,34 @@ describe("managed CES integration (real Unix socket)", () => {
     expect(rpcResp.type).toBe("rpc");
     expect(rpcResp.id).toBe(rpcId);
     expect(rpcResp.kind).toBe("response");
-    expect(rpcResp.method).toBe(CesRpcMethod.ListCredentials);
+    expect(rpcResp.method).toBe(CesRpcMethod.ListGrants);
 
-    const listPayload = rpcResp.payload as { accounts: string[] };
-    expect(listPayload.accounts).toEqual([]);
+    const grantsPayload = rpcResp.payload as ListGrantsResponse;
+    expect(grantsPayload.grants).toEqual([]);
 
-    // -- Step 3: RPC dispatch (get_credential, not found) ----------------------
-    const getRpcId = "rpc-2";
+    // -- Step 3: RPC dispatch (list_audit_records) -----------------------------
+    const auditRpcId = "rpc-2";
     sendMessage(clientSocket, {
       type: "rpc",
-      id: getRpcId,
+      id: auditRpcId,
       kind: "request",
-      method: CesRpcMethod.GetCredential,
-      payload: { account: "does-not-exist" },
+      method: CesRpcMethod.ListAuditRecords,
+      payload: {},
       timestamp: new Date().toISOString(),
     });
 
-    const getMessages = await readMessages(clientSocket, 1);
-    expect(getMessages.length).toBe(1);
+    const auditMessages = await readMessages(clientSocket, 1);
+    expect(auditMessages.length).toBe(1);
 
-    const getResp = getMessages[0] as RpcEnvelope & { type: "rpc" };
-    expect(getResp.type).toBe("rpc");
-    expect(getResp.id).toBe(getRpcId);
-    expect(getResp.kind).toBe("response");
-    expect(getResp.method).toBe(CesRpcMethod.GetCredential);
+    const auditResp = auditMessages[0] as RpcEnvelope & { type: "rpc" };
+    expect(auditResp.type).toBe("rpc");
+    expect(auditResp.id).toBe(auditRpcId);
+    expect(auditResp.kind).toBe("response");
+    expect(auditResp.method).toBe(CesRpcMethod.ListAuditRecords);
 
-    const getPayload = getResp.payload as { found: boolean };
-    expect(getPayload.found).toBe(false);
+    const auditPayload = auditResp.payload as { records: unknown[]; nextCursor: string | null };
+    expect(auditPayload.records).toEqual([]);
+    expect(auditPayload.nextCursor).toBeNull();
 
     // -- Step 4: Health endpoint -----------------------------------------------
     const healthzResp = await fetch(`http://localhost:${healthPort}/healthz`);
@@ -532,10 +529,7 @@ describe("managed CES integration (real Unix socket)", () => {
     const unknownResp = unknownMessages[0] as RpcEnvelope & { type: "rpc" };
     expect(unknownResp.id).toBe(unknownRpcId);
     expect(unknownResp.kind).toBe("response");
-    const unknownPayload = unknownResp.payload as {
-      success: boolean;
-      error: { code: string };
-    };
+    const unknownPayload = unknownResp.payload as { success: boolean; error: { code: string } };
     expect(unknownPayload.error.code).toBe("METHOD_NOT_FOUND");
 
     // -- Cleanup ---------------------------------------------------------------
@@ -558,10 +552,7 @@ describe("managed CES integration (real Unix socket)", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(
-      socketPath,
-      controller.signal,
-    );
+    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
     clientSocket = await connectToSocket(socketPath);
     const conn = await connectionPromise;
 
@@ -610,14 +601,11 @@ describe("managed CES integration (real Unix socket)", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(
-      socketPath,
-      controller.signal,
-    );
+    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
     clientSocket = await connectToSocket(socketPath);
     const conn = await connectionPromise;
 
-    const handlers = buildCredentialHandlers(dataDir);
+    const handlers = buildMinimalHandlers(dataDir);
     serverRpcServer = new CesRpcServer({
       input: conn.readable,
       output: conn.writable,
@@ -633,7 +621,7 @@ describe("managed CES integration (real Unix socket)", () => {
       type: "rpc",
       id: "pre-hs-1",
       kind: "request",
-      method: CesRpcMethod.ListCredentials,
+      method: CesRpcMethod.ListGrants,
       payload: {},
       timestamp: new Date().toISOString(),
     });
@@ -644,10 +632,7 @@ describe("managed CES integration (real Unix socket)", () => {
     const resp = messages[0] as RpcEnvelope & { type: "rpc" };
     expect(resp.id).toBe("pre-hs-1");
     expect(resp.kind).toBe("response");
-    const payload = resp.payload as {
-      success: boolean;
-      error: { code: string };
-    };
+    const payload = resp.payload as { success: boolean; error: { code: string } };
     expect(payload.error.code).toBe("HANDSHAKE_REQUIRED");
 
     clientSocket.end();
@@ -664,10 +649,7 @@ describe("managed CES integration (real Unix socket)", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(
-      socketPath,
-      controller.signal,
-    );
+    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
 
     // First connection succeeds
     clientSocket = await connectToSocket(socketPath);
@@ -718,10 +700,7 @@ describe("credential CRUD RPC", () => {
 
     controller = new AbortController();
 
-    const connectionPromise = acceptOneConnection(
-      socketPath,
-      controller.signal,
-    );
+    const connectionPromise = acceptOneConnection(socketPath, controller.signal);
     clientSocket = await connectToSocket(socketPath);
     const conn = await connectionPromise;