borgmcp-shared 0.6.2 → 0.6.4

package/src/conformance/adapter.ts

@@ -2,6 +2,7 @@ import {
   ErrorCode,
   compareLogCursor,
   createProtocolEnvelope,
+  decodeAssociateRepositoryCubeResponseEnvelope,
   decodeCreateCubeResponseEnvelope,
   decodeAppendLogResultEnvelope,
   decodeDecisionResultEnvelope,
@@ -14,6 +15,7 @@ import {
   decodeProtocolErrorEnvelope,
   decodeProtocolTagPreflight,
   decodeReadLogResultEnvelope,
+  decodeResolveRepositoryCubeResponseEnvelope,
   decodeReassignDroneResultEnvelope,
   decodeUpdateDroneRuntimeMetadataResponseEnvelope,
   decodeSseFrames,
@@ -22,11 +24,18 @@ import {
   PROTOCOL_VERSION,
   utf8ByteLength,
   type CreateCubeResponse,
+  type CreateCubeRepository,
+  type CubeTemplate,
+  type ResolvedRepositoryCube,
   type LogCursor,
   type StreamEvent,
   type DroneRuntimeMetadata,
 } from '../protocol/index.js';
-import { ENROLLMENT_RETRY_CONFORMANCE } from './index.js';
+import {
+  CREATE_CUBE_ASSOCIATION_CONFORMANCE,
+  CREATE_CUBE_RETRY_CONFORMANCE,
+  ENROLLMENT_RETRY_CONFORMANCE,
+} from './index.js';
 
 export interface ConformanceHttpResponse {
   status: number;
@@ -102,17 +111,34 @@ export interface ConformanceAuthorityState {
   grants: number;
   server_capabilities: number;
   cube_create_bindings: number;
+  repository_associations: number;
 }
 
 export interface ConformanceCreatedCubeState {
   cube_exists: boolean;
   creator_has_grant: boolean;
+  creator_access: 'manage' | null;
   grant_count: number;
   role_count: number;
+  name: string;
+  working_repo_name: string;
+  repository: CreateCubeRepository;
+  template: CubeTemplate;
+  human_seat_role_id: string;
+  default_worker_role_id: string;
   human_seat_role_matches: boolean;
   default_worker_role_matches: boolean;
 }
 
+export interface ConformanceRepositoryCubeFixture {
+  cube_id: string;
+  name: string;
+  template: CubeTemplate;
+  human_seat_role_id: string;
+  default_worker_role_id: string;
+  access: 'manage';
+}
+
 export interface ConformanceEnrollmentPrincipalState {
   response_client_matches: boolean;
   active_credential_bindings: number;
@@ -150,6 +176,7 @@ export interface ConformanceAdmin {
     cube: ConformanceCube,
     access?: ConformanceCubeAccess,
   ): Promise<void>;
+  revokeCubeGrant(principal: ConformancePrincipal, cube: ConformanceCube): Promise<void>;
   createRole(cube: ConformanceCube, input: {
     readonly roleClass: 'queen' | 'worker';
     readonly isHumanSeat: boolean;
@@ -178,6 +205,13 @@ export interface ConformanceAdmin {
     creator: ConformancePrincipal,
     response: CreateCubeResponse,
   ): Promise<ConformanceCreatedCubeState>;
+  prepareRepositoryCube(
+    cube: ConformanceCube,
+    input: {
+      name: string;
+      template: CubeTemplate;
+    },
+  ): Promise<ConformanceRepositoryCubeFixture>;
   inspectEnrollmentPrincipal(
     principal: ConformancePrincipal,
     responseClientId: string,
@@ -193,6 +227,8 @@ export interface ConformanceOperations {
   protocol(credential: string | null): Promise<ConformanceHttpResponse>;
   enroll(request: unknown): Promise<ConformanceHttpResponse>;
   createCube(credential: string | null, request: unknown): Promise<ConformanceHttpResponse>;
+  resolveRepositoryCube(credential: string | null, request: unknown): Promise<ConformanceHttpResponse>;
+  associateRepositoryCube(credential: string | null, request: unknown): Promise<ConformanceHttpResponse>;
   attach(credential: string, request: unknown): Promise<ConformanceHttpResponse>;
   selfMetadataUpdate(
     credential: string,
@@ -277,6 +313,7 @@ export const ADAPTER_CONFORMANCE_FIXTURES = [
   { id: 'http.unauthenticated-liveness', area: 'http' },
   { id: 'protocol.credential-free-preflight', area: 'protocol' },
   { id: 'enrollment.retry-authority', area: 'enrollment' },
+  { id: 'repository.explicit-association', area: 'repository' },
   { id: 'security.adapter-boundary-injection', area: 'security' },
   { id: 'security.oversize-request', area: 'security' },
   { id: 'security.cross-cube-isolation', area: 'security' },
@@ -686,7 +723,12 @@ export async function runAdapterConformance(
 
     const cubeRequest = {
       retry_key: '00000000-0000-4000-8000-000000000213',
-      name: 'repository-one',
+      name: 'Repository One',
+      working_repo_name: 'repository-one',
+      repository: {
+        kind: 'origin' as const,
+        value: 'https://github.com/Byte-Ventures/repository-one',
+      },
       template: 'default',
     };
     const droneCredential = await environment.admin.issueDroneSession(ownerPrincipal);
@@ -724,13 +766,25 @@ export async function runAdapterConformance(
     const createdResponse = await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-create', cubeRequest));
     expectStatus(createdResponse, 201, 'Owner cube create');
     const created = decodeCreateCubeResponseEnvelope(createdResponse.body).payload;
-    assertStateDelta(beforeCreate, await environment.admin.observeAuthorityState(), { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1 }, 'Owner cube create');
+    assertStateDelta(
+      beforeCreate,
+      await environment.admin.observeAuthorityState(),
+      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1, repository_associations: 1 },
+      'Owner cube create',
+    );
     invariant(
       same(await environment.admin.inspectCreatedCube(ownerPrincipal, created), {
         cube_exists: true,
         creator_has_grant: true,
+        creator_access: 'manage',
         grant_count: 1,
         role_count: 2,
+        name: cubeRequest.name,
+        working_repo_name: cubeRequest.working_repo_name,
+        repository: cubeRequest.repository,
+        template: cubeRequest.template,
+        human_seat_role_id: created.human_seat_role_id,
+        default_worker_role_id: created.default_worker_role_id,
         human_seat_role_matches: true,
         default_worker_role_matches: true,
       }),
@@ -739,19 +793,92 @@ export async function runAdapterConformance(
     const beforeCreateRetry = await environment.admin.observeAuthorityState();
     const retriedCreateResponse = await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-retry', cubeRequest));
     expectStatus(retriedCreateResponse, 201, 'Exact cube-create retry');
-    invariant(same(decodeCreateCubeResponseEnvelope(retriedCreateResponse.body).payload, created), 'Exact cube-create retry returned different identities.');
+    const retriedCreate = decodeCreateCubeResponseEnvelope(retriedCreateResponse.body).payload;
+    invariant(retriedCreate.result === 'resolved', 'Exact cube-create retry did not report resolved readback.');
+    invariant(
+      same({ ...retriedCreate, result: 'created' }, created),
+      'Exact cube-create retry returned different authoritative fields.',
+    );
     assertStateDelta(beforeCreateRetry, await environment.admin.observeAuthorityState(), {}, 'Exact cube-create retry');
-    const beforeCreateMismatch = await environment.admin.observeAuthorityState();
-    expectSecretFreeError(
-      await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-mismatch', { ...cubeRequest, name: 'repository-two' })),
-      409,
-      ErrorCode.INVALID_INPUT,
-      'Cube-create retry mismatch',
-      [cubeRequest.retry_key],
+    const displayRetryVector = CREATE_CUBE_RETRY_CONFORMANCE.find(
+      (vector) => vector.expected.outcome === 'resolved_response' &&
+        vector.retry.working_repo_name !== vector.initial.working_repo_name,
+    );
+    invariant(displayRetryVector !== undefined, 'Missing repository display readback vector.');
+    const beforeDisplayRetry = await environment.admin.observeAuthorityState();
+    const displayRetryResponse = await environment.operations.createCube(
+      ownerCredential,
+      createProtocolEnvelope('cube-display-retry', {
+        ...displayRetryVector.retry,
+        retry_key: cubeRequest.retry_key,
+      }),
+    );
+    expectStatus(displayRetryResponse, 201, 'Changed repository display retry');
+    invariant(
+      same(decodeCreateCubeResponseEnvelope(displayRetryResponse.body).payload, retriedCreate),
+      'Changed repository display retry did not return stored authoritative display.',
+    );
+    assertStateDelta(
+      beforeDisplayRetry,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Changed repository display retry',
+    );
+    for (const [index, vector] of CREATE_CUBE_RETRY_CONFORMANCE.entries()) {
+      if (vector.expected.outcome !== 'retry_tuple_mismatch') continue;
+      const mismatch = { ...vector.retry, retry_key: cubeRequest.retry_key };
+      const beforeCreateMismatch = await environment.admin.observeAuthorityState();
+      expectSecretFreeError(
+        await environment.operations.createCube(
+          ownerCredential,
+          createProtocolEnvelope(`cube-mismatch-${index}`, mismatch),
+        ),
+        409,
+        ErrorCode.INVALID_INPUT,
+        `Cube-create ${vector.name}`,
+        [cubeRequest.retry_key],
+      );
+      assertStateDelta(
+        beforeCreateMismatch,
+        await environment.admin.observeAuthorityState(),
+        {},
+        `Cube-create ${vector.name}`,
+      );
+    }
+    const sameAssociationVector = CREATE_CUBE_ASSOCIATION_CONFORMANCE.find(
+      (vector) => vector.expected.outcome === 'resolved',
+    );
+    invariant(sameAssociationVector !== undefined, 'Missing same-repository association vector.');
+    const beforeAssociationResolve = await environment.admin.observeAuthorityState();
+    const associationResolveResponse = await environment.operations.createCube(
+      ownerCredential,
+      createProtocolEnvelope('cube-association-resolve', {
+        ...sameAssociationVector.request,
+        repository: cubeRequest.repository,
+      }),
+    );
+    expectStatus(associationResolveResponse, 201, 'Fresh retry for associated repository');
+    const associationResolved = decodeCreateCubeResponseEnvelope(associationResolveResponse.body).payload;
+    invariant(associationResolved.result === 'resolved', 'Associated repository did not resolve.');
+    invariant(
+      same({ ...associationResolved, result: 'created' }, created),
+      'Associated repository did not return stored authoritative fields.',
+    );
+    assertStateDelta(
+      beforeAssociationResolve,
+      await environment.admin.observeAuthorityState(),
+      sameAssociationVector.expected.authority_state_delta,
+      'Fresh retry for associated repository',
     );
-    assertStateDelta(beforeCreateMismatch, await environment.admin.observeAuthorityState(), {}, 'Cube-create retry mismatch');
     await environment.admin.grantCreateCubeCapability(ordinaryPrincipal);
-    const crossClientRequest = { ...cubeRequest, name: 'ordinary-repository' };
+    const crossClientRequest = {
+      ...cubeRequest,
+      working_repo_name: 'ordinary-repository',
+      repository: {
+        kind: 'local' as const,
+        value: '00000000-0000-4000-8000-000000000216',
+      },
+    };
     const beforeCrossClientCreate = await environment.admin.observeAuthorityState();
     const crossClientResponse = await environment.operations.createCube(
       ordinaryCredential,
@@ -763,7 +890,7 @@ export async function runAdapterConformance(
     assertStateDelta(
       beforeCrossClientCreate,
       await environment.admin.observeAuthorityState(),
-      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1 },
+      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1, repository_associations: 1 },
       'Cross-client cube create',
     );
     invariant(
@@ -776,24 +903,35 @@ export async function runAdapterConformance(
       createProtocolEnvelope('cube-cross-client-retry', crossClientRequest),
     );
     expectStatus(crossClientRetry, 201, 'Exact cross-client cube-create retry');
+    const crossClientResolved = decodeCreateCubeResponseEnvelope(crossClientRetry.body).payload;
     invariant(
-      same(decodeCreateCubeResponseEnvelope(crossClientRetry.body).payload, crossClientCreated),
-      'Exact cross-client cube-create retry returned different identities.',
+      crossClientResolved.result === 'resolved',
+      'Exact cross-client cube-create retry did not report resolved readback.',
+    );
+    invariant(
+      same(
+        { ...crossClientResolved, result: 'created' },
+        crossClientCreated,
+      ),
+      'Exact cross-client cube-create retry returned different authoritative fields.',
     );
     assertStateDelta(beforeCrossClientRetry, await environment.admin.observeAuthorityState(), {}, 'Exact cross-client cube-create retry');
+    const differentAssociationVector = CREATE_CUBE_ASSOCIATION_CONFORMANCE.find(
+      (vector) => vector.expected.outcome === 'created',
+    );
+    invariant(differentAssociationVector !== undefined, 'Missing different-repository association vector.');
     const beforeSecondCreate = await environment.admin.observeAuthorityState();
-    const secondCreatedResponse = await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-create-second', {
-      ...cubeRequest,
-      retry_key: '00000000-0000-4000-8000-000000000214',
-      name: 'repository-two',
-    }));
+    const secondCreatedResponse = await environment.operations.createCube(
+      ownerCredential,
+      createProtocolEnvelope('cube-create-second', differentAssociationVector.request),
+    );
     expectStatus(secondCreatedResponse, 201, 'Second cube create');
     const secondCreated = decodeCreateCubeResponseEnvelope(secondCreatedResponse.body).payload;
     invariant(secondCreated.cube_id !== created.cube_id, 'Fresh cube-create retry key reused an existing cube.');
     assertStateDelta(
       beforeSecondCreate,
       await environment.admin.observeAuthorityState(),
-      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1 },
+      differentAssociationVector.expected.authority_state_delta,
       'Second cube create',
     );
     await environment.admin.revokePrincipal(ownerPrincipal);
@@ -866,6 +1004,244 @@ export async function runAdapterConformance(
     };
   });
 
+  await record('repository.explicit-association', async () => {
+    const repository = {
+      kind: 'origin' as const,
+      value: 'https://github.com/Byte-Ventures/legacy-repository',
+    };
+    const prepared = await environment.admin.prepareRepositoryCube(cubeA, {
+      name: 'Legacy Repository Cube',
+      template: 'software-dev',
+    });
+    const resolveRequest = {
+      working_repo_name: 'legacy-repository',
+      repository,
+    };
+    const beforeNone = await environment.admin.observeAuthorityState();
+    const noneResponse = await environment.operations.resolveRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-resolve-none', resolveRequest),
+    );
+    expectStatus(noneResponse, 200, 'Unassociated repository resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(noneResponse.body).payload, { result: 'none' }),
+      'Unassociated repository did not return explicit none.',
+    );
+    assertStateDelta(beforeNone, await environment.admin.observeAuthorityState(), {}, 'Repository resolution');
+
+    const associationRequest = { cube_id: cubeA.id, ...resolveRequest };
+    const beforeDenied = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialB,
+        createProtocolEnvelope('repository-associate-denied', associationRequest),
+      ),
+      403,
+      ErrorCode.ACCESS_DENIED,
+      'Inaccessible repository cube association',
+      [associationRequest.cube_id, repository.value],
+    );
+    assertStateDelta(beforeDenied, await environment.admin.observeAuthorityState(), {}, 'Denied repository association');
+
+    const beforeAssociation = await environment.admin.observeAuthorityState();
+    const associatedResponse = await environment.operations.associateRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-associate', associationRequest),
+    );
+    expectStatus(associatedResponse, 200, 'Explicit repository cube association');
+    const associated = decodeAssociateRepositoryCubeResponseEnvelope(associatedResponse.body).payload;
+    const authoritative = {
+      result: 'resolved' as const,
+      cube_id: prepared.cube_id,
+      name: prepared.name,
+      working_repo_name: resolveRequest.working_repo_name,
+      repository,
+      template: prepared.template,
+      human_seat_role_id: prepared.human_seat_role_id,
+      default_worker_role_id: prepared.default_worker_role_id,
+      access: prepared.access,
+    };
+    invariant(same(associated, authoritative), 'Repository association did not return authoritative stored fields.');
+    assertStateDelta(
+      beforeAssociation,
+      await environment.admin.observeAuthorityState(),
+      { repository_associations: 1 },
+      'Explicit repository association',
+    );
+
+    const beforeResolve = await environment.admin.observeAuthorityState();
+    const resolvedResponse = await environment.operations.resolveRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-resolve', {
+        ...resolveRequest,
+        working_repo_name: 'ignored-new-display',
+      }),
+    );
+    expectStatus(resolvedResponse, 200, 'Associated repository resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(resolvedResponse.body).payload, authoritative),
+      'Associated repository did not return stored authoritative display.',
+    );
+    assertStateDelta(beforeResolve, await environment.admin.observeAuthorityState(), {}, 'Associated repository resolution');
+
+    const beforeRetry = await environment.admin.observeAuthorityState();
+    const retryResponse = await environment.operations.associateRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-associate-retry', associationRequest),
+    );
+    expectStatus(retryResponse, 200, 'Exact repository association retry');
+    invariant(
+      same(decodeAssociateRepositoryCubeResponseEnvelope(retryResponse.body).payload, authoritative),
+      'Exact repository association retry changed authoritative fields.',
+    );
+    assertStateDelta(beforeRetry, await environment.admin.observeAuthorityState(), {}, 'Repository association retry');
+
+    const cubeC = await environment.admin.createCube('cube-c');
+    await environment.admin.grantCube(principalA, cubeC);
+    await environment.admin.prepareRepositoryCube(cubeC, {
+      name: 'Other Legacy Cube',
+      template: 'starter',
+    });
+    const beforeRepositoryConflict = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialA,
+        createProtocolEnvelope('repository-associate-repository-conflict', {
+          ...associationRequest,
+          cube_id: cubeC.id,
+        }),
+      ),
+      409,
+      ErrorCode.REPOSITORY_ALREADY_ASSOCIATED,
+      'Repository-to-other-cube conflict',
+      [cubeA.id, cubeC.id, repository.value],
+    );
+    assertStateDelta(
+      beforeRepositoryConflict,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Repository-to-other-cube conflict',
+    );
+
+    const beforeCubeConflict = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialA,
+        createProtocolEnvelope('repository-associate-cube-conflict', {
+          cube_id: cubeA.id,
+          working_repo_name: 'other-repository',
+          repository: {
+            kind: 'origin',
+            value: 'https://github.com/Byte-Ventures/other-repository',
+          },
+        }),
+      ),
+      409,
+      ErrorCode.CUBE_ALREADY_ASSOCIATED,
+      'Cube-to-other-repository conflict',
+      [cubeA.id, repository.value, 'https://github.com/Byte-Ventures/other-repository'],
+    );
+    assertStateDelta(
+      beforeCubeConflict,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Cube-to-other-repository conflict',
+    );
+
+    const preparedB = await environment.admin.prepareRepositoryCube(cubeB, {
+      name: 'Other Client Legacy Cube',
+      template: 'starter',
+    });
+    const beforeCrossClientResolve = await environment.admin.observeAuthorityState();
+    const crossClientResolve = await environment.operations.resolveRepositoryCube(
+      credentialB,
+      createProtocolEnvelope('repository-resolve-cross-client', resolveRequest),
+    );
+    expectStatus(crossClientResolve, 200, 'Cross-client repository resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(crossClientResolve.body).payload, { result: 'none' }),
+      'Another client repository binding was exposed by resolution.',
+    );
+    assertStateDelta(
+      beforeCrossClientResolve,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Cross-client repository resolution',
+    );
+    const beforeCrossClientAssociation = await environment.admin.observeAuthorityState();
+    const crossClientAssociation = await environment.operations.associateRepositoryCube(
+      credentialB,
+      createProtocolEnvelope('repository-associate-cross-client', {
+        ...associationRequest,
+        cube_id: cubeB.id,
+      }),
+    );
+    expectStatus(crossClientAssociation, 200, 'Cross-client repository association');
+    const crossClientAssociated = decodeAssociateRepositoryCubeResponseEnvelope(
+      crossClientAssociation.body,
+    ).payload;
+    invariant(
+      crossClientAssociated.cube_id === preparedB.cube_id &&
+        crossClientAssociated.repository.value === repository.value,
+      'Another client binding changed cross-client association identity.',
+    );
+    assertStateDelta(
+      beforeCrossClientAssociation,
+      await environment.admin.observeAuthorityState(),
+      { repository_associations: 1 },
+      'Cross-client repository association',
+    );
+
+    await environment.admin.revokeCubeGrant(principalA, cubeA);
+    const beforeHiddenResolve = await environment.admin.observeAuthorityState();
+    const hiddenResolve = await environment.operations.resolveRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-resolve-inaccessible-binding', resolveRequest),
+    );
+    expectStatus(hiddenResolve, 200, 'Inaccessible repository binding resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(hiddenResolve.body).payload, { result: 'none' }),
+      'Inaccessible repository binding was exposed by read-only resolution.',
+    );
+    assertStateDelta(
+      beforeHiddenResolve,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Inaccessible repository binding resolution',
+    );
+    const beforeHiddenAssociation = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialA,
+        createProtocolEnvelope('repository-associate-inaccessible-binding', {
+          ...associationRequest,
+          cube_id: cubeC.id,
+        }),
+      ),
+      403,
+      ErrorCode.ACCESS_DENIED,
+      'Inaccessible existing repository binding',
+      [cubeA.id, cubeC.id, repository.value],
+    );
+    assertStateDelta(
+      beforeHiddenAssociation,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Inaccessible existing repository binding',
+    );
+    await environment.admin.grantCube(principalA, cubeA);
+    return {
+      none: true,
+      resolved: true,
+      idempotent: true,
+      repository_conflict: ErrorCode.REPOSITORY_ALREADY_ASSOCIATED,
+      cube_conflict: ErrorCode.CUBE_ALREADY_ASSOCIATED,
+      inaccessible: ErrorCode.ACCESS_DENIED,
+      inaccessible_binding_hidden: true,
+      cross_client_binding_hidden: true,
+    };
+  });
+
   await record('security.adapter-boundary-injection', async () => {
     const injectedMessage = "'); DROP TABLE log_entries; --\r\ndata: forged-sse-frame";
     const injectedBody = JSON.stringify(