create-workframe 0.1.0

package/workframe-api/tests/test_room_tenancy.py

@@ -0,0 +1,701 @@
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+import server
+from db_setup import ensure_workframe_schemas
+
+
+class RoomTenancyTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        self._old_data_dir = server.DATA_DIR
+        self._old_auth_db_path = server.AUTH_DB_PATH
+        server.DATA_DIR = Path(self._tmp.name)
+        server.AUTH_DB_PATH = Path(self._tmp.name) / "auth.db"
+        ensure_workframe_schemas()
+        self.workspace_id = "workspace-a"
+        self.user_a = "user-a"
+        self.user_b = "user-b"
+        self.agent_profile_id = "agent-a"
+        self.agent_slug = "agent-a"
+        self.room_a = "room-a"
+        self.room_b = "room-b"
+        conn = server._workframe_db()
+        try:
+            now = "1"
+            for uid, name in ((self.user_a, "User A"), (self.user_b, "User B")):
+                conn.execute(
+                    "INSERT INTO users (id, display_name, role, status, created_at, updated_at) VALUES (?,?,?,?,?,?)",
+                    (uid, name, "member", "active", now, now),
+                )
+            conn.execute(
+                "INSERT INTO workspaces (id, slug, display_name, owner_id, status, created_at, updated_at) VALUES (?,?,?,?,?,?,?)",
+                (self.workspace_id, "workspace-a", "Workspace A", self.user_a, "active", now, now),
+            )
+            conn.execute(
+                """
+                INSERT INTO agent_profiles (id, workspace_id, slug, display_name, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+                """,
+                (self.agent_profile_id, self.workspace_id, self.agent_slug, "Agent A", "available", now, now),
+            )
+            for room_id, user_id in ((self.room_a, self.user_a), (self.room_b, self.user_b)):
+                conn.execute(
+                    """
+                    INSERT INTO rooms (
+                        id, workspace_id, agent_profile_id, name, slug, room_type, status, created_at, updated_at
+                    ) VALUES (?, ?, ?, ?, ?, 'direct', 'active', ?, ?)
+                    """,
+                    (room_id, self.workspace_id, self.agent_profile_id, f"DM {user_id}", f"dm-{user_id}", now, now),
+                )
+                conn.execute(
+                    """
+                    INSERT INTO room_memberships (id, room_id, user_id, role, status, joined_at, updated_at)
+                    VALUES (?, ?, ?, 'member', 'active', ?, ?)
+                    """,
+                    (f"rm-{room_id}", room_id, user_id, now, now),
+                )
+            conn.commit()
+        finally:
+            conn.close()
+
+    def tearDown(self) -> None:
+        server.DATA_DIR = self._old_data_dir
+        server.AUTH_DB_PATH = self._old_auth_db_path
+
+    def test_channel_room_clears_agent_on_migration(self) -> None:
+        conn = server._workframe_db()
+        try:
+            conn.execute(
+                """
+                INSERT INTO rooms (
+                    id, workspace_id, agent_profile_id, name, slug, room_type, status, created_at, updated_at
+                ) VALUES ('general', ?, ?, 'General', 'general', 'channel', 'active', '1', '1')
+                """,
+                (self.workspace_id, self.agent_profile_id),
+            )
+            conn.execute("DELETE FROM schema_migrations WHERE version = '6'")
+            conn.commit()
+        finally:
+            conn.close()
+        server._ensure_workframe_db_schema()
+        conn = server._workframe_db()
+        try:
+            row = conn.execute("SELECT agent_profile_id FROM rooms WHERE id = 'general'").fetchone()
+        finally:
+            conn.close()
+        self.assertIsNone(row["agent_profile_id"])
+
+    @patch.object(server, "_runtime_profile_on_disk", return_value=True)
+    @patch.object(server, "_overlay_turn_user_env")
+    @patch.object(server, "_overlay_turn_provider_env")
+    @patch.object(server, "ensure_runtime_profile")
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "ensure_profile_api", return_value={"api_port": 1})
+    @patch.object(server, "_create_profile_session_via_api")
+    @patch.object(server, "_session_exists", return_value=False)
+    def test_distinct_rooms_get_distinct_sessions(
+        self,
+        _session_exists,
+        create_session,
+        _ensure_api,
+        _resolve,
+        _ensure_runtime,
+        _overlay_llm,
+        _overlay_user,
+        _on_disk,
+    ) -> None:
+        sessions: dict[str, str] = {}
+
+        def _create(prof: str, sid: str, title: str):
+            sessions[sid] = prof
+            return 200, {}, title
+
+        create_session.side_effect = _create
+
+        first = server.profile_chat_session(
+            self.agent_slug,
+            {"room_id": self.room_a, "source_id": "ui", "client_id": "c1"},
+            self.user_a,
+        )
+        second = server.profile_chat_session(
+            self.agent_slug,
+            {"room_id": self.room_b, "source_id": "ui", "client_id": "c1"},
+            self.user_b,
+        )
+        self.assertNotEqual(first["session_id"], second["session_id"])
+        self.assertEqual(first["profile"], "u-user-a-agent-a")
+        self.assertEqual(second["profile"], "u-user-b-agent-a")
+        self.assertEqual(sessions[first["session_id"]], "u-user-a-agent-a")
+        self.assertEqual(sessions[second["session_id"]], "u-user-b-agent-a")
+
+        conn = server._workframe_db()
+        try:
+            row_a = server._get_active_room_session(conn, self.room_a, self.agent_profile_id)
+            row_b = server._get_active_room_session(conn, self.room_b, self.agent_profile_id)
+        finally:
+            conn.close()
+        self.assertEqual(row_a["session_id"], first["session_id"])
+        self.assertEqual(row_b["session_id"], second["session_id"])
+
+    @patch.object(server, "_runtime_profile_on_disk", return_value=True)
+    @patch.object(server, "_overlay_turn_user_env")
+    @patch.object(server, "_overlay_turn_provider_env")
+    @patch.object(server, "ensure_runtime_profile")
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "ensure_profile_api", return_value={"api_port": 1})
+    @patch.object(server, "_create_profile_session_via_api")
+    def test_reuses_latest_valid_room_session(
+        self,
+        create_session,
+        _ensure_api,
+        _resolve,
+        _ensure_runtime,
+        _overlay_llm,
+        _overlay_user,
+        _on_disk,
+    ) -> None:
+        runtime_prof = "u-user-a-agent-a"
+        create_session.return_value = (200, {}, "should-not-create")
+        conn = server._workframe_db()
+        try:
+            now = "99"
+            conn.execute(
+                """
+                INSERT INTO room_sessions (
+                    id, room_id, agent_profile_id, session_id, gateway_session_id,
+                    title, status, created_by, created_at, updated_at
+                ) VALUES (?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)
+                """,
+                (
+                    "rs-old",
+                    self.room_a,
+                    self.agent_profile_id,
+                    "wf_room_old_session",
+                    f"api:{runtime_prof}:wf_room_old_session",
+                    "Old",
+                    self.user_a,
+                    now,
+                    now,
+                ),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+        with patch.object(server, "_session_exists", side_effect=lambda _p, sid: sid == "wf_room_old_session"):
+            result = server.profile_chat_session(
+                self.agent_slug,
+                {"room_id": self.room_a, "source_id": "ui", "client_id": "c1"},
+                self.user_a,
+            )
+
+        self.assertEqual(result["session_id"], "wf_room_old_session")
+        self.assertEqual(result["profile"], runtime_prof)
+        self.assertFalse(result.get("created"))
+        create_session.assert_not_called()
+        conn = server._workframe_db()
+        try:
+            row = server._get_active_room_session(conn, self.room_a, self.agent_profile_id)
+        finally:
+            conn.close()
+        self.assertEqual(row["session_id"], "wf_room_old_session")
+        self.assertEqual(row["status"], "active")
+
+    def test_runtime_profile_slug_format(self) -> None:
+        self.assertEqual(
+            server._runtime_profile_slug("user-a", "agent-a"),
+            "u-user-a-agent-a",
+        )
+
+    @patch.object(server, "_list_profiles", return_value=["workframe-agent", "architect"])
+    def test_runtime_template_slug_resolves_template(self, _list_profiles) -> None:
+        self.assertEqual(
+            server._runtime_template_slug("u-cb6a2db4-ac86-4c49-8-workframe-agent"),
+            "workframe-agent",
+        )
+
+    @patch.object(server, "load_agent_registry", return_value={"workframe-agent": {"display_name": "Workframe Agent"}})
+    @patch.object(server, "_list_profiles", return_value=["workframe-agent"])
+    def test_profile_display_name_runtime_uses_registry(self, _list_profiles, _registry) -> None:
+        self.assertEqual(
+            server._profile_display_name("u-cb6a2db4-ac86-4c49-8-workframe-agent"),
+            "Workframe Agent",
+        )
+
+    def test_profile_display_name_runtime_without_registry_titlecases_template(self) -> None:
+        with patch.object(server, "_runtime_template_slug", return_value="workframe-agent"):
+            with patch.object(server, "_agent_db_display_name", return_value=""):
+                with patch.object(server, "_agent_registry_row", return_value={}):
+                    with patch.object(server, "_is_native_profile", return_value=True):
+                        self.assertEqual(
+                            server._profile_display_name("u-user-workframe-agent"),
+                            server._native_display_name(),
+                        )
+
+    @patch.object(server, "ensure_user_agent_cohort", return_value=[])
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "_runtime_profile_on_disk", side_effect=[False, True])
+    @patch.object(server, "ensure_runtime_profile")
+    def test_resolve_chat_hermes_profile_provisions_runtime_lazily(
+        self, ensure_runtime, _on_disk, _resolve, _cohort,
+    ) -> None:
+        prof = server._resolve_chat_hermes_profile(
+            self.agent_slug,
+            self.user_a,
+            self.room_a,
+            self.workspace_id,
+        )
+        self.assertEqual(prof, "u-user-a-agent-a")
+        ensure_runtime.assert_called_once_with(
+            "u-user-a-agent-a",
+            self.agent_slug,
+            self.user_a,
+            self.workspace_id,
+        )
+
+    @patch.object(server, "ensure_user_agent_cohort", return_value=[])
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "_runtime_profile_on_disk", return_value=False)
+    @patch.object(server, "ensure_runtime_profile")
+    def test_resolve_chat_hermes_profile_still_missing_after_provision(
+        self, _ensure_runtime, _on_disk, _resolve, _cohort,
+    ) -> None:
+        with self.assertRaises(ValueError) as ctx:
+            server._resolve_chat_hermes_profile(
+                self.agent_slug,
+                self.user_a,
+                self.room_a,
+                self.workspace_id,
+            )
+        self.assertEqual(str(ctx.exception), "runtime_profile_not_provisioned")
+
+    @patch.object(server, "ensure_user_agent_cohort", return_value=[])
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "_runtime_profile_on_disk", return_value=True)
+    @patch.object(server, "ensure_runtime_profile")
+    def test_resolve_chat_hermes_profile_skips_ensure_when_runtime_on_disk(
+        self, _ensure_runtime, _on_disk, _resolve, _cohort,
+    ) -> None:
+        prof = server._resolve_chat_hermes_profile(
+            self.agent_slug,
+            self.user_a,
+            self.room_a,
+            self.workspace_id,
+        )
+        self.assertEqual(prof, "u-user-a-agent-a")
+        _ensure_runtime.assert_not_called()
+
+    @patch.object(server, "_overlay_turn_user_env")
+    @patch.object(server, "_try_overlay_turn_provider_env", return_value=False)
+    @patch.object(server, "_user_has_llm_provider", return_value=False)
+    @patch.object(server, "ensure_runtime_profile")
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    def test_room_access_denied_for_non_member(self, _resolve, _ensure_runtime, _has_llm, _overlay_llm, _overlay_user) -> None:
+        with patch.object(server, "ensure_profile_api", return_value={"api_port": 1}):
+            with self.assertRaises(ValueError) as ctx:
+                server.profile_chat_session(
+                    self.agent_slug,
+                    {"room_id": self.room_a, "source_id": "ui", "client_id": "c1"},
+                    self.user_b,
+                )
+        self.assertEqual(str(ctx.exception), "room_access_denied")
+
+    @patch.object(server, "_runtime_profile_on_disk", return_value=True)
+    @patch.object(server, "_overlay_turn_user_env")
+    @patch.object(server, "_user_has_llm_provider", return_value=False)
+    @patch.object(server, "ensure_runtime_profile")
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "ensure_profile_api", return_value={"api_port": 1})
+    @patch.object(server, "_create_profile_session_via_api", return_value=(200, {}, "session"))
+    @patch.object(server, "_session_exists", return_value=False)
+    def test_bootstrap_succeeds_without_llm_provider(
+        self,
+        _session_exists,
+        create_session,
+        _ensure_api,
+        _resolve,
+        _ensure_runtime,
+        _has_llm,
+        _overlay_user,
+        _on_disk,
+    ) -> None:
+        result = server.profile_chat_session(
+            self.agent_slug,
+            {"room_id": self.room_a, "source_id": "ui", "client_id": "c1"},
+            self.user_a,
+        )
+        self.assertTrue(result.get("session_id"))
+        self.assertFalse(result.get("llm_ready"))
+
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "_runtime_profile_on_disk", return_value=True)
+    @patch.object(server, "chat_messages", return_value={"messages": [], "session": {}})
+    @patch.object(server, "ensure_profile_api", return_value={"api_port": 1})
+    @patch.object(server, "_create_profile_session_via_api", return_value=(200, {}, "session"))
+    @patch.object(server, "_session_exists", return_value=False)
+    def test_room_chat_bind_ignores_url_profile(
+        self,
+        _session_exists,
+        _create_session,
+        _ensure_api,
+        _chat_messages,
+        _on_disk,
+        _resolve,
+    ) -> None:
+        result = server.room_chat_bind(
+            self.room_a,
+            {"source_id": "ui", "client_id": "c1"},
+            self.user_a,
+        )
+        self.assertEqual(result["template_profile"], self.agent_slug)
+        self.assertEqual(result["profile"], "u-user-a-agent-a")
+
+    def test_parse_room_mentions_resolves_agent_slug(self) -> None:
+        agents = [{"id": "a1", "slug": "architect", "display_name": "Architect"}]
+        users = [{"id": "u1", "handle": "alan", "display_name": "Alan"}]
+        parsed = server._parse_room_mentions("@architect please review", agents, users)
+        self.assertEqual([a["slug"] for a in parsed["agents"]], ["architect"])
+        self.assertEqual(parsed["users"], [])
+
+    def test_parse_room_mentions_ignores_plain_text(self) -> None:
+        agents = [{"id": "a1", "slug": "architect", "display_name": "Architect"}]
+        parsed = server._parse_room_mentions("hello team", agents, [])
+        self.assertEqual(parsed["agents"], [])
+
+    def test_sanitize_space_room_clears_agent_binding(self) -> None:
+        room = {
+            "room_type": "channel",
+            "agent_profile_id": "agent-a",
+            "hermes_profile": "architect",
+        }
+        server._sanitize_space_room_agent_fields(room)
+        self.assertIsNone(room["agent_profile_id"])
+        self.assertIsNone(room["hermes_profile"])
+
+    @patch.object(server, "_bootstrap_profile_providers", return_value=False)
+    @patch.object(server, "_read_model_block", return_value={
+        "default": "openrouter/owl-alpha",
+        "provider": "openrouter",
+        "base_url": "",
+        "fallback_chain": [],
+    })
+    @patch.object(server, "_user_llm_providers_for_picker", return_value={"openrouter"})
+    @patch.object(server, "profile_exists", return_value=True)
+    def test_hermes_models_accepts_runtime_profile_slug(
+        self,
+        _exists,
+        _picker,
+        _block,
+        _bootstrap,
+    ) -> None:
+        result = server.hermes_models("u-user-a-agent-a", self.user_a, self.workspace_id)
+        self.assertTrue(result["has_llm_provider"])
+        self.assertEqual(result["primary"], "openrouter/owl-alpha")
+
+    def test_room_messages_query_returns_latest_window(self) -> None:
+        conn = server._workframe_db()
+        space_id = "space-general"
+        try:
+            conn.execute(
+                """
+                INSERT INTO rooms (
+                    id, workspace_id, name, slug, room_type, status, created_at, updated_at
+                ) VALUES (?, ?, 'General', 'general', 'channel', 'active', '1', '1')
+                """,
+                (space_id, self.workspace_id),
+            )
+            conn.execute(
+                """
+                INSERT INTO room_memberships (id, room_id, user_id, role, status, joined_at, updated_at)
+                VALUES ('rm-space', ?, ?, 'member', 'active', '1', '1')
+                """,
+                (space_id, self.user_a),
+            )
+            for i in range(55):
+                ts = str(1000 + i)
+                conn.execute(
+                    """
+                    INSERT INTO messages (
+                        id, room_id, sender_user_id, content, content_type, is_edited, created_at, updated_at
+                    ) VALUES (?, ?, ?, ?, 'text', 0, ?, ?)
+                    """,
+                    (f"m{i}", space_id, self.user_a, f"msg-{i}", ts, ts),
+                )
+            conn.commit()
+            limit = 50
+            rows = conn.execute(
+                """
+                SELECT id FROM (
+                    SELECT id, created_at FROM messages
+                    WHERE room_id = ? AND deleted_at IS NULL
+                    ORDER BY created_at DESC
+                    LIMIT ? OFFSET 0
+                ) AS recent
+                ORDER BY created_at ASC
+                """,
+                (space_id, limit),
+            ).fetchall()
+            self.assertEqual(len(rows), 50)
+            self.assertEqual(rows[0]["id"], "m5")
+            self.assertEqual(rows[-1]["id"], "m54")
+        finally:
+            conn.close()
+
+    @patch.object(server, "_overlay_turn_user_env")
+    @patch.object(server, "_try_overlay_turn_provider_env", return_value=False)
+    @patch.object(server, "_user_has_llm_provider", return_value=True)
+    @patch.object(server, "ensure_runtime_profile")
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "ensure_profile_api", return_value={"api_port": 1})
+    @patch.object(server, "_create_profile_session_via_api", return_value=(200, {}, "title"))
+    @patch.object(server, "_session_exists", return_value=False)
+    def test_space_profile_chat_session_allows_channel_room(
+        self,
+        _session_exists,
+        create_session,
+        _ensure_api,
+        _resolve,
+        _ensure_runtime,
+        _has_llm,
+        _overlay_llm,
+        _overlay_user,
+    ) -> None:
+        conn = server._workframe_db()
+        space_id = "space-general"
+        try:
+            conn.execute(
+                """
+                INSERT INTO rooms (
+                    id, workspace_id, name, slug, room_type, status, created_at, updated_at
+                ) VALUES (?, ?, 'General', 'general', 'channel', 'active', '1', '1')
+                """,
+                (space_id, self.workspace_id),
+            )
+            conn.execute(
+                """
+                INSERT INTO room_memberships (id, room_id, user_id, role, status, joined_at, updated_at)
+                VALUES ('rm-space', ?, ?, 'member', 'active', '1', '1')
+                """,
+                (space_id, self.user_a),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        create_session.return_value = (200, {}, "space session")
+        result = server.profile_chat_session(
+            self.agent_slug,
+            {"room_id": space_id, "source_id": "room", "client_id": space_id},
+            self.user_a,
+        )
+        self.assertTrue(result.get("session_id"))
+        self.assertEqual(result.get("profile"), self.agent_slug)
+        _ensure_runtime.assert_not_called()
+
+    @patch.object(server, "_runtime_profile_on_disk", return_value=True)
+    @patch.object(server, "_runtime_template_slug", return_value="agent-a")
+    @patch.object(server, "ensure_runtime_profile")
+    @patch.object(server, "resolve_validated_profile", side_effect=lambda slug: slug)
+    @patch.object(server, "ensure_profile_api", return_value={"api_port": 1})
+    @patch.object(server, "_create_profile_session_via_api", return_value=(200, {}, "title"))
+    @patch.object(server, "_session_exists", return_value=False)
+    def test_space_profile_chat_session_accepts_runtime_slug(
+        self,
+        _session_exists,
+        create_session,
+        _ensure_api,
+        _resolve,
+        _ensure_runtime,
+        _runtime_template,
+        _runtime_on_disk,
+    ) -> None:
+        conn = server._workframe_db()
+        space_id = "space-runtime"
+        runtime = "u-user-a-agent-a"
+        try:
+            conn.execute(
+                """
+                INSERT INTO rooms (
+                    id, workspace_id, name, slug, room_type, status, created_at, updated_at
+                ) VALUES (?, ?, 'General', 'general', 'channel', 'active', '1', '1')
+                """,
+                (space_id, self.workspace_id),
+            )
+            conn.execute(
+                """
+                INSERT INTO room_memberships (id, room_id, user_id, role, status, joined_at, updated_at)
+                VALUES ('rm-space-rt', ?, ?, 'member', 'active', '1', '1')
+                """,
+                (space_id, self.user_a),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        create_session.return_value = (200, {}, "space session")
+        result = server.profile_chat_session(
+            runtime,
+            {"room_id": space_id, "source_id": "room", "client_id": space_id},
+            self.user_a,
+        )
+        self.assertTrue(result.get("session_id"))
+        self.assertEqual(result.get("profile"), runtime)
+        self.assertEqual(result.get("template_profile"), self.agent_slug)
+
+    def test_profile_turn_payload_includes_space_transcript(self) -> None:
+        conn = server._workframe_db()
+        space_id = "space-prompt"
+        try:
+            conn.execute(
+                """
+                INSERT INTO rooms (
+                    id, workspace_id, name, slug, room_type, status, created_at, updated_at
+                ) VALUES (?, ?, 'General', 'general', 'channel', 'active', '1', '1')
+                """,
+                (space_id, self.workspace_id),
+            )
+            conn.execute(
+                """
+                INSERT INTO messages (
+                    id, room_id, sender_user_id, content, content_type, is_edited, created_at, updated_at
+                ) VALUES ('m1', ?, ?, '@agent-a hello', 'text', 0, '1', '1')
+                """,
+                (space_id, self.user_a),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        payload = server._profile_turn_payload(self.agent_slug, "@agent-a hello", space_id)
+        self.assertIn("group chat", payload["message"])
+        self.assertIn("@agent-a hello", payload["message"])
+
+    @patch.object(server.threading, "Thread")
+    def test_process_space_mentions_can_skip_server_invoke(self, thread_cls) -> None:
+        conn = server._workframe_db()
+        space_id = "space-mentions"
+        try:
+            conn.execute(
+                """
+                INSERT INTO rooms (
+                    id, workspace_id, name, slug, room_type, status, created_at, updated_at
+                ) VALUES (?, ?, 'General', 'general', 'channel', 'active', '1', '1')
+                """,
+                (space_id, self.workspace_id),
+            )
+            conn.execute(
+                """
+                INSERT INTO room_memberships (id, room_id, agent_profile_id, role, status, joined_at, updated_at)
+                VALUES ('rm-agent', ?, ?, 'agent', 'active', '1', '1')
+                """,
+                (space_id, self.agent_profile_id),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        result = server._process_space_message_mentions(
+            space_id,
+            self.workspace_id,
+            self.user_a,
+            "@agent-a ping",
+            "parent-1",
+            invoke_agents=False,
+        )
+        self.assertEqual(result["agent_mentions"], [self.agent_slug])
+        thread_cls.assert_not_called()
+
+    def test_resolve_latest_room_session_prefers_active(self) -> None:
+        conn = server._workframe_db()
+        profile = "u-user-a-agent-a"
+        sid_archived = "sess-archived"
+        sid_active = "sess-active"
+        try:
+            conn.execute(
+                """
+                INSERT INTO room_sessions (
+                    id, room_id, agent_profile_id, session_id, gateway_session_id,
+                    title, status, created_by, created_at, updated_at
+                ) VALUES (?, ?, ?, ?, ?, '', ?, ?, ?, ?)
+                """,
+                (
+                    "rs-archived",
+                    self.room_a,
+                    self.agent_profile_id,
+                    sid_archived,
+                    f"api:{profile}:{sid_archived}",
+                    "archived",
+                    self.user_a,
+                    "100",
+                    "300",
+                ),
+            )
+            conn.execute(
+                """
+                INSERT INTO room_sessions (
+                    id, room_id, agent_profile_id, session_id, gateway_session_id,
+                    title, status, created_by, created_at, updated_at
+                ) VALUES (?, ?, ?, ?, ?, '', ?, ?, ?, ?)
+                """,
+                (
+                    "rs-active",
+                    self.room_a,
+                    self.agent_profile_id,
+                    sid_active,
+                    f"api:{profile}:{sid_active}",
+                    "active",
+                    self.user_a,
+                    "200",
+                    "200",
+                ),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+        with patch.object(server, "_session_exists", return_value=True):
+            conn = server._workframe_db()
+            try:
+                row = server._resolve_latest_room_session(
+                    conn, profile, self.room_a, self.agent_profile_id,
+                )
+                self.assertIsNotNone(row)
+                self.assertEqual(str(row["session_id"]), sid_active)
+            finally:
+                conn.close()
+
+    def test_room_member_manage_requires_admin_or_workspace_owner(self) -> None:
+        conn = server._workframe_db()
+        try:
+            self.assertTrue(server._user_can_access_room(conn, self.room_a, self.user_a))
+            self.assertFalse(server._user_can_manage_room_members(conn, self.room_a, self.user_b))
+            self.assertFalse(server._user_can_manage_room_members(conn, self.room_a, self.user_a))
+            conn.execute(
+                "UPDATE room_memberships SET role = 'admin' WHERE room_id = ? AND user_id = ?",
+                (self.room_a, self.user_a),
+            )
+            conn.commit()
+            self.assertTrue(server._user_can_manage_room_members(conn, self.room_a, self.user_a))
+        finally:
+            conn.close()
+
+    def test_workspace_owner_can_manage_room_members_without_room_admin(self) -> None:
+        conn = server._workframe_db()
+        try:
+            now = "1"
+            conn.execute(
+                """
+                INSERT INTO workspace_memberships (
+                    id, workspace_id, user_id, role, status, created_at, updated_at
+                ) VALUES (?, ?, ?, 'owner', 'active', ?, ?)
+                """,
+                ("wm-owner", self.workspace_id, self.user_a, now, now),
+            )
+            conn.commit()
+            self.assertTrue(server._user_can_manage_room_members(conn, self.room_a, self.user_a))
+        finally:
+            conn.close()
+
+
+if __name__ == "__main__":
+    unittest.main()