create-workframe 0.1.11 → 0.1.13

package/workframe-api/test_route_registry.py

@@ -0,0 +1,245 @@
+#!/usr/bin/env python3
+"""Route registry audit (WF-037).
+
+Run: python services/workframe-api/test_route_registry.py
+"""
+import re
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent
+sys.path.insert(0, str(ROOT))
+
+import route_registry  # noqa: E402
+
+
+def _handler_source_text() -> str:
+    """server.Handler bodies plus extracted handler_modules mixins (WF-032)."""
+    parts = [(ROOT / "server.py").read_text(encoding="utf-8")]
+    mods = ROOT / "handler_modules"
+    if mods.is_dir():
+        for path in sorted(mods.glob("*.py")):
+            if path.name == "__init__.py":
+                continue
+            parts.append(path.read_text(encoding="utf-8"))
+    return "\n".join(parts)
+
+
+def _sample_path_from_label(label: str, pattern: re.Pattern[str] | None = None) -> str:
+    sample = (
+        label.replace("{id}", "sample-id")
+        .replace("{slug}", "sample-slug")
+        .replace("{token}", "sample-token")
+        .replace("{provider}", "github")
+        .replace("{cid}", "cred-1")
+        .replace("{path}", "docs/readme.md")
+        .replace("{kind}", "og")
+    )
+    if pattern is not None and not pattern.fullmatch(sample):
+        raise AssertionError(f"sample path does not match pattern: {sample} {label}")
+    return sample
+
+
+# Auth level coverage (4-value enum)
+assert route_registry.resolve_auth_level("GET", "/api/health") == route_registry.AuthLevel.PUBLIC
+assert route_registry.resolve_auth_level("GET", "/api/meta") == route_registry.AuthLevel.PUBLIC
+assert route_registry.resolve_auth_level("GET", "/api/snapshot") == route_registry.AuthLevel.SESSION
+assert route_registry.resolve_auth_level("POST", "/api/auth/start") == route_registry.AuthLevel.PUBLIC
+assert route_registry.resolve_auth_level("GET", "/api/me") == route_registry.AuthLevel.SESSION
+assert route_registry.resolve_auth_level("GET", "/api/admin/vault/status") == route_registry.AuthLevel.ROLE_OWNER_ADMIN
+assert route_registry.resolve_auth_level("GET", "/api/workspace/default/rooms") == route_registry.AuthLevel.SESSION
+
+# Unknown /api paths are unregistered → None (404 at dispatch, not auth-gated)
+assert route_registry.resolve_auth_level("GET", "/api/not-a-real-handler") is None
+assert route_registry.authorize_request(
+    "GET",
+    "/api/not-a-real-handler",
+    "",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda _s: None,
+    attach_user=lambda _u: None,
+)
+
+# Registered session route without session → 401
+assert not route_registry.authorize_request(
+    "GET",
+    "/api/me",
+    "",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda _s: None,
+    attach_user=lambda _u: None,
+)
+
+# ROUTES table: dispatched routes have handlers on server.Handler (+ handler_modules)
+handler_src = _handler_source_text()
+missing_handlers: list[str] = []
+for route in route_registry.ROUTES:
+    if not route.handler:
+        continue
+    if f"def {route.handler}(" not in handler_src:
+        missing_handlers.append(f"{route.method} {route.path} -> {route.handler}")
+assert not missing_handlers, f"missing handler methods: {missing_handlers}"
+
+# Every pattern-backed route has a handler and auth via label-derived sample path
+missing_pattern_handlers: list[str] = []
+missing_pattern_auth: list[str] = []
+for rp in route_registry.ROUTE_PATTERNS:
+    if not rp.handler:
+        missing_pattern_handlers.append(f"{rp.method} {rp.label}")
+        continue
+    if f"def {rp.handler}(" not in handler_src:
+        missing_pattern_handlers.append(f"{rp.method} {rp.label} -> {rp.handler}")
+    sample = _sample_path_from_label(rp.label, rp.pattern)
+    if route_registry.lookup_auth(rp.method, sample) is None:
+        missing_pattern_auth.append(f"{rp.method} {sample}")
+assert not missing_pattern_handlers, f"missing pattern handlers: {missing_pattern_handlers}"
+assert not missing_pattern_auth, f"missing pattern auth: {missing_pattern_auth}"
+
+# Pattern handlers must not re-dispatch with legacy startswith guards
+pattern_method_blocks = re.findall(
+    r"(def (_route_pattern_\w+)\([^)]*\)[^:]*:.*?)(?=\n    def |\Z)",
+    handler_src,
+    flags=re.DOTALL,
+)
+legacy_guards: list[str] = []
+for block, name in pattern_method_blocks:
+    if 'path.startswith("/api/' in block or "path.startswith('/api/" in block:
+        legacy_guards.append(name)
+assert not legacy_guards, f"legacy startswith guards in pattern handlers: {legacy_guards}"
+
+# Every if-chain literal /api path must be registered with explicit auth
+server_src = (ROOT / "server.py").read_text(encoding="utf-8")
+handler_paths = set(re.findall(r'if path == "(/api/[^"]+)"', server_src))
+handler_paths |= set(re.findall(r"if path == \'(/api/[^\']+)\'", server_src))
+unregistered: list[str] = []
+for p in sorted(handler_paths):
+    if route_registry.lookup_auth("GET", p) is None and route_registry.lookup_auth("POST", p) is None:
+        unregistered.append(p)
+assert not unregistered, f"unregistered auth for if-chain paths: {unregistered}"
+
+# Pattern-backed routes from startswith / fullmatch in do_GET/do_POST
+_pattern_probes = [
+    ("GET", "/api/public/branding/og"),
+    ("GET", "/api/workspace/ws-1/rooms"),
+    ("GET", "/api/rooms/room-1/messages"),
+    ("POST", "/api/rooms/room-1/messages/send"),
+    ("PATCH", "/api/workspace/ws-1"),
+    ("DELETE", "/api/memory/mem-1"),
+]
+for method, path in _pattern_probes:
+    assert route_registry.lookup_auth(method, path) is not None, f"missing pattern auth: {method} {path}"
+
+# sessionless_ok data GETs
+snap = route_registry.lookup_auth("GET", "/api/snapshot")
+assert snap is not None and snap.sessionless_ok
+assert not route_registry.authorize_request(
+    "GET",
+    "/api/agents",
+    "",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda _s: None,
+    attach_user=lambda _u: None,
+)
+assert route_registry.authorize_request(
+    "GET",
+    "/api/agents",
+    "sid-ok",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda s: {"user_id": "u1"} if s == "sid-ok" else None,
+    attach_user=lambda _u: None,
+)
+
+# owner/admin gate
+assert not route_registry.authorize_request(
+    "GET",
+    "/api/admin/vault/status",
+    "sid-ok",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda s: {"user_id": "u1"} if s == "sid-ok" else None,
+    attach_user=lambda _u: None,
+    get_workspace_role=lambda: "member",
+)
+assert route_registry.authorize_request(
+    "GET",
+    "/api/admin/vault/status",
+    "sid-ok",
+    deployment_mode="trusted_team",
+    dev_local_unsafe=False,
+    install_window_open=False,
+    validate_session=lambda s: {"user_id": "u1"} if s == "sid-ok" else None,
+    attach_user=lambda _u: None,
+    get_workspace_role=lambda: "owner",
+)
+
+dispatched_get = [r for r in route_registry.ROUTES if r.method == "GET" and r.handler]
+dispatched_post = [r for r in route_registry.ROUTES if r.method == "POST" and r.handler]
+dispatched_patch = [r for r in route_registry.ROUTES if r.method == "PATCH" and r.handler]
+pattern_dispatched = [rp for rp in route_registry.ROUTE_PATTERNS if rp.handler]
+assert len(dispatched_get) >= 50, f"unexpected GET dispatch count: {len(dispatched_get)}"
+assert len(dispatched_post) >= 40, f"unexpected POST dispatch count: {len(dispatched_post)}"
+assert len(dispatched_patch) >= 4, f"unexpected PATCH dispatch count: {len(dispatched_patch)}"
+assert len(pattern_dispatched) >= 60, f"unexpected pattern dispatch count: {len(pattern_dispatched)}"
+assert len(dispatched_get) + len(dispatched_post) + len(dispatched_patch) + len(pattern_dispatched) >= 160
+
+class _PostStub:
+    def __init__(self) -> None:
+        self.called = False
+        self.body: dict | None = None
+
+    def _route_post_auth_start(self, body: dict) -> None:
+        self.called = True
+        self.body = body
+
+_stub = _PostStub()
+assert route_registry.dispatch_post(_stub, "/api/auth/start", {"email": "a@b.c"})
+assert _stub.called and _stub.body == {"email": "a@b.c"}
+assert not route_registry.dispatch_post(_stub, "/api/not-registered", {})
+
+class _GetStub:
+    def __init__(self) -> None:
+        self.called = False
+        self.pattern_called = False
+
+    def _route_get_admin_vault_status(self, qs: dict) -> None:
+        self.called = True
+
+    def _route_pattern_get_workspace_events(self, path: str, qs: dict) -> None:
+        self.pattern_called = True
+
+_get_stub = _GetStub()
+assert route_registry.dispatch_get(_get_stub, "/api/admin/vault/status", {})
+assert _get_stub.called
+assert route_registry.dispatch_get(_get_stub, "/api/admin/vault/status", {})  # idempotent call ok
+
+assert route_registry.dispatch_pattern(
+    "GET", _get_stub, "/api/workspace/ws-1/events", qs={},
+) is True
+assert _get_stub.pattern_called
+
+class _PatchStub:
+    def __init__(self) -> None:
+        self.called = False
+
+    def _route_patch_me(self, body: dict) -> None:
+        self.called = True
+
+_patch_stub = _PatchStub()
+assert route_registry.dispatch_patch(_patch_stub, "/api/me", {"display_name": "x"})
+assert _patch_stub.called
+
+# No legacy frozenset allowlists
+assert not hasattr(route_registry, "GET_ALWAYS_PUBLIC_ROUTES")
+assert not hasattr(route_registry, "GET_SINGLE_USER_PUBLIC_ROUTES")
+assert not hasattr(route_registry, "GET_PUBLIC_ROUTES")
+
+print("route registry self-check ok")

package/workframe-api/test_run_authority.py

@@ -0,0 +1,112 @@
+"""WF-009 RunAuthorityGate self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from domain.entities import ActorType, FundingSource, RunSurface  # noqa: E402
+from run_authority import (  # noqa: E402
+    DENY_DELEGATION,
+    DENY_NO_CREDENTIAL_BYOK,
+    DENY_NO_CREDENTIAL_COMPANY,
+    DENY_PROVIDER_USER_ONLY,
+    RunAuthorityContext,
+    RunAuthorityRequest,
+    evaluate_run_authority,
+)
+
+
+def _req() -> RunAuthorityRequest:
+    return RunAuthorityRequest(
+        surface=RunSurface.CHAT,
+        actor_type=ActorType.USER,
+        actor_id="user-1",
+        triggering_user_id="user-1",
+        profile_slug="u-user-1-native",
+        workspace_id="ws-1",
+        provider="openrouter",
+    )
+
+
+def test_byok_user_cred() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(user_has_credential=True),
+        run_id="run-1",
+    )
+    assert decision.allowed
+    assert decision.payer_user_id == "user-1"
+    assert decision.funding_source == FundingSource.BYOK
+
+
+def test_byok_no_cred_denied() -> None:
+    decision = evaluate_run_authority(_req(), RunAuthorityContext())
+    assert not decision.allowed
+    assert decision.deny_reason == DENY_NO_CREDENTIAL_BYOK
+
+
+def test_company_workspace_cred() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(workspace_credential_mode="workspace", workspace_has_credential=True),
+    )
+    assert decision.allowed
+    assert decision.funding_source == FundingSource.COMPANY
+    assert decision.credential_scope == "workspace"
+
+
+def test_company_user_cred_wins() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(
+            workspace_credential_mode="workspace",
+            user_has_credential=True,
+            workspace_has_credential=True,
+        ),
+    )
+    assert decision.allowed
+    assert decision.funding_source == FundingSource.BYOK
+
+
+def test_user_only_no_fallback() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(provider_user_only=True, workspace_has_credential=True),
+    )
+    assert not decision.allowed
+    assert decision.deny_reason == DENY_PROVIDER_USER_ONLY
+
+
+def test_delegation_grantor() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(grantor_has_credential={"owner-1": True}),
+    )
+    assert decision.allowed
+    assert decision.payer_user_id == "owner-1"
+
+
+def test_delegation_no_grantor_cred() -> None:
+    decision = evaluate_run_authority(
+        _req(),
+        RunAuthorityContext(
+            workspace_credential_mode="workspace",
+            grantor_has_credential={"owner-1": False},
+        ),
+    )
+    assert not decision.allowed
+    assert decision.deny_reason == DENY_NO_CREDENTIAL_COMPANY
+
+
+if __name__ == "__main__":
+    test_byok_user_cred()
+    test_byok_no_cred_denied()
+    test_company_workspace_cred()
+    test_company_user_cred_wins()
+    test_user_only_no_fallback()
+    test_delegation_grantor()
+    test_delegation_no_grantor_cred()
+    print("test_run_authority: ok")

package/workframe-api/test_run_ledger.py

@@ -0,0 +1,157 @@
+"""WF-NS-P2 run ledger self-check."""
+
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import run_ledger  # noqa: E402
+from domain.entities import (  # noqa: E402
+    ActorType,
+    FundingSource,
+    RunStatus,
+    RunSurface,
+)
+from run_authority import RunAuthorityDecision, chat_run_request  # noqa: E402
+
+
+def test_schema_and_round_trip() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = Path(tmp) / "workframe.db"
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        run_ledger.WORKFRAME_DB = db_path
+        run_ledger._SCHEMA_READY.clear()
+        run_ledger.ensure_schema()
+
+        conn = sqlite3.connect(str(db_path))
+        conn.row_factory = sqlite3.Row
+        try:
+            decision = RunAuthorityDecision(
+                allowed=True,
+                deny_reason=None,
+                payer_user_id="user-1",
+                funding_source=FundingSource.BYOK,
+                credential_ref_id=None,
+                credential_scope="user",
+                grants=(),
+            )
+            run_ledger.record_authority_decision(
+                conn,
+                run_id="run-test-1",
+                request_surface=RunSurface.CHAT,
+                actor_type=ActorType.USER,
+                actor_id="user-1",
+                triggering_user_id="user-1",
+                workspace_id="ws-1",
+                agent_id="agent-1",
+                runtime_binding_id="bind-1",
+                profile_slug="u-user-1-native",
+                provider="openrouter",
+                room_id="room-1",
+                session_id="sess-1",
+                decision=decision,
+            )
+            conn.commit()
+
+            run = run_ledger.get_run(conn, "run-test-1")
+            assert run is not None
+            assert run.status == RunStatus.RUNNING
+            assert run.funding_source == FundingSource.BYOK
+
+            run_ledger.complete_run(
+                conn,
+                "run-test-1",
+                model="test/model",
+                provider="openrouter",
+                funding_source=FundingSource.BYOK,
+                payer_user_id="user-1",
+            )
+            conn.commit()
+
+            items = conn.execute(
+                "SELECT kind, funding_source, amount_usd, receipt_json FROM run_line_items WHERE run_id = ?",
+                ("run-test-1",),
+            ).fetchall()
+            assert len(items) == 1
+            assert str(items[0]["kind"]) == "llm_turn"
+            assert items[0]["amount_usd"] is None
+            receipt = json.loads(str(items[0]["receipt_json"]))
+            assert receipt["run_id"] == "run-test-1"
+            assert receipt["payer_user_id"] == "user-1"
+        finally:
+            conn.close()
+
+        events = run_ledger.list_run_events_for_room("room-1")
+        assert len(events) >= 2
+        assert events[0]["source"] == "run_ledger"
+
+
+def test_dm_room_chat_run_recorded() -> None:
+    """WF-NS-P2: DM rooms (room_type=direct) share chat_stream run path."""
+    dm_room_id = "550e8400-e29b-41d4-a716-446655440099"
+    req = chat_run_request(
+        triggering_user_id="user-a",
+        profile_slug="u-user-a-native",
+        workspace_id="ws-1",
+        provider="openrouter",
+        room_id=dm_room_id,
+    )
+    assert req.surface == RunSurface.CHAT
+
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = Path(tmp) / "workframe.db"
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        run_ledger.WORKFRAME_DB = db_path
+        run_ledger._SCHEMA_READY.clear()
+        run_ledger.ensure_schema()
+
+        conn = sqlite3.connect(str(db_path))
+        conn.row_factory = sqlite3.Row
+        try:
+            decision = RunAuthorityDecision(
+                allowed=True,
+                deny_reason=None,
+                payer_user_id="user-a",
+                funding_source=FundingSource.BYOK,
+                credential_ref_id=None,
+                credential_scope="user",
+                grants=(),
+            )
+            run_ledger.record_authority_decision(
+                conn,
+                run_id="run-dm-1",
+                request_surface=req.surface,
+                actor_type=req.actor_type,
+                actor_id=req.actor_id,
+                triggering_user_id="user-a",
+                workspace_id="ws-1",
+                agent_id=req.agent_id,
+                runtime_binding_id=req.runtime_binding_id,
+                profile_slug=req.profile_slug,
+                provider="openrouter",
+                room_id=dm_room_id,
+                session_id="sess-dm-1",
+                decision=decision,
+            )
+            conn.commit()
+            row = conn.execute(
+                "SELECT surface, room_id FROM runs WHERE run_id = ?",
+                ("run-dm-1",),
+            ).fetchone()
+            assert row is not None
+            assert row["surface"] == RunSurface.CHAT.value
+            assert row["room_id"] == dm_room_id
+        finally:
+            conn.close()
+
+
+if __name__ == "__main__":
+    test_schema_and_round_trip()
+    test_dm_room_chat_run_recorded()
+    print("test_run_ledger: ok")

package/workframe-api/test_run_surface_wiring.py

@@ -0,0 +1,130 @@
+"""WF-NS-P2 run surface wiring self-check."""
+
+from __future__ import annotations
+
+import os
+import sqlite3
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import run_ledger  # noqa: E402
+import run_surface_wiring  # noqa: E402
+import server  # noqa: E402
+from domain.entities import ActorType, RunSurface  # noqa: E402
+
+
+def _use_tmp_db(tmp: str) -> Path:
+    db_path = Path(tmp) / "workframe.db"
+    data = Path(tmp)
+    os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+    server.DATA_DIR = data
+    server.AUTH_DB_PATH = data / "auth.db"
+    run_ledger.DATA_DIR = data
+    run_ledger.WORKFRAME_DB = db_path
+    run_ledger._SCHEMA_READY.clear()
+    return db_path
+
+
+def _line_items_for_run(db_path: Path, run_id: str) -> list[sqlite3.Row]:
+    conn = sqlite3.connect(str(db_path))
+    conn.row_factory = sqlite3.Row
+    try:
+        return conn.execute(
+            "SELECT kind, amount_usd, receipt_json FROM run_line_items WHERE run_id = ?",
+            (run_id,),
+        ).fetchall()
+    finally:
+        conn.close()
+
+
+def test_slash_audit_run_no_gate() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        _use_tmp_db(tmp)
+        assert run_surface_wiring.slash_requires_authority("help") is False
+        assert run_surface_wiring.slash_requires_authority("chat") is True
+
+
+def test_record_automated_cron() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = _use_tmp_db(tmp)
+        run_ledger.ensure_schema()
+        result = run_surface_wiring.record_automated_surface_run(
+            {
+                "surface": "cron",
+                "profile_slug": "u-test-dev",
+                "triggering_user_id": "user-1",
+                "workspace_id": "ws-1",
+                "actor_id": "cron:daily",
+                "provider": "openrouter",
+                "event_type": "cron.triggered",
+                "payload": {"job": "daily"},
+            }
+        )
+        assert result["ok"] is True
+        rid = str(result["run_id"])
+        conn = sqlite3.connect(str(db_path))
+        conn.row_factory = sqlite3.Row
+        row = conn.execute("SELECT surface, status FROM runs WHERE run_id = ?", (rid,)).fetchone()
+        conn.close()
+        assert row is not None
+        assert row["surface"] == RunSurface.CRON.value
+        assert row["status"] == "completed"
+        items = _line_items_for_run(db_path, rid)
+        assert len(items) == 1
+        assert items[0]["amount_usd"] is None
+
+
+def test_finish_surface_run_emits_receipt() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = _use_tmp_db(tmp)
+        run_ledger.ensure_schema()
+        rid = run_surface_wiring.record_audit_surface_run(
+            surface=RunSurface.SLASH,
+            actor_type=ActorType.USER,
+            actor_id="user-1",
+            triggering_user_id="user-1",
+            profile_slug="u-test-dev",
+            workspace_id="ws-1",
+            event_type="slash.command",
+            payload={"command": "help"},
+            provider="openrouter",
+        )
+        run_surface_wiring.finish_surface_run(rid, ok=True, detail="ok")
+        items = _line_items_for_run(db_path, rid)
+        assert len(items) == 1
+        assert items[0]["amount_usd"] is None
+
+
+def test_record_automated_webhook() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        _use_tmp_db(tmp)
+        run_ledger.ensure_schema()
+        result = run_surface_wiring.record_automated_surface_run(
+            {
+                "surface": "webhook",
+                "profile_slug": "u-test-dev",
+                "triggering_user_id": "user-1",
+                "workspace_id": "ws-1",
+                "actor_id": "webhook:github",
+                "event_type": "webhook.received",
+                "provider": "openrouter",
+                "payload": {"source": "github"},
+            }
+        )
+        assert result["ok"] is True
+        assert result["surface"] == RunSurface.WEBHOOK.value
+        rid = str(result["run_id"])
+        items = _line_items_for_run(Path(tmp) / "workframe.db", rid)
+        assert len(items) == 1
+        assert items[0]["amount_usd"] is None
+
+
+if __name__ == "__main__":
+    test_slash_audit_run_no_gate()
+    test_record_automated_cron()
+    test_record_automated_webhook()
+    test_finish_surface_run_emits_receipt()
+    print("test_run_surface_wiring ok")