create-workframe 0.1.12 → 0.1.13

package/workframe-api/test_run_ledger.py

@@ -0,0 +1,157 @@
+"""WF-NS-P2 run ledger self-check."""
+
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import run_ledger  # noqa: E402
+from domain.entities import (  # noqa: E402
+    ActorType,
+    FundingSource,
+    RunStatus,
+    RunSurface,
+)
+from run_authority import RunAuthorityDecision, chat_run_request  # noqa: E402
+
+
+def test_schema_and_round_trip() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = Path(tmp) / "workframe.db"
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        run_ledger.WORKFRAME_DB = db_path
+        run_ledger._SCHEMA_READY.clear()
+        run_ledger.ensure_schema()
+
+        conn = sqlite3.connect(str(db_path))
+        conn.row_factory = sqlite3.Row
+        try:
+            decision = RunAuthorityDecision(
+                allowed=True,
+                deny_reason=None,
+                payer_user_id="user-1",
+                funding_source=FundingSource.BYOK,
+                credential_ref_id=None,
+                credential_scope="user",
+                grants=(),
+            )
+            run_ledger.record_authority_decision(
+                conn,
+                run_id="run-test-1",
+                request_surface=RunSurface.CHAT,
+                actor_type=ActorType.USER,
+                actor_id="user-1",
+                triggering_user_id="user-1",
+                workspace_id="ws-1",
+                agent_id="agent-1",
+                runtime_binding_id="bind-1",
+                profile_slug="u-user-1-native",
+                provider="openrouter",
+                room_id="room-1",
+                session_id="sess-1",
+                decision=decision,
+            )
+            conn.commit()
+
+            run = run_ledger.get_run(conn, "run-test-1")
+            assert run is not None
+            assert run.status == RunStatus.RUNNING
+            assert run.funding_source == FundingSource.BYOK
+
+            run_ledger.complete_run(
+                conn,
+                "run-test-1",
+                model="test/model",
+                provider="openrouter",
+                funding_source=FundingSource.BYOK,
+                payer_user_id="user-1",
+            )
+            conn.commit()
+
+            items = conn.execute(
+                "SELECT kind, funding_source, amount_usd, receipt_json FROM run_line_items WHERE run_id = ?",
+                ("run-test-1",),
+            ).fetchall()
+            assert len(items) == 1
+            assert str(items[0]["kind"]) == "llm_turn"
+            assert items[0]["amount_usd"] is None
+            receipt = json.loads(str(items[0]["receipt_json"]))
+            assert receipt["run_id"] == "run-test-1"
+            assert receipt["payer_user_id"] == "user-1"
+        finally:
+            conn.close()
+
+        events = run_ledger.list_run_events_for_room("room-1")
+        assert len(events) >= 2
+        assert events[0]["source"] == "run_ledger"
+
+
+def test_dm_room_chat_run_recorded() -> None:
+    """WF-NS-P2: DM rooms (room_type=direct) share chat_stream run path."""
+    dm_room_id = "550e8400-e29b-41d4-a716-446655440099"
+    req = chat_run_request(
+        triggering_user_id="user-a",
+        profile_slug="u-user-a-native",
+        workspace_id="ws-1",
+        provider="openrouter",
+        room_id=dm_room_id,
+    )
+    assert req.surface == RunSurface.CHAT
+
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = Path(tmp) / "workframe.db"
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        run_ledger.WORKFRAME_DB = db_path
+        run_ledger._SCHEMA_READY.clear()
+        run_ledger.ensure_schema()
+
+        conn = sqlite3.connect(str(db_path))
+        conn.row_factory = sqlite3.Row
+        try:
+            decision = RunAuthorityDecision(
+                allowed=True,
+                deny_reason=None,
+                payer_user_id="user-a",
+                funding_source=FundingSource.BYOK,
+                credential_ref_id=None,
+                credential_scope="user",
+                grants=(),
+            )
+            run_ledger.record_authority_decision(
+                conn,
+                run_id="run-dm-1",
+                request_surface=req.surface,
+                actor_type=req.actor_type,
+                actor_id=req.actor_id,
+                triggering_user_id="user-a",
+                workspace_id="ws-1",
+                agent_id=req.agent_id,
+                runtime_binding_id=req.runtime_binding_id,
+                profile_slug=req.profile_slug,
+                provider="openrouter",
+                room_id=dm_room_id,
+                session_id="sess-dm-1",
+                decision=decision,
+            )
+            conn.commit()
+            row = conn.execute(
+                "SELECT surface, room_id FROM runs WHERE run_id = ?",
+                ("run-dm-1",),
+            ).fetchone()
+            assert row is not None
+            assert row["surface"] == RunSurface.CHAT.value
+            assert row["room_id"] == dm_room_id
+        finally:
+            conn.close()
+
+
+if __name__ == "__main__":
+    test_schema_and_round_trip()
+    test_dm_room_chat_run_recorded()
+    print("test_run_ledger: ok")

package/workframe-api/test_run_surface_wiring.py

@@ -0,0 +1,130 @@
+"""WF-NS-P2 run surface wiring self-check."""
+
+from __future__ import annotations
+
+import os
+import sqlite3
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import run_ledger  # noqa: E402
+import run_surface_wiring  # noqa: E402
+import server  # noqa: E402
+from domain.entities import ActorType, RunSurface  # noqa: E402
+
+
+def _use_tmp_db(tmp: str) -> Path:
+    db_path = Path(tmp) / "workframe.db"
+    data = Path(tmp)
+    os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+    server.DATA_DIR = data
+    server.AUTH_DB_PATH = data / "auth.db"
+    run_ledger.DATA_DIR = data
+    run_ledger.WORKFRAME_DB = db_path
+    run_ledger._SCHEMA_READY.clear()
+    return db_path
+
+
+def _line_items_for_run(db_path: Path, run_id: str) -> list[sqlite3.Row]:
+    conn = sqlite3.connect(str(db_path))
+    conn.row_factory = sqlite3.Row
+    try:
+        return conn.execute(
+            "SELECT kind, amount_usd, receipt_json FROM run_line_items WHERE run_id = ?",
+            (run_id,),
+        ).fetchall()
+    finally:
+        conn.close()
+
+
+def test_slash_audit_run_no_gate() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        _use_tmp_db(tmp)
+        assert run_surface_wiring.slash_requires_authority("help") is False
+        assert run_surface_wiring.slash_requires_authority("chat") is True
+
+
+def test_record_automated_cron() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = _use_tmp_db(tmp)
+        run_ledger.ensure_schema()
+        result = run_surface_wiring.record_automated_surface_run(
+            {
+                "surface": "cron",
+                "profile_slug": "u-test-dev",
+                "triggering_user_id": "user-1",
+                "workspace_id": "ws-1",
+                "actor_id": "cron:daily",
+                "provider": "openrouter",
+                "event_type": "cron.triggered",
+                "payload": {"job": "daily"},
+            }
+        )
+        assert result["ok"] is True
+        rid = str(result["run_id"])
+        conn = sqlite3.connect(str(db_path))
+        conn.row_factory = sqlite3.Row
+        row = conn.execute("SELECT surface, status FROM runs WHERE run_id = ?", (rid,)).fetchone()
+        conn.close()
+        assert row is not None
+        assert row["surface"] == RunSurface.CRON.value
+        assert row["status"] == "completed"
+        items = _line_items_for_run(db_path, rid)
+        assert len(items) == 1
+        assert items[0]["amount_usd"] is None
+
+
+def test_finish_surface_run_emits_receipt() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        db_path = _use_tmp_db(tmp)
+        run_ledger.ensure_schema()
+        rid = run_surface_wiring.record_audit_surface_run(
+            surface=RunSurface.SLASH,
+            actor_type=ActorType.USER,
+            actor_id="user-1",
+            triggering_user_id="user-1",
+            profile_slug="u-test-dev",
+            workspace_id="ws-1",
+            event_type="slash.command",
+            payload={"command": "help"},
+            provider="openrouter",
+        )
+        run_surface_wiring.finish_surface_run(rid, ok=True, detail="ok")
+        items = _line_items_for_run(db_path, rid)
+        assert len(items) == 1
+        assert items[0]["amount_usd"] is None
+
+
+def test_record_automated_webhook() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        _use_tmp_db(tmp)
+        run_ledger.ensure_schema()
+        result = run_surface_wiring.record_automated_surface_run(
+            {
+                "surface": "webhook",
+                "profile_slug": "u-test-dev",
+                "triggering_user_id": "user-1",
+                "workspace_id": "ws-1",
+                "actor_id": "webhook:github",
+                "event_type": "webhook.received",
+                "provider": "openrouter",
+                "payload": {"source": "github"},
+            }
+        )
+        assert result["ok"] is True
+        assert result["surface"] == RunSurface.WEBHOOK.value
+        rid = str(result["run_id"])
+        items = _line_items_for_run(Path(tmp) / "workframe.db", rid)
+        assert len(items) == 1
+        assert items[0]["amount_usd"] is None
+
+
+if __name__ == "__main__":
+    test_slash_audit_run_no_gate()
+    test_record_automated_cron()
+    test_record_automated_webhook()
+    test_finish_surface_run_emits_receipt()
+    print("test_run_surface_wiring ok")

package/workframe-api/test_runtime_cohort.py

@@ -0,0 +1,85 @@
+"""WF-032 runtime_cohort self-check."""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+import uuid
+from pathlib import Path
+
+API_DIR = Path(__file__).resolve().parent
+if str(API_DIR) not in sys.path:
+    sys.path.insert(0, str(API_DIR))
+
+os.environ.setdefault("WORKFRAME_API_DATA_DIR", str(API_DIR / ".tmp-test-data"))
+os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
+os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
+
+import runtime_cohort  # noqa: E402
+import server  # noqa: E402
+
+
+def test_runtime_profile_slug_format() -> None:
+    slug = runtime_cohort._runtime_profile_slug("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "architect")
+    assert slug.startswith("u-")
+    assert slug.endswith("-architect")
+    assert server._runtime_profile_slug("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "architect") == slug
+
+
+def test_self_grant_forbidden() -> None:
+    try:
+        runtime_cohort.create_delegation_grant("ws-1", "user-1", "user-1")
+        raise AssertionError("expected ValueError")
+    except ValueError as exc:
+        assert str(exc) == "self_grant_forbidden"
+
+
+def test_delegation_grant_round_trip() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        server.DATA_DIR = Path(tmp)
+        server.AUTH_DB_PATH = Path(tmp) / "auth.db"
+        server._ensure_workframe_db_schema()
+        ws_id = str(uuid.uuid4())
+        grantor = str(uuid.uuid4())
+        grantee = str(uuid.uuid4())
+        now = server._utc_now()
+        conn = server._workframe_db()
+        try:
+            conn.execute(
+                "INSERT INTO workspaces (id, slug, display_name, owner_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)",
+                (ws_id, "test-ws", "Test", grantor, now, now),
+            )
+            for uid, email in ((grantor, "a@test.local"), (grantee, "b@test.local")):
+                conn.execute(
+                    "INSERT INTO users (id, email, display_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",
+                    (uid, email, email.split("@")[0], now, now),
+                )
+                conn.execute(
+                    """
+                    INSERT INTO workspace_memberships (
+                        id, workspace_id, user_id, role, status, created_at, updated_at
+                    ) VALUES (?, ?, ?, 'member', 'active', ?, ?)
+                    """,
+                    (str(uuid.uuid4()), ws_id, uid, now, now),
+                )
+            conn.commit()
+        finally:
+            conn.close()
+        created = runtime_cohort.create_delegation_grant(ws_id, grantor, grantee)
+        assert created["ok"] is True
+        grant_id = created["grant"]["id"]
+        listed = runtime_cohort.list_delegation_grants(ws_id, grantor)
+        assert any(row["id"] == grant_id for row in listed["grants"])
+        revoked = runtime_cohort.revoke_delegation_grant(ws_id, grant_id, grantor)
+        assert revoked["ok"] is True
+        grantors = runtime_cohort._delegation_grantor_ids_for_grantee(grantee, ws_id)
+        assert grantor not in grantors
+
+
+if __name__ == "__main__":
+    test_runtime_profile_slug_format()
+    test_self_grant_forbidden()
+    test_delegation_grant_round_trip()
+    print("test_runtime_cohort: ok")

package/workframe-api/test_secure_mode_docker_boundary.py

@@ -0,0 +1,39 @@
+"""WF-NS-P1 secure-mode docker socket boundary self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+
+def test_docker_request_blocked_in_secure_mode() -> None:
+    prev = server.SECURE_MODE
+    try:
+        server.SECURE_MODE = True
+        try:
+            server._docker_request("GET", "/containers/json")
+            raise AssertionError("expected RuntimeError in SECURE_MODE")
+        except RuntimeError as exc:
+            assert "SECURE_MODE" in str(exc)
+    finally:
+        server.SECURE_MODE = prev
+
+
+def test_public_compose_api_has_no_docker_sock() -> None:
+    """Compose config assertion — complements WF-011 supervisor negatives."""
+    repo = Path(__file__).resolve().parents[2]
+    public = (repo / "infra" / "compose" / "workframe" / "docker-compose.public.yml").read_text(
+        encoding="utf-8"
+    )
+    api_block = public.split("workframe-api:")[1].split("workframe-supervisor:")[0]
+    assert "/var/run/docker.sock" not in api_block
+
+
+if __name__ == "__main__":
+    test_docker_request_blocked_in_secure_mode()
+    test_public_compose_api_has_no_docker_sock()
+    print("test_secure_mode_docker_boundary: ok")

package/workframe-api/test_server_reexports.py

@@ -0,0 +1,99 @@
+"""WF-032 guard: server.py must re-export symbols still called from extracted modules."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+API_DIR = Path(__file__).resolve().parent
+if str(API_DIR) not in sys.path:
+    sys.path.insert(0, str(API_DIR))
+
+os.environ.setdefault("WORKFRAME_API_DATA_DIR", str(API_DIR / ".tmp-test-data"))
+os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
+os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
+
+import server  # noqa: E402
+
+
+_REQUIRED = (
+    "_parse_workspace_settings",
+    "_strip_profile_action_env",
+    "_strip_profile_llm_env",
+    "_user_action_env_specs",
+    "_overlay_turn_user_env",
+    "_overlay_turn_provider_env",
+    "_llm_proxy_base_url",
+    "_require_user_provider",
+    "_ensure_profile_llm_proxy",
+    "_revoke_turn_credential_lease",
+    "_sync_profile_provider_env",
+    "_session_info",
+    "chat_messages",
+    "chat_bootstrap",
+    "_gateway_container_exec",
+    "_gateway_container_exec_detached",
+    "_docker_exec",
+    "_gateway_exec",
+    "_hermes_agent_version",
+    "ensure_profile_api",
+    "hermes_commands_catalog",
+    "hermes_commands_exec",
+    "hermes_usage",
+    "_runtime_profile_slug",
+    "ensure_runtime_profile",
+    "ensure_user_agent_cohort",
+    "resolve_runtime_assignee",
+    "cohort_runtime_slugs",
+    "_prepare_runtime_profile_credentials",
+    "purge_stale_runtime_profiles",
+    "list_delegation_grants",
+    "create_delegation_grant",
+    "revoke_delegation_grant",
+    "_delegation_grantor_ids_for_grantee",
+    "_runtime_profile_on_disk",
+    "_invalidate_gateway_registered_cache",
+    "_normalize_user_avatar_url",
+    "_normalize_logo_url",
+    "_normalize_agent_avatar_patch",
+    "_resolve_avatar_fields",
+    "_upsert_agent_registry_row",
+    "_assign_agent_avatar",
+    "_avatar_id_for_display_name",
+    "_pick_logo_url",
+    "_supervisor_ready",
+    "_supervisor_request",
+    "_maybe_sync_compose_public_url",
+    "_supervisor_gateway_exec",
+    "_supervisor_container_exec",
+    "_supervisor_profile_lifecycle",
+    "_parse_messaging_settings_patch",
+    "_workspace_messaging_integrations_payload",
+    "_sync_workspace_messaging_gateway",
+    "room_chat_bind",
+    "profile_chat_bind",
+    "list_room_sessions",
+    "profile_chat_activate_room_session",
+    "profile_chat_message",
+    "_enrich_room_chat_payload",
+    "_room_session_rows",
+    "_extract_title",
+    "bootstrap_agent_dm_lane",
+    "_provision_agent_dm_runtimes",
+    "_ensure_default_workspace",
+    "_bootstrap_after_setup",
+    "_promote_workspace_owner_if_unclaimed",
+    "_sync_workspace_home_room",
+    "_onboard_workspace_member_rooms",
+)
+
+
+def test_server_wf032_reexports_present() -> None:
+    missing = [name for name in _REQUIRED if not hasattr(server, name)]
+    assert not missing, f"missing server re-exports: {missing}"
+
+
+if __name__ == "__main__":
+    test_server_wf032_reexports_present()
+    print("ok")

package/workframe-api/test_stack_config_install_smtp.py

@@ -53,4 +53,11 @@ os.environ["WORKFRAME_DEPLOYMENT_MODE"] = "trusted_team"
 stack_config.patch_stack_config({"deployment_mode": "single_user_local"})
 assert stack_config.resolve_deployment_mode() == "single_user_local"
 
+# Admin verify survives reload
+stack_config.patch_stack_config({"install_complete": False})
+stack_config.mark_install_admin_verified("owner@example.com")
+assert stack_config.install_admin_verified()
+cfg = stack_config.get_stack_config()
+assert cfg["smtp"]["admin_email"] == "owner@example.com"
+
 print("stack_config install-window smtp self-check ok")

package/workframe-api/turn_credentials.py

@@ -157,11 +157,22 @@ def parse_lease_token(value: str) -> str:
     return ""
 
 
-def validate_lease(token: str) -> dict[str, Any] | None:
-    """Return lease metadata if token is active (not revoked/expired)."""
+def _lease_row_to_meta(row: sqlite3.Row) -> dict[str, Any]:
+    return {
+        "run_id": str(row["run_id"]),
+        "payer_user_id": str(row["payer_user_id"]),
+        "workspace_id": str(row["workspace_id"]),
+        "provider": str(row["provider"]),
+        "credential_binding_id": str(row["credential_binding_id"] or ""),
+        "profile_slug": str(row["profile_slug"]),
+    }
+
+
+def inspect_lease(token: str) -> tuple[str | None, dict[str, Any] | None]:
+    """Return (deny_reason, lease_meta). deny_reason is None when the lease is active."""
     token = parse_lease_token(token)
     if not token:
-        return None
+        return "missing_token", None
     ensure_schema()
     conn = _connect()
     try:
@@ -176,16 +187,20 @@ def validate_lease(token: str) -> dict[str, Any] | None:
         ).fetchone()
     finally:
         conn.close()
-    if not row or row["revoked_at"] or _expired(str(row["expires_at"] or "")):
-        return None
-    return {
-        "run_id": str(row["run_id"]),
-        "payer_user_id": str(row["payer_user_id"]),
-        "workspace_id": str(row["workspace_id"]),
-        "provider": str(row["provider"]),
-        "credential_binding_id": str(row["credential_binding_id"] or ""),
-        "profile_slug": str(row["profile_slug"]),
-    }
+    if not row:
+        return "not_found", None
+    meta = _lease_row_to_meta(row)
+    if row["revoked_at"]:
+        return "revoked", meta
+    if _expired(str(row["expires_at"] or "")):
+        return "expired", meta
+    return None, meta
+
+
+def validate_lease(token: str) -> dict[str, Any] | None:
+    """Return lease metadata if token is active (not revoked/expired)."""
+    deny_reason, lease = inspect_lease(token)
+    return lease if deny_reason is None else None
 
 
 def revoke_lease(run_id: str) -> None: