github-issue-tower-defence-management 1.197.1 → 2.0.0

package/src/adapter/entry-points/console/webServer.test.ts

@@ -1499,6 +1499,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
     server: http.Server,
     requestPath: string,
     method = 'GET',
+    headers?: Record<string, string>,
   ): Promise<{
     statusCode: number;
     body: string;
@@ -1514,7 +1515,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
     const port = address.port;
     return new Promise((resolve, reject) => {
       const httpRequest = http.request(
-        { host: '127.0.0.1', port, path: requestPath, method },
+        { host: '127.0.0.1', port, path: requestPath, method, headers },
         (response) => {
           const chunks: Uint8Array[] = [];
           response.on('data', (chunk: Uint8Array) => chunks.push(chunk));
@@ -1653,7 +1654,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
       dashboardDataDir: dataDir,
     });
     try {
-      const response = await requestServer(server, '/tdpm.txt');
+      const response = await requestServer(server, `/tdpm.txt?k=${testToken}`);
       expect(response.statusCode).toBe(200);
       expect(response.body).toBe(expectedComposed);
       expect(response.contentType).toBe('text/html; charset=utf-8');
@@ -1680,7 +1681,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
       dashboardDataDir: null,
     });
     try {
-      const response = await requestServer(server, '/tdpm.txt');
+      const response = await requestServer(server, `/tdpm.txt?k=${testToken}`);
       expect(response.statusCode).toBe(200);
       expect(response.body).toBe(staticDashboardRaw);
       expect(response.contentType).toBe('text/html; charset=utf-8');
@@ -1706,7 +1707,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
       dashboardDataDir: dataDir,
     });
     try {
-      const response = await requestServer(server, '/tdpm.txt');
+      const response = await requestServer(server, `/tdpm.txt?k=${testToken}`);
       expect(response.statusCode).toBe(200);
       expect(response.body).toBe(staticDashboardRaw);
     } finally {
@@ -1739,7 +1740,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
       dashboardDataDir: dataDir,
     });
     try {
-      const response = await requestServer(server, '/tdpm.txt');
+      const response = await requestServer(server, `/tdpm.txt?k=${testToken}`);
       expect(response.statusCode).toBe(200);
       expect(response.body).toBe(staticDashboardRaw);
     } finally {
@@ -1759,7 +1760,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
       dashboardDataDir: null,
     });
     try {
-      const response = await requestServer(server, '/tdpm.txt');
+      const response = await requestServer(server, `/tdpm.txt?k=${testToken}`);
       expect(response.statusCode).toBe(404);
     } finally {
       await closeServer(server);
@@ -1774,7 +1775,7 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
       dashboardDataDir: null,
     });
     try {
-      const response = await requestServer(server, '/tdpm.txt');
+      const response = await requestServer(server, `/tdpm.txt?k=${testToken}`);
       expect(response.statusCode).toBe(404);
     } finally {
       await closeServer(server);
@@ -1803,6 +1804,66 @@ describe('webServer dashboard /tdpm.txt route integration', () => {
       fs.rmSync(staticDir, { recursive: true, force: true });
     }
   });
+
+  it('returns 401 for GET /tdpm.txt without a token', async () => {
+    const staticDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'dashboard-static-'),
+    );
+    writeStaticDashboard(staticDir);
+    const { server, tmpDir } = await startServer({
+      dashboardDir: staticDir,
+      dashboardDataDir: null,
+    });
+    try {
+      const response = await requestServer(server, '/tdpm.txt');
+      expect(response.statusCode).toBe(401);
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+      fs.rmSync(staticDir, { recursive: true, force: true });
+    }
+  });
+
+  it('returns 401 for GET /tdpm.txt with wrong token via query param', async () => {
+    const staticDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'dashboard-static-'),
+    );
+    writeStaticDashboard(staticDir);
+    const { server, tmpDir } = await startServer({
+      dashboardDir: staticDir,
+      dashboardDataDir: null,
+    });
+    try {
+      const response = await requestServer(server, '/tdpm.txt?k=wrong-token');
+      expect(response.statusCode).toBe(401);
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+      fs.rmSync(staticDir, { recursive: true, force: true });
+    }
+  });
+
+  it('returns 200 for GET /tdpm.txt with valid token via x-pv-token header', async () => {
+    const staticDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'dashboard-static-'),
+    );
+    writeStaticDashboard(staticDir);
+    const { server, tmpDir } = await startServer({
+      dashboardDir: staticDir,
+      dashboardDataDir: null,
+    });
+    try {
+      const response = await requestServer(server, '/tdpm.txt', 'GET', {
+        [CONSOLE_TOKEN_HEADER]: testToken,
+      });
+      expect(response.statusCode).toBe(200);
+      expect(response.body).toBe(staticDashboardRaw);
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+      fs.rmSync(staticDir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe('webServer image proxy', () => {

package/src/adapter/entry-points/console/webServer.ts

@@ -791,6 +791,15 @@ export const handleWebRequest = async (
       sendNotFound(response);
       return;
     }
+    const providedToken = extractProvidedToken(
+      requestUrl.searchParams.get('k'),
+      request.headers[CONSOLE_TOKEN_HEADER],
+      extractCookieToken(request.headers.cookie),
+    );
+    if (!isTokenValid(options.accessToken, providedToken)) {
+      sendUnauthorized(response);
+      return;
+    }
     const dashboardContent = resolveDashboardContent(options, requestPath);
     if (dashboardContent === null) {
       sendNotFound(response);

package/src/domain/usecases/CheckIssueReviewReadinessUseCase.test.ts

@@ -118,6 +118,7 @@ describe('CheckIssueReviewReadinessUseCase', () => {
 
       const result = await useCase.run({
         issueUrl: 'https://github.com/user/repo/issues/1',
+        allowedIssueAuthors: ['agent-bot'],
         labelsAsLlmAgentName: ['chore'],
         labelsNotRequiringPullRequest: ['story'],
       });
@@ -182,6 +183,7 @@ describe('CheckIssueReviewReadinessUseCase', () => {
 
       const result = await useCase.run({
         issueUrl: 'https://github.com/user/repo/issues/1',
+        allowedIssueAuthors: ['agent-bot'],
       });
 
       expect(result.reviewReady).toBe(false);
@@ -223,6 +225,7 @@ describe('CheckIssueReviewReadinessUseCase', () => {
 
       const result = await useCase.run({
         issueUrl: 'https://github.com/user/repo/issues/1',
+        allowedIssueAuthors: ['agent-bot'],
       });
 
       expect(result.rejections).toEqual([]);
@@ -265,6 +268,7 @@ describe('CheckIssueReviewReadinessUseCase', () => {
 
       const result = await useCase.run({
         issueUrl: 'https://github.com/user/repo/issues/1',
+        allowedIssueAuthors: ['agent-bot'],
       });
 
       expect(result.reviewReady).toBe(true);
@@ -286,15 +290,18 @@ describe('CheckIssueReviewReadinessUseCase', () => {
 
       const result = await useCase.run({
         issueUrl: 'https://github.com/user/repo/issues/1',
+        allowedIssueAuthors: ['agent-bot'],
       });
 
       expect(result.reviewReady).toBe(false);
-      expect(result.rejections[0].type).toBe(
-        'ANY_CI_JOB_FAILED_OR_IN_PROGRESS',
-      );
+      expect(result.rejections).toContainEqual({
+        type: 'ANY_CI_JOB_FAILED_OR_IN_PROGRESS',
+        detail:
+          'ANY_CI_JOB_FAILED_OR_IN_PROGRESS: https://github.com/user/repo/pull/1',
+      });
     });
 
-    it('should treat all authors as trusted when allowedIssueAuthors is null', async () => {
+    it('should reject all authors when allowedIssueAuthors is null (fail-closed)', async () => {
       const issue = createMockIssue();
       mockIssueRepository.getIssueByUrl.mockResolvedValue(issue);
       mockIssueCommentRepository.getCommentsFromIssue.mockResolvedValue([
@@ -309,8 +316,11 @@ describe('CheckIssueReviewReadinessUseCase', () => {
         allowedIssueAuthors: null,
       });
 
-      expect(result.reviewReady).toBe(true);
-      expect(result.rejections).toEqual([]);
+      expect(result.reviewReady).toBe(false);
+      expect(result.rejections).toContainEqual({
+        type: 'NO_REPORT_FROM_AGENT_BOT',
+        detail: 'NO_REPORT_FROM_AGENT_BOT',
+      });
     });
 
     it('should reject when last comment author is not in allowedIssueAuthors list', async () => {
@@ -353,5 +363,27 @@ describe('CheckIssueReviewReadinessUseCase', () => {
       expect(result.reviewReady).toBe(true);
       expect(result.rejections).toEqual([]);
     });
+
+    it('should accept author when allowedIssueAuthors is an empty array (fail-closed)', async () => {
+      const issue = createMockIssue();
+      mockIssueRepository.getIssueByUrl.mockResolvedValue(issue);
+      mockIssueCommentRepository.getCommentsFromIssue.mockResolvedValue([
+        createMockComment({ author: 'any-author' }),
+      ]);
+      mockIssueRepository.findRelatedOpenPRs.mockResolvedValue([
+        createReadyPr(),
+      ]);
+
+      const result = await useCase.run({
+        issueUrl: 'https://github.com/user/repo/issues/1',
+        allowedIssueAuthors: [],
+      });
+
+      expect(result.reviewReady).toBe(false);
+      expect(result.rejections).toContainEqual({
+        type: 'NO_REPORT_FROM_AGENT_BOT',
+        detail: 'NO_REPORT_FROM_AGENT_BOT',
+      });
+    });
   });
 });

package/src/domain/usecases/CheckIssueReviewReadinessUseCase.ts

@@ -8,6 +8,7 @@ import { resolveLabelsNotRequiringPullRequest } from './resolveLabelsNotRequirin
 import { isPullRequestDeclaredUnnecessary } from './isPullRequestDeclaredUnnecessary';
 import { normalizeReportBody } from './normalizeReportBody';
 import { isAgentReportBody } from './isAgentReportBody';
+import { isAuthorAuthorizedForAutoStatusCheck } from './isAuthorAuthorizedForAutoStatusCheck';
 
 type RejectedReasonType =
   | 'ISSUE_NOT_FOUND'
@@ -67,7 +68,7 @@ export class CheckIssueReviewReadinessUseCase {
       await this.issueCommentRepository.getCommentsFromIssue(issue);
 
     const isTrustedAuthor = (author: string): boolean =>
-      this.isAuthorTrusted(author, params.allowedIssueAuthors ?? null);
+      isAuthorAuthorizedForAutoStatusCheck(author, params.allowedIssueAuthors);
 
     const lastComment = comments[comments.length - 1];
     if (
@@ -110,12 +111,6 @@ export class CheckIssueReviewReadinessUseCase {
     };
   };
 
-  private isAuthorTrusted = (
-    author: string,
-    allowedIssueAuthors: string[] | null,
-  ): boolean =>
-    allowedIssueAuthors === null || allowedIssueAuthors.includes(author);
-
   private reportBodyHasNextStep = (body: string): boolean => {
     const reportMatch = normalizeReportBody(body).match(
       /```json\n([\s\S]*?)\n```/,