relay-flow 0.2.0-alpha → 0.2.2-alpha

package/internal/task/jira/auth.go

@@ -0,0 +1,209 @@
+package jira
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/charmbracelet/huh"
+	"github.com/mattn/go-isatty"
+	"github.com/rajpopat27/relay-flow/internal/config"
+	jirarest "github.com/rajpopat27/relay-flow/internal/task/jira/rest"
+	"gopkg.in/yaml.v3"
+)
+
+type credentials struct {
+	Site  string `yaml:"site"`
+	Email string `yaml:"email"`
+	Token string `yaml:"token"`
+}
+
+func auth(ctx context.Context, args []string, stdin io.Reader) error {
+	fs := flag.NewFlagSet("task auth", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	site := fs.String("site", "", "Jira site URL")
+	email := fs.String("email", "", "Jira account email")
+	token := fs.String("token", "", "Jira API token")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 {
+		return errors.New("unexpected positional arguments")
+	}
+
+	values := credentials{Site: strings.TrimSpace(*site), Email: strings.TrimSpace(*email), Token: *token}
+	flagged := values.Site != "" || values.Email != "" || values.Token != ""
+	if flagged && (values.Site == "" || values.Email == "" || values.Token == "") {
+		return errors.New("--site, --email, and --token must be given together")
+	}
+	if !flagged {
+		if isTTY(stdin) {
+			var err error
+			values, err = promptCredentials(values)
+			if err != nil {
+				return err
+			}
+		} else {
+			var ok bool
+			values, ok = readCredentialLines(stdin)
+			if !ok {
+				return errors.New("expected Jira site, email, and API token on stdin (or pass --site, --email, and --token)")
+			}
+		}
+	}
+
+	client, err := jirarest.New(values.Site, values.Email, values.Token)
+	if err != nil {
+		return err
+	}
+	if err := client.ValidateCredentials(ctx); err != nil {
+		return err
+	}
+	values.Site = strings.TrimRight(clientSite(values.Site), "/")
+	path, err := credentialsPath()
+	if err != nil {
+		return err
+	}
+	_, statErr := os.Stat(path)
+	firstAuth := os.IsNotExist(statErr)
+	if statErr != nil && !firstAuth {
+		return fmt.Errorf("stat credentials %s: %w", path, statErr)
+	}
+	if err := saveCredentials(path, values); err != nil {
+		return err
+	}
+	if !firstAuth {
+		return nil
+	}
+	return defaultAssignee(filepath.Join(filepath.Dir(path), "config.yaml"), values.Email)
+}
+
+func defaultAssignee(path, email string) error {
+	cfg, err := config.LoadMachine(path)
+	if err != nil {
+		return err
+	}
+	if _, configured := cfg.TaskConfig["assignee"]; configured {
+		return nil
+	}
+	if cfg.TaskConfig == nil {
+		cfg.TaskConfig = config.RawValues{}
+	}
+	cfg.TaskConfig["assignee"] = email
+	return config.SaveMachine(path, cfg)
+}
+
+func isTTY(stdin io.Reader) bool {
+	f, ok := stdin.(*os.File)
+	return ok && isatty.IsTerminal(f.Fd())
+}
+
+func promptCredentials(values credentials) (credentials, error) {
+	required := func(name string) func(string) error {
+		return func(value string) error {
+			if strings.TrimSpace(value) == "" {
+				return fmt.Errorf("%s is required", name)
+			}
+			return nil
+		}
+	}
+	form := huh.NewForm(huh.NewGroup(
+		huh.NewInput().Title("Jira site").Description("Your Atlassian site URL.").Placeholder("https://company.atlassian.net").Validate(required("Jira site")).Value(&values.Site),
+		huh.NewInput().Title("Jira email").Description("Email for the Jira API token.").Placeholder("you@company.com").Validate(required("Jira email")).Value(&values.Email),
+		huh.NewInput().Title("Jira API token").Description("Stored locally and never displayed.").EchoMode(huh.EchoModePassword).Validate(required("Jira API token")).Value(&values.Token),
+	).Title("Configure Jira"))
+	if err := form.Run(); err != nil {
+		return credentials{}, err
+	}
+	values.Site = strings.TrimSpace(values.Site)
+	values.Email = strings.TrimSpace(values.Email)
+	return values, nil
+}
+
+func readCredentialLines(stdin io.Reader) (credentials, bool) {
+	values := make([]string, 0, 3)
+	scanner := bufio.NewScanner(stdin)
+	for len(values) < 3 && scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line != "" {
+			values = append(values, line)
+		}
+	}
+	if len(values) != 3 {
+		return credentials{}, false
+	}
+	return credentials{Site: values[0], Email: values[1], Token: values[2]}, true
+}
+
+func clientSite(site string) string {
+	if !strings.Contains(site, "://") {
+		return "https://" + site
+	}
+	return site
+}
+
+func credentialsPath() (string, error) {
+	if root := os.Getenv("RELAY_FLOW_HOME"); root != "" {
+		return filepath.Join(root, "credentials.yaml"), nil
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("resolve user home: %w", err)
+	}
+	return filepath.Join(home, ".relay-flow", "credentials.yaml"), nil
+}
+
+func loadCredentialsDefault() (credentials, error) {
+	path, err := credentialsPath()
+	if err != nil {
+		return credentials{}, err
+	}
+	return loadCredentials(path)
+}
+
+func loadCredentials(path string) (credentials, error) {
+	info, err := os.Stat(path)
+	if err != nil {
+		return credentials{}, fmt.Errorf("stat credentials %s: %w", path, err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		return credentials{}, fmt.Errorf("credentials %s must have mode 0600", path)
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return credentials{}, fmt.Errorf("read credentials %s: %w", path, err)
+	}
+	var out credentials
+	decoder := yaml.NewDecoder(strings.NewReader(string(raw)))
+	decoder.KnownFields(true)
+	if err := decoder.Decode(&out); err != nil {
+		return credentials{}, fmt.Errorf("parse credentials %s: %w", path, err)
+	}
+	if out.Site == "" || out.Email == "" || out.Token == "" {
+		return credentials{}, errors.New("Jira site, email, and API token are required")
+	}
+	return out, nil
+}
+
+func saveCredentials(path string, value credentials) error {
+	if value.Site == "" || value.Email == "" || value.Token == "" {
+		return errors.New("Jira site, email, and API token are required")
+	}
+	raw, err := yaml.Marshal(value)
+	if err != nil {
+		return fmt.Errorf("marshal credentials: %w", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return fmt.Errorf("create credentials directory: %w", err)
+	}
+	if err := config.WriteAtomic(path, raw, 0o600); err != nil {
+		return fmt.Errorf("write credentials: %w", err)
+	}
+	return nil
+}

package/internal/task/jira/auth_test.go

@@ -0,0 +1,160 @@
+package jira
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/task"
+)
+
+func authServer(t *testing.T, valid bool) *httptest.Server {
+	t.Helper()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user, token, ok := r.BasicAuth()
+		if !ok || user != "bot@example.com" || token != "secret" || !valid {
+			http.Error(w, "invalid bot@example.com secret", http.StatusUnauthorized)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/rest/api/3/myself":
+			fmt.Fprint(w, `{"accountId":"bot"}`)
+		case "/rest/api/3/user/assignable/search":
+			fmt.Fprint(w, `[{"accountId":"bot","emailAddress":"bot@example.com","displayName":"Relay Bot"}]`)
+		case "/rest/api/3/project/PAY/statuses":
+			fmt.Fprint(w, `[{"id":"1","subtask":true,"statuses":[{"name":"To Do"},{"name":"In Progress"},{"name":"Done"}]}]`)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(server.Close)
+	return server
+}
+
+func TestAuthWritesLoadsAndNewUsesJiraOwnedCredentials(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("RELAY_FLOW_HOME", root)
+	configPath := filepath.Join(root, "config.yaml")
+	if err := config.SaveMachine(configPath, &config.Machine{TaskPlugin: "jira"}); err != nil {
+		t.Fatal(err)
+	}
+	server := authServer(t, true)
+	if err := task.Auth(context.Background(), "jira", []string{
+		"--site", server.URL, "--email", "bot@example.com", "--token", "secret",
+	}, strings.NewReader("")); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "credentials.yaml")
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Fatalf("credentials mode = %o, want 600", info.Mode().Perm())
+	}
+	got, err := loadCredentials(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Site != server.URL || got.Email != "bot@example.com" || got.Token != "secret" {
+		t.Fatalf("credentials = %+v", got)
+	}
+	machine, err := config.LoadMachine(configPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if machine.TaskConfig["assignee"] != "bot@example.com" {
+		t.Fatalf("default assignee = %v", machine.TaskConfig["assignee"])
+	}
+	if _, err := task.New(context.Background(), "jira", task.RepoSpec{
+		Name: "payments", RootConfig: machine.TaskConfig,
+		RepoConfig: config.RawValues{"project": "PAY", "component": "api"},
+	}); err != nil {
+		t.Fatalf("task.New did not load Jira-owned credentials: %v", err)
+	}
+}
+
+func TestAuthPreservesConfiguredAndLaterRemovedAssignee(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		firstAuth  bool
+		taskConfig config.RawValues
+		want       string
+		wantKey    bool
+	}{
+		{name: "configured on first auth", firstAuth: true, taskConfig: config.RawValues{"assignee": "configured@example.com"}, want: "configured@example.com", wantKey: true},
+		{name: "configured on later auth", taskConfig: config.RawValues{"assignee": "configured@example.com"}, want: "configured@example.com", wantKey: true},
+		{name: "removed on later auth", taskConfig: config.RawValues{}, wantKey: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			root := t.TempDir()
+			t.Setenv("RELAY_FLOW_HOME", root)
+			if err := config.SaveMachine(filepath.Join(root, "config.yaml"), &config.Machine{TaskPlugin: "jira", TaskConfig: tc.taskConfig}); err != nil {
+				t.Fatal(err)
+			}
+			if !tc.firstAuth {
+				if err := saveCredentials(filepath.Join(root, "credentials.yaml"), credentials{Site: "https://old.example.com", Email: "old@example.com", Token: "old"}); err != nil {
+					t.Fatal(err)
+				}
+			}
+			server := authServer(t, true)
+			if err := auth(context.Background(), []string{"--site", server.URL, "--email", "bot@example.com", "--token", "secret"}, strings.NewReader("")); err != nil {
+				t.Fatal(err)
+			}
+			machine, err := config.LoadMachine(filepath.Join(root, "config.yaml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			got, exists := machine.TaskConfig["assignee"]
+			if exists != tc.wantKey || (exists && got != tc.want) {
+				t.Fatalf("assignee = %v, exists = %v; want %q, exists = %v", got, exists, tc.want, tc.wantKey)
+			}
+		})
+	}
+}
+
+func TestAuthRejectsInvalidCredentialsWithoutWriting(t *testing.T) {
+	root := t.TempDir()
+	t.Setenv("RELAY_FLOW_HOME", root)
+	server := authServer(t, false)
+	err := auth(context.Background(), []string{
+		"--site", server.URL, "--email", "bot@example.com", "--token", "secret",
+	}, strings.NewReader(""))
+	if err == nil {
+		t.Fatal("invalid credentials accepted")
+	}
+	if strings.Contains(err.Error(), "secret") || strings.Contains(err.Error(), "bot@example.com") {
+		t.Fatalf("credential error exposed a secret: %v", err)
+	}
+	if _, statErr := os.Stat(filepath.Join(root, "credentials.yaml")); !os.IsNotExist(statErr) {
+		t.Fatalf("invalid auth wrote credentials: %v", statErr)
+	}
+}
+
+func TestLoadCredentialsRejectsPermissionsAndMalformedSecrets(t *testing.T) {
+	t.Run("permissions", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "credentials.yaml")
+		if err := os.WriteFile(path, []byte("site: https://jira.example.com\nemail: bot@example.com\ntoken: secret\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := loadCredentials(path); err == nil || !strings.Contains(err.Error(), "0600") {
+			t.Fatalf("permission error = %v", err)
+		}
+	})
+	t.Run("redaction", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "credentials.yaml")
+		if err := os.WriteFile(path, []byte("token: [super-secret"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := loadCredentials(path); err == nil || strings.Contains(err.Error(), "super-secret") {
+			t.Fatalf("malformed credential error = %v", err)
+		}
+	})
+}

package/internal/task/jira/effects_test.go

@@ -0,0 +1,39 @@
+package jira
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/task"
+)
+
+func TestClaimUsesOneLabelAdd(t *testing.T) {
+	fake := &fakeJira{}
+	sys := newSystemWithFake(t, fake)
+	if err := sys.Claim(context.Background(), task.TicketRef{Key: "PAY-1"}, "flow"); err != nil {
+		t.Fatal(err)
+	}
+	if len(fake.labelCalls) != 1 || fake.labelCalls[0] != "PAY-1:wf:flow" {
+		t.Fatalf("label calls = %v, want one claim update", fake.labelCalls)
+	}
+}
+
+func TestCommentKeepsMarkerIdempotency(t *testing.T) {
+	fake := &fakeJira{comments: []string{"existing\n<!-- visit:summary -->"}}
+	sys := newSystemWithFake(t, fake)
+	target := task.Target{Parent: task.TicketRef{Key: "PAY-1"}}
+	if err := sys.Comment(context.Background(), target, "summary", "visit:summary"); err != nil {
+		t.Fatal(err)
+	}
+	if len(fake.addedComments) != 0 {
+		t.Fatal("duplicate marked comment was posted")
+	}
+	fake.comments = nil
+	if err := sys.Comment(context.Background(), target, "summary", "visit:summary"); err != nil {
+		t.Fatal(err)
+	}
+	if len(fake.addedComments) != 1 || !strings.Contains(fake.addedComments[0], "visit:summary") {
+		t.Fatalf("posted comments = %v", fake.addedComments)
+	}
+}

package/internal/task/jira/filters_test.go

@@ -30,7 +30,7 @@ func (p *pollCountingSystem) Poll(ctx context.Context) ([]task.Ticket, error) {
 }
 
 func TestCompileFilterMatchesNormalizedFields(t *testing.T) {
-	sys := newSystemWithFake(t, &fakeACLI{})
+	sys := newSystemWithFake(t, &fakeJira{})
 
 	match, err := sys.CompileFilter(config.RawValues{
 		"filters": map[string]any{
@@ -57,7 +57,7 @@ func TestCompileFilterMatchesNormalizedFields(t *testing.T) {
 }
 
 func TestCompileFilterRejectsNonMatching(t *testing.T) {
-	sys := newSystemWithFake(t, &fakeACLI{})
+	sys := newSystemWithFake(t, &fakeJira{})
 	match, err := sys.CompileFilter(config.RawValues{
 		"filters": map[string]any{"parentStatuses": []any{"To Do"}},
 	})
@@ -80,7 +80,7 @@ func TestCompileFilterRejectsNonMatching(t *testing.T) {
 }
 
 func TestCompileFilterRejectsUnknownField(t *testing.T) {
-	sys := newSystemWithFake(t, &fakeACLI{})
+	sys := newSystemWithFake(t, &fakeJira{})
 	if _, err := sys.CompileFilter(config.RawValues{
 		"filters": map[string]any{"jql": "project = PAY"},
 	}); err == nil {
@@ -91,7 +91,7 @@ func TestCompileFilterRejectsUnknownField(t *testing.T) {
 func TestMatchingIsInMemoryNoRequery(t *testing.T) {
 	// One repo poll fetches the batch; the compiled matcher then evaluates
 	// every ticket in memory with no per-workflow re-query.
-	fake := &fakeACLI{searchJSON: []byte(`[{"id":"1","key":"PAY-1","fields":{"summary":"a","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":[]}},{"id":"2","key":"PAY-2","fields":{"summary":"b","status":{"name":"Done"},"issuetype":{"name":"Task"},"labels":[]}},{"id":"3","key":"PAY-3","fields":{"summary":"c","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":[]}}]`)}
+	fake := &fakeJira{searchJSON: []byte(`[{"id":"1","key":"PAY-1","fields":{"summary":"a","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":[]}},{"id":"2","key":"PAY-2","fields":{"summary":"b","status":{"name":"Done"},"issuetype":{"name":"Task"},"labels":[]}},{"id":"3","key":"PAY-3","fields":{"summary":"c","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":[]}}]`)}
 	base := newSystemWithFake(t, fake)
 	counting := &pollCountingSystem{System: base}
 
@@ -130,7 +130,7 @@ func TestJiraJSONNormalization(t *testing.T) {
 	// The adapter normalizes Jira search JSON (status, issue type, labels,
 	// assignee) into task.Ticket.Fields. Package-local so it can call the
 	// adapter's unexported normalization directly.
-	// acli emits a BARE ARRAY of issue objects (no REST envelope), and the
+	// The REST boundary supplies a normalized array of issue objects, and the
 	// normalized assignee is the user's email address — the stable identity
 	// workflow filters match on, not the human-readable display name.
 	raw := []byte(`[{"id":"1","key":"PAY-101","fields":{"summary":"parent","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":["coding"],"assignee":{"displayName":"Relay Bot","emailAddress":"relay@bot"}}}]`)
@@ -159,21 +159,41 @@ func TestJiraJSONNormalization(t *testing.T) {
 	}
 }
 
-func TestJiraJSONNormalizationParsesRealAcliSearchShape(t *testing.T) {
-	// 9.9: parse the REAL acli wire shape captured live from
-	//   acli jira workitem search --jql ... --fields key,summary,status,issuetype,labels,assignee --json
-	// Fixture stored under testdata/ so regressions in the parser are
-	// caught against the actual acli contract, not a hand-written envelope.
-	raw, err := os.ReadFile("testdata/acli_search.json")
+func TestJiraJSONNormalizationFiltersOnlyOpenInwardBlockers(t *testing.T) {
+	raw := []byte(`[
+		{"id":"1","key":"PAY-1","fields":{"summary":"open blocker","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":[],"issuelinks":[
+			{"type":{"name":"Blocks"},"inwardIssue":{"key":"OTHER-1","fields":{"status":{"statusCategory":{"key":"done"}}}}},
+			{"type":{"name":"Blocks"},"inwardIssue":{"key":"OTHER-2","fields":{"status":{"statusCategory":{"key":"new"}}}}}
+		]}},
+		{"id":"2","key":"PAY-2","fields":{"summary":"closed blockers","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":[],"issuelinks":[
+			{"type":{"name":"Blocks"},"inwardIssue":{"key":"OTHER-3","fields":{"status":{"statusCategory":{"key":"done"}}}}}
+		]}},
+		{"id":"3","key":"PAY-3","fields":{"summary":"blocks another","status":{"name":"To Do"},"issuetype":{"name":"Task"},"labels":[],"issuelinks":[
+			{"type":{"name":"Blocks"},"outwardIssue":{"key":"OTHER-4","fields":{"status":{"statusCategory":{"key":"new"}}}}}
+		]}}
+	]`)
+	tickets, err := normalizeSearchResponse(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(tickets) != 2 || tickets[0].Key != "PAY-2" || tickets[1].Key != "PAY-3" {
+		t.Fatalf("eligible tickets = %+v, want PAY-2 and PAY-3", tickets)
+	}
+}
+
+func TestJiraJSONNormalizationParsesCapturedIssueShape(t *testing.T) {
+	// Preserve the captured issue-field fixture while the REST client contract
+	// itself is exercised through strict HTTP tests.
+	raw, err := os.ReadFile("testdata/jira_search_issues.json")
 	if err != nil {
-		t.Fatalf("read acli fixture: %v", err)
+		t.Fatalf("read Jira fixture: %v", err)
 	}
 	tickets, err := normalizeSearchResponse(raw)
 	if err != nil {
-		t.Fatalf("normalization of real acli output failed: %v", err)
+		t.Fatalf("normalization of captured Jira output failed: %v", err)
 	}
 	if len(tickets) == 0 {
-		t.Fatal("real acli fixture yielded no tickets")
+		t.Fatal("captured Jira fixture yielded no tickets")
 	}
 	for _, tk := range tickets {
 		if tk.Key == "" || tk.ID == "" {
@@ -197,7 +217,7 @@ func TestJiraJSONNormalizationParsesRealAcliSearchShape(t *testing.T) {
 func TestCompileFilterAssigneeMatchesEmail(t *testing.T) {
 	// 9.9: workflow assignee filters match the normalized EMAIL identity,
 	// not the display name. e2e workflow.yaml filters on the user's email.
-	sys := newSystemWithFake(t, &fakeACLI{})
+	sys := newSystemWithFake(t, &fakeJira{})
 	match, err := sys.CompileFilter(config.RawValues{
 		"filters": map[string]any{"assignees": []any{"raj.popat@example.com"}},
 	})
@@ -218,7 +238,7 @@ func TestCompileFilterAssigneeMatchAndMismatch(t *testing.T) {
 	// assignee"); it matches the normalized ticket's assignee field.
 	// NOTE: the filter key `assignees` follows the same naming as
 	// parentStatuses/issueTypes/labels (plural); the docs do not pin the key.
-	sys := newSystemWithFake(t, &fakeACLI{})
+	sys := newSystemWithFake(t, &fakeJira{})
 	match, err := sys.CompileFilter(config.RawValues{
 		"filters": map[string]any{"assignees": []any{"relay-bot@example.com"}},
 	})
@@ -232,3 +252,63 @@ func TestCompileFilterAssigneeMatchAndMismatch(t *testing.T) {
 		t.Fatal("non-matching assignee accepted")
 	}
 }
+
+func TestCompileFilterInheritsEffectiveAssigneeCaseInsensitively(t *testing.T) {
+	sys, err := newSystem(context.Background(), &fakeClient{fake: &fakeJira{}}, task.RepoSpec{
+		Name:       "payments",
+		RootConfig: config.RawValues{"assignee": "root@example.com"},
+		RepoConfig: config.RawValues{"project": "PAY", "component": "api", "assignee": "Repo.Bot@Example.com"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	match, err := sys.CompileFilter(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !match(task.Ticket{Fields: map[string]any{"assignee": "repo.bot@example.COM"}}) {
+		t.Fatal("effective repo assignee did not match normalized email case-insensitively")
+	}
+	if match(task.Ticket{Fields: map[string]any{"assignee": "other@example.com"}}) {
+		t.Fatal("ticket assigned to another user matched effective assignee")
+	}
+}
+
+func TestCompileFilterWorkflowAssigneesOverrideEffectiveAssignee(t *testing.T) {
+	sys, err := newSystem(context.Background(), &fakeClient{fake: &fakeJira{}}, task.RepoSpec{
+		Name:       "payments",
+		RootConfig: config.RawValues{"assignee": "root@example.com"},
+		RepoConfig: config.RawValues{"project": "PAY", "component": "api"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	match, err := sys.CompileFilter(config.RawValues{
+		"assignee": "workflow@example.com",
+		"filters":  map[string]any{"assignees": []any{"selected@example.com"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !match(task.Ticket{Fields: map[string]any{"assignee": "SELECTED@example.com"}}) {
+		t.Fatal("explicit workflow assignee filter did not win")
+	}
+	for _, email := range []string{"root@example.com", "workflow@example.com"} {
+		if match(task.Ticket{Fields: map[string]any{"assignee": email}}) {
+			t.Fatalf("effective assignee %q overrode explicit filter", email)
+		}
+	}
+}
+
+func TestCompileFilterWithoutAssigneeDoesNotFilter(t *testing.T) {
+	sys := newSystemWithFake(t, &fakeJira{})
+	match, err := sys.CompileFilter(config.RawValues{
+		"filters": map[string]any{"assignees": []any{}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !match(task.Ticket{Fields: map[string]any{"assignee": "anyone@example.com"}}) {
+		t.Fatal("empty explicit assignee filter rejected a ticket")
+	}
+}

package/internal/task/jira/helpers_test.go

@@ -4,19 +4,21 @@ import (
 	"context"
 
 	"github.com/rajpopat27/relay-flow/internal/task"
+	"github.com/rajpopat27/relay-flow/internal/task/jira/rest"
 )
 
-// fakeClient adapts the test-local fakeACLI (transitions + raw search batch)
-// to the production acli.Client seam.
+// fakeClient adapts the test-local Jira fake to the production REST seam.
 type fakeClient struct {
-	fake *fakeACLI
+	fake *fakeJira
 }
 
 func (f *fakeClient) Search(context.Context, string) ([]byte, error) {
 	return f.fake.searchJSON, nil
 }
 
-func (f *fakeClient) ValidateAssignee(context.Context, string) error { return nil }
+func (f *fakeClient) ValidateCredentials(context.Context) error { return nil }
+
+func (f *fakeClient) ValidateAssignee(context.Context, string, string) error { return nil }
 
 func (f *fakeClient) ValidateStatus(context.Context, string, string) error { return nil }
 
@@ -24,29 +26,37 @@ func (f *fakeClient) View(context.Context, string) ([]byte, error) {
 	return []byte(`{"fields":{"labels":[],"subtasks":[]}}`), nil
 }
 
-func (f *fakeClient) CreateSubtask(context.Context, string, string, string) (string, string, error) {
-	return "", "", errNotFaked
-}
-
-func (f *fakeClient) Assign(_ context.Context, key, assignee string) error {
-	f.fake.assignments = append(f.fake.assignments, key+":"+assignee)
-	f.fake.events = append(f.fake.events, "assign")
-	return f.fake.assignErr
+func (f *fakeClient) CreateSubtasks(context.Context, string, string, string, []rest.SubtaskSpec) ([]rest.CreatedSubtask, error) {
+	return nil, errNotFaked
 }
 
-func (f *fakeClient) Transition(_ context.Context, key, status string) error {
+func (f *fakeClient) Transition(_ context.Context, key, status, assignee string) error {
+	if assignee != "" {
+		f.fake.assignments = append(f.fake.assignments, key+":"+assignee)
+		if f.fake.assignErr != nil {
+			return f.fake.assignErr
+		}
+	}
 	f.fake.events = append(f.fake.events, "transition")
 	f.fake.transition(key, status)
 	return nil
 }
 
-func (f *fakeClient) EnsureLabel(context.Context, string, string) error { return nil }
+func (f *fakeClient) EnsureLabel(_ context.Context, key, label string) error {
+	f.fake.labelCalls = append(f.fake.labelCalls, key+":"+label)
+	return nil
+}
 
-func (f *fakeClient) UpdateDescription(context.Context, string, string) error { return nil }
+func (f *fakeClient) UpdateMailbox(context.Context, string, string, string) error { return nil }
 
-func (f *fakeClient) ListComments(context.Context, string) ([]string, error) { return nil, nil }
+func (f *fakeClient) ListComments(context.Context, string) ([]string, error) {
+	return append([]string(nil), f.fake.comments...), nil
+}
 
-func (f *fakeClient) AddComment(context.Context, string, string) error { return nil }
+func (f *fakeClient) AddComment(_ context.Context, _ string, body string) error {
+	f.fake.addedComments = append(f.fake.addedComments, body)
+	return nil
+}
 
 type notFakedError struct{}
 
@@ -54,7 +64,7 @@ func (notFakedError) Error() string { return "not faked" }
 
 var errNotFaked = notFakedError{}
 
-// newSystemForTest builds the adapter around the test-local fake ACLI seam.
-func newSystemForTest(fake *fakeACLI) (task.System, error) {
+// newSystemForTest builds the adapter around the test-local REST seam.
+func newSystemForTest(fake *fakeJira) (task.System, error) {
 	return newSystemForCLI(&fakeClient{fake: fake})
 }