reviewflow 3.32.0 → 3.33.0

package/dist/tests/units/modules/platform-integration/usecases/transport/evaluateTransport.usecase.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluateTransport.usecase.test.d.ts","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/platform-integration/usecases/transport/evaluateTransport.usecase.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/platform-integration/usecases/transport/evaluateTransport.usecase.test.js

@@ -0,0 +1,69 @@
+import { describe, it, expect } from 'vitest';
+import { evaluateTransport } from '../../../../../../modules/platform-integration/usecases/transport/evaluateTransport.usecase.js';
+import { TransportContextFactory } from '../../../../../../tests/factories/transportContext.factory.js';
+describe('evaluateTransport', () => {
+    describe('AC1 - untrusted socket', () => {
+        it('rejects with 403 when the direct socket address is not the trusted hop, ignoring headers', () => {
+            const context = TransportContextFactory.valid({
+                directSocketAddress: '203.0.113.7',
+                forwardedProto: 'https',
+                resolvedClientIp: '10.20.30.40',
+            });
+            const decision = evaluateTransport(context);
+            expect(decision).toEqual({ kind: 'reject', status: 403, reason: 'untrusted-socket' });
+        });
+        it('does not consult the protocol or client ip once the socket fails', () => {
+            const context = TransportContextFactory.valid({
+                directSocketAddress: '203.0.113.7',
+                forwardedProto: 'http',
+                resolvedClientIp: null,
+                allowedCidrRanges: [],
+            });
+            const decision = evaluateTransport(context);
+            expect(decision.kind).toBe('reject');
+        });
+    });
+    describe('AC2 - non-https', () => {
+        it('rejects with 403 when the forwarded protocol is not https', () => {
+            const context = TransportContextFactory.valid({ forwardedProto: 'http' });
+            const decision = evaluateTransport(context);
+            expect(decision).toEqual({ kind: 'reject', status: 403, reason: 'non-https' });
+        });
+        it('rejects with 403 when no forwarded protocol is present', () => {
+            const context = TransportContextFactory.valid({ forwardedProto: null });
+            const decision = evaluateTransport(context);
+            expect(decision).toEqual({ kind: 'reject', status: 403, reason: 'non-https' });
+        });
+    });
+    describe('AC3 - allowlisted, https, hop-trusted', () => {
+        it('accepts a fully valid transport context', () => {
+            const context = TransportContextFactory.valid();
+            const decision = evaluateTransport(context);
+            expect(decision).toEqual({ kind: 'accept' });
+        });
+    });
+    describe('AC4 - off-allowlist', () => {
+        it('rejects with 403 when the resolved client ip is outside every configured range', () => {
+            const context = TransportContextFactory.valid({
+                resolvedClientIp: '192.168.1.1',
+                allowedCidrRanges: ['10.20.30.0/24'],
+            });
+            const decision = evaluateTransport(context);
+            expect(decision).toEqual({ kind: 'reject', status: 403, reason: 'off-allowlist' });
+        });
+        it('rejects with 403 when the client ip could not be resolved', () => {
+            const context = TransportContextFactory.valid({ resolvedClientIp: null });
+            const decision = evaluateTransport(context);
+            expect(decision).toEqual({ kind: 'reject', status: 403, reason: 'off-allowlist' });
+        });
+        it('accepts when the resolved client ip falls inside one of several ranges', () => {
+            const context = TransportContextFactory.valid({
+                resolvedClientIp: '172.16.5.9',
+                allowedCidrRanges: ['10.0.0.0/8', '172.16.0.0/12'],
+            });
+            const decision = evaluateTransport(context);
+            expect(decision).toEqual({ kind: 'accept' });
+        });
+    });
+});
+//# sourceMappingURL=evaluateTransport.usecase.test.js.map

package/dist/tests/units/modules/platform-integration/usecases/transport/evaluateTransport.usecase.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluateTransport.usecase.test.js","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/platform-integration/usecases/transport/evaluateTransport.usecase.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gFAAgF,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AAExF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,0FAA0F,EAAE,GAAG,EAAE;YAClG,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC;gBAC5C,mBAAmB,EAAE,aAAa;gBAClC,cAAc,EAAE,OAAO;gBACvB,gBAAgB,EAAE,aAAa;aAChC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC;gBAC5C,mBAAmB,EAAE,aAAa;gBAClC,cAAc,EAAE,MAAM;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,iBAAiB,EAAE,EAAE;aACtB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;YAE1E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAExE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACrD,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAC;YAEhD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;YACxF,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC;gBAC5C,gBAAgB,EAAE,aAAa;gBAC/B,iBAAiB,EAAE,CAAC,eAAe,CAAC;aACrC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;YAChF,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC;gBAC5C,gBAAgB,EAAE,YAAY;gBAC9B,iBAAiB,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;aACnD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/units/modules/review-execution/entities/actionProvenance/actionProvenance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=actionProvenance.test.d.ts.map

package/dist/tests/units/modules/review-execution/entities/actionProvenance/actionProvenance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionProvenance.test.d.ts","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/review-execution/entities/actionProvenance/actionProvenance.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/review-execution/entities/actionProvenance/actionProvenance.test.js

@@ -0,0 +1,26 @@
+import { resolveProvenance } from '../../../../../../modules/review-execution/entities/actionProvenance/actionProvenance.js';
+describe('resolveProvenance (AC-1 fail-closed provenance)', () => {
+    const nonCanonical = [
+        undefined,
+        null,
+        '',
+        'TRUSTED',
+        'trusted ',
+        ' trusted',
+        'Trusted',
+        'untrusted',
+        'admin',
+        {},
+        0,
+        true,
+    ];
+    for (const input of nonCanonical) {
+        it(`resolves non-canonical input ${JSON.stringify(input)} to untrusted`, () => {
+            expect(resolveProvenance(input)).toBe('untrusted');
+        });
+    }
+    it('resolves the exact canonical token "trusted" to trusted', () => {
+        expect(resolveProvenance('trusted')).toBe('trusted');
+    });
+});
+//# sourceMappingURL=actionProvenance.test.js.map

package/dist/tests/units/modules/review-execution/entities/actionProvenance/actionProvenance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionProvenance.test.js","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/review-execution/entities/actionProvenance/actionProvenance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0EAA0E,CAAA;AAE5G,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC/D,MAAM,YAAY,GAAc;QAC9B,SAAS;QACT,IAAI;QACJ,EAAE;QACF,SAAS;QACT,UAAU;QACV,UAAU;QACV,SAAS;QACT,WAAW;QACX,OAAO;QACP,EAAE;QACF,CAAC;QACD,IAAI;KACL,CAAA;IAED,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,EAAE,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE;YAC5E,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=threadInventory.gitlab.gateway.test.d.ts.map

package/dist/tests/units/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threadInventory.gitlab.gateway.test.d.ts","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.test.js

@@ -0,0 +1,44 @@
+import { GitLabThreadInventoryGateway } from '../../../../../../modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.js';
+class RecordingExecutor {
+    commands = [];
+    responses = [];
+    setResponses(responses) {
+        this.responses = responses;
+    }
+    run = (command) => {
+        this.commands.push(command);
+        const index = this.commands.length - 1;
+        const response = this.responses[index];
+        if (!response)
+            throw new Error('no response configured');
+        return `${response.headers}\r\n\r\n${response.body}`;
+    };
+}
+describe('GitLabThreadInventoryGateway', () => {
+    it('requests the discussions endpoint with the pinned project and MR, including headers', () => {
+        const executor = new RecordingExecutor();
+        executor.setResponses([
+            {
+                headers: 'X-Total-Pages: 1',
+                body: JSON.stringify([{ id: 'd1' }, { id: 'd2' }]),
+            },
+        ]);
+        const gateway = new GitLabThreadInventoryGateway(executor.run);
+        const page = gateway.fetchPage('group/sub/project', 7, 1);
+        expect(executor.commands[0]).toContain('group%2Fsub%2Fproject');
+        expect(executor.commands[0]).toContain('/merge_requests/7/discussions');
+        expect(executor.commands[0]).toContain('page=1');
+        expect(page.totalPages).toBe(1);
+        expect(page.threadIds.sort()).toEqual(['d1', 'd2']);
+    });
+    it('reads totalPages from the X-Total-Pages header so completeness can be proven', () => {
+        const executor = new RecordingExecutor();
+        executor.setResponses([
+            { headers: 'X-Total-Pages: 3', body: JSON.stringify([{ id: 'a' }]) },
+        ]);
+        const gateway = new GitLabThreadInventoryGateway(executor.run);
+        const page = gateway.fetchPage('g/p', 1, 1);
+        expect(page.totalPages).toBe(3);
+    });
+});
+//# sourceMappingURL=threadInventory.gitlab.gateway.test.js.map

package/dist/tests/units/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threadInventory.gitlab.gateway.test.js","sourceRoot":"","sources":["../../../../../../../src/tests/units/modules/review-execution/interface-adapters/gateways/threadInventory.gitlab.gateway.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,0FAA0F,CAAA;AAEvI,MAAM,iBAAiB;IACZ,QAAQ,GAAa,EAAE,CAAA;IACxB,SAAS,GAA6C,EAAE,CAAA;IAChE,YAAY,CAAC,SAAmD;QAC9D,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IACD,GAAG,GAAG,CAAC,OAAe,EAAU,EAAE;QAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QACxD,OAAO,GAAG,QAAQ,CAAC,OAAO,WAAW,QAAQ,CAAC,IAAI,EAAE,CAAA;IACtD,CAAC,CAAA;CACF;AAED,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAA;QACxC,QAAQ,CAAC,YAAY,CAAC;YACpB;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;aACnD;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,IAAI,4BAA4B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAEzD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;QAC/D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAA;QACvE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAA;QACxC,QAAQ,CAAC,YAAY,CAAC;YACpB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;SACrE,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,IAAI,4BAA4B,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAE3C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.parity.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=constrainActionSurface.parity.test.d.ts.map

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.parity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainActionSurface.parity.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/constrainActionSurface.parity.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.parity.test.js

@@ -0,0 +1,29 @@
+import { constrainActionSurface } from '../../../../../modules/review-execution/services/constrainActionSurface.js';
+import { parseThreadActions } from '../../../../../modules/review-execution/services/threadActionsParser.js';
+describe('AC-3 parser drops non-allowlisted token types', () => {
+    it('parses only allowlisted markers and ignores unknown ones', () => {
+        const stdout = '[UNKNOWN:1] [DROP_DB] [POST_COMMENT:hello]';
+        const parsed = parseThreadActions(stdout);
+        expect(parsed).toEqual([{ type: 'POST_COMMENT', body: 'hello' }]);
+    });
+});
+describe('AC-4 stdout / context-file parity', () => {
+    it('produces a byte-identical constrained set whichever path the actions arrive from', () => {
+        const stdoutActions = parseThreadActions('[THREAD_RESOLVE:10][THREAD_REPLY:999:nope][POST_COMMENT:hi][FETCH_THREADS]');
+        const contextFileActions = [
+            { type: 'THREAD_RESOLVE', threadId: '10' },
+            { type: 'THREAD_REPLY', threadId: '999', message: 'nope' },
+            { type: 'POST_COMMENT', body: 'hi' },
+            { type: 'FETCH_THREADS' },
+        ];
+        const constraints = {
+            provenance: 'untrusted',
+            threadInventory: new Set(['10']),
+        };
+        const fromStdout = constrainActionSurface(stdoutActions, constraints);
+        const fromContextFile = constrainActionSurface(contextFileActions, constraints);
+        expect(fromStdout).toEqual(fromContextFile);
+        expect(fromStdout).toEqual([{ type: 'POST_COMMENT', body: 'hi' }]);
+    });
+});
+//# sourceMappingURL=constrainActionSurface.parity.test.js.map

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.parity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainActionSurface.parity.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/constrainActionSurface.parity.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAA;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAA;AAG/F,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,MAAM,GAAG,4CAA4C,CAAA;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,aAAa,GAAG,kBAAkB,CACtC,4EAA4E,CAC7E,CAAA;QACD,MAAM,kBAAkB,GAAmB;YACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;YAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE;YACpC,EAAE,IAAI,EAAE,eAAe,EAAE;SAC1B,CAAA;QAED,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,WAAoB;YAChC,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;SACjC,CAAA;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;QACrE,MAAM,eAAe,GAAG,sBAAsB,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAA;QAE/E,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QAC3C,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=constrainActionSurface.test.d.ts.map

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainActionSurface.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/constrainActionSurface.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.test.js

@@ -0,0 +1,115 @@
+import { constrainActionSurface } from '../../../../../modules/review-execution/services/constrainActionSurface.js';
+const inventory = (...ids) => new Set(ids);
+describe('constrainActionSurface', () => {
+    describe('AC-2 untrusted write surface = postComment only', () => {
+        it('keeps only postComment for an untrusted job, dropping resolve/reply/fetch', () => {
+            const actions = [
+                { type: 'THREAD_RESOLVE', threadId: '10' },
+                { type: 'THREAD_REPLY', threadId: '10', message: 'hi' },
+                { type: 'POST_COMMENT', body: 'ok' },
+                { type: 'FETCH_THREADS' },
+            ];
+            const result = constrainActionSurface(actions, {
+                provenance: 'untrusted',
+                threadInventory: inventory('10'),
+            });
+            expect(result).toEqual([{ type: 'POST_COMMENT', body: 'ok' }]);
+        });
+    });
+    describe('AC-5 FETCH_THREADS restricted to trusted (read-amplification gate)', () => {
+        it('drops FETCH_THREADS for untrusted', () => {
+            const result = constrainActionSurface([{ type: 'FETCH_THREADS' }], {
+                provenance: 'untrusted',
+                threadInventory: inventory('10'),
+            });
+            expect(result).toEqual([]);
+        });
+        it('keeps FETCH_THREADS for trusted', () => {
+            const result = constrainActionSurface([{ type: 'FETCH_THREADS' }], {
+                provenance: 'trusted',
+                threadInventory: inventory('10'),
+            });
+            expect(result).toEqual([{ type: 'FETCH_THREADS' }]);
+        });
+    });
+    describe('AC-6 THREAD_RESOLVE target validation', () => {
+        it('keeps in-set ids (with trim) and drops out-of-set on a trusted job', () => {
+            const actions = [
+                { type: 'THREAD_RESOLVE', threadId: '10' },
+                { type: 'THREAD_RESOLVE', threadId: '999' },
+                { type: 'THREAD_RESOLVE', threadId: '11 ' },
+            ];
+            const result = constrainActionSurface(actions, {
+                provenance: 'trusted',
+                threadInventory: inventory('10', '11'),
+            });
+            expect(result).toEqual([
+                { type: 'THREAD_RESOLVE', threadId: '10' },
+                { type: 'THREAD_RESOLVE', threadId: '11' },
+            ]);
+        });
+    });
+    describe('AC-7 THREAD_REPLY target validation', () => {
+        it('keeps in-set id and drops out-of-set on a trusted job', () => {
+            const actions = [
+                { type: 'THREAD_REPLY', threadId: '10', message: 'a' },
+                { type: 'THREAD_REPLY', threadId: '999', message: 'b' },
+            ];
+            const result = constrainActionSurface(actions, {
+                provenance: 'trusted',
+                threadInventory: inventory('10', '11'),
+            });
+            expect(result).toEqual([{ type: 'THREAD_REPLY', threadId: '10', message: 'a' }]);
+        });
+    });
+    describe('AC-8 target validation precedes provenance, both required for resolve/reply', () => {
+        const matrix = [
+            { provenance: 'trusted', threadId: '10', kept: true },
+            { provenance: 'trusted', threadId: '999', kept: false },
+            { provenance: 'untrusted', threadId: '10', kept: false },
+            { provenance: 'untrusted', threadId: '999', kept: false },
+        ];
+        for (const verb of ['THREAD_RESOLVE', 'THREAD_REPLY']) {
+            for (const cell of matrix) {
+                it(`${verb} ${cell.provenance} ${cell.threadId} -> ${cell.kept ? 'kept' : 'dropped'}`, () => {
+                    const action = verb === 'THREAD_RESOLVE'
+                        ? { type: 'THREAD_RESOLVE', threadId: cell.threadId }
+                        : { type: 'THREAD_REPLY', threadId: cell.threadId, message: 'x' };
+                    const result = constrainActionSurface([action], {
+                        provenance: cell.provenance,
+                        threadInventory: inventory('10', '11'),
+                    });
+                    expect(result.length).toBe(cell.kept ? 1 : 0);
+                });
+            }
+        }
+    });
+    describe('AC-9 inventory is authoritative single source', () => {
+        it('acts only on ids present in the passed inventory, ignoring spoofed look-alike ids', () => {
+            const actions = [
+                { type: 'THREAD_RESOLVE', threadId: '42' },
+                { type: 'THREAD_RESOLVE', threadId: '7' },
+            ];
+            const result = constrainActionSurface(actions, {
+                provenance: 'trusted',
+                threadInventory: inventory('42'),
+            });
+            expect(result).toEqual([{ type: 'THREAD_RESOLVE', threadId: '42' }]);
+        });
+    });
+    describe('AC-10 empty inventory drops all resolve/reply', () => {
+        it('drops every resolve/reply when the authenticated inventory is empty (fail-closed)', () => {
+            const actions = [
+                { type: 'THREAD_RESOLVE', threadId: '10' },
+                { type: 'THREAD_REPLY', threadId: '10', message: 'a' },
+                { type: 'POST_COMMENT', body: 'still ok' },
+            ];
+            const result = constrainActionSurface(actions, {
+                provenance: 'trusted',
+                threadInventory: inventory(),
+            });
+            expect(result).toEqual([{ type: 'POST_COMMENT', body: 'still ok' }]);
+        });
+    });
+});
+//# sourceMappingURL=constrainActionSurface.test.js.map

package/dist/tests/units/modules/review-execution/services/constrainActionSurface.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainActionSurface.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/constrainActionSurface.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAA;AAGtG,MAAM,SAAS,GAAG,CAAC,GAAG,GAAa,EAAuB,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;AAEzE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC/D,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;YACnF,MAAM,OAAO,GAAmB;gBAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBACvD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE;gBACpC,EAAE,IAAI,EAAE,eAAe,EAAE;aAC1B,CAAA;YAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE;gBAC7C,UAAU,EAAE,WAAW;gBACvB,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;aACjC,CAAC,CAAA;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAClF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBACjE,UAAU,EAAE,WAAW;gBACvB,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;aACjC,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBACjE,UAAU,EAAE,SAAS;gBACrB,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;aACjC,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACrD,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;YAC5E,MAAM,OAAO,GAAmB;gBAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC1C,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE;gBAC3C,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC5C,CAAA;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE;gBAC7C,UAAU,EAAE,SAAS;gBACrB,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;aACvC,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC1C,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC3C,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,OAAO,GAAmB;gBAC9B,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;gBACtD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE;aACxD,CAAA;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE;gBAC7C,UAAU,EAAE,SAAS;gBACrB,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;aACvC,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAClF,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,6EAA6E,EAAE,GAAG,EAAE;QAC3F,MAAM,MAAM,GAAG;YACb,EAAE,UAAU,EAAE,SAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;YAC9D,EAAE,UAAU,EAAE,SAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;YAChE,EAAE,UAAU,EAAE,WAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YACjE,EAAE,UAAU,EAAE,WAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;SACnE,CAAA;QAED,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,cAAc,CAAU,EAAE,CAAC;YAC/D,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE;oBAC1F,MAAM,MAAM,GACV,IAAI,KAAK,gBAAgB;wBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;wBACrD,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;oBACrE,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,MAAM,CAAC,EAAE;wBAC9C,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;qBACvC,CAAC,CAAA;oBACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC/C,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC7D,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;YAC3F,MAAM,OAAO,GAAmB;gBAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC1C,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE;aAC1C,CAAA;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE;gBAC7C,UAAU,EAAE,SAAS;gBACrB,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;aACjC,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC7D,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;YAC3F,MAAM,OAAO,GAAmB;gBAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;gBACtD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;aAC3C,CAAA;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE;gBAC7C,UAAU,EAAE,SAAS;gBACrB,eAAe,EAAE,SAAS,EAAE;aAC7B,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/review-execution/services/contextActionsExecutor.autopath.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=contextActionsExecutor.autopath.test.d.ts.map

package/dist/tests/units/modules/review-execution/services/contextActionsExecutor.autopath.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextActionsExecutor.autopath.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/contextActionsExecutor.autopath.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/review-execution/services/contextActionsExecutor.autopath.test.js

@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest';
+import { executeActionsFromContext } from '../../../../../modules/review-execution/services/contextActionsExecutor.js';
+class RecordingCommandExecutor {
+    calls = [];
+    run = (command, args, cwd) => {
+        this.calls.push({ command, args, cwd });
+    };
+}
+const silentLogger = {
+    info: () => undefined,
+    warn: () => undefined,
+    error: () => undefined,
+    debug: () => undefined,
+};
+function buildContext(actions) {
+    return {
+        localPath: '/repo',
+        mergeRequestId: 'gitlab-group/proj-5',
+        platform: 'gitlab',
+        projectPath: 'group/proj',
+        mergeRequestNumber: 5,
+        threads: [],
+        agents: [],
+        actions,
+        diffMetadata: undefined,
+    };
+}
+describe('auto path context executor blocks write verbs (AC6/AC7)', () => {
+    it('AC6: never sends a THREAD_RESOLVE command to the executor', async () => {
+        const executor = new RecordingCommandExecutor();
+        const context = buildContext([
+            { type: 'POST_COMMENT', body: 'hello' },
+            { type: 'THREAD_RESOLVE', threadId: '42' },
+        ]);
+        await executeActionsFromContext(context, '/repo', silentLogger, executor.run, null);
+        const resolveCalls = executor.calls.filter(c => c.args.some(a => a.includes('discussions/42') && c.args.includes('resolved=true')));
+        expect(resolveCalls).toHaveLength(0);
+    });
+    it('AC7: still posts the comment and does not throw on a mixed verb stream', async () => {
+        const executor = new RecordingCommandExecutor();
+        const context = buildContext([
+            { type: 'POST_COMMENT', body: 'one' },
+            { type: 'THREAD_RESOLVE', threadId: '7' },
+            { type: 'FETCH_THREADS' },
+        ]);
+        const result = await executeActionsFromContext(context, '/repo', silentLogger, executor.run, null);
+        const postCalls = executor.calls.filter(c => c.args.some(a => a.startsWith('body=')));
+        expect(postCalls).toHaveLength(1);
+        expect(result.total).toBeGreaterThanOrEqual(1);
+    });
+});
+//# sourceMappingURL=contextActionsExecutor.autopath.test.js.map

package/dist/tests/units/modules/review-execution/services/contextActionsExecutor.autopath.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextActionsExecutor.autopath.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/contextActionsExecutor.autopath.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,+DAA+D,CAAA;AAGzG,MAAM,wBAAwB;IACZ,KAAK,GAA4D,EAAE,CAAA;IACnF,GAAG,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW,EAAQ,EAAE;QAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IACzC,CAAC,CAAA;CACF;AAED,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;IACtB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;CACvB,CAAA;AAED,SAAS,YAAY,CAAC,OAAiC;IACrD,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,qBAAqB;QACrC,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,YAAY;QACzB,kBAAkB,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,OAAO;QACP,YAAY,EAAE,SAAS;KACI,CAAA;AAC/B,CAAC;AAED,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,QAAQ,GAAG,IAAI,wBAAwB,EAAE,CAAA;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE;YACvC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC3C,CAAC,CAAA;QAEF,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAEnF,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CACnF,CAAA;QACD,MAAM,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,GAAG,IAAI,wBAAwB,EAAE,CAAA;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE;YACrC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE;YACzC,EAAE,IAAI,EAAE,eAAe,EAAE;SAC1B,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,OAAO,EACP,OAAO,EACP,YAAY,EACZ,QAAQ,CAAC,GAAG,EACZ,IAAI,CACL,CAAA;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACrF,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/review-execution/services/dispatchConstrainedActions.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dispatchConstrainedActions.test.d.ts.map

package/dist/tests/units/modules/review-execution/services/dispatchConstrainedActions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatchConstrainedActions.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/dispatchConstrainedActions.test.ts"],"names":[],"mappings":""}

package/dist/tests/units/modules/review-execution/services/dispatchConstrainedActions.test.js

@@ -0,0 +1,124 @@
+import { dispatchConstrainedActions } from '../../../../../modules/review-execution/services/dispatchConstrainedActions.js';
+class RecordingExecutor {
+    calls = [];
+    run = (command, args) => {
+        this.calls.push({ command, args });
+    };
+}
+class RecordingLogger {
+    errors = [];
+    info() { }
+    warn() { }
+    debug() { }
+    error(_obj, message) {
+        this.errors.push(message);
+    }
+}
+class StubInventoryGateway {
+    pages = [];
+    failure = null;
+    setPages(pages) {
+        this.pages = pages;
+    }
+    setFailure(error) {
+        this.failure = error;
+    }
+    fetchPage(_p, _m, page) {
+        if (this.failure)
+            throw this.failure;
+        const found = this.pages.find(x => x.page === page);
+        if (!found)
+            throw new Error(`no page ${page}`);
+        return found;
+    }
+}
+const baseContext = {
+    platform: 'gitlab',
+    projectPath: 'group/project',
+    mrNumber: 42,
+    localPath: '/tmp/repo',
+};
+function resolvedDiscussions(executor) {
+    return executor.calls
+        .filter(c => c.args.includes('PUT'))
+        .map(c => c.args.find(a => a.includes('/discussions/')) ?? '');
+}
+describe('dispatchConstrainedActions (breach closure: forged ids never reach live writes)', () => {
+    it('forged out-of-MR resolve id never produces a glab write call', async () => {
+        const executor = new RecordingExecutor();
+        const inventory = new StubInventoryGateway();
+        inventory.setPages([{ page: 1, totalPages: 1, threadIds: ['10'] }]);
+        const actions = [
+            { type: 'THREAD_RESOLVE', threadId: '999' },
+            { type: 'THREAD_RESOLVE', threadId: '10' },
+        ];
+        await dispatchConstrainedActions(actions, {
+            context: baseContext,
+            provenance: 'trusted',
+            inventoryGateway: inventory,
+            logger: new RecordingLogger(),
+            executor: executor.run,
+        });
+        const resolves = resolvedDiscussions(executor);
+        expect(resolves.some(r => r.includes('/discussions/999'))).toBe(false);
+        expect(resolves.filter(r => r.includes('/discussions/10')).length).toBe(1);
+    });
+    it('untrusted job: only postComment reaches the executor', async () => {
+        const executor = new RecordingExecutor();
+        const inventory = new StubInventoryGateway();
+        inventory.setPages([{ page: 1, totalPages: 1, threadIds: ['10'] }]);
+        const actions = [
+            { type: 'THREAD_RESOLVE', threadId: '10' },
+            { type: 'THREAD_REPLY', threadId: '10', message: 'x' },
+            { type: 'FETCH_THREADS' },
+            { type: 'POST_COMMENT', body: 'hi' },
+        ];
+        await dispatchConstrainedActions(actions, {
+            context: baseContext,
+            provenance: 'untrusted',
+            inventoryGateway: inventory,
+            logger: new RecordingLogger(),
+            executor: executor.run,
+        });
+        expect(executor.calls.length).toBe(1);
+        expect(executor.calls[0].args).toContain('POST');
+        expect(executor.calls[0].args.some(a => a.endsWith('/notes'))).toBe(true);
+    });
+    it('AC-10 fail-closed: when the authenticated inventory fetch fails, zero resolve/reply writes occur', async () => {
+        const executor = new RecordingExecutor();
+        const inventory = new StubInventoryGateway();
+        inventory.setFailure(new Error('auth failure'));
+        const logger = new RecordingLogger();
+        const actions = [
+            { type: 'THREAD_RESOLVE', threadId: '10' },
+            { type: 'THREAD_REPLY', threadId: '10', message: 'x' },
+        ];
+        await dispatchConstrainedActions(actions, {
+            context: baseContext,
+            provenance: 'trusted',
+            inventoryGateway: inventory,
+            logger,
+            executor: executor.run,
+        });
+        expect(executor.calls.length).toBe(0);
+        expect(logger.errors.length).toBeGreaterThan(0);
+    });
+    it('AC-10.1 forged payload inventory is ignored; only authenticated ids are honored', async () => {
+        const executor = new RecordingExecutor();
+        const inventory = new StubInventoryGateway();
+        inventory.setPages([{ page: 1, totalPages: 1, threadIds: ['authentic-1'] }]);
+        const actions = [
+            { type: 'THREAD_RESOLVE', threadId: 'forged-1' },
+            { type: 'THREAD_REPLY', threadId: 'forged-2', message: 'x' },
+        ];
+        await dispatchConstrainedActions(actions, {
+            context: baseContext,
+            provenance: 'trusted',
+            inventoryGateway: inventory,
+            logger: new RecordingLogger(),
+            executor: executor.run,
+        });
+        expect(executor.calls.length).toBe(0);
+    });
+});
+//# sourceMappingURL=dispatchConstrainedActions.test.js.map

package/dist/tests/units/modules/review-execution/services/dispatchConstrainedActions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatchConstrainedActions.test.js","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/dispatchConstrainedActions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mEAAmE,CAAA;AAO9G,MAAM,iBAAiB;IACZ,KAAK,GAA+C,EAAE,CAAA;IAC/D,GAAG,GAAG,CAAC,OAAe,EAAE,IAAc,EAAQ,EAAE;QAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACpC,CAAC,CAAA;CACF;AAED,MAAM,eAAe;IACV,MAAM,GAAa,EAAE,CAAA;IAC9B,IAAI,KAAU,CAAC;IACf,IAAI,KAAU,CAAC;IACf,KAAK,KAAU,CAAC;IAChB,KAAK,CAAC,IAAY,EAAE,OAAe;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC;CACF;AAED,MAAM,oBAAoB;IAChB,KAAK,GAA0B,EAAE,CAAA;IACjC,OAAO,GAAiB,IAAI,CAAA;IACpC,QAAQ,CAAC,KAA4B;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IACD,UAAU,CAAC,KAAY;QACrB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;IACtB,CAAC;IACD,SAAS,CAAC,EAAU,EAAE,EAAU,EAAE,IAAY;QAC5C,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAA;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC9C,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,EAAE,QAAiB;IAC3B,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,WAAW;CACvB,CAAA;AAED,SAAS,mBAAmB,CAAC,QAA2B;IACtD,OAAO,QAAQ,CAAC,KAAK;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,QAAQ,CAAC,iFAAiF,EAAE,GAAG,EAAE;IAC/F,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;QAC5C,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAEnE,MAAM,OAAO,GAAmB;YAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC3C,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC3C,CAAA;QAED,MAAM,0BAA0B,CAAC,OAAO,EAAE;YACxC,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,SAAS;YAC3B,MAAM,EAAE,IAAI,eAAe,EAAE;YAC7B,QAAQ,EAAE,QAAQ,CAAC,GAAG;SACvB,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;QAC5C,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAEnE,MAAM,OAAO,GAAmB;YAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;YACtD,EAAE,IAAI,EAAE,eAAe,EAAE;YACzB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE;SACrC,CAAA;QAED,MAAM,0BAA0B,CAAC,OAAO,EAAE;YACxC,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,WAAW;YACvB,gBAAgB,EAAE,SAAS;YAC3B,MAAM,EAAE,IAAI,eAAe,EAAE;YAC7B,QAAQ,EAAE,QAAQ,CAAC,GAAG;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;QAChH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;QAC5C,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QAEpC,MAAM,OAAO,GAAmB;YAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;SACvD,CAAA;QAED,MAAM,0BAA0B,CAAC,OAAO,EAAE;YACxC,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,SAAS;YAC3B,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,GAAG;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;QAC5C,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAA;QAE5E,MAAM,OAAO,GAAmB;YAC9B,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE;YAChD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE;SAC7D,CAAA;QAED,MAAM,0BAA0B,CAAC,OAAO,EAAE;YACxC,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,SAAS;YAC3B,MAAM,EAAE,IAAI,eAAe,EAAE;YAC7B,QAAQ,EAAE,QAAQ,CAAC,GAAG;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/units/modules/review-execution/services/resolveThreadInventory.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resolveThreadInventory.test.d.ts.map

package/dist/tests/units/modules/review-execution/services/resolveThreadInventory.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveThreadInventory.test.d.ts","sourceRoot":"","sources":["../../../../../../src/tests/units/modules/review-execution/services/resolveThreadInventory.test.ts"],"names":[],"mappings":""}