sea-dev 1.0.0

package/libs/dal/src/conversation.test.ts

@@ -0,0 +1,655 @@
+import { resetTestDb } from "@/_tests/mock-db"; // Must always be the first import
+
+import { db, schema } from "@sea/db";
+import type { Member } from "@sea/db/types";
+import type { UIMessage } from "ai";
+import { eq } from "drizzle-orm";
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  eraseConversation,
+  getAgentConversations,
+  getConversation,
+  getFormConversation,
+  getSubmissionConversation,
+  persistMessages,
+  setConversationModel,
+  summarizeEraseConversation,
+  updateAgentConversation,
+} from "./conversation";
+
+describe("dbtest: getAgentConversations", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to agent conversations from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create agent conversations for both organizations
+    await db.insert(schema.conversation).values([
+      { organizationId: org1!.id, agent: true, model: "gpt-4.1", name: "Agent 1 - Org 1" },
+      { organizationId: org1!.id, agent: true, model: "gpt-4.1", name: "Agent 2 - Org 1" },
+      { organizationId: org2!.id, agent: true, model: "gpt-4.1", name: "Agent 1 - Org 2" },
+      { organizationId: org2!.id, agent: true, model: "gpt-4.1", name: "Agent 2 - Org 2" },
+      // Also create non-agent conversations to ensure they're filtered out
+      { organizationId: org1!.id, agent: false, model: "gpt-4.1", name: "Regular Conv - Org 1" },
+      { organizationId: org2!.id, agent: false, model: "gpt-4.1", name: "Regular Conv - Org 2" },
+    ]);
+
+    // Create member for org1
+    const member: Member = {
+      id: "member-1",
+      organizationId: org1!.id,
+      userId: "user-1",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    // Get agent conversations - should only return org1 agent conversations
+    const conversations = await getAgentConversations({ member });
+
+    expect(conversations).toHaveLength(2);
+    expect(conversations.every((c) => c.organizationId === org1!.id)).toBe(true);
+    expect(conversations.every((c) => c.agent === true)).toBe(true);
+    expect(conversations.every((c) => c.name?.includes("Org 1"))).toBe(true);
+  });
+});
+
+describe("dbtest: eraseConversation", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("should not allow erasing conversations from different organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Organization 1" }, { name: "Organization 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-eraseconversation@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-eraseconversation@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [_member1, member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create a conversation in org1
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({
+        organizationId: org1!.id,
+        model: "gpt-4.1",
+      })
+      .returning();
+
+    // Create a message in the conversation
+    const [message] = await db
+      .insert(schema.message)
+      .values({
+        conversationId: conversation!.id,
+        role: "user",
+        parts: [{ type: "text", text: "Test messsage" }],
+      })
+      .returning();
+
+    // Attempt to erase conversation from org1 using member from org2
+    // This should throw an error due to invariant check
+    await expect(
+      eraseConversation({
+        member: member2!,
+        conversationId: conversation!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Verify the message still exists (wasn't deleted)
+    const remainingMessages = await db.query.message.findMany({
+      where: eq(schema.message.conversationId, conversation!.id),
+    });
+    expect(remainingMessages).toHaveLength(1);
+    expect(remainingMessages[0]!.id).toBe(message!.id);
+  });
+});
+
+describe("dbtest: getConversation", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("should not allow access to conversations from different organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Organization 1" }, { name: "Organization 2" }])
+      .returning();
+
+    // Create a conversation in org1
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({
+        organizationId: org1!.id,
+        model: "gpt-4.1",
+      })
+      .returning();
+
+    // Create a message in the conversation
+    await db.insert(schema.message).values({
+      conversationId: conversation!.id,
+      role: "user",
+      content: "Test message",
+    });
+
+    // Create member for org2
+    const member: Member = {
+      id: "member-2",
+      organizationId: org2!.id,
+      userId: "user-2",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    // Attempt to get conversation from org1 using member from org2
+    // This should throw notFound() error
+    const res = await getConversation({
+      member,
+      conversationId: conversation!.id,
+    });
+    expect(res.ok).toEqual(false);
+  });
+});
+
+describe("dbtest: getFormConversation", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to form conversations from other organizations", async () => {
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    const [workflow] = await db
+      .insert(schema.workflow)
+      .values({ organizationId: org1!.id, name: "Workflow 1" })
+      .returning();
+
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({ organizationId: org1!.id, model: "gpt-4.1" })
+      .returning();
+
+    const [form] = await db
+      .insert(schema.form)
+      .values({
+        organizationId: org1!.id,
+        workflowId: workflow!.id,
+        name: "Form 1",
+        hint: "",
+        conversationId: conversation!.id,
+      })
+      .returning();
+
+    const memberOtherOrg: Member = {
+      id: "member-other-org",
+      organizationId: org2!.id,
+      userId: "user-other-org",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    const result = await getFormConversation({ member: memberOtherOrg, formId: form!.id });
+    expect(result.ok).toBe(false);
+
+    const memberSameOrg: Member = {
+      id: "member-same-org",
+      organizationId: org1!.id,
+      userId: "user-same-org",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    const success = await getFormConversation({ member: memberSameOrg, formId: form!.id });
+    expect(success.ok).toBe(true);
+    if (success.ok) {
+      expect(success.data.conversationId).toBe(conversation!.id);
+    }
+  });
+});
+
+describe("dbtest: getSubmissionConversation", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to submission conversations from other organizations", async () => {
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    const [workflow] = await db
+      .insert(schema.workflow)
+      .values({ organizationId: org1!.id, name: "Workflow 1" })
+      .returning();
+
+    const [deal] = await db
+      .insert(schema.deal)
+      .values({ organizationId: org1!.id, name: "Deal 1" })
+      .returning();
+
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({ organizationId: org1!.id, model: "gpt-4.1" })
+      .returning();
+
+    const [form] = await db
+      .insert(schema.form)
+      .values({
+        organizationId: org1!.id,
+        workflowId: workflow!.id,
+        name: "Form 1",
+        conversationId: conversation!.id,
+      })
+      .returning();
+
+    const [submission] = await db
+      .insert(schema.submission)
+      .values({
+        organizationId: org1!.id,
+        formId: form!.id,
+        dealId: deal!.id,
+        name: "Submission 1",
+        summary: null,
+        status: "draft",
+        conversationId: conversation!.id,
+      })
+      .returning();
+
+    const memberOtherOrg: Member = {
+      id: "member-other-org",
+      organizationId: org2!.id,
+      userId: "user-other-org",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    const result = await getSubmissionConversation({
+      member: memberOtherOrg,
+      submissionId: submission!.id,
+    });
+    expect(result.ok).toBe(false);
+
+    const memberSameOrg: Member = {
+      id: "member-same-org",
+      organizationId: org1!.id,
+      userId: "user-same-org",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    const success = await getSubmissionConversation({
+      member: memberSameOrg,
+      submissionId: submission!.id,
+    });
+    expect(success.ok).toBe(true);
+    if (success.ok) {
+      expect(success.data.conversationId).toBe(conversation!.id);
+    }
+  });
+});
+
+describe("dbtest: getFormConversation (soft delete)", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("does not resolve conversations for soft-deleted forms", async () => {
+    const [org] = await db.insert(schema.organization).values({ name: "Org" }).returning();
+
+    const [workflow] = await db
+      .insert(schema.workflow)
+      .values({ organizationId: org!.id, name: "Workflow" })
+      .returning();
+
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({ organizationId: org!.id, model: "gpt-4.1" })
+      .returning();
+
+    const [form] = await db
+      .insert(schema.form)
+      .values({
+        organizationId: org!.id,
+        workflowId: workflow!.id,
+        name: "Soft-deleted form",
+        hint: "",
+        conversationId: conversation!.id,
+        deletedAt: new Date(),
+      })
+      .returning();
+
+    const member: Member = {
+      id: "member-org",
+      organizationId: org!.id,
+      userId: "user-org",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    const result = await getFormConversation({ member, formId: form!.id });
+    expect(result.ok).toBe(false);
+  });
+});
+
+describe("dbtest: getSubmissionConversation (soft delete)", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("does not resolve conversations for soft-deleted submissions", async () => {
+    const [org] = await db.insert(schema.organization).values({ name: "Org" }).returning();
+
+    const [workflow] = await db
+      .insert(schema.workflow)
+      .values({ organizationId: org!.id, name: "Workflow" })
+      .returning();
+
+    const [deal] = await db
+      .insert(schema.deal)
+      .values({ organizationId: org!.id, name: "Deal" })
+      .returning();
+
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({ organizationId: org!.id, model: "gpt-4.1" })
+      .returning();
+
+    const [form] = await db
+      .insert(schema.form)
+      .values({
+        organizationId: org!.id,
+        workflowId: workflow!.id,
+        name: "Form",
+        conversationId: conversation!.id,
+      })
+      .returning();
+
+    const [submission] = await db
+      .insert(schema.submission)
+      .values({
+        organizationId: org!.id,
+        formId: form!.id,
+        dealId: deal!.id,
+        name: "Submission",
+        summary: null,
+        status: "draft",
+        conversationId: conversation!.id,
+        deletedAt: new Date(),
+      })
+      .returning();
+
+    const member: Member = {
+      id: "member-org",
+      organizationId: org!.id,
+      userId: "user-org",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    const result = await getSubmissionConversation({
+      member,
+      submissionId: submission!.id,
+    });
+    expect(result.ok).toBe(false);
+  });
+});
+
+describe("dbtest: persistMessages", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents persisting messages to conversations from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Organization 1" }, { name: "Organization 2" }])
+      .returning();
+
+    // Create a conversation in org1
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({
+        organizationId: org1!.id,
+        model: "gpt-4.1",
+      })
+      .returning();
+
+    // Create member for org2
+    const member: Member = {
+      id: "member-2",
+      organizationId: org2!.id,
+      userId: "user-2",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    const messages: UIMessage[] = [
+      {
+        id: "msg-1",
+        role: "user" as const,
+        parts: [{ type: "text", text: "Test messsage" }],
+      },
+    ];
+
+    // Attempt to persist messages to conversation from org1 using member from org2
+    // This should throw an error due to invariant check
+    await expect(
+      persistMessages({
+        member,
+        conversationId: conversation!.id,
+        messages,
+      }),
+    ).rejects.toThrow();
+
+    // Verify no messages were persisted
+    const persistedMessages = await db.query.message.findMany({
+      where: eq(schema.message.conversationId, conversation!.id),
+    });
+    expect(persistedMessages).toHaveLength(0);
+  });
+});
+
+describe("dbtest: summarizeEraseConversation", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents access to conversations from other organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create a conversation in org1
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({
+        organizationId: org1!.id,
+        model: "gpt-4.1",
+      })
+      .returning();
+
+    // Create messages in the conversation
+    await db.insert(schema.message).values([
+      {
+        conversationId: conversation!.id,
+        role: "user",
+        content: "First message",
+      },
+      {
+        conversationId: conversation!.id,
+        role: "assistant",
+        content: "Second message",
+      },
+    ]);
+
+    // Create member for org2
+    const member: Member = {
+      id: "member-2",
+      organizationId: org2!.id,
+      userId: "user-2",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    // Attempt to summarize and erase conversation from org1 using member from org2
+    // This should throw an error due to invariant check
+    await expect(
+      summarizeEraseConversation({
+        member,
+        conversationId: conversation!.id,
+        summary: "dummy",
+      }),
+    ).rejects.toThrow();
+
+    // Verify messages still exist (weren't deleted)
+    const remainingMessages = await db.query.message.findMany({
+      where: eq(schema.message.conversationId, conversation!.id),
+    });
+    expect(remainingMessages).toHaveLength(2);
+
+    // Verify no context was created
+    const contexts = await db.query.context.findMany({
+      where: eq(schema.context.conversationId, conversation!.id),
+    });
+    expect(contexts).toHaveLength(0);
+  });
+});
+
+describe("dbtest: setConversationModel", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("should not allow updating conversation model from different organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Organization 1" }, { name: "Organization 2" }])
+      .returning();
+
+    // Create a conversation in org1
+    const [conversation] = await db
+      .insert(schema.conversation)
+      .values({
+        organizationId: org1!.id,
+        model: "gpt-4.1",
+      })
+      .returning();
+
+    // Create member for org2
+    const member: Member = {
+      id: "member-2",
+      organizationId: org2!.id,
+      userId: "user-2",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    // Attempt to update conversation model from org1 using member from org2
+    await setConversationModel({
+      member,
+      conversationId: conversation!.id,
+      chatModel: "gpt-4.1",
+    });
+
+    // Verify the conversation model was not updated (should still be original value)
+    const updatedConversation = await db.query.conversation.findFirst({
+      where: eq(schema.conversation.id, conversation!.id),
+    });
+    expect(updatedConversation!.model).toBe("gpt-4.1");
+  });
+});
+
+describe("dbtest: updateAgentConversation", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("should not allow updating agent conversations from different organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Organization 1" }, { name: "Organization 2" }])
+      .returning();
+
+    // Create agent conversation in org1
+    const agentId = "agent-test-123";
+    const [_conversation] = await db
+      .insert(schema.conversation)
+      .values({
+        id: agentId,
+        organizationId: org1!.id,
+        agent: true,
+        model: "gpt-4.1",
+        name: "Original Name",
+        memory: { originalKey: "originalValue" },
+      })
+      .returning();
+
+    // Create member for org2
+    const member: Member = {
+      id: "member-2",
+      organizationId: org2!.id,
+      userId: "user-2",
+      role: "member",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+
+    // Attempt to update agent conversation from org1 using member from org2
+    await updateAgentConversation({
+      member,
+      conversationId: agentId,
+      name: "Hacked Name",
+      memory: { maliciousKey: "maliciousValue" },
+    });
+
+    // Verify the conversation was not updated (should still have original values)
+    const updatedConversation = await db.query.conversation.findFirst({
+      where: eq(schema.conversation.id, agentId),
+    });
+    expect(updatedConversation!.name).toBe("Original Name");
+    expect(updatedConversation!.memory).toEqual({ originalKey: "originalValue" });
+    expect(updatedConversation!.organizationId).toBe(org1!.id);
+  });
+});