spine-framework 0.4.4 → 0.5.0-rc.4

package/.framework/tests/unit/deliveries-account-scoping.test.ts

@@ -0,0 +1,185 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// S-007: deliveries get/retry ran service-role queries (machine principals
+// resolve ctx.db to adminDb) with no account filter. get is now scoped to
+// ctx.accountId for non-system principals; retry verifies the caller's
+// account matches the delivery's before re-executing under SYSTEM_PRINCIPAL.
+
+vi.mock('../../functions/_shared/middleware.ts', () => ({
+  createHandler: (fn: any) => fn,
+}))
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: {
+    from: vi.fn(),
+  },
+  getUserDb: vi.fn(() => ({})),
+}))
+
+vi.mock('../../functions/_shared/audit.ts', () => ({
+  emitAudit: vi.fn().mockResolvedValue(undefined),
+  emitLog: vi.fn().mockResolvedValue(undefined),
+  emitSpan: vi.fn().mockResolvedValue(undefined),
+  emitActivity: vi.fn().mockResolvedValue(undefined),
+}))
+
+const mocks = vi.hoisted(() => ({
+  executeOutbound: vi.fn(),
+}))
+
+vi.mock('../../functions/integration-outbound.ts', () => ({
+  execute: mocks.executeOutbound,
+  default: vi.fn(),
+}))
+
+const executeOutbound = mocks.executeOutbound
+
+import { get, retry } from '../../functions/deliveries.ts'
+
+function q(result: { data?: any; error?: any }) {
+  const b: any = {}
+  const chainers = ['select', 'eq', 'in', 'is', 'ilike', 'filter', 'not', 'order',
+    'limit', 'update', 'insert', 'upsert', 'delete', 'neq', 'or', 'contains', 'gte', 'lte', 'range']
+  for (const m of chainers) b[m] = vi.fn(() => b)
+  b.single = vi.fn(async () => result)
+  b.maybeSingle = vi.fn(async () => result)
+  b.then = (onF: any, onR: any) => Promise.resolve(result).then(onF, onR)
+  return b
+}
+
+let queue: any[] = []
+let dbBuilt: any[] = []
+
+function stubDb() {
+  return {
+    from: vi.fn(() => {
+      const b = queue.length ? queue.shift() : q({ data: null, error: null })
+      dbBuilt.push(b)
+      return b
+    }),
+  }
+}
+
+beforeEach(() => {
+  queue = []
+  dbBuilt = []
+  vi.clearAllMocks()
+  executeOutbound.mockResolvedValue({ success: true, is_retry: true })
+})
+
+const scopedMachine = (accountId: string | null = 'acct-1') => ({
+  id: 'key-1',
+  type: 'machine',
+  accountId,
+  roles: [],
+  scopes: ['deliveries:read'],
+  isInternal: false,
+  machineType: 'integration',
+  provenance: { sourceType: 'api_key' },
+})
+
+const systemAdmin = () => ({
+  id: 'user-1',
+  type: 'human',
+  accountId: 'acct-1',
+  roles: ['system_admin'],
+  provenance: { sourceType: 'jwt' },
+})
+
+const systemPrincipal = () => ({
+  id: 'system',
+  type: 'machine',
+  accountId: null,
+  roles: [],
+  scopes: ['*:*'],
+  isInternal: true,
+  machineType: 'internal',
+  provenance: { sourceType: 'cron' },
+})
+
+function makeCtx(principal: any, overrides: any = {}) {
+  return {
+    requestId: 'req-1',
+    principal,
+    accountId: principal?.accountId ?? null,
+    db: stubDb(),
+    query: {},
+    headers: {},
+    ...overrides,
+  }
+}
+
+const delivery = (accountId: string | null) => ({
+  id: 'del-1',
+  account_id: accountId,
+  direction: 'outbound',
+  status: 'failed',
+})
+
+describe('deliveries get account scoping (S-007)', () => {
+  it('scopes the lookup to ctx.accountId for a machine principal', async () => {
+    queue.push(q({ data: delivery('acct-1'), error: null }))
+    const ctx = makeCtx(scopedMachine())
+    await get({ ...ctx, query: { id: 'del-1' } }, {})
+    const b = dbBuilt[0]
+    expect(b.eq).toHaveBeenCalledWith('id', 'del-1')
+    expect(b.eq).toHaveBeenCalledWith('account_id', 'acct-1')
+  })
+
+  it('does not scope for system_admin', async () => {
+    queue.push(q({ data: delivery('acct-2'), error: null }))
+    const ctx = makeCtx(systemAdmin())
+    const res = await get({ ...ctx, query: { id: 'del-1' } }, {})
+    expect(res.id).toBe('del-1')
+    const accountEq = dbBuilt[0].eq.mock.calls.filter((c: any[]) => c[0] === 'account_id')
+    expect(accountEq).toHaveLength(0)
+  })
+
+  it('requires account context for a non-system principal without one', async () => {
+    const ctx = makeCtx(scopedMachine(null))
+    await expect(get({ ...ctx, query: { id: 'del-1' } }, {})).rejects.toThrow('Account context required')
+  })
+})
+
+describe('deliveries retry account check (S-007)', () => {
+  it('rejects a scoped machine principal retrying another account\u2019s delivery with 403', async () => {
+    queue.push(q({ data: delivery('acct-2'), error: null }))
+    const ctx = makeCtx(scopedMachine())
+    await expect(retry(ctx, { id: 'del-1' })).rejects.toMatchObject({ statusCode: 403 })
+    expect(executeOutbound).not.toHaveBeenCalled()
+  })
+
+  it('rejects a non-system principal with no account context', async () => {
+    queue.push(q({ data: delivery('acct-2'), error: null }))
+    const ctx = makeCtx(scopedMachine(null))
+    await expect(retry(ctx, { id: 'del-1' })).rejects.toMatchObject({ statusCode: 403 })
+    expect(executeOutbound).not.toHaveBeenCalled()
+  })
+
+  it('allows a scoped caller to retry its own account\u2019s delivery', async () => {
+    queue.push(q({ data: delivery('acct-1'), error: null }))
+    const ctx = makeCtx(scopedMachine())
+    const res = await retry(ctx, { id: 'del-1' })
+    expect(res.success).toBe(true)
+    expect(executeOutbound).toHaveBeenCalledOnce()
+    const retryCtx = executeOutbound.mock.calls[0][0]
+    expect(retryCtx.accountId).toBe('acct-1')
+    expect(retryCtx.principal.id).toBe('system')
+  })
+
+  it('allows system_admin to retry any account\u2019s delivery', async () => {
+    queue.push(q({ data: delivery('acct-2'), error: null }))
+    const ctx = makeCtx(systemAdmin())
+    const res = await retry(ctx, { id: 'del-1' })
+    expect(res.success).toBe(true)
+    expect(executeOutbound).toHaveBeenCalledOnce()
+  })
+
+  it('allows the internal SYSTEM_PRINCIPAL (scheduled/manual cron path)', async () => {
+    queue.push(q({ data: delivery('acct-2'), error: null }))
+    const ctx = makeCtx(systemPrincipal())
+    const res = await retry(ctx, { id: 'del-1' })
+    expect(res.success).toBe(true)
+    expect(executeOutbound).toHaveBeenCalledOnce()
+  })
+})

package/.framework/tests/unit/integration-outbound-credentials.test.ts

@@ -0,0 +1,167 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
+// F-065: the stock `generic-http` seed ships
+// `api_token: { source: 'value', value: '' }`. An absent or explicitly-empty
+// credential must mean "call without auth" — the adapter decides whether a
+// key is required. A configured-but-broken env_var entry still throws.
+
+vi.mock('../../functions/_shared/middleware.ts', () => ({
+  createHandler: (fn: any) => fn,
+}))
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: {
+    from: vi.fn(),
+  },
+  getUserDb: vi.fn(() => ({})),
+}))
+
+vi.mock('../../functions/_shared/audit.ts', () => ({
+  emitAudit: vi.fn().mockResolvedValue(undefined),
+  emitLog: vi.fn().mockResolvedValue(undefined),
+  emitSpan: vi.fn().mockResolvedValue(undefined),
+  emitActivity: vi.fn().mockResolvedValue(undefined),
+}))
+
+// admin-data pulls in permissions/trigger-engine — only `get`/`update` are
+// used here, and only when record_id / update_record are set.
+vi.mock('../../functions/admin-data.ts', () => ({
+  get: vi.fn(),
+  update: vi.fn(),
+}))
+
+import { adminDb } from '../../functions/_shared/db.ts'
+import { emitLog } from '../../functions/_shared/audit.ts'
+import { execute } from '../../functions/integration-outbound.ts'
+
+// Chainable query-builder stub — every filter/terminal method returns the
+// builder except single/maybeSingle/await, which resolve to the result.
+function q(result: { data?: any; error?: any }) {
+  const b: any = {}
+  const chainers = ['select', 'eq', 'in', 'is', 'ilike', 'filter', 'not', 'order',
+    'limit', 'update', 'insert', 'upsert', 'delete', 'neq', 'or', 'contains', 'gte', 'lte', 'range']
+  for (const m of chainers) b[m] = vi.fn(() => b)
+  b.single = vi.fn(async () => result)
+  b.maybeSingle = vi.fn(async () => result)
+  b.then = (onF: any, onR: any) => Promise.resolve(result).then(onF, onR)
+  return b
+}
+
+let queue: any[] = []
+
+const fetchMock = vi.fn()
+
+function makeCtx(overrides: any = {}) {
+  return {
+    requestId: 'req-1',
+    principal: {
+      id: 'user-1',
+      type: 'human',
+      accountId: 'acct-1',
+      roles: ['system_admin'],
+    },
+    accountId: 'acct-1',
+    db: adminDb,
+    query: {},
+    ...overrides,
+  }
+}
+
+function queueIntegration(credentials: any, config: any = { outbound_adapter: 'adapters/generic-webhook-outbound' }) {
+  // execute() looks up the account-scoped row first, then the system row.
+  queue.push(q({ data: null, error: null })) // tenant miss
+  queue.push(q({ data: { id: 'int-1', slug: 'generic-http', credentials, config, is_active: true }, error: null })) // system hit
+  queue.push(q({ data: { id: 'del-1' }, error: null })) // webhook_deliveries insert
+  queue.push(q({ data: null, error: null })) // webhook_deliveries update
+}
+
+beforeEach(() => {
+  queue = []
+  vi.clearAllMocks()
+  vi.mocked(adminDb.from).mockImplementation(() => (queue.length ? queue.shift() : q({ data: null, error: null })))
+  fetchMock.mockResolvedValue({
+    ok: true,
+    status: 200,
+    text: async () => '{"ok":true}',
+  })
+  vi.stubGlobal('fetch', fetchMock)
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('integration-outbound optional credentials (F-065)', () => {
+  it('sends the request with no Authorization header when api_token is an empty literal', async () => {
+    queueIntegration({ api_token: { source: 'value', value: '' } })
+
+    const result = await execute(makeCtx(), {
+      integration_slug: 'generic-http',
+      action_config: { url: 'https://hooks.example.com/in' },
+    })
+
+    expect(result.success).toBe(true)
+    expect(fetchMock).toHaveBeenCalledOnce()
+    const headers = fetchMock.mock.calls[0][1].headers
+    expect(headers.Authorization).toBeUndefined()
+
+    // The skip is still audited — same event name, marked skipped.
+    const events = vi.mocked(emitLog).mock.calls.map(c => c[1])
+    expect(events).toContain('integration.credential_empty')
+    const emptyCall = vi.mocked(emitLog).mock.calls.find(c => c[1] === 'integration.credential_empty')!
+    expect(emptyCall[4]).toMatchObject({ skipped: true, field: 'api_token' })
+  })
+
+  it('proceeds unauthenticated when the credentials map has no entry for the field', async () => {
+    queueIntegration({})
+
+    const result = await execute(makeCtx(), {
+      integration_slug: 'generic-http',
+      action_config: { url: 'https://hooks.example.com/in' },
+    })
+
+    expect(result.success).toBe(true)
+    const headers = fetchMock.mock.calls[0][1].headers
+    expect(headers.Authorization).toBeUndefined()
+    const events = vi.mocked(emitLog).mock.calls.map(c => c[1])
+    expect(events).toContain('integration.credential_missing')
+  })
+
+  it('attaches Authorization: Bearer when a literal token is configured', async () => {
+    queueIntegration({ api_token: { source: 'value', value: 'tok-123' } })
+
+    await execute(makeCtx(), {
+      integration_slug: 'generic-http',
+      action_config: { url: 'https://hooks.example.com/in' },
+    })
+
+    const headers = fetchMock.mock.calls[0][1].headers
+    expect(headers.Authorization).toBe('Bearer tok-123')
+  })
+
+  it('still throws when an env_var credential names an unset variable', async () => {
+    queueIntegration({ api_token: { source: 'env_var', value: 'DEFINITELY_UNSET_ENV_VAR' } })
+
+    await expect(
+      execute(makeCtx(), {
+        integration_slug: 'generic-http',
+        action_config: { url: 'https://hooks.example.com/in' },
+      })
+    ).rejects.toThrow('Environment variable DEFINITELY_UNSET_ENV_VAR for api_token is not set')
+    expect(fetchMock).not.toHaveBeenCalled()
+    const events = vi.mocked(emitLog).mock.calls.map(c => c[1])
+    expect(events).toContain('integration.credential_env_missing')
+  })
+
+  it('openai adapter still fails when no credential resolved', async () => {
+    queueIntegration({}, { outbound_adapter: 'adapters/openai-outbound' })
+
+    await expect(
+      execute(makeCtx(), {
+        integration_slug: 'openai',
+        action_config: { endpoint: '/chat/completions', body: {} },
+      })
+    ).rejects.toThrow('OpenAI adapter requires api_token credential')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+})

package/.framework/tests/unit/integrations-audit-redaction.test.ts

@@ -0,0 +1,130 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: {
+    from: vi.fn(),
+  },
+  getUserDb: vi.fn(() => ({})),
+  joins: {
+    app: 'app:apps(id, slug, name)',
+    createdBy: 'created_by:people(id, full_name)',
+  },
+}))
+
+vi.mock('../../functions/_shared/audit.ts', () => ({
+  emitAudit: vi.fn().mockResolvedValue(undefined),
+  emitLog: vi.fn().mockResolvedValue(undefined),
+  emitSpan: vi.fn().mockResolvedValue(undefined),
+  emitActivity: vi.fn().mockResolvedValue(undefined),
+}))
+
+import { adminDb } from '../../functions/_shared/db.ts'
+import { emitLog } from '../../functions/_shared/audit.ts'
+import { update, create } from '../../functions/integrations.ts'
+
+// Chainable query-builder stub — every filter/terminal method returns the
+// builder except single/maybeSingle/await, which resolve to the result.
+function q(result: { data?: any; error?: any }) {
+  const b: any = {}
+  const chainers = ['select', 'eq', 'in', 'is', 'ilike', 'filter', 'not', 'order',
+    'limit', 'update', 'insert', 'upsert', 'delete', 'neq', 'or', 'contains', 'gte', 'lte', 'range']
+  for (const m of chainers) b[m] = vi.fn(() => b)
+  b.single = vi.fn(async () => result)
+  b.maybeSingle = vi.fn(async () => result)
+  b.then = (onF: any, onR: any) => Promise.resolve(result).then(onF, onR)
+  return b
+}
+
+let queue: any[] = []
+let built: any[] = []
+
+beforeEach(() => {
+  queue = []
+  built = []
+  vi.clearAllMocks()
+  vi.mocked(adminDb.from).mockImplementation(() => {
+    const b = queue.length ? queue.shift() : q({ data: null, error: null })
+    built.push(b)
+    return b
+  })
+})
+
+// createHandler-wrapped exports invoke the inner handler directly when the
+// first arg carries requestId + principal (the ctx shortcut used by handler()).
+function makeCtx(overrides: any = {}) {
+  return {
+    requestId: 'req-1',
+    principal: {
+      id: 'user-1',
+      type: 'human',
+      accountId: 'acct-1',
+      roles: ['system_admin'],
+    },
+    accountId: 'acct-1',
+    db: adminDb,
+    query: {},
+    ...overrides,
+  }
+}
+
+describe('integrations update audit redaction (S-005)', () => {
+  it('redacts credentials in the audit after payload while writing them to the DB', async () => {
+    const integration = { id: 'int-1', name: 'OpenAI' }
+    const builder = q({ data: integration, error: null })
+    queue.push(builder)
+
+    const credentials = {
+      api_key: { source: 'value', value: 'sk-super-secret' },
+    }
+
+    const result = await update(makeCtx(), {
+      id: 'int-1',
+      name: 'OpenAI v2',
+      credentials,
+    })
+
+    expect(result).toEqual(integration)
+
+    // The DB write still receives the real credentials.
+    const written = builder.update.mock.calls[0][0]
+    expect(written.credentials).toEqual(credentials)
+    expect(written.is_configured).toBe(true)
+    expect(written.name).toBe('OpenAI v2')
+
+    // The audit payload carries only a redaction marker.
+    expect(emitLog).toHaveBeenCalledOnce()
+    const [, eventType, target, changes] = vi.mocked(emitLog).mock.calls[0]
+    expect(eventType).toBe('integration.updated')
+    expect(target).toEqual({ type: 'integration', id: 'int-1' })
+    expect(changes.after.credentials).toEqual({ __redacted: true })
+    expect(JSON.stringify(changes.after)).not.toContain('sk-super-secret')
+    expect(changes.after.name).toBe('OpenAI v2')
+  })
+
+  it('emits no credentials key in the audit payload when credentials are not updated', async () => {
+    const builder = q({ data: { id: 'int-2' }, error: null })
+    queue.push(builder)
+
+    await update(makeCtx(), { id: 'int-2', description: 'new desc' })
+
+    const [, , , changes] = vi.mocked(emitLog).mock.calls[0]
+    expect(changes.after).not.toHaveProperty('credentials')
+    expect(changes.after.description).toBe('new desc')
+  })
+
+  it('does not leak credentials in the create audit payload', async () => {
+    const builder = q({ data: { id: 'int-3' }, error: null })
+    queue.push(builder)
+
+    await create(makeCtx(), {
+      name: 'Resend',
+      integration_type: 'api',
+      provider: 'resend',
+      credentials: { api_key: { source: 'value', value: 're_secret' } },
+    })
+
+    const [, , , changes] = vi.mocked(emitLog).mock.calls[0]
+    expect(changes.after).not.toHaveProperty('credentials')
+    expect(JSON.stringify(changes.after)).not.toContain('re_secret')
+  })
+})

package/.framework/tests/unit/logging-app-id.test.ts

@@ -0,0 +1,75 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const { mockFrom, mockMaybeSingle } = vi.hoisted(() => ({
+  mockFrom: vi.fn(),
+  mockMaybeSingle: vi.fn(),
+}))
+
+vi.mock('../../functions/_shared/db.ts', () => ({
+  adminDb: { from: mockFrom },
+  getUserDb: vi.fn(),
+}))
+
+vi.mock('../../functions/_shared/middleware.ts', () => ({}))
+
+vi.mock('../../functions/_shared/principal.ts', () => ({
+  formatPrincipalForAudit: vi.fn(() => null),
+}))
+
+const APP_UUID = '5f2c1e9a-3b7d-4a8e-9c6f-1d2e3f4a5b6c'
+
+async function loadLogging() {
+  vi.resetModules()
+  return await import('../../functions/_shared/logging.ts')
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockFrom.mockReturnValue({
+    select: vi.fn(() => ({
+      eq: vi.fn(() => ({ maybeSingle: mockMaybeSingle })),
+    })),
+  })
+})
+
+describe('resolveAppUuid', () => {
+  it('returns a uuid input unchanged without a db call', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    await expect(resolveAppUuid(APP_UUID)).resolves.toBe(APP_UUID)
+    expect(mockFrom).not.toHaveBeenCalled()
+  })
+
+  it('resolves a slug via the apps lookup and caches the hit', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    mockMaybeSingle.mockResolvedValue({ data: { id: APP_UUID }, error: null })
+    await expect(resolveAppUuid('demo')).resolves.toBe(APP_UUID)
+    await expect(resolveAppUuid('demo')).resolves.toBe(APP_UUID)
+    expect(mockFrom).toHaveBeenCalledTimes(1)
+    expect(mockFrom).toHaveBeenCalledWith('apps')
+  })
+
+  it('returns null for an unknown slug and caches the miss', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    mockMaybeSingle.mockResolvedValue({ data: null, error: null })
+    await expect(resolveAppUuid('missing-app')).resolves.toBeNull()
+    await expect(resolveAppUuid('missing-app')).resolves.toBeNull()
+    expect(mockFrom).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns null on lookup error and retries instead of caching', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    mockMaybeSingle.mockResolvedValue({ data: null, error: { message: 'db down' } })
+    await expect(resolveAppUuid('demo')).resolves.toBeNull()
+    mockMaybeSingle.mockResolvedValue({ data: { id: APP_UUID }, error: null })
+    await expect(resolveAppUuid('demo')).resolves.toBe(APP_UUID)
+    expect(mockFrom).toHaveBeenCalledTimes(2)
+  })
+
+  it('returns null for null, undefined, and empty input without a db call', async () => {
+    const { resolveAppUuid } = await loadLogging()
+    await expect(resolveAppUuid(null)).resolves.toBeNull()
+    await expect(resolveAppUuid(undefined)).resolves.toBeNull()
+    await expect(resolveAppUuid('')).resolves.toBeNull()
+    expect(mockFrom).not.toHaveBeenCalled()
+  })
+})