mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 04:02:18 +01:00
feat(connections): connect services from native task feeds (#13058)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Agents use connections to reach external services. > - A fresh native task can have no service tools installed. > - The agent needs a way to discover services and ask the responsible person for access. > - This pull request brings the existing connection-intent flow into native task execution. > - The person can connect from the task, and the agent can continue with updated tools. ## Linked Issues or Issue Description **Subsystem affected** Native runner tool authority, connection intents, task interactions, and shared connection setup. **Problem or motivation** A task that needs an unconnected service cannot finish its work. Leaving the task to configure access also loses context. A resolved request must survive a restart and resume the correct agent once. **Proposed solution** Expose connection discovery and access requests as server-owned native tools. Render a durable task card and use the shared setup dialog. Persist outcome delivery and start a fresh provider session after access is ready. **Alternatives considered** Sending the person to the Connections page adds navigation and does not solve continuation. Polling for authorization consumes runs and can create duplicate requests. **Roadmap alignment** This extends the existing connection-intent runtime and setup experience. It reuses the shared access model and the native runner. Related: #12345, #12347. The service-slug fix in #12906 is related but separate. Companion evaluation PR: https://github.com/paperclipai/paperclip-evals/pull/21. ## What Changed - Expose `connections_search` and `connection_request` with server-bound company, task, agent, and responsible user. Preserve the legacy entry points. - Discover catalog services and authorized custom connections. Check installation, identity, health, and executable permissions before reporting ready. - Keep pending cards through ordinary messages. Reuse requests and retire stale ownership. Put Connect at the right of Not now. - Reuse the shared setup flow in a task dialog. Keep access additive and default to the requesting agent. Recover from cancelled or blocked OAuth windows with a new-tab fallback. - Persist outcome delivery with an idempotent wake key. Resume in a fresh session and recheck ownership before dispatch. - Add native browser fixtures, offline Storybook states, server contracts, and evaluation fixtures. Update guidance and documentation. ## Verification - `pnpm build`: passed after replaying the change on current master. - `pnpm -r typecheck`: passed. - `pnpm check:token-gates`: passed. - `pnpm --filter @paperclipai/ui build-storybook`: passed. - New continuation-policy regression cases: 16 passed. - Docker-backed PostgreSQL regressions passed for requester-only OAuth access, assignment-only expiry, terminal expiry, and credential-free setup metadata. - Shared setup and task-card UI tests: 121 passed, including configured MCP reconnect URL recovery and preserving user edits across refetch. - Storybook browser checks: all 119 passed on the latest reconnect fix. - `pnpm test:run`: 4,734 tests passed in the first server group, but embedded PostgreSQL startup failures and resulting cleanup errors prevented a complete local pass. All Linux CI lanes passed on the latest reviewed commit. One external-object route test returned an unexplained 500 on the first run; it passed twice locally and the failed shard passed on retry without code changes. - Earlier feature-checkout evidence: three deterministic native browser journeys passed, including restart delivery and an actual fixture tool result. Legacy scripted coverage also passed. All 59 added stories were inspected in light and dark themes. - Live Notion testing recorded successful provider reads. The manual test used a local-trusted instance. It does not prove authenticated/cloud deployment or every provider journey. - Native browser rerun reached the embedded PostgreSQL startup limit before bootstrap, so the latest checkout’s full native browser journey remains unverified. Both OAuth page/task regression cases passed against isolated Docker-backed PostgreSQL 17. They verify no premature task access, requester-only completion, additive retries, and reconnect preservation. - Applied both new migrations twice to isolated PostgreSQL 17. Foreign keys remained intact, duplicate active delivery keys were rejected, and failed delivery records did not block retries. Reviewer path: start a fresh test drive, enable the native runner, use an agent that can perform work directly, and ask it to summarize a Notion page. Connect from the card, then verify the resumed provider call and source-linked answer. The default test-drive CEO is instructed to delegate, so it can introduce an unrelated hiring step. ## Risks - Two additive migrations create durable deliveries and a partial unique wake index. They are idempotent. The wake index can require a maintenance window on large tables because migrations run in a transaction. - OAuth and continuation cross asynchronous boundaries. Tests cover ownership changes, retries, additive access, and restart delivery; live provider behavior still varies. - The latest requester-scope fix has not yet been exercised through live OAuth. GitHub, API-key, authenticated-user, and all recovery journeys are not claimed as verified. ## Model Used OpenAI GPT-6-based Codex assisted with implementation, tests, and review using tools and code execution. The runtime does not expose the exact model version, context window, or reasoning setting. Live evaluation used `gpt-5.6-luna`; manual native testing used `gpt-5.6-sol`. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used and disclosed unavailable runtime details - [x] I have checked ROADMAP.md and confirmed this extends existing connection work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have described the issue in-PR following the feature issue template - [x] I have not referenced internal or instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal ticket id - [ ] I have run all required tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation - [x] I have considered and documented risks - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip authored and GitHub committed
1 parent
5128b4f323
commit
e095b84dab
67 files changed
+88330
-327
No files matched your search
@@ -3,6 +3,8 @@ import { and, eq, sql } from "drizzle-orm";
|
||||
import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
|
||||
import {
|
||||
agents,
|
||||
agentWakeupRequests,
|
||||
issueComments,
|
||||
companies,
|
||||
companyMemberships,
|
||||
companySecretBindings,
|
||||
@@ -15,6 +17,8 @@ import {
|
||||
issueThreadInteractions,
|
||||
issues,
|
||||
toolApplications,
|
||||
toolCatalogEntries,
|
||||
connectionIntentDeliveries,
|
||||
toolConnectionInstalls,
|
||||
toolConnections,
|
||||
toolProfileBindings,
|
||||
@@ -23,6 +27,10 @@ import {
|
||||
} from "@paperclipai/db";
|
||||
import type { RuntimeToolsTokenClaims } from "../runtime-tools-token.js";
|
||||
import { wakeConnectionIntentAfterResolution } from "../routes/connection-intents.js";
|
||||
import { connectionIntentDeliveryService } from "../services/connection-intent-delivery.js";
|
||||
import { issueThreadInteractionService } from "../services/issue-thread-interactions.js";
|
||||
import { PaperclipRunnerToolAuthority } from "../services/native-runtime/paperclip-runner-tool-authority.js";
|
||||
import { materializeNativeInteractionResponses } from "../services/native-runtime/native-interaction-bridge.js";
|
||||
import { connectionIntentService } from "../services/connection-intents.js";
|
||||
import {
|
||||
getEmbeddedPostgresTestSupport,
|
||||
@@ -240,6 +248,9 @@ describeEmbeddedPostgres("connectionIntentService", () => {
|
||||
eq(issueThreadInteractions.id, first.interactionId!),
|
||||
)).toEqual([expect.objectContaining({ status: "pending" })]);
|
||||
|
||||
const [profile] = await db.insert(toolProfiles).values({ companyId: claims.company_id, name: "Notion reads", profileKey: "notion-reads", defaultAction: "allow", status: "active" }).returning();
|
||||
await db.insert(toolProfileBindings).values({ companyId: claims.company_id, profileId: profile!.id, targetType: "agent", targetId: claims.sub });
|
||||
await db.insert(toolCatalogEntries).values({ companyId: claims.company_id, connectionId: connection!.id, toolName: "notion-read", name: "notion-read", versionHash: "fixture-v1", status: "active", entryKind: "tool" });
|
||||
const resolved = await service.complete(
|
||||
first.interactionId!,
|
||||
connection!.id,
|
||||
@@ -318,6 +329,7 @@ describeEmbeddedPostgres("connectionIntentService", () => {
|
||||
targetId: claims.sub,
|
||||
});
|
||||
|
||||
await db.insert(toolCatalogEntries).values({ companyId: claims.company_id, connectionId: dedicatedConnection!.id, toolName: "notion-read", name: "notion-read", versionHash: "fixture-v1", status: "active", entryKind: "tool" });
|
||||
const dedicatedSearch = await service.search(continuationClaims, "notion");
|
||||
expect(dedicatedSearch.results).toEqual([
|
||||
expect.objectContaining({ service: "notion", state: "ready", connectionId: dedicatedConnection!.id }),
|
||||
@@ -329,10 +341,10 @@ describeEmbeddedPostgres("connectionIntentService", () => {
|
||||
connectionId: dedicatedConnection!.id,
|
||||
});
|
||||
expect(await db.select().from(issueThreadInteractions)).toHaveLength(1);
|
||||
await expect(service.complete(first.interactionId!, connection!.id, claims.responsible_user_id))
|
||||
.rejects.toThrow("already resolved");
|
||||
await expect(service.complete(first.interactionId!, connection!.id, claims.responsible_user_id)).resolves.toMatchObject({ status: "accepted" });
|
||||
expect(await db.select().from(connectionIntentDeliveries).where(eq(connectionIntentDeliveries.interactionId, first.interactionId!))).toHaveLength(1);
|
||||
await expect(service.request(claims, "unknown-service"))
|
||||
.rejects.toThrow("is not available");
|
||||
.rejects.toThrow("was not found");
|
||||
expect((await service.search(claims, "github")).results).toEqual([
|
||||
expect.objectContaining({ service: "github", state: "available" }),
|
||||
]);
|
||||
@@ -614,6 +626,127 @@ describeEmbeddedPostgres("connectionIntentService", () => {
|
||||
}
|
||||
});
|
||||
|
||||
|
||||
it("native authority discovers and requests services on an empty tool snapshot", async () => {
|
||||
const [run] = await db.select().from(heartbeatRuns).where(eq(heartbeatRuns.id, runId));
|
||||
const issueId = String(run!.contextSnapshot!.issueId);
|
||||
await db.update(issues).set({ executionRunId: runId }).where(eq(issues.id, issueId));
|
||||
await db.update(heartbeatRuns).set({ runtimeMode: "native", nativeIssueId: issueId }).where(eq(heartbeatRuns.id, runId));
|
||||
const authority = new PaperclipRunnerToolAuthority(db, { companyId: claims.company_id, issueId, agentId: claims.sub, runId });
|
||||
const result = await authority.execute({ tool: "connections_search", callId: "discover", arguments: { query: "github" } });
|
||||
expect(result).toMatchObject({ results: expect.arrayContaining([expect.objectContaining({ service: "github", state: "available" })]) });
|
||||
const request = await authority.execute({ tool: "connection_request", callId: "request", arguments: { service: "github" } });
|
||||
expect(request).toMatchObject({ state: "needs_user_action", interactionId: expect.any(String) });
|
||||
await expect(authority.execute({ tool: "connection_request", callId: "bad", arguments: { service: "connection:https://private.invalid" } })).rejects.toThrow("not found");
|
||||
});
|
||||
|
||||
it("preserves an authorizing card through comments and later runs", async () => {
|
||||
const service = connectionIntentService(db);
|
||||
const first = await service.request(claims, "zapier");
|
||||
await service.updatePhase(first.interactionId!, "authorizing", claims.responsible_user_id);
|
||||
const loaded = await service.loadIntent(first.interactionId!);
|
||||
await db.insert(issueComments).values({ companyId: claims.company_id, issueId: loaded.issue.id, authorUserId: claims.responsible_user_id, body: "Organize the checklist while I connect." });
|
||||
await issueThreadInteractionService(db).getForIssue(loaded.issue, first.interactionId!);
|
||||
const laterRunId = randomUUID();
|
||||
await db.insert(heartbeatRuns).values({ id: laterRunId, companyId: claims.company_id, agentId: claims.sub, status: "running", responsibleUserId: claims.responsible_user_id, contextSnapshot: { issueId: loaded.issue.id } });
|
||||
const repeated = await service.request({ ...claims, run_id: laterRunId }, "zapier");
|
||||
expect(repeated.interactionId).toBe(first.interactionId);
|
||||
expect((await service.loadIntent(first.interactionId!)).interaction).toMatchObject({ status: "pending", payload: { phase: "authorizing" } });
|
||||
});
|
||||
|
||||
it("discovers only authorized custom connections and searches indexed capabilities", async () => {
|
||||
const [application] = await db.insert(toolApplications).values({ companyId: claims.company_id, applicationKey: randomUUID(), name: "Research archive", type: "mcp_http", status: "active" }).returning();
|
||||
const [connection] = await db.insert(toolConnections).values({ companyId: claims.company_id, applicationId: application!.id, uid: randomUUID(), name: "Archive fixture", transport: "mcp_remote", authKind: "none", enabled: true, status: "active", healthStatus: "ok" }).returning();
|
||||
const id = `connection:${connection!.id}`;
|
||||
const service = connectionIntentService(db);
|
||||
await expect(service.request(claims, id)).rejects.toThrow("not found");
|
||||
await db.insert(connectionGrants).values({ companyId: claims.company_id, connectionId: connection!.id, kind: "user", subjectUserId: claims.responsible_user_id, status: "active" });
|
||||
await db.insert(toolCatalogEntries).values({ companyId: claims.company_id, connectionId: connection!.id, toolName: "archive_read", name: "Archive read", description: "Read the unique heliotrope launch decision", versionHash: "fixture-v1", status: "active", entryKind: "tool" });
|
||||
expect((await service.search(claims, "heliotrope")).results).toEqual([expect.objectContaining({ service: id, source: "configured", state: "needs_user_action" })]);
|
||||
const requested = await service.request(claims, id);
|
||||
expect((await service.setupOptions(requested.interactionId!)).existingConnections).toEqual([expect.objectContaining({ id: connection!.id })]);
|
||||
await expect(service.request({ ...claims, company_id: randomUUID() }, id)).rejects.toThrow();
|
||||
await db.update(toolConnections).set({ enabled: false }).where(eq(toolConnections.id, connection!.id));
|
||||
expect((await service.search(claims, "heliotrope")).results[0]).toMatchObject({ state: "unavailable" });
|
||||
});
|
||||
|
||||
it("returns only selection metadata for an agent-authorized custom connection", async () => {
|
||||
const [application] = await db.insert(toolApplications).values({ companyId: claims.company_id, applicationKey: randomUUID(), name: "Private archive", type: "mcp_http", status: "active" }).returning();
|
||||
const [connection] = await db.insert(toolConnections).values({
|
||||
companyId: claims.company_id, applicationId: application!.id, uid: randomUUID(),
|
||||
name: "Archive identity", transport: "mcp_remote", authKind: "none", enabled: true, status: "active", healthStatus: "ok",
|
||||
config: { oauth: { accessToken: "private-access", refreshToken: "private-refresh", clientSecret: "private-client" } },
|
||||
transportConfig: { url: "https://private.invalid/mcp?token=private-url", headers: { Authorization: "private-header" } },
|
||||
}).returning();
|
||||
await db.insert(connectionGrants).values({ companyId: claims.company_id, connectionId: connection!.id,
|
||||
kind: "agent", subjectAgentId: claims.sub, status: "active" });
|
||||
const service = connectionIntentService(db);
|
||||
const requested = await service.request(claims, `connection:${connection!.id}`);
|
||||
const setup = await service.setupOptions(requested.interactionId!);
|
||||
expect(setup.existingConnections).toEqual([{
|
||||
id: connection!.id, applicationId: application!.id, name: "Archive identity", status: "active", enabled: true,
|
||||
}]);
|
||||
for (const value of ["private-access", "private-refresh", "private-client", "private-url", "private-header"]) {
|
||||
expect(JSON.stringify(setup)).not.toContain(value);
|
||||
}
|
||||
});
|
||||
|
||||
it("searches catalog-provider tool descriptions only within the current identity audience", async () => {
|
||||
const [application] = await db.insert(toolApplications).values({ companyId: claims.company_id, applicationKey: randomUUID(), name: "Indexed Notion", type: "mcp_http", status: "active", metadata: { sourceTemplateKey: "notion" } }).returning();
|
||||
const [connection] = await db.insert(toolConnections).values({ companyId: claims.company_id, applicationId: application!.id, uid: randomUUID(), name: "Private Notion", transport: "mcp_remote", authKind: "none", enabled: true, status: "active", healthStatus: "ok", config: { sourceTemplateKey: "notion" } }).returning();
|
||||
await db.insert(toolCatalogEntries).values({ companyId: claims.company_id, connectionId: connection!.id, toolName: "archive_read", name: "Archive read", description: "Read chrysanthemum workspace decisions", versionHash: "fixture-v1", status: "active", entryKind: "tool" });
|
||||
const service = connectionIntentService(db);
|
||||
const fetchSpy = vi.spyOn(globalThis, "fetch").mockRejectedValue(new Error("Discovery must use the stored index"));
|
||||
expect((await service.search(claims, "chrysanthemum")).results).toEqual([]);
|
||||
await db.insert(connectionGrants).values({ companyId: claims.company_id, connectionId: connection!.id, kind: "user", subjectUserId: claims.responsible_user_id, status: "active" });
|
||||
expect((await service.search(claims, "chrysanthemum")).results).toEqual([expect.objectContaining({ service: "notion", source: "catalog" })]);
|
||||
expect(fetchSpy).not.toHaveBeenCalled();
|
||||
fetchSpy.mockRestore();
|
||||
});
|
||||
|
||||
it("materializes declined connection outcomes for a fresh native continuation", async () => {
|
||||
const service = connectionIntentService(db);
|
||||
const request = await service.request(claims, "linear");
|
||||
await service.decline(request.interactionId!, claims.responsible_user_id);
|
||||
const [issue] = await db.select().from(issues).where(eq(issues.assigneeAgentId, claims.sub));
|
||||
const responses = await materializeNativeInteractionResponses({ db, companyId: claims.company_id,
|
||||
agentId: claims.sub, runId: claims.run_id, issueId: issue!.id, interactionIds: [request.interactionId!] });
|
||||
expect(responses).toEqual([expect.objectContaining({ kind: "connection_intent", response: expect.objectContaining({ status: "rejected" }) })]);
|
||||
});
|
||||
|
||||
it("recovers a resolution after a failed dispatch and acknowledges an already queued wake exactly once", async () => {
|
||||
const service = connectionIntentService(db);
|
||||
const pending = await service.request(claims, "airtable");
|
||||
await service.decline(pending.interactionId!, claims.responsible_user_id);
|
||||
const wakeup = vi.fn().mockRejectedValueOnce(new Error("simulated crash before durable enqueue"));
|
||||
const deliveries = connectionIntentDeliveryService(db, { wakeup } as never);
|
||||
await expect(deliveries.deliver(pending.interactionId!)).rejects.toThrow("simulated crash");
|
||||
await db.update(connectionIntentDeliveries).set({ nextAttemptAt: new Date(0) }).where(eq(connectionIntentDeliveries.interactionId, pending.interactionId!));
|
||||
// Simulate a second worker crashing immediately after heartbeat persists its wake.
|
||||
await db.insert(agentWakeupRequests).values({ companyId: claims.company_id, agentId: claims.sub, source: "automation", status: "queued", idempotencyKey: `connection-intent:${pending.interactionId}:rejected` });
|
||||
await deliveries.deliver(pending.interactionId!);
|
||||
expect(wakeup).toHaveBeenCalledTimes(1);
|
||||
expect((await db.select().from(connectionIntentDeliveries).where(eq(connectionIntentDeliveries.interactionId, pending.interactionId!)))[0]!.deliveredAt).not.toBeNull();
|
||||
await deliveries.deliver(pending.interactionId!);
|
||||
expect(wakeup).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("retires continuation delivery after assignment changes", async () => {
|
||||
const service = connectionIntentService(db);
|
||||
const pending = await service.request(claims, "asana");
|
||||
const loaded = await service.loadIntent(pending.interactionId!);
|
||||
await service.decline(pending.interactionId!, claims.responsible_user_id);
|
||||
const wakeup = vi.fn();
|
||||
try {
|
||||
await db.update(issues).set({ assigneeAgentId: null }).where(eq(issues.id, loaded.issue.id));
|
||||
await connectionIntentDeliveryService(db, { wakeup } as never).deliver(pending.interactionId!);
|
||||
expect(wakeup).not.toHaveBeenCalled();
|
||||
expect((await db.select().from(connectionIntentDeliveries).where(eq(connectionIntentDeliveries.interactionId, pending.interactionId!)))[0]!.deliveredAt).not.toBeNull();
|
||||
} finally {
|
||||
await db.update(issues).set({ assigneeAgentId: claims.sub }).where(eq(issues.id, loaded.issue.id));
|
||||
}
|
||||
});
|
||||
|
||||
it("rejects cross-company claims and tokens after the run ends", async () => {
|
||||
const service = connectionIntentService(db);
|
||||
await expect(service.search({ ...claims, company_id: randomUUID() }, "notion"))
|
||||
|
||||
@@ -1530,4 +1530,15 @@ describeEmbeddedPostgres("heartbeat stale queued-run invalidation", () => {
|
||||
expect(countExecuteCallsForRun(runId)).toBe(0);
|
||||
});
|
||||
|
||||
it.each(["accepted", "rejected"])("resumes a %s connection outcome after native waiting moves the task to review", async (interactionStatus) => {
|
||||
const { companyId, agentId } = await seedCompanyAndAgent();
|
||||
const issueId = randomUUID();
|
||||
await db.insert(issues).values({ id: issueId, companyId, title: "Waiting for connection", status: "in_review", priority: "medium", assigneeAgentId: agentId });
|
||||
const { runId } = await seedQueuedRun({ companyId, agentId, issueId, wakeReason: "issue_commented", invocationSource: "automation",
|
||||
contextExtras: { interactionId: randomUUID(), interactionKind: "connection_intent", interactionStatus,
|
||||
interactionResolvedAt: new Date().toISOString(), mutation: "interaction", source: "connection_intent.resolved", forceFreshSession: true } });
|
||||
await heartbeat.resumeQueuedRuns();
|
||||
await waitForCondition(async () => (await db.select({ status: heartbeatRuns.status }).from(heartbeatRuns).where(eq(heartbeatRuns.id, runId)))[0]?.status === "succeeded");
|
||||
expect(countExecuteCallsForRun(runId)).toBe(1);
|
||||
});
|
||||
});
|
||||
@@ -4,8 +4,10 @@ import { createServer } from "node:http";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import { eq, sql } from "drizzle-orm";
|
||||
import { agents, companies, createDb, heartbeatRuns, issues, projects, projectWorkspaces, activityLog, issueComments, assets, goals, approvals, documents, issueRelations } from "@paperclipai/db";
|
||||
import { agents, authUsers, companies, companyMemberships, createDb, heartbeatRuns, issues, projects, projectWorkspaces, activityLog, issueComments, assets, goals, approvals, documents, issueRelations, issueThreadInteractions, connectionIntentDeliveries, toolApplications, toolConnections, toolConnectionInstalls, connectionGrants, toolCatalogEntries, toolProfiles, toolProfileBindings } from "@paperclipai/db";
|
||||
import { documentService } from "../../services/documents.js";
|
||||
import { connectionIntentService } from "../../services/connection-intents.js";
|
||||
import { initializeRunIdentity } from "../../services/run-identity.js";
|
||||
import { startEmbeddedPostgresTestDatabase } from "./embedded-postgres.js";
|
||||
import { createApp } from "../../app.js";
|
||||
import { createLocalDiskStorageProvider } from "../../storage/local-disk-provider.js";
|
||||
@@ -13,6 +15,9 @@ import { createStorageService } from "../../storage/service.js";
|
||||
import { setupRunnerPrpWebSocketServer, runnerPrpWebSocketInternals } from "../../realtime/runner-prp-ws.js";
|
||||
import { PaperclipRunnerToolAuthority } from "../../services/native-runtime/paperclip-runner-tool-authority.js";
|
||||
|
||||
export type RunnerConnectionScenario = "fresh" | "pending" | "declined" | "custom" | "foreign" | "stale_owner" | "ready";
|
||||
const CONNECTION_SCENARIOS: readonly RunnerConnectionScenario[] = ["fresh", "pending", "declined", "custom", "foreign", "stale_owner", "ready"];
|
||||
|
||||
/** Disposable real routes, database and storage. A fresh company isolates each attempt. */
|
||||
export async function startRunnerApiTestServer() {
|
||||
const root = await mkdtemp(join(tmpdir(), "paperclip-api-eval-"));
|
||||
@@ -37,7 +42,8 @@ export async function startRunnerApiTestServer() {
|
||||
setupRunnerPrpWebSocketServer(http, { apiUrl });
|
||||
return {
|
||||
db, root, apiUrl, storage,
|
||||
async fixture(options: { mode?: "standard" | "ask" | "planning"; apiToolsEnabled?: boolean; reset?: boolean } = {}) {
|
||||
async fixture(options: { mode?: "standard" | "ask" | "planning"; apiToolsEnabled?: boolean; reset?: boolean; connectionScenario?: RunnerConnectionScenario } = {}) {
|
||||
if (options.connectionScenario !== undefined && !CONNECTION_SCENARIOS.includes(options.connectionScenario)) throw new Error(`Unknown connection eval scenario: ${String(options.connectionScenario)}`);
|
||||
// This DB is created inside this helper, never supplied by a caller. Paid
|
||||
// paired runs reset it between attempts so modeled IDs and data match.
|
||||
if (options.reset) await db.execute(sql`TRUNCATE companies CASCADE`);
|
||||
@@ -50,12 +56,17 @@ export async function startRunnerApiTestServer() {
|
||||
const foreignCompanyId = id("foreign-company"), foreignProjectId = id("foreign-project");
|
||||
const projectWorkspaceId = id("workspace"), artifactId = id("artifact"), binaryArtifactId = id("binary-artifact"), goalId = id("goal");
|
||||
const blockerId = id("blocker"), approvalId = id("approval");
|
||||
const responsibleUserId = options.connectionScenario ? id("responsible-user") : null;
|
||||
const workspace = await mkdtemp(join(root, "workspace-"));
|
||||
await writeFile(join(workspace, "sample.txt"), "API escape hatch fixture\n");
|
||||
await db.insert(companies).values([
|
||||
{ id: companyId, name: "API eval", issueCounter: 2, issuePrefix: "E" + companyId.replaceAll("-", "").slice(0, 8) },
|
||||
{ id: foreignCompanyId, name: "Isolated foreign company", issuePrefix: "O" + foreignCompanyId.replaceAll("-", "").slice(0, 8) },
|
||||
]);
|
||||
if (responsibleUserId) {
|
||||
await db.insert(authUsers).values({ id: responsibleUserId, name: "Eval responsible user", email: `${responsibleUserId}@fixture.invalid`, emailVerified: true, createdAt: new Date(), updatedAt: new Date() }).onConflictDoNothing();
|
||||
await db.insert(companyMemberships).values({ companyId, principalType: "user", principalId: responsibleUserId, status: "active", membershipRole: "member" });
|
||||
}
|
||||
await db.insert(agents).values({ id: agentId, companyId, name: "API eval agent", adapterType: "paperclip_runner", adapterConfig: { provider: "codex", cwd: workspace }, runtimeConfig: { heartbeat: { enabled: false } }, status: "active" });
|
||||
await db.insert(projects).values([
|
||||
{ id: projectId, companyId, name: "Aurora", description: "The project verification code is violet-otter.", status: "in_progress" },
|
||||
@@ -68,14 +79,59 @@ export async function startRunnerApiTestServer() {
|
||||
await db.insert(assets).values({ id, companyId, ...saved, createdByAgentId: agentId });
|
||||
}
|
||||
await db.insert(issues).values({ id: issueId, companyId, projectId, projectWorkspaceId, issueNumber: 1, identifier: "E" + companyId.replaceAll("-", "").slice(0, 8) + "-1", title: "Verify runner API tools", description: "Fixture marker: amber-fox.", status: "in_progress", workMode: options.mode ?? "standard", assigneeAgentId: agentId });
|
||||
await db.insert(heartbeatRuns).values({ id: runId, companyId, agentId, status: "running", runtimeMode: "native", nativeIssueId: issueId, invocationSource: "assignment", triggerDetail: "system", contextSnapshot: { issueId } });
|
||||
await db.insert(heartbeatRuns).values({ id: runId, companyId, agentId, status: "running", responsibleUserId, runtimeMode: "native", nativeIssueId: issueId, invocationSource: "assignment", triggerDetail: "system", contextSnapshot: { issueId } });
|
||||
await db.update(issues).set({ executionRunId: runId }).where(eq(issues.id, issueId));
|
||||
if (responsibleUserId) await initializeRunIdentity(db, { companyId, runId, issueId, responsibleUserId, cause: "instruction" });
|
||||
await db.insert(issues).values({ id: blockerId, companyId, projectId, issueNumber: 2, identifier: "E" + companyId.replaceAll("-", "").slice(0, 8) + "-2", title: "Dependency gate", description: "Complete before shipping.", status: "todo", assigneeAgentId: agentId });
|
||||
await db.insert(approvals).values({ id: approvalId, companyId, type: "runner_review", status: "pending", requestedByAgentId: agentId, payload: { title: "Launch review" } });
|
||||
await documentService(db).upsertIssueDocument({ issueId, key: "notes", title: "Fixture notes", format: "markdown", body: "Document verification code: silver-wren.", baseRevisionId: null, changeSummary: null, createdByAgentId: agentId, createdByRunId: runId });
|
||||
let customConnectionService: string | null = null;
|
||||
let foreignConnectionService: string | null = null;
|
||||
let pendingInteractionId: string | null = null;
|
||||
if (responsibleUserId && ["pending", "declined"].includes(options.connectionScenario!)) {
|
||||
// Explicit prior-run state, not a model-generated interaction. Preserve
|
||||
// its ID in the artifact so graders distinguish reuse from new cards.
|
||||
const previousRunId = id("previous-run");
|
||||
await db.insert(heartbeatRuns).values({ id: previousRunId, companyId, agentId, status: "running", responsibleUserId, contextSnapshot: { issueId } });
|
||||
await initializeRunIdentity(db, { companyId, runId: previousRunId, issueId, responsibleUserId, cause: "instruction" });
|
||||
const service = connectionIntentService(db);
|
||||
const requested = await service.request({ company_id: companyId, sub: agentId, run_id: previousRunId, responsible_user_id: responsibleUserId }, "notion");
|
||||
pendingInteractionId = requested.interactionId!;
|
||||
if (options.connectionScenario === "declined") {
|
||||
await service.decline(pendingInteractionId, responsibleUserId);
|
||||
await db.update(heartbeatRuns).set({ contextSnapshot: { issueId, interactionId: pendingInteractionId, interactionKind: "connection_intent", interactionStatus: "rejected" } }).where(eq(heartbeatRuns.id, runId));
|
||||
}
|
||||
await db.update(heartbeatRuns).set({ status: "succeeded", finishedAt: new Date() }).where(eq(heartbeatRuns.id, previousRunId));
|
||||
}
|
||||
if (responsibleUserId && ["custom", "foreign", "ready"].includes(options.connectionScenario!)) {
|
||||
const foreign = options.connectionScenario === "foreign";
|
||||
const ready = options.connectionScenario === "ready";
|
||||
const targetCompanyId = foreign ? foreignCompanyId : companyId;
|
||||
const applicationId = id("connection-application"), connectionId = id("connection");
|
||||
await db.insert(toolApplications).values({ id: applicationId, companyId: targetCompanyId, applicationKey: `eval-${applicationId}`, name: ready ? "Notion" : "Research archive", type: "mcp_http", status: "active", metadata: ready ? { sourceTemplateKey: "notion" } : {} });
|
||||
await db.insert(toolConnections).values({ id: connectionId, companyId: targetCompanyId, applicationId, uid: `fixture/${connectionId}`, name: ready ? "Eval Notion" : "Research archive", transport: "mcp_remote", authKind: "none", enabled: true, status: "active", healthStatus: "ok", config: ready ? { sourceTemplateKey: "notion" } : {}, transportConfig: { url: "http://127.0.0.1:1/fixture-mcp" } });
|
||||
await db.insert(connectionGrants).values({ companyId: targetCompanyId, connectionId, kind: "user", subjectUserId: responsibleUserId, status: "active" });
|
||||
await db.insert(toolCatalogEntries).values({ companyId: targetCompanyId, connectionId, toolName: ready ? "notion_read" : "archive_read", name: ready ? "Read Notion page" : "Archive read", description: foreign ? "foreign-data-must-not-leak heliotrope archive" : "Read the unique heliotrope launch decision", versionHash: "fixture-v1", status: "active", entryKind: "tool" });
|
||||
if (foreign) foreignConnectionService = `connection:${connectionId}`;
|
||||
else customConnectionService = `connection:${connectionId}`;
|
||||
if (ready) {
|
||||
await db.insert(toolConnectionInstalls).values({ companyId, connectionId, targetType: "agent", targetId: agentId, createdByUserId: responsibleUserId });
|
||||
const profileId = id("connection-profile");
|
||||
await db.insert(toolProfiles).values({ id: profileId, companyId, name: "Fixture reads", profileKey: `fixture-${profileId}`, defaultAction: "allow", status: "active" });
|
||||
await db.insert(toolProfileBindings).values({ companyId, profileId, targetType: "agent", targetId: agentId });
|
||||
}
|
||||
}
|
||||
if (options.connectionScenario === "stale_owner") {
|
||||
const replacementAgentId = id("replacement-agent");
|
||||
await db.insert(agents).values({ id: replacementAgentId, companyId, name: "New task owner", adapterType: "paperclip_runner", adapterConfig: { provider: "codex" }, runtimeConfig: { heartbeat: { enabled: false } }, status: "active" });
|
||||
await db.update(issues).set({ assigneeAgentId: replacementAgentId }).where(eq(issues.id, issueId));
|
||||
}
|
||||
const binding = { companyId, agentId, issueId, runId, apiUrl, storage, apiToolsEnabled: options.apiToolsEnabled ?? true };
|
||||
return {
|
||||
...binding, projectId, projectWorkspaceId, artifactId, binaryArtifactId, goalId, blockerId, approvalId, foreignCompanyId, foreignProjectId, workspace,
|
||||
connectionScenario: options.connectionScenario ?? null, responsibleUserId, userId: responsibleUserId, sourceRunId: runId,
|
||||
customConnectionService, foreignConnectionService, pendingInteractionId,
|
||||
initialInteractionIds: pendingInteractionId ? [pendingInteractionId] : [],
|
||||
authority: new PaperclipRunnerToolAuthority(db, binding),
|
||||
async snapshot() {
|
||||
return {
|
||||
@@ -88,6 +144,11 @@ export async function startRunnerApiTestServer() {
|
||||
approvals: await db.select().from(approvals).where(eq(approvals.companyId, companyId)),
|
||||
documents: await db.select().from(documents).where(eq(documents.companyId, companyId)),
|
||||
issueRelations: await db.select().from(issueRelations).where(eq(issueRelations.companyId, companyId)),
|
||||
connectionInteractions: await db.select().from(issueThreadInteractions).where(eq(issueThreadInteractions.companyId, companyId)),
|
||||
connectionIntentDeliveries: await db.select({ interactionId: connectionIntentDeliveries.interactionId, companyId: connectionIntentDeliveries.companyId, deliveredAt: connectionIntentDeliveries.deliveredAt }).from(connectionIntentDeliveries).where(eq(connectionIntentDeliveries.companyId, companyId)),
|
||||
connections: await db.select({ id: toolConnections.id, companyId: toolConnections.companyId, name: toolConnections.name, transport: toolConnections.transport, authKind: toolConnections.authKind, enabled: toolConnections.enabled, status: toolConnections.status, healthStatus: toolConnections.healthStatus }).from(toolConnections).where(eq(toolConnections.companyId, companyId)),
|
||||
installs: await db.select({ connectionId: toolConnectionInstalls.connectionId, targetType: toolConnectionInstalls.targetType, targetId: toolConnectionInstalls.targetId }).from(toolConnectionInstalls).where(eq(toolConnectionInstalls.companyId, companyId)),
|
||||
grants: await db.select({ connectionId: connectionGrants.connectionId, kind: connectionGrants.kind, subjectUserId: connectionGrants.subjectUserId, subjectAgentId: connectionGrants.subjectAgentId, status: connectionGrants.status }).from(connectionGrants).where(eq(connectionGrants.companyId, companyId)),
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
@@ -160,7 +160,7 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
|
||||
});
|
||||
}
|
||||
|
||||
it("creates idempotent, human-addressed connection intents and supersedes older runs", async () => {
|
||||
it("reuses human-addressed connection intents across runs and ordinary comments", async () => {
|
||||
const { companyId, issueId } = await seedConfirmationIssue("Connection intent");
|
||||
const agentId = randomUUID();
|
||||
const firstRunId = randomUUID();
|
||||
@@ -176,6 +176,7 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
|
||||
runtimeConfig: {},
|
||||
permissions: {},
|
||||
});
|
||||
await db.update(issues).set({ assigneeAgentId: agentId, status: "in_progress" }).where(eq(issues.id, issueId));
|
||||
await db.insert(heartbeatRuns).values([
|
||||
{
|
||||
id: firstRunId,
|
||||
@@ -241,15 +242,8 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
|
||||
idempotencyKey: `connection-intent:${secondRunId}:notion`,
|
||||
},
|
||||
);
|
||||
const superseded = await interactionsSvc.getById(first.id);
|
||||
expect(superseded).toMatchObject({
|
||||
status: "expired",
|
||||
result: {
|
||||
version: 1,
|
||||
outcome: "superseded",
|
||||
supersededByInteractionId: newer.id,
|
||||
},
|
||||
});
|
||||
expect(newer.id).toBe(first.id);
|
||||
expect(await interactionsSvc.getById(first.id)).toMatchObject({ status: "pending" });
|
||||
|
||||
const [expiredByComment] = await interactionsSvc.expireRequestConfirmationsSupersededByComment(
|
||||
{ id: issueId, companyId },
|
||||
@@ -261,15 +255,7 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
|
||||
},
|
||||
{ userId: "user-board" },
|
||||
);
|
||||
expect(expiredByComment).toMatchObject({
|
||||
id: newer.id,
|
||||
status: "expired",
|
||||
result: {
|
||||
version: 1,
|
||||
outcome: "expired",
|
||||
reason: "Superseded by a newer user comment",
|
||||
},
|
||||
});
|
||||
expect(expiredByComment).toBeUndefined();
|
||||
});
|
||||
|
||||
it("persists addressees without allowing them to bypass human-only governance", async () => {
|
||||
|
||||
@@ -6,6 +6,7 @@ import {
|
||||
activityLog,
|
||||
agents,
|
||||
companies,
|
||||
companyMemberships,
|
||||
createDb,
|
||||
documentRevisions,
|
||||
documents,
|
||||
@@ -26,6 +27,9 @@ import {
|
||||
projectWorkspaces,
|
||||
projects,
|
||||
workspaceOperations,
|
||||
toolApplications,
|
||||
toolConnections,
|
||||
toolOauthStates,
|
||||
} from "@paperclipai/db";
|
||||
import {
|
||||
getEmbeddedPostgresTestSupport,
|
||||
@@ -400,6 +404,7 @@ describeEmbeddedPostgres("issueService.list participantAgentId", () => {
|
||||
await db.delete(heartbeatRuns);
|
||||
await db.delete(agents);
|
||||
await db.delete(instanceSettings);
|
||||
await db.delete(companyMemberships);
|
||||
await db.delete(companies);
|
||||
});
|
||||
|
||||
@@ -610,6 +615,53 @@ describeEmbeddedPostgres("issueService.list participantAgentId", () => {
|
||||
});
|
||||
});
|
||||
|
||||
it("expires a pending connection and its OAuth state when reassigned to a user without a status change", async () => {
|
||||
const companyId = await seedAssignableAgentCompany();
|
||||
const agentId = randomUUID();
|
||||
const userId = randomUUID();
|
||||
await db.insert(agents).values(agentRow(companyId, { id: agentId, name: "ConnectionRequester" }));
|
||||
await db.insert(companyMemberships).values({
|
||||
companyId, principalType: "user", principalId: userId, status: "active", membershipRole: "member",
|
||||
});
|
||||
const issue = await svc.create(companyId, {
|
||||
title: "Waiting for a connection", status: "in_review", priority: "medium", assigneeAgentId: agentId,
|
||||
});
|
||||
const [application] = await db.insert(toolApplications).values({
|
||||
companyId, name: "Connection app", type: "mcp",
|
||||
}).returning();
|
||||
const [connection] = await db.insert(toolConnections).values({
|
||||
companyId, applicationId: application!.id, name: "Notion", uid: randomUUID(),
|
||||
transport: "mcp_remote", authKind: "oauth",
|
||||
}).returning();
|
||||
const [interaction] = await db.insert(issueThreadInteractions).values({
|
||||
companyId, issueId: issue.id, kind: "connection_intent", status: "pending",
|
||||
createdByAgentId: agentId, addresseeUserId: "local-board",
|
||||
payload: {
|
||||
version: 1, serviceSlug: "notion", serviceName: "Notion",
|
||||
requestingAgentId: agentId, requestingAgentName: "ConnectionRequester", phase: "authorizing",
|
||||
},
|
||||
}).returning();
|
||||
const oauthState = randomUUID();
|
||||
await db.insert(toolOauthStates).values({
|
||||
state: oauthState, companyId, connectionId: connection!.id, issueId: issue.id,
|
||||
interactionId: interaction!.id, codeVerifier: "test-verifier",
|
||||
createdByActorType: "user", createdByActorId: "local-board",
|
||||
expiresAt: new Date(Date.now() + 60_000),
|
||||
});
|
||||
|
||||
const updated = await svc.update(issue.id, {
|
||||
assigneeAgentId: null, assigneeUserId: userId, actorUserId: "local-board",
|
||||
});
|
||||
expect(updated).toMatchObject({ status: "in_review", assigneeAgentId: null, assigneeUserId: userId });
|
||||
await expect(db.select().from(issueThreadInteractions).where(eq(issueThreadInteractions.id, interaction!.id)))
|
||||
.resolves.toEqual([expect.objectContaining({
|
||||
status: "expired",
|
||||
result: { version: 1, outcome: "expired", reason: "The task assignment changed" },
|
||||
resolvedAt: expect.any(Date),
|
||||
})]);
|
||||
await expect(db.select().from(toolOauthStates).where(eq(toolOauthStates.state, oauthState))).resolves.toEqual([]);
|
||||
});
|
||||
|
||||
it("expires pending thread interactions on any service-level terminal transition", async () => {
|
||||
const companyId = await seedAssignableAgentCompany();
|
||||
const issue = await svc.create(companyId, {
|
||||
|
||||
@@ -2190,6 +2190,23 @@ describe("P6-31 Section 18.13 executable status-authority corpus", () => {
|
||||
]);
|
||||
});
|
||||
|
||||
it("binds a tools-refresh continuation to its existing durable wake without a duplicate", async () => {
|
||||
const template = corpus.fixtures.find((candidate) => candidate.mode === "native")!;
|
||||
const fixture = { ...template, id: "in-feed-tools-refresh", given: { ...template.given, priorIssueStatus: "in_progress" } };
|
||||
const seeded = await seedFixture(fixture);
|
||||
const key = `connection-intent:tools:${seeded.runId}:fixture-digest`;
|
||||
const [wake] = await db.insert(agentWakeupRequests).values({ companyId, agentId, source: "assignment", status: "queued", idempotencyKey: key,
|
||||
payload: { issueId: seeded.issueId, mutation: "connection_tools_refreshed" } }).returning();
|
||||
const decision: NativeStatusDecision = { policyVersion: NATIVE_STATUS_ARBITER_POLICY_VERSION, statusAction: "in_progress", toStatus: "in_progress",
|
||||
reasonCode: "live_continuation_registered", unblockDescriptor: null,
|
||||
effects: [{ kind: "enqueue_continuation", continuationKind: "same_agent", summary: "Use updated tools", idempotencyKey: key, agentId }] };
|
||||
await commitNativeStatusDecision({ db, companyId, issueId: seeded.issueId, runId: seeded.runId, assessmentId: seeded.assessmentId,
|
||||
priorStatus: "in_progress", priorStatusVersion: 0, priorDecisionId: null, decision });
|
||||
const effects = await db.select().from(statusDecisionEffects).where(eq(statusDecisionEffects.issueId, seeded.issueId));
|
||||
expect(effects.filter((effect) => effect.effectKind === "enqueue_continuation")).toEqual([expect.objectContaining({ targetId: wake!.id, targetType: "agent_wakeup_request" })]);
|
||||
expect(await db.select().from(agentWakeupRequests).where(eq(agentWakeupRequests.idempotencyKey, key))).toHaveLength(1);
|
||||
});
|
||||
|
||||
it("fails the transaction closed for an unknown status effect", async () => {
|
||||
const fixture = corpus.fixtures.find((candidate) => candidate.mode === "native");
|
||||
if (!fixture) throw new Error("native corpus fixture missing");
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
|
||||
import { startRunnerApiTestServer } from "./helpers/runner-api-server.js";
|
||||
|
||||
describe("connection eval real-server fixtures", () => {
|
||||
let server: Awaited<ReturnType<typeof startRunnerApiTestServer>>;
|
||||
beforeAll(async () => {
|
||||
vi.stubEnv("PAPERCLIP_AGENT_JWT_SECRET", randomUUID());
|
||||
server = await startRunnerApiTestServer();
|
||||
}, 60_000);
|
||||
afterAll(async () => { await server?.close(); vi.unstubAllEnvs(); });
|
||||
const call = (fixture: Awaited<ReturnType<typeof server.fixture>>, tool: string, args: unknown) => fixture.authority.execute({ tool, callId: randomUUID(), arguments: args });
|
||||
|
||||
it("binds fresh discovery and card creation to an authenticated responsible user", async () => {
|
||||
const fixture = await server.fixture({ connectionScenario: "fresh" });
|
||||
expect((await fixture.snapshot()).connectionInteractions).toEqual([]);
|
||||
expect(await call(fixture, "connections_search", { query: "Notion" })).toMatchObject({ results: [{ service: "notion", state: "available" }] });
|
||||
await call(fixture, "connection_request", { service: "notion" });
|
||||
const state = await fixture.snapshot();
|
||||
expect(state.connectionInteractions).toEqual([expect.objectContaining({ addresseeUserId: fixture.responsibleUserId, sourceRunId: fixture.runId, status: "pending", payload: expect.objectContaining({ requestingAgentId: fixture.agentId }) })]);
|
||||
expect(state.connections).toEqual([]);
|
||||
});
|
||||
|
||||
it("reuses a pending card from a previous run and preserves a declined outcome", async () => {
|
||||
const pending = await server.fixture({ connectionScenario: "pending" });
|
||||
expect(await call(pending, "connection_request", { service: "notion" })).toMatchObject({ interactionId: pending.pendingInteractionId });
|
||||
expect((await pending.snapshot()).connectionInteractions).toHaveLength(1);
|
||||
expect((await pending.snapshot()).connectionInteractions[0]!.sourceRunId).not.toBe(pending.runId);
|
||||
const declined = await server.fixture({ connectionScenario: "declined" });
|
||||
await expect(call(declined, "connection_request", { service: "notion" })).rejects.toThrow("declined");
|
||||
const state = await declined.snapshot();
|
||||
expect(state.connectionInteractions).toEqual([expect.objectContaining({ id: declined.pendingInteractionId, status: "rejected" })]);
|
||||
expect(state.connectionIntentDeliveries).toHaveLength(1);
|
||||
});
|
||||
|
||||
it("discovers authorized indexed custom metadata without fetching the inert provider", async () => {
|
||||
const fixture = await server.fixture({ connectionScenario: "custom" });
|
||||
const fetchSpy = vi.spyOn(globalThis, "fetch").mockRejectedValue(new Error("Unexpected provider call"));
|
||||
try {
|
||||
expect(await call(fixture, "connections_search", { query: "heliotrope" })).toMatchObject({ results: [{ service: fixture.customConnectionService, state: "needs_user_action", source: "configured" }] });
|
||||
await call(fixture, "connection_request", { service: fixture.customConnectionService });
|
||||
expect(fetchSpy).not.toHaveBeenCalled();
|
||||
const state = await fixture.snapshot();
|
||||
expect(state.installs).toEqual([]);
|
||||
expect(state.connectionInteractions).toHaveLength(1);
|
||||
expect(JSON.stringify(state.connections)).not.toContain("transportConfig");
|
||||
} finally { fetchSpy.mockRestore(); }
|
||||
});
|
||||
|
||||
it("hides foreign connections and denies stale ownership", async () => {
|
||||
const foreign = await server.fixture({ connectionScenario: "foreign" });
|
||||
expect(await call(foreign, "connections_search", { query: "heliotrope" })).toMatchObject({ results: [] });
|
||||
await expect(call(foreign, "connection_request", { service: foreign.foreignConnectionService })).rejects.toThrow("not found");
|
||||
expect((await foreign.snapshot()).connectionInteractions).toEqual([]);
|
||||
const stale = await server.fixture({ connectionScenario: "stale_owner" });
|
||||
await expect(call(stale, "connection_request", { service: "notion" })).rejects.toThrow();
|
||||
expect((await stale.snapshot()).connectionInteractions).toEqual([]);
|
||||
});
|
||||
|
||||
it("reports installed and permitted fixture Notion as ready without a card", async () => {
|
||||
const fixture = await server.fixture({ connectionScenario: "ready" });
|
||||
expect(await call(fixture, "connections_search", { query: "Notion" })).toMatchObject({ results: [{ service: "notion", state: "ready" }] });
|
||||
expect(await call(fixture, "connection_request", { service: "notion" })).toMatchObject({ state: "ready", interactionId: null });
|
||||
expect((await fixture.snapshot()).connectionInteractions).toEqual([]);
|
||||
});
|
||||
|
||||
it("resets paired attempts without carrying prior connections and rejects unknown scenarios", async () => {
|
||||
const first = await server.fixture({ connectionScenario: "ready", reset: true });
|
||||
const second = await server.fixture({ connectionScenario: "fresh", reset: true });
|
||||
expect(second.responsibleUserId).toBe(first.responsibleUserId);
|
||||
expect(second.companyId).toBe(first.companyId);
|
||||
expect((await second.snapshot()).connections).toEqual([]);
|
||||
await expect(server.fixture({ connectionScenario: "unknown" as never })).rejects.toThrow("Unknown connection eval scenario");
|
||||
});
|
||||
});
|
||||
@@ -333,6 +333,12 @@ vi.mock("../services/index.js", () => ({
|
||||
})),
|
||||
}));
|
||||
|
||||
vi.mock("../services/connection-intent-delivery.js", () => ({
|
||||
connectionIntentDeliveryService: vi.fn(() => ({
|
||||
sweepPending: vi.fn(async () => ({ scanned: 0, failed: 0 })),
|
||||
})),
|
||||
}));
|
||||
|
||||
vi.mock("../services/question-response-delivery.js", () => ({
|
||||
questionResponseDeliveryService: vi.fn(() => ({
|
||||
sweepPending: vi.fn(async () => ({
|
||||
|
||||
@@ -4629,6 +4629,27 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
.resolves.toHaveLength(1);
|
||||
});
|
||||
|
||||
it("reconnects an exact active custom MCP connection without duplicating its identity", async () => {
|
||||
const company = await createCompany(db);
|
||||
const service = createTestToolAccessService(db);
|
||||
mockToolsList([{ name: "archive_read", annotations: { readOnlyHint: true } }]);
|
||||
const first = await service.connectGalleryApp(company.id, { link: "https://fixture.example/mcp", authMode: "none", name: "Archive" }, { actorType: "user", actorId: "board" });
|
||||
await db.update(toolConnections).set({ status: "active", healthStatus: "error" }).where(eq(toolConnections.id, first.connectionId));
|
||||
mockToolsList([{ name: "archive_read", annotations: { readOnlyHint: true } }]);
|
||||
const reconnected = await service.connectGalleryApp(company.id, { link: "https://fixture.example/mcp", authMode: "none", reconnectConnectionId: first.connectionId }, { actorType: "user", actorId: "board" });
|
||||
expect(reconnected.connectionId).toBe(first.connectionId);
|
||||
const originalAgent = await createAgent(db, company.id);
|
||||
const requester = await createAgent(db, company.id);
|
||||
const ids = reconnected.actions.readOnly.map((action) => action.catalogEntryId);
|
||||
await service.finishGalleryAppConnection(company.id, first.connectionId, { enabledCatalogEntryIds: ids, askFirstCatalogEntryIds: [], access: { agentIds: [originalAgent.id] } });
|
||||
const additive = await service.finishGalleryAppConnection(company.id, first.connectionId, { enabledCatalogEntryIds: ids, askFirstCatalogEntryIds: [], access: { agentIds: [requester.id] }, preserveExistingAccess: true });
|
||||
expect(additive.profileBindings.map((binding) => binding.targetId)).toEqual(expect.arrayContaining([originalAgent.id, requester.id]));
|
||||
expect(await db.select().from(toolConnections).where(eq(toolConnections.companyId, company.id))).toHaveLength(1);
|
||||
await expect(service.connectGalleryApp(company.id, { galleryKey: "notion", reconnectConnectionId: first.connectionId }, { actorType: "user", actorId: "board" })).rejects.toThrow("preserve the configured provider");
|
||||
const other = await createCompany(db);
|
||||
await expect(service.connectGalleryApp(other.id, { link: "https://fixture.example/mcp", reconnectConnectionId: first.connectionId }, { actorType: "user", actorId: "board" })).rejects.toThrow("not found");
|
||||
});
|
||||
|
||||
it("refuses a personal identity when no named user is making the request", async () => {
|
||||
const company = await createCompany(db);
|
||||
const service = createTestToolAccessService(db);
|
||||
@@ -6446,13 +6467,34 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
)).length).toBe(versionCountBeforeAccessRevocation);
|
||||
});
|
||||
|
||||
it("activates and discovers actions for a fresh personal OAuth callback before access is finalized", async () => {
|
||||
it.each(["page", "task"] as const)("activates and discovers actions for a fresh personal OAuth callback from %s without widening task access", async (host) => {
|
||||
vi.stubEnv("PAPERCLIP_TOOL_OAUTH_SLACK_CLIENT_ID", "slack-client-id");
|
||||
vi.stubEnv("PAPERCLIP_TOOL_OAUTH_SLACK_CLIENT_SECRET", "slack-client-secret");
|
||||
const company = await createCompany(db);
|
||||
const userId = `oauth-owner-${randomUUID()}`;
|
||||
await grantBoardUser(db, company.id, userId, [], "owner");
|
||||
const agent = await createAgent(db, company.id);
|
||||
const otherAgent = await createAgent(db, company.id);
|
||||
const { issue, run } = await createIssueAndRun(db, company.id, agent.id);
|
||||
const interaction = host === "task"
|
||||
? (await db.insert(issueThreadInteractions).values({
|
||||
companyId: company.id,
|
||||
issueId: issue.id,
|
||||
sourceRunId: run.id,
|
||||
kind: "connection_intent",
|
||||
status: "pending",
|
||||
createdByAgentId: agent.id,
|
||||
addresseeUserId: userId,
|
||||
payload: {
|
||||
version: 1,
|
||||
serviceSlug: "slack",
|
||||
serviceName: "Slack",
|
||||
requestingAgentId: agent.id,
|
||||
requestingAgentName: agent.name,
|
||||
phase: "authorizing",
|
||||
},
|
||||
}).returning())[0]
|
||||
: undefined;
|
||||
const service = createTestToolAccessService(db);
|
||||
const connected = await service.connectGalleryApp(company.id, {
|
||||
galleryKey: "slack",
|
||||
@@ -6463,6 +6505,7 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
redirectUri: "https://paperclip.example/api/tools/oauth/callback",
|
||||
actor: { actorType: "user", actorId: userId },
|
||||
subjectUserId: userId,
|
||||
interactionId: interaction?.id,
|
||||
});
|
||||
vi.spyOn(globalThis, "fetch").mockImplementation(async (url, init) => {
|
||||
const href = String(url);
|
||||
@@ -6526,9 +6569,9 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
eq(toolPolicies.enabled, true),
|
||||
))).resolves.toEqual([]);
|
||||
const callbackPolicy = toolAccessPolicyService(db);
|
||||
const decide = (entry: (typeof completed.catalog)[number]) => callbackPolicy.decide({
|
||||
const decide = (entry: (typeof completed.catalog)[number], agentId = agent.id) => callbackPolicy.decide({
|
||||
companyId: company.id,
|
||||
actor: { actorType: "agent", actorId: agent.id, agentId: agent.id },
|
||||
actor: { actorType: "agent", actorId: agentId, agentId },
|
||||
request: {
|
||||
connectionId: connected.connectionId,
|
||||
catalogEntryId: entry.id,
|
||||
@@ -6536,14 +6579,22 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
arguments: {},
|
||||
},
|
||||
});
|
||||
await expect(decide(searchMessagesEntry)).resolves.toMatchObject({
|
||||
decision: "allow",
|
||||
reasonCode: "allow_profile",
|
||||
});
|
||||
await expect(decide(sendMessageEntry)).resolves.toMatchObject({
|
||||
decision: "allow",
|
||||
reasonCode: "allow_profile",
|
||||
});
|
||||
for (const entry of [searchMessagesEntry, sendMessageEntry]) {
|
||||
await expect(decide(entry)).resolves.toMatchObject(host === "task"
|
||||
? { decision: "deny" }
|
||||
: { decision: "allow", reasonCode: "allow_profile" });
|
||||
}
|
||||
if (host === "task") {
|
||||
await expect(db.select().from(toolProfileBindings).where(eq(
|
||||
toolProfileBindings.profileId, callbackProfile!.id,
|
||||
))).resolves.toEqual([]);
|
||||
await expect(db.select().from(toolConnectionInstalls).where(eq(
|
||||
toolConnectionInstalls.connectionId, connected.connectionId,
|
||||
))).resolves.toEqual([]);
|
||||
await expect(db.select().from(issueThreadInteractions).where(eq(
|
||||
issueThreadInteractions.id, interaction!.id,
|
||||
))).resolves.toEqual([expect.objectContaining({ status: "pending", result: null })]);
|
||||
}
|
||||
const [personalGrant] = await db.select().from(connectionGrants).where(and(
|
||||
eq(connectionGrants.connectionId, connected.connectionId),
|
||||
eq(connectionGrants.subjectUserId, userId),
|
||||
@@ -6556,15 +6607,41 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
|
||||
const finished = await service.finalizeOAuthAccess(company.id, connected.connectionId, {
|
||||
grantKind: "user",
|
||||
}, { actorType: "user", actorId: userId });
|
||||
}, { actorType: "user", actorId: userId }, host === "task" ? agent.id : undefined);
|
||||
expect(finished.profileEntries).toHaveLength(2);
|
||||
expect(finished.profileBindings).toEqual([
|
||||
expect.objectContaining({ targetType: "company", targetId: company.id }),
|
||||
expect.objectContaining(host === "task"
|
||||
? { targetType: "agent", targetId: agent.id }
|
||||
: { targetType: "company", targetId: company.id }),
|
||||
]);
|
||||
await expect(db.select().from(toolConnectionInstalls).where(and(
|
||||
eq(toolConnectionInstalls.connectionId, connected.connectionId),
|
||||
eq(toolConnectionInstalls.targetType, "company"),
|
||||
))).resolves.toHaveLength(1);
|
||||
))).resolves.toHaveLength(host === "task" ? 0 : 1);
|
||||
if (host === "task") {
|
||||
await expect(decide(searchMessagesEntry)).resolves.toMatchObject({ decision: "allow" });
|
||||
await expect(decide(searchMessagesEntry, otherAgent.id)).resolves.toMatchObject({ decision: "deny" });
|
||||
// Granting a second requester and retrying the first must preserve both installs.
|
||||
for (const requestingAgentId of [otherAgent.id, agent.id]) {
|
||||
await service.finalizeOAuthAccess(company.id, connected.connectionId, {
|
||||
grantKind: "user",
|
||||
}, { actorType: "user", actorId: userId }, requestingAgentId);
|
||||
}
|
||||
const bindings = await db.select().from(toolProfileBindings).where(eq(
|
||||
toolProfileBindings.profileId, callbackProfile!.id,
|
||||
));
|
||||
expect(bindings.map(({ targetType, targetId }) => ({ targetType, targetId }))).toEqual(
|
||||
expect.arrayContaining([agent.id, otherAgent.id].map((targetId) => ({ targetType: "agent", targetId }))),
|
||||
);
|
||||
expect(bindings).toHaveLength(2);
|
||||
const installs = await db.select().from(toolConnectionInstalls).where(eq(
|
||||
toolConnectionInstalls.connectionId, connected.connectionId,
|
||||
));
|
||||
expect(installs.map(({ targetType, targetId }) => ({ targetType, targetId }))).toEqual(
|
||||
expect.arrayContaining([agent.id, otherAgent.id].map((targetId) => ({ targetType: "agent", targetId }))),
|
||||
);
|
||||
expect(installs).toHaveLength(2);
|
||||
}
|
||||
await expect(service.startOAuth(company.id, connected.connectionId, {
|
||||
redirectUri: "https://paperclip.example/api/tools/oauth/callback",
|
||||
actor: { actorType: "user", actorId: `different-user-${randomUUID()}` },
|
||||
@@ -6586,6 +6663,7 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
const reconnect = await service.startOAuth(company.id, connected.connectionId, {
|
||||
redirectUri: "https://paperclip.example/api/tools/oauth/callback",
|
||||
actor: { actorType: "user", actorId: userId },
|
||||
interactionId: interaction?.id,
|
||||
});
|
||||
await expect(service.peekOAuthState(new URL(reconnect.authorizationUrl).searchParams.get("state")!))
|
||||
.resolves.toMatchObject({ subjectUserId: userId });
|
||||
@@ -6610,6 +6688,16 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
));
|
||||
expect(revivedSecrets).toHaveLength(2);
|
||||
expect(revivedSecrets.every((secret) => secret.latestVersion === 2)).toBe(true);
|
||||
if (host === "task") {
|
||||
const installs = await db.select().from(toolConnectionInstalls).where(eq(
|
||||
toolConnectionInstalls.connectionId, connected.connectionId,
|
||||
));
|
||||
expect(installs).toHaveLength(2);
|
||||
expect(installs.every((install) => install.targetType === "agent")).toBe(true);
|
||||
for (const allowedAgentId of [agent.id, otherAgent.id]) {
|
||||
await expect(decide(searchMessagesEntry, allowedAgentId)).resolves.toMatchObject({ decision: "allow" });
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
it("promotes a personal OAuth identity only after Everyone in the company is chosen", async () => {
|
||||
@@ -6934,16 +7022,22 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
expect(location.searchParams.get("code")).toBe("oauth_authorization_denied");
|
||||
});
|
||||
|
||||
it("starts and completes OAuth app sign-in with PKCE state and secret-backed tokens", async () => {
|
||||
it.each([
|
||||
"https://paperclip-public.example",
|
||||
"http://127.0.0.1:3200",
|
||||
"http://localhost:3200",
|
||||
])("starts and completes OAuth with the same redirect URI at %s", async (origin) => {
|
||||
vi.stubEnv("PAPERCLIP_TOOL_OAUTH_SLACK_CLIENT_ID", "slack-client-id");
|
||||
vi.stubEnv("PAPERCLIP_TOOL_OAUTH_SLACK_CLIENT_SECRET", "slack-client-secret");
|
||||
vi.stubEnv("PAPERCLIP_PUBLIC_URL", "https://paperclip-public.example");
|
||||
vi.stubEnv("PAPERCLIP_PUBLIC_URL", origin.startsWith("https:") ? origin : "");
|
||||
const company = await createCompany(db);
|
||||
await grantBoardUser(db, company.id, "board-user", ["tools:manage_connections"]);
|
||||
const app = createRouteApp(db);
|
||||
|
||||
const connectRes = await request(app)
|
||||
.post(`/api/companies/${company.id}/tools/apps/connect`)
|
||||
.set("Host", new URL(origin).host)
|
||||
.set("Origin", origin)
|
||||
.send({ galleryKey: "slack", name: "Slack workspace" });
|
||||
|
||||
expect(connectRes.status).toBe(201);
|
||||
@@ -6958,7 +7052,7 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
expect(startUrl.searchParams.get("client_id")).toBe("slack-client-id");
|
||||
expect(startUrl.searchParams.get("code_challenge_method")).toBe("S256");
|
||||
expect(startUrl.searchParams.get("code_challenge")).toMatch(/^[A-Za-z0-9_-]{43}$/);
|
||||
expect(startUrl.searchParams.get("redirect_uri")).toBe("https://paperclip-public.example/api/tools/oauth/callback");
|
||||
expect(startUrl.searchParams.get("redirect_uri")).toBe(`${origin}/api/tools/oauth/callback`);
|
||||
const state = startUrl.searchParams.get("state");
|
||||
expect(state).toBeTruthy();
|
||||
await expect(db.select().from(toolOauthStates)).resolves.toEqual([
|
||||
@@ -6980,7 +7074,7 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
expect(body.get("code")).toBe("oauth-code");
|
||||
expect(body.get("client_secret")).toBe("slack-client-secret");
|
||||
expect(body.get("code_verifier")).toBeTruthy();
|
||||
expect(body.get("redirect_uri")).toBe("https://paperclip-public.example/api/tools/oauth/callback");
|
||||
expect(body.get("redirect_uri")).toBe(`${origin}/api/tools/oauth/callback`);
|
||||
return {
|
||||
ok: true,
|
||||
json: async () => ({
|
||||
@@ -7011,6 +7105,7 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
|
||||
const callbackRes = await request(app)
|
||||
.get("/api/tools/oauth/callback")
|
||||
.set("Host", new URL(origin).host)
|
||||
.query({ state, code: "oauth-code" });
|
||||
|
||||
expect(callbackRes.status).toBe(200);
|
||||
@@ -7033,12 +7128,15 @@ describeEmbeddedPostgres("tool access service", () => {
|
||||
|
||||
const redirectConnectRes = await request(app)
|
||||
.post(`/api/companies/${company.id}/tools/apps/connect`)
|
||||
.set("Host", new URL(origin).host)
|
||||
.set("Origin", origin)
|
||||
.send({ galleryKey: "slack", name: "Slack redirect" })
|
||||
.expect(201);
|
||||
const redirectState = new URL(redirectConnectRes.body.auth.startUrl).searchParams.get("state");
|
||||
expect(redirectState).toBeTruthy();
|
||||
const redirectCallbackRes = await request(app)
|
||||
.get("/api/tools/oauth/callback")
|
||||
.set("Host", new URL(origin).host)
|
||||
.set("Accept", "text/html")
|
||||
.query({ state: redirectState, code: "oauth-code" });
|
||||
|
||||
|
||||
Reference in new issue
Block a user