mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-18 05:23:39 +02:00
## Thinking Path > - Paperclip is the control plane for companies that use AI agents. > - Apps give humans and agents controlled access to external services. > - The existing app detail flow split permissions, tests, setup, and activity across separate pages. > - The split made access rules harder to understand and made reconnect work hard to find. > - New write actions also defaulted to Ask first, which did not match the intended connection policy. > - This pull request combines permission control and action testing, removes the setup page, and moves connection activity into Audit. > - The benefit is one clear place to configure, test, reconnect, and review each app. ## Linked Issues or Issue Description **What existing behavior does this improve?** The installed app Permissions, Test, Setup, and Activity views. **Subsystem affected** Cross-cutting. This change updates the React UI, shared app defaults, server permission behavior, tests, smoke scripts, and connection documentation. **Current behavior** App access and action testing use separate pages. The app detail view also links to a setup page after installation. Connection activity uses a separate tab. New write actions default to Ask first. **Proposed behavior** Permissions uses the connection access language from the initial flow. It includes searchable Read and Write sections, a three-state permission control, and a Test dialog for each action. Reconnect appears below a Needs attention header on Permissions and Review. Old Setup and Test links redirect to Permissions. Old Activity links redirect to the filtered company Audit feed. New write actions default to Allowed. **Reason and benefit** A person can understand and test app access without moving between several pages. Reconnect work stays visible where the person reviews the connection. Audit events use one consistent feed and filter model. New connections have the intended default policy. **Breaking changes** The Setup, Test, and app Activity tabs are removed. Existing deep links redirect to their replacement pages. Existing saved action permissions do not change. Only defaults for new write actions change. **Additional context** This builds on the managed app connection work in #12728. A search found no duplicate open pull request or issue. ## What Changed - Combined action testing with Permissions. - Added searchable Read and Write action groups. - Added Off, Ask first, and Allowed controls with tooltips. - Added an action Test dialog with agent selection, arguments, and formatted results. - Removed the installed-app Setup and Activity tabs. - Added reconnect guidance to Permissions and Review when a connection needs attention. - Routed connection activity into the company Audit feed and preserved the Apps & tools filter in streamlined Audit. - Moved connection removal to the Connectors-page management menu. - Made new write actions default to Allowed across connection creation paths. - Updated regression tests, browser suites, smoke scripts, and connection documentation. ## Verification - `pnpm check:token-gates` - `pnpm exec vitest run packages/shared/src/app-definitions.test.ts server/src/__tests__/generic-mcp-connection.test.ts server/src/__tests__/tool-access-service.test.ts ui/src/components/AppConnectionSidebar.test.tsx ui/src/pages/apps/AppDetail.test.tsx ui/src/pages/apps/AppNotConnected.test.tsx ui/src/pages/apps/AppsConnect.test.tsx ui/src/pages/apps/Browse.test.tsx ui/src/pages/apps/Connections.test.tsx ui/src/pages/apps/composio-services.test.ts ui/src/pages/audit/AuditFeed.test.tsx ui/src/pages/tools/PasteConfigTab.test.tsx` (517 tests passed) - `pnpm exec vitest run ui/src/pages/apps/app-detail/TestPanel.test.tsx ui/src/pages/audit/AuditHub.test.tsx ui/src/pages/audit/AuditFeed.test.tsx ui/src/pages/apps/AppDetail.test.tsx ui/src/pages/apps/Browse.test.tsx` (96 tests passed) - Targeted Playwright verification for connection removal, rename on Permissions, inline action testing, and Smoke Lab Audit evidence (5 flows passed) - `pnpm -r typecheck` - `pnpm build` - `pnpm test:run` completed with 5,755 passing tests and 20 unrelated macOS harness failures. The failures use `/tmp` versus `/private/tmp`, invalid ports above 65535, and workspace fixtures outside this change. ## Risks - Low migration risk. This change has no database migration. - Old app-detail URLs depend on redirect compatibility. - New connections grant write actions by default. Finalization remains configure-authorized and audited, Ask first and Off remain available per action, and existing connections keep their saved policy. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected - check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex, exact model ID `gpt-5`. The client does not expose the context-window size. The model used reasoning, repository tools, code execution, and browser verification. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
434 lines
14 KiB
TypeScript
434 lines
14 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import { flushSync } from "react-dom";
|
|
import { createRoot } from "react-dom/client";
|
|
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
import { AppNotConnected } from "./AppNotConnected";
|
|
|
|
const listApplicationsMock = vi.hoisted(() => vi.fn());
|
|
const listConnectionsMock = vi.hoisted(() => vi.fn());
|
|
const listGalleryMock = vi.hoisted(() => vi.fn());
|
|
const listConnectionGrantsMock = vi.hoisted(() => vi.fn());
|
|
const listConnectionActivityMock = vi.hoisted(() => vi.fn());
|
|
const listActionRequestsMock = vi.hoisted(() => vi.fn());
|
|
const listUserDirectoryMock = vi.hoisted(() => vi.fn());
|
|
const updateApplicationMock = vi.hoisted(() => vi.fn());
|
|
const mockAgentsList = vi.hoisted(() => vi.fn());
|
|
const mockNavigate = vi.hoisted(() => vi.fn());
|
|
const navigateComponentMock = vi.hoisted(() => vi.fn());
|
|
const mockParams = vi.hoisted(() => ({ applicationId: "app-1", tab: "permissions" as string | undefined }));
|
|
|
|
vi.mock("@/api/tools", () => ({
|
|
toolsApi: {
|
|
listApplications: (companyId: string) => listApplicationsMock(companyId),
|
|
listConnections: (companyId: string) => listConnectionsMock(companyId),
|
|
listGallery: (companyId: string) => listGalleryMock(companyId),
|
|
listConnectionGrants: (connectionId: string) => listConnectionGrantsMock(connectionId),
|
|
listConnectionActivity: (connectionId: string, limit: number) =>
|
|
listConnectionActivityMock(connectionId, limit),
|
|
listActionRequests: (companyId: string, status: string) =>
|
|
listActionRequestsMock(companyId, status),
|
|
updateApplication: (applicationId: string, input: unknown) =>
|
|
updateApplicationMock(applicationId, input),
|
|
approveActionRequest: vi.fn(),
|
|
declineActionRequest: vi.fn(),
|
|
createTrustRuleFromActionRequest: vi.fn(),
|
|
},
|
|
}));
|
|
|
|
vi.mock("@/api/access", () => ({
|
|
accessApi: {
|
|
listUserDirectory: (companyId: string) => listUserDirectoryMock(companyId),
|
|
},
|
|
}));
|
|
|
|
vi.mock("@/api/agents", () => ({
|
|
agentsApi: {
|
|
list: (companyId: string) => mockAgentsList(companyId),
|
|
},
|
|
}));
|
|
|
|
vi.mock("@/lib/router", () => ({
|
|
useParams: () => mockParams,
|
|
useNavigate: () => mockNavigate,
|
|
Navigate: ({ to, replace }: { to: string; replace?: boolean }) => {
|
|
navigateComponentMock({ to, replace });
|
|
return <div data-navigate-to={to} />;
|
|
},
|
|
Link: ({ to, children, ...props }: { to: string; children: React.ReactNode }) => (
|
|
<a href={to} {...props}>{children}</a>
|
|
),
|
|
}));
|
|
|
|
vi.mock("@/context/CompanyContext", () => ({
|
|
useCompany: () => ({
|
|
selectedCompanyId: "company-1",
|
|
selectedCompany: { id: "company-1", name: "Paperclip" },
|
|
}),
|
|
}));
|
|
|
|
vi.mock("@/context/BreadcrumbContext", () => ({
|
|
useBreadcrumbs: () => ({ setBreadcrumbs: vi.fn() }),
|
|
}));
|
|
|
|
vi.mock("@/context/ToastContext", () => ({
|
|
useToast: () => ({ pushToast: vi.fn() }),
|
|
}));
|
|
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
|
|
|
|
async function act(callback: () => void | Promise<void>) {
|
|
let result: void | Promise<void> = undefined;
|
|
flushSync(() => {
|
|
result = callback();
|
|
});
|
|
await result;
|
|
}
|
|
|
|
async function flushReact() {
|
|
for (let i = 0; i < 3; i += 1) {
|
|
await act(async () => {
|
|
await Promise.resolve();
|
|
await new Promise((resolve) => window.setTimeout(resolve, 0));
|
|
});
|
|
}
|
|
}
|
|
|
|
function application(overrides: Record<string, unknown> = {}) {
|
|
return {
|
|
id: "app-1",
|
|
companyId: "company-1",
|
|
applicationKey: "github",
|
|
name: "GitHub",
|
|
description: "Repository app",
|
|
type: "mcp_http",
|
|
status: "active",
|
|
pluginId: null,
|
|
ownerAgentId: null,
|
|
ownerUserId: null,
|
|
metadata: null,
|
|
archivedAt: null,
|
|
createdAt: new Date("2026-01-01T00:00:00Z"),
|
|
updatedAt: new Date("2026-01-01T00:00:00Z"),
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function connection(overrides: Record<string, unknown> = {}) {
|
|
return {
|
|
id: "conn-old",
|
|
companyId: "company-1",
|
|
applicationId: "app-1",
|
|
name: "GitHub",
|
|
connectionKind: "managed",
|
|
transport: "mcp_remote",
|
|
authKind: "api_key",
|
|
credentialPolicy: "shared",
|
|
status: "archived",
|
|
transportConfig: { url: "https://github.example/mcp" },
|
|
config: { url: "https://github.example/mcp" },
|
|
credentialSecretRefs: [],
|
|
credentialRefs: [],
|
|
healthStatus: "error",
|
|
healthMessage: "Token expired.",
|
|
healthCheckedAt: null,
|
|
lastError: null,
|
|
enabled: true,
|
|
lastUsedAt: new Date("2026-06-10T00:00:00Z"),
|
|
createdByAgentId: null,
|
|
createdByUserId: null,
|
|
createdAt: new Date("2026-01-01T00:00:00Z"),
|
|
updatedAt: new Date("2026-06-11T00:00:00Z"),
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
describe("AppNotConnected", () => {
|
|
let container: HTMLDivElement;
|
|
let root: ReturnType<typeof createRoot>;
|
|
|
|
beforeEach(() => {
|
|
container = document.createElement("div");
|
|
document.body.appendChild(container);
|
|
mockParams.applicationId = "app-1";
|
|
mockParams.tab = "permissions";
|
|
listApplicationsMock.mockResolvedValue({ applications: [application()] });
|
|
listConnectionsMock.mockResolvedValue({ connections: [connection()] });
|
|
listGalleryMock.mockResolvedValue({
|
|
apps: [{ key: "github", name: "GitHub", logoUrl: "https://example.test/github.png" }],
|
|
});
|
|
listConnectionActivityMock.mockResolvedValue({ events: [], issues: {}, actionRequests: {} });
|
|
listConnectionGrantsMock.mockResolvedValue({
|
|
connection: { id: "conn-old", uid: "conn-old" },
|
|
grants: [],
|
|
capabilities: {
|
|
canConfigure: true,
|
|
canCreateOrganizationGrant: true,
|
|
canSetCompanyInstall: true,
|
|
canConnectAsCurrentUser: true,
|
|
canManageAgentInstalls: true,
|
|
canViewOtherPersonalIdentities: false,
|
|
editableAgentIds: [],
|
|
},
|
|
currentUserId: "user-1",
|
|
members: [],
|
|
});
|
|
listActionRequestsMock.mockResolvedValue({ actionRequests: [] });
|
|
listUserDirectoryMock.mockResolvedValue({ users: [] });
|
|
mockAgentsList.mockResolvedValue([]);
|
|
updateApplicationMock.mockResolvedValue(application({ status: "archived" }));
|
|
});
|
|
|
|
afterEach(() => {
|
|
flushSync(() => root?.unmount());
|
|
container.remove();
|
|
document.body.innerHTML = "";
|
|
vi.clearAllMocks();
|
|
});
|
|
|
|
async function renderPage() {
|
|
const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
|
|
root = createRoot(container);
|
|
await act(async () => {
|
|
root.render(
|
|
<QueryClientProvider client={client}>
|
|
<AppNotConnected />
|
|
</QueryClientProvider>,
|
|
);
|
|
});
|
|
await flushReact();
|
|
}
|
|
|
|
it("redirects the application root route to Permissions", async () => {
|
|
mockParams.tab = undefined;
|
|
|
|
await renderPage();
|
|
|
|
expect(navigateComponentMock).toHaveBeenCalledWith({ to: "/apps/app/app-1/permissions", replace: true });
|
|
expect(listApplicationsMock).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("redirects to the connected app tab when a live connection exists", async () => {
|
|
mockParams.tab = "permissions";
|
|
listConnectionsMock.mockResolvedValue({
|
|
connections: [connection({ id: "conn-live", status: "active" })],
|
|
});
|
|
|
|
await renderPage();
|
|
|
|
expect(navigateComponentMock).toHaveBeenCalledWith({ to: "/apps/conn-live/permissions", replace: true });
|
|
});
|
|
|
|
it("redirects a provider application to its live connection Permissions page", async () => {
|
|
listApplicationsMock.mockResolvedValue({
|
|
applications: [
|
|
application({
|
|
id: "app-1",
|
|
applicationKey: "app-gallery:notion:one",
|
|
name: "Notion",
|
|
metadata: { sourceTemplateKey: "notion" },
|
|
}),
|
|
application({
|
|
id: "app-2",
|
|
applicationKey: "app-gallery:notion:two",
|
|
name: "Notion workspace",
|
|
metadata: { sourceTemplateKey: "notion" },
|
|
}),
|
|
],
|
|
});
|
|
listConnectionsMock.mockResolvedValue({
|
|
connections: [
|
|
connection({
|
|
id: "conn-one",
|
|
applicationId: "app-1",
|
|
name: "Notion",
|
|
status: "active",
|
|
createdByUserId: "user-1",
|
|
}),
|
|
connection({ id: "conn-two", applicationId: "app-2", name: "Notion team", status: "active" }),
|
|
],
|
|
});
|
|
listUserDirectoryMock.mockResolvedValue({
|
|
users: [{
|
|
principalId: "user-1",
|
|
status: "active",
|
|
user: {
|
|
id: "user-1",
|
|
name: "Dotta",
|
|
email: "dotta@example.com",
|
|
image: "https://example.com/dotta.png",
|
|
},
|
|
}],
|
|
});
|
|
|
|
await renderPage();
|
|
|
|
expect(navigateComponentMock).toHaveBeenCalledWith({
|
|
to: "/apps/conn-one/permissions",
|
|
replace: true,
|
|
});
|
|
});
|
|
|
|
it("does not group unrelated generic link applications", async () => {
|
|
listApplicationsMock.mockResolvedValue({
|
|
applications: [
|
|
application({
|
|
id: "app-1",
|
|
applicationKey: "app-gallery:link:first",
|
|
name: "First server",
|
|
metadata: { source: "link" },
|
|
}),
|
|
application({
|
|
id: "app-2",
|
|
applicationKey: "app-gallery:link:second",
|
|
name: "Second server",
|
|
metadata: { source: "link" },
|
|
}),
|
|
],
|
|
});
|
|
listConnectionsMock.mockResolvedValue({
|
|
connections: [
|
|
connection({ id: "conn-old", applicationId: "app-1", status: "archived" }),
|
|
connection({ id: "conn-live", applicationId: "app-2", status: "active" }),
|
|
],
|
|
});
|
|
|
|
await renderPage();
|
|
|
|
expect(container.textContent).toContain("Not connected");
|
|
expect(container.textContent).toContain("Needs attention");
|
|
expect(container.textContent).toContain("Reconnect");
|
|
});
|
|
|
|
it.each([
|
|
["review", "Nothing is waiting for your OK right now."],
|
|
["permissions", "Permissions paused"],
|
|
])("renders the %s tab with persistent app identity", async (tab, expectedText) => {
|
|
mockParams.tab = tab;
|
|
|
|
await renderPage();
|
|
|
|
expect(container.textContent).toContain("GitHub");
|
|
expect(container.textContent).toContain("Not connected");
|
|
expect(container.textContent).toContain(expectedText);
|
|
});
|
|
|
|
it.each([
|
|
["setup", "/apps/app/app-1/permissions"],
|
|
["test", "/apps/app/app-1/permissions"],
|
|
["advanced", "/apps/app/app-1/permissions"],
|
|
["activity", "/activity?action=tool_"],
|
|
])("redirects the retired %s tab", async (tab, to) => {
|
|
mockParams.tab = tab;
|
|
await renderPage();
|
|
expect(navigateComponentMock).toHaveBeenCalledWith({ to, replace: true });
|
|
});
|
|
|
|
it.each(["permissions", "review"])("shows reconnect directly below the header on %s", async (tab) => {
|
|
mockParams.tab = tab;
|
|
|
|
await renderPage();
|
|
|
|
expect(container.textContent).toContain("Needs attention");
|
|
expect(container.textContent).toContain("Add a working GitHub key to restore access.");
|
|
expect(Array.from(container.querySelectorAll("button")).some(
|
|
(button) => button.textContent?.trim() === "Reconnect",
|
|
)).toBe(true);
|
|
});
|
|
|
|
it("carries the retained identity into the reconnect flow", async () => {
|
|
listConnectionsMock.mockResolvedValue({
|
|
connections: [connection({ credentialPolicy: "per_user", createdByUserId: "user-1" })],
|
|
});
|
|
|
|
await renderPage();
|
|
await act(async () => {
|
|
Array.from(container.querySelectorAll("button"))
|
|
.find((button) => button.textContent?.trim() === "Reconnect")
|
|
?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
|
|
});
|
|
|
|
expect(mockNavigate).toHaveBeenCalledWith(
|
|
"/apps/connect?applicationId=app-1&name=GitHub&new=1&reconnect=conn-old&identity=user&source=github&link=https%3A%2F%2Fgithub.example%2Fmcp",
|
|
);
|
|
});
|
|
|
|
it("keeps a removed Vercel-backed connection in the isolated Vercel setup", async () => {
|
|
listConnectionsMock.mockResolvedValue({
|
|
connections: [connection({ credentialSource: "vercel_connect" })],
|
|
});
|
|
|
|
await renderPage();
|
|
await act(async () => {
|
|
Array.from(container.querySelectorAll("button"))
|
|
.find((button) => button.textContent?.trim() === "Reconnect")
|
|
?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
|
|
});
|
|
|
|
expect(mockNavigate).toHaveBeenCalledWith(
|
|
"/apps/vercel-connect?applicationId=app-1&name=GitHub&new=1&reconnect=conn-old&identity=organization&source=github&link=https%3A%2F%2Fgithub.example%2Fmcp",
|
|
);
|
|
});
|
|
|
|
it("prefills a custom MCP reconnect from the stored transport URL", async () => {
|
|
listApplicationsMock.mockResolvedValue({
|
|
applications: [application({ applicationKey: "custom-mcp", name: "Bla", metadata: null })],
|
|
});
|
|
listConnectionsMock.mockResolvedValue({
|
|
connections: [connection({
|
|
name: "Bla",
|
|
config: { url: "http://127.0.0.1:49287" },
|
|
transportConfig: { url: "http://127.0.0.1:49287" },
|
|
})],
|
|
});
|
|
listGalleryMock.mockResolvedValue({ apps: [] });
|
|
|
|
await renderPage();
|
|
await act(async () => {
|
|
Array.from(container.querySelectorAll("button"))
|
|
.find((button) => button.textContent?.trim() === "Reconnect")
|
|
?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
|
|
});
|
|
|
|
expect(mockNavigate).toHaveBeenCalledWith(
|
|
"/apps/connect?applicationId=app-1&name=Bla&new=1&reconnect=conn-old&identity=organization&byo=1&link=http%3A%2F%2F127.0.0.1%3A49287",
|
|
);
|
|
});
|
|
|
|
it("does not offer a removed personal reconnect to someone other than its fixed owner", async () => {
|
|
listConnectionsMock.mockResolvedValue({
|
|
connections: [connection({ credentialPolicy: "per_user", createdByUserId: "user-2" })],
|
|
});
|
|
listConnectionGrantsMock.mockResolvedValue({
|
|
connection: { id: "conn-old", uid: "conn-old" },
|
|
grants: [{
|
|
id: "grant-user-2",
|
|
kind: "user",
|
|
subjectUserId: "user-2",
|
|
status: "revoked",
|
|
credentialSecretRefs: [],
|
|
}],
|
|
capabilities: {
|
|
canConfigure: true,
|
|
canCreateOrganizationGrant: true,
|
|
canSetCompanyInstall: true,
|
|
canConnectAsCurrentUser: true,
|
|
canManageAgentInstalls: true,
|
|
canViewOtherPersonalIdentities: true,
|
|
editableAgentIds: [],
|
|
},
|
|
currentUserId: "user-1",
|
|
members: [],
|
|
});
|
|
|
|
await renderPage();
|
|
|
|
expect(container.textContent).toContain("The person this connection belongs to must reconnect it.");
|
|
expect(Array.from(container.querySelectorAll("button")).some(
|
|
(button) => button.textContent?.trim() === "Reconnect",
|
|
)).toBe(false);
|
|
});
|
|
});
|