mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-27 02:44:50 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Agent runs often need provider credentials, API tokens, and other environment-bound secrets. > - Company-level secrets work for shared credentials, but they do not model values that should differ by human operator. > - Without a user-scoped model, a run can dispatch without knowing whether the responsible human has supplied the needed value. > - Paperclip also needs run attribution to make those user-scoped runtime checks deterministic and auditable. > - This pull request adds user-specific secret definitions, per-user values, environment bindings, responsible-user attribution, and runtime resolution gates. > - The benefit is that teams can define the secret once, let each user provide their own value, and block runs before dispatch when required user secrets or active definitions are unavailable. ## Linked Issues or Issue Description Refs #224 Refs #6057 This PR implements user-specific secret support as a core secret-management capability rather than a one-off adapter setting. It is related to existing public work on company secrets UI and runtime secret refs, but is distinct because the value is owned by the responsible user and resolved at run dispatch time. Related PR search before opening found existing secrets work such as #1550, #8256, #8614, #8634, and #8647; none of those add the full user-secret definition/value/runtime gate covered here. ## What Changed - Added user-secret definitions and per-user "My secrets" values, keeping stored values out of access metadata. - Added `user_secret_ref` environment bindings and UI affordances to pick them alongside existing secret refs. - Added responsible-user runtime resolution so user-secret refs resolve against the human responsible for the run. - Added pre-dispatch missing-secret gates so runs fail before adapter dispatch when required user values are absent or definitions are inactive. - Added low-trust allowlist hardening for user-secret runtime access. - Added issue, routine, run, and agent API key responsible-user attribution and fail-closed dispatch behavior when attribution cannot be resolved. - Added denial-copy mapping so responsible-user authorization failures surface as actionable run outcomes instead of opaque setup failures. - Added OpenAPI documentation for the user-secret routes. - Rebases cleanly on current `master`; migrations were renumbered incrementally as `0128_user_specific_secrets`, `0129_agent_api_key_responsible_user`, and `0130_run_responsible_user_invariant` after upstream `0126`/`0127` migrations. - Removed previously committed local design screenshots so the PR contains code/docs/tests only. ## Verification - PASS: PR head `2527febd106bcf3ca264ca0da7fca491084192d6` is based on `paperclipai/paperclip:master`. - PASS: `git diff --check` - PASS: `git diff --name-only public/master...HEAD | rg '^(pnpm-lock\\.yaml|\\.github/workflows/|screenshots/)' || true` produced no files. - PASS: migration journal audit confirmed unique indexes through `130` with tail entries `0126_issue_comment_derived_attribution`, `0127_environment_custom_images_instance_scoped`, `0128_user_specific_secrets`, `0129_agent_api_key_responsible_user`, and `0130_run_responsible_user_invariant`. - PASS: `pnpm --filter @paperclipai/ui typecheck` - PASS: `pnpm --filter @paperclipai/server typecheck` - PASS: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/heartbeat-responsible-user-invariant.test.ts` - PASS: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/heartbeat-active-run-output-watchdog.test.ts src/__tests__/heartbeat-stale-queue-invalidation.test.ts src/__tests__/heartbeat-workspace-finalize-branch.test.ts src/__tests__/issue-monitor-scheduler.test.ts` - PASS: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/heartbeat-comment-wake-batching.test.ts src/__tests__/heartbeat-retry-scheduling.test.ts src/__tests__/heartbeat-accepted-plan-workspace-refresh.test.ts src/__tests__/heartbeat-plugin-environment.test.ts` - PASS: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/low-trust-red-team-routes.test.ts` - PASS: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/secrets-service.test.ts` (55 tests) - PASS: `pnpm vitest run server/src/__tests__/secrets-routes.test.ts server/src/__tests__/secrets-service.test.ts` (89 tests after final Greptile cleanup fixes) - PASS: `pnpm --filter @paperclipai/server exec vitest run src/__tests__/heartbeat-issue-liveness-escalation.test.ts` (17 tests after the final rebase CI fix) - PASS: focused server Vitest batches covering heartbeat recovery, project env, plugin env, routines, low-trust, pipelines, monitors, watchdog, and stale queue paths. - PASS: GitHub checks are green on `2527febd106bcf3ca264ca0da7fca491084192d6`, including Typecheck + Release Registry, Build, General tests, serialized server suites, e2e, Canary Dry Run, verify, security checks, and Greptile Review. - PASS: Greptile Review completed successfully on `2527febd106bcf3ca264ca0da7fca491084192d6` with Confidence Score 5/5, and GraphQL review-thread audit returned zero unresolved non-outdated threads. ## Risks - Runtime behavior now depends on a run having a correct responsible user; missing or incorrect responsibility assignment can block runs before adapter dispatch. - `user_secret_ref` bindings intentionally expose metadata without values, but UI/API callers may need to handle the new binding kind explicitly. - External secret providers and IAM policies are not automatically provisioned by this PR; operators still need to configure provider-side access for non-local vaults. - The PR is broad across db/shared/server/UI/runtime paths, so release validation should include both API and UI secret workflows before merge. - The migration renumbering is intentionally incremental after upstream migrations; the branch migrations use guarded column/table/index/constraint creation so users who tested the older draft numbering should not hit duplicate DDL for the existing objects. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex, GPT-5-based coding agent (`gpt-5`), Codex local adapter with shell/tool use and code execution. Context window and internal reasoning mode are not exposed by the runtime. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
537 lines
17 KiB
TypeScript
537 lines
17 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import { act } from "react";
|
|
import type { ComponentProps } from "react";
|
|
import { createRoot } from "react-dom/client";
|
|
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
|
|
import type {
|
|
CompanySecret,
|
|
Routine,
|
|
RoutineEnvConfig,
|
|
RoutineRevision,
|
|
RoutineRevisionSnapshotV1,
|
|
} from "@paperclipai/shared";
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
import { RoutineHistoryTab } from "./RoutineHistoryTab";
|
|
|
|
const mockRoutinesApi = vi.hoisted(() => ({
|
|
listRevisions: vi.fn(),
|
|
restoreRevision: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("../api/routines", async () => {
|
|
const actual = await vi.importActual<Record<string, unknown>>("../api/routines");
|
|
return {
|
|
...actual,
|
|
routinesApi: {
|
|
...((actual as { routinesApi?: Record<string, unknown> }).routinesApi ?? {}),
|
|
...mockRoutinesApi,
|
|
},
|
|
};
|
|
});
|
|
|
|
vi.mock("./MarkdownBody", () => ({
|
|
MarkdownBody: ({ children }: { children: string }) => <div>{children}</div>,
|
|
}));
|
|
|
|
vi.mock("@/components/ui/dialog", () => ({
|
|
Dialog: ({ open, children }: { open: boolean; children: React.ReactNode }) =>
|
|
open ? <div data-testid="dialog">{children}</div> : null,
|
|
DialogContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
|
|
DialogHeader: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
|
|
DialogTitle: ({ children }: { children: React.ReactNode }) => <h2>{children}</h2>,
|
|
DialogDescription: ({ children }: { children: React.ReactNode }) => <p>{children}</p>,
|
|
DialogFooter: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
|
|
}));
|
|
|
|
vi.mock("@/components/ui/button", () => ({
|
|
Button: ({ children, onClick, type = "button", disabled, ...props }: ComponentProps<"button">) => (
|
|
<button type={type} onClick={onClick} disabled={disabled} {...props}>
|
|
{children}
|
|
</button>
|
|
),
|
|
}));
|
|
|
|
vi.mock("@/components/ui/input", () => ({
|
|
Input: (props: ComponentProps<"input">) => <input {...props} />,
|
|
}));
|
|
|
|
vi.mock("@/components/ui/label", () => ({
|
|
Label: ({ children, htmlFor }: { children: React.ReactNode; htmlFor?: string }) => (
|
|
<label htmlFor={htmlFor}>{children}</label>
|
|
),
|
|
}));
|
|
|
|
vi.mock("@/components/ui/skeleton", () => ({
|
|
Skeleton: (props: ComponentProps<"div">) => <div data-testid="skeleton" {...props} />,
|
|
}));
|
|
|
|
const toastSpy = vi.fn();
|
|
vi.mock("../context/ToastContext", () => ({
|
|
useToastActions: () => ({ pushToast: toastSpy }),
|
|
}));
|
|
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
|
|
|
|
async function flush() {
|
|
await act(async () => {
|
|
await new Promise((resolve) => setTimeout(resolve, 0));
|
|
});
|
|
}
|
|
|
|
function snapshotV1(overrides?: Partial<RoutineRevisionSnapshotV1["routine"]>): RoutineRevisionSnapshotV1 {
|
|
return {
|
|
version: 1,
|
|
routine: {
|
|
id: "routine-1",
|
|
companyId: "company-1",
|
|
projectId: null,
|
|
goalId: null,
|
|
parentIssueId: null,
|
|
responsibleUserId: null,
|
|
title: "Daily standup digest",
|
|
description: "Summarize standup notes",
|
|
assigneeAgentId: null,
|
|
priority: "medium",
|
|
status: "active",
|
|
concurrencyPolicy: "coalesce_if_active",
|
|
catchUpPolicy: "skip_missed",
|
|
variables: [],
|
|
env: null,
|
|
...overrides,
|
|
},
|
|
triggers: [],
|
|
};
|
|
}
|
|
|
|
function createRevision(overrides: Partial<RoutineRevision> = {}): RoutineRevision {
|
|
return {
|
|
id: overrides.id ?? "revision-1",
|
|
companyId: "company-1",
|
|
routineId: "routine-1",
|
|
revisionNumber: overrides.revisionNumber ?? 1,
|
|
title: "Daily standup digest",
|
|
description: "Summarize standup notes",
|
|
snapshot: overrides.snapshot ?? snapshotV1(),
|
|
changeSummary: null,
|
|
restoredFromRevisionId: null,
|
|
createdByAgentId: null,
|
|
createdByUserId: "user-1",
|
|
createdByRunId: null,
|
|
createdAt: new Date("2026-05-01T12:00:00.000Z"),
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function createRoutine(overrides: Partial<Routine> = {}): Routine {
|
|
return {
|
|
id: "routine-1",
|
|
companyId: "company-1",
|
|
projectId: null,
|
|
goalId: null,
|
|
parentIssueId: null,
|
|
responsibleUserId: null,
|
|
title: "Daily standup digest",
|
|
description: "Summarize standup notes",
|
|
assigneeAgentId: null,
|
|
priority: "medium",
|
|
status: "active",
|
|
concurrencyPolicy: "coalesce_if_active",
|
|
catchUpPolicy: "skip_missed",
|
|
variables: [],
|
|
latestRevisionId: "revision-2",
|
|
latestRevisionNumber: 2,
|
|
createdByAgentId: null,
|
|
createdByUserId: "user-1",
|
|
updatedByAgentId: null,
|
|
updatedByUserId: "user-1",
|
|
lastTriggeredAt: null,
|
|
lastEnqueuedAt: null,
|
|
createdAt: new Date("2026-05-01T11:00:00.000Z"),
|
|
updatedAt: new Date("2026-05-04T12:00:00.000Z"),
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function makeQueryClient() {
|
|
return new QueryClient({
|
|
defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
|
|
});
|
|
}
|
|
|
|
describe("RoutineHistoryTab", () => {
|
|
let container: HTMLDivElement;
|
|
|
|
beforeEach(() => {
|
|
container = document.createElement("div");
|
|
document.body.appendChild(container);
|
|
vi.clearAllMocks();
|
|
toastSpy.mockReset();
|
|
});
|
|
|
|
afterEach(() => {
|
|
container.remove();
|
|
});
|
|
|
|
async function render(props: Partial<Parameters<typeof RoutineHistoryTab>[0]> = {}) {
|
|
const root = createRoot(container);
|
|
const queryClient = makeQueryClient();
|
|
const routine = props.routine ?? createRoutine();
|
|
await act(async () => {
|
|
root.render(
|
|
<QueryClientProvider client={queryClient}>
|
|
<RoutineHistoryTab
|
|
routine={routine}
|
|
isEditDirty={false}
|
|
dirtyFields={[]}
|
|
onDiscardEdits={() => {}}
|
|
onSaveEdits={() => {}}
|
|
agents={new Map()}
|
|
projects={new Map()}
|
|
onRestoreSecretMaterials={() => {}}
|
|
{...props}
|
|
/>
|
|
</QueryClientProvider>,
|
|
);
|
|
});
|
|
await flush();
|
|
return root;
|
|
}
|
|
|
|
it("shows the empty state when only the bootstrap revision exists", async () => {
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([
|
|
createRevision({ id: "revision-1", revisionNumber: 1 }),
|
|
]);
|
|
await render({
|
|
routine: createRoutine({ latestRevisionId: "revision-1", latestRevisionNumber: 1 }),
|
|
});
|
|
expect(container.textContent).toContain("No edits yet");
|
|
expect(container.textContent).toContain("Revision 1 is the only history");
|
|
});
|
|
|
|
it("renders the revision list with current and historical pills", async () => {
|
|
const current = createRevision({
|
|
id: "revision-2",
|
|
revisionNumber: 2,
|
|
changeSummary: "Updated routine",
|
|
});
|
|
const old = createRevision({
|
|
id: "revision-1",
|
|
revisionNumber: 1,
|
|
changeSummary: "Created routine",
|
|
});
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
|
|
await render();
|
|
expect(container.textContent).toContain("rev 2");
|
|
expect(container.textContent).toContain("rev 1");
|
|
expect(container.textContent).toContain("Current");
|
|
});
|
|
|
|
it("shows the historical-preview banner with append-only copy when previewing an old revision", async () => {
|
|
const current = createRevision({
|
|
id: "revision-2",
|
|
revisionNumber: 2,
|
|
changeSummary: "Updated routine",
|
|
});
|
|
const old = createRevision({
|
|
id: "revision-1",
|
|
revisionNumber: 1,
|
|
snapshot: snapshotV1({ status: "paused" }),
|
|
changeSummary: "Created routine",
|
|
});
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
|
|
await render();
|
|
const oldRow = container.querySelector(
|
|
"[data-testid='revision-row-1']",
|
|
) as HTMLButtonElement | null;
|
|
expect(oldRow).not.toBeNull();
|
|
await act(async () => {
|
|
oldRow?.click();
|
|
});
|
|
await flush();
|
|
expect(container.textContent).toContain("Viewing revision 1 (read-only)");
|
|
expect(container.textContent).toContain(
|
|
"Restoring this revision creates a new revision 3 with the same content. History stays append-only.",
|
|
);
|
|
expect(container.textContent).toContain("Status");
|
|
expect(container.textContent).toContain("paused");
|
|
expect(container.textContent).toContain("Restore as new revision");
|
|
});
|
|
|
|
it("blocks historical preview and surfaces the conflict banner when local edits are dirty", async () => {
|
|
const current = createRevision({ id: "revision-2", revisionNumber: 2 });
|
|
const old = createRevision({ id: "revision-1", revisionNumber: 1 });
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
|
|
await render({
|
|
isEditDirty: true,
|
|
dirtyFields: [{ key: "description", label: "the description" }],
|
|
});
|
|
expect(container.textContent).toContain("Unsaved routine edits");
|
|
const oldRow = container.querySelector(
|
|
"[data-testid='revision-row-1']",
|
|
) as HTMLButtonElement | null;
|
|
expect(oldRow?.disabled).toBe(true);
|
|
});
|
|
|
|
it("calls restoreRevision and surfaces a success toast after confirming restore", async () => {
|
|
const current = createRevision({ id: "revision-2", revisionNumber: 2 });
|
|
const old = createRevision({ id: "revision-1", revisionNumber: 1 });
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
|
|
mockRoutinesApi.restoreRevision.mockResolvedValue({
|
|
routine: createRoutine({ latestRevisionId: "revision-3", latestRevisionNumber: 3 }),
|
|
revision: createRevision({
|
|
id: "revision-3",
|
|
revisionNumber: 3,
|
|
restoredFromRevisionId: "revision-1",
|
|
}),
|
|
restoredFromRevisionId: "revision-1",
|
|
restoredFromRevisionNumber: 1,
|
|
secretMaterials: [],
|
|
});
|
|
await render();
|
|
const oldRow = container.querySelector(
|
|
"[data-testid='revision-row-1']",
|
|
) as HTMLButtonElement | null;
|
|
await act(async () => {
|
|
oldRow?.click();
|
|
});
|
|
await flush();
|
|
const restoreButtons = Array.from(container.querySelectorAll("button")).filter(
|
|
(button) => button.textContent === "Restore as new revision",
|
|
);
|
|
expect(restoreButtons.length).toBeGreaterThan(0);
|
|
await act(async () => {
|
|
restoreButtons[0].click();
|
|
});
|
|
await flush();
|
|
expect(container.querySelector("[data-testid='dialog']")).not.toBeNull();
|
|
const confirmButtons = Array.from(container.querySelectorAll("button")).filter((b) =>
|
|
(b.textContent ?? "").includes("Restore as revision 3"),
|
|
);
|
|
expect(confirmButtons.length).toBeGreaterThan(0);
|
|
await act(async () => {
|
|
confirmButtons[0].click();
|
|
});
|
|
await flush();
|
|
expect(mockRoutinesApi.restoreRevision).toHaveBeenCalledWith(
|
|
"routine-1",
|
|
"revision-1",
|
|
{ changeSummary: null },
|
|
);
|
|
expect(toastSpy).toHaveBeenCalled();
|
|
const successCall = toastSpy.mock.calls.find(
|
|
(call) => call[0]?.title === "Restored revision 1 as revision 3",
|
|
);
|
|
expect(successCall).toBeTruthy();
|
|
});
|
|
|
|
it("shows env summary on the revision preview and routes counts into restore dialog", async () => {
|
|
const env: RoutineEnvConfig = {
|
|
GH_TOKEN: { type: "secret_ref", secretId: "secret-1", version: "latest" },
|
|
LOG_LEVEL: { type: "plain", value: "debug" },
|
|
};
|
|
const current = createRevision({
|
|
id: "revision-2",
|
|
revisionNumber: 2,
|
|
snapshot: snapshotV1({ env }),
|
|
});
|
|
const old = createRevision({
|
|
id: "revision-1",
|
|
revisionNumber: 1,
|
|
snapshot: snapshotV1({
|
|
env: { GH_TOKEN: { type: "secret_ref", secretId: "secret-1", version: 3 } },
|
|
}),
|
|
});
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
|
|
const secrets: CompanySecret[] = [
|
|
{
|
|
id: "secret-1",
|
|
companyId: "company-1",
|
|
scope: "company",
|
|
ownerUserId: null,
|
|
userSecretDefinitionId: null,
|
|
key: "gh_token",
|
|
name: "github-bot",
|
|
provider: "local_encrypted",
|
|
status: "active",
|
|
managedMode: "paperclip_managed",
|
|
externalRef: null,
|
|
providerConfigId: null,
|
|
providerMetadata: null,
|
|
latestVersion: 4,
|
|
description: null,
|
|
lastResolvedAt: null,
|
|
lastRotatedAt: null,
|
|
deletedAt: null,
|
|
createdByAgentId: null,
|
|
createdByUserId: null,
|
|
createdAt: new Date("2026-04-01T00:00:00.000Z"),
|
|
updatedAt: new Date("2026-04-01T00:00:00.000Z"),
|
|
},
|
|
];
|
|
await render({ secrets });
|
|
expect(container.textContent).toContain("Env");
|
|
expect(container.textContent).toContain("2 keys (1 secret ref)");
|
|
|
|
const oldRow = container.querySelector(
|
|
"[data-testid='revision-row-1']",
|
|
) as HTMLButtonElement | null;
|
|
await act(async () => {
|
|
oldRow?.click();
|
|
});
|
|
await flush();
|
|
const restoreButtons = Array.from(container.querySelectorAll("button")).filter(
|
|
(button) => button.textContent === "Restore as new revision",
|
|
);
|
|
expect(restoreButtons.length).toBeGreaterThan(0);
|
|
await act(async () => {
|
|
restoreButtons[0].click();
|
|
});
|
|
await flush();
|
|
expect(container.textContent).toContain("Routine secrets will revert");
|
|
expect(container.textContent).toContain("1 key removed");
|
|
expect(container.textContent).toContain("1 key changed");
|
|
});
|
|
|
|
it("labels secret-ref env diffs by changed secret instead of binding kind", async () => {
|
|
const current = createRevision({
|
|
id: "revision-2",
|
|
revisionNumber: 2,
|
|
snapshot: snapshotV1({
|
|
env: { GH_TOKEN: { type: "secret_ref", secretId: "secret-2", version: "latest" } },
|
|
}),
|
|
});
|
|
const old = createRevision({
|
|
id: "revision-1",
|
|
revisionNumber: 1,
|
|
snapshot: snapshotV1({
|
|
env: { GH_TOKEN: { type: "secret_ref", secretId: "secret-1", version: "latest" } },
|
|
}),
|
|
});
|
|
const secrets: CompanySecret[] = [
|
|
{
|
|
id: "secret-1",
|
|
companyId: "company-1",
|
|
scope: "company",
|
|
ownerUserId: null,
|
|
userSecretDefinitionId: null,
|
|
key: "old_token",
|
|
name: "old-token",
|
|
provider: "local_encrypted",
|
|
status: "active",
|
|
managedMode: "paperclip_managed",
|
|
externalRef: null,
|
|
providerConfigId: null,
|
|
providerMetadata: null,
|
|
latestVersion: 1,
|
|
description: null,
|
|
lastResolvedAt: null,
|
|
lastRotatedAt: null,
|
|
deletedAt: null,
|
|
createdByAgentId: null,
|
|
createdByUserId: null,
|
|
createdAt: new Date("2026-04-01T00:00:00.000Z"),
|
|
updatedAt: new Date("2026-04-01T00:00:00.000Z"),
|
|
},
|
|
{
|
|
id: "secret-2",
|
|
companyId: "company-1",
|
|
scope: "company",
|
|
ownerUserId: null,
|
|
userSecretDefinitionId: null,
|
|
key: "new_token",
|
|
name: "new-token",
|
|
provider: "local_encrypted",
|
|
status: "active",
|
|
managedMode: "paperclip_managed",
|
|
externalRef: null,
|
|
providerConfigId: null,
|
|
providerMetadata: null,
|
|
latestVersion: 1,
|
|
description: null,
|
|
lastResolvedAt: null,
|
|
lastRotatedAt: null,
|
|
deletedAt: null,
|
|
createdByAgentId: null,
|
|
createdByUserId: null,
|
|
createdAt: new Date("2026-04-01T00:00:00.000Z"),
|
|
updatedAt: new Date("2026-04-01T00:00:00.000Z"),
|
|
},
|
|
];
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
|
|
await render({ secrets });
|
|
|
|
const oldRow = container.querySelector(
|
|
"[data-testid='revision-row-1']",
|
|
) as HTMLButtonElement | null;
|
|
await act(async () => {
|
|
oldRow?.click();
|
|
});
|
|
await flush();
|
|
const compareButton = Array.from(container.querySelectorAll("button")).find(
|
|
(button) => button.textContent === "Compare with current",
|
|
);
|
|
await act(async () => {
|
|
compareButton?.click();
|
|
});
|
|
await flush();
|
|
|
|
expect(container.textContent).toContain("Env GH_TOKEN secret");
|
|
expect(container.textContent).not.toContain("Env GH_TOKEN binding kind");
|
|
});
|
|
|
|
it("invokes onRestored with the restore response so the editor can rehydrate (PAP-3588)", async () => {
|
|
const current = createRevision({ id: "revision-2", revisionNumber: 2 });
|
|
const old = createRevision({
|
|
id: "revision-1",
|
|
revisionNumber: 1,
|
|
snapshot: snapshotV1({ description: "Original description" }),
|
|
});
|
|
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
|
|
const restoredRoutine = createRoutine({
|
|
description: "Original description",
|
|
latestRevisionId: "revision-3",
|
|
latestRevisionNumber: 3,
|
|
});
|
|
mockRoutinesApi.restoreRevision.mockResolvedValue({
|
|
routine: restoredRoutine,
|
|
revision: createRevision({
|
|
id: "revision-3",
|
|
revisionNumber: 3,
|
|
restoredFromRevisionId: "revision-1",
|
|
}),
|
|
restoredFromRevisionId: "revision-1",
|
|
restoredFromRevisionNumber: 1,
|
|
secretMaterials: [],
|
|
});
|
|
const onRestored = vi.fn();
|
|
await render({ onRestored });
|
|
const oldRow = container.querySelector(
|
|
"[data-testid='revision-row-1']",
|
|
) as HTMLButtonElement | null;
|
|
await act(async () => {
|
|
oldRow?.click();
|
|
});
|
|
await flush();
|
|
const restoreButtons = Array.from(container.querySelectorAll("button")).filter(
|
|
(button) => button.textContent === "Restore as new revision",
|
|
);
|
|
await act(async () => {
|
|
restoreButtons[0].click();
|
|
});
|
|
await flush();
|
|
const confirmButtons = Array.from(container.querySelectorAll("button")).filter((b) =>
|
|
(b.textContent ?? "").includes("Restore as revision 3"),
|
|
);
|
|
await act(async () => {
|
|
confirmButtons[0].click();
|
|
});
|
|
await flush();
|
|
expect(onRestored).toHaveBeenCalledTimes(1);
|
|
const [response] = onRestored.mock.calls[0];
|
|
expect(response.routine).toEqual(restoredRoutine);
|
|
expect(response.revision.id).toBe("revision-3");
|
|
});
|
|
});
|