Files
PaperClipAI/ui/src/pages/PluginSettings.test.tsx
T
DottaandClaude Opus 5.5 7c65a2f479 fix(authz): link plugin settings and say reply now on board-only denials (#20182)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - Chat agents run with agent credentials, and plugin management routes
are board-only
> - A board-only denial tells the agent the denial is final and links
the board page that holds the control, when the page is known (#20151)
> - Plugin routes had no known page, so the denial said "link a page
only if you already know its route"
> - In a chat eval, an agent asked to finish configuring a plugin got
this denial and kept searching the API for about two minutes, so it did
not answer in time
> - This pull request names the plugin manager, or that plugin's
settings page, in the denial
> - The benefit is that the agent can hand the step to the person with a
working link right away

## Linked Issues or Issue Description

Refs #20151

**What happened**
An agent that called a board-only plugin route (for example `GET
/api/plugins` or `POST /api/plugins/:pluginId/config`) got the generic
remediation with no page. In the `plugins.configure-plugin` chat eval,
the agent kept calling `search_api` for another plugin route after the
403 and did not reply within the 150-second window.

**Expected behavior**
The denial names the page where a board user does the step: the plugin
manager (`/<prefix>/company/settings/instance/plugins`) or the plugin's
settings page (`/<prefix>/company/settings/instance/plugins/<id or
key>`). No link is given when the operator hides plugin management
(`PAPERCLIP_HIDDEN_SETTINGS=instance.plugins`).

**Steps to reproduce**
1. Install a plugin.
2. As an agent, call `POST /api/plugins/<pluginId>/config`.
3. See a 403 `board_access_required` remediation without a plugin page.

## What Changed

- `server/src/routes/authz.ts`: board-only denials on `/api/plugins`
routes link the plugin manager, or the plugin's settings page when the
path names a plugin UUID or key. The plugin settings page accepts
either. No link when plugin management is hidden.
- `server/src/routes/authz.ts`: every agent board-only denial now says
to stop working on the denied step and reply now. With the plugin link
alone, the eval agent still searched the API for two more minutes.
- `server/src/routes/authz.ts`: any manifest-format plugin key
(including dot-free keys such as `my-plugin`) gets a direct link; plugin
manager endpoints (`examples`, `install`, `tools`, `ui-contributions`)
link the plugin list.
- `ui/src/pages/PluginSettings.tsx`: custom settings slots match by
plugin key as well as plugin id, so a page opened by key shows the
plugin's own settings.
- `server/src/__tests__/board-access-denial.test.ts`: cases for list,
install, config by id, disable by key, a dot-free key, manager
endpoints, and the hidden-settings case.
`ui/src/pages/PluginSettings.test.tsx`: opening the page by key mounts
that plugin's settings slot.
- Merged `master`, keeping its project access-members denial cases.

## Verification

- `cd server && npx vitest run src/__tests__/board-access-denial.test.ts
src/__tests__/agent-permissions-routes.test.ts
src/__tests__/environment-routes.test.ts
src/__tests__/execution-workspace-runtime-lease-route.test.ts`: 241
passed after merging master.
- `cd ui && npx vitest run src/pages/PluginSettings.test.tsx`: 9 passed;
the new key-route case fails without the `PluginSettings` change.
- `cd server && pnpm typecheck`: passes.

## Risks

- Low risk. Only the remediation text of agent board-only denials on
`/api/plugins` routes changes. Board users and authorization do not
change.

## Model Used

- Anthropic Claude Opus 5.5 (`claude-opus-5-5`), tool use and code
execution in Claude Code.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-09 00:39:39 -06:00

491 lines
16 KiB
TypeScript

// @vitest-environment jsdom
import { act } from "react";
import { createRoot } from "react-dom/client";
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { ApiError } from "@/api/client";
import { queryKeys } from "../lib/queryKeys";
import { PluginSettings } from "./PluginSettings";
const mockPluginsApi = vi.hoisted(() => ({
get: vi.fn(),
health: vi.fn(),
dashboard: vi.fn(),
logs: vi.fn(),
getConfig: vi.fn(),
listLocalFolders: vi.fn(),
configureLocalFolder: vi.fn(),
}));
const mockSetBreadcrumbs = vi.hoisted(() => vi.fn());
const mockRoute = vi.hoisted(() => ({ pluginId: "plugin-1" }));
const mockSlots = vi.hoisted(() => ({ slots: [] as Array<Record<string, unknown>> }));
vi.mock("@/api/plugins", () => ({
pluginsApi: mockPluginsApi,
}));
vi.mock("@/context/BreadcrumbContext", () => ({
useBreadcrumbs: () => ({
setBreadcrumbs: mockSetBreadcrumbs,
}),
}));
vi.mock("@/context/CompanyContext", () => ({
useCompany: () => ({
selectedCompany: { id: "company-1", name: "Paperclip", issuePrefix: "PAP" },
selectedCompanyId: "company-1",
}),
}));
vi.mock("@/lib/router", () => ({
Link: ({ to, children }: { to: string; children: React.ReactNode }) => <a href={to}>{children}</a>,
Navigate: () => null,
useParams: () => ({ companyPrefix: "PAP", pluginId: mockRoute.pluginId }),
}));
vi.mock("@/plugins/slots", () => ({
PluginSlotMount: ({ slot }: { slot: { id: string } }) => <div data-testid="settings-slot">{slot.id}</div>,
usePluginSlots: () => ({ slots: mockSlots.slots }),
}));
vi.mock("@/components/PageTabBar", () => ({
PageTabBar: () => null,
}));
// eslint-disable-next-line @typescript-eslint/no-explicit-any
(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
async function flushReact() {
await act(async () => {
await Promise.resolve();
await new Promise((resolve) => window.setTimeout(resolve, 0));
});
}
function basePlugin(overrides: Record<string, unknown> = {}) {
return {
id: "plugin-1",
pluginKey: "paperclip.e2b-sandbox-provider",
packageName: "@paperclipai/plugin-e2b",
version: "0.1.0",
status: "error",
categories: ["automation"],
manifestJson: {
displayName: "E2B Sandbox Provider",
version: "0.1.0",
description: "E2B environments for Paperclip.",
author: "Paperclip",
capabilities: ["environment.drivers.register"],
environmentDrivers: [
{
driverKey: "e2b",
kind: "sandbox_provider",
displayName: "E2B Cloud Sandbox",
},
],
},
lastError: null,
...overrides,
};
}
function wikiFolderDeclaration() {
return {
folderKey: "wiki-root",
displayName: "Wiki root",
description: "Company-scoped local folder that stores wiki files.",
access: "readWrite" as const,
requiredDirectories: ["raw", "wiki"],
requiredFiles: ["WIKI.md", "index.md"],
};
}
function folderStatus(overrides: Record<string, unknown> = {}) {
return {
folderKey: "wiki-root",
configured: false,
path: null,
realPath: null,
access: "readWrite",
readable: false,
writable: false,
requiredDirectories: ["raw", "wiki"],
requiredFiles: ["WIKI.md", "index.md"],
missingDirectories: ["raw", "wiki"],
missingFiles: ["WIKI.md", "index.md"],
healthy: false,
problems: [{ code: "not_configured", message: "No local folder path is configured." }],
checkedAt: "2026-05-02T16:00:00.000Z",
...overrides,
};
}
async function renderSettings(
container: HTMLDivElement,
experimentalSettings: Record<string, unknown> = {},
) {
const root = createRoot(container);
const queryClient = new QueryClient({
defaultOptions: { queries: { retry: false } },
});
// The local-folders section is a host-path surface, so it stays hidden until
// the managed-sandbox-only policy is known. Seed the policy as off; the tests
// below are about folder rendering, not about the gate.
queryClient.setQueryData(queryKeys.instance.experimentalSettings, experimentalSettings);
await act(async () => {
root.render(
<QueryClientProvider client={queryClient}>
<PluginSettings />
</QueryClientProvider>,
);
});
await flushReact();
await flushReact();
return root;
}
describe("PluginSettings", () => {
let container: HTMLDivElement;
beforeEach(() => {
container = document.createElement("div");
document.body.appendChild(container);
mockPluginsApi.get.mockResolvedValue(basePlugin());
mockPluginsApi.dashboard.mockResolvedValue(null);
mockPluginsApi.health.mockResolvedValue({ pluginId: "plugin-1", status: "ready", healthy: true, checks: [] });
mockPluginsApi.logs.mockResolvedValue([]);
mockPluginsApi.listLocalFolders.mockResolvedValue({
pluginId: "plugin-1",
companyId: "company-1",
declarations: [],
folders: [],
});
});
afterEach(() => {
container.remove();
document.body.innerHTML = "";
vi.clearAllMocks();
mockRoute.pluginId = "plugin-1";
mockSlots.slots = [];
});
it("shows a plugin's custom settings page when the route names the plugin by key", async () => {
mockRoute.pluginId = "acme.website-preview";
mockSlots.slots = [
{ id: "settings", type: "settingsPage", pluginId: "plugin-1", pluginKey: "acme.website-preview" },
{ id: "other-settings", type: "settingsPage", pluginId: "plugin-2", pluginKey: "acme.other" },
];
mockPluginsApi.get.mockResolvedValue(basePlugin({
pluginKey: "acme.website-preview",
status: "ready",
manifestJson: { displayName: "Website Preview", version: "0.1.0", capabilities: [] },
}));
const root = await renderSettings(container);
const mounted = [...container.querySelectorAll('[data-testid="settings-slot"]')].map((node) => node.textContent);
expect(mounted).toEqual(["settings"]);
expect(container.textContent).not.toContain("This plugin does not require any settings.");
await act(async () => {
root.unmount();
});
});
it("routes environment-provider plugins to instance environments when they have no instance config", async () => {
const root = await renderSettings(container);
expect(container.textContent).toContain("Configure this plugin from Settings → Environments.");
expect(container.textContent).toContain("secret bindings still resolve through the selected organization context");
const link = container.querySelector('a[href="/company/settings/instance/environments"]');
expect(link?.textContent).toContain("Open Environments");
await act(async () => {
root.unmount();
});
});
it("renders unconfigured manifest local folders with required paths", async () => {
const declaration = wikiFolderDeclaration();
mockPluginsApi.get.mockResolvedValue(basePlugin({
pluginKey: "paperclipai.plugin-llm-wiki",
packageName: "@paperclipai/plugin-llm-wiki",
status: "ready",
manifestJson: {
displayName: "LLM Wiki",
version: "0.1.0",
description: "Local-file LLM Wiki plugin.",
author: "Paperclip",
capabilities: ["local.folders"],
localFolders: [declaration],
},
}));
mockPluginsApi.listLocalFolders.mockResolvedValue({
pluginId: "plugin-1",
companyId: "company-1",
declarations: [declaration],
folders: [folderStatus()],
});
const root = await renderSettings(container);
expect(container.textContent).toContain("Local folders");
expect(container.textContent).toContain("Wiki root");
expect(container.textContent).toContain("Needs attention");
expect(container.textContent).toContain("No local folder path is configured.");
expect(container.textContent).toContain("Missing directories: raw, wiki");
expect(container.textContent).toContain("Missing files: WIKI.md, index.md");
await act(async () => {
root.unmount();
});
});
it("keeps loaded local folder statuses on screen when their refetch fails transiently", async () => {
const declaration = wikiFolderDeclaration();
mockPluginsApi.get.mockResolvedValue(basePlugin({
pluginKey: "paperclipai.plugin-llm-wiki",
packageName: "@paperclipai/plugin-llm-wiki",
status: "ready",
manifestJson: {
displayName: "LLM Wiki",
version: "0.1.0",
description: "Local-file LLM Wiki plugin.",
author: "Paperclip",
capabilities: ["local.folders"],
localFolders: [declaration],
},
}));
mockPluginsApi.listLocalFolders.mockResolvedValue({
pluginId: "plugin-1",
companyId: "company-1",
declarations: [declaration],
folders: [folderStatus()],
});
const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
queryClient.setQueryData(queryKeys.instance.experimentalSettings, {});
const root = createRoot(container);
await act(async () => {
root.render(
<QueryClientProvider client={queryClient}>
<PluginSettings />
</QueryClientProvider>,
);
});
await flushReact();
await flushReact();
expect(container.textContent).toContain("No local folder path is configured.");
mockPluginsApi.listLocalFolders.mockRejectedValue(
new ApiError("Paperclip is restarting.", 503, { error: "tenant_app_unavailable" }),
);
await act(async () => {
await queryClient.invalidateQueries({ queryKey: queryKeys.plugins.localFolders("plugin-1", "company-1") });
});
await flushReact();
expect(mockPluginsApi.listLocalFolders).toHaveBeenCalledTimes(2);
expect(container.textContent).toContain("Wiki root");
expect(container.textContent).toContain("No local folder path is configured.");
expect(container.querySelector('[data-query-view="error"]')).toBeNull();
expect(container.textContent).not.toContain("Paperclip is restarting.");
expect(container.textContent).not.toContain("tenant_app_unavailable");
await act(async () => {
root.unmount();
});
});
it("shows readable copy with Retry instead of leaving the page when the plugin fails to load", async () => {
mockPluginsApi.get
.mockRejectedValueOnce(new ApiError("Boom", 500, { error: "Boom" }))
.mockResolvedValue(basePlugin());
const root = await renderSettings(container);
expect(container.querySelector('[data-query-view="error"]')).not.toBeNull();
expect(container.textContent).toContain("Couldn't load this plugin");
expect(container.textContent).not.toContain("E2B Sandbox Provider");
const retryButton = Array.from(container.querySelectorAll("button")).find(
(button) => button.textContent === "Retry",
);
expect(retryButton, "Retry button").toBeTruthy();
await act(async () => {
retryButton!.dispatchEvent(new MouseEvent("click", { bubbles: true }));
});
await flushReact();
await flushReact();
expect(container.textContent).toContain("E2B Sandbox Provider");
expect(container.querySelector('[data-query-view="error"]')).toBeNull();
await act(async () => {
root.unmount();
});
});
it("hides local folders when the instance runs agents only in the platform-managed environment", async () => {
const declaration = wikiFolderDeclaration();
mockPluginsApi.get.mockResolvedValue(basePlugin({
pluginKey: "paperclipai.plugin-llm-wiki",
packageName: "@paperclipai/plugin-llm-wiki",
status: "ready",
manifestJson: {
displayName: "LLM Wiki",
version: "0.1.0",
description: "Local-file LLM Wiki plugin.",
author: "Paperclip",
capabilities: ["local.folders"],
localFolders: [declaration],
},
}));
mockPluginsApi.listLocalFolders.mockResolvedValue({
pluginId: "plugin-1",
companyId: "company-1",
declarations: [declaration],
folders: [folderStatus()],
});
const root = await renderSettings(container, { enableManagedSandboxOnly: true });
// The platform-managed environment owns the filesystem, so the whole
// section disappears rather than showing paths nobody can act on.
expect(container.textContent).not.toContain("Local folders");
await act(async () => {
root.unmount();
});
});
it("renders invalid configured folders with validation problems", async () => {
const declaration = wikiFolderDeclaration();
mockPluginsApi.get.mockResolvedValue(basePlugin({
manifestJson: {
displayName: "LLM Wiki",
version: "0.1.0",
description: "Local-file LLM Wiki plugin.",
author: "Paperclip",
capabilities: ["local.folders"],
localFolders: [declaration],
},
}));
mockPluginsApi.listLocalFolders.mockResolvedValue({
pluginId: "plugin-1",
companyId: "company-1",
declarations: [declaration],
folders: [folderStatus({
configured: true,
path: "/tmp/wiki",
realPath: "/tmp/wiki",
readable: true,
writable: true,
missingDirectories: [],
missingFiles: ["WIKI.md"],
problems: [{ code: "missing_file", message: "Required file is missing.", path: "WIKI.md" }],
})],
});
const root = await renderSettings(container);
expect(container.textContent).toContain("/tmp/wiki");
expect(container.textContent).toContain("ReadableYes");
expect(container.textContent).toContain("WritableYes");
expect(container.textContent).toContain("Validation problems");
expect(container.textContent).toContain("Required file is missing.");
expect(container.textContent).toContain("Missing files: WIKI.md");
await act(async () => {
root.unmount();
});
});
it("does not render required paths as present when the configured root cannot be inspected", async () => {
const declaration = wikiFolderDeclaration();
mockPluginsApi.get.mockResolvedValue(basePlugin({
manifestJson: {
displayName: "LLM Wiki",
version: "0.1.0",
description: "Local-file LLM Wiki plugin.",
author: "Paperclip",
capabilities: ["local.folders"],
localFolders: [declaration],
},
}));
mockPluginsApi.listLocalFolders.mockResolvedValue({
pluginId: "plugin-1",
companyId: "company-1",
declarations: [declaration],
folders: [folderStatus({
configured: true,
path: "/tmp/wiki-missing",
readable: false,
writable: false,
missingDirectories: [],
missingFiles: [],
problems: [{ code: "missing", message: "Configured local folder cannot be inspected.", path: "/tmp/wiki-missing" }],
})],
});
const root = await renderSettings(container);
expect(container.textContent).toContain("Configured local folder cannot be inspected.");
expect(container.textContent).toContain("Not inspected");
expect(container.textContent).toContain("Configured root was not inspected.");
expect(container.textContent).not.toContain("Present");
await act(async () => {
root.unmount();
});
});
it("renders healthy folders without validation problems", async () => {
const declaration = wikiFolderDeclaration();
mockPluginsApi.get.mockResolvedValue(basePlugin({
manifestJson: {
displayName: "LLM Wiki",
version: "0.1.0",
description: "Local-file LLM Wiki plugin.",
author: "Paperclip",
capabilities: ["local.folders"],
localFolders: [declaration],
},
}));
mockPluginsApi.listLocalFolders.mockResolvedValue({
pluginId: "plugin-1",
companyId: "company-1",
declarations: [declaration],
folders: [folderStatus({
configured: true,
path: "/tmp/wiki",
realPath: "/private/tmp/wiki",
readable: true,
writable: true,
missingDirectories: [],
missingFiles: [],
healthy: true,
problems: [],
})],
});
const root = await renderSettings(container);
expect(container.textContent).toContain("Healthy");
expect(container.textContent).toContain("Configured path");
expect(container.textContent).toContain("/tmp/wiki");
expect(container.textContent).toContain("ReadableYes");
expect(container.textContent).toContain("WritableYes");
expect(container.textContent).toContain("Present");
expect(container.textContent).not.toContain("Validation problems");
await act(async () => {
root.unmount();
});
});
});