mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 18:31:34 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Environment configs (sandbox providers, SSH) can bind stored company secrets through `format: "secret-ref"` fields, picked in the environment editor's secret picker > - Environments are instance-scoped and shared by every company on an instance, but the picker lists only the current company's secrets, so a ref pointing at another company's secret renders as "Missing secret (…)" in destructive styling > - That state is indistinguishable from a genuinely deleted secret, so operators "fix" a healthy binding by creating a duplicate secret in their own company — the exact sequence that used to corrupt bindings before #10576 > - This pull request adds an instance-gated metadata endpoint for an environment's secret refs and teaches the picker to name a cross-company secret and its owner honestly > - The benefit is that operators can tell a healthy cross-company binding from a broken one, and stop creating duplicate secrets ## Linked Issues or Issue Description **Is your feature request related to a problem? Please describe.** In the environment editor, a secret-ref field that points at a secret owned by a different company shows "Missing secret (22095402…)" in red, with "The previously selected secret is no longer available. Pick another or remove the binding." The binding is actually healthy — the current company's picker just cannot list the other company's secrets. Operators react by creating a duplicate secret and re-pointing the field. **Describe the solution you'd like** The editor should know the referenced secret's name, status, and owning company (metadata only, never the value) and present a cross-company ref neutrally, a deleted secret as deleted, and only an unknown id as missing. Related: #10576 (fixes the binding corruption this UI state used to trigger). ## What Changed - New `GET /environments/:id/secret-refs` returns `{ refs: [{ configPath, secretId, name, status, companyId, companyName }] }` for the environment's config-derived secret refs. Values are never returned. The route sits behind `assertCanAccessInstanceEnvironments`, the same gate as environment editing. - New `secretService.describeSecretRefs` loads that metadata across companies; unknown ids are omitted. - `SecretBindingPicker` reads an optional `SecretRefHintsContext` (keyed by secret id). With a hint, a ref the company list cannot show renders as `NAME — Owning Company` with neutral styling and the note "Owned by the … company. The binding keeps working; selecting a secret from this list re-points it here." A hint with `status: "deleted"` reports the secret as deleted. Without hints, behavior is byte-identical to before — agent editors and other picker users are unaffected. - `CompanyEnvironments` fetches descriptors for the environment being edited and provides them through the context. ## Verification - `cd server && pnpm vitest run src/__tests__/environment-routes.test.ts src/__tests__/secrets-service.test.ts` — new endpoint happy path, agent 403 (descriptors never computed), and embedded-Postgres coverage proving cross-company names resolve and unknown ids drop out. - `cd ui && pnpm vitest run src/components/SecretBindingPicker.test.tsx src/components/JsonSchemaForm.test.tsx src/pages/CompanyEnvironments.test.tsx` — hinted cross-company rendering, hinted deleted secret, and unchanged no-hint fallback. - `pnpm run typecheck` in `server` and `ui`. - Manual: edit an environment whose secret-ref field references another company's secret; the field names the secret and its owning company instead of "Missing secret". ## Risks - The endpoint exposes secret names and company names across companies to instance-level environment editors. Those actors already manage instance-shared environments (and instance admins are implicit members of every company), so this reveals no secret material and no new reach; the service method documents that callers must sit behind an instance-level gate. - UI change is additive and context-gated; pickers without a provider render exactly as before. ## Model Used Claude Fable 5 (`claude-fable-5`, Anthropic) via Claude Code — extended thinking, agentic tool use (file edits, vitest/tsc runs). No other models involved. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge
145 lines
4.9 KiB
TypeScript
145 lines
4.9 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import { act } from "react";
|
|
import { createRoot, type Root } from "react-dom/client";
|
|
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
import {
|
|
SecretBindingPicker,
|
|
SecretRefHintsContext,
|
|
type SecretRefHintsContextValue,
|
|
} from "./SecretBindingPicker";
|
|
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
|
|
|
|
const mockSecretsApi = vi.hoisted(() => ({
|
|
list: vi.fn(),
|
|
create: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("../api/secrets", () => ({
|
|
secretsApi: mockSecretsApi,
|
|
}));
|
|
|
|
vi.mock("../context/CompanyContext", () => ({
|
|
useCompany: () => ({ selectedCompanyId: "company-1" }),
|
|
}));
|
|
|
|
describe("SecretBindingPicker", () => {
|
|
let container: HTMLDivElement;
|
|
let root: Root | null = null;
|
|
let queryClient: QueryClient;
|
|
|
|
beforeEach(() => {
|
|
container = document.createElement("div");
|
|
document.body.appendChild(container);
|
|
queryClient = new QueryClient({
|
|
defaultOptions: { queries: { retry: false } },
|
|
});
|
|
mockSecretsApi.list.mockReset();
|
|
mockSecretsApi.list.mockResolvedValue([]);
|
|
});
|
|
|
|
afterEach(() => {
|
|
act(() => {
|
|
root?.unmount();
|
|
});
|
|
root = null;
|
|
container.remove();
|
|
queryClient.clear();
|
|
});
|
|
|
|
async function render(context: SecretRefHintsContextValue | undefined) {
|
|
await act(async () => {
|
|
root = createRoot(container);
|
|
root.render(
|
|
<QueryClientProvider client={queryClient}>
|
|
<SecretRefHintsContext.Provider value={context}>
|
|
<SecretBindingPicker
|
|
value={{ secretId: "22222222-2222-2222-2222-222222222222" }}
|
|
onChange={() => {}}
|
|
/>
|
|
</SecretRefHintsContext.Provider>
|
|
</QueryClientProvider>,
|
|
);
|
|
});
|
|
// Let the secrets query settle so selectedMissing is based on real data.
|
|
await act(async () => {
|
|
await Promise.resolve();
|
|
});
|
|
}
|
|
|
|
function readyContext(status: string): SecretRefHintsContextValue {
|
|
return {
|
|
status: "ready",
|
|
hints: {
|
|
"22222222-2222-2222-2222-222222222222": {
|
|
name: "DAYTONA_API_KEY",
|
|
status,
|
|
companyId: "company-2",
|
|
companyName: "Other Team",
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
it("names an active cross-company secret and its owner instead of calling it missing", async () => {
|
|
await render(readyContext("active"));
|
|
|
|
expect(container.textContent).toContain("DAYTONA_API_KEY — Other Team");
|
|
expect(container.textContent).toContain("Owned by the Other Team company");
|
|
expect(container.textContent).not.toContain("Missing secret");
|
|
expect(container.querySelector("select")?.className).not.toContain("border-destructive");
|
|
});
|
|
|
|
it("reports a deleted hinted secret as deleted", async () => {
|
|
await render(readyContext("deleted"));
|
|
|
|
expect(container.textContent).toContain("DAYTONA_API_KEY — Other Team");
|
|
expect(container.textContent).toContain("was deleted");
|
|
expect(container.querySelector("select")?.className).toContain("border-destructive");
|
|
});
|
|
|
|
it("does not present a disabled cross-company secret as working", async () => {
|
|
await render(readyContext("disabled"));
|
|
|
|
expect(container.textContent).toContain("DAYTONA_API_KEY — Other Team");
|
|
expect(container.textContent).toContain("This secret is disabled");
|
|
expect(container.textContent).not.toContain("keeps working");
|
|
expect(container.querySelector("select")?.className).toContain("border-destructive");
|
|
});
|
|
|
|
it("stays neutral while descriptors are loading", async () => {
|
|
await render({ status: "loading", hints: {} });
|
|
|
|
expect(container.textContent).toContain("Checking this secret reference");
|
|
expect(container.textContent).not.toContain("Missing secret");
|
|
expect(container.querySelector("select")?.className).not.toContain("border-destructive");
|
|
});
|
|
|
|
it("stays neutral when the descriptor lookup failed", async () => {
|
|
await render({ status: "error", hints: {} });
|
|
|
|
expect(container.textContent).toContain("Could not load this secret reference");
|
|
expect(container.textContent).not.toContain("Missing secret");
|
|
expect(container.querySelector("select")?.className).not.toContain("border-destructive");
|
|
});
|
|
|
|
it("treats an unknown id as missing once descriptors are ready", async () => {
|
|
await render({ status: "ready", hints: {} });
|
|
|
|
expect(container.textContent).toContain("Missing secret");
|
|
expect(container.textContent).toContain("no longer available");
|
|
expect(container.querySelector("select")?.className).toContain("border-destructive");
|
|
});
|
|
|
|
it("keeps the generic missing-secret treatment when no hint context exists", async () => {
|
|
await render(undefined);
|
|
|
|
expect(container.textContent).toContain("Missing secret");
|
|
expect(container.textContent).toContain("no longer available");
|
|
expect(container.querySelector("select")?.className).toContain("border-destructive");
|
|
});
|
|
});
|