Files
PaperClipAI/ui/src/components/SecretBindingPicker.test.tsx
T
Devin Foley 90ead239a8 feat(ui/server): name cross-company environment secret refs instead of calling them missing (#10577)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - Environment configs (sandbox providers, SSH) can bind stored company
secrets through `format: "secret-ref"` fields, picked in the environment
editor's secret picker
> - Environments are instance-scoped and shared by every company on an
instance, but the picker lists only the current company's secrets, so a
ref pointing at another company's secret renders as "Missing secret (…)"
in destructive styling
> - That state is indistinguishable from a genuinely deleted secret, so
operators "fix" a healthy binding by creating a duplicate secret in
their own company — the exact sequence that used to corrupt bindings
before #10576
> - This pull request adds an instance-gated metadata endpoint for an
environment's secret refs and teaches the picker to name a cross-company
secret and its owner honestly
> - The benefit is that operators can tell a healthy cross-company
binding from a broken one, and stop creating duplicate secrets

## Linked Issues or Issue Description

**Is your feature request related to a problem? Please describe.**

In the environment editor, a secret-ref field that points at a secret
owned by a different company shows "Missing secret (22095402…)" in red,
with "The previously selected secret is no longer available. Pick
another or remove the binding." The binding is actually healthy — the
current company's picker just cannot list the other company's secrets.
Operators react by creating a duplicate secret and re-pointing the
field.

**Describe the solution you'd like**

The editor should know the referenced secret's name, status, and owning
company (metadata only, never the value) and present a cross-company ref
neutrally, a deleted secret as deleted, and only an unknown id as
missing.

Related: #10576 (fixes the binding corruption this UI state used to
trigger).

## What Changed

- New `GET /environments/:id/secret-refs` returns `{ refs: [{
configPath, secretId, name, status, companyId, companyName }] }` for the
environment's config-derived secret refs. Values are never returned. The
route sits behind `assertCanAccessInstanceEnvironments`, the same gate
as environment editing.
- New `secretService.describeSecretRefs` loads that metadata across
companies; unknown ids are omitted.
- `SecretBindingPicker` reads an optional `SecretRefHintsContext` (keyed
by secret id). With a hint, a ref the company list cannot show renders
as `NAME — Owning Company` with neutral styling and the note "Owned by
the … company. The binding keeps working; selecting a secret from this
list re-points it here." A hint with `status: "deleted"` reports the
secret as deleted. Without hints, behavior is byte-identical to before —
agent editors and other picker users are unaffected.
- `CompanyEnvironments` fetches descriptors for the environment being
edited and provides them through the context.

## Verification

- `cd server && pnpm vitest run src/__tests__/environment-routes.test.ts
src/__tests__/secrets-service.test.ts` — new endpoint happy path, agent
403 (descriptors never computed), and embedded-Postgres coverage proving
cross-company names resolve and unknown ids drop out.
- `cd ui && pnpm vitest run src/components/SecretBindingPicker.test.tsx
src/components/JsonSchemaForm.test.tsx
src/pages/CompanyEnvironments.test.tsx` — hinted cross-company
rendering, hinted deleted secret, and unchanged no-hint fallback.
- `pnpm run typecheck` in `server` and `ui`.
- Manual: edit an environment whose secret-ref field references another
company's secret; the field names the secret and its owning company
instead of "Missing secret".

## Risks

- The endpoint exposes secret names and company names across companies
to instance-level environment editors. Those actors already manage
instance-shared environments (and instance admins are implicit members
of every company), so this reveals no secret material and no new reach;
the service method documents that callers must sit behind an
instance-level gate.
- UI change is additive and context-gated; pickers without a provider
render exactly as before.

## Model Used

Claude Fable 5 (`claude-fable-5`, Anthropic) via Claude Code — extended
thinking, agentic tool use (file edits, vitest/tsc runs). No other
models involved.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-07-31 16:46:26 -07:00

145 lines
4.9 KiB
TypeScript

// @vitest-environment jsdom
import { act } from "react";
import { createRoot, type Root } from "react-dom/client";
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import {
SecretBindingPicker,
SecretRefHintsContext,
type SecretRefHintsContextValue,
} from "./SecretBindingPicker";
// eslint-disable-next-line @typescript-eslint/no-explicit-any
(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
const mockSecretsApi = vi.hoisted(() => ({
list: vi.fn(),
create: vi.fn(),
}));
vi.mock("../api/secrets", () => ({
secretsApi: mockSecretsApi,
}));
vi.mock("../context/CompanyContext", () => ({
useCompany: () => ({ selectedCompanyId: "company-1" }),
}));
describe("SecretBindingPicker", () => {
let container: HTMLDivElement;
let root: Root | null = null;
let queryClient: QueryClient;
beforeEach(() => {
container = document.createElement("div");
document.body.appendChild(container);
queryClient = new QueryClient({
defaultOptions: { queries: { retry: false } },
});
mockSecretsApi.list.mockReset();
mockSecretsApi.list.mockResolvedValue([]);
});
afterEach(() => {
act(() => {
root?.unmount();
});
root = null;
container.remove();
queryClient.clear();
});
async function render(context: SecretRefHintsContextValue | undefined) {
await act(async () => {
root = createRoot(container);
root.render(
<QueryClientProvider client={queryClient}>
<SecretRefHintsContext.Provider value={context}>
<SecretBindingPicker
value={{ secretId: "22222222-2222-2222-2222-222222222222" }}
onChange={() => {}}
/>
</SecretRefHintsContext.Provider>
</QueryClientProvider>,
);
});
// Let the secrets query settle so selectedMissing is based on real data.
await act(async () => {
await Promise.resolve();
});
}
function readyContext(status: string): SecretRefHintsContextValue {
return {
status: "ready",
hints: {
"22222222-2222-2222-2222-222222222222": {
name: "DAYTONA_API_KEY",
status,
companyId: "company-2",
companyName: "Other Team",
},
},
};
}
it("names an active cross-company secret and its owner instead of calling it missing", async () => {
await render(readyContext("active"));
expect(container.textContent).toContain("DAYTONA_API_KEY — Other Team");
expect(container.textContent).toContain("Owned by the Other Team company");
expect(container.textContent).not.toContain("Missing secret");
expect(container.querySelector("select")?.className).not.toContain("border-destructive");
});
it("reports a deleted hinted secret as deleted", async () => {
await render(readyContext("deleted"));
expect(container.textContent).toContain("DAYTONA_API_KEY — Other Team");
expect(container.textContent).toContain("was deleted");
expect(container.querySelector("select")?.className).toContain("border-destructive");
});
it("does not present a disabled cross-company secret as working", async () => {
await render(readyContext("disabled"));
expect(container.textContent).toContain("DAYTONA_API_KEY — Other Team");
expect(container.textContent).toContain("This secret is disabled");
expect(container.textContent).not.toContain("keeps working");
expect(container.querySelector("select")?.className).toContain("border-destructive");
});
it("stays neutral while descriptors are loading", async () => {
await render({ status: "loading", hints: {} });
expect(container.textContent).toContain("Checking this secret reference");
expect(container.textContent).not.toContain("Missing secret");
expect(container.querySelector("select")?.className).not.toContain("border-destructive");
});
it("stays neutral when the descriptor lookup failed", async () => {
await render({ status: "error", hints: {} });
expect(container.textContent).toContain("Could not load this secret reference");
expect(container.textContent).not.toContain("Missing secret");
expect(container.querySelector("select")?.className).not.toContain("border-destructive");
});
it("treats an unknown id as missing once descriptors are ready", async () => {
await render({ status: "ready", hints: {} });
expect(container.textContent).toContain("Missing secret");
expect(container.textContent).toContain("no longer available");
expect(container.querySelector("select")?.className).toContain("border-destructive");
});
it("keeps the generic missing-secret treatment when no hint context exists", async () => {
await render(undefined);
expect(container.textContent).toContain("Missing secret");
expect(container.textContent).toContain("no longer available");
expect(container.querySelector("select")?.className).toContain("border-destructive");
});
});