PaperClipAI/server/src/services/issue-thread-interaction-resolution.test.ts

import { describe, expect, it } from "vitest";
import {
  addressedHumanOnlyDenialMessage,
  evaluateIssueThreadInteractionResolverAudience,
  issueThreadInteractionAttentionAgentAllowed,
} from "./issue-thread-interaction-resolution.js";

const agent = { type: "agent", agentId: "agent-1", runId: "run-1" } as const;

function interaction(overrides: Record<string, unknown> = {}) {
  return {
    createdByAgentId: "agent-1",
    createdByUserId: null,
    sourceRunId: "run-1",
    addresseeAgentId: null,
    addresseeUserId: null,
    effectiveResolverPolicy: "anyone",
    ...overrides,
  };
}

describe("issue-thread interaction resolver audience", () => {
  it("allows the creator and creating run under anyone", () => {
    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: agent,
      interaction: interaction(),
    })).toMatchObject({ allowed: true, effectiveResolverPolicy: "anyone", reason: "allow_anyone" });
  });

  it.each([
    ["creator agent", { createdByAgentId: "agent-1", sourceRunId: "run-other" }],
    ["creating run", { createdByAgentId: "agent-other", sourceRunId: "run-1" }],
  ])("excludes the %s only when not_creator is effective", (_name, creator) => {
    const decision = evaluateIssueThreadInteractionResolverAudience({
      actor: agent,
      interaction: interaction({ ...creator, effectiveResolverPolicy: "not_creator" }),
    });
    expect(decision).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
  });

  it("enforces an explicit addressee", () => {
    const decision = evaluateIssueThreadInteractionResolverAudience({
      actor: agent,
      interaction: interaction({ addresseeAgentId: "agent-2" }),
    });
    expect(decision).toMatchObject({ allowed: false, code: "interaction_addressee_mismatch" });
  });

  it("allows only the addressed user to resolve a user-addressed interaction", () => {
    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: { type: "user", userId: "alice" },
      interaction: interaction({ addresseeUserId: "alice", effectiveResolverPolicy: "human_only" }),
    })).toMatchObject({ allowed: true, reason: "allow_addressee" });

    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: { type: "user", userId: "bob" },
      interaction: interaction({ addresseeUserId: "alice", effectiveResolverPolicy: "human_only" }),
    })).toMatchObject({ allowed: false, code: "interaction_addressee_mismatch" });
  });

  it("requires run attribution for agents", () => {
    const decision = evaluateIssueThreadInteractionResolverAudience({
      actor: { type: "agent", agentId: "agent-1", runId: null },
      interaction: interaction(),
    });
    expect(decision).toMatchObject({
      allowed: false,
      status: 422,
      code: "interaction_run_attribution_required",
    });
  });

  it("allows a server-derived restriction to narrow but never widen the audience", () => {
    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: agent,
      interaction: interaction({ createdByAgentId: "agent-other", sourceRunId: "run-other" }),
      additionalRestriction: "human_only",
    })).toMatchObject({ allowed: false, code: "interaction_human_only" });

    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: agent,
      interaction: interaction({ effectiveResolverPolicy: "human_only" }),
      additionalRestriction: "anyone",
    })).toMatchObject({ allowed: false, code: "interaction_human_only" });
  });

  it("intersects human-only and creator-separation restrictions", () => {
    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: { type: "user", userId: "user-1" },
      interaction: interaction({
        createdByAgentId: null,
        createdByUserId: "user-1",
        effectiveResolverPolicy: "not_creator",
      }),
      additionalRestriction: "human_only",
    })).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });

    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: { type: "user", userId: "user-1" },
      interaction: interaction({
        createdByAgentId: null,
        createdByUserId: "user-1",
        effectiveResolverPolicy: "human_only",
      }),
      additionalRestriction: "not_creator",
    })).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
  });

  it("excludes the review requester when a review card has null creator columns", () => {
    const restriction = {
      policy: "not_creator",
      excludedActor: { type: "user", id: "review-requester" },
      source: "issue_review",
    } as const;
    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: { type: "user", userId: "review-requester" },
      interaction: interaction({
        createdByAgentId: null,
        createdByUserId: null,
        sourceRunId: null,
      }),
      additionalRestriction: restriction,
    })).toMatchObject({
      allowed: false,
      code: "review_policy_denied",
      details: {
        policy: "not_creator",
        allowedActor: "writer_other_than_review_requester",
      },
    });
    expect(evaluateIssueThreadInteractionResolverAudience({
      actor: { type: "user", userId: "peer-reviewer" },
      interaction: interaction({
        createdByAgentId: null,
        createdByUserId: null,
        sourceRunId: null,
      }),
      additionalRestriction: restriction,
    })).toMatchObject({ allowed: true, effectiveResolverPolicy: "not_creator" });
  });

  it("keeps governed actions independently human-only", () => {
    const decision = evaluateIssueThreadInteractionResolverAudience({
      actor: agent,
      interaction: interaction(),
      governedAction: true,
    });
    expect(decision).toMatchObject({ allowed: false, code: "interaction_governed_action_denied" });
  });

  it("preserves legacy inherited board_or_agents creator separation", () => {
    const decision = evaluateIssueThreadInteractionResolverAudience({
      actor: agent,
      interaction: interaction({
        effectiveResolverPolicy: "board_or_agents",
        resolverPolicyProvenance: "legacy_inherited_restriction",
      }),
    });
    expect(decision).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
  });

  it("derives agent attention ownership from the same effective audience", () => {
    expect(issueThreadInteractionAttentionAgentAllowed({
      agentId: "agent-1",
      interaction: interaction(),
    })).toBe(true);
    expect(issueThreadInteractionAttentionAgentAllowed({
      agentId: "agent-1",
      interaction: interaction({ effectiveResolverPolicy: "not_creator" }),
    })).toBe(false);
    expect(issueThreadInteractionAttentionAgentAllowed({
      agentId: "agent-2",
      interaction: interaction({ effectiveResolverPolicy: "human_only" }),
    })).toBe(false);
  });

  describe("human-only card addressed to someone else", () => {
    const card = interaction({ createdByAgentId: null, createdByUserId: "alex", addresseeUserId: "riley", effectiveResolverPolicy: "human_only" });

    it("tells the agent only the addressee resolves it and not to send the asker to the card", () => {
      const decision = evaluateIssueThreadInteractionResolverAudience({ actor: { ...agent, relayedHumanUserId: "alex" }, interaction: card });
      expect(decision).toMatchObject({ allowed: false, status: 403, code: "interaction_human_only", details: { addresseeUserId: "riley", askerIsNotAddressee: true } });
      const message = decision.allowed ? "" : decision.message;
      expect(message).toContain("This issue-thread interaction is human-only and addressed to");
      expect(message).toContain("Only the addressee can accept or decline it");
      expect(message).toContain("do not ask the person asking to accept or decline it");
    });

    it("names the addressee once the route knows their display name", () => {
      const message = addressedHumanOnlyDenialMessage("Riley", true);
      expect(message).toContain("addressed to Riley.");
      expect(message).toContain("Only Riley can accept or decline it");
      expect(message).toContain("the card waits on Riley");
      expect(message).not.toContain("addresseeUserId");
    });

    it.each([
      ["no verified replying user", agent],
      ["the addressee as the replying user", { ...agent, relayedHumanUserId: "riley" }],
    ])("keeps the advice neutral with %s", (_name, actor) => {
      const decision = evaluateIssueThreadInteractionResolverAudience({ actor, interaction: card });
      expect(decision).toMatchObject({ allowed: false, code: "interaction_human_only", details: { addresseeUserId: "riley", askerIsNotAddressee: false } });
      const message = decision.allowed ? "" : decision.message;
      expect(message).toContain("Only the addressee can accept or decline it");
      expect(message).not.toContain("do not ask the person asking");
    });

    it("keeps the plain human-only denial when the card has no addressee", () => {
      const decision = evaluateIssueThreadInteractionResolverAudience({ actor: agent,
        interaction: interaction({ effectiveResolverPolicy: "human_only" }) });
      expect(decision).toMatchObject({ allowed: false, code: "interaction_human_only", message: "This issue-thread interaction is human-only" });
    });
  });

  describe("relayed human decision", () => {
    const relay = { ...agent, relayedHumanUserId: "user-1" };
    const humanOnly = (overrides: Record<string, unknown> = {}) =>
      interaction({ effectiveResolverPolicy: "human_only", effectiveResolverPolicySource: "requested",
        resolverPolicyProvenance: "explicit", ...overrides });

    it("allows a verified reply on a card whose creator requested human_only", () => {
      expect(evaluateIssueThreadInteractionResolverAudience({ actor: relay, interaction: humanOnly() }))
        .toMatchObject({ allowed: true, effectiveResolverPolicy: "human_only", reason: "allow_relayed_human" });
    });

    it.each([
      ["no relay", { actor: agent }],
      ["a company cap", { interaction: humanOnly({ effectiveResolverPolicySource: "company_cap" }) }],
      ["a governed-action source", { interaction: humanOnly({ effectiveResolverPolicySource: "governed_action" }) }],
      ["an unknown legacy source", { interaction: humanOnly({ effectiveResolverPolicySource: null }) }],
      ["a governed action", { governedAction: true }],
      ["an issue-review restriction", { additionalRestriction: "human_only" as const }],
      ["another addressed user", { interaction: humanOnly({ addresseeUserId: "user-2" }) }],
      ["a human-created card", { interaction: humanOnly({ createdByAgentId: null, createdByUserId: "user-1" }) }],
      ["another agent's card", { interaction: humanOnly({ createdByAgentId: "agent-2" }) }],
      ["an inherited company default", { interaction: humanOnly({ resolverPolicyProvenance: "inherited" }) }],
    ])("still denies %s", (_name, override) => {
      const decision = evaluateIssueThreadInteractionResolverAudience({ actor: relay, interaction: humanOnly(), ...override });
      expect(decision).toMatchObject({ allowed: false });
    });

    it("never widens a non-human-only card", () => {
      expect(evaluateIssueThreadInteractionResolverAudience({ actor: relay,
        interaction: interaction({ effectiveResolverPolicy: "not_creator" }) }))
        .toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
    });
  });
});