mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-17 10:06:42 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - External tools need explicit identity and access boundaries. > - Shared connection credentials cannot represent every user-scoped use case. > - Grants must stay company-scoped and support safe delegation. > - This pull request adds connection grants, identity rules, and their database contract. > - The benefit is durable control over which identity an agent may use. ## Linked Issues or Issue Description Refs #11965 This is stack 3 of 11. It depends on stack 2 and replaces another reviewable part of #11965. ## What Changed - Add company and user connection grants. - Add delegated identity and membership rules. - Synchronize database, shared, server, and UI contracts. - Register the grant-member replacement route in the OpenAPI surface in the same layer that mounts it. - Add migration 0231 with replay-safe guards and coverage. ## Verification - `pnpm -r typecheck` - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/tool-access-service.test.ts` - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/openapi-routes.test.ts` (5 passed) - `pnpm --filter @paperclipai/db check:migrations` - `pnpm build` ## Risks - Incorrect grant selection could expose the wrong credential scope. - The service enforces company and subject boundaries before credential use. - Migration 0231 is generated, ordered after 0230, and safe to replay. > I checked `ROADMAP.md`. This stack continues the existing app connection work from #11965 and does not duplicate another planned item. ## Model Used OpenAI Codex, GPT-5. The runtime model ID and context window were not exposed. The model used reasoning, tool use, and code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either linked a public issue or pull request with `Refs #` - [x] I have not referenced internal or instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
103 lines
3.4 KiB
TypeScript
103 lines
3.4 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { interactionResolverAudience } from "./attention.js";
|
|
|
|
const AGENT_NAMES: Record<string, string> = {
|
|
"agent-watchdog": "Watchdog",
|
|
"agent-codex": "CodexCoder",
|
|
};
|
|
|
|
const agentName = (agentId: string) => AGENT_NAMES[agentId] ?? null;
|
|
|
|
function row(overrides: Record<string, unknown> = {}) {
|
|
return {
|
|
addresseeAgentId: null,
|
|
createdByAgentId: "agent-watchdog",
|
|
requestedResolverPolicy: "anyone",
|
|
effectiveResolverPolicy: "anyone",
|
|
resolverPolicyProvenance: "inherited",
|
|
effectiveResolverPolicySource: "requested",
|
|
...overrides,
|
|
} as Parameters<typeof interactionResolverAudience>[0];
|
|
}
|
|
|
|
describe("attention feed resolver audience", () => {
|
|
it("carries the open default with the creator named", () => {
|
|
expect(interactionResolverAudience(row(), agentName)).toEqual({
|
|
requestedResolverPolicy: "anyone",
|
|
effectiveResolverPolicy: "anyone",
|
|
effectiveResolverPolicySource: "requested",
|
|
resolverPolicyProvenance: "inherited",
|
|
addresseeAgentId: null,
|
|
addresseeUserId: null,
|
|
addresseeName: null,
|
|
createdByAgentId: "agent-watchdog",
|
|
createdByAgentName: "Watchdog",
|
|
});
|
|
});
|
|
|
|
it("names the addressed agent", () => {
|
|
expect(interactionResolverAudience(row({ addresseeAgentId: "agent-codex" }), agentName))
|
|
.toMatchObject({ addresseeAgentId: "agent-codex", addresseeName: "CodexCoder" });
|
|
});
|
|
|
|
it("reports the company cap that narrowed the requested audience", () => {
|
|
expect(interactionResolverAudience(
|
|
row({
|
|
requestedResolverPolicy: "anyone",
|
|
effectiveResolverPolicy: "human_only",
|
|
effectiveResolverPolicySource: "company_cap",
|
|
}),
|
|
agentName,
|
|
)).toMatchObject({
|
|
requestedResolverPolicy: "anyone",
|
|
effectiveResolverPolicy: "human_only",
|
|
effectiveResolverPolicySource: "company_cap",
|
|
});
|
|
});
|
|
|
|
it("keeps a pre-migration board_or_agents row restricted, matching the evaluator", () => {
|
|
// The queue must not read `Anyone` while the resolution routes still treat
|
|
// the card as creator-excluded.
|
|
expect(interactionResolverAudience(
|
|
row({
|
|
requestedResolverPolicy: "board_or_agents",
|
|
effectiveResolverPolicy: "board_or_agents",
|
|
resolverPolicyProvenance: "legacy_inherited_restriction",
|
|
}),
|
|
agentName,
|
|
)).toMatchObject({
|
|
requestedResolverPolicy: "not_creator",
|
|
effectiveResolverPolicy: "not_creator",
|
|
resolverPolicyProvenance: "legacy_inherited_restriction",
|
|
});
|
|
});
|
|
|
|
it("infers legacy provenance for a row written before the column existed", () => {
|
|
expect(interactionResolverAudience(
|
|
row({
|
|
requestedResolverPolicy: "board_only",
|
|
effectiveResolverPolicy: "board_only",
|
|
resolverPolicyProvenance: null,
|
|
effectiveResolverPolicySource: null,
|
|
}),
|
|
agentName,
|
|
)).toMatchObject({
|
|
requestedResolverPolicy: "human_only",
|
|
effectiveResolverPolicy: "human_only",
|
|
resolverPolicyProvenance: "legacy_inherited_restriction",
|
|
effectiveResolverPolicySource: "requested",
|
|
});
|
|
});
|
|
|
|
it("leaves an unknown agent unnamed rather than inventing a responder", () => {
|
|
expect(interactionResolverAudience(
|
|
row({ addresseeAgentId: "agent-deleted", createdByAgentId: null }),
|
|
agentName,
|
|
)).toMatchObject({
|
|
addresseeName: null,
|
|
createdByAgentId: null,
|
|
createdByAgentName: null,
|
|
});
|
|
});
|
|
});
|