Files
PaperClipAI/server/src/services/attention-resolver-audience.test.ts
T
DottaandPaperclip 20ccf3f476 feat(apps): add connection grants and delegated identities (#12341)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - External tools need explicit identity and access boundaries.
> - Shared connection credentials cannot represent every user-scoped use
case.
> - Grants must stay company-scoped and support safe delegation.
> - This pull request adds connection grants, identity rules, and their
database contract.
> - The benefit is durable control over which identity an agent may use.

## Linked Issues or Issue Description

Refs #11965

This is stack 3 of 11. It depends on stack 2 and replaces another
reviewable part of #11965.

## What Changed

- Add company and user connection grants.
- Add delegated identity and membership rules.
- Synchronize database, shared, server, and UI contracts.
- Register the grant-member replacement route in the OpenAPI surface in
the same layer that mounts it.
- Add migration 0231 with replay-safe guards and coverage.

## Verification

- `pnpm -r typecheck`
- `pnpm --filter @paperclipai/server exec vitest run
src/__tests__/tool-access-service.test.ts`
- `pnpm --filter @paperclipai/server exec vitest run
src/__tests__/openapi-routes.test.ts` (5 passed)
- `pnpm --filter @paperclipai/db check:migrations`
- `pnpm build`

## Risks

- Incorrect grant selection could expose the wrong credential scope.
- The service enforces company and subject boundaries before credential
use.
- Migration 0231 is generated, ordered after 0230, and safe to replay.

> I checked `ROADMAP.md`. This stack continues the existing app
connection work from #11965 and does not duplicate another planned item.

## Model Used

OpenAI Codex, GPT-5. The runtime model ID and context window were not
exposed. The model used reasoning, tool use, and code execution.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either linked a public issue or pull request with `Refs #`
- [x] I have not referenced internal or instance-local Paperclip issues
or links
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-08-29 12:08:33 -05:00

103 lines
3.4 KiB
TypeScript

import { describe, expect, it } from "vitest";
import { interactionResolverAudience } from "./attention.js";
const AGENT_NAMES: Record<string, string> = {
"agent-watchdog": "Watchdog",
"agent-codex": "CodexCoder",
};
const agentName = (agentId: string) => AGENT_NAMES[agentId] ?? null;
function row(overrides: Record<string, unknown> = {}) {
return {
addresseeAgentId: null,
createdByAgentId: "agent-watchdog",
requestedResolverPolicy: "anyone",
effectiveResolverPolicy: "anyone",
resolverPolicyProvenance: "inherited",
effectiveResolverPolicySource: "requested",
...overrides,
} as Parameters<typeof interactionResolverAudience>[0];
}
describe("attention feed resolver audience", () => {
it("carries the open default with the creator named", () => {
expect(interactionResolverAudience(row(), agentName)).toEqual({
requestedResolverPolicy: "anyone",
effectiveResolverPolicy: "anyone",
effectiveResolverPolicySource: "requested",
resolverPolicyProvenance: "inherited",
addresseeAgentId: null,
addresseeUserId: null,
addresseeName: null,
createdByAgentId: "agent-watchdog",
createdByAgentName: "Watchdog",
});
});
it("names the addressed agent", () => {
expect(interactionResolverAudience(row({ addresseeAgentId: "agent-codex" }), agentName))
.toMatchObject({ addresseeAgentId: "agent-codex", addresseeName: "CodexCoder" });
});
it("reports the company cap that narrowed the requested audience", () => {
expect(interactionResolverAudience(
row({
requestedResolverPolicy: "anyone",
effectiveResolverPolicy: "human_only",
effectiveResolverPolicySource: "company_cap",
}),
agentName,
)).toMatchObject({
requestedResolverPolicy: "anyone",
effectiveResolverPolicy: "human_only",
effectiveResolverPolicySource: "company_cap",
});
});
it("keeps a pre-migration board_or_agents row restricted, matching the evaluator", () => {
// The queue must not read `Anyone` while the resolution routes still treat
// the card as creator-excluded.
expect(interactionResolverAudience(
row({
requestedResolverPolicy: "board_or_agents",
effectiveResolverPolicy: "board_or_agents",
resolverPolicyProvenance: "legacy_inherited_restriction",
}),
agentName,
)).toMatchObject({
requestedResolverPolicy: "not_creator",
effectiveResolverPolicy: "not_creator",
resolverPolicyProvenance: "legacy_inherited_restriction",
});
});
it("infers legacy provenance for a row written before the column existed", () => {
expect(interactionResolverAudience(
row({
requestedResolverPolicy: "board_only",
effectiveResolverPolicy: "board_only",
resolverPolicyProvenance: null,
effectiveResolverPolicySource: null,
}),
agentName,
)).toMatchObject({
requestedResolverPolicy: "human_only",
effectiveResolverPolicy: "human_only",
resolverPolicyProvenance: "legacy_inherited_restriction",
effectiveResolverPolicySource: "requested",
});
});
it("leaves an unknown agent unnamed rather than inventing a responder", () => {
expect(interactionResolverAudience(
row({ addresseeAgentId: "agent-deleted", createdByAgentId: null }),
agentName,
)).toMatchObject({
addresseeName: null,
createdByAgentId: null,
createdByAgentName: null,
});
});
});