|
| 1 | +/** |
| 2 | + * The watch-create confirm path: no `draft.target` re-authorizes the URL's own |
| 3 | + * environment exactly as before; a `draft.target` re-authorizes THAT environment and |
| 4 | + * requires it to stay inside the URL's own organization — a user's membership |
| 5 | + * elsewhere is not license to watch across orgs from this chat. |
| 6 | + */ |
| 7 | +import { beforeEach, describe, expect, it, vi } from "vitest"; |
| 8 | +import type { WatchDraft } from "@internal/dashboard-agent-contracts"; |
| 9 | + |
| 10 | +const mocks = vi.hoisted(() => ({ |
| 11 | + authorizeWatchEnvironmentById: vi.fn(), |
| 12 | + submitDashboardAgentWatch: vi.fn(), |
| 13 | + findEnvironmentBySlug: vi.fn(), |
| 14 | +})); |
| 15 | + |
| 16 | +vi.mock("~/db.server", () => ({ $replica: {}, prisma: {} })); |
| 17 | +vi.mock("~/env.server", () => ({ env: { SESSION_SECRET: "test-session-secret" } })); |
| 18 | +vi.mock("~/services/session.server", () => ({ |
| 19 | + requireUser: async () => ({ id: "usr_real", admin: false, isImpersonating: false }), |
| 20 | +})); |
| 21 | +vi.mock("~/v3/canAccessDashboardAgent.server", () => ({ |
| 22 | + canAccessDashboardAgent: async () => true, |
| 23 | +})); |
| 24 | +vi.mock("~/models/project.server", () => ({ |
| 25 | + findProjectBySlug: async () => ({ |
| 26 | + id: "proj_real", |
| 27 | + organizationId: "org_real", |
| 28 | + externalRef: "proj_ref_real", |
| 29 | + }), |
| 30 | +})); |
| 31 | +vi.mock("~/models/runtimeEnvironment.server", () => ({ |
| 32 | + findEnvironmentBySlug: mocks.findEnvironmentBySlug, |
| 33 | +})); |
| 34 | +vi.mock("~/services/dashboardAgentDb.server", () => ({ dashboardAgentDb: {} })); |
| 35 | +vi.mock("~/services/resolveTriggerUri.server", () => ({ resolveTriggerUri: () => null })); |
| 36 | +// The chat route reaches the ClickHouse factory through the watch services, and the factory |
| 37 | +// builds its client at import time from an env var no test sets. |
| 38 | +vi.mock("~/services/clickhouse/clickhouseFactoryInstance.server", () => ({ |
| 39 | + clickhouseFactory: { getClickhouseForOrganization: async () => ({}) }, |
| 40 | +})); |
| 41 | +vi.mock("~/services/dashboardAgentWatches.server", async (importOriginal) => ({ |
| 42 | + ...((await importOriginal()) as Record<string, unknown>), |
| 43 | + authorizeWatchEnvironmentById: mocks.authorizeWatchEnvironmentById, |
| 44 | + submitDashboardAgentWatch: mocks.submitDashboardAgentWatch, |
| 45 | +})); |
| 46 | + |
| 47 | +import { action } from "~/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent"; |
| 48 | + |
| 49 | +const SPEC = { |
| 50 | + kind: "backlog_drain" as const, |
| 51 | + queue: "my-queue", |
| 52 | + checkEveryMinutes: 15 as const, |
| 53 | + maxHours: 6, |
| 54 | + note: "checking on the backlog", |
| 55 | +}; |
| 56 | + |
| 57 | +function watchCreateRequest(draft: WatchDraft) { |
| 58 | + const form = new URLSearchParams({ |
| 59 | + intent: "watch-create", |
| 60 | + clientRequestId: "req_1", |
| 61 | + draft: JSON.stringify(draft), |
| 62 | + }); |
| 63 | + |
| 64 | + return action({ |
| 65 | + request: new Request( |
| 66 | + "https://app.trigger.dev/resources/orgs/acme/projects/api/env/dev/dashboard-agent", |
| 67 | + { |
| 68 | + method: "POST", |
| 69 | + headers: { "content-type": "application/x-www-form-urlencoded" }, |
| 70 | + body: form.toString(), |
| 71 | + } |
| 72 | + ), |
| 73 | + params: { organizationSlug: "acme", projectParam: "api", envParam: "dev" }, |
| 74 | + context: {}, |
| 75 | + } as any); |
| 76 | +} |
| 77 | + |
| 78 | +describe("watch-create target resolution", () => { |
| 79 | + beforeEach(() => { |
| 80 | + mocks.authorizeWatchEnvironmentById.mockReset(); |
| 81 | + mocks.submitDashboardAgentWatch.mockReset().mockResolvedValue({ |
| 82 | + ok: true, |
| 83 | + watching: true, |
| 84 | + watchId: "watch_1", |
| 85 | + chatId: "chat_1", |
| 86 | + messages: [], |
| 87 | + }); |
| 88 | + mocks.findEnvironmentBySlug.mockReset().mockResolvedValue({ id: "env_url" }); |
| 89 | + }); |
| 90 | + |
| 91 | + it("re-authorizes the URL's own environment when no target is given", async () => { |
| 92 | + mocks.authorizeWatchEnvironmentById.mockResolvedValue({ |
| 93 | + id: "env_url", |
| 94 | + organizationId: "org_real", |
| 95 | + }); |
| 96 | + |
| 97 | + const response = await watchCreateRequest({ |
| 98 | + spec: SPEC, |
| 99 | + followUp: { investigateOnAttention: false, notifyExternally: false }, |
| 100 | + }); |
| 101 | + |
| 102 | + expect(response.status).toBe(200); |
| 103 | + expect(mocks.findEnvironmentBySlug).toHaveBeenCalledTimes(1); |
| 104 | + expect(mocks.authorizeWatchEnvironmentById).toHaveBeenCalledWith({ |
| 105 | + userId: "usr_real", |
| 106 | + environmentId: "env_url", |
| 107 | + }); |
| 108 | + expect(mocks.submitDashboardAgentWatch.mock.calls[0][0].environment.id).toBe("env_url"); |
| 109 | + }); |
| 110 | + |
| 111 | + it("resolves and authorizes a same-org sibling target instead of the URL's environment", async () => { |
| 112 | + mocks.authorizeWatchEnvironmentById.mockResolvedValue({ |
| 113 | + id: "env_sibling", |
| 114 | + organizationId: "org_real", |
| 115 | + }); |
| 116 | + |
| 117 | + const response = await watchCreateRequest({ |
| 118 | + spec: SPEC, |
| 119 | + followUp: { investigateOnAttention: false, notifyExternally: false }, |
| 120 | + target: { environmentId: "env_sibling" }, |
| 121 | + }); |
| 122 | + |
| 123 | + expect(response.status).toBe(200); |
| 124 | + expect(await response.json()).toMatchObject({ watching: true, watchId: "watch_1" }); |
| 125 | + // The URL's environment is never looked up on the target path. |
| 126 | + expect(mocks.findEnvironmentBySlug).not.toHaveBeenCalled(); |
| 127 | + expect(mocks.authorizeWatchEnvironmentById).toHaveBeenCalledWith({ |
| 128 | + userId: "usr_real", |
| 129 | + environmentId: "env_sibling", |
| 130 | + }); |
| 131 | + expect(mocks.submitDashboardAgentWatch.mock.calls[0][0].environment.id).toBe("env_sibling"); |
| 132 | + }); |
| 133 | + |
| 134 | + it("refuses a target environment in a different organization with a clean 4xx", async () => { |
| 135 | + mocks.authorizeWatchEnvironmentById.mockResolvedValue({ |
| 136 | + id: "env_foreign", |
| 137 | + organizationId: "org_other", |
| 138 | + }); |
| 139 | + |
| 140 | + const response = await watchCreateRequest({ |
| 141 | + spec: SPEC, |
| 142 | + followUp: { investigateOnAttention: false, notifyExternally: false }, |
| 143 | + target: { environmentId: "env_foreign" }, |
| 144 | + }); |
| 145 | + |
| 146 | + expect(response.status).toBe(404); |
| 147 | + expect(await response.json()).toMatchObject({ code: "invalid_target" }); |
| 148 | + expect(mocks.submitDashboardAgentWatch).not.toHaveBeenCalled(); |
| 149 | + }); |
| 150 | + |
| 151 | + it("refuses a target environment the user has no access to", async () => { |
| 152 | + mocks.authorizeWatchEnvironmentById.mockResolvedValue(null); |
| 153 | + |
| 154 | + const response = await watchCreateRequest({ |
| 155 | + spec: SPEC, |
| 156 | + followUp: { investigateOnAttention: false, notifyExternally: false }, |
| 157 | + target: { environmentId: "env_gone" }, |
| 158 | + }); |
| 159 | + |
| 160 | + expect(response.status).toBe(404); |
| 161 | + expect(await response.json()).toMatchObject({ code: "invalid_target" }); |
| 162 | + expect(mocks.submitDashboardAgentWatch).not.toHaveBeenCalled(); |
| 163 | + }); |
| 164 | +}); |
0 commit comments