mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-08 09:26:50 +08:00
* fix(daemon): enforce runtime ownership on daemon routes (MUL-8154) /api/daemon/* accepts any workspace member's PAT/JWT, and authorization only checked workspace membership. Any member could claim another member's tasks (receiving the agent's custom_env, MCP config and an owner-scoped task token), write task results/messages, and take a runtime over by re-registering its daemon_id. - Runtime-level check on every runtime/task daemon route, HTTP heartbeat, deregister, batch claim (and so the WS claim RPC) and the WS handshake: user credentials must own the runtime (NULL owner fails closed); daemon tokens must match a non-empty runtime daemon_id. - Register: pre-check that every existing row on the daemon_id belongs to the caller, plus a required_owner_id fence in both upserts (incl. the failed-profile path) so a concurrent registration cannot win the row. Daemon-token registration keeps the existing owner. - Legacy merge: only for user-credential registrations, and only when the caller owns both rows, verified on the FOR UPDATE-locked rows. - Tasks without a runtime are not writable through daemon routes; status stays readable. - GetTaskStatus / WS lease queries carry runtime owner/daemon so the hot paths keep one round trip. Co-authored-by: multica-agent <[email protected]> * test(daemon): authenticate fixtures as the runtime owner (MUL-8154) Most handler tests drove daemon routes with a daemon token whose daemon_id did not match the fixture runtime, relying on the workspace-wide token scope this fix removes. They now authenticate the way real daemons do, with the runtime owner's user credential (newOwnerDaemonRequest). Tests about daemon token scoping keep mdt_ and get fixtures with a matching daemon_id; the ownerless-runtime tests also assert that a user credential is refused. Co-authored-by: multica-agent <[email protected]> * fix(daemon): serialize registration per daemon and keep Qoder WS claims working (MUL-8154) Review of #9423: - P1: the owner pre-check and the per-provider/profile upserts hit different conflict keys, so two members registering different providers of the same daemon could both pass the pre-check and both insert, leaving one daemon with two owners (and a daemon token for either runtime reaching the other's). Registration now runs the pre-check and every runtime write in one transaction under a pg_advisory_xact_lock on (workspace_id, daemon_id), on a single connection so queued registrations cannot starve the holder. Legacy merges, analytics and the register event run after commit; failed-profile records use savepoints so they stay best-effort. - P2: the Qoder revocation check read the Authorization header, which the WS RPC bridge's in-process request does not carry, so valid Qoder WS claims silently returned nothing. DaemonAuth now records the mdt_ token hash in the request context, the WS identity keeps it, the RPC bridge re-attaches it, and the check validates that hash on every call (revocation still applies to an open connection). - Regression tests for cross-provider and provider+profile concurrent registration, and for valid/revoked Qoder credentials over WS RPC. Co-authored-by: multica-agent <[email protected]> * fix(daemon): bind daemon tokens to the runtime owner they were issued for (MUL-8154) Second review of #9423: a daemon_id can be re-registered by another member after its runtimes are deleted, and a daemon token was bound only to (workspace, daemon_id), so the previous owner's Remote MCP token reached the new owner's runtime (heartbeat, claim, owner-scoped task token). - daemon_token.owner_id (migration 588). Remote MCP tokens are bound to the locked runtime owner inside FinalizeTaskClaim; live tokens are backfilled only where their daemon has exactly one owner. - DaemonAuth carries the owner binding (DB and cache; cache key bumped to v2 so pre-upgrade entries are never read), the WS identity keeps it and the RPC bridge replays it. - Daemon-token authorization now also requires token owner == runtime owner. Qoder-managed tokens stay unbound (governed by cloud_agent_connection), and user credentials can no longer register the reserved qoder-managed-* ids. - Tests: the reuse lifecycle over HTTP, a new WS handshake and an already open WS connection; the reserved daemon_id; the concurrency barrier now hooks the registration transaction (TxStarter) so the interleaving is real. Co-authored-by: multica-agent <[email protected]> * fix(daemon): owner-bind daemon-token registration; drop unsafe token backfill (MUL-8154) Third review of #9423: - Migration 588 no longer backfills daemon_token.owner_id from the daemon's current owner: that owner may be a later re-registrant, which re-bound the previous owner's live token to them. Existing non-Qoder tokens stay NULL and are refused (24h Remote MCP credentials, re-issued on the next claim). - owner_id is a plain UUID column, no foreign key / cascade (AGENTS.md). - Register via a non-Qoder daemon token now uses the token's owner for the in-transaction pre-check and the SQL owner fence, and refuses unbound tokens. Qoder keeps its connection-based check; daemon tokens still never trigger legacy merges. - Tests: an old owner's bound token and an unbound legacy token can neither register over nor heartbeat the replacement owner's runtime. Co-authored-by: multica-agent <[email protected]> * fix(daemon): grant the Qoder registration exemption only with a live connection (MUL-8154) Fourth review of #9423: register skipped the token owner binding for any qoder-managed-* daemon token, but checked the Qoder connection only when the body declared a qoder_cloud runtime. A pre-upgrade Remote MCP token under that prefix (no owner, no connection) could register type=claude and rewrite another member's runtime. Register now verifies the token against a live cloud_agent_connection before anything else whenever the token is in the Qoder namespace, regardless of the declared runtimes, and restricts that namespace to the bridge's own shape: a built-in qoder_cloud runtime, no custom profiles, no failed_profiles. Test covers built-in, custom-profile, failed-profiles-only and qoder_cloud bodies with an unconnected token, plus the connected token's allowed and refused shapes. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: multica-eve <[email protected]> Co-authored-by: multica-agent <[email protected]>
373 lines
13 KiB
Go
373 lines
13 KiB
Go
package handler
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
func createChatProjectTestProject(t *testing.T, workspaceID, title, description string) string {
|
|
t.Helper()
|
|
|
|
var projectID string
|
|
if err := testPool.QueryRow(context.Background(), `
|
|
INSERT INTO project (workspace_id, title, description)
|
|
VALUES ($1, $2, NULLIF($3, ''))
|
|
RETURNING id
|
|
`, workspaceID, title, description).Scan(&projectID); err != nil {
|
|
t.Fatalf("create project: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
testPool.Exec(context.Background(), `DELETE FROM project WHERE id = $1`, projectID)
|
|
})
|
|
return projectID
|
|
}
|
|
|
|
func createChatSessionWithProjectForTest(t *testing.T, agentID, projectID string) string {
|
|
t.Helper()
|
|
|
|
var sessionID string
|
|
if err := testPool.QueryRow(context.Background(), `
|
|
INSERT INTO chat_session (
|
|
workspace_id, agent_id, creator_id, title, status, project_id, explicitly_created_at
|
|
)
|
|
VALUES ($1, $2, $3, 'Project context chat', 'active', $4, now())
|
|
RETURNING id
|
|
`, testWorkspaceID, agentID, testUserID, projectID).Scan(&sessionID); err != nil {
|
|
t.Fatalf("create chat session: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
testPool.Exec(context.Background(), `DELETE FROM chat_session WHERE id = $1`, sessionID)
|
|
})
|
|
return sessionID
|
|
}
|
|
|
|
func TestCreateChatSession_ProjectContext(t *testing.T) {
|
|
if testHandler == nil || testPool == nil {
|
|
t.Skip("database not available")
|
|
}
|
|
|
|
agentID := createHandlerTestAgent(t, "ChatProjectContextAgent", []byte("[]"))
|
|
projectID := createChatProjectTestProject(t, testWorkspaceID, "Chat project", "Durable context")
|
|
|
|
t.Run("persists a workspace project", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
req := withChatTestWorkspaceCtx(t, newRequest(http.MethodPost, "/api/chat/sessions", map[string]any{
|
|
"agent_id": agentID,
|
|
"title": "with project",
|
|
"project_id": projectID,
|
|
}))
|
|
testHandler.CreateChatSession(w, req)
|
|
if w.Code != http.StatusCreated {
|
|
t.Fatalf("CreateChatSession: expected 201, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
var response ChatSessionResponse
|
|
if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
testPool.Exec(context.Background(), `DELETE FROM chat_session WHERE id = $1`, response.ID)
|
|
})
|
|
if response.ProjectID == nil || *response.ProjectID != projectID {
|
|
t.Fatalf("project_id = %v, want %s", response.ProjectID, projectID)
|
|
}
|
|
|
|
var storedProjectID *string
|
|
if err := testPool.QueryRow(context.Background(), `
|
|
SELECT project_id::text FROM chat_session WHERE id = $1
|
|
`, response.ID).Scan(&storedProjectID); err != nil {
|
|
t.Fatalf("load persisted project_id: %v", err)
|
|
}
|
|
if storedProjectID == nil || *storedProjectID != projectID {
|
|
t.Fatalf("stored project_id = %v, want %s", storedProjectID, projectID)
|
|
}
|
|
|
|
listW := httptest.NewRecorder()
|
|
listReq := withChatTestWorkspaceCtx(t, newRequest(http.MethodGet, "/api/chat/sessions", nil))
|
|
testHandler.ListChatSessions(listW, listReq)
|
|
if listW.Code != http.StatusOK {
|
|
t.Fatalf("ListChatSessions: expected 200, got %d: %s", listW.Code, listW.Body.String())
|
|
}
|
|
var sessions []ChatSessionResponse
|
|
if err := json.NewDecoder(listW.Body).Decode(&sessions); err != nil {
|
|
t.Fatalf("decode session list: %v", err)
|
|
}
|
|
found := false
|
|
for _, session := range sessions {
|
|
if session.ID != response.ID {
|
|
continue
|
|
}
|
|
found = true
|
|
if session.ProjectID == nil || *session.ProjectID != projectID {
|
|
t.Fatalf("listed project_id = %v, want %s", session.ProjectID, projectID)
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatalf("created session %s missing from list", response.ID)
|
|
}
|
|
})
|
|
|
|
t.Run("rejects malformed project id", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
req := withChatTestWorkspaceCtx(t, newRequest(http.MethodPost, "/api/chat/sessions", map[string]any{
|
|
"agent_id": agentID,
|
|
"project_id": "not-a-uuid",
|
|
}))
|
|
testHandler.CreateChatSession(w, req)
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
})
|
|
|
|
t.Run("rejects a project from another workspace", func(t *testing.T) {
|
|
var foreignWorkspaceID string
|
|
if err := testPool.QueryRow(context.Background(), `
|
|
INSERT INTO workspace (name, slug) VALUES ('Foreign chat context', $1) RETURNING id
|
|
`, "chat-context-"+uuid.NewString()).Scan(&foreignWorkspaceID); err != nil {
|
|
t.Fatalf("create foreign workspace: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
testPool.Exec(context.Background(), `DELETE FROM workspace WHERE id = $1`, foreignWorkspaceID)
|
|
})
|
|
foreignProjectID := createChatProjectTestProject(t, foreignWorkspaceID, "Foreign project", "")
|
|
|
|
w := httptest.NewRecorder()
|
|
req := withChatTestWorkspaceCtx(t, newRequest(http.MethodPost, "/api/chat/sessions", map[string]any{
|
|
"agent_id": agentID,
|
|
"project_id": foreignProjectID,
|
|
}))
|
|
testHandler.CreateChatSession(w, req)
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
})
|
|
|
|
t.Run("keeps project optional", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
req := withChatTestWorkspaceCtx(t, newRequest(http.MethodPost, "/api/chat/sessions", map[string]any{
|
|
"agent_id": agentID,
|
|
"title": "workspace context only",
|
|
}))
|
|
testHandler.CreateChatSession(w, req)
|
|
if w.Code != http.StatusCreated {
|
|
t.Fatalf("CreateChatSession: expected 201, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
var response ChatSessionResponse
|
|
if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
testPool.Exec(context.Background(), `DELETE FROM chat_session WHERE id = $1`, response.ID)
|
|
})
|
|
if response.ProjectID != nil {
|
|
t.Fatalf("project_id = %v, want null", response.ProjectID)
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestUpdateChatSession_UpdatesProjectContext(t *testing.T) {
|
|
if testHandler == nil || testPool == nil {
|
|
t.Skip("database not available")
|
|
}
|
|
|
|
projectID := createChatProjectTestProject(t, testWorkspaceID, "Removable chat project", "")
|
|
replacementProjectID := createChatProjectTestProject(t, testWorkspaceID, "Replacement chat project", "")
|
|
agentID := createHandlerTestAgent(t, "RemoveChatProjectAgent", []byte("[]"))
|
|
sessionID := createChatSessionWithProjectForTest(t, agentID, projectID)
|
|
|
|
updateProject := func(projectID any) *httptest.ResponseRecorder {
|
|
t.Helper()
|
|
w := httptest.NewRecorder()
|
|
req := withURLParam(
|
|
withChatTestWorkspaceCtx(t, newRequest(http.MethodPatch, "/api/chat/sessions/"+sessionID, map[string]any{
|
|
"project_id": projectID,
|
|
})),
|
|
"sessionId",
|
|
sessionID,
|
|
)
|
|
testHandler.UpdateChatSession(w, req)
|
|
return w
|
|
}
|
|
|
|
w := updateProject(replacementProjectID)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("replace project: expected 200, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
var response ChatSessionResponse
|
|
if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
if response.ID != sessionID {
|
|
t.Fatalf("session id = %q, want %q", response.ID, sessionID)
|
|
}
|
|
if response.ProjectID == nil || *response.ProjectID != replacementProjectID {
|
|
t.Fatalf("response project_id = %v, want %s", response.ProjectID, replacementProjectID)
|
|
}
|
|
|
|
var foreignWorkspaceID string
|
|
if err := testPool.QueryRow(context.Background(), `
|
|
INSERT INTO workspace (name, slug) VALUES ('Foreign chat update', $1) RETURNING id
|
|
`, "chat-update-"+uuid.NewString()).Scan(&foreignWorkspaceID); err != nil {
|
|
t.Fatalf("create foreign workspace: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
testPool.Exec(context.Background(), `DELETE FROM workspace WHERE id = $1`, foreignWorkspaceID)
|
|
})
|
|
foreignProjectID := createChatProjectTestProject(t, foreignWorkspaceID, "Foreign replacement", "")
|
|
foreignW := updateProject(foreignProjectID)
|
|
if foreignW.Code != http.StatusNotFound {
|
|
t.Fatalf("foreign project: expected 404, got %d: %s", foreignW.Code, foreignW.Body.String())
|
|
}
|
|
|
|
w = updateProject(nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("remove project: expected 200, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
response = ChatSessionResponse{}
|
|
if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
|
|
t.Fatalf("decode remove response: %v", err)
|
|
}
|
|
if response.ProjectID != nil {
|
|
t.Fatalf("response project_id = %v, want null", response.ProjectID)
|
|
}
|
|
|
|
var storedProjectID *string
|
|
if err := testPool.QueryRow(context.Background(), `
|
|
SELECT project_id::text FROM chat_session WHERE id = $1
|
|
`, sessionID).Scan(&storedProjectID); err != nil {
|
|
t.Fatalf("load updated chat session: %v", err)
|
|
}
|
|
if storedProjectID != nil {
|
|
t.Fatalf("stored project_id = %v, want null", storedProjectID)
|
|
}
|
|
}
|
|
|
|
func TestDeleteProject_ClearsChatSessionContext(t *testing.T) {
|
|
if testHandler == nil || testPool == nil {
|
|
t.Skip("database not available")
|
|
}
|
|
|
|
projectID := createChatProjectTestProject(t, testWorkspaceID, "Deleted chat project", "")
|
|
agentID := createHandlerTestAgent(t, "DeletedChatProjectAgent", []byte("[]"))
|
|
sessionID := createChatSessionWithProjectForTest(t, agentID, projectID)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := withURLParam(
|
|
newRequest(http.MethodDelete, "/api/projects/"+projectID, nil),
|
|
"id",
|
|
projectID,
|
|
)
|
|
testHandler.DeleteProject(w, req)
|
|
if w.Code != http.StatusNoContent {
|
|
t.Fatalf("DeleteProject: expected 204, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
var storedProjectID *string
|
|
if err := testPool.QueryRow(context.Background(), `
|
|
SELECT project_id::text FROM chat_session WHERE id = $1
|
|
`, sessionID).Scan(&storedProjectID); err != nil {
|
|
t.Fatalf("load chat session after project delete: %v", err)
|
|
}
|
|
if storedProjectID != nil {
|
|
t.Fatalf("project_id = %v after project delete, want null", storedProjectID)
|
|
}
|
|
}
|
|
|
|
func TestClaimTaskByRuntime_ChatProjectContext(t *testing.T) {
|
|
if testHandler == nil || testPool == nil {
|
|
t.Skip("database not available")
|
|
}
|
|
|
|
ctx := context.Background()
|
|
setHandlerTestWorkspaceRepos(t, []map[string]string{
|
|
{"url": "https://github.com/example/workspace-fallback"},
|
|
})
|
|
projectID := createChatProjectTestProject(
|
|
t,
|
|
testWorkspaceID,
|
|
"Chat claim project",
|
|
"Use the project design system and release branch.",
|
|
)
|
|
const projectRepoURL = "https://github.com/example/chat-project-repo"
|
|
const projectRepoRef = "release/chat-context"
|
|
if _, err := testPool.Exec(ctx, `
|
|
INSERT INTO project_resource (
|
|
project_id, workspace_id, resource_type, resource_ref, label, position
|
|
) VALUES ($1, $2, 'github_repo', $3::jsonb, 'Chat repository', 0)
|
|
`, projectID, testWorkspaceID, `{"url":"`+projectRepoURL+`","ref":"`+projectRepoRef+`"}`); err != nil {
|
|
t.Fatalf("create project resource: %v", err)
|
|
}
|
|
|
|
agentID := createHandlerTestAgent(t, "ChatProjectClaimAgent", []byte("[]"))
|
|
runtimeID := handlerTestRuntimeID(t)
|
|
sessionID := createChatSessionWithProjectForTest(t, agentID, projectID)
|
|
if _, err := testPool.Exec(ctx, `
|
|
INSERT INTO chat_message (chat_session_id, role, content)
|
|
VALUES ($1, 'user', 'Plan the project release')
|
|
`, sessionID); err != nil {
|
|
t.Fatalf("create chat message: %v", err)
|
|
}
|
|
|
|
var taskID string
|
|
if err := testPool.QueryRow(ctx, `
|
|
INSERT INTO agent_task_queue (
|
|
agent_id, runtime_id, status, priority, chat_session_id
|
|
) VALUES ($1, $2, 'queued', 1000, $3)
|
|
RETURNING id
|
|
`, agentID, runtimeID, sessionID).Scan(&taskID); err != nil {
|
|
t.Fatalf("create chat task: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
testPool.Exec(context.Background(), `DELETE FROM agent_task_queue WHERE id = $1`, taskID)
|
|
})
|
|
|
|
w := httptest.NewRecorder()
|
|
req := newOwnerDaemonRequest(
|
|
http.MethodPost,
|
|
"/api/daemon/runtimes/"+runtimeID+"/claim",
|
|
nil,
|
|
)
|
|
req = withURLParam(req, "runtimeId", runtimeID)
|
|
testHandler.ClaimTaskByRuntime(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("ClaimTaskByRuntime: expected 200, got %d: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
var response struct {
|
|
Task *struct {
|
|
ID string `json:"id"`
|
|
ProjectID string `json:"project_id"`
|
|
ProjectTitle string `json:"project_title"`
|
|
ProjectDescription string `json:"project_description"`
|
|
ProjectResources []ProjectResourceData `json:"project_resources"`
|
|
Repos []RepoData `json:"repos"`
|
|
} `json:"task"`
|
|
}
|
|
if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
if response.Task == nil || response.Task.ID != taskID {
|
|
t.Fatalf("claimed task = %+v, want %s", response.Task, taskID)
|
|
}
|
|
if response.Task.ProjectID != projectID {
|
|
t.Fatalf("project_id = %q, want %q", response.Task.ProjectID, projectID)
|
|
}
|
|
if response.Task.ProjectTitle != "Chat claim project" {
|
|
t.Fatalf("project_title = %q", response.Task.ProjectTitle)
|
|
}
|
|
if response.Task.ProjectDescription != "Use the project design system and release branch." {
|
|
t.Fatalf("project_description = %q", response.Task.ProjectDescription)
|
|
}
|
|
if len(response.Task.ProjectResources) != 1 || response.Task.ProjectResources[0].Label != "Chat repository" {
|
|
t.Fatalf("project_resources = %+v", response.Task.ProjectResources)
|
|
}
|
|
if len(response.Task.Repos) != 1 || response.Task.Repos[0].URL != projectRepoURL || response.Task.Repos[0].Ref != projectRepoRef {
|
|
t.Fatalf("repos = %+v, want project repo only", response.Task.Repos)
|
|
}
|
|
}
|