feat: complete Epic 1 production foundation

2026-08-25 01:24:11 +03:00
parent 767428436d
commit 182bde8ac0
298 changed files with 35719 additions and 5299 deletions
@@ -1,5 +1,8 @@
 use super::*;

+mod pending;
+mod revocation;
+
 #[tokio::test]
 async fn approval_key_lists_and_decides_pending_requests() {
    let registry = test_registry().await;
@@ -23,6 +26,8 @@ async fn approval_key_lists_and_decides_pending_requests() {
        operation_version: 1,
        status: ApprovalRequestStatus::Pending,
        risk_level: OperationApprovalRiskLevel::Dangerous,
+        request_id: None,
+        trace_id: None,
        request_payload: json!({"email": "ada@example.com"}),
        response_payload: None,
        created_at: OffsetDateTime::now_utc(),
@@ -164,11 +169,16 @@ async fn approval_key_lists_and_decides_pending_requests() {
        .list_invocation_logs(ListInvocationLogsQuery {
            workspace_id: &test_workspace_id(),
            level: None,
+            status: None,
+            outcome_group: None,
            search_text: None,
            source: Some(InvocationSource::AgentToolCall),
            operation_id: Some(&operation.id),
            agent_id: Some(&test_agent_id("sales-human-approval")),
            created_after: None,
+            created_before: None,
+            cursor_created_at: None,
+            cursor_id: None,
            limit: 10,
        })
        .await
@@ -203,6 +213,8 @@ async fn approval_key_denies_without_executing_upstream() {
        operation_version: 1,
        status: ApprovalRequestStatus::Pending,
        risk_level: OperationApprovalRiskLevel::Dangerous,
+        request_id: None,
+        trace_id: None,
        request_payload: json!({"email": "deny@example.com"}),
        response_payload: None,
        created_at: OffsetDateTime::now_utc(),
@@ -265,11 +277,16 @@ async fn approval_key_denies_without_executing_upstream() {
        .list_invocation_logs(ListInvocationLogsQuery {
            workspace_id: &test_workspace_id(),
            level: None,
+            status: None,
+            outcome_group: None,
            search_text: None,
            source: Some(InvocationSource::AgentToolCall),
            operation_id: Some(&operation.id),
            agent_id: Some(&test_agent_id("sales-human-deny")),
            created_after: None,
+            created_before: None,
+            cursor_created_at: None,
+            cursor_id: None,
            limit: 10,
        })
        .await
@@ -277,6 +294,112 @@ async fn approval_key_denies_without_executing_upstream() {
    assert!(logs.is_empty());
 }

+#[tokio::test]
+async fn approval_key_allowed_origins_are_enforced_at_approval_boundary() {
+    let registry = test_registry().await;
+    let upstream_base_url = spawn_upstream_server().await;
+    let operation = test_operation(&upstream_base_url, "crm_origin_guard");
+    registry
+        .create_operation(&test_workspace_id(), &operation, Some("alice"))
+        .await
+        .unwrap();
+    publish_agent_with_bindings(
+        &registry,
+        "sales-origin-guard",
+        vec![binding_for_operation(&operation)],
+    )
+    .await;
+    let approval = ApprovalRequest {
+        id: ApprovalRequestId::new("approval_origin_guard_01"),
+        workspace_id: test_workspace_id(),
+        agent_id: test_agent_id("sales-origin-guard"),
+        operation_id: operation.id.clone(),
+        operation_version: 1,
+        status: ApprovalRequestStatus::Pending,
+        risk_level: OperationApprovalRiskLevel::Dangerous,
+        request_id: None,
+        trace_id: None,
+        request_payload: json!({"email": "origin@example.com"}),
+        response_payload: None,
+        created_at: OffsetDateTime::now_utc(),
+        expires_at: OffsetDateTime::now_utc() + time::Duration::minutes(5),
+        decided_at: None,
+        decided_by_key_id: None,
+        decision_note: None,
+    };
+    registry
+        .create_approval_request(CreateApprovalRequest {
+            approval: &approval,
+        })
+        .await
+        .unwrap();
+
+    let approval_secret = format!("crk_appr_origin_{}", uuid::Uuid::now_v7().simple());
+    let approval_key = PlatformApiKey {
+        id: PlatformApiKeyId::new("pk_approval_origin_guard"),
+        workspace_id: test_workspace_id(),
+        agent_id: Some(test_agent_id("sales-origin-guard")),
+        key_kind: PlatformApiKeyKind::Approval,
+        name: "approval-origin-guard".to_owned(),
+        prefix: approval_secret.chars().take(16).collect(),
+        scopes: vec![PlatformApiKeyScope::ReadPending],
+        status: PlatformApiKeyStatus::Active,
+        created_at: OffsetDateTime::now_utc(),
+        last_used_at: None,
+        expires_at: None,
+        allowed_origins: vec!["https://allowed.example.test".to_owned()],
+    };
+    registry
+        .create_platform_api_key(CreatePlatformApiKeyRequest {
+            api_key: &approval_key,
+            secret_hash: &hash_access_secret(&approval_secret),
+        })
+        .await
+        .unwrap();
+
+    let base_url = spawn_mcp_server(build_test_app(
+        registry.clone(),
+        Duration::from_millis(0),
+        Some("https://crank.example.com".to_owned()),
+    ))
+    .await;
+    let client = reqwest::Client::new();
+    let approvals_url = format!(
+        "{}/approvals",
+        agent_mcp_url(&base_url, "sales-origin-guard")
+    );
+
+    let rejected = client
+        .get(&approvals_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_secret}"))
+        .header(header::ORIGIN, "https://evil.example.test")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(rejected.status(), reqwest::StatusCode::FORBIDDEN);
+    let rejected_body = rejected.text().await.unwrap();
+    assert!(!rejected_body.contains("allowed.example.test"));
+    assert!(!rejected_body.contains("evil.example.test"));
+    assert!(!rejected_body.contains(&approval_secret));
+
+    let server_side_client = client
+        .get(&approvals_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_secret}"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(server_side_client.status(), reqwest::StatusCode::OK);
+
+    let accepted = client
+        .get(&approvals_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_secret}"))
+        .header(header::ORIGIN, "https://allowed.example.test")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(accepted.status(), reqwest::StatusCode::OK);
+}
+
 #[tokio::test]
 async fn approval_key_expires_without_executing_upstream() {
    let registry = test_registry().await;
@@ -300,6 +423,8 @@ async fn approval_key_expires_without_executing_upstream() {
        operation_version: 1,
        status: ApprovalRequestStatus::Pending,
        risk_level: OperationApprovalRiskLevel::Dangerous,
+        request_id: None,
+        trace_id: None,
        request_payload: json!({"email": "expired@example.com"}),
        response_payload: None,
        created_at: OffsetDateTime::now_utc() - time::Duration::minutes(10),
@@ -349,11 +474,16 @@ async fn approval_key_expires_without_executing_upstream() {
        .list_invocation_logs(ListInvocationLogsQuery {
            workspace_id: &test_workspace_id(),
            level: None,
+            status: None,
+            outcome_group: None,
            search_text: None,
            source: Some(InvocationSource::AgentToolCall),
            operation_id: Some(&operation.id),
            agent_id: Some(&test_agent_id("sales-human-expired")),
            created_after: None,
+            created_before: None,
+            cursor_created_at: None,
+            cursor_id: None,
            limit: 10,
        })
        .await
@@ -361,116 +491,6 @@ async fn approval_key_expires_without_executing_upstream() {
    assert!(logs.is_empty());
 }

-#[tokio::test]
-async fn tool_call_with_approval_policy_creates_pending_request() {
-    let registry = test_registry().await;
-    let upstream_base_url = spawn_upstream_server().await;
-    let mut operation = test_operation(&upstream_base_url, "crm_requires_human_approval");
-    operation.execution_config.approval_policy = Some(OperationApprovalPolicy {
-        required: true,
-        mode: OperationApprovalMode::Custom,
-        risk_level: OperationApprovalRiskLevel::Dangerous,
-        ttl_seconds: 300,
-        show_payload_preview: true,
-        payload_preview_mode: OperationApprovalPayloadPreviewMode::MaskedJson,
-        elicitation_message: None,
-    });
-    registry
-        .create_operation(&test_workspace_id(), &operation, Some("alice"))
-        .await
-        .unwrap();
-    registry
-        .publish_operation(PublishRequest {
-            workspace_id: &test_workspace_id(),
-            operation_id: &operation.id,
-            version: 1,
-            published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
-            published_by: Some("alice"),
-        })
-        .await
-        .unwrap();
-    publish_agent_for_operation(&registry, &operation, "sales-gated").await;
-    let api_key = create_platform_api_key(
-        &registry,
-        "sales-gated",
-        "mcp-gated",
-        &[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
-    )
-    .await;
-    let approval_key =
-        create_approval_platform_api_key(&registry, "sales-gated", "approval-gated").await;
-
-    let base_url = spawn_mcp_server(build_test_app(
-        registry,
-        Duration::from_millis(0),
-        Some("https://crank.example.com".to_owned()),
-    ))
-    .await;
-    let client = reqwest::Client::new();
-    let mcp_url = agent_mcp_url(&base_url, "sales-gated");
-    let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
-
-    let tool_call = json!({
-        "jsonrpc": "2.0",
-        "id": 9,
-        "method": "tools/call",
-        "params": {
-            "name": "crm_requires_human_approval",
-            "arguments": {
-                "email": "ada@example.com"
-            }
-        }
-    });
-    let tool_result = post_jsonrpc(
-        &client,
-        &mcp_url,
-        &api_key,
-        Some(&initialized_session),
-        tool_call.clone(),
-    )
-    .await;
-
-    assert_eq!(
-        tool_result["result"]["structuredContent"]["status"],
-        "approval_required"
-    );
-    assert_eq!(tool_result["result"]["isError"], false);
-    let approval_id = tool_result["result"]["structuredContent"]["approval_id"]
-        .as_str()
-        .unwrap();
-    assert!(approval_id.starts_with("approval_"));
-
-    let repeated_tool_result = post_jsonrpc(
-        &client,
-        &mcp_url,
-        &api_key,
-        Some(&initialized_session),
-        tool_call,
-    )
-    .await;
-    assert_eq!(
-        repeated_tool_result["result"]["structuredContent"]["approval_id"], approval_id,
-        "deduplicated tools/call must return the persisted approval id",
-    );
-
-    let approvals_url = format!("{}/approvals", agent_mcp_url(&base_url, "sales-gated"));
-    let pending = client
-        .get(&approvals_url)
-        .header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
-        .send()
-        .await
-        .unwrap()
-        .json::<Value>()
-        .await
-        .unwrap();
-    assert_eq!(pending["items"].as_array().unwrap().len(), 1);
-    assert_eq!(pending["items"][0]["approval"]["id"], approval_id);
-    assert_eq!(
-        pending["items"][0]["approval"]["request_payload"]["email"],
-        "ada@example.com"
-    );
-}
-
 #[tokio::test]
 async fn approval_http_endpoints_enforce_request_rate_limit() {
    let registry = test_registry().await;
@@ -589,6 +609,8 @@ async fn recovery_does_not_repeat_interrupted_mutating_approval() {
        operation_version: operation.version,
        status: ApprovalRequestStatus::Pending,
        risk_level: OperationApprovalRiskLevel::Dangerous,
+        request_id: None,
+        trace_id: None,
        request_payload: json!({"email": "interrupted@example.com"}),
        response_payload: None,
        created_at: now - time::Duration::minutes(10),
@@ -609,9 +631,12 @@ async fn recovery_does_not_repeat_interrupted_mutating_approval() {
            workspace_id: &approval.workspace_id,
            agent_id: &approval.agent_id,
            approval_id: &approval.id,
+            operation_id: &approval.operation_id,
+            operation_version: approval.operation_version,
+            request_payload: &approval.request_payload,
            status: ApprovalRequestStatus::Approved,
            decided_at: now - time::Duration::minutes(10),
-            decided_by_key_id: &approval_key_id,
+            decided_by_key_id: Some(&approval_key_id),
            response_payload: Some(json!({"approve": "yes"})),
            decision_note: None,
        })
@@ -666,7 +691,7 @@ fn build_test_app_with_approval_recovery(registry: PostgresRegistry) -> Router {
        registry,
        Duration::from_millis(0),
        Some("https://crank.example.com".to_owned()),
-        SecretCrypto::new("test-master-key").unwrap(),
+        SecretCrypto::new("test-master-key-00000000000000000000000000000000").unwrap(),
        crank_runtime::community_with_outbound_policy(
            crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
        )
@@ -0,0 +1,151 @@
+use super::*;
+
+#[tokio::test]
+async fn tool_call_with_approval_policy_creates_pending_request() {
+    let registry = test_registry().await;
+    let upstream_base_url = spawn_upstream_server().await;
+    let mut operation = test_operation(&upstream_base_url, "crm_requires_human_approval");
+    operation.execution_config.approval_policy = Some(OperationApprovalPolicy {
+        required: true,
+        mode: OperationApprovalMode::Custom,
+        risk_level: OperationApprovalRiskLevel::Dangerous,
+        ttl_seconds: 300,
+        show_payload_preview: true,
+        payload_preview_mode: OperationApprovalPayloadPreviewMode::MaskedJson,
+        elicitation_message: None,
+    });
+    registry
+        .create_operation(&test_workspace_id(), &operation, Some("alice"))
+        .await
+        .unwrap();
+    registry
+        .publish_operation(PublishRequest {
+            workspace_id: &test_workspace_id(),
+            operation_id: &operation.id,
+            version: 1,
+            published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
+            published_by: Some("alice"),
+        })
+        .await
+        .unwrap();
+    publish_agent_for_operation(&registry, &operation, "sales-gated").await;
+    let api_key = create_platform_api_key(
+        &registry,
+        "sales-gated",
+        "mcp-gated",
+        &[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
+    )
+    .await;
+    let approval_key =
+        create_approval_platform_api_key(&registry, "sales-gated", "approval-gated").await;
+
+    let base_url = spawn_mcp_server(build_test_app(
+        registry.clone(),
+        Duration::from_millis(0),
+        Some("https://crank.example.com".to_owned()),
+    ))
+    .await;
+    let client = reqwest::Client::new();
+    let mcp_url = agent_mcp_url(&base_url, "sales-gated");
+    let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
+
+    let tool_call = json!({
+        "jsonrpc": "2.0",
+        "id": 9,
+        "method": "tools/call",
+        "params": {
+            "name": "crm_requires_human_approval",
+            "arguments": {
+                "email": "ada@example.com",
+                "api_key": "history-secret-canary"
+            }
+        }
+    });
+    let tool_result = post_jsonrpc(
+        &client,
+        &mcp_url,
+        &api_key,
+        Some(&initialized_session),
+        tool_call.clone(),
+    )
+    .await;
+
+    assert_eq!(
+        tool_result["result"]["structuredContent"]["status"],
+        "approval_required"
+    );
+    assert_eq!(tool_result["result"]["isError"], false);
+    let approval_id = tool_result["result"]["structuredContent"]["approval_id"]
+        .as_str()
+        .unwrap();
+    assert!(approval_id.starts_with("approval_"));
+
+    let repeated_tool_result = post_jsonrpc(
+        &client,
+        &mcp_url,
+        &api_key,
+        Some(&initialized_session),
+        tool_call,
+    )
+    .await;
+    assert_eq!(
+        repeated_tool_result["result"]["structuredContent"]["approval_id"], approval_id,
+        "deduplicated tools/call must return the persisted approval id",
+    );
+
+    let approvals_url = format!("{}/approvals", agent_mcp_url(&base_url, "sales-gated"));
+    let pending = client
+        .get(&approvals_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
+        .send()
+        .await
+        .unwrap()
+        .json::<Value>()
+        .await
+        .unwrap();
+    assert_eq!(pending["items"].as_array().unwrap().len(), 1);
+    assert_eq!(pending["items"][0]["approval"]["id"], approval_id);
+    assert_eq!(
+        pending["items"][0]["approval"]["request_payload"]["email"],
+        "ada@example.com"
+    );
+    let pending_preview =
+        serde_json::to_string(&pending["items"][0]["approval"]["request_payload"]).unwrap();
+    assert!(!pending_preview.contains("history-secret-canary"));
+    assert!(pending_preview.contains("[REDACTED]"));
+
+    let logs = registry
+        .list_invocation_logs(ListInvocationLogsQuery {
+            workspace_id: &test_workspace_id(),
+            level: None,
+            status: None,
+            outcome_group: None,
+            search_text: None,
+            source: Some(InvocationSource::AgentToolCall),
+            operation_id: Some(&operation.id),
+            agent_id: Some(&test_agent_id("sales-gated")),
+            created_after: None,
+            created_before: None,
+            cursor_created_at: None,
+            cursor_id: None,
+            limit: 10,
+        })
+        .await
+        .unwrap();
+    assert!(!logs.is_empty());
+    let history_preview = serde_json::to_string(
+        &logs
+            .iter()
+            .map(|record| {
+                json!({
+                    "request": record.log.request_preview,
+                    "response": record.log.response_preview,
+                })
+            })
+            .collect::<Vec<_>>(),
+    )
+    .unwrap();
+    assert!(!history_preview.contains("history-secret-canary"));
+    assert!(!history_preview.contains("ada@example.com"));
+    assert!(history_preview.contains("approval_required"));
+}
@@ -0,0 +1,137 @@
+use super::*;
+
+#[tokio::test]
+async fn revoked_approval_key_stops_list_approve_and_deny_without_restart() {
+    let registry = test_registry().await;
+    let upstream_base_url = spawn_upstream_server().await;
+    let operation = test_operation(&upstream_base_url, "crm_approval_revoked");
+    registry
+        .create_operation(&test_workspace_id(), &operation, Some("alice"))
+        .await
+        .unwrap();
+    publish_agent_with_bindings(
+        &registry,
+        "sales-approval-revoked",
+        vec![binding_for_operation(&operation)],
+    )
+    .await;
+    let approval = ApprovalRequest {
+        id: ApprovalRequestId::new("approval_mcp_revoked_01"),
+        workspace_id: test_workspace_id(),
+        agent_id: test_agent_id("sales-approval-revoked"),
+        operation_id: operation.id.clone(),
+        operation_version: 1,
+        status: ApprovalRequestStatus::Pending,
+        risk_level: OperationApprovalRiskLevel::Dangerous,
+        request_id: None,
+        trace_id: None,
+        request_payload: json!({"email": "revoked@example.com"}),
+        response_payload: None,
+        created_at: OffsetDateTime::now_utc(),
+        expires_at: OffsetDateTime::now_utc() + time::Duration::minutes(5),
+        decided_at: None,
+        decided_by_key_id: None,
+        decision_note: None,
+    };
+    registry
+        .create_approval_request(CreateApprovalRequest {
+            approval: &approval,
+        })
+        .await
+        .unwrap();
+
+    let approval_key = create_approval_platform_api_key(
+        &registry,
+        "sales-approval-revoked",
+        "approval-revoked-http",
+    )
+    .await;
+    let base_url = spawn_mcp_server(build_test_app(
+        registry.clone(),
+        Duration::from_millis(0),
+        Some("https://crank.example.com".to_owned()),
+    ))
+    .await;
+    let client = reqwest::Client::new();
+    let approvals_url = format!(
+        "{}/approvals",
+        agent_mcp_url(&base_url, "sales-approval-revoked")
+    );
+    let approve_url = format!(
+        "{}/approvals/{}/approve",
+        agent_mcp_url(&base_url, "sales-approval-revoked"),
+        approval.id
+    );
+    let deny_url = format!(
+        "{}/approvals/{}/deny",
+        agent_mcp_url(&base_url, "sales-approval-revoked"),
+        approval.id
+    );
+
+    let before_revoke = client
+        .get(&approvals_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(before_revoke.status(), reqwest::StatusCode::OK);
+
+    let approval_key_id = registry
+        .list_platform_api_keys_for_agent(
+            &test_workspace_id(),
+            &test_agent_id("sales-approval-revoked"),
+        )
+        .await
+        .unwrap()
+        .into_iter()
+        .find(|record| record.api_key.name == "approval-revoked-http")
+        .unwrap()
+        .api_key
+        .id;
+    registry
+        .revoke_platform_api_key_for_agent(
+            &test_workspace_id(),
+            &test_agent_id("sales-approval-revoked"),
+            &approval_key_id,
+            &OffsetDateTime::now_utc(),
+        )
+        .await
+        .unwrap();
+
+    let denied_list = client
+        .get(&approvals_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(denied_list.status(), reqwest::StatusCode::UNAUTHORIZED);
+
+    let denied_approve = client
+        .post(&approve_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
+        .json(&json!({ "approve": "yes" }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(denied_approve.status(), reqwest::StatusCode::UNAUTHORIZED);
+
+    let denied_deny = client
+        .post(&deny_url)
+        .header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
+        .json(&json!({ "approve": "no" }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(denied_deny.status(), reqwest::StatusCode::UNAUTHORIZED);
+
+    let current = registry
+        .get_approval_request_for_agent(
+            &test_workspace_id(),
+            &test_agent_id("sales-approval-revoked"),
+            &approval.id,
+        )
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(current.approval.status, ApprovalRequestStatus::Pending);
+}