feat: complete Epic 1 production foundation
This commit is contained in:
+2
-1
@@ -23,6 +23,7 @@ CRANK_CACHE_BACKEND=memory
|
|||||||
CRANK_CACHE_URL=
|
CRANK_CACHE_URL=
|
||||||
CRANK_OUTBOUND_ALLOWED_HOSTS=
|
CRANK_OUTBOUND_ALLOWED_HOSTS=
|
||||||
CRANK_OUTBOUND_DENIED_HOSTS=
|
CRANK_OUTBOUND_DENIED_HOSTS=
|
||||||
|
CRANK_OUTBOUND_MAX_REQUEST_BYTES=4194304
|
||||||
CRANK_OUTBOUND_MAX_RESPONSE_BYTES=4194304
|
CRANK_OUTBOUND_MAX_RESPONSE_BYTES=4194304
|
||||||
CRANK_ENVIRONMENT=development
|
CRANK_ENVIRONMENT=development
|
||||||
CRANK_LOG_LEVEL=
|
CRANK_LOG_LEVEL=
|
||||||
@@ -50,7 +51,7 @@ CRANK_INVOCATION_LOG_RETENTION_DAYS=30
|
|||||||
CRANK_SESSION_SECRET=
|
CRANK_SESSION_SECRET=
|
||||||
CRANK_PASSWORD_PEPPER=
|
CRANK_PASSWORD_PEPPER=
|
||||||
CRANK_SESSION_TTL_HOURS=24
|
CRANK_SESSION_TTL_HOURS=24
|
||||||
CRANK_TRUST_FORWARDED_HEADERS=false
|
CRANK_TRUSTED_PROXY_IPS=
|
||||||
CRANK_BOOTSTRAP_ADMIN_EMAIL=
|
CRANK_BOOTSTRAP_ADMIN_EMAIL=
|
||||||
CRANK_BOOTSTRAP_ADMIN_PASSWORD=
|
CRANK_BOOTSTRAP_ADMIN_PASSWORD=
|
||||||
CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME=Crank Owner
|
CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME=Crank Owner
|
||||||
|
|||||||
@@ -26,3 +26,7 @@ TASKS.md
|
|||||||
|
|
||||||
# BMAD workspace data and generated artifacts
|
# BMAD workspace data and generated artifacts
|
||||||
**/_bmad*/
|
**/_bmad*/
|
||||||
|
.bmad-loop/runs/
|
||||||
|
.bmad-loop/cache/
|
||||||
|
.bmad-loop/policy.toml
|
||||||
|
_bmad/render/
|
||||||
|
|||||||
+328
@@ -0,0 +1,328 @@
|
|||||||
|
{
|
||||||
|
"db_name": "PostgreSQL",
|
||||||
|
"query": "select\n o.id,\n o.workspace_id,\n ov.name,\n ov.display_name,\n ov.category,\n ov.protocol,\n ov.security_level,\n ov.created_at as \"operation_created_at!: time::OffsetDateTime\",\n ov.created_at as \"operation_updated_at!: time::OffsetDateTime\",\n ov.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from published_operations po\n join operation_versions ov\n on ov.operation_id = po.operation_id and ov.version = po.version\n join operations o on o.id = po.operation_id\n where po.operation_id = $1",
|
||||||
|
"describe": {
|
||||||
|
"columns": [
|
||||||
|
{
|
||||||
|
"ordinal": 0,
|
||||||
|
"name": "id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 1,
|
||||||
|
"name": "workspace_id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 2,
|
||||||
|
"name": "name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 3,
|
||||||
|
"name": "display_name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 4,
|
||||||
|
"name": "category",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "category"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 5,
|
||||||
|
"name": "protocol",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "protocol"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 6,
|
||||||
|
"name": "security_level",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "security_level"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 7,
|
||||||
|
"name": "operation_created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 8,
|
||||||
|
"name": "operation_updated_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 9,
|
||||||
|
"name": "operation_published_at: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 10,
|
||||||
|
"name": "version",
|
||||||
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 11,
|
||||||
|
"name": "status",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 12,
|
||||||
|
"name": "target_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "target_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 13,
|
||||||
|
"name": "input_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 14,
|
||||||
|
"name": "output_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 15,
|
||||||
|
"name": "input_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 16,
|
||||||
|
"name": "output_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 17,
|
||||||
|
"name": "execution_config_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "execution_config_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 18,
|
||||||
|
"name": "tool_description_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "tool_description_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 19,
|
||||||
|
"name": "samples_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "samples_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 20,
|
||||||
|
"name": "generated_draft_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "generated_draft_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 21,
|
||||||
|
"name": "config_export_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "config_export_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 22,
|
||||||
|
"name": "wizard_state_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "wizard_state_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 23,
|
||||||
|
"name": "change_note",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "change_note"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 24,
|
||||||
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 25,
|
||||||
|
"name": "created_by",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_by"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"parameters": {
|
||||||
|
"Left": [
|
||||||
|
"Text"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"nullable": [
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
true
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"hash": "09a122a463d94b08719b16c221d266b9b2061da3eb19f0b16e1069ca30c4e60b"
|
||||||
|
}
|
||||||
+98
-14
@@ -6,72 +6,156 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "name",
|
"name": "name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "category",
|
"name": "category",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "category"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "protocol",
|
"name": "protocol",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "protocol"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "security_level",
|
"name": "security_level",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "security_level"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "target_json",
|
"name": "target_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "target_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 8,
|
"ordinal": 8,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 9,
|
"ordinal": 9,
|
||||||
"name": "current_draft_version",
|
"name": "current_draft_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "current_draft_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 10,
|
"ordinal": 10,
|
||||||
"name": "latest_published_version",
|
"name": "latest_published_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "latest_published_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 11,
|
"ordinal": 11,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 12,
|
"ordinal": 12,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 13,
|
"ordinal": 13,
|
||||||
"name": "published_at: time::OffsetDateTime",
|
"name": "published_at: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+330
@@ -0,0 +1,330 @@
|
|||||||
|
{
|
||||||
|
"db_name": "PostgreSQL",
|
||||||
|
"query": "select\n o.id,\n o.workspace_id,\n ov.name,\n ov.display_name,\n ov.category,\n ov.protocol,\n ov.security_level,\n ov.created_at as \"operation_created_at!: time::OffsetDateTime\",\n ov.created_at as \"operation_updated_at!: time::OffsetDateTime\",\n ov.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from operation_versions ov\n join operations o on o.id = ov.operation_id\n where o.workspace_id = $1 and ov.operation_id = $2 and ov.version = $3",
|
||||||
|
"describe": {
|
||||||
|
"columns": [
|
||||||
|
{
|
||||||
|
"ordinal": 0,
|
||||||
|
"name": "id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 1,
|
||||||
|
"name": "workspace_id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 2,
|
||||||
|
"name": "name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 3,
|
||||||
|
"name": "display_name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 4,
|
||||||
|
"name": "category",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "category"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 5,
|
||||||
|
"name": "protocol",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "protocol"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 6,
|
||||||
|
"name": "security_level",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "security_level"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 7,
|
||||||
|
"name": "operation_created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 8,
|
||||||
|
"name": "operation_updated_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 9,
|
||||||
|
"name": "operation_published_at: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 10,
|
||||||
|
"name": "version",
|
||||||
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 11,
|
||||||
|
"name": "status",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 12,
|
||||||
|
"name": "target_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "target_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 13,
|
||||||
|
"name": "input_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 14,
|
||||||
|
"name": "output_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 15,
|
||||||
|
"name": "input_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 16,
|
||||||
|
"name": "output_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 17,
|
||||||
|
"name": "execution_config_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "execution_config_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 18,
|
||||||
|
"name": "tool_description_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "tool_description_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 19,
|
||||||
|
"name": "samples_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "samples_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 20,
|
||||||
|
"name": "generated_draft_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "generated_draft_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 21,
|
||||||
|
"name": "config_export_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "config_export_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 22,
|
||||||
|
"name": "wizard_state_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "wizard_state_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 23,
|
||||||
|
"name": "change_note",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "change_note"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 24,
|
||||||
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 25,
|
||||||
|
"name": "created_by",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_by"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"parameters": {
|
||||||
|
"Left": [
|
||||||
|
"Text",
|
||||||
|
"Text",
|
||||||
|
"Int4"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"nullable": [
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
true
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"hash": "0c0a4e5d7b11cd7df7aaf34fd3b7c294da65804186907e015da9420d594fefda"
|
||||||
|
}
|
||||||
-173
@@ -1,173 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n o.id,\n o.workspace_id,\n o.name,\n o.display_name,\n o.category,\n o.protocol,\n o.security_level,\n o.created_at as \"operation_created_at!: time::OffsetDateTime\",\n o.updated_at as \"operation_updated_at!: time::OffsetDateTime\",\n o.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from operation_versions ov\n join operations o on o.id = ov.operation_id\n where o.workspace_id = $1 and ov.operation_id = $2\n order by ov.version asc",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "workspace_id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "category",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "protocol",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 6,
|
|
||||||
"name": "security_level",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 7,
|
|
||||||
"name": "operation_created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 8,
|
|
||||||
"name": "operation_updated_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 9,
|
|
||||||
"name": "operation_published_at: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 10,
|
|
||||||
"name": "version",
|
|
||||||
"type_info": "Int4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 11,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 12,
|
|
||||||
"name": "target_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 13,
|
|
||||||
"name": "input_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 14,
|
|
||||||
"name": "output_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 15,
|
|
||||||
"name": "input_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 16,
|
|
||||||
"name": "output_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 17,
|
|
||||||
"name": "execution_config_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 18,
|
|
||||||
"name": "tool_description_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 19,
|
|
||||||
"name": "samples_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 20,
|
|
||||||
"name": "generated_draft_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 21,
|
|
||||||
"name": "config_export_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 22,
|
|
||||||
"name": "wizard_state_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 23,
|
|
||||||
"name": "change_note",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 24,
|
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 25,
|
|
||||||
"name": "created_by",
|
|
||||||
"type_info": "Text"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text",
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
true
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "0fb9fabe7417aa52f0977efa0ad5b3f1975517a60f63bb09028b3acb3506d1eb"
|
|
||||||
}
|
|
||||||
+42
-6
@@ -6,32 +6,68 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "agent_id",
|
"name": "agent_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_versions",
|
||||||
|
"name": "agent_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "version",
|
"name": "version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_versions",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_versions",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "instructions_json",
|
"name": "instructions_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_versions",
|
||||||
|
"name": "instructions_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "tool_selection_policy_json",
|
"name": "tool_selection_policy_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_versions",
|
||||||
|
"name": "tool_selection_policy_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+56
-8
@@ -6,42 +6,90 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "operation_id",
|
"name": "operation_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "operation_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "version",
|
"name": "version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "sample_kind",
|
"name": "sample_kind",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "sample_kind"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "storage_ref",
|
"name": "storage_ref",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "storage_ref"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "content_type",
|
"name": "content_type",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "content_type"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "file_name",
|
"name": "file_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "file_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_samples",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+77
-11
@@ -6,57 +6,123 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "slug",
|
"name": "slug",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "slug"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "description",
|
"name": "description",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "description"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "current_draft_version",
|
"name": "current_draft_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "current_draft_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "latest_published_version",
|
"name": "latest_published_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "latest_published_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 8,
|
"ordinal": 8,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 9,
|
"ordinal": 9,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 10,
|
"ordinal": 10,
|
||||||
"name": "published_at: time::OffsetDateTime",
|
"name": "published_at: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
-174
@@ -1,174 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n o.id,\n o.workspace_id,\n o.name,\n o.display_name,\n o.category,\n o.protocol,\n o.security_level,\n o.created_at as \"operation_created_at!: time::OffsetDateTime\",\n o.updated_at as \"operation_updated_at!: time::OffsetDateTime\",\n o.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from operation_versions ov\n join operations o on o.id = ov.operation_id\n where o.workspace_id = $1 and ov.operation_id = $2 and ov.version = $3",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "workspace_id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "category",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "protocol",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 6,
|
|
||||||
"name": "security_level",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 7,
|
|
||||||
"name": "operation_created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 8,
|
|
||||||
"name": "operation_updated_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 9,
|
|
||||||
"name": "operation_published_at: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 10,
|
|
||||||
"name": "version",
|
|
||||||
"type_info": "Int4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 11,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 12,
|
|
||||||
"name": "target_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 13,
|
|
||||||
"name": "input_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 14,
|
|
||||||
"name": "output_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 15,
|
|
||||||
"name": "input_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 16,
|
|
||||||
"name": "output_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 17,
|
|
||||||
"name": "execution_config_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 18,
|
|
||||||
"name": "tool_description_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 19,
|
|
||||||
"name": "samples_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 20,
|
|
||||||
"name": "generated_draft_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 21,
|
|
||||||
"name": "config_export_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 22,
|
|
||||||
"name": "wizard_state_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 23,
|
|
||||||
"name": "change_note",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 24,
|
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 25,
|
|
||||||
"name": "created_by",
|
|
||||||
"type_info": "Text"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text",
|
|
||||||
"Text",
|
|
||||||
"Int4"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
true
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "21011878e679a08b38c588bae6e24f770221be24a289ba6d83ed32b6b051ed2b"
|
|
||||||
}
|
|
||||||
+35
-5
@@ -6,27 +6,57 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "email",
|
"name": "email",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "email"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "created_at!: OffsetDateTime",
|
"name": "created_at!: OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+2
-1
@@ -6,7 +6,8 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "allowed!",
|
"name": "allowed!",
|
||||||
"type_info": "Bool"
|
"type_info": "Bool",
|
||||||
|
"origin": "Expression"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+2
-1
@@ -6,7 +6,8 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "present!",
|
"name": "present!",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": "Expression"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
-52
@@ -1,52 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n id,\n email,\n display_name,\n password_hash as \"password_hash!\",\n status,\n created_at as \"created_at!: OffsetDateTime\"\n from users\n where email = $1\n limit 1",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "email",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "password_hash!",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "created_at!: OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
false
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "38911a904c6d284f5fb80cf2ae9f569de7c0ffd3b8ca73e6c01f0842ace4ad25"
|
|
||||||
}
|
|
||||||
-52
@@ -1,52 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n id,\n email,\n display_name,\n password_hash as \"password_hash!\",\n status,\n created_at as \"created_at!: OffsetDateTime\"\n from users\n where id = $1\n limit 1",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "email",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "password_hash!",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "created_at!: OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
false
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "3d647bffe6eaf3b95be589ae2fe006b4aec8f55fa070f9f2ff3859dc7cb96d06"
|
|
||||||
}
|
|
||||||
-25
@@ -1,25 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "insert into users (\n id,\n email,\n display_name,\n password_hash,\n status,\n created_at\n ) values (\n $1, $2, $3, $4, 'active', now()\n )\n on conflict (email) do update\n set display_name = excluded.display_name,\n password_hash = excluded.password_hash,\n status = 'active'\n returning id",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text",
|
|
||||||
"Text",
|
|
||||||
"Text",
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "3df72b8a0ac4a76b15909fc78268a1c87d1cd184973bf1cecc0c725691432c08"
|
|
||||||
}
|
|
||||||
+329
@@ -0,0 +1,329 @@
|
|||||||
|
{
|
||||||
|
"db_name": "PostgreSQL",
|
||||||
|
"query": "select\n o.id,\n o.workspace_id,\n ov.name,\n ov.display_name,\n ov.category,\n ov.protocol,\n ov.security_level,\n ov.created_at as \"operation_created_at!: time::OffsetDateTime\",\n ov.created_at as \"operation_updated_at!: time::OffsetDateTime\",\n ov.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from operation_versions ov\n join operations o on o.id = ov.operation_id\n where o.workspace_id = $1 and ov.operation_id = $2\n order by ov.version asc",
|
||||||
|
"describe": {
|
||||||
|
"columns": [
|
||||||
|
{
|
||||||
|
"ordinal": 0,
|
||||||
|
"name": "id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 1,
|
||||||
|
"name": "workspace_id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 2,
|
||||||
|
"name": "name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 3,
|
||||||
|
"name": "display_name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 4,
|
||||||
|
"name": "category",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "category"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 5,
|
||||||
|
"name": "protocol",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "protocol"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 6,
|
||||||
|
"name": "security_level",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "security_level"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 7,
|
||||||
|
"name": "operation_created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 8,
|
||||||
|
"name": "operation_updated_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 9,
|
||||||
|
"name": "operation_published_at: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 10,
|
||||||
|
"name": "version",
|
||||||
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 11,
|
||||||
|
"name": "status",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 12,
|
||||||
|
"name": "target_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "target_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 13,
|
||||||
|
"name": "input_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 14,
|
||||||
|
"name": "output_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 15,
|
||||||
|
"name": "input_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 16,
|
||||||
|
"name": "output_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 17,
|
||||||
|
"name": "execution_config_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "execution_config_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 18,
|
||||||
|
"name": "tool_description_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "tool_description_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 19,
|
||||||
|
"name": "samples_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "samples_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 20,
|
||||||
|
"name": "generated_draft_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "generated_draft_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 21,
|
||||||
|
"name": "config_export_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "config_export_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 22,
|
||||||
|
"name": "wizard_state_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "wizard_state_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 23,
|
||||||
|
"name": "change_note",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "change_note"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 24,
|
||||||
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 25,
|
||||||
|
"name": "created_by",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_by"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"parameters": {
|
||||||
|
"Left": [
|
||||||
|
"Text",
|
||||||
|
"Text"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"nullable": [
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
true
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"hash": "3e015fdc582e6cbbcc0e8d8863873f4e3113fd89f806fb4e0592c0200283f599"
|
||||||
|
}
|
||||||
+396
@@ -0,0 +1,396 @@
|
|||||||
|
{
|
||||||
|
"db_name": "PostgreSQL",
|
||||||
|
"query": "select\n w.id as workspace_id,\n w.slug as workspace_slug,\n a.id as agent_id,\n a.slug as agent_slug,\n b.tool_name,\n b.tool_title,\n coalesce(b.tool_description_override, ov.tool_description_json->>'description') as \"tool_description!\",\n o.id,\n ov.name,\n ov.display_name,\n ov.category,\n ov.protocol,\n ov.security_level,\n ov.created_at as \"operation_created_at!: time::OffsetDateTime\",\n ov.created_at as \"operation_updated_at!: time::OffsetDateTime\",\n ov.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from workspaces w\n join agents a on a.workspace_id = w.id\n join published_agents pa on pa.agent_id = a.id\n join agent_operation_bindings b on b.agent_id = a.id and b.agent_version = pa.version\n join operation_versions ov on ov.operation_id = b.operation_id and ov.version = b.operation_version\n join operations o on o.id = ov.operation_id and o.workspace_id = w.id\n where w.slug = $1 and a.slug = $2 and b.enabled = true\n order by b.tool_name asc",
|
||||||
|
"describe": {
|
||||||
|
"columns": [
|
||||||
|
{
|
||||||
|
"ordinal": 0,
|
||||||
|
"name": "workspace_id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 1,
|
||||||
|
"name": "workspace_slug",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "slug"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 2,
|
||||||
|
"name": "agent_id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 3,
|
||||||
|
"name": "agent_slug",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "slug"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 4,
|
||||||
|
"name": "tool_name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_operation_bindings",
|
||||||
|
"name": "tool_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 5,
|
||||||
|
"name": "tool_title",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_operation_bindings",
|
||||||
|
"name": "tool_title"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 6,
|
||||||
|
"name": "tool_description!",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": "Expression"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 7,
|
||||||
|
"name": "id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 8,
|
||||||
|
"name": "name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 9,
|
||||||
|
"name": "display_name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 10,
|
||||||
|
"name": "category",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "category"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 11,
|
||||||
|
"name": "protocol",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "protocol"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 12,
|
||||||
|
"name": "security_level",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "security_level"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 13,
|
||||||
|
"name": "operation_created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 14,
|
||||||
|
"name": "operation_updated_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 15,
|
||||||
|
"name": "operation_published_at: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 16,
|
||||||
|
"name": "version",
|
||||||
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 17,
|
||||||
|
"name": "status",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 18,
|
||||||
|
"name": "target_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "target_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 19,
|
||||||
|
"name": "input_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 20,
|
||||||
|
"name": "output_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 21,
|
||||||
|
"name": "input_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 22,
|
||||||
|
"name": "output_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 23,
|
||||||
|
"name": "execution_config_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "execution_config_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 24,
|
||||||
|
"name": "tool_description_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "tool_description_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 25,
|
||||||
|
"name": "samples_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "samples_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 26,
|
||||||
|
"name": "generated_draft_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "generated_draft_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 27,
|
||||||
|
"name": "config_export_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "config_export_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 28,
|
||||||
|
"name": "wizard_state_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "wizard_state_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 29,
|
||||||
|
"name": "change_note",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "change_note"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 30,
|
||||||
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 31,
|
||||||
|
"name": "created_by",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_by"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"parameters": {
|
||||||
|
"Left": [
|
||||||
|
"Text",
|
||||||
|
"Text"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"nullable": [
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
null,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
true
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"hash": "4699ba47e6489b840ada38a7491f071f605dabd061992cd0a567241a8de1fa0c"
|
||||||
|
}
|
||||||
+49
-7
@@ -6,37 +6,79 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "slug",
|
"name": "slug",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "slug"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "settings_json",
|
"name": "settings_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "settings_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+56
-8
@@ -6,42 +6,90 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "operation_id",
|
"name": "operation_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "operation_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "version",
|
"name": "version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "descriptor_kind",
|
"name": "descriptor_kind",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "descriptor_kind"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "storage_ref",
|
"name": "storage_ref",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "storage_ref"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "source_name",
|
"name": "source_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "source_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "package_index_json",
|
"name": "package_index_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "package_index_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "descriptors",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+2
-1
@@ -6,7 +6,8 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "present!",
|
"name": "present!",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": "Expression"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
-64
@@ -1,64 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n w.id,\n w.slug,\n w.display_name,\n w.status,\n w.settings_json,\n w.created_at as \"created_at!: time::OffsetDateTime\",\n w.updated_at as \"updated_at!: time::OffsetDateTime\",\n m.role\n from memberships m\n join workspaces w on w.id = m.workspace_id\n where m.user_id = $1\n order by w.slug asc",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "slug",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "settings_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 6,
|
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 7,
|
|
||||||
"name": "role",
|
|
||||||
"type_info": "Text"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "92bd2268efce8ba515b1d502287dea62bdfae0ba66100589ead3f986244b4cbb"
|
|
||||||
}
|
|
||||||
-172
@@ -1,172 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n o.id,\n o.workspace_id,\n o.name,\n o.display_name,\n o.category,\n o.protocol,\n o.security_level,\n o.created_at as \"operation_created_at!: time::OffsetDateTime\",\n o.updated_at as \"operation_updated_at!: time::OffsetDateTime\",\n o.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from published_operations po\n join operation_versions ov\n on ov.operation_id = po.operation_id and ov.version = po.version\n join operations o on o.id = po.operation_id\n where po.operation_id = $1",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "workspace_id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "category",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "protocol",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 6,
|
|
||||||
"name": "security_level",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 7,
|
|
||||||
"name": "operation_created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 8,
|
|
||||||
"name": "operation_updated_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 9,
|
|
||||||
"name": "operation_published_at: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 10,
|
|
||||||
"name": "version",
|
|
||||||
"type_info": "Int4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 11,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 12,
|
|
||||||
"name": "target_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 13,
|
|
||||||
"name": "input_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 14,
|
|
||||||
"name": "output_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 15,
|
|
||||||
"name": "input_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 16,
|
|
||||||
"name": "output_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 17,
|
|
||||||
"name": "execution_config_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 18,
|
|
||||||
"name": "tool_description_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 19,
|
|
||||||
"name": "samples_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 20,
|
|
||||||
"name": "generated_draft_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 21,
|
|
||||||
"name": "config_export_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 22,
|
|
||||||
"name": "wizard_state_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 23,
|
|
||||||
"name": "change_note",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 24,
|
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 25,
|
|
||||||
"name": "created_by",
|
|
||||||
"type_info": "Text"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
true
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "94c7e7cb5068c56f6caed09c71323f5efe2beba283e317af1157e7b262cf65ce"
|
|
||||||
}
|
|
||||||
+77
-11
@@ -6,57 +6,123 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "slug",
|
"name": "slug",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "slug"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "description",
|
"name": "description",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "description"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "current_draft_version",
|
"name": "current_draft_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "current_draft_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "latest_published_version",
|
"name": "latest_published_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "latest_published_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 8,
|
"ordinal": 8,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 9,
|
"ordinal": 9,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 10,
|
"ordinal": 10,
|
||||||
"name": "published_at: time::OffsetDateTime",
|
"name": "published_at: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+326
@@ -0,0 +1,326 @@
|
|||||||
|
{
|
||||||
|
"db_name": "PostgreSQL",
|
||||||
|
"query": "select\n o.id,\n o.workspace_id,\n ov.name,\n ov.display_name,\n ov.category,\n ov.protocol,\n ov.security_level,\n ov.created_at as \"operation_created_at!: time::OffsetDateTime\",\n ov.created_at as \"operation_updated_at!: time::OffsetDateTime\",\n ov.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from published_operations po\n join operation_versions ov\n on ov.operation_id = po.operation_id and ov.version = po.version\n join operations o on o.id = po.operation_id\n order by o.name asc",
|
||||||
|
"describe": {
|
||||||
|
"columns": [
|
||||||
|
{
|
||||||
|
"ordinal": 0,
|
||||||
|
"name": "id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 1,
|
||||||
|
"name": "workspace_id",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 2,
|
||||||
|
"name": "name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 3,
|
||||||
|
"name": "display_name",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 4,
|
||||||
|
"name": "category",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "category"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 5,
|
||||||
|
"name": "protocol",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "protocol"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 6,
|
||||||
|
"name": "security_level",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "security_level"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 7,
|
||||||
|
"name": "operation_created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 8,
|
||||||
|
"name": "operation_updated_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 9,
|
||||||
|
"name": "operation_published_at: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 10,
|
||||||
|
"name": "version",
|
||||||
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 11,
|
||||||
|
"name": "status",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 12,
|
||||||
|
"name": "target_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "target_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 13,
|
||||||
|
"name": "input_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 14,
|
||||||
|
"name": "output_schema_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_schema_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 15,
|
||||||
|
"name": "input_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "input_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 16,
|
||||||
|
"name": "output_mapping_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "output_mapping_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 17,
|
||||||
|
"name": "execution_config_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "execution_config_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 18,
|
||||||
|
"name": "tool_description_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "tool_description_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 19,
|
||||||
|
"name": "samples_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "samples_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 20,
|
||||||
|
"name": "generated_draft_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "generated_draft_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 21,
|
||||||
|
"name": "config_export_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "config_export_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 22,
|
||||||
|
"name": "wizard_state_json",
|
||||||
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "wizard_state_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 23,
|
||||||
|
"name": "change_note",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "change_note"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 24,
|
||||||
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"ordinal": 25,
|
||||||
|
"name": "created_by",
|
||||||
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "created_by"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"parameters": {
|
||||||
|
"Left": []
|
||||||
|
},
|
||||||
|
"nullable": [
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
false,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
true,
|
||||||
|
false,
|
||||||
|
true
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"hash": "b531368c52ef70664dfe75fe801e52e70fc74af8e782989cf4aea3f1170d33e5"
|
||||||
|
}
|
||||||
+49
-7
@@ -6,37 +6,79 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "name",
|
"name": "name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "kind",
|
"name": "kind",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "kind"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "config_json",
|
"name": "config_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "config_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "created_at!: OffsetDateTime",
|
"name": "created_at!: OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "updated_at!: OffsetDateTime",
|
"name": "updated_at!: OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
-64
@@ -1,64 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n id,\n protocol_version,\n initialized,\n workspace_slug,\n agent_slug,\n created_at as \"created_at!: OffsetDateTime\",\n updated_at as \"updated_at!: OffsetDateTime\",\n expires_at as \"expires_at: OffsetDateTime\"\n from mcp_transport_sessions\n where id = $1",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "protocol_version",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "initialized",
|
|
||||||
"type_info": "Bool"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "workspace_slug",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "agent_slug",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "created_at!: OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 6,
|
|
||||||
"name": "updated_at!: OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 7,
|
|
||||||
"name": "expires_at: OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "bdae00d03a55ba3b6d121578b081e970ff08427f9a3dd396b649996a9131260c"
|
|
||||||
}
|
|
||||||
+56
-8
@@ -6,42 +6,90 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "memberships",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "user_id",
|
"name": "user_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "memberships",
|
||||||
|
"name": "user_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "role",
|
"name": "role",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "memberships",
|
||||||
|
"name": "role"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "memberships",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "email",
|
"name": "email",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "email"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "user_created_at!: time::OffsetDateTime",
|
"name": "user_created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
-209
@@ -1,209 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n w.id as workspace_id,\n w.slug as workspace_slug,\n a.id as agent_id,\n a.slug as agent_slug,\n b.tool_name,\n b.tool_title,\n coalesce(b.tool_description_override, ov.tool_description_json->>'description') as \"tool_description!\",\n o.id,\n o.name,\n o.display_name,\n o.category,\n o.protocol,\n o.security_level,\n o.created_at as \"operation_created_at!: time::OffsetDateTime\",\n o.updated_at as \"operation_updated_at!: time::OffsetDateTime\",\n o.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from workspaces w\n join agents a on a.workspace_id = w.id\n join published_agents pa on pa.agent_id = a.id\n join agent_operation_bindings b on b.agent_id = a.id and b.agent_version = pa.version\n join operation_versions ov on ov.operation_id = b.operation_id and ov.version = b.operation_version\n join operations o on o.id = ov.operation_id and o.workspace_id = w.id\n where w.slug = $1 and a.slug = $2 and b.enabled = true\n order by b.tool_name asc",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "workspace_id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "workspace_slug",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "agent_id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "agent_slug",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "tool_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "tool_title",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 6,
|
|
||||||
"name": "tool_description!",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 7,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 8,
|
|
||||||
"name": "name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 9,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 10,
|
|
||||||
"name": "category",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 11,
|
|
||||||
"name": "protocol",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 12,
|
|
||||||
"name": "security_level",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 13,
|
|
||||||
"name": "operation_created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 14,
|
|
||||||
"name": "operation_updated_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 15,
|
|
||||||
"name": "operation_published_at: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 16,
|
|
||||||
"name": "version",
|
|
||||||
"type_info": "Int4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 17,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 18,
|
|
||||||
"name": "target_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 19,
|
|
||||||
"name": "input_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 20,
|
|
||||||
"name": "output_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 21,
|
|
||||||
"name": "input_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 22,
|
|
||||||
"name": "output_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 23,
|
|
||||||
"name": "execution_config_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 24,
|
|
||||||
"name": "tool_description_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 25,
|
|
||||||
"name": "samples_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 26,
|
|
||||||
"name": "generated_draft_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 27,
|
|
||||||
"name": "config_export_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 28,
|
|
||||||
"name": "wizard_state_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 29,
|
|
||||||
"name": "change_note",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 30,
|
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 31,
|
|
||||||
"name": "created_by",
|
|
||||||
"type_info": "Text"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": [
|
|
||||||
"Text",
|
|
||||||
"Text"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
null,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
true
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "c570f37d6cbc556f763f8a05d3b225b2ba5e5694c46c84deda01f99751eec3ec"
|
|
||||||
}
|
|
||||||
+63
-9
@@ -6,47 +6,101 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "name",
|
"name": "name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "kind",
|
"name": "kind",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "kind"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "current_version",
|
"name": "current_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "current_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 8,
|
"ordinal": 8,
|
||||||
"name": "last_used_at: time::OffsetDateTime",
|
"name": "last_used_at: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "last_used_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+49
-7
@@ -6,37 +6,79 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "slug",
|
"name": "slug",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "slug"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "settings_json",
|
"name": "settings_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "settings_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "workspaces",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+63
-9
@@ -6,47 +6,101 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "name",
|
"name": "name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "kind",
|
"name": "kind",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "kind"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "current_version",
|
"name": "current_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "current_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 8,
|
"ordinal": 8,
|
||||||
"name": "last_used_at: time::OffsetDateTime",
|
"name": "last_used_at: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secrets",
|
||||||
|
"name": "last_used_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+56
-8
@@ -6,42 +6,90 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "email",
|
"name": "email",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "email"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "role",
|
"name": "role",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "role"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "token_hash",
|
"name": "token_hash",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "token_hash"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "expires_at!: time::OffsetDateTime",
|
"name": "expires_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "expires_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "invitation_tokens",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+98
-14
@@ -6,72 +6,156 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "name",
|
"name": "name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "category",
|
"name": "category",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "category"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "protocol",
|
"name": "protocol",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "protocol"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "security_level",
|
"name": "security_level",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "security_level"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 7,
|
"ordinal": 7,
|
||||||
"name": "target_json",
|
"name": "target_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operation_versions",
|
||||||
|
"name": "target_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 8,
|
"ordinal": 8,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 9,
|
"ordinal": 9,
|
||||||
"name": "current_draft_version",
|
"name": "current_draft_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "current_draft_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 10,
|
"ordinal": 10,
|
||||||
"name": "latest_published_version",
|
"name": "latest_published_version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "latest_published_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 11,
|
"ordinal": 11,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 12,
|
"ordinal": 12,
|
||||||
"name": "updated_at!: time::OffsetDateTime",
|
"name": "updated_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 13,
|
"ordinal": 13,
|
||||||
"name": "published_at: time::OffsetDateTime",
|
"name": "published_at: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "operations",
|
||||||
|
"name": "published_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+49
-7
@@ -6,37 +6,79 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "user_sessions",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "user_id",
|
"name": "user_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "user_sessions",
|
||||||
|
"name": "user_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "current_workspace_id",
|
"name": "current_workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "user_sessions",
|
||||||
|
"name": "current_workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "email",
|
"name": "email",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "email"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "status",
|
"name": "status",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "status"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "created_at!: OffsetDateTime",
|
"name": "created_at!: OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "users",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+49
-7
@@ -6,37 +6,79 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "id",
|
"name": "id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "workspace_id",
|
"name": "workspace_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "workspace_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "name",
|
"name": "name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "name"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "kind",
|
"name": "kind",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "kind"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "config_json",
|
"name": "config_json",
|
||||||
"type_info": "Jsonb"
|
"type_info": "Jsonb",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "config_json"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "created_at!: OffsetDateTime",
|
"name": "created_at!: OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 6,
|
"ordinal": 6,
|
||||||
"name": "updated_at!: OffsetDateTime",
|
"name": "updated_at!: OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "auth_profiles",
|
||||||
|
"name": "updated_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+42
-6
@@ -6,32 +6,68 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "secret_id",
|
"name": "secret_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secret_versions",
|
||||||
|
"name": "secret_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "version",
|
"name": "version",
|
||||||
"type_info": "Int4"
|
"type_info": "Int4",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secret_versions",
|
||||||
|
"name": "version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "ciphertext",
|
"name": "ciphertext",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secret_versions",
|
||||||
|
"name": "ciphertext"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "key_version",
|
"name": "key_version",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secret_versions",
|
||||||
|
"name": "key_version"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 4,
|
"ordinal": 4,
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
"name": "created_at!: time::OffsetDateTime",
|
||||||
"type_info": "Timestamptz"
|
"type_info": "Timestamptz",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secret_versions",
|
||||||
|
"name": "created_at"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 5,
|
"ordinal": 5,
|
||||||
"name": "created_by",
|
"name": "created_by",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "secret_versions",
|
||||||
|
"name": "created_by"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
+28
-4
@@ -6,22 +6,46 @@
|
|||||||
{
|
{
|
||||||
"ordinal": 0,
|
"ordinal": 0,
|
||||||
"name": "operation_id",
|
"name": "operation_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agent_operation_bindings",
|
||||||
|
"name": "operation_id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 1,
|
"ordinal": 1,
|
||||||
"name": "agent_id",
|
"name": "agent_id",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "id"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 2,
|
"ordinal": 2,
|
||||||
"name": "agent_slug",
|
"name": "agent_slug",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "slug"
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"ordinal": 3,
|
"ordinal": 3,
|
||||||
"name": "display_name",
|
"name": "display_name",
|
||||||
"type_info": "Text"
|
"type_info": "Text",
|
||||||
|
"origin": {
|
||||||
|
"Table": {
|
||||||
|
"table": "agents",
|
||||||
|
"name": "display_name"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"parameters": {
|
"parameters": {
|
||||||
|
|||||||
-170
@@ -1,170 +0,0 @@
|
|||||||
{
|
|
||||||
"db_name": "PostgreSQL",
|
|
||||||
"query": "select\n o.id,\n o.workspace_id,\n o.name,\n o.display_name,\n o.category,\n o.protocol,\n o.security_level,\n o.created_at as \"operation_created_at!: time::OffsetDateTime\",\n o.updated_at as \"operation_updated_at!: time::OffsetDateTime\",\n o.published_at as \"operation_published_at: time::OffsetDateTime\",\n ov.version,\n ov.status,\n ov.target_json,\n ov.input_schema_json,\n ov.output_schema_json,\n ov.input_mapping_json,\n ov.output_mapping_json,\n ov.execution_config_json,\n ov.tool_description_json,\n ov.samples_json,\n ov.generated_draft_json,\n ov.config_export_json,\n ov.wizard_state_json,\n ov.change_note,\n ov.created_at as \"created_at!: time::OffsetDateTime\",\n ov.created_by\n from published_operations po\n join operation_versions ov\n on ov.operation_id = po.operation_id and ov.version = po.version\n join operations o on o.id = po.operation_id\n order by o.name asc",
|
|
||||||
"describe": {
|
|
||||||
"columns": [
|
|
||||||
{
|
|
||||||
"ordinal": 0,
|
|
||||||
"name": "id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 1,
|
|
||||||
"name": "workspace_id",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 2,
|
|
||||||
"name": "name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 3,
|
|
||||||
"name": "display_name",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 4,
|
|
||||||
"name": "category",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 5,
|
|
||||||
"name": "protocol",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 6,
|
|
||||||
"name": "security_level",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 7,
|
|
||||||
"name": "operation_created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 8,
|
|
||||||
"name": "operation_updated_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 9,
|
|
||||||
"name": "operation_published_at: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 10,
|
|
||||||
"name": "version",
|
|
||||||
"type_info": "Int4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 11,
|
|
||||||
"name": "status",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 12,
|
|
||||||
"name": "target_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 13,
|
|
||||||
"name": "input_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 14,
|
|
||||||
"name": "output_schema_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 15,
|
|
||||||
"name": "input_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 16,
|
|
||||||
"name": "output_mapping_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 17,
|
|
||||||
"name": "execution_config_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 18,
|
|
||||||
"name": "tool_description_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 19,
|
|
||||||
"name": "samples_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 20,
|
|
||||||
"name": "generated_draft_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 21,
|
|
||||||
"name": "config_export_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 22,
|
|
||||||
"name": "wizard_state_json",
|
|
||||||
"type_info": "Jsonb"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 23,
|
|
||||||
"name": "change_note",
|
|
||||||
"type_info": "Text"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 24,
|
|
||||||
"name": "created_at!: time::OffsetDateTime",
|
|
||||||
"type_info": "Timestamptz"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ordinal": 25,
|
|
||||||
"name": "created_by",
|
|
||||||
"type_info": "Text"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"parameters": {
|
|
||||||
"Left": []
|
|
||||||
},
|
|
||||||
"nullable": [
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
false,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
true,
|
|
||||||
false,
|
|
||||||
true
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"hash": "ff7cac26067a7845a033db286befb7762b051412ac83c0238fe7ce426c02d4d4"
|
|
||||||
}
|
|
||||||
Generated
+13
-11
@@ -27,6 +27,7 @@ dependencies = [
|
|||||||
"axum-extra",
|
"axum-extra",
|
||||||
"base64",
|
"base64",
|
||||||
"crank-community-auth",
|
"crank-community-auth",
|
||||||
|
"crank-community-mcp",
|
||||||
"crank-config",
|
"crank-config",
|
||||||
"crank-core",
|
"crank-core",
|
||||||
"crank-import",
|
"crank-import",
|
||||||
@@ -57,6 +58,7 @@ dependencies = [
|
|||||||
"tracing",
|
"tracing",
|
||||||
"tracing-opentelemetry",
|
"tracing-opentelemetry",
|
||||||
"tracing-subscriber",
|
"tracing-subscriber",
|
||||||
|
"url",
|
||||||
"uuid",
|
"uuid",
|
||||||
]
|
]
|
||||||
|
|
||||||
@@ -1113,7 +1115,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||||||
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
|
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"libc",
|
"libc",
|
||||||
"windows-sys 0.61.2",
|
"windows-sys 0.52.0",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
@@ -1389,9 +1391,9 @@ checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
|
|||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "h2"
|
name = "h2"
|
||||||
version = "0.4.15"
|
version = "0.4.16"
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
|
checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"atomic-waker",
|
"atomic-waker",
|
||||||
"bytes",
|
"bytes",
|
||||||
@@ -1638,7 +1640,7 @@ dependencies = [
|
|||||||
"libc",
|
"libc",
|
||||||
"percent-encoding",
|
"percent-encoding",
|
||||||
"pin-project-lite",
|
"pin-project-lite",
|
||||||
"socket2 0.6.4",
|
"socket2 0.5.10",
|
||||||
"tokio",
|
"tokio",
|
||||||
"tower-service",
|
"tower-service",
|
||||||
"tracing",
|
"tracing",
|
||||||
@@ -2157,7 +2159,7 @@ version = "0.50.3"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
|
checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"windows-sys 0.61.2",
|
"windows-sys 0.59.0",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
@@ -2574,7 +2576,7 @@ dependencies = [
|
|||||||
"quinn-udp",
|
"quinn-udp",
|
||||||
"rustc-hash",
|
"rustc-hash",
|
||||||
"rustls",
|
"rustls",
|
||||||
"socket2 0.6.4",
|
"socket2 0.5.10",
|
||||||
"thiserror 2.0.18",
|
"thiserror 2.0.18",
|
||||||
"tokio",
|
"tokio",
|
||||||
"tracing",
|
"tracing",
|
||||||
@@ -2613,9 +2615,9 @@ dependencies = [
|
|||||||
"cfg_aliases",
|
"cfg_aliases",
|
||||||
"libc",
|
"libc",
|
||||||
"once_cell",
|
"once_cell",
|
||||||
"socket2 0.6.4",
|
"socket2 0.5.10",
|
||||||
"tracing",
|
"tracing",
|
||||||
"windows-sys 0.61.2",
|
"windows-sys 0.52.0",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
@@ -2953,7 +2955,7 @@ dependencies = [
|
|||||||
"errno",
|
"errno",
|
||||||
"libc",
|
"libc",
|
||||||
"linux-raw-sys 0.12.1",
|
"linux-raw-sys 0.12.1",
|
||||||
"windows-sys 0.61.2",
|
"windows-sys 0.52.0",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
@@ -3012,7 +3014,7 @@ dependencies = [
|
|||||||
"security-framework",
|
"security-framework",
|
||||||
"security-framework-sys",
|
"security-framework-sys",
|
||||||
"webpki-root-certs",
|
"webpki-root-certs",
|
||||||
"windows-sys 0.61.2",
|
"windows-sys 0.52.0",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
@@ -4410,7 +4412,7 @@ version = "0.1.11"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
|
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"windows-sys 0.61.2",
|
"windows-sys 0.52.0",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
|
|||||||
@@ -41,10 +41,12 @@ time.workspace = true
|
|||||||
tokio = { workspace = true, features = ["fs"] }
|
tokio = { workspace = true, features = ["fs"] }
|
||||||
tracing.workspace = true
|
tracing.workspace = true
|
||||||
tracing-subscriber.workspace = true
|
tracing-subscriber.workspace = true
|
||||||
|
url.workspace = true
|
||||||
uuid.workspace = true
|
uuid.workspace = true
|
||||||
|
|
||||||
[dev-dependencies]
|
[dev-dependencies]
|
||||||
async-trait = "0.1"
|
async-trait = "0.1"
|
||||||
|
crank-community-mcp = { path = "../../crates/crank-community-mcp" }
|
||||||
crank-test-support = { path = "../../crates/crank-test-support" }
|
crank-test-support = { path = "../../crates/crank-test-support" }
|
||||||
metrics.workspace = true
|
metrics.workspace = true
|
||||||
metrics-util = "0.20.4"
|
metrics-util = "0.20.4"
|
||||||
|
|||||||
@@ -1,10 +1,15 @@
|
|||||||
use axum::{
|
use axum::{
|
||||||
Router, middleware,
|
Router,
|
||||||
|
extract::DefaultBodyLimit,
|
||||||
|
middleware,
|
||||||
routing::{delete, get, post},
|
routing::{delete, get, post},
|
||||||
};
|
};
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
auth::{require_session, require_workspace_session},
|
auth::{
|
||||||
|
enforce_browser_security, require_csrf_for_browser_mutations, require_session,
|
||||||
|
require_workspace_session,
|
||||||
|
},
|
||||||
rate_limit::apply_api_rate_limit,
|
rate_limit::apply_api_rate_limit,
|
||||||
request_context::apply_request_context,
|
request_context::apply_request_context,
|
||||||
routes::{
|
routes::{
|
||||||
@@ -15,14 +20,18 @@ use crate::{
|
|||||||
list_agent_platform_api_keys, list_agents, preview_tool_search, publish_agent,
|
list_agent_platform_api_keys, list_agents, preview_tool_search, publish_agent,
|
||||||
revoke_agent_platform_api_key, save_agent_bindings, unpublish_agent, update_agent,
|
revoke_agent_platform_api_key, save_agent_bindings, unpublish_agent, update_agent,
|
||||||
},
|
},
|
||||||
auth::{change_password, get_profile, get_session, login, logout, update_profile},
|
auth::{
|
||||||
|
bootstrap_status, change_password, complete_bootstrap, get_profile, get_session, login,
|
||||||
|
logout, refresh_session_csrf, update_profile,
|
||||||
|
},
|
||||||
auth_profiles::{create_auth_profile, get_auth_profile, list_auth_profiles},
|
auth_profiles::{create_auth_profile, get_auth_profile, list_auth_profiles},
|
||||||
capabilities::get_capabilities,
|
capabilities::get_capabilities,
|
||||||
imports::{create_openapi_import, preview_openapi_import},
|
imports::{create_openapi_import, preview_openapi_import},
|
||||||
observability::{
|
observability::{
|
||||||
get_agent_usage, get_approval, get_log, get_operation_usage, get_usage, list_approvals,
|
approve_approval, deny_approval, export_logs_csv, export_usage_csv, get_agent_usage,
|
||||||
list_logs,
|
get_approval, get_log, get_operation_usage, get_usage, list_approvals, list_logs,
|
||||||
},
|
},
|
||||||
|
onboarding::{get_onboarding, record_onboarding_event, reset_onboarding_selection},
|
||||||
operations::{
|
operations::{
|
||||||
analyze_operation_quality, archive_operation, create_operation, create_version,
|
analyze_operation_quality, archive_operation, create_operation, create_version,
|
||||||
delete_operation, export_operation, generate_draft, get_operation,
|
delete_operation, export_operation, generate_draft, get_operation,
|
||||||
@@ -48,7 +57,10 @@ pub fn build_app(state: AppState) -> Router {
|
|||||||
"/operations/analyze-quality",
|
"/operations/analyze-quality",
|
||||||
post(analyze_operation_quality),
|
post(analyze_operation_quality),
|
||||||
)
|
)
|
||||||
.route("/operations/import", post(import_operation))
|
.route(
|
||||||
|
"/operations/import",
|
||||||
|
post(import_operation).layer(DefaultBodyLimit::max(256 * 1024)),
|
||||||
|
)
|
||||||
.route(
|
.route(
|
||||||
"/operations/{operation_id}",
|
"/operations/{operation_id}",
|
||||||
get(get_operation)
|
get(get_operation)
|
||||||
@@ -126,12 +138,22 @@ pub fn build_app(state: AppState) -> Router {
|
|||||||
.route("/secrets/{secret_id}/rotate", post(rotate_secret))
|
.route("/secrets/{secret_id}/rotate", post(rotate_secret))
|
||||||
.route("/export", get(export_workspace))
|
.route("/export", get(export_workspace))
|
||||||
.route("/logs", get(list_logs))
|
.route("/logs", get(list_logs))
|
||||||
|
.route("/logs/export.csv", get(export_logs_csv))
|
||||||
.route("/logs/{log_id}", get(get_log))
|
.route("/logs/{log_id}", get(get_log))
|
||||||
.route("/approvals", get(list_approvals))
|
.route("/approvals", get(list_approvals))
|
||||||
.route("/approvals/{approval_id}", get(get_approval))
|
.route("/approvals/{approval_id}", get(get_approval))
|
||||||
|
.route("/approvals/{approval_id}/approve", post(approve_approval))
|
||||||
|
.route("/approvals/{approval_id}/deny", post(deny_approval))
|
||||||
|
.route("/usage/export.csv", get(export_usage_csv))
|
||||||
.route("/usage", get(get_usage))
|
.route("/usage", get(get_usage))
|
||||||
.route("/usage/operations/{operation_id}", get(get_operation_usage))
|
.route("/usage/operations/{operation_id}", get(get_operation_usage))
|
||||||
.route("/usage/agents/{agent_id}", get(get_agent_usage));
|
.route("/usage/agents/{agent_id}", get(get_agent_usage))
|
||||||
|
.route("/onboarding", get(get_onboarding))
|
||||||
|
.route("/onboarding/events", post(record_onboarding_event))
|
||||||
|
.route(
|
||||||
|
"/onboarding/reset-selection",
|
||||||
|
post(reset_onboarding_selection),
|
||||||
|
);
|
||||||
|
|
||||||
let workspace_root_router = Router::new()
|
let workspace_root_router = Router::new()
|
||||||
.route("/capabilities", get(get_capabilities))
|
.route("/capabilities", get(get_capabilities))
|
||||||
@@ -157,6 +179,7 @@ pub fn build_app(state: AppState) -> Router {
|
|||||||
let protected_auth_router = Router::new()
|
let protected_auth_router = Router::new()
|
||||||
.route("/logout", post(logout))
|
.route("/logout", post(logout))
|
||||||
.route("/session", get(get_session))
|
.route("/session", get(get_session))
|
||||||
|
.route("/session/csrf", post(refresh_session_csrf))
|
||||||
.route("/profile", get(get_profile).patch(update_profile))
|
.route("/profile", get(get_profile).patch(update_profile))
|
||||||
.route("/password", post(change_password))
|
.route("/password", post(change_password))
|
||||||
.layer(middleware::from_fn_with_state(
|
.layer(middleware::from_fn_with_state(
|
||||||
@@ -170,10 +193,20 @@ pub fn build_app(state: AppState) -> Router {
|
|||||||
.nest(
|
.nest(
|
||||||
"/api/auth",
|
"/api/auth",
|
||||||
Router::new()
|
Router::new()
|
||||||
|
.route("/bootstrap/status", get(bootstrap_status))
|
||||||
|
.route("/bootstrap/complete", post(complete_bootstrap))
|
||||||
.route("/login", post(login))
|
.route("/login", post(login))
|
||||||
.merge(protected_auth_router),
|
.merge(protected_auth_router),
|
||||||
)
|
)
|
||||||
.nest("/api/admin", admin_router)
|
.nest("/api/admin", admin_router)
|
||||||
|
.layer(middleware::from_fn_with_state(
|
||||||
|
state.clone(),
|
||||||
|
require_csrf_for_browser_mutations,
|
||||||
|
))
|
||||||
|
.layer(middleware::from_fn_with_state(
|
||||||
|
state.clone(),
|
||||||
|
enforce_browser_security,
|
||||||
|
))
|
||||||
.layer(middleware::from_fn_with_state(
|
.layer(middleware::from_fn_with_state(
|
||||||
state.clone(),
|
state.clone(),
|
||||||
apply_api_rate_limit,
|
apply_api_rate_limit,
|
||||||
|
|||||||
+131
-3
@@ -1,22 +1,24 @@
|
|||||||
use axum::{
|
use axum::{
|
||||||
extract::{OriginalUri, Request, State},
|
extract::{OriginalUri, Request, State},
|
||||||
|
http::{HeaderValue, Method, header},
|
||||||
middleware::Next,
|
middleware::Next,
|
||||||
response::Response,
|
response::Response,
|
||||||
};
|
};
|
||||||
use axum_extra::extract::cookie::{Cookie, CookieJar};
|
use axum_extra::extract::cookie::{Cookie, CookieJar};
|
||||||
use crank_community_auth::{
|
use crank_community_auth::{
|
||||||
cleared_session_cookie as build_cleared_session_cookie,
|
cleared_session_cookie as build_cleared_session_cookie, create_csrf_token as build_csrf_token,
|
||||||
create_session_cookie as build_session_cookie, hash_password as community_hash_password,
|
create_session_cookie as build_session_cookie, hash_password as community_hash_password,
|
||||||
session_cookie as build_session_cookie_header,
|
session_cookie as build_session_cookie_header,
|
||||||
};
|
};
|
||||||
use crank_core::{User, UserSessionId, WorkspaceId};
|
use crank_core::{MembershipRole, User, UserSessionId, WorkspaceId};
|
||||||
use crank_registry::WorkspaceMembershipRecord;
|
use crank_registry::WorkspaceMembershipRecord;
|
||||||
use serde::Serialize;
|
use serde::Serialize;
|
||||||
|
|
||||||
use crate::{error::ApiError, state::AppState};
|
use crate::{error::ApiError, state::AppState};
|
||||||
|
|
||||||
pub use crank_community_auth::{
|
pub use crank_community_auth::{
|
||||||
SESSION_COOKIE_NAME, SessionCookie, extract_session_token, hash_session_secret, verify_password,
|
SESSION_COOKIE_NAME, SessionCookie, create_csrf_token, extract_session_token, hash_csrf_token,
|
||||||
|
hash_session_secret, verify_password,
|
||||||
};
|
};
|
||||||
|
|
||||||
#[derive(Clone)]
|
#[derive(Clone)]
|
||||||
@@ -53,6 +55,10 @@ pub fn create_session_cookie(settings: &AuthSettings) -> Result<SessionCookie, A
|
|||||||
.map_err(|error| ApiError::internal(format!("failed to create session cookie: {error}")))
|
.map_err(|error| ApiError::internal(format!("failed to create session cookie: {error}")))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub fn create_csrf_token_value() -> String {
|
||||||
|
build_csrf_token()
|
||||||
|
}
|
||||||
|
|
||||||
pub fn session_cookie(settings: &AuthSettings, token: &str) -> Cookie<'static> {
|
pub fn session_cookie(settings: &AuthSettings, token: &str) -> Cookie<'static> {
|
||||||
build_session_cookie_header(token, settings.cookie_secure, settings.session_ttl_hours)
|
build_session_cookie_header(token, settings.cookie_secure, settings.session_ttl_hours)
|
||||||
}
|
}
|
||||||
@@ -90,11 +96,81 @@ pub async fn require_workspace_session(
|
|||||||
if !has_access {
|
if !has_access {
|
||||||
return Err(ApiError::forbidden("workspace access denied"));
|
return Err(ApiError::forbidden("workspace access denied"));
|
||||||
}
|
}
|
||||||
|
if !matches!(
|
||||||
|
request.method(),
|
||||||
|
&axum::http::Method::GET | &axum::http::Method::HEAD
|
||||||
|
) && !session.memberships.iter().any(|membership| {
|
||||||
|
membership.workspace.id == workspace_id && membership.role == MembershipRole::Owner
|
||||||
|
}) {
|
||||||
|
return Err(ApiError::forbidden("workspace owner access required"));
|
||||||
|
}
|
||||||
|
|
||||||
request.extensions_mut().insert(session);
|
request.extensions_mut().insert(session);
|
||||||
Ok(next.run(request).await)
|
Ok(next.run(request).await)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub async fn require_csrf_for_browser_mutations(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
jar: CookieJar,
|
||||||
|
request: Request,
|
||||||
|
next: Next,
|
||||||
|
) -> Result<Response, ApiError> {
|
||||||
|
if !requires_csrf(request.method(), request.uri().path()) {
|
||||||
|
return Ok(next.run(request).await);
|
||||||
|
}
|
||||||
|
let (session_id, _session_value) = extract_session_token(&jar)
|
||||||
|
.ok_or_else(|| ApiError::unauthorized("authentication required"))?;
|
||||||
|
let token = request
|
||||||
|
.headers()
|
||||||
|
.get("x-csrf-token")
|
||||||
|
.and_then(|value| value.to_str().ok())
|
||||||
|
.filter(|value| valid_csrf_token(value))
|
||||||
|
.ok_or_else(|| ApiError::forbidden("csrf validation failed"))?;
|
||||||
|
let csrf_hash = hash_csrf_token(
|
||||||
|
&session_id,
|
||||||
|
token,
|
||||||
|
&state.service.auth_settings().session_secret,
|
||||||
|
);
|
||||||
|
if !state
|
||||||
|
.service
|
||||||
|
.verify_session_csrf(&session_id, &csrf_hash)
|
||||||
|
.await?
|
||||||
|
{
|
||||||
|
return Err(ApiError::forbidden("csrf validation failed"));
|
||||||
|
}
|
||||||
|
Ok(next.run(request).await)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn enforce_browser_security(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
request: Request,
|
||||||
|
next: Next,
|
||||||
|
) -> Result<Response, ApiError> {
|
||||||
|
if let Some(origin) = request.headers().get(header::ORIGIN)
|
||||||
|
&& is_cross_origin(
|
||||||
|
origin,
|
||||||
|
request.headers().get(header::HOST),
|
||||||
|
if state.service.auth_settings().cookie_secure {
|
||||||
|
"https"
|
||||||
|
} else {
|
||||||
|
"http"
|
||||||
|
},
|
||||||
|
)
|
||||||
|
&& request.uri().path().starts_with("/api/")
|
||||||
|
{
|
||||||
|
return Err(ApiError::forbidden("cross-origin admin request denied"));
|
||||||
|
}
|
||||||
|
let mut response = next.run(request).await;
|
||||||
|
let headers = response.headers_mut();
|
||||||
|
headers.insert(
|
||||||
|
"x-content-type-options",
|
||||||
|
HeaderValue::from_static("nosniff"),
|
||||||
|
);
|
||||||
|
headers.insert("x-frame-options", HeaderValue::from_static("DENY"));
|
||||||
|
headers.insert("referrer-policy", HeaderValue::from_static("no-referrer"));
|
||||||
|
Ok(response)
|
||||||
|
}
|
||||||
|
|
||||||
async fn resolve_authenticated_session(
|
async fn resolve_authenticated_session(
|
||||||
state: AppState,
|
state: AppState,
|
||||||
jar: &CookieJar,
|
jar: &CookieJar,
|
||||||
@@ -122,3 +198,55 @@ fn workspace_id_from_path(path: &str) -> Option<WorkspaceId> {
|
|||||||
|
|
||||||
Some(WorkspaceId::new(workspace_id))
|
Some(WorkspaceId::new(workspace_id))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn requires_csrf(method: &Method, path: &str) -> bool {
|
||||||
|
if matches!(method, &Method::GET | &Method::HEAD | &Method::OPTIONS) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
if matches!(
|
||||||
|
path,
|
||||||
|
"/api/auth/login" | "/api/auth/bootstrap/complete" | "/api/auth/session/csrf"
|
||||||
|
) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
path.starts_with("/api/auth/") || path.starts_with("/api/admin/")
|
||||||
|
}
|
||||||
|
|
||||||
|
fn valid_csrf_token(value: &str) -> bool {
|
||||||
|
(32..=256).contains(&value.len())
|
||||||
|
&& value
|
||||||
|
.bytes()
|
||||||
|
.all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.'))
|
||||||
|
}
|
||||||
|
|
||||||
|
fn is_cross_origin(
|
||||||
|
origin: &HeaderValue,
|
||||||
|
host: Option<&HeaderValue>,
|
||||||
|
expected_scheme: &str,
|
||||||
|
) -> bool {
|
||||||
|
let Some(host) = host.and_then(|value| value.to_str().ok()) else {
|
||||||
|
return true;
|
||||||
|
};
|
||||||
|
let Some(origin) = origin.to_str().ok() else {
|
||||||
|
return true;
|
||||||
|
};
|
||||||
|
let Ok(url) = url::Url::parse(origin) else {
|
||||||
|
return true;
|
||||||
|
};
|
||||||
|
url.host_str()
|
||||||
|
.zip(url.port_or_known_default())
|
||||||
|
.map(|(origin_host, origin_port)| {
|
||||||
|
let origin_authority = format!("{}://{origin_host}:{origin_port}", url.scheme());
|
||||||
|
let request_authority = if host.contains(':') {
|
||||||
|
format!("{expected_scheme}://{}", host.to_ascii_lowercase())
|
||||||
|
} else {
|
||||||
|
let default_port = if expected_scheme == "https" { 443 } else { 80 };
|
||||||
|
format!(
|
||||||
|
"{expected_scheme}://{}:{default_port}",
|
||||||
|
host.to_ascii_lowercase()
|
||||||
|
)
|
||||||
|
};
|
||||||
|
origin_authority.to_ascii_lowercase() != request_authority
|
||||||
|
})
|
||||||
|
.unwrap_or(true)
|
||||||
|
}
|
||||||
|
|||||||
@@ -1,15 +1,19 @@
|
|||||||
use std::{process::ExitCode, time::Duration};
|
#[path = "crank_migrate/admin_auth_command.rs"]
|
||||||
|
mod admin_auth_command;
|
||||||
|
#[path = "crank_migrate/db_connect.rs"]
|
||||||
|
mod db_connect;
|
||||||
|
|
||||||
use crank_config::{ConfigSource, DatabaseSettings, parse_migrator};
|
use crank_config::{ConfigSource, parse_migrator};
|
||||||
use crank_registry::{
|
use crank_registry::{
|
||||||
BackfillPolicy, MigrationApplyResult, MigrationAuthority, MigrationPreflight,
|
BackfillPolicy, MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate,
|
||||||
|
MasterKeyRotationRecord, MigrationApplyResult, MigrationAuthority, MigrationPreflight,
|
||||||
|
PostgresRegistry, RegistryError, SecretVersionRecord,
|
||||||
};
|
};
|
||||||
|
use crank_runtime::SecretCrypto;
|
||||||
use serde_json::json;
|
use serde_json::json;
|
||||||
use sqlx::{
|
use std::{path::Path, process::ExitCode};
|
||||||
PgPool,
|
use time::OffsetDateTime;
|
||||||
postgres::{PgConnectOptions, PgPoolOptions},
|
const MASTER_KEY_ROTATION_PAGE_SIZE: i64 = 1_000;
|
||||||
};
|
|
||||||
|
|
||||||
#[tokio::main]
|
#[tokio::main]
|
||||||
async fn main() -> ExitCode {
|
async fn main() -> ExitCode {
|
||||||
match run().await {
|
match run().await {
|
||||||
@@ -37,7 +41,6 @@ struct CliError {
|
|||||||
recovery: &'static str,
|
recovery: &'static str,
|
||||||
version: Option<i64>,
|
version: Option<i64>,
|
||||||
}
|
}
|
||||||
|
|
||||||
impl CliError {
|
impl CliError {
|
||||||
const fn new(code: &'static str, stage: &'static str, recovery: &'static str) -> Self {
|
const fn new(code: &'static str, stage: &'static str, recovery: &'static str) -> Self {
|
||||||
Self {
|
Self {
|
||||||
@@ -47,7 +50,6 @@ impl CliError {
|
|||||||
version: None,
|
version: None,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn from_migration(error: crank_registry::MigrationError) -> Self {
|
fn from_migration(error: crank_registry::MigrationError) -> Self {
|
||||||
Self {
|
Self {
|
||||||
code: error.code(),
|
code: error.code(),
|
||||||
@@ -56,20 +58,87 @@ impl CliError {
|
|||||||
version: error.version(),
|
version: error.version(),
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
fn from_registry(error: RegistryError) -> Self {
|
||||||
|
match error {
|
||||||
|
RegistryError::MasterKeyIdentityMismatch { .. } => Self::new(
|
||||||
|
"master_key_identity_mismatch",
|
||||||
|
"master_key.identity",
|
||||||
|
"use_matching_master_key",
|
||||||
|
),
|
||||||
|
RegistryError::InvalidMasterKeyIdentity => Self::new(
|
||||||
|
"master_key_identity_invalid",
|
||||||
|
"master_key.identity",
|
||||||
|
"verify_operator_input",
|
||||||
|
),
|
||||||
|
RegistryError::MasterKeyRotationInProgress => Self::new(
|
||||||
|
"master_key_rotation_in_progress",
|
||||||
|
"master_key.rotation",
|
||||||
|
"resume_verify_promote_or_abort_rotation",
|
||||||
|
),
|
||||||
|
RegistryError::MasterKeyRotationNotFound { .. } => Self::new(
|
||||||
|
"master_key_rotation_not_found",
|
||||||
|
"master_key.rotation",
|
||||||
|
"run_status",
|
||||||
|
),
|
||||||
|
RegistryError::MasterKeyRotationConflict => Self::new(
|
||||||
|
"master_key_rotation_conflict",
|
||||||
|
"master_key.rotation",
|
||||||
|
"run_status",
|
||||||
|
),
|
||||||
|
RegistryError::MasterKeyRotationVerificationFailed => Self::new(
|
||||||
|
"master_key_rotation_verification_failed",
|
||||||
|
"master_key.rotation",
|
||||||
|
"rerun_rotation_or_abort",
|
||||||
|
),
|
||||||
|
RegistryError::AdminBootstrapUnavailable => Self::new(
|
||||||
|
"admin_bootstrap_unavailable",
|
||||||
|
"admin_auth.bootstrap",
|
||||||
|
"use_existing_active_contract_or_wait_until_expired",
|
||||||
|
),
|
||||||
|
RegistryError::AdminBootstrapRejected => Self::new(
|
||||||
|
"admin_bootstrap_rejected",
|
||||||
|
"admin_auth.bootstrap",
|
||||||
|
"create_new_local_bootstrap_contract",
|
||||||
|
),
|
||||||
|
RegistryError::AdminRecoveryRejected => Self::new(
|
||||||
|
"admin_recovery_rejected",
|
||||||
|
"admin_auth.recovery",
|
||||||
|
"verify_local_inputs_and_master_key",
|
||||||
|
),
|
||||||
|
RegistryError::AdminLoginRateLimited { .. } => Self::new(
|
||||||
|
"admin_login_rate_limited",
|
||||||
|
"admin_auth.login",
|
||||||
|
"retry_after_delay",
|
||||||
|
),
|
||||||
|
RegistryError::AdminCsrfRejected => {
|
||||||
|
Self::new("admin_csrf_rejected", "admin_auth.csrf", "refresh_session")
|
||||||
|
}
|
||||||
|
RegistryError::Storage(_) => {
|
||||||
|
Self::new("storage_unavailable", "database.query", "contact_operator")
|
||||||
|
}
|
||||||
|
_ => Self::new("registry_error", "registry.operation", "contact_operator"),
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
async fn run() -> Result<ExitCode, CliError> {
|
async fn run() -> Result<ExitCode, CliError> {
|
||||||
let mut arguments = std::env::args().skip(1);
|
let args = std::env::args().skip(1).collect::<Vec<_>>();
|
||||||
let requested = arguments.next();
|
if args.first().map(String::as_str) == Some("master-key") {
|
||||||
let option = arguments.next();
|
return run_master_key(&args[1..]).await;
|
||||||
if arguments.next().is_some() {
|
}
|
||||||
|
if args.first().map(String::as_str) == Some("admin-auth") {
|
||||||
|
return admin_auth_command::run_admin_auth(&args[1..]).await;
|
||||||
|
}
|
||||||
|
let requested = args.first().map(String::as_str);
|
||||||
|
let option = args.get(1).map(String::as_str);
|
||||||
|
if args.len() > 2 {
|
||||||
return Err(CliError::new(
|
return Err(CliError::new(
|
||||||
"invalid_command",
|
"invalid_command",
|
||||||
"cli.arguments",
|
"cli.arguments",
|
||||||
"run_preflight",
|
"run_preflight",
|
||||||
));
|
));
|
||||||
}
|
}
|
||||||
let command = match requested.as_deref() {
|
let command = match requested {
|
||||||
None | Some("preflight") => "preflight",
|
None | Some("preflight") => "preflight",
|
||||||
Some("plan") => "plan",
|
Some("plan") => "plan",
|
||||||
Some("apply") => "apply",
|
Some("apply") => "apply",
|
||||||
@@ -117,7 +186,7 @@ async fn run() -> Result<ExitCode, CliError> {
|
|||||||
})
|
})
|
||||||
.collect::<Vec<_>>();
|
.collect::<Vec<_>>();
|
||||||
let plan = json!({ "schema_version": 1, "sequence": sequence });
|
let plan = json!({ "schema_version": 1, "sequence": sequence });
|
||||||
if option.as_deref() == Some("--check") {
|
if option == Some("--check") {
|
||||||
let bytes = std::fs::read("docs/schemas/migration-sequence.json")
|
let bytes = std::fs::read("docs/schemas/migration-sequence.json")
|
||||||
.map_err(|_| CliError::new("contract_drift", "plan.read", "contact_operator"))?;
|
.map_err(|_| CliError::new("contract_drift", "plan.read", "contact_operator"))?;
|
||||||
if bytes.len() > 65_536 {
|
if bytes.len() > 65_536 {
|
||||||
@@ -162,7 +231,7 @@ async fn run() -> Result<ExitCode, CliError> {
|
|||||||
.map_err(|_| CliError::new("config_invalid", "config.source", "run_preflight"))?,
|
.map_err(|_| CliError::new("config_invalid", "config.source", "run_preflight"))?,
|
||||||
)
|
)
|
||||||
.map_err(|_| CliError::new("config_invalid", "config.validate", "run_preflight"))?;
|
.map_err(|_| CliError::new("config_invalid", "config.validate", "run_preflight"))?;
|
||||||
let pool = connect(&config.database).await?;
|
let pool = db_connect::connect(&config.database).await?;
|
||||||
|
|
||||||
if command == "apply" {
|
if command == "apply" {
|
||||||
let result = MigrationAuthority::apply(&pool)
|
let result = MigrationAuthority::apply(&pool)
|
||||||
@@ -204,39 +273,680 @@ async fn run() -> Result<ExitCode, CliError> {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
async fn connect(config: &DatabaseSettings) -> Result<PgPool, CliError> {
|
async fn run_master_key(arguments: &[String]) -> Result<ExitCode, CliError> {
|
||||||
let options = if let Some(url) = &config.url {
|
let Some(command) = arguments.first().map(String::as_str) else {
|
||||||
url.expose_secret()
|
return Err(CliError::new(
|
||||||
.parse::<PgConnectOptions>()
|
"invalid_command",
|
||||||
.map_err(|_| CliError::new("config_invalid", "database.source", "run_preflight"))?
|
"cli.arguments",
|
||||||
} else {
|
"run_master_key_status",
|
||||||
PgConnectOptions::new()
|
));
|
||||||
.host(&config.host)
|
|
||||||
.port(config.port)
|
|
||||||
.database(&config.database)
|
|
||||||
.username(&config.username)
|
|
||||||
.password(config.password.expose_secret())
|
|
||||||
};
|
};
|
||||||
for attempt in 1..=10 {
|
let options = MasterKeyOptions::parse(&arguments[1..])?;
|
||||||
let result = PgPoolOptions::new()
|
let config = parse_migrator(
|
||||||
.max_connections(config.pool.max_connections)
|
ConfigSource::from_os_for_migrator()
|
||||||
.min_connections(config.pool.min_connections)
|
.map_err(|_| CliError::new("config_invalid", "config.source", "run_preflight"))?,
|
||||||
.acquire_timeout(Duration::from_millis(config.pool.acquire_timeout_ms))
|
)
|
||||||
.idle_timeout(Duration::from_millis(config.pool.idle_timeout_ms))
|
.map_err(|_| CliError::new("config_invalid", "config.validate", "run_preflight"))?;
|
||||||
.max_lifetime(Duration::from_millis(config.pool.max_lifetime_ms))
|
let registry = db_connect::connect_registry(&config.database).await?;
|
||||||
.connect_with(options.clone())
|
|
||||||
.await;
|
match command {
|
||||||
match result {
|
"status" => {
|
||||||
Ok(pool) => return Ok(pool),
|
ensure_no_options(&options)?;
|
||||||
Err(_) if attempt < 10 => {
|
let status = registry
|
||||||
tokio::time::sleep(Duration::from_secs(1)).await;
|
.master_key_rotation_status()
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": "ok",
|
||||||
|
"active_epoch": status.active_identity.as_ref().map(|identity| identity.epoch),
|
||||||
|
"rotation_count": status.rotations.len(),
|
||||||
|
"rotations": status.rotations.iter().map(rotation_json).collect::<Vec<_>>(),
|
||||||
|
})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
"preflight" => {
|
||||||
|
let preflight = master_key_preflight(®istry, &options).await?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": "preflight_ok",
|
||||||
|
"source_epoch": preflight.source_epoch,
|
||||||
|
"target_epoch": preflight.target_epoch,
|
||||||
|
"affected_secret_versions": preflight.affected_secret_versions,
|
||||||
|
"backup_ref": preflight.backup_ref.map(|_| "configured"),
|
||||||
|
})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
"rotate" => {
|
||||||
|
let (rotation, current_crypto, target_crypto) =
|
||||||
|
if let Some(rotation) = active_rotation(®istry, &["running"]).await? {
|
||||||
|
let (current_crypto, target_crypto) =
|
||||||
|
rotation_crypto_for_resume(®istry, &options, &rotation).await?;
|
||||||
|
(rotation, current_crypto, target_crypto)
|
||||||
|
} else {
|
||||||
|
let preflight = master_key_preflight(®istry, &options).await?;
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
let rotation = registry
|
||||||
|
.begin_master_key_rotation(
|
||||||
|
preflight.source_epoch,
|
||||||
|
preflight.target_epoch,
|
||||||
|
preflight.target_crypto.master_key_fingerprint(),
|
||||||
|
preflight.backup_ref.as_deref(),
|
||||||
|
&now,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
(rotation, preflight.current_crypto, preflight.target_crypto)
|
||||||
|
};
|
||||||
|
let processed = process_rotation_batch(
|
||||||
|
®istry,
|
||||||
|
&rotation,
|
||||||
|
¤t_crypto,
|
||||||
|
&target_crypto,
|
||||||
|
options.max_versions,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
let status = if rotation.processed_secret_versions + processed
|
||||||
|
>= rotation.total_secret_versions
|
||||||
|
{
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
registry
|
||||||
|
.finish_master_key_rotation_batches(&rotation.id, &now)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?
|
||||||
|
} else {
|
||||||
|
registry
|
||||||
|
.master_key_rotation_status()
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?
|
||||||
|
.rotations
|
||||||
|
.into_iter()
|
||||||
|
.find(|candidate| candidate.id == rotation.id)
|
||||||
|
.ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_not_found",
|
||||||
|
"master_key.rotation",
|
||||||
|
"run_status",
|
||||||
|
)
|
||||||
|
})?
|
||||||
|
};
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": status.state,
|
||||||
|
"rotation_id": status.id,
|
||||||
|
"source_epoch": status.source_epoch,
|
||||||
|
"target_epoch": status.target_epoch,
|
||||||
|
"processed_secret_versions": status.processed_secret_versions,
|
||||||
|
"total_secret_versions": status.total_secret_versions,
|
||||||
|
})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
"verify" => {
|
||||||
|
let target_key = read_required_key_file(options.target_key_file.as_deref())?;
|
||||||
|
let rotation = active_rotation(®istry, &["verifying"])
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_conflict",
|
||||||
|
"master_key.rotation",
|
||||||
|
"run_rotate",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let target_crypto = SecretCrypto::with_epoch(&target_key, rotation.target_epoch)
|
||||||
|
.map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if target_crypto.master_key_fingerprint() != rotation.target_fingerprint {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_identity_mismatch",
|
||||||
|
"master_key.identity",
|
||||||
|
"use_matching_target_key",
|
||||||
|
));
|
||||||
}
|
}
|
||||||
Err(_) => break,
|
let verified = verify_staged_targets(®istry, &rotation, &target_crypto).await?;
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
let status = registry
|
||||||
|
.verify_master_key_rotation(&rotation.id, verified, &now)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": status.state,
|
||||||
|
"rotation_id": status.id,
|
||||||
|
"verified_secret_versions": status.verified_secret_versions,
|
||||||
|
"total_secret_versions": status.total_secret_versions,
|
||||||
|
})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
"promote" => {
|
||||||
|
let target_key = read_required_key_file(options.target_key_file.as_deref())?;
|
||||||
|
let rotation = active_rotation(®istry, &["verified"])
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_conflict",
|
||||||
|
"master_key.rotation",
|
||||||
|
"run_verify",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let target_crypto = SecretCrypto::with_epoch(&target_key, rotation.target_epoch)
|
||||||
|
.map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if target_crypto.master_key_fingerprint() != rotation.target_fingerprint {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_identity_mismatch",
|
||||||
|
"master_key.identity",
|
||||||
|
"use_matching_target_key",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
verify_staged_targets(®istry, &rotation, &target_crypto).await?;
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
let status = registry
|
||||||
|
.promote_master_key_rotation(
|
||||||
|
&rotation.id,
|
||||||
|
MasterKeyIdentityCandidate {
|
||||||
|
epoch: rotation.target_epoch,
|
||||||
|
fingerprint: target_crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &now,
|
||||||
|
},
|
||||||
|
&now,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": status.state,
|
||||||
|
"rotation_id": status.id,
|
||||||
|
"active_epoch": status.target_epoch,
|
||||||
|
})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
"abort" => {
|
||||||
|
let rotation_id = options
|
||||||
|
.rotation_id
|
||||||
|
.as_deref()
|
||||||
|
.ok_or_else(|| CliError::new("invalid_command", "cli.arguments", "run_status"))?;
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
let status = registry
|
||||||
|
.abort_master_key_rotation(rotation_id, &now)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": status.state,
|
||||||
|
"rotation_id": status.id,
|
||||||
|
"active_epoch": status.source_epoch,
|
||||||
|
})
|
||||||
|
);
|
||||||
|
}
|
||||||
|
_ => {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_master_key_status",
|
||||||
|
));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
Err(CliError::new(
|
Ok(ExitCode::SUCCESS)
|
||||||
"storage_unavailable",
|
}
|
||||||
"database.connect",
|
#[derive(Default)]
|
||||||
"contact_operator",
|
struct MasterKeyOptions {
|
||||||
))
|
current_key_file: Option<String>,
|
||||||
|
target_key_file: Option<String>,
|
||||||
|
backup_ref: Option<String>,
|
||||||
|
rotation_id: Option<String>,
|
||||||
|
max_versions: Option<usize>,
|
||||||
|
}
|
||||||
|
impl MasterKeyOptions {
|
||||||
|
fn parse(arguments: &[String]) -> Result<Self, CliError> {
|
||||||
|
let mut options = Self::default();
|
||||||
|
let mut index = 0;
|
||||||
|
while index < arguments.len() {
|
||||||
|
let key = arguments[index].as_str();
|
||||||
|
let Some(value) = arguments.get(index + 1) else {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_master_key_status",
|
||||||
|
));
|
||||||
|
};
|
||||||
|
match key {
|
||||||
|
"--current-key-file" => options.current_key_file = Some(value.clone()),
|
||||||
|
"--target-key-file" => options.target_key_file = Some(value.clone()),
|
||||||
|
"--backup-ref" => options.backup_ref = Some(value.clone()),
|
||||||
|
"--rotation-id" => options.rotation_id = Some(value.clone()),
|
||||||
|
"--max-versions" => {
|
||||||
|
let parsed = value.parse::<usize>().map_err(|_| {
|
||||||
|
CliError::new("invalid_command", "cli.arguments", "run_master_key_status")
|
||||||
|
})?;
|
||||||
|
if parsed == 0 || parsed > 10_000 {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_master_key_status",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
options.max_versions = Some(parsed);
|
||||||
|
}
|
||||||
|
_ => {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_master_key_status",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
index += 2;
|
||||||
|
}
|
||||||
|
Ok(options)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
struct MasterKeyPreflight {
|
||||||
|
source_epoch: i64,
|
||||||
|
target_epoch: i64,
|
||||||
|
affected_secret_versions: usize,
|
||||||
|
backup_ref: Option<String>,
|
||||||
|
current_crypto: SecretCrypto,
|
||||||
|
target_crypto: SecretCrypto,
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn master_key_preflight(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
options: &MasterKeyOptions,
|
||||||
|
) -> Result<MasterKeyPreflight, CliError> {
|
||||||
|
let current_key = read_required_key_file(options.current_key_file.as_deref())?;
|
||||||
|
let target_key = read_required_key_file(options.target_key_file.as_deref())?;
|
||||||
|
let status = registry
|
||||||
|
.master_key_rotation_status()
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
if status.rotations.iter().any(|rotation| {
|
||||||
|
matches!(
|
||||||
|
rotation.state.as_str(),
|
||||||
|
"running" | "verifying" | "verified"
|
||||||
|
)
|
||||||
|
}) {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_rotation_in_progress",
|
||||||
|
"master_key.rotation",
|
||||||
|
"resume_verify_promote_or_abort_rotation",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let active = status.active_identity.ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_identity_missing",
|
||||||
|
"master_key.identity",
|
||||||
|
"start_secret_process_once",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let current_crypto = SecretCrypto::with_epoch(¤t_key, active.epoch).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if current_crypto.master_key_fingerprint() != active.fingerprint {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_identity_mismatch",
|
||||||
|
"master_key.identity",
|
||||||
|
"use_matching_current_key",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let target_epoch = active.epoch + 1;
|
||||||
|
let target_crypto = SecretCrypto::with_epoch(&target_key, target_epoch).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if target_crypto.master_key_fingerprint() == current_crypto.master_key_fingerprint()
|
||||||
|
|| registry
|
||||||
|
.master_key_fingerprint_exists(target_crypto.master_key_fingerprint())
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?
|
||||||
|
{
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_rotation_conflict",
|
||||||
|
"master_key.rotation",
|
||||||
|
"choose_new_target_key",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let affected_secret_versions =
|
||||||
|
count_and_verify_current_versions(registry, active.epoch, ¤t_crypto).await?;
|
||||||
|
Ok(MasterKeyPreflight {
|
||||||
|
source_epoch: active.epoch,
|
||||||
|
target_epoch,
|
||||||
|
affected_secret_versions,
|
||||||
|
backup_ref: options.backup_ref.clone(),
|
||||||
|
current_crypto,
|
||||||
|
target_crypto,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn rotation_crypto_for_resume(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
options: &MasterKeyOptions,
|
||||||
|
rotation: &MasterKeyRotationRecord,
|
||||||
|
) -> Result<(SecretCrypto, SecretCrypto), CliError> {
|
||||||
|
let current_key = read_required_key_file(options.current_key_file.as_deref())?;
|
||||||
|
let target_key = read_required_key_file(options.target_key_file.as_deref())?;
|
||||||
|
let active = registry
|
||||||
|
.active_master_key_identity()
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?
|
||||||
|
.ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_identity_missing",
|
||||||
|
"master_key.identity",
|
||||||
|
"start_secret_process_once",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let current_crypto =
|
||||||
|
SecretCrypto::with_epoch(¤t_key, rotation.source_epoch).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if active.epoch != rotation.source_epoch
|
||||||
|
|| active.fingerprint != current_crypto.master_key_fingerprint()
|
||||||
|
{
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_identity_mismatch",
|
||||||
|
"master_key.identity",
|
||||||
|
"use_matching_current_key",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let target_crypto =
|
||||||
|
SecretCrypto::with_epoch(&target_key, rotation.target_epoch).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if target_crypto.master_key_fingerprint() != rotation.target_fingerprint {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_identity_mismatch",
|
||||||
|
"master_key.identity",
|
||||||
|
"use_matching_target_key",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Ok((current_crypto, target_crypto))
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn process_rotation_batch(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
rotation: &MasterKeyRotationRecord,
|
||||||
|
current_crypto: &SecretCrypto,
|
||||||
|
target_crypto: &SecretCrypto,
|
||||||
|
max_versions: Option<usize>,
|
||||||
|
) -> Result<i64, CliError> {
|
||||||
|
let mut processed = 0_i64;
|
||||||
|
let mut after_secret_id: Option<String> = None;
|
||||||
|
let mut after_version: Option<u32> = None;
|
||||||
|
loop {
|
||||||
|
let versions = registry
|
||||||
|
.list_secret_versions_for_master_key_epoch_page(
|
||||||
|
rotation.source_epoch,
|
||||||
|
after_secret_id.as_deref(),
|
||||||
|
after_version,
|
||||||
|
MASTER_KEY_ROTATION_PAGE_SIZE,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
if versions.is_empty() {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
for version in versions {
|
||||||
|
after_secret_id = Some(version.secret_version.secret_id.as_str().to_owned());
|
||||||
|
after_version = Some(version.secret_version.version);
|
||||||
|
if version.target_master_key_epoch == Some(rotation.target_epoch) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if max_versions.is_some_and(|limit| processed as usize >= limit) {
|
||||||
|
return Ok(processed);
|
||||||
|
}
|
||||||
|
let plaintext = decrypt_current(&version, current_crypto)?;
|
||||||
|
let target_ciphertext = target_crypto.encrypt(&plaintext).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_verification_failed",
|
||||||
|
"master_key.rotation",
|
||||||
|
"rerun_rotation_or_abort",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
registry
|
||||||
|
.stage_master_key_rotation_ciphertext(
|
||||||
|
&rotation.id,
|
||||||
|
&version.secret_version.secret_id,
|
||||||
|
version.secret_version.version,
|
||||||
|
rotation.source_epoch,
|
||||||
|
&target_ciphertext,
|
||||||
|
target_crypto.key_version(),
|
||||||
|
rotation.target_epoch,
|
||||||
|
&now,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
processed += 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Ok(processed)
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn verify_staged_targets(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
rotation: &MasterKeyRotationRecord,
|
||||||
|
target_crypto: &SecretCrypto,
|
||||||
|
) -> Result<i64, CliError> {
|
||||||
|
let mut verified = 0_i64;
|
||||||
|
let mut after_secret_id: Option<String> = None;
|
||||||
|
let mut after_version: Option<u32> = None;
|
||||||
|
loop {
|
||||||
|
let versions = registry
|
||||||
|
.list_target_secret_versions_for_master_key_rotation_page(
|
||||||
|
rotation.target_epoch,
|
||||||
|
after_secret_id.as_deref(),
|
||||||
|
after_version,
|
||||||
|
MASTER_KEY_ROTATION_PAGE_SIZE,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
if versions.is_empty() {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
for version in versions {
|
||||||
|
after_secret_id = Some(version.secret_version.secret_id.as_str().to_owned());
|
||||||
|
after_version = Some(version.secret_version.version);
|
||||||
|
let ciphertext = version.target_ciphertext.as_deref().ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_verification_failed",
|
||||||
|
"master_key.rotation",
|
||||||
|
"rerun_rotation_or_abort",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let key_version = version.target_key_version.as_deref().ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_verification_failed",
|
||||||
|
"master_key.rotation",
|
||||||
|
"rerun_rotation_or_abort",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
target_crypto
|
||||||
|
.decrypt_for_epoch(key_version, rotation.target_epoch, ciphertext)
|
||||||
|
.map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_verification_failed",
|
||||||
|
"master_key.rotation",
|
||||||
|
"rerun_rotation_or_abort",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
verified += 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if verified != rotation.total_secret_versions {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_rotation_verification_failed",
|
||||||
|
"master_key.rotation",
|
||||||
|
"rerun_rotation_or_abort",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Ok(verified)
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn count_and_verify_current_versions(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
epoch: i64,
|
||||||
|
current_crypto: &SecretCrypto,
|
||||||
|
) -> Result<usize, CliError> {
|
||||||
|
let mut count = 0_usize;
|
||||||
|
let mut after_secret_id: Option<String> = None;
|
||||||
|
let mut after_version: Option<u32> = None;
|
||||||
|
loop {
|
||||||
|
let versions = registry
|
||||||
|
.list_secret_versions_for_master_key_epoch_page(
|
||||||
|
epoch,
|
||||||
|
after_secret_id.as_deref(),
|
||||||
|
after_version,
|
||||||
|
MASTER_KEY_ROTATION_PAGE_SIZE,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
if versions.is_empty() {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
for version in versions {
|
||||||
|
after_secret_id = Some(version.secret_version.secret_id.as_str().to_owned());
|
||||||
|
after_version = Some(version.secret_version.version);
|
||||||
|
decrypt_current(&version, current_crypto)?;
|
||||||
|
count += 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Ok(count)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn decrypt_current(
|
||||||
|
version: &SecretVersionRecord,
|
||||||
|
current_crypto: &SecretCrypto,
|
||||||
|
) -> Result<serde_json::Value, CliError> {
|
||||||
|
current_crypto
|
||||||
|
.decrypt_for_epoch(
|
||||||
|
&version.secret_version.key_version,
|
||||||
|
version.master_key_epoch,
|
||||||
|
&version.secret_version.ciphertext,
|
||||||
|
)
|
||||||
|
.map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_rotation_verification_failed",
|
||||||
|
"master_key.rotation",
|
||||||
|
"rerun_rotation_or_abort",
|
||||||
|
)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn active_rotation(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
allowed_states: &[&str],
|
||||||
|
) -> Result<Option<MasterKeyRotationRecord>, CliError> {
|
||||||
|
let status = registry
|
||||||
|
.master_key_rotation_status()
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
Ok(status
|
||||||
|
.rotations
|
||||||
|
.into_iter()
|
||||||
|
.find(|rotation| allowed_states.contains(&rotation.state.as_str())))
|
||||||
|
}
|
||||||
|
|
||||||
|
fn rotation_json(rotation: &MasterKeyRotationRecord) -> serde_json::Value {
|
||||||
|
json!({
|
||||||
|
"id": rotation.id,
|
||||||
|
"source_epoch": rotation.source_epoch,
|
||||||
|
"target_epoch": rotation.target_epoch,
|
||||||
|
"state": rotation.state,
|
||||||
|
"backup_ref": rotation.backup_ref.as_ref().map(|_| "configured"),
|
||||||
|
"checkpoint_secret_id": rotation.checkpoint_secret_id,
|
||||||
|
"total_secret_versions": rotation.total_secret_versions,
|
||||||
|
"processed_secret_versions": rotation.processed_secret_versions,
|
||||||
|
"verified_secret_versions": rotation.verified_secret_versions,
|
||||||
|
"failure_code": rotation.failure_code,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
fn read_required_key_file(path: Option<&str>) -> Result<String, CliError> {
|
||||||
|
let path = path.ok_or_else(|| {
|
||||||
|
CliError::new("invalid_command", "cli.arguments", "run_master_key_status")
|
||||||
|
})?;
|
||||||
|
if path.len() > 512 || path.bytes().any(|byte| byte.is_ascii_control()) {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_input_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let metadata = std::fs::metadata(Path::new(path)).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_input_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if !metadata.is_file() || metadata.len() > 16_384 {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_input_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let value = std::fs::read_to_string(Path::new(path)).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_input_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if value.trim().is_empty() {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_input_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"verify_operator_input",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Ok(value)
|
||||||
|
}
|
||||||
|
fn ensure_no_options(options: &MasterKeyOptions) -> Result<(), CliError> {
|
||||||
|
if options.current_key_file.is_some()
|
||||||
|
|| options.target_key_file.is_some()
|
||||||
|
|| options.backup_ref.is_some()
|
||||||
|
|| options.rotation_id.is_some()
|
||||||
|
|| options.max_versions.is_some()
|
||||||
|
{
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_master_key_status",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,342 @@
|
|||||||
|
use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
|
||||||
|
use crank_community_auth::hash_password;
|
||||||
|
use crank_config::{ConfigSource, parse_migrator};
|
||||||
|
use crank_registry::{
|
||||||
|
CreateAdminBootstrapContractRequest, MASTER_KEY_CIPHER_CONTRACT, PostgresRegistry,
|
||||||
|
RecoverAdminPasswordRequest,
|
||||||
|
};
|
||||||
|
use crank_runtime::SecretCrypto;
|
||||||
|
use rand::RngExt;
|
||||||
|
use serde_json::json;
|
||||||
|
use sha2::{Digest, Sha256};
|
||||||
|
use std::{
|
||||||
|
path::{Path, PathBuf},
|
||||||
|
process::ExitCode,
|
||||||
|
};
|
||||||
|
use time::{Duration as TimeDuration, OffsetDateTime};
|
||||||
|
|
||||||
|
use super::{CliError, db_connect::connect_registry};
|
||||||
|
|
||||||
|
pub(super) async fn run_admin_auth(arguments: &[String]) -> Result<ExitCode, CliError> {
|
||||||
|
let Some(command) = arguments.first().map(String::as_str) else {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_admin_auth_bootstrap_create",
|
||||||
|
));
|
||||||
|
};
|
||||||
|
let options = AdminAuthOptions::parse(&arguments[1..])?;
|
||||||
|
let config = parse_migrator(
|
||||||
|
ConfigSource::from_os_for_migrator()
|
||||||
|
.map_err(|_| CliError::new("config_invalid", "config.source", "run_preflight"))?,
|
||||||
|
)
|
||||||
|
.map_err(|_| CliError::new("config_invalid", "config.validate", "run_preflight"))?;
|
||||||
|
let registry = connect_registry(&config.database).await?;
|
||||||
|
match command {
|
||||||
|
"bootstrap-create" => create_bootstrap_contract(®istry, options).await?,
|
||||||
|
"bootstrap-complete" => complete_bootstrap_contract(®istry, options).await?,
|
||||||
|
"recover" => recover_admin_password(®istry, options).await?,
|
||||||
|
_ => {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_admin_auth_bootstrap_create",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Ok(ExitCode::SUCCESS)
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn complete_bootstrap_contract(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
options: AdminAuthOptions,
|
||||||
|
) -> Result<(), CliError> {
|
||||||
|
let token_path = options
|
||||||
|
.token_file
|
||||||
|
.as_deref()
|
||||||
|
.ok_or_else(|| CliError::new("invalid_command", "cli.arguments", "provide_token_file"))?;
|
||||||
|
let password_path = options.password_file.as_deref().ok_or_else(|| {
|
||||||
|
CliError::new("invalid_command", "cli.arguments", "provide_password_file")
|
||||||
|
})?;
|
||||||
|
let pepper_path = options.password_pepper_file.as_deref().ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"provide_password_pepper_file",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let token = read_secret_file(token_path, "admin_auth.bootstrap_token")?;
|
||||||
|
let password = read_secret_file(password_path, "admin_auth.password")?;
|
||||||
|
let pepper = read_secret_file(pepper_path, "admin_auth.password_pepper")?;
|
||||||
|
if !(32..=256).contains(&token.len())
|
||||||
|
|| !(12..=256).contains(&password.len())
|
||||||
|
|| pepper.is_empty()
|
||||||
|
|| pepper.len() > 1_024
|
||||||
|
{
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"provide_bounded_secret_files",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
let token_hash = admin_auth_hash("bootstrap", &token);
|
||||||
|
let password_hash = hash_password(&password, &pepper).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"admin_bootstrap_rejected",
|
||||||
|
"admin_auth.bootstrap",
|
||||||
|
"verify_local_inputs",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
let user_id = registry
|
||||||
|
.consume_admin_bootstrap_contract(crank_registry::ConsumeAdminBootstrapContractRequest {
|
||||||
|
token_hash: &token_hash,
|
||||||
|
password_hash: &password_hash,
|
||||||
|
now: &now,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": "bootstrap_completed",
|
||||||
|
"user_id": user_id.as_str()
|
||||||
|
})
|
||||||
|
);
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn recover_admin_password(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
options: AdminAuthOptions,
|
||||||
|
) -> Result<(), CliError> {
|
||||||
|
let email = options
|
||||||
|
.email
|
||||||
|
.as_deref()
|
||||||
|
.ok_or_else(|| CliError::new("invalid_command", "cli.arguments", "provide_email"))?;
|
||||||
|
let password_path = options.password_file.as_deref().ok_or_else(|| {
|
||||||
|
CliError::new("invalid_command", "cli.arguments", "provide_password_file")
|
||||||
|
})?;
|
||||||
|
let pepper_path = options.password_pepper_file.as_deref().ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"provide_password_pepper_file",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let master_key_path = options.master_key_file.as_deref().ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"provide_master_key_file",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
|
||||||
|
let master_key = read_secret_file(master_key_path, "master_key.input")?;
|
||||||
|
let active = registry
|
||||||
|
.active_master_key_identity()
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?
|
||||||
|
.ok_or_else(|| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_identity_missing",
|
||||||
|
"master_key.identity",
|
||||||
|
"start_service_once_with_current_master_key",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let crypto = SecretCrypto::with_epoch(&master_key, active.epoch).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"master_key_invalid",
|
||||||
|
"master_key.input",
|
||||||
|
"provide_current_master_key_file",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if active.cipher_contract != MASTER_KEY_CIPHER_CONTRACT
|
||||||
|
|| active.fingerprint != crypto.master_key_fingerprint()
|
||||||
|
{
|
||||||
|
return Err(CliError::new(
|
||||||
|
"master_key_identity_mismatch",
|
||||||
|
"master_key.identity",
|
||||||
|
"use_matching_master_key",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
let password = read_secret_file(password_path, "admin_auth.password")?;
|
||||||
|
let pepper = read_secret_file(pepper_path, "admin_auth.password_pepper")?;
|
||||||
|
if !(12..=256).contains(&password.len()) || pepper.is_empty() || pepper.len() > 1_024 {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"provide_bounded_secret_files",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let password_hash = hash_password(&password, &pepper).map_err(|_| {
|
||||||
|
CliError::new(
|
||||||
|
"admin_recovery_rejected",
|
||||||
|
"admin_auth.recovery",
|
||||||
|
"verify_local_inputs",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let audit_id = format!("audit_{}", uuid::Uuid::now_v7().simple());
|
||||||
|
let user_id = registry
|
||||||
|
.recover_admin_password(RecoverAdminPasswordRequest {
|
||||||
|
email,
|
||||||
|
password_hash: &password_hash,
|
||||||
|
audit_id: &audit_id,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": "admin_recovered",
|
||||||
|
"user_id": user_id.as_str(),
|
||||||
|
"sessions_revoked": true,
|
||||||
|
"audit_id": audit_id
|
||||||
|
})
|
||||||
|
);
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn create_bootstrap_contract(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
options: AdminAuthOptions,
|
||||||
|
) -> Result<(), CliError> {
|
||||||
|
let email = options
|
||||||
|
.email
|
||||||
|
.as_deref()
|
||||||
|
.ok_or_else(|| CliError::new("invalid_command", "cli.arguments", "provide_email"))?;
|
||||||
|
let display_name = options.display_name.as_deref().unwrap_or("Crank Owner");
|
||||||
|
let ttl_seconds = options.ttl_seconds.unwrap_or(900);
|
||||||
|
if !(60..=86_400).contains(&ttl_seconds) {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"set_ttl_between_60_and_86400",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let token = random_token();
|
||||||
|
let contract_id = format!("boot_{}", uuid::Uuid::now_v7().simple());
|
||||||
|
let token_hash = admin_auth_hash("bootstrap", &token);
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
let expires_at = now
|
||||||
|
.checked_add(TimeDuration::seconds(ttl_seconds))
|
||||||
|
.ok_or_else(|| CliError::new("invalid_command", "cli.arguments", "reduce_ttl"))?;
|
||||||
|
let contract = registry
|
||||||
|
.create_admin_bootstrap_contract(CreateAdminBootstrapContractRequest {
|
||||||
|
id: &contract_id,
|
||||||
|
token_hash: &token_hash,
|
||||||
|
email,
|
||||||
|
display_name,
|
||||||
|
expires_at: &expires_at,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.map_err(CliError::from_registry)?;
|
||||||
|
println!(
|
||||||
|
"{}",
|
||||||
|
json!({
|
||||||
|
"status": "bootstrap_created",
|
||||||
|
"contract_id": contract.id,
|
||||||
|
"expires_at": contract.expires_at,
|
||||||
|
"bootstrap_token": token,
|
||||||
|
"warning": "copy_once_token_not_logged_by_services"
|
||||||
|
})
|
||||||
|
);
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Default)]
|
||||||
|
struct AdminAuthOptions {
|
||||||
|
email: Option<String>,
|
||||||
|
display_name: Option<String>,
|
||||||
|
ttl_seconds: Option<i64>,
|
||||||
|
token_file: Option<PathBuf>,
|
||||||
|
password_file: Option<PathBuf>,
|
||||||
|
password_pepper_file: Option<PathBuf>,
|
||||||
|
master_key_file: Option<PathBuf>,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl AdminAuthOptions {
|
||||||
|
fn parse(arguments: &[String]) -> Result<Self, CliError> {
|
||||||
|
let mut options = Self::default();
|
||||||
|
let mut index = 0;
|
||||||
|
while index < arguments.len() {
|
||||||
|
let key = arguments[index].as_str();
|
||||||
|
let Some(value) = arguments.get(index + 1) else {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_admin_auth_bootstrap_create",
|
||||||
|
));
|
||||||
|
};
|
||||||
|
match key {
|
||||||
|
"--email" => options.email = Some(value.clone()),
|
||||||
|
"--display-name" => options.display_name = Some(value.clone()),
|
||||||
|
"--ttl-seconds" => {
|
||||||
|
options.ttl_seconds = Some(value.parse::<i64>().map_err(|_| {
|
||||||
|
CliError::new("invalid_command", "cli.arguments", "set_ttl_seconds")
|
||||||
|
})?);
|
||||||
|
}
|
||||||
|
"--password-file" => options.password_file = Some(PathBuf::from(value)),
|
||||||
|
"--token-file" => options.token_file = Some(PathBuf::from(value)),
|
||||||
|
"--password-pepper-file" => {
|
||||||
|
options.password_pepper_file = Some(PathBuf::from(value));
|
||||||
|
}
|
||||||
|
"--master-key-file" => options.master_key_file = Some(PathBuf::from(value)),
|
||||||
|
_ => {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
"cli.arguments",
|
||||||
|
"run_admin_auth_bootstrap_create",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
index += 2;
|
||||||
|
}
|
||||||
|
Ok(options)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn read_secret_file(path: &Path, stage: &'static str) -> Result<String, CliError> {
|
||||||
|
let metadata = std::fs::metadata(path)
|
||||||
|
.map_err(|_| CliError::new("invalid_command", stage, "provide_readable_secret_file"))?;
|
||||||
|
if !metadata.is_file() || metadata.len() > 8_192 {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
stage,
|
||||||
|
"provide_bounded_secret_file",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let bytes = std::fs::read(path)
|
||||||
|
.map_err(|_| CliError::new("invalid_command", stage, "provide_readable_secret_file"))?;
|
||||||
|
if bytes.len() > 8_192 {
|
||||||
|
return Err(CliError::new(
|
||||||
|
"invalid_command",
|
||||||
|
stage,
|
||||||
|
"provide_bounded_secret_file",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let mut value = String::from_utf8(bytes)
|
||||||
|
.map_err(|_| CliError::new("invalid_command", stage, "provide_utf8_secret_file"))?;
|
||||||
|
if value.ends_with("\r\n") {
|
||||||
|
value.truncate(value.len() - 2);
|
||||||
|
} else if value.ends_with('\n') {
|
||||||
|
value.truncate(value.len() - 1);
|
||||||
|
}
|
||||||
|
Ok(value)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn random_token() -> String {
|
||||||
|
let mut bytes = [0_u8; 32];
|
||||||
|
rand::rng().fill(&mut bytes);
|
||||||
|
URL_SAFE_NO_PAD.encode(bytes)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn admin_auth_hash(scope: &str, token: &str) -> String {
|
||||||
|
let mut digest = Sha256::new();
|
||||||
|
digest.update(scope.as_bytes());
|
||||||
|
digest.update(b":");
|
||||||
|
digest.update(token.as_bytes());
|
||||||
|
URL_SAFE_NO_PAD.encode(digest.finalize())
|
||||||
|
}
|
||||||
@@ -0,0 +1,78 @@
|
|||||||
|
use crank_config::DatabaseSettings;
|
||||||
|
use crank_registry::{PostgresPoolConfig, PostgresRegistry, RegistryError};
|
||||||
|
use sqlx::{
|
||||||
|
PgPool,
|
||||||
|
postgres::{PgConnectOptions, PgPoolOptions},
|
||||||
|
};
|
||||||
|
use std::time::Duration;
|
||||||
|
|
||||||
|
use super::CliError;
|
||||||
|
|
||||||
|
pub(super) async fn connect(config: &DatabaseSettings) -> Result<PgPool, CliError> {
|
||||||
|
let options = connect_options(config)?;
|
||||||
|
for attempt in 1..=10 {
|
||||||
|
let result = PgPoolOptions::new()
|
||||||
|
.max_connections(config.pool.max_connections)
|
||||||
|
.min_connections(config.pool.min_connections)
|
||||||
|
.acquire_timeout(Duration::from_millis(config.pool.acquire_timeout_ms))
|
||||||
|
.idle_timeout(Duration::from_millis(config.pool.idle_timeout_ms))
|
||||||
|
.max_lifetime(Duration::from_millis(config.pool.max_lifetime_ms))
|
||||||
|
.connect_with(options.clone())
|
||||||
|
.await;
|
||||||
|
match result {
|
||||||
|
Ok(pool) => return Ok(pool),
|
||||||
|
Err(_) if attempt < 10 => tokio::time::sleep(Duration::from_secs(1)).await,
|
||||||
|
Err(_) => break,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Err(CliError::new(
|
||||||
|
"storage_unavailable",
|
||||||
|
"database.connect",
|
||||||
|
"contact_operator",
|
||||||
|
))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) async fn connect_registry(
|
||||||
|
config: &DatabaseSettings,
|
||||||
|
) -> Result<PostgresRegistry, CliError> {
|
||||||
|
let options = connect_options(config)?;
|
||||||
|
let pool_config = PostgresPoolConfig {
|
||||||
|
max_connections: config.pool.max_connections,
|
||||||
|
min_connections: config.pool.min_connections,
|
||||||
|
acquire_timeout_ms: config.pool.acquire_timeout_ms,
|
||||||
|
idle_timeout_ms: config.pool.idle_timeout_ms,
|
||||||
|
max_lifetime_ms: config.pool.max_lifetime_ms,
|
||||||
|
};
|
||||||
|
for attempt in 1..=10 {
|
||||||
|
let result =
|
||||||
|
PostgresRegistry::connect_with_options_and_pool_config(options.clone(), pool_config)
|
||||||
|
.await;
|
||||||
|
match result {
|
||||||
|
Ok(registry) => return Ok(registry),
|
||||||
|
Err(RegistryError::Storage(_)) if attempt < 10 => {
|
||||||
|
tokio::time::sleep(Duration::from_secs(1)).await;
|
||||||
|
}
|
||||||
|
Err(error) => return Err(CliError::from_registry(error)),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Err(CliError::new(
|
||||||
|
"storage_unavailable",
|
||||||
|
"database.connect",
|
||||||
|
"contact_operator",
|
||||||
|
))
|
||||||
|
}
|
||||||
|
|
||||||
|
fn connect_options(config: &DatabaseSettings) -> Result<PgConnectOptions, CliError> {
|
||||||
|
if let Some(url) = &config.url {
|
||||||
|
url.expose_secret()
|
||||||
|
.parse::<PgConnectOptions>()
|
||||||
|
.map_err(|_| CliError::new("config_invalid", "database.source", "run_preflight"))
|
||||||
|
} else {
|
||||||
|
Ok(PgConnectOptions::new()
|
||||||
|
.host(&config.host)
|
||||||
|
.port(config.port)
|
||||||
|
.database(&config.database)
|
||||||
|
.username(&config.username)
|
||||||
|
.password(config.password.expose_secret()))
|
||||||
|
}
|
||||||
|
}
|
||||||
+168
-6
@@ -1,13 +1,15 @@
|
|||||||
use crank_core::{
|
use crank_core::{
|
||||||
AgentId, AgentStatus, ApprovalRequestStatus, AuthConfig, AuthKind, ExecutionMode, ExportMode,
|
AgentId, AgentStatus, ApprovalRequestStatus, AuthConfig, AuthKind, ExecutionMode, ExportMode,
|
||||||
GeneratedDraft, InvocationLevel, InvocationSource, InvocationStatus, OperationSecurityLevel,
|
GeneratedDraft, InvocationLevel, InvocationSource, InvocationStatus, OperationAvailability,
|
||||||
OperationStatus, PlatformApiKeyKind, PlatformApiKeyScope, Protocol, SecretKind, Target,
|
OperationSecurityLevel, OperationStatus, OperationVersionState, PlatformApiKeyKind,
|
||||||
ToolSelectionPolicy, UsagePeriod, WizardState, WorkspaceId, WorkspaceStatus,
|
PlatformApiKeyScope, Protocol, SecretKind, Target, ToolSelectionPolicy, UsagePeriod,
|
||||||
|
WizardState, WorkspaceId, WorkspaceStatus,
|
||||||
};
|
};
|
||||||
use crank_mapping::MappingSet;
|
use crank_mapping::MappingSet;
|
||||||
use crank_registry::{
|
use crank_registry::{
|
||||||
PlatformApiKeyRecord, RegistryOperation, UsageAgentBreakdown, UsageOperationBreakdown,
|
InvocationLogRecord, PlatformApiKeyRecord, RegistryOperation, UsageAgentBreakdown,
|
||||||
UsageSummary, UsageTimelinePoint, WorkspaceMembershipRecord, WorkspaceRecord,
|
UsageOperationBreakdown, UsageOutcomeGroup, UsageSummary, UsageTimelinePoint,
|
||||||
|
WorkspaceMembershipRecord, WorkspaceRecord,
|
||||||
};
|
};
|
||||||
use crank_schema::Schema;
|
use crank_schema::Schema;
|
||||||
use serde::{Deserialize, Serialize};
|
use serde::{Deserialize, Serialize};
|
||||||
@@ -19,11 +21,23 @@ pub struct LoginPayload {
|
|||||||
pub password: String,
|
pub password: String,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
|
pub struct CompleteBootstrapPayload {
|
||||||
|
pub token: String,
|
||||||
|
pub password: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct BootstrapStatusResponse {
|
||||||
|
pub bootstrap_required: bool,
|
||||||
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Serialize)]
|
#[derive(Clone, Debug, Serialize)]
|
||||||
pub struct SessionResponse {
|
pub struct SessionResponse {
|
||||||
pub user: crank_core::User,
|
pub user: crank_core::User,
|
||||||
pub memberships: Vec<WorkspaceMembershipRecord>,
|
pub memberships: Vec<WorkspaceMembershipRecord>,
|
||||||
pub current_workspace_id: Option<String>,
|
pub current_workspace_id: Option<String>,
|
||||||
|
pub csrf_token: String,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Deserialize)]
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
@@ -80,12 +94,19 @@ pub struct PublishPayload {
|
|||||||
pub struct TestRunPayload {
|
pub struct TestRunPayload {
|
||||||
pub version: u32,
|
pub version: u32,
|
||||||
pub input: Value,
|
pub input: Value,
|
||||||
|
#[serde(default)]
|
||||||
|
pub confirmation_token: Option<String>,
|
||||||
|
#[serde(default)]
|
||||||
|
pub locale: Option<String>,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Serialize)]
|
#[derive(Clone, Debug, Serialize)]
|
||||||
pub struct TestRunResult {
|
pub struct TestRunResult {
|
||||||
pub ok: bool,
|
pub ok: bool,
|
||||||
pub mode: ExecutionMode,
|
pub mode: ExecutionMode,
|
||||||
|
pub tested_version: u32,
|
||||||
|
pub request_id: String,
|
||||||
|
pub trace_id: String,
|
||||||
pub request_preview: Value,
|
pub request_preview: Value,
|
||||||
pub response_preview: Value,
|
pub response_preview: Value,
|
||||||
pub errors: Vec<Value>,
|
pub errors: Vec<Value>,
|
||||||
@@ -228,6 +249,7 @@ pub struct AgentSummaryView {
|
|||||||
pub status: AgentStatus,
|
pub status: AgentStatus,
|
||||||
pub current_draft_version: u32,
|
pub current_draft_version: u32,
|
||||||
pub latest_published_version: Option<u32>,
|
pub latest_published_version: Option<u32>,
|
||||||
|
pub catalog_revision: i64,
|
||||||
pub created_at: String,
|
pub created_at: String,
|
||||||
pub updated_at: String,
|
pub updated_at: String,
|
||||||
pub published_at: Option<String>,
|
pub published_at: Option<String>,
|
||||||
@@ -266,6 +288,91 @@ fn default_platform_api_key_kind() -> PlatformApiKeyKind {
|
|||||||
pub struct CreatedPlatformApiKeyResponse {
|
pub struct CreatedPlatformApiKeyResponse {
|
||||||
pub api_key: PlatformApiKeyRecord,
|
pub api_key: PlatformApiKeyRecord,
|
||||||
pub secret: String,
|
pub secret: String,
|
||||||
|
#[serde(skip_serializing_if = "Option::is_none")]
|
||||||
|
pub connection: Option<EphemeralMcpConnection>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct EphemeralMcpClientConfig {
|
||||||
|
pub client: String,
|
||||||
|
pub config: Value,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct EphemeralMcpConnection {
|
||||||
|
pub endpoint: String,
|
||||||
|
pub clients: Vec<EphemeralMcpClientConfig>,
|
||||||
|
pub secret_display: &'static str,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
|
#[serde(deny_unknown_fields)]
|
||||||
|
pub struct OnboardingEventPayload {
|
||||||
|
pub event: String,
|
||||||
|
pub idempotency_key: String,
|
||||||
|
pub expected_revision: i64,
|
||||||
|
#[serde(default)]
|
||||||
|
pub completed_steps: Option<Value>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct OnboardingStepView {
|
||||||
|
pub id: crank_core::OnboardingStepId,
|
||||||
|
pub completed: bool,
|
||||||
|
pub status: String,
|
||||||
|
pub action_code: String,
|
||||||
|
pub reason_code: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct OnboardingFirstCallEvidence {
|
||||||
|
pub log_id: String,
|
||||||
|
pub agent_id: String,
|
||||||
|
pub key_id: String,
|
||||||
|
pub operation_id: String,
|
||||||
|
pub operation_version: u32,
|
||||||
|
pub tool_name: String,
|
||||||
|
pub occurred_at: String,
|
||||||
|
pub request_id: Option<String>,
|
||||||
|
pub trace_id: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct OnboardingResponse {
|
||||||
|
pub schema_version: u16,
|
||||||
|
pub workspace_id: String,
|
||||||
|
pub revision: i64,
|
||||||
|
pub status: String,
|
||||||
|
pub completed: bool,
|
||||||
|
pub eligible_since: Option<String>,
|
||||||
|
pub steps: Vec<OnboardingStepView>,
|
||||||
|
pub operation_id: Option<String>,
|
||||||
|
pub operation_version: Option<u32>,
|
||||||
|
pub agent_id: Option<String>,
|
||||||
|
pub catalog_revision: Option<i64>,
|
||||||
|
pub platform_api_key_id: Option<String>,
|
||||||
|
pub mcp_endpoint: Option<String>,
|
||||||
|
pub first_call: Option<OnboardingFirstCallEvidence>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct OnboardingEventResponse {
|
||||||
|
pub accepted: bool,
|
||||||
|
#[serde(flatten)]
|
||||||
|
pub onboarding: OnboardingResponse,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
|
#[serde(deny_unknown_fields)]
|
||||||
|
pub struct ResetOnboardingSelectionPayload {
|
||||||
|
pub expected_revision: i64,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct ResetOnboardingSelectionResponse {
|
||||||
|
pub selection_reset: bool,
|
||||||
|
#[serde(flatten)]
|
||||||
|
pub onboarding: OnboardingResponse,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Serialize)]
|
#[derive(Clone, Debug, Serialize)]
|
||||||
@@ -285,11 +392,16 @@ pub struct WorkspaceCatalogSnapshotResponse {
|
|||||||
#[derive(Clone, Debug, Deserialize)]
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
pub struct LogsQuery {
|
pub struct LogsQuery {
|
||||||
pub level: Option<InvocationLevel>,
|
pub level: Option<InvocationLevel>,
|
||||||
|
pub status: Option<InvocationStatus>,
|
||||||
|
pub outcome_group: Option<UsageOutcomeGroup>,
|
||||||
pub search: Option<String>,
|
pub search: Option<String>,
|
||||||
pub source: Option<InvocationSource>,
|
pub source: Option<InvocationSource>,
|
||||||
pub operation_id: Option<String>,
|
pub operation_id: Option<String>,
|
||||||
pub agent_id: Option<String>,
|
pub agent_id: Option<String>,
|
||||||
pub period: Option<UsagePeriod>,
|
pub period: Option<UsagePeriod>,
|
||||||
|
pub created_after: Option<String>,
|
||||||
|
pub created_before: Option<String>,
|
||||||
|
pub cursor: Option<String>,
|
||||||
pub limit: Option<u32>,
|
pub limit: Option<u32>,
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -299,10 +411,19 @@ pub struct ApprovalsQuery {
|
|||||||
pub limit: Option<u32>,
|
pub limit: Option<u32>,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
|
pub struct ApprovalDecisionPayload {
|
||||||
|
pub approve: String,
|
||||||
|
#[serde(default)]
|
||||||
|
pub note: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Deserialize)]
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
pub struct UsageRequestQuery {
|
pub struct UsageRequestQuery {
|
||||||
pub period: Option<UsagePeriod>,
|
pub period: Option<UsagePeriod>,
|
||||||
pub source: Option<InvocationSource>,
|
pub source: Option<InvocationSource>,
|
||||||
|
pub created_after: Option<String>,
|
||||||
|
pub created_before: Option<String>,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Serialize)]
|
#[derive(Clone, Debug, Serialize)]
|
||||||
@@ -311,6 +432,13 @@ pub struct UsageOverviewResponse {
|
|||||||
pub timeline: Vec<UsageTimelinePoint>,
|
pub timeline: Vec<UsageTimelinePoint>,
|
||||||
pub operations: Vec<UsageOperationBreakdown>,
|
pub operations: Vec<UsageOperationBreakdown>,
|
||||||
pub agents: Vec<UsageAgentBreakdown>,
|
pub agents: Vec<UsageAgentBreakdown>,
|
||||||
|
pub outcomes: Vec<crank_registry::UsageOutcomeBreakdown>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Serialize)]
|
||||||
|
pub struct LogsListResponse {
|
||||||
|
pub items: Vec<InvocationLogRecord>,
|
||||||
|
pub next_cursor: Option<String>,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Serialize)]
|
#[derive(Clone, Debug, Serialize)]
|
||||||
@@ -362,7 +490,35 @@ pub struct ExportQuery {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Deserialize, Serialize)]
|
#[derive(Clone, Debug, Deserialize, Serialize)]
|
||||||
|
#[serde(deny_unknown_fields)]
|
||||||
pub struct YamlOperationDocument {
|
pub struct YamlOperationDocument {
|
||||||
|
pub format_version: String,
|
||||||
|
pub kind: String,
|
||||||
|
pub operation: PortableOperation,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Deserialize, Serialize)]
|
||||||
|
#[serde(deny_unknown_fields)]
|
||||||
|
pub struct PortableOperation {
|
||||||
|
pub name: String,
|
||||||
|
pub display_name: String,
|
||||||
|
#[serde(default = "default_operation_category")]
|
||||||
|
pub category: String,
|
||||||
|
pub protocol: Protocol,
|
||||||
|
#[serde(default)]
|
||||||
|
pub security_level: OperationSecurityLevel,
|
||||||
|
pub target: Target,
|
||||||
|
pub input_schema: Schema,
|
||||||
|
pub output_schema: Schema,
|
||||||
|
pub input_mapping: MappingSet,
|
||||||
|
pub output_mapping: MappingSet,
|
||||||
|
pub execution_config: crank_core::ExecutionConfig,
|
||||||
|
pub tool_description: crank_core::ToolDescription,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Debug, Deserialize)]
|
||||||
|
#[serde(deny_unknown_fields)]
|
||||||
|
pub struct LegacyYamlOperationDocument {
|
||||||
pub format_version: String,
|
pub format_version: String,
|
||||||
pub kind: String,
|
pub kind: String,
|
||||||
pub operation: RegistryOperation,
|
pub operation: RegistryOperation,
|
||||||
@@ -473,6 +629,7 @@ pub struct OperationSummaryView {
|
|||||||
pub status: OperationStatus,
|
pub status: OperationStatus,
|
||||||
pub current_draft_version: u32,
|
pub current_draft_version: u32,
|
||||||
pub latest_published_version: Option<u32>,
|
pub latest_published_version: Option<u32>,
|
||||||
|
pub can_delete: bool,
|
||||||
pub created_at: String,
|
pub created_at: String,
|
||||||
pub updated_at: String,
|
pub updated_at: String,
|
||||||
pub published_at: Option<String>,
|
pub published_at: Option<String>,
|
||||||
@@ -490,6 +647,7 @@ pub struct OperationDetailView {
|
|||||||
pub protocol: Protocol,
|
pub protocol: Protocol,
|
||||||
pub security_level: OperationSecurityLevel,
|
pub security_level: OperationSecurityLevel,
|
||||||
pub status: OperationStatus,
|
pub status: OperationStatus,
|
||||||
|
pub availability: OperationAvailability,
|
||||||
pub current_draft_version: u32,
|
pub current_draft_version: u32,
|
||||||
pub latest_published_version: Option<u32>,
|
pub latest_published_version: Option<u32>,
|
||||||
pub created_at: String,
|
pub created_at: String,
|
||||||
@@ -503,7 +661,7 @@ pub struct OperationDetailView {
|
|||||||
#[derive(Clone, Debug, Serialize)]
|
#[derive(Clone, Debug, Serialize)]
|
||||||
pub struct VersionRef {
|
pub struct VersionRef {
|
||||||
pub version: u32,
|
pub version: u32,
|
||||||
pub status: OperationStatus,
|
pub status: OperationVersionState,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Clone, Debug, Serialize)]
|
#[derive(Clone, Debug, Serialize)]
|
||||||
@@ -558,6 +716,10 @@ pub(crate) struct InvocationRecordRequest<'a> {
|
|||||||
pub message: String,
|
pub message: String,
|
||||||
pub status_code: Option<u16>,
|
pub status_code: Option<u16>,
|
||||||
pub error_kind: Option<String>,
|
pub error_kind: Option<String>,
|
||||||
|
pub execution_stage: Option<crank_core::ExecutionStage>,
|
||||||
|
pub execution_error_code: Option<crank_core::ExecutionErrorCode>,
|
||||||
|
pub retryability: Option<crank_core::Retryability>,
|
||||||
|
pub outcome_certainty: Option<crank_core::OutcomeCertainty>,
|
||||||
pub duration_ms: u64,
|
pub duration_ms: u64,
|
||||||
pub request_preview: Value,
|
pub request_preview: Value,
|
||||||
pub response_preview: Value,
|
pub response_preview: Value,
|
||||||
|
|||||||
+257
-114
@@ -31,6 +31,11 @@ pub enum ApiError {
|
|||||||
context: Option<Value>,
|
context: Option<Value>,
|
||||||
},
|
},
|
||||||
#[error("{message}")]
|
#[error("{message}")]
|
||||||
|
Unprocessable {
|
||||||
|
message: String,
|
||||||
|
context: Option<Value>,
|
||||||
|
},
|
||||||
|
#[error("{message}")]
|
||||||
NotFound {
|
NotFound {
|
||||||
message: String,
|
message: String,
|
||||||
context: Option<Value>,
|
context: Option<Value>,
|
||||||
@@ -41,6 +46,16 @@ pub enum ApiError {
|
|||||||
context: Option<Value>,
|
context: Option<Value>,
|
||||||
},
|
},
|
||||||
#[error("{message}")]
|
#[error("{message}")]
|
||||||
|
PayloadTooLarge {
|
||||||
|
message: String,
|
||||||
|
context: Option<Value>,
|
||||||
|
},
|
||||||
|
#[error("{message}")]
|
||||||
|
PreconditionRequired {
|
||||||
|
message: String,
|
||||||
|
context: Option<Value>,
|
||||||
|
},
|
||||||
|
#[error("{message}")]
|
||||||
RateLimited {
|
RateLimited {
|
||||||
message: String,
|
message: String,
|
||||||
context: Option<Value>,
|
context: Option<Value>,
|
||||||
@@ -95,6 +110,13 @@ impl ApiError {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub(crate) fn unprocessable_with_context(message: impl Into<String>, context: Value) -> Self {
|
||||||
|
Self::Unprocessable {
|
||||||
|
message: message.into(),
|
||||||
|
context: Some(context),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
pub(crate) fn not_found_with_context(message: impl Into<String>, context: Value) -> Self {
|
pub(crate) fn not_found_with_context(message: impl Into<String>, context: Value) -> Self {
|
||||||
Self::NotFound {
|
Self::NotFound {
|
||||||
message: message.into(),
|
message: message.into(),
|
||||||
@@ -109,25 +131,58 @@ impl ApiError {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub(crate) fn payload_too_large_with_context(
|
||||||
|
message: impl Into<String>,
|
||||||
|
context: Value,
|
||||||
|
) -> Self {
|
||||||
|
Self::PayloadTooLarge {
|
||||||
|
message: message.into(),
|
||||||
|
context: Some(context),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(crate) fn precondition_required_with_context(
|
||||||
|
message: impl Into<String>,
|
||||||
|
context: Value,
|
||||||
|
) -> Self {
|
||||||
|
Self::PreconditionRequired {
|
||||||
|
message: message.into(),
|
||||||
|
context: Some(context),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
fn status_code(&self) -> StatusCode {
|
fn status_code(&self) -> StatusCode {
|
||||||
match self {
|
match self {
|
||||||
Self::Unauthorized { .. } => StatusCode::UNAUTHORIZED,
|
Self::Unauthorized { .. } => StatusCode::UNAUTHORIZED,
|
||||||
Self::Forbidden { .. } => StatusCode::FORBIDDEN,
|
Self::Forbidden { .. } => StatusCode::FORBIDDEN,
|
||||||
Self::Validation { .. } => StatusCode::BAD_REQUEST,
|
Self::Validation { .. } => StatusCode::BAD_REQUEST,
|
||||||
|
Self::Unprocessable { .. } => StatusCode::UNPROCESSABLE_ENTITY,
|
||||||
Self::NotFound { .. } => StatusCode::NOT_FOUND,
|
Self::NotFound { .. } => StatusCode::NOT_FOUND,
|
||||||
Self::Conflict { .. } => StatusCode::CONFLICT,
|
Self::Conflict { .. } => StatusCode::CONFLICT,
|
||||||
|
Self::PayloadTooLarge { .. } => StatusCode::PAYLOAD_TOO_LARGE,
|
||||||
|
Self::PreconditionRequired { .. } => StatusCode::PRECONDITION_REQUIRED,
|
||||||
Self::RateLimited { .. } => StatusCode::TOO_MANY_REQUESTS,
|
Self::RateLimited { .. } => StatusCode::TOO_MANY_REQUESTS,
|
||||||
Self::Internal { .. } => StatusCode::INTERNAL_SERVER_ERROR,
|
Self::Internal { .. } => StatusCode::INTERNAL_SERVER_ERROR,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn code(&self) -> &'static str {
|
pub(crate) fn code(&self) -> &str {
|
||||||
|
if let Some(code) = self
|
||||||
|
.context_ref()
|
||||||
|
.and_then(|context| context.get("error_code"))
|
||||||
|
.and_then(Value::as_str)
|
||||||
|
{
|
||||||
|
return code;
|
||||||
|
}
|
||||||
match self {
|
match self {
|
||||||
Self::Unauthorized { .. } => "unauthorized",
|
Self::Unauthorized { .. } => "unauthorized",
|
||||||
Self::Forbidden { .. } => "forbidden",
|
Self::Forbidden { .. } => "forbidden",
|
||||||
Self::Validation { .. } => "validation_error",
|
Self::Validation { .. } => "validation_error",
|
||||||
|
Self::Unprocessable { .. } => "unprocessable_entity",
|
||||||
Self::NotFound { .. } => "not_found",
|
Self::NotFound { .. } => "not_found",
|
||||||
Self::Conflict { .. } => "conflict",
|
Self::Conflict { .. } => "conflict",
|
||||||
|
Self::PayloadTooLarge { .. } => "payload_too_large",
|
||||||
|
Self::PreconditionRequired { .. } => "precondition_required",
|
||||||
Self::RateLimited { .. } => "rate_limited",
|
Self::RateLimited { .. } => "rate_limited",
|
||||||
Self::Internal { .. } => "internal_error",
|
Self::Internal { .. } => "internal_error",
|
||||||
}
|
}
|
||||||
@@ -147,8 +202,11 @@ impl IntoResponse for ApiError {
|
|||||||
Self::Unauthorized { .. }
|
Self::Unauthorized { .. }
|
||||||
| Self::Forbidden { .. }
|
| Self::Forbidden { .. }
|
||||||
| Self::Validation { .. }
|
| Self::Validation { .. }
|
||||||
|
| Self::Unprocessable { .. }
|
||||||
| Self::NotFound { .. }
|
| Self::NotFound { .. }
|
||||||
| Self::Conflict { .. }
|
| Self::Conflict { .. }
|
||||||
|
| Self::PayloadTooLarge { .. }
|
||||||
|
| Self::PreconditionRequired { .. }
|
||||||
| Self::RateLimited { .. } => {
|
| Self::RateLimited { .. } => {
|
||||||
warn!(
|
warn!(
|
||||||
name: "admin.response.rejected",
|
name: "admin.response.rejected",
|
||||||
@@ -182,17 +240,24 @@ impl IntoResponse for ApiError {
|
|||||||
}
|
}
|
||||||
|
|
||||||
impl ApiError {
|
impl ApiError {
|
||||||
fn context(&self) -> Option<Value> {
|
fn context_ref(&self) -> Option<&Value> {
|
||||||
match self {
|
match self {
|
||||||
Self::Unauthorized { context, .. }
|
Self::Unauthorized { context, .. }
|
||||||
| Self::Forbidden { context, .. }
|
| Self::Forbidden { context, .. }
|
||||||
| Self::Validation { context, .. }
|
| Self::Validation { context, .. }
|
||||||
|
| Self::Unprocessable { context, .. }
|
||||||
| Self::NotFound { context, .. }
|
| Self::NotFound { context, .. }
|
||||||
| Self::Conflict { context, .. }
|
| Self::Conflict { context, .. }
|
||||||
|
| Self::PayloadTooLarge { context, .. }
|
||||||
|
| Self::PreconditionRequired { context, .. }
|
||||||
| Self::RateLimited { context, .. }
|
| Self::RateLimited { context, .. }
|
||||||
| Self::Internal { context, .. } => context.clone(),
|
| Self::Internal { context, .. } => context.as_ref(),
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn context(&self) -> Option<Value> {
|
||||||
|
self.context_ref().cloned()
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
impl From<RegistryError> for ApiError {
|
impl From<RegistryError> for ApiError {
|
||||||
@@ -228,10 +293,41 @@ impl From<RegistryError> for ApiError {
|
|||||||
format!("platform api key {key_id} was not found"),
|
format!("platform api key {key_id} was not found"),
|
||||||
json!({ "key_id": key_id }),
|
json!({ "key_id": key_id }),
|
||||||
),
|
),
|
||||||
|
RegistryError::PlatformApiKeyInactive { key_id } => Self::conflict_with_context(
|
||||||
|
"platform api key is not active",
|
||||||
|
json!({
|
||||||
|
"key_id": key_id,
|
||||||
|
"error_code": "platform_api_key_not_active",
|
||||||
|
"recovery": "create_replacement_key"
|
||||||
|
}),
|
||||||
|
),
|
||||||
RegistryError::SecretNotFound { secret_id } => Self::not_found_with_context(
|
RegistryError::SecretNotFound { secret_id } => Self::not_found_with_context(
|
||||||
format!("secret {secret_id} was not found"),
|
format!("secret {secret_id} was not found"),
|
||||||
json!({ "secret_id": secret_id }),
|
json!({ "secret_id": secret_id }),
|
||||||
),
|
),
|
||||||
|
RegistryError::SecretInactive { secret_id } => Self::conflict_with_context(
|
||||||
|
"secret is not active",
|
||||||
|
json!({
|
||||||
|
"secret_id": secret_id,
|
||||||
|
"error_code": "secret_not_active",
|
||||||
|
"recovery": "rotate_or_replace_secret"
|
||||||
|
}),
|
||||||
|
),
|
||||||
|
RegistryError::SecretConcurrentUpdate { secret_id } => Self::conflict_with_context(
|
||||||
|
"secret was updated concurrently",
|
||||||
|
json!({
|
||||||
|
"secret_id": secret_id,
|
||||||
|
"error_code": "secret_concurrent_update",
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
),
|
||||||
|
RegistryError::MasterKeyRotationInProgress => Self::conflict_with_context(
|
||||||
|
"master key rotation is in progress",
|
||||||
|
json!({
|
||||||
|
"error_code": "master_key_rotation_in_progress",
|
||||||
|
"recovery": "retry_after_rotation"
|
||||||
|
}),
|
||||||
|
),
|
||||||
RegistryError::InvocationLogNotFound { log_id } => Self::not_found_with_context(
|
RegistryError::InvocationLogNotFound { log_id } => Self::not_found_with_context(
|
||||||
format!("invocation log {log_id} was not found"),
|
format!("invocation log {log_id} was not found"),
|
||||||
json!({ "log_id": log_id }),
|
json!({ "log_id": log_id }),
|
||||||
@@ -268,6 +364,57 @@ impl From<RegistryError> for ApiError {
|
|||||||
json!({ "operation_id": operation_id }),
|
json!({ "operation_id": operation_id }),
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
RegistryError::OperationArchived { operation_id } => Self::conflict_with_context(
|
||||||
|
format!("operation {operation_id} is archived"),
|
||||||
|
json!({ "operation_id": operation_id, "error_code": "operation_archived" }),
|
||||||
|
),
|
||||||
|
RegistryError::OperationStaleVersion {
|
||||||
|
operation_id,
|
||||||
|
expected,
|
||||||
|
actual,
|
||||||
|
} => Self::conflict_with_context(
|
||||||
|
format!("operation {operation_id} has a stale base version"),
|
||||||
|
json!({
|
||||||
|
"operation_id": operation_id,
|
||||||
|
"current_version": expected,
|
||||||
|
"provided_version": actual,
|
||||||
|
"error_code": "operation_stale_version",
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
),
|
||||||
|
RegistryError::InvalidOperationTransition {
|
||||||
|
operation_id,
|
||||||
|
from,
|
||||||
|
action,
|
||||||
|
} => Self::conflict_with_context(
|
||||||
|
format!("operation {operation_id} cannot perform {action} from {from}"),
|
||||||
|
json!({
|
||||||
|
"operation_id": operation_id,
|
||||||
|
"state": from,
|
||||||
|
"action": action,
|
||||||
|
"error_code": "operation_invalid_transition"
|
||||||
|
}),
|
||||||
|
),
|
||||||
|
RegistryError::OperationDeleteForbidden { operation_id } => {
|
||||||
|
Self::conflict_with_context(
|
||||||
|
format!(
|
||||||
|
"operation {operation_id} cannot be deleted because durable history exists"
|
||||||
|
),
|
||||||
|
json!({
|
||||||
|
"operation_id": operation_id,
|
||||||
|
"error_code": "operation_delete_forbidden"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
RegistryError::OperationAuthProfileUnavailable { operation_id } => {
|
||||||
|
Self::unprocessable_with_context(
|
||||||
|
"operation auth profile reference is unavailable",
|
||||||
|
json!({
|
||||||
|
"operation_id": operation_id,
|
||||||
|
"error_code": "operation_auth_profile_invalid"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
}
|
||||||
RegistryError::AuthProfileNotFound { auth_profile_id } => Self::not_found_with_context(
|
RegistryError::AuthProfileNotFound { auth_profile_id } => Self::not_found_with_context(
|
||||||
format!("auth profile {auth_profile_id} was not found"),
|
format!("auth profile {auth_profile_id} was not found"),
|
||||||
json!({ "auth_profile_id": auth_profile_id }),
|
json!({ "auth_profile_id": auth_profile_id }),
|
||||||
@@ -276,6 +423,17 @@ impl From<RegistryError> for ApiError {
|
|||||||
format!("operation {operation_id} already exists"),
|
format!("operation {operation_id} already exists"),
|
||||||
json!({ "operation_id": operation_id }),
|
json!({ "operation_id": operation_id }),
|
||||||
),
|
),
|
||||||
|
RegistryError::PlatformApiKeyNameAlreadyExists { workspace_id, name } => {
|
||||||
|
Self::conflict_with_context(
|
||||||
|
"platform api key name already exists",
|
||||||
|
json!({
|
||||||
|
"workspace_id": workspace_id,
|
||||||
|
"name": name,
|
||||||
|
"error_code": "platform_api_key_name_conflict",
|
||||||
|
"recovery": "choose_different_name"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
}
|
||||||
RegistryError::WorkspaceSlugAlreadyExists { slug } => Self::conflict_with_context(
|
RegistryError::WorkspaceSlugAlreadyExists { slug } => Self::conflict_with_context(
|
||||||
format!("workspace with slug {slug} already exists"),
|
format!("workspace with slug {slug} already exists"),
|
||||||
json!({ "slug": slug }),
|
json!({ "slug": slug }),
|
||||||
@@ -286,6 +444,8 @@ impl From<RegistryError> for ApiError {
|
|||||||
json!({
|
json!({
|
||||||
"workspace_id": workspace_id,
|
"workspace_id": workspace_id,
|
||||||
"name": name,
|
"name": name,
|
||||||
|
"error_code": "secret_name_conflict",
|
||||||
|
"recovery": "choose_different_name"
|
||||||
}),
|
}),
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
@@ -297,12 +457,29 @@ impl From<RegistryError> for ApiError {
|
|||||||
json!({
|
json!({
|
||||||
"secret_id": secret_id,
|
"secret_id": secret_id,
|
||||||
"auth_profile_id": auth_profile_id,
|
"auth_profile_id": auth_profile_id,
|
||||||
|
"error_code": "secret_referenced_by_auth_profile",
|
||||||
|
"recovery": "remove_or_update_auth_profile_reference"
|
||||||
}),
|
}),
|
||||||
),
|
),
|
||||||
RegistryError::UserEmailAlreadyExists { email } => Self::conflict_with_context(
|
RegistryError::UserEmailAlreadyExists { email } => Self::conflict_with_context(
|
||||||
format!("user with email {email} already exists"),
|
format!("user with email {email} already exists"),
|
||||||
json!({ "email": email }),
|
json!({ "email": email }),
|
||||||
),
|
),
|
||||||
|
RegistryError::AdminBootstrapUnavailable | RegistryError::AdminBootstrapRejected => {
|
||||||
|
Self::unauthorized("bootstrap request is invalid or expired")
|
||||||
|
}
|
||||||
|
RegistryError::AdminRecoveryRejected => Self::unauthorized("recovery request rejected"),
|
||||||
|
RegistryError::AdminLoginRateLimited { retry_after_ms } => {
|
||||||
|
Self::rate_limited_with_context(
|
||||||
|
"login temporarily unavailable",
|
||||||
|
json!({
|
||||||
|
"retry_after_ms": retry_after_ms.clamp(1, 300_000),
|
||||||
|
"error_code": "login_throttled",
|
||||||
|
"recovery": "retry_after_delay"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
RegistryError::AdminCsrfRejected => Self::forbidden("csrf validation failed"),
|
||||||
RegistryError::InvalidInitialVersion {
|
RegistryError::InvalidInitialVersion {
|
||||||
operation_id,
|
operation_id,
|
||||||
version,
|
version,
|
||||||
@@ -337,6 +514,39 @@ impl From<RegistryError> for ApiError {
|
|||||||
"actual": actual,
|
"actual": actual,
|
||||||
}),
|
}),
|
||||||
),
|
),
|
||||||
|
RegistryError::ImmutableAgentVersion { agent_id, version } => {
|
||||||
|
Self::conflict_with_context(
|
||||||
|
"Agent Version is immutable; reload before editing",
|
||||||
|
json!({
|
||||||
|
"agent_id": agent_id,
|
||||||
|
"version": version,
|
||||||
|
"error_code": "agent_stale_revision",
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
RegistryError::AgentStaleRevision { agent_id } => Self::conflict_with_context(
|
||||||
|
"Agent state changed; reload before retrying",
|
||||||
|
json!({
|
||||||
|
"agent_id": agent_id,
|
||||||
|
"error_code": "agent_stale_revision",
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
),
|
||||||
|
RegistryError::InvalidAgentTransition {
|
||||||
|
agent_id,
|
||||||
|
from,
|
||||||
|
action,
|
||||||
|
} => Self::conflict_with_context(
|
||||||
|
format!("agent {agent_id} cannot transition from {from} using {action}"),
|
||||||
|
json!({
|
||||||
|
"agent_id": agent_id,
|
||||||
|
"from": from,
|
||||||
|
"action": action,
|
||||||
|
"error_code": "agent_invalid_transition",
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
),
|
||||||
RegistryError::ImmutableOperationFieldChanged {
|
RegistryError::ImmutableOperationFieldChanged {
|
||||||
operation_id,
|
operation_id,
|
||||||
field,
|
field,
|
||||||
@@ -347,6 +557,14 @@ impl From<RegistryError> for ApiError {
|
|||||||
"field": field,
|
"field": field,
|
||||||
}),
|
}),
|
||||||
),
|
),
|
||||||
|
RegistryError::OnboardingStaleRevision => Self::conflict_with_context(
|
||||||
|
"onboarding state changed; reload before retrying",
|
||||||
|
json!({"error_code":"onboarding_stale_revision","recovery":"reload"}),
|
||||||
|
),
|
||||||
|
RegistryError::OnboardingIncomplete => Self::unprocessable_with_context(
|
||||||
|
"onboarding domain steps are not complete",
|
||||||
|
json!({"error_code":"onboarding_incomplete"}),
|
||||||
|
),
|
||||||
RegistryError::InvalidEnumRepresentation { field } => Self::validation_with_context(
|
RegistryError::InvalidEnumRepresentation { field } => Self::validation_with_context(
|
||||||
format!("unsupported enum representation for field {field}"),
|
format!("unsupported enum representation for field {field}"),
|
||||||
json!({ "field": field }),
|
json!({ "field": field }),
|
||||||
@@ -370,10 +588,18 @@ impl From<RegistryError> for ApiError {
|
|||||||
format!("import job {job_id} was already applied with different parameters"),
|
format!("import job {job_id} was already applied with different parameters"),
|
||||||
json!({ "job_id": job_id }),
|
json!({ "job_id": job_id }),
|
||||||
),
|
),
|
||||||
|
RegistryError::Storage(_) => Self::internal("registry operation failed"),
|
||||||
RegistryError::Migration(_)
|
RegistryError::Migration(_)
|
||||||
| RegistryError::Storage(_)
|
|
||||||
| RegistryError::Serialization(_)
|
| RegistryError::Serialization(_)
|
||||||
| RegistryError::InvalidCorrelationIdentity { .. } => Self::internal(value.to_string()),
|
| RegistryError::MasterKeyIdentityMismatch { .. }
|
||||||
|
| RegistryError::InvalidMasterKeyIdentity
|
||||||
|
| RegistryError::MasterKeyRotationNotFound { .. }
|
||||||
|
| RegistryError::MasterKeyRotationConflict
|
||||||
|
| RegistryError::MasterKeyRotationVerificationFailed
|
||||||
|
| RegistryError::InvalidCorrelationIdentity { .. }
|
||||||
|
| RegistryError::InvalidExecutionRecord { .. } => {
|
||||||
|
Self::internal("registry operation failed")
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -405,117 +631,34 @@ impl From<StorageError> for ApiError {
|
|||||||
}
|
}
|
||||||
|
|
||||||
pub fn runtime_test_failure(error: &RuntimeError) -> Value {
|
pub fn runtime_test_failure(error: &RuntimeError) -> Value {
|
||||||
|
let failure =
|
||||||
|
crank_runtime::normalize_runtime_error(error, &crank_core::CorrelationContext::generate());
|
||||||
|
execution_test_failure(&failure)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn execution_test_failure(failure: &crank_core::ExecutionFailure) -> Value {
|
||||||
|
execution_test_failure_localized(failure, crank_core::ExecutionLocale::En)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn execution_test_failure_localized(
|
||||||
|
failure: &crank_core::ExecutionFailure,
|
||||||
|
locale: crank_core::ExecutionLocale,
|
||||||
|
) -> Value {
|
||||||
let mut payload = json!({
|
let mut payload = json!({
|
||||||
"code": runtime_test_failure_code(error),
|
"code": failure.error_code().as_str(),
|
||||||
"message": safe_runtime_test_failure_message(error)
|
"message": failure.error_code().message(locale),
|
||||||
|
"stage": failure.stage().as_str(),
|
||||||
|
"retryability": failure.retryability().as_str(),
|
||||||
|
"outcome_certainty": failure.outcome_certainty().as_str(),
|
||||||
});
|
});
|
||||||
if let Some(context) = runtime_error_context(error) {
|
if let Some(status) = failure.upstream_status() {
|
||||||
payload["context"] = context;
|
payload["context"] = json!({ "upstream_status": status });
|
||||||
|
}
|
||||||
|
if let Some(challenge) = failure.confirmation() {
|
||||||
|
payload["context"] = json!({
|
||||||
|
"confirmation_token": challenge.token(),
|
||||||
|
"expires_in_ms": challenge.expires_in_ms(),
|
||||||
|
});
|
||||||
}
|
}
|
||||||
payload
|
payload
|
||||||
}
|
}
|
||||||
|
|
||||||
fn safe_runtime_test_failure_message(error: &RuntimeError) -> &'static str {
|
|
||||||
match error {
|
|
||||||
RuntimeError::Schema(_) => "input schema validation failed",
|
|
||||||
RuntimeError::Mapping(_) => "input mapping failed",
|
|
||||||
RuntimeError::RestAdapter(_) | RuntimeError::ProtocolAdapter(_) => {
|
|
||||||
"upstream execution failed"
|
|
||||||
}
|
|
||||||
RuntimeError::UnsupportedProtocol { .. } => "operation protocol is unsupported",
|
|
||||||
RuntimeError::ConcurrencyLimitExceeded { .. } => "runtime concurrency limit exceeded",
|
|
||||||
RuntimeError::InvalidPreparedRequest { .. } => "prepared request is invalid",
|
|
||||||
RuntimeError::ConfirmationRequired { .. } => "operation confirmation is required",
|
|
||||||
RuntimeError::InvalidConfirmationToken { .. } => "confirmation token is invalid",
|
|
||||||
RuntimeError::ConfirmationStoreUnavailable { .. } => "confirmation store is unavailable",
|
|
||||||
RuntimeError::IdempotencyStoreUnavailable { .. } => "idempotency store is unavailable",
|
|
||||||
RuntimeError::IdempotencyInProgress { .. } => "idempotent execution is in progress",
|
|
||||||
RuntimeError::IdempotencyConflict { .. } => "idempotency key conflicts with the request",
|
|
||||||
RuntimeError::IdempotencyOutcomeUnknown { .. } => "previous execution outcome is unknown",
|
|
||||||
RuntimeError::UnsupportedExecutionMode { .. } => "execution mode is unsupported",
|
|
||||||
RuntimeError::MissingAuthProfile { .. } => "authorization profile is missing",
|
|
||||||
RuntimeError::MissingSecret { .. } | RuntimeError::MissingSecretVersion { .. } => {
|
|
||||||
"authorization secret is missing"
|
|
||||||
}
|
|
||||||
RuntimeError::InvalidAuthSecretValue { .. } => "authorization secret is invalid",
|
|
||||||
RuntimeError::SecretCrypto { .. } => "authorization secret processing failed",
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
fn runtime_test_failure_code(error: &RuntimeError) -> &'static str {
|
|
||||||
match error {
|
|
||||||
RuntimeError::Schema(_) => "runtime_schema_error",
|
|
||||||
RuntimeError::Mapping(_) => "runtime_mapping_error",
|
|
||||||
RuntimeError::RestAdapter(_) => "runtime_rest_error",
|
|
||||||
RuntimeError::ProtocolAdapter(_) => "runtime_adapter_error",
|
|
||||||
RuntimeError::UnsupportedProtocol { .. } => "runtime_protocol_error",
|
|
||||||
RuntimeError::ConcurrencyLimitExceeded { .. } => "runtime_overloaded",
|
|
||||||
RuntimeError::InvalidPreparedRequest { .. } => "runtime_request_error",
|
|
||||||
RuntimeError::ConfirmationRequired { .. } => "runtime_confirmation_required",
|
|
||||||
RuntimeError::InvalidConfirmationToken { .. } => "runtime_confirmation_error",
|
|
||||||
RuntimeError::ConfirmationStoreUnavailable { .. } => "runtime_confirmation_unavailable",
|
|
||||||
RuntimeError::IdempotencyStoreUnavailable { .. } => "runtime_idempotency_unavailable",
|
|
||||||
RuntimeError::IdempotencyInProgress { .. } => "runtime_idempotency_in_progress",
|
|
||||||
RuntimeError::IdempotencyConflict { .. } => "runtime_idempotency_conflict",
|
|
||||||
RuntimeError::IdempotencyOutcomeUnknown { .. } => "runtime_idempotency_outcome_unknown",
|
|
||||||
RuntimeError::UnsupportedExecutionMode { .. } => "runtime_streaming_mode_error",
|
|
||||||
RuntimeError::MissingAuthProfile { .. } => "runtime_auth_profile_error",
|
|
||||||
RuntimeError::MissingSecret { .. } | RuntimeError::MissingSecretVersion { .. } => {
|
|
||||||
"runtime_secret_error"
|
|
||||||
}
|
|
||||||
RuntimeError::InvalidAuthSecretValue { .. } => "runtime_secret_value_error",
|
|
||||||
RuntimeError::SecretCrypto { .. } => "runtime_secret_crypto_error",
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pub fn runtime_error_context(error: &RuntimeError) -> Option<Value> {
|
|
||||||
match error {
|
|
||||||
RuntimeError::InvalidPreparedRequest { field, .. } => Some(json!({
|
|
||||||
"field": field,
|
|
||||||
})),
|
|
||||||
RuntimeError::ConfirmationRequired {
|
|
||||||
confirmation_token,
|
|
||||||
expires_in_ms,
|
|
||||||
safety_class,
|
|
||||||
..
|
|
||||||
} => Some(json!({
|
|
||||||
"confirmation_token": confirmation_token,
|
|
||||||
"expires_in_ms": expires_in_ms,
|
|
||||||
"safety_class": safety_class,
|
|
||||||
})),
|
|
||||||
RuntimeError::InvalidConfirmationToken { operation_id }
|
|
||||||
| RuntimeError::ConfirmationStoreUnavailable { operation_id }
|
|
||||||
| RuntimeError::IdempotencyStoreUnavailable { operation_id }
|
|
||||||
| RuntimeError::IdempotencyInProgress { operation_id }
|
|
||||||
| RuntimeError::IdempotencyConflict { operation_id }
|
|
||||||
| RuntimeError::IdempotencyOutcomeUnknown { operation_id } => Some(json!({
|
|
||||||
"operation_id": operation_id,
|
|
||||||
})),
|
|
||||||
RuntimeError::InvalidAuthSecretValue { secret_id, .. } => Some(json!({
|
|
||||||
"secret_id": secret_id,
|
|
||||||
})),
|
|
||||||
RuntimeError::SecretCrypto { .. } => None,
|
|
||||||
RuntimeError::MissingAuthProfile { auth_profile_id } => Some(json!({
|
|
||||||
"auth_profile_id": auth_profile_id,
|
|
||||||
})),
|
|
||||||
RuntimeError::MissingSecret { secret_id } => Some(json!({
|
|
||||||
"secret_id": secret_id,
|
|
||||||
})),
|
|
||||||
RuntimeError::MissingSecretVersion { secret_id, version } => Some(json!({
|
|
||||||
"secret_id": secret_id,
|
|
||||||
"version": version,
|
|
||||||
})),
|
|
||||||
RuntimeError::UnsupportedExecutionMode { operation_id, mode } => Some(json!({
|
|
||||||
"operation_id": operation_id,
|
|
||||||
"mode": mode,
|
|
||||||
})),
|
|
||||||
RuntimeError::UnsupportedProtocol { protocol } => Some(json!({
|
|
||||||
"protocol": protocol,
|
|
||||||
})),
|
|
||||||
RuntimeError::ConcurrencyLimitExceeded { kind, limit } => Some(json!({
|
|
||||||
"kind": kind,
|
|
||||||
"limit": limit,
|
|
||||||
})),
|
|
||||||
_ => None,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|||||||
+108
-10
@@ -17,7 +17,9 @@ use crank_observability::{
|
|||||||
CriticalErrorCategory, MetricsConfig, ObservabilityConfig, ObservabilityLifecycle,
|
CriticalErrorCategory, MetricsConfig, ObservabilityConfig, ObservabilityLifecycle,
|
||||||
OtlpTraceConfig, RedactionLimits, SentryConfig, ServiceIdentity, capture_critical_error,
|
OtlpTraceConfig, RedactionLimits, SentryConfig, ServiceIdentity, capture_critical_error,
|
||||||
};
|
};
|
||||||
use crank_registry::{PostgresPoolConfig, PostgresRegistry};
|
use crank_registry::{
|
||||||
|
MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresPoolConfig, PostgresRegistry,
|
||||||
|
};
|
||||||
use crank_runtime::{
|
use crank_runtime::{
|
||||||
RequestRateLimitConfig, RequestRateLimiter, RuntimeCacheConfig, RuntimeCacheStores,
|
RequestRateLimitConfig, RequestRateLimiter, RuntimeCacheConfig, RuntimeCacheStores,
|
||||||
RuntimeLimits, SecretCrypto,
|
RuntimeLimits, SecretCrypto,
|
||||||
@@ -65,6 +67,36 @@ fn safe_startup_diagnostic(error: &(dyn std::error::Error + 'static)) -> String
|
|||||||
})
|
})
|
||||||
.to_string();
|
.to_string();
|
||||||
}
|
}
|
||||||
|
if let Some(crank_registry::RegistryError::MasterKeyIdentityMismatch { epoch }) =
|
||||||
|
cause.downcast_ref::<crank_registry::RegistryError>()
|
||||||
|
{
|
||||||
|
return serde_json::json!({
|
||||||
|
"status": "error",
|
||||||
|
"code": "master_key_identity_mismatch",
|
||||||
|
"stage": "startup.master_key_identity",
|
||||||
|
"version": epoch,
|
||||||
|
"recovery": "configure_same_master_key",
|
||||||
|
})
|
||||||
|
.to_string();
|
||||||
|
}
|
||||||
|
if cause
|
||||||
|
.downcast_ref::<crank_registry::RegistryError>()
|
||||||
|
.is_some_and(|error| {
|
||||||
|
matches!(
|
||||||
|
error,
|
||||||
|
crank_registry::RegistryError::InvalidMasterKeyIdentity
|
||||||
|
)
|
||||||
|
})
|
||||||
|
{
|
||||||
|
return serde_json::json!({
|
||||||
|
"status": "error",
|
||||||
|
"code": "master_key_identity_invalid",
|
||||||
|
"stage": "startup.master_key_identity",
|
||||||
|
"version": null,
|
||||||
|
"recovery": "contact_operator",
|
||||||
|
})
|
||||||
|
.to_string();
|
||||||
|
}
|
||||||
current = cause.source();
|
current = cause.source();
|
||||||
}
|
}
|
||||||
serde_json::json!({
|
serde_json::json!({
|
||||||
@@ -149,7 +181,11 @@ async fn run(
|
|||||||
cookie_secure: base_url.starts_with("https://"),
|
cookie_secure: base_url.starts_with("https://"),
|
||||||
bootstrap_admin: BootstrapAdminConfig {
|
bootstrap_admin: BootstrapAdminConfig {
|
||||||
email: config.bootstrap_email.clone(),
|
email: config.bootstrap_email.clone(),
|
||||||
password: config.bootstrap_password.expose_secret().to_owned(),
|
password: config
|
||||||
|
.bootstrap_password
|
||||||
|
.as_ref()
|
||||||
|
.map(|password| password.expose_secret().to_owned())
|
||||||
|
.unwrap_or_default(),
|
||||||
display_name: config.bootstrap_display_name.clone(),
|
display_name: config.bootstrap_display_name.clone(),
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
@@ -163,10 +199,13 @@ async fn run(
|
|||||||
config.rate_limit.requests_per_second,
|
config.rate_limit.requests_per_second,
|
||||||
config.rate_limit.burst,
|
config.rate_limit.burst,
|
||||||
)?;
|
)?;
|
||||||
let secret_crypto = SecretCrypto::new(config.runtime.master_key.expose_secret())?;
|
let secret_crypto =
|
||||||
let outbound_http_policy = crank_runtime::OutboundHttpPolicy::try_new(
|
verified_startup_secret_crypto(®istry, config.runtime.master_key.expose_secret())
|
||||||
|
.await?;
|
||||||
|
let outbound_http_policy = crank_runtime::OutboundHttpPolicy::try_new_with_limits(
|
||||||
config.runtime.outbound.allowed_hosts.clone(),
|
config.runtime.outbound.allowed_hosts.clone(),
|
||||||
config.runtime.outbound.denied_hosts.clone(),
|
config.runtime.outbound.denied_hosts.clone(),
|
||||||
|
config.runtime.outbound.max_request_bytes,
|
||||||
config.runtime.outbound.max_response_bytes,
|
config.runtime.outbound.max_response_bytes,
|
||||||
)?;
|
)?;
|
||||||
let runtime = crank_runtime::community_with_outbound_policy(outbound_http_policy.clone())
|
let runtime = crank_runtime::community_with_outbound_policy(outbound_http_policy.clone())
|
||||||
@@ -183,10 +222,10 @@ async fn run(
|
|||||||
secret_crypto,
|
secret_crypto,
|
||||||
runtime,
|
runtime,
|
||||||
)
|
)
|
||||||
|
.with_public_base_url(base_url)
|
||||||
.with_outbound_http_policy(outbound_http_policy)
|
.with_outbound_http_policy(outbound_http_policy)
|
||||||
.with_identity_provider(std::sync::Arc::new(identity_provider))
|
.with_identity_provider(std::sync::Arc::new(identity_provider))
|
||||||
.build();
|
.build();
|
||||||
service.bootstrap_admin_user().await?;
|
|
||||||
if config.demo_seed {
|
if config.demo_seed {
|
||||||
service.seed_demo_assets().await?;
|
service.seed_demo_assets().await?;
|
||||||
}
|
}
|
||||||
@@ -198,7 +237,7 @@ async fn run(
|
|||||||
} else {
|
} else {
|
||||||
RequestRateLimiter::new(api_rate_limit)
|
RequestRateLimiter::new(api_rate_limit)
|
||||||
},
|
},
|
||||||
trust_forwarded_headers: config.trust_forwarded_headers,
|
trusted_proxy_ips: config.trusted_proxy_ips.clone(),
|
||||||
};
|
};
|
||||||
let app = build_app(state);
|
let app = build_app(state);
|
||||||
let listener = TcpListener::bind(config.bind_addr).await?;
|
let listener = TcpListener::bind(config.bind_addr).await?;
|
||||||
@@ -285,9 +324,10 @@ fn preflight_config(config: &AdminProcessConfig) -> Result<(), crank_config::Con
|
|||||||
.map_err(|_| invalid("admin.rate_limit"))?;
|
.map_err(|_| invalid("admin.rate_limit"))?;
|
||||||
SecretCrypto::new(config.runtime.master_key.expose_secret())
|
SecretCrypto::new(config.runtime.master_key.expose_secret())
|
||||||
.map_err(|_| invalid("runtime.master_key"))?;
|
.map_err(|_| invalid("runtime.master_key"))?;
|
||||||
crank_runtime::OutboundHttpPolicy::try_new(
|
crank_runtime::OutboundHttpPolicy::try_new_with_limits(
|
||||||
config.runtime.outbound.allowed_hosts.clone(),
|
config.runtime.outbound.allowed_hosts.clone(),
|
||||||
config.runtime.outbound.denied_hosts.clone(),
|
config.runtime.outbound.denied_hosts.clone(),
|
||||||
|
config.runtime.outbound.max_request_bytes,
|
||||||
config.runtime.outbound.max_response_bytes,
|
config.runtime.outbound.max_response_bytes,
|
||||||
)
|
)
|
||||||
.map_err(|_| invalid("runtime.outbound"))?;
|
.map_err(|_| invalid("runtime.outbound"))?;
|
||||||
@@ -315,6 +355,53 @@ fn preflight_config(config: &AdminProcessConfig) -> Result<(), crank_config::Con
|
|||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn verified_startup_secret_crypto(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
master_key: &str,
|
||||||
|
) -> Result<SecretCrypto, Box<dyn std::error::Error>> {
|
||||||
|
let active = registry.active_master_key_identity().await?;
|
||||||
|
let secret_crypto = if let Some(identity) = active {
|
||||||
|
SecretCrypto::with_epoch(master_key, identity.epoch)?
|
||||||
|
} else {
|
||||||
|
let crypto = SecretCrypto::new(master_key)?;
|
||||||
|
let mut after_secret_id: Option<String> = None;
|
||||||
|
let mut after_version: Option<u32> = None;
|
||||||
|
loop {
|
||||||
|
let versions = registry
|
||||||
|
.list_secret_versions_for_master_key_epoch_page(
|
||||||
|
1,
|
||||||
|
after_secret_id.as_deref(),
|
||||||
|
after_version,
|
||||||
|
1_000,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
if versions.is_empty() {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
for version in versions {
|
||||||
|
after_secret_id = Some(version.secret_version.secret_id.as_str().to_owned());
|
||||||
|
after_version = Some(version.secret_version.version);
|
||||||
|
crypto.decrypt_for_epoch(
|
||||||
|
&version.secret_version.key_version,
|
||||||
|
version.master_key_epoch,
|
||||||
|
&version.secret_version.ciphertext,
|
||||||
|
)?;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
crypto
|
||||||
|
};
|
||||||
|
let master_key_observed_at = time::OffsetDateTime::now_utc();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: secret_crypto.master_key_epoch(),
|
||||||
|
fingerprint: secret_crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &master_key_observed_at,
|
||||||
|
})
|
||||||
|
.await?;
|
||||||
|
Ok(secret_crypto)
|
||||||
|
}
|
||||||
|
|
||||||
fn otlp_config(
|
fn otlp_config(
|
||||||
config: &ObservabilitySettings,
|
config: &ObservabilitySettings,
|
||||||
) -> Result<OtlpTraceConfig, crank_observability::OtlpTraceConfigError> {
|
) -> Result<OtlpTraceConfig, crank_observability::OtlpTraceConfigError> {
|
||||||
@@ -395,12 +482,23 @@ fn spawn_invocation_log_cleanup(service: admin_api::service::AdminService, reten
|
|||||||
interval.tick().await;
|
interval.tick().await;
|
||||||
let cutoff = time::OffsetDateTime::now_utc() - time::Duration::days(retention_days);
|
let cutoff = time::OffsetDateTime::now_utc() - time::Duration::days(retention_days);
|
||||||
match service.cleanup_invocation_logs_before(cutoff).await {
|
match service.cleanup_invocation_logs_before(cutoff).await {
|
||||||
Ok(removed) if removed > 0 => info!(
|
Ok(outcome) if outcome.deleted_records > 0 => info!(
|
||||||
name: "admin.invocation_log_cleanup.completed",
|
name: "admin.invocation_log_cleanup.completed",
|
||||||
removed,
|
status = ?outcome.status,
|
||||||
|
removed = outcome.deleted_records,
|
||||||
|
requested_cutoff = %outcome.policy.requested_cutoff,
|
||||||
|
effective_cutoff = %outcome.policy.effective_cutoff,
|
||||||
|
preserved_usage_window_days = outcome.policy.preserved_usage_window_days,
|
||||||
"expired invocation logs removed"
|
"expired invocation logs removed"
|
||||||
),
|
),
|
||||||
Ok(_) => {}
|
Ok(outcome) => info!(
|
||||||
|
name: "admin.invocation_log_cleanup.noop",
|
||||||
|
status = ?outcome.status,
|
||||||
|
requested_cutoff = %outcome.policy.requested_cutoff,
|
||||||
|
effective_cutoff = %outcome.policy.effective_cutoff,
|
||||||
|
preserved_usage_window_days = outcome.policy.preserved_usage_window_days,
|
||||||
|
"no expired invocation logs removed"
|
||||||
|
),
|
||||||
Err(_) => warn!(
|
Err(_) => warn!(
|
||||||
name: "admin.invocation_log_cleanup.failed",
|
name: "admin.invocation_log_cleanup.failed",
|
||||||
error_category = "registry_cleanup",
|
error_category = "registry_cleanup",
|
||||||
|
|||||||
@@ -10,20 +10,23 @@ use crank_runtime::{RateLimitCheckError, RateLimitRejection};
|
|||||||
|
|
||||||
use crate::{error::ApiError, state::AppState};
|
use crate::{error::ApiError, state::AppState};
|
||||||
|
|
||||||
|
#[derive(Clone, Debug)]
|
||||||
|
pub struct ClientIdentityBucket(pub String);
|
||||||
|
|
||||||
pub async fn apply_api_rate_limit(
|
pub async fn apply_api_rate_limit(
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
request: Request,
|
mut request: Request,
|
||||||
next: Next,
|
next: Next,
|
||||||
) -> Result<Response, ApiError> {
|
) -> Result<Response, ApiError> {
|
||||||
let peer_ip = request
|
let peer_ip = request
|
||||||
.extensions()
|
.extensions()
|
||||||
.get::<ConnectInfo<SocketAddr>>()
|
.get::<ConnectInfo<SocketAddr>>()
|
||||||
.map(|ConnectInfo(address)| address.ip());
|
.map(|ConnectInfo(address)| address.ip());
|
||||||
let key = rate_limit_key(
|
let key = client_rate_limit_key(
|
||||||
request.headers(),
|
request.headers(),
|
||||||
request.uri().path(),
|
request.uri().path(),
|
||||||
peer_ip,
|
peer_ip,
|
||||||
state.trust_forwarded_headers,
|
&state.trusted_proxy_ips,
|
||||||
);
|
);
|
||||||
if let Err(error) = state.api_rate_limiter.check(&key).await {
|
if let Err(error) = state.api_rate_limiter.check(&key).await {
|
||||||
return match error {
|
return match error {
|
||||||
@@ -37,6 +40,8 @@ pub async fn apply_api_rate_limit(
|
|||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
request.extensions_mut().insert(ClientIdentityBucket(key));
|
||||||
|
|
||||||
Ok(next.run(request).await)
|
Ok(next.run(request).await)
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -46,13 +51,15 @@ fn rejection_context(rejection: RateLimitRejection) -> serde_json::Value {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
fn rate_limit_key(
|
pub fn client_rate_limit_key(
|
||||||
headers: &HeaderMap,
|
headers: &HeaderMap,
|
||||||
path: &str,
|
path: &str,
|
||||||
peer_ip: Option<IpAddr>,
|
peer_ip: Option<IpAddr>,
|
||||||
trust_forwarded_headers: bool,
|
trusted_proxy_ips: &[IpAddr],
|
||||||
) -> String {
|
) -> String {
|
||||||
if trust_forwarded_headers && let Some(client_ip) = forwarded_client_ip(headers) {
|
if peer_ip.is_some_and(|peer_ip| trusted_proxy_ips.contains(&peer_ip))
|
||||||
|
&& let Some(client_ip) = forwarded_client_ip(headers)
|
||||||
|
{
|
||||||
return format!("ip:{client_ip}");
|
return format!("ip:{client_ip}");
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -63,7 +70,8 @@ fn rate_limit_key(
|
|||||||
format!("anonymous:{path}")
|
format!("anonymous:{path}")
|
||||||
}
|
}
|
||||||
|
|
||||||
/// Resolves the client IP from proxy headers, assuming a single trusted proxy.
|
/// Resolves the client IP from proxy headers after the immediate peer was
|
||||||
|
/// matched against the trusted-proxy allowlist.
|
||||||
///
|
///
|
||||||
/// `X-Real-IP` is preferred because a trusted proxy (e.g. nginx) sets it to the
|
/// `X-Real-IP` is preferred because a trusted proxy (e.g. nginx) sets it to the
|
||||||
/// real peer address. For `X-Forwarded-For` the proxy *appends* the observed
|
/// real peer address. For `X-Forwarded-For` the proxy *appends* the observed
|
||||||
@@ -96,7 +104,7 @@ mod tests {
|
|||||||
|
|
||||||
use axum::http::{HeaderMap, HeaderValue, header::COOKIE};
|
use axum::http::{HeaderMap, HeaderValue, header::COOKIE};
|
||||||
|
|
||||||
use super::rate_limit_key;
|
use super::client_rate_limit_key;
|
||||||
|
|
||||||
fn peer() -> Option<IpAddr> {
|
fn peer() -> Option<IpAddr> {
|
||||||
Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 7)))
|
Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 7)))
|
||||||
@@ -112,7 +120,7 @@ mod tests {
|
|||||||
headers.insert("x-forwarded-for", HeaderValue::from_static("10.0.0.5"));
|
headers.insert("x-forwarded-for", HeaderValue::from_static("10.0.0.5"));
|
||||||
|
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
rate_limit_key(&headers, "/api/auth/login", peer(), true),
|
client_rate_limit_key(&headers, "/api/auth/login", peer(), &[peer().unwrap()]),
|
||||||
"ip:10.0.0.5"
|
"ip:10.0.0.5"
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
@@ -124,7 +132,23 @@ mod tests {
|
|||||||
headers.insert("x-real-ip", HeaderValue::from_static("10.0.0.9"));
|
headers.insert("x-real-ip", HeaderValue::from_static("10.0.0.9"));
|
||||||
|
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
rate_limit_key(&headers, "/api/auth/login", peer(), false),
|
client_rate_limit_key(&headers, "/api/auth/login", peer(), &[]),
|
||||||
|
"ip:203.0.113.7"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn ignores_forwarded_headers_from_unlisted_peer() {
|
||||||
|
let mut headers = HeaderMap::new();
|
||||||
|
headers.insert("x-real-ip", HeaderValue::from_static("10.0.0.9"));
|
||||||
|
|
||||||
|
assert_eq!(
|
||||||
|
client_rate_limit_key(
|
||||||
|
&headers,
|
||||||
|
"/api/auth/login",
|
||||||
|
peer(),
|
||||||
|
&[IpAddr::V4(Ipv4Addr::new(198, 51, 100, 10))]
|
||||||
|
),
|
||||||
"ip:203.0.113.7"
|
"ip:203.0.113.7"
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
@@ -139,7 +163,7 @@ mod tests {
|
|||||||
headers.insert("x-real-ip", HeaderValue::from_static("10.0.0.9"));
|
headers.insert("x-real-ip", HeaderValue::from_static("10.0.0.9"));
|
||||||
|
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
rate_limit_key(&headers, "/api/auth/login", peer(), true),
|
client_rate_limit_key(&headers, "/api/auth/login", peer(), &[peer().unwrap()]),
|
||||||
"ip:10.0.0.9"
|
"ip:10.0.0.9"
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
@@ -155,7 +179,7 @@ mod tests {
|
|||||||
);
|
);
|
||||||
|
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
rate_limit_key(&headers, "/api/auth/login", peer(), true),
|
client_rate_limit_key(&headers, "/api/auth/login", peer(), &[peer().unwrap()]),
|
||||||
"ip:10.0.0.6"
|
"ip:10.0.0.6"
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
@@ -165,7 +189,7 @@ mod tests {
|
|||||||
let headers = HeaderMap::new();
|
let headers = HeaderMap::new();
|
||||||
|
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
rate_limit_key(&headers, "/api/auth/login", peer(), true),
|
client_rate_limit_key(&headers, "/api/auth/login", peer(), &[peer().unwrap()]),
|
||||||
"ip:203.0.113.7"
|
"ip:203.0.113.7"
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
@@ -180,7 +204,7 @@ mod tests {
|
|||||||
);
|
);
|
||||||
|
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
rate_limit_key(&headers, "/api/auth/login", peer(), true),
|
client_rate_limit_key(&headers, "/api/auth/login", peer(), &[peer().unwrap()]),
|
||||||
"ip:203.0.113.7"
|
"ip:203.0.113.7"
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
@@ -190,7 +214,7 @@ mod tests {
|
|||||||
let headers = HeaderMap::new();
|
let headers = HeaderMap::new();
|
||||||
|
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
rate_limit_key(&headers, "/api/auth/login", None, false),
|
client_rate_limit_key(&headers, "/api/auth/login", None, &[]),
|
||||||
"anonymous:/api/auth/login"
|
"anonymous:/api/auth/login"
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -5,6 +5,7 @@ pub mod auth_profiles;
|
|||||||
pub mod capabilities;
|
pub mod capabilities;
|
||||||
pub mod imports;
|
pub mod imports;
|
||||||
pub mod observability;
|
pub mod observability;
|
||||||
|
pub mod onboarding;
|
||||||
pub mod operations;
|
pub mod operations;
|
||||||
pub mod secrets;
|
pub mod secrets;
|
||||||
pub mod upstreams;
|
pub mod upstreams;
|
||||||
|
|||||||
@@ -1,15 +1,19 @@
|
|||||||
use axum::{
|
use axum::{
|
||||||
Json,
|
Extension, Json,
|
||||||
extract::{Path, State},
|
extract::{Path, State},
|
||||||
|
http::{HeaderMap, header},
|
||||||
|
response::IntoResponse,
|
||||||
};
|
};
|
||||||
use serde::Deserialize;
|
use serde::Deserialize;
|
||||||
use serde_json::{Value, json};
|
use serde_json::{Value, json};
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
|
auth::AuthenticatedSession,
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
|
request_context::RequestContext,
|
||||||
service::{
|
service::{
|
||||||
AgentCatalogPayload, AgentPayload, PlatformApiKeyPayload, PublishPayload,
|
AdminAuditContext, AgentCatalogPayload, AgentPayload, PlatformApiKeyPayload,
|
||||||
ToolSearchPreviewPayload, UpdateAgentPayload,
|
PublishPayload, ToolSearchPreviewPayload, UpdateAgentPayload,
|
||||||
},
|
},
|
||||||
state::AppState,
|
state::AppState,
|
||||||
};
|
};
|
||||||
@@ -77,7 +81,7 @@ pub async fn create_agent(
|
|||||||
pub async fn get_agent(
|
pub async fn get_agent(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<impl IntoResponse, ApiError> {
|
||||||
let agent = state
|
let agent = state
|
||||||
.service
|
.service
|
||||||
.get_agent(
|
.get_agent(
|
||||||
@@ -85,20 +89,30 @@ pub async fn get_agent(
|
|||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(agent)))
|
let etag = crate::service::AdminService::agent_state_etag(&agent);
|
||||||
|
let mut headers = HeaderMap::new();
|
||||||
|
headers.insert(
|
||||||
|
header::ETAG,
|
||||||
|
header::HeaderValue::from_str(&etag)
|
||||||
|
.map_err(|_| ApiError::internal("invalid agent etag"))?,
|
||||||
|
);
|
||||||
|
Ok((headers, Json(json!(agent))))
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn update_agent(
|
pub async fn update_agent(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
Json(payload): Json<UpdateAgentPayload>,
|
Json(payload): Json<UpdateAgentPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected_state = require_agent_precondition(&state, &path, &headers).await?;
|
||||||
let updated = state
|
let updated = state
|
||||||
.service
|
.service
|
||||||
.update_agent(
|
.update_agent(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
payload,
|
payload,
|
||||||
|
Some(&expected_state),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(updated)))
|
Ok(Json(json!(updated)))
|
||||||
@@ -107,12 +121,15 @@ pub async fn update_agent(
|
|||||||
pub async fn delete_agent(
|
pub async fn delete_agent(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected_state = require_agent_precondition(&state, &path, &headers).await?;
|
||||||
let deleted = state
|
let deleted = state
|
||||||
.service
|
.service
|
||||||
.delete_agent(
|
.delete_agent(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
|
Some(&expected_state),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(deleted)))
|
Ok(Json(json!(deleted)))
|
||||||
@@ -136,30 +153,79 @@ pub async fn get_agent_version(
|
|||||||
pub async fn save_agent_bindings(
|
pub async fn save_agent_bindings(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
Json(payload): Json<AgentCatalogPayload>,
|
Json(payload): Json<AgentCatalogPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected_state = require_agent_precondition(&state, &path, &headers).await?;
|
||||||
let record = state
|
let record = state
|
||||||
.service
|
.service
|
||||||
.save_agent_bindings(
|
.save_agent_bindings(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
payload,
|
payload,
|
||||||
|
Some(&expected_state),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(record)))
|
Ok(Json(json!(record)))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn require_agent_precondition(
|
||||||
|
state: &AppState,
|
||||||
|
path: &WorkspaceAgentPath,
|
||||||
|
headers: &HeaderMap,
|
||||||
|
) -> Result<crank_registry::AgentStateExpectation, ApiError> {
|
||||||
|
let agent = state
|
||||||
|
.service
|
||||||
|
.get_agent(
|
||||||
|
&path.workspace_id.as_str().into(),
|
||||||
|
&path.agent_id.as_str().into(),
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
let expected = crate::service::AdminService::agent_state_etag(&agent);
|
||||||
|
let provided = headers
|
||||||
|
.get(header::IF_MATCH)
|
||||||
|
.and_then(|value| value.to_str().ok())
|
||||||
|
.ok_or_else(|| {
|
||||||
|
ApiError::precondition_required_with_context(
|
||||||
|
"If-Match is required for Agent mutation",
|
||||||
|
json!({
|
||||||
|
"error_code": "agent_precondition_required",
|
||||||
|
"current_version": agent.current_draft_version,
|
||||||
|
"latest_published_version": agent.latest_published_version,
|
||||||
|
"catalog_revision": agent.catalog_revision,
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if provided != expected {
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"Agent state changed; reload before retrying",
|
||||||
|
json!({
|
||||||
|
"error_code": "agent_stale_revision",
|
||||||
|
"current_version": agent.current_draft_version,
|
||||||
|
"latest_published_version": agent.latest_published_version,
|
||||||
|
"catalog_revision": agent.catalog_revision,
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
crate::service::AdminService::agent_state_expectation(&agent)
|
||||||
|
}
|
||||||
|
|
||||||
pub async fn publish_agent(
|
pub async fn publish_agent(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
Json(payload): Json<PublishPayload>,
|
Json(payload): Json<PublishPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected_state = require_agent_precondition(&state, &path, &headers).await?;
|
||||||
let published = state
|
let published = state
|
||||||
.service
|
.service
|
||||||
.publish_agent(
|
.publish_agent(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
payload.version,
|
payload.version,
|
||||||
|
Some(&expected_state),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(published)))
|
Ok(Json(json!(published)))
|
||||||
@@ -168,12 +234,15 @@ pub async fn publish_agent(
|
|||||||
pub async fn unpublish_agent(
|
pub async fn unpublish_agent(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected_state = require_agent_precondition(&state, &path, &headers).await?;
|
||||||
let updated = state
|
let updated = state
|
||||||
.service
|
.service
|
||||||
.unpublish_agent(
|
.unpublish_agent(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
|
Some(&expected_state),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(updated)))
|
Ok(Json(json!(updated)))
|
||||||
@@ -182,12 +251,15 @@ pub async fn unpublish_agent(
|
|||||||
pub async fn archive_agent(
|
pub async fn archive_agent(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected_state = require_agent_precondition(&state, &path, &headers).await?;
|
||||||
let updated = state
|
let updated = state
|
||||||
.service
|
.service
|
||||||
.archive_agent(
|
.archive_agent(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
|
Some(&expected_state),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(updated)))
|
Ok(Json(json!(updated)))
|
||||||
@@ -210,14 +282,19 @@ pub async fn list_agent_platform_api_keys(
|
|||||||
pub async fn create_agent_platform_api_key(
|
pub async fn create_agent_platform_api_key(
|
||||||
Path(path): Path<WorkspaceAgentPath>,
|
Path(path): Path<WorkspaceAgentPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
|
Extension(request_context): Extension<RequestContext>,
|
||||||
Json(payload): Json<PlatformApiKeyPayload>,
|
Json(payload): Json<PlatformApiKeyPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let audit_context =
|
||||||
|
AdminAuditContext::from_session_and_correlation(&session, &request_context.correlation);
|
||||||
let created = state
|
let created = state
|
||||||
.service
|
.service
|
||||||
.create_agent_platform_api_key(
|
.create_agent_platform_api_key(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
payload,
|
payload,
|
||||||
|
Some(&audit_context),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(created)))
|
Ok(Json(json!(created)))
|
||||||
@@ -226,13 +303,18 @@ pub async fn create_agent_platform_api_key(
|
|||||||
pub async fn revoke_agent_platform_api_key(
|
pub async fn revoke_agent_platform_api_key(
|
||||||
Path(path): Path<WorkspaceAgentPlatformApiKeyPath>,
|
Path(path): Path<WorkspaceAgentPlatformApiKeyPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
|
Extension(request_context): Extension<RequestContext>,
|
||||||
) -> Result<axum::http::StatusCode, ApiError> {
|
) -> Result<axum::http::StatusCode, ApiError> {
|
||||||
|
let audit_context =
|
||||||
|
AdminAuditContext::from_session_and_correlation(&session, &request_context.correlation);
|
||||||
state
|
state
|
||||||
.service
|
.service
|
||||||
.revoke_agent_platform_api_key(
|
.revoke_agent_platform_api_key(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
&path.key_id.as_str().into(),
|
&path.key_id.as_str().into(),
|
||||||
|
Some(&audit_context),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(axum::http::StatusCode::NO_CONTENT)
|
Ok(axum::http::StatusCode::NO_CONTENT)
|
||||||
@@ -241,13 +323,18 @@ pub async fn revoke_agent_platform_api_key(
|
|||||||
pub async fn delete_agent_platform_api_key(
|
pub async fn delete_agent_platform_api_key(
|
||||||
Path(path): Path<WorkspaceAgentPlatformApiKeyPath>,
|
Path(path): Path<WorkspaceAgentPlatformApiKeyPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
|
Extension(request_context): Extension<RequestContext>,
|
||||||
) -> Result<axum::http::StatusCode, ApiError> {
|
) -> Result<axum::http::StatusCode, ApiError> {
|
||||||
|
let audit_context =
|
||||||
|
AdminAuditContext::from_session_and_correlation(&session, &request_context.correlation);
|
||||||
state
|
state
|
||||||
.service
|
.service
|
||||||
.delete_agent_platform_api_key(
|
.delete_agent_platform_api_key(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.agent_id.as_str().into(),
|
&path.agent_id.as_str().into(),
|
||||||
&path.key_id.as_str().into(),
|
&path.key_id.as_str().into(),
|
||||||
|
Some(&audit_context),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(axum::http::StatusCode::NO_CONTENT)
|
Ok(axum::http::StatusCode::NO_CONTENT)
|
||||||
|
|||||||
@@ -5,18 +5,52 @@ use serde_json::json;
|
|||||||
use crate::{
|
use crate::{
|
||||||
auth::{AuthenticatedSession, cleared_session_cookie, extract_session_token, session_cookie},
|
auth::{AuthenticatedSession, cleared_session_cookie, extract_session_token, session_cookie},
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
|
rate_limit::ClientIdentityBucket,
|
||||||
service::{
|
service::{
|
||||||
ChangePasswordPayload, LoginPayload, UpdateCurrentWorkspacePayload, UpdateProfilePayload,
|
ChangePasswordPayload, CompleteBootstrapPayload, LoginPayload,
|
||||||
|
UpdateCurrentWorkspacePayload, UpdateProfilePayload,
|
||||||
},
|
},
|
||||||
state::AppState,
|
state::AppState,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
pub async fn bootstrap_status(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
) -> Result<Json<serde_json::Value>, ApiError> {
|
||||||
|
Ok(Json(serde_json::json!(
|
||||||
|
state.service.bootstrap_status().await?
|
||||||
|
)))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn complete_bootstrap(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
jar: CookieJar,
|
||||||
|
Json(payload): Json<CompleteBootstrapPayload>,
|
||||||
|
) -> Result<impl IntoResponse, ApiError> {
|
||||||
|
let (session_data, session) = state.service.complete_bootstrap(payload).await?;
|
||||||
|
let cookie_value = format!(
|
||||||
|
"{}.{}",
|
||||||
|
session_data.session_id.as_str(),
|
||||||
|
session_data.value
|
||||||
|
);
|
||||||
|
let jar = jar.add(session_cookie(state.service.auth_settings(), &cookie_value));
|
||||||
|
|
||||||
|
Ok((jar, Json(serde_json::json!(session))))
|
||||||
|
}
|
||||||
|
|
||||||
pub async fn login(
|
pub async fn login(
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
jar: CookieJar,
|
jar: CookieJar,
|
||||||
|
client_bucket: Option<Extension<ClientIdentityBucket>>,
|
||||||
Json(payload): Json<LoginPayload>,
|
Json(payload): Json<LoginPayload>,
|
||||||
) -> Result<impl IntoResponse, ApiError> {
|
) -> Result<impl IntoResponse, ApiError> {
|
||||||
let (session_data, session) = state.service.login(payload).await?;
|
let client_bucket = client_bucket
|
||||||
|
.as_ref()
|
||||||
|
.map(|Extension(bucket)| bucket.0.as_str())
|
||||||
|
.unwrap_or("anonymous:/api/auth/login");
|
||||||
|
let (session_data, session) = state
|
||||||
|
.service
|
||||||
|
.login_with_client_bucket(payload, client_bucket)
|
||||||
|
.await?;
|
||||||
let cookie_value = format!(
|
let cookie_value = format!(
|
||||||
"{}.{}",
|
"{}.{}",
|
||||||
session_data.session_id.as_str(),
|
session_data.session_id.as_str(),
|
||||||
@@ -54,6 +88,22 @@ pub async fn get_session(
|
|||||||
Ok(Json(serde_json::json!(session)))
|
Ok(Json(serde_json::json!(session)))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub async fn refresh_session_csrf(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
jar: CookieJar,
|
||||||
|
) -> Result<Json<serde_json::Value>, ApiError> {
|
||||||
|
let (session_id, session_value) = extract_session_token(&jar)
|
||||||
|
.ok_or_else(|| ApiError::unauthorized("authentication required"))?;
|
||||||
|
state
|
||||||
|
.service
|
||||||
|
.get_session(&session_id, &session_value)
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| ApiError::unauthorized("session is invalid or expired"))?;
|
||||||
|
let csrf_token = state.service.rotate_session_csrf_token(&session_id).await?;
|
||||||
|
|
||||||
|
Ok(Json(json!({ "csrf_token": csrf_token })))
|
||||||
|
}
|
||||||
|
|
||||||
pub async fn get_profile(
|
pub async fn get_profile(
|
||||||
Extension(session): Extension<AuthenticatedSession>,
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
) -> Result<Json<serde_json::Value>, ApiError> {
|
) -> Result<Json<serde_json::Value>, ApiError> {
|
||||||
@@ -73,6 +123,7 @@ pub async fn update_profile(
|
|||||||
.service
|
.service
|
||||||
.update_profile(
|
.update_profile(
|
||||||
&session.user.id,
|
&session.user.id,
|
||||||
|
&session.session_id,
|
||||||
session.current_workspace_id.as_ref(),
|
session.current_workspace_id.as_ref(),
|
||||||
payload,
|
payload,
|
||||||
)
|
)
|
||||||
|
|||||||
@@ -1,11 +1,17 @@
|
|||||||
use axum::{
|
use axum::{
|
||||||
Json,
|
Extension, Json,
|
||||||
extract::{Path, State},
|
extract::{Path, State},
|
||||||
};
|
};
|
||||||
use serde::Deserialize;
|
use serde::Deserialize;
|
||||||
use serde_json::{Value, json};
|
use serde_json::{Value, json};
|
||||||
|
|
||||||
use crate::{error::ApiError, service::AuthProfilePayload, state::AppState};
|
use crate::{
|
||||||
|
auth::AuthenticatedSession,
|
||||||
|
error::ApiError,
|
||||||
|
request_context::RequestContext,
|
||||||
|
service::{AdminAuditContext, AuthProfilePayload},
|
||||||
|
state::AppState,
|
||||||
|
};
|
||||||
|
|
||||||
#[derive(Deserialize)]
|
#[derive(Deserialize)]
|
||||||
pub struct WorkspacePath {
|
pub struct WorkspacePath {
|
||||||
@@ -32,11 +38,19 @@ pub async fn list_auth_profiles(
|
|||||||
pub async fn create_auth_profile(
|
pub async fn create_auth_profile(
|
||||||
Path(path): Path<WorkspacePath>,
|
Path(path): Path<WorkspacePath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
|
Extension(request_context): Extension<RequestContext>,
|
||||||
Json(payload): Json<AuthProfilePayload>,
|
Json(payload): Json<AuthProfilePayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let audit_context =
|
||||||
|
AdminAuditContext::from_session_and_correlation(&session, &request_context.correlation);
|
||||||
let profile = state
|
let profile = state
|
||||||
.service
|
.service
|
||||||
.create_auth_profile(&path.workspace_id.as_str().into(), payload)
|
.create_auth_profile(
|
||||||
|
&path.workspace_id.as_str().into(),
|
||||||
|
payload,
|
||||||
|
Some(&audit_context),
|
||||||
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(profile)))
|
Ok(Json(json!(profile)))
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,13 +1,18 @@
|
|||||||
use axum::{
|
use axum::{
|
||||||
Json,
|
Json,
|
||||||
extract::{Path, Query, State},
|
extract::{Path, Query, State},
|
||||||
|
http::{
|
||||||
|
HeaderValue, StatusCode,
|
||||||
|
header::{CONTENT_DISPOSITION, CONTENT_TYPE},
|
||||||
|
},
|
||||||
|
response::{IntoResponse, Response},
|
||||||
};
|
};
|
||||||
use serde_json::{Value, json};
|
use serde_json::{Value, json};
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
routes::access::WorkspacePath,
|
routes::access::WorkspacePath,
|
||||||
service::{ApprovalsQuery, LogsQuery, UsageRequestQuery},
|
service::{ApprovalDecisionPayload, ApprovalsQuery, LogsQuery, UsageRequestQuery},
|
||||||
state::AppState,
|
state::AppState,
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -44,7 +49,49 @@ pub async fn list_logs(
|
|||||||
.service
|
.service
|
||||||
.list_logs(&path.workspace_id.as_str().into(), query)
|
.list_logs(&path.workspace_id.as_str().into(), query)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!({ "items": items })))
|
Ok(Json(json!(items)))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn export_logs_csv(
|
||||||
|
Path(path): Path<WorkspacePath>,
|
||||||
|
Query(query): Query<LogsQuery>,
|
||||||
|
State(state): State<AppState>,
|
||||||
|
) -> Result<Response, ApiError> {
|
||||||
|
let csv = state
|
||||||
|
.service
|
||||||
|
.export_logs_csv(&path.workspace_id.as_str().into(), query)
|
||||||
|
.await?;
|
||||||
|
let mut response = (StatusCode::OK, csv).into_response();
|
||||||
|
response.headers_mut().insert(
|
||||||
|
CONTENT_TYPE,
|
||||||
|
HeaderValue::from_static("text/csv; charset=utf-8"),
|
||||||
|
);
|
||||||
|
response.headers_mut().insert(
|
||||||
|
CONTENT_DISPOSITION,
|
||||||
|
HeaderValue::from_static("attachment; filename=\"crank-invocation-history.csv\""),
|
||||||
|
);
|
||||||
|
Ok(response)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn export_usage_csv(
|
||||||
|
Path(path): Path<WorkspacePath>,
|
||||||
|
Query(query): Query<UsageRequestQuery>,
|
||||||
|
State(state): State<AppState>,
|
||||||
|
) -> Result<Response, ApiError> {
|
||||||
|
let csv = state
|
||||||
|
.service
|
||||||
|
.export_usage_csv(&path.workspace_id.as_str().into(), query)
|
||||||
|
.await?;
|
||||||
|
let mut response = (StatusCode::OK, csv).into_response();
|
||||||
|
response.headers_mut().insert(
|
||||||
|
CONTENT_TYPE,
|
||||||
|
HeaderValue::from_static("text/csv; charset=utf-8"),
|
||||||
|
);
|
||||||
|
response.headers_mut().insert(
|
||||||
|
CONTENT_DISPOSITION,
|
||||||
|
HeaderValue::from_static("attachment; filename=\"crank-usage.csv\""),
|
||||||
|
);
|
||||||
|
Ok(response)
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn get_log(
|
pub async fn get_log(
|
||||||
@@ -87,6 +134,38 @@ pub async fn get_approval(
|
|||||||
Ok(Json(json!(item)))
|
Ok(Json(json!(item)))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub async fn approve_approval(
|
||||||
|
Path(path): Path<WorkspaceApprovalPath>,
|
||||||
|
State(state): State<AppState>,
|
||||||
|
Json(payload): Json<ApprovalDecisionPayload>,
|
||||||
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let item = state
|
||||||
|
.service
|
||||||
|
.approve_approval(
|
||||||
|
&path.workspace_id.as_str().into(),
|
||||||
|
&path.approval_id.as_str().into(),
|
||||||
|
payload,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
Ok(Json(json!(item)))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn deny_approval(
|
||||||
|
Path(path): Path<WorkspaceApprovalPath>,
|
||||||
|
State(state): State<AppState>,
|
||||||
|
Json(payload): Json<ApprovalDecisionPayload>,
|
||||||
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let item = state
|
||||||
|
.service
|
||||||
|
.deny_approval(
|
||||||
|
&path.workspace_id.as_str().into(),
|
||||||
|
&path.approval_id.as_str().into(),
|
||||||
|
payload,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
Ok(Json(json!(item)))
|
||||||
|
}
|
||||||
|
|
||||||
pub async fn get_usage(
|
pub async fn get_usage(
|
||||||
Path(path): Path<WorkspacePath>,
|
Path(path): Path<WorkspacePath>,
|
||||||
Query(query): Query<UsageRequestQuery>,
|
Query(query): Query<UsageRequestQuery>,
|
||||||
|
|||||||
@@ -0,0 +1,59 @@
|
|||||||
|
use axum::{
|
||||||
|
Json,
|
||||||
|
extract::{Path, State},
|
||||||
|
};
|
||||||
|
|
||||||
|
use crate::{
|
||||||
|
error::ApiError,
|
||||||
|
service::{
|
||||||
|
OnboardingEventPayload, OnboardingEventResponse, OnboardingResponse,
|
||||||
|
ResetOnboardingSelectionPayload, ResetOnboardingSelectionResponse,
|
||||||
|
},
|
||||||
|
state::AppState,
|
||||||
|
};
|
||||||
|
|
||||||
|
#[derive(serde::Deserialize)]
|
||||||
|
pub struct WorkspaceOnboardingPath {
|
||||||
|
pub workspace_id: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn reset_onboarding_selection(
|
||||||
|
Path(path): Path<WorkspaceOnboardingPath>,
|
||||||
|
State(state): State<AppState>,
|
||||||
|
Json(payload): Json<ResetOnboardingSelectionPayload>,
|
||||||
|
) -> Result<Json<ResetOnboardingSelectionResponse>, ApiError> {
|
||||||
|
Ok(Json(
|
||||||
|
state
|
||||||
|
.service
|
||||||
|
.reset_onboarding_selection(
|
||||||
|
&path.workspace_id.as_str().into(),
|
||||||
|
payload.expected_revision,
|
||||||
|
)
|
||||||
|
.await?,
|
||||||
|
))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn get_onboarding(
|
||||||
|
Path(path): Path<WorkspaceOnboardingPath>,
|
||||||
|
State(state): State<AppState>,
|
||||||
|
) -> Result<Json<OnboardingResponse>, ApiError> {
|
||||||
|
Ok(Json(
|
||||||
|
state
|
||||||
|
.service
|
||||||
|
.get_onboarding(&path.workspace_id.as_str().into())
|
||||||
|
.await?,
|
||||||
|
))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn record_onboarding_event(
|
||||||
|
Path(path): Path<WorkspaceOnboardingPath>,
|
||||||
|
State(state): State<AppState>,
|
||||||
|
Json(payload): Json<OnboardingEventPayload>,
|
||||||
|
) -> Result<Json<OnboardingEventResponse>, ApiError> {
|
||||||
|
Ok(Json(
|
||||||
|
state
|
||||||
|
.service
|
||||||
|
.record_onboarding_event(&path.workspace_id.as_str().into(), payload)
|
||||||
|
.await?,
|
||||||
|
))
|
||||||
|
}
|
||||||
@@ -1,9 +1,10 @@
|
|||||||
use axum::{
|
use axum::{
|
||||||
Json,
|
Json,
|
||||||
extract::{Extension, Path, Query, State},
|
extract::{Extension, Path, Query, State, rejection::StringRejection},
|
||||||
http::{HeaderMap, StatusCode, header},
|
http::{HeaderMap, StatusCode, header},
|
||||||
response::IntoResponse,
|
response::IntoResponse,
|
||||||
};
|
};
|
||||||
|
use crank_registry::OperationStateExpectation;
|
||||||
use serde::Deserialize;
|
use serde::Deserialize;
|
||||||
use serde_json::{Value, json};
|
use serde_json::{Value, json};
|
||||||
|
|
||||||
@@ -79,7 +80,7 @@ pub async fn analyze_operation_quality(
|
|||||||
pub async fn get_operation(
|
pub async fn get_operation(
|
||||||
Path(path): Path<WorkspaceOperationPath>,
|
Path(path): Path<WorkspaceOperationPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<impl IntoResponse, ApiError> {
|
||||||
let operation = state
|
let operation = state
|
||||||
.service
|
.service
|
||||||
.get_operation(
|
.get_operation(
|
||||||
@@ -87,20 +88,30 @@ pub async fn get_operation(
|
|||||||
&path.operation_id.as_str().into(),
|
&path.operation_id.as_str().into(),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(operation)))
|
let etag = crate::service::AdminService::operation_state_etag(&operation);
|
||||||
|
let mut headers = HeaderMap::new();
|
||||||
|
headers.insert(
|
||||||
|
header::ETAG,
|
||||||
|
header::HeaderValue::from_str(&etag)
|
||||||
|
.map_err(|_| ApiError::internal("invalid operation etag"))?,
|
||||||
|
);
|
||||||
|
Ok((headers, Json(json!(operation))))
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn update_operation(
|
pub async fn update_operation(
|
||||||
Path(path): Path<WorkspaceOperationPath>,
|
Path(path): Path<WorkspaceOperationPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
Json(payload): Json<UpdateOperationPayload>,
|
Json(payload): Json<UpdateOperationPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected = require_operation_precondition(&state, &path, &headers).await?;
|
||||||
let result = state
|
let result = state
|
||||||
.service
|
.service
|
||||||
.update_operation(
|
.update_operation(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.operation_id.as_str().into(),
|
&path.operation_id.as_str().into(),
|
||||||
payload,
|
payload,
|
||||||
|
&expected,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(result)))
|
Ok(Json(json!(result)))
|
||||||
@@ -109,12 +120,15 @@ pub async fn update_operation(
|
|||||||
pub async fn delete_operation(
|
pub async fn delete_operation(
|
||||||
Path(path): Path<WorkspaceOperationPath>,
|
Path(path): Path<WorkspaceOperationPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected = require_operation_precondition(&state, &path, &headers).await?;
|
||||||
let result = state
|
let result = state
|
||||||
.service
|
.service
|
||||||
.delete_operation(
|
.delete_operation(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.operation_id.as_str().into(),
|
&path.operation_id.as_str().into(),
|
||||||
|
&expected,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(result)))
|
Ok(Json(json!(result)))
|
||||||
@@ -123,7 +137,7 @@ pub async fn delete_operation(
|
|||||||
pub async fn get_operation_version(
|
pub async fn get_operation_version(
|
||||||
Path(path): Path<WorkspaceOperationVersionPath>,
|
Path(path): Path<WorkspaceOperationVersionPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<impl IntoResponse, ApiError> {
|
||||||
let version = state
|
let version = state
|
||||||
.service
|
.service
|
||||||
.get_operation_version(
|
.get_operation_version(
|
||||||
@@ -132,20 +146,30 @@ pub async fn get_operation_version(
|
|||||||
path.version,
|
path.version,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(version)))
|
let etag = crate::service::AdminService::operation_version_etag(&version)?;
|
||||||
|
let mut headers = HeaderMap::new();
|
||||||
|
headers.insert(
|
||||||
|
header::ETAG,
|
||||||
|
header::HeaderValue::from_str(&etag)
|
||||||
|
.map_err(|_| ApiError::internal("invalid operation version etag"))?,
|
||||||
|
);
|
||||||
|
Ok((headers, Json(json!(version))))
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn create_version(
|
pub async fn create_version(
|
||||||
Path(path): Path<WorkspaceOperationPath>,
|
Path(path): Path<WorkspaceOperationPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
Json(payload): Json<NewVersionPayload>,
|
Json(payload): Json<NewVersionPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected = require_operation_precondition(&state, &path, &headers).await?;
|
||||||
let created = state
|
let created = state
|
||||||
.service
|
.service
|
||||||
.create_version(
|
.create_version(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.operation_id.as_str().into(),
|
&path.operation_id.as_str().into(),
|
||||||
payload,
|
payload,
|
||||||
|
&expected,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(created)))
|
Ok(Json(json!(created)))
|
||||||
@@ -154,14 +178,17 @@ pub async fn create_version(
|
|||||||
pub async fn publish_operation(
|
pub async fn publish_operation(
|
||||||
Path(path): Path<WorkspaceOperationPath>,
|
Path(path): Path<WorkspaceOperationPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
Json(payload): Json<PublishPayload>,
|
Json(payload): Json<PublishPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected = require_operation_precondition(&state, &path, &headers).await?;
|
||||||
let published = state
|
let published = state
|
||||||
.service
|
.service
|
||||||
.publish_operation(
|
.publish_operation(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.operation_id.as_str().into(),
|
&path.operation_id.as_str().into(),
|
||||||
payload.version,
|
payload.version,
|
||||||
|
&expected,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(published)))
|
Ok(Json(json!(published)))
|
||||||
@@ -170,17 +197,63 @@ pub async fn publish_operation(
|
|||||||
pub async fn archive_operation(
|
pub async fn archive_operation(
|
||||||
Path(path): Path<WorkspaceOperationPath>,
|
Path(path): Path<WorkspaceOperationPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
headers: HeaderMap,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let expected = require_operation_precondition(&state, &path, &headers).await?;
|
||||||
let archived = state
|
let archived = state
|
||||||
.service
|
.service
|
||||||
.archive_operation(
|
.archive_operation(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.operation_id.as_str().into(),
|
&path.operation_id.as_str().into(),
|
||||||
|
&expected,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(archived)))
|
Ok(Json(json!(archived)))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn require_operation_precondition(
|
||||||
|
state: &AppState,
|
||||||
|
path: &WorkspaceOperationPath,
|
||||||
|
headers: &HeaderMap,
|
||||||
|
) -> Result<OperationStateExpectation, ApiError> {
|
||||||
|
let detail = state
|
||||||
|
.service
|
||||||
|
.get_operation(
|
||||||
|
&path.workspace_id.as_str().into(),
|
||||||
|
&path.operation_id.as_str().into(),
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
let expected = crate::service::AdminService::operation_state_etag(&detail);
|
||||||
|
let provided = headers
|
||||||
|
.get(header::IF_MATCH)
|
||||||
|
.and_then(|value| value.to_str().ok())
|
||||||
|
.ok_or_else(|| {
|
||||||
|
ApiError::precondition_required_with_context(
|
||||||
|
"If-Match is required for Operation mutation",
|
||||||
|
json!({
|
||||||
|
"error_code": "operation_precondition_required",
|
||||||
|
"current_version": detail.current_draft_version,
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if provided != expected {
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"Operation state changed; reload before retrying",
|
||||||
|
json!({
|
||||||
|
"error_code": "operation_stale_version",
|
||||||
|
"current_version": detail.current_draft_version,
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Ok(OperationStateExpectation {
|
||||||
|
current_draft_version: detail.current_draft_version,
|
||||||
|
status: detail.status,
|
||||||
|
latest_published_version: detail.latest_published_version,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
pub async fn run_test(
|
pub async fn run_test(
|
||||||
Path(path): Path<WorkspaceOperationPath>,
|
Path(path): Path<WorkspaceOperationPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
@@ -285,11 +358,33 @@ pub async fn import_operation(
|
|||||||
Path(path): Path<WorkspacePath>,
|
Path(path): Path<WorkspacePath>,
|
||||||
Query(query): Query<ImportQuery>,
|
Query(query): Query<ImportQuery>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
body: String,
|
headers: HeaderMap,
|
||||||
|
body: Result<String, StringRejection>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let body = body.map_err(|rejection| match rejection {
|
||||||
|
StringRejection::InvalidUtf8(_) => ApiError::unprocessable_with_context(
|
||||||
|
"operation yaml is not valid UTF-8",
|
||||||
|
json!({ "error_code": "operation_yaml_invalid" }),
|
||||||
|
),
|
||||||
|
StringRejection::FailedToBufferBody(_) => ApiError::payload_too_large_with_context(
|
||||||
|
"operation yaml exceeds the 256 KiB limit",
|
||||||
|
json!({ "error_code": "operation_yaml_too_large" }),
|
||||||
|
),
|
||||||
|
_ => ApiError::unprocessable_with_context(
|
||||||
|
"operation yaml body is invalid",
|
||||||
|
json!({ "error_code": "operation_yaml_invalid" }),
|
||||||
|
),
|
||||||
|
})?;
|
||||||
let imported = state
|
let imported = state
|
||||||
.service
|
.service
|
||||||
.import_operation(&path.workspace_id.as_str().into(), query, &body)
|
.import_operation(
|
||||||
|
&path.workspace_id.as_str().into(),
|
||||||
|
query,
|
||||||
|
&body,
|
||||||
|
headers
|
||||||
|
.get(header::IF_MATCH)
|
||||||
|
.and_then(|value| value.to_str().ok()),
|
||||||
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(imported)))
|
Ok(Json(json!(imported)))
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -8,7 +8,8 @@ use serde_json::{Value, json};
|
|||||||
use crate::{
|
use crate::{
|
||||||
auth::AuthenticatedSession,
|
auth::AuthenticatedSession,
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
service::{RotateSecretPayload, SecretPayload},
|
request_context::RequestContext,
|
||||||
|
service::{AdminAuditContext, RotateSecretPayload, SecretPayload},
|
||||||
state::AppState,
|
state::AppState,
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -38,14 +39,18 @@ pub async fn create_secret(
|
|||||||
Path(path): Path<WorkspacePath>,
|
Path(path): Path<WorkspacePath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
Extension(session): Extension<AuthenticatedSession>,
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
|
Extension(request_context): Extension<RequestContext>,
|
||||||
Json(payload): Json<SecretPayload>,
|
Json(payload): Json<SecretPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let audit_context =
|
||||||
|
AdminAuditContext::from_session_and_correlation(&session, &request_context.correlation);
|
||||||
let secret = state
|
let secret = state
|
||||||
.service
|
.service
|
||||||
.create_secret(
|
.create_secret(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
Some(&session.user.id),
|
Some(&session.user.id),
|
||||||
payload,
|
payload,
|
||||||
|
Some(&audit_context),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(secret)))
|
Ok(Json(json!(secret)))
|
||||||
@@ -69,8 +74,11 @@ pub async fn rotate_secret(
|
|||||||
Path(path): Path<WorkspaceSecretPath>,
|
Path(path): Path<WorkspaceSecretPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
Extension(session): Extension<AuthenticatedSession>,
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
|
Extension(request_context): Extension<RequestContext>,
|
||||||
Json(payload): Json<RotateSecretPayload>,
|
Json(payload): Json<RotateSecretPayload>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let audit_context =
|
||||||
|
AdminAuditContext::from_session_and_correlation(&session, &request_context.correlation);
|
||||||
let secret = state
|
let secret = state
|
||||||
.service
|
.service
|
||||||
.rotate_secret(
|
.rotate_secret(
|
||||||
@@ -78,6 +86,7 @@ pub async fn rotate_secret(
|
|||||||
&path.secret_id.as_str().into(),
|
&path.secret_id.as_str().into(),
|
||||||
Some(&session.user.id),
|
Some(&session.user.id),
|
||||||
payload,
|
payload,
|
||||||
|
Some(&audit_context),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!(secret)))
|
Ok(Json(json!(secret)))
|
||||||
@@ -86,12 +95,17 @@ pub async fn rotate_secret(
|
|||||||
pub async fn delete_secret(
|
pub async fn delete_secret(
|
||||||
Path(path): Path<WorkspaceSecretPath>,
|
Path(path): Path<WorkspaceSecretPath>,
|
||||||
State(state): State<AppState>,
|
State(state): State<AppState>,
|
||||||
|
Extension(session): Extension<AuthenticatedSession>,
|
||||||
|
Extension(request_context): Extension<RequestContext>,
|
||||||
) -> Result<Json<Value>, ApiError> {
|
) -> Result<Json<Value>, ApiError> {
|
||||||
|
let audit_context =
|
||||||
|
AdminAuditContext::from_session_and_correlation(&session, &request_context.correlation);
|
||||||
state
|
state
|
||||||
.service
|
.service
|
||||||
.delete_secret(
|
.delete_secret(
|
||||||
&path.workspace_id.as_str().into(),
|
&path.workspace_id.as_str().into(),
|
||||||
&path.secret_id.as_str().into(),
|
&path.secret_id.as_str().into(),
|
||||||
|
Some(&audit_context),
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
Ok(Json(json!({ "ok": true })))
|
Ok(Json(json!({ "ok": true })))
|
||||||
|
|||||||
+372
-97
@@ -4,23 +4,26 @@ use std::sync::Arc;
|
|||||||
|
|
||||||
use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
|
use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
|
||||||
use crank_core::{
|
use crank_core::{
|
||||||
AuditSink, AuthProfile, CapabilityProfile, CommunityCapabilityProfile, EditionCapabilities,
|
AuditActor, AuditEvent, AuditEventId, AuditSink, AuditTarget, AuditTargetKind, AuthProfile,
|
||||||
|
CapabilityProfile, CommunityCapabilityProfile, CorrelationContext, EditionCapabilities,
|
||||||
ExecutionMode, IdentityError, IdentityProvider, InvocationLog, InvocationLogId,
|
ExecutionMode, IdentityError, IdentityProvider, InvocationLog, InvocationLogId,
|
||||||
InvocationSource, NoopAuditSink, OperationSecurityLevel, OwnerOnlyPolicyEngine, PolicyEngine,
|
InvocationSource, NoopAuditSink, OperationSecurityLevel, OwnerOnlyPolicyEngine, PolicyEngine,
|
||||||
ProductEdition, Protocol, ToolQualityMappingRule, ToolQualityMappingSet, ToolQualitySchemaKind,
|
ProductEdition, Protocol, SecretStatus, ToolQualityMappingRule, ToolQualityMappingSet,
|
||||||
ToolQualitySchemaNode, UsagePeriod, WorkspaceId,
|
ToolQualitySchemaKind, ToolQualitySchemaNode, UsagePeriod, WorkspaceId,
|
||||||
};
|
};
|
||||||
use crank_mapping::{MappingRule, MappingSet};
|
use crank_mapping::{MappingRule, MappingSet};
|
||||||
use crank_registry::{
|
use crank_registry::{
|
||||||
AgentSummary, CreateInvocationLogRequest, InvocationHistoryWriteOutcome, OperationAgentRef,
|
AgentSummary, CreateInvocationLogRequest, InvocationHistoryWriteOutcome, OperationAgentRef,
|
||||||
OperationSummary, OperationUsageSummary, PostgresRegistry, RegistryOperation, UsageBucket,
|
OperationSummary, OperationUsageSummary, PostgresRegistry, RegistryError, RegistryOperation,
|
||||||
|
UsageBucket,
|
||||||
};
|
};
|
||||||
use crank_runtime::{
|
use crank_runtime::{
|
||||||
OutboundHttpPolicy, PreparedRequest, ResolvedAuth, RuntimeError, RuntimeExecutor, SecretCrypto,
|
OutboundHttpPolicy, ResolvedAuth, RuntimeError, RuntimeExecutor, SecretCrypto,
|
||||||
};
|
};
|
||||||
use crank_schema::{Schema, SchemaKind};
|
use crank_schema::{Schema, SchemaKind};
|
||||||
use crank_trace::{DbOperation, ErrorCategory, Stage, StageOutcome, observe_db_query};
|
use crank_trace::{DbOperation, ErrorCategory, Stage, StageOutcome, observe_db_query};
|
||||||
use serde_json::{Value, json};
|
use rand::RngExt;
|
||||||
|
use serde_json::json;
|
||||||
use sha2::{Digest, Sha256};
|
use sha2::{Digest, Sha256};
|
||||||
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
use tracing::Instrument;
|
use tracing::Instrument;
|
||||||
@@ -33,6 +36,7 @@ mod demo;
|
|||||||
mod import_export;
|
mod import_export;
|
||||||
mod imports;
|
mod imports;
|
||||||
mod observability;
|
mod observability;
|
||||||
|
mod onboarding;
|
||||||
mod operation_validation;
|
mod operation_validation;
|
||||||
mod operations;
|
mod operations;
|
||||||
mod samples;
|
mod samples;
|
||||||
@@ -40,7 +44,11 @@ mod secrets;
|
|||||||
mod upstreams;
|
mod upstreams;
|
||||||
mod workspaces;
|
mod workspaces;
|
||||||
|
|
||||||
use crate::{auth::AuthSettings, error::ApiError, storage::LocalArtifactStorage};
|
use crate::{
|
||||||
|
auth::{AuthSettings, AuthenticatedSession},
|
||||||
|
error::ApiError,
|
||||||
|
storage::LocalArtifactStorage,
|
||||||
|
};
|
||||||
use operation_validation::{
|
use operation_validation::{
|
||||||
validate_approval_policy, validate_execution_timeout, validate_idempotency_policy,
|
validate_approval_policy, validate_execution_timeout, validate_idempotency_policy,
|
||||||
validate_protocol_target, validate_response_cache_policy,
|
validate_protocol_target, validate_response_cache_policy,
|
||||||
@@ -58,6 +66,7 @@ pub struct AdminService {
|
|||||||
audit_sink: Arc<dyn AuditSink>,
|
audit_sink: Arc<dyn AuditSink>,
|
||||||
capability_profile: Arc<dyn CapabilityProfile>,
|
capability_profile: Arc<dyn CapabilityProfile>,
|
||||||
outbound_http_policy: OutboundHttpPolicy,
|
outbound_http_policy: OutboundHttpPolicy,
|
||||||
|
public_base_url: String,
|
||||||
}
|
}
|
||||||
|
|
||||||
pub struct AdminServiceBuilder {
|
pub struct AdminServiceBuilder {
|
||||||
@@ -71,10 +80,46 @@ pub struct AdminServiceBuilder {
|
|||||||
audit_sink: Option<Arc<dyn AuditSink>>,
|
audit_sink: Option<Arc<dyn AuditSink>>,
|
||||||
capability_profile: Option<Arc<dyn CapabilityProfile>>,
|
capability_profile: Option<Arc<dyn CapabilityProfile>>,
|
||||||
outbound_http_policy: OutboundHttpPolicy,
|
outbound_http_policy: OutboundHttpPolicy,
|
||||||
|
public_base_url: String,
|
||||||
}
|
}
|
||||||
|
|
||||||
pub use crate::dto::*;
|
pub use crate::dto::*;
|
||||||
|
|
||||||
|
#[derive(Clone, Debug)]
|
||||||
|
pub struct AdminAuditContext {
|
||||||
|
actor: AuditActor,
|
||||||
|
request_id: String,
|
||||||
|
trace_id: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl AdminAuditContext {
|
||||||
|
pub fn from_session_and_correlation(
|
||||||
|
session: &AuthenticatedSession,
|
||||||
|
correlation: &CorrelationContext,
|
||||||
|
) -> Self {
|
||||||
|
Self {
|
||||||
|
actor: AuditActor {
|
||||||
|
user_id: session.user.id.clone(),
|
||||||
|
email: session.user.email.clone(),
|
||||||
|
session_id: Some(session.session_id.clone()),
|
||||||
|
},
|
||||||
|
request_id: correlation.request_id().as_str().to_owned(),
|
||||||
|
trace_id: correlation.trace_id().as_str().to_owned(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Clone, Copy, Debug)]
|
||||||
|
pub(super) struct CredentialAuditRecord<'a> {
|
||||||
|
pub action: &'static str,
|
||||||
|
pub target_kind: AuditTargetKind,
|
||||||
|
pub workspace_id: &'a WorkspaceId,
|
||||||
|
pub target_id: &'a str,
|
||||||
|
pub credential_type: &'static str,
|
||||||
|
pub outcome: &'static str,
|
||||||
|
pub reason: &'a str,
|
||||||
|
}
|
||||||
|
|
||||||
impl AdminService {
|
impl AdminService {
|
||||||
pub async fn readiness(&self) -> Result<(), ApiError> {
|
pub async fn readiness(&self) -> Result<(), ApiError> {
|
||||||
self.registry.ping().await?;
|
self.registry.ping().await?;
|
||||||
@@ -132,6 +177,19 @@ impl AdminService {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn runtime_credential_error_code(error: &RuntimeError) -> &'static str {
|
||||||
|
match error {
|
||||||
|
RuntimeError::AuthorizationStoreUnavailable => "authorization_store_unavailable",
|
||||||
|
RuntimeError::MissingAuthProfile { .. } => "auth_profile_not_found",
|
||||||
|
RuntimeError::InvalidAuthProfileConfig { .. } => "auth_profile_invalid",
|
||||||
|
RuntimeError::MissingSecret { .. } => "secret_not_found",
|
||||||
|
RuntimeError::MissingSecretVersion { .. } => "secret_version_not_found",
|
||||||
|
RuntimeError::InvalidAuthSecretValue { .. } => "secret_invalid",
|
||||||
|
RuntimeError::SecretCrypto { .. } => "secret_crypto_failed",
|
||||||
|
_ => "credential_resolution_failed",
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
impl AdminServiceBuilder {
|
impl AdminServiceBuilder {
|
||||||
pub fn new(
|
pub fn new(
|
||||||
registry: PostgresRegistry,
|
registry: PostgresRegistry,
|
||||||
@@ -151,6 +209,7 @@ impl AdminServiceBuilder {
|
|||||||
audit_sink: None,
|
audit_sink: None,
|
||||||
capability_profile: None,
|
capability_profile: None,
|
||||||
outbound_http_policy: OutboundHttpPolicy::default(),
|
outbound_http_policy: OutboundHttpPolicy::default(),
|
||||||
|
public_base_url: "http://localhost:3000".to_owned(),
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -164,6 +223,11 @@ impl AdminServiceBuilder {
|
|||||||
self
|
self
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub fn with_public_base_url(mut self, public_base_url: String) -> Self {
|
||||||
|
self.public_base_url = public_base_url.trim_end_matches('/').to_owned();
|
||||||
|
self
|
||||||
|
}
|
||||||
|
|
||||||
#[allow(dead_code)]
|
#[allow(dead_code)]
|
||||||
pub fn with_policy_engine(mut self, policy_engine: Arc<dyn PolicyEngine>) -> Self {
|
pub fn with_policy_engine(mut self, policy_engine: Arc<dyn PolicyEngine>) -> Self {
|
||||||
self.policy_engine = Some(policy_engine);
|
self.policy_engine = Some(policy_engine);
|
||||||
@@ -201,6 +265,7 @@ impl AdminServiceBuilder {
|
|||||||
.capability_profile
|
.capability_profile
|
||||||
.unwrap_or_else(|| Arc::new(CommunityCapabilityProfile)),
|
.unwrap_or_else(|| Arc::new(CommunityCapabilityProfile)),
|
||||||
outbound_http_policy: self.outbound_http_policy,
|
outbound_http_policy: self.outbound_http_policy,
|
||||||
|
public_base_url: self.public_base_url,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -254,10 +319,56 @@ impl AdminService {
|
|||||||
self.capability_profile().capabilities()
|
self.capability_profile().capabilities()
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn record_credential_audit(
|
||||||
|
&self,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
|
record: CredentialAuditRecord<'_>,
|
||||||
|
) {
|
||||||
|
let Some(audit_context) = audit_context else {
|
||||||
|
return;
|
||||||
|
};
|
||||||
|
|
||||||
|
let event = AuditEvent {
|
||||||
|
id: AuditEventId::new(new_prefixed_id("audit")),
|
||||||
|
occurred_at: OffsetDateTime::now_utc(),
|
||||||
|
actor: audit_context.actor.clone(),
|
||||||
|
action: record.action.to_owned(),
|
||||||
|
target: AuditTarget {
|
||||||
|
workspace_id: record.workspace_id.clone(),
|
||||||
|
kind: record.target_kind,
|
||||||
|
id: record.target_id.to_owned(),
|
||||||
|
},
|
||||||
|
payload: json!({
|
||||||
|
"credential_type": record.credential_type,
|
||||||
|
"outcome": record.outcome,
|
||||||
|
"reason": record.reason,
|
||||||
|
"request_id": audit_context.request_id,
|
||||||
|
"trace_id": audit_context.trace_id
|
||||||
|
}),
|
||||||
|
source_ip: None,
|
||||||
|
user_agent: None,
|
||||||
|
};
|
||||||
|
|
||||||
|
if self.audit_sink.record(event).await.is_err() {
|
||||||
|
tracing::warn!(
|
||||||
|
name: "admin.credential_audit.lost",
|
||||||
|
action = record.action,
|
||||||
|
credential_type = record.credential_type,
|
||||||
|
outcome = record.outcome,
|
||||||
|
reason = record.reason,
|
||||||
|
request_id = %audit_context.request_id,
|
||||||
|
trace_id = %audit_context.trace_id,
|
||||||
|
error_code = "audit_sink_failed",
|
||||||
|
"credential audit event was not recorded"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
async fn resolve_operation_auth(
|
async fn resolve_operation_auth(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
execution_config: &crank_core::ExecutionConfig,
|
execution_config: &crank_core::ExecutionConfig,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<Option<ResolvedAuth>, RuntimeError> {
|
) -> Result<Option<ResolvedAuth>, RuntimeError> {
|
||||||
let Some(auth_profile_id) = execution_config.auth_profile_ref.as_ref() else {
|
let Some(auth_profile_id) = execution_config.auth_profile_ref.as_ref() else {
|
||||||
return Ok(None);
|
return Ok(None);
|
||||||
@@ -271,15 +382,14 @@ impl AdminService {
|
|||||||
.get_auth_profile(workspace_id, auth_profile_id),
|
.get_auth_profile(workspace_id, auth_profile_id),
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.map_err(|error| RuntimeError::SecretCrypto {
|
.map_err(|_| RuntimeError::AuthorizationStoreUnavailable)?;
|
||||||
operation: "load auth profile",
|
let Some(auth_profile) = auth_profile else {
|
||||||
details: error.to_string(),
|
return Err(RuntimeError::MissingAuthProfile {
|
||||||
})?
|
auth_profile_id: auth_profile_id.as_str().to_owned(),
|
||||||
.ok_or_else(|| RuntimeError::MissingAuthProfile {
|
});
|
||||||
auth_profile_id: auth_profile_id.as_str().to_owned(),
|
};
|
||||||
})?;
|
|
||||||
|
|
||||||
self.resolve_auth_profile(workspace_id, &auth_profile)
|
self.resolve_auth_profile(workspace_id, &auth_profile, audit_context)
|
||||||
.await
|
.await
|
||||||
.map(Some)
|
.map(Some)
|
||||||
}
|
}
|
||||||
@@ -292,6 +402,17 @@ impl AdminService {
|
|||||||
ErrorCategory::Configuration.record(&span);
|
ErrorCategory::Configuration.record(&span);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
if let Err(error) = &result {
|
||||||
|
self.record_credential_resolution_failure(
|
||||||
|
audit_context,
|
||||||
|
workspace_id,
|
||||||
|
crank_core::AuditTargetKind::AuthProfile,
|
||||||
|
auth_profile_id.as_str(),
|
||||||
|
"auth_profile",
|
||||||
|
runtime_credential_error_code(error),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
result
|
result
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -299,6 +420,7 @@ impl AdminService {
|
|||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
auth_profile: &AuthProfile,
|
auth_profile: &AuthProfile,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<ResolvedAuth, RuntimeError> {
|
) -> Result<ResolvedAuth, RuntimeError> {
|
||||||
let mut secrets = BTreeMap::new();
|
let mut secrets = BTreeMap::new();
|
||||||
let used_at = OffsetDateTime::now_utc();
|
let used_at = OffsetDateTime::now_utc();
|
||||||
@@ -309,45 +431,156 @@ impl AdminService {
|
|||||||
self.registry.get_secret(workspace_id, secret_id),
|
self.registry.get_secret(workspace_id, secret_id),
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.map_err(|error| RuntimeError::SecretCrypto {
|
.map_err(|_| RuntimeError::AuthorizationStoreUnavailable)?;
|
||||||
operation: "load secret",
|
let Some(secret) = secret else {
|
||||||
details: error.to_string(),
|
let error = RuntimeError::MissingSecret {
|
||||||
})?
|
secret_id: secret_id.as_str().to_owned(),
|
||||||
.ok_or_else(|| RuntimeError::MissingSecret {
|
};
|
||||||
secret_id: secret_id.as_str().to_owned(),
|
self.record_credential_resolution_failure(
|
||||||
})?;
|
audit_context,
|
||||||
|
workspace_id,
|
||||||
|
crank_core::AuditTargetKind::Secret,
|
||||||
|
secret_id.as_str(),
|
||||||
|
"secret",
|
||||||
|
runtime_credential_error_code(&error),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
};
|
||||||
|
if secret.secret.status != SecretStatus::Active {
|
||||||
|
let error = RuntimeError::InvalidAuthSecretValue {
|
||||||
|
secret_id: secret_id.as_str().to_owned(),
|
||||||
|
reason: "secret is not active".to_owned(),
|
||||||
|
};
|
||||||
|
self.record_credential_resolution_failure(
|
||||||
|
audit_context,
|
||||||
|
workspace_id,
|
||||||
|
crank_core::AuditTargetKind::Secret,
|
||||||
|
secret_id.as_str(),
|
||||||
|
"secret",
|
||||||
|
runtime_credential_error_code(&error),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
let version = observe_db_query(
|
let version = observe_db_query(
|
||||||
DbOperation::SecretRead,
|
DbOperation::SecretRead,
|
||||||
self.registry
|
self.registry
|
||||||
.get_current_secret_version(workspace_id, secret_id),
|
.get_current_secret_version(workspace_id, secret_id),
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.map_err(|error| RuntimeError::SecretCrypto {
|
.map_err(|_| RuntimeError::AuthorizationStoreUnavailable)?;
|
||||||
operation: "load current secret version",
|
let Some(version) = version else {
|
||||||
details: error.to_string(),
|
let error = RuntimeError::MissingSecretVersion {
|
||||||
})?
|
secret_id: secret_id.as_str().to_owned(),
|
||||||
.ok_or_else(|| RuntimeError::MissingSecretVersion {
|
version: secret.secret.current_version,
|
||||||
secret_id: secret_id.as_str().to_owned(),
|
};
|
||||||
version: secret.secret.current_version,
|
self.record_credential_resolution_failure(
|
||||||
})?;
|
audit_context,
|
||||||
let plaintext = self.secret_crypto.decrypt(
|
workspace_id,
|
||||||
|
crank_core::AuditTargetKind::Secret,
|
||||||
|
secret_id.as_str(),
|
||||||
|
"secret",
|
||||||
|
runtime_credential_error_code(&error),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
};
|
||||||
|
let plaintext = self.secret_crypto.decrypt_for_epoch(
|
||||||
&version.secret_version.key_version,
|
&version.secret_version.key_version,
|
||||||
|
version.master_key_epoch,
|
||||||
&version.secret_version.ciphertext,
|
&version.secret_version.ciphertext,
|
||||||
)?;
|
);
|
||||||
|
let plaintext = match plaintext {
|
||||||
|
Ok(plaintext) => plaintext,
|
||||||
|
Err(error) => {
|
||||||
|
self.record_credential_resolution_failure(
|
||||||
|
audit_context,
|
||||||
|
workspace_id,
|
||||||
|
crank_core::AuditTargetKind::Secret,
|
||||||
|
secret_id.as_str(),
|
||||||
|
"secret",
|
||||||
|
runtime_credential_error_code(&error),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
observe_db_query(
|
observe_db_query(
|
||||||
DbOperation::SecretTouch,
|
DbOperation::SecretTouch,
|
||||||
self.registry
|
self.registry
|
||||||
.touch_secret(workspace_id, secret_id, &used_at),
|
.touch_secret(workspace_id, secret_id, &used_at),
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.map_err(|error| RuntimeError::SecretCrypto {
|
.unwrap_or_else(|_| {
|
||||||
operation: "touch secret",
|
tracing::warn!(
|
||||||
details: error.to_string(),
|
name: "admin.secret.touch_failed",
|
||||||
})?;
|
secret_id = %secret_id.as_str(),
|
||||||
|
request_id = audit_context
|
||||||
|
.map(|context| context.request_id.as_str())
|
||||||
|
.unwrap_or("unavailable"),
|
||||||
|
trace_id = audit_context
|
||||||
|
.map(|context| context.trace_id.as_str())
|
||||||
|
.unwrap_or("unavailable"),
|
||||||
|
error_code = "secret_touch_failed",
|
||||||
|
"secret last-used metadata was not updated"
|
||||||
|
);
|
||||||
|
});
|
||||||
secrets.insert(secret_id.clone(), plaintext);
|
secrets.insert(secret_id.clone(), plaintext);
|
||||||
}
|
}
|
||||||
|
|
||||||
ResolvedAuth::from_profile(auth_profile, &secrets)
|
let result = ResolvedAuth::from_profile(auth_profile, &secrets);
|
||||||
|
if let Err(error) = &result {
|
||||||
|
self.record_credential_resolution_failure(
|
||||||
|
audit_context,
|
||||||
|
workspace_id,
|
||||||
|
crank_core::AuditTargetKind::AuthProfile,
|
||||||
|
auth_profile.id.as_str(),
|
||||||
|
"auth_profile",
|
||||||
|
runtime_credential_error_code(error),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
result
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn record_credential_resolution_failure(
|
||||||
|
&self,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
target_kind: crank_core::AuditTargetKind,
|
||||||
|
target_id: &str,
|
||||||
|
credential_type: &'static str,
|
||||||
|
reason: &'static str,
|
||||||
|
) {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.resolve_denied",
|
||||||
|
target_kind,
|
||||||
|
workspace_id,
|
||||||
|
target_id,
|
||||||
|
credential_type,
|
||||||
|
outcome: "failure",
|
||||||
|
reason,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
tracing::warn!(
|
||||||
|
name: "admin.credential.resolve_denied",
|
||||||
|
credential_type,
|
||||||
|
target_kind = ?target_kind,
|
||||||
|
target_id,
|
||||||
|
outcome = "failure",
|
||||||
|
reason,
|
||||||
|
request_id = audit_context
|
||||||
|
.map(|context| context.request_id.as_str())
|
||||||
|
.unwrap_or("unavailable"),
|
||||||
|
trace_id = audit_context
|
||||||
|
.map(|context| context.trace_id.as_str())
|
||||||
|
.unwrap_or("unavailable"),
|
||||||
|
"credential resolution was denied"
|
||||||
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
fn validate_operation_payload(&self, payload: &OperationPayload) -> Result<(), ApiError> {
|
fn validate_operation_payload(&self, payload: &OperationPayload) -> Result<(), ApiError> {
|
||||||
@@ -376,6 +609,70 @@ impl AdminService {
|
|||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn validate_registry_operation_in_workspace(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
operation: &RegistryOperation,
|
||||||
|
) -> Result<(), ApiError> {
|
||||||
|
self.validate_registry_operation(operation)?;
|
||||||
|
if let Some(auth_profile_id) = operation.execution_config.auth_profile_ref.as_ref() {
|
||||||
|
let Some(auth_profile) = self
|
||||||
|
.registry
|
||||||
|
.get_auth_profile(workspace_id, auth_profile_id)
|
||||||
|
.await?
|
||||||
|
else {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"operation auth profile reference is unavailable",
|
||||||
|
json!({ "error_code": "operation_auth_profile_invalid" }),
|
||||||
|
));
|
||||||
|
};
|
||||||
|
self.validate_auth_profile_secret_refs_for_execution(workspace_id, &auth_profile)
|
||||||
|
.await?;
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn validate_auth_profile_secret_refs_for_execution(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
auth_profile: &AuthProfile,
|
||||||
|
) -> Result<(), ApiError> {
|
||||||
|
if auth_profile.kind != auth_profile.config.kind() {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"operation auth profile kind and config do not match",
|
||||||
|
json!({ "error_code": "operation_auth_profile_invalid" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
for secret_id in auth_profile.config.secret_ids() {
|
||||||
|
let Some(secret) = self.registry.get_secret(workspace_id, secret_id).await? else {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"operation auth profile secret reference is unavailable",
|
||||||
|
json!({ "error_code": "operation_auth_profile_invalid" }),
|
||||||
|
));
|
||||||
|
};
|
||||||
|
if secret.secret.status != SecretStatus::Active {
|
||||||
|
return Err(RegistryError::SecretInactive {
|
||||||
|
secret_id: secret_id.as_str().to_owned(),
|
||||||
|
}
|
||||||
|
.into());
|
||||||
|
}
|
||||||
|
if self
|
||||||
|
.registry
|
||||||
|
.get_current_secret_version(workspace_id, secret_id)
|
||||||
|
.await?
|
||||||
|
.is_none()
|
||||||
|
{
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"operation auth profile secret has no current version",
|
||||||
|
json!({ "error_code": "operation_auth_profile_invalid" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
fn validate_outbound_target(&self, target: &crank_core::Target) -> Result<(), ApiError> {
|
fn validate_outbound_target(&self, target: &crank_core::Target) -> Result<(), ApiError> {
|
||||||
match target {
|
match target {
|
||||||
crank_core::Target::Rest(rest) => self
|
crank_core::Target::Rest(rest) => self
|
||||||
@@ -462,7 +759,9 @@ impl AdminService {
|
|||||||
id: InvocationLogId::new(new_prefixed_id("log")),
|
id: InvocationLogId::new(new_prefixed_id("log")),
|
||||||
workspace_id: request.workspace_id.clone(),
|
workspace_id: request.workspace_id.clone(),
|
||||||
agent_id: request.agent_id.cloned(),
|
agent_id: request.agent_id.cloned(),
|
||||||
|
platform_api_key_id: None,
|
||||||
operation_id: request.operation.id.clone(),
|
operation_id: request.operation.id.clone(),
|
||||||
|
operation_version: Some(request.operation.version),
|
||||||
source: request.source,
|
source: request.source,
|
||||||
level: request.level,
|
level: request.level,
|
||||||
status: request.status,
|
status: request.status,
|
||||||
@@ -473,6 +772,10 @@ impl AdminService {
|
|||||||
status_code: request.status_code,
|
status_code: request.status_code,
|
||||||
duration_ms: request.duration_ms,
|
duration_ms: request.duration_ms,
|
||||||
error_kind: request.error_kind,
|
error_kind: request.error_kind,
|
||||||
|
execution_stage: request.execution_stage,
|
||||||
|
execution_error_code: request.execution_error_code,
|
||||||
|
retryability: request.retryability,
|
||||||
|
outcome_certainty: request.outcome_certainty,
|
||||||
request_preview: request.request_preview,
|
request_preview: request.request_preview,
|
||||||
response_preview: request.response_preview,
|
response_preview: request.response_preview,
|
||||||
created_at: OffsetDateTime::now_utc(),
|
created_at: OffsetDateTime::now_utc(),
|
||||||
@@ -553,29 +856,6 @@ fn invocation_status_label(status: crank_core::InvocationStatus) -> &'static str
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn build_request_preview(
|
|
||||||
mapping: &MappingSet,
|
|
||||||
input: &Value,
|
|
||||||
) -> Result<Value, crank_mapping::MappingError> {
|
|
||||||
let prepared = if mapping.is_empty() {
|
|
||||||
PreparedRequest::default()
|
|
||||||
} else {
|
|
||||||
let mapped = mapping.apply(&json!({ "mcp": input }))?;
|
|
||||||
PreparedRequest::from_mapping_output(&mapped).map_err(|error| {
|
|
||||||
crank_mapping::MappingError::InvalidJsonPath {
|
|
||||||
path: error.to_string(),
|
|
||||||
}
|
|
||||||
})?
|
|
||||||
};
|
|
||||||
|
|
||||||
Ok(json!({
|
|
||||||
"path": prepared.path_params,
|
|
||||||
"query": prepared.query_params,
|
|
||||||
"headers": prepared.headers,
|
|
||||||
"body": prepared.body.unwrap_or(Value::Null)
|
|
||||||
}))
|
|
||||||
}
|
|
||||||
|
|
||||||
fn validate_profile_display_name(value: &str) -> Result<String, ApiError> {
|
fn validate_profile_display_name(value: &str) -> Result<String, ApiError> {
|
||||||
let display_name = value.trim();
|
let display_name = value.trim();
|
||||||
if display_name.is_empty() {
|
if display_name.is_empty() {
|
||||||
@@ -616,7 +896,9 @@ fn new_prefixed_id(prefix: &str) -> String {
|
|||||||
}
|
}
|
||||||
|
|
||||||
fn generate_access_secret(marker: &str) -> String {
|
fn generate_access_secret(marker: &str) -> String {
|
||||||
let random = URL_SAFE_NO_PAD.encode(Uuid::now_v7().as_bytes());
|
let mut secret_bytes = [0_u8; 32];
|
||||||
|
rand::rng().fill(&mut secret_bytes);
|
||||||
|
let random = URL_SAFE_NO_PAD.encode(secret_bytes);
|
||||||
format!("{marker}{random}")
|
format!("{marker}{random}")
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -640,7 +922,7 @@ fn format_timestamp(timestamp: OffsetDateTime) -> String {
|
|||||||
fn map_identity_error(error: IdentityError) -> ApiError {
|
fn map_identity_error(error: IdentityError) -> ApiError {
|
||||||
match error {
|
match error {
|
||||||
IdentityError::BadCredentials => ApiError::unauthorized("invalid email or password"),
|
IdentityError::BadCredentials => ApiError::unauthorized("invalid email or password"),
|
||||||
IdentityError::AccountDisabled => ApiError::forbidden("account is disabled"),
|
IdentityError::AccountDisabled => ApiError::unauthorized("invalid email or password"),
|
||||||
IdentityError::NotSupportedForProvider => ApiError::internal(
|
IdentityError::NotSupportedForProvider => ApiError::internal(
|
||||||
"password login is not supported by the configured identity provider",
|
"password login is not supported by the configured identity provider",
|
||||||
),
|
),
|
||||||
@@ -648,32 +930,6 @@ fn map_identity_error(error: IdentityError) -> ApiError {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn runtime_error_code(error: &RuntimeError) -> &'static str {
|
|
||||||
match error {
|
|
||||||
RuntimeError::Schema(_) => "schema_error",
|
|
||||||
RuntimeError::Mapping(_) => "mapping_error",
|
|
||||||
RuntimeError::InvalidPreparedRequest { .. } => "invalid_request",
|
|
||||||
RuntimeError::ConfirmationRequired { .. } => "confirmation_required",
|
|
||||||
RuntimeError::InvalidConfirmationToken { .. } => "invalid_confirmation_token",
|
|
||||||
RuntimeError::ConfirmationStoreUnavailable { .. } => "confirmation_unavailable",
|
|
||||||
RuntimeError::IdempotencyStoreUnavailable { .. } => "idempotency_unavailable",
|
|
||||||
RuntimeError::IdempotencyInProgress { .. } => "idempotency_in_progress",
|
|
||||||
RuntimeError::IdempotencyConflict { .. } => "idempotency_conflict",
|
|
||||||
RuntimeError::IdempotencyOutcomeUnknown { .. } => "idempotency_outcome_unknown",
|
|
||||||
RuntimeError::RestAdapter(_) => "rest_error",
|
|
||||||
RuntimeError::ProtocolAdapter(_) => "adapter_error",
|
|
||||||
RuntimeError::UnsupportedProtocol { .. } => "unsupported_protocol",
|
|
||||||
RuntimeError::ConcurrencyLimitExceeded { .. } => "runtime_overloaded",
|
|
||||||
RuntimeError::UnsupportedExecutionMode { .. } => "streaming_mode_error",
|
|
||||||
RuntimeError::MissingAuthProfile { .. } => "auth_profile_not_found",
|
|
||||||
RuntimeError::MissingSecret { .. } | RuntimeError::MissingSecretVersion { .. } => {
|
|
||||||
"secret_not_found"
|
|
||||||
}
|
|
||||||
RuntimeError::InvalidAuthSecretValue { .. } => "secret_value_error",
|
|
||||||
RuntimeError::SecretCrypto { .. } => "secret_crypto_error",
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
fn protocol_capability_view(
|
fn protocol_capability_view(
|
||||||
protocol: Protocol,
|
protocol: Protocol,
|
||||||
_edition: ProductEdition,
|
_edition: ProductEdition,
|
||||||
@@ -698,7 +954,9 @@ fn protocol_capability_view(
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn usage_window(period: UsagePeriod) -> Result<(UsagePeriod, String, UsageBucket), ApiError> {
|
fn usage_window(
|
||||||
|
period: UsagePeriod,
|
||||||
|
) -> Result<(UsagePeriod, String, String, UsageBucket), ApiError> {
|
||||||
let now = OffsetDateTime::now_utc();
|
let now = OffsetDateTime::now_utc();
|
||||||
let (start, bucket) = match period {
|
let (start, bucket) = match period {
|
||||||
UsagePeriod::Last30Minutes => (
|
UsagePeriod::Last30Minutes => (
|
||||||
@@ -746,13 +1004,14 @@ fn usage_window(period: UsagePeriod) -> Result<(UsagePeriod, String, UsageBucket
|
|||||||
),
|
),
|
||||||
};
|
};
|
||||||
|
|
||||||
Ok((
|
let created_after = start
|
||||||
period,
|
.format(&Rfc3339)
|
||||||
start
|
.map_err(|error| ApiError::internal(error.to_string()))?;
|
||||||
.format(&Rfc3339)
|
let created_before = now
|
||||||
.map_err(|error| ApiError::internal(error.to_string()))?,
|
.format(&Rfc3339)
|
||||||
bucket,
|
.map_err(|error| ApiError::internal(error.to_string()))?;
|
||||||
))
|
|
||||||
|
Ok((period, created_after, created_before, bucket))
|
||||||
}
|
}
|
||||||
|
|
||||||
fn today_start_utc() -> Result<String, ApiError> {
|
fn today_start_utc() -> Result<String, ApiError> {
|
||||||
@@ -810,6 +1069,7 @@ fn map_agent_summary_view(summary: AgentSummary) -> AgentSummaryView {
|
|||||||
status: summary.status,
|
status: summary.status,
|
||||||
current_draft_version: summary.current_draft_version,
|
current_draft_version: summary.current_draft_version,
|
||||||
latest_published_version: summary.latest_published_version,
|
latest_published_version: summary.latest_published_version,
|
||||||
|
catalog_revision: summary.catalog_revision,
|
||||||
created_at: format_timestamp(summary.created_at),
|
created_at: format_timestamp(summary.created_at),
|
||||||
updated_at: format_timestamp(summary.updated_at),
|
updated_at: format_timestamp(summary.updated_at),
|
||||||
published_at: summary.published_at.map(format_timestamp),
|
published_at: summary.published_at.map(format_timestamp),
|
||||||
@@ -822,10 +1082,24 @@ fn map_agent_summary_view(summary: AgentSummary) -> AgentSummaryView {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn agent_mcp_endpoint(workspace_slug: &str, agent_slug: &str) -> String {
|
pub(crate) fn agent_mcp_endpoint(workspace_slug: &str, agent_slug: &str) -> String {
|
||||||
format!("/mcp/v1/{workspace_slug}/{agent_slug}")
|
format!("/mcp/v1/{workspace_slug}/{agent_slug}")
|
||||||
}
|
}
|
||||||
|
|
||||||
|
impl AdminService {
|
||||||
|
pub(crate) fn public_agent_mcp_endpoint(
|
||||||
|
&self,
|
||||||
|
workspace_slug: &str,
|
||||||
|
agent_slug: &str,
|
||||||
|
) -> String {
|
||||||
|
format!(
|
||||||
|
"{}{}",
|
||||||
|
self.public_base_url,
|
||||||
|
agent_mcp_endpoint(workspace_slug, agent_slug)
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
fn tool_quality_schema_node(schema: &Schema) -> ToolQualitySchemaNode {
|
fn tool_quality_schema_node(schema: &Schema) -> ToolQualitySchemaNode {
|
||||||
ToolQualitySchemaNode {
|
ToolQualitySchemaNode {
|
||||||
kind: tool_quality_schema_kind(&schema.kind),
|
kind: tool_quality_schema_kind(&schema.kind),
|
||||||
@@ -1013,6 +1287,7 @@ fn enrich_operation_summary(
|
|||||||
status: summary.status,
|
status: summary.status,
|
||||||
current_draft_version: summary.current_draft_version,
|
current_draft_version: summary.current_draft_version,
|
||||||
latest_published_version: summary.latest_published_version,
|
latest_published_version: summary.latest_published_version,
|
||||||
|
can_delete: summary.can_delete,
|
||||||
created_at: format_timestamp(summary.created_at),
|
created_at: format_timestamp(summary.created_at),
|
||||||
updated_at: format_timestamp(summary.updated_at),
|
updated_at: format_timestamp(summary.updated_at),
|
||||||
published_at: summary.published_at.map(format_timestamp),
|
published_at: summary.published_at.map(format_timestamp),
|
||||||
|
|||||||
@@ -5,11 +5,13 @@ use crank_core::{
|
|||||||
ToolAccessMode, ToolSelectionPolicy, UsagePeriod, WorkspaceId, search_tool_catalog,
|
ToolAccessMode, ToolSelectionPolicy, UsagePeriod, WorkspaceId, search_tool_catalog,
|
||||||
};
|
};
|
||||||
use crank_registry::{
|
use crank_registry::{
|
||||||
AgentVersionRecord, CreateAgentDraftVersionRequest, CreateAgentRequest, PublishAgentRequest,
|
AgentStateExpectation, AgentVersionRecord, CreateAgentDraftVersionRequest, CreateAgentRequest,
|
||||||
SaveAgentBindingsRequest, SaveAgentCatalogConfigRequest, UsageBucket, UsageQuery,
|
PublishAgentRequest, SaveAgentCatalogConfigRequest, UpdateAgentSummaryRequest, UsageBucket,
|
||||||
|
UsageQuery,
|
||||||
};
|
};
|
||||||
use serde_json::json;
|
use serde_json::json;
|
||||||
use time::OffsetDateTime;
|
use sha2::{Digest, Sha256};
|
||||||
|
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
use tracing::{info, instrument};
|
use tracing::{info, instrument};
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
@@ -17,12 +19,50 @@ use crate::{
|
|||||||
service::{
|
service::{
|
||||||
AdminService, AgentCatalogPayload, AgentMutationResult, AgentPayload, AgentSummaryView,
|
AdminService, AgentCatalogPayload, AgentMutationResult, AgentPayload, AgentSummaryView,
|
||||||
CreatedAgentResponse, PublishAgentResponse, ToolSearchPreviewPayload, UpdateAgentPayload,
|
CreatedAgentResponse, PublishAgentResponse, ToolSearchPreviewPayload, UpdateAgentPayload,
|
||||||
agent_mcp_endpoint, format_timestamp, map_agent_summary_view, new_prefixed_id,
|
agent_mcp_endpoint, format_timestamp, map_agent_summary_view, new_prefixed_id, now_string,
|
||||||
today_start_utc,
|
today_start_utc,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
impl AdminService {
|
impl AdminService {
|
||||||
|
pub fn agent_state_etag(agent: &AgentSummaryView) -> String {
|
||||||
|
let policy =
|
||||||
|
serde_json::to_string(&agent.tool_selection_policy).unwrap_or_else(|_| "{}".to_owned());
|
||||||
|
let operation_ids = agent.operation_ids.join(",");
|
||||||
|
let material = format!(
|
||||||
|
"agent-state-v2\0{}\0{}\0{}\0{}\0{}\0{}\0{}\0{:?}\0{:?}\0{}\0{}\0{}\0{}\0{}",
|
||||||
|
agent.workspace_id,
|
||||||
|
agent.id,
|
||||||
|
agent.slug,
|
||||||
|
agent.display_name,
|
||||||
|
agent.description,
|
||||||
|
agent.updated_at,
|
||||||
|
agent.current_draft_version,
|
||||||
|
agent.status,
|
||||||
|
agent.latest_published_version,
|
||||||
|
agent.catalog_revision,
|
||||||
|
agent.operation_count,
|
||||||
|
operation_ids,
|
||||||
|
policy,
|
||||||
|
agent.key_count
|
||||||
|
);
|
||||||
|
format!("\"{:x}\"", Sha256::digest(material.as_bytes()))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn agent_state_expectation(
|
||||||
|
agent: &AgentSummaryView,
|
||||||
|
) -> Result<AgentStateExpectation, ApiError> {
|
||||||
|
let updated_at = OffsetDateTime::parse(&agent.updated_at, &Rfc3339)
|
||||||
|
.map_err(|_| ApiError::internal("invalid agent state timestamp"))?;
|
||||||
|
Ok(AgentStateExpectation {
|
||||||
|
status: agent.status,
|
||||||
|
current_draft_version: agent.current_draft_version,
|
||||||
|
latest_published_version: agent.latest_published_version,
|
||||||
|
catalog_revision: agent.catalog_revision,
|
||||||
|
updated_at,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
#[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str()))]
|
#[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str()))]
|
||||||
pub async fn preview_tool_search(
|
pub async fn preview_tool_search(
|
||||||
&self,
|
&self,
|
||||||
@@ -110,13 +150,16 @@ impl AdminService {
|
|||||||
self.ensure_workspace_exists(workspace_id).await?;
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
let workspace = self.get_workspace(workspace_id).await?;
|
let workspace = self.get_workspace(workspace_id).await?;
|
||||||
let summaries = self.registry.list_agents(workspace_id).await?;
|
let summaries = self.registry.list_agents(workspace_id).await?;
|
||||||
|
let usage_start = today_start_utc()?;
|
||||||
|
let usage_end = now_string()?;
|
||||||
let usage = self
|
let usage = self
|
||||||
.registry
|
.registry
|
||||||
.list_usage_by_agent(UsageQuery {
|
.list_usage_by_agent(UsageQuery {
|
||||||
workspace_id,
|
workspace_id,
|
||||||
period: UsagePeriod::Last24Hours,
|
period: UsagePeriod::Last24Hours,
|
||||||
source: None,
|
source: None,
|
||||||
created_after: &today_start_utc()?,
|
created_after: &usage_start,
|
||||||
|
created_before: &usage_end,
|
||||||
bucket: UsageBucket::Hour,
|
bucket: UsageBucket::Hour,
|
||||||
})
|
})
|
||||||
.await?;
|
.await?;
|
||||||
@@ -189,6 +232,8 @@ impl AdminService {
|
|||||||
.iter()
|
.iter()
|
||||||
.map(|binding| binding.operation_id.as_str().to_owned())
|
.map(|binding| binding.operation_id.as_str().to_owned())
|
||||||
.collect::<Vec<_>>();
|
.collect::<Vec<_>>();
|
||||||
|
let usage_start = today_start_utc()?;
|
||||||
|
let usage_end = now_string()?;
|
||||||
let usage = self
|
let usage = self
|
||||||
.registry
|
.registry
|
||||||
.get_usage_for_agent(
|
.get_usage_for_agent(
|
||||||
@@ -196,7 +241,8 @@ impl AdminService {
|
|||||||
workspace_id,
|
workspace_id,
|
||||||
period: UsagePeriod::Last24Hours,
|
period: UsagePeriod::Last24Hours,
|
||||||
source: None,
|
source: None,
|
||||||
created_after: &today_start_utc()?,
|
created_after: &usage_start,
|
||||||
|
created_before: &usage_end,
|
||||||
bucket: UsageBucket::Hour,
|
bucket: UsageBucket::Hour,
|
||||||
},
|
},
|
||||||
agent_id,
|
agent_id,
|
||||||
@@ -317,6 +363,7 @@ impl AdminService {
|
|||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
payload: UpdateAgentPayload,
|
payload: UpdateAgentPayload,
|
||||||
|
expected_state: Option<&AgentStateExpectation>,
|
||||||
) -> Result<AgentMutationResult, ApiError> {
|
) -> Result<AgentMutationResult, ApiError> {
|
||||||
let existing = self
|
let existing = self
|
||||||
.registry
|
.registry
|
||||||
@@ -328,6 +375,20 @@ impl AdminService {
|
|||||||
json!({ "agent_id": agent_id.as_str() }),
|
json!({ "agent_id": agent_id.as_str() }),
|
||||||
)
|
)
|
||||||
})?;
|
})?;
|
||||||
|
if existing.status == AgentStatus::Published
|
||||||
|
&& (payload.slug != existing.slug
|
||||||
|
|| payload.display_name != existing.display_name
|
||||||
|
|| payload.description != existing.description)
|
||||||
|
{
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"published Agent summary is immutable; unpublish before editing",
|
||||||
|
json!({
|
||||||
|
"agent_id": agent_id.as_str(),
|
||||||
|
"error_code": "agent_published_summary_immutable",
|
||||||
|
"recovery": "unpublish_edit_publish"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
if payload.slug != existing.slug
|
if payload.slug != existing.slug
|
||||||
&& self
|
&& self
|
||||||
@@ -346,10 +407,13 @@ impl AdminService {
|
|||||||
.update_agent_summary(
|
.update_agent_summary(
|
||||||
workspace_id,
|
workspace_id,
|
||||||
agent_id,
|
agent_id,
|
||||||
&payload.slug,
|
UpdateAgentSummaryRequest {
|
||||||
&payload.display_name,
|
slug: &payload.slug,
|
||||||
&payload.description,
|
display_name: &payload.display_name,
|
||||||
&updated_at,
|
description: &payload.description,
|
||||||
|
updated_at: &updated_at,
|
||||||
|
expected_state,
|
||||||
|
},
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
@@ -365,6 +429,7 @@ impl AdminService {
|
|||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
|
expected_state: Option<&AgentStateExpectation>,
|
||||||
) -> Result<AgentMutationResult, ApiError> {
|
) -> Result<AgentMutationResult, ApiError> {
|
||||||
let existing = self
|
let existing = self
|
||||||
.registry
|
.registry
|
||||||
@@ -376,8 +441,20 @@ impl AdminService {
|
|||||||
json!({ "agent_id": agent_id.as_str() }),
|
json!({ "agent_id": agent_id.as_str() }),
|
||||||
)
|
)
|
||||||
})?;
|
})?;
|
||||||
|
if existing.latest_published_version.is_some() {
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"published Agent cannot be deleted; archive or unpublish it instead",
|
||||||
|
json!({
|
||||||
|
"agent_id": agent_id.as_str(),
|
||||||
|
"error_code": "agent_delete_forbidden",
|
||||||
|
"recovery": "archive_or_unpublish"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
self.registry.delete_agent(workspace_id, agent_id).await?;
|
self.registry
|
||||||
|
.delete_agent(workspace_id, agent_id, expected_state)
|
||||||
|
.await?;
|
||||||
|
|
||||||
Ok(AgentMutationResult {
|
Ok(AgentMutationResult {
|
||||||
agent_id: agent_id.as_str().to_owned(),
|
agent_id: agent_id.as_str().to_owned(),
|
||||||
@@ -392,6 +469,7 @@ impl AdminService {
|
|||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
payload: AgentCatalogPayload,
|
payload: AgentCatalogPayload,
|
||||||
|
expected_state: Option<&AgentStateExpectation>,
|
||||||
) -> Result<AgentVersionRecord, ApiError> {
|
) -> Result<AgentVersionRecord, ApiError> {
|
||||||
let current_version = self
|
let current_version = self
|
||||||
.ensure_editable_agent_version(workspace_id, agent_id)
|
.ensure_editable_agent_version(workspace_id, agent_id)
|
||||||
@@ -408,6 +486,8 @@ impl AdminService {
|
|||||||
enabled: binding.enabled,
|
enabled: binding.enabled,
|
||||||
})
|
})
|
||||||
.collect::<Vec<_>>();
|
.collect::<Vec<_>>();
|
||||||
|
self.validate_exact_published_agent_bindings(workspace_id, &bindings)
|
||||||
|
.await?;
|
||||||
let tool_selection_policy = requested_policy
|
let tool_selection_policy = requested_policy
|
||||||
.unwrap_or_else(|| current_version.snapshot.tool_selection_policy.clone());
|
.unwrap_or_else(|| current_version.snapshot.tool_selection_policy.clone());
|
||||||
validate_tool_selection_policy(&tool_selection_policy, &bindings)?;
|
validate_tool_selection_policy(&tool_selection_policy, &bindings)?;
|
||||||
@@ -419,6 +499,7 @@ impl AdminService {
|
|||||||
agent_version: current_version.version,
|
agent_version: current_version.version,
|
||||||
bindings: &bindings,
|
bindings: &bindings,
|
||||||
tool_selection_policy: &tool_selection_policy,
|
tool_selection_policy: &tool_selection_policy,
|
||||||
|
expected_state,
|
||||||
})
|
})
|
||||||
.await?;
|
.await?;
|
||||||
info!(
|
info!(
|
||||||
@@ -474,19 +555,23 @@ impl AdminService {
|
|||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
version: u32,
|
version: u32,
|
||||||
|
expected_state: Option<&AgentStateExpectation>,
|
||||||
) -> Result<PublishAgentResponse, ApiError> {
|
) -> Result<PublishAgentResponse, ApiError> {
|
||||||
let agent_version = self
|
let agent_version = self
|
||||||
.get_agent_version(workspace_id, agent_id, version)
|
.get_agent_version(workspace_id, agent_id, version)
|
||||||
.await?;
|
.await?;
|
||||||
let published_bindings = self
|
|
||||||
.published_agent_bindings(workspace_id, &agent_version.bindings)
|
|
||||||
.await?;
|
|
||||||
validate_tool_selection_policy(
|
validate_tool_selection_policy(
|
||||||
&agent_version.snapshot.tool_selection_policy,
|
&agent_version.snapshot.tool_selection_policy,
|
||||||
&published_bindings,
|
&agent_version.bindings,
|
||||||
)?;
|
)?;
|
||||||
|
|
||||||
if published_bindings.is_empty() {
|
if agent_version
|
||||||
|
.bindings
|
||||||
|
.iter()
|
||||||
|
.filter(|binding| binding.enabled)
|
||||||
|
.count()
|
||||||
|
== 0
|
||||||
|
{
|
||||||
return Err(ApiError::conflict_with_context(
|
return Err(ApiError::conflict_with_context(
|
||||||
"agent cannot be published without published enabled tools",
|
"agent cannot be published without published enabled tools",
|
||||||
json!({
|
json!({
|
||||||
@@ -497,36 +582,10 @@ impl AdminService {
|
|||||||
));
|
));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
self.validate_exact_published_agent_bindings(workspace_id, &agent_version.bindings)
|
||||||
|
.await?;
|
||||||
|
|
||||||
let published_at = OffsetDateTime::now_utc();
|
let published_at = OffsetDateTime::now_utc();
|
||||||
if published_bindings != agent_version.bindings {
|
|
||||||
let draft_version = AgentVersion {
|
|
||||||
agent_id: agent_id.clone(),
|
|
||||||
version: agent_version.version + 1,
|
|
||||||
status: AgentStatus::Draft,
|
|
||||||
instructions: agent_version.snapshot.instructions.clone(),
|
|
||||||
tool_selection_policy: agent_version.snapshot.tool_selection_policy.clone(),
|
|
||||||
created_at: published_at,
|
|
||||||
};
|
|
||||||
|
|
||||||
self.registry
|
|
||||||
.create_agent_draft_version(CreateAgentDraftVersionRequest {
|
|
||||||
workspace_id,
|
|
||||||
agent_id,
|
|
||||||
version: &draft_version,
|
|
||||||
bindings: &agent_version.bindings,
|
|
||||||
updated_at: &published_at,
|
|
||||||
})
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
self.registry
|
|
||||||
.save_agent_bindings(SaveAgentBindingsRequest {
|
|
||||||
workspace_id,
|
|
||||||
agent_id,
|
|
||||||
agent_version: agent_version.version,
|
|
||||||
bindings: &published_bindings,
|
|
||||||
})
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
self.registry
|
self.registry
|
||||||
.publish_agent(PublishAgentRequest {
|
.publish_agent(PublishAgentRequest {
|
||||||
@@ -535,6 +594,7 @@ impl AdminService {
|
|||||||
version,
|
version,
|
||||||
published_at: &published_at,
|
published_at: &published_at,
|
||||||
published_by: None,
|
published_by: None,
|
||||||
|
expected_state,
|
||||||
})
|
})
|
||||||
.await?;
|
.await?;
|
||||||
info!(
|
info!(
|
||||||
@@ -552,41 +612,65 @@ impl AdminService {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
async fn published_agent_bindings(
|
async fn validate_exact_published_agent_bindings(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
bindings: &[AgentOperationBinding],
|
bindings: &[AgentOperationBinding],
|
||||||
) -> Result<Vec<AgentOperationBinding>, ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
let mut published = Vec::new();
|
|
||||||
|
|
||||||
for binding in bindings {
|
for binding in bindings {
|
||||||
if !binding.enabled {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
let Some(summary) = self
|
let Some(summary) = self
|
||||||
.registry
|
.registry
|
||||||
.get_operation_summary(workspace_id, &binding.operation_id)
|
.get_operation_summary(workspace_id, &binding.operation_id)
|
||||||
.await?
|
.await?
|
||||||
else {
|
else {
|
||||||
continue;
|
return Err(ApiError::not_found_with_context(
|
||||||
|
"operation was not found for Agent binding",
|
||||||
|
json!({
|
||||||
|
"error_code": "agent_binding_scope_denied",
|
||||||
|
"operation_id": binding.operation_id.as_str()
|
||||||
|
}),
|
||||||
|
));
|
||||||
};
|
};
|
||||||
|
if summary.status == crank_core::OperationStatus::Archived {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"archived operation cannot be added to an Agent binding",
|
||||||
|
json!({
|
||||||
|
"error_code": "agent_binding_archived_operation",
|
||||||
|
"operation_id": binding.operation_id.as_str()
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
let Some(operation_version) = summary.latest_published_version else {
|
let Some(version) = self
|
||||||
continue;
|
.registry
|
||||||
|
.get_operation_version(
|
||||||
|
workspace_id,
|
||||||
|
&binding.operation_id,
|
||||||
|
binding.operation_version,
|
||||||
|
)
|
||||||
|
.await?
|
||||||
|
else {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"operation version is not published for Agent binding",
|
||||||
|
json!({
|
||||||
|
"error_code": "agent_binding_not_published",
|
||||||
|
"operation_id": binding.operation_id.as_str(),
|
||||||
|
"operation_version": binding.operation_version
|
||||||
|
}),
|
||||||
|
));
|
||||||
};
|
};
|
||||||
|
if !version.snapshot.is_published() {
|
||||||
published.push(AgentOperationBinding {
|
return Err(ApiError::unprocessable_with_context(
|
||||||
operation_id: summary.id,
|
"operation version is not published for Agent binding",
|
||||||
operation_version,
|
json!({
|
||||||
tool_name: binding.tool_name.clone(),
|
"error_code": "agent_binding_not_published",
|
||||||
tool_title: binding.tool_title.clone(),
|
"operation_id": binding.operation_id.as_str(),
|
||||||
tool_description_override: binding.tool_description_override.clone(),
|
"operation_version": binding.operation_version
|
||||||
enabled: true,
|
}),
|
||||||
});
|
));
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
Ok(())
|
||||||
Ok(published)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str()))]
|
#[instrument(skip(self), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str()))]
|
||||||
@@ -594,11 +678,12 @@ impl AdminService {
|
|||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
|
expected_state: Option<&AgentStateExpectation>,
|
||||||
) -> Result<AgentMutationResult, ApiError> {
|
) -> Result<AgentMutationResult, ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
let updated_at = OffsetDateTime::now_utc();
|
let updated_at = OffsetDateTime::now_utc();
|
||||||
self.registry
|
self.registry
|
||||||
.unpublish_agent(workspace_id, agent_id, &updated_at)
|
.unpublish_agent(workspace_id, agent_id, &updated_at, expected_state)
|
||||||
.await?;
|
.await?;
|
||||||
info!(
|
info!(
|
||||||
name: "admin.agent.unpublished",
|
name: "admin.agent.unpublished",
|
||||||
@@ -618,11 +703,12 @@ impl AdminService {
|
|||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
|
expected_state: Option<&AgentStateExpectation>,
|
||||||
) -> Result<AgentMutationResult, ApiError> {
|
) -> Result<AgentMutationResult, ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
let updated_at = OffsetDateTime::now_utc();
|
let updated_at = OffsetDateTime::now_utc();
|
||||||
self.registry
|
self.registry
|
||||||
.archive_agent(workspace_id, agent_id, &updated_at)
|
.archive_agent(workspace_id, agent_id, &updated_at, expected_state)
|
||||||
.await?;
|
.await?;
|
||||||
info!(
|
info!(
|
||||||
name: "admin.agent.archived",
|
name: "admin.agent.archived",
|
||||||
|
|||||||
@@ -6,12 +6,14 @@ use crank_registry::{CreatePlatformApiKeyRequest, PlatformApiKeyRecord};
|
|||||||
use serde_json::json;
|
use serde_json::json;
|
||||||
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
use tracing::instrument;
|
use tracing::instrument;
|
||||||
|
use url::Url;
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
service::{
|
service::{
|
||||||
AdminService, CreatedPlatformApiKeyResponse, PlatformApiKeyPayload, generate_access_secret,
|
AdminAuditContext, AdminService, CreatedPlatformApiKeyResponse, CredentialAuditRecord,
|
||||||
hash_access_secret, new_prefixed_id,
|
EphemeralMcpClientConfig, EphemeralMcpConnection, PlatformApiKeyPayload,
|
||||||
|
generate_access_secret, hash_access_secret, new_prefixed_id,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -38,32 +40,84 @@ impl AdminService {
|
|||||||
.await?)
|
.await?)
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str(), key_name = %payload.name))]
|
#[instrument(skip(self, payload, audit_context), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str(), key_name = %payload.name))]
|
||||||
pub async fn create_agent_platform_api_key(
|
pub async fn create_agent_platform_api_key(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
payload: PlatformApiKeyPayload,
|
mut payload: PlatformApiKeyPayload,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<CreatedPlatformApiKeyResponse, ApiError> {
|
) -> Result<CreatedPlatformApiKeyResponse, ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
let workspace = match self.get_workspace(workspace_id).await {
|
||||||
self.registry
|
Ok(workspace) => workspace,
|
||||||
|
Err(error) => {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: "platform_api_key",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
let agent_result = match self
|
||||||
|
.registry
|
||||||
.get_agent_summary(workspace_id, agent_id)
|
.get_agent_summary(workspace_id, agent_id)
|
||||||
.await?
|
.await
|
||||||
.ok_or_else(|| {
|
{
|
||||||
|
Ok(agent) => agent.ok_or_else(|| {
|
||||||
ApiError::not_found_with_context(
|
ApiError::not_found_with_context(
|
||||||
format!("agent {} was not found", agent_id.as_str()),
|
format!("agent {} was not found", agent_id.as_str()),
|
||||||
json!({ "agent_id": agent_id.as_str() }),
|
json!({ "agent_id": agent_id.as_str() }),
|
||||||
)
|
)
|
||||||
})?;
|
}),
|
||||||
|
Err(error) => Err(ApiError::from(error)),
|
||||||
|
};
|
||||||
|
let agent = match agent_result {
|
||||||
|
Ok(agent) => agent,
|
||||||
|
Err(error) => {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: "platform_api_key",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
validate_platform_api_key_payload(&payload)?;
|
let expires_at = match validate_platform_api_key_payload(&mut payload) {
|
||||||
|
Ok(expires_at) => expires_at,
|
||||||
let expires_at = match payload.expires_at.as_deref() {
|
Err(error) => {
|
||||||
Some(value) => Some(
|
self.record_credential_audit(
|
||||||
OffsetDateTime::parse(value, &Rfc3339)
|
audit_context,
|
||||||
.map_err(|_| ApiError::validation("expires_at must be RFC3339 timestamp"))?,
|
CredentialAuditRecord {
|
||||||
),
|
action: "credential.platform_api_key.create_failed",
|
||||||
None => None,
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: payload.key_kind.audit_credential_type(),
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
};
|
};
|
||||||
let secret = generate_access_secret(payload.key_kind.secret_marker());
|
let secret = generate_access_secret(payload.key_kind.secret_marker());
|
||||||
let api_key = PlatformApiKeyRecord {
|
let api_key = PlatformApiKeyRecord {
|
||||||
@@ -83,55 +137,213 @@ impl AdminService {
|
|||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
self.registry
|
if let Err(error) = self
|
||||||
|
.registry
|
||||||
.create_platform_api_key(CreatePlatformApiKeyRequest {
|
.create_platform_api_key(CreatePlatformApiKeyRequest {
|
||||||
api_key: &api_key.api_key,
|
api_key: &api_key.api_key,
|
||||||
secret_hash: &hash_access_secret(&secret),
|
secret_hash: &hash_access_secret(&secret),
|
||||||
})
|
})
|
||||||
.await?;
|
.await
|
||||||
|
{
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: api_key.api_key.id.as_str(),
|
||||||
|
credential_type: api_key.api_key.key_kind.audit_credential_type(),
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.created",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: api_key.api_key.id.as_str(),
|
||||||
|
credential_type: api_key.api_key.key_kind.audit_credential_type(),
|
||||||
|
outcome: "success",
|
||||||
|
reason: "credential_created",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
Ok(CreatedPlatformApiKeyResponse { api_key, secret })
|
let connection = (api_key.api_key.key_kind == PlatformApiKeyKind::McpClient).then(|| {
|
||||||
|
let endpoint = self.public_agent_mcp_endpoint(&workspace.workspace.slug, &agent.slug);
|
||||||
|
EphemeralMcpConnection {
|
||||||
|
endpoint: endpoint.clone(),
|
||||||
|
clients: ephemeral_client_configs(&endpoint, &secret),
|
||||||
|
secret_display: "once",
|
||||||
|
}
|
||||||
|
});
|
||||||
|
Ok(CreatedPlatformApiKeyResponse {
|
||||||
|
api_key,
|
||||||
|
secret,
|
||||||
|
connection,
|
||||||
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str(), key_id = %key_id.as_str()))]
|
#[instrument(skip(self, audit_context), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str(), key_id = %key_id.as_str()))]
|
||||||
pub async fn revoke_agent_platform_api_key(
|
pub async fn revoke_agent_platform_api_key(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
key_id: &PlatformApiKeyId,
|
key_id: &PlatformApiKeyId,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<(), ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
self.registry
|
if let Err(error) = self
|
||||||
|
.registry
|
||||||
.revoke_platform_api_key_for_agent(
|
.revoke_platform_api_key_for_agent(
|
||||||
workspace_id,
|
workspace_id,
|
||||||
agent_id,
|
agent_id,
|
||||||
key_id,
|
key_id,
|
||||||
&OffsetDateTime::now_utc(),
|
&OffsetDateTime::now_utc(),
|
||||||
)
|
)
|
||||||
.await?;
|
.await
|
||||||
|
{
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.revoke_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: key_id.as_str(),
|
||||||
|
credential_type: "platform_api_key",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.revoked",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: key_id.as_str(),
|
||||||
|
credential_type: "platform_api_key",
|
||||||
|
outcome: "success",
|
||||||
|
reason: "credential_revoked",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str(), key_id = %key_id.as_str()))]
|
#[instrument(skip(self, audit_context), fields(workspace_id = %workspace_id.as_str(), agent_id = %agent_id.as_str(), key_id = %key_id.as_str()))]
|
||||||
pub async fn delete_agent_platform_api_key(
|
pub async fn delete_agent_platform_api_key(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
agent_id: &AgentId,
|
agent_id: &AgentId,
|
||||||
key_id: &PlatformApiKeyId,
|
key_id: &PlatformApiKeyId,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<(), ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
self.registry
|
if let Err(error) = self
|
||||||
|
.registry
|
||||||
.delete_platform_api_key_for_agent(workspace_id, agent_id, key_id)
|
.delete_platform_api_key_for_agent(workspace_id, agent_id, key_id)
|
||||||
.await?;
|
.await
|
||||||
|
{
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.delete_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: key_id.as_str(),
|
||||||
|
credential_type: "platform_api_key",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.platform_api_key.deleted",
|
||||||
|
target_kind: crank_core::AuditTargetKind::PlatformApiKey,
|
||||||
|
workspace_id,
|
||||||
|
target_id: key_id.as_str(),
|
||||||
|
credential_type: "platform_api_key",
|
||||||
|
outcome: "success",
|
||||||
|
reason: "credential_deleted",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
fn validate_platform_api_key_payload(payload: &PlatformApiKeyPayload) -> Result<(), ApiError> {
|
fn ephemeral_client_configs(endpoint: &str, secret: &str) -> Vec<EphemeralMcpClientConfig> {
|
||||||
|
["claude_desktop", "cursor", "vscode"]
|
||||||
|
.into_iter()
|
||||||
|
.map(|client| EphemeralMcpClientConfig {
|
||||||
|
client: client.to_owned(),
|
||||||
|
config: json!({
|
||||||
|
"transport": "streamable_http",
|
||||||
|
"url": endpoint,
|
||||||
|
"headers": {"Authorization": format!("Bearer {secret}")}
|
||||||
|
}),
|
||||||
|
})
|
||||||
|
.collect()
|
||||||
|
}
|
||||||
|
|
||||||
|
trait PlatformApiKeyKindAuditExt {
|
||||||
|
fn audit_credential_type(self) -> &'static str;
|
||||||
|
}
|
||||||
|
|
||||||
|
impl PlatformApiKeyKindAuditExt for PlatformApiKeyKind {
|
||||||
|
fn audit_credential_type(self) -> &'static str {
|
||||||
|
match self {
|
||||||
|
PlatformApiKeyKind::McpClient => "mcp_client_key",
|
||||||
|
PlatformApiKeyKind::Approval => "approval_key",
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn validate_platform_api_key_payload(
|
||||||
|
payload: &mut PlatformApiKeyPayload,
|
||||||
|
) -> Result<Option<OffsetDateTime>, ApiError> {
|
||||||
|
const MAX_KEY_NAME_CHARS: usize = 128;
|
||||||
|
const MAX_SCOPES: usize = 8;
|
||||||
|
|
||||||
|
payload.name = payload.name.trim().to_owned();
|
||||||
if payload.name.trim().is_empty() {
|
if payload.name.trim().is_empty() {
|
||||||
return Err(ApiError::validation("key name is required"));
|
return Err(ApiError::validation("key name is required"));
|
||||||
}
|
}
|
||||||
|
if payload.name.chars().count() > MAX_KEY_NAME_CHARS {
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"key name must be at most 128 characters",
|
||||||
|
));
|
||||||
|
}
|
||||||
if payload.scopes.is_empty() {
|
if payload.scopes.is_empty() {
|
||||||
return Err(ApiError::validation("at least one key scope is required"));
|
return Err(ApiError::validation("at least one key scope is required"));
|
||||||
}
|
}
|
||||||
|
if payload.scopes.len() > MAX_SCOPES {
|
||||||
|
return Err(ApiError::validation("too many key scopes"));
|
||||||
|
}
|
||||||
|
if payload
|
||||||
|
.scopes
|
||||||
|
.iter()
|
||||||
|
.enumerate()
|
||||||
|
.any(|(index, scope)| payload.scopes[..index].contains(scope))
|
||||||
|
{
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"key scopes must not contain duplicates",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
let valid = payload.scopes.iter().all(|scope| match payload.key_kind {
|
let valid = payload.scopes.iter().all(|scope| match payload.key_kind {
|
||||||
PlatformApiKeyKind::McpClient => matches!(
|
PlatformApiKeyKind::McpClient => matches!(
|
||||||
@@ -156,6 +368,66 @@ fn validate_platform_api_key_payload(payload: &PlatformApiKeyPayload) -> Result<
|
|||||||
"approval key can contain at most 20 allowed origins",
|
"approval key can contain at most 20 allowed origins",
|
||||||
));
|
));
|
||||||
}
|
}
|
||||||
|
if payload.key_kind == PlatformApiKeyKind::Approval {
|
||||||
|
let mut normalized_origins = Vec::with_capacity(payload.allowed_origins.len());
|
||||||
|
for origin in &payload.allowed_origins {
|
||||||
|
normalized_origins.push(validate_approval_origin(origin)?);
|
||||||
|
}
|
||||||
|
if normalized_origins
|
||||||
|
.iter()
|
||||||
|
.enumerate()
|
||||||
|
.any(|(index, origin)| normalized_origins[..index].contains(origin))
|
||||||
|
{
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"allowed origins must not contain duplicates",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
payload.allowed_origins = normalized_origins;
|
||||||
|
} else if !payload.allowed_origins.is_empty() {
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"allowed origins are only supported for approval keys",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
Ok(())
|
let expires_at = payload
|
||||||
|
.expires_at
|
||||||
|
.as_deref()
|
||||||
|
.map(|value| {
|
||||||
|
OffsetDateTime::parse(value, &Rfc3339)
|
||||||
|
.map_err(|_| ApiError::validation("expires_at must be RFC3339 timestamp"))
|
||||||
|
})
|
||||||
|
.transpose()?;
|
||||||
|
if expires_at.is_some_and(|value| value <= OffsetDateTime::now_utc()) {
|
||||||
|
return Err(ApiError::validation("expires_at must be in the future"));
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(expires_at)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn validate_approval_origin(origin: &str) -> Result<String, ApiError> {
|
||||||
|
const MAX_ORIGIN_LEN: usize = 2048;
|
||||||
|
if origin.is_empty() || origin.len() > MAX_ORIGIN_LEN {
|
||||||
|
return Err(ApiError::validation("allowed origin is invalid"));
|
||||||
|
}
|
||||||
|
if origin
|
||||||
|
.bytes()
|
||||||
|
.any(|byte| byte.is_ascii_control() || byte.is_ascii_whitespace())
|
||||||
|
{
|
||||||
|
return Err(ApiError::validation("allowed origin is invalid"));
|
||||||
|
}
|
||||||
|
|
||||||
|
let parsed =
|
||||||
|
Url::parse(origin).map_err(|_| ApiError::validation("allowed origin is invalid"))?;
|
||||||
|
if !matches!(parsed.scheme(), "http" | "https")
|
||||||
|
|| parsed.host_str().is_none()
|
||||||
|
|| !parsed.username().is_empty()
|
||||||
|
|| parsed.password().is_some()
|
||||||
|
|| parsed.path() != "/"
|
||||||
|
|| parsed.query().is_some()
|
||||||
|
|| parsed.fragment().is_some()
|
||||||
|
{
|
||||||
|
return Err(ApiError::validation("allowed origin is invalid"));
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(parsed.origin().ascii_serialization())
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,20 +1,101 @@
|
|||||||
use crank_core::{LoginOutcome, MembershipRole, UserSessionId, WorkspaceId};
|
use crank_core::{
|
||||||
|
LoginOutcome, MembershipRole, User, UserId, UserSessionId, UserStatus, WorkspaceId,
|
||||||
|
};
|
||||||
|
use crank_registry::{AdminSecurityAuditRequest, ConsumeAdminBootstrapContractRequest};
|
||||||
use serde_json::json;
|
use serde_json::json;
|
||||||
|
use time::OffsetDateTime;
|
||||||
use tracing::instrument;
|
use tracing::instrument;
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
auth::{
|
auth::{
|
||||||
AuthenticatedSession, SessionCookie, create_session_cookie, hash_password,
|
AuthenticatedSession, SessionCookie, create_csrf_token_value, create_session_cookie,
|
||||||
hash_session_secret, verify_password,
|
hash_csrf_token, hash_password, hash_session_secret, verify_password,
|
||||||
},
|
},
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
service::{
|
service::{
|
||||||
AdminService, ChangePasswordPayload, LoginPayload, SessionResponse, UpdateProfilePayload,
|
AdminService, BootstrapStatusResponse, ChangePasswordPayload, CompleteBootstrapPayload,
|
||||||
map_identity_error, validate_profile_display_name, validate_profile_email,
|
LoginPayload, SessionResponse, UpdateProfilePayload, hash_access_secret,
|
||||||
|
map_identity_error, new_prefixed_id, validate_profile_display_name, validate_profile_email,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
impl AdminService {
|
impl AdminService {
|
||||||
|
pub async fn bootstrap_status(&self) -> Result<BootstrapStatusResponse, ApiError> {
|
||||||
|
Ok(BootstrapStatusResponse {
|
||||||
|
bootstrap_required: !self.registry.has_password_admin().await?,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn complete_bootstrap(
|
||||||
|
&self,
|
||||||
|
payload: CompleteBootstrapPayload,
|
||||||
|
) -> Result<(SessionCookie, SessionResponse), ApiError> {
|
||||||
|
if payload.token.len() < 32 || payload.token.len() > 256 {
|
||||||
|
self.record_admin_security_audit(None, "bootstrap_rejected", "rejected", "bootstrap")
|
||||||
|
.await;
|
||||||
|
return Err(Self::constant_bootstrap_error());
|
||||||
|
}
|
||||||
|
if payload.password.len() < 12 || payload.password.len() > 256 {
|
||||||
|
self.record_admin_security_audit(None, "bootstrap_rejected", "rejected", "bootstrap")
|
||||||
|
.await;
|
||||||
|
return Err(Self::constant_bootstrap_error());
|
||||||
|
}
|
||||||
|
|
||||||
|
let now = OffsetDateTime::now_utc();
|
||||||
|
let bootstrap_token_hash = hash_access_secret(&format!("bootstrap:{}", payload.token));
|
||||||
|
if !self
|
||||||
|
.registry
|
||||||
|
.admin_bootstrap_contract_is_consumable(&bootstrap_token_hash, &now)
|
||||||
|
.await?
|
||||||
|
{
|
||||||
|
self.record_admin_security_audit(None, "bootstrap_rejected", "rejected", "bootstrap")
|
||||||
|
.await;
|
||||||
|
return Err(Self::constant_bootstrap_error());
|
||||||
|
}
|
||||||
|
|
||||||
|
let password_hash = hash_password(&payload.password, &self.auth_settings.password_pepper)?;
|
||||||
|
let user_id = self
|
||||||
|
.registry
|
||||||
|
.consume_admin_bootstrap_contract(ConsumeAdminBootstrapContractRequest {
|
||||||
|
token_hash: &bootstrap_token_hash,
|
||||||
|
password_hash: &password_hash,
|
||||||
|
now: &now,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.map_err(|_| Self::constant_bootstrap_error());
|
||||||
|
let user_id = match user_id {
|
||||||
|
Ok(user_id) => user_id,
|
||||||
|
Err(error) => {
|
||||||
|
self.record_admin_security_audit(
|
||||||
|
None,
|
||||||
|
"bootstrap_rejected",
|
||||||
|
"rejected",
|
||||||
|
"bootstrap",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
self.record_admin_security_audit(
|
||||||
|
Some(&user_id),
|
||||||
|
"bootstrap_completed",
|
||||||
|
"success",
|
||||||
|
"bootstrap",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let user = self
|
||||||
|
.registry
|
||||||
|
.get_auth_user_by_id(&user_id)
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| ApiError::internal("bootstrap user was not found"))?
|
||||||
|
.user;
|
||||||
|
self.create_session_for_user(user).await
|
||||||
|
}
|
||||||
|
|
||||||
|
fn constant_bootstrap_error() -> ApiError {
|
||||||
|
ApiError::unauthorized("bootstrap request is invalid or expired")
|
||||||
|
}
|
||||||
|
|
||||||
pub async fn bootstrap_admin_user(&self) -> Result<(), ApiError> {
|
pub async fn bootstrap_admin_user(&self) -> Result<(), ApiError> {
|
||||||
let password_hash = hash_password(
|
let password_hash = hash_password(
|
||||||
&self.auth_settings.bootstrap_admin.password,
|
&self.auth_settings.bootstrap_admin.password,
|
||||||
@@ -83,36 +164,99 @@ impl AdminService {
|
|||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
|
pub async fn verify_session_csrf(
|
||||||
|
&self,
|
||||||
|
session_id: &UserSessionId,
|
||||||
|
csrf_hash: &str,
|
||||||
|
) -> Result<bool, ApiError> {
|
||||||
|
Ok(self
|
||||||
|
.registry
|
||||||
|
.verify_session_csrf(session_id, csrf_hash)
|
||||||
|
.await?)
|
||||||
|
}
|
||||||
|
|
||||||
pub async fn login(
|
pub async fn login(
|
||||||
&self,
|
&self,
|
||||||
payload: LoginPayload,
|
payload: LoginPayload,
|
||||||
) -> Result<(SessionCookie, SessionResponse), ApiError> {
|
) -> Result<(SessionCookie, SessionResponse), ApiError> {
|
||||||
let authenticated = self.authenticate_login(&payload).await?;
|
self.login_with_client_bucket(payload, "anonymous").await
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn login_with_client_bucket(
|
||||||
|
&self,
|
||||||
|
payload: LoginPayload,
|
||||||
|
client_bucket: &str,
|
||||||
|
) -> Result<(SessionCookie, SessionResponse), ApiError> {
|
||||||
|
let scope_hash = hash_access_secret(&format!(
|
||||||
|
"login:{}:{}",
|
||||||
|
client_bucket,
|
||||||
|
payload.email.trim().to_ascii_lowercase()
|
||||||
|
));
|
||||||
|
if let Some(locked_until) = self
|
||||||
|
.registry
|
||||||
|
.login_backoff_locked_until(&scope_hash)
|
||||||
|
.await?
|
||||||
|
{
|
||||||
|
let retry_after_ms = (locked_until - OffsetDateTime::now_utc())
|
||||||
|
.whole_milliseconds()
|
||||||
|
.clamp(1, 300_000);
|
||||||
|
return Err(ApiError::rate_limited_with_context(
|
||||||
|
"login temporarily unavailable",
|
||||||
|
json!({
|
||||||
|
"retry_after_ms": retry_after_ms,
|
||||||
|
"error_code": "login_throttled",
|
||||||
|
"recovery": "retry_after_delay"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let authenticated = match self.authenticate_login(&payload).await {
|
||||||
|
Ok(authenticated) => authenticated,
|
||||||
|
Err(error) => {
|
||||||
|
let _ = self
|
||||||
|
.registry
|
||||||
|
.record_login_failure(&scope_hash, &OffsetDateTime::now_utc())
|
||||||
|
.await;
|
||||||
|
self.record_admin_security_audit(None, "login_rejected", "rejected", "login")
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
self.registry.reset_login_backoff(&scope_hash).await?;
|
||||||
|
self.record_admin_security_audit(
|
||||||
|
Some(&authenticated.user.id),
|
||||||
|
"login_succeeded",
|
||||||
|
"success",
|
||||||
|
"login",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
self.create_session_for_user(authenticated.user).await
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn create_session_for_user(
|
||||||
|
&self,
|
||||||
|
user: User,
|
||||||
|
) -> Result<(SessionCookie, SessionResponse), ApiError> {
|
||||||
let session_cookie = create_session_cookie(&self.auth_settings)?;
|
let session_cookie = create_session_cookie(&self.auth_settings)?;
|
||||||
|
let csrf_token = create_csrf_token_value();
|
||||||
let secret_hash = hash_session_secret(
|
let secret_hash = hash_session_secret(
|
||||||
&session_cookie.session_id,
|
&session_cookie.session_id,
|
||||||
&session_cookie.value,
|
&session_cookie.value,
|
||||||
&self.auth_settings.session_secret,
|
&self.auth_settings.session_secret,
|
||||||
);
|
);
|
||||||
let memberships = self
|
let csrf_hash = hash_csrf_token(
|
||||||
.registry
|
&session_cookie.session_id,
|
||||||
.list_workspaces_for_user(&authenticated.user.id)
|
&csrf_token,
|
||||||
.await?;
|
&self.auth_settings.session_secret,
|
||||||
|
);
|
||||||
|
let memberships = self.registry.list_workspaces_for_user(&user.id).await?;
|
||||||
let default_workspace_id = memberships
|
let default_workspace_id = memberships
|
||||||
.iter()
|
.iter()
|
||||||
.find(|membership| membership.workspace.id.as_str() == "ws_default")
|
.find(|membership| membership.workspace.id.as_str() == "ws_default")
|
||||||
.map(|membership| membership.workspace.id.as_str().to_owned());
|
.map(|membership| membership.workspace.id.as_str().to_owned());
|
||||||
let current_workspace_id = default_workspace_id.or_else(|| {
|
let current_workspace_id = default_workspace_id.or_else(|| {
|
||||||
authenticated
|
memberships
|
||||||
.current_workspace_id
|
.first()
|
||||||
.as_ref()
|
.map(|membership| membership.workspace.id.as_str().to_owned())
|
||||||
.map(|workspace_id| workspace_id.as_str().to_owned())
|
|
||||||
.or_else(|| {
|
|
||||||
memberships
|
|
||||||
.first()
|
|
||||||
.map(|membership| membership.workspace.id.as_str().to_owned())
|
|
||||||
})
|
|
||||||
});
|
});
|
||||||
let current_workspace_ref = current_workspace_id
|
let current_workspace_ref = current_workspace_id
|
||||||
.as_ref()
|
.as_ref()
|
||||||
@@ -120,9 +264,10 @@ impl AdminService {
|
|||||||
self.registry
|
self.registry
|
||||||
.create_user_session(
|
.create_user_session(
|
||||||
&session_cookie.session_id,
|
&session_cookie.session_id,
|
||||||
&authenticated.user.id,
|
&user.id,
|
||||||
current_workspace_ref.as_ref(),
|
current_workspace_ref.as_ref(),
|
||||||
&secret_hash,
|
&secret_hash,
|
||||||
|
Some(&csrf_hash),
|
||||||
&session_cookie.expires_at,
|
&session_cookie.expires_at,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
@@ -130,9 +275,10 @@ impl AdminService {
|
|||||||
Ok((
|
Ok((
|
||||||
session_cookie,
|
session_cookie,
|
||||||
SessionResponse {
|
SessionResponse {
|
||||||
user: authenticated.user,
|
user,
|
||||||
memberships,
|
memberships,
|
||||||
current_workspace_id,
|
current_workspace_id,
|
||||||
|
csrf_token,
|
||||||
},
|
},
|
||||||
))
|
))
|
||||||
}
|
}
|
||||||
@@ -158,7 +304,19 @@ impl AdminService {
|
|||||||
.registry
|
.registry
|
||||||
.get_auth_user_by_email(&payload.email)
|
.get_auth_user_by_email(&payload.email)
|
||||||
.await?
|
.await?
|
||||||
.ok_or_else(|| ApiError::unauthorized("invalid email or password"))?;
|
.ok_or_else(|| {
|
||||||
|
let _ = hash_password(&payload.password, &self.auth_settings.password_pepper);
|
||||||
|
ApiError::unauthorized("invalid email or password")
|
||||||
|
})?;
|
||||||
|
|
||||||
|
if user.user.status != UserStatus::Active {
|
||||||
|
let _ = verify_password(
|
||||||
|
&payload.password,
|
||||||
|
&self.auth_settings.password_pepper,
|
||||||
|
&user.password_hash,
|
||||||
|
);
|
||||||
|
return Err(ApiError::unauthorized("invalid email or password"));
|
||||||
|
}
|
||||||
|
|
||||||
if !verify_password(
|
if !verify_password(
|
||||||
&payload.password,
|
&payload.password,
|
||||||
@@ -181,6 +339,8 @@ impl AdminService {
|
|||||||
_session_value: &str,
|
_session_value: &str,
|
||||||
) -> Result<(), ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
self.registry.revoke_user_session(session_id).await?;
|
self.registry.revoke_user_session(session_id).await?;
|
||||||
|
self.record_admin_security_audit(None, "logout", "success", "session")
|
||||||
|
.await;
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -190,21 +350,23 @@ impl AdminService {
|
|||||||
session_id: &UserSessionId,
|
session_id: &UserSessionId,
|
||||||
session_value: &str,
|
session_value: &str,
|
||||||
) -> Result<Option<SessionResponse>, ApiError> {
|
) -> Result<Option<SessionResponse>, ApiError> {
|
||||||
Ok(self
|
let Some(session) = self.get_session(session_id, session_value).await? else {
|
||||||
.get_session(session_id, session_value)
|
return Ok(None);
|
||||||
.await?
|
};
|
||||||
.map(|session| SessionResponse {
|
Ok(Some(SessionResponse {
|
||||||
user: session.user,
|
user: session.user,
|
||||||
memberships: session.memberships,
|
memberships: session.memberships,
|
||||||
current_workspace_id: session
|
current_workspace_id: session
|
||||||
.current_workspace_id
|
.current_workspace_id
|
||||||
.map(|id| id.as_str().to_owned()),
|
.map(|id| id.as_str().to_owned()),
|
||||||
}))
|
csrf_token: String::new(),
|
||||||
|
}))
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn update_profile(
|
pub async fn update_profile(
|
||||||
&self,
|
&self,
|
||||||
user_id: &crank_core::UserId,
|
user_id: &crank_core::UserId,
|
||||||
|
session_id: &UserSessionId,
|
||||||
current_workspace_id: Option<&WorkspaceId>,
|
current_workspace_id: Option<&WorkspaceId>,
|
||||||
payload: UpdateProfilePayload,
|
payload: UpdateProfilePayload,
|
||||||
) -> Result<SessionResponse, ApiError> {
|
) -> Result<SessionResponse, ApiError> {
|
||||||
@@ -221,18 +383,19 @@ impl AdminService {
|
|||||||
user,
|
user,
|
||||||
memberships,
|
memberships,
|
||||||
current_workspace_id: current_workspace_id.map(|id| id.as_str().to_owned()),
|
current_workspace_id: current_workspace_id.map(|id| id.as_str().to_owned()),
|
||||||
|
csrf_token: self.rotate_session_csrf_token(session_id).await?,
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn change_password(
|
pub async fn change_password(
|
||||||
&self,
|
&self,
|
||||||
user_id: &crank_core::UserId,
|
user_id: &crank_core::UserId,
|
||||||
current_session_id: &UserSessionId,
|
_current_session_id: &UserSessionId,
|
||||||
payload: ChangePasswordPayload,
|
payload: ChangePasswordPayload,
|
||||||
) -> Result<(), ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
if payload.new_password.len() < 12 {
|
if payload.new_password.len() < 12 || payload.new_password.len() > 256 {
|
||||||
return Err(ApiError::validation(
|
return Err(ApiError::validation(
|
||||||
"new password must be at least 12 characters long",
|
"new password must be between 12 and 256 characters long",
|
||||||
));
|
));
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -258,13 +421,48 @@ impl AdminService {
|
|||||||
let password_hash =
|
let password_hash =
|
||||||
hash_password(&payload.new_password, &self.auth_settings.password_pepper)?;
|
hash_password(&payload.new_password, &self.auth_settings.password_pepper)?;
|
||||||
self.registry
|
self.registry
|
||||||
.update_user_password_and_revoke_other_sessions(
|
.update_user_password_and_revoke_all_sessions(user_id, &password_hash)
|
||||||
user_id,
|
|
||||||
current_session_id,
|
|
||||||
&password_hash,
|
|
||||||
)
|
|
||||||
.await?;
|
.await?;
|
||||||
|
self.record_admin_security_audit(Some(user_id), "password_rotated", "success", "password")
|
||||||
|
.await;
|
||||||
|
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn record_admin_security_audit(
|
||||||
|
&self,
|
||||||
|
actor_user_id: Option<&UserId>,
|
||||||
|
action: &'static str,
|
||||||
|
outcome: &'static str,
|
||||||
|
source: &'static str,
|
||||||
|
) {
|
||||||
|
let (request_id, trace_id) = crank_observability::current_request_correlation();
|
||||||
|
let audit_id = new_prefixed_id("audit");
|
||||||
|
let _ = self
|
||||||
|
.registry
|
||||||
|
.record_admin_security_audit(AdminSecurityAuditRequest {
|
||||||
|
id: &audit_id,
|
||||||
|
action,
|
||||||
|
outcome,
|
||||||
|
actor_user_id,
|
||||||
|
session_id: None,
|
||||||
|
request_id: request_id.as_deref(),
|
||||||
|
trace_id: trace_id.as_deref(),
|
||||||
|
source,
|
||||||
|
})
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn rotate_session_csrf_token(
|
||||||
|
&self,
|
||||||
|
session_id: &UserSessionId,
|
||||||
|
) -> Result<String, ApiError> {
|
||||||
|
let csrf_token = create_csrf_token_value();
|
||||||
|
let csrf_hash =
|
||||||
|
hash_csrf_token(session_id, &csrf_token, &self.auth_settings.session_secret);
|
||||||
|
self.registry
|
||||||
|
.update_user_session_csrf(session_id, &csrf_hash)
|
||||||
|
.await?;
|
||||||
|
Ok(csrf_token)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,9 +1,9 @@
|
|||||||
use std::collections::BTreeMap;
|
use std::collections::BTreeMap;
|
||||||
|
|
||||||
use crank_core::{
|
use crank_core::{
|
||||||
AgentId, InvocationLevel, InvocationSource, InvocationStatus, MembershipRole, OperationId,
|
AgentId, AgentOperationBinding, InvocationLevel, InvocationSource, InvocationStatus,
|
||||||
OperationSecurityLevel, PlatformApiKeyKind, PlatformApiKeyScope, PlatformApiKeyStatus,
|
MembershipRole, OperationId, OperationSecurityLevel, PlatformApiKeyKind, PlatformApiKeyScope,
|
||||||
Protocol, Target, WizardState, WorkspaceId,
|
PlatformApiKeyStatus, Protocol, Target, WizardState, WorkspaceId,
|
||||||
};
|
};
|
||||||
use crank_mapping::{JsonPathRoot, infer_mapping_from_samples};
|
use crank_mapping::{JsonPathRoot, infer_mapping_from_samples};
|
||||||
use crank_mapping::{MappingRule, MappingSet};
|
use crank_mapping::{MappingRule, MappingSet};
|
||||||
@@ -87,8 +87,12 @@ impl AdminService {
|
|||||||
async fn cleanup_legacy_demo_assets(&self, workspace_id: &WorkspaceId) -> Result<(), ApiError> {
|
async fn cleanup_legacy_demo_assets(&self, workspace_id: &WorkspaceId) -> Result<(), ApiError> {
|
||||||
for slug in ["revops-copilot", "support-triage"] {
|
for slug in ["revops-copilot", "support-triage"] {
|
||||||
if let Some(agent) = self.find_agent_by_slug(workspace_id, slug).await? {
|
if let Some(agent) = self.find_agent_by_slug(workspace_id, slug).await? {
|
||||||
self.delete_agent(workspace_id, &AgentId::new(agent.id.as_str().to_owned()))
|
self.delete_agent(
|
||||||
.await?;
|
workspace_id,
|
||||||
|
&AgentId::new(agent.id.as_str().to_owned()),
|
||||||
|
None,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -129,7 +133,10 @@ impl AdminService {
|
|||||||
.await
|
.await
|
||||||
{
|
{
|
||||||
Ok(()) => Ok(()),
|
Ok(()) => Ok(()),
|
||||||
Err(RegistryError::OperationHasPublishedAgentBindings { .. }) => {
|
Err(
|
||||||
|
RegistryError::OperationHasPublishedAgentBindings { .. }
|
||||||
|
| RegistryError::OperationDeleteForbidden { .. },
|
||||||
|
) => {
|
||||||
tracing::warn!(
|
tracing::warn!(
|
||||||
name: "admin.demo_operation.cleanup_skipped",
|
name: "admin.demo_operation.cleanup_skipped",
|
||||||
operation_id = %operation_id.as_str(),
|
operation_id = %operation_id.as_str(),
|
||||||
@@ -168,6 +175,7 @@ impl AdminService {
|
|||||||
expires_at: None,
|
expires_at: None,
|
||||||
allowed_origins: Vec::new(),
|
allowed_origins: Vec::new(),
|
||||||
},
|
},
|
||||||
|
None,
|
||||||
)
|
)
|
||||||
.await?
|
.await?
|
||||||
.api_key
|
.api_key
|
||||||
@@ -175,7 +183,7 @@ impl AdminService {
|
|||||||
};
|
};
|
||||||
|
|
||||||
if revoke && key.api_key.status != PlatformApiKeyStatus::Revoked {
|
if revoke && key.api_key.status != PlatformApiKeyStatus::Revoked {
|
||||||
self.revoke_agent_platform_api_key(workspace_id, agent_id, &key.api_key.id)
|
self.revoke_agent_platform_api_key(workspace_id, agent_id, &key.api_key.id, None)
|
||||||
.await?;
|
.await?;
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -210,8 +218,17 @@ impl AdminService {
|
|||||||
return Ok(());
|
return Ok(());
|
||||||
}
|
}
|
||||||
|
|
||||||
self.publish_operation(workspace_id, &summary.id, summary.current_draft_version)
|
self.publish_operation(
|
||||||
.await?;
|
workspace_id,
|
||||||
|
&summary.id,
|
||||||
|
summary.current_draft_version,
|
||||||
|
&crank_registry::OperationStateExpectation {
|
||||||
|
current_draft_version: summary.current_draft_version,
|
||||||
|
status: summary.status,
|
||||||
|
latest_published_version: summary.latest_published_version,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -273,10 +290,15 @@ impl AdminService {
|
|||||||
publish: bool,
|
publish: bool,
|
||||||
) -> Result<(), ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
let summary = self.get_agent(workspace_id, agent_id).await?;
|
let summary = self.get_agent(workspace_id, agent_id).await?;
|
||||||
self.save_agent_bindings(workspace_id, agent_id, bindings.into())
|
let current = self
|
||||||
|
.get_agent_version(workspace_id, agent_id, summary.current_draft_version)
|
||||||
.await?;
|
.await?;
|
||||||
|
if !demo_agent_bindings_match(¤t.bindings, &bindings) {
|
||||||
|
self.save_agent_bindings(workspace_id, agent_id, bindings.into(), None)
|
||||||
|
.await?;
|
||||||
|
}
|
||||||
if publish && summary.latest_published_version.is_none() {
|
if publish && summary.latest_published_version.is_none() {
|
||||||
self.publish_agent(workspace_id, agent_id, summary.current_draft_version)
|
self.publish_agent(workspace_id, agent_id, summary.current_draft_version, None)
|
||||||
.await?;
|
.await?;
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -294,11 +316,16 @@ impl AdminService {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id,
|
workspace_id,
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: None,
|
source: None,
|
||||||
operation_id: None,
|
operation_id: None,
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 1,
|
limit: 1,
|
||||||
})
|
})
|
||||||
.await?
|
.await?
|
||||||
@@ -329,6 +356,10 @@ impl AdminService {
|
|||||||
message: "Frankfurter returned latest exchange rate".to_owned(),
|
message: "Frankfurter returned latest exchange rate".to_owned(),
|
||||||
status_code: Some(200),
|
status_code: Some(200),
|
||||||
error_kind: None,
|
error_kind: None,
|
||||||
|
execution_stage: Some(crank_core::ExecutionStage::Runtime),
|
||||||
|
execution_error_code: None,
|
||||||
|
retryability: Some(crank_core::Retryability::Never),
|
||||||
|
outcome_certainty: Some(crank_core::OutcomeCertainty::Certain),
|
||||||
duration_ms: 124,
|
duration_ms: 124,
|
||||||
request_preview: json!({
|
request_preview: json!({
|
||||||
"path": {},
|
"path": {},
|
||||||
@@ -343,6 +374,25 @@ impl AdminService {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn demo_agent_bindings_match(
|
||||||
|
existing: &[AgentOperationBinding],
|
||||||
|
desired: &[AgentBindingPayload],
|
||||||
|
) -> bool {
|
||||||
|
if existing.len() != desired.len() {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
let mut desired = desired.iter().collect::<Vec<_>>();
|
||||||
|
desired.sort_by(|left, right| left.tool_name.cmp(&right.tool_name));
|
||||||
|
existing.iter().zip(desired).all(|(existing, desired)| {
|
||||||
|
existing.operation_id.as_str() == desired.operation_id
|
||||||
|
&& existing.operation_version == desired.operation_version
|
||||||
|
&& existing.tool_name == desired.tool_name
|
||||||
|
&& existing.tool_title == desired.tool_title
|
||||||
|
&& existing.tool_description_override == desired.tool_description_override
|
||||||
|
&& existing.enabled == desired.enabled
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
fn demo_currency_agent_payload() -> AgentPayload {
|
fn demo_currency_agent_payload() -> AgentPayload {
|
||||||
AgentPayload {
|
AgentPayload {
|
||||||
slug: "currency-rates".to_owned(),
|
slug: "currency-rates".to_owned(),
|
||||||
|
|||||||
@@ -1,16 +1,26 @@
|
|||||||
use crank_core::{ConfigExport, WorkspaceId};
|
use crank_core::{OperationStatus, Target, WorkspaceId};
|
||||||
use crank_registry::RegistryOperation;
|
use crank_registry::OperationStateExpectation;
|
||||||
|
use serde::de::{self, Deserialize, Deserializer, MapAccess, SeqAccess, Visitor};
|
||||||
|
use serde_yaml::Value as YamlValue;
|
||||||
|
use std::fmt;
|
||||||
use tracing::{info, instrument};
|
use tracing::{info, instrument};
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
import_guidance::import_guidance_warnings,
|
import_guidance::import_guidance_warnings,
|
||||||
service::{
|
service::{
|
||||||
AdminService, ExportQuery, ImportMode, ImportQuery, ImportResponse, NewVersionPayload,
|
AdminService, ExportQuery, ImportMode, ImportQuery, ImportResponse,
|
||||||
OperationPayload, YamlOperationDocument,
|
LegacyYamlOperationDocument, NewVersionPayload, OperationPayload, PortableOperation,
|
||||||
|
YamlOperationDocument,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
|
const MAX_YAML_BYTES: usize = 256 * 1024;
|
||||||
|
const MAX_YAML_LINE_OR_SCALAR_BYTES: usize = 64 * 1024;
|
||||||
|
const MAX_YAML_DEPTH: usize = 64;
|
||||||
|
const MAX_YAML_NODES: usize = 20_000;
|
||||||
|
const MAX_YAML_COLLECTION_ITEMS: usize = 4_096;
|
||||||
|
|
||||||
impl AdminService {
|
impl AdminService {
|
||||||
#[instrument(skip(self), fields(operation_id = %operation_id.as_str(), version = query.version.unwrap_or_default(), mode = ?query.mode))]
|
#[instrument(skip(self), fields(operation_id = %operation_id.as_str(), version = query.version.unwrap_or_default(), mode = ?query.mode))]
|
||||||
pub async fn export_operation(
|
pub async fn export_operation(
|
||||||
@@ -30,19 +40,30 @@ impl AdminService {
|
|||||||
let record = self
|
let record = self
|
||||||
.get_operation_version(workspace_id, operation_id, version)
|
.get_operation_version(workspace_id, operation_id, version)
|
||||||
.await?;
|
.await?;
|
||||||
let document = YamlOperationDocument {
|
let aggregate = self.get_operation(workspace_id, operation_id).await?;
|
||||||
format_version: "1".to_owned(),
|
let exportable = record.status == OperationStatus::Published
|
||||||
kind: "operation".to_owned(),
|
|| (aggregate.status != OperationStatus::Archived
|
||||||
operation: RegistryOperation {
|
&& record.status == OperationStatus::Draft
|
||||||
config_export: Some(ConfigExport {
|
&& aggregate.current_draft_version == version);
|
||||||
format_version: "1".to_owned(),
|
if !exportable {
|
||||||
export_mode: query.mode,
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"only the active current Draft or a Published Version can be exported",
|
||||||
|
serde_json::json!({
|
||||||
|
"error_code": "operation_invalid_transition",
|
||||||
|
"version": version
|
||||||
}),
|
}),
|
||||||
..record.snapshot
|
));
|
||||||
},
|
}
|
||||||
|
let operation = PortableOperation::from_registry(&record.snapshot);
|
||||||
|
reject_credential_material(&operation)?;
|
||||||
|
let document = YamlOperationDocument {
|
||||||
|
format_version: "2".to_owned(),
|
||||||
|
kind: "operation".to_owned(),
|
||||||
|
operation,
|
||||||
};
|
};
|
||||||
|
|
||||||
serde_yaml::to_string(&document).map_err(|error| ApiError::internal(error.to_string()))
|
serde_yaml::to_string(&document)
|
||||||
|
.map_err(|_| ApiError::internal("portable yaml serialization failed"))
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self, yaml_document), fields(mode = ?query.mode))]
|
#[instrument(skip(self, yaml_document), fields(mode = ?query.mode))]
|
||||||
@@ -51,29 +72,41 @@ impl AdminService {
|
|||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
query: ImportQuery,
|
query: ImportQuery,
|
||||||
yaml_document: &str,
|
yaml_document: &str,
|
||||||
|
if_match: Option<&str>,
|
||||||
) -> Result<ImportResponse, ApiError> {
|
) -> Result<ImportResponse, ApiError> {
|
||||||
let document: YamlOperationDocument = serde_yaml::from_str(yaml_document)
|
reject_yaml_anchors_and_aliases(yaml_document)?;
|
||||||
.map_err(|error| ApiError::validation(error.to_string()))?;
|
let parsed = parse_bounded_yaml(yaml_document)?;
|
||||||
if document.kind != "operation" {
|
let format_version = parsed
|
||||||
return Err(ApiError::validation("yaml kind must be operation"));
|
.as_mapping()
|
||||||
}
|
.and_then(|mapping| mapping.get(YamlValue::String("format_version".to_owned())))
|
||||||
|
.and_then(YamlValue::as_str)
|
||||||
|
.ok_or_else(yaml_invalid)?;
|
||||||
|
|
||||||
let payload = OperationPayload {
|
let (operation, warnings) = match format_version {
|
||||||
name: document.operation.name.clone(),
|
"2" => {
|
||||||
display_name: document.operation.display_name.clone(),
|
let document: YamlOperationDocument =
|
||||||
category: document.operation.category.clone(),
|
serde_yaml::from_value(parsed).map_err(|_| yaml_invalid())?;
|
||||||
protocol: document.operation.protocol,
|
if document.kind != "operation" || document.format_version != "2" {
|
||||||
security_level: document.operation.security_level,
|
return Err(yaml_unsupported());
|
||||||
target: document.operation.target.clone(),
|
}
|
||||||
input_schema: document.operation.input_schema.clone(),
|
(document.operation, Vec::new())
|
||||||
output_schema: document.operation.output_schema.clone(),
|
}
|
||||||
input_mapping: document.operation.input_mapping.clone(),
|
"1" => {
|
||||||
output_mapping: document.operation.output_mapping.clone(),
|
let document: LegacyYamlOperationDocument =
|
||||||
execution_config: document.operation.execution_config.clone(),
|
serde_yaml::from_value(parsed).map_err(|_| yaml_invalid())?;
|
||||||
tool_description: document.operation.tool_description.clone(),
|
if document.kind != "operation" || document.format_version != "1" {
|
||||||
wizard_state: document.operation.wizard_state.clone(),
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
let warnings = import_guidance_warnings(&document.operation);
|
||||||
|
(
|
||||||
|
PortableOperation::from_registry(&document.operation),
|
||||||
|
warnings,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
_ => return Err(yaml_unsupported()),
|
||||||
};
|
};
|
||||||
let warnings = import_guidance_warnings(&document.operation);
|
reject_credential_material(&operation)?;
|
||||||
|
let payload = operation.to_payload();
|
||||||
|
|
||||||
match query.mode {
|
match query.mode {
|
||||||
ImportMode::Create => {
|
ImportMode::Create => {
|
||||||
@@ -88,9 +121,66 @@ impl AdminService {
|
|||||||
}
|
}
|
||||||
ImportMode::Upsert => {
|
ImportMode::Upsert => {
|
||||||
if let Some(existing) = self
|
if let Some(existing) = self
|
||||||
.find_operation_by_name(workspace_id, &document.operation.name)
|
.find_operation_by_name(workspace_id, &operation.name)
|
||||||
.await?
|
.await?
|
||||||
{
|
{
|
||||||
|
if existing.status == OperationStatus::Archived {
|
||||||
|
return Err(crank_registry::RegistryError::OperationArchived {
|
||||||
|
operation_id: existing.id.as_str().to_owned(),
|
||||||
|
}
|
||||||
|
.into());
|
||||||
|
}
|
||||||
|
let current = self
|
||||||
|
.get_operation_version(
|
||||||
|
workspace_id,
|
||||||
|
&existing.id,
|
||||||
|
existing.current_draft_version,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
if operation.matches_registry(¤t.snapshot) {
|
||||||
|
let expected_state = OperationStateExpectation {
|
||||||
|
current_draft_version: existing.current_draft_version,
|
||||||
|
status: existing.status,
|
||||||
|
latest_published_version: existing.latest_published_version,
|
||||||
|
};
|
||||||
|
self.registry
|
||||||
|
.verify_operation_state(workspace_id, &existing.id, &expected_state)
|
||||||
|
.await?;
|
||||||
|
return Ok(ImportResponse {
|
||||||
|
operation_id: existing.id.as_str().to_owned(),
|
||||||
|
workspace_id: workspace_id.as_str().to_owned(),
|
||||||
|
version: existing.current_draft_version,
|
||||||
|
import_mode: ImportMode::Upsert,
|
||||||
|
warnings,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
let current_detail = self.get_operation(workspace_id, &existing.id).await?;
|
||||||
|
let expected_state = OperationStateExpectation {
|
||||||
|
current_draft_version: current_detail.current_draft_version,
|
||||||
|
status: current_detail.status,
|
||||||
|
latest_published_version: current_detail.latest_published_version,
|
||||||
|
};
|
||||||
|
let expected_etag = Self::operation_state_etag(¤t_detail);
|
||||||
|
let provided_etag = if_match.ok_or_else(|| {
|
||||||
|
ApiError::precondition_required_with_context(
|
||||||
|
"If-Match is required when YAML upsert changes an existing Operation",
|
||||||
|
serde_json::json!({
|
||||||
|
"error_code": "operation_precondition_required",
|
||||||
|
"current_version": existing.current_draft_version,
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
if provided_etag != expected_etag {
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"Operation state changed; reload before retrying YAML upsert",
|
||||||
|
serde_json::json!({
|
||||||
|
"error_code": "operation_stale_version",
|
||||||
|
"current_version": existing.current_draft_version,
|
||||||
|
"recovery": "reload"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
let created = self
|
let created = self
|
||||||
.create_version(
|
.create_version(
|
||||||
workspace_id,
|
workspace_id,
|
||||||
@@ -99,9 +189,9 @@ impl AdminService {
|
|||||||
operation: payload,
|
operation: payload,
|
||||||
change_note: Some("yaml upsert".to_owned()),
|
change_note: Some("yaml upsert".to_owned()),
|
||||||
},
|
},
|
||||||
|
&expected_state,
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
let response = ImportResponse {
|
let response = ImportResponse {
|
||||||
operation_id: created.operation_id,
|
operation_id: created.operation_id,
|
||||||
workspace_id: created.workspace_id,
|
workspace_id: created.workspace_id,
|
||||||
@@ -118,22 +208,384 @@ impl AdminService {
|
|||||||
Ok(response)
|
Ok(response)
|
||||||
} else {
|
} else {
|
||||||
let created = self.create_operation(workspace_id, payload).await?;
|
let created = self.create_operation(workspace_id, payload).await?;
|
||||||
let response = ImportResponse {
|
Ok(ImportResponse {
|
||||||
operation_id: created.operation_id,
|
operation_id: created.operation_id,
|
||||||
workspace_id: created.workspace_id,
|
workspace_id: created.workspace_id,
|
||||||
version: created.version,
|
version: created.version,
|
||||||
import_mode: ImportMode::Upsert,
|
import_mode: ImportMode::Upsert,
|
||||||
warnings,
|
warnings,
|
||||||
};
|
})
|
||||||
info!(
|
|
||||||
name: "admin.operation.imported",
|
|
||||||
operation_id = %response.operation_id,
|
|
||||||
version = response.version,
|
|
||||||
"operation imported by upsert"
|
|
||||||
);
|
|
||||||
Ok(response)
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
impl PortableOperation {
|
||||||
|
fn from_registry(operation: &crank_registry::RegistryOperation) -> Self {
|
||||||
|
Self {
|
||||||
|
name: operation.name.clone(),
|
||||||
|
display_name: operation.display_name.clone(),
|
||||||
|
category: operation.category.clone(),
|
||||||
|
protocol: operation.protocol,
|
||||||
|
security_level: operation.security_level,
|
||||||
|
target: operation.target.clone(),
|
||||||
|
input_schema: operation.input_schema.clone(),
|
||||||
|
output_schema: operation.output_schema.clone(),
|
||||||
|
input_mapping: operation.input_mapping.clone(),
|
||||||
|
output_mapping: operation.output_mapping.clone(),
|
||||||
|
execution_config: operation.execution_config.clone(),
|
||||||
|
tool_description: operation.tool_description.clone(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn to_payload(&self) -> OperationPayload {
|
||||||
|
OperationPayload {
|
||||||
|
name: self.name.clone(),
|
||||||
|
display_name: self.display_name.clone(),
|
||||||
|
category: self.category.clone(),
|
||||||
|
protocol: self.protocol,
|
||||||
|
security_level: self.security_level,
|
||||||
|
target: self.target.clone(),
|
||||||
|
input_schema: self.input_schema.clone(),
|
||||||
|
output_schema: self.output_schema.clone(),
|
||||||
|
input_mapping: self.input_mapping.clone(),
|
||||||
|
output_mapping: self.output_mapping.clone(),
|
||||||
|
execution_config: self.execution_config.clone(),
|
||||||
|
tool_description: self.tool_description.clone(),
|
||||||
|
wizard_state: None,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn matches_registry(&self, operation: &crank_registry::RegistryOperation) -> bool {
|
||||||
|
self.name == operation.name
|
||||||
|
&& self.display_name == operation.display_name
|
||||||
|
&& self.category == operation.category
|
||||||
|
&& self.protocol == operation.protocol
|
||||||
|
&& self.security_level == operation.security_level
|
||||||
|
&& self.target == operation.target
|
||||||
|
&& self.input_schema == operation.input_schema
|
||||||
|
&& self.output_schema == operation.output_schema
|
||||||
|
&& self.input_mapping == operation.input_mapping
|
||||||
|
&& self.output_mapping == operation.output_mapping
|
||||||
|
&& self.execution_config == operation.execution_config
|
||||||
|
&& self.tool_description == operation.tool_description
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn parse_bounded_yaml(document: &str) -> Result<YamlValue, ApiError> {
|
||||||
|
if document.is_empty() {
|
||||||
|
return Err(yaml_invalid());
|
||||||
|
}
|
||||||
|
if document.len() > MAX_YAML_BYTES {
|
||||||
|
return Err(ApiError::payload_too_large_with_context(
|
||||||
|
"operation yaml exceeds the 256 KiB limit",
|
||||||
|
serde_json::json!({ "error_code": "operation_yaml_too_large" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
if document
|
||||||
|
.lines()
|
||||||
|
.any(|line| line.len() > MAX_YAML_LINE_OR_SCALAR_BYTES)
|
||||||
|
{
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
let separators = document.lines().filter(|line| line.trim() == "---").count();
|
||||||
|
if separators > 1 || document.lines().any(|line| line.trim() == "...") {
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
DuplicateChecked::deserialize(serde_yaml::Deserializer::from_str(document))
|
||||||
|
.map_err(|_| yaml_invalid())?;
|
||||||
|
let parsed: YamlValue = serde_yaml::from_str(document).map_err(|_| yaml_invalid())?;
|
||||||
|
let mut nodes = 0;
|
||||||
|
validate_yaml_value(&parsed, 0, &mut nodes)?;
|
||||||
|
Ok(parsed)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// A bounded preflight pass which rejects duplicate mapping keys before
|
||||||
|
/// `serde_yaml::Value` can collapse them. Values are deliberately discarded:
|
||||||
|
/// the authoritative typed parse follows only after this structural check.
|
||||||
|
struct DuplicateChecked;
|
||||||
|
|
||||||
|
impl<'de> Deserialize<'de> for DuplicateChecked {
|
||||||
|
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
|
||||||
|
where
|
||||||
|
D: Deserializer<'de>,
|
||||||
|
{
|
||||||
|
deserializer.deserialize_any(DuplicateCheckedVisitor)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
struct DuplicateCheckedVisitor;
|
||||||
|
|
||||||
|
impl<'de> Visitor<'de> for DuplicateCheckedVisitor {
|
||||||
|
type Value = DuplicateChecked;
|
||||||
|
|
||||||
|
fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
|
||||||
|
formatter.write_str("a YAML value without duplicate mapping keys")
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
|
||||||
|
where
|
||||||
|
A: MapAccess<'de>,
|
||||||
|
{
|
||||||
|
let mut keys = Vec::<YamlValue>::new();
|
||||||
|
while let Some(key) = map.next_key::<YamlValue>()? {
|
||||||
|
if keys.iter().any(|existing| existing == &key) {
|
||||||
|
return Err(de::Error::custom("duplicate mapping key"));
|
||||||
|
}
|
||||||
|
keys.push(key);
|
||||||
|
map.next_value::<DuplicateChecked>()?;
|
||||||
|
}
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_seq<A>(self, mut sequence: A) -> Result<Self::Value, A::Error>
|
||||||
|
where
|
||||||
|
A: SeqAccess<'de>,
|
||||||
|
{
|
||||||
|
while sequence.next_element::<DuplicateChecked>()?.is_some() {}
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_bool<E>(self, _: bool) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_i64<E>(self, _: i64) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_u64<E>(self, _: u64) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_f64<E>(self, _: f64) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_str<E>(self, _: &str) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_string<E>(self, _: String) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_none<E>(self) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_unit<E>(self) -> Result<Self::Value, E> {
|
||||||
|
Ok(DuplicateChecked)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_some<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
|
||||||
|
where
|
||||||
|
D: Deserializer<'de>,
|
||||||
|
{
|
||||||
|
DuplicateChecked::deserialize(deserializer)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn visit_newtype_struct<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
|
||||||
|
where
|
||||||
|
D: Deserializer<'de>,
|
||||||
|
{
|
||||||
|
DuplicateChecked::deserialize(deserializer)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn validate_yaml_value(value: &YamlValue, depth: usize, nodes: &mut usize) -> Result<(), ApiError> {
|
||||||
|
if depth > MAX_YAML_DEPTH {
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
*nodes = nodes.saturating_add(1);
|
||||||
|
if *nodes > MAX_YAML_NODES {
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
match value {
|
||||||
|
YamlValue::Sequence(values) => {
|
||||||
|
if values.len() > MAX_YAML_COLLECTION_ITEMS {
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
for value in values {
|
||||||
|
validate_yaml_value(value, depth + 1, nodes)?;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
YamlValue::Mapping(values) => {
|
||||||
|
if values.len() > MAX_YAML_COLLECTION_ITEMS {
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
for (key, value) in values {
|
||||||
|
validate_yaml_value(key, depth + 1, nodes)?;
|
||||||
|
validate_yaml_value(value, depth + 1, nodes)?;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
YamlValue::String(value) if value.len() > MAX_YAML_LINE_OR_SCALAR_BYTES => {
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
YamlValue::Tagged(_) => return Err(yaml_unsupported()),
|
||||||
|
_ => {}
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn reject_credential_material(operation: &PortableOperation) -> Result<(), ApiError> {
|
||||||
|
let sensitive_name = |name: &str| {
|
||||||
|
let normalized = name.to_ascii_lowercase();
|
||||||
|
let segments = normalized.split(['-', '_', '.']).collect::<Vec<_>>();
|
||||||
|
matches!(
|
||||||
|
normalized.as_str(),
|
||||||
|
"authorization" | "proxy-authorization" | "cookie" | "set-cookie"
|
||||||
|
) || segments
|
||||||
|
.iter()
|
||||||
|
.any(|segment| matches!(*segment, "auth" | "token" | "secret" | "cookie"))
|
||||||
|
|| segments.windows(2).any(|parts| parts == ["api", "key"])
|
||||||
|
};
|
||||||
|
let sensitive_value = |value: &str| {
|
||||||
|
let normalized = value.trim().to_ascii_lowercase();
|
||||||
|
normalized.starts_with("bearer ")
|
||||||
|
|| normalized.starts_with("basic ")
|
||||||
|
|| normalized.starts_with("digest ")
|
||||||
|
|| normalized.contains("api_key=")
|
||||||
|
|| normalized.contains("access_token=")
|
||||||
|
};
|
||||||
|
let target_headers = match &operation.target {
|
||||||
|
Target::Rest(target) => &target.static_headers,
|
||||||
|
};
|
||||||
|
if target_headers
|
||||||
|
.iter()
|
||||||
|
.any(|(name, value)| sensitive_name(name) || sensitive_value(value))
|
||||||
|
|| operation
|
||||||
|
.execution_config
|
||||||
|
.headers
|
||||||
|
.iter()
|
||||||
|
.any(|(name, value)| sensitive_name(name) || sensitive_value(value))
|
||||||
|
{
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"portable yaml contains credential-bearing headers",
|
||||||
|
serde_json::json!({ "error_code": "operation_yaml_invalid" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn reject_yaml_anchors_and_aliases(document: &str) -> Result<(), ApiError> {
|
||||||
|
let mut single_quote = false;
|
||||||
|
let mut double_quote = false;
|
||||||
|
let mut escaped = false;
|
||||||
|
let mut comment = false;
|
||||||
|
let mut previous = '\n';
|
||||||
|
let chars = document.chars().collect::<Vec<_>>();
|
||||||
|
for (index, character) in chars.iter().copied().enumerate() {
|
||||||
|
if character == '\n' {
|
||||||
|
comment = false;
|
||||||
|
previous = character;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if comment {
|
||||||
|
previous = character;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if double_quote {
|
||||||
|
if escaped {
|
||||||
|
escaped = false;
|
||||||
|
} else if character == '\\' {
|
||||||
|
escaped = true;
|
||||||
|
} else if character == '"' {
|
||||||
|
double_quote = false;
|
||||||
|
}
|
||||||
|
previous = character;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if single_quote {
|
||||||
|
if character == '\'' {
|
||||||
|
single_quote = false;
|
||||||
|
}
|
||||||
|
previous = character;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
match character {
|
||||||
|
'#' => comment = true,
|
||||||
|
'"' => double_quote = true,
|
||||||
|
'\'' => single_quote = true,
|
||||||
|
'&' | '*'
|
||||||
|
if (previous.is_whitespace() || matches!(previous, ':' | '[' | '{' | ','))
|
||||||
|
&& chars.get(index + 1).is_some_and(|next| {
|
||||||
|
next.is_ascii_alphanumeric() || matches!(next, '_' | '-')
|
||||||
|
}) =>
|
||||||
|
{
|
||||||
|
return Err(yaml_unsupported());
|
||||||
|
}
|
||||||
|
_ => {}
|
||||||
|
}
|
||||||
|
previous = character;
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn yaml_invalid() -> ApiError {
|
||||||
|
ApiError::unprocessable_with_context(
|
||||||
|
"operation yaml is invalid",
|
||||||
|
serde_json::json!({ "error_code": "operation_yaml_invalid" }),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn yaml_unsupported() -> ApiError {
|
||||||
|
ApiError::unprocessable_with_context(
|
||||||
|
"operation yaml uses an unsupported construct",
|
||||||
|
serde_json::json!({ "error_code": "operation_yaml_unsupported" }),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
#[cfg(test)]
|
||||||
|
mod tests {
|
||||||
|
use super::parse_bounded_yaml;
|
||||||
|
use serde_json::Value;
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn portable_v2_schema_freezes_the_closed_top_level_contract() {
|
||||||
|
let schema: Value = serde_json::from_str(include_str!(
|
||||||
|
"../../../../docs/schemas/operation-export-v2.schema.json"
|
||||||
|
))
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(schema["properties"]["format_version"]["const"], "2");
|
||||||
|
assert_eq!(schema["properties"]["kind"]["const"], "operation");
|
||||||
|
assert_eq!(schema["additionalProperties"], false);
|
||||||
|
assert_eq!(
|
||||||
|
schema["$defs"]["portable_operation"]["additionalProperties"],
|
||||||
|
false
|
||||||
|
);
|
||||||
|
assert_eq!(
|
||||||
|
schema["$defs"]["portable_operation"]["properties"]["security_level"]["enum"],
|
||||||
|
serde_json::json!(["standard"])
|
||||||
|
);
|
||||||
|
for name in [
|
||||||
|
"rest_target",
|
||||||
|
"schema",
|
||||||
|
"mapping_set",
|
||||||
|
"mapping_rule",
|
||||||
|
"execution_config",
|
||||||
|
"tool_description",
|
||||||
|
] {
|
||||||
|
assert_eq!(schema["$defs"][name]["additionalProperties"], false);
|
||||||
|
}
|
||||||
|
assert_eq!(
|
||||||
|
schema["$defs"]["portable_operation"]["properties"]["target"]["$ref"],
|
||||||
|
"#/$defs/rest_target"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn bounded_yaml_rejects_duplicate_keys_before_typed_parsing() {
|
||||||
|
let document =
|
||||||
|
"format_version: '2'\nkind: operation\nkind: attacker_override\noperation: {}\n";
|
||||||
|
let error = parse_bounded_yaml(document).expect_err("duplicate key must fail closed");
|
||||||
|
match error {
|
||||||
|
crate::error::ApiError::Unprocessable { context, .. } => assert_eq!(
|
||||||
|
context.and_then(|value| value["error_code"].as_str().map(str::to_owned)),
|
||||||
|
Some("operation_yaml_invalid".to_owned())
|
||||||
|
),
|
||||||
|
other => panic!("unexpected error: {other:?}"),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|||||||
@@ -1,28 +1,52 @@
|
|||||||
|
use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
|
||||||
use crank_core::{
|
use crank_core::{
|
||||||
AgentId, ApprovalRequestId, ApprovalRequestStatus, InvocationLogId, OperationId, UsagePeriod,
|
AgentId, ApprovalRequestId, ApprovalRequestStatus, InvocationLogId, OperationId, UsagePeriod,
|
||||||
WorkspaceId,
|
WorkspaceId,
|
||||||
};
|
};
|
||||||
use crank_registry::{
|
use crank_registry::{
|
||||||
ApprovalRequestRecord, ExpireApprovalRequest, InvocationLogRecord, ListApprovalRequestsQuery,
|
ApprovalRequestRecord, DecideApprovalRequest, ExpireApprovalRequest, InvocationLogRecord,
|
||||||
ListInvocationLogsQuery, UsageQuery, UsageRollupRecord,
|
InvocationRetentionOutcome, ListApprovalRequestsQuery, ListInvocationLogsQuery, UsageQuery,
|
||||||
|
UsageRollupRecord,
|
||||||
};
|
};
|
||||||
use serde_json::json;
|
use serde_json::json;
|
||||||
use time::OffsetDateTime;
|
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
use tracing::instrument;
|
use tracing::instrument;
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
service::{
|
service::{
|
||||||
AdminService, ApprovalsQuery, LogsQuery, UsageOverviewResponse, UsageRequestQuery,
|
AdminService, ApprovalDecisionPayload, ApprovalsQuery, LogsListResponse, LogsQuery,
|
||||||
usage_window,
|
UsageOverviewResponse, UsageRequestQuery, usage_window,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
|
const LOG_LIST_DEFAULT_LIMIT: u32 = 100;
|
||||||
|
const LOG_LIST_MAX_LIMIT: u32 = 200;
|
||||||
|
const LOG_CSV_MAX_ROWS: u32 = 1_000;
|
||||||
|
const MAX_EXPLICIT_USAGE_WINDOW_DAYS: i64 = 90;
|
||||||
|
|
||||||
|
#[derive(serde::Serialize, serde::Deserialize)]
|
||||||
|
struct LogsCursor {
|
||||||
|
created_at: String,
|
||||||
|
id: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
fn safe_approval_record(mut record: ApprovalRequestRecord) -> ApprovalRequestRecord {
|
||||||
|
record.approval.request_payload =
|
||||||
|
crank_core::sanitize_invocation_preview(&record.approval.request_payload);
|
||||||
|
record.approval.response_payload = record
|
||||||
|
.approval
|
||||||
|
.response_payload
|
||||||
|
.as_ref()
|
||||||
|
.map(crank_core::sanitize_invocation_preview);
|
||||||
|
record
|
||||||
|
}
|
||||||
|
|
||||||
impl AdminService {
|
impl AdminService {
|
||||||
pub async fn cleanup_invocation_logs_before(
|
pub async fn cleanup_invocation_logs_before(
|
||||||
&self,
|
&self,
|
||||||
cutoff: OffsetDateTime,
|
cutoff: OffsetDateTime,
|
||||||
) -> Result<u64, ApiError> {
|
) -> Result<InvocationRetentionOutcome, ApiError> {
|
||||||
self.registry
|
self.registry
|
||||||
.delete_invocation_logs_before(cutoff)
|
.delete_invocation_logs_before(cutoff)
|
||||||
.await
|
.await
|
||||||
@@ -34,25 +58,45 @@ impl AdminService {
|
|||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
query: LogsQuery,
|
query: LogsQuery,
|
||||||
) -> Result<Vec<InvocationLogRecord>, ApiError> {
|
) -> Result<LogsListResponse, ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
let operation_id = query.operation_id.as_deref().map(OperationId::new);
|
let operation_id = query.operation_id.as_deref().map(OperationId::new);
|
||||||
let agent_id = query.agent_id.as_deref().map(AgentId::new);
|
let agent_id = query.agent_id.as_deref().map(AgentId::new);
|
||||||
let (_, created_after, _) = usage_window(query.period.unwrap_or(UsagePeriod::Last7Days))?;
|
let (_, created_after, created_before, _) =
|
||||||
|
resolve_usage_window(query.period.unwrap_or(UsagePeriod::Last7Days), &query)?;
|
||||||
|
let (cursor_created_at, cursor_id) = decode_logs_cursor(query.cursor.as_deref())?;
|
||||||
|
let limit = query
|
||||||
|
.limit
|
||||||
|
.unwrap_or(LOG_LIST_DEFAULT_LIMIT)
|
||||||
|
.clamp(1, LOG_LIST_MAX_LIMIT);
|
||||||
|
|
||||||
self.registry
|
let mut items = self
|
||||||
|
.registry
|
||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id,
|
workspace_id,
|
||||||
level: query.level,
|
level: query.level,
|
||||||
|
status: query.status,
|
||||||
|
outcome_group: query.outcome_group,
|
||||||
search_text: query.search.as_deref(),
|
search_text: query.search.as_deref(),
|
||||||
source: query.source,
|
source: query.source,
|
||||||
operation_id: operation_id.as_ref(),
|
operation_id: operation_id.as_ref(),
|
||||||
agent_id: agent_id.as_ref(),
|
agent_id: agent_id.as_ref(),
|
||||||
created_after: Some(&created_after),
|
created_after: Some(&created_after),
|
||||||
limit: query.limit.unwrap_or(100),
|
created_before: Some(&created_before),
|
||||||
|
cursor_created_at: cursor_created_at.as_deref(),
|
||||||
|
cursor_id: cursor_id.as_ref(),
|
||||||
|
limit: limit.saturating_add(1),
|
||||||
})
|
})
|
||||||
.await
|
.await?;
|
||||||
.map_err(ApiError::from)
|
|
||||||
|
let next_cursor = if items.len() > limit as usize {
|
||||||
|
items.truncate(limit as usize);
|
||||||
|
items.last().map(encode_logs_cursor).transpose()?
|
||||||
|
} else {
|
||||||
|
None
|
||||||
|
};
|
||||||
|
|
||||||
|
Ok(LogsListResponse { items, next_cursor })
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self))]
|
#[instrument(skip(self))]
|
||||||
@@ -72,6 +116,69 @@ impl AdminService {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[instrument(skip(self))]
|
||||||
|
pub async fn export_logs_csv(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
mut query: LogsQuery,
|
||||||
|
) -> Result<String, ApiError> {
|
||||||
|
query.limit = Some(
|
||||||
|
query
|
||||||
|
.limit
|
||||||
|
.unwrap_or(LOG_CSV_MAX_ROWS)
|
||||||
|
.clamp(1, LOG_CSV_MAX_ROWS),
|
||||||
|
);
|
||||||
|
query.cursor = None;
|
||||||
|
let page = self.list_logs(workspace_id, query).await?;
|
||||||
|
let mut csv = String::from(
|
||||||
|
"created_at,level,status,source,agent,operation,operation_version,duration_ms,request_id,trace_id,stage,error_code,message,request_preview,response_preview\n",
|
||||||
|
);
|
||||||
|
for record in page.items {
|
||||||
|
let log = record.log;
|
||||||
|
let row = [
|
||||||
|
log.created_at
|
||||||
|
.format(&Rfc3339)
|
||||||
|
.map_err(|error| ApiError::internal(error.to_string()))?,
|
||||||
|
serialize_csv_text(log.level)?,
|
||||||
|
serialize_csv_text(log.status)?,
|
||||||
|
serialize_csv_text(log.source)?,
|
||||||
|
record
|
||||||
|
.agent_display_name
|
||||||
|
.or(record.agent_slug)
|
||||||
|
.unwrap_or_default(),
|
||||||
|
record.operation_display_name,
|
||||||
|
log.operation_version
|
||||||
|
.map(|value| value.to_string())
|
||||||
|
.unwrap_or_default(),
|
||||||
|
log.duration_ms.to_string(),
|
||||||
|
log.request_id.unwrap_or_default(),
|
||||||
|
log.trace_id.unwrap_or_default(),
|
||||||
|
log.execution_stage
|
||||||
|
.map(serialize_csv_text)
|
||||||
|
.transpose()?
|
||||||
|
.unwrap_or_default(),
|
||||||
|
log.execution_error_code
|
||||||
|
.map(serialize_csv_text)
|
||||||
|
.transpose()?
|
||||||
|
.unwrap_or_default(),
|
||||||
|
log.message,
|
||||||
|
serde_json::to_string(&log.request_preview)
|
||||||
|
.map_err(|error| ApiError::internal(error.to_string()))?,
|
||||||
|
serde_json::to_string(&log.response_preview)
|
||||||
|
.map_err(|error| ApiError::internal(error.to_string()))?,
|
||||||
|
];
|
||||||
|
csv.push_str(&row.into_iter().map(csv_cell).collect::<Vec<_>>().join(","));
|
||||||
|
csv.push('\n');
|
||||||
|
if csv.len() > 1_048_576 {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"logs CSV export exceeded the bounded response size",
|
||||||
|
json!({ "error_code": "logs_csv_too_large" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Ok(csv)
|
||||||
|
}
|
||||||
|
|
||||||
#[instrument(skip(self))]
|
#[instrument(skip(self))]
|
||||||
pub async fn list_approvals(
|
pub async fn list_approvals(
|
||||||
&self,
|
&self,
|
||||||
@@ -92,7 +199,7 @@ impl AdminService {
|
|||||||
for record in records {
|
for record in records {
|
||||||
let record = self.normalize_approval_record(record).await?;
|
let record = self.normalize_approval_record(record).await?;
|
||||||
if query.status.is_none() || record.approval.status == query.status.unwrap() {
|
if query.status.is_none() || record.approval.status == query.status.unwrap() {
|
||||||
normalized.push(record);
|
normalized.push(safe_approval_record(record));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -117,7 +224,114 @@ impl AdminService {
|
|||||||
)
|
)
|
||||||
})?;
|
})?;
|
||||||
|
|
||||||
self.normalize_approval_record(record).await
|
self.normalize_approval_record(record)
|
||||||
|
.await
|
||||||
|
.map(safe_approval_record)
|
||||||
|
}
|
||||||
|
|
||||||
|
#[instrument(skip(self, payload))]
|
||||||
|
pub async fn approve_approval(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
approval_id: &ApprovalRequestId,
|
||||||
|
payload: ApprovalDecisionPayload,
|
||||||
|
) -> Result<ApprovalRequestRecord, ApiError> {
|
||||||
|
if !payload.approve.eq_ignore_ascii_case("yes") {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"approve must be yes for approval confirmation",
|
||||||
|
json!({ "error_code": "invalid_decision_payload" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
self.decide_admin_approval(
|
||||||
|
workspace_id,
|
||||||
|
approval_id,
|
||||||
|
ApprovalRequestStatus::Approved,
|
||||||
|
Some(json!({"approve": "yes"})),
|
||||||
|
payload.note.as_deref(),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
}
|
||||||
|
|
||||||
|
#[instrument(skip(self, payload))]
|
||||||
|
pub async fn deny_approval(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
approval_id: &ApprovalRequestId,
|
||||||
|
payload: ApprovalDecisionPayload,
|
||||||
|
) -> Result<ApprovalRequestRecord, ApiError> {
|
||||||
|
if !payload.approve.eq_ignore_ascii_case("no") {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"approve must be no for approval denial",
|
||||||
|
json!({ "error_code": "invalid_decision_payload" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
self.decide_admin_approval(
|
||||||
|
workspace_id,
|
||||||
|
approval_id,
|
||||||
|
ApprovalRequestStatus::Denied,
|
||||||
|
Some(json!({"approve": "no"})),
|
||||||
|
payload.note.as_deref(),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn decide_admin_approval(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
approval_id: &ApprovalRequestId,
|
||||||
|
status: ApprovalRequestStatus,
|
||||||
|
response_payload: Option<serde_json::Value>,
|
||||||
|
decision_note: Option<&str>,
|
||||||
|
) -> Result<ApprovalRequestRecord, ApiError> {
|
||||||
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
|
let current = self
|
||||||
|
.registry
|
||||||
|
.get_approval_request(workspace_id, approval_id)
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| {
|
||||||
|
ApiError::not_found_with_context(
|
||||||
|
format!("approval request {} was not found", approval_id.as_str()),
|
||||||
|
json!({ "approval_id": approval_id.as_str() }),
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let normalized = self.normalize_approval_record(current).await?;
|
||||||
|
if normalized.approval.status != ApprovalRequestStatus::Pending {
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"approval request is not pending",
|
||||||
|
json!({
|
||||||
|
"approval_id": approval_id.as_str(),
|
||||||
|
"status": normalized.approval.status,
|
||||||
|
"error_code": "approval_state_conflict"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let decided = self
|
||||||
|
.registry
|
||||||
|
.decide_approval_request(DecideApprovalRequest {
|
||||||
|
workspace_id,
|
||||||
|
agent_id: &normalized.approval.agent_id,
|
||||||
|
approval_id,
|
||||||
|
operation_id: &normalized.approval.operation_id,
|
||||||
|
operation_version: normalized.approval.operation_version,
|
||||||
|
request_payload: &normalized.approval.request_payload,
|
||||||
|
status,
|
||||||
|
decided_at: OffsetDateTime::now_utc(),
|
||||||
|
decided_by_key_id: None,
|
||||||
|
response_payload,
|
||||||
|
decision_note,
|
||||||
|
})
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| {
|
||||||
|
ApiError::conflict_with_context(
|
||||||
|
"approval request state changed before decision was recorded",
|
||||||
|
json!({
|
||||||
|
"approval_id": approval_id.as_str(),
|
||||||
|
"error_code": "approval_state_conflict"
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
|
||||||
|
Ok(safe_approval_record(decided))
|
||||||
}
|
}
|
||||||
|
|
||||||
async fn normalize_approval_record(
|
async fn normalize_approval_record(
|
||||||
@@ -149,13 +363,14 @@ impl AdminService {
|
|||||||
query: UsageRequestQuery,
|
query: UsageRequestQuery,
|
||||||
) -> Result<UsageOverviewResponse, ApiError> {
|
) -> Result<UsageOverviewResponse, ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
let (period, created_after, bucket) =
|
let (period, created_after, created_before, bucket) =
|
||||||
usage_window(query.period.unwrap_or(UsagePeriod::Last7Days))?;
|
resolve_usage_request_window(query.period.unwrap_or(UsagePeriod::Last7Days), &query)?;
|
||||||
let usage_query = UsageQuery {
|
let usage_query = UsageQuery {
|
||||||
workspace_id,
|
workspace_id,
|
||||||
period,
|
period,
|
||||||
source: query.source,
|
source: query.source,
|
||||||
created_after: &created_after,
|
created_after: &created_after,
|
||||||
|
created_before: &created_before,
|
||||||
bucket,
|
bucket,
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -168,16 +383,104 @@ impl AdminService {
|
|||||||
.registry
|
.registry
|
||||||
.list_usage_by_operation(usage_query.clone())
|
.list_usage_by_operation(usage_query.clone())
|
||||||
.await?;
|
.await?;
|
||||||
let agents = self.registry.list_usage_by_agent(usage_query).await?;
|
let agents = self
|
||||||
|
.registry
|
||||||
|
.list_usage_by_agent(usage_query.clone())
|
||||||
|
.await?;
|
||||||
|
let outcomes = self.registry.list_usage_outcomes(usage_query).await?;
|
||||||
|
|
||||||
Ok(UsageOverviewResponse {
|
Ok(UsageOverviewResponse {
|
||||||
summary,
|
summary,
|
||||||
timeline,
|
timeline,
|
||||||
operations,
|
operations,
|
||||||
agents,
|
agents,
|
||||||
|
outcomes,
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[instrument(skip(self))]
|
||||||
|
pub async fn export_usage_csv(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
query: UsageRequestQuery,
|
||||||
|
) -> Result<String, ApiError> {
|
||||||
|
let usage = self.get_usage_overview(workspace_id, query).await?;
|
||||||
|
let mut csv = String::from(
|
||||||
|
"kind,name,group,error_code,calls_total,calls_error,p50_ms,p95_ms,p99_ms\n",
|
||||||
|
);
|
||||||
|
for operation in usage.operations {
|
||||||
|
csv.push_str(
|
||||||
|
&[
|
||||||
|
"operation".to_owned(),
|
||||||
|
operation.operation_display_name,
|
||||||
|
String::new(),
|
||||||
|
String::new(),
|
||||||
|
operation.calls_total.to_string(),
|
||||||
|
operation.calls_error.to_string(),
|
||||||
|
operation.p50_ms.to_string(),
|
||||||
|
operation.p95_ms.to_string(),
|
||||||
|
operation.p99_ms.to_string(),
|
||||||
|
]
|
||||||
|
.into_iter()
|
||||||
|
.map(csv_cell)
|
||||||
|
.collect::<Vec<_>>()
|
||||||
|
.join(","),
|
||||||
|
);
|
||||||
|
csv.push('\n');
|
||||||
|
}
|
||||||
|
for agent in usage.agents {
|
||||||
|
csv.push_str(
|
||||||
|
&[
|
||||||
|
"agent".to_owned(),
|
||||||
|
agent.agent_display_name,
|
||||||
|
String::new(),
|
||||||
|
String::new(),
|
||||||
|
agent.calls_total.to_string(),
|
||||||
|
agent.calls_error.to_string(),
|
||||||
|
agent.p50_ms.to_string(),
|
||||||
|
agent.p95_ms.to_string(),
|
||||||
|
agent.p99_ms.to_string(),
|
||||||
|
]
|
||||||
|
.into_iter()
|
||||||
|
.map(csv_cell)
|
||||||
|
.collect::<Vec<_>>()
|
||||||
|
.join(","),
|
||||||
|
);
|
||||||
|
csv.push('\n');
|
||||||
|
}
|
||||||
|
for outcome in usage.outcomes {
|
||||||
|
csv.push_str(
|
||||||
|
&[
|
||||||
|
"outcome".to_owned(),
|
||||||
|
String::new(),
|
||||||
|
serialize_csv_text(outcome.group)?,
|
||||||
|
outcome
|
||||||
|
.execution_error_code
|
||||||
|
.map(serialize_csv_text)
|
||||||
|
.transpose()?
|
||||||
|
.unwrap_or_default(),
|
||||||
|
outcome.calls_total.to_string(),
|
||||||
|
String::new(),
|
||||||
|
outcome.p50_ms.to_string(),
|
||||||
|
outcome.p95_ms.to_string(),
|
||||||
|
outcome.p99_ms.to_string(),
|
||||||
|
]
|
||||||
|
.into_iter()
|
||||||
|
.map(csv_cell)
|
||||||
|
.collect::<Vec<_>>()
|
||||||
|
.join(","),
|
||||||
|
);
|
||||||
|
csv.push('\n');
|
||||||
|
}
|
||||||
|
if csv.len() > 1_048_576 {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"usage CSV export exceeded the bounded response size",
|
||||||
|
json!({ "error_code": "usage_csv_too_large" }),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Ok(csv)
|
||||||
|
}
|
||||||
|
|
||||||
#[instrument(skip(self))]
|
#[instrument(skip(self))]
|
||||||
pub async fn get_operation_usage(
|
pub async fn get_operation_usage(
|
||||||
&self,
|
&self,
|
||||||
@@ -186,8 +489,8 @@ impl AdminService {
|
|||||||
query: UsageRequestQuery,
|
query: UsageRequestQuery,
|
||||||
) -> Result<UsageRollupRecord, ApiError> {
|
) -> Result<UsageRollupRecord, ApiError> {
|
||||||
self.get_operation(workspace_id, operation_id).await?;
|
self.get_operation(workspace_id, operation_id).await?;
|
||||||
let (period, created_after, bucket) =
|
let (period, created_after, created_before, bucket) =
|
||||||
usage_window(query.period.unwrap_or(UsagePeriod::Last7Days))?;
|
resolve_usage_request_window(query.period.unwrap_or(UsagePeriod::Last7Days), &query)?;
|
||||||
|
|
||||||
self.registry
|
self.registry
|
||||||
.get_usage_for_operation(
|
.get_usage_for_operation(
|
||||||
@@ -196,6 +499,7 @@ impl AdminService {
|
|||||||
period,
|
period,
|
||||||
source: query.source,
|
source: query.source,
|
||||||
created_after: &created_after,
|
created_after: &created_after,
|
||||||
|
created_before: &created_before,
|
||||||
bucket,
|
bucket,
|
||||||
},
|
},
|
||||||
operation_id,
|
operation_id,
|
||||||
@@ -220,8 +524,8 @@ impl AdminService {
|
|||||||
query: UsageRequestQuery,
|
query: UsageRequestQuery,
|
||||||
) -> Result<UsageRollupRecord, ApiError> {
|
) -> Result<UsageRollupRecord, ApiError> {
|
||||||
self.get_agent(workspace_id, agent_id).await?;
|
self.get_agent(workspace_id, agent_id).await?;
|
||||||
let (period, created_after, bucket) =
|
let (period, created_after, created_before, bucket) =
|
||||||
usage_window(query.period.unwrap_or(UsagePeriod::Last7Days))?;
|
resolve_usage_request_window(query.period.unwrap_or(UsagePeriod::Last7Days), &query)?;
|
||||||
|
|
||||||
self.registry
|
self.registry
|
||||||
.get_usage_for_agent(
|
.get_usage_for_agent(
|
||||||
@@ -230,6 +534,7 @@ impl AdminService {
|
|||||||
period,
|
period,
|
||||||
source: query.source,
|
source: query.source,
|
||||||
created_after: &created_after,
|
created_after: &created_after,
|
||||||
|
created_before: &created_before,
|
||||||
bucket,
|
bucket,
|
||||||
},
|
},
|
||||||
agent_id,
|
agent_id,
|
||||||
@@ -243,3 +548,143 @@ impl AdminService {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn resolve_usage_window(
|
||||||
|
period: UsagePeriod,
|
||||||
|
query: &LogsQuery,
|
||||||
|
) -> Result<(UsagePeriod, String, String, crank_registry::UsageBucket), ApiError> {
|
||||||
|
resolve_explicit_or_period_window(
|
||||||
|
period,
|
||||||
|
query.created_after.as_deref(),
|
||||||
|
query.created_before.as_deref(),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn resolve_usage_request_window(
|
||||||
|
period: UsagePeriod,
|
||||||
|
query: &UsageRequestQuery,
|
||||||
|
) -> Result<(UsagePeriod, String, String, crank_registry::UsageBucket), ApiError> {
|
||||||
|
resolve_explicit_or_period_window(
|
||||||
|
period,
|
||||||
|
query.created_after.as_deref(),
|
||||||
|
query.created_before.as_deref(),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn resolve_explicit_or_period_window(
|
||||||
|
period: UsagePeriod,
|
||||||
|
created_after: Option<&str>,
|
||||||
|
created_before: Option<&str>,
|
||||||
|
) -> Result<(UsagePeriod, String, String, crank_registry::UsageBucket), ApiError> {
|
||||||
|
match (created_after, created_before) {
|
||||||
|
(None, None) => usage_window(period),
|
||||||
|
(Some(_), None) | (None, Some(_)) => Err(invalid_usage_window(
|
||||||
|
"usage window requires both created_after and created_before",
|
||||||
|
)),
|
||||||
|
(Some(after), Some(before)) => {
|
||||||
|
let after = OffsetDateTime::parse(after, &Rfc3339)
|
||||||
|
.map_err(|_| invalid_usage_window("created_after must be RFC3339 UTC"))?;
|
||||||
|
let before = OffsetDateTime::parse(before, &Rfc3339)
|
||||||
|
.map_err(|_| invalid_usage_window("created_before must be RFC3339 UTC"))?;
|
||||||
|
if after >= before {
|
||||||
|
return Err(invalid_usage_window(
|
||||||
|
"created_after must be before created_before",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
let duration = before - after;
|
||||||
|
if duration > time::Duration::days(MAX_EXPLICIT_USAGE_WINDOW_DAYS) {
|
||||||
|
return Err(invalid_usage_window("usage window exceeds maximum range"));
|
||||||
|
}
|
||||||
|
let bucket = if duration <= time::Duration::days(1) {
|
||||||
|
crank_registry::UsageBucket::Hour
|
||||||
|
} else if duration <= time::Duration::days(14) {
|
||||||
|
crank_registry::UsageBucket::Day
|
||||||
|
} else if duration <= time::Duration::days(45) {
|
||||||
|
crank_registry::UsageBucket::Week
|
||||||
|
} else {
|
||||||
|
crank_registry::UsageBucket::Month
|
||||||
|
};
|
||||||
|
Ok((
|
||||||
|
period,
|
||||||
|
after
|
||||||
|
.format(&Rfc3339)
|
||||||
|
.map_err(|error| ApiError::internal(error.to_string()))?,
|
||||||
|
before
|
||||||
|
.format(&Rfc3339)
|
||||||
|
.map_err(|error| ApiError::internal(error.to_string()))?,
|
||||||
|
bucket,
|
||||||
|
))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn invalid_usage_window(message: &'static str) -> ApiError {
|
||||||
|
ApiError::unprocessable_with_context(message, json!({ "error_code": "usage_window_invalid" }))
|
||||||
|
}
|
||||||
|
|
||||||
|
fn decode_logs_cursor(
|
||||||
|
cursor: Option<&str>,
|
||||||
|
) -> Result<(Option<String>, Option<InvocationLogId>), ApiError> {
|
||||||
|
let Some(cursor) = cursor else {
|
||||||
|
return Ok((None, None));
|
||||||
|
};
|
||||||
|
if cursor.len() > 512 {
|
||||||
|
return Err(invalid_logs_cursor());
|
||||||
|
}
|
||||||
|
let bytes = URL_SAFE_NO_PAD
|
||||||
|
.decode(cursor)
|
||||||
|
.map_err(|_| invalid_logs_cursor())?;
|
||||||
|
let decoded: LogsCursor = serde_json::from_slice(&bytes).map_err(|_| invalid_logs_cursor())?;
|
||||||
|
OffsetDateTime::parse(&decoded.created_at, &Rfc3339).map_err(|_| invalid_logs_cursor())?;
|
||||||
|
if decoded.id.is_empty()
|
||||||
|
|| decoded.id.len() > 128
|
||||||
|
|| decoded.id.contains(';')
|
||||||
|
|| decoded.id.contains(',')
|
||||||
|
{
|
||||||
|
return Err(invalid_logs_cursor());
|
||||||
|
}
|
||||||
|
Ok((
|
||||||
|
Some(decoded.created_at),
|
||||||
|
Some(InvocationLogId::new(decoded.id)),
|
||||||
|
))
|
||||||
|
}
|
||||||
|
|
||||||
|
fn encode_logs_cursor(record: &InvocationLogRecord) -> Result<String, ApiError> {
|
||||||
|
let cursor = LogsCursor {
|
||||||
|
created_at: record
|
||||||
|
.log
|
||||||
|
.created_at
|
||||||
|
.format(&Rfc3339)
|
||||||
|
.map_err(|error| ApiError::internal(error.to_string()))?,
|
||||||
|
id: record.log.id.as_str().to_owned(),
|
||||||
|
};
|
||||||
|
let encoded =
|
||||||
|
serde_json::to_vec(&cursor).map_err(|error| ApiError::internal(error.to_string()))?;
|
||||||
|
Ok(URL_SAFE_NO_PAD.encode(encoded))
|
||||||
|
}
|
||||||
|
|
||||||
|
fn invalid_logs_cursor() -> ApiError {
|
||||||
|
ApiError::unprocessable_with_context(
|
||||||
|
"logs cursor is invalid",
|
||||||
|
json!({ "error_code": "logs_cursor_invalid" }),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn serialize_csv_text<T: serde::Serialize>(value: T) -> Result<String, ApiError> {
|
||||||
|
serde_json::to_value(value)
|
||||||
|
.map_err(|error| ApiError::internal(error.to_string()))?
|
||||||
|
.as_str()
|
||||||
|
.map(ToOwned::to_owned)
|
||||||
|
.ok_or_else(|| ApiError::internal("failed to serialize CSV enum value"))
|
||||||
|
}
|
||||||
|
|
||||||
|
fn csv_cell(mut value: String) -> String {
|
||||||
|
if value
|
||||||
|
.chars()
|
||||||
|
.next()
|
||||||
|
.is_some_and(|ch| matches!(ch, '=' | '+' | '-' | '@' | '\t' | '\r' | '\n'))
|
||||||
|
{
|
||||||
|
value.insert(0, '\'');
|
||||||
|
}
|
||||||
|
format!("\"{}\"", value.replace('"', "\"\""))
|
||||||
|
}
|
||||||
|
|||||||
@@ -0,0 +1,268 @@
|
|||||||
|
use crank_core::{
|
||||||
|
OnboardingProjection, OnboardingStepId, ProductEventId, ProductEventKind, WorkspaceId,
|
||||||
|
};
|
||||||
|
use crank_registry::{
|
||||||
|
OnboardingPresentationMilestone, RecordOnboardingMilestoneRequest, RegistryError,
|
||||||
|
};
|
||||||
|
use serde_json::json;
|
||||||
|
use time::OffsetDateTime;
|
||||||
|
|
||||||
|
use crate::{
|
||||||
|
error::ApiError,
|
||||||
|
service::{
|
||||||
|
AdminService, OnboardingEventPayload, OnboardingEventResponse, OnboardingFirstCallEvidence,
|
||||||
|
OnboardingResponse, OnboardingStepView, ResetOnboardingSelectionResponse, format_timestamp,
|
||||||
|
new_prefixed_id,
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
impl AdminService {
|
||||||
|
pub async fn get_onboarding(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
) -> Result<OnboardingResponse, ApiError> {
|
||||||
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
|
let projection = self
|
||||||
|
.registry
|
||||||
|
.ensure_onboarding_eligibility(workspace_id, OffsetDateTime::now_utc())
|
||||||
|
.await?;
|
||||||
|
self.map_onboarding_response(projection).await
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn record_onboarding_event(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
payload: OnboardingEventPayload,
|
||||||
|
) -> Result<OnboardingEventResponse, ApiError> {
|
||||||
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
|
if payload.completed_steps.is_some() || payload.event == "completed" {
|
||||||
|
return Err(onboarding_event_not_allowed());
|
||||||
|
}
|
||||||
|
if payload.idempotency_key.is_empty() || payload.idempotency_key.len() > 256 {
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"idempotency_key must contain 1..256 bytes",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
if payload.idempotency_key.starts_with("onboarding:") {
|
||||||
|
return Err(onboarding_event_not_allowed());
|
||||||
|
}
|
||||||
|
let (milestone, event_kind) = match payload.event.as_str() {
|
||||||
|
"started" => (
|
||||||
|
OnboardingPresentationMilestone::Started,
|
||||||
|
ProductEventKind::OnboardingStarted,
|
||||||
|
),
|
||||||
|
"resumed" => (
|
||||||
|
OnboardingPresentationMilestone::Resumed,
|
||||||
|
ProductEventKind::OnboardingResumed,
|
||||||
|
),
|
||||||
|
"dismissed" => (
|
||||||
|
OnboardingPresentationMilestone::Dismissed,
|
||||||
|
ProductEventKind::OnboardingDismissed,
|
||||||
|
),
|
||||||
|
"abandoned" => (
|
||||||
|
OnboardingPresentationMilestone::Abandoned,
|
||||||
|
ProductEventKind::OnboardingAbandoned,
|
||||||
|
),
|
||||||
|
_ => return Err(onboarding_event_not_allowed()),
|
||||||
|
};
|
||||||
|
// Presentation events must never exist outside the server-owned cohort,
|
||||||
|
// including a direct API call before the first UI snapshot GET.
|
||||||
|
let current = self
|
||||||
|
.registry
|
||||||
|
.ensure_onboarding_eligibility(workspace_id, OffsetDateTime::now_utc())
|
||||||
|
.await?;
|
||||||
|
let outcome = self
|
||||||
|
.registry
|
||||||
|
.record_onboarding_milestone(RecordOnboardingMilestoneRequest {
|
||||||
|
workspace_id,
|
||||||
|
event_id: &ProductEventId::new(new_prefixed_id("pe")),
|
||||||
|
milestone,
|
||||||
|
idempotency_key: &payload.idempotency_key,
|
||||||
|
expected_revision: payload.expected_revision,
|
||||||
|
occurred_at: OffsetDateTime::now_utc(),
|
||||||
|
eligible_since: None,
|
||||||
|
})
|
||||||
|
.await;
|
||||||
|
let outcome = match outcome {
|
||||||
|
Ok(outcome) => outcome,
|
||||||
|
Err(RegistryError::OnboardingStaleRevision) => {
|
||||||
|
let replay = self
|
||||||
|
.registry
|
||||||
|
.get_product_event_by_idempotency_key(workspace_id, &payload.idempotency_key)
|
||||||
|
.await?;
|
||||||
|
if replay
|
||||||
|
.as_ref()
|
||||||
|
.is_some_and(|record| record.event.kind == event_kind)
|
||||||
|
{
|
||||||
|
return Ok(OnboardingEventResponse {
|
||||||
|
accepted: false,
|
||||||
|
onboarding: self.map_onboarding_response(current).await?,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
if replay.is_some() {
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"idempotency key was already used for another onboarding event",
|
||||||
|
json!({"error_code":"onboarding_idempotency_conflict","recovery":"use_original_event"}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"onboarding state changed; reload before retrying",
|
||||||
|
json!({"error_code":"onboarding_stale_revision","recovery":"reload"}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Err(RegistryError::InvalidExecutionRecord {
|
||||||
|
field: "product_event.idempotency_conflict",
|
||||||
|
}) => {
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"idempotency key was already used for another onboarding event",
|
||||||
|
json!({"error_code":"onboarding_idempotency_conflict","recovery":"use_original_event"}),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
Err(other) => return Err(other.into()),
|
||||||
|
};
|
||||||
|
Ok(OnboardingEventResponse {
|
||||||
|
accepted: outcome.accepted,
|
||||||
|
onboarding: self.map_onboarding_response(outcome.projection).await?,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn reset_onboarding_selection(
|
||||||
|
&self,
|
||||||
|
workspace_id: &WorkspaceId,
|
||||||
|
expected_revision: i64,
|
||||||
|
) -> Result<ResetOnboardingSelectionResponse, ApiError> {
|
||||||
|
self.ensure_workspace_exists(workspace_id).await?;
|
||||||
|
let projection = self
|
||||||
|
.registry
|
||||||
|
.reset_onboarding_selection(workspace_id, expected_revision, OffsetDateTime::now_utc())
|
||||||
|
.await
|
||||||
|
.map_err(|error| match error {
|
||||||
|
RegistryError::OnboardingStaleRevision => ApiError::conflict_with_context(
|
||||||
|
"onboarding state changed; reload before resetting the selection",
|
||||||
|
json!({"error_code":"onboarding_stale_revision","recovery":"reload"}),
|
||||||
|
),
|
||||||
|
other => ApiError::from(other),
|
||||||
|
})?;
|
||||||
|
Ok(ResetOnboardingSelectionResponse {
|
||||||
|
selection_reset: true,
|
||||||
|
onboarding: self.map_onboarding_response(projection).await?,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn map_onboarding_response(
|
||||||
|
&self,
|
||||||
|
projection: OnboardingProjection,
|
||||||
|
) -> Result<OnboardingResponse, ApiError> {
|
||||||
|
let endpoint = if let Some(agent_id) = projection.agent_id.as_ref() {
|
||||||
|
let workspace = self.get_workspace(&projection.workspace_id).await?;
|
||||||
|
let agent = self
|
||||||
|
.registry
|
||||||
|
.get_agent_summary(&projection.workspace_id, agent_id)
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| ApiError::internal("onboarding agent disappeared"))?;
|
||||||
|
Some(self.public_agent_mcp_endpoint(&workspace.workspace.slug, &agent.slug))
|
||||||
|
} else {
|
||||||
|
None
|
||||||
|
};
|
||||||
|
let first_call = match (
|
||||||
|
projection.first_call_log_id.as_ref(),
|
||||||
|
projection.agent_id.as_ref(),
|
||||||
|
projection.platform_api_key_id.as_ref(),
|
||||||
|
projection.operation_id.as_ref(),
|
||||||
|
projection.operation_version,
|
||||||
|
projection.first_call_tool_name.as_ref(),
|
||||||
|
projection.first_call_at,
|
||||||
|
) {
|
||||||
|
(
|
||||||
|
Some(log_id),
|
||||||
|
Some(agent_id),
|
||||||
|
Some(key_id),
|
||||||
|
Some(operation_id),
|
||||||
|
Some(operation_version),
|
||||||
|
Some(tool_name),
|
||||||
|
Some(occurred_at),
|
||||||
|
) => Some(OnboardingFirstCallEvidence {
|
||||||
|
log_id: log_id.as_str().to_owned(),
|
||||||
|
agent_id: agent_id.as_str().to_owned(),
|
||||||
|
key_id: key_id.as_str().to_owned(),
|
||||||
|
operation_id: operation_id.as_str().to_owned(),
|
||||||
|
operation_version,
|
||||||
|
tool_name: tool_name.clone(),
|
||||||
|
occurred_at: format_timestamp(occurred_at),
|
||||||
|
request_id: projection.first_call_request_id.clone(),
|
||||||
|
trace_id: projection.first_call_trace_id.clone(),
|
||||||
|
}),
|
||||||
|
_ => None,
|
||||||
|
};
|
||||||
|
let first_incomplete = projection.steps.iter().position(|step| !step.completed);
|
||||||
|
Ok(OnboardingResponse {
|
||||||
|
schema_version: 1,
|
||||||
|
workspace_id: projection.workspace_id.as_str().to_owned(),
|
||||||
|
revision: projection.revision,
|
||||||
|
status: if projection.completed {
|
||||||
|
"complete".to_owned()
|
||||||
|
} else {
|
||||||
|
"in_progress".to_owned()
|
||||||
|
},
|
||||||
|
completed: projection.completed,
|
||||||
|
eligible_since: projection.eligible_since.map(format_timestamp),
|
||||||
|
steps: projection
|
||||||
|
.steps
|
||||||
|
.iter()
|
||||||
|
.enumerate()
|
||||||
|
.map(|(index, step)| {
|
||||||
|
let status = if step.completed {
|
||||||
|
"complete"
|
||||||
|
} else if projection.was_completed {
|
||||||
|
"regressed"
|
||||||
|
} else if Some(index) == first_incomplete {
|
||||||
|
"current"
|
||||||
|
} else {
|
||||||
|
"pending"
|
||||||
|
};
|
||||||
|
let reason_code = match status {
|
||||||
|
"complete" => "authoritative_evidence_present",
|
||||||
|
"regressed" => "authoritative_evidence_regressed",
|
||||||
|
"current" => "authoritative_evidence_missing",
|
||||||
|
_ => "prerequisite_incomplete",
|
||||||
|
};
|
||||||
|
OnboardingStepView {
|
||||||
|
id: step.id,
|
||||||
|
completed: step.completed,
|
||||||
|
status: status.to_owned(),
|
||||||
|
action_code: action_code(step.id).to_owned(),
|
||||||
|
reason_code: reason_code.to_owned(),
|
||||||
|
}
|
||||||
|
})
|
||||||
|
.collect(),
|
||||||
|
operation_id: projection.operation_id.map(|id| id.as_str().to_owned()),
|
||||||
|
operation_version: projection.operation_version,
|
||||||
|
agent_id: projection.agent_id.map(|id| id.as_str().to_owned()),
|
||||||
|
catalog_revision: projection.catalog_revision,
|
||||||
|
platform_api_key_id: projection
|
||||||
|
.platform_api_key_id
|
||||||
|
.map(|id| id.as_str().to_owned()),
|
||||||
|
mcp_endpoint: endpoint,
|
||||||
|
first_call,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn action_code(step: OnboardingStepId) -> &'static str {
|
||||||
|
match step {
|
||||||
|
OnboardingStepId::Operation => "create_operation",
|
||||||
|
OnboardingStepId::Test => "test_operation",
|
||||||
|
OnboardingStepId::PublishOperation => "publish_operation",
|
||||||
|
OnboardingStepId::Agent => "publish_agent",
|
||||||
|
OnboardingStepId::Key => "create_mcp_key",
|
||||||
|
OnboardingStepId::McpConnection => "connect_mcp_client",
|
||||||
|
OnboardingStepId::FirstCall => "call_tool",
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn onboarding_event_not_allowed() -> ApiError {
|
||||||
|
ApiError::unprocessable_with_context(
|
||||||
|
"client cannot complete authoritative onboarding steps",
|
||||||
|
json!({"error_code":"onboarding_event_not_allowed"}),
|
||||||
|
)
|
||||||
|
}
|
||||||
@@ -1,14 +1,17 @@
|
|||||||
use crank_core::{
|
use crank_core::{
|
||||||
ConfigExport, ExecutionMode, ExportMode, InvocationLevel, InvocationSource, InvocationStatus,
|
ConfigExport, ExecutionMode, ExecutionOrigin, ExportMode, InvocationLevel, InvocationSource,
|
||||||
OperationId, OperationStatus, Samples, WorkspaceId,
|
InvocationStatus, OperationAvailability, OperationId, OperationStatus, OperationVersionState,
|
||||||
|
Samples, WorkspaceId,
|
||||||
};
|
};
|
||||||
use crank_registry::{
|
use crank_registry::{
|
||||||
CreateVersionRequest, OperationVersionRecord, PublishRequest, RegistryOperation,
|
CreateVersionRequest, OperationStateExpectation, OperationVersionRecord, PublishRequest,
|
||||||
|
RegistryOperation,
|
||||||
};
|
};
|
||||||
use crank_runtime::{
|
use crank_runtime::{
|
||||||
RuntimeError, RuntimeExecutionRequest, RuntimeOperation, RuntimeRequestContext,
|
ExecutionAuthorization, RuntimeExecutionRequest, RuntimeOperation, RuntimeRequestContext,
|
||||||
};
|
};
|
||||||
use serde_json::{Value, json};
|
use serde_json::{Value, json};
|
||||||
|
use sha2::{Digest, Sha256};
|
||||||
use time::OffsetDateTime;
|
use time::OffsetDateTime;
|
||||||
use tracing::{info, instrument};
|
use tracing::{info, instrument};
|
||||||
|
|
||||||
@@ -18,13 +21,33 @@ use crate::{
|
|||||||
AdminService, CreatedOperationResponse, InvocationRecordRequest, NewVersionPayload,
|
AdminService, CreatedOperationResponse, InvocationRecordRequest, NewVersionPayload,
|
||||||
OperationDetailView, OperationMutationResult, OperationPayload, OperationSummaryView,
|
OperationDetailView, OperationMutationResult, OperationPayload, OperationSummaryView,
|
||||||
PublishResponse, TestRunPayload, TestRunResult, UpdateOperationPayload, VersionRef,
|
PublishResponse, TestRunPayload, TestRunResult, UpdateOperationPayload, VersionRef,
|
||||||
agent_ref_map, build_request_preview, default_usage_summary, enrich_operation_summary,
|
agent_ref_map, default_usage_summary, enrich_operation_summary, format_timestamp,
|
||||||
format_timestamp, new_prefixed_id, now_string, runtime_error_code, today_start_utc,
|
new_prefixed_id, now_string, today_start_utc, tool_quality_mapping_set,
|
||||||
tool_quality_mapping_set, tool_quality_schema_node, usage_map,
|
tool_quality_schema_node, usage_map,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
impl AdminService {
|
impl AdminService {
|
||||||
|
pub fn operation_state_etag(detail: &OperationDetailView) -> String {
|
||||||
|
let material = format!(
|
||||||
|
"operation-state-v2\0{}\0{}\0{}\0{:?}\0{:?}",
|
||||||
|
detail.workspace_id,
|
||||||
|
detail.id,
|
||||||
|
detail.current_draft_version,
|
||||||
|
detail.status,
|
||||||
|
detail.latest_published_version
|
||||||
|
);
|
||||||
|
format!("\"{:x}\"", Sha256::digest(material.as_bytes()))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn operation_version_etag(record: &OperationVersionRecord) -> Result<String, ApiError> {
|
||||||
|
let bytes = serde_json::to_vec(&record.snapshot)
|
||||||
|
.map_err(|_| ApiError::internal("operation version serialization failed"))?;
|
||||||
|
let mut digest = Sha256::new();
|
||||||
|
digest.update(b"operation-version-v2\0");
|
||||||
|
digest.update(bytes);
|
||||||
|
Ok(format!("\"{:x}\"", digest.finalize()))
|
||||||
|
}
|
||||||
pub async fn list_operations(
|
pub async fn list_operations(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
@@ -84,6 +107,11 @@ impl AdminService {
|
|||||||
let refs = agent_ref_map(agent_refs)
|
let refs = agent_ref_map(agent_refs)
|
||||||
.remove(operation_id.as_str())
|
.remove(operation_id.as_str())
|
||||||
.unwrap_or_default();
|
.unwrap_or_default();
|
||||||
|
let current_version = self
|
||||||
|
.registry
|
||||||
|
.get_operation_version(workspace_id, operation_id, summary.current_draft_version)
|
||||||
|
.await?
|
||||||
|
.ok_or_else(|| ApiError::internal("current operation version is unavailable"))?;
|
||||||
|
|
||||||
Ok(OperationDetailView {
|
Ok(OperationDetailView {
|
||||||
id: summary.id.as_str().to_owned(),
|
id: summary.id.as_str().to_owned(),
|
||||||
@@ -94,6 +122,11 @@ impl AdminService {
|
|||||||
protocol: summary.protocol,
|
protocol: summary.protocol,
|
||||||
security_level: summary.security_level,
|
security_level: summary.security_level,
|
||||||
status: summary.status,
|
status: summary.status,
|
||||||
|
availability: if summary.status == OperationStatus::Archived {
|
||||||
|
OperationAvailability::Archived
|
||||||
|
} else {
|
||||||
|
OperationAvailability::Active
|
||||||
|
},
|
||||||
current_draft_version: summary.current_draft_version,
|
current_draft_version: summary.current_draft_version,
|
||||||
latest_published_version: summary.latest_published_version,
|
latest_published_version: summary.latest_published_version,
|
||||||
created_at: format_timestamp(summary.created_at),
|
created_at: format_timestamp(summary.created_at),
|
||||||
@@ -101,11 +134,15 @@ impl AdminService {
|
|||||||
published_at: summary.published_at.map(format_timestamp),
|
published_at: summary.published_at.map(format_timestamp),
|
||||||
draft_version_ref: VersionRef {
|
draft_version_ref: VersionRef {
|
||||||
version: summary.current_draft_version,
|
version: summary.current_draft_version,
|
||||||
status: summary.status,
|
status: if current_version.status == OperationStatus::Published {
|
||||||
|
OperationVersionState::Published
|
||||||
|
} else {
|
||||||
|
OperationVersionState::Draft
|
||||||
|
},
|
||||||
},
|
},
|
||||||
published_version_ref: summary.latest_published_version.map(|version| VersionRef {
|
published_version_ref: summary.latest_published_version.map(|version| VersionRef {
|
||||||
version,
|
version,
|
||||||
status: OperationStatus::Published,
|
status: OperationVersionState::Published,
|
||||||
}),
|
}),
|
||||||
agent_refs: refs,
|
agent_refs: refs,
|
||||||
})
|
})
|
||||||
@@ -155,6 +192,8 @@ impl AdminService {
|
|||||||
}
|
}
|
||||||
|
|
||||||
let snapshot = self.new_operation_snapshot(payload)?;
|
let snapshot = self.new_operation_snapshot(payload)?;
|
||||||
|
self.validate_registry_operation_in_workspace(workspace_id, &snapshot)
|
||||||
|
.await?;
|
||||||
let operation_id = snapshot.id.clone();
|
let operation_id = snapshot.id.clone();
|
||||||
|
|
||||||
self.registry
|
self.registry
|
||||||
@@ -240,6 +279,7 @@ impl AdminService {
|
|||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
operation_id: &OperationId,
|
operation_id: &OperationId,
|
||||||
payload: NewVersionPayload,
|
payload: NewVersionPayload,
|
||||||
|
expected_state: &OperationStateExpectation,
|
||||||
) -> Result<CreatedOperationResponse, ApiError> {
|
) -> Result<CreatedOperationResponse, ApiError> {
|
||||||
self.validate_operation_payload(&payload.operation)?;
|
self.validate_operation_payload(&payload.operation)?;
|
||||||
|
|
||||||
@@ -254,7 +294,27 @@ impl AdminService {
|
|||||||
)
|
)
|
||||||
})?;
|
})?;
|
||||||
let now = OffsetDateTime::now_utc();
|
let now = OffsetDateTime::now_utc();
|
||||||
let version = summary.current_draft_version + 1;
|
if summary.current_draft_version != expected_state.current_draft_version
|
||||||
|
|| summary.status != expected_state.status
|
||||||
|
|| summary.latest_published_version != expected_state.latest_published_version
|
||||||
|
{
|
||||||
|
return Err(crank_registry::RegistryError::OperationStaleVersion {
|
||||||
|
operation_id: operation_id.as_str().to_owned(),
|
||||||
|
expected: expected_state.current_draft_version,
|
||||||
|
actual: summary.current_draft_version,
|
||||||
|
}
|
||||||
|
.into());
|
||||||
|
}
|
||||||
|
let version = summary
|
||||||
|
.current_draft_version
|
||||||
|
.checked_add(1)
|
||||||
|
.filter(|value| i32::try_from(*value).is_ok())
|
||||||
|
.ok_or_else(|| {
|
||||||
|
ApiError::conflict_with_context(
|
||||||
|
"operation revision limit reached",
|
||||||
|
json!({ "error_code": "operation_revision_exhausted" }),
|
||||||
|
)
|
||||||
|
})?;
|
||||||
let snapshot = RegistryOperation {
|
let snapshot = RegistryOperation {
|
||||||
id: operation_id.clone(),
|
id: operation_id.clone(),
|
||||||
name: payload.operation.name,
|
name: payload.operation.name,
|
||||||
@@ -283,13 +343,19 @@ impl AdminService {
|
|||||||
published_at: None,
|
published_at: None,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
self.validate_registry_operation_in_workspace(workspace_id, &snapshot)
|
||||||
|
.await?;
|
||||||
|
|
||||||
self.registry
|
self.registry
|
||||||
.create_version(CreateVersionRequest {
|
.create_version_cas(
|
||||||
workspace_id,
|
CreateVersionRequest {
|
||||||
snapshot: &snapshot,
|
workspace_id,
|
||||||
change_note: payload.change_note.as_deref(),
|
snapshot: &snapshot,
|
||||||
created_by: None,
|
change_note: payload.change_note.as_deref(),
|
||||||
})
|
created_by: None,
|
||||||
|
},
|
||||||
|
expected_state,
|
||||||
|
)
|
||||||
.await?;
|
.await?;
|
||||||
info!(
|
info!(
|
||||||
name: "admin.operation.version_created",
|
name: "admin.operation.version_created",
|
||||||
@@ -313,21 +379,20 @@ impl AdminService {
|
|||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
operation_id: &OperationId,
|
operation_id: &OperationId,
|
||||||
payload: UpdateOperationPayload,
|
payload: UpdateOperationPayload,
|
||||||
|
expected_state: &OperationStateExpectation,
|
||||||
) -> Result<OperationMutationResult, ApiError> {
|
) -> Result<OperationMutationResult, ApiError> {
|
||||||
let existing = self
|
let existing = self
|
||||||
.get_operation_version(
|
.get_operation_version(
|
||||||
workspace_id,
|
workspace_id,
|
||||||
operation_id,
|
operation_id,
|
||||||
self.get_operation(workspace_id, operation_id)
|
expected_state.current_draft_version,
|
||||||
.await?
|
|
||||||
.current_draft_version,
|
|
||||||
)
|
)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
let updated_at = OffsetDateTime::now_utc();
|
let updated_at = OffsetDateTime::now_utc();
|
||||||
let snapshot = RegistryOperation {
|
let snapshot = RegistryOperation {
|
||||||
id: operation_id.clone(),
|
id: operation_id.clone(),
|
||||||
name: existing.snapshot.name,
|
name: existing.snapshot.name.clone(),
|
||||||
display_name: payload.display_name,
|
display_name: payload.display_name,
|
||||||
category: payload.category,
|
category: payload.category,
|
||||||
protocol: existing.snapshot.protocol,
|
protocol: existing.snapshot.protocol,
|
||||||
@@ -341,24 +406,39 @@ impl AdminService {
|
|||||||
output_mapping: payload.output_mapping,
|
output_mapping: payload.output_mapping,
|
||||||
execution_config: payload.execution_config,
|
execution_config: payload.execution_config,
|
||||||
tool_description: payload.tool_description,
|
tool_description: payload.tool_description,
|
||||||
samples: existing.snapshot.samples,
|
samples: existing.snapshot.samples.clone(),
|
||||||
generated_draft: existing.snapshot.generated_draft,
|
generated_draft: existing.snapshot.generated_draft.clone(),
|
||||||
config_export: existing.snapshot.config_export,
|
config_export: existing.snapshot.config_export.clone(),
|
||||||
wizard_state: payload.wizard_state,
|
wizard_state: payload.wizard_state,
|
||||||
created_at: existing.snapshot.created_at,
|
created_at: existing.snapshot.created_at,
|
||||||
updated_at,
|
updated_at,
|
||||||
published_at: existing.snapshot.published_at,
|
published_at: existing.snapshot.published_at,
|
||||||
};
|
};
|
||||||
|
|
||||||
self.validate_registry_operation(&snapshot)?;
|
self.validate_registry_operation_in_workspace(workspace_id, &snapshot)
|
||||||
|
.await?;
|
||||||
|
if existing.snapshot.portable_semantically_eq(&snapshot)
|
||||||
|
&& existing.snapshot.wizard_state == snapshot.wizard_state
|
||||||
|
{
|
||||||
|
self.registry
|
||||||
|
.verify_operation_state(workspace_id, operation_id, expected_state)
|
||||||
|
.await?;
|
||||||
|
return Ok(OperationMutationResult {
|
||||||
|
operation_id: operation_id.as_str().to_owned(),
|
||||||
|
workspace_id: workspace_id.as_str().to_owned(),
|
||||||
|
version: existing.version,
|
||||||
|
status: existing.status,
|
||||||
|
updated_at: format_timestamp(existing.snapshot.updated_at),
|
||||||
|
});
|
||||||
|
}
|
||||||
self.registry
|
self.registry
|
||||||
.update_operation_draft(workspace_id, &snapshot)
|
.update_operation_draft_cas(workspace_id, &snapshot, expected_state)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
Ok(OperationMutationResult {
|
Ok(OperationMutationResult {
|
||||||
operation_id: operation_id.as_str().to_owned(),
|
operation_id: operation_id.as_str().to_owned(),
|
||||||
workspace_id: workspace_id.as_str().to_owned(),
|
workspace_id: workspace_id.as_str().to_owned(),
|
||||||
version: snapshot.version,
|
version: snapshot.version.saturating_add(1),
|
||||||
status: snapshot.status,
|
status: snapshot.status,
|
||||||
updated_at: format_timestamp(updated_at),
|
updated_at: format_timestamp(updated_at),
|
||||||
})
|
})
|
||||||
@@ -370,16 +450,56 @@ impl AdminService {
|
|||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
operation_id: &OperationId,
|
operation_id: &OperationId,
|
||||||
version: u32,
|
version: u32,
|
||||||
|
expected_state: &OperationStateExpectation,
|
||||||
) -> Result<PublishResponse, ApiError> {
|
) -> Result<PublishResponse, ApiError> {
|
||||||
|
let record = self
|
||||||
|
.get_operation_version(workspace_id, operation_id, version)
|
||||||
|
.await?;
|
||||||
|
self.validate_registry_operation_in_workspace(workspace_id, &record.snapshot)
|
||||||
|
.await?;
|
||||||
|
let mut findings = crank_core::analyze_tool_identity_quality(
|
||||||
|
&record.snapshot.name,
|
||||||
|
&record.snapshot.tool_description,
|
||||||
|
)
|
||||||
|
.findings;
|
||||||
|
findings.extend(
|
||||||
|
crank_core::analyze_tool_schema_quality(
|
||||||
|
"input_schema",
|
||||||
|
&tool_quality_schema_node(&record.snapshot.input_schema),
|
||||||
|
)
|
||||||
|
.findings,
|
||||||
|
);
|
||||||
|
findings.extend(
|
||||||
|
crank_core::analyze_tool_response_projection_quality(&tool_quality_mapping_set(
|
||||||
|
&record.snapshot.output_mapping,
|
||||||
|
))
|
||||||
|
.findings,
|
||||||
|
);
|
||||||
|
let report = crank_core::ToolQualityReport::new(findings);
|
||||||
|
if report.blocking {
|
||||||
|
return Err(ApiError::unprocessable_with_context(
|
||||||
|
"operation publish is blocked by quality findings",
|
||||||
|
json!({
|
||||||
|
"error_code": "operation_publish_blocked",
|
||||||
|
"findings": report.findings
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
let published_at = OffsetDateTime::now_utc();
|
let published_at = OffsetDateTime::now_utc();
|
||||||
self.registry
|
self.registry
|
||||||
.publish_operation(PublishRequest {
|
.publish_operation_cas(
|
||||||
workspace_id,
|
PublishRequest {
|
||||||
operation_id,
|
workspace_id,
|
||||||
version,
|
operation_id,
|
||||||
published_at: &published_at,
|
version,
|
||||||
published_by: None,
|
published_at: &published_at,
|
||||||
})
|
published_by: None,
|
||||||
|
},
|
||||||
|
expected_state,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
let authoritative = self
|
||||||
|
.get_operation_version(workspace_id, operation_id, version)
|
||||||
.await?;
|
.await?;
|
||||||
info!(
|
info!(
|
||||||
name: "admin.operation.published",
|
name: "admin.operation.published",
|
||||||
@@ -392,7 +512,11 @@ impl AdminService {
|
|||||||
operation_id: operation_id.as_str().to_owned(),
|
operation_id: operation_id.as_str().to_owned(),
|
||||||
workspace_id: workspace_id.as_str().to_owned(),
|
workspace_id: workspace_id.as_str().to_owned(),
|
||||||
published_version: version,
|
published_version: version,
|
||||||
published_at: format_timestamp(published_at),
|
published_at: authoritative
|
||||||
|
.snapshot
|
||||||
|
.published_at
|
||||||
|
.map(format_timestamp)
|
||||||
|
.unwrap_or_else(|| format_timestamp(published_at)),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -401,19 +525,21 @@ impl AdminService {
|
|||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
operation_id: &OperationId,
|
operation_id: &OperationId,
|
||||||
|
expected_state: &OperationStateExpectation,
|
||||||
) -> Result<OperationMutationResult, ApiError> {
|
) -> Result<OperationMutationResult, ApiError> {
|
||||||
let summary = self.get_operation(workspace_id, operation_id).await?;
|
let summary = self.get_operation(workspace_id, operation_id).await?;
|
||||||
let updated_at = OffsetDateTime::now_utc();
|
let updated_at = OffsetDateTime::now_utc();
|
||||||
self.registry
|
self.registry
|
||||||
.archive_operation(workspace_id, operation_id, &updated_at)
|
.archive_operation_cas(workspace_id, operation_id, &updated_at, expected_state)
|
||||||
.await?;
|
.await?;
|
||||||
|
let authoritative = self.get_operation(workspace_id, operation_id).await?;
|
||||||
|
|
||||||
Ok(OperationMutationResult {
|
Ok(OperationMutationResult {
|
||||||
operation_id: operation_id.as_str().to_owned(),
|
operation_id: operation_id.as_str().to_owned(),
|
||||||
workspace_id: workspace_id.as_str().to_owned(),
|
workspace_id: workspace_id.as_str().to_owned(),
|
||||||
version: summary.current_draft_version,
|
version: summary.current_draft_version,
|
||||||
status: OperationStatus::Archived,
|
status: OperationStatus::Archived,
|
||||||
updated_at: format_timestamp(updated_at),
|
updated_at: authoritative.updated_at,
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -422,11 +548,12 @@ impl AdminService {
|
|||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
operation_id: &OperationId,
|
operation_id: &OperationId,
|
||||||
|
expected_state: &OperationStateExpectation,
|
||||||
) -> Result<OperationMutationResult, ApiError> {
|
) -> Result<OperationMutationResult, ApiError> {
|
||||||
let summary = self.get_operation(workspace_id, operation_id).await?;
|
let summary = self.get_operation(workspace_id, operation_id).await?;
|
||||||
let updated_at = now_string()?;
|
let updated_at = now_string()?;
|
||||||
self.registry
|
self.registry
|
||||||
.delete_operation(workspace_id, operation_id)
|
.delete_operation_cas(workspace_id, operation_id, expected_state)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
Ok(OperationMutationResult {
|
Ok(OperationMutationResult {
|
||||||
@@ -448,70 +575,77 @@ impl AdminService {
|
|||||||
) -> Result<TestRunResult, ApiError> {
|
) -> Result<TestRunResult, ApiError> {
|
||||||
let request_id = correlation.request_id().as_str();
|
let request_id = correlation.request_id().as_str();
|
||||||
let trace_id = correlation.trace_id().as_str();
|
let trace_id = correlation.trace_id().as_str();
|
||||||
let runtime_request_context = RuntimeRequestContext::from_correlation(correlation)
|
let mut runtime_request_context = RuntimeRequestContext::from_correlation(correlation)
|
||||||
.with_metering_context(workspace_id.clone(), None, InvocationSource::AdminTestRun);
|
.with_metering_context(workspace_id.clone(), None, InvocationSource::AdminTestRun);
|
||||||
|
if let Some(token) = payload.confirmation_token.as_deref() {
|
||||||
|
runtime_request_context = runtime_request_context.with_confirmation_token(token);
|
||||||
|
}
|
||||||
|
let locale = payload
|
||||||
|
.locale
|
||||||
|
.as_deref()
|
||||||
|
.filter(|value| {
|
||||||
|
value.eq_ignore_ascii_case("ru") || value.to_ascii_lowercase().starts_with("ru-")
|
||||||
|
})
|
||||||
|
.map_or(crank_core::ExecutionLocale::En, |_| {
|
||||||
|
crank_core::ExecutionLocale::Ru
|
||||||
|
});
|
||||||
let record = self
|
let record = self
|
||||||
.get_operation_version(workspace_id, operation_id, payload.version)
|
.get_operation_version(workspace_id, operation_id, payload.version)
|
||||||
.await?;
|
.await?;
|
||||||
|
let summary = self.get_operation(workspace_id, operation_id).await?;
|
||||||
|
if summary.status == OperationStatus::Archived
|
||||||
|
|| record.status != OperationStatus::Draft
|
||||||
|
|| summary.current_draft_version != payload.version
|
||||||
|
{
|
||||||
|
return Err(ApiError::conflict_with_context(
|
||||||
|
"only the current saved Draft can be tested",
|
||||||
|
json!({
|
||||||
|
"operation_id": operation_id.as_str(),
|
||||||
|
"current_version": summary.current_draft_version,
|
||||||
|
"tested_version": payload.version,
|
||||||
|
"error_code": "operation_invalid_transition"
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
}
|
||||||
let runtime = RuntimeOperation::from(record.snapshot.clone());
|
let runtime = RuntimeOperation::from(record.snapshot.clone());
|
||||||
let mode = ExecutionMode::Unary;
|
let mode = ExecutionMode::Unary;
|
||||||
let preview_span = crank_trace::Stage::RuntimeArgumentsMap.span();
|
|
||||||
let preview_result = preview_span
|
|
||||||
.in_scope(|| build_request_preview(&record.snapshot.input_mapping, &payload.input));
|
|
||||||
let request_preview = match preview_result {
|
|
||||||
Ok(preview) => preview,
|
|
||||||
Err(error) => {
|
|
||||||
crank_trace::StageOutcome::Error.record(&preview_span);
|
|
||||||
crank_trace::ErrorCategory::Mapping.record(&preview_span);
|
|
||||||
drop(preview_span);
|
|
||||||
self.record_invocation(InvocationRecordRequest {
|
|
||||||
workspace_id,
|
|
||||||
agent_id: None,
|
|
||||||
operation: &record.snapshot,
|
|
||||||
request_id: Some(request_id),
|
|
||||||
trace_id: Some(trace_id),
|
|
||||||
source: InvocationSource::AdminTestRun,
|
|
||||||
level: InvocationLevel::Error,
|
|
||||||
status: InvocationStatus::Error,
|
|
||||||
message: "mapping preview failed".to_owned(),
|
|
||||||
status_code: None,
|
|
||||||
error_kind: Some("mapping".to_owned()),
|
|
||||||
duration_ms: 0,
|
|
||||||
request_preview: Value::Null,
|
|
||||||
response_preview: Value::Null,
|
|
||||||
})
|
|
||||||
.await;
|
|
||||||
return Ok(TestRunResult {
|
|
||||||
ok: false,
|
|
||||||
mode,
|
|
||||||
request_preview: Value::Null,
|
|
||||||
response_preview: Value::Null,
|
|
||||||
errors: vec![crate::error::runtime_test_failure(&RuntimeError::Mapping(
|
|
||||||
error,
|
|
||||||
))],
|
|
||||||
});
|
|
||||||
}
|
|
||||||
};
|
|
||||||
crank_trace::StageOutcome::Success.record(&preview_span);
|
|
||||||
drop(preview_span);
|
|
||||||
|
|
||||||
let resolved_auth = self
|
let resolved_auth = self
|
||||||
.resolve_operation_auth(workspace_id, &runtime.execution_config)
|
.resolve_operation_auth(workspace_id, &runtime.execution_config, None)
|
||||||
.await;
|
.await;
|
||||||
let started_at = std::time::Instant::now();
|
let started_at = std::time::Instant::now();
|
||||||
match match resolved_auth {
|
let correlation = crank_core::CorrelationContext::new(
|
||||||
|
runtime_request_context.request_id.clone(),
|
||||||
|
runtime_request_context.trace_context.clone(),
|
||||||
|
);
|
||||||
|
let execution_result = match resolved_auth {
|
||||||
Ok(resolved_auth) => {
|
Ok(resolved_auth) => {
|
||||||
self.runtime
|
match RuntimeExecutionRequest::try_new(
|
||||||
.execute_request(
|
workspace_id,
|
||||||
RuntimeExecutionRequest::new(&runtime, &payload.input)
|
ExecutionOrigin::AdminDraft,
|
||||||
.with_optional_auth(resolved_auth.as_ref())
|
None,
|
||||||
.with_context(&runtime_request_context),
|
&runtime,
|
||||||
)
|
&payload.input,
|
||||||
.await
|
ExecutionAuthorization::Authorized,
|
||||||
|
resolved_auth.as_ref(),
|
||||||
|
&runtime_request_context,
|
||||||
|
std::time::Instant::now()
|
||||||
|
+ std::time::Duration::from_millis(
|
||||||
|
runtime.execution_config.timeout_ms.max(1),
|
||||||
|
),
|
||||||
|
) {
|
||||||
|
Ok(request) => self.runtime.execute_outcome(request).await,
|
||||||
|
Err(_) => Err(crank_core::ExecutionFailure::new(
|
||||||
|
crank_core::ExecutionErrorCode::RuntimeInternal,
|
||||||
|
correlation.clone(),
|
||||||
|
)),
|
||||||
|
}
|
||||||
}
|
}
|
||||||
Err(error) => Err(error),
|
Err(error) => Err(crank_runtime::normalize_runtime_error(&error, &correlation)),
|
||||||
} {
|
};
|
||||||
Ok(response_preview) => {
|
match execution_result {
|
||||||
|
Ok(success) => {
|
||||||
|
let response_preview = crank_core::sanitize_invocation_preview(&success.output);
|
||||||
|
let request_preview = success.request_preview;
|
||||||
let duration_ms =
|
let duration_ms =
|
||||||
u64::try_from(started_at.elapsed().as_millis()).unwrap_or(u64::MAX);
|
u64::try_from(started_at.elapsed().as_millis()).unwrap_or(u64::MAX);
|
||||||
self.record_invocation(InvocationRecordRequest {
|
self.record_invocation(InvocationRecordRequest {
|
||||||
@@ -526,6 +660,10 @@ impl AdminService {
|
|||||||
message: "admin test run completed".to_owned(),
|
message: "admin test run completed".to_owned(),
|
||||||
status_code: None,
|
status_code: None,
|
||||||
error_kind: None,
|
error_kind: None,
|
||||||
|
execution_stage: Some(crank_core::ExecutionStage::Runtime),
|
||||||
|
execution_error_code: None,
|
||||||
|
retryability: Some(crank_core::Retryability::Never),
|
||||||
|
outcome_certainty: Some(crank_core::OutcomeCertainty::Certain),
|
||||||
duration_ms,
|
duration_ms,
|
||||||
request_preview: request_preview.clone(),
|
request_preview: request_preview.clone(),
|
||||||
response_preview: response_preview.clone(),
|
response_preview: response_preview.clone(),
|
||||||
@@ -534,12 +672,15 @@ impl AdminService {
|
|||||||
Ok(TestRunResult {
|
Ok(TestRunResult {
|
||||||
ok: true,
|
ok: true,
|
||||||
mode,
|
mode,
|
||||||
|
tested_version: payload.version,
|
||||||
|
request_id: request_id.to_owned(),
|
||||||
|
trace_id: trace_id.to_owned(),
|
||||||
request_preview,
|
request_preview,
|
||||||
response_preview,
|
response_preview,
|
||||||
errors: Vec::new(),
|
errors: Vec::new(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
Err(error) => {
|
Err(failure) => {
|
||||||
let duration_ms =
|
let duration_ms =
|
||||||
u64::try_from(started_at.elapsed().as_millis()).unwrap_or(u64::MAX);
|
u64::try_from(started_at.elapsed().as_millis()).unwrap_or(u64::MAX);
|
||||||
self.record_invocation(InvocationRecordRequest {
|
self.record_invocation(InvocationRecordRequest {
|
||||||
@@ -551,20 +692,29 @@ impl AdminService {
|
|||||||
source: InvocationSource::AdminTestRun,
|
source: InvocationSource::AdminTestRun,
|
||||||
level: InvocationLevel::Error,
|
level: InvocationLevel::Error,
|
||||||
status: InvocationStatus::Error,
|
status: InvocationStatus::Error,
|
||||||
message: error.to_string(),
|
message: "runtime execution failed".to_owned(),
|
||||||
status_code: None,
|
status_code: failure.upstream_status(),
|
||||||
error_kind: Some(runtime_error_code(&error).to_owned()),
|
error_kind: Some(failure.error_code().as_str().to_owned()),
|
||||||
|
execution_stage: Some(failure.stage()),
|
||||||
|
execution_error_code: Some(failure.error_code()),
|
||||||
|
retryability: Some(failure.retryability()),
|
||||||
|
outcome_certainty: Some(failure.outcome_certainty()),
|
||||||
duration_ms,
|
duration_ms,
|
||||||
request_preview: request_preview.clone(),
|
request_preview: Value::Null,
|
||||||
response_preview: Value::Null,
|
response_preview: Value::Null,
|
||||||
})
|
})
|
||||||
.await;
|
.await;
|
||||||
Ok(TestRunResult {
|
Ok(TestRunResult {
|
||||||
ok: false,
|
ok: false,
|
||||||
mode,
|
mode,
|
||||||
request_preview,
|
tested_version: payload.version,
|
||||||
|
request_id: request_id.to_owned(),
|
||||||
|
trace_id: trace_id.to_owned(),
|
||||||
|
request_preview: Value::Null,
|
||||||
response_preview: Value::Null,
|
response_preview: Value::Null,
|
||||||
errors: vec![crate::error::runtime_test_failure(&error)],
|
errors: vec![crate::error::execution_test_failure_localized(
|
||||||
|
&failure, locale,
|
||||||
|
)],
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -12,7 +12,8 @@ use tracing::{info, instrument};
|
|||||||
use crate::{
|
use crate::{
|
||||||
error::ApiError,
|
error::ApiError,
|
||||||
service::{
|
service::{
|
||||||
AdminService, AuthProfilePayload, RotateSecretPayload, SecretPayload, new_prefixed_id,
|
AdminAuditContext, AdminService, AuthProfilePayload, CredentialAuditRecord,
|
||||||
|
RotateSecretPayload, SecretPayload, new_prefixed_id,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -57,15 +58,46 @@ impl AdminService {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str(), secret_name = %payload.name))]
|
#[instrument(skip(self, created_by, payload, audit_context), fields(workspace_id = %workspace_id.as_str(), secret_name = %payload.name))]
|
||||||
pub async fn create_secret(
|
pub async fn create_secret(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
created_by: Option<&UserId>,
|
created_by: Option<&UserId>,
|
||||||
payload: SecretPayload,
|
payload: SecretPayload,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<Secret, ApiError> {
|
) -> Result<Secret, ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
if let Err(error) = self.ensure_workspace_exists(workspace_id).await {
|
||||||
validate_secret_payload(&payload)?;
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
if let Err(error) = validate_secret_payload(&payload) {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
|
||||||
let now = OffsetDateTime::now_utc();
|
let now = OffsetDateTime::now_utc();
|
||||||
let secret = Secret {
|
let secret = Secret {
|
||||||
@@ -82,89 +114,322 @@ impl AdminService {
|
|||||||
let ciphertext = self
|
let ciphertext = self
|
||||||
.secret_crypto
|
.secret_crypto
|
||||||
.encrypt(&payload.value)
|
.encrypt(&payload.value)
|
||||||
.map_err(|error| ApiError::internal(error.to_string()))?;
|
.map_err(|error| ApiError::internal(error.to_string()));
|
||||||
|
let ciphertext = match ciphertext {
|
||||||
|
Ok(ciphertext) => ciphertext,
|
||||||
|
Err(error) => {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret.id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
self.registry
|
if let Err(error) = self
|
||||||
|
.registry
|
||||||
.create_secret(CreateSecretRequest {
|
.create_secret(CreateSecretRequest {
|
||||||
secret: &secret,
|
secret: &secret,
|
||||||
ciphertext: &ciphertext,
|
ciphertext: &ciphertext,
|
||||||
key_version: self.secret_crypto.key_version(),
|
key_version: self.secret_crypto.key_version(),
|
||||||
|
master_key_epoch: self.secret_crypto.master_key_epoch(),
|
||||||
created_by,
|
created_by,
|
||||||
})
|
})
|
||||||
.await?;
|
.await
|
||||||
|
{
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret.id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
info!(
|
info!(
|
||||||
name: "admin.secret.created",
|
name: "admin.secret.created",
|
||||||
secret_id = %secret.id.as_str(),
|
secret_id = %secret.id.as_str(),
|
||||||
"secret created"
|
"secret created"
|
||||||
);
|
);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.created",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret.id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "success",
|
||||||
|
reason: "credential_created",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
Ok(secret)
|
Ok(secret)
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str(), secret_id = %secret_id.as_str()))]
|
#[instrument(skip(self, created_by, payload, audit_context), fields(workspace_id = %workspace_id.as_str(), secret_id = %secret_id.as_str()))]
|
||||||
pub async fn rotate_secret(
|
pub async fn rotate_secret(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
secret_id: &SecretId,
|
secret_id: &SecretId,
|
||||||
created_by: Option<&UserId>,
|
created_by: Option<&UserId>,
|
||||||
payload: RotateSecretPayload,
|
payload: RotateSecretPayload,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<Secret, ApiError> {
|
) -> Result<Secret, ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
if let Err(error) = self.ensure_workspace_exists(workspace_id).await {
|
||||||
if payload.value.is_null() {
|
self.record_credential_audit(
|
||||||
return Err(ApiError::validation("secret value must not be null"));
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.rotate_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
let existing = match self.get_secret(workspace_id, secret_id).await {
|
||||||
|
Ok(secret) => secret,
|
||||||
|
Err(error) => {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.rotate_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
if let Err(error) = validate_secret_value(existing.kind, &payload.value) {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.rotate_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
}
|
}
|
||||||
|
|
||||||
let now = OffsetDateTime::now_utc();
|
let now = OffsetDateTime::now_utc();
|
||||||
let ciphertext = self
|
let ciphertext = self
|
||||||
.secret_crypto
|
.secret_crypto
|
||||||
.encrypt(&payload.value)
|
.encrypt(&payload.value)
|
||||||
.map_err(|error| ApiError::internal(error.to_string()))?;
|
.map_err(|error| ApiError::internal(error.to_string()));
|
||||||
self.registry
|
let ciphertext = match ciphertext {
|
||||||
|
Ok(ciphertext) => ciphertext,
|
||||||
|
Err(error) => {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.rotate_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
let version = match self
|
||||||
|
.registry
|
||||||
.rotate_secret(RotateSecretRequest {
|
.rotate_secret(RotateSecretRequest {
|
||||||
workspace_id,
|
workspace_id,
|
||||||
secret_id,
|
secret_id,
|
||||||
ciphertext: &ciphertext,
|
ciphertext: &ciphertext,
|
||||||
key_version: self.secret_crypto.key_version(),
|
key_version: self.secret_crypto.key_version(),
|
||||||
|
master_key_epoch: self.secret_crypto.master_key_epoch(),
|
||||||
created_at: &now,
|
created_at: &now,
|
||||||
updated_at: &now,
|
updated_at: &now,
|
||||||
created_by,
|
created_by,
|
||||||
})
|
})
|
||||||
.await?;
|
.await
|
||||||
|
{
|
||||||
|
Ok(version) => version,
|
||||||
|
Err(error) => {
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.rotate_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
info!(
|
info!(
|
||||||
name: "admin.secret.rotated",
|
name: "admin.secret.rotated",
|
||||||
secret_id = %secret_id.as_str(),
|
secret_id = %secret_id.as_str(),
|
||||||
"secret rotated"
|
"secret rotated"
|
||||||
);
|
);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.rotated",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "success",
|
||||||
|
reason: "credential_rotated",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
self.get_secret(workspace_id, secret_id).await
|
Ok(Secret {
|
||||||
|
current_version: version.secret_version.version,
|
||||||
|
updated_at: now,
|
||||||
|
..existing
|
||||||
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self), fields(workspace_id = %workspace_id.as_str(), secret_id = %secret_id.as_str()))]
|
#[instrument(skip(self, audit_context), fields(workspace_id = %workspace_id.as_str(), secret_id = %secret_id.as_str()))]
|
||||||
pub async fn delete_secret(
|
pub async fn delete_secret(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
secret_id: &SecretId,
|
secret_id: &SecretId,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<(), ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
if let Err(error) = self.ensure_workspace_exists(workspace_id).await {
|
||||||
if let Some(profile) = self
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.delete_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
let referencing_profiles = match self
|
||||||
.registry
|
.registry
|
||||||
.list_auth_profiles_referencing_secret(workspace_id, secret_id)
|
.list_auth_profiles_referencing_secret(workspace_id, secret_id)
|
||||||
.await?
|
.await
|
||||||
.into_iter()
|
|
||||||
.next()
|
|
||||||
{
|
{
|
||||||
|
Ok(profiles) => profiles,
|
||||||
|
Err(error) => {
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.delete_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
if let Some(profile) = referencing_profiles.into_iter().next() {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.delete_denied",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "denied",
|
||||||
|
reason: "secret_referenced_by_auth_profile",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
return Err(RegistryError::SecretReferencedByAuthProfile {
|
return Err(RegistryError::SecretReferencedByAuthProfile {
|
||||||
secret_id: secret_id.as_str().to_owned(),
|
secret_id: secret_id.as_str().to_owned(),
|
||||||
auth_profile_id: profile.id.as_str().to_owned(),
|
auth_profile_id: profile.id.as_str().to_owned(),
|
||||||
}
|
}
|
||||||
.into());
|
.into());
|
||||||
}
|
}
|
||||||
self.registry.delete_secret(workspace_id, secret_id).await?;
|
if let Err(error) = self.registry.delete_secret(workspace_id, secret_id).await {
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.delete_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
info!(
|
info!(
|
||||||
name: "admin.secret.deleted",
|
name: "admin.secret.deleted",
|
||||||
secret_id = %secret_id.as_str(),
|
secret_id = %secret_id.as_str(),
|
||||||
"secret deleted"
|
"secret deleted"
|
||||||
);
|
);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.secret.deleted",
|
||||||
|
target_kind: crank_core::AuditTargetKind::Secret,
|
||||||
|
workspace_id,
|
||||||
|
target_id: secret_id.as_str(),
|
||||||
|
credential_type: "secret",
|
||||||
|
outcome: "success",
|
||||||
|
reason: "credential_deleted",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -185,39 +450,118 @@ impl AdminService {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
#[instrument(skip(self, payload), fields(auth_profile_name = %payload.name, auth_kind = ?payload.kind))]
|
#[instrument(skip(self, payload, audit_context), fields(auth_profile_name = %payload.name, auth_kind = ?payload.kind))]
|
||||||
pub async fn create_auth_profile(
|
pub async fn create_auth_profile(
|
||||||
&self,
|
&self,
|
||||||
workspace_id: &WorkspaceId,
|
workspace_id: &WorkspaceId,
|
||||||
payload: AuthProfilePayload,
|
payload: AuthProfilePayload,
|
||||||
|
audit_context: Option<&AdminAuditContext>,
|
||||||
) -> Result<AuthProfile, ApiError> {
|
) -> Result<AuthProfile, ApiError> {
|
||||||
validate_auth_profile_kind(payload.kind, &payload.config)?;
|
if let Err(error) = validate_auth_profile_payload(&payload) {
|
||||||
self.ensure_workspace_exists(workspace_id).await?;
|
self.record_credential_audit(
|
||||||
self.validate_auth_profile_secret_ids(workspace_id, &payload.config)
|
audit_context,
|
||||||
.await?;
|
CredentialAuditRecord {
|
||||||
|
action: "credential.auth_profile.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::AuthProfile,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: "auth_profile",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
if let Err(error) = self.ensure_workspace_exists(workspace_id).await {
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.auth_profile.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::AuthProfile,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: "auth_profile",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
if let Err(error) = self
|
||||||
|
.validate_auth_profile_secret_ids(workspace_id, &payload.config)
|
||||||
|
.await
|
||||||
|
{
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.auth_profile.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::AuthProfile,
|
||||||
|
workspace_id,
|
||||||
|
target_id: "pending",
|
||||||
|
credential_type: "auth_profile",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
|
||||||
let now = OffsetDateTime::now_utc();
|
let now = OffsetDateTime::now_utc();
|
||||||
let profile = AuthProfile {
|
let profile = AuthProfile {
|
||||||
id: AuthProfileId::new(new_prefixed_id("auth")),
|
id: AuthProfileId::new(new_prefixed_id("auth")),
|
||||||
workspace_id: workspace_id.clone(),
|
workspace_id: workspace_id.clone(),
|
||||||
name: payload.name,
|
name: payload.name.trim().to_owned(),
|
||||||
kind: payload.kind,
|
kind: payload.kind,
|
||||||
config: payload.config,
|
config: payload.config,
|
||||||
created_at: now,
|
created_at: now,
|
||||||
updated_at: now,
|
updated_at: now,
|
||||||
};
|
};
|
||||||
|
|
||||||
self.registry
|
if let Err(error) = self
|
||||||
|
.registry
|
||||||
.save_auth_profile(SaveAuthProfileRequest {
|
.save_auth_profile(SaveAuthProfileRequest {
|
||||||
workspace_id,
|
workspace_id,
|
||||||
profile: &profile,
|
profile: &profile,
|
||||||
})
|
})
|
||||||
.await?;
|
.await
|
||||||
|
{
|
||||||
|
let error = ApiError::from(error);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.auth_profile.create_failed",
|
||||||
|
target_kind: crank_core::AuditTargetKind::AuthProfile,
|
||||||
|
workspace_id,
|
||||||
|
target_id: profile.id.as_str(),
|
||||||
|
credential_type: "auth_profile",
|
||||||
|
outcome: "failure",
|
||||||
|
reason: error.code(),
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
info!(
|
info!(
|
||||||
name: "admin.auth_profile.created",
|
name: "admin.auth_profile.created",
|
||||||
auth_profile_id = %profile.id.as_str(),
|
auth_profile_id = %profile.id.as_str(),
|
||||||
"auth profile created"
|
"auth profile created"
|
||||||
);
|
);
|
||||||
|
self.record_credential_audit(
|
||||||
|
audit_context,
|
||||||
|
CredentialAuditRecord {
|
||||||
|
action: "credential.auth_profile.created",
|
||||||
|
target_kind: crank_core::AuditTargetKind::AuthProfile,
|
||||||
|
workspace_id,
|
||||||
|
target_id: profile.id.as_str(),
|
||||||
|
credential_type: "auth_profile",
|
||||||
|
outcome: "success",
|
||||||
|
reason: "credential_created",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
Ok(profile)
|
Ok(profile)
|
||||||
}
|
}
|
||||||
@@ -228,13 +572,45 @@ impl AdminService {
|
|||||||
config: &AuthConfig,
|
config: &AuthConfig,
|
||||||
) -> Result<(), ApiError> {
|
) -> Result<(), ApiError> {
|
||||||
for secret_id in config.secret_ids() {
|
for secret_id in config.secret_ids() {
|
||||||
self.get_secret(workspace_id, secret_id).await?;
|
let secret = self.get_secret(workspace_id, secret_id).await?;
|
||||||
|
if secret.status != SecretStatus::Active {
|
||||||
|
return Err(RegistryError::SecretInactive {
|
||||||
|
secret_id: secret_id.as_str().to_owned(),
|
||||||
|
}
|
||||||
|
.into());
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn validate_auth_profile_payload(payload: &AuthProfilePayload) -> Result<(), ApiError> {
|
||||||
|
const MAX_PROFILE_NAME_CHARS: usize = 128;
|
||||||
|
|
||||||
|
let profile_name = payload.name.trim();
|
||||||
|
if profile_name.is_empty() || profile_name.chars().count() > MAX_PROFILE_NAME_CHARS {
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"auth profile name must contain 1 to 128 characters",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
if profile_name.chars().any(char::is_control) {
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"auth profile name contains unsupported characters",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
validate_auth_profile_kind(payload.kind, &payload.config)?;
|
||||||
|
match &payload.config {
|
||||||
|
AuthConfig::Bearer(config) => validate_auth_header_name(&config.header_name)?,
|
||||||
|
AuthConfig::Basic(_) => {}
|
||||||
|
AuthConfig::ApiKeyHeader(config) => validate_auth_header_name(&config.header_name)?,
|
||||||
|
AuthConfig::ApiKeyQuery(config) => validate_auth_query_name(&config.param_name)?,
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
fn validate_auth_profile_kind(kind: AuthKind, config: &AuthConfig) -> Result<(), ApiError> {
|
fn validate_auth_profile_kind(kind: AuthKind, config: &AuthConfig) -> Result<(), ApiError> {
|
||||||
let is_match = matches!(
|
let is_match = matches!(
|
||||||
(kind, config),
|
(kind, config),
|
||||||
@@ -252,13 +628,145 @@ fn validate_auth_profile_kind(kind: AuthKind, config: &AuthConfig) -> Result<(),
|
|||||||
}
|
}
|
||||||
|
|
||||||
fn validate_secret_payload(payload: &SecretPayload) -> Result<(), ApiError> {
|
fn validate_secret_payload(payload: &SecretPayload) -> Result<(), ApiError> {
|
||||||
if payload.name.trim().is_empty() {
|
const MAX_SECRET_NAME_CHARS: usize = 128;
|
||||||
return Err(ApiError::validation("secret name must not be empty"));
|
|
||||||
|
let name = payload.name.trim();
|
||||||
|
if name.is_empty() || name.chars().count() > MAX_SECRET_NAME_CHARS {
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"secret name must contain 1 to 128 characters",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
if name.chars().any(char::is_control) {
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"secret name contains unsupported characters",
|
||||||
|
));
|
||||||
}
|
}
|
||||||
|
|
||||||
if payload.value.is_null() {
|
validate_secret_value(payload.kind, &payload.value)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn validate_secret_value(
|
||||||
|
kind: crank_core::SecretKind,
|
||||||
|
value: &serde_json::Value,
|
||||||
|
) -> Result<(), ApiError> {
|
||||||
|
const MAX_SECRET_VALUE_BYTES: usize = 65_536;
|
||||||
|
const MAX_SECRET_STRING_BYTES: usize = 16_384;
|
||||||
|
|
||||||
|
if value.is_null() {
|
||||||
return Err(ApiError::validation("secret value must not be null"));
|
return Err(ApiError::validation("secret value must not be null"));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
let encoded = serde_json::to_vec(value)
|
||||||
|
.map_err(|_| ApiError::validation("secret value must be valid JSON"))?;
|
||||||
|
if encoded.len() > MAX_SECRET_VALUE_BYTES {
|
||||||
|
return Err(ApiError::validation("secret value is too large"));
|
||||||
|
}
|
||||||
|
|
||||||
|
match kind {
|
||||||
|
crank_core::SecretKind::Token | crank_core::SecretKind::Header => {
|
||||||
|
if value.is_string() {
|
||||||
|
validate_non_empty_secret_string(value, "secret value", MAX_SECRET_STRING_BYTES)?;
|
||||||
|
} else {
|
||||||
|
let object = value.as_object().ok_or_else(|| {
|
||||||
|
ApiError::validation(
|
||||||
|
"token/header secret must be a string or a single token/value field",
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
let field = object
|
||||||
|
.get("token")
|
||||||
|
.or_else(|| object.get("value"))
|
||||||
|
.filter(|_| object.len() == 1)
|
||||||
|
.ok_or_else(|| {
|
||||||
|
ApiError::validation("token/header secret must contain only token or value")
|
||||||
|
})?;
|
||||||
|
validate_non_empty_secret_string(field, "secret value", MAX_SECRET_STRING_BYTES)?;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
crank_core::SecretKind::UsernamePassword => {
|
||||||
|
let object = value.as_object().ok_or_else(|| {
|
||||||
|
ApiError::validation("username_password secret must contain username and password")
|
||||||
|
})?;
|
||||||
|
if object.len() != 2
|
||||||
|
|| !object.contains_key("username")
|
||||||
|
|| !object.contains_key("password")
|
||||||
|
{
|
||||||
|
return Err(ApiError::validation(
|
||||||
|
"username_password secret must contain only username and password",
|
||||||
|
));
|
||||||
|
}
|
||||||
|
validate_non_empty_secret_string(
|
||||||
|
&object["username"],
|
||||||
|
"secret username",
|
||||||
|
MAX_SECRET_STRING_BYTES,
|
||||||
|
)?;
|
||||||
|
validate_non_empty_secret_string(
|
||||||
|
&object["password"],
|
||||||
|
"secret password",
|
||||||
|
MAX_SECRET_STRING_BYTES,
|
||||||
|
)?;
|
||||||
|
}
|
||||||
|
crank_core::SecretKind::Generic => {}
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn validate_non_empty_secret_string(
|
||||||
|
value: &serde_json::Value,
|
||||||
|
field: &str,
|
||||||
|
max_bytes: usize,
|
||||||
|
) -> Result<(), ApiError> {
|
||||||
|
let value = value
|
||||||
|
.as_str()
|
||||||
|
.ok_or_else(|| ApiError::validation(format!("{field} must be a string")))?;
|
||||||
|
if value.is_empty() {
|
||||||
|
return Err(ApiError::validation(format!("{field} must not be empty")));
|
||||||
|
}
|
||||||
|
if value.len() > max_bytes {
|
||||||
|
return Err(ApiError::validation(format!("{field} is too large")));
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn validate_auth_header_name(value: &str) -> Result<(), ApiError> {
|
||||||
|
const MAX_HEADER_NAME_BYTES: usize = 128;
|
||||||
|
if value.is_empty()
|
||||||
|
|| value.len() > MAX_HEADER_NAME_BYTES
|
||||||
|
|| !value.bytes().all(|byte| {
|
||||||
|
byte.is_ascii_alphanumeric()
|
||||||
|
|| matches!(
|
||||||
|
byte,
|
||||||
|
b'!' | b'#'
|
||||||
|
| b'$'
|
||||||
|
| b'%'
|
||||||
|
| b'&'
|
||||||
|
| b'\''
|
||||||
|
| b'*'
|
||||||
|
| b'+'
|
||||||
|
| b'-'
|
||||||
|
| b'.'
|
||||||
|
| b'^'
|
||||||
|
| b'_'
|
||||||
|
| b'`'
|
||||||
|
| b'|'
|
||||||
|
| b'~'
|
||||||
|
)
|
||||||
|
})
|
||||||
|
{
|
||||||
|
return Err(ApiError::validation("auth header name is invalid"));
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn validate_auth_query_name(value: &str) -> Result<(), ApiError> {
|
||||||
|
const MAX_QUERY_NAME_BYTES: usize = 128;
|
||||||
|
if value.is_empty()
|
||||||
|
|| value.len() > MAX_QUERY_NAME_BYTES
|
||||||
|
|| !value.bytes().all(|byte| {
|
||||||
|
byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-' | b'.' | b'[' | b']')
|
||||||
|
})
|
||||||
|
{
|
||||||
|
return Err(ApiError::validation("auth query parameter name is invalid"));
|
||||||
|
}
|
||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -97,6 +97,7 @@ impl AdminService {
|
|||||||
user,
|
user,
|
||||||
memberships,
|
memberships,
|
||||||
current_workspace_id: Some(workspace_id.as_str().to_owned()),
|
current_workspace_id: Some(workspace_id.as_str().to_owned()),
|
||||||
|
csrf_token: self.rotate_session_csrf_token(session_id).await?,
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -1,14 +1,14 @@
|
|||||||
use crate::service::AdminService;
|
use crate::service::AdminService;
|
||||||
use crank_runtime::RequestRateLimiter;
|
use crank_runtime::RequestRateLimiter;
|
||||||
|
use std::net::IpAddr;
|
||||||
|
|
||||||
#[derive(Clone)]
|
#[derive(Clone)]
|
||||||
pub struct AppState {
|
pub struct AppState {
|
||||||
pub service: AdminService,
|
pub service: AdminService,
|
||||||
pub api_rate_limiter: RequestRateLimiter,
|
pub api_rate_limiter: RequestRateLimiter,
|
||||||
/// Whether to trust `X-Real-IP` / `X-Forwarded-For` for client identification.
|
/// Immediate peer IPs allowed to supply `X-Real-IP` / `X-Forwarded-For`.
|
||||||
///
|
///
|
||||||
/// Only enable when the service sits behind a trusted reverse proxy that
|
/// Only configure reverse proxies that overwrite these headers. When the
|
||||||
/// overwrites these headers (e.g. the bundled nginx). When disabled the
|
/// peer is absent or not listed the real TCP peer address is used.
|
||||||
/// real TCP peer address is used, which a client cannot spoof.
|
pub trusted_proxy_ips: Vec<IpAddr>,
|
||||||
pub trust_forwarded_headers: bool,
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,12 +1,20 @@
|
|||||||
use std::process::Command;
|
use std::process::Command;
|
||||||
|
|
||||||
|
use crank_registry::{MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresRegistry};
|
||||||
|
use crank_runtime::SecretCrypto;
|
||||||
|
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
|
|
||||||
|
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
|
||||||
|
const REGISTERED_MASTER_KEY: &str = "registered-master-key-CANARY_SECRET_VALUE-00000000";
|
||||||
|
const WRONG_MASTER_KEY: &str = "wrong-master-key-CANARY_SECRET_VALUE-0000000000000";
|
||||||
|
|
||||||
fn run_with(entries: &[(&str, &str)]) -> String {
|
fn run_with(entries: &[(&str, &str)]) -> String {
|
||||||
let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
|
let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
|
||||||
for field in crank_config::field_registry() {
|
for field in crank_config::field_registry() {
|
||||||
command.env_remove(field.env_name);
|
command.env_remove(field.env_name);
|
||||||
}
|
}
|
||||||
command.envs([
|
command.envs([
|
||||||
("CRANK_MASTER_KEY", "master"),
|
("CRANK_MASTER_KEY", TEST_MASTER_KEY),
|
||||||
("CRANK_SESSION_SECRET", "session"),
|
("CRANK_SESSION_SECRET", "session"),
|
||||||
("CRANK_PASSWORD_PEPPER", "pepper"),
|
("CRANK_PASSWORD_PEPPER", "pepper"),
|
||||||
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
|
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
|
||||||
@@ -69,3 +77,92 @@ async fn fresh_database_startup_is_read_only() {
|
|||||||
.unwrap();
|
.unwrap();
|
||||||
assert!(!present);
|
assert!(!present);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn master_key_mismatch_blocks_startup_with_safe_diagnostic() {
|
||||||
|
let database_url = crank_test_support::postgres_schema_url("admin_master_key_mismatch").await;
|
||||||
|
let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
|
||||||
|
.arg("apply")
|
||||||
|
.env("CRANK_DATABASE_URL", &database_url)
|
||||||
|
.output()
|
||||||
|
.expect("migration command executes");
|
||||||
|
assert!(
|
||||||
|
applied.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&applied.stderr)
|
||||||
|
);
|
||||||
|
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||||
|
let crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: 1,
|
||||||
|
fingerprint: crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &OffsetDateTime::parse("2026-08-21T00:00:00Z", &Rfc3339).unwrap(),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let stderr = run_with(&[
|
||||||
|
("CRANK_DATABASE_URL", &database_url),
|
||||||
|
("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
|
||||||
|
]);
|
||||||
|
assert!(stderr.contains("master_key_identity_mismatch"), "{stderr}");
|
||||||
|
assert!(!stderr.contains("registered-master-key"));
|
||||||
|
assert!(!stderr.contains("wrong-master-key"));
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn populated_database_without_identity_rejects_wrong_first_key() {
|
||||||
|
let database_url =
|
||||||
|
crank_test_support::postgres_schema_url("admin_master_key_first_registration_wrong").await;
|
||||||
|
let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
|
||||||
|
.arg("apply")
|
||||||
|
.env("CRANK_DATABASE_URL", &database_url)
|
||||||
|
.output()
|
||||||
|
.expect("migration command executes");
|
||||||
|
assert!(
|
||||||
|
applied.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&applied.stderr)
|
||||||
|
);
|
||||||
|
let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
|
||||||
|
let old_crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
|
||||||
|
let ciphertext = old_crypto
|
||||||
|
.encrypt(&serde_json::json!({"token": "CANARY_SECRET_VALUE"}))
|
||||||
|
.unwrap();
|
||||||
|
sqlx::query(
|
||||||
|
"insert into secrets (
|
||||||
|
id, workspace_id, name, kind, status, current_version, created_at, updated_at
|
||||||
|
) values (
|
||||||
|
'legacy_secret', 'ws_default', 'legacy secret', 'token', 'active', 1, now(), now()
|
||||||
|
)",
|
||||||
|
)
|
||||||
|
.execute(&pool)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
sqlx::query(
|
||||||
|
"insert into secret_versions (
|
||||||
|
secret_id, version, ciphertext, key_version, master_key_epoch, created_at, created_by
|
||||||
|
) values (
|
||||||
|
'legacy_secret', 1, $1, $2, 1, now(), null
|
||||||
|
)",
|
||||||
|
)
|
||||||
|
.bind(ciphertext)
|
||||||
|
.bind(old_crypto.key_version())
|
||||||
|
.execute(&pool)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let stderr = run_with(&[
|
||||||
|
("CRANK_DATABASE_URL", &database_url),
|
||||||
|
("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
|
||||||
|
]);
|
||||||
|
assert!(stderr.contains("startup_failed"), "{stderr}");
|
||||||
|
assert!(!stderr.contains("CANARY_SECRET_VALUE"));
|
||||||
|
let identities: i64 = sqlx::query_scalar("select count(*) from master_key_identities")
|
||||||
|
.fetch_one(&pool)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(identities, 0);
|
||||||
|
}
|
||||||
|
|||||||
@@ -1,8 +1,13 @@
|
|||||||
mod integration {
|
mod integration {
|
||||||
|
mod agent_catalog;
|
||||||
mod auth_rate_limit;
|
mod auth_rate_limit;
|
||||||
mod common;
|
mod common;
|
||||||
mod community_access_usage;
|
mod community_access_usage;
|
||||||
|
mod credential_lifecycle;
|
||||||
|
mod logs_usage;
|
||||||
|
mod onboarding;
|
||||||
mod openapi_import;
|
mod openapi_import;
|
||||||
|
mod operation_lifecycle;
|
||||||
mod operations_agents;
|
mod operations_agents;
|
||||||
mod request_context;
|
mod request_context;
|
||||||
mod secrets_import_auth;
|
mod secrets_import_auth;
|
||||||
|
|||||||
@@ -0,0 +1,310 @@
|
|||||||
|
#![allow(dead_code, unused_imports)]
|
||||||
|
|
||||||
|
use super::common::*;
|
||||||
|
|
||||||
|
use serde_json::{Value, json};
|
||||||
|
use serial_test::serial;
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn binding_requires_exact_published_operation_version() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("agent_catalog_binding_requires_published");
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let draft_operation = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload(
|
||||||
|
&upstream_base_url,
|
||||||
|
"draft_not_bindable_tool",
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let draft_operation_id = draft_operation["operation_id"].as_str().unwrap().to_owned();
|
||||||
|
|
||||||
|
let agent = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents"))
|
||||||
|
.json(&json!({
|
||||||
|
"slug": "strict-catalog-agent",
|
||||||
|
"display_name": "Strict Catalog Agent",
|
||||||
|
"description": "Rejects draft bindings",
|
||||||
|
"instructions": {},
|
||||||
|
"tool_selection_policy": {}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let agent_id = agent["agent_id"].as_str().unwrap().to_owned();
|
||||||
|
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!([
|
||||||
|
{
|
||||||
|
"operation_id": draft_operation_id,
|
||||||
|
"operation_version": 1,
|
||||||
|
"tool_name": "draft_not_bindable_tool",
|
||||||
|
"tool_title": "Draft should not bind",
|
||||||
|
"tool_description_override": null,
|
||||||
|
"enabled": true
|
||||||
|
}
|
||||||
|
]))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
let body = response.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
body["error"]["code"], "agent_binding_not_published",
|
||||||
|
"binding Draft Operation must fail before publish and not be silently filtered"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn stale_agent_revision_rejects_mutation() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("agent_catalog_stale_revision");
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let operation = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload(
|
||||||
|
&upstream_base_url,
|
||||||
|
"stale_agent_tool",
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let operation_id = operation["operation_id"].as_str().unwrap().to_owned();
|
||||||
|
assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!({ "version": 1 }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
let agent = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents"))
|
||||||
|
.json(&json!({
|
||||||
|
"slug": "stale-agent",
|
||||||
|
"display_name": "Stale Agent",
|
||||||
|
"description": "Stale revision test",
|
||||||
|
"instructions": {},
|
||||||
|
"tool_selection_policy": {}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let agent_id = agent["agent_id"].as_str().unwrap().to_owned();
|
||||||
|
assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!([{
|
||||||
|
"operation_id": operation_id,
|
||||||
|
"operation_version": 1,
|
||||||
|
"tool_name": "stale_agent_tool",
|
||||||
|
"tool_title": "Stale Agent Tool",
|
||||||
|
"enabled": true
|
||||||
|
}]))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!({ "version": 1 }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.json(&json!([]))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
assert_eq!(
|
||||||
|
response.status(),
|
||||||
|
reqwest::StatusCode::PRECONDITION_REQUIRED,
|
||||||
|
"Agent mutations after read must require current revision precondition"
|
||||||
|
);
|
||||||
|
let body = response.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(body["error"]["code"], "agent_precondition_required");
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn unpublishes_and_archives_agent() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("agent_statuses");
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let operation = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload(
|
||||||
|
&upstream_base_url,
|
||||||
|
"crm_create_lead_agent_status",
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let operation_id = operation["operation_id"].as_str().unwrap().to_owned();
|
||||||
|
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!({ "version": 1 }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let created = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents"))
|
||||||
|
.json(&json!({
|
||||||
|
"slug": "sales-routing",
|
||||||
|
"display_name": "Sales Routing",
|
||||||
|
"description": "Routing agent",
|
||||||
|
"instructions": {},
|
||||||
|
"tool_selection_policy": {}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let agent_id = created["agent_id"].as_str().unwrap().to_owned();
|
||||||
|
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!([
|
||||||
|
{
|
||||||
|
"operation_id": operation_id,
|
||||||
|
"operation_version": 1,
|
||||||
|
"tool_name": "crm_create_lead_agent_status",
|
||||||
|
"tool_title": "Create Lead",
|
||||||
|
"tool_description_override": null,
|
||||||
|
"enabled": true
|
||||||
|
}
|
||||||
|
]))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!({ "version": 1 }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let unpublished = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/unpublish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!({}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(unpublished["agent_id"], agent_id);
|
||||||
|
|
||||||
|
let draft_detail = assert_success_json(
|
||||||
|
client
|
||||||
|
.get(format!("{base_url}/agents/{agent_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(draft_detail["status"], "draft");
|
||||||
|
assert_eq!(draft_detail["latest_published_version"], 1);
|
||||||
|
|
||||||
|
let archived = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/archive"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!({}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(archived["agent_id"], agent_id);
|
||||||
|
|
||||||
|
let archived_detail = assert_success_json(
|
||||||
|
client
|
||||||
|
.get(format!("{base_url}/agents/{agent_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(archived_detail["status"], "archived");
|
||||||
|
}
|
||||||
@@ -11,17 +11,22 @@ use std::{
|
|||||||
|
|
||||||
use async_trait::async_trait;
|
use async_trait::async_trait;
|
||||||
use axum::{Json, Router, routing::post};
|
use axum::{Json, Router, routing::post};
|
||||||
|
use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
|
||||||
use crank_core::{
|
use crank_core::{
|
||||||
ExecutionConfig, HttpMethod, MembershipRole, OperationSecurityLevel, Protocol,
|
ExecutionConfig, HttpMethod, MembershipRole, OperationSecurityLevel, Protocol,
|
||||||
ResponseCachePolicy, RestTarget, SecretKind, Target, ToolDescription, WorkspaceId,
|
ResponseCachePolicy, RestTarget, SecretKind, Target, ToolDescription, WorkspaceId,
|
||||||
};
|
};
|
||||||
use crank_core::{IdentityError, IdentityProvider, IdentityProviderKind, LoginOutcome};
|
use crank_core::{IdentityError, IdentityProvider, IdentityProviderKind, LoginOutcome};
|
||||||
use crank_mapping::{MappingRule, MappingSet};
|
use crank_mapping::{MappingRule, MappingSet};
|
||||||
use crank_registry::PostgresRegistry;
|
use crank_registry::{
|
||||||
|
CreateAdminBootstrapContractRequest, MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate,
|
||||||
|
MigrationAuthority, PostgresRegistry,
|
||||||
|
};
|
||||||
use crank_runtime::SecretCrypto;
|
use crank_runtime::SecretCrypto;
|
||||||
use crank_schema::{Schema, SchemaKind};
|
use crank_schema::{Schema, SchemaKind};
|
||||||
use serde_json::{Value, json};
|
use serde_json::{Value, json};
|
||||||
use serial_test::serial;
|
use serial_test::serial;
|
||||||
|
use sha2::{Digest, Sha256};
|
||||||
use tokio::net::TcpListener;
|
use tokio::net::TcpListener;
|
||||||
|
|
||||||
use admin_api::{
|
use admin_api::{
|
||||||
@@ -36,7 +41,7 @@ const TEST_AUTH_EMAIL: &str = "owner@crank.local";
|
|||||||
const TEST_AUTH_PASSWORD: &str = "test-password";
|
const TEST_AUTH_PASSWORD: &str = "test-password";
|
||||||
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
||||||
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
||||||
const TEST_MASTER_KEY: &str = "test-master-key";
|
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
|
||||||
|
|
||||||
struct TestServer {
|
struct TestServer {
|
||||||
base_url: String,
|
base_url: String,
|
||||||
@@ -92,6 +97,48 @@ impl IdentityProvider for RejectingIdentityProvider {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn empty_registry(name: &str) -> PostgresRegistry {
|
||||||
|
let database_url = crank_test_support::postgres_schema_url(name).await;
|
||||||
|
let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
|
||||||
|
MigrationAuthority::apply(&pool).await.unwrap();
|
||||||
|
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||||
|
let secret_crypto = test_secret_crypto();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: secret_crypto.master_key_epoch(),
|
||||||
|
fingerprint: secret_crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &time::OffsetDateTime::now_utc(),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
registry
|
||||||
|
}
|
||||||
|
|
||||||
|
fn bootstrap_token_hash(token: &str) -> String {
|
||||||
|
let digest = Sha256::digest(format!("bootstrap:{token}").as_bytes());
|
||||||
|
URL_SAFE_NO_PAD.encode(digest)
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn login_client_without_csrf(root_url: &str) -> reqwest::Client {
|
||||||
|
let client = reqwest::Client::builder()
|
||||||
|
.cookie_store(true)
|
||||||
|
.build()
|
||||||
|
.unwrap();
|
||||||
|
client
|
||||||
|
.post(format!("{root_url}/api/auth/login"))
|
||||||
|
.json(&json!({
|
||||||
|
"email": TEST_AUTH_EMAIL,
|
||||||
|
"password": TEST_AUTH_PASSWORD,
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.error_for_status()
|
||||||
|
.unwrap();
|
||||||
|
client
|
||||||
|
}
|
||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
#[serial]
|
#[serial]
|
||||||
async fn rejects_rapid_login_requests_with_429() {
|
async fn rejects_rapid_login_requests_with_429() {
|
||||||
@@ -109,7 +156,7 @@ async fn rejects_rapid_login_requests_with_429() {
|
|||||||
api_rate_limiter: crank_runtime::RequestRateLimiter::new(
|
api_rate_limiter: crank_runtime::RequestRateLimiter::new(
|
||||||
crank_runtime::RequestRateLimitConfig::new(1, 1).unwrap(),
|
crank_runtime::RequestRateLimitConfig::new(1, 1).unwrap(),
|
||||||
),
|
),
|
||||||
trust_forwarded_headers: false,
|
trusted_proxy_ips: Vec::new(),
|
||||||
});
|
});
|
||||||
let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel();
|
let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel();
|
||||||
let handle = tokio::spawn(async move {
|
let handle = tokio::spawn(async move {
|
||||||
@@ -195,3 +242,119 @@ async fn login_uses_identity_provider_when_configured() {
|
|||||||
};
|
};
|
||||||
assert_eq!(error.to_string(), "invalid email or password");
|
assert_eq!(error.to_string(), "invalid email or password");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn bootstrap_token_creates_first_admin_once_and_never_replays() {
|
||||||
|
let registry = empty_registry("test_admin_api_bootstrap_token").await;
|
||||||
|
let token = "bootstrap-token-story-1-12-local-operator-only";
|
||||||
|
registry
|
||||||
|
.create_admin_bootstrap_contract(CreateAdminBootstrapContractRequest {
|
||||||
|
id: "boot_test_story_1_12",
|
||||||
|
token_hash: &bootstrap_token_hash(token),
|
||||||
|
email: "first-owner@crank.local",
|
||||||
|
display_name: "First Owner",
|
||||||
|
expires_at: &(time::OffsetDateTime::now_utc() + time::Duration::minutes(15)),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let storage_root = test_storage_root("bootstrap_token");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let root_url = base_url
|
||||||
|
.as_ref()
|
||||||
|
.split("/api/admin/workspaces/")
|
||||||
|
.next()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned();
|
||||||
|
let client = reqwest::Client::builder()
|
||||||
|
.cookie_store(true)
|
||||||
|
.build()
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let status = assert_success_json(
|
||||||
|
client
|
||||||
|
.get(format!("{root_url}/api/auth/bootstrap/status"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(status["bootstrap_required"], true);
|
||||||
|
|
||||||
|
let completed = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{root_url}/api/auth/bootstrap/complete"))
|
||||||
|
.json(&json!({
|
||||||
|
"token": token,
|
||||||
|
"password": "first-owner-password-123"
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(completed["user"]["email"], "first-owner@crank.local");
|
||||||
|
assert!(completed["csrf_token"].as_str().unwrap().len() >= 32);
|
||||||
|
|
||||||
|
let replay = client
|
||||||
|
.post(format!("{root_url}/api/auth/bootstrap/complete"))
|
||||||
|
.json(&json!({
|
||||||
|
"token": token,
|
||||||
|
"password": "second-password-should-not-work"
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(replay.status(), reqwest::StatusCode::UNAUTHORIZED);
|
||||||
|
|
||||||
|
let status_after = assert_success_json(
|
||||||
|
client
|
||||||
|
.get(format!("{root_url}/api/auth/bootstrap/status"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(status_after["bootstrap_required"], false);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn browser_mutations_require_csrf_and_reject_cross_origin_requests() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("csrf_and_origin");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let root_url = base_url
|
||||||
|
.as_ref()
|
||||||
|
.split("/api/admin/workspaces/")
|
||||||
|
.next()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned();
|
||||||
|
let client = login_client_without_csrf(&root_url).await;
|
||||||
|
|
||||||
|
let missing_csrf = client
|
||||||
|
.patch(format!("{root_url}/api/auth/profile"))
|
||||||
|
.json(&json!({
|
||||||
|
"display_name": "Blocked Without CSRF",
|
||||||
|
"email": TEST_AUTH_EMAIL
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(missing_csrf.status(), reqwest::StatusCode::FORBIDDEN);
|
||||||
|
let missing_body = missing_csrf.text().await.unwrap();
|
||||||
|
assert!(!missing_body.contains(TEST_SESSION_SECRET));
|
||||||
|
assert!(!missing_body.contains(TEST_AUTH_PASSWORD));
|
||||||
|
|
||||||
|
let cross_origin = client
|
||||||
|
.get(format!("{root_url}/api/auth/profile"))
|
||||||
|
.header("origin", "https://attacker.example")
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(cross_origin.status(), reqwest::StatusCode::FORBIDDEN);
|
||||||
|
let cross_origin_body = cross_origin.text().await.unwrap();
|
||||||
|
assert!(!cross_origin_body.contains(TEST_SESSION_SECRET));
|
||||||
|
assert!(!cross_origin_body.contains(TEST_AUTH_PASSWORD));
|
||||||
|
}
|
||||||
|
|||||||
@@ -10,12 +10,12 @@ use std::{
|
|||||||
use async_trait::async_trait;
|
use async_trait::async_trait;
|
||||||
use axum::{Json, Router, routing::post};
|
use axum::{Json, Router, routing::post};
|
||||||
use crank_core::{
|
use crank_core::{
|
||||||
ExecutionConfig, HttpMethod, MembershipRole, OperationSecurityLevel, Protocol,
|
AuditSink, ExecutionConfig, HttpMethod, MembershipRole, OperationSecurityLevel, Protocol,
|
||||||
ResponseCachePolicy, RestTarget, SecretKind, Target, ToolDescription, WorkspaceId,
|
ResponseCachePolicy, RestTarget, SecretKind, Target, ToolDescription, WorkspaceId,
|
||||||
};
|
};
|
||||||
use crank_core::{IdentityError, IdentityProvider, IdentityProviderKind, LoginOutcome};
|
use crank_core::{IdentityError, IdentityProvider, IdentityProviderKind, LoginOutcome};
|
||||||
use crank_mapping::{MappingRule, MappingSet};
|
use crank_mapping::{MappingRule, MappingSet};
|
||||||
use crank_registry::PostgresRegistry;
|
use crank_registry::{MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresRegistry};
|
||||||
use crank_runtime::SecretCrypto;
|
use crank_runtime::SecretCrypto;
|
||||||
use crank_schema::{Schema, SchemaKind};
|
use crank_schema::{Schema, SchemaKind};
|
||||||
use serde_json::{Value, json};
|
use serde_json::{Value, json};
|
||||||
@@ -34,7 +34,7 @@ const TEST_AUTH_EMAIL: &str = "owner@crank.local";
|
|||||||
const TEST_AUTH_PASSWORD: &str = "test-password";
|
const TEST_AUTH_PASSWORD: &str = "test-password";
|
||||||
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
||||||
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
||||||
const TEST_MASTER_KEY: &str = "test-master-key";
|
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
|
||||||
|
|
||||||
pub(super) struct TestServer {
|
pub(super) struct TestServer {
|
||||||
base_url: String,
|
base_url: String,
|
||||||
@@ -104,7 +104,32 @@ pub(super) fn build_test_app(
|
|||||||
api_rate_limiter: crank_runtime::RequestRateLimiter::new(
|
api_rate_limiter: crank_runtime::RequestRateLimiter::new(
|
||||||
crank_runtime::RequestRateLimitConfig::new(10_000, 10_000).unwrap(),
|
crank_runtime::RequestRateLimitConfig::new(10_000, 10_000).unwrap(),
|
||||||
),
|
),
|
||||||
trust_forwarded_headers: false,
|
trusted_proxy_ips: Vec::new(),
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn build_test_app_with_audit_sink(
|
||||||
|
registry: PostgresRegistry,
|
||||||
|
storage_root: std::path::PathBuf,
|
||||||
|
audit_sink: Arc<dyn AuditSink>,
|
||||||
|
) -> Router {
|
||||||
|
let outbound_policy = crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]);
|
||||||
|
let runtime = crank_runtime::community_with_outbound_policy(outbound_policy.clone()).build();
|
||||||
|
build_app(AppState {
|
||||||
|
service: AdminServiceBuilder::new(
|
||||||
|
registry,
|
||||||
|
storage_root,
|
||||||
|
test_auth_settings(),
|
||||||
|
test_secret_crypto(),
|
||||||
|
runtime,
|
||||||
|
)
|
||||||
|
.with_outbound_http_policy(outbound_policy)
|
||||||
|
.with_audit_sink(audit_sink)
|
||||||
|
.build(),
|
||||||
|
api_rate_limiter: crank_runtime::RequestRateLimiter::new(
|
||||||
|
crank_runtime::RequestRateLimitConfig::new(10_000, 10_000).unwrap(),
|
||||||
|
),
|
||||||
|
trusted_proxy_ips: Vec::new(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -169,12 +194,13 @@ pub(super) async fn authorized_client(workspace_base_url: impl AsRef<str>) -> re
|
|||||||
.split("/api/admin/workspaces/")
|
.split("/api/admin/workspaces/")
|
||||||
.next()
|
.next()
|
||||||
.unwrap();
|
.unwrap();
|
||||||
let client = reqwest::Client::builder()
|
let cookie_jar = Arc::new(reqwest::cookie::Jar::default());
|
||||||
.cookie_store(true)
|
let login_client = reqwest::Client::builder()
|
||||||
|
.cookie_provider(cookie_jar.clone())
|
||||||
.build()
|
.build()
|
||||||
.unwrap();
|
.unwrap();
|
||||||
|
|
||||||
client
|
let login = login_client
|
||||||
.post(format!("{root_url}/api/auth/login"))
|
.post(format!("{root_url}/api/auth/login"))
|
||||||
.json(&json!({
|
.json(&json!({
|
||||||
"email": TEST_AUTH_EMAIL,
|
"email": TEST_AUTH_EMAIL,
|
||||||
@@ -184,9 +210,67 @@ pub(super) async fn authorized_client(workspace_base_url: impl AsRef<str>) -> re
|
|||||||
.await
|
.await
|
||||||
.unwrap()
|
.unwrap()
|
||||||
.error_for_status()
|
.error_for_status()
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
|
let csrf_token = login["csrf_token"]
|
||||||
|
.as_str()
|
||||||
|
.expect("login response must include csrf_token");
|
||||||
|
let mut default_headers = reqwest::header::HeaderMap::new();
|
||||||
|
default_headers.insert(
|
||||||
|
"x-csrf-token",
|
||||||
|
reqwest::header::HeaderValue::from_str(csrf_token).unwrap(),
|
||||||
|
);
|
||||||
|
|
||||||
client
|
reqwest::Client::builder()
|
||||||
|
.cookie_provider(cookie_jar)
|
||||||
|
.default_headers(default_headers)
|
||||||
|
.build()
|
||||||
|
.unwrap()
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) async fn operation_etag(
|
||||||
|
client: &reqwest::Client,
|
||||||
|
workspace_base_url: impl AsRef<str>,
|
||||||
|
operation_id: &str,
|
||||||
|
) -> String {
|
||||||
|
let response = client
|
||||||
|
.get(format!(
|
||||||
|
"{}/operations/{operation_id}",
|
||||||
|
workspace_base_url.as_ref()
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::OK);
|
||||||
|
response
|
||||||
|
.headers()
|
||||||
|
.get(reqwest::header::ETAG)
|
||||||
|
.expect("operation detail must expose an ETag")
|
||||||
|
.to_str()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned()
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) async fn agent_etag(
|
||||||
|
client: &reqwest::Client,
|
||||||
|
workspace_base_url: impl AsRef<str>,
|
||||||
|
agent_id: &str,
|
||||||
|
) -> String {
|
||||||
|
let response = client
|
||||||
|
.get(format!("{}/agents/{agent_id}", workspace_base_url.as_ref()))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::OK);
|
||||||
|
response
|
||||||
|
.headers()
|
||||||
|
.get(reqwest::header::ETAG)
|
||||||
|
.expect("agent detail must expose an ETag")
|
||||||
|
.to_str()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned()
|
||||||
}
|
}
|
||||||
|
|
||||||
pub(super) async fn assert_success_json(response: reqwest::Response) -> Value {
|
pub(super) async fn assert_success_json(response: reqwest::Response) -> Value {
|
||||||
@@ -216,6 +300,16 @@ pub(super) async fn test_registry() -> PostgresRegistry {
|
|||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||||
|
let secret_crypto = test_secret_crypto();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: secret_crypto.master_key_epoch(),
|
||||||
|
fingerprint: secret_crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &time::OffsetDateTime::now_utc(),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
let password_hash = hash_password(TEST_AUTH_PASSWORD, TEST_PASSWORD_PEPPER).unwrap();
|
let password_hash = hash_password(TEST_AUTH_PASSWORD, TEST_PASSWORD_PEPPER).unwrap();
|
||||||
let user_id = registry
|
let user_id = registry
|
||||||
.upsert_bootstrap_user(TEST_AUTH_EMAIL, "Test Owner", &password_hash)
|
.upsert_bootstrap_user(TEST_AUTH_EMAIL, "Test Owner", &password_hash)
|
||||||
|
|||||||
@@ -39,7 +39,7 @@ const TEST_AUTH_EMAIL: &str = "owner@crank.local";
|
|||||||
const TEST_AUTH_PASSWORD: &str = "test-password";
|
const TEST_AUTH_PASSWORD: &str = "test-password";
|
||||||
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
||||||
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
||||||
const TEST_MASTER_KEY: &str = "test-master-key";
|
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
|
||||||
|
|
||||||
struct TestServer {
|
struct TestServer {
|
||||||
base_url: String,
|
base_url: String,
|
||||||
@@ -478,6 +478,11 @@ async fn seeds_demo_assets_for_live_ui() {
|
|||||||
&WorkspaceId::new(DEFAULT_WORKSPACE_ID),
|
&WorkspaceId::new(DEFAULT_WORKSPACE_ID),
|
||||||
&smoke_operation_id,
|
&smoke_operation_id,
|
||||||
smoke_operation.version,
|
smoke_operation.version,
|
||||||
|
&crank_registry::OperationStateExpectation {
|
||||||
|
current_draft_version: smoke_operation.version,
|
||||||
|
status: crank_core::OperationStatus::Draft,
|
||||||
|
latest_published_version: None,
|
||||||
|
},
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -508,6 +513,7 @@ async fn seeds_demo_assets_for_live_ui() {
|
|||||||
enabled: true,
|
enabled: true,
|
||||||
}]
|
}]
|
||||||
.into(),
|
.into(),
|
||||||
|
None,
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -516,6 +522,7 @@ async fn seeds_demo_assets_for_live_ui() {
|
|||||||
&WorkspaceId::new(DEFAULT_WORKSPACE_ID),
|
&WorkspaceId::new(DEFAULT_WORKSPACE_ID),
|
||||||
&smoke_agent_id,
|
&smoke_agent_id,
|
||||||
smoke_agent.version,
|
smoke_agent.version,
|
||||||
|
None,
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -573,17 +580,22 @@ async fn seeds_demo_assets_for_live_ui() {
|
|||||||
&default_workspace_id,
|
&default_workspace_id,
|
||||||
admin_api::service::LogsQuery {
|
admin_api::service::LogsQuery {
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
search: None,
|
search: None,
|
||||||
source: None,
|
source: None,
|
||||||
operation_id: None,
|
operation_id: None,
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
|
outcome_group: None,
|
||||||
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
period: None,
|
period: None,
|
||||||
|
cursor: None,
|
||||||
limit: Some(20),
|
limit: Some(20),
|
||||||
},
|
},
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
assert!(!logs.is_empty());
|
assert!(!logs.items.is_empty());
|
||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
@@ -646,9 +658,11 @@ async fn updates_profile_and_changes_password() {
|
|||||||
updated_profile["user"]["email"],
|
updated_profile["user"]["email"],
|
||||||
"updated-owner@crank.local"
|
"updated-owner@crank.local"
|
||||||
);
|
);
|
||||||
|
let updated_csrf_token = updated_profile["csrf_token"].as_str().unwrap();
|
||||||
|
|
||||||
let password_status = client
|
let password_status = client
|
||||||
.post(format!("{root_url}/api/auth/password"))
|
.post(format!("{root_url}/api/auth/password"))
|
||||||
|
.header("x-csrf-token", updated_csrf_token)
|
||||||
.json(&json!({
|
.json(&json!({
|
||||||
"current_password": TEST_AUTH_PASSWORD,
|
"current_password": TEST_AUTH_PASSWORD,
|
||||||
"new_password": "updated-password-123"
|
"new_password": "updated-password-123"
|
||||||
@@ -671,7 +685,7 @@ async fn updates_profile_and_changes_password() {
|
|||||||
.await
|
.await
|
||||||
.unwrap()
|
.unwrap()
|
||||||
.status();
|
.status();
|
||||||
assert_eq!(current_session_status, reqwest::StatusCode::OK);
|
assert_eq!(current_session_status, reqwest::StatusCode::UNAUTHORIZED);
|
||||||
assert_eq!(other_session_status, reqwest::StatusCode::UNAUTHORIZED);
|
assert_eq!(other_session_status, reqwest::StatusCode::UNAUTHORIZED);
|
||||||
|
|
||||||
let relogin_client = reqwest::Client::builder()
|
let relogin_client = reqwest::Client::builder()
|
||||||
@@ -741,87 +755,6 @@ async fn rejects_multi_workspace_session_switching_in_community() {
|
|||||||
assert_eq!(session["current_workspace_id"], DEFAULT_WORKSPACE_ID);
|
assert_eq!(session["current_workspace_id"], DEFAULT_WORKSPACE_ID);
|
||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
|
||||||
#[serial]
|
|
||||||
async fn exposes_logs_and_usage_from_real_test_runs() {
|
|
||||||
let registry = test_registry().await;
|
|
||||||
let storage_root = test_storage_root("observability");
|
|
||||||
let upstream_base_url = spawn_upstream_server().await;
|
|
||||||
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
|
||||||
let client = authorized_client(&base_url).await;
|
|
||||||
|
|
||||||
let created = client
|
|
||||||
.post(format!("{base_url}/operations"))
|
|
||||||
.json(&test_operation_payload(
|
|
||||||
&upstream_base_url,
|
|
||||||
"crm_observability",
|
|
||||||
))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
let operation_id = created["operation_id"].as_str().unwrap().to_owned();
|
|
||||||
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
|
|
||||||
.json(&json!({
|
|
||||||
"version": 1,
|
|
||||||
"input": { "email": "user@example.com" }
|
|
||||||
}))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
let logs = client
|
|
||||||
.get(format!("{base_url}/logs?period=7d"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
let log_id = logs["items"][0]["log"]["id"].as_str().unwrap().to_owned();
|
|
||||||
let log_detail = client
|
|
||||||
.get(format!("{base_url}/logs/{log_id}"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
let usage = client
|
|
||||||
.get(format!("{base_url}/usage?period=7d"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
let operation_usage = client
|
|
||||||
.get(format!(
|
|
||||||
"{base_url}/usage/operations/{operation_id}?period=7d"
|
|
||||||
))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
assert_eq!(logs["items"][0]["log"]["source"], "admin_test_run");
|
|
||||||
assert_eq!(logs["items"][0]["operation_name"], "crm_observability");
|
|
||||||
assert_eq!(log_detail["log"]["status"], "ok");
|
|
||||||
assert_eq!(usage["summary"]["rollup"]["calls_total"], 1);
|
|
||||||
assert_eq!(usage["summary"]["rollup"]["calls_ok"], 1);
|
|
||||||
assert_eq!(
|
|
||||||
usage["operations"][0]["operation_name"],
|
|
||||||
"crm_observability"
|
|
||||||
);
|
|
||||||
assert_eq!(operation_usage["rollup"]["calls_total"], 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
#[serial]
|
#[serial]
|
||||||
async fn preserves_request_id_for_test_run_invocations() {
|
async fn preserves_request_id_for_test_run_invocations() {
|
||||||
|
|||||||
@@ -0,0 +1,994 @@
|
|||||||
|
#![allow(dead_code, unused_imports)]
|
||||||
|
|
||||||
|
use super::common::*;
|
||||||
|
|
||||||
|
use std::sync::{Arc, Mutex};
|
||||||
|
|
||||||
|
use axum::{Json, Router, http::HeaderMap, routing::post};
|
||||||
|
use crank_core::{AuditError, AuditEvent, AuditSink, PlatformApiKeyKind, SecretKind};
|
||||||
|
use serde_json::{Value, json};
|
||||||
|
use serial_test::serial;
|
||||||
|
use tokio::net::TcpListener;
|
||||||
|
|
||||||
|
#[derive(Clone, Default)]
|
||||||
|
struct RecordingAuditSink {
|
||||||
|
events: Arc<Mutex<Vec<AuditEvent>>>,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl RecordingAuditSink {
|
||||||
|
fn events(&self) -> Vec<AuditEvent> {
|
||||||
|
self.events.lock().unwrap().clone()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[async_trait::async_trait]
|
||||||
|
impl AuditSink for RecordingAuditSink {
|
||||||
|
async fn record(&self, event: AuditEvent) -> Result<(), AuditError> {
|
||||||
|
self.events.lock().unwrap().push(event);
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn machine_key_raw_value_is_create_only_and_duplicate_name_is_typed_conflict() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("credential_lifecycle_keys");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let agent_id = create_agent(&client, &base_url, "credential-lifecycle-agent").await;
|
||||||
|
|
||||||
|
let created = post_json(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/agents/{agent_id}/platform-api-keys"),
|
||||||
|
json!({"name": "primary-mcp-key", "key_kind": PlatformApiKeyKind::McpClient, "scopes": ["read", "write"]}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let raw_key = created["secret"]
|
||||||
|
.as_str()
|
||||||
|
.expect("create response must disclose the raw key once")
|
||||||
|
.to_owned();
|
||||||
|
let random_part = raw_key
|
||||||
|
.strip_prefix("crk_")
|
||||||
|
.expect("MCP key must use the MCP bearer marker");
|
||||||
|
assert_eq!(random_part.len(), 43, "32 raw bytes in unpadded base64url");
|
||||||
|
assert!(
|
||||||
|
random_part
|
||||||
|
.bytes()
|
||||||
|
.all(|byte| { byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_') })
|
||||||
|
);
|
||||||
|
assert_eq!(
|
||||||
|
created["connection"]["endpoint"],
|
||||||
|
"http://localhost:3000/mcp/v1/default/credential-lifecycle-agent"
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
created["connection"]["clients"]
|
||||||
|
.as_array()
|
||||||
|
.is_some_and(|clients| !clients.is_empty())
|
||||||
|
);
|
||||||
|
|
||||||
|
let approval = post_json(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/agents/{agent_id}/platform-api-keys"),
|
||||||
|
json!({"name": "approval-without-mcp-config", "key_kind": PlatformApiKeyKind::Approval, "scopes": ["read_pending"]}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert!(approval.get("connection").is_none());
|
||||||
|
|
||||||
|
let listed_text = client
|
||||||
|
.get(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(!listed_text.contains(&raw_key));
|
||||||
|
assert!(!listed_text.contains("secret_hash"));
|
||||||
|
assert!(!listed_text.contains("\"secret\""));
|
||||||
|
|
||||||
|
let duplicate = client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "primary-mcp-key",
|
||||||
|
"key_kind": PlatformApiKeyKind::McpClient,
|
||||||
|
"scopes": ["read"]
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(duplicate.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let duplicate_body = duplicate.text().await.unwrap();
|
||||||
|
assert!(!duplicate_body.contains(&raw_key));
|
||||||
|
assert!(!duplicate_body.contains("secret_hash"));
|
||||||
|
assert!(!duplicate_body.contains("duplicate key value"));
|
||||||
|
let duplicate_json: Value = serde_json::from_str(&duplicate_body).unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
duplicate_json["error"]["code"],
|
||||||
|
"platform_api_key_name_conflict"
|
||||||
|
);
|
||||||
|
|
||||||
|
for payload in [
|
||||||
|
json!({"name": "n".repeat(129), "key_kind": PlatformApiKeyKind::McpClient, "scopes": ["read"]}),
|
||||||
|
json!({"name": "duplicate-scope", "key_kind": PlatformApiKeyKind::McpClient, "scopes": ["read", "read"]}),
|
||||||
|
json!({"name": "past-expiry", "key_kind": PlatformApiKeyKind::McpClient, "scopes": ["read"], "expires_at": "2020-01-01T00:00:00Z"}),
|
||||||
|
] {
|
||||||
|
assert_post_error(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/agents/{agent_id}/platform-api-keys"),
|
||||||
|
payload,
|
||||||
|
reqwest::StatusCode::BAD_REQUEST,
|
||||||
|
"validation_error",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
|
||||||
|
let canonical = post_json(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/agents/{agent_id}/platform-api-keys"),
|
||||||
|
json!({"name": "canonical-approval-origin", "key_kind": PlatformApiKeyKind::Approval, "scopes": ["read_pending"], "allowed_origins": ["HTTPS://Example.COM:443/", "http://EXAMPLE.com:80/"]}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(
|
||||||
|
canonical["api_key"]["api_key"]["allowed_origins"],
|
||||||
|
json!(["https://example.com", "http://example.com"])
|
||||||
|
);
|
||||||
|
for (index, origin) in [
|
||||||
|
"https://[::1",
|
||||||
|
"https://example.test:bad/",
|
||||||
|
"https://user:pass@example.test/",
|
||||||
|
"https://example.test/path",
|
||||||
|
"https://example.test/?token=origin-canary",
|
||||||
|
"https://example.test/#fragment",
|
||||||
|
]
|
||||||
|
.into_iter()
|
||||||
|
.enumerate()
|
||||||
|
{
|
||||||
|
assert_post_error(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/agents/{agent_id}/platform-api-keys"),
|
||||||
|
json!({"name": format!("malformed-origin-{index}"), "key_kind": PlatformApiKeyKind::Approval, "scopes": ["read_pending"], "allowed_origins": [origin]}),
|
||||||
|
reqwest::StatusCode::BAD_REQUEST,
|
||||||
|
"validation_error",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
assert_post_error(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/agents/{agent_id}/platform-api-keys"),
|
||||||
|
json!({"name": "duplicate-canonical-origin", "key_kind": PlatformApiKeyKind::Approval, "scopes": ["read_pending"], "allowed_origins": ["https://EXAMPLE.test:443/", "https://example.test/"]}),
|
||||||
|
reqwest::StatusCode::BAD_REQUEST,
|
||||||
|
"validation_error",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn deleted_machine_key_name_can_be_reused_and_terminal_state_cannot_regress() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("credential_lifecycle_key_reuse");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let agent_id = create_agent(&client, &base_url, "credential-key-reuse-agent").await;
|
||||||
|
|
||||||
|
let first = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "replaceable-key",
|
||||||
|
"key_kind": PlatformApiKeyKind::McpClient,
|
||||||
|
"scopes": ["read"]
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let first_key_id = first["api_key"]["api_key"]["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let delete_response = client
|
||||||
|
.delete(format!(
|
||||||
|
"{base_url}/agents/{agent_id}/platform-api-keys/{first_key_id}"
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(delete_response.status(), reqwest::StatusCode::NO_CONTENT);
|
||||||
|
|
||||||
|
let revoke_deleted = client
|
||||||
|
.post(format!(
|
||||||
|
"{base_url}/agents/{agent_id}/platform-api-keys/{first_key_id}/revoke"
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(revoke_deleted.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let revoke_body: Value = serde_json::from_str(&revoke_deleted.text().await.unwrap()).unwrap();
|
||||||
|
assert_eq!(revoke_body["error"]["code"], "platform_api_key_not_active");
|
||||||
|
|
||||||
|
let second = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "replaceable-key",
|
||||||
|
"key_kind": PlatformApiKeyKind::McpClient,
|
||||||
|
"scopes": ["read"]
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let second_key_id = second["api_key"]["api_key"]["id"].as_str().unwrap();
|
||||||
|
assert_ne!(first_key_id, second_key_id);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn secret_plaintext_is_write_only_and_auth_profile_stores_reference() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("credential_lifecycle_secrets");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
let canary = "secret-canary-1-10-do-not-leak";
|
||||||
|
|
||||||
|
let created_response = client
|
||||||
|
.post(format!("{base_url}/secrets"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "crm-bearer-token",
|
||||||
|
"kind": SecretKind::Token,
|
||||||
|
"value": { "token": canary }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let created_text = created_response.text().await.unwrap();
|
||||||
|
assert!(!created_text.contains(canary));
|
||||||
|
assert!(!created_text.contains("ciphertext"));
|
||||||
|
let created: Value = serde_json::from_str(&created_text).unwrap();
|
||||||
|
let secret_id = created["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let listed_text = client
|
||||||
|
.get(format!("{base_url}/secrets"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(!listed_text.contains(canary));
|
||||||
|
assert!(!listed_text.contains("ciphertext"));
|
||||||
|
|
||||||
|
let fetched_text = client
|
||||||
|
.get(format!("{base_url}/secrets/{secret_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(!fetched_text.contains(canary));
|
||||||
|
assert!(!fetched_text.contains("ciphertext"));
|
||||||
|
|
||||||
|
let auth_profile_text = client
|
||||||
|
.post(format!("{base_url}/auth-profiles"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "crm-bearer",
|
||||||
|
"kind": "bearer",
|
||||||
|
"config": {
|
||||||
|
"bearer": {
|
||||||
|
"header_name": "Authorization",
|
||||||
|
"secret_id": secret_id
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(!auth_profile_text.contains(canary));
|
||||||
|
assert!(!auth_profile_text.contains("ciphertext"));
|
||||||
|
let auth_profile: Value = serde_json::from_str(&auth_profile_text).unwrap();
|
||||||
|
assert_eq!(auth_profile["config"]["bearer"]["secret_id"], secret_id);
|
||||||
|
|
||||||
|
for (name, kind, value) in [
|
||||||
|
("null-token", SecretKind::Token, Value::Null),
|
||||||
|
(
|
||||||
|
"wrong-token-shape",
|
||||||
|
SecretKind::Token,
|
||||||
|
json!({"token": "token", "extra": "field"}),
|
||||||
|
),
|
||||||
|
(
|
||||||
|
"wrong-header-shape",
|
||||||
|
SecretKind::Header,
|
||||||
|
json!({"header_name": "X-Token"}),
|
||||||
|
),
|
||||||
|
(
|
||||||
|
"wrong-username-password-shape",
|
||||||
|
SecretKind::UsernamePassword,
|
||||||
|
json!({"username": "user"}),
|
||||||
|
),
|
||||||
|
] {
|
||||||
|
assert_post_error(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/secrets"),
|
||||||
|
json!({"name": name, "kind": kind, "value": value}),
|
||||||
|
reqwest::StatusCode::BAD_REQUEST,
|
||||||
|
"validation_error",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
assert_post_error(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/secrets"),
|
||||||
|
json!({"name": "oversized-secret", "kind": SecretKind::Generic, "value": "x".repeat(65_537)}),
|
||||||
|
reqwest::StatusCode::BAD_REQUEST,
|
||||||
|
"validation_error",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
for value in [
|
||||||
|
Value::Null,
|
||||||
|
json!({"token": "token", "extra": "field"}),
|
||||||
|
json!("x".repeat(65_537)),
|
||||||
|
] {
|
||||||
|
assert_post_error(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/secrets/{secret_id}/rotate"),
|
||||||
|
json!({"value": value}),
|
||||||
|
reqwest::StatusCode::BAD_REQUEST,
|
||||||
|
"validation_error",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
let current = assert_success_json(
|
||||||
|
client
|
||||||
|
.get(format!("{base_url}/secrets/{secret_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(current["current_version"], 1);
|
||||||
|
|
||||||
|
for payload in [
|
||||||
|
json!({"name": "", "kind": "bearer", "config": {"bearer": {"header_name": "Authorization", "secret_id": secret_id}}}),
|
||||||
|
json!({"name": "n".repeat(129), "kind": "bearer", "config": {"bearer": {"header_name": "Authorization", "secret_id": secret_id}}}),
|
||||||
|
json!({"name": "invalid-header-name", "kind": "bearer", "config": {"bearer": {"header_name": "Bad Header", "secret_id": secret_id}}}),
|
||||||
|
json!({"name": "invalid-query-name", "kind": "api_key_query", "config": {"api_key_query": {"param_name": "bad name", "secret_id": secret_id}}}),
|
||||||
|
] {
|
||||||
|
assert_post_error(
|
||||||
|
&client,
|
||||||
|
format!("{base_url}/auth-profiles"),
|
||||||
|
payload,
|
||||||
|
reqwest::StatusCode::BAD_REQUEST,
|
||||||
|
"validation_error",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn credential_mutations_emit_bounded_non_secret_audit_events() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("credential_lifecycle_audit");
|
||||||
|
let audit_sink = RecordingAuditSink::default();
|
||||||
|
let base_url = spawn_admin_api(build_test_app_with_audit_sink(
|
||||||
|
registry,
|
||||||
|
storage_root,
|
||||||
|
Arc::new(audit_sink.clone()),
|
||||||
|
))
|
||||||
|
.await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
let request_id = "req_credential_audit_1";
|
||||||
|
let traceparent = "00-11111111111111111111111111111111-2222222222222222-01";
|
||||||
|
|
||||||
|
let secret = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/secrets"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"name": "audit-token",
|
||||||
|
"kind": SecretKind::Token,
|
||||||
|
"value": { "token": "audit-secret-canary" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let secret_id = secret["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/secrets/{secret_id}/rotate"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"value": { "token": "audit-rotated-canary" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
let auth_profile = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/auth-profiles"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"name": "audit-profile",
|
||||||
|
"kind": "bearer",
|
||||||
|
"config": {
|
||||||
|
"bearer": {
|
||||||
|
"header_name": "Authorization",
|
||||||
|
"secret_id": secret_id
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let auth_profile_id = auth_profile["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let delete_denied = client
|
||||||
|
.delete(format!("{base_url}/secrets/{secret_id}"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(delete_denied.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
|
||||||
|
let created_agent = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"slug": "credential-audit-agent",
|
||||||
|
"display_name": "Credential Audit Agent",
|
||||||
|
"description": "Agent for credential audit tests.",
|
||||||
|
"instructions": {},
|
||||||
|
"tool_selection_policy": {}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let agent_id = created_agent["agent_id"].as_str().unwrap();
|
||||||
|
let created_key = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"name": "audit-mcp-key",
|
||||||
|
"key_kind": PlatformApiKeyKind::McpClient,
|
||||||
|
"scopes": ["read"]
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let raw_key = created_key["secret"].as_str().unwrap();
|
||||||
|
let key_id = created_key["api_key"]["api_key"]["id"].as_str().unwrap();
|
||||||
|
let duplicate_key = client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"name": "audit-mcp-key",
|
||||||
|
"key_kind": PlatformApiKeyKind::McpClient,
|
||||||
|
"scopes": ["read"]
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(duplicate_key.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let validation_key = client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"name": "n".repeat(129),
|
||||||
|
"key_kind": PlatformApiKeyKind::McpClient,
|
||||||
|
"scopes": ["read"]
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(validation_key.status(), reqwest::StatusCode::BAD_REQUEST);
|
||||||
|
let invalid_profile = client
|
||||||
|
.post(format!("{base_url}/auth-profiles"))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.json(&json!({
|
||||||
|
"name": "audit-invalid-profile",
|
||||||
|
"kind": "bearer",
|
||||||
|
"config": {
|
||||||
|
"bearer": {
|
||||||
|
"header_name": "Authorization",
|
||||||
|
"secret_id": "secret_missing_for_audit"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(invalid_profile.status(), reqwest::StatusCode::NOT_FOUND);
|
||||||
|
client
|
||||||
|
.post(format!(
|
||||||
|
"{base_url}/agents/{agent_id}/platform-api-keys/{key_id}/revoke"
|
||||||
|
))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let delete_response = client
|
||||||
|
.delete(format!(
|
||||||
|
"{base_url}/agents/{agent_id}/platform-api-keys/{key_id}"
|
||||||
|
))
|
||||||
|
.header("x-request-id", request_id)
|
||||||
|
.header("traceparent", traceparent)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(delete_response.status(), reqwest::StatusCode::NO_CONTENT);
|
||||||
|
|
||||||
|
let listed_after_delete = assert_success_json(
|
||||||
|
client
|
||||||
|
.get(format!("{base_url}/agents/{agent_id}/platform-api-keys"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let deleted_metadata = listed_after_delete["items"]
|
||||||
|
.as_array()
|
||||||
|
.unwrap()
|
||||||
|
.iter()
|
||||||
|
.find(|item| item["api_key"]["id"] == key_id)
|
||||||
|
.expect("delete must preserve key metadata for provenance");
|
||||||
|
assert_eq!(deleted_metadata["api_key"]["status"], "deleted");
|
||||||
|
let listed_after_delete_text = serde_json::to_string(&listed_after_delete).unwrap();
|
||||||
|
assert!(!listed_after_delete_text.contains(raw_key));
|
||||||
|
|
||||||
|
let events = audit_sink.events();
|
||||||
|
let actions: Vec<&str> = events.iter().map(|event| event.action.as_str()).collect();
|
||||||
|
for expected in [
|
||||||
|
"credential.secret.created",
|
||||||
|
"credential.secret.rotated",
|
||||||
|
"credential.auth_profile.created",
|
||||||
|
"credential.secret.delete_denied",
|
||||||
|
"credential.platform_api_key.created",
|
||||||
|
"credential.platform_api_key.create_failed",
|
||||||
|
"credential.auth_profile.create_failed",
|
||||||
|
"credential.platform_api_key.revoked",
|
||||||
|
"credential.platform_api_key.deleted",
|
||||||
|
] {
|
||||||
|
assert!(
|
||||||
|
actions.contains(&expected),
|
||||||
|
"missing audit action {expected}"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
let audit_json = serde_json::to_string(&events).unwrap();
|
||||||
|
assert!(audit_json.contains(request_id));
|
||||||
|
assert!(audit_json.contains("11111111111111111111111111111111"));
|
||||||
|
assert!(audit_json.contains(auth_profile_id));
|
||||||
|
assert!(!audit_json.contains("audit-secret-canary"));
|
||||||
|
assert!(!audit_json.contains("audit-rotated-canary"));
|
||||||
|
assert!(!audit_json.contains(raw_key));
|
||||||
|
assert!(!audit_json.contains("secret_hash"));
|
||||||
|
assert!(!audit_json.contains("ciphertext"));
|
||||||
|
assert!(!audit_json.contains("Bearer "));
|
||||||
|
|
||||||
|
for event in &events {
|
||||||
|
let reason = event.payload["reason"]
|
||||||
|
.as_str()
|
||||||
|
.expect("credential audit events must contain a reason code");
|
||||||
|
assert!(!reason.is_empty());
|
||||||
|
assert!(reason.len() <= 128, "audit reason must remain bounded");
|
||||||
|
}
|
||||||
|
assert!(events.iter().any(|event| {
|
||||||
|
event.action == "credential.platform_api_key.create_failed"
|
||||||
|
&& event.payload["reason"] == "validation_error"
|
||||||
|
}));
|
||||||
|
assert!(events.iter().any(|event| {
|
||||||
|
event.action == "credential.platform_api_key.create_failed"
|
||||||
|
&& event.payload["reason"] == "platform_api_key_name_conflict"
|
||||||
|
}));
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn disabled_secret_fails_closed_for_reference_rotation_and_execution() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let registry_control = registry.clone();
|
||||||
|
let storage_root = test_storage_root("credential_lifecycle_disabled_secret");
|
||||||
|
let (upstream_base_url, observed_authorizations) = spawn_auth_capture_upstream().await;
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let secret = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/secrets"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "disabled-token",
|
||||||
|
"kind": SecretKind::Token,
|
||||||
|
"value": { "token": "disabled-secret-canary" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let secret_id = secret["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let auth_profile = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/auth-profiles"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "disabled-profile",
|
||||||
|
"kind": "bearer",
|
||||||
|
"config": {
|
||||||
|
"bearer": {
|
||||||
|
"header_name": "Authorization",
|
||||||
|
"secret_id": secret_id
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let auth_profile_id = auth_profile["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let mut operation_payload = serde_json::to_value(test_operation_payload(
|
||||||
|
&upstream_base_url,
|
||||||
|
"disabled_secret_execution",
|
||||||
|
))
|
||||||
|
.unwrap();
|
||||||
|
operation_payload["execution_config"]["auth_profile_ref"] = json!(auth_profile_id);
|
||||||
|
let created_operation = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&operation_payload)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let operation_id = created_operation["operation_id"].as_str().unwrap();
|
||||||
|
|
||||||
|
sqlx::query("update secrets set status = 'disabled' where id = $1")
|
||||||
|
.bind(secret_id)
|
||||||
|
.execute(registry_control.pool())
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let ref_disabled = client
|
||||||
|
.post(format!("{base_url}/auth-profiles"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "disabled-profile-new-ref",
|
||||||
|
"kind": "bearer",
|
||||||
|
"config": {
|
||||||
|
"bearer": {
|
||||||
|
"header_name": "Authorization",
|
||||||
|
"secret_id": secret_id
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(ref_disabled.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let ref_disabled_body: Value =
|
||||||
|
serde_json::from_str(&ref_disabled.text().await.unwrap()).unwrap();
|
||||||
|
assert_eq!(ref_disabled_body["error"]["code"], "secret_not_active");
|
||||||
|
|
||||||
|
let rotate_disabled = client
|
||||||
|
.post(format!("{base_url}/secrets/{secret_id}/rotate"))
|
||||||
|
.json(&json!({
|
||||||
|
"value": { "token": "should-not-rotate" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(rotate_disabled.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let rotate_body: Value = serde_json::from_str(&rotate_disabled.text().await.unwrap()).unwrap();
|
||||||
|
assert_eq!(rotate_body["error"]["code"], "secret_not_active");
|
||||||
|
|
||||||
|
let test_run = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
|
||||||
|
.json(&json!({
|
||||||
|
"version": 1,
|
||||||
|
"input": { "email": "disabled@example.com" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(test_run["ok"], false);
|
||||||
|
let body = serde_json::to_string(&test_run).unwrap();
|
||||||
|
assert!(!body.contains("disabled-secret-canary"));
|
||||||
|
assert!(observed_authorizations.lock().unwrap().is_empty());
|
||||||
|
|
||||||
|
let operation_get = client
|
||||||
|
.get(format!("{base_url}/operations/{operation_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let operation_etag = operation_get
|
||||||
|
.headers()
|
||||||
|
.get(reqwest::header::ETAG)
|
||||||
|
.unwrap()
|
||||||
|
.to_str()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned();
|
||||||
|
let publish_disabled = client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
||||||
|
.header(reqwest::header::IF_MATCH, operation_etag)
|
||||||
|
.json(&json!({ "version": 1 }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(publish_disabled.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let publish_body: Value =
|
||||||
|
serde_json::from_str(&publish_disabled.text().await.unwrap()).unwrap();
|
||||||
|
assert_eq!(publish_body["error"]["code"], "secret_not_active");
|
||||||
|
assert!(observed_authorizations.lock().unwrap().is_empty());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn concurrent_secret_rotation_serializes_versions_without_storage_conflict() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("credential_lifecycle_concurrent_rotation");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let secret = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/secrets"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "concurrent-token",
|
||||||
|
"kind": SecretKind::Token,
|
||||||
|
"value": { "token": "initial-concurrent-token" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let secret_id = secret["id"].as_str().unwrap().to_owned();
|
||||||
|
|
||||||
|
let first = client
|
||||||
|
.post(format!("{base_url}/secrets/{secret_id}/rotate"))
|
||||||
|
.json(&json!({ "value": { "token": "concurrent-token-a" } }))
|
||||||
|
.send();
|
||||||
|
let second = client
|
||||||
|
.post(format!("{base_url}/secrets/{secret_id}/rotate"))
|
||||||
|
.json(&json!({ "value": { "token": "concurrent-token-b" } }))
|
||||||
|
.send();
|
||||||
|
let (first, second) = tokio::join!(first, second);
|
||||||
|
let first = assert_success_json(first.unwrap()).await;
|
||||||
|
let second = assert_success_json(second.unwrap()).await;
|
||||||
|
assert!(first["current_version"].as_u64().unwrap() >= 2);
|
||||||
|
assert!(second["current_version"].as_u64().unwrap() >= 2);
|
||||||
|
let current = assert_success_json(
|
||||||
|
client
|
||||||
|
.get(format!("{base_url}/secrets/{secret_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(current["current_version"], 3);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn auth_profile_secret_rotation_changes_next_admin_test_execution() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("credential_lifecycle_rotation");
|
||||||
|
let (upstream_base_url, observed_authorizations) = spawn_auth_capture_upstream().await;
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let secret = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/secrets"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "crm-rotating-token",
|
||||||
|
"kind": SecretKind::Token,
|
||||||
|
"value": { "token": "initial-rotation-token" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let secret_id = secret["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let auth_profile = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/auth-profiles"))
|
||||||
|
.json(&json!({
|
||||||
|
"name": "crm-rotating-bearer",
|
||||||
|
"kind": "bearer",
|
||||||
|
"config": {
|
||||||
|
"bearer": {
|
||||||
|
"header_name": "Authorization",
|
||||||
|
"secret_id": secret_id
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let auth_profile_id = auth_profile["id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let mut operation_payload = serde_json::to_value(test_operation_payload(
|
||||||
|
&upstream_base_url,
|
||||||
|
"crm_auth_rotation",
|
||||||
|
))
|
||||||
|
.unwrap();
|
||||||
|
operation_payload["execution_config"]["auth_profile_ref"] = json!(auth_profile_id);
|
||||||
|
let created_operation = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&operation_payload)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let operation_id = created_operation["operation_id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let first_run = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
|
||||||
|
.json(&json!({
|
||||||
|
"version": 1,
|
||||||
|
"input": { "email": "first@example.com" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(first_run["ok"], true);
|
||||||
|
|
||||||
|
let rotated = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/secrets/{secret_id}/rotate"))
|
||||||
|
.json(&json!({
|
||||||
|
"value": { "token": "rotated-rotation-token" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(rotated["current_version"], 2);
|
||||||
|
|
||||||
|
let second_run = assert_success_json(
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
|
||||||
|
.json(&json!({
|
||||||
|
"version": 1,
|
||||||
|
"input": { "email": "second@example.com" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(second_run["ok"], true);
|
||||||
|
|
||||||
|
let captured = observed_authorizations.lock().unwrap().clone();
|
||||||
|
assert_eq!(
|
||||||
|
captured,
|
||||||
|
vec![
|
||||||
|
Some("Bearer initial-rotation-token".to_owned()),
|
||||||
|
Some("Bearer rotated-rotation-token".to_owned())
|
||||||
|
]
|
||||||
|
);
|
||||||
|
|
||||||
|
let auth_profile_after = client
|
||||||
|
.get(format!("{base_url}/auth-profiles/{auth_profile_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(auth_profile_after.contains(secret_id));
|
||||||
|
assert!(!auth_profile_after.contains("initial-rotation-token"));
|
||||||
|
assert!(!auth_profile_after.contains("rotated-rotation-token"));
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn spawn_auth_capture_upstream() -> (String, Arc<Mutex<Vec<Option<String>>>>) {
|
||||||
|
let observed_authorizations = Arc::new(Mutex::new(Vec::new()));
|
||||||
|
let captured = Arc::clone(&observed_authorizations);
|
||||||
|
let app = Router::new().route(
|
||||||
|
"/crm/leads",
|
||||||
|
post(move |headers: HeaderMap| {
|
||||||
|
let captured = Arc::clone(&captured);
|
||||||
|
async move {
|
||||||
|
let authorization = headers
|
||||||
|
.get("authorization")
|
||||||
|
.and_then(|value| value.to_str().ok())
|
||||||
|
.map(str::to_owned);
|
||||||
|
captured.lock().unwrap().push(authorization);
|
||||||
|
Json(json!({ "id": "lead_123" }))
|
||||||
|
}
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||||
|
let address = listener.local_addr().unwrap();
|
||||||
|
tokio::spawn(async move {
|
||||||
|
axum::serve(listener, app).await.unwrap();
|
||||||
|
});
|
||||||
|
|
||||||
|
(format!("http://{address}"), observed_authorizations)
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn assert_error_code(response: reqwest::Response, status: reqwest::StatusCode, code: &str) {
|
||||||
|
assert_eq!(response.status(), status);
|
||||||
|
let body = response.text().await.unwrap();
|
||||||
|
let json: Value = serde_json::from_str(&body).unwrap();
|
||||||
|
assert_eq!(json["error"]["code"], code, "unexpected error body: {body}");
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn post_json(client: &reqwest::Client, url: String, payload: Value) -> Value {
|
||||||
|
assert_success_json(client.post(url).json(&payload).send().await.unwrap()).await
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn create_agent(client: &reqwest::Client, base_url: impl AsRef<str>, slug: &str) -> String {
|
||||||
|
let base_url = base_url.as_ref();
|
||||||
|
post_json(
|
||||||
|
client,
|
||||||
|
format!("{base_url}/agents"),
|
||||||
|
json!({"slug": slug, "display_name": slug, "description": "Credential lifecycle test agent.", "instructions": {}, "tool_selection_policy": {}}),
|
||||||
|
)
|
||||||
|
.await["agent_id"]
|
||||||
|
.as_str()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned()
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn assert_post_error(
|
||||||
|
client: &reqwest::Client,
|
||||||
|
url: String,
|
||||||
|
payload: Value,
|
||||||
|
status: reqwest::StatusCode,
|
||||||
|
code: &str,
|
||||||
|
) {
|
||||||
|
assert_error_code(
|
||||||
|
client.post(url).json(&payload).send().await.unwrap(),
|
||||||
|
status,
|
||||||
|
code,
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
}
|
||||||
@@ -0,0 +1,152 @@
|
|||||||
|
#![allow(dead_code, unused_imports)]
|
||||||
|
|
||||||
|
use super::common::*;
|
||||||
|
|
||||||
|
use serde_json::{Value, json};
|
||||||
|
use serial_test::serial;
|
||||||
|
use time::{Duration, OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn exposes_logs_and_usage_from_real_test_runs() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("observability");
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let created = client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload(
|
||||||
|
&upstream_base_url,
|
||||||
|
"crm_observability",
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let operation_id = created["operation_id"].as_str().unwrap().to_owned();
|
||||||
|
|
||||||
|
client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
|
||||||
|
.json(&json!({
|
||||||
|
"version": 1,
|
||||||
|
"input": { "email": "user@example.com" }
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let logs = client
|
||||||
|
.get(format!("{base_url}/logs?period=7d"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(logs["items"].is_array());
|
||||||
|
assert!(logs.get("next_cursor").is_some());
|
||||||
|
let log_id = logs["items"][0]["log"]["id"].as_str().unwrap().to_owned();
|
||||||
|
let created_at = OffsetDateTime::parse(
|
||||||
|
logs["items"][0]["log"]["created_at"].as_str().unwrap(),
|
||||||
|
&Rfc3339,
|
||||||
|
)
|
||||||
|
.unwrap();
|
||||||
|
let log_detail = client
|
||||||
|
.get(format!("{base_url}/logs/{log_id}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let csv = client
|
||||||
|
.get(format!("{base_url}/logs/export.csv?period=7d&status=ok"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let outcome_logs = client
|
||||||
|
.get(format!("{base_url}/logs?period=7d&outcome_group=success"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let created_after = (created_at - Duration::minutes(1))
|
||||||
|
.format(&Rfc3339)
|
||||||
|
.unwrap();
|
||||||
|
let created_before = (created_at + Duration::minutes(1))
|
||||||
|
.format(&Rfc3339)
|
||||||
|
.unwrap();
|
||||||
|
let usage = client
|
||||||
|
.get(format!("{base_url}/usage?period=7d"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let windowed_usage = client
|
||||||
|
.get(format!(
|
||||||
|
"{base_url}/usage?created_after={created_after}&created_before={created_before}"
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let usage_csv = client
|
||||||
|
.get(format!("{base_url}/usage/export.csv?period=7d"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let operation_usage = client
|
||||||
|
.get(format!(
|
||||||
|
"{base_url}/usage/operations/{operation_id}?period=7d"
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
assert_eq!(logs["items"][0]["log"]["source"], "admin_test_run");
|
||||||
|
assert_eq!(logs["items"][0]["operation_name"], "crm_observability");
|
||||||
|
assert_eq!(log_detail["log"]["status"], "ok");
|
||||||
|
assert_eq!(log_detail["log"]["operation_version"], 1);
|
||||||
|
assert!(log_detail["log"]["request_id"].as_str().is_some());
|
||||||
|
assert!(
|
||||||
|
log_detail["log"]["trace_id"]
|
||||||
|
.as_str()
|
||||||
|
.is_some_and(|value| value.len() == 32)
|
||||||
|
);
|
||||||
|
assert!(csv.starts_with("created_at,level,status,source"));
|
||||||
|
assert!(csv.contains(log_detail["log"]["request_id"].as_str().unwrap()));
|
||||||
|
assert!(csv.contains(log_detail["log"]["trace_id"].as_str().unwrap()));
|
||||||
|
assert_eq!(outcome_logs["items"][0]["log"]["status"], "ok");
|
||||||
|
assert_eq!(usage["summary"]["rollup"]["calls_total"], 1);
|
||||||
|
assert_eq!(usage["summary"]["rollup"]["calls_ok"], 1);
|
||||||
|
assert_eq!(usage["outcomes"][0]["group"], "success");
|
||||||
|
assert_eq!(usage["outcomes"][0]["calls_total"], 1);
|
||||||
|
assert_eq!(windowed_usage["summary"]["rollup"]["calls_total"], 1);
|
||||||
|
assert!(usage_csv.starts_with("kind,name,group,error_code,calls_total"));
|
||||||
|
assert!(usage_csv.contains("operation"));
|
||||||
|
assert!(usage_csv.contains("outcome"));
|
||||||
|
assert_eq!(
|
||||||
|
usage["operations"][0]["operation_name"],
|
||||||
|
"crm_observability"
|
||||||
|
);
|
||||||
|
assert_eq!(operation_usage["rollup"]["calls_total"], 1);
|
||||||
|
}
|
||||||
@@ -0,0 +1,322 @@
|
|||||||
|
#![allow(dead_code, unused_imports)]
|
||||||
|
|
||||||
|
use super::common::*;
|
||||||
|
|
||||||
|
use serde_json::{Value, json};
|
||||||
|
use serial_test::serial;
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn exposes_server_authoritative_onboarding_projection() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("onboarding_projection");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let response = client
|
||||||
|
.get(format!("{base_url}/onboarding"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let status = response.status();
|
||||||
|
let body = response.json::<Value>().await.unwrap();
|
||||||
|
|
||||||
|
assert_eq!(status, reqwest::StatusCode::OK, "body={body}");
|
||||||
|
assert_eq!(body["schema_version"], 1);
|
||||||
|
assert_eq!(body["status"], "in_progress");
|
||||||
|
assert!(body["revision"].as_i64().is_some());
|
||||||
|
assert!(body["eligible_since"].as_str().is_some());
|
||||||
|
assert_eq!(body["workspace_id"], "ws_default");
|
||||||
|
assert_eq!(body["completed"], false);
|
||||||
|
assert_eq!(
|
||||||
|
body["steps"]
|
||||||
|
.as_array()
|
||||||
|
.unwrap()
|
||||||
|
.iter()
|
||||||
|
.map(|step| step["id"].as_str().unwrap())
|
||||||
|
.collect::<Vec<_>>(),
|
||||||
|
vec![
|
||||||
|
"operation",
|
||||||
|
"test",
|
||||||
|
"publish_operation",
|
||||||
|
"agent",
|
||||||
|
"key",
|
||||||
|
"mcp_connection",
|
||||||
|
"first_call",
|
||||||
|
]
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
body["steps"]
|
||||||
|
.as_array()
|
||||||
|
.unwrap()
|
||||||
|
.iter()
|
||||||
|
.all(|step| step["completed"] == false)
|
||||||
|
);
|
||||||
|
assert_eq!(body["steps"][0]["status"], "current");
|
||||||
|
assert!(
|
||||||
|
body["steps"]
|
||||||
|
.as_array()
|
||||||
|
.unwrap()
|
||||||
|
.iter()
|
||||||
|
.skip(1)
|
||||||
|
.all(|step| step["status"] == "pending")
|
||||||
|
);
|
||||||
|
|
||||||
|
// The server-owned eligibility denominator is recorded on the first GET;
|
||||||
|
// a repeat is idempotent and cannot advance browser-owned completion.
|
||||||
|
let repeated = client
|
||||||
|
.get(format!("{base_url}/onboarding"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(repeated["revision"], body["revision"]);
|
||||||
|
assert_eq!(repeated["steps"], body["steps"]);
|
||||||
|
assert_eq!(repeated["eligible_since"], body["eligible_since"]);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn ux_milestones_are_idempotent_and_revision_guarded() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("onboarding_events");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let initial = client
|
||||||
|
.get(format!("{base_url}/onboarding"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let revision = initial["revision"].as_i64().unwrap();
|
||||||
|
let payload = json!({
|
||||||
|
"event": "started",
|
||||||
|
"idempotency_key": "onboarding-start-tab-a",
|
||||||
|
"expected_revision": revision,
|
||||||
|
});
|
||||||
|
|
||||||
|
let first = client
|
||||||
|
.post(format!("{base_url}/onboarding/events"))
|
||||||
|
.json(&payload)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let first_status = first.status();
|
||||||
|
let first = first.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(first_status, reqwest::StatusCode::OK, "body={first}");
|
||||||
|
assert_eq!(first["accepted"], true);
|
||||||
|
let accepted_revision = first["revision"].as_i64().unwrap();
|
||||||
|
assert_ne!(accepted_revision, revision);
|
||||||
|
|
||||||
|
let replay = client
|
||||||
|
.post(format!("{base_url}/onboarding/events"))
|
||||||
|
.json(&payload)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let replay_status = replay.status();
|
||||||
|
let replay = replay.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(replay_status, reqwest::StatusCode::OK, "body={replay}");
|
||||||
|
assert_eq!(replay["accepted"], false);
|
||||||
|
assert_eq!(replay["revision"], accepted_revision);
|
||||||
|
|
||||||
|
let semantic_conflict = client
|
||||||
|
.post(format!("{base_url}/onboarding/events"))
|
||||||
|
.json(&json!({
|
||||||
|
"event": "dismissed",
|
||||||
|
"idempotency_key": "onboarding-start-tab-a",
|
||||||
|
"expected_revision": revision,
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let semantic_conflict_status = semantic_conflict.status();
|
||||||
|
let semantic_conflict = semantic_conflict.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
semantic_conflict_status,
|
||||||
|
reqwest::StatusCode::CONFLICT,
|
||||||
|
"body={semantic_conflict}"
|
||||||
|
);
|
||||||
|
assert_eq!(
|
||||||
|
semantic_conflict["error"]["code"],
|
||||||
|
"onboarding_idempotency_conflict"
|
||||||
|
);
|
||||||
|
|
||||||
|
let current_revision_conflict = client
|
||||||
|
.post(format!("{base_url}/onboarding/events"))
|
||||||
|
.json(&json!({
|
||||||
|
"event": "dismissed",
|
||||||
|
"idempotency_key": "onboarding-start-tab-a",
|
||||||
|
"expected_revision": accepted_revision,
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let current_revision_conflict_status = current_revision_conflict.status();
|
||||||
|
let current_revision_conflict = current_revision_conflict.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
current_revision_conflict_status,
|
||||||
|
reqwest::StatusCode::CONFLICT,
|
||||||
|
"body={current_revision_conflict}"
|
||||||
|
);
|
||||||
|
assert_eq!(
|
||||||
|
current_revision_conflict["error"]["code"],
|
||||||
|
"onboarding_idempotency_conflict"
|
||||||
|
);
|
||||||
|
|
||||||
|
let stale = client
|
||||||
|
.post(format!("{base_url}/onboarding/events"))
|
||||||
|
.json(&json!({
|
||||||
|
"event": "dismissed",
|
||||||
|
"idempotency_key": "onboarding-dismiss-tab-b",
|
||||||
|
"expected_revision": revision,
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let stale_status = stale.status();
|
||||||
|
let stale = stale.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(stale_status, reqwest::StatusCode::CONFLICT, "body={stale}");
|
||||||
|
assert_eq!(stale["error"]["code"], "onboarding_stale_revision");
|
||||||
|
|
||||||
|
for payload in [
|
||||||
|
json!({
|
||||||
|
"event": "eligible",
|
||||||
|
"idempotency_key": "forged-eligibility",
|
||||||
|
"expected_revision": accepted_revision,
|
||||||
|
}),
|
||||||
|
json!({
|
||||||
|
"event": "completed",
|
||||||
|
"idempotency_key": "forged-completion",
|
||||||
|
"expected_revision": accepted_revision,
|
||||||
|
}),
|
||||||
|
json!({
|
||||||
|
"event": "started",
|
||||||
|
"idempotency_key": "forged-step",
|
||||||
|
"expected_revision": accepted_revision,
|
||||||
|
"completed_steps": ["operation", "first_call"],
|
||||||
|
}),
|
||||||
|
json!({
|
||||||
|
"event": "started",
|
||||||
|
"idempotency_key": "onboarding:completed:v1",
|
||||||
|
"expected_revision": accepted_revision,
|
||||||
|
}),
|
||||||
|
] {
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/onboarding/events"))
|
||||||
|
.json(&payload)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let status = response.status();
|
||||||
|
let body = response.json::<Value>().await.unwrap();
|
||||||
|
|
||||||
|
assert_eq!(
|
||||||
|
status,
|
||||||
|
reqwest::StatusCode::UNPROCESSABLE_ENTITY,
|
||||||
|
"body={body}"
|
||||||
|
);
|
||||||
|
assert_eq!(body["error"]["code"], "onboarding_event_not_allowed");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn direct_presentation_mutation_cannot_precede_server_eligibility() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("onboarding_direct_event");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let direct = client
|
||||||
|
.post(format!("{base_url}/onboarding/events"))
|
||||||
|
.json(&json!({
|
||||||
|
"event": "started",
|
||||||
|
"idempotency_key": "direct-before-snapshot",
|
||||||
|
"expected_revision": 0,
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let direct_status = direct.status();
|
||||||
|
let direct = direct.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
direct_status,
|
||||||
|
reqwest::StatusCode::CONFLICT,
|
||||||
|
"body={direct}"
|
||||||
|
);
|
||||||
|
assert_eq!(direct["error"]["code"], "onboarding_stale_revision");
|
||||||
|
|
||||||
|
let snapshot = client
|
||||||
|
.get(format!("{base_url}/onboarding"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(snapshot["eligible_since"].as_str().is_some());
|
||||||
|
assert_eq!(snapshot["status"], "in_progress");
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn reset_selection_is_explicit_and_revision_guarded() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("onboarding_reset_selection");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let initial = client
|
||||||
|
.get(format!("{base_url}/onboarding"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let revision = initial["revision"].as_i64().unwrap();
|
||||||
|
|
||||||
|
let reset = client
|
||||||
|
.post(format!("{base_url}/onboarding/reset-selection"))
|
||||||
|
.json(&json!({"expected_revision": revision}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let reset_status = reset.status();
|
||||||
|
let reset = reset.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(reset_status, reqwest::StatusCode::OK, "body={reset}");
|
||||||
|
assert_eq!(reset["selection_reset"], true);
|
||||||
|
assert_ne!(reset["revision"], initial["revision"]);
|
||||||
|
assert_eq!(reset["workspace_id"], initial["workspace_id"]);
|
||||||
|
|
||||||
|
let stale = client
|
||||||
|
.post(format!("{base_url}/onboarding/reset-selection"))
|
||||||
|
.json(&json!({"expected_revision": revision}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let stale_status = stale.status();
|
||||||
|
let stale = stale.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(stale_status, reqwest::StatusCode::CONFLICT, "body={stale}");
|
||||||
|
assert_eq!(stale["error"]["code"], "onboarding_stale_revision");
|
||||||
|
|
||||||
|
let forged_selection = client
|
||||||
|
.post(format!("{base_url}/onboarding/reset-selection"))
|
||||||
|
.json(&json!({
|
||||||
|
"expected_revision": reset["revision"],
|
||||||
|
"operation_id": "op_client_selected",
|
||||||
|
}))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
forged_selection.status(),
|
||||||
|
reqwest::StatusCode::UNPROCESSABLE_ENTITY
|
||||||
|
);
|
||||||
|
}
|
||||||
@@ -0,0 +1,412 @@
|
|||||||
|
#![allow(dead_code, unused_imports)]
|
||||||
|
|
||||||
|
use super::common::*;
|
||||||
|
|
||||||
|
use serde_json::Value;
|
||||||
|
use serial_test::serial;
|
||||||
|
|
||||||
|
const WORKSPACE_ID: &str = "ws_default";
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn portable_yaml_v2_is_redacted_and_semantic_replay_is_a_noop() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("operation-yaml-v2");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
let created = client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload("http://127.0.0.1:9", "portable_v2"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let operation_id = created["operation_id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let yaml = client
|
||||||
|
.get(format!("{base_url}/operations/{operation_id}/export"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(yaml.contains("format_version: '2'") || yaml.contains("format_version: 2"));
|
||||||
|
let parsed: serde_yaml::Value = serde_yaml::from_str(&yaml).unwrap();
|
||||||
|
let operation = parsed["operation"].as_mapping().unwrap();
|
||||||
|
for forbidden in ["id", "status", "created_at", "wizard_state", "samples"] {
|
||||||
|
assert!(!operation.contains_key(serde_yaml::Value::String(forbidden.to_owned())));
|
||||||
|
}
|
||||||
|
|
||||||
|
let replay = client
|
||||||
|
.post(format!("{base_url}/operations/import?mode=upsert"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(yaml.clone())
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(replay["operation_id"], operation_id);
|
||||||
|
assert_eq!(replay["version"], 1);
|
||||||
|
|
||||||
|
let changed_yaml = yaml.replace(
|
||||||
|
"display_name: Create Lead",
|
||||||
|
"display_name: Portable Changed",
|
||||||
|
);
|
||||||
|
assert_ne!(changed_yaml, yaml);
|
||||||
|
let missing = client
|
||||||
|
.post(format!("{base_url}/operations/import?mode=upsert"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(changed_yaml.clone())
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(missing.status(), reqwest::StatusCode::PRECONDITION_REQUIRED);
|
||||||
|
let missing = missing.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(missing["error"]["code"], "operation_precondition_required");
|
||||||
|
|
||||||
|
let changed = client
|
||||||
|
.post(format!("{base_url}/operations/import?mode=upsert"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, operation_id).await,
|
||||||
|
)
|
||||||
|
.body(changed_yaml)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(changed.status(), reqwest::StatusCode::OK);
|
||||||
|
let changed = changed.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(changed["version"], 2);
|
||||||
|
|
||||||
|
let current_yaml = client
|
||||||
|
.get(format!("{base_url}/operations/{operation_id}/export"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let archived = client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/archive"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, operation_id).await,
|
||||||
|
)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(archived.status().is_success());
|
||||||
|
let replay = client
|
||||||
|
.post(format!("{base_url}/operations/import?mode=upsert"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(current_yaml)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(replay.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
assert!(replay.text().await.unwrap().contains("operation_archived"));
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn hostile_and_oversized_yaml_fail_before_mutation_without_echoing_canary() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("operation-yaml-hostile");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry.clone(), storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
let canary = "yaml-secret-canary-never-reflect";
|
||||||
|
let hostile = format!(
|
||||||
|
"format_version: '2'\nkind: operation\noperation:\n name: bad\n unknown_secret: {canary}\n"
|
||||||
|
);
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/operations/import"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(hostile)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
let body = response.text().await.unwrap();
|
||||||
|
assert!(!body.contains(canary));
|
||||||
|
assert!(body.contains("operation_yaml_invalid"));
|
||||||
|
let body: Value = serde_json::from_str(&body).unwrap();
|
||||||
|
assert_eq!(body["error"]["code"], "operation_yaml_invalid");
|
||||||
|
|
||||||
|
let oversized = "x".repeat(256 * 1024 + 1);
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/operations/import"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(oversized)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::PAYLOAD_TOO_LARGE);
|
||||||
|
let count = registry
|
||||||
|
.list_operations(&crank_core::WorkspaceId::new(WORKSPACE_ID))
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.len();
|
||||||
|
assert_eq!(count, 0);
|
||||||
|
|
||||||
|
let alias = "format_version: '2'\nkind: operation\noperation: &shared\n name: alias\n";
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/operations/import"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(alias)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
assert!(
|
||||||
|
response
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.contains("operation_yaml_unsupported")
|
||||||
|
);
|
||||||
|
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/operations/import"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(vec![0xff, 0xfe, 0xfd])
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
assert!(
|
||||||
|
response
|
||||||
|
.text()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.contains("operation_yaml_invalid")
|
||||||
|
);
|
||||||
|
|
||||||
|
let mut credential_payload = serde_json::to_value(test_operation_payload(
|
||||||
|
"http://127.0.0.1:9",
|
||||||
|
"portable_credential_header",
|
||||||
|
))
|
||||||
|
.unwrap();
|
||||||
|
credential_payload["target"]["static_headers"]["X-Auth-Token"] =
|
||||||
|
Value::String("credential-canary".to_owned());
|
||||||
|
let created = client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&credential_payload)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let credential_operation_id = created["operation_id"].as_str().unwrap();
|
||||||
|
let response = client
|
||||||
|
.get(format!(
|
||||||
|
"{base_url}/operations/{credential_operation_id}/export"
|
||||||
|
))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
assert!(!response.text().await.unwrap().contains("credential-canary"));
|
||||||
|
|
||||||
|
let mut portable = serde_json::to_value(test_operation_payload(
|
||||||
|
"http://127.0.0.1:9",
|
||||||
|
"unknown_nested_yaml",
|
||||||
|
))
|
||||||
|
.unwrap();
|
||||||
|
portable.as_object_mut().unwrap().remove("wizard_state");
|
||||||
|
portable["target"]["unknown_nested"] = Value::String(canary.to_owned());
|
||||||
|
let document = serde_yaml::to_string(&serde_json::json!({
|
||||||
|
"format_version": "2",
|
||||||
|
"kind": "operation",
|
||||||
|
"operation": portable
|
||||||
|
}))
|
||||||
|
.unwrap();
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/operations/import"))
|
||||||
|
.header("content-type", "application/yaml")
|
||||||
|
.body(document)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
assert!(!response.text().await.unwrap().contains(canary));
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn operation_mutations_require_identity_bound_etags_and_versions_are_stable() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("operation-etag");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
|
||||||
|
let first = client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload("http://127.0.0.1:9", "etag_first"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let second = client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload("http://127.0.0.1:9", "etag_second"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let first_id = first["operation_id"].as_str().unwrap();
|
||||||
|
let second_id = second["operation_id"].as_str().unwrap();
|
||||||
|
|
||||||
|
let missing = client
|
||||||
|
.post(format!("{base_url}/operations/{first_id}/archive"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(missing.status(), reqwest::StatusCode::PRECONDITION_REQUIRED);
|
||||||
|
let missing = missing.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(missing["error"]["code"], "operation_precondition_required");
|
||||||
|
|
||||||
|
let first_etag = operation_etag(&client, &base_url, first_id).await;
|
||||||
|
let replay = client
|
||||||
|
.post(format!("{base_url}/operations/{second_id}/archive"))
|
||||||
|
.header(reqwest::header::IF_MATCH, first_etag)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(replay.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let replay = replay.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(replay["error"]["code"], "operation_stale_version");
|
||||||
|
|
||||||
|
let v1 = client
|
||||||
|
.get(format!("{base_url}/operations/{first_id}/versions/1"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(v1.status(), reqwest::StatusCode::OK);
|
||||||
|
let v1_etag = v1.headers()[reqwest::header::ETAG]
|
||||||
|
.to_str()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned();
|
||||||
|
let mut update =
|
||||||
|
serde_json::to_value(test_operation_payload("http://127.0.0.1:9", "etag_first")).unwrap();
|
||||||
|
update["display_name"] = Value::String("Changed Draft".to_owned());
|
||||||
|
let updated = client
|
||||||
|
.patch(format!("{base_url}/operations/{first_id}"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, first_id).await,
|
||||||
|
)
|
||||||
|
.json(&update)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(updated.status(), reqwest::StatusCode::OK);
|
||||||
|
|
||||||
|
let v1_after = client
|
||||||
|
.get(format!("{base_url}/operations/{first_id}/versions/1"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(v1_after.status(), reqwest::StatusCode::OK);
|
||||||
|
assert_eq!(
|
||||||
|
v1_after.headers()[reqwest::header::ETAG].to_str().unwrap(),
|
||||||
|
v1_etag
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn same_etag_concurrent_patches_have_exactly_one_winner() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("operation-etag-race");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry.clone(), storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
let created = client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&test_operation_payload("http://127.0.0.1:9", "etag_race"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let operation_id = created["operation_id"].as_str().unwrap();
|
||||||
|
let etag = operation_etag(&client, &base_url, operation_id).await;
|
||||||
|
let mut first =
|
||||||
|
serde_json::to_value(test_operation_payload("http://127.0.0.1:9", "etag_race")).unwrap();
|
||||||
|
first["display_name"] = Value::String("first winner candidate".to_owned());
|
||||||
|
let mut second = first.clone();
|
||||||
|
second["display_name"] = Value::String("second winner candidate".to_owned());
|
||||||
|
let url = format!("{base_url}/operations/{operation_id}");
|
||||||
|
let first_request = client
|
||||||
|
.patch(&url)
|
||||||
|
.header(reqwest::header::IF_MATCH, &etag)
|
||||||
|
.json(&first)
|
||||||
|
.send();
|
||||||
|
let second_request = client
|
||||||
|
.patch(&url)
|
||||||
|
.header(reqwest::header::IF_MATCH, &etag)
|
||||||
|
.json(&second)
|
||||||
|
.send();
|
||||||
|
let (first_response, second_response) = tokio::join!(first_request, second_request);
|
||||||
|
let statuses = [
|
||||||
|
first_response.unwrap().status(),
|
||||||
|
second_response.unwrap().status(),
|
||||||
|
];
|
||||||
|
assert_eq!(
|
||||||
|
statuses.iter().filter(|status| status.is_success()).count(),
|
||||||
|
1
|
||||||
|
);
|
||||||
|
assert_eq!(
|
||||||
|
statuses
|
||||||
|
.iter()
|
||||||
|
.filter(|status| **status == reqwest::StatusCode::CONFLICT)
|
||||||
|
.count(),
|
||||||
|
1
|
||||||
|
);
|
||||||
|
let summary = registry
|
||||||
|
.get_operation_summary(
|
||||||
|
&crank_core::WorkspaceId::new(WORKSPACE_ID),
|
||||||
|
&crank_core::OperationId::new(operation_id),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(summary.current_draft_version, 2);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
|
#[serial]
|
||||||
|
async fn operation_rejects_unscoped_auth_profile_reference_before_save() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let storage_root = test_storage_root("operation-auth-reference");
|
||||||
|
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
||||||
|
let client = authorized_client(&base_url).await;
|
||||||
|
let mut payload = serde_json::to_value(test_operation_payload(
|
||||||
|
"http://127.0.0.1:9",
|
||||||
|
"missing_auth_profile",
|
||||||
|
))
|
||||||
|
.unwrap();
|
||||||
|
payload["execution_config"]["auth_profile_ref"] =
|
||||||
|
Value::String("auth_foreign_or_missing".to_owned());
|
||||||
|
let response = client
|
||||||
|
.post(format!("{base_url}/operations"))
|
||||||
|
.json(&payload)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
let body = response.text().await.unwrap();
|
||||||
|
assert!(body.contains("operation_auth_profile_invalid"));
|
||||||
|
assert!(!body.contains("auth_foreign_or_missing"));
|
||||||
|
}
|
||||||
@@ -36,7 +36,7 @@ const TEST_AUTH_EMAIL: &str = "owner@crank.local";
|
|||||||
const TEST_AUTH_PASSWORD: &str = "test-password";
|
const TEST_AUTH_PASSWORD: &str = "test-password";
|
||||||
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
||||||
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
||||||
const TEST_MASTER_KEY: &str = "test-master-key";
|
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
|
||||||
|
|
||||||
struct TestServer {
|
struct TestServer {
|
||||||
base_url: String,
|
base_url: String,
|
||||||
@@ -123,15 +123,6 @@ async fn creates_publishes_and_tests_rest_operation() {
|
|||||||
.json::<Value>()
|
.json::<Value>()
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
let published = client
|
|
||||||
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
|
||||||
.json(&json!({ "version": 1 }))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
let test_run_response = client
|
let test_run_response = client
|
||||||
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
|
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
|
||||||
.header("x-request-id", "req_admin_test_run")
|
.header("x-request-id", "req_admin_test_run")
|
||||||
@@ -151,6 +142,19 @@ async fn creates_publishes_and_tests_rest_operation() {
|
|||||||
"0af7651916cd43dd8448eb211c80319c"
|
"0af7651916cd43dd8448eb211c80319c"
|
||||||
);
|
);
|
||||||
let test_run = test_run_response.json::<Value>().await.unwrap();
|
let test_run = test_run_response.json::<Value>().await.unwrap();
|
||||||
|
let published = client
|
||||||
|
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!({ "version": 1 }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
assert_eq!(listed["items"][0]["name"], "crm_create_lead");
|
assert_eq!(listed["items"][0]["name"], "crm_create_lead");
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
@@ -160,20 +164,24 @@ async fn creates_publishes_and_tests_rest_operation() {
|
|||||||
assert_eq!(listed["items"][0]["target_action"], "POST");
|
assert_eq!(listed["items"][0]["target_action"], "POST");
|
||||||
assert_eq!(published["published_version"], 1);
|
assert_eq!(published["published_version"], 1);
|
||||||
assert_eq!(test_run["ok"], true);
|
assert_eq!(test_run["ok"], true);
|
||||||
assert_eq!(
|
assert_eq!(test_run["request_preview"]["body_configured"], true);
|
||||||
test_run["request_preview"]["body"]["email"],
|
let safe_preview = test_run["request_preview"].to_string();
|
||||||
"user@example.com"
|
assert!(!safe_preview.contains("user@example.com"));
|
||||||
);
|
|
||||||
assert_eq!(test_run["response_preview"]["id"], "lead_123");
|
assert_eq!(test_run["response_preview"]["id"], "lead_123");
|
||||||
let logs = registry
|
let logs = registry
|
||||||
.list_invocation_logs(crank_registry::ListInvocationLogsQuery {
|
.list_invocation_logs(crank_registry::ListInvocationLogsQuery {
|
||||||
workspace_id: &WorkspaceId::new(DEFAULT_WORKSPACE_ID),
|
workspace_id: &WorkspaceId::new(DEFAULT_WORKSPACE_ID),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(crank_core::InvocationSource::AdminTestRun),
|
source: Some(crank_core::InvocationSource::AdminTestRun),
|
||||||
operation_id: Some(&crank_core::OperationId::new(&operation_id)),
|
operation_id: Some(&crank_core::OperationId::new(&operation_id)),
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
@@ -267,6 +275,10 @@ async fn updates_archives_and_deletes_operation() {
|
|||||||
|
|
||||||
let updated = client
|
let updated = client
|
||||||
.patch(format!("{base_url}/operations/{operation_id}"))
|
.patch(format!("{base_url}/operations/{operation_id}"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
.json(&json!({
|
.json(&json!({
|
||||||
"display_name": "Create Lead Updated",
|
"display_name": "Create Lead Updated",
|
||||||
"category": "marketing",
|
"category": "marketing",
|
||||||
@@ -350,6 +362,10 @@ async fn updates_archives_and_deletes_operation() {
|
|||||||
|
|
||||||
let archived = client
|
let archived = client
|
||||||
.post(format!("{base_url}/operations/{operation_id}/archive"))
|
.post(format!("{base_url}/operations/{operation_id}/archive"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
.unwrap()
|
.unwrap()
|
||||||
@@ -360,29 +376,29 @@ async fn updates_archives_and_deletes_operation() {
|
|||||||
|
|
||||||
let deleted = client
|
let deleted = client
|
||||||
.delete(format!("{base_url}/operations/{operation_id}"))
|
.delete(format!("{base_url}/operations/{operation_id}"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(deleted.status(), reqwest::StatusCode::CONFLICT);
|
||||||
|
let deleted = deleted.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
deleted["error"]["context"]["error_code"],
|
||||||
|
"operation_delete_forbidden"
|
||||||
|
);
|
||||||
|
|
||||||
|
let retained = client
|
||||||
|
.get(format!("{base_url}/operations/{operation_id}"))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
.unwrap()
|
.unwrap()
|
||||||
.json::<Value>()
|
.json::<Value>()
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
assert_eq!(deleted["operation_id"], operation_id);
|
assert_eq!(retained["status"], "archived");
|
||||||
|
|
||||||
let missing = client
|
|
||||||
.get(format!("{base_url}/operations/{operation_id}"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
let missing_status = missing.status();
|
|
||||||
let missing = missing.json::<Value>().await.unwrap();
|
|
||||||
assert_eq!(missing_status, reqwest::StatusCode::NOT_FOUND);
|
|
||||||
assert_eq!(missing["error"]["code"], "not_found");
|
|
||||||
assert_eq!(
|
|
||||||
missing["error"]["context"],
|
|
||||||
json!({
|
|
||||||
"operation_id": operation_id
|
|
||||||
})
|
|
||||||
);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
@@ -408,6 +424,10 @@ async fn creates_binds_and_publishes_agent() {
|
|||||||
|
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
.json(&json!({ "version": 1 }))
|
.json(&json!({ "version": 1 }))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -432,6 +452,10 @@ async fn creates_binds_and_publishes_agent() {
|
|||||||
|
|
||||||
let bindings = client
|
let bindings = client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!([
|
.json(&json!([
|
||||||
{
|
{
|
||||||
"operation_id": operation_id,
|
"operation_id": operation_id,
|
||||||
@@ -449,6 +473,10 @@ async fn creates_binds_and_publishes_agent() {
|
|||||||
.unwrap();
|
.unwrap();
|
||||||
let published = client
|
let published = client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!({ "version": 1 }))
|
.json(&json!({ "version": 1 }))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -489,6 +517,10 @@ async fn saves_and_previews_versioned_agent_tool_search_policy() {
|
|||||||
assert_success_json(
|
assert_success_json(
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
.json(&json!({"version": 1}))
|
.json(&json!({"version": 1}))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -535,6 +567,10 @@ async fn saves_and_previews_versioned_agent_tool_search_policy() {
|
|||||||
let saved = assert_success_json(
|
let saved = assert_success_json(
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&catalog)
|
.json(&catalog)
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -565,6 +601,10 @@ async fn saves_and_previews_versioned_agent_tool_search_policy() {
|
|||||||
let published = assert_success_json(
|
let published = assert_success_json(
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!({"version": 1}))
|
.json(&json!({"version": 1}))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -576,7 +616,7 @@ async fn saves_and_previews_versioned_agent_tool_search_policy() {
|
|||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
#[serial]
|
#[serial]
|
||||||
async fn agent_publish_skips_draft_operation_bindings_and_preserves_draft() {
|
async fn agent_binding_rejects_draft_operation_before_publish() {
|
||||||
let registry = test_registry().await;
|
let registry = test_registry().await;
|
||||||
let storage_root = test_storage_root("agent_publish_filters_drafts");
|
let storage_root = test_storage_root("agent_publish_filters_drafts");
|
||||||
let upstream_base_url = spawn_upstream_server().await;
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
@@ -604,6 +644,10 @@ async fn agent_publish_skips_draft_operation_bindings_and_preserves_draft() {
|
|||||||
.post(format!(
|
.post(format!(
|
||||||
"{base_url}/operations/{published_operation_id}/publish"
|
"{base_url}/operations/{published_operation_id}/publish"
|
||||||
))
|
))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &published_operation_id).await,
|
||||||
|
)
|
||||||
.json(&json!({ "version": 1 }))
|
.json(&json!({ "version": 1 }))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -642,9 +686,47 @@ async fn agent_publish_skips_draft_operation_bindings_and_preserves_draft() {
|
|||||||
.await;
|
.await;
|
||||||
let agent_id = agent["agent_id"].as_str().unwrap().to_owned();
|
let agent_id = agent["agent_id"].as_str().unwrap().to_owned();
|
||||||
|
|
||||||
|
let rejected = client
|
||||||
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
|
.json(&json!([
|
||||||
|
{
|
||||||
|
"operation_id": published_operation_id,
|
||||||
|
"operation_version": 1,
|
||||||
|
"tool_name": "crm_published_tool",
|
||||||
|
"tool_title": "Published Tool",
|
||||||
|
"tool_description_override": null,
|
||||||
|
"enabled": true
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operation_id": draft_operation_id,
|
||||||
|
"operation_version": 1,
|
||||||
|
"tool_name": "crm_draft_tool",
|
||||||
|
"tool_title": "Draft Tool",
|
||||||
|
"tool_description_override": null,
|
||||||
|
"enabled": true
|
||||||
|
}
|
||||||
|
]))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(rejected.status(), reqwest::StatusCode::UNPROCESSABLE_ENTITY);
|
||||||
|
let rejected_body = rejected.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
rejected_body["error"]["code"],
|
||||||
|
"agent_binding_not_published"
|
||||||
|
);
|
||||||
|
|
||||||
assert_success_json(
|
assert_success_json(
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!([
|
.json(&json!([
|
||||||
{
|
{
|
||||||
"operation_id": published_operation_id,
|
"operation_id": published_operation_id,
|
||||||
@@ -653,14 +735,6 @@ async fn agent_publish_skips_draft_operation_bindings_and_preserves_draft() {
|
|||||||
"tool_title": "Published Tool",
|
"tool_title": "Published Tool",
|
||||||
"tool_description_override": null,
|
"tool_description_override": null,
|
||||||
"enabled": true
|
"enabled": true
|
||||||
},
|
|
||||||
{
|
|
||||||
"operation_id": draft_operation_id,
|
|
||||||
"operation_version": 1,
|
|
||||||
"tool_name": "crm_draft_tool",
|
|
||||||
"tool_title": "Draft Tool",
|
|
||||||
"tool_description_override": null,
|
|
||||||
"enabled": true
|
|
||||||
}
|
}
|
||||||
]))
|
]))
|
||||||
.send()
|
.send()
|
||||||
@@ -672,6 +746,10 @@ async fn agent_publish_skips_draft_operation_bindings_and_preserves_draft() {
|
|||||||
let published = assert_success_json(
|
let published = assert_success_json(
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!({ "version": 1 }))
|
.json(&json!({ "version": 1 }))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -694,24 +772,15 @@ async fn agent_publish_skips_draft_operation_bindings_and_preserves_draft() {
|
|||||||
.unwrap(),
|
.unwrap(),
|
||||||
)
|
)
|
||||||
.await;
|
.await;
|
||||||
let draft_version = assert_success_json(
|
|
||||||
client
|
|
||||||
.get(format!("{base_url}/agents/{agent_id}/versions/2"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
|
|
||||||
assert_eq!(published["published_version"], 1);
|
assert_eq!(published["published_version"], 1);
|
||||||
assert_eq!(agent_detail["current_draft_version"], 2);
|
assert_eq!(agent_detail["current_draft_version"], 1);
|
||||||
assert_eq!(agent_detail["latest_published_version"], 1);
|
assert_eq!(agent_detail["latest_published_version"], 1);
|
||||||
assert_eq!(published_version["bindings"].as_array().unwrap().len(), 1);
|
assert_eq!(published_version["bindings"].as_array().unwrap().len(), 1);
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
published_version["bindings"][0]["operation_id"],
|
published_version["bindings"][0]["operation_id"],
|
||||||
published_operation_id
|
published_operation_id
|
||||||
);
|
);
|
||||||
assert_eq!(draft_version["bindings"].as_array().unwrap().len(), 2);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
#[tokio::test(flavor = "multi_thread")]
|
||||||
@@ -737,6 +806,10 @@ async fn updates_lists_and_deletes_agent() {
|
|||||||
|
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
operation_etag(&client, &base_url, &operation_id).await,
|
||||||
|
)
|
||||||
.json(&json!({ "version": 1 }))
|
.json(&json!({ "version": 1 }))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -761,6 +834,10 @@ async fn updates_lists_and_deletes_agent() {
|
|||||||
|
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!([
|
.json(&json!([
|
||||||
{
|
{
|
||||||
"operation_id": operation_id,
|
"operation_id": operation_id,
|
||||||
@@ -777,6 +854,10 @@ async fn updates_lists_and_deletes_agent() {
|
|||||||
|
|
||||||
client
|
client
|
||||||
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!({ "version": 1 }))
|
.json(&json!({ "version": 1 }))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
@@ -800,6 +881,10 @@ async fn updates_lists_and_deletes_agent() {
|
|||||||
|
|
||||||
let updated = client
|
let updated = client
|
||||||
.patch(format!("{base_url}/agents/{agent_id}"))
|
.patch(format!("{base_url}/agents/{agent_id}"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.json(&json!({
|
.json(&json!({
|
||||||
"slug": "support-escalation",
|
"slug": "support-escalation",
|
||||||
"display_name": "Support Escalation",
|
"display_name": "Support Escalation",
|
||||||
@@ -807,11 +892,17 @@ async fn updates_lists_and_deletes_agent() {
|
|||||||
}))
|
}))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
.unwrap();
|
||||||
assert_eq!(updated["agent_id"], agent_id);
|
assert_eq!(
|
||||||
|
updated.status(),
|
||||||
|
reqwest::StatusCode::CONFLICT,
|
||||||
|
"published Agent summary/slug must not mutate published MCP endpoint identity"
|
||||||
|
);
|
||||||
|
let updated = updated.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
updated["error"]["context"]["error_code"],
|
||||||
|
"agent_published_summary_immutable"
|
||||||
|
);
|
||||||
|
|
||||||
let detail = client
|
let detail = client
|
||||||
.get(format!("{base_url}/agents/{agent_id}"))
|
.get(format!("{base_url}/agents/{agent_id}"))
|
||||||
@@ -821,148 +912,35 @@ async fn updates_lists_and_deletes_agent() {
|
|||||||
.json::<Value>()
|
.json::<Value>()
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
assert_eq!(detail["slug"], "support-escalation");
|
assert_eq!(detail["slug"], "support-team");
|
||||||
assert_eq!(detail["display_name"], "Support Escalation");
|
assert_eq!(detail["display_name"], "Support Team");
|
||||||
assert_eq!(detail["operation_count"], 1);
|
assert_eq!(detail["operation_count"], 1);
|
||||||
assert_eq!(detail["mcp_endpoint"], "/mcp/v1/default/support-escalation");
|
assert_eq!(detail["mcp_endpoint"], "/mcp/v1/default/support-team");
|
||||||
|
|
||||||
let deleted = client
|
let delete_response = client
|
||||||
.delete(format!("{base_url}/agents/{agent_id}"))
|
.delete(format!("{base_url}/agents/{agent_id}"))
|
||||||
|
.header(
|
||||||
|
reqwest::header::IF_MATCH,
|
||||||
|
agent_etag(&client, &base_url, &agent_id).await,
|
||||||
|
)
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
.unwrap();
|
||||||
assert_eq!(deleted["agent_id"], agent_id);
|
assert_eq!(
|
||||||
|
delete_response.status(),
|
||||||
|
reqwest::StatusCode::CONFLICT,
|
||||||
|
"published Agent must not be hard-deleted because immutable versions/history must remain"
|
||||||
|
);
|
||||||
|
let delete_body = delete_response.json::<Value>().await.unwrap();
|
||||||
|
assert_eq!(
|
||||||
|
delete_body["error"]["context"]["error_code"],
|
||||||
|
"agent_delete_forbidden"
|
||||||
|
);
|
||||||
|
|
||||||
let missing = client
|
let still_present = client
|
||||||
.get(format!("{base_url}/agents/{agent_id}"))
|
.get(format!("{base_url}/agents/{agent_id}"))
|
||||||
.send()
|
.send()
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
let missing_status = missing.status();
|
assert_eq!(still_present.status(), reqwest::StatusCode::OK);
|
||||||
let missing = missing.json::<Value>().await.unwrap();
|
|
||||||
assert_eq!(missing_status, reqwest::StatusCode::NOT_FOUND);
|
|
||||||
assert_eq!(missing["error"]["code"], "not_found");
|
|
||||||
assert_eq!(
|
|
||||||
missing["error"]["context"],
|
|
||||||
json!({
|
|
||||||
"agent_id": agent_id
|
|
||||||
})
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[tokio::test(flavor = "multi_thread")]
|
|
||||||
#[serial]
|
|
||||||
async fn unpublishes_and_archives_agent() {
|
|
||||||
let registry = test_registry().await;
|
|
||||||
let storage_root = test_storage_root("agent_statuses");
|
|
||||||
let upstream_base_url = spawn_upstream_server().await;
|
|
||||||
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
|
|
||||||
let client = authorized_client(&base_url).await;
|
|
||||||
|
|
||||||
let operation = assert_success_json(
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/operations"))
|
|
||||||
.json(&test_operation_payload(
|
|
||||||
&upstream_base_url,
|
|
||||||
"crm_create_lead_agent_status",
|
|
||||||
))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
let operation_id = operation["operation_id"].as_str().unwrap().to_owned();
|
|
||||||
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/operations/{operation_id}/publish"))
|
|
||||||
.json(&json!({ "version": 1 }))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
let created = assert_success_json(
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/agents"))
|
|
||||||
.json(&json!({
|
|
||||||
"slug": "sales-routing",
|
|
||||||
"display_name": "Sales Routing",
|
|
||||||
"description": "Routing agent",
|
|
||||||
"instructions": {},
|
|
||||||
"tool_selection_policy": {}
|
|
||||||
}))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
let agent_id = created["agent_id"].as_str().unwrap().to_owned();
|
|
||||||
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/agents/{agent_id}/bindings"))
|
|
||||||
.json(&json!([
|
|
||||||
{
|
|
||||||
"operation_id": operation_id,
|
|
||||||
"operation_version": 1,
|
|
||||||
"tool_name": "crm_create_lead_agent_status",
|
|
||||||
"tool_title": "Create Lead",
|
|
||||||
"tool_description_override": null,
|
|
||||||
"enabled": true
|
|
||||||
}
|
|
||||||
]))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/agents/{agent_id}/publish"))
|
|
||||||
.json(&json!({ "version": 1 }))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
let unpublished = assert_success_json(
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/agents/{agent_id}/unpublish"))
|
|
||||||
.json(&json!({}))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
assert_eq!(unpublished["agent_id"], agent_id);
|
|
||||||
|
|
||||||
let draft_detail = assert_success_json(
|
|
||||||
client
|
|
||||||
.get(format!("{base_url}/agents/{agent_id}"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
assert_eq!(draft_detail["status"], "draft");
|
|
||||||
assert_eq!(draft_detail["latest_published_version"], 1);
|
|
||||||
|
|
||||||
let archived = assert_success_json(
|
|
||||||
client
|
|
||||||
.post(format!("{base_url}/agents/{agent_id}/archive"))
|
|
||||||
.json(&json!({}))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
assert_eq!(archived["agent_id"], agent_id);
|
|
||||||
|
|
||||||
let archived_detail = assert_success_json(
|
|
||||||
client
|
|
||||||
.get(format!("{base_url}/agents/{agent_id}"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
assert_eq!(archived_detail["status"], "archived");
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -36,7 +36,7 @@ const TEST_AUTH_EMAIL: &str = "owner@crank.local";
|
|||||||
const TEST_AUTH_PASSWORD: &str = "test-password";
|
const TEST_AUTH_PASSWORD: &str = "test-password";
|
||||||
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
|
||||||
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
const TEST_SESSION_SECRET: &str = "test-session-secret";
|
||||||
const TEST_MASTER_KEY: &str = "test-master-key";
|
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
|
||||||
|
|
||||||
struct TestServer {
|
struct TestServer {
|
||||||
base_url: String,
|
base_url: String,
|
||||||
@@ -168,7 +168,7 @@ async fn manages_auth_profiles_and_yaml_upsert() {
|
|||||||
secret_id
|
secret_id
|
||||||
);
|
);
|
||||||
assert_eq!(imported["operation_id"], operation_id);
|
assert_eq!(imported["operation_id"], operation_id);
|
||||||
assert_eq!(imported["version"], 2);
|
assert_eq!(imported["version"], 1);
|
||||||
assert_eq!(imported["import_mode"], "upsert");
|
assert_eq!(imported["import_mode"], "upsert");
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -379,7 +379,7 @@ async fn rejects_deleting_secret_referenced_by_auth_profile() {
|
|||||||
let body = response.json::<Value>().await.unwrap();
|
let body = response.json::<Value>().await.unwrap();
|
||||||
|
|
||||||
assert_eq!(status, reqwest::StatusCode::CONFLICT);
|
assert_eq!(status, reqwest::StatusCode::CONFLICT);
|
||||||
assert_eq!(body["error"]["code"], "conflict");
|
assert_eq!(body["error"]["code"], "secret_referenced_by_auth_profile");
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
body["error"]["message"],
|
body["error"]["message"],
|
||||||
format!("secret {secret_id} is referenced by auth profile {auth_profile_id}")
|
format!("secret {secret_id} is referenced by auth profile {auth_profile_id}")
|
||||||
|
|||||||
@@ -1,5 +1,14 @@
|
|||||||
use std::process::{Command, Output};
|
use std::process::{Command, Output};
|
||||||
|
|
||||||
|
use crank_community_auth::{hash_password, verify_password};
|
||||||
|
use crank_core::{Secret, SecretId, SecretKind, SecretStatus, UserSessionId, WorkspaceId};
|
||||||
|
use crank_registry::{
|
||||||
|
CreateSecretRequest, MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresRegistry,
|
||||||
|
};
|
||||||
|
use crank_runtime::SecretCrypto;
|
||||||
|
use serde_json::json;
|
||||||
|
use time::{Duration as TimeDuration, OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
|
|
||||||
fn command(arguments: &[&str], database_url: Option<&str>) -> Output {
|
fn command(arguments: &[&str], database_url: Option<&str>) -> Output {
|
||||||
let mut command = Command::new(env!("CARGO_BIN_EXE_crank-migrate"));
|
let mut command = Command::new(env!("CARGO_BIN_EXE_crank-migrate"));
|
||||||
command.args(arguments);
|
command.args(arguments);
|
||||||
@@ -16,6 +25,10 @@ fn command(arguments: &[&str], database_url: Option<&str>) -> Output {
|
|||||||
command.output().expect("migration command must run")
|
command.output().expect("migration command must run")
|
||||||
}
|
}
|
||||||
|
|
||||||
|
fn timestamp(value: &str) -> OffsetDateTime {
|
||||||
|
OffsetDateTime::parse(value, &Rfc3339).unwrap()
|
||||||
|
}
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
fn plan_is_deterministic_and_committed_contract_is_current() {
|
fn plan_is_deterministic_and_committed_contract_is_current() {
|
||||||
let first = command(&["plan"], None);
|
let first = command(&["plan"], None);
|
||||||
@@ -27,7 +40,7 @@ fn plan_is_deterministic_and_committed_contract_is_current() {
|
|||||||
);
|
);
|
||||||
assert_eq!(first.stdout, second.stdout);
|
assert_eq!(first.stdout, second.stdout);
|
||||||
let plan: serde_json::Value = serde_json::from_slice(&first.stdout).unwrap();
|
let plan: serde_json::Value = serde_json::from_slice(&first.stdout).unwrap();
|
||||||
assert_eq!(plan["sequence"].as_array().unwrap().len(), 3);
|
assert_eq!(plan["sequence"].as_array().unwrap().len(), 11);
|
||||||
|
|
||||||
let checked = command(&["plan", "--check"], None);
|
let checked = command(&["plan", "--check"], None);
|
||||||
assert!(
|
assert!(
|
||||||
@@ -69,7 +82,147 @@ async fn database_only_config_can_apply_and_preflight_a_fresh_schema() {
|
|||||||
);
|
);
|
||||||
let result: serde_json::Value = serde_json::from_slice(&preflight.stdout).unwrap();
|
let result: serde_json::Value = serde_json::from_slice(&preflight.stdout).unwrap();
|
||||||
assert_eq!(result["status"], "current");
|
assert_eq!(result["status"], "current");
|
||||||
assert_eq!(result["version"], 3);
|
assert_eq!(result["version"], 11);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn admin_auth_bootstrap_create_outputs_bootstrap_secret_without_service_secrets() {
|
||||||
|
let database_url =
|
||||||
|
crank_test_support::postgres_schema_url("test_migration_admin_auth_bootstrap").await;
|
||||||
|
assert!(command(&["apply"], Some(&database_url)).status.success());
|
||||||
|
|
||||||
|
let created = command(
|
||||||
|
&[
|
||||||
|
"admin-auth",
|
||||||
|
"bootstrap-create",
|
||||||
|
"--email",
|
||||||
|
"operator@example.local",
|
||||||
|
"--display-name",
|
||||||
|
"Local Operator",
|
||||||
|
"--ttl-seconds",
|
||||||
|
"900",
|
||||||
|
],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
created.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&created.stderr)
|
||||||
|
);
|
||||||
|
let payload: serde_json::Value = serde_json::from_slice(&created.stdout).unwrap();
|
||||||
|
assert_eq!(payload["status"], "bootstrap_created");
|
||||||
|
assert!(
|
||||||
|
payload["contract_id"]
|
||||||
|
.as_str()
|
||||||
|
.unwrap()
|
||||||
|
.starts_with("boot_")
|
||||||
|
);
|
||||||
|
assert!(payload["bootstrap_token"].as_str().unwrap().len() >= 32);
|
||||||
|
let stdout = String::from_utf8(created.stdout).unwrap();
|
||||||
|
assert!(!stdout.contains("CRANK_SESSION_SECRET"));
|
||||||
|
assert!(!stdout.contains("CRANK_PASSWORD_PEPPER"));
|
||||||
|
|
||||||
|
let duplicate = command(
|
||||||
|
&[
|
||||||
|
"admin-auth",
|
||||||
|
"bootstrap-create",
|
||||||
|
"--email",
|
||||||
|
"operator@example.local",
|
||||||
|
],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(!duplicate.status.success());
|
||||||
|
let diagnostic: serde_json::Value = serde_json::from_slice(&duplicate.stderr).unwrap();
|
||||||
|
assert_eq!(diagnostic["code"], "admin_bootstrap_unavailable");
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn admin_auth_recovery_requires_master_key_and_revokes_sessions_without_secret_output() {
|
||||||
|
let database_url =
|
||||||
|
crank_test_support::postgres_schema_url("test_migration_admin_auth_recovery").await;
|
||||||
|
assert!(command(&["apply"], Some(&database_url)).status.success());
|
||||||
|
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||||
|
let now = timestamp("2026-08-21T00:00:00Z");
|
||||||
|
let master_key = "recovery-master-key-CANARY_SECRET_VALUE-000000000";
|
||||||
|
let crypto = SecretCrypto::new(master_key).unwrap();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: crypto.master_key_epoch(),
|
||||||
|
fingerprint: crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &now,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let pepper = "recovery-pepper-CANARY_SECRET_VALUE";
|
||||||
|
let old_password = "old-recovery-password-CANARY_SECRET_VALUE";
|
||||||
|
let old_hash = hash_password(old_password, pepper).unwrap();
|
||||||
|
let user_id = registry
|
||||||
|
.upsert_bootstrap_user("recover@example.local", "Recover Operator", &old_hash)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let session_id = UserSessionId::new("session_recovery_cli");
|
||||||
|
registry
|
||||||
|
.create_user_session(
|
||||||
|
&session_id,
|
||||||
|
&user_id,
|
||||||
|
Some(&WorkspaceId::new("ws_default")),
|
||||||
|
"session-secret-hash",
|
||||||
|
None,
|
||||||
|
&(OffsetDateTime::now_utc() + TimeDuration::hours(1)),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let key_dir =
|
||||||
|
std::env::temp_dir().join(format!("crank-admin-auth-recovery-{}", std::process::id()));
|
||||||
|
std::fs::create_dir_all(&key_dir).unwrap();
|
||||||
|
let password_path = key_dir.join("new-password.txt");
|
||||||
|
let pepper_path = key_dir.join("pepper.txt");
|
||||||
|
let master_key_path = key_dir.join("master.key");
|
||||||
|
let new_password = "new-recovery-password-CANARY_SECRET_VALUE";
|
||||||
|
std::fs::write(&password_path, format!("{new_password}\n")).unwrap();
|
||||||
|
std::fs::write(&pepper_path, format!("{pepper}\n")).unwrap();
|
||||||
|
std::fs::write(&master_key_path, format!("{master_key}\n")).unwrap();
|
||||||
|
|
||||||
|
let recovered = command(
|
||||||
|
&[
|
||||||
|
"admin-auth",
|
||||||
|
"recover",
|
||||||
|
"--email",
|
||||||
|
"recover@example.local",
|
||||||
|
"--password-file",
|
||||||
|
password_path.to_str().unwrap(),
|
||||||
|
"--password-pepper-file",
|
||||||
|
pepper_path.to_str().unwrap(),
|
||||||
|
"--master-key-file",
|
||||||
|
master_key_path.to_str().unwrap(),
|
||||||
|
],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
recovered.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&recovered.stderr)
|
||||||
|
);
|
||||||
|
let stdout = String::from_utf8(recovered.stdout).unwrap();
|
||||||
|
assert!(stdout.contains("\"status\":\"admin_recovered\""));
|
||||||
|
assert!(!stdout.contains("CANARY_SECRET_VALUE"));
|
||||||
|
assert!(
|
||||||
|
registry
|
||||||
|
.get_user_session(&session_id, "session-secret-hash")
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.is_none()
|
||||||
|
);
|
||||||
|
let user = registry
|
||||||
|
.get_auth_user_by_email("recover@example.local")
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.unwrap();
|
||||||
|
assert!(verify_password(new_password, pepper, &user.password_hash));
|
||||||
|
assert!(!verify_password(old_password, pepper, &user.password_hash));
|
||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
@@ -88,3 +241,197 @@ async fn migration_error_json_preserves_affected_version() {
|
|||||||
assert_eq!(diagnostic["code"], "checksum_mismatch");
|
assert_eq!(diagnostic["code"], "checksum_mismatch");
|
||||||
assert_eq!(diagnostic["version"], 2);
|
assert_eq!(diagnostic["version"], 2);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn master_key_rotation_command_is_resumable_and_redacted() {
|
||||||
|
let database_url =
|
||||||
|
crank_test_support::postgres_schema_url("test_master_key_rotation_cli").await;
|
||||||
|
assert!(command(&["apply"], Some(&database_url)).status.success());
|
||||||
|
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||||
|
let now = timestamp("2026-08-21T00:00:00Z");
|
||||||
|
let current_key = "current-master-key-cli-canary-0000000000000000";
|
||||||
|
let target_key = "target-master-key-cli-canary-00000000000000000";
|
||||||
|
let current_crypto = SecretCrypto::new(current_key).unwrap();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: 1,
|
||||||
|
fingerprint: current_crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &now,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
insert_secret(®istry, "cli_secret_a", ¤t_crypto, &now).await;
|
||||||
|
insert_secret(®istry, "cli_secret_b", ¤t_crypto, &now).await;
|
||||||
|
|
||||||
|
let key_dir =
|
||||||
|
std::env::temp_dir().join(format!("crank-master-key-rotation-{}", std::process::id()));
|
||||||
|
std::fs::create_dir_all(&key_dir).unwrap();
|
||||||
|
let current_path = key_dir.join("current.key");
|
||||||
|
let target_path = key_dir.join("target.key");
|
||||||
|
std::fs::write(¤t_path, current_key).unwrap();
|
||||||
|
std::fs::write(&target_path, target_key).unwrap();
|
||||||
|
let current_path = current_path.to_string_lossy().to_string();
|
||||||
|
let target_path = target_path.to_string_lossy().to_string();
|
||||||
|
|
||||||
|
let preflight = command(
|
||||||
|
&[
|
||||||
|
"master-key",
|
||||||
|
"preflight",
|
||||||
|
"--current-key-file",
|
||||||
|
¤t_path,
|
||||||
|
"--target-key-file",
|
||||||
|
&target_path,
|
||||||
|
"--backup-ref",
|
||||||
|
"offline-backup-ref",
|
||||||
|
],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
preflight.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&preflight.stderr)
|
||||||
|
);
|
||||||
|
assert_redacted(&preflight, current_key, target_key);
|
||||||
|
let preflight_json: serde_json::Value = serde_json::from_slice(&preflight.stdout).unwrap();
|
||||||
|
assert_eq!(preflight_json["status"], "preflight_ok");
|
||||||
|
assert_eq!(preflight_json["affected_secret_versions"], 2);
|
||||||
|
assert!(
|
||||||
|
registry
|
||||||
|
.master_key_rotation_status()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.rotations
|
||||||
|
.is_empty()
|
||||||
|
);
|
||||||
|
|
||||||
|
let partial = command(
|
||||||
|
&[
|
||||||
|
"master-key",
|
||||||
|
"rotate",
|
||||||
|
"--current-key-file",
|
||||||
|
¤t_path,
|
||||||
|
"--target-key-file",
|
||||||
|
&target_path,
|
||||||
|
"--backup-ref",
|
||||||
|
"offline-backup-ref",
|
||||||
|
"--max-versions",
|
||||||
|
"1",
|
||||||
|
],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
partial.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&partial.stderr)
|
||||||
|
);
|
||||||
|
assert_redacted(&partial, current_key, target_key);
|
||||||
|
let partial_json: serde_json::Value = serde_json::from_slice(&partial.stdout).unwrap();
|
||||||
|
assert_eq!(partial_json["status"], "running");
|
||||||
|
assert_eq!(partial_json["processed_secret_versions"], 1);
|
||||||
|
|
||||||
|
let resumed = command(
|
||||||
|
&[
|
||||||
|
"master-key",
|
||||||
|
"rotate",
|
||||||
|
"--current-key-file",
|
||||||
|
¤t_path,
|
||||||
|
"--target-key-file",
|
||||||
|
&target_path,
|
||||||
|
"--backup-ref",
|
||||||
|
"offline-backup-ref",
|
||||||
|
],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
resumed.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&resumed.stderr)
|
||||||
|
);
|
||||||
|
let resumed_json: serde_json::Value = serde_json::from_slice(&resumed.stdout).unwrap();
|
||||||
|
assert_eq!(resumed_json["status"], "verifying");
|
||||||
|
assert_eq!(resumed_json["processed_secret_versions"], 2);
|
||||||
|
|
||||||
|
let verified = command(
|
||||||
|
&["master-key", "verify", "--target-key-file", &target_path],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
verified.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&verified.stderr)
|
||||||
|
);
|
||||||
|
let verified_json: serde_json::Value = serde_json::from_slice(&verified.stdout).unwrap();
|
||||||
|
assert_eq!(verified_json["status"], "verified");
|
||||||
|
|
||||||
|
let promoted = command(
|
||||||
|
&["master-key", "promote", "--target-key-file", &target_path],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
promoted.status.success(),
|
||||||
|
"{}",
|
||||||
|
String::from_utf8_lossy(&promoted.stderr)
|
||||||
|
);
|
||||||
|
assert_redacted(&promoted, current_key, target_key);
|
||||||
|
let promoted_json: serde_json::Value = serde_json::from_slice(&promoted.stdout).unwrap();
|
||||||
|
assert_eq!(promoted_json["status"], "promoted");
|
||||||
|
assert_eq!(promoted_json["active_epoch"], 2);
|
||||||
|
|
||||||
|
let old_key_rejected = command(
|
||||||
|
&[
|
||||||
|
"master-key",
|
||||||
|
"preflight",
|
||||||
|
"--current-key-file",
|
||||||
|
¤t_path,
|
||||||
|
"--target-key-file",
|
||||||
|
&target_path,
|
||||||
|
],
|
||||||
|
Some(&database_url),
|
||||||
|
);
|
||||||
|
assert!(!old_key_rejected.status.success());
|
||||||
|
assert_redacted(&old_key_rejected, current_key, target_key);
|
||||||
|
let diagnostic: serde_json::Value = serde_json::from_slice(&old_key_rejected.stderr).unwrap();
|
||||||
|
assert_eq!(diagnostic["code"], "master_key_identity_mismatch");
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn insert_secret(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
id: &str,
|
||||||
|
crypto: &SecretCrypto,
|
||||||
|
now: &OffsetDateTime,
|
||||||
|
) {
|
||||||
|
let ciphertext = crypto
|
||||||
|
.encrypt(&json!({ "token": format!("{id}_value") }))
|
||||||
|
.unwrap();
|
||||||
|
let secret = Secret {
|
||||||
|
id: SecretId::new(id),
|
||||||
|
workspace_id: WorkspaceId::new("ws_default"),
|
||||||
|
name: id.to_owned(),
|
||||||
|
kind: SecretKind::Token,
|
||||||
|
status: SecretStatus::Active,
|
||||||
|
current_version: 1,
|
||||||
|
created_at: *now,
|
||||||
|
updated_at: *now,
|
||||||
|
last_used_at: None,
|
||||||
|
};
|
||||||
|
registry
|
||||||
|
.create_secret(CreateSecretRequest {
|
||||||
|
secret: &secret,
|
||||||
|
ciphertext: &ciphertext,
|
||||||
|
key_version: crypto.key_version(),
|
||||||
|
master_key_epoch: crypto.master_key_epoch(),
|
||||||
|
created_by: None,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
}
|
||||||
|
|
||||||
|
fn assert_redacted(output: &Output, current_key: &str, target_key: &str) {
|
||||||
|
let stdout = String::from_utf8_lossy(&output.stdout);
|
||||||
|
let stderr = String::from_utf8_lossy(&output.stderr);
|
||||||
|
assert!(!stdout.contains(current_key));
|
||||||
|
assert!(!stdout.contains(target_key));
|
||||||
|
assert!(!stderr.contains(current_key));
|
||||||
|
assert!(!stderr.contains(target_key));
|
||||||
|
}
|
||||||
|
|||||||
@@ -1,2 +1,4 @@
|
|||||||
#[path = "unit/error.rs"]
|
#[path = "unit/error.rs"]
|
||||||
mod error;
|
mod error;
|
||||||
|
#[path = "unit/execution_parity.rs"]
|
||||||
|
mod execution_parity;
|
||||||
|
|||||||
@@ -1,6 +1,8 @@
|
|||||||
use admin_api::error::{runtime_error_context, runtime_test_failure};
|
use admin_api::error::{
|
||||||
|
execution_test_failure, execution_test_failure_localized, runtime_test_failure,
|
||||||
|
};
|
||||||
|
use crank_core::{CorrelationContext, ExecutionErrorCode, ExecutionFailure, ExecutionLocale};
|
||||||
use crank_runtime::RuntimeError;
|
use crank_runtime::RuntimeError;
|
||||||
use serde_json::json;
|
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
fn runtime_test_failure_includes_structured_context() {
|
fn runtime_test_failure_includes_structured_context() {
|
||||||
@@ -9,23 +11,23 @@ fn runtime_test_failure_includes_structured_context() {
|
|||||||
reason: "must be an object".to_owned(),
|
reason: "must be an object".to_owned(),
|
||||||
});
|
});
|
||||||
|
|
||||||
assert_eq!(payload["code"], "runtime_request_error");
|
assert_eq!(payload["code"], "prepared_request_invalid");
|
||||||
assert_eq!(
|
assert_eq!(payload["stage"], "request_preparation");
|
||||||
payload["context"],
|
assert_eq!(payload["retryability"], "never");
|
||||||
json!({
|
assert_eq!(payload["outcome_certainty"], "certain");
|
||||||
"field": "request.headers"
|
assert!(payload.get("context").is_none());
|
||||||
})
|
|
||||||
);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
fn runtime_error_context_does_not_expose_secret_crypto_details() {
|
fn runtime_error_context_does_not_expose_secret_crypto_details() {
|
||||||
let context = runtime_error_context(&RuntimeError::SecretCrypto {
|
let canary = "story18-secret-crypto-canary";
|
||||||
|
let payload = runtime_test_failure(&RuntimeError::SecretCrypto {
|
||||||
operation: "decode secret envelope",
|
operation: "decode secret envelope",
|
||||||
details: "bad base64".to_owned(),
|
details: canary.to_owned(),
|
||||||
});
|
});
|
||||||
|
|
||||||
assert_eq!(context, None);
|
assert_eq!(payload["code"], "secret_invalid");
|
||||||
|
assert!(!payload.to_string().contains(canary));
|
||||||
}
|
}
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
@@ -35,12 +37,45 @@ fn runtime_test_failure_includes_runtime_overload_context() {
|
|||||||
limit: 16,
|
limit: 16,
|
||||||
});
|
});
|
||||||
|
|
||||||
assert_eq!(payload["code"], "runtime_overloaded");
|
assert_eq!(payload["code"], "execution_overloaded");
|
||||||
assert_eq!(
|
assert_eq!(payload["stage"], "admission");
|
||||||
payload["context"],
|
assert_eq!(payload["retryability"], "after_delay");
|
||||||
json!({
|
assert!(payload.get("context").is_none());
|
||||||
"kind": "window",
|
}
|
||||||
"limit": 16
|
|
||||||
})
|
#[test]
|
||||||
);
|
fn every_execution_code_projects_the_canonical_semantics_without_raw_context() {
|
||||||
|
let canary = "story18-admin-projection-canary";
|
||||||
|
for code in ExecutionErrorCode::ALL {
|
||||||
|
let failure = ExecutionFailure::new(code, CorrelationContext::generate());
|
||||||
|
let payload = execution_test_failure(&failure);
|
||||||
|
assert_eq!(payload["code"], code.as_str());
|
||||||
|
assert_eq!(payload["stage"], code.stage().as_str());
|
||||||
|
assert_eq!(payload["retryability"], code.retryability().as_str());
|
||||||
|
assert_eq!(
|
||||||
|
payload["outcome_certainty"],
|
||||||
|
code.outcome_certainty().as_str()
|
||||||
|
);
|
||||||
|
assert!(!payload["message"].as_str().unwrap_or_default().is_empty());
|
||||||
|
assert!(!payload.to_string().contains(canary));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn confirmation_challenge_is_bounded_and_localized_at_the_admin_boundary() {
|
||||||
|
let failure = ExecutionFailure::new(
|
||||||
|
ExecutionErrorCode::ConfirmationRequired,
|
||||||
|
CorrelationContext::generate(),
|
||||||
|
)
|
||||||
|
.try_with_confirmation("confirmation-capability", 30_000)
|
||||||
|
.unwrap();
|
||||||
|
let payload = execution_test_failure_localized(&failure, ExecutionLocale::Ru);
|
||||||
|
|
||||||
|
assert_eq!(payload["message"], "Операция требует подтверждения.");
|
||||||
|
assert_eq!(
|
||||||
|
payload["context"]["confirmation_token"],
|
||||||
|
"confirmation-capability"
|
||||||
|
);
|
||||||
|
assert_eq!(payload["context"]["expires_in_ms"], 30_000);
|
||||||
|
assert!(!format!("{failure:?}").contains("confirmation-capability"));
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,50 @@
|
|||||||
|
use admin_api::error::execution_test_failure_localized;
|
||||||
|
use crank_community_mcp::tool_error::tool_error_contract_from_failure;
|
||||||
|
use crank_core::{
|
||||||
|
CorrelationContext, ExecutionErrorCode, ExecutionFailure, ExecutionLocale, Retryability,
|
||||||
|
};
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn admin_and_mcp_project_every_execution_failure_with_identical_semantics() {
|
||||||
|
for locale in [ExecutionLocale::En, ExecutionLocale::Ru] {
|
||||||
|
for code in ExecutionErrorCode::ALL {
|
||||||
|
let failure = ExecutionFailure::new(code, CorrelationContext::generate());
|
||||||
|
let admin = execution_test_failure_localized(&failure, locale);
|
||||||
|
let mcp = tool_error_contract_from_failure(&failure, locale);
|
||||||
|
|
||||||
|
assert_eq!(admin["code"], mcp.error_code);
|
||||||
|
assert_eq!(admin["stage"], mcp.stage);
|
||||||
|
assert_eq!(admin["retryability"], mcp.retryability);
|
||||||
|
assert_eq!(admin["outcome_certainty"], mcp.outcome_certainty);
|
||||||
|
assert_eq!(admin["message"], mcp.message);
|
||||||
|
assert_eq!(
|
||||||
|
mcp.recoverable,
|
||||||
|
matches!(
|
||||||
|
code.retryability(),
|
||||||
|
Retryability::Safe
|
||||||
|
| Retryability::AfterDelay
|
||||||
|
| Retryability::RequiresConfirmation
|
||||||
|
)
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn admin_and_mcp_preserve_dispatch_uncertainty_without_changing_the_code() {
|
||||||
|
for locale in [ExecutionLocale::En, ExecutionLocale::Ru] {
|
||||||
|
let failure = ExecutionFailure::new(
|
||||||
|
ExecutionErrorCode::UpstreamTransportError,
|
||||||
|
CorrelationContext::generate(),
|
||||||
|
)
|
||||||
|
.with_dispatch_uncertainty();
|
||||||
|
let admin = execution_test_failure_localized(&failure, locale);
|
||||||
|
let mcp = tool_error_contract_from_failure(&failure, locale);
|
||||||
|
|
||||||
|
assert_eq!(admin["retryability"], "manual_reconcile");
|
||||||
|
assert_eq!(admin["outcome_certainty"], "outcome_unknown");
|
||||||
|
assert_eq!(admin["retryability"], mcp.retryability);
|
||||||
|
assert_eq!(admin["outcome_certainty"], mcp.outcome_certainty);
|
||||||
|
assert!(!mcp.recoverable);
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -13,7 +13,9 @@ use crank_observability::{
|
|||||||
CriticalErrorCategory, MetricsConfig, ObservabilityConfig, ObservabilityLifecycle,
|
CriticalErrorCategory, MetricsConfig, ObservabilityConfig, ObservabilityLifecycle,
|
||||||
OtlpTraceConfig, RedactionLimits, SentryConfig, ServiceIdentity, capture_critical_error,
|
OtlpTraceConfig, RedactionLimits, SentryConfig, ServiceIdentity, capture_critical_error,
|
||||||
};
|
};
|
||||||
use crank_registry::{PostgresPoolConfig, PostgresRegistry};
|
use crank_registry::{
|
||||||
|
MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresPoolConfig, PostgresRegistry,
|
||||||
|
};
|
||||||
use crank_runtime::{
|
use crank_runtime::{
|
||||||
RequestRateLimitConfig, RequestRateLimiter, RuntimeCacheConfig, RuntimeCacheStores,
|
RequestRateLimitConfig, RequestRateLimiter, RuntimeCacheConfig, RuntimeCacheStores,
|
||||||
RuntimeLimits, SecretCrypto,
|
RuntimeLimits, SecretCrypto,
|
||||||
@@ -62,6 +64,36 @@ fn safe_startup_diagnostic(error: &(dyn std::error::Error + 'static)) -> String
|
|||||||
})
|
})
|
||||||
.to_string();
|
.to_string();
|
||||||
}
|
}
|
||||||
|
if let Some(crank_registry::RegistryError::MasterKeyIdentityMismatch { epoch }) =
|
||||||
|
cause.downcast_ref::<crank_registry::RegistryError>()
|
||||||
|
{
|
||||||
|
return serde_json::json!({
|
||||||
|
"status": "error",
|
||||||
|
"code": "master_key_identity_mismatch",
|
||||||
|
"stage": "startup.master_key_identity",
|
||||||
|
"version": epoch,
|
||||||
|
"recovery": "configure_same_master_key",
|
||||||
|
})
|
||||||
|
.to_string();
|
||||||
|
}
|
||||||
|
if cause
|
||||||
|
.downcast_ref::<crank_registry::RegistryError>()
|
||||||
|
.is_some_and(|error| {
|
||||||
|
matches!(
|
||||||
|
error,
|
||||||
|
crank_registry::RegistryError::InvalidMasterKeyIdentity
|
||||||
|
)
|
||||||
|
})
|
||||||
|
{
|
||||||
|
return serde_json::json!({
|
||||||
|
"status": "error",
|
||||||
|
"code": "master_key_identity_invalid",
|
||||||
|
"stage": "startup.master_key_identity",
|
||||||
|
"version": null,
|
||||||
|
"recovery": "contact_operator",
|
||||||
|
})
|
||||||
|
.to_string();
|
||||||
|
}
|
||||||
current = cause.source();
|
current = cause.source();
|
||||||
}
|
}
|
||||||
serde_json::json!({
|
serde_json::json!({
|
||||||
@@ -145,10 +177,13 @@ async fn run(
|
|||||||
spawn_postgres_pool_metrics(registry.pool().clone());
|
spawn_postgres_pool_metrics(registry.pool().clone());
|
||||||
}
|
}
|
||||||
let session_store = PostgresTransportSessionStore::from_pool(registry.pool().clone()).await?;
|
let session_store = PostgresTransportSessionStore::from_pool(registry.pool().clone()).await?;
|
||||||
let secret_crypto = SecretCrypto::new(config.runtime.master_key.expose_secret())?;
|
let secret_crypto =
|
||||||
let outbound_http_policy = crank_runtime::OutboundHttpPolicy::try_new(
|
verified_startup_secret_crypto(®istry, config.runtime.master_key.expose_secret())
|
||||||
|
.await?;
|
||||||
|
let outbound_http_policy = crank_runtime::OutboundHttpPolicy::try_new_with_limits(
|
||||||
config.runtime.outbound.allowed_hosts.clone(),
|
config.runtime.outbound.allowed_hosts.clone(),
|
||||||
config.runtime.outbound.denied_hosts.clone(),
|
config.runtime.outbound.denied_hosts.clone(),
|
||||||
|
config.runtime.outbound.max_request_bytes,
|
||||||
config.runtime.outbound.max_response_bytes,
|
config.runtime.outbound.max_response_bytes,
|
||||||
)?;
|
)?;
|
||||||
let runtime = crank_runtime::community_with_outbound_policy(outbound_http_policy)
|
let runtime = crank_runtime::community_with_outbound_policy(outbound_http_policy)
|
||||||
@@ -275,9 +310,10 @@ fn preflight_config(config: &McpProcessConfig) -> Result<(), crank_config::Confi
|
|||||||
.map_err(|_| invalid("mcp.rate_limit"))?;
|
.map_err(|_| invalid("mcp.rate_limit"))?;
|
||||||
SecretCrypto::new(config.runtime.master_key.expose_secret())
|
SecretCrypto::new(config.runtime.master_key.expose_secret())
|
||||||
.map_err(|_| invalid("runtime.master_key"))?;
|
.map_err(|_| invalid("runtime.master_key"))?;
|
||||||
crank_runtime::OutboundHttpPolicy::try_new(
|
crank_runtime::OutboundHttpPolicy::try_new_with_limits(
|
||||||
config.runtime.outbound.allowed_hosts.clone(),
|
config.runtime.outbound.allowed_hosts.clone(),
|
||||||
config.runtime.outbound.denied_hosts.clone(),
|
config.runtime.outbound.denied_hosts.clone(),
|
||||||
|
config.runtime.outbound.max_request_bytes,
|
||||||
config.runtime.outbound.max_response_bytes,
|
config.runtime.outbound.max_response_bytes,
|
||||||
)
|
)
|
||||||
.map_err(|_| invalid("runtime.outbound"))?;
|
.map_err(|_| invalid("runtime.outbound"))?;
|
||||||
@@ -326,6 +362,53 @@ fn preflight_config(config: &McpProcessConfig) -> Result<(), crank_config::Confi
|
|||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn verified_startup_secret_crypto(
|
||||||
|
registry: &PostgresRegistry,
|
||||||
|
master_key: &str,
|
||||||
|
) -> Result<SecretCrypto, Box<dyn std::error::Error>> {
|
||||||
|
let active = registry.active_master_key_identity().await?;
|
||||||
|
let secret_crypto = if let Some(identity) = active {
|
||||||
|
SecretCrypto::with_epoch(master_key, identity.epoch)?
|
||||||
|
} else {
|
||||||
|
let crypto = SecretCrypto::new(master_key)?;
|
||||||
|
let mut after_secret_id: Option<String> = None;
|
||||||
|
let mut after_version: Option<u32> = None;
|
||||||
|
loop {
|
||||||
|
let versions = registry
|
||||||
|
.list_secret_versions_for_master_key_epoch_page(
|
||||||
|
1,
|
||||||
|
after_secret_id.as_deref(),
|
||||||
|
after_version,
|
||||||
|
1_000,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
if versions.is_empty() {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
for version in versions {
|
||||||
|
after_secret_id = Some(version.secret_version.secret_id.as_str().to_owned());
|
||||||
|
after_version = Some(version.secret_version.version);
|
||||||
|
crypto.decrypt_for_epoch(
|
||||||
|
&version.secret_version.key_version,
|
||||||
|
version.master_key_epoch,
|
||||||
|
&version.secret_version.ciphertext,
|
||||||
|
)?;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
crypto
|
||||||
|
};
|
||||||
|
let master_key_observed_at = time::OffsetDateTime::now_utc();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: secret_crypto.master_key_epoch(),
|
||||||
|
fingerprint: secret_crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &master_key_observed_at,
|
||||||
|
})
|
||||||
|
.await?;
|
||||||
|
Ok(secret_crypto)
|
||||||
|
}
|
||||||
|
|
||||||
fn postgres_pool_config(
|
fn postgres_pool_config(
|
||||||
config: &DatabaseSettings,
|
config: &DatabaseSettings,
|
||||||
) -> Result<PostgresPoolConfig, crank_registry::PostgresPoolConfigError> {
|
) -> Result<PostgresPoolConfig, crank_registry::PostgresPoolConfigError> {
|
||||||
|
|||||||
@@ -1,11 +1,21 @@
|
|||||||
use std::process::Command;
|
use std::process::Command;
|
||||||
|
|
||||||
|
use crank_registry::{
|
||||||
|
MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, MigrationAuthority, PostgresRegistry,
|
||||||
|
};
|
||||||
|
use crank_runtime::SecretCrypto;
|
||||||
|
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
|
|
||||||
|
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
|
||||||
|
const REGISTERED_MASTER_KEY: &str = "registered-master-key-CANARY_SECRET_VALUE-00000000";
|
||||||
|
const WRONG_MASTER_KEY: &str = "wrong-master-key-CANARY_SECRET_VALUE-0000000000000";
|
||||||
|
|
||||||
fn run_with(entries: &[(&str, &str)]) -> String {
|
fn run_with(entries: &[(&str, &str)]) -> String {
|
||||||
let mut command = Command::new(env!("CARGO_BIN_EXE_mcp-server"));
|
let mut command = Command::new(env!("CARGO_BIN_EXE_mcp-server"));
|
||||||
for field in crank_config::field_registry() {
|
for field in crank_config::field_registry() {
|
||||||
command.env_remove(field.env_name);
|
command.env_remove(field.env_name);
|
||||||
}
|
}
|
||||||
command.env("CRANK_MASTER_KEY", "master");
|
command.env("CRANK_MASTER_KEY", TEST_MASTER_KEY);
|
||||||
for (name, value) in entries {
|
for (name, value) in entries {
|
||||||
command.env(name, value);
|
command.env(name, value);
|
||||||
}
|
}
|
||||||
@@ -63,3 +73,29 @@ async fn fresh_database_startup_is_read_only() {
|
|||||||
.unwrap();
|
.unwrap();
|
||||||
assert!(!present);
|
assert!(!present);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn master_key_mismatch_blocks_startup_with_safe_diagnostic() {
|
||||||
|
let database_url = crank_test_support::postgres_schema_url("mcp_master_key_mismatch").await;
|
||||||
|
let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
|
||||||
|
MigrationAuthority::apply(&pool).await.unwrap();
|
||||||
|
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||||
|
let crypto = SecretCrypto::new(REGISTERED_MASTER_KEY).unwrap();
|
||||||
|
registry
|
||||||
|
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||||
|
epoch: 1,
|
||||||
|
fingerprint: crypto.master_key_fingerprint(),
|
||||||
|
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||||
|
observed_at: &OffsetDateTime::parse("2026-08-21T00:00:00Z", &Rfc3339).unwrap(),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let stderr = run_with(&[
|
||||||
|
("CRANK_DATABASE_URL", &database_url),
|
||||||
|
("CRANK_MASTER_KEY", WRONG_MASTER_KEY),
|
||||||
|
]);
|
||||||
|
assert!(stderr.contains("master_key_identity_mismatch"), "{stderr}");
|
||||||
|
assert!(!stderr.contains("registered-master-key"));
|
||||||
|
assert!(!stderr.contains("wrong-master-key"));
|
||||||
|
}
|
||||||
|
|||||||
@@ -114,11 +114,16 @@ async fn preserves_mcp_result_when_postgres_rejects_invocation_history() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &WorkspaceId::new("ws_default"),
|
workspace_id: &WorkspaceId::new("ws_default"),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: None,
|
source: None,
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
|
|||||||
@@ -23,14 +23,14 @@ use crank_core::{
|
|||||||
ApprovalRequestId, ApprovalRequestStatus, ExecutionConfig, HttpMethod, InvocationSource,
|
ApprovalRequestId, ApprovalRequestStatus, ExecutionConfig, HttpMethod, InvocationSource,
|
||||||
Operation, OperationApprovalMode, OperationApprovalPayloadPreviewMode, OperationApprovalPolicy,
|
Operation, OperationApprovalMode, OperationApprovalPayloadPreviewMode, OperationApprovalPolicy,
|
||||||
OperationApprovalRiskLevel, OperationId, OperationStatus, PlatformApiKey, PlatformApiKeyId,
|
OperationApprovalRiskLevel, OperationId, OperationStatus, PlatformApiKey, PlatformApiKeyId,
|
||||||
PlatformApiKeyScope, PlatformApiKeyStatus, Protocol, RestTarget, Target, ToolDescription,
|
PlatformApiKeyKind, PlatformApiKeyScope, PlatformApiKeyStatus, Protocol, RestTarget, Target,
|
||||||
WorkspaceId,
|
ToolDescription, WorkspaceId,
|
||||||
};
|
};
|
||||||
use crank_mapping::{MappingRule, MappingSet};
|
use crank_mapping::{MappingRule, MappingSet};
|
||||||
use crank_registry::{
|
use crank_registry::{
|
||||||
CreateAgentRequest, CreateApprovalRequest, CreatePlatformApiKeyRequest,
|
CreateAgentDraftVersionRequest, CreateAgentRequest, CreateApprovalRequest,
|
||||||
ListInvocationLogsQuery, PostgresRegistry, PublishAgentRequest, PublishRequest,
|
CreatePlatformApiKeyRequest, ListInvocationLogsQuery, PostgresRegistry, PublishAgentRequest,
|
||||||
SaveAgentBindingsRequest,
|
PublishRequest, SaveAgentBindingsRequest,
|
||||||
};
|
};
|
||||||
use crank_runtime::{
|
use crank_runtime::{
|
||||||
InMemoryCoordinationStateStore, RequestRateLimitConfig, RequestRateLimiter, RuntimeExecutor,
|
InMemoryCoordinationStateStore, RequestRateLimitConfig, RequestRateLimiter, RuntimeExecutor,
|
||||||
@@ -141,7 +141,7 @@ fn build_test_app_with_store(
|
|||||||
registry,
|
registry,
|
||||||
refresh_interval,
|
refresh_interval,
|
||||||
public_base_url,
|
public_base_url,
|
||||||
SecretCrypto::new("test-master-key").unwrap(),
|
SecretCrypto::new("test-master-key-00000000000000000000000000000000").unwrap(),
|
||||||
crank_runtime::community_with_outbound_policy(
|
crank_runtime::community_with_outbound_policy(
|
||||||
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
||||||
)
|
)
|
||||||
@@ -153,6 +153,17 @@ fn build_test_app_with_store(
|
|||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async fn assert_revoked_mcp_request_is_denied(
|
||||||
|
response: reqwest::Response,
|
||||||
|
api_key: &str,
|
||||||
|
key_id: &PlatformApiKeyId,
|
||||||
|
) {
|
||||||
|
assert_eq!(response.status(), reqwest::StatusCode::UNAUTHORIZED);
|
||||||
|
let denied_body = response.text().await.unwrap();
|
||||||
|
assert!(!denied_body.contains(api_key));
|
||||||
|
assert!(!denied_body.contains(key_id.as_str()));
|
||||||
|
}
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
async fn refreshes_published_tools_without_restart() {
|
async fn refreshes_published_tools_without_restart() {
|
||||||
let registry = test_registry().await;
|
let registry = test_registry().await;
|
||||||
@@ -204,12 +215,33 @@ async fn refreshes_published_tools_without_restart() {
|
|||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
|
let agent_id = test_agent_id("sales-refresh");
|
||||||
|
let draft_v2 = AgentVersion {
|
||||||
|
agent_id: agent_id.clone(),
|
||||||
|
version: 2,
|
||||||
|
status: AgentStatus::Draft,
|
||||||
|
instructions: json!({}),
|
||||||
|
tool_selection_policy: Default::default(),
|
||||||
|
created_at: OffsetDateTime::parse("2026-03-26T10:01:00Z", &Rfc3339).unwrap(),
|
||||||
|
};
|
||||||
registry
|
registry
|
||||||
.save_agent_bindings(SaveAgentBindingsRequest {
|
.create_agent_draft_version(CreateAgentDraftVersionRequest {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
agent_id: &test_agent_id("sales-refresh"),
|
agent_id: &agent_id,
|
||||||
agent_version: 1,
|
version: &draft_v2,
|
||||||
bindings: &[binding_for_operation(&operation)],
|
bindings: &[binding_for_operation(&operation)],
|
||||||
|
updated_at: &OffsetDateTime::parse("2026-03-26T10:01:00Z", &Rfc3339).unwrap(),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
registry
|
||||||
|
.publish_agent(PublishAgentRequest {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
agent_id: &agent_id,
|
||||||
|
version: 2,
|
||||||
|
published_at: &OffsetDateTime::parse("2026-03-26T10:02:00Z", &Rfc3339).unwrap(),
|
||||||
|
published_by: Some("alice"),
|
||||||
|
expected_state: None,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -236,7 +268,7 @@ async fn refreshes_published_tools_without_restart() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
async fn shares_published_catalog_snapshot_across_instances() {
|
async fn shared_catalog_cache_does_not_serve_stale_snapshot_after_unpublish() {
|
||||||
let registry = test_registry().await;
|
let registry = test_registry().await;
|
||||||
let upstream_base_url = spawn_upstream_server().await;
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
let operation = test_operation(&upstream_base_url, "crm_catalog_shared");
|
let operation = test_operation(&upstream_base_url, "crm_catalog_shared");
|
||||||
@@ -274,6 +306,7 @@ async fn shares_published_catalog_snapshot_across_instances() {
|
|||||||
&test_workspace_id(),
|
&test_workspace_id(),
|
||||||
&test_agent_id("sales-shared-catalog"),
|
&test_agent_id("sales-shared-catalog"),
|
||||||
&OffsetDateTime::parse("2026-03-26T10:05:00Z", &Rfc3339).unwrap(),
|
&OffsetDateTime::parse("2026-03-26T10:05:00Z", &Rfc3339).unwrap(),
|
||||||
|
None,
|
||||||
)
|
)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -283,13 +316,15 @@ async fn shares_published_catalog_snapshot_across_instances() {
|
|||||||
Duration::from_secs(60),
|
Duration::from_secs(60),
|
||||||
coordination_store,
|
coordination_store,
|
||||||
);
|
);
|
||||||
let tools_b = catalog_b
|
let error = catalog_b
|
||||||
.list_tools(test_workspace_slug(), "sales-shared-catalog")
|
.list_tools(test_workspace_slug(), "sales-shared-catalog")
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.expect_err("unpublished Agent must not be served from shared cache");
|
||||||
|
|
||||||
assert_eq!(tools_b.len(), 1);
|
assert!(matches!(
|
||||||
assert_eq!(tools_b[0].tool_name, operation.name);
|
error,
|
||||||
|
crank_registry::RegistryError::PublishedAgentNotFound { .. }
|
||||||
|
));
|
||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
@@ -456,6 +491,135 @@ async fn rejects_initialize_with_key_from_different_agent() {
|
|||||||
assert_eq!(response.status(), reqwest::StatusCode::UNAUTHORIZED);
|
assert_eq!(response.status(), reqwest::StatusCode::UNAUTHORIZED);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn revoked_mcp_key_stops_existing_session_without_restart() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let operation = test_operation(&upstream_base_url, "crm_revoked_key");
|
||||||
|
registry
|
||||||
|
.create_operation(&test_workspace_id(), &operation, Some("alice"))
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
registry
|
||||||
|
.publish_operation(PublishRequest {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
operation_id: &operation.id,
|
||||||
|
version: 1,
|
||||||
|
published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
|
||||||
|
published_by: Some("alice"),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
publish_agent_for_operation(®istry, &operation, "sales-revoked-key").await;
|
||||||
|
let api_key = create_platform_api_key(
|
||||||
|
®istry,
|
||||||
|
"sales-revoked-key",
|
||||||
|
"mcp-revoked-boundary",
|
||||||
|
&[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
let base_url = spawn_mcp_server(build_test_app(
|
||||||
|
registry.clone(),
|
||||||
|
Duration::from_millis(0),
|
||||||
|
Some("https://crank.example.com".to_owned()),
|
||||||
|
))
|
||||||
|
.await;
|
||||||
|
let client = reqwest::Client::new();
|
||||||
|
let mcp_url = agent_mcp_url(&base_url, "sales-revoked-key");
|
||||||
|
let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
|
||||||
|
|
||||||
|
let before_revoke = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
Some(&initialized_session),
|
||||||
|
json!({
|
||||||
|
"jsonrpc": "2.0",
|
||||||
|
"id": 2,
|
||||||
|
"method": "tools/list",
|
||||||
|
"params": {}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(
|
||||||
|
before_revoke["result"]["tools"][0]["name"],
|
||||||
|
"crm_revoked_key"
|
||||||
|
);
|
||||||
|
|
||||||
|
let key_id = registry
|
||||||
|
.list_platform_api_keys_for_agent(&test_workspace_id(), &test_agent_id("sales-revoked-key"))
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.into_iter()
|
||||||
|
.find(|record| record.api_key.name == "mcp-revoked-boundary")
|
||||||
|
.unwrap()
|
||||||
|
.api_key
|
||||||
|
.id;
|
||||||
|
registry
|
||||||
|
.revoke_platform_api_key_for_agent(
|
||||||
|
&test_workspace_id(),
|
||||||
|
&test_agent_id("sales-revoked-key"),
|
||||||
|
&key_id,
|
||||||
|
&OffsetDateTime::now_utc(),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let rejected_initialize = post_jsonrpc_response(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
None,
|
||||||
|
None,
|
||||||
|
json!({
|
||||||
|
"jsonrpc": "2.0",
|
||||||
|
"id": 3,
|
||||||
|
"method": "initialize",
|
||||||
|
"params": {
|
||||||
|
"protocolVersion": "2025-11-25"
|
||||||
|
}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_revoked_mcp_request_is_denied(rejected_initialize, &api_key, &key_id).await;
|
||||||
|
|
||||||
|
let rejected_tools_list = post_jsonrpc_response(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
Some(&initialized_session),
|
||||||
|
None,
|
||||||
|
json!({
|
||||||
|
"jsonrpc": "2.0",
|
||||||
|
"id": 4,
|
||||||
|
"method": "tools/list",
|
||||||
|
"params": {}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_revoked_mcp_request_is_denied(rejected_tools_list, &api_key, &key_id).await;
|
||||||
|
|
||||||
|
let rejected_tools_call = post_jsonrpc_response(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
Some(&initialized_session),
|
||||||
|
None,
|
||||||
|
json!({
|
||||||
|
"jsonrpc": "2.0",
|
||||||
|
"id": 5,
|
||||||
|
"method": "tools/call",
|
||||||
|
"params": {
|
||||||
|
"name": "crm_revoked_key",
|
||||||
|
"arguments": {}
|
||||||
|
}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_revoked_mcp_request_is_denied(rejected_tools_call, &api_key, &key_id).await;
|
||||||
|
}
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
async fn rejects_initialize_without_platform_api_key() {
|
async fn rejects_initialize_without_platform_api_key() {
|
||||||
let registry = test_registry().await;
|
let registry = test_registry().await;
|
||||||
|
|||||||
@@ -1,5 +1,8 @@
|
|||||||
use super::*;
|
use super::*;
|
||||||
|
|
||||||
|
mod pending;
|
||||||
|
mod revocation;
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
async fn approval_key_lists_and_decides_pending_requests() {
|
async fn approval_key_lists_and_decides_pending_requests() {
|
||||||
let registry = test_registry().await;
|
let registry = test_registry().await;
|
||||||
@@ -23,6 +26,8 @@ async fn approval_key_lists_and_decides_pending_requests() {
|
|||||||
operation_version: 1,
|
operation_version: 1,
|
||||||
status: ApprovalRequestStatus::Pending,
|
status: ApprovalRequestStatus::Pending,
|
||||||
risk_level: OperationApprovalRiskLevel::Dangerous,
|
risk_level: OperationApprovalRiskLevel::Dangerous,
|
||||||
|
request_id: None,
|
||||||
|
trace_id: None,
|
||||||
request_payload: json!({"email": "ada@example.com"}),
|
request_payload: json!({"email": "ada@example.com"}),
|
||||||
response_payload: None,
|
response_payload: None,
|
||||||
created_at: OffsetDateTime::now_utc(),
|
created_at: OffsetDateTime::now_utc(),
|
||||||
@@ -164,11 +169,16 @@ async fn approval_key_lists_and_decides_pending_requests() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(InvocationSource::AgentToolCall),
|
source: Some(InvocationSource::AgentToolCall),
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: Some(&test_agent_id("sales-human-approval")),
|
agent_id: Some(&test_agent_id("sales-human-approval")),
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
@@ -203,6 +213,8 @@ async fn approval_key_denies_without_executing_upstream() {
|
|||||||
operation_version: 1,
|
operation_version: 1,
|
||||||
status: ApprovalRequestStatus::Pending,
|
status: ApprovalRequestStatus::Pending,
|
||||||
risk_level: OperationApprovalRiskLevel::Dangerous,
|
risk_level: OperationApprovalRiskLevel::Dangerous,
|
||||||
|
request_id: None,
|
||||||
|
trace_id: None,
|
||||||
request_payload: json!({"email": "deny@example.com"}),
|
request_payload: json!({"email": "deny@example.com"}),
|
||||||
response_payload: None,
|
response_payload: None,
|
||||||
created_at: OffsetDateTime::now_utc(),
|
created_at: OffsetDateTime::now_utc(),
|
||||||
@@ -265,11 +277,16 @@ async fn approval_key_denies_without_executing_upstream() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(InvocationSource::AgentToolCall),
|
source: Some(InvocationSource::AgentToolCall),
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: Some(&test_agent_id("sales-human-deny")),
|
agent_id: Some(&test_agent_id("sales-human-deny")),
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
@@ -277,6 +294,112 @@ async fn approval_key_denies_without_executing_upstream() {
|
|||||||
assert!(logs.is_empty());
|
assert!(logs.is_empty());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn approval_key_allowed_origins_are_enforced_at_approval_boundary() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let operation = test_operation(&upstream_base_url, "crm_origin_guard");
|
||||||
|
registry
|
||||||
|
.create_operation(&test_workspace_id(), &operation, Some("alice"))
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
publish_agent_with_bindings(
|
||||||
|
®istry,
|
||||||
|
"sales-origin-guard",
|
||||||
|
vec![binding_for_operation(&operation)],
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let approval = ApprovalRequest {
|
||||||
|
id: ApprovalRequestId::new("approval_origin_guard_01"),
|
||||||
|
workspace_id: test_workspace_id(),
|
||||||
|
agent_id: test_agent_id("sales-origin-guard"),
|
||||||
|
operation_id: operation.id.clone(),
|
||||||
|
operation_version: 1,
|
||||||
|
status: ApprovalRequestStatus::Pending,
|
||||||
|
risk_level: OperationApprovalRiskLevel::Dangerous,
|
||||||
|
request_id: None,
|
||||||
|
trace_id: None,
|
||||||
|
request_payload: json!({"email": "origin@example.com"}),
|
||||||
|
response_payload: None,
|
||||||
|
created_at: OffsetDateTime::now_utc(),
|
||||||
|
expires_at: OffsetDateTime::now_utc() + time::Duration::minutes(5),
|
||||||
|
decided_at: None,
|
||||||
|
decided_by_key_id: None,
|
||||||
|
decision_note: None,
|
||||||
|
};
|
||||||
|
registry
|
||||||
|
.create_approval_request(CreateApprovalRequest {
|
||||||
|
approval: &approval,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let approval_secret = format!("crk_appr_origin_{}", uuid::Uuid::now_v7().simple());
|
||||||
|
let approval_key = PlatformApiKey {
|
||||||
|
id: PlatformApiKeyId::new("pk_approval_origin_guard"),
|
||||||
|
workspace_id: test_workspace_id(),
|
||||||
|
agent_id: Some(test_agent_id("sales-origin-guard")),
|
||||||
|
key_kind: PlatformApiKeyKind::Approval,
|
||||||
|
name: "approval-origin-guard".to_owned(),
|
||||||
|
prefix: approval_secret.chars().take(16).collect(),
|
||||||
|
scopes: vec![PlatformApiKeyScope::ReadPending],
|
||||||
|
status: PlatformApiKeyStatus::Active,
|
||||||
|
created_at: OffsetDateTime::now_utc(),
|
||||||
|
last_used_at: None,
|
||||||
|
expires_at: None,
|
||||||
|
allowed_origins: vec!["https://allowed.example.test".to_owned()],
|
||||||
|
};
|
||||||
|
registry
|
||||||
|
.create_platform_api_key(CreatePlatformApiKeyRequest {
|
||||||
|
api_key: &approval_key,
|
||||||
|
secret_hash: &hash_access_secret(&approval_secret),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let base_url = spawn_mcp_server(build_test_app(
|
||||||
|
registry.clone(),
|
||||||
|
Duration::from_millis(0),
|
||||||
|
Some("https://crank.example.com".to_owned()),
|
||||||
|
))
|
||||||
|
.await;
|
||||||
|
let client = reqwest::Client::new();
|
||||||
|
let approvals_url = format!(
|
||||||
|
"{}/approvals",
|
||||||
|
agent_mcp_url(&base_url, "sales-origin-guard")
|
||||||
|
);
|
||||||
|
|
||||||
|
let rejected = client
|
||||||
|
.get(&approvals_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_secret}"))
|
||||||
|
.header(header::ORIGIN, "https://evil.example.test")
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(rejected.status(), reqwest::StatusCode::FORBIDDEN);
|
||||||
|
let rejected_body = rejected.text().await.unwrap();
|
||||||
|
assert!(!rejected_body.contains("allowed.example.test"));
|
||||||
|
assert!(!rejected_body.contains("evil.example.test"));
|
||||||
|
assert!(!rejected_body.contains(&approval_secret));
|
||||||
|
|
||||||
|
let server_side_client = client
|
||||||
|
.get(&approvals_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_secret}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(server_side_client.status(), reqwest::StatusCode::OK);
|
||||||
|
|
||||||
|
let accepted = client
|
||||||
|
.get(&approvals_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_secret}"))
|
||||||
|
.header(header::ORIGIN, "https://allowed.example.test")
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(accepted.status(), reqwest::StatusCode::OK);
|
||||||
|
}
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
async fn approval_key_expires_without_executing_upstream() {
|
async fn approval_key_expires_without_executing_upstream() {
|
||||||
let registry = test_registry().await;
|
let registry = test_registry().await;
|
||||||
@@ -300,6 +423,8 @@ async fn approval_key_expires_without_executing_upstream() {
|
|||||||
operation_version: 1,
|
operation_version: 1,
|
||||||
status: ApprovalRequestStatus::Pending,
|
status: ApprovalRequestStatus::Pending,
|
||||||
risk_level: OperationApprovalRiskLevel::Dangerous,
|
risk_level: OperationApprovalRiskLevel::Dangerous,
|
||||||
|
request_id: None,
|
||||||
|
trace_id: None,
|
||||||
request_payload: json!({"email": "expired@example.com"}),
|
request_payload: json!({"email": "expired@example.com"}),
|
||||||
response_payload: None,
|
response_payload: None,
|
||||||
created_at: OffsetDateTime::now_utc() - time::Duration::minutes(10),
|
created_at: OffsetDateTime::now_utc() - time::Duration::minutes(10),
|
||||||
@@ -349,11 +474,16 @@ async fn approval_key_expires_without_executing_upstream() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(InvocationSource::AgentToolCall),
|
source: Some(InvocationSource::AgentToolCall),
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: Some(&test_agent_id("sales-human-expired")),
|
agent_id: Some(&test_agent_id("sales-human-expired")),
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
@@ -361,116 +491,6 @@ async fn approval_key_expires_without_executing_upstream() {
|
|||||||
assert!(logs.is_empty());
|
assert!(logs.is_empty());
|
||||||
}
|
}
|
||||||
|
|
||||||
#[tokio::test]
|
|
||||||
async fn tool_call_with_approval_policy_creates_pending_request() {
|
|
||||||
let registry = test_registry().await;
|
|
||||||
let upstream_base_url = spawn_upstream_server().await;
|
|
||||||
let mut operation = test_operation(&upstream_base_url, "crm_requires_human_approval");
|
|
||||||
operation.execution_config.approval_policy = Some(OperationApprovalPolicy {
|
|
||||||
required: true,
|
|
||||||
mode: OperationApprovalMode::Custom,
|
|
||||||
risk_level: OperationApprovalRiskLevel::Dangerous,
|
|
||||||
ttl_seconds: 300,
|
|
||||||
show_payload_preview: true,
|
|
||||||
payload_preview_mode: OperationApprovalPayloadPreviewMode::MaskedJson,
|
|
||||||
elicitation_message: None,
|
|
||||||
});
|
|
||||||
registry
|
|
||||||
.create_operation(&test_workspace_id(), &operation, Some("alice"))
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
registry
|
|
||||||
.publish_operation(PublishRequest {
|
|
||||||
workspace_id: &test_workspace_id(),
|
|
||||||
operation_id: &operation.id,
|
|
||||||
version: 1,
|
|
||||||
published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
|
|
||||||
published_by: Some("alice"),
|
|
||||||
})
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
publish_agent_for_operation(®istry, &operation, "sales-gated").await;
|
|
||||||
let api_key = create_platform_api_key(
|
|
||||||
®istry,
|
|
||||||
"sales-gated",
|
|
||||||
"mcp-gated",
|
|
||||||
&[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
let approval_key =
|
|
||||||
create_approval_platform_api_key(®istry, "sales-gated", "approval-gated").await;
|
|
||||||
|
|
||||||
let base_url = spawn_mcp_server(build_test_app(
|
|
||||||
registry,
|
|
||||||
Duration::from_millis(0),
|
|
||||||
Some("https://crank.example.com".to_owned()),
|
|
||||||
))
|
|
||||||
.await;
|
|
||||||
let client = reqwest::Client::new();
|
|
||||||
let mcp_url = agent_mcp_url(&base_url, "sales-gated");
|
|
||||||
let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
|
|
||||||
|
|
||||||
let tool_call = json!({
|
|
||||||
"jsonrpc": "2.0",
|
|
||||||
"id": 9,
|
|
||||||
"method": "tools/call",
|
|
||||||
"params": {
|
|
||||||
"name": "crm_requires_human_approval",
|
|
||||||
"arguments": {
|
|
||||||
"email": "ada@example.com"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
});
|
|
||||||
let tool_result = post_jsonrpc(
|
|
||||||
&client,
|
|
||||||
&mcp_url,
|
|
||||||
&api_key,
|
|
||||||
Some(&initialized_session),
|
|
||||||
tool_call.clone(),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
|
|
||||||
assert_eq!(
|
|
||||||
tool_result["result"]["structuredContent"]["status"],
|
|
||||||
"approval_required"
|
|
||||||
);
|
|
||||||
assert_eq!(tool_result["result"]["isError"], false);
|
|
||||||
let approval_id = tool_result["result"]["structuredContent"]["approval_id"]
|
|
||||||
.as_str()
|
|
||||||
.unwrap();
|
|
||||||
assert!(approval_id.starts_with("approval_"));
|
|
||||||
|
|
||||||
let repeated_tool_result = post_jsonrpc(
|
|
||||||
&client,
|
|
||||||
&mcp_url,
|
|
||||||
&api_key,
|
|
||||||
Some(&initialized_session),
|
|
||||||
tool_call,
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
assert_eq!(
|
|
||||||
repeated_tool_result["result"]["structuredContent"]["approval_id"], approval_id,
|
|
||||||
"deduplicated tools/call must return the persisted approval id",
|
|
||||||
);
|
|
||||||
|
|
||||||
let approvals_url = format!("{}/approvals", agent_mcp_url(&base_url, "sales-gated"));
|
|
||||||
let pending = client
|
|
||||||
.get(&approvals_url)
|
|
||||||
.header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.json::<Value>()
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
assert_eq!(pending["items"].as_array().unwrap().len(), 1);
|
|
||||||
assert_eq!(pending["items"][0]["approval"]["id"], approval_id);
|
|
||||||
assert_eq!(
|
|
||||||
pending["items"][0]["approval"]["request_payload"]["email"],
|
|
||||||
"ada@example.com"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
async fn approval_http_endpoints_enforce_request_rate_limit() {
|
async fn approval_http_endpoints_enforce_request_rate_limit() {
|
||||||
let registry = test_registry().await;
|
let registry = test_registry().await;
|
||||||
@@ -589,6 +609,8 @@ async fn recovery_does_not_repeat_interrupted_mutating_approval() {
|
|||||||
operation_version: operation.version,
|
operation_version: operation.version,
|
||||||
status: ApprovalRequestStatus::Pending,
|
status: ApprovalRequestStatus::Pending,
|
||||||
risk_level: OperationApprovalRiskLevel::Dangerous,
|
risk_level: OperationApprovalRiskLevel::Dangerous,
|
||||||
|
request_id: None,
|
||||||
|
trace_id: None,
|
||||||
request_payload: json!({"email": "interrupted@example.com"}),
|
request_payload: json!({"email": "interrupted@example.com"}),
|
||||||
response_payload: None,
|
response_payload: None,
|
||||||
created_at: now - time::Duration::minutes(10),
|
created_at: now - time::Duration::minutes(10),
|
||||||
@@ -609,9 +631,12 @@ async fn recovery_does_not_repeat_interrupted_mutating_approval() {
|
|||||||
workspace_id: &approval.workspace_id,
|
workspace_id: &approval.workspace_id,
|
||||||
agent_id: &approval.agent_id,
|
agent_id: &approval.agent_id,
|
||||||
approval_id: &approval.id,
|
approval_id: &approval.id,
|
||||||
|
operation_id: &approval.operation_id,
|
||||||
|
operation_version: approval.operation_version,
|
||||||
|
request_payload: &approval.request_payload,
|
||||||
status: ApprovalRequestStatus::Approved,
|
status: ApprovalRequestStatus::Approved,
|
||||||
decided_at: now - time::Duration::minutes(10),
|
decided_at: now - time::Duration::minutes(10),
|
||||||
decided_by_key_id: &approval_key_id,
|
decided_by_key_id: Some(&approval_key_id),
|
||||||
response_payload: Some(json!({"approve": "yes"})),
|
response_payload: Some(json!({"approve": "yes"})),
|
||||||
decision_note: None,
|
decision_note: None,
|
||||||
})
|
})
|
||||||
@@ -666,7 +691,7 @@ fn build_test_app_with_approval_recovery(registry: PostgresRegistry) -> Router {
|
|||||||
registry,
|
registry,
|
||||||
Duration::from_millis(0),
|
Duration::from_millis(0),
|
||||||
Some("https://crank.example.com".to_owned()),
|
Some("https://crank.example.com".to_owned()),
|
||||||
SecretCrypto::new("test-master-key").unwrap(),
|
SecretCrypto::new("test-master-key-00000000000000000000000000000000").unwrap(),
|
||||||
crank_runtime::community_with_outbound_policy(
|
crank_runtime::community_with_outbound_policy(
|
||||||
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
||||||
)
|
)
|
||||||
|
|||||||
@@ -0,0 +1,151 @@
|
|||||||
|
use super::*;
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn tool_call_with_approval_policy_creates_pending_request() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let mut operation = test_operation(&upstream_base_url, "crm_requires_human_approval");
|
||||||
|
operation.execution_config.approval_policy = Some(OperationApprovalPolicy {
|
||||||
|
required: true,
|
||||||
|
mode: OperationApprovalMode::Custom,
|
||||||
|
risk_level: OperationApprovalRiskLevel::Dangerous,
|
||||||
|
ttl_seconds: 300,
|
||||||
|
show_payload_preview: true,
|
||||||
|
payload_preview_mode: OperationApprovalPayloadPreviewMode::MaskedJson,
|
||||||
|
elicitation_message: None,
|
||||||
|
});
|
||||||
|
registry
|
||||||
|
.create_operation(&test_workspace_id(), &operation, Some("alice"))
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
registry
|
||||||
|
.publish_operation(PublishRequest {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
operation_id: &operation.id,
|
||||||
|
version: 1,
|
||||||
|
published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
|
||||||
|
published_by: Some("alice"),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
publish_agent_for_operation(®istry, &operation, "sales-gated").await;
|
||||||
|
let api_key = create_platform_api_key(
|
||||||
|
®istry,
|
||||||
|
"sales-gated",
|
||||||
|
"mcp-gated",
|
||||||
|
&[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let approval_key =
|
||||||
|
create_approval_platform_api_key(®istry, "sales-gated", "approval-gated").await;
|
||||||
|
|
||||||
|
let base_url = spawn_mcp_server(build_test_app(
|
||||||
|
registry.clone(),
|
||||||
|
Duration::from_millis(0),
|
||||||
|
Some("https://crank.example.com".to_owned()),
|
||||||
|
))
|
||||||
|
.await;
|
||||||
|
let client = reqwest::Client::new();
|
||||||
|
let mcp_url = agent_mcp_url(&base_url, "sales-gated");
|
||||||
|
let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
|
||||||
|
|
||||||
|
let tool_call = json!({
|
||||||
|
"jsonrpc": "2.0",
|
||||||
|
"id": 9,
|
||||||
|
"method": "tools/call",
|
||||||
|
"params": {
|
||||||
|
"name": "crm_requires_human_approval",
|
||||||
|
"arguments": {
|
||||||
|
"email": "ada@example.com",
|
||||||
|
"api_key": "history-secret-canary"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
});
|
||||||
|
let tool_result = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
Some(&initialized_session),
|
||||||
|
tool_call.clone(),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
assert_eq!(
|
||||||
|
tool_result["result"]["structuredContent"]["status"],
|
||||||
|
"approval_required"
|
||||||
|
);
|
||||||
|
assert_eq!(tool_result["result"]["isError"], false);
|
||||||
|
let approval_id = tool_result["result"]["structuredContent"]["approval_id"]
|
||||||
|
.as_str()
|
||||||
|
.unwrap();
|
||||||
|
assert!(approval_id.starts_with("approval_"));
|
||||||
|
|
||||||
|
let repeated_tool_result = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
Some(&initialized_session),
|
||||||
|
tool_call,
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(
|
||||||
|
repeated_tool_result["result"]["structuredContent"]["approval_id"], approval_id,
|
||||||
|
"deduplicated tools/call must return the persisted approval id",
|
||||||
|
);
|
||||||
|
|
||||||
|
let approvals_url = format!("{}/approvals", agent_mcp_url(&base_url, "sales-gated"));
|
||||||
|
let pending = client
|
||||||
|
.get(&approvals_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.json::<Value>()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(pending["items"].as_array().unwrap().len(), 1);
|
||||||
|
assert_eq!(pending["items"][0]["approval"]["id"], approval_id);
|
||||||
|
assert_eq!(
|
||||||
|
pending["items"][0]["approval"]["request_payload"]["email"],
|
||||||
|
"ada@example.com"
|
||||||
|
);
|
||||||
|
let pending_preview =
|
||||||
|
serde_json::to_string(&pending["items"][0]["approval"]["request_payload"]).unwrap();
|
||||||
|
assert!(!pending_preview.contains("history-secret-canary"));
|
||||||
|
assert!(pending_preview.contains("[REDACTED]"));
|
||||||
|
|
||||||
|
let logs = registry
|
||||||
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
|
search_text: None,
|
||||||
|
source: Some(InvocationSource::AgentToolCall),
|
||||||
|
operation_id: Some(&operation.id),
|
||||||
|
agent_id: Some(&test_agent_id("sales-gated")),
|
||||||
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
|
limit: 10,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(!logs.is_empty());
|
||||||
|
let history_preview = serde_json::to_string(
|
||||||
|
&logs
|
||||||
|
.iter()
|
||||||
|
.map(|record| {
|
||||||
|
json!({
|
||||||
|
"request": record.log.request_preview,
|
||||||
|
"response": record.log.response_preview,
|
||||||
|
})
|
||||||
|
})
|
||||||
|
.collect::<Vec<_>>(),
|
||||||
|
)
|
||||||
|
.unwrap();
|
||||||
|
assert!(!history_preview.contains("history-secret-canary"));
|
||||||
|
assert!(!history_preview.contains("ada@example.com"));
|
||||||
|
assert!(history_preview.contains("approval_required"));
|
||||||
|
}
|
||||||
@@ -0,0 +1,137 @@
|
|||||||
|
use super::*;
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn revoked_approval_key_stops_list_approve_and_deny_without_restart() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let operation = test_operation(&upstream_base_url, "crm_approval_revoked");
|
||||||
|
registry
|
||||||
|
.create_operation(&test_workspace_id(), &operation, Some("alice"))
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
publish_agent_with_bindings(
|
||||||
|
®istry,
|
||||||
|
"sales-approval-revoked",
|
||||||
|
vec![binding_for_operation(&operation)],
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let approval = ApprovalRequest {
|
||||||
|
id: ApprovalRequestId::new("approval_mcp_revoked_01"),
|
||||||
|
workspace_id: test_workspace_id(),
|
||||||
|
agent_id: test_agent_id("sales-approval-revoked"),
|
||||||
|
operation_id: operation.id.clone(),
|
||||||
|
operation_version: 1,
|
||||||
|
status: ApprovalRequestStatus::Pending,
|
||||||
|
risk_level: OperationApprovalRiskLevel::Dangerous,
|
||||||
|
request_id: None,
|
||||||
|
trace_id: None,
|
||||||
|
request_payload: json!({"email": "revoked@example.com"}),
|
||||||
|
response_payload: None,
|
||||||
|
created_at: OffsetDateTime::now_utc(),
|
||||||
|
expires_at: OffsetDateTime::now_utc() + time::Duration::minutes(5),
|
||||||
|
decided_at: None,
|
||||||
|
decided_by_key_id: None,
|
||||||
|
decision_note: None,
|
||||||
|
};
|
||||||
|
registry
|
||||||
|
.create_approval_request(CreateApprovalRequest {
|
||||||
|
approval: &approval,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let approval_key = create_approval_platform_api_key(
|
||||||
|
®istry,
|
||||||
|
"sales-approval-revoked",
|
||||||
|
"approval-revoked-http",
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let base_url = spawn_mcp_server(build_test_app(
|
||||||
|
registry.clone(),
|
||||||
|
Duration::from_millis(0),
|
||||||
|
Some("https://crank.example.com".to_owned()),
|
||||||
|
))
|
||||||
|
.await;
|
||||||
|
let client = reqwest::Client::new();
|
||||||
|
let approvals_url = format!(
|
||||||
|
"{}/approvals",
|
||||||
|
agent_mcp_url(&base_url, "sales-approval-revoked")
|
||||||
|
);
|
||||||
|
let approve_url = format!(
|
||||||
|
"{}/approvals/{}/approve",
|
||||||
|
agent_mcp_url(&base_url, "sales-approval-revoked"),
|
||||||
|
approval.id
|
||||||
|
);
|
||||||
|
let deny_url = format!(
|
||||||
|
"{}/approvals/{}/deny",
|
||||||
|
agent_mcp_url(&base_url, "sales-approval-revoked"),
|
||||||
|
approval.id
|
||||||
|
);
|
||||||
|
|
||||||
|
let before_revoke = client
|
||||||
|
.get(&approvals_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(before_revoke.status(), reqwest::StatusCode::OK);
|
||||||
|
|
||||||
|
let approval_key_id = registry
|
||||||
|
.list_platform_api_keys_for_agent(
|
||||||
|
&test_workspace_id(),
|
||||||
|
&test_agent_id("sales-approval-revoked"),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.into_iter()
|
||||||
|
.find(|record| record.api_key.name == "approval-revoked-http")
|
||||||
|
.unwrap()
|
||||||
|
.api_key
|
||||||
|
.id;
|
||||||
|
registry
|
||||||
|
.revoke_platform_api_key_for_agent(
|
||||||
|
&test_workspace_id(),
|
||||||
|
&test_agent_id("sales-approval-revoked"),
|
||||||
|
&approval_key_id,
|
||||||
|
&OffsetDateTime::now_utc(),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let denied_list = client
|
||||||
|
.get(&approvals_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(denied_list.status(), reqwest::StatusCode::UNAUTHORIZED);
|
||||||
|
|
||||||
|
let denied_approve = client
|
||||||
|
.post(&approve_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
|
||||||
|
.json(&json!({ "approve": "yes" }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(denied_approve.status(), reqwest::StatusCode::UNAUTHORIZED);
|
||||||
|
|
||||||
|
let denied_deny = client
|
||||||
|
.post(&deny_url)
|
||||||
|
.header(header::AUTHORIZATION, format!("Bearer {approval_key}"))
|
||||||
|
.json(&json!({ "approve": "no" }))
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(denied_deny.status(), reqwest::StatusCode::UNAUTHORIZED);
|
||||||
|
|
||||||
|
let current = registry
|
||||||
|
.get_approval_request_for_agent(
|
||||||
|
&test_workspace_id(),
|
||||||
|
&test_agent_id("sales-approval-revoked"),
|
||||||
|
&approval.id,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(current.approval.status, ApprovalRequestStatus::Pending);
|
||||||
|
}
|
||||||
@@ -134,7 +134,7 @@ fn build_test_app_with_store(
|
|||||||
registry,
|
registry,
|
||||||
refresh_interval,
|
refresh_interval,
|
||||||
public_base_url,
|
public_base_url,
|
||||||
SecretCrypto::new("test-master-key").unwrap(),
|
SecretCrypto::new("test-master-key-00000000000000000000000000000000").unwrap(),
|
||||||
crank_runtime::community_with_outbound_policy(
|
crank_runtime::community_with_outbound_policy(
|
||||||
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
||||||
)
|
)
|
||||||
@@ -417,6 +417,7 @@ pub(super) async fn publish_agent_with_policy(
|
|||||||
version: 1,
|
version: 1,
|
||||||
published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
|
published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
|
||||||
published_by: Some("alice"),
|
published_by: Some("alice"),
|
||||||
|
expected_state: None,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
|
|||||||
@@ -276,11 +276,16 @@ async fn exports_real_tool_stages_without_sensitive_data() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(InvocationSource::AgentToolCall),
|
source: Some(InvocationSource::AgentToolCall),
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
|
|||||||
@@ -3,7 +3,8 @@ use super::common::*;
|
|||||||
use std::time::Duration;
|
use std::time::Duration;
|
||||||
|
|
||||||
use crank_core::{
|
use crank_core::{
|
||||||
PlatformApiKeyScope, ToolAccessMode, ToolGroup, ToolSearchSettings, ToolSelectionPolicy,
|
AgentId, PlatformApiKeyScope, ToolAccessMode, ToolGroup, ToolSearchSettings,
|
||||||
|
ToolSelectionPolicy,
|
||||||
};
|
};
|
||||||
use crank_registry::PublishRequest;
|
use crank_registry::PublishRequest;
|
||||||
use serde_json::json;
|
use serde_json::json;
|
||||||
@@ -108,10 +109,16 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
|
|||||||
search["result"]["structuredContent"]["tools"][0]["name"],
|
search["result"]["structuredContent"]["tools"][0]["name"],
|
||||||
"create_invoice"
|
"create_invoice"
|
||||||
);
|
);
|
||||||
assert_eq!(
|
assert!(
|
||||||
search["result"]["structuredContent"]["catalog_revision"],
|
search["result"]["structuredContent"]["catalog_revision"]
|
||||||
"agent-version-1"
|
.as_str()
|
||||||
|
.unwrap()
|
||||||
|
.starts_with("agent-version-1-catalog-revision-")
|
||||||
);
|
);
|
||||||
|
let catalog_revision = search["result"]["structuredContent"]["catalog_revision"]
|
||||||
|
.as_str()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned();
|
||||||
|
|
||||||
let stale_call = post_jsonrpc(
|
let stale_call = post_jsonrpc(
|
||||||
&client,
|
&client,
|
||||||
@@ -131,7 +138,7 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
|
|||||||
assert_eq!(stale_call["result"]["isError"], true);
|
assert_eq!(stale_call["result"]["isError"], true);
|
||||||
assert_eq!(
|
assert_eq!(
|
||||||
stale_call["result"]["structuredContent"]["error"]["code"],
|
stale_call["result"]["structuredContent"]["error"]["code"],
|
||||||
"catalog_revision_changed"
|
"agent_catalog_result_stale"
|
||||||
);
|
);
|
||||||
|
|
||||||
let call = post_jsonrpc(
|
let call = post_jsonrpc(
|
||||||
@@ -144,7 +151,7 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
|
|||||||
"params":{"name":"call_tool","arguments":{
|
"params":{"name":"call_tool","arguments":{
|
||||||
"name":"create_invoice",
|
"name":"create_invoice",
|
||||||
"arguments":{"email":"user@example.com"},
|
"arguments":{"email":"user@example.com"},
|
||||||
"catalog_revision":"agent-version-1"
|
"catalog_revision": catalog_revision
|
||||||
}}
|
}}
|
||||||
}),
|
}),
|
||||||
)
|
)
|
||||||
@@ -152,3 +159,116 @@ async fn search_mode_discovers_and_calls_tools_through_meta_tools() {
|
|||||||
assert_eq!(call["result"]["isError"], false);
|
assert_eq!(call["result"]["isError"], false);
|
||||||
assert_eq!(call["result"]["structuredContent"]["id"], "lead_123");
|
assert_eq!(call["result"]["structuredContent"]["id"], "lead_123");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn stale_search_result_rejects_tool_call() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let invoice = test_operation(&upstream_base_url, "stale_invoice_tool");
|
||||||
|
registry
|
||||||
|
.create_operation(&test_workspace_id(), &invoice, Some("alice"))
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
registry
|
||||||
|
.publish_operation(PublishRequest {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
operation_id: &invoice.id,
|
||||||
|
version: 1,
|
||||||
|
published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
|
||||||
|
published_by: Some("alice"),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
publish_agent_with_policy(
|
||||||
|
®istry,
|
||||||
|
"stale-search-agent",
|
||||||
|
vec![binding_for_operation(&invoice)],
|
||||||
|
ToolSelectionPolicy {
|
||||||
|
mode: ToolAccessMode::Search,
|
||||||
|
groups: vec![ToolGroup {
|
||||||
|
id: "finance".to_owned(),
|
||||||
|
name: "Finance".to_owned(),
|
||||||
|
description: "Invoices and payments".to_owned(),
|
||||||
|
tool_names: vec![invoice.name.clone()],
|
||||||
|
}],
|
||||||
|
search: ToolSearchSettings { max_results: 5 },
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let agent_id = AgentId::new("agent_stale-search-agent");
|
||||||
|
let api_key = create_platform_api_key(
|
||||||
|
®istry,
|
||||||
|
"stale-search-agent",
|
||||||
|
"mcp-stale-search",
|
||||||
|
&[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let base_url = spawn_mcp_server(build_test_app(
|
||||||
|
registry.clone(),
|
||||||
|
Duration::from_millis(0),
|
||||||
|
Some("https://crank.example.com".to_owned()),
|
||||||
|
))
|
||||||
|
.await;
|
||||||
|
let client = reqwest::Client::new();
|
||||||
|
let mcp_url = agent_mcp_url(&base_url, "stale-search-agent");
|
||||||
|
let session = initialize_session(&client, &mcp_url, &api_key).await;
|
||||||
|
|
||||||
|
let search = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
Some(&session),
|
||||||
|
json!({
|
||||||
|
"jsonrpc":"2.0","id":3,"method":"tools/call",
|
||||||
|
"params":{"name":"search_tools","arguments":{"query":"invoice","group_ids":["finance"]}}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let stale_revision = search["result"]["structuredContent"]["catalog_revision"]
|
||||||
|
.as_str()
|
||||||
|
.unwrap()
|
||||||
|
.to_owned();
|
||||||
|
|
||||||
|
registry
|
||||||
|
.unpublish_agent(
|
||||||
|
&test_workspace_id(),
|
||||||
|
&agent_id,
|
||||||
|
&OffsetDateTime::parse("2026-03-26T10:01:00Z", &Rfc3339).unwrap(),
|
||||||
|
None,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
registry
|
||||||
|
.publish_agent(crank_registry::PublishAgentRequest {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
agent_id: &agent_id,
|
||||||
|
version: 1,
|
||||||
|
published_at: &OffsetDateTime::parse("2026-03-26T10:02:00Z", &Rfc3339).unwrap(),
|
||||||
|
published_by: Some("alice"),
|
||||||
|
expected_state: None,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
|
||||||
|
let stale_call = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&api_key,
|
||||||
|
Some(&session),
|
||||||
|
json!({
|
||||||
|
"jsonrpc":"2.0","id":4,"method":"tools/call",
|
||||||
|
"params":{"name":"call_tool","arguments":{
|
||||||
|
"name":"stale_invoice_tool",
|
||||||
|
"arguments":{"email":"user@example.com"},
|
||||||
|
"catalog_revision": stale_revision
|
||||||
|
}}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
assert_eq!(stale_call["result"]["isError"], true);
|
||||||
|
assert_eq!(
|
||||||
|
stale_call["result"]["structuredContent"]["error"]["code"],
|
||||||
|
"agent_catalog_result_stale"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|||||||
@@ -140,7 +140,7 @@ fn build_test_app_with_store(
|
|||||||
registry,
|
registry,
|
||||||
refresh_interval,
|
refresh_interval,
|
||||||
public_base_url,
|
public_base_url,
|
||||||
SecretCrypto::new("test-master-key").unwrap(),
|
SecretCrypto::new("test-master-key-00000000000000000000000000000000").unwrap(),
|
||||||
crank_runtime::community_with_outbound_policy(
|
crank_runtime::community_with_outbound_policy(
|
||||||
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
crank_runtime::OutboundHttpPolicy::allowing_hosts(["127.0.0.1"]),
|
||||||
)
|
)
|
||||||
@@ -234,11 +234,16 @@ async fn initializes_lists_and_calls_published_tool_via_mcp() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(crank_core::InvocationSource::AgentToolCall),
|
source: Some(crank_core::InvocationSource::AgentToolCall),
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
@@ -333,11 +338,16 @@ async fn preserves_request_id_for_tool_call_invocations() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(crank_core::InvocationSource::AgentToolCall),
|
source: Some(crank_core::InvocationSource::AgentToolCall),
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
@@ -432,11 +442,16 @@ async fn generates_request_id_for_tool_call_responses_and_logs() {
|
|||||||
.list_invocation_logs(ListInvocationLogsQuery {
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
workspace_id: &test_workspace_id(),
|
workspace_id: &test_workspace_id(),
|
||||||
level: None,
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
search_text: None,
|
search_text: None,
|
||||||
source: Some(crank_core::InvocationSource::AgentToolCall),
|
source: Some(crank_core::InvocationSource::AgentToolCall),
|
||||||
operation_id: Some(&operation.id),
|
operation_id: Some(&operation.id),
|
||||||
agent_id: None,
|
agent_id: None,
|
||||||
created_after: None,
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
limit: 10,
|
limit: 10,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
|
|||||||
@@ -0,0 +1,321 @@
|
|||||||
|
#[path = "integration/common.rs"]
|
||||||
|
mod common;
|
||||||
|
|
||||||
|
use std::time::Duration;
|
||||||
|
|
||||||
|
use crank_core::{
|
||||||
|
ExecutionStage, InvocationLevel, InvocationLog, InvocationLogId, InvocationSource,
|
||||||
|
InvocationStatus, OutcomeCertainty, PlatformApiKeyScope, ProductEventKind, Retryability,
|
||||||
|
};
|
||||||
|
use crank_registry::{
|
||||||
|
CreateInvocationLogRequest, InvocationHistoryWriteOutcome, ListInvocationLogsQuery,
|
||||||
|
ListProductEventsQuery, PublishRequest,
|
||||||
|
};
|
||||||
|
use serde_json::json;
|
||||||
|
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||||
|
|
||||||
|
use common::{
|
||||||
|
agent_mcp_url, build_test_app, create_platform_api_key, initialize_session, post_jsonrpc,
|
||||||
|
publish_agent_for_operation, spawn_mcp_server, spawn_upstream_server, test_operation,
|
||||||
|
test_registry, test_workspace_id,
|
||||||
|
};
|
||||||
|
|
||||||
|
#[tokio::test]
|
||||||
|
async fn onboarding_completes_only_after_exact_key_successful_public_tool_call() {
|
||||||
|
let registry = test_registry().await;
|
||||||
|
let upstream_base_url = spawn_upstream_server().await;
|
||||||
|
let operation = test_operation(&upstream_base_url, "onboarding_first_call");
|
||||||
|
let mut operation_draft = operation.clone();
|
||||||
|
operation_draft.status = crank_core::OperationStatus::Draft;
|
||||||
|
operation_draft.published_at = None;
|
||||||
|
|
||||||
|
registry
|
||||||
|
.create_operation(
|
||||||
|
&test_workspace_id(),
|
||||||
|
&operation_draft,
|
||||||
|
Some("onboarding-test"),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let admin_test = InvocationLog {
|
||||||
|
id: InvocationLogId::new("log_onboarding_admin_test"),
|
||||||
|
workspace_id: test_workspace_id(),
|
||||||
|
agent_id: None,
|
||||||
|
platform_api_key_id: None,
|
||||||
|
operation_id: operation.id.clone(),
|
||||||
|
operation_version: Some(1),
|
||||||
|
source: InvocationSource::AdminTestRun,
|
||||||
|
level: InvocationLevel::Info,
|
||||||
|
status: InvocationStatus::Ok,
|
||||||
|
tool_name: operation.name.clone(),
|
||||||
|
message: "admin test succeeded".to_owned(),
|
||||||
|
request_id: Some("req_onboarding_admin_test".to_owned()),
|
||||||
|
trace_id: Some("4bf92f3577b34da6a3ce929d0e0e4736".to_owned()),
|
||||||
|
status_code: Some(200),
|
||||||
|
duration_ms: 1,
|
||||||
|
error_kind: None,
|
||||||
|
execution_stage: Some(ExecutionStage::Runtime),
|
||||||
|
execution_error_code: None,
|
||||||
|
retryability: Some(Retryability::Never),
|
||||||
|
outcome_certainty: Some(OutcomeCertainty::Certain),
|
||||||
|
request_preview: json!({}),
|
||||||
|
response_preview: json!({"ok": true}),
|
||||||
|
created_at: OffsetDateTime::parse("2026-08-23T07:59:00Z", &Rfc3339).unwrap(),
|
||||||
|
};
|
||||||
|
assert_eq!(
|
||||||
|
registry
|
||||||
|
.create_invocation_log(CreateInvocationLogRequest { log: &admin_test })
|
||||||
|
.await,
|
||||||
|
InvocationHistoryWriteOutcome::Recorded
|
||||||
|
);
|
||||||
|
registry
|
||||||
|
.publish_operation(PublishRequest {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
operation_id: &operation.id,
|
||||||
|
version: 1,
|
||||||
|
published_at: &OffsetDateTime::parse("2026-08-23T08:00:00Z", &Rfc3339).unwrap(),
|
||||||
|
published_by: Some("onboarding-test"),
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
publish_agent_for_operation(®istry, &operation, "onboarding-agent").await;
|
||||||
|
|
||||||
|
let selected_key_name = "onboarding-raw-key-canary";
|
||||||
|
let selected_key_id = format!("pk_{selected_key_name}");
|
||||||
|
let selected_key = create_platform_api_key(
|
||||||
|
®istry,
|
||||||
|
"onboarding-agent",
|
||||||
|
selected_key_name,
|
||||||
|
&[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
let other_key = create_platform_api_key(
|
||||||
|
®istry,
|
||||||
|
"onboarding-agent",
|
||||||
|
"onboarding-other",
|
||||||
|
&[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
let pre_call_projection = registry
|
||||||
|
.get_onboarding_projection(&test_workspace_id())
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(
|
||||||
|
pre_call_projection
|
||||||
|
.step(crank_core::OnboardingStepId::PublishOperation)
|
||||||
|
.is_some_and(|step| step.completed),
|
||||||
|
"fixture must expose a Published Operation: {pre_call_projection:#?}"
|
||||||
|
);
|
||||||
|
|
||||||
|
let base_url = spawn_mcp_server(build_test_app(
|
||||||
|
registry.clone(),
|
||||||
|
Duration::from_millis(0),
|
||||||
|
Some("https://crank.example.com".to_owned()),
|
||||||
|
))
|
||||||
|
.await;
|
||||||
|
let client = reqwest::Client::new();
|
||||||
|
let mcp_url = agent_mcp_url(&base_url, "onboarding-agent");
|
||||||
|
|
||||||
|
let selected_session = initialize_session(&client, &mcp_url, &selected_key).await;
|
||||||
|
let listed = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&selected_key,
|
||||||
|
Some(&selected_session),
|
||||||
|
json!({"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(listed["result"]["tools"][0]["name"], operation.name);
|
||||||
|
assert!(
|
||||||
|
exact_key_successes(®istry, &operation.id, &selected_key_id)
|
||||||
|
.await
|
||||||
|
.is_empty(),
|
||||||
|
"initialize and tools/list must not complete onboarding"
|
||||||
|
);
|
||||||
|
|
||||||
|
let failed = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&selected_key,
|
||||||
|
Some(&selected_session),
|
||||||
|
json!({
|
||||||
|
"jsonrpc":"2.0",
|
||||||
|
"id":3,
|
||||||
|
"method":"tools/call",
|
||||||
|
"params":{"name":operation.name,"arguments":{}}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(failed["result"]["isError"], true);
|
||||||
|
assert!(
|
||||||
|
exact_key_successes(®istry, &operation.id, &selected_key_id)
|
||||||
|
.await
|
||||||
|
.is_empty(),
|
||||||
|
"a failed tools/call must not complete onboarding"
|
||||||
|
);
|
||||||
|
|
||||||
|
let other_session = initialize_session(&client, &mcp_url, &other_key).await;
|
||||||
|
let other_success = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&other_key,
|
||||||
|
Some(&other_session),
|
||||||
|
json!({
|
||||||
|
"jsonrpc":"2.0",
|
||||||
|
"id":4,
|
||||||
|
"method":"tools/call",
|
||||||
|
"params":{
|
||||||
|
"name":operation.name,
|
||||||
|
"arguments":{"email":"other@example.com"}
|
||||||
|
}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(other_success["result"]["isError"], false);
|
||||||
|
assert!(
|
||||||
|
exact_key_successes(®istry, &operation.id, &selected_key_id)
|
||||||
|
.await
|
||||||
|
.is_empty(),
|
||||||
|
"a successful tools/call made with another key must not complete onboarding"
|
||||||
|
);
|
||||||
|
|
||||||
|
let selected_success = post_jsonrpc(
|
||||||
|
&client,
|
||||||
|
&mcp_url,
|
||||||
|
&selected_key,
|
||||||
|
Some(&selected_session),
|
||||||
|
json!({
|
||||||
|
"jsonrpc":"2.0",
|
||||||
|
"id":5,
|
||||||
|
"method":"tools/call",
|
||||||
|
"params":{
|
||||||
|
"name":operation.name,
|
||||||
|
"arguments":{"email":"selected@example.com"}
|
||||||
|
}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
assert_eq!(selected_success["result"]["isError"], false);
|
||||||
|
|
||||||
|
let exact_successes = exact_key_successes(®istry, &operation.id, &selected_key_id).await;
|
||||||
|
assert_eq!(
|
||||||
|
exact_successes.len(),
|
||||||
|
1,
|
||||||
|
"onboarding must complete from exactly one successful public tools/call made with the selected key"
|
||||||
|
);
|
||||||
|
assert_eq!(
|
||||||
|
exact_successes[0]["platform_api_key_id"], selected_key_id,
|
||||||
|
"successful invocation evidence must retain the typed key identity"
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
exact_successes[0]["request_id"]
|
||||||
|
.as_str()
|
||||||
|
.is_some_and(|id| !id.is_empty())
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
exact_successes[0]["trace_id"]
|
||||||
|
.as_str()
|
||||||
|
.is_some_and(|id| id.len() == 32)
|
||||||
|
);
|
||||||
|
|
||||||
|
// A direct MCP call can precede the first onboarding snapshot. The later
|
||||||
|
// server-owned eligibility write must repair the completion event without
|
||||||
|
// replacing the invocation timestamp that anchored the exact lineage.
|
||||||
|
let projection = registry
|
||||||
|
.ensure_onboarding_eligibility(&test_workspace_id(), OffsetDateTime::now_utc())
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
let operation_summary = registry
|
||||||
|
.get_operation_summary(&test_workspace_id(), &operation.id)
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert!(
|
||||||
|
projection.completed,
|
||||||
|
"projection did not complete: {projection:#?}; operation: {operation_summary:#?}"
|
||||||
|
);
|
||||||
|
let completion_events = registry
|
||||||
|
.list_product_events(ListProductEventsQuery {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
kind: Some(ProductEventKind::OnboardingCompleted),
|
||||||
|
created_after: OffsetDateTime::UNIX_EPOCH,
|
||||||
|
created_before: OffsetDateTime::now_utc() + time::Duration::minutes(1),
|
||||||
|
limit: 10,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap();
|
||||||
|
assert_eq!(completion_events.len(), 1);
|
||||||
|
assert_eq!(
|
||||||
|
completion_events[0].event.occurred_at,
|
||||||
|
projection.first_call_at.unwrap()
|
||||||
|
);
|
||||||
|
|
||||||
|
let persisted_evidence = invocation_evidence(®istry, &operation.id).await;
|
||||||
|
assert!(!persisted_evidence.is_empty());
|
||||||
|
for evidence in persisted_evidence {
|
||||||
|
let serialized = serde_json::to_string(&evidence).unwrap();
|
||||||
|
assert!(
|
||||||
|
!serialized.contains(&selected_key),
|
||||||
|
"raw Bearer canary must never appear in serialized invocation evidence"
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
!serialized.contains(&other_key),
|
||||||
|
"another raw Bearer secret must never appear in serialized invocation evidence"
|
||||||
|
);
|
||||||
|
for field in ["message", "request_preview", "response_preview"] {
|
||||||
|
let persisted_field = serde_json::to_string(&evidence[field]).unwrap();
|
||||||
|
assert!(
|
||||||
|
!persisted_field.contains(&selected_key),
|
||||||
|
"raw Bearer canary leaked into persisted {field}"
|
||||||
|
);
|
||||||
|
assert!(
|
||||||
|
!persisted_field.contains(&other_key),
|
||||||
|
"another raw Bearer secret leaked into persisted {field}"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn exact_key_successes(
|
||||||
|
registry: &crank_registry::PostgresRegistry,
|
||||||
|
operation_id: &crank_core::OperationId,
|
||||||
|
selected_key_id: &str,
|
||||||
|
) -> Vec<serde_json::Value> {
|
||||||
|
invocation_evidence(registry, operation_id)
|
||||||
|
.await
|
||||||
|
.into_iter()
|
||||||
|
.filter(|log| {
|
||||||
|
log.get("platform_api_key_id")
|
||||||
|
.and_then(serde_json::Value::as_str)
|
||||||
|
== Some(selected_key_id)
|
||||||
|
&& log.get("status").and_then(serde_json::Value::as_str) == Some("ok")
|
||||||
|
})
|
||||||
|
.collect()
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn invocation_evidence(
|
||||||
|
registry: &crank_registry::PostgresRegistry,
|
||||||
|
operation_id: &crank_core::OperationId,
|
||||||
|
) -> Vec<serde_json::Value> {
|
||||||
|
registry
|
||||||
|
.list_invocation_logs(ListInvocationLogsQuery {
|
||||||
|
workspace_id: &test_workspace_id(),
|
||||||
|
level: None,
|
||||||
|
status: None,
|
||||||
|
outcome_group: None,
|
||||||
|
search_text: None,
|
||||||
|
source: Some(InvocationSource::AgentToolCall),
|
||||||
|
operation_id: Some(operation_id),
|
||||||
|
agent_id: None,
|
||||||
|
created_after: None,
|
||||||
|
created_before: None,
|
||||||
|
cursor_created_at: None,
|
||||||
|
cursor_id: None,
|
||||||
|
limit: 100,
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
.unwrap()
|
||||||
|
.into_iter()
|
||||||
|
.map(|record| serde_json::to_value(record.log).unwrap())
|
||||||
|
.collect()
|
||||||
|
}
|
||||||
@@ -135,6 +135,26 @@
|
|||||||
|
|
||||||
.refresh-btn:hover { color: var(--text-secondary); background: var(--bg-muted); }
|
.refresh-btn:hover { color: var(--text-secondary); background: var(--bg-muted); }
|
||||||
|
|
||||||
|
.refresh-btn:disabled {
|
||||||
|
opacity: 0.55;
|
||||||
|
cursor: not-allowed;
|
||||||
|
}
|
||||||
|
|
||||||
|
.log-pagination {
|
||||||
|
display: flex;
|
||||||
|
justify-content: center;
|
||||||
|
padding: 12px 20px 18px;
|
||||||
|
}
|
||||||
|
|
||||||
|
.log-pagination .refresh-btn {
|
||||||
|
margin-left: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
.log-id-filter {
|
||||||
|
width: 180px;
|
||||||
|
margin: 0;
|
||||||
|
}
|
||||||
|
|
||||||
.approval-panel {
|
.approval-panel {
|
||||||
margin-bottom: 18px;
|
margin-bottom: 18px;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,82 @@
|
|||||||
|
.onboarding-trigger {
|
||||||
|
position: fixed;
|
||||||
|
right: 22px;
|
||||||
|
bottom: 22px;
|
||||||
|
z-index: 780;
|
||||||
|
display: inline-flex;
|
||||||
|
align-items: center;
|
||||||
|
gap: 8px;
|
||||||
|
min-height: 42px;
|
||||||
|
padding: 9px 14px;
|
||||||
|
border: 1px solid var(--border-color, #30363d);
|
||||||
|
border-radius: 999px;
|
||||||
|
background: var(--surface-raised, #161b22);
|
||||||
|
color: var(--text-primary, #f0f6fc);
|
||||||
|
box-shadow: 0 8px 28px rgba(0, 0, 0, .28);
|
||||||
|
cursor: pointer;
|
||||||
|
font: inherit;
|
||||||
|
font-weight: 600;
|
||||||
|
}
|
||||||
|
|
||||||
|
.onboarding-trigger:hover { border-color: var(--accent, #58a6ff); }
|
||||||
|
.onboarding-trigger:focus-visible,
|
||||||
|
.onboarding-panel button:focus-visible,
|
||||||
|
.onboarding-panel a:focus-visible { outline: 2px solid var(--accent, #58a6ff); outline-offset: 2px; }
|
||||||
|
|
||||||
|
.onboarding-panel {
|
||||||
|
position: fixed;
|
||||||
|
right: 22px;
|
||||||
|
bottom: 76px;
|
||||||
|
z-index: 790;
|
||||||
|
width: min(410px, calc(100vw - 28px));
|
||||||
|
max-height: min(700px, calc(100vh - 104px));
|
||||||
|
overflow: auto;
|
||||||
|
scroll-behavior: auto;
|
||||||
|
border: 1px solid var(--border-color, #30363d);
|
||||||
|
border-radius: 14px;
|
||||||
|
background: var(--surface-raised, #161b22);
|
||||||
|
color: var(--text-primary, #f0f6fc);
|
||||||
|
box-shadow: 0 18px 48px rgba(0, 0, 0, .4);
|
||||||
|
}
|
||||||
|
|
||||||
|
.onboarding-panel[hidden] { display: none; }
|
||||||
|
.onboarding-head { display: flex; justify-content: space-between; gap: 12px; padding: 17px 18px 12px; border-bottom: 1px solid var(--border-color, #30363d); }
|
||||||
|
.onboarding-title { margin: 0; font-size: 17px; }
|
||||||
|
.onboarding-subtitle { margin: 4px 0 0; color: var(--text-muted, #8b949e); font-size: 12px; }
|
||||||
|
.onboarding-head-actions { display: flex; gap: 4px; }
|
||||||
|
.onboarding-icon-button { border: 0; background: transparent; color: inherit; cursor: pointer; border-radius: 6px; min-width: 32px; min-height: 32px; }
|
||||||
|
.onboarding-body { padding: 14px 18px 18px; }
|
||||||
|
.onboarding-status { min-height: 20px; color: var(--text-muted, #8b949e); font-size: 12px; margin-bottom: 10px; }
|
||||||
|
.onboarding-error { padding: 12px; border: 1px solid var(--danger, #f85149); border-radius: 8px; color: var(--danger, #f85149); }
|
||||||
|
.onboarding-error-ids { margin-top: 6px; overflow-wrap: anywhere; font-size: 12px; }
|
||||||
|
.onboarding-list { list-style: none; margin: 0; padding: 0; display: grid; gap: 8px; }
|
||||||
|
.onboarding-step { display: grid; grid-template-columns: 26px 1fr; gap: 9px; padding: 10px; border: 1px solid var(--border-color, #30363d); border-radius: 9px; }
|
||||||
|
.onboarding-step[aria-current="step"] { border-color: var(--accent, #58a6ff); background: rgba(88, 166, 255, .08); }
|
||||||
|
.onboarding-step.is-regressed { border-color: var(--amber, #d29922); }
|
||||||
|
.onboarding-step-marker { display: grid; place-items: center; width: 24px; height: 24px; border-radius: 50%; background: var(--surface-muted, #21262d); font-size: 12px; }
|
||||||
|
.onboarding-step.is-complete .onboarding-step-marker { background: var(--success, #3fb950); color: #07140a; }
|
||||||
|
.onboarding-step-title { font-weight: 600; font-size: 13px; }
|
||||||
|
.onboarding-step-reason { margin-top: 3px; color: var(--text-muted, #8b949e); font-size: 12px; }
|
||||||
|
.onboarding-step-action { margin-top: 8px; border: 0; border-radius: 7px; padding: 7px 10px; background: var(--accent, #58a6ff); color: #08111c; font: inherit; font-size: 12px; font-weight: 600; cursor: pointer; }
|
||||||
|
.onboarding-completion { padding: 12px; border: 1px solid var(--success, #3fb950); border-radius: 9px; overflow-wrap: anywhere; }
|
||||||
|
.onboarding-completion a { color: var(--accent, #58a6ff); }
|
||||||
|
.onboarding-first-call-evidence { display: grid; grid-template-columns: max-content 1fr; gap: 4px 10px; margin: 10px 0; font-size: 12px; }
|
||||||
|
.onboarding-first-call-evidence dt { color: var(--text-muted, #8b949e); }
|
||||||
|
.onboarding-first-call-evidence dd { margin: 0; font-family: var(--font-mono, monospace); overflow-wrap: anywhere; }
|
||||||
|
.onboarding-deep-link-stale { position: fixed; left: 50%; top: 76px; z-index: 810; width: min(520px, calc(100vw - 28px)); transform: translateX(-50%); padding: 14px; border: 1px solid var(--amber, #d29922); border-radius: 10px; background: var(--surface-raised, #161b22); color: var(--text-primary, #f0f6fc); box-shadow: 0 12px 36px rgba(0, 0, 0, .35); }
|
||||||
|
.onboarding-footer { display: flex; justify-content: space-between; gap: 8px; margin-top: 12px; }
|
||||||
|
.onboarding-link-button { border: 0; background: transparent; color: var(--text-muted, #8b949e); text-decoration: underline; cursor: pointer; font: inherit; font-size: 12px; }
|
||||||
|
|
||||||
|
/* Active task surfaces own the pointer plane. The optional onboarding helper
|
||||||
|
must never cover drawer controls while guiding the user through that drawer. */
|
||||||
|
body:has(.drawer.open) .onboarding-trigger,
|
||||||
|
body:has(.drawer.open) .onboarding-panel { z-index: 149; }
|
||||||
|
|
||||||
|
@media (max-width: 640px) {
|
||||||
|
.onboarding-trigger { right: 14px; bottom: 14px; }
|
||||||
|
.onboarding-panel { right: 14px; bottom: 68px; }
|
||||||
|
}
|
||||||
|
|
||||||
|
@media (prefers-reduced-motion: reduce) {
|
||||||
|
.onboarding-panel, .onboarding-trigger { transition: none !important; animation: none !important; scroll-behavior: auto; }
|
||||||
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user