forked from bai/curriculum-project-hub
hongjr03
afaf5bee09
RoleEntry 扩成 (model, systemPrompt, tools) bundle,id 兼任 slash command 名。 ToolRegistry.subset() 支持按白名单构造 per-run 视图,模型永远看不到 role 外的工具。 trigger 解析 /<role> 命令,查 RoleEntry 组装 systemPrompt + 子集 registry 传给 runner。 新增 RoleTriggerGrant 表 + canTriggerRole gate,与 ADR-0004 canTriggerAgent 串联: 先问'能不能触发 agent',再问'能触发哪个 role'。未配置 role 放行(back-compat)。 - models.ts: RoleEntry 加 systemPrompt + tools 字段 - tools.ts: ToolRegistry.subset(names) 返回共享 handler 的子集视图 - trigger.ts: extractRole 解析 slash; 传 systemPrompt + runTools; catch 链容错 P2025 - runner.ts: RunRequest.systemPrompt 改 string | undefined (exactOptionalPropertyTypes) - schema.prisma + migration: RoleTriggerGrant(projectId, roleId, principal, revokedAt) - permission.ts: canTriggerRole gate (有 grant 记录即白名单模式,含 revoked) - server.ts: draft/review 两个 role 加 systemPrompt + tools 白名单 - 测试: role-permission.test.ts (5) + trigger.test.ts (+3), 53 全绿
72 lines
2.9 KiB
TypeScript
72 lines
2.9 KiB
TypeScript
import { describe, it, expect, beforeEach, afterAll } from "vitest";
|
|
import { prisma, resetDb } from "./helpers.js";
|
|
import { canTriggerRole } from "../../src/permission.js";
|
|
|
|
describe("canTriggerRole (integration, per-role gate)", () => {
|
|
beforeEach(async () => {
|
|
await resetDb();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await prisma.$disconnect();
|
|
});
|
|
|
|
it("allows when role is unconfigured on the project (back-compat: open)", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-1", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "draft", "ou_a");
|
|
expect(r.allowed).toBe(true);
|
|
});
|
|
|
|
it("allows when principal holds an active grant for the role", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-2", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: project.id, roleId: "review", principal: "ou_a" },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "review", "ou_a");
|
|
expect(r.allowed).toBe(true);
|
|
});
|
|
|
|
it("denies when grants exist for the role but principal has none", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-3", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
// Someone else has the role; ou_b does not.
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: project.id, roleId: "review", principal: "ou_a" },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "review", "ou_b");
|
|
expect(r.allowed).toBe(false);
|
|
});
|
|
|
|
it("denies when the principal's grant was revoked", async () => {
|
|
const project = await prisma.project.create({
|
|
data: { id: "p-role-4", name: "T", workspaceDir: "/tmp/x" },
|
|
});
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: project.id, roleId: "review", principal: "ou_a", revokedAt: new Date() },
|
|
});
|
|
const r = await canTriggerRole(prisma, project.id, "review", "ou_a");
|
|
expect(r.allowed).toBe(false);
|
|
});
|
|
|
|
it("scopes grants per-project (grant on p1 does not allow on p2)", async () => {
|
|
const p1 = await prisma.project.create({ data: { id: "p-role-5a", name: "T", workspaceDir: "/tmp/x" } });
|
|
const p2 = await prisma.project.create({ data: { id: "p-role-5b", name: "T", workspaceDir: "/tmp/x" } });
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: p1.id, roleId: "review", principal: "ou_a" },
|
|
});
|
|
// p2 has the role configured for someone else; ou_a has no grant there.
|
|
await prisma.roleTriggerGrant.create({
|
|
data: { projectId: p2.id, roleId: "review", principal: "ou_other" },
|
|
});
|
|
const onP1 = await canTriggerRole(prisma, p1.id, "review", "ou_a");
|
|
expect(onP1.allowed).toBe(true);
|
|
const onP2 = await canTriggerRole(prisma, p2.id, "review", "ou_a");
|
|
expect(onP2.allowed).toBe(false);
|
|
});
|
|
});
|