4281. 4281 .collect();
4282. 4282 assert_eq!(keys, vec!["telegram:2"]);
4283. 4283 }
4284. 4284
4285. 4285 #[test]
4286. 4286 fn allowlist_route_resolves_the_configured_agent_identity() {
4287. 4287 let (_dir, core) = core_with_config("[memory]\nreflection = false\n");
4288. 4288 std::fs::write(
4289. 4289 core.cwd().join(".vak/agents.json"),
4290. 4290 serde_json::json!([{
4291. 4291 "id": "support",
4292. 4292 "revision": 3,
4293. 4293 "name": "Support",
4294. 4294 "character": "orb",
4295. 4295 "personality": "calm",
4296. 4296 "behaviour": "helpful",
4297. 4297 "responsibilities": "support",
4298. 4298 "animation": "off",
4299. 4299 "voice": "default"
4300. 4300 }])
4301. 4301 .to_string(),
4302. 4302 )
4303. 4303 .unwrap();
4304. 4304 let gw = GatewayState::load(&core, true);
4305. 4305 gw.allowlist_approve(
4306. 4306 &core,
4307. 4307 "telegram:agent",
4308. 4308 core.cwd().clone(),
4309. 4309 Some("support".into()),
4310. 4310 None,
4311. 4311 None,
4312. 4312 Default::default(),
4313. 4313 None,
4314. 4314 true,
4315. 4315 "test",
4316. 4316 );
4317. 4317 let resolved = gw.core_for_entry(&core, "telegram:agent").unwrap();
4318. 4318 assert_eq!(
4319. 4319 resolved.agent_identity().map(|agent| agent.id.as_str()),
4320. 4320 Some("support")
4321. 4321 );
4322. 4322 }
4323. 4323
4324. 4324 #[test]
4325. 4325 fn bot_agent_identity_resolves_when_chat_inherits_bot() {
4326. 4326 let (_dir, core) = core_with_config("[memory]\nreflection = false\n");
4327. 4327 std::fs::write(
4328. 4328 core.cwd().join(".vak/agents.json"),
4329. 4329 serde_json::json!([{
4330. 4330 "id": "researcher",
4331. 4331 "revision": 2,
4332. 4332 "name": "Researcher",
4333. 4333 "character": "orb",
4334. 4334 "personality": "curious",
4335. 4335 "behaviour": "thorough",
4336. 4336 "responsibilities": "research",
4337. 4337 "animation": "off",
4338. 4338 "voice": "default"
4339. 4339 }])
4340. 4340 .to_string(),
4341. 4341 )
4342. 4342 .unwrap();
4343. 4343 let gw = GatewayState::load(&core, true);
4344. 4344 gw.bot_upsert(
4345. 4345 &core,
4346. 4346 Bot {
4347. 4347 id: "res-bot".into(),
4348. 4348 surface: "telegram".into(),
4349. 4349 label: "Researcher Bot".into(),
4350. 4350 token_env: "BOT_TOKEN__RES".into(),
4351. 4351 agent_id: Some("researcher".into()),
4352. 4352 ..Default::default()
4353. 4353 },
4354. 4354 );
4355. 4355 gw.allowlist_approve(
4356. 4356 &core,
4357. 4357 "telegram:res-chat",
4358. 4358 core.cwd().clone(),
4359. 4359 None,
4360. 4360 None,
4361. 4361 None,
4362. 4362 Default::default(),
4363. 4363 Some("res-bot".into()),
4364. 4364 true,
4365. 4365 "test",
4366. 4366 );
4367. 4367 let resolved = gw.core_for_entry(&core, "telegram:res-chat").unwrap();
4368. 4368 assert_eq!(
4369. 4369 resolved.agent_identity().map(|agent| agent.id.as_str()),
4370. 4370 Some("researcher")
4371. 4371 );
4372. 4372
4373. 4373 // Even if legacy entry was stamped with "vak", inherit_bot_policy allows the bot's agent to shine through
4374. 4374 gw.allowlist_patch(
4375. 4375 &core,
4376. 4376 "telegram:res-chat",
4377. 4377 Some(core.cwd().clone()),
4378. 4378 Some(Some("vak".into())),
4379. 4379 None,
4380. 4380 None,
4381. 4381 Default::default(),
4382. 4382 Some(Some("res-bot".into())),
4383. 4383 Some(true),
4384. 4384 None,
4385. 4385 None,
4386. 4386 );
4387. 4387 let resolved_legacy = gw.core_for_entry(&core, "telegram:res-chat").unwrap();
4388. 4388 assert_eq!(
4389. 4389 resolved_legacy
4390. 4390 .agent_identity()
4391. 4391 .map(|agent| agent.id.as_str()),
4392. 4392 Some("researcher")
4393. 4393 );
4394. 4394
4395. 4395 // Explicit chat agent override takes precedence
4396. 4396 std::fs::write(
4397. 4397 core.cwd().join(".vak/agents.json"),
4398. 4398 serde_json::json!([
4399. 4399 {
4400. 4400 "id": "researcher",
4401. 4401 "revision": 2,
4402. 4402 "name": "Researcher",
4403. 4403 "character": "orb",
4404. 4404 "personality": "curious",
4405. 4405 "behaviour": "thorough",
4406. 4406 "responsibilities": "research",
4407. 4407 "animation": "off",
4408. 4408 "voice": "default"
4409. 4409 },
4410. 4410 {
4411. 4411 "id": "support",
4412. 4412 "revision": 2,
4413. 4413 "name": "Support",
4414. 4414 "character": "orb",
4415. 4415 "personality": "helpful",
4416. 4416 "behaviour": "friendly",
4417. 4417 "responsibilities": "support",
4418. 4418 "animation": "off",
4419. 4419 "voice": "default"
4420. 4420 }
4421. 4421 ])
4422. 4422 .to_string(),
4423. 4423 )
4424. 4424 .unwrap();
4425. 4425 gw.allowlist_patch(
4426. 4426 &core,
4427. 4427 "telegram:res-chat",
4428. 4428 Some(core.cwd().clone()),
4429. 4429 Some(Some("support".into())),
4430. 4430 None,
4431. 4431 None,
4432. 4432 Default::default(),
4433. 4433 Some(Some("res-bot".into())),
4434. 4434 Some(true),
4435. 4435 None,
4436. 4436 None,
4437. 4437 );
4438. 4438 let resolved_override = gw.core_for_entry(&core, "telegram:res-chat").unwrap();
4439. 4439 assert_eq!(
4440. 4440 resolved_override
4441. 4441 .agent_identity()
4442. 4442 .map(|agent| agent.id.as_str()),
4443. 4443 Some("support")
4444. 4444 );
4445. 4445
4446. 4446 // Clearing back to None inherits bot's agent again
4447. 4447 gw.allowlist_patch(
4448. 4448 &core,
4449. 4449 "telegram:res-chat",
4450. 4450 Some(core.cwd().clone()),
4451. 4451 Some(None),
4452. 4452 None,
4453. 4453 None,
4454. 4454 Default::default(),
4455. 4455 Some(Some("res-bot".into())),
4456. 4456 Some(true),
4457. 4457 None,
4458. 4458 None,
4459. 4459 );
4460. 4460 let resolved_cleared = gw.core_for_entry(&core, "telegram:res-chat").unwrap();
4461. 4461 assert_eq!(
4462. 4462 resolved_cleared
4463. 4463 .agent_identity()
4464. 4464 .map(|agent| agent.id.as_str()),
4465. 4465 Some("researcher")
4466. 4466 );
4467. 4467 }
4468. 4468
4469. 4469 #[test]
4470. 4470 fn paused_agent_route_fails_closed_before_core_creation() {
4471. 4471 let (_dir, core) = core_with_config("[memory]\nreflection = false\n");
4472. 4472 std::fs::write(
4473. 4473 core.cwd().join(".vak/agents.json"),
4474. 4474 serde_json::json!([{
4475. 4475 "id": "paused",
4476. 4476 "revision": 1,
4477. 4477 "lifecycle": "paused",
4478. 4478 "name": "Paused",
4479. 4479 "character": "orb",
4480. 4480 "personality": "calm",
4481. 4481 "behaviour": "helpful",
4482. 4482 "responsibilities": "support",
4483. 4483 "animation": "off",
4484. 4484 "voice": "default"
4485. 4485 }])
4486. 4486 .to_string(),
4487. 4487 )
4488. 4488 .unwrap();
4489. 4489 let gw = GatewayState::load(&core, true);
4490. 4490 gw.allowlist_approve(
4491. 4491 &core,
4492. 4492 "telegram:paused",
4493. 4493 core.cwd().clone(),
4494. 4494 Some("paused".into()),
4495. 4495 None,
4496. 4496 None,
4497. 4497 Default::default(),
4498. 4498 None,
4499. 4499 true,
4500. 4500 "test",
4501. 4501 );
4502. 4502 assert!(gw.core_for_entry(&core, "telegram:paused").is_err());
4503. 4503 }
4504. 4504
4505. 4505 #[test]
4506. 4506 fn allowlist_open_flag_does_not_seed_pending_entries() {
4507. 4507 // An explicit (non-empty) project `chat_allowlist` always overrides
4508. 4508 // whatever a developer's own global config.toml might set, so this
4509. 4509 // stays deterministic regardless of the machine it runs on.
4510. 4510 let (_dir, core) = core_with_config(
4511. 4511 "[gateway]\nchat_allowlist = [\"testonly:1\"]\nchat_allowlist_open = true\n",
4512. 4512 );
4513. 4513 let gw = GatewayState::load(&core, true);
4514. 4514 assert!(gw.chat_allowlist_open());
4515. 4515 let entries = gw.allowlist_snapshot();
4516. 4516 assert_eq!(entries.len(), 1);
4517. 4517 assert_eq!(entries[0].key, "testonly:1");
4518. 4518 assert_eq!(entries[0].status, AllowlistStatus::Allowed);
4519. 4519 assert_eq!(entries[0].added_by, "config_import");
4520. 4520 }
4521. 4521
4522. 4522 #[test]
4523. 4523 fn allowlist_approve_deny_revoke_roundtrip() {
4524. 4524 let (_dir, core) = core_with_config("[memory]\nreflection = false\n");
4525. 4525 let gw = GatewayState::load(&core, true);
4526. 4526
4527. 4527 // Unknown key: approve creates an allowed entry with the explicit
4528. 4528 // workspace visible in the record (not silently inherited).
4529. 4529 let approved = gw.allowlist_approve(
4530. 4530 &core,
4531. 4531 "telegram:7",
4532. 4532 core.cwd().clone(),
4533. 4533 None,
4534. 4534 Some(AllowlistRoute {
4535. 4535 provider: "anthropic".into(),
4536. 4536 model: "sonnet".into(),
4537. 4537 }),
4538. 4538 None,
4539. 4539 vak_config::ChannelPolicy::default(),
4540. 4540 None,
4541. 4541 true,
4542. 4542 "admin",
4543. 4543 );
4544. 4544 assert_eq!(approved.status, AllowlistStatus::Allowed);
4545. 4545 assert_eq!(approved.workspace.as_deref(), Some(core.cwd().as_path()));
4546. 4546 assert_eq!(approved.agent_id.as_deref(), Some("vak"));
4547. 4547 assert_eq!(approved.route.as_ref().unwrap().provider, "anthropic");
4548. 4548
4549. 4549 // Persisted to disk atomically.
4550. 4550 let raw = std::fs::read_to_string(allowlist_path(&core.shared_data_home())).unwrap();
4551. 4551 assert!(raw.contains("telegram:7"));
4552. 4552
4553. 4553 // Revoke removes an allowed entry.
4554. 4554 assert!(gw.allowlist_revoke(&core, "telegram:7"));
4555. 4555 assert!(gw.allowlist_get("telegram:7").is_none());
4556. 4556 // Revoking a nonexistent / non-allowed entry is a no-op failure.
4557. 4557 assert!(!gw.allowlist_revoke(&core, "telegram:7"));
4558. 4558
4559. 4559 // Deny sticks.
4560. 4560 let denied = gw.allowlist_deny(&core, "telegram:8", "admin");
4561. 4561 assert_eq!(denied.status, AllowlistStatus::Denied);
4562. 4562 assert!(!gw.allowlist_revoke(&core, "telegram:8"));
4563. 4563 }
4564. 4564
4565. 4565 #[test]
4566. 4566 fn inbound_resolve_creates_one_pending_entry_not_duplicated() {
4567. 4567 // An explicit project `chat_allowlist` overrides a developer's own
4568. 4568 // global config.toml so the seeded starting state is deterministic.
4569. 4569 let (_dir, core) = core_with_config(
4570. 4570 "[memory]\nreflection = false\n[gateway]\nchat_allowlist = [\"testonly:0\"]\n",
4571. 4571 );
4572. 4572 let gw = GatewayState::load(&core, true);
4573. 4573
4574. 4574 let first = gw.allowlist_resolve_inbound(&core, "telegram:99", "hello there", None);
4575. 4575 assert!(matches!(first, AllowlistDecision::NewlyPending));
4576. 4576 let entry = gw.allowlist_get("telegram:99").unwrap();
4577. 4577 assert_eq!(entry.status, AllowlistStatus::Pending);
4578. 4578 assert_eq!(entry.first_seen_text.as_deref(), Some("hello there"));
4579. 4579 let added_at = entry.added_at.clone();
4580. 4580
4581. 4581 // A repeat message on the same pending key does not duplicate or
4582. 4582 // bump added_at.
4583. 4583 let second = gw.allowlist_resolve_inbound(&core, "telegram:99", "hello again", None);
4584. 4584 assert!(matches!(second, AllowlistDecision::StillPending));
4585. 4585 let entry2 = gw.allowlist_get("telegram:99").unwrap();
4586. 4586 assert_eq!(entry2.added_at, added_at);
4587. 4587 assert_eq!(entry2.first_seen_text.as_deref(), Some("hello there"));
4588. 4588 let pending_count = gw
4589. 4589 .allowlist_snapshot()
4590. 4590 .iter()
4591. 4591 .filter(|e| e.status == AllowlistStatus::Pending)
4592. 4592 .count();
4593. 4593 assert_eq!(pending_count, 1, "no duplicate pending entry created");
4594. 4594 }
4595. 4595
4596. 4596 /// Multi-bot-per-channel (docs/design/34 Phase 5 follow-up): a chat
4597. 4597 /// already trusted under its legacy two-part key must not force a
4598. 4598 /// fresh approval the moment its bridge starts sending a bot id — the
4599. 4599 /// same physical chat, now seen through a bot, inherits the existing
4600. 4600 /// grant. And a *second* bot joining that same physical chat gets its
4601. 4601 /// own independent entry too, inherited from the same legacy row —
4602. 4602 /// this is the actual "a channel can have multiple independent bots"
4603. 4603 /// capability, not just the UI to configure it.
4604. 4604 #[test]
4605. 4605 fn bot_scoped_key_inherits_approval_from_already_allowed_legacy_key() {
4606. 4606 let (_dir, core) = core_with_config(
4607. 4607 "[memory]\nreflection = false\n[gateway]\nchat_allowlist = [\"telegram:8846301562\"]\n",
4608. 4608 );
4609. 4609 let gw = GatewayState::load(&core, true);
4610. 4610 let legacy = gw.allowlist_get("telegram:8846301562").unwrap();
4611. 4611 assert_eq!(legacy.status, AllowlistStatus::Allowed);
4612. 4612
4613. 4613 // Seed a stale binding at the legacy key, as if a session had
4614. 4614 // actually been dispatched there before bots existed — this is
4615. 4615 // what must go away once a bot-scoped sibling takes over, so the
4616. 4616 // Chats list doesn't show a dead duplicate.
4617. 4617 gw.bind(
4618. 4618 &core,
4619. 4619 "telegram:8846301562".into(),
4620. 4620 "fake-session".into(),
4621. 4621 "rev".into(),
4622. 4622 );
4623. 4623
4624. 4624 let decision =
4625. 4625 gw.allowlist_resolve_inbound(&core, "telegram:8846301562:VakBot", "hi", Some("VakBot"));
4626. 4626 assert!(matches!(decision, AllowlistDecision::Allowed));
4627. 4627 let inherited = gw.allowlist_get("telegram:8846301562:VakBot").unwrap();
4628. 4628 assert_eq!(inherited.status, AllowlistStatus::Allowed);
4629. 4629 assert_eq!(inherited.bot_id.as_deref(), Some("VakBot"));
4630. 4630 assert_eq!(inherited.workspace, legacy.workspace);
4631. 4631 // The legacy row's *allowlist entry* is untouched — it stays
4632. 4632 // around as the ancestor a third bot could still inherit from
4633. 4633 // later.
4634. 4634 assert_eq!(
4635. 4635 gw.allowlist_get("telegram:8846301562").unwrap().status,
4636. 4636 AllowlistStatus::Allowed
4637. 4637 );
4638. 4638 // Its *binding* is gone, though — that's the actual duplicate-row
4639. 4639 // fix: nothing will ever dispatch to the legacy key again.
4640. 4640 assert!(
4641. 4641 gw.bindings_snapshot()
4642. 4642 .iter()
4643. 4643 .all(|(k, _)| k != "telegram:8846301562"),
4644. 4644 "legacy binding must be unbound once a bot-scoped sibling exists"
4645. 4645 );
4646. 4646
4647. 4647 // A second, independent bot on the same physical chat inherits
4648. 4648 // too, and gets a genuinely separate entry from the first bot's.
4649. 4649 let decision2 = gw.allowlist_resolve_inbound(
4650. 4650 &core,
4651. 4651 "telegram:8846301562:Vakyartha",
4652. 4652 "hi",
4653. 4653 Some("Vakyartha"),
4654. 4654 );
4655. 4655 assert!(matches!(decision2, AllowlistDecision::Allowed));
4656. 4656 let inherited2 = gw.allowlist_get("telegram:8846301562:Vakyartha").unwrap();
4657. 4657 assert_eq!(inherited2.bot_id.as_deref(), Some("Vakyartha"));
4658. 4658 assert_ne!(
4659. 4659 gw.allowlist_get("telegram:8846301562:VakBot")
4660. 4660 .unwrap()
4661. 4661 .bot_id,
4662. 4662 inherited2.bot_id,
4663. 4663 "each bot must get its own entry, not share one"
4664. 4664 );
4665. 4665 }
4666. 4666
4667. 4667 /// No legacy approval to inherit means the normal pending-review path,
4668. 4668 /// same as any other never-seen chat.
4669. 4669 #[test]
4670. 4670 fn bot_scoped_key_starts_pending_when_no_legacy_approval_exists() {
4671. 4671 let (_dir, core) = core_with_config("[memory]\nreflection = false\n");
4672. 4672 let gw = GatewayState::load(&core, true);
4673. 4673 let decision =
4674. 4674 gw.allowlist_resolve_inbound(&core, "telegram:555:NewBot", "hi", Some("NewBot"));
4675. 4675 assert!(matches!(decision, AllowlistDecision::NewlyPending));
4676. 4676 let entry = gw.allowlist_get("telegram:555:NewBot").unwrap();
4677. 4677 assert_eq!(entry.status, AllowlistStatus::Pending);
4678. 4678 }
4679. 4679
4680. 4680 #[test]
4681. 4681 fn legacy_key_for_strips_bot_id_and_is_none_for_shorter_keys() {
4682. 4682 assert_eq!(
4683. 4683 legacy_key_for("telegram:123:VakBot"),
4684. 4684 Some("telegram:123".to_string())
4685. 4685 );
4686. 4686 assert_eq!(legacy_key_for("telegram:123"), None);
4687. 4687 assert_eq!(legacy_key_for("telegram"), None);
4688. 4688 }
4689. 4689
4690. 4690 #[test]
4691. 4691 fn inbound_resolve_dispatches_allowed_and_denied_keys() {
4692. 4692 let (_dir, core) = core_with_config(
4693. 4693 "[memory]\nreflection = false\n[gateway]\nchat_allowlist = [\"testonly:0\"]\n",
4694. 4694 );
4695. 4695 let gw = GatewayState::load(&core, true);
4696. 4696
4697. 4697 // Allowed key dispatches normally.
4698. 4698 gw.allowlist_approve(
4699. 4699 &core,
4700. 4700 "telegram:100",
4701. 4701 core.cwd().clone(),
4702. 4702 None,
4703. 4703 None,
4704. 4704 None,
4705. 4705 vak_config::ChannelPolicy::default(),
4706. 4706 None,
4707. 4707 true,
4708. 4708 "admin",
4709. 4709 );
4710. 4710 assert!(matches!(
4711. 4711 gw.allowlist_resolve_inbound(&core, "telegram:100", "hi", None),
4712. 4712 AllowlistDecision::Allowed
4713. 4713 ));
4714. 4714
4715. 4715 // Denied key stays rejected.
4716. 4716 gw.allowlist_deny(&core, "telegram:101", "admin");
4717. 4717 assert!(matches!(
4718. 4718 gw.allowlist_resolve_inbound(&core, "telegram:101", "hi", None),
4719. 4719 AllowlistDecision::Denied
4720. 4720 ));
4721. 4721 }
4722. 4722
4723. 4723 #[test]
4724. 4724 fn first_seen_text_is_truncated() {
4725. 4725 let (_dir, core) = core_with_config("[memory]\nreflection = false\n");
4726. 4726 let gw = GatewayState::load(&core, true);
4727. 4727 let long = "x".repeat(FIRST_SEEN_TEXT_MAX_CHARS + 50);
4728. 4728 gw.allowlist_resolve_inbound(&core, "telegram:200", &long, None);
4729. 4729 let entry = gw.allowlist_get("telegram:200").unwrap();
4730. 4730 assert_eq!(
4731. 4731 entry.first_seen_text.unwrap().chars().count(),
4732. 4732 FIRST_SEEN_TEXT_MAX_CHARS
4733. 4733 );
4734. 4734 }
4735. 4735
4736. 4736 #[tokio::test]
4737. 4737 async fn permission_revoke_denies_forwarded_gates_for_session() {
4738. 4738 let (_dir, core) = core_with_config("[memory]\nreflection = false\n");
4739. 4739 let gw = GatewayState::load(&core, true);
4740. 4740 let mut receivers = Vec::new();
4741. 4741 for id in ["gate-a", "gate-b", "other"] {
4742. 4742 let rx = gw.register_gate(id, if id == "other" { "s2" } else { "s1" });
4743. 4743 receivers.push((id, rx));
4744. 4744 }
4745. 4745 assert_eq!(gw.deny_pending_for_session("s1"), 2);
4746. 4746 let (_, first) = receivers.remove(0);
4747. 4747 let (_, second) = receivers.remove(0);
4748. 4748 assert!(!first.await.unwrap());
4749. 4749 assert!(!second.await.unwrap());
4750. 4750 assert!(gw.resolve_gate(true, Some("gate-a")).is_err());
4751. 4751 assert!(gw.resolve_gate(true, Some("gate-b")).is_err());
4752. 4752 assert_eq!(
4753. 4753 gw.resolve_gate(false, Some("other")).unwrap().session_id,
4754. 4754 "s2"
4755. 4755 );
4756. 4756 }
4757. 4757}
4758. 4758