1. 1//! Integration tests for multi-bot-per-channel identity
2. 2//! (docs/design/34 Phase 5 follow-up, AGENTS.md invariants 23-24).
3. 3//!
4. 4//! These tests verify the three-segment key resolution at the HTTP
5. 5//! `/gateway/inbound` boundary: a bot-scoped key (`surface:chat:bot_id`)
6. 6//! must inherit from an already-allowed legacy key, each bot gets an
7. 7//! independent entry, and a legacy (no bot_id) message still works.
8. 8
9. 9#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
10. 10
11. 11use std::collections::VecDeque;
12. 12use std::sync::{Arc, Mutex};
13. 13
14. 14use tokio_util::sync::CancellationToken;
15. 15
16. 16use vak_core::Core;
17. 17use vak_llm::stream;
18. 18use vak_llm::types::{AssistantMessage, ChatRequest, ContentBlock, Usage};
19. 19use vak_llm::{EventStream, LlmError, Provider};
20. 20
21. 21struct Scripted {
22. 22 responses: Mutex<VecDeque<AssistantMessage>>,
23. 23}
24. 24
25. 25#[async_trait::async_trait]
26. 26impl Provider for Scripted {
27. 27 fn name(&self) -> &'static str {
28. 28 "scripted"
29. 29 }
30. 30 async fn stream(
31. 31 &self,
32. 32 _request: ChatRequest,
33. 33 _cancel: CancellationToken,
34. 34 ) -> Result<EventStream, LlmError> {
35. 35 let next = self.responses.lock().unwrap().pop_front();
36. 36 let (mut sink, rx) = stream::channel(64);
37. 37 match next {
38. 38 Some(m) => {
39. 39 sink.push(stream::StreamEvent::Start { partial: m.clone() });
40. 40 sink.close_message(m).await;
41. 41 }
42. 42 None => sink.close_error(LlmError::Parse("exhausted".into())).await,
43. 43 }
44. 44 Ok(rx)
45. 45 }
46. 46}
47. 47
48. 48fn text(t: &str) -> AssistantMessage {
49. 49 AssistantMessage {
50. 50 content: vec![ContentBlock::text(t)],
51. 51 stop_reason: vak_llm::types::StopReason::EndTurn,
52. 52 usage: Usage {
53. 53 input_tokens: 7,
54. 54 output_tokens: 3,
55. 55 ..Default::default()
56. 56 },
57. 57 model: "test-model".into(),
58. 58 response_id: None,
59. 59 }
60. 60}
61. 61
62. 62/// Spawn a gateway server with the given allowlist and one scripted reply.
63. 63/// Uses `gateway_router` (no bearer auth) for simplicity.
64. 64async fn spawn_gateway(allowlist: &[&str]) -> String {
65. 65 let dir = tempfile::tempdir().unwrap();
66. 66 let cwd = dir.path().to_path_buf();
67. 67 let _ = std::fs::create_dir_all(cwd.join(".vak"));
68. 68 let list = allowlist
69. 69 .iter()
70. 70 .map(|k| format!("\"{k}\""))
71. 71 .collect::<Vec<_>>()
72. 72 .join(", ");
73. 73 let config = format!(
74. 74 "[memory]\nreflection = false\n[gateway]\nenabled = true\nchat_allowlist = [{list}]\n"
75. 75 );
76. 76 let _ = std::fs::write(cwd.join(".vak/config.toml"), &config);
77. 77 vak_config::paths::isolate_home_for_tests();
78. 78 let core = Core::new_with_trust(cwd.clone(), true).unwrap();
79. 79 core.set_sessions_home(dir.path().join("home"));
80. 80 core.set_provider_instance(Arc::new(Scripted {
81. 81 responses: Mutex::new(VecDeque::from(vec![text("hello")])),
82. 82 }));
83. 83 let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
84. 84 let addr = listener.local_addr().unwrap();
85. 85 tokio::spawn(async move {
86. 86 axum::serve(listener, vak_server::gateway_router(core))
87. 87 .await
88. 88 .unwrap();
89. 89 });
90. 90 format!("http://{addr}")
91. 91}
92. 92
93. 93/// POST a message to the gateway inbound endpoint (no auth for gateway_router).
94. 94async fn post_inbound(base: &str, body: serde_json::Value) -> reqwest::StatusCode {
95. 95 let client = reqwest::Client::new();
96. 96 client
97. 97 .post(format!("{base}/gateway/inbound"))
98. 98 .json(&body)
99. 99 .send()
100. 100 .await
101. 101 .unwrap()
102. 102 .status()
103. 103}
104. 104
105. 105/// Two bots sharing one physical chat get independent allowlist entries.
106. 106/// Bot A's message inherits the legacy approval; Bot B gets its own
107. 107/// independent entry (rule 24: one identity per bot).
108. 108#[tokio::test]
109. 109async fn two_bots_on_same_chat_get_independent_keys() {
110. 110 let base = spawn_gateway(&["telegram:12345"]).await;
111. 111
112. 112 // Bot A inherits from the pre-approved legacy key.
113. 113 let status_a = post_inbound(
114. 114 &base,
115. 115 serde_json::json!({
116. 116 "surface": "telegram",
117. 117 "chat": "12345",
118. 118 "text": "hi from Alpha",
119. 119 "bot_id": "Alpha",
120. 120 }),
121. 121 )
122. 122 .await;
123. 123 assert!(
124. 124 status_a.is_success(),
125. 125 "bot-scoped key with legacy approval must be allowed (got {status_a})"
126. 126 );
127. 127
128. 128 // Bot B — same physical chat, different bot identity. Also inherits
129. 129 // from the legacy key, but gets its own entry, session, and policy.
130. 130 let status_b = post_inbound(
131. 131 &base,
132. 132 serde_json::json!({
133. 133 "surface": "telegram",
134. 134 "chat": "12345",
135. 135 "text": "hi from Beta",
136. 136 "bot_id": "Beta",
137. 137 }),
138. 138 )
139. 139 .await;
140. 140 assert!(
141. 141 status_b.is_success(),
142. 142 "second bot on same chat must be independently allowed (got {status_b})"
143. 143 );
144. 144
145. 145 // A second message from Bot A should still be accepted (idempotent —
146. 146 // already-allowed bot-scoped key takes the same Allowed path).
147. 147 let status_a2 = post_inbound(
148. 148 &base,
149. 149 serde_json::json!({
150. 150 "surface": "telegram",
151. 151 "chat": "12345",
152. 152 "text": "second from Alpha",
153. 153 "bot_id": "Alpha",
154. 154 }),
155. 155 )
156. 156 .await;
157. 157 assert!(
158. 158 status_a2.is_success(),
159. 159 "repeat bot-scoped message must be allowed (got {status_a2})"
160. 160 );
161. 161}
162. 162
163. 163/// A bot-scoped key with no pre-approved legacy entry is rejected at the
164. 164/// gateway (pending review, AG-34).
165. 165#[tokio::test]
166. 166async fn bot_scoped_key_without_legacy_approval_is_rejected() {
167. 167 let base = spawn_gateway(&["telegram:99999"]).await;
168. 168
169. 169 let status = post_inbound(
170. 170 &base,
171. 171 serde_json::json!({
172. 172 "surface": "telegram",
173. 173 "chat": "11111",
174. 174 "text": "unapproved chat with bot",
175. 175 "bot_id": "SoloBot",
176. 176 }),
177. 177 )
178. 178 .await;
179. 179 assert!(
180. 180 !status.is_success(),
181. 181 "bot-scoped key without legacy approval must be rejected (got {status})"
182. 182 );
183. 183}
184. 184
185. 185/// A legacy (no bot_id) message to a pre-approved chat is allowed.
186. 186/// This confirms the two-segment key path still works after multi-bot
187. 187/// support was added (rule 24).
188. 188#[tokio::test]
189. 189async fn legacy_key_without_bot_id_still_works() {
190. 190 let base = spawn_gateway(&["telegram:54321"]).await;
191. 191
192. 192 let status = post_inbound(
193. 193 &base,
194. 194 serde_json::json!({
195. 195 "surface": "telegram",
196. 196 "chat": "54321",
197. 197 "text": "legacy message",
198. 198 }),
199. 199 )
200. 200 .await;
201. 201 assert!(
202. 202 status.is_success(),
203. 203 "legacy two-segment key should be allowed (got {status})"
204. 204 );
205. 205}
206. 206