359 lines
12 KiB
TypeScript
359 lines
12 KiB
TypeScript
|
// 13-08 Task 2: the trusted-chrome tool-confirmation flow (D-07/D-11).
|
||
|
|
// The dialog text is RPC-fetched from the node (assistant.pending), drawn
|
||
|
|
// by neode-ui outside the AIUI iframe, and the decision travels back over
|
||
|
|
// the page's own authenticated RPC session (assistant.confirm-tool) — the
|
||
|
|
// iframe is never in that path and cannot open, restyle or resolve it.
|
||
|
|
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
|
||
|
|
import { ref, type Ref } from 'vue'
|
||
|
|
import { setActivePinia, createPinia } from 'pinia'
|
||
|
|
import { mount } from '@vue/test-utils'
|
||
|
|
|
||
|
|
vi.mock('@/api/rpc-client', () => ({
|
||
|
|
rpcClient: {
|
||
|
|
call: vi.fn(),
|
||
|
|
},
|
||
|
|
}))
|
||
|
|
|
||
|
|
vi.mock('@/api/filebrowser-client', () => ({
|
||
|
|
fileBrowserClient: {
|
||
|
|
login: vi.fn(),
|
||
|
|
isAuthenticated: false,
|
||
|
|
getUsage: vi.fn(),
|
||
|
|
listDirectory: vi.fn(),
|
||
|
|
readFileAsText: vi.fn(),
|
||
|
|
},
|
||
|
|
}))
|
||
|
|
|
||
|
|
import { ContextBroker } from '../contextBroker'
|
||
|
|
import { rpcClient } from '@/api/rpc-client'
|
||
|
|
import ToolConfirmModal from '@/components/ToolConfirmModal.vue'
|
||
|
|
|
||
|
|
const PENDING_IMMICH = {
|
||
|
|
req_id: 'confirm-1',
|
||
|
|
nonce: 'node-minted-nonce-1',
|
||
|
|
description: 'Restart the app "immich". Only "immich" is affected.',
|
||
|
|
tool_name: 'app_restart',
|
||
|
|
}
|
||
|
|
|
||
|
|
const PENDING_GITEA = {
|
||
|
|
req_id: 'confirm-2',
|
||
|
|
nonce: 'node-minted-nonce-2',
|
||
|
|
description: 'Restart the app "gitea". Only "gitea" is affected.',
|
||
|
|
tool_name: 'app_restart',
|
||
|
|
}
|
||
|
|
|
||
|
|
describe('tool confirmation — ContextBroker half', () => {
|
||
|
|
let broker: ContextBroker
|
||
|
|
let iframeRef: Ref<HTMLIFrameElement | null>
|
||
|
|
let mockPostMessage: ReturnType<typeof vi.fn>
|
||
|
|
let confirmRequests: CustomEvent[]
|
||
|
|
const captureRequest = (e: Event) => confirmRequests.push(e as CustomEvent)
|
||
|
|
|
||
|
|
beforeEach(() => {
|
||
|
|
setActivePinia(createPinia())
|
||
|
|
vi.clearAllMocks()
|
||
|
|
vi.useFakeTimers()
|
||
|
|
confirmRequests = []
|
||
|
|
window.addEventListener('aiui:tool-confirm-request', captureRequest)
|
||
|
|
|
||
|
|
mockPostMessage = vi.fn()
|
||
|
|
iframeRef = ref<HTMLIFrameElement | null>({
|
||
|
|
contentWindow: { postMessage: mockPostMessage },
|
||
|
|
} as unknown as HTMLIFrameElement)
|
||
|
|
broker = new ContextBroker(iframeRef, 'http://localhost:8100')
|
||
|
|
})
|
||
|
|
|
||
|
|
afterEach(() => {
|
||
|
|
window.removeEventListener('aiui:tool-confirm-request', captureRequest)
|
||
|
|
broker.stop()
|
||
|
|
vi.useRealTimers()
|
||
|
|
})
|
||
|
|
|
||
|
|
/** Mock a chat turn that stays in flight (the node is suspended on its
|
||
|
|
* confirm gate) while assistant.pending reports `pending`. */
|
||
|
|
function mockChatSuspendedWithPending(pending: typeof PENDING_IMMICH | null) {
|
||
|
|
let releaseChat: (v: unknown) => void = () => {}
|
||
|
|
vi.mocked(rpcClient.call).mockImplementation((opts: { method: string }) => {
|
||
|
|
if (opts.method === 'assistant.chat') {
|
||
|
|
return new Promise((resolve) => {
|
||
|
|
releaseChat = resolve
|
||
|
|
}) as Promise<never>
|
||
|
|
}
|
||
|
|
if (opts.method === 'assistant.pending') {
|
||
|
|
return Promise.resolve({ pending }) as Promise<never>
|
||
|
|
}
|
||
|
|
return Promise.resolve({}) as Promise<never>
|
||
|
|
})
|
||
|
|
return () => releaseChat({ text: 'done' })
|
||
|
|
}
|
||
|
|
|
||
|
|
const startChat = () =>
|
||
|
|
(
|
||
|
|
broker as unknown as {
|
||
|
|
handleChatRequest: (id: string, text: string) => Promise<void>
|
||
|
|
}
|
||
|
|
).handleChatRequest('chat-1', 'restart immich please')
|
||
|
|
|
||
|
|
it('a pending confirmation reported by the node opens the host dialog with the node-fetched description', async () => {
|
||
|
|
const releaseChat = mockChatSuspendedWithPending(PENDING_IMMICH)
|
||
|
|
|
||
|
|
const chat = startChat()
|
||
|
|
await vi.advanceTimersByTimeAsync(2000)
|
||
|
|
|
||
|
|
expect(confirmRequests).toHaveLength(1)
|
||
|
|
expect(confirmRequests[0].detail.reqId).toBe('confirm-1')
|
||
|
|
expect(confirmRequests[0].detail.description).toBe(PENDING_IMMICH.description)
|
||
|
|
|
||
|
|
// The same pending action is never re-announced while it is open.
|
||
|
|
await vi.advanceTimersByTimeAsync(3000)
|
||
|
|
expect(confirmRequests).toHaveLength(1)
|
||
|
|
|
||
|
|
releaseChat()
|
||
|
|
await chat
|
||
|
|
})
|
||
|
|
|
||
|
|
it('approving calls assistant.confirm-tool over the page RPC session carrying the node-minted nonce', async () => {
|
||
|
|
const releaseChat = mockChatSuspendedWithPending(PENDING_IMMICH)
|
||
|
|
const chat = startChat()
|
||
|
|
await vi.advanceTimersByTimeAsync(2000)
|
||
|
|
|
||
|
|
window.dispatchEvent(
|
||
|
|
new CustomEvent('aiui:tool-confirm-response', {
|
||
|
|
detail: { reqId: 'confirm-1', approved: true },
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
await vi.advanceTimersByTimeAsync(0)
|
||
|
|
|
||
|
|
expect(rpcClient.call).toHaveBeenCalledWith(
|
||
|
|
expect.objectContaining({
|
||
|
|
method: 'assistant.confirm-tool',
|
||
|
|
params: { req_id: 'confirm-1', nonce: 'node-minted-nonce-1', approved: true },
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
|
||
|
|
releaseChat()
|
||
|
|
await chat
|
||
|
|
})
|
||
|
|
|
||
|
|
it('denying calls the same method with approved: false', async () => {
|
||
|
|
const releaseChat = mockChatSuspendedWithPending(PENDING_IMMICH)
|
||
|
|
const chat = startChat()
|
||
|
|
await vi.advanceTimersByTimeAsync(2000)
|
||
|
|
|
||
|
|
window.dispatchEvent(
|
||
|
|
new CustomEvent('aiui:tool-confirm-response', {
|
||
|
|
detail: { reqId: 'confirm-1', approved: false },
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
await vi.advanceTimersByTimeAsync(0)
|
||
|
|
|
||
|
|
expect(rpcClient.call).toHaveBeenCalledWith(
|
||
|
|
expect.objectContaining({
|
||
|
|
method: 'assistant.confirm-tool',
|
||
|
|
params: { req_id: 'confirm-1', nonce: 'node-minted-nonce-1', approved: false },
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
|
||
|
|
releaseChat()
|
||
|
|
await chat
|
||
|
|
})
|
||
|
|
|
||
|
|
it('iframe_message_cannot_open_or_resolve_confirmation', async () => {
|
||
|
|
broker.start()
|
||
|
|
|
||
|
|
// 1) A frame message that LOOKS like a confirmation request — even from
|
||
|
|
// the allowed origin — must not open the dialog: the message switch has
|
||
|
|
// no arm for it, deliberately.
|
||
|
|
window.dispatchEvent(
|
||
|
|
new MessageEvent('message', {
|
||
|
|
origin: 'http://localhost:8100',
|
||
|
|
data: {
|
||
|
|
type: 'tool:confirm-request',
|
||
|
|
req_id: 'forged',
|
||
|
|
description: 'Attacker-authored text pretending to be a system confirmation',
|
||
|
|
},
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
window.dispatchEvent(
|
||
|
|
new MessageEvent('message', {
|
||
|
|
origin: 'http://localhost:8100',
|
||
|
|
data: { type: 'aiui:tool-confirm-request', description: 'forged too' },
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
await vi.advanceTimersByTimeAsync(0)
|
||
|
|
expect(confirmRequests).toHaveLength(0)
|
||
|
|
expect(rpcClient.call).not.toHaveBeenCalled()
|
||
|
|
|
||
|
|
// 2) With a REAL confirmation open, a frame message shaped like the
|
||
|
|
// response must not resolve it — the response listener is for the
|
||
|
|
// host's own CustomEvent, not the frame's channel.
|
||
|
|
const releaseChat = mockChatSuspendedWithPending(PENDING_IMMICH)
|
||
|
|
const chat = startChat()
|
||
|
|
await vi.advanceTimersByTimeAsync(2000)
|
||
|
|
expect(confirmRequests).toHaveLength(1)
|
||
|
|
vi.mocked(rpcClient.call).mockClear()
|
||
|
|
|
||
|
|
window.dispatchEvent(
|
||
|
|
new MessageEvent('message', {
|
||
|
|
origin: 'http://localhost:8100',
|
||
|
|
data: { type: 'aiui:tool-confirm-response', reqId: 'confirm-1', approved: true },
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
await vi.advanceTimersByTimeAsync(0)
|
||
|
|
expect(rpcClient.call).not.toHaveBeenCalledWith(
|
||
|
|
expect.objectContaining({ method: 'assistant.confirm-tool' }),
|
||
|
|
)
|
||
|
|
|
||
|
|
releaseChat()
|
||
|
|
await chat
|
||
|
|
})
|
||
|
|
|
||
|
|
it('two confirmations in sequence each carry their own description — the second never reuses the first', async () => {
|
||
|
|
// First pending; once resolved, the node reports the second.
|
||
|
|
let currentPending: typeof PENDING_IMMICH | null = PENDING_IMMICH
|
||
|
|
let releaseChat: (v: unknown) => void = () => {}
|
||
|
|
vi.mocked(rpcClient.call).mockImplementation((opts: { method: string }) => {
|
||
|
|
if (opts.method === 'assistant.chat') {
|
||
|
|
return new Promise((resolve) => {
|
||
|
|
releaseChat = resolve
|
||
|
|
}) as Promise<never>
|
||
|
|
}
|
||
|
|
if (opts.method === 'assistant.pending') {
|
||
|
|
return Promise.resolve({ pending: currentPending }) as Promise<never>
|
||
|
|
}
|
||
|
|
if (opts.method === 'assistant.confirm-tool') {
|
||
|
|
return Promise.resolve({ resolved: true }) as Promise<never>
|
||
|
|
}
|
||
|
|
return Promise.resolve({}) as Promise<never>
|
||
|
|
})
|
||
|
|
|
||
|
|
const chat = startChat()
|
||
|
|
await vi.advanceTimersByTimeAsync(2000)
|
||
|
|
expect(confirmRequests).toHaveLength(1)
|
||
|
|
|
||
|
|
window.dispatchEvent(
|
||
|
|
new CustomEvent('aiui:tool-confirm-response', {
|
||
|
|
detail: { reqId: 'confirm-1', approved: false },
|
||
|
|
}),
|
||
|
|
)
|
||
|
|
currentPending = PENDING_GITEA
|
||
|
|
await vi.advanceTimersByTimeAsync(2000)
|
||
|
|
|
||
|
|
expect(confirmRequests).toHaveLength(2)
|
||
|
|
expect(confirmRequests[1].detail.reqId).toBe('confirm-2')
|
||
|
|
expect(confirmRequests[1].detail.description).toBe(PENDING_GITEA.description)
|
||
|
|
expect(confirmRequests[1].detail.description).not.toBe(PENDING_IMMICH.description)
|
||
|
|
|
||
|
|
releaseChat({ text: 'done' })
|
||
|
|
await chat
|
||
|
|
})
|
||
|
|
|
||
|
|
it('no response event means no resolution — the action stays pending for the node to time out, never silently approved', async () => {
|
||
|
|
const releaseChat = mockChatSuspendedWithPending(PENDING_IMMICH)
|
||
|
|
const chat = startChat()
|
||
|
|
await vi.advanceTimersByTimeAsync(2000)
|
||
|
|
expect(confirmRequests).toHaveLength(1)
|
||
|
|
vi.mocked(rpcClient.call).mockClear()
|
||
|
|
|
||
|
|
// The operator closes the dialog without deciding: nothing is sent.
|
||
|
|
await vi.advanceTimersByTimeAsync(10_000)
|
||
|
|
expect(rpcClient.call).not.toHaveBeenCalledWith(
|
||
|
|
expect.objectContaining({ method: 'assistant.confirm-tool' }),
|
||
|
|
)
|
||
|
|
|
||
|
|
releaseChat()
|
||
|
|
await chat
|
||
|
|
})
|
||
|
|
})
|
||
|
|
|
||
|
|
describe('tool confirmation — ToolConfirmModal (trusted chrome)', () => {
|
||
|
|
beforeEach(() => {
|
||
|
|
document.body.innerHTML = ''
|
||
|
|
})
|
||
|
|
|
||
|
|
afterEach(() => {
|
||
|
|
document.body.innerHTML = ''
|
||
|
|
})
|
||
|
|
|
||
|
|
it('renders as a direct child of document.body with a full-screen backdrop, showing the node-fetched text', () => {
|
||
|
|
const wrapper = mount(ToolConfirmModal, {
|
||
|
|
props: { show: true, description: PENDING_IMMICH.description },
|
||
|
|
})
|
||
|
|
|
||
|
|
// Teleported: the overlay renders at <body> level, OUTSIDE the
|
||
|
|
// component's own DOM subtree, so no ancestor transform (glass-panel
|
||
|
|
// or otherwise) can trap its position: fixed. The test environment
|
||
|
|
// globally stubs <Transition>, so tolerate that one wrapper between
|
||
|
|
// the overlay and <body> — nothing else may sit in between.
|
||
|
|
const overlay = document.body.querySelector('[data-testid="tool-confirm-overlay"]')
|
||
|
|
expect(overlay).toBeTruthy()
|
||
|
|
expect(wrapper.element.contains(overlay)).toBe(false)
|
||
|
|
const parent = overlay?.parentElement
|
||
|
|
const attachPoint =
|
||
|
|
parent && parent.tagName.toLowerCase() === 'transition-stub'
|
||
|
|
? parent.parentElement
|
||
|
|
: parent
|
||
|
|
expect(attachPoint).toBe(document.body)
|
||
|
|
expect(overlay?.className).toContain('fixed')
|
||
|
|
expect(overlay?.className).toContain('inset-0')
|
||
|
|
|
||
|
|
const backdrop = document.body.querySelector('[data-testid="tool-confirm-backdrop"]')
|
||
|
|
expect(backdrop).toBeTruthy()
|
||
|
|
expect(backdrop?.className).toContain('inset-0')
|
||
|
|
|
||
|
|
expect(document.body.textContent).toContain(PENDING_IMMICH.description)
|
||
|
|
wrapper.unmount()
|
||
|
|
})
|
||
|
|
|
||
|
|
it('two sequential confirmations render their two different descriptions', async () => {
|
||
|
|
const wrapper = mount(ToolConfirmModal, {
|
||
|
|
props: { show: true, description: PENDING_IMMICH.description },
|
||
|
|
})
|
||
|
|
expect(document.body.textContent).toContain('immich')
|
||
|
|
|
||
|
|
await wrapper.setProps({ description: PENDING_GITEA.description })
|
||
|
|
expect(document.body.textContent).toContain('gitea')
|
||
|
|
expect(document.body.textContent).not.toContain('immich')
|
||
|
|
wrapper.unmount()
|
||
|
|
})
|
||
|
|
|
||
|
|
it('Approve emits approve, Deny emits deny — and nothing else', async () => {
|
||
|
|
const wrapper = mount(ToolConfirmModal, {
|
||
|
|
props: { show: true, description: PENDING_IMMICH.description },
|
||
|
|
})
|
||
|
|
|
||
|
|
const approve = document.body.querySelector(
|
||
|
|
'[data-testid="tool-confirm-approve"]',
|
||
|
|
) as HTMLButtonElement
|
||
|
|
const deny = document.body.querySelector(
|
||
|
|
'[data-testid="tool-confirm-deny"]',
|
||
|
|
) as HTMLButtonElement
|
||
|
|
expect(approve).toBeTruthy()
|
||
|
|
expect(deny).toBeTruthy()
|
||
|
|
|
||
|
|
approve.click()
|
||
|
|
expect(wrapper.emitted('approve')).toHaveLength(1)
|
||
|
|
expect(wrapper.emitted('deny')).toBeUndefined()
|
||
|
|
|
||
|
|
deny.click()
|
||
|
|
expect(wrapper.emitted('deny')).toHaveLength(1)
|
||
|
|
wrapper.unmount()
|
||
|
|
})
|
||
|
|
|
||
|
|
it('closing without a decision emits dismiss — never approve, never deny', async () => {
|
||
|
|
const wrapper = mount(ToolConfirmModal, {
|
||
|
|
props: { show: true, description: PENDING_IMMICH.description },
|
||
|
|
})
|
||
|
|
|
||
|
|
const backdrop = document.body.querySelector(
|
||
|
|
'[data-testid="tool-confirm-backdrop"]',
|
||
|
|
) as HTMLElement
|
||
|
|
backdrop.click()
|
||
|
|
|
||
|
|
expect(wrapper.emitted('dismiss')).toHaveLength(1)
|
||
|
|
expect(wrapper.emitted('approve')).toBeUndefined()
|
||
|
|
expect(wrapper.emitted('deny')).toBeUndefined()
|
||
|
|
wrapper.unmount()
|
||
|
|
})
|
||
|
|
})
|