feat(server): expose secure harness API

2026-09-07 16:37:51 +08:00
parent 64ca126047
commit 5e28e74ca1
16 changed files with 654 additions and 1 deletions
@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { createTestApp } from "./test-app.js";
+
+const apps: Array<ReturnType<typeof createTestApp>["app"]> = [];
+afterEach(async () => Promise.all(apps.splice(0).map((app) => app.close())));
+
+describe("attachment and approval API", () => {
+  it("streams exactly one multipart image and removes by opaque ID", async () => {
+    const { app, attachmentStore } = createTestApp();
+    apps.push(app);
+    const boundary = "agent-studio-boundary";
+    const body = Buffer.from([
+      `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="chart.png"\r\nContent-Type: image/png\r\n\r\n`,
+      "fake-png-bytes",
+      `\r\n--${boundary}--\r\n`,
+    ].join(""));
+    const uploaded = await app.inject({
+      method: "POST", url: "/api/sessions/ses_1/attachments",
+      headers: { "content-type": `multipart/form-data; boundary=${boundary}` }, payload: body,
+    });
+    const removed = await app.inject({ method: "DELETE", url: "/api/sessions/ses_1/attachments/att_1" });
+
+    expect(uploaded.statusCode).toBe(201);
+    const uploadedBody = uploaded.json<{ attachment: { attachmentId: string }; requestId: string }>();
+    expect(uploadedBody.attachment.attachmentId).toBe("att_1");
+    expect(uploadedBody.requestId).toMatch(/^req_/);
+    expect(attachmentStore.add).toHaveBeenCalled();
+    expect(removed.statusCode).toBe(200);
+  });
+
+  it("resolves approval decisions through the authoritative broker", async () => {
+    const { app, approvalBroker } = createTestApp();
+    apps.push(app);
+    const approved = await app.inject({ method: "POST", url: "/api/approvals/ap_1/approve" });
+    const denied = await app.inject({ method: "POST", url: "/api/approvals/ap_2/deny" });
+
+    expect(approved.json()).toMatchObject({ approval: { status: "approved" } });
+    expect(denied.json()).toMatchObject({ approval: { status: "denied" } });
+    expect(approvalBroker.approve).toHaveBeenCalledWith("ap_1");
+  });
+});