Files
paperclip/ui/src/components/RoutineHistoryTab.test.tsx
T
Dotta 705c1b8d81 [codex] Add routine env secrets support (#6212)
## Thinking Path

> - Paperclip orchestrates AI agents for zero-human companies.
> - Scheduled routines are the control-plane path for recurring agent
work.
> - Routines already had dispatch/history, but their runtime environment
did not carry routine-owned secret bindings through execution.
> - Operators need routine-specific secrets that can override
project/agent env without exposing secret values in history, logs, or
access events.
> - This pull request adds the routine env runtime contract, wires it
into execution, and makes the routine UI/history surfaces show safe
secret metadata.
> - The benefit is that routine executions can use scoped secret refs
predictably while preserving company boundaries and auditability.

## What Changed

- Added routine env persistence/runtime support, including
`routines.env`, `routine_runs.routine_revision_id`, revision snapshots,
and idempotent migration `0086_routine_env_runtime_contract`.
- Resolved routine env during heartbeat adapter config assembly with
precedence `agent < project < routine` and secret access events recorded
against the routine consumer.
- Added secret binding synchronization for routine create/update/restore
flows and guarded cross-company, missing, disabled, and deleted secret
cases.
- Added a Secrets tab to routine detail, env/secret history diff
rendering, and Storybook coverage for the new UI states.
- Added server/UI regression tests, including an embedded-Postgres QA
path for routine secret execution and restore behavior.
- Updated implementation/database docs for routine env and
secret-binding behavior.

## Verification

- `pnpm install --frozen-lockfile` after rebasing onto
`public-gh/master` to refresh workspace links for the newly-added
upstream Grok adapter package.
- `pnpm exec vitest run
server/src/__tests__/heartbeat-project-env.test.ts
server/src/__tests__/routines-service.test.ts
server/src/__tests__/secrets-service.test.ts
server/src/__tests__/qa-routine-secrets-e2e.test.ts
ui/src/components/RoutineHistoryTab.test.tsx` passed: 5 files, 92 tests.
- `pnpm -r typecheck` passed across the workspace.
- `pnpm build` passed. Vite emitted the existing
large-chunk/dynamic-import warnings.
- UI screenshots were captured locally during QA in
`artifacts/pap-9521/` and `artifacts/pap-9522/`; generated screenshots
are not committed to avoid adding binary artifacts to the repo.

## Risks

- Migration risk is limited by `IF NOT EXISTS` guards for the new
columns, FK, and index, and the migration is ordered as `0086`
immediately after upstream `0085`.
- Runtime behavior changes env precedence for routine executions by
adding routine env as the highest-precedence layer; tests cover
agent/project/routine precedence.
- Secret handling is security-sensitive; tests cover value-free
manifests/events/errors, disabled/missing/deleted secrets, and
cross-company rejection.
- UI history now renders routine env/secret diffs; tests and Storybook
stories cover the main rendering paths.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

- OpenAI Codex coding agent based on GPT-5, with shell/tool use and
medium reasoning effort.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-05-17 16:30:34 -05:00

526 lines
17 KiB
TypeScript

// @vitest-environment jsdom
import { act } from "react";
import type { ComponentProps } from "react";
import { createRoot } from "react-dom/client";
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
import type {
CompanySecret,
Routine,
RoutineEnvConfig,
RoutineRevision,
RoutineRevisionSnapshotV1,
} from "@paperclipai/shared";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { RoutineHistoryTab } from "./RoutineHistoryTab";
const mockRoutinesApi = vi.hoisted(() => ({
listRevisions: vi.fn(),
restoreRevision: vi.fn(),
}));
vi.mock("../api/routines", async () => {
const actual = await vi.importActual<Record<string, unknown>>("../api/routines");
return {
...actual,
routinesApi: {
...((actual as { routinesApi?: Record<string, unknown> }).routinesApi ?? {}),
...mockRoutinesApi,
},
};
});
vi.mock("./MarkdownBody", () => ({
MarkdownBody: ({ children }: { children: string }) => <div>{children}</div>,
}));
vi.mock("@/components/ui/dialog", () => ({
Dialog: ({ open, children }: { open: boolean; children: React.ReactNode }) =>
open ? <div data-testid="dialog">{children}</div> : null,
DialogContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
DialogHeader: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
DialogTitle: ({ children }: { children: React.ReactNode }) => <h2>{children}</h2>,
DialogDescription: ({ children }: { children: React.ReactNode }) => <p>{children}</p>,
DialogFooter: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
}));
vi.mock("@/components/ui/button", () => ({
Button: ({ children, onClick, type = "button", disabled, ...props }: ComponentProps<"button">) => (
<button type={type} onClick={onClick} disabled={disabled} {...props}>
{children}
</button>
),
}));
vi.mock("@/components/ui/input", () => ({
Input: (props: ComponentProps<"input">) => <input {...props} />,
}));
vi.mock("@/components/ui/label", () => ({
Label: ({ children, htmlFor }: { children: React.ReactNode; htmlFor?: string }) => (
<label htmlFor={htmlFor}>{children}</label>
),
}));
vi.mock("@/components/ui/skeleton", () => ({
Skeleton: (props: ComponentProps<"div">) => <div data-testid="skeleton" {...props} />,
}));
const toastSpy = vi.fn();
vi.mock("../context/ToastContext", () => ({
useToastActions: () => ({ pushToast: toastSpy }),
}));
// eslint-disable-next-line @typescript-eslint/no-explicit-any
(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
async function flush() {
await act(async () => {
await new Promise((resolve) => setTimeout(resolve, 0));
});
}
function snapshotV1(overrides?: Partial<RoutineRevisionSnapshotV1["routine"]>): RoutineRevisionSnapshotV1 {
return {
version: 1,
routine: {
id: "routine-1",
companyId: "company-1",
projectId: null,
goalId: null,
parentIssueId: null,
title: "Daily standup digest",
description: "Summarize standup notes",
assigneeAgentId: null,
priority: "medium",
status: "active",
concurrencyPolicy: "coalesce_if_active",
catchUpPolicy: "skip_missed",
variables: [],
env: null,
...overrides,
},
triggers: [],
};
}
function createRevision(overrides: Partial<RoutineRevision> = {}): RoutineRevision {
return {
id: overrides.id ?? "revision-1",
companyId: "company-1",
routineId: "routine-1",
revisionNumber: overrides.revisionNumber ?? 1,
title: "Daily standup digest",
description: "Summarize standup notes",
snapshot: overrides.snapshot ?? snapshotV1(),
changeSummary: null,
restoredFromRevisionId: null,
createdByAgentId: null,
createdByUserId: "user-1",
createdByRunId: null,
createdAt: new Date("2026-05-01T12:00:00.000Z"),
...overrides,
};
}
function createRoutine(overrides: Partial<Routine> = {}): Routine {
return {
id: "routine-1",
companyId: "company-1",
projectId: null,
goalId: null,
parentIssueId: null,
title: "Daily standup digest",
description: "Summarize standup notes",
assigneeAgentId: null,
priority: "medium",
status: "active",
concurrencyPolicy: "coalesce_if_active",
catchUpPolicy: "skip_missed",
variables: [],
latestRevisionId: "revision-2",
latestRevisionNumber: 2,
createdByAgentId: null,
createdByUserId: "user-1",
updatedByAgentId: null,
updatedByUserId: "user-1",
lastTriggeredAt: null,
lastEnqueuedAt: null,
createdAt: new Date("2026-05-01T11:00:00.000Z"),
updatedAt: new Date("2026-05-04T12:00:00.000Z"),
...overrides,
};
}
function makeQueryClient() {
return new QueryClient({
defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
});
}
describe("RoutineHistoryTab", () => {
let container: HTMLDivElement;
beforeEach(() => {
container = document.createElement("div");
document.body.appendChild(container);
vi.clearAllMocks();
toastSpy.mockReset();
});
afterEach(() => {
container.remove();
});
async function render(props: Partial<Parameters<typeof RoutineHistoryTab>[0]> = {}) {
const root = createRoot(container);
const queryClient = makeQueryClient();
const routine = props.routine ?? createRoutine();
await act(async () => {
root.render(
<QueryClientProvider client={queryClient}>
<RoutineHistoryTab
routine={routine}
isEditDirty={false}
dirtyFields={[]}
onDiscardEdits={() => {}}
onSaveEdits={() => {}}
agents={new Map()}
projects={new Map()}
onRestoreSecretMaterials={() => {}}
{...props}
/>
</QueryClientProvider>,
);
});
await flush();
return root;
}
it("shows the empty state when only the bootstrap revision exists", async () => {
mockRoutinesApi.listRevisions.mockResolvedValue([
createRevision({ id: "revision-1", revisionNumber: 1 }),
]);
await render({
routine: createRoutine({ latestRevisionId: "revision-1", latestRevisionNumber: 1 }),
});
expect(container.textContent).toContain("No edits yet");
expect(container.textContent).toContain("Revision 1 is the only history");
});
it("renders the revision list with current and historical pills", async () => {
const current = createRevision({
id: "revision-2",
revisionNumber: 2,
changeSummary: "Updated routine",
});
const old = createRevision({
id: "revision-1",
revisionNumber: 1,
changeSummary: "Created routine",
});
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
await render();
expect(container.textContent).toContain("rev 2");
expect(container.textContent).toContain("rev 1");
expect(container.textContent).toContain("Current");
});
it("shows the historical-preview banner with append-only copy when previewing an old revision", async () => {
const current = createRevision({
id: "revision-2",
revisionNumber: 2,
changeSummary: "Updated routine",
});
const old = createRevision({
id: "revision-1",
revisionNumber: 1,
snapshot: snapshotV1({ status: "paused" }),
changeSummary: "Created routine",
});
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
await render();
const oldRow = container.querySelector(
"[data-testid='revision-row-1']",
) as HTMLButtonElement | null;
expect(oldRow).not.toBeNull();
await act(async () => {
oldRow?.click();
});
await flush();
expect(container.textContent).toContain("Viewing revision 1 (read-only)");
expect(container.textContent).toContain(
"Restoring this revision creates a new revision 3 with the same content. History stays append-only.",
);
expect(container.textContent).toContain("Status");
expect(container.textContent).toContain("paused");
expect(container.textContent).toContain("Restore as new revision");
});
it("blocks historical preview and surfaces the conflict banner when local edits are dirty", async () => {
const current = createRevision({ id: "revision-2", revisionNumber: 2 });
const old = createRevision({ id: "revision-1", revisionNumber: 1 });
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
await render({
isEditDirty: true,
dirtyFields: [{ key: "description", label: "the description" }],
});
expect(container.textContent).toContain("Unsaved routine edits");
const oldRow = container.querySelector(
"[data-testid='revision-row-1']",
) as HTMLButtonElement | null;
expect(oldRow?.disabled).toBe(true);
});
it("calls restoreRevision and surfaces a success toast after confirming restore", async () => {
const current = createRevision({ id: "revision-2", revisionNumber: 2 });
const old = createRevision({ id: "revision-1", revisionNumber: 1 });
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
mockRoutinesApi.restoreRevision.mockResolvedValue({
routine: createRoutine({ latestRevisionId: "revision-3", latestRevisionNumber: 3 }),
revision: createRevision({
id: "revision-3",
revisionNumber: 3,
restoredFromRevisionId: "revision-1",
}),
restoredFromRevisionId: "revision-1",
restoredFromRevisionNumber: 1,
secretMaterials: [],
});
await render();
const oldRow = container.querySelector(
"[data-testid='revision-row-1']",
) as HTMLButtonElement | null;
await act(async () => {
oldRow?.click();
});
await flush();
const restoreButtons = Array.from(container.querySelectorAll("button")).filter(
(button) => button.textContent === "Restore as new revision",
);
expect(restoreButtons.length).toBeGreaterThan(0);
await act(async () => {
restoreButtons[0].click();
});
await flush();
expect(container.querySelector("[data-testid='dialog']")).not.toBeNull();
const confirmButtons = Array.from(container.querySelectorAll("button")).filter((b) =>
(b.textContent ?? "").includes("Restore as revision 3"),
);
expect(confirmButtons.length).toBeGreaterThan(0);
await act(async () => {
confirmButtons[0].click();
});
await flush();
expect(mockRoutinesApi.restoreRevision).toHaveBeenCalledWith(
"routine-1",
"revision-1",
{ changeSummary: null },
);
expect(toastSpy).toHaveBeenCalled();
const successCall = toastSpy.mock.calls.find(
(call) => call[0]?.title === "Restored revision 1 as revision 3",
);
expect(successCall).toBeTruthy();
});
it("shows env summary on the revision preview and routes counts into restore dialog", async () => {
const env: RoutineEnvConfig = {
GH_TOKEN: { type: "secret_ref", secretId: "secret-1", version: "latest" },
LOG_LEVEL: { type: "plain", value: "debug" },
};
const current = createRevision({
id: "revision-2",
revisionNumber: 2,
snapshot: snapshotV1({ env }),
});
const old = createRevision({
id: "revision-1",
revisionNumber: 1,
snapshot: snapshotV1({
env: { GH_TOKEN: { type: "secret_ref", secretId: "secret-1", version: 3 } },
}),
});
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
const secrets: CompanySecret[] = [
{
id: "secret-1",
companyId: "company-1",
key: "gh_token",
name: "github-bot",
provider: "local_encrypted",
status: "active",
managedMode: "paperclip_managed",
externalRef: null,
providerConfigId: null,
providerMetadata: null,
latestVersion: 4,
description: null,
lastResolvedAt: null,
lastRotatedAt: null,
deletedAt: null,
createdByAgentId: null,
createdByUserId: null,
createdAt: new Date("2026-04-01T00:00:00.000Z"),
updatedAt: new Date("2026-04-01T00:00:00.000Z"),
},
];
await render({ secrets });
expect(container.textContent).toContain("Env");
expect(container.textContent).toContain("2 keys (1 secret ref)");
const oldRow = container.querySelector(
"[data-testid='revision-row-1']",
) as HTMLButtonElement | null;
await act(async () => {
oldRow?.click();
});
await flush();
const restoreButtons = Array.from(container.querySelectorAll("button")).filter(
(button) => button.textContent === "Restore as new revision",
);
expect(restoreButtons.length).toBeGreaterThan(0);
await act(async () => {
restoreButtons[0].click();
});
await flush();
expect(container.textContent).toContain("Routine secrets will revert");
expect(container.textContent).toContain("1 key removed");
expect(container.textContent).toContain("1 key changed");
});
it("labels secret-ref env diffs by changed secret instead of binding kind", async () => {
const current = createRevision({
id: "revision-2",
revisionNumber: 2,
snapshot: snapshotV1({
env: { GH_TOKEN: { type: "secret_ref", secretId: "secret-2", version: "latest" } },
}),
});
const old = createRevision({
id: "revision-1",
revisionNumber: 1,
snapshot: snapshotV1({
env: { GH_TOKEN: { type: "secret_ref", secretId: "secret-1", version: "latest" } },
}),
});
const secrets: CompanySecret[] = [
{
id: "secret-1",
companyId: "company-1",
key: "old_token",
name: "old-token",
provider: "local_encrypted",
status: "active",
managedMode: "paperclip_managed",
externalRef: null,
providerConfigId: null,
providerMetadata: null,
latestVersion: 1,
description: null,
lastResolvedAt: null,
lastRotatedAt: null,
deletedAt: null,
createdByAgentId: null,
createdByUserId: null,
createdAt: new Date("2026-04-01T00:00:00.000Z"),
updatedAt: new Date("2026-04-01T00:00:00.000Z"),
},
{
id: "secret-2",
companyId: "company-1",
key: "new_token",
name: "new-token",
provider: "local_encrypted",
status: "active",
managedMode: "paperclip_managed",
externalRef: null,
providerConfigId: null,
providerMetadata: null,
latestVersion: 1,
description: null,
lastResolvedAt: null,
lastRotatedAt: null,
deletedAt: null,
createdByAgentId: null,
createdByUserId: null,
createdAt: new Date("2026-04-01T00:00:00.000Z"),
updatedAt: new Date("2026-04-01T00:00:00.000Z"),
},
];
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
await render({ secrets });
const oldRow = container.querySelector(
"[data-testid='revision-row-1']",
) as HTMLButtonElement | null;
await act(async () => {
oldRow?.click();
});
await flush();
const compareButton = Array.from(container.querySelectorAll("button")).find(
(button) => button.textContent === "Compare with current",
);
await act(async () => {
compareButton?.click();
});
await flush();
expect(container.textContent).toContain("Env GH_TOKEN secret");
expect(container.textContent).not.toContain("Env GH_TOKEN binding kind");
});
it("invokes onRestored with the restore response so the editor can rehydrate (PAP-3588)", async () => {
const current = createRevision({ id: "revision-2", revisionNumber: 2 });
const old = createRevision({
id: "revision-1",
revisionNumber: 1,
snapshot: snapshotV1({ description: "Original description" }),
});
mockRoutinesApi.listRevisions.mockResolvedValue([current, old]);
const restoredRoutine = createRoutine({
description: "Original description",
latestRevisionId: "revision-3",
latestRevisionNumber: 3,
});
mockRoutinesApi.restoreRevision.mockResolvedValue({
routine: restoredRoutine,
revision: createRevision({
id: "revision-3",
revisionNumber: 3,
restoredFromRevisionId: "revision-1",
}),
restoredFromRevisionId: "revision-1",
restoredFromRevisionNumber: 1,
secretMaterials: [],
});
const onRestored = vi.fn();
await render({ onRestored });
const oldRow = container.querySelector(
"[data-testid='revision-row-1']",
) as HTMLButtonElement | null;
await act(async () => {
oldRow?.click();
});
await flush();
const restoreButtons = Array.from(container.querySelectorAll("button")).filter(
(button) => button.textContent === "Restore as new revision",
);
await act(async () => {
restoreButtons[0].click();
});
await flush();
const confirmButtons = Array.from(container.querySelectorAll("button")).filter((b) =>
(b.textContent ?? "").includes("Restore as revision 3"),
);
await act(async () => {
confirmButtons[0].click();
});
await flush();
expect(onRestored).toHaveBeenCalledTimes(1);
const [response] = onRestored.mock.calls[0];
expect(response.routine).toEqual(restoredRoutine);
expect(response.revision.id).toBe("revision-3");
});
});