forked from farhoodlabs/paperclip
32a9165ddf
## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - The control plane depends on authenticated routes enforcing company boundaries and role permissions correctly > - This branch also touches the issue detail and markdown editing flows operators use while handling advisory and triage work > - Partial issue cache seeds and fragile rich-editor parsing could leave important issue content missing or blank at the moment an operator needed it > - Blocked issues becoming actionable again should wake their assignee automatically instead of silently staying idle > - This pull request rebases the advisory follow-up branch onto current `master`, hardens authenticated route authorization, and carries the issue-detail/editor reliability fixes forward with regression tests > - The benefit is tighter authz on sensitive routes plus more reliable issue/advisory editing and wakeup behavior on top of the latest base ## What Changed - Hardened authenticated route authorization across agent, activity, approval, access, project, plugin, health, execution-workspace, portability, and related server paths, with new cross-tenant and runtime-authz regression coverage. - Switched issue detail queries from `initialData` to placeholder-based hydration so list/quicklook seeds still refetch full issue bodies. - Normalized advisory-style HTML images before mounting the markdown editor and strengthened fallback behavior when the rich editor silently fails or rejects the content. - Woke assigned agents when blocked issues move back to `todo`, with route coverage for reopen and unblock transitions. - Rebasing note: this branch now sits cleanly on top of the latest `master` tip used for the PR base. ## Verification - `pnpm exec vitest run ui/src/lib/issueDetailQuery.test.tsx ui/src/components/MarkdownEditor.test.tsx server/src/__tests__/issue-comment-reopen-routes.test.ts server/src/__tests__/activity-routes.test.ts server/src/__tests__/agent-cross-tenant-authz-routes.test.ts` - Confirmed `pnpm-lock.yaml` is not part of the PR diff. - Rebased the branch onto current `public-gh/master` before publishing. ## Risks - Broad authz tightening may expose existing flows that were relying on permissive board or agent access and now need explicit grants. - Markdown editor fallback changes could affect focus or rendering in edge-case content that mixes HTML-like advisory markup with normal markdown. - This verification was intentionally scoped to touched regressions and did not run the full repository suite. ## Model Used - OpenAI Codex, GPT-5-based coding agent in the Codex CLI environment with tool use for terminal, git, and GitHub operations. The exact runtime model identifier is not exposed inside this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, it is behavior-only and does not need before/after screenshots - [x] I have updated relevant documentation to reflect my changes, or no documentation changes were needed for these internal fixes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
285 lines
8.1 KiB
TypeScript
285 lines
8.1 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import { act, forwardRef, useImperativeHandle, useRef } from "react";
|
|
import { createRoot } from "react-dom/client";
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
vi.mock("./MarkdownEditor", () => ({
|
|
MarkdownEditor: forwardRef<
|
|
{ focus: () => void },
|
|
{ value: string; onChange: (value: string) => void }
|
|
>(function MarkdownEditorMock(props, ref) {
|
|
const taRef = useRef<HTMLTextAreaElement>(null);
|
|
useImperativeHandle(ref, () => ({
|
|
focus: () => taRef.current?.focus(),
|
|
}));
|
|
return (
|
|
<textarea
|
|
ref={taRef}
|
|
data-testid="multiline-md-mock"
|
|
value={props.value}
|
|
onChange={(e) => props.onChange(e.target.value)}
|
|
/>
|
|
);
|
|
}),
|
|
}));
|
|
|
|
import { InlineEditor, queueContainedBlurCommit } from "./InlineEditor";
|
|
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
|
|
|
|
/** Lets React detect a DOM value change on controlled textareas (see React #10140). */
|
|
function setNativeTextareaValue(textarea: HTMLTextAreaElement, value: string) {
|
|
const valueSetter = Object.getOwnPropertyDescriptor(window.HTMLTextAreaElement.prototype, "value")?.set;
|
|
const previous = textarea.value;
|
|
valueSetter?.call(textarea, value);
|
|
const tracker = (textarea as HTMLTextAreaElement & { _valueTracker?: { setValue: (v: string) => void } })
|
|
._valueTracker;
|
|
tracker?.setValue(previous);
|
|
textarea.dispatchEvent(new Event("input", { bubbles: true }));
|
|
}
|
|
|
|
/** Matches `queueContainedBlurCommit` (double rAF before commit). Microtasks alone do not run these. */
|
|
function flushDoubleRequestAnimationFrame(): Promise<void> {
|
|
return new Promise((resolve) => {
|
|
requestAnimationFrame(() => {
|
|
requestAnimationFrame(() => {
|
|
resolve();
|
|
});
|
|
});
|
|
});
|
|
}
|
|
|
|
describe("InlineEditor", () => {
|
|
let container: HTMLDivElement;
|
|
|
|
beforeEach(() => {
|
|
container = document.createElement("div");
|
|
document.body.appendChild(container);
|
|
});
|
|
|
|
afterEach(() => {
|
|
container.remove();
|
|
});
|
|
|
|
it("calls onSave with empty string when nullable and the field is cleared (single-line)", () => {
|
|
const onSave = vi.fn().mockResolvedValue(undefined);
|
|
const root = createRoot(container);
|
|
|
|
act(() => {
|
|
root.render(<InlineEditor value="hello" nullable onSave={onSave} />);
|
|
});
|
|
|
|
const display = container.querySelector("span");
|
|
expect(display).not.toBeNull();
|
|
expect(display?.textContent).toBe("hello");
|
|
|
|
act(() => {
|
|
display!.dispatchEvent(new MouseEvent("click", { bubbles: true }));
|
|
});
|
|
|
|
const textarea = container.querySelector("textarea");
|
|
expect(textarea).not.toBeNull();
|
|
|
|
act(() => {
|
|
setNativeTextareaValue(textarea!, "");
|
|
});
|
|
act(() => {
|
|
textarea!.blur();
|
|
});
|
|
|
|
expect(onSave).toHaveBeenCalledTimes(1);
|
|
expect(onSave).toHaveBeenCalledWith("");
|
|
|
|
act(() => {
|
|
root.unmount();
|
|
});
|
|
});
|
|
|
|
it("does not call onSave when nullable is false/omitted and the field is cleared", () => {
|
|
const onSave = vi.fn().mockResolvedValue(undefined);
|
|
const root = createRoot(container);
|
|
|
|
act(() => {
|
|
root.render(<InlineEditor value="hello" onSave={onSave} />);
|
|
});
|
|
|
|
const display = container.querySelector("span");
|
|
expect(display).not.toBeNull();
|
|
|
|
act(() => {
|
|
display!.dispatchEvent(new MouseEvent("click", { bubbles: true }));
|
|
});
|
|
|
|
const textarea = container.querySelector("textarea");
|
|
expect(textarea).not.toBeNull();
|
|
|
|
act(() => {
|
|
setNativeTextareaValue(textarea!, "");
|
|
});
|
|
act(() => {
|
|
textarea!.blur();
|
|
});
|
|
|
|
expect(onSave).not.toHaveBeenCalled();
|
|
|
|
act(() => {
|
|
root.unmount();
|
|
});
|
|
});
|
|
|
|
it("multiline nullable clear uses autosave path (shows Saved after blur)", async () => {
|
|
const onSave = vi.fn().mockResolvedValue(undefined);
|
|
const root = createRoot(container);
|
|
const outside = document.createElement("button");
|
|
document.body.appendChild(outside);
|
|
|
|
act(() => {
|
|
root.render(<InlineEditor value="hello" multiline nullable onSave={onSave} />);
|
|
});
|
|
|
|
const textarea = container.querySelector<HTMLTextAreaElement>('[data-testid="multiline-md-mock"]');
|
|
expect(textarea).not.toBeNull();
|
|
|
|
act(() => {
|
|
textarea!.focus();
|
|
});
|
|
act(() => {
|
|
setNativeTextareaValue(textarea!, "");
|
|
});
|
|
act(() => {
|
|
outside.focus();
|
|
});
|
|
await act(async () => {
|
|
await flushDoubleRequestAnimationFrame();
|
|
});
|
|
|
|
expect(onSave).toHaveBeenCalledTimes(1);
|
|
expect(onSave).toHaveBeenCalledWith("");
|
|
expect(container.textContent).toContain("Saved");
|
|
|
|
act(() => {
|
|
root.unmount();
|
|
});
|
|
outside.remove();
|
|
});
|
|
|
|
it("syncs a new multiline value while focused when the user has not edited locally", () => {
|
|
const onSave = vi.fn().mockResolvedValue(undefined);
|
|
const root = createRoot(container);
|
|
|
|
act(() => {
|
|
root.render(<InlineEditor value="" multiline onSave={onSave} />);
|
|
});
|
|
|
|
const textarea = container.querySelector<HTMLTextAreaElement>('[data-testid="multiline-md-mock"]');
|
|
expect(textarea).not.toBeNull();
|
|
expect(textarea?.value).toBe("");
|
|
|
|
act(() => {
|
|
textarea!.focus();
|
|
});
|
|
|
|
act(() => {
|
|
root.render(<InlineEditor value="Loaded description" multiline onSave={onSave} />);
|
|
});
|
|
|
|
expect(textarea?.value).toBe("Loaded description");
|
|
|
|
act(() => {
|
|
root.unmount();
|
|
});
|
|
});
|
|
|
|
it("preserves focused multiline local edits when the prop value changes underneath them", () => {
|
|
const onSave = vi.fn().mockResolvedValue(undefined);
|
|
const root = createRoot(container);
|
|
|
|
act(() => {
|
|
root.render(<InlineEditor value="Original" multiline onSave={onSave} />);
|
|
});
|
|
|
|
const textarea = container.querySelector<HTMLTextAreaElement>('[data-testid="multiline-md-mock"]');
|
|
expect(textarea).not.toBeNull();
|
|
|
|
act(() => {
|
|
textarea!.focus();
|
|
});
|
|
act(() => {
|
|
setNativeTextareaValue(textarea!, "Local draft");
|
|
});
|
|
|
|
act(() => {
|
|
root.render(<InlineEditor value="Remote update" multiline onSave={onSave} />);
|
|
});
|
|
|
|
expect(textarea?.value).toBe("Local draft");
|
|
|
|
act(() => {
|
|
root.unmount();
|
|
});
|
|
});
|
|
});
|
|
|
|
describe("queueContainedBlurCommit", () => {
|
|
let container: HTMLDivElement;
|
|
let inside: HTMLTextAreaElement;
|
|
let outside: HTMLButtonElement;
|
|
let originalRequestAnimationFrame: typeof window.requestAnimationFrame;
|
|
let originalCancelAnimationFrame: typeof window.cancelAnimationFrame;
|
|
|
|
beforeEach(() => {
|
|
vi.useFakeTimers();
|
|
originalRequestAnimationFrame = window.requestAnimationFrame;
|
|
originalCancelAnimationFrame = window.cancelAnimationFrame;
|
|
window.requestAnimationFrame = ((callback: FrameRequestCallback) =>
|
|
window.setTimeout(() => callback(performance.now()), 0)) as typeof window.requestAnimationFrame;
|
|
window.cancelAnimationFrame = ((id: number) => window.clearTimeout(id)) as typeof window.cancelAnimationFrame;
|
|
|
|
container = document.createElement("div");
|
|
inside = document.createElement("textarea");
|
|
outside = document.createElement("button");
|
|
container.appendChild(inside);
|
|
document.body.append(container, outside);
|
|
});
|
|
|
|
afterEach(() => {
|
|
window.requestAnimationFrame = originalRequestAnimationFrame;
|
|
window.cancelAnimationFrame = originalCancelAnimationFrame;
|
|
container.remove();
|
|
outside.remove();
|
|
vi.useRealTimers();
|
|
});
|
|
|
|
async function flushFrames() {
|
|
await act(async () => {
|
|
vi.runAllTimers();
|
|
await Promise.resolve();
|
|
});
|
|
}
|
|
|
|
it("commits when focus stays outside the editor container", async () => {
|
|
const onCommit = vi.fn();
|
|
const cancel = queueContainedBlurCommit(container, onCommit);
|
|
|
|
outside.focus();
|
|
await flushFrames();
|
|
|
|
expect(onCommit).toHaveBeenCalledTimes(1);
|
|
cancel();
|
|
});
|
|
|
|
it("skips the commit when focus returns inside before the delayed check completes", async () => {
|
|
const onCommit = vi.fn();
|
|
const cancel = queueContainedBlurCommit(container, onCommit);
|
|
|
|
outside.focus();
|
|
inside.focus();
|
|
await flushFrames();
|
|
|
|
expect(onCommit).not.toHaveBeenCalled();
|
|
cancel();
|
|
});
|
|
});
|