AgentHub/server/__tests__/server-mode-users.test.js

/**
 * @file server-mode-users.test.js
 * @description Server mode's staff views: `GET /api/users` lists each account's
 * workspaces, sessions and recent spend to an admin/analyst and refuses a
 * member; an admin/analyst reading a member's session is written to the audit
 * log (`GET /api/users/audit`), while a member reading their own, or a read of
 * an ownerless session, is not.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const { describe, it, before, after } = require("node:test");
const assert = require("node:assert/strict");
const path = require("node:path");
const fs = require("node:fs");
const os = require("node:os");

const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "server-mode-users-"));
process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
process.env.DASHBOARD_LIVENESS_PROBE = "0";

const { createApp, startServer } = require("../index");
const { db } = require("../db");
const auth = require("../lib/auth");

let server;
let BASE;
const ids = {};

async function call(p, cookie) {
  const res = await fetch(BASE + p, { headers: cookie ? { cookie } : {} });
  return { status: res.status, body: await res.json().catch(() => null) };
}

async function login(username, password) {
  const res = await fetch(BASE + "/api/auth/login", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ username, password }),
  });
  assert.equal(res.status, 200);
  return res.headers.get("set-cookie").split(";")[0];
}

before(async () => {
  process.env.AGENTHUB_MODE = "server";
  server = await startServer(createApp(), 0);
  BASE = `http://127.0.0.1:${server.address().port}`;
  ids.boss = (await auth.createUser("boss", "admin-pass-1", "admin")).id;
  ids.ana = (await auth.createUser("ana", "analyst-pass-1", "analyst")).id;
  ids.mia = (await auth.createUser("mia", "member-pass-1", "member")).id;
  const lane = db
    .prepare("INSERT INTO lanes (cwd, tool, owner_id) VALUES ('/w/mia', 'claude', ?)")
    .run(ids.mia).lastInsertRowid;
  db.prepare(
    "INSERT INTO sessions (id, name, status, cwd, lane_id) VALUES ('sm', 'mia work', 'active', '/w/mia', ?)"
  ).run(lane);
  db.prepare(
    "INSERT INTO sessions (id, name, status, cwd) VALUES ('sx', 'host work', 'active', '/w/host')"
  ).run();
  db.prepare(
    `INSERT INTO token_usage_hourly (session_id, hour, model, output_tokens)
     VALUES ('sm', ?, 'claude-sonnet-4-5-20250929', 1000000)`
  ).run(new Date().toISOString().slice(0, 13));
});

after(() => {
  delete process.env.AGENTHUB_MODE;
  server?.close();
  fs.rmSync(TMP, { recursive: true, force: true });
});

describe("staff views", () => {
  it("lists every account's usage to staff and refuses a member", async () => {
    const admin = await login("boss", "admin-pass-1");
    const r = await call("/api/users", admin);
    assert.equal(r.status, 200);
    const mia = r.body.users.find((u) => u.username === "mia");
    assert.equal(mia.workspaces, 1);
    assert.equal(mia.sessions, 1);
    assert.ok(mia.last7d.cost > 0 && mia.last30d.cost >= mia.last7d.cost);
    assert.ok(!JSON.stringify(r.body).includes("scrypt"), "no password hash");
    assert.equal((await call("/api/users", await login("ana", "analyst-pass-1"))).status, 200);
    const member = await call("/api/users", await login("mia", "member-pass-1"));
    assert.equal(member.status, 403);
  });

  it("audits a staff read of a member's session, and nothing else", async () => {
    const admin = await login("boss", "admin-pass-1");
    const mia = await login("mia", "member-pass-1");
    const before = (await call("/api/users/audit", admin)).body.entries.length;

    assert.equal((await call("/api/sessions/sm", mia)).status, 200); // own read
    assert.equal((await call("/api/sessions/sx", admin)).status, 200); // ownerless
    assert.equal((await call("/api/sessions/sm/transcript", admin)).status < 500, true);
    await call("/api/sessions/sm", await login("ana", "analyst-pass-1"));

    const entries = (await call("/api/users/audit", admin)).body.entries;
    assert.equal(entries.length - before, 2);
    assert.deepEqual(
      entries.slice(0, 2).map((e) => [e.reader, e.owner, e.session_id]),
      [
        ["ana", "mia", "sm"],
        ["boss", "mia", "sm"],
      ]
    );
  });
});