AgentHub/server/__tests__/server-mode-workflows.test.js

/**
 * @file server-mode-workflows.test.js
 * @description Server mode's row ownership on the workflow endpoints
 * (server/routes/workflows.js, server/lib/workflow-stats.js run through the
 * read worker): GET /api/workflows, /api/workflows/skill-usage and
 * /api/workflows/runs count and list only a member's own sessions, another
 * member sees theirs, an admin and an analyst see every row, and local mode
 * answers exactly what an admin does.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const { describe, it, before, after } = require("node:test");
const assert = require("node:assert/strict");
const path = require("node:path");
const fs = require("node:fs");
const os = require("node:os");

const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "server-mode-workflows-"));
process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
process.env.DASHBOARD_LIVENESS_PROBE = "0";

const { createApp, startServer } = require("../index");
const { db } = require("../db");
const auth = require("../lib/auth");

let server;
let BASE;
const cookies = {};

async function get(p, cookie) {
  const res = await fetch(BASE + p, { headers: cookie ? { cookie } : {} });
  return { status: res.status, body: await res.json() };
}

async function loginAs(username, password) {
  const res = await fetch(BASE + "/api/auth/login", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ username, password }),
  });
  assert.equal(res.status, 200);
  return res.headers.get("set-cookie").split(";")[0];
}

/** One session with a main agent, a Skill call, a Bash call and a workflow run. */
function seedSession(id, laneId, skill, wfStatus) {
  db.prepare(
    `INSERT INTO sessions (id, name, status, cwd, lane_id, started_at, ended_at)
     VALUES (?, ?, 'completed', '/w', ?, '2026-10-01T00:00:00.000Z', '2026-10-01T00:10:00.000Z')`
  ).run(id, id, laneId);
  db.prepare(
    "INSERT INTO agents (id, session_id, name, type, status) VALUES (?, ?, 'Main', 'main', 'completed')"
  ).run(`${id}-main`, id);
  const ev = db.prepare(
    "INSERT INTO events (session_id, event_type, tool_name, data) VALUES (?, 'PreToolUse', ?, ?)"
  );
  ev.run(id, "Skill", JSON.stringify({ tool_input: { skill } }));
  ev.run(id, "Bash", null);
  db.prepare(
    "INSERT INTO workflows (run_id, session_id, name, status, started_at) VALUES (?, ?, ?, ?, '2026-10-01T00:00:00.000Z')"
  ).run(`wf-${id}`, id, id, wfStatus);
}

before(async () => {
  server = await startServer(createApp(), 0);
  BASE = `http://127.0.0.1:${server.address().port}`;
  const mia = await auth.createUser("mia", "member-pass-1", "developer");
  const max = await auth.createUser("max", "member-pass-2", "developer");
  await auth.createUser("boss", "admin-pass-1", "admin");
  await auth.createUser("ana", "analyst-pass-1", "analyst");

  const lane = db.prepare("INSERT INTO lanes (cwd, tool, owner_id) VALUES (?, 'claude', ?)");
  const miaLane = lane.run("/w/mia", mia.id).lastInsertRowid;
  const maxLane = lane.run("/w/max", max.id).lastInsertRowid;
  seedSession("m1", miaLane, "mia:one", "completed");
  seedSession("m2", null, "mia:two", "running"); // not stamped: held by mia's run
  db.prepare(
    "INSERT INTO dashboard_runs (id, session_id, mode, cwd, status, lane_id) VALUES (?, 'm2', 'interactive', '/w', 'running', ?)"
  ).run(`agenthub-lane-${miaLane}-1`, miaLane);
  seedSession("x1", maxLane, "max:one", "failed");
  seedSession("h1", null, "host:one", "completed"); // nobody's workspace
});

after(() => {
  delete process.env.AGENTHUB_MODE;
  server?.close();
  fs.rmSync(TMP, { recursive: true, force: true });
});

const ALL = ["h1", "m1", "m2", "x1"];

async function view(cookie) {
  const wf = await get("/api/workflows?sections=stats,complexity,modelDelegation", cookie);
  const skills = await get("/api/workflows/skill-usage", cookie);
  const runs = await get("/api/workflows/runs", cookie);
  const byStatus = await get("/api/workflows/runs?status=completed", cookie);
  for (const r of [wf, skills, runs, byStatus]) assert.equal(r.status, 200, JSON.stringify(r));
  return {
    wf: wf.body,
    sessions: wf.body.complexity.map((s) => s.id).sort(),
    totalSessions: wf.body.stats.totalSessions,
    totalAgents: wf.body.stats.totalAgents,
    skills: skills.body.skills.map((s) => s.name).sort(),
    plugins: skills.body.plugins.map((p) => p.name).sort(),
    runs: runs.body.runs.map((r) => r.session_id).sort(),
    total: runs.body.total,
    counts: runs.body.counts,
    completed: byStatus.body.runs.map((r) => r.session_id).sort(),
    completedTotal: byStatus.body.total,
  };
}

let localView;

describe("local mode", () => {
  it("reads every row", async () => {
    localView = await view();
    assert.deepEqual(localView.sessions, ALL);
    assert.equal(localView.totalSessions, 4);
    assert.equal(localView.totalAgents, 4);
    assert.deepEqual(localView.skills, ["host:one", "max:one", "mia:one", "mia:two"]);
    assert.deepEqual(localView.runs, ALL);
    assert.equal(localView.total, 4);
    assert.deepEqual(localView.counts, { completed: 2, running: 1, failed: 1 });
    assert.deepEqual(localView.completed, ["h1", "m1"]);
  });
});

describe("server mode", () => {
  before(async () => {
    process.env.AGENTHUB_MODE = "server";
    cookies.mia = await loginAs("mia", "member-pass-1");
    cookies.max = await loginAs("max", "member-pass-2");
    cookies.boss = await loginAs("boss", "admin-pass-1");
    cookies.ana = await loginAs("ana", "analyst-pass-1");
  });

  it("shows a member only their own sessions in every number", async () => {
    const v = await view(cookies.mia);
    assert.deepEqual(v.sessions, ["m1", "m2"]);
    assert.equal(v.totalSessions, 2);
    assert.equal(v.totalAgents, 2);
    assert.deepEqual(v.skills, ["mia:one", "mia:two"]);
    assert.deepEqual(v.plugins, ["mia"]);
    assert.deepEqual(v.runs, ["m1", "m2"]);
    assert.equal(v.total, 2);
    assert.deepEqual(v.counts, { completed: 1, running: 1 });
    assert.deepEqual(v.completed, ["m1"]);
    assert.equal(v.completedTotal, 1);
  });

  it("shows another member theirs", async () => {
    const v = await view(cookies.max);
    assert.deepEqual(v.sessions, ["x1"]);
    assert.equal(v.totalSessions, 1);
    assert.deepEqual(v.skills, ["max:one"]);
    assert.deepEqual(v.runs, ["x1"]);
    assert.deepEqual(v.counts, { failed: 1 });
    assert.deepEqual(v.completed, []);
  });

  it("refuses a member another member's session filter", async () => {
    const r = await get("/api/workflows/runs?session_id=x1", cookies.mia);
    assert.equal(r.status, 404);
  });

  it("shows an admin and an analyst exactly what local mode shows", async () => {
    for (const who of ["boss", "ana"]) {
      const v = await view(cookies[who]);
      assert.deepEqual({ ...v, wf: null }, { ...localView, wf: null });
      assert.deepEqual(v.wf.stats, localView.wf.stats);
      assert.deepEqual(v.wf.modelDelegation, localView.wf.modelDelegation);
    }
  });
});