popagent

Latest change bea7c647f451d774dcf4753d7ca5ca5e01d0cf54 - Rename supervisor agent ID to orchistrator by Ólafur Búi Ólafsson

import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { RequestContext } from "@mastra/core/request-context";
import { agentSecrets, normalizeSecretOrigin } from "../secrets";
import { createUseBrowserSecretTool } from "./secrets";

const originalSecretKey = process.env.POPAGENT_SECRET_KEY;
beforeAll(() => {
  process.env.POPAGENT_SECRET_KEY ??= crypto.getRandomValues(new Uint8Array(32)).toBase64();
});
afterAll(() => {
  if (originalSecretKey === undefined) delete process.env.POPAGENT_SECRET_KEY;
  else process.env.POPAGENT_SECRET_KEY = originalSecretKey;
});

describe("agent secret store", () => {
  test("persists metadata separately from an origin-bound encrypted value", async () => {
    const resourceId = `secret-tools-${crypto.randomUUID()}`;
    const name = `browser/password-${crypto.randomUUID()}`;
    const initialValue = `initial-${crypto.randomUUID()}`;
    const replacementValue = `replacement-${crypto.randomUUID()}`;

    const created = await agentSecrets.create(resourceId, {
      name,
      value: initialValue,
      allowedOrigin: "https://example.com",
    });
    try {
      expect(created).toEqual(expect.objectContaining({
        name,
        allowedOrigin: "https://example.com",
      }));
      expect(JSON.stringify(await agentSecrets.list(resourceId))).not.toContain(initialValue);
      expect(await agentSecrets.recallBound(resourceId, name)).toEqual({
        name,
        value: initialValue,
        allowedOrigin: "https://example.com",
      });

      const updated = await agentSecrets.update(resourceId, name, {
        value: replacementValue,
        allowedOrigin: "https://example.org:443",
      });
      expect(updated?.allowedOrigin).toBe("https://example.org");
      expect(await agentSecrets.recallBound(resourceId, name)).toEqual({
        name,
        value: replacementValue,
        allowedOrigin: "https://example.org",
      });
    } finally {
      await agentSecrets.delete(resourceId, name);
    }
    expect(await agentSecrets.recallBound(resourceId, name)).toBeUndefined();
  });

  test("accepts only exact HTTPS origins", () => {
    expect(normalizeSecretOrigin("https://EXAMPLE.com:443")).toBe("https://example.com");
    expect(() => normalizeSecretOrigin("http://example.com")).toThrow("HTTPS");
    expect(() => normalizeSecretOrigin("https://*.example.com")).toThrow("exact origin");
    expect(() => normalizeSecretOrigin("https://example.com/login")).toThrow("origin without a path");
  });
});

describe("useBrowserSecret", () => {
  test("passes plaintext only to the bound browser consumer", async () => {
    const marker = `secret-${crypto.randomUUID()}`;
    const uses: unknown[] = [];
    const tool = createUseBrowserSecretTool(
      {
        recallBound: async () => ({
          name: "login/password",
          value: marker,
          allowedOrigin: "https://example.com",
        }),
      },
      {
        useBoundSecret: async (input) => {
          uses.push(input);
          return { used: true as const, name: input.name, origin: input.allowedOrigin };
        },
      },
    );
    const requestContext = new RequestContext();
    requestContext.set("popagent.resourceId", "popagent-user");

    const result = await tool.execute?.(
      { name: "login/password", ref: "@e5" },
      {
        requestContext,
        agent: {
          agentId: "orchistrator",
          threadId: "thread-1",
          toolCallId: "tool-1",
        },
      } as never,
    );

    expect(result).toEqual({
      used: true,
      name: "login/password",
      origin: "https://example.com",
    });
    expect(JSON.stringify(result)).not.toContain(marker);
    expect(uses).toEqual([{
      agentId: "orchistrator",
      threadId: "thread-1",
      ref: "@e5",
      name: "login/password",
      value: marker,
      allowedOrigin: "https://example.com",
    }]);
  });
});