P2 BLOCKING exit green: approval interception chain end-to-end

- tc-tools: Effect declarations -> §15 GatedCategory mapping, deny-by-default external reach, taint invariant property-tested (tainted external effects are NEVER auto-allowed) - tc-safety: pending approvals with exact payload+preview, CAS decide with audit + single-use grant in one tx, checkpoint suspend/load, exclusive resume claim, expiry sweep, decided-unresumed work queue (migration 0004 adds the outbox the gated email.send tool writes) - tc-runtime: resumable LoopState checkpointed to agent_runs; gated tool -> approval row -> approval_required/run_suspended events -> suspend; resume consumes the grant BEFORE executing (spent grant = no execution), rejection feeds a structured refusal in-band; durable resume sweeper; continuous journal seq across suspension (tested). ContentPart::Text became a struct variant — internally-tagged newtype primitives don't serialize - tc-api: GET/decide approvals endpoints (409 double-decide, tenant isolation), decision triggers in-process resume; full chain proven over HTTP incl. gateway resumeFrom continuation - frontend: approval_required/run_suspended events, suspended reply state, inline ApprovalCard (§10: summary, category, exact payload preview, approve/reject -> decide + stream re-attach), /approvals queue page, nav - E2E (14 journeys, workers:1 to serialize the shared backend): gated email blocks with disabled composer -> approve -> continuation + ✓ step + reload replay; reject -> ✗ step, nothing executed; queue page decides pending 106 Rust + 61 frontend tests + 14 Playwright journeys green. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-10 04:58:47 -05:00
parent 9f9f507c15
commit de38449b41
62 changed files with 3576 additions and 203 deletions
@@ -0,0 +1,93 @@
+use axum::extract::{Path, State};
+use axum::Json;
+use serde_json::{json, Value};
+use tc_safety::{approvals, Approval, Decision, ResumeReady, SafetyError};
+use uuid::Uuid;
+
+use crate::{ApiError, AppState, Authed};
+
+impl From<SafetyError> for ApiError {
+    fn from(err: SafetyError) -> Self {
+        match err {
+            SafetyError::NotFound => ApiError::NotFound,
+            SafetyError::AlreadyDecided => ApiError::Conflict,
+            _ => ApiError::Internal,
+        }
+    }
+}
+
+/// Loads an approval, hiding other workspaces' approvals entirely.
+async fn workspace_approval(
+    state: &AppState,
+    user: &tc_auth::AuthedUser,
+    id: Uuid,
+) -> Result<Approval, ApiError> {
+    let approval = approvals::get(&state.pool, id).await?;
+    if approval.workspace_id != user.workspace_id {
+        return Err(ApiError::NotFound);
+    }
+    Ok(approval)
+}
+
+/// GET /api/approvals — the pending review queue (§10), oldest first.
+pub async fn list(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+) -> Result<Json<Vec<Approval>>, ApiError> {
+    let pending = approvals::list_pending(&state.pool, user.workspace_id).await?;
+    Ok(Json(pending))
+}
+
+/// GET /api/approvals/{id}
+pub async fn get(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Approval>, ApiError> {
+    Ok(Json(workspace_approval(&state, &user, id).await?))
+}
+
+async fn decide(
+    state: AppState,
+    user: tc_auth::AuthedUser,
+    id: Uuid,
+    decision: Decision,
+) -> Result<Json<Value>, ApiError> {
+    workspace_approval(&state, &user, id).await?;
+    let approval = approvals::decide(&state.pool, id, user.user_id, decision).await?;
+
+    // Kick the resume immediately; the sweeper remains the durable
+    // fallback if this process dies first.
+    let runtime = state.runtime.clone();
+    let ready = ResumeReady {
+        run_id: approval.run_id,
+        approval_id: approval.id,
+        approved: decision == Decision::Approve,
+    };
+    tokio::spawn(async move {
+        let _ = runtime.resume_run(ready).await;
+    });
+
+    Ok(Json(
+        json!({ "id": approval.id, "status": approval.status }),
+    ))
+}
+
+/// POST /api/approvals/{id}/approve — executes the gated action (§15:
+/// approve-only execution, idempotent, audited).
+pub async fn approve(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Value>, ApiError> {
+    decide(state, user, id, Decision::Approve).await
+}
+
+/// POST /api/approvals/{id}/reject — the agent learns the refusal in-band.
+pub async fn reject(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Value>, ApiError> {
+    decide(state, user, id, Decision::Reject).await
+}