Omar SobhandClaude Fable 5
000b9b3a4b
- app_connections repo; POST /api/apps/connect (keys/basic): the credential goes to the secret broker over its socket and only the encrypted ref lands in the row; disconnect endpoint; /api/apps directory merged with live connection status; audit rows for connect/disconnect - Broker protocol: InvokeHttp carries a JSON body - slack.post tool (SendsExternally -> gated): marked broker_executed — the runtime skips its own grant consumption and the BROKER independently verifies + consumes the single-use grant, then calls Slack with the bot token injected; the runtime never sees the credential - Config: [broker] socket_path + [slack] base_url; e2e harness spawns the real teamclaw-broker daemon and the server hosts an e2e-only /__slack sink - SlackApp: Connection tab stores the token via the broker; connected state - Integration test: blocked while pending -> approved -> sink received exactly one post with 'Bearer xoxb-test-token' -> grant replay refused - E2E journey: connect Slack in the panel -> gated post card with preview -> sink empty while pending -> approve -> exactly one post, queue clear 133 Rust + 63 frontend tests + 21 Playwright journeys. Co-Authored-By: Claude Fable 5 <[email protected]>
62 lines
2.7 KiB
TypeScript
62 lines
2.7 KiB
TypeScript
import { expect, test, type Page } from "@playwright/test";
|
|
|
|
// P4 exit criterion (spec §17): connect an app, and Slack outbound is
|
|
// provably blocked without approval — then executed BY the secret broker
|
|
// exactly once after approval (asserted against the e2e Slack sink).
|
|
|
|
const OWNER_EMAIL = "[email protected]";
|
|
const OWNER_PASSWORD = "e2e-password";
|
|
|
|
async function signIn(page: Page) {
|
|
await page.goto("/login");
|
|
await page.getByLabel("Email").fill(OWNER_EMAIL);
|
|
await page.getByLabel("Password").fill(OWNER_PASSWORD);
|
|
await page.getByRole("button", { name: "Sign in" }).click();
|
|
await expect(page.getByRole("heading", { name: "TeamClaw" })).toBeVisible();
|
|
}
|
|
|
|
test("connect Slack, then an outbound post is gated and broker-executed", async ({
|
|
page,
|
|
request,
|
|
}) => {
|
|
await signIn(page);
|
|
await page.getByRole("link", { name: /Scout/ }).click();
|
|
await expect(page).toHaveURL(/\/claws\/.+\/chat\//);
|
|
|
|
// Connect Slack through the panel: the token goes to the broker.
|
|
await page.getByRole("button", { name: "Computer" }).click();
|
|
const panel = page.getByRole("complementary", { name: "Computer" });
|
|
await panel.getByRole("button", { name: "Slack" }).click();
|
|
await panel.getByRole("button", { name: "Connect Slack" }).first().click();
|
|
await panel.getByLabel(/Bot token/).fill("xoxb-e2e-token");
|
|
await panel.getByRole("button", { name: "Connect Slack" }).click();
|
|
await expect(panel.getByText("Slack is connected")).toBeVisible();
|
|
await panel.getByRole("button", { name: "Close computer" }).click();
|
|
|
|
// Ask for a post: blocked behind the approval card.
|
|
const box = page.getByLabel("Message Scout");
|
|
await box.fill("share the numbers [[scenario:slack-post]]");
|
|
await box.press("Enter");
|
|
const card = page.getByRole("region", { name: "Review and approve" });
|
|
await expect(card).toBeVisible();
|
|
await expect(card.getByText(/wants to:/)).toContainText("Post to Slack #general");
|
|
|
|
// Provably blocked: the sink saw nothing.
|
|
const before = await request.get("http://127.0.0.1:8080/__slack/posts");
|
|
expect(await before.json()).toHaveLength(0);
|
|
|
|
// Approve → the broker posts exactly once.
|
|
await card.getByRole("button", { name: "Approve" }).click();
|
|
await expect(page.getByText(/Posted to #general/)).toBeVisible();
|
|
|
|
const after = await request.get("http://127.0.0.1:8080/__slack/posts");
|
|
const posts = (await after.json()) as { channel: string; text: string }[];
|
|
expect(posts).toHaveLength(1);
|
|
expect(posts[0].channel).toBe("#general");
|
|
expect(posts[0].text).toBe("Q2 revenue is up 14%.");
|
|
|
|
// The audit trail shows the decision.
|
|
await page.getByRole("link", { name: "Approvals" }).click();
|
|
await expect(page.getByText(/All clear/)).toBeVisible();
|
|
});
|