Skip to content

test(agents): share the two log-access action strings so an absence guard cannot pass vacuously (BLO-35509) #1998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
allyblockcast wants to merge 1 commit into from
Open

test(agents): share the two log-access action strings so an absence guard cannot pass vacuously (BLO-35509) #1998

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 18 additions & 7 deletions server/src/__tests__/agent-live-run-routes.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,17 @@ const routeAgentId = "11111111-1111-4111-8111-111111111111";
const WORKSPACE_OPERATION_LOG_SENTINEL =
"TOKEN_FIXTURE=sentinel-operation-log-not-a-real-credential ./deploy.sh";

/**
* BLO-35509. Source of truth: `server/src/routes/agents.ts` (`logRunLogAccessAudit`). Declared
* once because two of the uses below are `not.toHaveBeenCalledWith` absence guards, and an
* absence guard keyed on a literal nobody emits passes vacuously — a typo confined to that one
* site is silent, since the positives hold their own copies and keep passing. Verified on
* `master`: typo `:637` or `:780` alone and all 35 still pass. Sharing the const makes that
* shape a reference error instead.
*/
const HEARTBEAT_RUN_LOG_ACCESSED = "heartbeat.run_log_accessed";
const WORKSPACE_OPERATION_LOG_ACCESSED = "workspace_operation.log_accessed";

function workspaceOperationLogFixture(overrides: Record<string, unknown> = {}) {
return {
id: "operation-1",
Expand Down Expand Up @@ -549,7 +560,7 @@ describe("agent live run routes", () => {
actorType: "user",
actorId: "local-board",
agentId: null,
action: "heartbeat.run_log_accessed",
action: HEARTBEAT_RUN_LOG_ACCESSED,
entityType: "heartbeat_run",
entityId: "run-1",
runId: "run-1",
Expand Down Expand Up @@ -588,7 +599,7 @@ describe("agent live run routes", () => {
actorType: "agent",
actorId: routeAgentId,
agentId: routeAgentId,
action: "heartbeat.run_log_accessed",
action: HEARTBEAT_RUN_LOG_ACCESSED,
entityType: "heartbeat_run",
entityId: "run-1",
runId: "run-1",
Expand Down Expand Up @@ -634,7 +645,7 @@ describe("agent live run routes", () => {
expect(res.status, JSON.stringify(res.body)).toBe(404);
expect(mockHeartbeatService.readLog).toHaveBeenCalled();
expect(mockLogActivity).not.toHaveBeenCalledWith(expect.anything(), expect.objectContaining({
action: "heartbeat.run_log_accessed",
action: HEARTBEAT_RUN_LOG_ACCESSED,
}));
});

Expand Down Expand Up @@ -669,7 +680,7 @@ describe("agent live run routes", () => {
// disclosed. Without `withheld` the record is indistinguishable from a real disclosure, and
// "who read this log" over-reports.
expect(mockLogActivity).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({
action: "workspace_operation.log_accessed",
action: WORKSPACE_OPERATION_LOG_ACCESSED,
details: expect.objectContaining({ result: "allowed", withheld: true }),
}));
});
Expand All @@ -690,7 +701,7 @@ describe("agent live run routes", () => {
companyId: "company-1",
actorType: "user",
actorId: "local-board",
action: "workspace_operation.log_accessed",
action: WORKSPACE_OPERATION_LOG_ACCESSED,
entityType: "workspace_operation",
entityId: "operation-1",
// The operation's own run, so an audit reader can join back to the run that produced it.
Expand Down Expand Up @@ -730,7 +741,7 @@ describe("agent live run routes", () => {
actorType: "agent",
actorId: routeAgentId,
agentId: routeAgentId,
action: "workspace_operation.log_accessed",
action: WORKSPACE_OPERATION_LOG_ACCESSED,
entityType: "workspace_operation",
entityId: "operation-1",
details: expect.objectContaining({
Expand Down Expand Up @@ -777,7 +788,7 @@ describe("agent live run routes", () => {
expect(res.status, JSON.stringify(res.body)).toBe(404);
expect(mockWorkspaceOperationService.readLog).toHaveBeenCalled();
expect(mockLogActivity).not.toHaveBeenCalledWith(expect.anything(), expect.objectContaining({
action: "workspace_operation.log_accessed",
action: WORKSPACE_OPERATION_LOG_ACCESSED,
}));
});

Expand Down
Loading