fix: implement chat surface authorization logic and add tests

Author: NoOne7135

tests/chat_surface_service.test.ts

@@ -0,0 +1,140 @@
+import { jest } from '@jest/globals';
+import { ChatSurfaceService } from '../transport/surfaces/chatSurfaceService.js';
+
+const OPTIONS = {
+  sessionResource: {
+    resourceId: 'sessions',
+    idField: 'id',
+    titleField: 'title',
+    turnsField: 'turns',
+    askerIdField: 'asker_id',
+    createdAtField: 'created_at',
+  },
+  turnResource: {
+    resourceId: 'turns',
+    idField: 'id',
+    sessionIdField: 'session_id',
+    createdAtField: 'created_at',
+    promptField: 'prompt',
+    responseField: 'response',
+  },
+  chatExternalIdentityResource: {
+    resourceId: 'external_identities',
+    surfaces: {
+      telegram: { provider: 'AdminForthAdapterTelegramOauth2' },
+    },
+  },
+} as any;
+
+const ADAPTER = { name: 'telegram' } as any;
+const INCOMING = {
+  surface: 'telegram',
+  externalUserId: 'telegram-user-1',
+  externalConversationId: 'telegram-chat-1',
+  prompt: 'hello',
+} as any;
+
+function buildRequest() {
+  return {
+    body: {},
+    query: {},
+    headers: {},
+    cookies: [],
+    requestUrl: '/adminapi/v1/agent/surface/telegram/webhook',
+    response: {
+      setHeader: jest.fn(),
+      setStatus: jest.fn(),
+      blobStream: jest.fn(),
+    },
+  } as any;
+}
+
+function buildService(adminUserRecord: Record<string, unknown>, authorizationHooks: any[]) {
+  const adminforth = {
+    config: {
+      auth: {
+        usersResourceId: 'admin_users',
+        usernameField: 'email',
+        adminUserAuthorize: authorizationHooks,
+      },
+      resources: [{
+        resourceId: 'admin_users',
+        columns: [{ name: 'id', primaryKey: true }],
+      }],
+    },
+    resource(resourceId: string) {
+      if (resourceId === 'external_identities') {
+        return {
+          list: jest.fn().mockResolvedValue([{
+            provider: 'AdminForthAdapterTelegramOauth2',
+            externalUserId: 'telegram-user-1',
+            adminUserId: 'user-1',
+          }]),
+        };
+      }
+
+      return {
+        get: jest.fn().mockResolvedValue(adminUserRecord),
+      };
+    },
+  };
+  const sessionStore = {
+    getOrCreateChatSurfaceSession: jest.fn().mockResolvedValue('session-1'),
+  };
+  const handleTurn = jest.fn().mockResolvedValue(undefined);
+  const service = new ChatSurfaceService(
+    () => adminforth as any,
+    OPTIONS,
+    sessionStore as any,
+    handleTurn,
+    jest.fn(),
+  );
+
+  return { service, sessionStore, handleTurn };
+}
+
+describe('adminforth-agent chat surface authorization', () => {
+  it('blocks a deactivated user before creating an agent session', async () => {
+    const authorizationHook = jest.fn(async ({ adminUser }) => ({
+      allowed: adminUser.dbUser.is_active,
+    }));
+    const { service, sessionStore, handleTurn } = buildService(
+      { id: 'user-1', email: 'user@example.com', is_active: false },
+      [authorizationHook],
+    );
+    const sink = { emit: jest.fn(), close: jest.fn() };
+
+    await service.handleMessage(ADAPTER, INCOMING, sink as any, buildRequest());
+
+    expect(authorizationHook).toHaveBeenCalledWith(expect.objectContaining({
+      adminUser: expect.objectContaining({ pk: 'user-1' }),
+      extra: expect.objectContaining({
+        meta: { chatSurface: 'telegram' },
+      }),
+    }));
+    expect(sessionStore.getOrCreateChatSurfaceSession).not.toHaveBeenCalled();
+    expect(handleTurn).not.toHaveBeenCalled();
+    expect(sink.emit).toHaveBeenCalledWith({
+      type: 'error',
+      message: 'This chat account is not authorized to use AdminForth Agent.',
+    });
+  });
+
+  it('continues to the agent when all authorization hooks allow the user', async () => {
+    const authorizationHook = jest.fn().mockResolvedValue({ allowed: true });
+    const { service, sessionStore, handleTurn } = buildService(
+      { id: 'user-1', email: 'user@example.com', is_active: true },
+      [authorizationHook],
+    );
+    const sink = { emit: jest.fn(), close: jest.fn() };
+
+    await service.handleMessage(ADAPTER, INCOMING, sink as any, buildRequest());
+
+    expect(sessionStore.getOrCreateChatSurfaceSession).toHaveBeenCalled();
+    expect(handleTurn).toHaveBeenCalledWith(expect.objectContaining({
+      sessionId: 'session-1',
+      chatSurface: 'telegram',
+      adminUser: expect.objectContaining({ pk: 'user-1' }),
+    }));
+  });
+});

transport/http/chatSurfaceEndpoints.ts

@@ -54,7 +54,7 @@ export function setupChatSurfaceEndpoints(ctx: ChatSurfaceEndpointsContext, serv
         const sink = await adapter.createEventSink(surfaceContext, incoming);
 
         try {
-          await ctx.handleChatSurfaceMessage(adapter, incoming, sink);
+          await ctx.handleChatSurfaceMessage(adapter, incoming, sink, endpointInput);
         } finally {
           await sink.close?.();
         }

transport/http/context.ts

@@ -3,6 +3,7 @@ import type {
   ChatSurfaceEventSink,
   ChatSurfaceIncomingMessage,
   IAdminForth,
+  IAdminForthEndpointHandlerInput,
 } from "adminforth";
 import type {
   HandleEditTurnInput,
@@ -35,6 +36,7 @@ export type AgentEndpointsContext = {
     adapter: ChatSurfaceAdapter,
     incoming: ChatSurfaceIncomingMessage,
     sink: ChatSurfaceEventSink,
+    request: IAdminForthEndpointHandlerInput,
   ): Promise<void>;
 };
 

transport/surfaces/chatSurfaceService.ts

@@ -1,9 +1,11 @@
 import type {
   AdminUser,
+  AdminUserAuthorizeFunction,
   ChatSurfaceAdapter,
   ChatSurfaceEventSink,
   ChatSurfaceIncomingMessage,
   IAdminForth,
+  IAdminForthEndpointHandlerInput,
 } from "adminforth";
 import { Filters, logger } from "adminforth";
 import type { AgentEventEmitter } from "../../domain/agentEvents.js";
@@ -281,10 +283,43 @@ export class ChatSurfaceService {
     ]);
   }
 
+  private async isAdminUserAuthorized(
+    adminUser: AdminUser,
+    incoming: ChatSurfaceIncomingMessage,
+    request: IAdminForthEndpointHandlerInput,
+  ) {
+    const adminforth = this.getAdminforth();
+    const hooks = adminforth.config.auth!.adminUserAuthorize as AdminUserAuthorizeFunction[];
+    const extra = {
+      body: request.body,
+      query: request.query,
+      headers: request.headers,
+      cookies: request.cookies,
+      requestUrl: request.requestUrl,
+      meta: { chatSurface: incoming.surface },
+      response: request.response,
+    };
+
+    for (const hook of hooks) {
+      const result = await hook({
+        adminUser,
+        response: request.response,
+        adminforth,
+        extra,
+      });
+      if (result?.allowed === false || result?.error) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
   async handleMessage(
     adapter: ChatSurfaceAdapter,
     incoming: ChatSurfaceIncomingMessage,
     sink: ChatSurfaceEventSink,
+    request: IAdminForthEndpointHandlerInput,
   ) {
     if (await this.handleLink(incoming, sink)) {
       return;
@@ -310,6 +345,14 @@ export class ChatSurfaceService {
       dbUser: adminUserRecord,
     };
 
+    if (!await this.isAdminUserAuthorized(adminUser, incoming, request)) {
+      await sink.emit({
+        type: "error",
+        message: "This chat account is not authorized to use AdminForth Agent.",
+      });
+      return;
+    }
+
     const incomingWithAudio = incoming as ChatSurfaceIncomingMessageWithAudio;
     if (incomingWithAudio.audio) {
       await this.handleAudioMessage(incomingWithAudio, sink as ChatSurfaceEventSinkWithAudio, adminUser);