AzuTear
586 lines
21 KiB
C#
586 lines
21 KiB
C#
using System.Security.Claims;
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using System.Text.Json;
|
|
using System.Text.Json.Nodes;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Microsoft.Extensions.Configuration;
|
|
using Microsoft.Extensions.Logging.Abstractions;
|
|
using Microsoft.Extensions.Options;
|
|
using ModelContextProtocol.Server;
|
|
using Nexus.Api.Controllers;
|
|
using Nexus.Api.Data;
|
|
using Nexus.Api.Models;
|
|
using Nexus.Api.Services;
|
|
using Xunit;
|
|
|
|
namespace Nexus.Api.Tests;
|
|
|
|
public sealed class AgentProposalServiceTests
|
|
{
|
|
[Fact]
|
|
public async Task Create_IsIdempotent_AndNeverMutatesOpenClaw()
|
|
{
|
|
await using var fixture = await AgentProposalFixture.CreateAsync(
|
|
externalIdentitySupported: false);
|
|
var request = Proposal("Release Analyst");
|
|
var invocation = Invocation("proposal-1");
|
|
|
|
var first = await fixture.Service.CreateAsync(
|
|
request,
|
|
"manual",
|
|
invocation);
|
|
var replay = await fixture.Service.CreateAsync(
|
|
request,
|
|
"manual",
|
|
invocation);
|
|
|
|
Assert.True(first.Ok);
|
|
Assert.Equal(AgentProposalStates.AwaitingApproval, first.State);
|
|
Assert.True(replay.Ok);
|
|
Assert.Equal("idempotent_replay", replay.State);
|
|
Assert.Equal(first.Proposal!.Id, replay.Proposal!.Id);
|
|
Assert.Equal(1, await fixture.Db.AgentProposals.CountAsync());
|
|
Assert.Equal(0, fixture.Gateway.CreateCalls);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ListCursor_DoesNotSkipProposalsWithTheSameCreatedAt()
|
|
{
|
|
await using var fixture = await AgentProposalFixture.CreateAsync(
|
|
externalIdentitySupported: false);
|
|
foreach (var suffix in new[] { "a", "b", "c" })
|
|
{
|
|
await fixture.Service.CreateAsync(
|
|
Proposal($"Release Analyst {suffix}") with
|
|
{
|
|
ClientRequestId = $"proposal-{suffix}"
|
|
},
|
|
"manual",
|
|
Invocation($"proposal-{suffix}"));
|
|
}
|
|
|
|
var timestamp = new DateTimeOffset(
|
|
2026,
|
|
7,
|
|
30,
|
|
12,
|
|
0,
|
|
0,
|
|
TimeSpan.Zero);
|
|
foreach (var proposal in await fixture.Db.AgentProposals.ToListAsync())
|
|
{
|
|
proposal.CreatedAt = timestamp;
|
|
proposal.UpdatedAt = timestamp;
|
|
}
|
|
await fixture.Db.SaveChangesAsync();
|
|
|
|
var first = await fixture.Service.GetAsync(limit: 2);
|
|
var second = await fixture.Service.GetAsync(
|
|
limit: 2,
|
|
cursor: first.NextCursor);
|
|
|
|
Assert.Equal(2, first.Items.Count);
|
|
Assert.Single(second.Items);
|
|
Assert.Null(second.NextCursor);
|
|
Assert.Equal(
|
|
3,
|
|
first.Items
|
|
.Concat(second.Items)
|
|
.Select(item => item.Id)
|
|
.Distinct()
|
|
.Count());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Approve_FailsClosed_WhenExternalClientIdentityIsUnsupported()
|
|
{
|
|
await using var fixture = await AgentProposalFixture.CreateAsync(
|
|
externalIdentitySupported: false);
|
|
var created = await fixture.Service.CreateAsync(
|
|
Proposal("Release Analyst"),
|
|
"manual",
|
|
Invocation("proposal-1"));
|
|
|
|
var approved = await fixture.Service.ApproveAsync(
|
|
created.Proposal!.Id,
|
|
new AgentProposalActionRequest(created.Proposal.Revision),
|
|
Invocation("approve-1"));
|
|
|
|
Assert.False(approved.Ok);
|
|
Assert.Equal("experimental_blocked", approved.State);
|
|
Assert.Equal(0, await fixture.Db.AgentProvisionRequests.CountAsync());
|
|
Assert.Equal(0, fixture.Gateway.CreateCalls);
|
|
Assert.Equal(
|
|
AgentProposalStates.AwaitingApproval,
|
|
(await fixture.Service.GetByIdAsync(created.Proposal.Id))!.Status);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApprovedProposal_CreatesOnce_VerifiesInventory_AndFinalizesFiles()
|
|
{
|
|
await using var fixture = await AgentProposalFixture.CreateAsync(
|
|
externalIdentitySupported: true);
|
|
var created = await fixture.Service.CreateAsync(
|
|
Proposal("Release Analyst"),
|
|
"manual",
|
|
Invocation("proposal-1"));
|
|
var approved = await fixture.Service.ApproveAsync(
|
|
created.Proposal!.Id,
|
|
new AgentProposalActionRequest(created.Proposal.Revision),
|
|
Invocation("approve-1"));
|
|
|
|
Assert.True(approved.Ok);
|
|
Assert.Equal(AgentProposalStates.Provisioning, approved.State);
|
|
Assert.True(await fixture.Service.ProcessNextAsync());
|
|
|
|
var completed = await fixture.Service.GetByIdAsync(created.Proposal.Id);
|
|
Assert.NotNull(completed);
|
|
Assert.Equal(AgentProposalStates.Ready, completed!.Status);
|
|
Assert.Equal("release-analyst", completed.OpenClawAgentId);
|
|
Assert.Equal(1, fixture.Gateway.CreateCalls);
|
|
Assert.Contains(
|
|
"release-analyst/IDENTITY.md",
|
|
fixture.AgentFiles.Writes.Keys);
|
|
Assert.Contains(
|
|
"release-analyst/AGENTS.md",
|
|
fixture.AgentFiles.Writes.Keys);
|
|
Assert.Empty(completed.Files);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Provisioning_ResolvesWorkspaceFromLiveOpenClawDefaults()
|
|
{
|
|
await using var fixture = await AgentProposalFixture.CreateAsync(
|
|
externalIdentitySupported: true);
|
|
var created = await fixture.Service.CreateAsync(
|
|
Proposal("Release Analyst"),
|
|
"manual",
|
|
Invocation("proposal-live-workspace"));
|
|
fixture.AgentFiles.DefaultWorkspace = "/srv/openclaw/workspaces";
|
|
|
|
await fixture.Service.ApproveAsync(
|
|
created.Proposal!.Id,
|
|
new AgentProposalActionRequest(created.Proposal.Revision),
|
|
Invocation("approve-live-workspace"));
|
|
Assert.True(await fixture.Service.ProcessNextAsync());
|
|
|
|
var completed = await fixture.Service.GetByIdAsync(created.Proposal.Id);
|
|
Assert.Equal(
|
|
"/srv/openclaw/workspaces/release-analyst",
|
|
completed!.Workspace);
|
|
Assert.Equal(
|
|
"/srv/openclaw/workspaces/release-analyst",
|
|
completed.OpenClawWorkspace);
|
|
Assert.Equal(1, fixture.Gateway.CreateCalls);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task UncertainCreate_IsNotRepeated_AndRetryReconcilesBeforeAnotherCreate()
|
|
{
|
|
await using var fixture = await AgentProposalFixture.CreateAsync(
|
|
externalIdentitySupported: true);
|
|
fixture.Gateway.ThrowUncertainCreate = true;
|
|
var created = await fixture.Service.CreateAsync(
|
|
Proposal("Release Analyst"),
|
|
"manual",
|
|
Invocation("proposal-1"));
|
|
await fixture.Service.ApproveAsync(
|
|
created.Proposal!.Id,
|
|
new AgentProposalActionRequest(created.Proposal.Revision),
|
|
Invocation("approve-1"));
|
|
|
|
Assert.True(await fixture.Service.ProcessNextAsync());
|
|
Assert.False(await fixture.Service.ProcessNextAsync());
|
|
var uncertain = await fixture.Service.GetByIdAsync(created.Proposal.Id);
|
|
Assert.Equal(AgentProposalStates.InDoubt, uncertain!.Status);
|
|
Assert.Equal(1, fixture.Gateway.CreateCalls);
|
|
|
|
var retry = await fixture.Service.RetryAsync(
|
|
created.Proposal.Id,
|
|
new AgentProposalActionRequest(uncertain.Revision),
|
|
Invocation("retry-1"));
|
|
Assert.True(retry.Ok);
|
|
Assert.True(await fixture.Service.ProcessNextAsync());
|
|
|
|
var reconciled = await fixture.Service.GetByIdAsync(created.Proposal.Id);
|
|
Assert.Equal(AgentProposalStates.Failed, reconciled!.Status);
|
|
Assert.Equal("reconciled_absent", reconciled.Error!.Code);
|
|
Assert.Equal(1, fixture.Gateway.CreateCalls);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ExpiredCreateLease_IsReclaimedAsReadOnlyReconciliation()
|
|
{
|
|
await using var fixture = await AgentProposalFixture.CreateAsync(
|
|
externalIdentitySupported: true);
|
|
var created = await fixture.Service.CreateAsync(
|
|
Proposal("Lease Sentinel"),
|
|
"manual",
|
|
Invocation("proposal-lease"));
|
|
await fixture.Service.ApproveAsync(
|
|
created.Proposal!.Id,
|
|
new AgentProposalActionRequest(created.Proposal.Revision),
|
|
Invocation("approve-lease"));
|
|
|
|
var request = await fixture.Db.AgentProvisionRequests.SingleAsync();
|
|
request.Status = AgentProvisionRequestStates.Dispatching;
|
|
request.DispatchStartedAt = DateTimeOffset.UtcNow.AddMinutes(-5);
|
|
request.LeaseOwner = "abandoned-worker";
|
|
request.LeaseUntil = DateTimeOffset.UtcNow.AddSeconds(-1);
|
|
await fixture.Db.SaveChangesAsync();
|
|
|
|
Assert.True(await fixture.Service.ProcessNextAsync());
|
|
|
|
var reconciled = await fixture.Service.GetByIdAsync(
|
|
created.Proposal.Id);
|
|
Assert.Equal(AgentProposalStates.Failed, reconciled!.Status);
|
|
Assert.Equal("reconciled_absent", reconciled.Error!.Code);
|
|
Assert.Equal(0, fixture.Gateway.CreateCalls);
|
|
Assert.Contains(
|
|
await fixture.Db.OutboxEvents.ToListAsync(),
|
|
item => item.Type == "agent.provision.lease_reclaimed");
|
|
}
|
|
|
|
[Fact]
|
|
public void Controller_AndMcpTools_ExposeExpectedSecurityMetadata()
|
|
{
|
|
var authorize = typeof(OpenClawAgentProposalsController)
|
|
.GetCustomAttributes(typeof(AuthorizeAttribute), inherit: true)
|
|
.OfType<AuthorizeAttribute>()
|
|
.Single();
|
|
Assert.Equal("owner", authorize.Roles);
|
|
|
|
var propose = typeof(NexusMcpTools).GetMethod(
|
|
nameof(NexusMcpTools.ProposeAgent))!;
|
|
var proposeTool = propose.GetCustomAttributes(
|
|
typeof(McpServerToolAttribute),
|
|
inherit: false)
|
|
.OfType<McpServerToolAttribute>()
|
|
.Single();
|
|
Assert.Equal("nexus_propose_agent", proposeTool.Name);
|
|
Assert.False(proposeTool.ReadOnly);
|
|
Assert.False(proposeTool.Destructive);
|
|
Assert.True(proposeTool.Idempotent);
|
|
Assert.False(proposeTool.OpenWorld);
|
|
Assert.True(proposeTool.UseStructuredContent);
|
|
Assert.Equal(typeof(AgentProposalToolResult), proposeTool.OutputSchemaType);
|
|
|
|
var get = typeof(NexusMcpTools).GetMethod(
|
|
nameof(NexusMcpTools.GetAgentProposal))!;
|
|
var getTool = get.GetCustomAttributes(
|
|
typeof(McpServerToolAttribute),
|
|
inherit: false)
|
|
.OfType<McpServerToolAttribute>()
|
|
.Single();
|
|
Assert.True(getTool.ReadOnly);
|
|
Assert.False(getTool.Destructive);
|
|
}
|
|
|
|
private static CreateAgentProposalRequest Proposal(string name)
|
|
=> new(
|
|
name,
|
|
Role: "Release quality",
|
|
Description: "Verify releases and report evidence.",
|
|
Model: "openai/gpt-5.5",
|
|
ClientRequestId: "proposal-1");
|
|
|
|
private static OpenClawInvocationMetadata Invocation(string key)
|
|
=> new(key, $"correlation-{key}", "bao", null);
|
|
}
|
|
|
|
internal sealed class AgentProposalFixture : IAsyncDisposable
|
|
{
|
|
private AgentProposalFixture(
|
|
NexusDbContext db,
|
|
AgentProposalService service,
|
|
ProposalGatewayConnector gateway,
|
|
ProposalAgentConfigurationService agentFiles)
|
|
{
|
|
Db = db;
|
|
Service = service;
|
|
Gateway = gateway;
|
|
AgentFiles = agentFiles;
|
|
}
|
|
|
|
public NexusDbContext Db { get; }
|
|
public AgentProposalService Service { get; }
|
|
public ProposalGatewayConnector Gateway { get; }
|
|
public ProposalAgentConfigurationService AgentFiles { get; }
|
|
|
|
public static async Task<AgentProposalFixture> CreateAsync(
|
|
bool externalIdentitySupported)
|
|
{
|
|
var options = new DbContextOptionsBuilder<NexusDbContext>()
|
|
.UseInMemoryDatabase(Guid.NewGuid().ToString())
|
|
.Options;
|
|
var db = new NexusDbContext(options);
|
|
await db.Database.EnsureCreatedAsync();
|
|
|
|
var gateway = new ProposalGatewayConnector();
|
|
var management = new OpenClawManagementState();
|
|
management.SetEnabled(true);
|
|
db.OpenClawConnectionProfiles.Add(new OpenClawConnectionProfile
|
|
{
|
|
Endpoint = "ws://127.0.0.1:18789/",
|
|
DiscoverySource = "test",
|
|
RequiredVersion = gateway.RequiredVersion,
|
|
AdoptionState = OpenClawAdoptionStates.Adopted,
|
|
ManagementEnabled = true,
|
|
CapabilityHash = AgentProposalService.BuildCapabilityHash(gateway),
|
|
Revision = 1
|
|
});
|
|
await db.SaveChangesAsync();
|
|
|
|
var configuration = new ConfigurationBuilder()
|
|
.AddInMemoryCollection(new Dictionary<string, string?>
|
|
{
|
|
["OpenClawSetup:ExternalClientIdentitySupported"] =
|
|
externalIdentitySupported.ToString()
|
|
})
|
|
.Build();
|
|
var agentFiles = new ProposalAgentConfigurationService();
|
|
var service = new AgentProposalService(
|
|
db,
|
|
gateway,
|
|
agentFiles,
|
|
new StubOpenClawWriteGate(
|
|
externalIdentitySupported
|
|
? OpenClawWriteGateDecision.Permit()
|
|
: OpenClawWriteGateDecision.Block(
|
|
"experimental_blocked",
|
|
"External identity is not supported.")),
|
|
Options.Create(new AgentProvisioningOptions()),
|
|
new AgentProvisioningSignal(),
|
|
NullLogger<AgentProposalService>.Instance);
|
|
return new AgentProposalFixture(db, service, gateway, agentFiles);
|
|
}
|
|
|
|
public ValueTask DisposeAsync() => Db.DisposeAsync();
|
|
}
|
|
|
|
internal sealed class ProposalGatewayConnector : IGatewayConnector
|
|
{
|
|
private readonly List<(string Id, string Workspace)> agents = [];
|
|
|
|
public bool ThrowUncertainCreate { get; set; }
|
|
public int CreateCalls { get; private set; }
|
|
public GatewayConnectionState ConnectionState => GatewayConnectionState.Connected;
|
|
public string? GatewayVersion => "2026.7.1";
|
|
public string? RequiredVersion => "2026.7.1";
|
|
public DateTimeOffset? LastConnectedAt => DateTimeOffset.UtcNow;
|
|
public int ReconnectAttempts => 0;
|
|
public string? StatusMessage => "ready";
|
|
public string? DeviceId => "test-device";
|
|
public bool DeviceTokenConfigured => true;
|
|
public bool PairingRequired => false;
|
|
public string? PairingRequestId => null;
|
|
public int? ProtocolVersion => 4;
|
|
public IReadOnlySet<string> AdvertisedMethods { get; } = new HashSet<string>(
|
|
[
|
|
"agents.list",
|
|
"agents.create",
|
|
"agents.files.get",
|
|
"agents.files.set",
|
|
"config.get",
|
|
"models.list"
|
|
],
|
|
StringComparer.Ordinal);
|
|
public IReadOnlySet<string> AdvertisedEvents { get; } =
|
|
new HashSet<string>(StringComparer.Ordinal);
|
|
public IReadOnlySet<string> GrantedScopes { get; } = new HashSet<string>(
|
|
["operator.read", "operator.admin"],
|
|
StringComparer.Ordinal);
|
|
public DateTimeOffset? LastEventAt => null;
|
|
|
|
public bool Supports(string method) => AdvertisedMethods.Contains(method);
|
|
|
|
public Task<JsonNode?> InvokeAsync(
|
|
string method,
|
|
object? parameters = null,
|
|
TimeSpan? timeout = null,
|
|
CancellationToken cancellationToken = default,
|
|
OpenClawInvocationContext? invocationContext = null)
|
|
{
|
|
if (method == "agents.list")
|
|
{
|
|
return Task.FromResult<JsonNode?>(new JsonObject
|
|
{
|
|
["agents"] = new JsonArray(agents
|
|
.Select(item => (JsonNode)new JsonObject
|
|
{
|
|
["id"] = item.Id,
|
|
["workspace"] = item.Workspace
|
|
})
|
|
.ToArray())
|
|
});
|
|
}
|
|
|
|
if (method == "models.list")
|
|
{
|
|
return Task.FromResult<JsonNode?>(new JsonObject
|
|
{
|
|
["models"] = new JsonArray
|
|
{
|
|
new JsonObject
|
|
{
|
|
["id"] = "openai/gpt-5.5",
|
|
["name"] = "GPT-5.5",
|
|
["provider"] = "openai",
|
|
["available"] = true
|
|
}
|
|
}
|
|
});
|
|
}
|
|
|
|
if (method == "agents.create")
|
|
{
|
|
CreateCalls++;
|
|
if (ThrowUncertainCreate)
|
|
{
|
|
throw new OpenClawGatewayRpcException(
|
|
"GATEWAY_DISCONNECTED",
|
|
"Connection dropped.",
|
|
retryable: true);
|
|
}
|
|
|
|
var json = JsonSerializer.SerializeToNode(parameters)!.AsObject();
|
|
var name = json["name"]!.GetValue<string>();
|
|
var id = name.Trim().ToLowerInvariant().Replace(' ', '-');
|
|
var workspace = json["workspace"]!.GetValue<string>();
|
|
agents.Add((id, workspace));
|
|
return Task.FromResult<JsonNode?>(new JsonObject
|
|
{
|
|
["ok"] = true,
|
|
["agentId"] = id,
|
|
["name"] = name,
|
|
["workspace"] = workspace
|
|
});
|
|
}
|
|
|
|
throw new OpenClawGatewayRpcException(
|
|
"METHOD_NOT_FOUND",
|
|
$"Unexpected method {method}.");
|
|
}
|
|
|
|
public IReadOnlyList<GatewayEventEnvelope> GetRecentEvents(int limit = 100)
|
|
=> [];
|
|
}
|
|
|
|
internal sealed class ProposalAgentConfigurationService
|
|
: IOpenClawAgentConfigurationService
|
|
{
|
|
public Dictionary<string, string> Writes { get; } =
|
|
new(StringComparer.Ordinal);
|
|
public string? DefaultWorkspace { get; set; }
|
|
|
|
public Task<OpenClawAgentFileDto> GetAgentFileAsync(
|
|
string agentId,
|
|
string fileName,
|
|
CancellationToken cancellationToken = default)
|
|
{
|
|
var key = $"{agentId}/{fileName}";
|
|
if (Writes.TryGetValue(key, out var content))
|
|
{
|
|
return Task.FromResult(File(agentId, fileName, content));
|
|
}
|
|
|
|
return Task.FromResult(new OpenClawAgentFileDto(
|
|
agentId,
|
|
fileName,
|
|
true,
|
|
null,
|
|
null,
|
|
null,
|
|
OpenClawAgentConfigurationService.MissingContentHash,
|
|
DateTimeOffset.UtcNow));
|
|
}
|
|
|
|
public async Task<OpenClawAgentFileWriteDto> SetAgentFileAsync(
|
|
string agentId,
|
|
string fileName,
|
|
UpdateOpenClawAgentFileRequest request,
|
|
OpenClawInvocationContext invocationContext,
|
|
CancellationToken cancellationToken = default)
|
|
{
|
|
Writes[$"{agentId}/{fileName}"] = request.Content;
|
|
var file = await GetAgentFileAsync(agentId, fileName, cancellationToken);
|
|
return new OpenClawAgentFileWriteDto(
|
|
true,
|
|
"completed",
|
|
"verified",
|
|
file,
|
|
true,
|
|
invocationContext.IdempotencyKey,
|
|
invocationContext.CorrelationId,
|
|
DateTimeOffset.UtcNow);
|
|
}
|
|
|
|
public Task<OpenClawAgentFileCollectionDto> GetAgentFilesAsync(
|
|
string agentId,
|
|
CancellationToken cancellationToken = default)
|
|
=> throw new NotSupportedException();
|
|
|
|
public Task<OpenClawWorkspaceCollectionDto> GetWorkspaceAsync(
|
|
string agentId,
|
|
string? path,
|
|
int offset,
|
|
int limit,
|
|
CancellationToken cancellationToken = default)
|
|
=> throw new NotSupportedException();
|
|
|
|
public Task<OpenClawWorkspaceFileDto> GetWorkspaceFileAsync(
|
|
string agentId,
|
|
string path,
|
|
CancellationToken cancellationToken = default)
|
|
=> throw new NotSupportedException();
|
|
|
|
public Task<OpenClawConfigSchemaLookupDto> GetConfigSchemaAsync(
|
|
string path,
|
|
CancellationToken cancellationToken = default)
|
|
=> throw new NotSupportedException();
|
|
|
|
public Task<OpenClawConfigSnapshotDto> GetConfigAsync(
|
|
CancellationToken cancellationToken = default)
|
|
=> Task.FromResult(new OpenClawConfigSnapshotDto(
|
|
true,
|
|
true,
|
|
"config-hash",
|
|
new JsonObject
|
|
{
|
|
["agents"] = new JsonObject
|
|
{
|
|
["defaults"] = new JsonObject
|
|
{
|
|
["workspace"] = DefaultWorkspace
|
|
}
|
|
}
|
|
},
|
|
null,
|
|
null,
|
|
DateTimeOffset.UtcNow));
|
|
|
|
public Task<OpenClawConfigPatchDto> PatchConfigAsync(
|
|
PatchOpenClawConfigRequest request,
|
|
OpenClawInvocationContext invocationContext,
|
|
CancellationToken cancellationToken = default)
|
|
=> throw new NotSupportedException();
|
|
|
|
private static OpenClawAgentFileDto File(
|
|
string agentId,
|
|
string name,
|
|
string content)
|
|
=> new(
|
|
agentId,
|
|
name,
|
|
false,
|
|
Encoding.UTF8.GetByteCount(content),
|
|
DateTimeOffset.UtcNow,
|
|
content,
|
|
Convert.ToHexString(
|
|
SHA256.HashData(Encoding.UTF8.GetBytes(content)))
|
|
.ToLowerInvariant(),
|
|
DateTimeOffset.UtcNow);
|
|
}
|