fix: enforce work product external url policy

tests/integration/work-product-url-policy.spec.ts

@@ -0,0 +1,211 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { afterEach, describe, expect, it } from "vitest";
+import { createAgentToken, initializeAgentTokenSigningKey } from "../../src/main/agent-auth";
+import { createApiServer } from "../../src/main/api-server";
+import { AppDatabase } from "../../src/main/database";
+import { createTestApiServerCallbacks } from "../support/api-server-callbacks";
+
+const tempDirs: string[] = [];
+
+async function createTempDir(prefix: string) {
+  const dir = await mkdtemp(join(tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+afterEach(async () => {
+  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+});
+
+async function createHarness() {
+  const profileDir = await createTempDir("agentcompany-work-product-url-");
+  initializeAgentTokenSigningKey(profileDir);
+  const db = new AppDatabase(profileDir);
+  db.init();
+  db.core.connectors.updateConnectorHealth({
+    id: "openai-codex",
+    status: "ready",
+    authState: "authenticated",
+    version: "test",
+    lastError: null,
+  });
+
+  const companyId = db.core.company.saveCompany({
+    name: "URL Policy Co",
+    description: "Tests work product URL trust policy",
+    status: "active",
+  });
+  const workspaceId = db.core.workspaces.saveWorkspace({
+    companyId,
+    name: "Primary",
+    localPath: profileDir,
+    repoUrl: "",
+    repoRef: "",
+    isPrimary: true,
+  });
+  const agentId = db.core.agents.saveAgent({
+    companyId,
+    name: "Reporter",
+    role: "Researcher",
+    title: "Reporter",
+    status: "active",
+    reportsTo: null,
+    connectorId: "openai-codex",
+    workspaceId,
+    model: null,
+    capabilities: "Writes reports",
+    budgetMonthlyUsd: 100,
+  });
+  const taskId = db.core.tasks.saveTask({
+    companyId,
+    title: "Publish external report",
+    description: "Attach a report link.",
+    assigneeAgentId: agentId,
+    workspaceId,
+    priority: "medium",
+    status: "in_progress",
+  });
+  const run = db.core.runs.createRun({
+    companyId,
+    taskId,
+    agentId,
+    workspaceId,
+    connectorId: "openai-codex",
+  });
+  const token = createAgentToken(agentId, companyId, run.id);
+  const server = createApiServer(db, createTestApiServerCallbacks());
+  const port = await server.start();
+
+  return {
+    db,
+    server,
+    companyId,
+    taskId,
+    baseUrl: `http://127.0.0.1:${port}`,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "X-Agent-Company-Run-Id": run.id,
+      "Content-Type": "application/json; charset=utf-8",
+    },
+  };
+}
+
+describe("work product URL API policy", () => {
+  it("rejects blank URLs during work product creation", async () => {
+    const harness = await createHarness();
+    try {
+      const response = await fetch(`${harness.baseUrl}/api/issues/${harness.taskId}/work-products`, {
+        method: "POST",
+        headers: harness.headers,
+        body: JSON.stringify({
+          type: "link",
+          provider: "external",
+          title: "Blank URL",
+          url: "   ",
+        }),
+      });
+
+      expect(response.status).toBe(400);
+      expect(harness.db.queryAll("select id from work_products")).toHaveLength(0);
+    } finally {
+      harness.server.stop();
+      harness.db.close();
+    }
+  });
+
+  it("rejects custom schemes during work product creation", async () => {
+    const harness = await createHarness();
+    try {
+      const response = await fetch(`${harness.baseUrl}/api/issues/${harness.taskId}/work-products`, {
+        method: "POST",
+        headers: harness.headers,
+        body: JSON.stringify({
+          type: "link",
+          provider: "external",
+          title: "Local scheme",
+          url: "vscode://file/etc/passwd",
+        }),
+      });
+
+      expect(response.status).toBe(400);
+      expect(harness.db.queryAll("select id from work_products")).toHaveLength(0);
+    } finally {
+      harness.server.stop();
+      harness.db.close();
+    }
+  });
+
+  it("rejects credential-bearing URLs during work product creation", async () => {
+    const harness = await createHarness();
+    try {
+      const response = await fetch(`${harness.baseUrl}/api/issues/${harness.taskId}/work-products`, {
+        method: "POST",
+        headers: harness.headers,
+        body: JSON.stringify({
+          type: "link",
+          provider: "external",
+          title: "Credential URL",
+          url: "https://user:pass@example.com/reports/q1",
+        }),
+      });
+
+      expect(response.status).toBe(400);
+      expect(harness.db.queryAll("select id from work_products")).toHaveLength(0);
+    } finally {
+      harness.server.stop();
+      harness.db.close();
+    }
+  });
+
+  it("stores http links for later confirmation during open", async () => {
+    const harness = await createHarness();
+    try {
+      const response = await fetch(`${harness.baseUrl}/api/issues/${harness.taskId}/work-products`, {
+        method: "POST",
+        headers: harness.headers,
+        body: JSON.stringify({
+          type: "link",
+          provider: "external",
+          title: "External report",
+          url: " https://example.com/reports/q1 ",
+        }),
+      });
+
+      expect(response.status).toBe(201);
+      const row = harness.db.queryAll<{ url: string }>("select url from work_products limit 1")[0];
+      expect(row?.url).toBe("https://example.com/reports/q1");
+    } finally {
+      harness.server.stop();
+      harness.db.close();
+    }
+  });
+
+  it("rejects custom schemes during work product updates", async () => {
+    const harness = await createHarness();
+    try {
+      const id = harness.db.core.documents.createWorkProduct({
+        companyId: harness.companyId,
+        taskId: harness.taskId,
+        type: "link",
+        provider: "external",
+        title: "External report",
+        url: "https://example.com/reports/q1",
+      });
+
+      const response = await fetch(`${harness.baseUrl}/api/work-products/${id}`, {
+        method: "PATCH",
+        headers: harness.headers,
+        body: JSON.stringify({ url: "file:///etc/passwd" }),
+      });
+
+      expect(response.status).toBe(400);
+      const row = harness.db.queryAll<{ url: string }>("select url from work_products where id = ? limit 1", id)[0];
+      expect(row?.url).toBe("https://example.com/reports/q1");
+    } finally {
+      harness.server.stop();
+      harness.db.close();
+    }
+  });
+});