LibreChat/client/src/components/SidePanel/Agents/__tests__/AgentFooter.spec.tsx
Danny Avila 65c81955f0
🔐 feat: Granular Role-based Permissions + Entra ID Group Discovery (#7804)
* feat: Add granular role-based permissions system with Entra ID integration

      - Implement RBAC with viewer/editor/owner roles using bitwise permissions
      - Add AccessRole, AclEntry, and Group models for permission management
      - Create PermissionService for core permission logic and validation
      - Integrate Microsoft Graph API for Entra ID user/group search
      - Add middleware for resource access validation with custom ID resolvers
      - Implement bulk permission updates with transaction support
      - Create permission management UI with people picker and role selection
      - Add public sharing capabilities for resources
      - Include database migration for existing agent ownership
      - Support hybrid local/Entra ID identity management
      - Add comprehensive test coverage for all new services

chore: Update @librechat/data-schemas to version 0.0.9 and export common module in index.ts

fix: Update userGroup tests to mock logger correctly and change principalId expectation from null to undefined

* fix(data-schemas): use partial index for group idOnTheSource uniqueness

Replace sparse index with partial filter expression to allow multiple local groups
while maintaining unique constraint for external source IDs. The sparse option
on compound indexes doesn't work as expected when one field is always present.

* fix: imports in migrate-agent-permissions.js

* chore(data-schemas): add comprehensive README for data schemas package

- Introduced a detailed README.md file outlining the structure, architecture patterns, and best practices for the LibreChat Data Schemas package.
- Included guidelines for creating new entities, type definitions, schema files, model factory functions, and database methods.
- Added examples and common patterns to enhance understanding and usage of the package.

* chore: remove unused translation keys from localization file

* ci: fix existing tests based off new permission handling

- Renamed test cases to reflect changes in permission checks being handled at the route level.
- Updated assertions to verify that agents are returned regardless of user permissions due to the new permission system.
- Adjusted mocks in AppService and PermissionService tests to ensure proper functionality without relying on actual implementations.

* ci: add unit tests for access control middleware

- Introduced tests for the `canAccessAgentResource` middleware to validate permission checks for agent resources.
- Implemented tests for various scenarios including user roles, ACL entries, and permission levels.
- Added tests for the `checkAccess` function to ensure proper permission handling based on user roles and permissions.
- Utilized MongoDB in-memory server for isolated test environments.

* refactor: remove unused mocks from GraphApiService tests

* ci: enhance AgentFooter tests with improved mocks and permission handling

- Updated mocks for `useWatch`, `useAuthContext`, `useHasAccess`, and `useResourcePermissions` to streamline test setup.
- Adjusted assertions to reflect changes in UI based on agent ID and user roles.
- Replaced `share-agent` component with `grant-access-dialog` in tests to align with recent UI updates.
- Added tests for handling null agent data and permissions loading scenarios.

* ci: enhance GraphApiService tests with MongoDB in-memory server

- Updated test setup to use MongoDB in-memory server for isolated testing.
- Refactored beforeEach to beforeAll for database connection management.
- Cleared database before each test to ensure a clean state.
- Retained existing mocks while improving test structure for better clarity.

* ci: enhance GraphApiService tests with additional logger mocks

- Added mock implementation for logger methods in GraphApiService tests to improve error and debug logging during test execution.
- Ensured existing mocks remain intact while enhancing test coverage and clarity.

* chore: address ESLint Warnings

* - add cursor-based pagination to getListAgentsByAccess and update handler
- add index on updatedAt and _id in agent schema for improved query performance

* refactor permission service with reuse of model methods from data-schema package

* - Fix ObjectId comparison in getListAgentsHandler using .equals() method instead of strict equality
  - Add findPubliclyAccessibleResources function to PermissionService for bulk public resource queries
  - Add hasPublicPermission function to PermissionService for individual resource public permission checks
  - Update getAgentHandler to use hasPublicPermission for accurate individual agent public status
  - Replace instanceProjectId-based global checks with isPublic property from backend in client code
  - Add isPublic property to Agent type definition
  - Add NODE_TLS_REJECT_UNAUTHORIZED debug setting to VS Code launch config

* feat: add check for People.Read scope in searchContacts

* fix: add roleId parameter to grantPermission and update tests for GraphApiService

* refactor: remove problematic projection pipelines in getResourcePermissions for document db aws compatibility

* feat: enhance agent permissions migration with DocumentDB compatibility and add dry-run script

* feat: add support for including Entra ID group owners as members in permissions management + fix Group members  paging

* feat: enforce at least one owner requirement for permission updates and add corresponding localization messages

* refactor: remove German locale (must be added via i18n)

* chore: linting in `api/models/Agent.js` and removed unused variables

* chore: linting, remove unused vars, and remove project-related parameters from `updateAgentHandler`

* chore: address ESLint errors

* chore: revert removal of unused vars for versioning

---------

Co-authored-by: Atef Bellaaj <slalom.bellaaj@external.daimlertruck.com>
2025-06-23 10:50:07 -04:00

410 lines
12 KiB
TypeScript

import React from 'react';
import { SystemRoles } from 'librechat-data-provider';
import { render, screen } from '@testing-library/react';
import type { UseMutationResult } from '@tanstack/react-query';
import '@testing-library/jest-dom/extend-expect';
import type { Agent, AgentCreateParams, TUser } from 'librechat-data-provider';
import AgentFooter from '../AgentFooter';
import { Panel } from '~/common';
const mockUseWatch = jest.fn();
const mockUseAuthContext = jest.fn();
const mockUseHasAccess = jest.fn();
const mockUseResourcePermissions = jest.fn();
jest.mock('react-hook-form', () => ({
useFormContext: () => ({
control: {},
}),
useWatch: (params) => mockUseWatch(params),
}));
// Default mock implementations
mockUseWatch.mockImplementation(({ name }) => {
if (name === 'agent') {
return {
_id: 'agent-db-123',
name: 'Test Agent',
author: 'user-123',
projectIds: ['project-1'],
isCollaborative: false,
};
}
if (name === 'id') {
return 'agent-123';
}
return undefined;
});
const mockUser = {
id: 'user-123',
username: 'testuser',
email: 'test@example.com',
name: 'Test User',
avatar: '',
role: 'USER',
provider: 'local',
emailVerified: true,
createdAt: '2023-01-01T00:00:00.000Z',
updatedAt: '2023-01-01T00:00:00.000Z',
} as TUser;
// Default auth context
mockUseAuthContext.mockReturnValue({
user: mockUser,
token: 'mock-token',
isAuthenticated: true,
error: undefined,
login: jest.fn(),
logout: jest.fn(),
setError: jest.fn(),
roles: {},
});
// Default access and permissions
mockUseHasAccess.mockReturnValue(true);
mockUseResourcePermissions.mockReturnValue({
hasPermission: () => true,
isLoading: false,
permissionBits: 0,
});
jest.mock('~/hooks', () => ({
useLocalize: () => (key) => {
const translations = {
com_ui_save: 'Save',
com_ui_create: 'Create',
};
return translations[key] || key;
},
useAuthContext: () => mockUseAuthContext(),
useHasAccess: () => mockUseHasAccess(),
useResourcePermissions: () => mockUseResourcePermissions(),
}));
const createBaseMutation = <T = Agent, P = any>(
isLoading = false,
): UseMutationResult<T, Error, P> => {
if (isLoading) {
return {
mutate: jest.fn(),
mutateAsync: jest.fn().mockResolvedValue({} as T),
isLoading: true,
isError: false,
isSuccess: false,
isIdle: false as const,
status: 'loading' as const,
error: null,
data: undefined,
failureCount: 0,
failureReason: null,
reset: jest.fn(),
context: undefined,
variables: undefined,
isPaused: false,
};
} else {
return {
mutate: jest.fn(),
mutateAsync: jest.fn().mockResolvedValue({} as T),
isLoading: false,
isError: false,
isSuccess: false,
isIdle: true as const,
status: 'idle' as const,
error: null,
data: undefined,
failureCount: 0,
failureReason: null,
reset: jest.fn(),
context: undefined,
variables: undefined,
isPaused: false,
};
}
};
jest.mock('~/data-provider', () => ({
useUpdateAgentMutation: () => createBaseMutation<Agent, any>(),
}));
jest.mock('../Advanced/AdvancedButton', () => ({
__esModule: true,
default: jest.fn(() => <div data-testid="advanced-button" />),
}));
jest.mock('../Version/VersionButton', () => ({
__esModule: true,
default: jest.fn(() => <div data-testid="version-button" />),
}));
jest.mock('../AdminSettings', () => ({
__esModule: true,
default: jest.fn(() => <div data-testid="admin-settings" />),
}));
jest.mock('../DeleteButton', () => ({
__esModule: true,
default: jest.fn(() => <div data-testid="delete-button" />),
}));
jest.mock('../Sharing/GrantAccessDialog', () => ({
__esModule: true,
default: jest.fn(() => <div data-testid="grant-access-dialog" />),
}));
jest.mock('../DuplicateAgent', () => ({
__esModule: true,
default: jest.fn(() => <div data-testid="duplicate-agent" />),
}));
jest.mock('~/components', () => ({
Spinner: () => <div data-testid="spinner" />,
}));
describe('AgentFooter', () => {
const mockUsers = {
regular: mockUser,
admin: {
...mockUser,
id: 'admin-123',
username: 'admin',
email: 'admin@example.com',
name: 'Admin User',
role: SystemRoles.ADMIN,
} as TUser,
different: {
...mockUser,
id: 'different-user',
username: 'different',
email: 'different@example.com',
name: 'Different User',
} as TUser,
};
const createAuthContext = (user: TUser) => ({
user,
token: 'mock-token',
isAuthenticated: true,
error: undefined,
login: jest.fn(),
logout: jest.fn(),
setError: jest.fn(),
roles: {},
});
const mockSetActivePanel = jest.fn();
const mockSetCurrentAgentId = jest.fn();
const mockCreateMutation = createBaseMutation<Agent, AgentCreateParams>();
const mockUpdateMutation = createBaseMutation<Agent, any>();
const defaultProps = {
activePanel: Panel.builder,
createMutation: mockCreateMutation,
updateMutation: mockUpdateMutation,
setActivePanel: mockSetActivePanel,
setCurrentAgentId: mockSetCurrentAgentId,
};
beforeEach(() => {
jest.clearAllMocks();
// Reset to default mock implementations
mockUseWatch.mockImplementation(({ name }) => {
if (name === 'agent') {
return {
_id: 'agent-db-123',
name: 'Test Agent',
author: 'user-123',
projectIds: ['project-1'],
isCollaborative: false,
};
}
if (name === 'id') {
return 'agent-123';
}
return undefined;
});
// Reset auth context to default user
mockUseAuthContext.mockReturnValue({
user: mockUser,
token: 'mock-token',
isAuthenticated: true,
error: undefined,
login: jest.fn(),
logout: jest.fn(),
setError: jest.fn(),
roles: {},
});
// Reset access and permissions to defaults
mockUseHasAccess.mockReturnValue(true);
mockUseResourcePermissions.mockReturnValue({
hasPermission: () => true,
isLoading: false,
permissionBits: 0,
});
});
describe('Main Functionality', () => {
test('renders with standard components based on default state', () => {
render(<AgentFooter {...defaultProps} />);
expect(screen.getByText('Save')).toBeInTheDocument();
expect(screen.getByTestId('advanced-button')).toBeInTheDocument();
expect(screen.getByTestId('version-button')).toBeInTheDocument();
expect(screen.getByTestId('delete-button')).toBeInTheDocument();
expect(screen.queryByTestId('admin-settings')).not.toBeInTheDocument();
expect(screen.getByTestId('grant-access-dialog')).toBeInTheDocument();
expect(screen.getByTestId('duplicate-agent')).toBeInTheDocument();
expect(screen.queryByTestId('spinner')).not.toBeInTheDocument();
});
test('handles loading states for createMutation', () => {
const { unmount } = render(
<AgentFooter {...defaultProps} createMutation={createBaseMutation(true)} />,
);
expect(screen.getByTestId('spinner')).toBeInTheDocument();
expect(screen.queryByText('Save')).not.toBeInTheDocument();
expect(screen.getByRole('button')).toBeDisabled();
expect(screen.getByRole('button')).toHaveAttribute('aria-busy', 'true');
unmount();
});
test('handles loading states for updateMutation', () => {
render(<AgentFooter {...defaultProps} updateMutation={createBaseMutation(true)} />);
expect(screen.getByTestId('spinner')).toBeInTheDocument();
expect(screen.queryByText('Save')).not.toBeInTheDocument();
});
});
describe('Conditional Rendering', () => {
test('adjusts UI based on activePanel state', () => {
render(<AgentFooter {...defaultProps} activePanel={Panel.advanced} />);
expect(screen.queryByTestId('advanced-button')).not.toBeInTheDocument();
expect(screen.queryByTestId('version-button')).not.toBeInTheDocument();
});
test('adjusts UI based on agent ID existence', () => {
mockUseWatch.mockImplementation(({ name }) => {
if (name === 'agent') {
return null; // No agent means no delete/share/duplicate buttons
}
if (name === 'id') {
return undefined; // No ID means create mode
}
return undefined;
});
// When there's no agent, permissions should also return false
mockUseResourcePermissions.mockReturnValue({
hasPermission: () => false,
isLoading: false,
permissionBits: 0,
});
render(<AgentFooter {...defaultProps} />);
expect(screen.getByText('Create')).toBeInTheDocument();
expect(screen.queryByTestId('version-button')).not.toBeInTheDocument();
expect(screen.queryByTestId('delete-button')).not.toBeInTheDocument();
expect(screen.queryByTestId('grant-access-dialog')).not.toBeInTheDocument();
expect(screen.queryByTestId('duplicate-agent')).not.toBeInTheDocument();
});
test('adjusts UI based on user role', () => {
mockUseAuthContext.mockReturnValue(createAuthContext(mockUsers.admin));
const { unmount } = render(<AgentFooter {...defaultProps} />);
expect(screen.getByTestId('admin-settings')).toBeInTheDocument();
expect(screen.getByTestId('grant-access-dialog')).toBeInTheDocument();
// Clean up the first render
unmount();
jest.clearAllMocks();
mockUseAuthContext.mockReturnValue(createAuthContext(mockUsers.different));
mockUseWatch.mockImplementation(({ name }) => {
if (name === 'agent') {
return { name: 'Test Agent', author: 'different-author', _id: 'agent-123' };
}
if (name === 'id') {
return 'agent-123';
}
return undefined;
});
render(<AgentFooter {...defaultProps} />);
expect(screen.queryByTestId('grant-access-dialog')).toBeInTheDocument(); // Still shows because hasAccess is true
expect(screen.queryByTestId('duplicate-agent')).not.toBeInTheDocument(); // Should not show for different author
});
test('adjusts UI based on permissions', () => {
mockUseHasAccess.mockReturnValue(false);
// Also need to ensure the agent is not owned by the user and user is not admin
mockUseWatch.mockImplementation(({ name }) => {
if (name === 'agent') {
return {
_id: 'agent-db-123',
name: 'Test Agent',
author: 'different-user', // Different author
projectIds: ['project-1'],
isCollaborative: false,
};
}
if (name === 'id') {
return 'agent-123';
}
return undefined;
});
// Mock permissions to not allow sharing
mockUseResourcePermissions.mockReturnValue({
hasPermission: () => false, // No permissions
isLoading: false,
permissionBits: 0,
});
render(<AgentFooter {...defaultProps} />);
expect(screen.queryByTestId('grant-access-dialog')).not.toBeInTheDocument();
});
test('hides action buttons when permissions are loading', () => {
// Ensure we have an agent that would normally show buttons
mockUseWatch.mockImplementation(({ name }) => {
if (name === 'agent') {
return {
_id: 'agent-db-123',
name: 'Test Agent',
author: 'user-123', // Same as current user
projectIds: ['project-1'],
isCollaborative: false,
};
}
if (name === 'id') {
return 'agent-123';
}
return undefined;
});
mockUseResourcePermissions.mockReturnValue({
hasPermission: () => true,
isLoading: true, // This should hide the buttons
permissionBits: 0,
});
render(<AgentFooter {...defaultProps} />);
expect(screen.queryByTestId('delete-button')).not.toBeInTheDocument();
expect(screen.queryByTestId('grant-access-dialog')).not.toBeInTheDocument();
// Duplicate button should still show as it doesn't depend on permissions loading
expect(screen.getByTestId('duplicate-agent')).toBeInTheDocument();
});
});
describe('Edge Cases', () => {
test('handles null agent data', () => {
mockUseWatch.mockImplementation(({ name }) => {
if (name === 'agent') {
return null;
}
if (name === 'id') {
return 'agent-123';
}
return undefined;
});
render(<AgentFooter {...defaultProps} />);
expect(screen.getByText('Save')).toBeInTheDocument();
});
});
});