Build the agent-native compute CRM platform

2026-08-13 01:39:01 -07:00
parent bfd2f8d95a
commit 853bde2265
160 changed files with 61812 additions and 483 deletions
@@ -0,0 +1,91 @@
+import { strict as assert } from 'node:assert';
+import { randomBytes } from 'node:crypto';
+import { describe, it } from 'node:test';
+import type { Config } from '../src/lib/config';
+import {
+  inviteMetadata,
+  isInferenceEndpoint,
+  memberAccessSchema,
+  platformSettingsResponse,
+  platformSettingsSchema,
+} from '../src/routes/admin-settings';
+import { decryptSecret, encryptSecret, SecretConfigurationError } from '../src/lib/secrets';
+
+describe('admin settings decisions', () => {
+  it('keeps inference separate from the Prime compute API host', () => {
+    assert.equal(isInferenceEndpoint('https://api.pinference.ai/api/v1'), true);
+    assert.equal(isInferenceEndpoint('https://api.primeintellect.ai'), false);
+    assert.equal(
+      platformSettingsSchema.safeParse({
+        piggyInferenceBase: 'https://api.primeintellect.ai/v1',
+      }).success,
+      false,
+    );
+  });
+
+  it('encrypts credentials with authenticated random envelopes and requires an external key', () => {
+    const key = randomBytes(32).toString('base64');
+    const first = encryptSecret('prime-secret', key);
+    const second = encryptSecret('prime-secret', key);
+    assert.notEqual(first, second);
+    assert.equal(decryptSecret(first, key), 'prime-secret');
+    assert.throws(
+      () => encryptSecret('prime-secret', undefined),
+      (error: unknown) => error instanceof SecretConfigurationError,
+    );
+  });
+
+  it('never returns a stored key, ciphertext, or invite hash in metadata', () => {
+    const now = new Date('2026-08-12T12:00:00.000Z');
+    const settings = platformSettingsResponse(
+      {
+        id: 'default',
+        piggyModel: 'nvidia/nemotron-3-nano-30b-a3b',
+        piggyInferenceBase: 'https://api.pinference.ai/api/v1',
+        piggyEnabled: true,
+        primeApiKeyEncrypted: 'v1.iv.tag.ciphertext',
+        primeApiKeyUpdatedAt: now,
+        primeSyncEnabled: true,
+        primeSyncIntervalMinutes: 30,
+        updatedByUserId: null,
+        updatedAt: now,
+      },
+      {
+        PRIME_API_KEY: 'environment-secret',
+        PRIME_API_BASE: 'https://api.primeintellect.ai',
+      } as Config,
+    );
+    assert.equal(JSON.stringify(settings).includes('ciphertext'), false);
+    assert.equal(JSON.stringify(settings).includes('environment-secret'), false);
+
+    const invite = inviteMetadata({
+      id: '00000000-0000-0000-0000-000000000001',
+      codeHash: 'never-return-this',
+      email: null,
+      team: null,
+      role: 'member',
+      createdByUserId: null,
+      expiresAt: null,
+      usesRemaining: 1,
+      scopeNote: null,
+      redeemedByUserId: null,
+      redeemedAt: null,
+      revokedAt: null,
+      createdAt: now,
+    });
+    assert.equal('codeHash' in invite, false);
+  });
+
+  it('rejects duplicate team assignments rather than depending on a database conflict', () => {
+    assert.equal(
+      memberAccessSchema.safeParse({
+        isPlatformAdmin: false,
+        memberships: [
+          { team: 'supply', role: 'member' },
+          { team: 'supply', role: 'admin' },
+        ],
+      }).success,
+      false,
+    );
+  });
+});