feat: finalize mindspace service extraction phase a

2026-07-03 08:40:28 +08:00
parent 506a551438
commit ec5b1a6e3f
32 changed files with 2834 additions and 490 deletions
@@ -100,6 +100,29 @@ function createAdminLayoutPool(adminRow) {
  };
 }

+function createAgentPolicyPool(userRow) {
+  return {
+    async query(sql, params = []) {
+      if (sql.includes('FROM h5_users u') && sql.includes('WHERE u.id = ?')) {
+        return [[userRow]];
+      }
+      if (sql.includes('FROM h5_assets a') && sql.includes('JOIN h5_space_categories')) {
+        return [[]];
+      }
+      if (sql.includes('FROM h5_user_capability_grants')) return [[]];
+      if (sql.includes('FROM h5_user_policy_grants')) return [[]];
+      if (sql.includes('FROM h5_user_skill_grants')) return [[]];
+      if (sql.includes('UPDATE h5_users SET workspace_root = ?')) {
+        userRow.workspace_root = params[0];
+        return [[]];
+      }
+      if (sql.includes('DELETE FROM h5_user_path_grants')) return [[]];
+      if (sql.includes('INSERT INTO h5_user_path_grants')) return [[]];
+      return [[]];
+    },
+  };
+}
+
 test('login rate limits repeated failures', async () => {
  const auth = createUserAuth(createAuthPool(null), {
    loginMaxFailures: 2,
@@ -267,6 +290,38 @@ test('ensureAdminUser repairs existing admin workspace without password env', as
  assert.equal(adminRow.workspace_root, path.join(root, 'MindSpace', adminRow.id));
 });

+test('agent session policy preserves sandbox root and exposes workspace ref metadata', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'memind-agent-policy-'));
+  const userRow = {
+    id: 'user-1',
+    username: 'john',
+    slug: 'john',
+    email: 'john@example.com',
+    display_name: 'John',
+    role: 'user',
+    status: 'active',
+    plan_type: 'free',
+    workspace_root: path.join(root, 'legacy-root'),
+    quota_bytes: 1024,
+    used_bytes: 0,
+    reserved_bytes: 0,
+    balance_cents: 100,
+    tokens_used: 0,
+  };
+  const auth = createUserAuth(createAgentPolicyPool(userRow), {
+    h5Root: root,
+    persistSessions: false,
+    env: { GOOSED_SANDBOX_PUBLISH_ROOT: '/srv/goosed-mindspace' },
+  });
+
+  const policy = await auth.getAgentSessionPolicy(userRow.id);
+  const sandboxFs = policy.extensionOverrides.find((item) => item.name === 'sandbox-fs');
+  assert.ok(sandboxFs);
+  assert.equal(sandboxFs.envs.SANDBOX_ROOT, path.resolve('/srv/goosed-mindspace/user-1'));
+  assert.equal(sandboxFs.envs.MINDSPACE_WORKSPACE_ROOT, path.resolve(root, 'MindSpace', 'user-1'));
+  assert.equal(sandboxFs.envs.MINDSPACE_WORKSPACE_REF, 'mindspace://users/user-1/workspace');
+});
+
 test('admin capabilities include granted platform skills', async () => {
  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'memind-admin-skills-'));
  await fs.mkdir(path.join(root, 'skills', 'product-campaign-page'), { recursive: true });