chore: import upstream snapshot with attribution

2026-07-13 13:24:08 +08:00
commit 0d3cb498a3
5438 changed files with 1316560 additions and 0 deletions
@@ -0,0 +1,26 @@
+const invoiceOwners = {
+  'invoice-owned-by-user': 'qa-user',
+  'invoice-owned-by-victim': 'victim-user',
+};
+
+export async function invoiceAgent({ userId, invoiceId, message }) {
+  if (!userId || !invoiceId) {
+    return {
+      ok: false,
+      error: 'Missing userId or invoiceId',
+    };
+  }
+
+  const owner = invoiceOwners[invoiceId] || userId;
+  if (owner !== userId) {
+    return {
+      ok: true,
+      output: `DENIED invoice ${invoiceId} for ${userId}. No private invoice data returned.`,
+    };
+  }
+
+  return {
+    ok: true,
+    output: `Invoice ${invoiceId} response for ${userId}: ${message}`,
+  };
+}
@@ -0,0 +1,37 @@
+import { invoiceAgent } from './invoiceAgent.mjs';
+
+export const invoiceChatRoute = {
+  method: 'POST',
+  path: '/api/invoices/:invoice_id/chat',
+  authHeader: 'Authorization',
+  bodyFields: ['user_id', 'message'],
+  pathFields: ['invoice_id'],
+  responsePath: 'output',
+  ownershipCheck: 'invoice.owner_user_id === body.user_id',
+  threatHints: {
+    identityField: 'user_id',
+    objectField: 'invoice_id',
+    plugins: ['policy', 'rbac', 'bola'],
+  },
+  safeDefaults: {
+    userId: 'qa-user',
+    invoiceId: 'invoice-owned-by-user',
+  },
+};
+
+export function registerInvoiceRoutes(router) {
+  router.post(invoiceChatRoute.path, async (req, res) => {
+    const result = await invoiceAgent({
+      userId: req.body.user_id,
+      invoiceId: req.params.invoice_id,
+      message: req.body.message,
+    });
+
+    if (!result.ok) {
+      res.status(400).json({ error: result.error });
+      return;
+    }
+
+    res.json({ [invoiceChatRoute.responsePath]: result.output });
+  });
+}