update reviewer authentication and API calls

aadesh18 · aadesh18 · commit 185d245c67d2 · 2026-05-11T13:20:30.000-07:00
diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/add-manual/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/add-manual/route.ts
@@ -1,4 +1,4 @@
-import { callReducerStrict } from "@/lib/ai/spacetimedb-client";
+import { callReducerStrict, opt } from "@/lib/ai/spacetimedb-client";
 import { assertIsAiChatReviewer } from "@/lib/ai/qa/reviewer-auth";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { adaptSchema, yupBoolean, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
@@ -16,6 +16,7 @@ export const POST = createSmartRouteHandler({
       question: yupString().defined(),
       answer: yupString().defined(),
       publish: yupBoolean().defined(),
+      requestId: yupString(),
     }).defined(),
     method: yupString().oneOf(["POST"]).defined(),
   }),
@@ -27,8 +28,8 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   handler: async ({ auth, body }) => {
+    assertIsAiChatReviewer(auth);
     const user = auth.user;
-    assertIsAiChatReviewer(user);
 
     const token = getEnvVariable("STACK_MCP_LOG_TOKEN");
     await callReducerStrict("add_manual_qa", [
@@ -37,6 +38,7 @@ export const POST = createSmartRouteHandler({
       body.answer,
       body.publish,
       user.display_name ?? user.primary_email ?? user.id,
+      body.requestId
     ]);
 
     return {
diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/delete/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/delete/route.ts
@@ -25,7 +25,7 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   handler: async ({ auth, body }) => {
-    assertIsAiChatReviewer(auth.user);
+    assertIsAiChatReviewer(auth);
 
     const token = getEnvVariable("STACK_MCP_LOG_TOKEN");
     await callReducerStrict("delete_qa_entry", [
diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/mark-reviewed/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/mark-reviewed/route.ts
@@ -25,8 +25,8 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   handler: async ({ auth, body }) => {
+    assertIsAiChatReviewer(auth);
     const user = auth.user;
-    assertIsAiChatReviewer(user);
 
     const token = getEnvVariable("STACK_MCP_LOG_TOKEN");
     await callReducerStrict("mark_human_reviewed", [
diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/unmark-reviewed/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/unmark-reviewed/route.ts
@@ -25,7 +25,7 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   handler: async ({ auth, body }) => {
-    assertIsAiChatReviewer(auth.user);
+    assertIsAiChatReviewer(auth);
 
     const token = getEnvVariable("STACK_MCP_LOG_TOKEN");
     await callReducerStrict("unmark_human_reviewed", [
diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/update-correction/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/update-correction/route.ts
@@ -28,8 +28,8 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   handler: async ({ auth, body }) => {
+    assertIsAiChatReviewer(auth);
     const user = auth.user;
-    assertIsAiChatReviewer(user);
 
     const token = getEnvVariable("STACK_MCP_LOG_TOKEN");
     const reviewer = user.display_name ?? user.primary_email ?? user.id;
diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/update-qa-entry/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/update-qa-entry/route.ts
@@ -28,8 +28,8 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   handler: async ({ auth, body }) => {
+    assertIsAiChatReviewer(auth);
     const user = auth.user;
-    assertIsAiChatReviewer(user);
 
     const token = getEnvVariable("STACK_MCP_LOG_TOKEN");
     const editor = user.display_name ?? user.primary_email ?? user.id;
diff --git a/apps/backend/src/app/api/latest/internal/spacetimedb-enroll-reviewer/route.ts b/apps/backend/src/app/api/latest/internal/spacetimedb-enroll-reviewer/route.ts
@@ -26,8 +26,8 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   handler: async ({ auth, body }) => {
+    assertIsAiChatReviewer(auth);
     const user = auth.user;
-    assertIsAiChatReviewer(user);
     if (!/^[0-9a-fA-F]{64}$/.test(body.identity)) {
       throw new StatusError(StatusError.BadRequest, "Invalid identity.");
     }
diff --git a/apps/backend/src/lib/ai/qa/reviewer-auth.ts b/apps/backend/src/lib/ai/qa/reviewer-auth.ts
@@ -1,6 +1,19 @@
+import { KnownErrors } from "@stackframe/stack-shared";
 import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 
-export function assertIsAiChatReviewer(user: { client_read_only_metadata?: unknown }): void {
+export function assertIsAiChatReviewer(auth: {
+  project: { id: string },
+  user?: { client_read_only_metadata?: unknown } | null,
+}): void {
+  if (auth.project.id !== "internal") {
+    throw new KnownErrors.ExpectedInternalProject();
+  }
+
+  const user = auth.user;
+  if (!user) {
+    throw new StatusError(StatusError.Unauthorized, "You must be signed in to perform MCP review operations.");
+  }
+
   const metadata = user.client_read_only_metadata;
   if (!(metadata && typeof metadata === "object" && "isAiChatReviewer" in metadata && metadata.isAiChatReviewer === true)) {
     throw new StatusError(StatusError.Forbidden, "You are not approved to perform MCP review operations.");
diff --git a/apps/backend/src/lib/ai/spacetimedb-client.ts b/apps/backend/src/lib/ai/spacetimedb-client.ts
@@ -67,27 +67,34 @@ function spacetimeDbError(label: string, status: number, preview: string): Error
   return new StackAssertionError(detail);
 }
 
-export async function callReducer(reducer: string, args: unknown[]): Promise<void> {
+async function callWithEnrollmentRetry(reducer: string, args: unknown[]): Promise<boolean> {
   const token = await getServiceToken();
-  if (!token) return;
-  await rawCallReducer(token, reducer, args);
+  if (!token) return false;
+  try {
+    await rawCallReducer(token, reducer, args);
+    return true;
+  } catch (err) {
+    if (!(err instanceof StatusError) || err.statusCode !== 401) throw err;
+    enrollmentPromise = null;
+    const fresh = await getServiceToken();
+    if (!fresh) throw err;
+    await rawCallReducer(fresh, reducer, args);
+    return true;
+  }
+}
+
+export async function callReducer(reducer: string, args: unknown[]): Promise<void> {
+  await callWithEnrollmentRetry(reducer, args);
 }
 
-/**
- * Like {@link callReducer} but throws when SpacetimeDB isn't configured, rather
- * than no-opping. Use for endpoints where the client treats a 200 as proof the
- * mutation actually ran (reviewer enrollment, human QA edits, deletions).
- * Fire-and-forget logging paths should keep using the best-effort variant.
- */
 export async function callReducerStrict(reducer: string, args: unknown[]): Promise<void> {
-  const token = await getServiceToken();
-  if (!token) {
+  const ran = await callWithEnrollmentRetry(reducer, args);
+  if (!ran) {
     throw new StackAssertionError(
       `SpacetimeDB is not configured. Reducer ${reducer} cannot run. ` +
       `Check STACK_SPACETIMEDB_URL and STACK_SPACETIMEDB_SERVICE_TOKEN.`
     );
   }
-  await rawCallReducer(token, reducer, args);
 }
 
 /**
@@ -130,4 +137,3 @@ export async function callSql<T = Record<string, unknown>>(sql: string): Promise
     return obj as T;
   });
 }
-
diff --git a/apps/e2e/tests/spacetimedb/helpers.ts b/apps/e2e/tests/spacetimedb/helpers.ts
@@ -158,6 +158,27 @@ function coerceBigInt(raw: unknown): bigint | undefined {
   if (typeof raw === "bigint") return raw;
   return undefined;
 }
+async function collectStackUserIdsForIdentities(
+  callerToken: string,
+  identities: ReadonlySet<string>,
+): Promise<Set<string>> {
+  const out = new Set<string>();
+  if (identities.size === 0) return out;
+  const { rows } = await sqlQuery(callerToken, "SELECT * FROM operators");
+  for (const row of rows) {
+    const stackUserIdRaw = row.stack_user_id ?? row.stackUserId;
+    if (typeof stackUserIdRaw !== "string") continue;
+    if (stackUserIdRaw === "__service__") continue;
+    const rowJson = JSON.stringify(row).toLowerCase();
+    for (const identity of identities) {
+      if (rowJson.includes(identity.toLowerCase())) {
+        out.add(stackUserIdRaw);
+        break;
+      }
+    }
+  }
+  return out;
+}
 
 /**
  * Per-test collector for anything these tests drop into SpacetimeDB so
@@ -198,11 +219,12 @@ export function createCleanupScope(): CleanupScope {
       const caller = await mintIdentity().catch(() => null);
       if (caller == null) return;
 
+      const callerStackUserId = `cleanup-${caller.identity}`;
       try {
         await callReducer(caller.token, "add_operator", [
           logToken,
           [`0x${caller.identity}`],
-          `__cleanup__-${caller.identity}`,
+          callerStackUserId,
           "Cleanup Scope",
         ]).catch(() => undefined);
 
@@ -225,11 +247,15 @@ export function createCleanupScope(): CleanupScope {
           await callReducer(caller.token, "delete_ai_query_log", [logToken, correlationId]).catch(() => undefined);
         }
 
-        for (const identity of identities) {
-          await callReducer(caller.token, "remove_operator", [logToken, [`0x${identity}`]]).catch(() => undefined);
+        if (identities.size > 0) {
+          const stackUserIdsToRemove = await collectStackUserIdsForIdentities(caller.token, identities)
+            .catch(() => new Set<string>());
+          for (const stackUserId of stackUserIdsToRemove) {
+            await callReducer(caller.token, "remove_operators_for_user", [logToken, stackUserId]).catch(() => undefined);
+          }
         }
       } finally {
-        await callReducer(caller.token, "remove_operator", [logToken, [`0x${caller.identity}`]]).catch(() => undefined);
+        await callReducer(caller.token, "remove_operators_for_user", [logToken, callerStackUserId]).catch(() => undefined);
         identities.clear();
         questions.clear();
         aiQueryCorrelationIds.clear();
diff --git a/apps/e2e/tests/spacetimedb/operators-rls.test.ts b/apps/e2e/tests/spacetimedb/operators-rls.test.ts
@@ -62,10 +62,7 @@ describe.skipIf(!canRun)("operators table RLS", () => {
     expect(rows.length).toBe(0);
   });
 
-  it("enrolling a second identity as the same reviewer sweeps the first", async ({ expect }) => {
-    // The add_operator reducer's sweep logic deletes prior rows with the same
-    // stackUserId before inserting a new identity — a reviewer switching browsers
-    // should not accumulate stale operator rows.
+  it("enrolling a second identity as the same reviewer keeps both active", async ({ expect }) => {
     const x = await mintIdentity();
     scope.trackIdentity(x.identity);
     await AiChatReviewer.createReviewer();
@@ -76,7 +73,6 @@ describe.skipIf(!canRun)("operators table RLS", () => {
     });
     expect(enrollX.status).toBe(200);
 
-    // Same reviewer (backendContext.userAuth unchanged) enrolls a second identity.
     const y = await mintIdentity();
     scope.trackIdentity(y.identity);
     const enrollY = await niceBackendFetch("/api/latest/internal/spacetimedb-enroll-reviewer", {
@@ -85,43 +81,64 @@ describe.skipIf(!canRun)("operators table RLS", () => {
       body: { identity: y.identity },
     });
     expect(enrollY.status).toBe(200);
-
-    // X should no longer be in operators — sweep removed its row.
     const asX = await sqlQuery(x.token, "SELECT * FROM operators");
-    expect(asX.rows.length).toBe(0);
-    // Y should still be the active operator.
+    expect(asX.rows.length).toBe(1);
     const asY = await sqlQuery(y.token, "SELECT * FROM operators");
     expect(asY.rows.length).toBe(1);
   });
 
   it.skipIf(!logToken)(
-    "remove_operator reducer revokes an operator's view access",
+    "remove_operators_for_user revokes every device a user has enrolled",
     async ({ expect }) => {
-      const target = await mintIdentity();
-      scope.trackIdentity(target.identity);
+      const targetA = await mintIdentity();
+      scope.trackIdentity(targetA.identity);
       await AiChatReviewer.createReviewer();
-      const enroll = await niceBackendFetch("/api/latest/internal/spacetimedb-enroll-reviewer", {
+      const enrollA = await niceBackendFetch("/api/latest/internal/spacetimedb-enroll-reviewer", {
+        method: "POST",
+        accessType: "client",
+        body: { identity: targetA.identity },
+      });
+      expect(enrollA.status).toBe(200);
+
+      const targetB = await mintIdentity();
+      scope.trackIdentity(targetB.identity);
+      const enrollB = await niceBackendFetch("/api/latest/internal/spacetimedb-enroll-reviewer", {
         method: "POST",
         accessType: "client",
-        body: { identity: target.identity },
+        body: { identity: targetB.identity },
       });
-      expect(enroll.status).toBe(200);
+      expect(enrollB.status).toBe(200);
+
+      expect((await sqlQuery(targetA.token, "SELECT * FROM operators")).rows.length).toBe(1);
+      expect((await sqlQuery(targetB.token, "SELECT * FROM operators")).rows.length).toBe(1);
 
-      // Confirm enrolled.
-      const before = await sqlQuery(target.token, "SELECT * FROM operators");
-      expect(before.rows.length).toBe(1);
+      const adminEnroll = await mintIdentity();
+      await callReducer(adminEnroll.token, "add_operator", [
+        logToken!,
+        [`0x${adminEnroll.identity}`],
+        `e2e-admin-${adminEnroll.identity}`,
+        "E2E Admin",
+      ]);
+      scope.trackIdentity(adminEnroll.identity);
+      const allOps = await sqlQuery(adminEnroll.token, "SELECT * FROM operators");
+      const targetRowJson = JSON.stringify(allOps.rows.find(r =>
+        JSON.stringify(r).toLowerCase().includes(targetA.identity.toLowerCase())
+      ) ?? {});
+      expect(targetRowJson).toContain("0x" + targetA.identity.toLowerCase().slice(0, 8));
+      const stackUserId = (allOps.rows.find(r =>
+        JSON.stringify(r).toLowerCase().includes(targetA.identity.toLowerCase())
+      ) as { stack_user_id?: string, stackUserId?: string } | undefined);
+      const sUid = stackUserId?.stack_user_id ?? stackUserId?.stackUserId;
+      expect(typeof sUid).toBe("string");
 
-      // Directly call remove_operator with the log token.
-      const caller = await mintIdentity();
-      const removed = await callReducer(caller.token, "remove_operator", [
+      const removed = await callReducer(adminEnroll.token, "remove_operators_for_user", [
         logToken!,
-        [`0x${target.identity}`],
+        sUid!,
       ]);
       expect(removed.ok).toBe(true);
 
-      // Target is no longer an operator.
-      const after = await sqlQuery(target.token, "SELECT * FROM operators");
-      expect(after.rows.length).toBe(0);
+      expect((await sqlQuery(targetA.token, "SELECT * FROM operators")).rows.length).toBe(0);
+      expect((await sqlQuery(targetB.token, "SELECT * FROM operators")).rows.length).toBe(0);
     },
   );
 });
diff --git a/apps/e2e/tests/spacetimedb/reducer-auth.test.ts b/apps/e2e/tests/spacetimedb/reducer-auth.test.ts
@@ -57,16 +57,17 @@ describe.skipIf(!canRun)("SpacetimeDB reducer auth", () => {
 
     const cases = [
       { name: "add_operator", args: [wrong, [hexId], "some-user", "Some Name"] },
-      { name: "remove_operator", args: [wrong, [hexId]] },
+      { name: "remove_operators_for_user", args: [wrong, "some-user"] },
       { name: "enroll_service", args: [wrong, "Some Service"] },
       { name: "mark_human_reviewed", args: [wrong, "corr", "reviewer"] },
       { name: "unmark_human_reviewed", args: [wrong, "corr"] },
       {
-        name: "update_human_correction",
+        name: "upsert_qa_from_call",
         args: [wrong, "corr", "q", "a", false, "reviewer"],
       },
-      { name: "add_manual_qa", args: [wrong, "q", "a", false, "reviewer"] },
-      { name: "delete_qa_entry", args: [wrong, "corr"] },
+      { name: "add_manual_qa", args: [wrong, "q", "a", false, "reviewer", opt(null)] },
+      { name: "delete_qa_entry", args: [wrong, 0n] },
+      { name: "update_qa_entry_with_publish", args: [wrong, 0n, "q", "a", false, "reviewer"] },
       {
         name: "log_mcp_call",
         args: [wrong, "corr", opt(null), "tool", "reason", "prompt", "q", "r", 0, "[]", 0n, "model", opt(null)],
diff --git a/apps/internal-tool/.env b/apps/internal-tool/.env
@@ -2,7 +2,6 @@
 NEXT_PUBLIC_STACK_API_URL=REPLACE_ME
 NEXT_PUBLIC_STACK_PROJECT_ID=REPLACE_ME
 NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY=REPLACE_ME
-STACK_SECRET_SERVER_KEY=REPLACE_ME
 NEXT_PUBLIC_STACK_DASHBOARD_URL=REPLACE_ME
 # SpacetimeDB
 NEXT_PUBLIC_SPACETIMEDB_HOST=REPLACE_ME
diff --git a/apps/internal-tool/scripts/pre-dev.mjs b/apps/internal-tool/scripts/pre-dev.mjs
@@ -29,24 +29,6 @@ if (publish.status !== 0) {
 }
 
 await provisionServiceToken();
-await runQaEntriesBackfill();
-
-async function runQaEntriesBackfill() {
-  const dbName = process.env.STACK_SPACETIMEDB_DB_NAME ?? "stack-auth-llm";
-  const logToken = process.env.STACK_MCP_LOG_TOKEN ?? "";
-  if (!logToken) {
-    console.warn("[internal-tool] STACK_MCP_LOG_TOKEN not set; skipping qa_entries backfill.");
-    return;
-  }
-  const result = spawnSync(
-    "spacetime",
-    ["call", dbName, "backfill_qa_entries", JSON.stringify(logToken)],
-    { stdio: "inherit" },
-  );
-  if (result.status !== 0) {
-    console.warn(`[internal-tool] backfill_qa_entries returned ${result.status}; ignoring (may already be migrated).`);
-  }
-}
 
 async function provisionServiceToken() {
   const portPrefix = process.env.NEXT_PUBLIC_STACK_PORT_PREFIX ?? "81";
diff --git a/apps/internal-tool/spacetimedb/src/index.ts b/apps/internal-tool/spacetimedb/src/index.ts
diff --git a/apps/internal-tool/src/app/app-client.tsx b/apps/internal-tool/src/app/app-client.tsx
diff --git a/apps/internal-tool/src/components/AddManualQa.tsx b/apps/internal-tool/src/components/AddManualQa.tsx
diff --git a/apps/internal-tool/src/hooks/useSpacetimeDB.ts b/apps/internal-tool/src/hooks/useSpacetimeDB.ts
diff --git a/apps/internal-tool/src/lib/mcp-review-api.ts b/apps/internal-tool/src/lib/mcp-review-api.ts
