@adcp/sdk 13.0.0-rc.8 → 13.0.0-rc.9

package/dist/lib/testing/storyboard/validations.mjs

@@ -18,6 +18,7 @@ import { detectShapeDriftHints } from "./shape-drift-hints.mjs";
 import { PROBE_TASK_ALLOWLIST } from "./test-kit.mjs";
 import { validateCanonicalFormatSatisfaction } from "./canonical-format-satisfaction.mjs";
 import { extractTaskAdcpError } from "./rate-limit-trip.mjs";
+import { normalizeOAuthResourceForComparison, redactOAuthUrlForOutput } from "./oauth-metadata-graph/index.mjs";
 function runValidations(validations, context) {
   return validations.map((v) => attachOnFailure(runValidation(v, context), context, v));
 }
@@ -70,6 +71,8 @@ function runValidation(validation, ctx) {
       return requireHttpResult(ctx, validation, (hr) => validateOn401RequireHeader(validation, hr));
     case "resource_equals_agent_url":
       return requireHttpResult(ctx, validation, (hr) => validateResourceEqualsAgentUrl(validation, hr, ctx.agentUrl));
+    case "oauth_metadata_graph":
+      return validateOAuthMetadataGraph(validation, ctx.oauthMetadataGraph);
     case "any_of":
       return validateAnyOf(validation, ctx.contributions);
     case "a2a_submitted_artifact":
@@ -118,11 +121,12 @@ function runValidation(validation, ctx) {
     default:
       return {
         check: validation.check,
-        passed: true,
-        not_applicable: true,
+        passed: false,
         description: validation.description,
-        note: `runner does not implement check type '${validation.check}' \u2014 graded as not_applicable to preserve forward compatibility`,
-        json_pointer: null
+        error: `runner does not implement authored check type '${validation.check}'`,
+        json_pointer: null,
+        expected: "a validation check implemented by this runner",
+        actual: validation.check
       };
   }
 }
@@ -1099,21 +1103,6 @@ function validateOn401RequireHeader(validation, hr) {
     actual: value ?? null
   };
 }
-function normalizeAgentUrl(url) {
-  try {
-    const u = new URL(url);
-    u.hash = "";
-    u.search = "";
-    u.username = "";
-    u.password = "";
-    if (u.pathname.length > 1 && u.pathname.endsWith("/")) {
-      u.pathname = u.pathname.slice(0, -1);
-    }
-    return `${u.protocol.toLowerCase()}//${u.host.toLowerCase()}${u.pathname}`;
-  } catch {
-    return url;
-  }
-}
 const AGENT_CARD_SUFFIX_RE = /\/\.well-known\/agent(?:-card)?\.json$/i;
 function canonicalizeAgentUrlForScope(url) {
   try {
@@ -1145,12 +1134,14 @@ function validateResourceEqualsAgentUrl(validation, hr, agentUrl) {
       description: validation.description,
       error: "Response body missing string `resource` field.",
       json_pointer: "/resource",
-      expected: normalizeAgentUrl(agentUrl),
+      expected: redactOAuthUrlForOutput(normalizeOAuthResourceForComparison(agentUrl)),
       actual: null
     };
   }
-  const expected = normalizeAgentUrl(agentUrl);
-  const actual = normalizeAgentUrl(resource);
+  const expected = normalizeOAuthResourceForComparison(agentUrl);
+  const actual = normalizeOAuthResourceForComparison(resource);
+  const displayExpected = redactOAuthUrlForOutput(expected);
+  const displayActual = redactOAuthUrlForOutput(actual);
   const passed = actual === expected;
   let redactedError;
   if (!passed) {
@@ -1161,7 +1152,7 @@ function validateResourceEqualsAgentUrl(validation, hr, agentUrl) {
     }
     const expectedHost = new URL(expected).host;
     const hostDiffers = actualHost !== expectedHost;
-    redactedError = `RFC 9728 \`resource\` does not equal the URL clients call (${expected}). ` + (hostDiffers ? `Advertised host differs from the agent host \u2014 the most common cause is copying your authorization server origin into \`resource\`. ` : `Advertised path differs from the agent path. `) + `Fix: set \`resource\` equal to the full agent URL in your protected-resource metadata document.`;
+    redactedError = `RFC 9728 \`resource\` does not equal the URL clients call (${displayExpected}). ` + (hostDiffers ? `Advertised host differs from the agent host \u2014 the most common cause is copying your authorization server origin into \`resource\`. ` : `Advertised path differs from the agent path. `) + `Fix: set \`resource\` equal to the full agent URL in your protected-resource metadata document.`;
   }
   if (passed) {
     return {
@@ -1177,10 +1168,59 @@ function validateResourceEqualsAgentUrl(validation, hr, agentUrl) {
     description: validation.description,
     error: redactedError,
     json_pointer: "/resource",
+    expected: displayExpected,
+    actual: displayActual
+  };
+}
+function validateOAuthMetadataGraph(validation, grade) {
+  const expected = {
+    profile: "adcp/oauth-metadata-graph/v1",
+    require_authorization_servers: true,
+    follow_all_authorization_servers: true,
+    probe_advertised_endpoints: true
+  };
+  if (!grade) {
+    return {
+      check: validation.check,
+      passed: false,
+      description: validation.description,
+      error: "oauth_metadata_graph was not prefetched by the storyboard runner",
+      json_pointer: null,
+      expected,
+      actual: null
+    };
+  }
+  if (grade.success) {
+    return {
+      check: validation.check,
+      passed: true,
+      description: validation.description,
+      json_pointer: null,
+      expected,
+      observations: grade.observations
+    };
+  }
+  const primary = grade.findings[0];
+  return {
+    check: validation.check,
+    passed: false,
+    description: validation.description,
+    error: `${grade.error_code}: ${grade.error}`,
+    json_pointer: primary?.field ? findingFieldToJsonPointer(primary.field) : null,
     expected,
-    actual
+    actual: {
+      code: grade.error_code,
+      ...primary?.url && { url: primary.url },
+      ...primary?.field && { field: primary.field },
+      ...primary?.message && { detail: primary.message }
+    },
+    observations: grade.observations
   };
 }
+function findingFieldToJsonPointer(field) {
+  const segments = field.replace(/\[(\d+)\]/g, ".$1").split(".");
+  return `/${segments.map((segment) => segment.replace(/~/g, "~0").replace(/\//g, "~1")).join("/")}`;
+}
 function validateAnyOf(validation, contributions) {
   const flags = Array.isArray(validation.allowed_values) ? validation.allowed_values.map(String) : [];
   const passed = flags.some((f) => contributions.has(f));