@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/auth-broker.test.js

@@ -1,541 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const pkce_js_1 = require("../auth-broker/pkce.js");
-const jwt_js_1 = require("../auth-broker/jwt.js");
-const server_js_1 = require("../auth-broker/server.js");
-const types_js_1 = require("../auth/types.js");
-function testConfig(port) {
-    return {
-        port,
-        publicBaseUrl: `http://127.0.0.1:${port}`,
-        jwtSecret: 'test-jwt-secret',
-        accessTokenTtlSec: 3600,
-        refreshTokenTtlSec: 86400,
-        allowedEmailDomains: ['agenthippo.ai', 'example.com'],
-        devMode: true,
-        rateLimitPerMin: 0,
-        logPii: true,
-        cookieName: 'ah_token',
-        cookieDomain: '.agenthippo.ai',
-        idpBaseUrl: 'http://127.0.0.1:0',
-        proxySecret: '',
-        trustProxyHeadersUnverified: false,
-        teamConfigured: true,
-        team: {
-            id: 'team_test',
-            name: 'Test Team',
-            storeRepo: 'acme/agent-store',
-            storeIndexUrl: 'https://acme.github.io/agent-store',
-            githubOrg: 'acme',
-            gatewayUrl: 'http://127.0.0.1:3456/v1',
-        },
-    };
-}
-async function postForm(url, fields) {
-    const body = new URLSearchParams(fields);
-    return fetch(url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body,
-    });
-}
-suite('AuthBroker', () => {
-    test('PKCE login issues tokens and bootstrap payload', async () => {
-        const config = testConfig(0);
-        const broker = (0, server_js_1.createAuthBrokerServer)(config);
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        broker.baseUrl = baseUrl;
-        try {
-            const verifier = (0, pkce_js_1.generateCodeVerifier)();
-            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
-            const redirectUri = 'agenthippo://auth/callback';
-            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    email: 'dev@agenthippo.ai',
-                    client_id: types_js_1.AUTH_CLIENT_ID,
-                    redirect_uri: redirectUri,
-                    code_challenge: challenge,
-                }),
-            });
-            assert.strictEqual(devRes.status, 200);
-            const devJson = await devRes.json();
-            assert.ok(devJson.code);
-            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
-                grant_type: 'authorization_code',
-                client_id: types_js_1.AUTH_CLIENT_ID,
-                code: devJson.code,
-                redirect_uri: redirectUri,
-                code_verifier: verifier,
-            });
-            assert.strictEqual(tokenRes.status, 200);
-            const tokens = await tokenRes.json();
-            assert.ok(tokens.access_token);
-            assert.ok(tokens.refresh_token);
-            const bootstrapRes = await fetch(`${baseUrl}/api/ide/bootstrap`, {
-                headers: { Authorization: `Bearer ${tokens.access_token}` },
-            });
-            assert.strictEqual(bootstrapRes.status, 200);
-            const bootstrap = await bootstrapRes.json();
-            assert.strictEqual(bootstrap.store.repo, 'acme/agent-store');
-            assert.strictEqual(bootstrap.routing.inferenceGatewayUrl, 'http://127.0.0.1:3456/v1');
-            // The bootstrap carries no routing credential — the account JWT is the credential.
-            assert.strictEqual(bootstrap.routing.litellmApiKey, undefined);
-            assert.strictEqual(bootstrap.team.id, 'team_test');
-            const refreshRes = await postForm(`${baseUrl}/oauth/token`, {
-                grant_type: 'refresh_token',
-                client_id: types_js_1.AUTH_CLIENT_ID,
-                refresh_token: tokens.refresh_token,
-            });
-            assert.strictEqual(refreshRes.status, 200);
-            const refreshed = await refreshRes.json();
-            assert.ok(refreshed.access_token);
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('rejects disallowed email domains', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const res = await fetch(`${baseUrl}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    email: 'evil@bad-domain.test',
-                    client_id: types_js_1.AUTH_CLIENT_ID,
-                    redirect_uri: 'agenthippo://auth/callback',
-                    code_challenge: (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)()),
-                }),
-            });
-            assert.strictEqual(res.status, 403);
-            const body = await res.json();
-            assert.strictEqual(body.error, 'forbidden');
-            assert.ok(body.error_description?.includes('domain'));
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('bootstrap refresh endpoint is gone — routing carries no credential to re-issue', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const verifier = (0, pkce_js_1.generateCodeVerifier)();
-            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
-            const redirectUri = 'agenthippo://auth/callback';
-            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    email: 'dev@agenthippo.ai',
-                    client_id: types_js_1.AUTH_CLIENT_ID,
-                    redirect_uri: redirectUri,
-                    code_challenge: challenge,
-                }),
-            });
-            const devJson = await devRes.json();
-            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
-                grant_type: 'authorization_code',
-                client_id: types_js_1.AUTH_CLIENT_ID,
-                code: devJson.code,
-                redirect_uri: redirectUri,
-                code_verifier: verifier,
-            });
-            const tokens = await tokenRes.json();
-            const refreshRes = await fetch(`${baseUrl}/api/ide/bootstrap/refresh`, {
-                method: 'POST',
-                headers: { Authorization: `Bearer ${tokens.access_token}` },
-            });
-            assert.strictEqual(refreshRes.status, 404);
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('solo deployment omits team in bootstrap and team_id in JWT', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)({
-            ...testConfig(0),
-            teamConfigured: false,
-        });
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const verifier = (0, pkce_js_1.generateCodeVerifier)();
-            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
-            const redirectUri = 'agenthippo://auth/callback';
-            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    email: 'solo@agenthippo.ai',
-                    client_id: types_js_1.AUTH_CLIENT_ID,
-                    redirect_uri: redirectUri,
-                    code_challenge: challenge,
-                }),
-            });
-            const devJson = await devRes.json();
-            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
-                grant_type: 'authorization_code',
-                client_id: types_js_1.AUTH_CLIENT_ID,
-                code: devJson.code,
-                redirect_uri: redirectUri,
-                code_verifier: verifier,
-            });
-            assert.strictEqual(tokenRes.status, 200);
-            const tokens = await tokenRes.json();
-            const payload = (0, jwt_js_1.verifyJwt)(tokens.access_token, 'test-jwt-secret');
-            assert.ok(payload);
-            assert.strictEqual(payload.team_id, undefined);
-            const bootstrapRes = await fetch(`${baseUrl}/api/ide/bootstrap`, {
-                headers: { Authorization: `Bearer ${tokens.access_token}` },
-            });
-            assert.strictEqual(bootstrapRes.status, 200);
-            const bootstrap = await bootstrapRes.json();
-            assert.strictEqual(bootstrap.team, undefined);
-            assert.deepStrictEqual(bootstrap.policy.teamManagedSettings, []);
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('persists users across broker restarts', async () => {
-        const fs = await import('fs');
-        const os = await import('os');
-        const path = await import('path');
-        const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'auth-broker-test-'));
-        const persistPath = path.join(dataDir, 'auth-store.json');
-        const config = { ...testConfig(0), dataDir };
-        const broker1 = (0, server_js_1.createAuthBrokerServer)(config);
-        await new Promise((resolve) => broker1.server.listen(0, '127.0.0.1', resolve));
-        const address = broker1.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const verifier = (0, pkce_js_1.generateCodeVerifier)();
-            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
-            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    email: 'persist@agenthippo.ai',
-                    client_id: types_js_1.AUTH_CLIENT_ID,
-                    redirect_uri: 'agenthippo://auth/callback',
-                    code_challenge: challenge,
-                }),
-            });
-            assert.strictEqual(devRes.status, 200);
-        }
-        finally {
-            await broker1.close();
-        }
-        assert.ok(fs.existsSync(persistPath));
-        const broker2 = (0, server_js_1.createAuthBrokerServer)(config);
-        await new Promise((resolve) => broker2.server.listen(0, '127.0.0.1', resolve));
-        const address2 = broker2.server.address();
-        if (!address2 || typeof address2 === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl2 = `http://127.0.0.1:${address2.port}`;
-        try {
-            const meRes = await fetch(`${baseUrl2}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    email: 'persist@agenthippo.ai',
-                    client_id: types_js_1.AUTH_CLIENT_ID,
-                    redirect_uri: 'agenthippo://auth/callback',
-                    code_challenge: (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)()),
-                }),
-            });
-            assert.strictEqual(meRes.status, 200);
-        }
-        finally {
-            await broker2.close();
-            fs.rmSync(dataDir, { recursive: true, force: true });
-        }
-    });
-    test('introspect requires a bearer token', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const verifier = (0, pkce_js_1.generateCodeVerifier)();
-            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
-            const redirectUri = 'agenthippo://auth/callback';
-            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    email: 'dev@agenthippo.ai',
-                    client_id: types_js_1.AUTH_CLIENT_ID,
-                    redirect_uri: redirectUri,
-                    code_challenge: challenge,
-                }),
-            });
-            const devJson = await devRes.json();
-            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
-                grant_type: 'authorization_code',
-                client_id: types_js_1.AUTH_CLIENT_ID,
-                code: devJson.code,
-                redirect_uri: redirectUri,
-                code_verifier: verifier,
-            });
-            const tokens = await tokenRes.json();
-            // Anonymous introspect must be rejected.
-            const anonRes = await postForm(`${baseUrl}/oauth/introspect`, { token: tokens.access_token });
-            assert.strictEqual(anonRes.status, 401);
-            // Authenticated introspect returns active claims.
-            const authedRes = await fetch(`${baseUrl}/oauth/introspect`, {
-                method: 'POST',
-                headers: {
-                    Authorization: `Bearer ${tokens.access_token}`,
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                body: new URLSearchParams({ token: tokens.access_token }),
-            });
-            assert.strictEqual(authedRes.status, 200);
-            const introspected = await authedRes.json();
-            assert.strictEqual(introspected.active, true);
-            assert.strictEqual(introspected.email, 'dev@agenthippo.ai');
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('per-IP rate limit returns 429 on the token endpoint past the cap', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)({ ...testConfig(0), rateLimitPerMin: 2 });
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            // Invalid grant bodies still consume the limiter (the gate runs before parsing).
-            const first = await postForm(`${baseUrl}/oauth/token`, { grant_type: 'authorization_code' });
-            const second = await postForm(`${baseUrl}/oauth/token`, { grant_type: 'authorization_code' });
-            const third = await postForm(`${baseUrl}/oauth/token`, { grant_type: 'authorization_code' });
-            assert.notStrictEqual(first.status, 429);
-            assert.notStrictEqual(second.status, 429);
-            assert.strictEqual(third.status, 429);
-            assert.ok(third.headers.get('retry-after'));
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('federated token verifies at /api/ide/me without a local user record (A′ trust)', async () => {
-        // Simulate an IdP-issued federated token: sign with the shared secret, never create the
-        // user in THIS broker's store (fresh broker, empty store — like an edge service). The
-        // verified JWT claims must be trusted directly.
-        const config = testConfig(0);
-        const broker = (0, server_js_1.createAuthBrokerServer)(config);
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const token = (0, jwt_js_1.signJwt)({ sub: 'user_federated_123', email: 'trung@agenthippo.ai', name: 'Trung', team_id: 'team_test' }, config.jwtSecret, 3600);
-            const meRes = await fetch(`${baseUrl}/api/ide/me`, {
-                headers: { Authorization: `Bearer ${token}` },
-            });
-            assert.strictEqual(meRes.status, 200);
-            assert.strictEqual(meRes.headers.get('X-Agent-User'), 'trung@agenthippo.ai');
-            const body = await meRes.json();
-            assert.strictEqual(body.user.id, 'user_federated_123');
-            assert.strictEqual(body.user.displayName, 'Trung');
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('federated cookie verifies at /api/ide/me (browser flow, no Bearer header)', async () => {
-        const config = testConfig(0);
-        const broker = (0, server_js_1.createAuthBrokerServer)(config);
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            // Mint a JWT via the dev login + token flow, then present it as a Cookie (not Bearer).
-            const verifier = (0, pkce_js_1.generateCodeVerifier)();
-            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
-            const redirectUri = 'agenthippo://auth/callback';
-            const devRes = await fetch(`${baseUrl}/oauth/dev/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ email: 'dev@agenthippo.ai', client_id: types_js_1.AUTH_CLIENT_ID, redirect_uri: redirectUri, code_challenge: challenge }),
-            });
-            const devJson = await devRes.json();
-            const tokenRes = await postForm(`${baseUrl}/oauth/token`, {
-                grant_type: 'authorization_code', client_id: types_js_1.AUTH_CLIENT_ID,
-                code: devJson.code, redirect_uri: redirectUri, code_verifier: verifier,
-            });
-            const tokens = await tokenRes.json();
-            const meRes = await fetch(`${baseUrl}/api/ide/me`, {
-                headers: { Cookie: `${config.cookieName}=${tokens.access_token}` },
-            });
-            assert.strictEqual(meRes.status, 200);
-            assert.strictEqual(meRes.headers.get('X-Agent-User'), 'dev@agenthippo.ai');
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('browser-login stamps the shared cookie and redirects to a same-domain return_to', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const res = await fetch(`${baseUrl}/oauth/browser-login?return_to=https://cs.agenthippo.ai/app`, {
-                redirect: 'manual',
-                headers: { 'X-Auth-Request-Email': 'dev@agenthippo.ai' },
-            });
-            assert.strictEqual(res.status, 302);
-            const setCookie = res.headers.get('set-cookie') || '';
-            assert.ok(setCookie.includes('ah_token='), 'Set-Cookie has ah_token');
-            assert.ok(setCookie.includes('Domain=.agenthippo.ai'), 'cookie scoped to parent domain');
-            assert.ok(setCookie.toLowerCase().includes('httponly'), 'cookie is HttpOnly');
-            assert.strictEqual(res.headers.get('location'), 'https://cs.agenthippo.ai/app');
-            // A return_to on an unrelated domain must NOT be honored — fall back to publicBaseUrl.
-            const bad = await fetch(`${baseUrl}/oauth/browser-login?return_to=https://evil.example.com/`, {
-                redirect: 'manual', headers: { 'X-Auth-Request-Email': 'dev@agenthippo.ai' },
-            });
-            assert.strictEqual(bad.status, 302);
-            assert.notStrictEqual(bad.headers.get('location'), 'https://evil.example.com/');
-            // No X-Auth-Request-Email (not behind oauth2-proxy) → 401.
-            const noAuth = await fetch(`${baseUrl}/oauth/browser-login`, { redirect: 'manual' });
-            assert.strictEqual(noAuth.status, 401);
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('authorize rejects a redirect_uri outside the loopback/IDE-callback allow-list', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)());
-            // An attacker-controlled destination — must never receive an auth code (open-redirect /
-            // code-theft guard). Real clients only ever send the loopback or IDE-scheme callback.
-            const url = `${baseUrl}/oauth/authorize?client_id=${types_js_1.AUTH_CLIENT_ID}`
-                + `&redirect_uri=${encodeURIComponent('https://attacker.example/collect')}`
-                + `&code_challenge=${challenge}&code_challenge_method=S256&state=x&login_hint=dev@agenthippo.ai`;
-            const res = await fetch(url, { redirect: 'manual' });
-            assert.strictEqual(res.status, 400);
-            const body = await res.json();
-            assert.strictEqual(body.error, 'invalid_request');
-        }
-        finally {
-            await broker.close();
-        }
-    });
-    test('authorize accepts the loopback and IDE-scheme redirect_uri shapes real clients send', async () => {
-        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
-        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
-        const address = broker.server.address();
-        if (!address || typeof address === 'string') {
-            throw new Error('bad listen address');
-        }
-        const baseUrl = `http://127.0.0.1:${address.port}`;
-        try {
-            const redirectUris = [
-                'http://127.0.0.1:54123/callback', // CLI/IDE loopback callback (any OS-assigned port)
-                'vscode://agenthippo.agenthippo/auth/callback', // IDE URI-scheme callback
-            ];
-            for (const redirectUri of redirectUris) {
-                const challenge = (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)());
-                const url = `${baseUrl}/oauth/authorize?client_id=${types_js_1.AUTH_CLIENT_ID}`
-                    + `&redirect_uri=${encodeURIComponent(redirectUri)}`
-                    + `&code_challenge=${challenge}&code_challenge_method=S256&state=x&login_hint=dev@agenthippo.ai`;
-                const res = await fetch(url, { redirect: 'manual' });
-                assert.strictEqual(res.status, 302, `expected redirect for ${redirectUri}`);
-                const location = res.headers.get('location') || '';
-                assert.ok(location.startsWith(redirectUri), `location "${location}" should start with "${redirectUri}"`);
-                assert.ok(new URL(location).searchParams.get('code'), 'redirect carries an auth code');
-            }
-        }
-        finally {
-            await broker.close();
-        }
-    });
-});

package/out/test/auth-callback.test.js

@@ -1,62 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const callbackUriParse_js_1 = require("../auth/callbackUriParse.js");
-const types_js_1 = require("../auth/types.js");
-suite('Auth callback URI', () => {
-    test('parseAuthCallbackFromText accepts extension-scoped redirect', () => {
-        const state = 'test-state-123';
-        const url = `cursor://${types_js_1.AUTH_EXTENSION_AUTHORITY}${types_js_1.AUTH_CALLBACK_PATH}?code=abc&state=${state}`;
-        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromText)(url, state), 'abc');
-    });
-    test('parseAuthCallbackFromText rejects wrong state', () => {
-        const url = `cursor://${types_js_1.AUTH_EXTENSION_AUTHORITY}${types_js_1.AUTH_CALLBACK_PATH}?code=abc&state=other`;
-        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromText)(url, 'expected'), undefined);
-    });
-    test('legacy auth/callback authority is not accepted', () => {
-        const url = 'cursor://auth/callback?code=abc&state=s';
-        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromText)(url, 's'), undefined);
-    });
-    test('parseAuthCallbackFromLoopbackUrl accepts localhost redirect', () => {
-        const state = 'loop-state';
-        const url = `http://127.0.0.1:8765/callback?code=loopcode&state=${state}`;
-        assert.strictEqual((0, callbackUriParse_js_1.parseAuthCallbackFromLoopbackUrl)(url, state), 'loopcode');
-    });
-});