@clinebot/core 0.0.34 → 0.0.36

package/src/auth/oca.test.ts

@@ -1,340 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { getValidOcaCredentials } from "./oca";
-import type { OAuthCredentials } from "./types";
-
-function toBase64Url(value: string): string {
-	return Buffer.from(value, "utf8").toString("base64url");
-}
-
-function createJwt(payload: Record<string, unknown>): string {
-	return `${toBase64Url(JSON.stringify({ alg: "none", typ: "JWT" }))}.${toBase64Url(JSON.stringify(payload))}.sig`;
-}
-
-function createCredentials(
-	overrides: Partial<OAuthCredentials> = {},
-): OAuthCredentials {
-	return {
-		access: "access-old",
-		refresh: "refresh-old",
-		expires: 0,
-		accountId: "acct-old",
-		email: "old@example.com",
-		metadata: { provider: "oca", mode: "internal" },
-		...overrides,
-	};
-}
-
-describe("auth/oca getValidOcaCredentials", () => {
-	afterEach(() => {
-		vi.unstubAllGlobals();
-		vi.restoreAllMocks();
-	});
-
-	it("returns current credentials when token is still fresh", async () => {
-		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(10_000);
-		const current = createCredentials({ expires: 400_000 });
-		const fetchMock = vi.fn();
-		vi.stubGlobal("fetch", fetchMock);
-
-		const result = await getValidOcaCredentials(current);
-		expect(result).toBe(current);
-		expect(fetchMock).not.toHaveBeenCalled();
-		nowSpy.mockRestore();
-	});
-
-	it("refreshes an expired token after discovery", async () => {
-		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(100_000);
-		const idToken = createJwt({
-			sub: "acct-new",
-			email: "new@example.com",
-			exp: 2_000_000_000,
-		});
-
-		const fetchMock = vi
-			.fn()
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							token_endpoint: "https://idcs.example.com/oauth2/v1/token",
-						}),
-						{
-							status: 200,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			)
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							access_token: createJwt({
-								sub: "acct-new",
-								email: "new@example.com",
-								exp: 2_000_000_000,
-							}),
-							refresh_token: "refresh-new",
-							id_token: idToken,
-						}),
-						{ status: 200, headers: { "Content-Type": "application/json" } },
-					),
-			);
-
-		vi.stubGlobal("fetch", fetchMock);
-
-		const result = await getValidOcaCredentials(
-			createCredentials({ expires: 101_000 }),
-			undefined,
-			{
-				config: {
-					internal: {
-						clientId: "client-1",
-						idcsUrl: "https://idcs.example.com",
-						scopes: "openid offline_access",
-						baseUrl: "https://oca.example.com",
-					},
-				},
-			},
-		);
-
-		expect(result).toMatchObject({
-			access: expect.any(String),
-			refresh: "refresh-new",
-			accountId: "acct-new",
-			email: "new@example.com",
-			metadata: {
-				provider: "oca",
-				mode: "internal",
-			},
-		});
-		expect(fetchMock).toHaveBeenCalledTimes(2);
-		nowSpy.mockRestore();
-	});
-
-	it("returns null when refresh fails with invalid_grant", async () => {
-		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(100_000);
-		const fetchMock = vi
-			.fn()
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							token_endpoint: "https://idcs.invalid/oauth2/v1/token",
-						}),
-						{
-							status: 200,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			)
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							error: "invalid_grant",
-							error_description: "expired refresh token",
-						}),
-						{
-							status: 400,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			);
-		vi.stubGlobal("fetch", fetchMock);
-
-		const result = await getValidOcaCredentials(
-			createCredentials({ expires: 101_000 }),
-			undefined,
-			{
-				config: {
-					internal: {
-						clientId: "client-2",
-						idcsUrl: "https://idcs.invalid",
-						scopes: "openid offline_access",
-						baseUrl: "https://oca.example.com",
-					},
-				},
-			},
-		);
-		expect(result).toBeNull();
-		nowSpy.mockRestore();
-	});
-
-	it("keeps current credentials on transient refresh failures when access token is still usable", async () => {
-		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(100_000);
-		const fetchMock = vi
-			.fn()
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							token_endpoint: "https://idcs.retry/oauth2/v1/token",
-						}),
-						{
-							status: 200,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			)
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							error: "server_error",
-							error_description: "temporary issue",
-						}),
-						{
-							status: 500,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			);
-		vi.stubGlobal("fetch", fetchMock);
-
-		const current = createCredentials({ expires: 150_000 });
-		const result = await getValidOcaCredentials(
-			current,
-			{
-				refreshBufferMs: 60_000,
-				retryableTokenGraceMs: 30_000,
-			},
-			{
-				config: {
-					internal: {
-						clientId: "client-3",
-						idcsUrl: "https://idcs.retry",
-						scopes: "openid offline_access",
-						baseUrl: "https://oca.example.com",
-					},
-				},
-			},
-		);
-		expect(result).toBe(current);
-		nowSpy.mockRestore();
-	});
-
-	it("re-discovers token endpoint shortly after discovery fallback errors", async () => {
-		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(100_000);
-		const fetchMock = vi
-			.fn()
-			// first refresh: discovery fails and fallback endpoint is used
-			.mockImplementationOnce(async () => new Response(null, { status: 503 }))
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							error: "server_error",
-							error_description: "temporary issue",
-						}),
-						{
-							status: 500,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			)
-			// second refresh within fallback TTL: discovery should still be cached
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							error: "server_error",
-							error_description: "temporary issue",
-						}),
-						{
-							status: 500,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			)
-			// third refresh after fallback TTL: discovery should be retried
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							token_endpoint: "https://idcs.fallback/oauth2/v2/token",
-						}),
-						{
-							status: 200,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			)
-			.mockImplementationOnce(
-				async () =>
-					new Response(
-						JSON.stringify({
-							error: "server_error",
-							error_description: "temporary issue",
-						}),
-						{
-							status: 500,
-							headers: { "Content-Type": "application/json" },
-						},
-					),
-			);
-		vi.stubGlobal("fetch", fetchMock);
-
-		const current = createCredentials({ expires: 10_000_000 });
-		const providerOptions = {
-			config: {
-				internal: {
-					clientId: "client-fallback-ttl",
-					idcsUrl: "https://idcs.fallback",
-					scopes: "openid offline_access",
-					baseUrl: "https://oca.example.com",
-				},
-			},
-		};
-
-		const first = await getValidOcaCredentials(
-			current,
-			{ forceRefresh: true },
-			providerOptions,
-		);
-		expect(first).toBe(current);
-
-		nowSpy.mockReturnValue(200_000);
-		const second = await getValidOcaCredentials(
-			current,
-			{ forceRefresh: true },
-			providerOptions,
-		);
-		expect(second).toBe(current);
-
-		nowSpy.mockReturnValue(500_001);
-		const third = await getValidOcaCredentials(
-			current,
-			{ forceRefresh: true },
-			providerOptions,
-		);
-		expect(third).toBe(current);
-
-		expect(fetchMock).toHaveBeenCalledTimes(5);
-		expect(fetchMock).toHaveBeenNthCalledWith(
-			1,
-			"https://idcs.fallback/.well-known/openid-configuration",
-			expect.objectContaining({ method: "GET" }),
-		);
-		expect(fetchMock).toHaveBeenNthCalledWith(
-			2,
-			"https://idcs.fallback/oauth2/v1/token",
-			expect.objectContaining({ method: "POST" }),
-		);
-		expect(fetchMock).toHaveBeenNthCalledWith(
-			3,
-			"https://idcs.fallback/oauth2/v1/token",
-			expect.objectContaining({ method: "POST" }),
-		);
-		expect(fetchMock).toHaveBeenNthCalledWith(
-			4,
-			"https://idcs.fallback/.well-known/openid-configuration",
-			expect.objectContaining({ method: "GET" }),
-		);
-		expect(fetchMock).toHaveBeenNthCalledWith(
-			5,
-			"https://idcs.fallback/oauth2/v2/token",
-			expect.objectContaining({ method: "POST" }),
-		);
-		nowSpy.mockRestore();
-	});
-});

package/src/auth/server.test.ts

@@ -1,287 +0,0 @@
-import http from "node:http";
-import net from "node:net";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { startLocalOAuthServer } from "./server";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-/** Bind to port 0 to let the OS pick a free port, then release it. */
-function getFreePort(): Promise<number> {
-	return new Promise((resolve, reject) => {
-		const srv = net.createServer();
-		srv.listen(0, "127.0.0.1", () => {
-			const addr = srv.address() as net.AddressInfo;
-			srv.close(() => resolve(addr.port));
-		});
-		srv.on("error", reject);
-	});
-}
-
-/** Occupy a port so the OAuth server cannot bind to it. */
-function occupyPort(port: number): Promise<http.Server> {
-	return new Promise((resolve, reject) => {
-		const srv = http.createServer();
-		srv.listen(port, "127.0.0.1", () => resolve(srv));
-		srv.on("error", reject);
-	});
-}
-
-/** Close an http.Server, resolving when the socket is gone. */
-function closeServer(srv: http.Server): Promise<void> {
-	return new Promise((resolve, reject) =>
-		srv.close((err) => (err ? reject(err) : resolve())),
-	);
-}
-
-/** Make a GET request and return status + body. */
-function get(url: string): Promise<{ status: number; body: string }> {
-	return new Promise((resolve, reject) => {
-		http
-			.get(url, (res) => {
-				let body = "";
-				res.on("data", (chunk: Buffer) => {
-					body += chunk.toString();
-				});
-				res.on("end", () => resolve({ status: res.statusCode ?? 0, body }));
-			})
-			.on("error", reject);
-	});
-}
-
-/** Flush microtasks + a short macro-task delay for fire-and-forget promises. */
-function flushAsync(): Promise<void> {
-	return new Promise((resolve) => setTimeout(resolve, 20));
-}
-
-// ---------------------------------------------------------------------------
-// onListening
-// ---------------------------------------------------------------------------
-
-describe("auth/server startLocalOAuthServer — onListening", () => {
-	it("is called with host, port, and callbackUrl when the server binds", async () => {
-		const port = await getFreePort();
-		const onListening = vi.fn();
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onListening,
-		});
-
-		expect(onListening).toHaveBeenCalledOnce();
-		expect(onListening).toHaveBeenCalledWith({
-			host: "127.0.0.1",
-			port,
-			callbackUrl: `http://127.0.0.1:${port}/callback`,
-		});
-
-		server.close();
-	});
-
-	it("is not called when no port can be bound", async () => {
-		const port = await getFreePort();
-		const blocker = await occupyPort(port);
-		const onListening = vi.fn();
-
-		await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onListening,
-		});
-
-		expect(onListening).not.toHaveBeenCalled();
-
-		await closeServer(blocker);
-	});
-
-	it("fires for the first available port and skips occupied ones", async () => {
-		const [port1, port2] = await Promise.all([getFreePort(), getFreePort()]);
-		const blocker = await occupyPort(port1);
-		const onListening = vi.fn();
-
-		const server = await startLocalOAuthServer({
-			ports: [port1, port2],
-			callbackPath: "/cb",
-			onListening,
-		});
-
-		expect(onListening).toHaveBeenCalledOnce();
-		expect(onListening).toHaveBeenCalledWith(
-			expect.objectContaining({ port: port2 }),
-		);
-
-		server.close();
-		await closeServer(blocker);
-	});
-
-	it("swallows errors thrown by the onListening callback", async () => {
-		const port = await getFreePort();
-		const onListening = vi
-			.fn()
-			.mockReturnValue(Promise.reject(new Error("listening boom")));
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onListening,
-		});
-
-		await flushAsync();
-		expect(onListening).toHaveBeenCalledOnce();
-
-		server.close();
-	});
-});
-
-// ---------------------------------------------------------------------------
-// onClose
-// ---------------------------------------------------------------------------
-
-describe("auth/server startLocalOAuthServer — onClose", () => {
-	it("is called with host and port when close() is invoked", async () => {
-		const port = await getFreePort();
-		const onClose = vi.fn();
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onClose,
-		});
-
-		server.close();
-
-		expect(onClose).toHaveBeenCalledOnce();
-		expect(onClose).toHaveBeenCalledWith({ host: "127.0.0.1", port });
-	});
-
-	it("is called with host and port when cancelWait() is invoked", async () => {
-		const port = await getFreePort();
-		const onClose = vi.fn();
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onClose,
-		});
-
-		server.cancelWait();
-
-		expect(onClose).toHaveBeenCalledOnce();
-		expect(onClose).toHaveBeenCalledWith({ host: "127.0.0.1", port });
-	});
-
-	it("is called after a successful OAuth callback request", async () => {
-		const port = await getFreePort();
-		const onClose = vi.fn();
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onClose,
-		});
-
-		const waitPromise = server.waitForCallback();
-		const { status } = await get(
-			`http://127.0.0.1:${port}/callback?code=tok123`,
-		);
-		expect(status).toBe(200);
-
-		await waitPromise;
-
-		expect(onClose).toHaveBeenCalledOnce();
-		expect(onClose).toHaveBeenCalledWith({ host: "127.0.0.1", port });
-	});
-
-	it("is not called when no port was bound", async () => {
-		const port = await getFreePort();
-		const blocker = await occupyPort(port);
-		const onClose = vi.fn();
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onClose,
-		});
-
-		server.close();
-		expect(onClose).not.toHaveBeenCalled();
-
-		await closeServer(blocker);
-	});
-
-	it("swallows errors thrown by the onClose callback", async () => {
-		const port = await getFreePort();
-		const onClose = vi
-			.fn()
-			.mockReturnValue(Promise.reject(new Error("teardown failed")));
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/callback",
-			onClose,
-		});
-
-		server.close();
-		await flushAsync();
-
-		expect(onClose).toHaveBeenCalledOnce();
-	});
-});
-
-// ---------------------------------------------------------------------------
-// onListening + onClose ordering
-// ---------------------------------------------------------------------------
-
-describe("auth/server startLocalOAuthServer — onListening + onClose together", () => {
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("fires onListening on bind then onClose after a successful callback", async () => {
-		const port = await getFreePort();
-		const order: string[] = [];
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/cb",
-			onListening: vi.fn(() => {
-				order.push("listening");
-			}),
-			onClose: vi.fn(() => {
-				order.push("close");
-			}),
-		});
-
-		expect(order).toEqual(["listening"]);
-
-		const waitPromise = server.waitForCallback();
-		await get(`http://127.0.0.1:${port}/cb?code=mycode`);
-		const payload = await waitPromise;
-
-		expect(payload?.code).toBe("mycode");
-		expect(order).toEqual(["listening", "close"]);
-	});
-
-	it("fires onListening on bind then onClose after cancelWait()", async () => {
-		const port = await getFreePort();
-		const order: string[] = [];
-
-		const server = await startLocalOAuthServer({
-			ports: [port],
-			callbackPath: "/cb",
-			onListening: vi.fn(() => {
-				order.push("listening");
-			}),
-			onClose: vi.fn(() => {
-				order.push("close");
-			}),
-		});
-
-		expect(order).toEqual(["listening"]);
-
-		server.cancelWait();
-		expect(order).toEqual(["listening", "close"]);
-	});
-});