@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/src/foundation-shared/__tests__/config-helpers.test.ts

@@ -1,89 +0,0 @@
-// config-helpers Unit-Tests (Phase 1, test-luecken-integration).
-//
-// Pinnt das Verhalten der von ai-/mail-/file-foundation geteilten
-// Narrowing-Helfer — inkl. der non-obvious Grenzfälle: requireDefined
-// narrowt NUR `undefined` (nicht falsy), und requireNonEmpty hat zwei
-// getrennte Fehlerpfade (undefined vs leer), die über die Error-Message
-// unterschieden werden.
-
-import { describe, expect, test } from "bun:test";
-import { InternalError, UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
-import { requireDefined, requireNonEmpty } from "../config-helpers";
-
-describe("requireDefined", () => {
-  test("undefined → wirft mit featureName + label + Misconfig-Hinweis", () => {
-    expect(() => requireDefined(undefined, "ai-foundation", "apiKey")).toThrow(
-      "ai-foundation: 'apiKey' config key resolved to undefined — registry misconfigured (no value + no default)",
-    );
-  });
-
-  test("undefined → wirft InternalError (500): Dev-Bug, kein Tenant-Gap", () => {
-    expect(() => requireDefined(undefined, "ai-foundation", "apiKey")).toThrow(InternalError);
-  });
-
-  test("defined Wert → unverändert zurück", () => {
-    expect(requireDefined("sk-123", "ai-foundation", "apiKey")).toBe("sk-123");
-  });
-
-  test("falsy-aber-defined Werte passieren (Check ist === undefined, nicht falsy)", () => {
-    // Würde hier ein falsy-Check stehen, bräche ein numerischer Key mit Wert 0
-    // oder ein leerer-String-Default. requireNonEmpty ist der strengere Helfer.
-    expect(requireDefined(0, "f", "n")).toBe(0);
-    expect(requireDefined("", "f", "n")).toBe("");
-    expect(requireDefined(false, "f", "n")).toBe(false);
-    expect(requireDefined(null, "f", "n")).toBeNull();
-  });
-
-  test("Objekt-Wert → identische Referenz zurück (generischer Typ erhalten)", () => {
-    const cfg = { host: "smtp.example.com", port: 587 };
-    expect(requireDefined(cfg, "mail-foundation", "smtp")).toBe(cfg);
-  });
-});
-
-describe("requireNonEmpty", () => {
-  test("undefined → wirft die requireDefined-Message (delegiert, NICHT empty-Pfad)", () => {
-    expect(() => requireNonEmpty(undefined, "mail-foundation", "host")).toThrow(
-      "config key resolved to undefined",
-    );
-  });
-
-  test("leerer String → wirft empty-Message mit Default-uiHint", () => {
-    expect(() => requireNonEmpty("", "file-foundation", "bucket")).toThrow(
-      "file-foundation: 'bucket' is empty — tenant must configure it before use. Set via tenant-admin UI or seed-handler.",
-    );
-  });
-
-  test("leerer String → wirft UnconfiguredError (422, code unconfigured, typed details)", () => {
-    try {
-      requireNonEmpty("", "file-foundation", "bucket");
-      throw new Error("expected requireNonEmpty to throw");
-    } catch (err) {
-      if (!(err instanceof UnconfiguredError)) throw err;
-      expect(err.code).toBe("unconfigured");
-      expect(err.httpStatus).toBe(422);
-      expect(err.details).toMatchObject({ feature: "file-foundation", key: "bucket" });
-    }
-  });
-
-  test("leerer String mit custom uiHint → Hint landet in der Message", () => {
-    expect(() =>
-      requireNonEmpty("", "ai-foundation", "model", "Choose a model in Settings → AI."),
-    ).toThrow("is empty — tenant must configure it before use. Choose a model in Settings → AI.");
-  });
-
-  test("non-empty Wert → unverändert zurück", () => {
-    expect(requireNonEmpty("smtp.example.com", "mail-foundation", "host")).toBe("smtp.example.com");
-  });
-
-  test("reiner Whitespace → wirft empty-Message (getrimmt, gilt als leer)", () => {
-    expect(() => requireNonEmpty("   ", "mail-foundation", "host")).toThrow(
-      "mail-foundation: 'host' is empty — tenant must configure it before use.",
-    );
-  });
-
-  test("umgebender Whitespace wird vom Rückgabewert getrimmt", () => {
-    expect(requireNonEmpty("  smtp.example.com  ", "mail-foundation", "host")).toBe(
-      "smtp.example.com",
-    );
-  });
-});

package/src/foundation-shared/__tests__/mail-host-policy.test.ts

@@ -1,68 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import type { lookup } from "node:dns/promises";
-import {
-  BlockedHostError,
-  HostResolutionError,
-  resolveMailConnectTarget,
-} from "../mail-host-policy";
-
-describe("resolveMailConnectTarget", () => {
-  test("pins a public hostname to its resolved address and sets servername to the original host", async () => {
-    const fakeLookup = (async () => [
-      { address: "203.0.113.5", family: 4 },
-    ]) as unknown as typeof lookup;
-
-    await expect(
-      resolveMailConnectTarget("smtp.tenant.example", { lookupFn: fakeLookup }),
-    ).resolves.toEqual({ host: "203.0.113.5", servername: "smtp.tenant.example" });
-  });
-
-  test("connects a public IP-literal host directly, without a servername", async () => {
-    await expect(resolveMailConnectTarget("93.184.216.34")).resolves.toEqual({
-      host: "93.184.216.34",
-    });
-  });
-
-  test("rejects a private IP-literal host", async () => {
-    await expect(resolveMailConnectTarget("10.0.0.5")).rejects.toThrow(BlockedHostError);
-  });
-
-  test("rejects a hostname that resolves to a private address", async () => {
-    const fakeLookup = (async () => [
-      { address: "127.0.0.1", family: 4 },
-    ]) as unknown as typeof lookup;
-
-    await expect(
-      resolveMailConnectTarget("internal.example", { lookupFn: fakeLookup }),
-    ).rejects.toThrow(BlockedHostError);
-  });
-
-  test("surfaces a DNS failure distinctly from a blocked host", async () => {
-    const failingLookup = (async () => {
-      throw new Error("ENOTFOUND");
-    }) as unknown as typeof lookup;
-
-    await expect(
-      resolveMailConnectTarget("nowhere.example", { lookupFn: failingLookup }),
-    ).rejects.toThrow(HostResolutionError);
-  });
-
-  test("allowlisted private host bypasses resolution entirely, case-insensitively", async () => {
-    const lookupFn = (() => {
-      throw new Error("must not be called for an allowlisted host");
-    }) as unknown as typeof lookup;
-
-    await expect(
-      resolveMailConnectTarget("Mailpit.internal", {
-        allowedPrivateMailHosts: ["mailpit.internal"],
-        lookupFn,
-      }),
-    ).resolves.toEqual({ host: "Mailpit.internal" });
-  });
-
-  test("a host absent from the allowlist still goes through resolution", async () => {
-    await expect(
-      resolveMailConnectTarget("10.0.0.5", { allowedPrivateMailHosts: ["mailpit.internal"] }),
-    ).rejects.toThrow(BlockedHostError);
-  });
-});

package/src/foundation-shared/config-helpers.ts

@@ -1,97 +0,0 @@
-// Shared config-read helpers used by the per-tenant Foundation factories
-// (ai-foundation, mail-foundation, file-foundation). Each foundation reads
-// its config-keys + secret out of `ctx`, narrows undefined → throw, and
-// dispatches to a provider. The narrowing helpers live here as a single
-// source so all three foundations report errors the same way and a fix
-// to one error-message format reaches all callers.
-//
-// **Why a shared module instead of duplicate copies:**
-//   First two foundations (ai + mail) hand-rolled identical helpers,
-//   the third (file) made it three times. That's the threshold where
-//   premature-abstraction-warnings flip to DRY-warnings — three nearly-
-//   identical 25-LOC helper-pairs across three files would diverge in
-//   error-text under maintenance, exactly the bug-class extraction
-//   prevents.
-//
-// **What this module is NOT:**
-//   - Not a feature — no `defineFeature`, no boot-time registration.
-//   - Not a barrel for everything — only the helpers actually shared
-//     across foundations live here. Per-foundation transport/provider-
-//     factories stay in their own package.
-
-import { InternalError, UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
-
-/**
- * Narrow `value | undefined` → `value` with a clear message that names
- * which config key resolved to nothing. Use for keys whose `undefined`
- * means a registry misconfiguration (no value + no default).
- *
- * Throws InternalError (500): `undefined` here is a developer bug, not a
- * tenant-configuration gap — contrast requireNonEmpty.
- *
- * Foundation-Pattern: this is the wrap-helper around `await ctx.config(
- * featureFoundationFeature.exports.configKeys.someKey)` — the call-site
- * stays a single line per key.
- *
- * **`featureName` is the qualified-name prefix in the error** (e.g.
- * `"ai-foundation"`, `"mail-foundation"`) — included so that an exception
- * surfaced from a multi-foundation app pinpoints the failing foundation.
- */
-export function requireDefined<T>(value: T | undefined, featureName: string, label: string): T {
-  if (value === undefined) {
-    throw new InternalError({
-      message: `${featureName}: '${label}' config key resolved to undefined — registry misconfigured (no value + no default)`,
-    });
-  }
-  return value;
-}
-
-/**
- * Narrow `string | undefined` → non-empty `string`. Tighter than
- * `requireDefined` for the case where the registry HAS a default (often
- * `""`) but the foundation requires the tenant to have set a real value
- * before the factory can build a working transport / provider.
- *
- * Typical use: SMTP host, S3 bucket, model id — values without which the
- * downstream SDK would 400 with a cryptic message. The clearer "tenant
- * must configure X via tenant-admin UI" lands at the call-site instead.
- *
- * Whitespace is trimmed: a whitespace-only value counts as empty, and the
- * returned string has surrounding whitespace removed — so a stray " host "
- * never reaches the SDK as-is.
- *
- * Throws UnconfiguredError (422, code "unconfigured") so clients can route
- * the user to the settings screen instead of a generic 500.
- */
-export function requireNonEmpty(
-  value: string | undefined,
-  featureName: string,
-  label: string,
-  uiHint = "Set via tenant-admin UI or seed-handler.",
-): string {
-  const trimmed = requireDefined(value, featureName, label).trim();
-  if (trimmed.length === 0) {
-    throw new UnconfiguredError({ feature: featureName, key: label, hint: uiHint });
-  }
-  return trimmed;
-}
-
-/**
- * Narrow a `ctx.secrets.get()` result → set secret. The secrets-counterpart
- * to requireNonEmpty: a missing secret is a tenant-configuration gap, not a
- * crash — same 422 contract, so clients route to the settings screen.
- *
- * `key` is the secret's qualified name (`HANDLE.name`) so the error names
- * exactly what `secrets:write:set` expects.
- */
-export function requireSecretSet<T>(
-  value: T | undefined,
-  featureName: string,
-  key: string,
-  uiHint = "Set via secrets:write:set or the tenant-admin UI.",
-): T {
-  if (value === undefined) {
-    throw new UnconfiguredError({ feature: featureName, key, hint: uiHint });
-  }
-  return value;
-}

package/src/foundation-shared/index.ts

@@ -1,13 +0,0 @@
-// Public API of foundation-shared — utilities consumed by the per-tenant
-// Foundation packages (ai-foundation, mail-foundation, file-foundation).
-
-export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers";
-export {
-  BlockedHostError,
-  HostResolutionError,
-  MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR,
-  type MailConnectTarget,
-  type MailHostGuardOptions,
-  readAllowedPrivateMailHostsFromEnv,
-  resolveMailConnectTarget,
-} from "./mail-host-policy";

package/src/foundation-shared/mail-host-policy.ts

@@ -1,70 +0,0 @@
-// Connect-time egress guard for tenant-supplied SMTP/IMAP hosts (shared by
-// mail-transport-smtp and inbound-provider-imap): a tenant-controlled host
-// must resolve to a public address, never an internal one. Resolution
-// happens exactly once and the caller connects to the resolved address
-// directly (see kumiko-http's resolvePublicHostname for why that matters),
-// so this also covers hosts that were valid when a tenant set them and
-// only later re-resolve to a private address.
-//
-// `allowedPrivateMailHosts` is the operator's own escape hatch for an
-// internal relay or a dev/test server (mailpit, greenmail) — deliberately
-// an operator env var (KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS, read via
-// readAllowedPrivateMailHostsFromEnv), never a tenant-config key, so a
-// tenant can never grant themselves the bypass. Shared by both features
-// since a deploy commonly mounts both; declared once in mail-transport-
-// smtp's envSchema (see its feature.ts) to avoid the framework's env-var-
-// conflict check tripping when both features are mounted together.
-
-import type { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
-import { resolvePublicHostname } from "@cosmicdrift/kumiko-framework/http";
-
-export const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
-
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
-export function readAllowedPrivateMailHostsFromEnv(
-  env: Readonly<Record<string, string | undefined>> = process.env,
-): readonly string[] {
-  const raw = env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-  if (!raw) return [];
-  return raw
-    .split(",")
-    .map((host) => host.trim())
-    .filter((host) => host.length > 0);
-}
-
-export type MailHostGuardOptions = {
-  readonly allowedPrivateMailHosts?: readonly string[];
-  readonly lookupFn?: typeof lookup;
-};
-
-export type MailConnectTarget = {
-  readonly host: string;
-  readonly servername?: string;
-};
-
-function isAllowedPrivateMailHost(host: string, allowed: readonly string[]): boolean {
-  return allowed.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
-}
-
-export async function resolveMailConnectTarget(
-  host: string,
-  options: MailHostGuardOptions = {},
-): Promise<MailConnectTarget> {
-  if (isAllowedPrivateMailHost(host, options.allowedPrivateMailHosts ?? [])) {
-    return { host };
-  }
-  const resolved = await resolvePublicHostname(host, options.lookupFn);
-  // An IP-literal host pins to itself — no hostname was ever there for TLS
-  // SNI/cert validation to check, so `servername` stays unset (the mail
-  // libraries themselves skip SNI for an IP host).
-  if (isIP(host) !== 0) {
-    return { host: resolved.address };
-  }
-  return { host: resolved.address, servername: host };
-}
-
-// Re-exported so callers can classify a rejection (policy verdict, no
-// retry) without importing kumiko-http directly.
-export { BlockedHostError, HostResolutionError } from "@cosmicdrift/kumiko-framework/http";

package/src/inbound-mail-foundation/__tests__/account-state.test.ts

@@ -1,30 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
-import type { MailAccountEventPayload } from "../events";
-import { loadCurrentMailAccountPayload } from "../handlers/account-state";
-
-function ctxWithEvents(
-  payloads: readonly MailAccountEventPayload[],
-): Pick<HandlerContext, "loadAggregate"> {
-  return {
-    loadAggregate: async () =>
-      payloads.map((payload) => ({
-        // @cast-boundary test fixture — only `payload` is read by the function under test
-        payload,
-      })) as unknown as Awaited<ReturnType<HandlerContext["loadAggregate"]>>,
-  };
-}
-
-describe("loadCurrentMailAccountPayload", () => {
-  test("returns undefined when the aggregate has no events", async () => {
-    const ctx = ctxWithEvents([]);
-    expect(await loadCurrentMailAccountPayload(ctx, "acc-1")).toBeUndefined();
-  });
-
-  test("returns the payload of the LAST event — full-snapshot semantics", async () => {
-    const first = { status: "active" } as unknown as MailAccountEventPayload;
-    const last = { status: "degraded" } as unknown as MailAccountEventPayload;
-    const ctx = ctxWithEvents([first, last]);
-    expect(await loadCurrentMailAccountPayload(ctx, "acc-1")).toBe(last);
-  });
-});

package/src/inbound-mail-foundation/__tests__/connect-routes.integration.test.ts

@@ -1,273 +0,0 @@
-// Connect-routes integration — mounts createInboundMailConnectRoutes as
-// real extraRoutes on a setupTestStack (kumiko-framework#3050), driven with
-// real HTTP through the framework's own auth/signature wiring, never a
-// hand-rolled Hono app or createTestDispatcher.
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { randomBytes } from "node:crypto";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
-import {
-  createTestUser,
-  setupTestStack,
-  type TestStack,
-  testTenantId,
-  unsafeCreateEntityTable,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createMutableMasterKeyProvider,
-  type MutableMasterKeyProvider,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/testing";
-import {
-  createComplianceProfilesFeature,
-  tenantComplianceProfileEntity,
-} from "../../compliance-profiles";
-import { createConfigFeature } from "../../config";
-import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
-import { createSecretsContext, createSecretsFeature, tenantSecretsTable } from "../../secrets";
-import { createTenantFeature } from "../../tenant/feature";
-import { tenantEntity } from "../../tenant/schema/tenant";
-import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
-import {
-  createInboundMailConnectRoutes,
-  INBOUND_MAIL_PROVIDER_EXTENSION,
-  type InboundMailProviderPlugin,
-  inboundCredentialSecretKey,
-  inboundMailFoundationFeature,
-  mailAccountsProjectionTable,
-  type OAuthTokenSet,
-  seenMessageEntity,
-  syncCursorEntity,
-} from "../index";
-
-const OAUTH_PROVIDER_KEY = "oauth-test";
-const STATE_SECRET = "inbound-mail-connect-test-state-secret-32b";
-const CALLBACK_URL = "http://localhost/inbound-mail/oauth/callback";
-const CONNECT_PATH = "/api/inbound-mail/connect";
-const CALLBACK_PATH = "/inbound-mail/oauth/callback";
-
-const oauthTestPlugin: InboundMailProviderPlugin = {
-  verify: async () => {},
-  fetch: async () => ({ messages: [], nextCursor: { offset: 0 }, hasMore: false }),
-  oauth: {
-    scopes: { receive: ["mail.read"] },
-    buildAuthorizeUrl: async (_ctx, p) =>
-      `https://oauth.test/authorize?state=${encodeURIComponent(p.state)}&redirect_uri=${encodeURIComponent(p.redirectUri)}`,
-    exchangeCode: async (_ctx, p): Promise<OAuthTokenSet> => {
-      if (p.code === "fail-exchange") {
-        throw new Error("token endpoint unavailable");
-      }
-      if (p.code === "no-refresh") {
-        return {
-          accessToken: "access-only",
-          expiresAt: "2099-01-01T00:00:00Z",
-          scopesGranted: ["mail.read"],
-        };
-      }
-      return {
-        accessToken: "access-token",
-        refreshToken: "refresh-token-abc",
-        expiresAt: "2099-01-01T00:00:00Z",
-        scopesGranted: ["mail.read"],
-      };
-    },
-    refreshAccessToken: async () => {
-      throw new Error("not used in connect-routes tests");
-    },
-  },
-};
-
-const oauthTestProviderFeature = defineFeature("inbound-provider-oauth-test", (r) => {
-  r.requires("inbound-mail-foundation");
-  r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, OAUTH_PROVIDER_KEY, oauthTestPlugin);
-});
-
-let stack: TestStack;
-let db: DbConnection;
-let secrets: ReturnType<typeof createSecretsContext>;
-let providerRef: MutableMasterKeyProvider;
-
-beforeAll(async () => {
-  const initialKp = createEnvMasterKeyProvider({
-    env: {
-      KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
-      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
-    },
-  });
-  providerRef = createMutableMasterKeyProvider(initialKp);
-
-  stack = await setupTestStack({
-    features: [
-      createConfigFeature(),
-      createTenantFeature(),
-      createSecretsFeature(),
-      createComplianceProfilesFeature(),
-      createTenantLifecycleFeature(),
-      inboundMailFoundationFeature,
-      inboundProviderInMemoryFeature,
-      oauthTestProviderFeature,
-    ],
-    masterKeyProvider: providerRef,
-    extraContext: ({ db: stackDb }) => ({
-      secrets: createSecretsContext({ db: stackDb, masterKeyProvider: providerRef }),
-    }),
-    extraRoutes: createInboundMailConnectRoutes({
-      stateSecret: STATE_SECRET,
-      callbackUrl: CALLBACK_URL,
-    }),
-  });
-  db = stack.db;
-  secrets = createSecretsContext({ db, masterKeyProvider: providerRef });
-
-  await unsafeCreateEntityTable(db, tenantEntity);
-  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
-  await unsafeCreateEntityTable(db, syncCursorEntity);
-  await unsafeCreateEntityTable(db, seenMessageEntity);
-  await unsafePushTables(db, { tenant_secrets: tenantSecretsTable });
-  configurePiiSubjectKms(new InMemoryKmsAdapter());
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-  resetPiiSubjectKmsForTests();
-});
-
-function adminFor(tenantNumber: number) {
-  return createTestUser({
-    id: tenantNumber,
-    tenantId: testTenantId(tenantNumber),
-    roles: ["TenantAdmin", "SystemAdmin"],
-  });
-}
-
-async function authHeader(user: ReturnType<typeof adminFor>): Promise<Record<string, string>> {
-  const token = await stack.jwt.sign(user);
-  return { Authorization: `Bearer ${token}` };
-}
-
-async function getConnect(query: string, user?: ReturnType<typeof adminFor>) {
-  const headers = user ? await authHeader(user) : {};
-  return stack.app.request(`${CONNECT_PATH}?${query}`, { headers, redirect: "manual" });
-}
-
-async function getCallback(query: string) {
-  return stack.app.request(`${CALLBACK_PATH}?${query}`);
-}
-
-describe("connect-routes — connect", () => {
-  test("401 without session user", async () => {
-    const res = await getConnect(
-      `provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=inbox@acme.test`,
-    );
-    expect(res.status).toBe(401);
-  });
-
-  test("400 when query params are incomplete", async () => {
-    const res = await getConnect(`provider=${OAUTH_PROVIDER_KEY}`, adminFor(4301));
-    expect(res.status).toBe(400);
-    const body = (await res.json()) as { error: { code: string } };
-    expect(body.error.code).toBe("invalid_connect_request");
-  });
-
-  test("404 for unknown provider key", async () => {
-    const res = await getConnect(
-      "provider=does-not-exist&scope=shared&mailbox=inbox@acme.test",
-      adminFor(4302),
-    );
-    expect(res.status).toBe(404);
-  });
-
-  test("400 when provider has no oauth flow (inmemory)", async () => {
-    const res = await getConnect(
-      "provider=inmemory&scope=shared&mailbox=inbox@acme.test",
-      adminFor(4303),
-    );
-    expect(res.status).toBe(400);
-    const body = (await res.json()) as { error: { code: string } };
-    expect(body.error.code).toBe("provider_has_no_oauth_flow");
-  });
-
-  test("302 redirect to provider authorize URL with signed state", async () => {
-    const res = await getConnect(
-      `provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=team@acme.test`,
-      adminFor(4304),
-    );
-    expect(res.status).toBe(302);
-    const location = res.headers.get("location");
-    expect(location).toBeTruthy();
-    const url = new URL(location!);
-    expect(url.origin + url.pathname).toBe("https://oauth.test/authorize");
-    expect(url.searchParams.get("redirect_uri")).toBe(CALLBACK_URL);
-    expect(url.searchParams.get("state")).toBeTruthy();
-  });
-});
-
-describe("connect-routes — oauth callback", () => {
-  test("400 when code/state missing", async () => {
-    const res = await getCallback("");
-    expect(res.status).toBe(400);
-  });
-
-  test("400 on tampered state", async () => {
-    const res = await getCallback("code=ok&state=not.a.valid.state");
-    expect(res.status).toBe(400);
-    const body = (await res.json()) as { error: { code: string } };
-    expect(body.error.code).toBe("invalid_state");
-  });
-
-  test("happy path: creates mail account + stores refresh token secret", async () => {
-    const user = adminFor(4305);
-    const connectRes = await getConnect(
-      `provider=${OAUTH_PROVIDER_KEY}&scope=user&mailbox=owner@acme.test`,
-      user,
-    );
-    const state = new URL(connectRes.headers.get("location")!).searchParams.get("state");
-    expect(state).toBeTruthy();
-
-    const callbackRes = await getCallback(`code=ok&state=${encodeURIComponent(state!)}`);
-    expect(callbackRes.status).toBe(200);
-    const body = (await callbackRes.json()) as { connected: boolean; accountId: string };
-    expect(body.connected).toBe(true);
-    expect(body.accountId).toBeTruthy();
-
-    const accounts = await selectMany(db, mailAccountsProjectionTable, { id: body.accountId });
-    expect(accounts).toHaveLength(1);
-    expect(accounts[0]?.["provider"]).toBe(OAUTH_PROVIDER_KEY);
-    expect(accounts[0]?.["ownerUserId"]).toBe(user.id);
-
-    const stored = await secrets.get(user.tenantId, inboundCredentialSecretKey(body.accountId));
-    expect(stored).toBeDefined();
-    expect(stored!.reveal()).toBe("refresh-token-abc");
-  });
-
-  test("502 when token exchange fails", async () => {
-    const connectRes = await getConnect(
-      `provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=fail@acme.test`,
-      adminFor(4306),
-    );
-    const state = new URL(connectRes.headers.get("location")!).searchParams.get("state");
-
-    const res = await getCallback(`code=fail-exchange&state=${encodeURIComponent(state!)}`);
-    expect(res.status).toBe(502);
-    const body = (await res.json()) as { error: { code: string } };
-    expect(body.error.code).toBe("token_exchange_failed");
-  });
-
-  test("502 when provider omits refresh token", async () => {
-    const connectRes = await getConnect(
-      `provider=${OAUTH_PROVIDER_KEY}&scope=shared&mailbox=norefresh@acme.test`,
-      adminFor(4307),
-    );
-    const state = new URL(connectRes.headers.get("location")!).searchParams.get("state");
-
-    const res = await getCallback(`code=no-refresh&state=${encodeURIComponent(state!)}`);
-    expect(res.status).toBe(502);
-    const body = (await res.json()) as { error: { code: string } };
-    expect(body.error.code).toBe("no_refresh_token");
-  });
-});