@cursor/july 0.1.19 → 0.1.21

package/src/channels/github/auth.test.ts

@@ -0,0 +1,105 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const execFileMock = vi.hoisted(() => vi.fn());
+const createAppAuthMock = vi.hoisted(() => vi.fn());
+
+vi.mock("node:child_process", () => ({
+  execFile: execFileMock,
+}));
+
+vi.mock("@octokit/auth-app", () => ({
+  createAppAuth: createAppAuthMock,
+}));
+
+import * as auth from "./auth.js";
+
+function clearAuthEnv(): void {
+  delete process.env.GITHUB_TOKEN;
+  delete process.env.GH_TOKEN;
+  delete process.env.GITHUB_APP_ID;
+  delete process.env.GITHUB_APP_PRIVATE_KEY;
+  delete process.env.GITHUB_APP_INSTALLATION_ID;
+}
+
+describe("resolveGitHubAccessToken", () => {
+  beforeEach(() => {
+    auth.clearGitHubAuthCaches();
+    execFileMock.mockReset();
+    createAppAuthMock.mockReset();
+    clearAuthEnv();
+  });
+
+  afterEach(() => {
+    auth.clearGitHubAuthCaches();
+    execFileMock.mockReset();
+    createAppAuthMock.mockReset();
+    clearAuthEnv();
+  });
+
+  it("prefers App installation tokens over ambient PAT when App creds are set", async () => {
+    process.env.GITHUB_TOKEN = "pat-should-not-win";
+    process.env.GITHUB_APP_ID = "123";
+    process.env.GITHUB_APP_PRIVATE_KEY =
+      "-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----";
+    createAppAuthMock.mockReturnValue(
+      async () => ({ token: "ghs_installation" }) as never
+    );
+
+    await expect(
+      auth.resolveGitHubAccessToken({ installationId: 42 })
+    ).resolves.toBe("ghs_installation");
+    expect(createAppAuthMock).toHaveBeenCalledOnce();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it("falls back to PAT when App credentials are unset (local testing)", async () => {
+    process.env.GITHUB_TOKEN = "local-pat";
+
+    await expect(
+      auth.resolveGitHubAccessToken({ installationId: 42 })
+    ).resolves.toBe("local-pat");
+    expect(createAppAuthMock).not.toHaveBeenCalled();
+  });
+
+  it("uses GITHUB_APP_INSTALLATION_ID for host-scoped App auth", async () => {
+    process.env.GITHUB_APP_ID = "123";
+    process.env.GITHUB_APP_PRIVATE_KEY =
+      "-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----";
+    process.env.GITHUB_APP_INSTALLATION_ID = "99";
+    createAppAuthMock.mockReturnValue(
+      async () => ({ token: "ghs_host" }) as never
+    );
+
+    await expect(auth.resolveGitHubAccessToken({})).resolves.toBe("ghs_host");
+    expect(createAppAuthMock).toHaveBeenCalledOnce();
+  });
+});
+
+describe("ensureGhCliTokenEnv", () => {
+  beforeEach(() => {
+    auth.clearGitHubAuthCaches();
+    execFileMock.mockReset();
+    createAppAuthMock.mockReset();
+    clearAuthEnv();
+  });
+
+  afterEach(() => {
+    auth.clearGitHubAuthCaches();
+    execFileMock.mockReset();
+    createAppAuthMock.mockReset();
+    clearAuthEnv();
+  });
+
+  it("exports an App installation token as GH_TOKEN for gh CLI", async () => {
+    process.env.GITHUB_APP_ID = "123";
+    process.env.GITHUB_APP_PRIVATE_KEY =
+      "-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----";
+    process.env.GITHUB_APP_INSTALLATION_ID = "99";
+    createAppAuthMock.mockReturnValue(
+      async () => ({ token: "ghs_for_gh" }) as never
+    );
+
+    await expect(auth.ensureGhCliTokenEnv()).resolves.toBe(true);
+    expect(process.env.GH_TOKEN).toBe("ghs_for_gh");
+  });
+});

package/src/channels/github/cursor-account.test.ts

@@ -0,0 +1,204 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { createGitHubOctokit } from "./api.js";
+import { resolveCredentialValue } from "./auth.js";
+import {
+  getGithubCursorAccountRuntime,
+  resolveCursorGithubPermissions,
+  resolveCursorGithubProxyUrl,
+} from "./cursor-account.js";
+import { getGitHubChannelOptions, githubChannel } from "./github-channel.js";
+
+describe("githubChannel({ cursorAccount })", () => {
+  it("binds outbound API auth without rewriting authored cursorAccount options", async () => {
+    const definition = githubChannel({
+      cursorAccount: { repos: ["Acme/Widgets"], permissions: "read" },
+    });
+    const runtime = getGithubCursorAccountRuntime(definition);
+
+    expect(runtime?.options.cursorAccount).toEqual({
+      repos: ["Acme/Widgets"],
+      permissions: "read",
+    });
+    expect(runtime?.scope).toEqual({
+      owner: "acme",
+      repos: ["acme/widgets"],
+      permissions: "read",
+    });
+    expect(() => runtime?.credentials.getToken()).toThrow(/has not been bound/);
+    runtime?.credentials.bind(async () => "ghs_cursor_account");
+    await expect(
+      resolveCredentialValue(
+        getGitHubChannelOptions(definition)?.credentials?.token
+      )
+    ).resolves.toBe("ghs_cursor_account");
+  });
+
+  it("defaults permissions to pr-write on the private scope", () => {
+    const definition = githubChannel({
+      cursorAccount: { repos: ["acme/widgets"] },
+    });
+    expect(getGithubCursorAccountRuntime(definition)?.scope).toEqual({
+      owner: "acme",
+      repos: ["acme/widgets"],
+      permissions: "pr-write",
+    });
+  });
+
+  it("allows a webhook secret but rejects separate outbound credentials", () => {
+    expect(() =>
+      githubChannel({
+        cursorAccount: true,
+        credentials: { webhookSecret: "signing-secret" },
+      })
+    ).not.toThrow();
+    expect(() =>
+      githubChannel({
+        cursorAccount: true,
+        credentials: { token: "ghp_dedicated" },
+      })
+    ).toThrow(/cannot be combined/);
+    expect(() =>
+      githubChannel({
+        cursorAccount: true,
+        credentials: { appId: 1, privateKey: "pem" },
+      })
+    ).toThrow(/cannot be combined/);
+  });
+
+  it("rejects an empty inline repository scope", () => {
+    expect(() => githubChannel({ cursorAccount: { repos: [] } })).toThrow(
+      /require at least one repository/
+    );
+  });
+
+  it.each([
+    [["acme/widgets", "other/tools"], /must share one owner/],
+    [["https://github.com/acme/widgets"], /expected owner\/repo/],
+    [
+      Array.from({ length: 21 }, (_, index) => `acme/repo-${index}`),
+      /at most 20 repositories/,
+    ],
+  ])("rejects an unsupported repository scope", (repos, error) => {
+    expect(() => githubChannel({ cursorAccount: { repos } })).toThrow(error);
+  });
+
+  it("treats cursorAccount false as disabled", () => {
+    expect(
+      getGithubCursorAccountRuntime(githubChannel({ cursorAccount: false }))
+    ).toBeUndefined();
+  });
+
+  it("accepts contents-write permissions on the private scope", () => {
+    const definition = githubChannel({
+      cursorAccount: {
+        repos: ["acme/widgets"],
+        permissions: "contents-write",
+      },
+    });
+    expect(getGithubCursorAccountRuntime(definition)?.scope?.permissions).toBe(
+      "contents-write"
+    );
+  });
+});
+
+describe("resolveCursorGithubPermissions", () => {
+  it("escalates to the most privileged requested tier", () => {
+    expect(resolveCursorGithubPermissions(["read", "pr-write"])).toBe(
+      "pr-write"
+    );
+    expect(
+      resolveCursorGithubPermissions(["read", "contents-write", "pr-write"])
+    ).toBe("contents-write");
+  });
+});
+
+describe("cursor-account GitHub proxy mode", () => {
+  afterEach(() => {
+    delete process.env.AGENT_SERVE_GITHUB_PROXY_URL;
+  });
+
+  function captureFetch(): {
+    fetchImpl: typeof fetch;
+    requests: { url: string; headers: Headers }[];
+  } {
+    const requests: { url: string; headers: Headers }[] = [];
+    const fetchImpl: typeof fetch = async (input, init) => {
+      requests.push({
+        url: input instanceof Request ? input.url : String(input),
+        headers:
+          input instanceof Request ? input.headers : new Headers(init?.headers),
+      });
+      return Response.json({ id: 1 });
+    };
+    return { fetchImpl, requests };
+  }
+
+  it("resolves the proxy URL from the backend base URL or env override", () => {
+    expect(resolveCursorGithubProxyUrl("https://api.cursor.com")).toBe(
+      "https://api.cursor.com/v0/github-proxy"
+    );
+    process.env.AGENT_SERVE_GITHUB_PROXY_URL =
+      "https://backend.local:8000/v0/github-proxy/";
+    expect(resolveCursorGithubProxyUrl("https://api.cursor.com")).toBe(
+      "https://backend.local:8000/v0/github-proxy"
+    );
+  });
+
+  it("routes channel Octokit calls to the bound proxy with scope headers", async () => {
+    const definition = githubChannel({
+      cursorAccount: { repos: ["acme/widgets"], permissions: "pr-write" },
+    });
+    const runtime = getGithubCursorAccountRuntime(definition);
+    runtime?.credentials.bind(async () => "crsr_api_key");
+    runtime?.credentials.bindProxyTransport({
+      apiBaseUrl: "https://api.cursor.com/v0/github-proxy",
+      headers: {
+        "x-cursor-github-repos": "acme/widgets",
+        "x-cursor-github-permissions": "pr-write",
+      },
+    });
+
+    const { fetchImpl, requests } = captureFetch();
+    const octokit = await createGitHubOctokit({
+      api: { fetch: fetchImpl },
+      credentials: getGitHubChannelOptions(definition)?.credentials,
+    });
+    await octokit.request("GET /repos/{owner}/{repo}", {
+      owner: "acme",
+      repo: "widgets",
+    });
+
+    expect(requests).toHaveLength(1);
+    const { url, headers } = requests[0]!;
+    expect(url).toBe(
+      "https://api.cursor.com/v0/github-proxy/repos/acme/widgets"
+    );
+    expect(headers.get("authorization")).toBe("Bearer crsr_api_key");
+    expect(headers.get("x-cursor-github-repos")).toBe("acme/widgets");
+    expect(headers.get("x-cursor-github-permissions")).toBe("pr-write");
+  });
+
+  it("keeps raw-token mode when no proxy transport is bound", async () => {
+    const definition = githubChannel({
+      cursorAccount: { repos: ["acme/widgets"] },
+    });
+    getGithubCursorAccountRuntime(definition)?.credentials.bind(
+      async () => "ghs_raw"
+    );
+
+    const { fetchImpl, requests } = captureFetch();
+    const octokit = await createGitHubOctokit({
+      api: { fetch: fetchImpl },
+      credentials: getGitHubChannelOptions(definition)?.credentials,
+    });
+    await octokit.request("GET /repos/{owner}/{repo}", {
+      owner: "acme",
+      repo: "widgets",
+    });
+
+    const { url, headers } = requests[0]!;
+    expect(url).toBe("https://api.github.com/repos/acme/widgets");
+    expect(headers.get("authorization")).toBe("Bearer ghs_raw");
+    expect(headers.get("x-cursor-github-repos")).toBeNull();
+  });
+});