@cursor/july 0.1.20 → 0.1.21

package/src/internal/cursor-github-credentials.integration.test.ts

@@ -0,0 +1,271 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { getGithubCursorAccountRuntime } from "../channels/github/cursor-account.js";
+import { githubChannel } from "../channels/github/github-channel.js";
+import { httpChannel } from "../channels.js";
+import type {
+  AgentProject,
+  AgentServeHandle,
+  ChannelDefinition,
+} from "../types.js";
+import type { AgentRunner } from "./sdk-runner.js";
+import { startServer } from "./server.js";
+
+interface RecordedRequest {
+  method: string;
+  url: string;
+  body?: unknown;
+  authorization?: string;
+}
+
+describe("serve with cursor-account GitHub channels", () => {
+  const savedEnv: Record<string, string | undefined> = {};
+  const requests: RecordedRequest[] = [];
+  let stateRoot: string | undefined;
+  let handle: AgentServeHandle | undefined;
+
+  const runner: AgentRunner = {
+    async runTurn() {
+      return { status: "finished", result: "unused" };
+    },
+  };
+
+  function fixture(
+    cursorAccount: true | { repos: readonly string[] } = {
+      repos: ["acme/widgets", "acme/tools"],
+    }
+  ): AgentProject {
+    return {
+      rootDir: "/tmp/cursor-github-fixture",
+      agentDir: "/tmp/cursor-github-fixture/agent",
+      name: "github-fixture",
+      agent: {
+        name: "github-fixture",
+        runtime: "local",
+        tools: [],
+        skills: [],
+        connections: [],
+        subagents: [],
+        seedFiles: [],
+      },
+      httpChannel: httpChannel(),
+      channels: [
+        {
+          id: "github",
+          definition: githubChannel({
+            cursorAccount,
+          }) as unknown as ChannelDefinition,
+        },
+      ],
+      schedules: [],
+      hooks: [],
+      abs: [],
+      diagnostics: [],
+    };
+  }
+
+  beforeEach(() => {
+    requests.length = 0;
+    for (const key of [
+      "AGENT_SERVE_CONFIG_DIR",
+      "CURSOR_API_BASE_URL",
+      "CURSOR_API_KEY",
+      "GH_TOKEN",
+    ]) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+    process.env.AGENT_SERVE_CONFIG_DIR = "/nonexistent-agent-serve-config";
+    vi.stubGlobal(
+      "fetch",
+      async (input: RequestInfo | URL, init?: RequestInit) => {
+        const url = String(input);
+        const headers = new Headers(init?.headers);
+        const authorization = headers.get("authorization");
+        const body =
+          typeof init?.body === "string"
+            ? (JSON.parse(init.body) as unknown)
+            : undefined;
+        requests.push({
+          method: init?.method ?? "GET",
+          url,
+          ...(body === undefined ? {} : { body }),
+          ...(authorization === null ? {} : { authorization }),
+        });
+        if (url.endsWith("/v0/scm-events/github-token")) {
+          return Response.json({
+            token: "ghs_cursor_account",
+            expiresAt: new Date(Date.now() + 45 * 60_000).toISOString(),
+          });
+        }
+        if (url.includes("/v0/scm-events/subscriptions")) {
+          const subscriptions =
+            (
+              body as
+                | {
+                    subscriptions?: Array<{
+                      provider: string;
+                      repo: string;
+                    }>;
+                  }
+                | undefined
+            )?.subscriptions ?? [];
+          return Response.json({
+            repos: subscriptions.map((subscription) => ({
+              ...subscription,
+              isSubscribed: true,
+            })),
+          });
+        }
+        return Response.json({
+          events: [],
+          nextOffset: "",
+          gapDetected: false,
+        });
+      }
+    );
+  });
+
+  afterEach(async () => {
+    await handle?.close();
+    handle = undefined;
+    if (stateRoot !== undefined) {
+      await rm(stateRoot, { recursive: true, force: true });
+      stateRoot = undefined;
+    }
+    vi.unstubAllGlobals();
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  });
+
+  it("requires the host to be signed in to Cursor", async () => {
+    stateRoot = await mkdtemp(join(tmpdir(), "agent-serve-cursor-github-"));
+    await expect(
+      startServer([{ slug: "", project: fixture() }], {
+        port: 0,
+        stateRoot,
+        playground: false,
+        runner,
+      })
+    ).rejects.toThrow(
+      /cursor-events[\s\S]*signed-in Cursor[\s\S]*agentkit login/
+    );
+  });
+
+  it("mints one credential covering every selected repository", async () => {
+    stateRoot = await mkdtemp(join(tmpdir(), "agent-serve-cursor-github-"));
+    process.env.CURSOR_API_KEY = "crsr_account";
+    process.env.CURSOR_API_BASE_URL = "https://backend.example";
+    const project = fixture();
+    const logs: string[] = [];
+
+    handle = await startServer([{ slug: "", project }], {
+      port: 0,
+      stateRoot,
+      playground: false,
+      runner,
+      logger: (line) => logs.push(line),
+    });
+
+    const tokenRequest = requests.find((request) =>
+      request.url.endsWith("/v0/scm-events/github-token")
+    );
+    expect(tokenRequest).toMatchObject({
+      method: "POST",
+      body: {
+        repos: ["acme/widgets", "acme/tools"],
+        permissions: "pr-write",
+      },
+      authorization: "Bearer crsr_account",
+    });
+    expect(process.env.GH_TOKEN).toBe("ghs_cursor_account");
+    const definition = project.channels[0]?.definition;
+    if (definition === undefined) {
+      throw new Error("GitHub fixture channel is missing.");
+    }
+    const accountRuntime = getGithubCursorAccountRuntime(definition);
+    await expect(accountRuntime?.credentials.getToken()).resolves.toBe(
+      "ghs_cursor_account"
+    );
+    expect(
+      logs.some((line) =>
+        line.includes("Cursor account repo-scoped credential")
+      )
+    ).toBe(true);
+  });
+
+  it("does not expose signed-in GitHub access through anonymous serving", async () => {
+    stateRoot = await mkdtemp(join(tmpdir(), "agent-serve-cursor-github-"));
+    process.env.CURSOR_API_KEY = "crsr_account";
+    process.env.CURSOR_API_BASE_URL = "https://backend.example";
+
+    await expect(
+      startServer([{ slug: "", project: fixture() }], {
+        port: 0,
+        stateRoot,
+        playground: false,
+        runner,
+        allowAnonymous: true,
+      })
+    ).rejects.toThrow(/cannot be served with --allow-anonymous/);
+  });
+
+  it("serves anonymously when allowAnonymousCursorGithub opts in", async () => {
+    stateRoot = await mkdtemp(join(tmpdir(), "agent-serve-cursor-github-"));
+    process.env.CURSOR_API_KEY = "crsr_account";
+    process.env.CURSOR_API_BASE_URL = "https://backend.example";
+    const logs: string[] = [];
+
+    handle = await startServer([{ slug: "", project: fixture() }], {
+      port: 0,
+      stateRoot,
+      playground: false,
+      runner,
+      allowAnonymous: true,
+      allowAnonymousCursorGithub: true,
+      logger: (line) => logs.push(line),
+    });
+
+    expect(
+      requests.find((request) =>
+        request.url.endsWith("/v0/scm-events/github-token")
+      )
+    ).toBeDefined();
+    expect(
+      logs.some((line) => line.includes("--allow-anonymous-cursor-github"))
+    ).toBe(true);
+  });
+
+  it("accepts repository scope from serve options with cursorAccount true", async () => {
+    stateRoot = await mkdtemp(join(tmpdir(), "agent-serve-cursor-github-"));
+    process.env.CURSOR_API_BASE_URL = "https://backend.example";
+
+    handle = await startServer([{ slug: "", project: fixture(true) }], {
+      port: 0,
+      stateRoot,
+      playground: false,
+      runner,
+      cursorEvents: {
+        repos: ["acme/widgets"],
+        apiKey: "crsr_nested",
+        baseUrl: "https://backend.example",
+      },
+    });
+
+    expect(
+      requests.find((request) =>
+        request.url.endsWith("/v0/scm-events/github-token")
+      )
+    ).toMatchObject({
+      body: { repos: ["acme/widgets"] },
+      authorization: "Bearer crsr_nested",
+    });
+  });
+});