@desplega.ai/agent-swarm 1.119.6 → 1.121.0

package/src/tests/oauth-credential-bindings.test.ts

@@ -9,6 +9,7 @@ import {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { closeDb, createAgent, getDb, initDb } from "../be/db";
 import {
+  deleteOAuthTokens,
   getOAuthApp,
   getOAuthTokens,
   storeOAuthTokens,
@@ -41,8 +42,8 @@ type ToolResult = {
     bindings: Array<{
       configKey: string;
       authKind?: "config" | "oauth";
-      oauthProvider?: string;
-      tokenStatus?: "ok" | "expiring" | "missing";
+      oauthAuthorizationId?: string;
+      tokenStatus?: "ok" | "expiring" | "refresh-failed" | "revoked" | "missing";
     }>;
   };
 };
@@ -100,7 +101,6 @@ async function listen(server: Server): Promise<number> {
 function cleanupRows() {
   const db = getDb();
   db.run("DELETE FROM script_credential_bindings WHERE config_key LIKE 'PHASE2_%'");
-  db.run("DELETE FROM oauth_tokens WHERE provider LIKE 'phase2-%'");
   db.run("DELETE FROM oauth_apps WHERE provider LIKE 'phase2-%'");
 }
 
@@ -147,24 +147,31 @@ describe("OAuth credential bindings", () => {
       .all()
       .map((column) => column.name);
     expect(columns).toContain("auth_kind");
-    expect(columns).toContain("oauth_provider");
+    expect(columns).toContain("oauth_authorization_id");
+
+    upsertOAuthApp("phase2-roundtrip", testApp("phase2-roundtrip"));
+    storeOAuthTokens("phase2-roundtrip", {
+      accessToken: "roundtrip-access",
+      expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+    });
+    const authorizationId = getOAuthTokens("phase2-roundtrip")!.id;
 
     const binding = upsertCredentialBinding({
       configKey: "PHASE2_ROUNDTRIP_OAUTH",
       allowedHosts: ["api.vendor.test"],
       headerTemplate: "Authorization: Bearer [REDACTED:PHASE2_ROUNDTRIP_OAUTH]",
       authKind: "oauth",
-      oauthProvider: "phase2-roundtrip",
+      oauthAuthorizationId: authorizationId,
     });
 
     expect(binding.authKind).toBe("oauth");
-    expect(binding.oauthProvider).toBe("phase2-roundtrip");
+    expect(binding.oauthAuthorizationId).toBe(authorizationId);
 
     const listed = listRelationalCredentialBindings({ includeInactive: true }).find(
       (item) => item.id === binding.id,
     );
     expect(listed?.authKind).toBe("oauth");
-    expect(listed?.oauthProvider).toBe("phase2-roundtrip");
+    expect(listed?.oauthAuthorizationId).toBe(authorizationId);
   });
 
   test("OAuth binding resolves through the stored access token", async () => {
@@ -179,7 +186,7 @@ describe("OAuth credential bindings", () => {
       allowedHosts: ["api.vendor.test"],
       headerTemplate: "Authorization: Bearer [REDACTED:PHASE2_RESOLVE_OAUTH]",
       authKind: "oauth",
-      oauthProvider: "phase2-resolve",
+      oauthAuthorizationId: getOAuthTokens("phase2-resolve")!.id,
     });
     process.env.PHASE2_RESOLVE_OAUTH = "env-must-not-win";
 
@@ -205,7 +212,7 @@ describe("OAuth credential bindings", () => {
       allowedHosts: ["api.vendor.test"],
       headerTemplate: "Authorization: Bearer [REDACTED:PHASE2_REFRESH_OAUTH]",
       authKind: "oauth",
-      oauthProvider: "phase2-refresh",
+      oauthAuthorizationId: getOAuthTokens("phase2-refresh")!.id,
     });
 
     const fetchSpy = mock((input: string | URL | Request, init?: RequestInit) => {
@@ -254,7 +261,7 @@ describe("OAuth credential bindings", () => {
       allowedHosts: ["api.vendor.test"],
       headerTemplate: "Authorization: Bearer [REDACTED:PHASE2_BASIC_OAUTH]",
       authKind: "oauth",
-      oauthProvider: "phase2-basic",
+      oauthAuthorizationId: getOAuthTokens("phase2-basic")!.id,
     });
 
     const config = getOAuthProviderConfig("phase2-basic");
@@ -308,7 +315,16 @@ describe("OAuth credential bindings", () => {
     expect(url).not.toContain("scope=read%2Cwrite");
   });
 
-  test("credential-bindings tool rejects reserved tracker OAuth providers", async () => {
+  test("metadata actor remains an authorization parameter without lifted extras", () => {
+    upsertOAuthApp("phase2-actor", {
+      ...testApp("phase2-actor"),
+      metadata: JSON.stringify({ actor: "app" }),
+    });
+
+    expect(getOAuthProviderConfig("phase2-actor")?.extraParams).toEqual({ actor: "app" });
+  });
+
+  test("credential-bindings tool now accepts tracker providers (reserved carve-out removed in step-8)", async () => {
     const result = (await credentialBindingsTool().handler(
       {
         action: "oauth-app-upsert",
@@ -322,9 +338,10 @@ describe("OAuth credential bindings", () => {
       meta(),
     )) as ToolResult;
 
-    expect(result.structuredContent.success).toBe(false);
-    expect(result.structuredContent.message).toContain("dedicated tracker");
-    expect(getOAuthApp("jira")).toBeNull();
+    // linear/jira are ordinary oauth_apps rows now — no reserved-provider block.
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.message).not.toContain("dedicated tracker");
+    expect(getOAuthApp("jira")?.clientId).toBe("jira-client");
   });
 
   test("credential-bindings tool validates OAuth app URLs in production", async () => {
@@ -376,7 +393,7 @@ describe("OAuth credential bindings", () => {
       allowedHosts: ["api.vendor.test"],
       headerTemplate: "Authorization: Bearer [REDACTED:PHASE2_BROKEN_OAUTH]",
       authKind: "oauth",
-      oauthProvider: "phase2-broken",
+      oauthAuthorizationId: getOAuthTokens("phase2-broken")!.id,
     });
     upsertCredentialBinding({
       configKey: "PHASE2_HEALTHY_CONFIG",
@@ -406,15 +423,21 @@ describe("OAuth credential bindings", () => {
     delete process.env.PHASE2_HEALTHY_CONFIG;
   });
 
-  test("missing OAuth token skips binding resolution and list reports missing", async () => {
+  test("revoked OAuth token skips binding resolution and list reports revoked", async () => {
     upsertOAuthApp("phase2-missing", testApp("phase2-missing"));
+    storeOAuthTokens("phase2-missing", {
+      accessToken: "soon-deleted",
+      expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+    });
+    const authorizationId = getOAuthTokens("phase2-missing")!.id;
     upsertCredentialBinding({
       configKey: "PHASE2_MISSING_OAUTH",
       allowedHosts: ["api.vendor.test"],
       headerTemplate: "Authorization: Bearer [REDACTED:PHASE2_MISSING_OAUTH]",
       authKind: "oauth",
-      oauthProvider: "phase2-missing",
+      oauthAuthorizationId: authorizationId,
     });
+    deleteOAuthTokens("phase2-missing");
     process.env.PHASE2_MISSING_OAUTH = "env-must-not-win";
 
     const bindings = await buildScriptCredentialBindings({});
@@ -428,7 +451,9 @@ describe("OAuth credential bindings", () => {
       (binding) => binding.configKey === "PHASE2_MISSING_OAUTH",
     );
     expect(result.structuredContent.success).toBe(true);
-    expect(listed?.tokenStatus).toBe("missing");
+    // Disconnect revokes the authorization in place (row kept for referential
+    // continuity), so the binding surfaces as `revoked`, not `missing`.
+    expect(listed?.tokenStatus).toBe("revoked");
   });
 
   test("generic OAuth callback exchanges code and stores tokens", async () => {
@@ -472,17 +497,20 @@ describe("OAuth credential bindings", () => {
     }
   });
 
-  test("generic OAuth callback rejects linear", async () => {
+  test("generic OAuth callback no longer special-cases linear (unified routing)", async () => {
+    // step-4 dropped the DEDICATED_CALLBACK_PROVIDERS 409 asymmetry: every
+    // provider routes through the unified, state-keyed handler. An unknown
+    // state now reports the same invalid-state error as any other provider.
     const server = createOAuthServer();
     const port = await listen(server);
     try {
       const res = await fetch(
-        `http://localhost:${port}/api/oauth/linear/callback?code=callback-code&state=state`,
+        `http://localhost:${port}/api/oauth/linear/callback?code=callback-code&state=unknown-state`,
       );
 
-      expect(res.status).toBe(409);
+      expect(res.status).toBe(400);
       const body = (await res.json()) as { error: string };
-      expect(body.error).toContain("/api/trackers/linear/callback");
+      expect(body.error).toContain("Invalid or expired OAuth state");
     } finally {
       server.close();
     }

package/src/tests/oauth-presets.test.ts

@@ -0,0 +1,275 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+import { closeDb, createAgent, initDb } from "../be/db";
+import { getOAuthApp } from "../be/db-queries/oauth";
+import { handleScriptConnections } from "../http/script-connections";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { assertOAuthAppUrlsSafe } from "../oauth/app-validation";
+import {
+  getOAuthPreset,
+  hydrateOAuthAppFromPreset,
+  listOAuthPresetIds,
+  listOAuthPresets,
+} from "../oauth/presets";
+import { buildAuthorizationUrl } from "../oauth/wrapper";
+
+const TEST_DB_PATH = "./test-oauth-presets.sqlite";
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(path + suffix);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+type TestResponse = { status: number; text: string; json: () => Promise<unknown> };
+
+async function dispatch(
+  path: string,
+  init: { method?: string; body?: unknown; agentId?: string } = {},
+): Promise<TestResponse> {
+  const req = Readable.from(
+    init.body === undefined ? [] : [Buffer.from(JSON.stringify(init.body))],
+  ) as IncomingMessage;
+  req.method = init.method ?? "GET";
+  req.url = path;
+  req.headers = init.agentId
+    ? { "x-agent-id": init.agentId, "content-type": "application/json" }
+    : { "content-type": "application/json" };
+
+  let status = 200;
+  let text = "";
+  const res = {
+    headersSent: false,
+    writableEnded: false,
+    setHeader() {},
+    writeHead(code: number) {
+      status = code;
+      this.headersSent = true;
+      return this;
+    },
+    end(chunk?: unknown) {
+      if (chunk !== undefined) text += String(chunk);
+      this.writableEnded = true;
+      return this;
+    },
+  } as unknown as ServerResponse;
+
+  const pathSegments = getPathSegments(req.url || "");
+  const queryParams = parseQueryParams(req.url || "");
+  if (!(await handleScriptConnections(req, res, pathSegments, queryParams, init.agentId))) {
+    res.writeHead(404);
+    res.end("Not Found");
+  }
+  return { status, text, json: async () => JSON.parse(text) };
+}
+
+let leadAgentId: string;
+
+beforeAll(async () => {
+  await removeDbFiles(TEST_DB_PATH);
+  initDb(TEST_DB_PATH);
+  leadAgentId = createAgent({ name: "presets-lead", isLead: true, status: "idle" }).id;
+});
+
+afterAll(async () => {
+  closeDb();
+  await removeDbFiles(TEST_DB_PATH);
+});
+
+describe("oauth presets — pure data", () => {
+  test("exposes the expected curated preset ids", () => {
+    expect(listOAuthPresetIds().sort()).toEqual(
+      ["github", "google", "jira", "linear", "notion", "slack"].sort(),
+    );
+    expect(listOAuthPresets()).toHaveLength(6);
+  });
+
+  test("every preset carries endpoints, setup hints, and SSRF-safe URLs", () => {
+    for (const preset of listOAuthPresets()) {
+      expect(preset.authorizeUrl.startsWith("https://")).toBe(true);
+      expect(preset.tokenUrl.startsWith("https://")).toBe(true);
+      // Parse without throwing.
+      expect(() => new URL(preset.authorizeUrl)).not.toThrow();
+      expect(() => new URL(preset.tokenUrl)).not.toThrow();
+      if (preset.revocationUrl) expect(() => new URL(preset.revocationUrl as string)).not.toThrow();
+      if (preset.userinfoUrl) expect(() => new URL(preset.userinfoUrl as string)).not.toThrow();
+      expect(preset.setupHints.length).toBeGreaterThan(0);
+      // Defense in depth: the merged endpoints must survive the SSRF gate.
+      expect(() =>
+        assertOAuthAppUrlsSafe({ authorizeUrl: preset.authorizeUrl, tokenUrl: preset.tokenUrl }),
+      ).not.toThrow();
+    }
+  });
+
+  test("provider-specific quirks are encoded", () => {
+    const google = getOAuthPreset("google");
+    expect(google?.extraParams).toMatchObject({ access_type: "offline", prompt: "consent" });
+    expect(google?.scopeSeparator).toBe(" ");
+
+    const notion = getOAuthPreset("notion");
+    expect(notion?.tokenAuthStyle).toBe("basic");
+    expect(notion?.tokenBodyFormat).toBe("json");
+
+    const jira = getOAuthPreset("jira");
+    expect(jira?.requiresRefreshTokenRotation).toBe(true);
+
+    const linear = getOAuthPreset("linear");
+    expect(linear?.scopeSeparator).toBe(",");
+
+    const slack = getOAuthPreset("slack");
+    expect(slack?.scopeSeparator).toBe(",");
+  });
+
+  test("hydration marks curated-prefill and lets explicit fields win", () => {
+    const preset = getOAuthPreset("google");
+    if (!preset) throw new Error("google preset missing");
+
+    const merged = hydrateOAuthAppFromPreset(preset, {
+      tokenUrl: "https://custom.example.com/token",
+      scopes: ["custom.scope"],
+      extraParams: { prompt: "select_account" },
+    });
+
+    expect(merged.source).toBe("curated-prefill");
+    expect(merged.authorizeUrl).toBe(preset.authorizeUrl); // filled from preset
+    expect(merged.tokenUrl).toBe("https://custom.example.com/token"); // explicit wins
+    expect(merged.scopes).toEqual(["custom.scope"]); // explicit wins
+    // extraParams merge per-key: explicit prompt wins, preset access_type stays.
+    expect(merged.extraParams).toMatchObject({ access_type: "offline", prompt: "select_account" });
+    expect(merged.setupHints).toEqual(preset.setupHints);
+  });
+
+  test("google hydration yields offline params in the built authorization URL", async () => {
+    const preset = getOAuthPreset("google");
+    if (!preset) throw new Error("google preset missing");
+    const hydrated = hydrateOAuthAppFromPreset(preset, {});
+
+    // buildAuthorizationUrl now persists a PKCE pending row keyed to a real app
+    // (step-4), so the app must exist first.
+    const created = await dispatch("/api/oauth-apps", {
+      method: "POST",
+      agentId: leadAgentId,
+      body: { presetId: "google", clientId: "google-client", clientSecret: "google-secret" },
+    });
+    expect(created.status).toBe(200);
+
+    const { url } = await buildAuthorizationUrl(
+      {
+        provider: hydrated.provider,
+        clientId: "google-client",
+        clientSecret: "google-secret",
+        authorizeUrl: hydrated.authorizeUrl,
+        tokenUrl: hydrated.tokenUrl,
+        redirectUri: "https://api.public.test/api/oauth/callback",
+        scopes: hydrated.scopes,
+        scopeSeparator: hydrated.scopeSeparator,
+        extraParams: hydrated.extraParams,
+      },
+      { flow: "generic" },
+    );
+
+    const parsed = new URL(url);
+    expect(parsed.searchParams.get("access_type")).toBe("offline");
+    expect(parsed.searchParams.get("prompt")).toBe("consent");
+    // Space separator surfaces as `+` / `%20` in the encoded scope.
+    expect(parsed.searchParams.get("scope")).toBe("openid email profile");
+  });
+});
+
+describe("oauth presets — HTTP", () => {
+  test("GET /api/oauth-presets lists all six presets with hints", async () => {
+    const res = await dispatch("/api/oauth-presets");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      presets: Array<{ id: string; authorizeUrl: string; setupHints: string[] }>;
+    };
+    expect(body.presets).toHaveLength(6);
+    expect(body.presets.map((p) => p.id).sort()).toEqual(
+      ["github", "google", "jira", "linear", "notion", "slack"].sort(),
+    );
+    for (const preset of body.presets) {
+      expect(preset.authorizeUrl.startsWith("https://")).toBe(true);
+      expect(preset.setupHints.length).toBeGreaterThan(0);
+    }
+    // No secrets ever live in presets.
+    expect(res.text).not.toContain("clientSecret");
+  });
+
+  test("POST /api/oauth-apps with presetId 'google' hydrates endpoints + source", async () => {
+    const res = await dispatch("/api/oauth-apps", {
+      method: "POST",
+      agentId: leadAgentId,
+      body: { presetId: "google", clientId: "google-client", clientSecret: "google-secret" },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      oauthApp: { provider: string; authorizeUrl: string; source: string };
+      redirectUri: string;
+      setupHints: string[];
+    };
+    expect(body.redirectUri).toContain("/api/oauth/callback");
+    expect(body.setupHints.length).toBeGreaterThan(0);
+    expect(body.oauthApp.source).toBe("curated-prefill");
+    expect(res.text).not.toContain("google-secret");
+
+    const stored = getOAuthApp("google");
+    expect(stored?.source).toBe("curated-prefill");
+    expect(stored?.authorizeUrl).toBe("https://accounts.google.com/o/oauth2/v2/auth");
+    expect(stored?.tokenUrl).toBe("https://oauth2.googleapis.com/token");
+    expect(stored?.scopeSeparator).toBe(" ");
+    expect(stored?.revocationUrl).toBe("https://oauth2.googleapis.com/revoke");
+    expect(stored?.extraParamsJson ?? "").toContain("access_type");
+    expect(stored?.clientSecret).toBe("google-secret");
+  });
+
+  test("no presetId + missing required endpoint fields is rejected with 400", async () => {
+    // provider/authorizeUrl/tokenUrl are optional in the schema (preset can
+    // supply them) — but with no presetId the handler must still reject a
+    // request that omits them, not write a half-configured app.
+    const res = await dispatch("/api/oauth-apps", {
+      method: "POST",
+      agentId: leadAgentId,
+      body: { provider: "bare_provider", clientId: "c", clientSecret: "s" },
+    });
+    expect(res.status).toBe(400);
+    expect(res.text).toContain("authorizeUrl");
+    expect(getOAuthApp("bare_provider")).toBeNull();
+  });
+
+  test("explicit fields override the preset during hydration", async () => {
+    const res = await dispatch("/api/oauth-apps", {
+      method: "POST",
+      agentId: leadAgentId,
+      body: {
+        presetId: "google",
+        provider: "google_custom",
+        clientId: "gc",
+        clientSecret: "gcs",
+        tokenUrl: "https://custom.example.com/token",
+      },
+    });
+    expect(res.status).toBe(200);
+    const stored = getOAuthApp("google_custom");
+    expect(stored?.tokenUrl).toBe("https://custom.example.com/token");
+    expect(stored?.authorizeUrl).toBe("https://accounts.google.com/o/oauth2/v2/auth");
+    expect(stored?.source).toBe("curated-prefill");
+  });
+
+  test("unknown presetId is rejected with 400 listing valid ids", async () => {
+    const res = await dispatch("/api/oauth-apps", {
+      method: "POST",
+      agentId: leadAgentId,
+      body: { presetId: "not-a-real-preset", clientId: "c", clientSecret: "s" },
+    });
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toContain("Unknown presetId");
+    expect(body.error).toContain("google");
+  });
+});