@hed-hog/core 0.0.387 → 0.0.390

package/src/mcp-chat/mcp-chat.service.spec.ts

@@ -0,0 +1,236 @@
+import axios from 'axios';
+import { McpChatService } from './mcp-chat.service';
+
+jest.mock('axios');
+
+const mockedAxios = axios as jest.Mocked<typeof axios>;
+
+type ProfileConfig = Record<string, unknown>;
+
+/**
+ * O serviço é instanciado à mão em vez de por `Test.createTestingModule` para
+ * não arrastar os `forwardRef` do módulo — o que está sob teste é a resolução
+ * do modelo, não a injeção.
+ */
+function buildService(params: {
+  providerSlug: string;
+  config: ProfileConfig;
+  clarification?: string;
+}) {
+  const recordStep = jest.fn();
+  const finish = jest.fn();
+
+  const prisma = {
+    mcp_conversation: {
+      findUnique: jest.fn().mockResolvedValue({ user_id: 1, title: 'conversa' }),
+      update: jest.fn().mockResolvedValue({}),
+    },
+    mcp_conversation_message: {
+      create: jest.fn().mockResolvedValue({}),
+      findMany: jest.fn().mockResolvedValue([]),
+    },
+    integration_profile: {
+      findUnique: jest.fn().mockResolvedValue({
+        config: { api_key: 'chave-secreta', ...params.config },
+        integration_provider: { slug: params.providerSlug },
+      }),
+    },
+    route: { findMany: jest.fn().mockResolvedValue([]) },
+  };
+
+  const setting = {
+    getSettingValues: jest.fn(async (keys: string[]) => {
+      const values: Record<string, unknown> = {
+        'mcp-enabled': true,
+        'mcp-ai-profile-id': 'perfil-mcp',
+      };
+      return Object.fromEntries(keys.map((key) => [key, values[key]]));
+    }),
+  };
+
+  // Sem ferramentas registradas o loop encerra na primeira resposta, e
+  // `tools`/`tool_choice` continuam `undefined` no corpo enviado.
+  const registry = { getAll: jest.fn().mockReturnValue([]) };
+
+  const promptBuilder = {
+    build: jest.fn().mockResolvedValue({
+      systemPrompt: 'prompt de sistema',
+      layers: [],
+      layerNames: [],
+    }),
+  };
+
+  const aiExecution = {
+    start: jest.fn().mockResolvedValue(7),
+    recordStep,
+    finish,
+  };
+
+  const service = new McpChatService(
+    prisma as any,
+    setting as any,
+    registry as any,
+    promptBuilder as any,
+    aiExecution as any,
+  );
+
+  if (params.clarification) {
+    jest
+      .spyOn(service as any, 'selectOpenAiTools')
+      .mockResolvedValue({ tools: [], clarification: params.clarification });
+  }
+
+  return { service, recordStep, finish, prisma };
+}
+
+function mockOpenAiReply() {
+  mockedAxios.post.mockResolvedValue({
+    data: {
+      choices: [{ message: { content: 'resposta' } }],
+      usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
+    },
+  } as any);
+}
+
+function mockGeminiReply() {
+  mockedAxios.post.mockResolvedValue({
+    data: {
+      candidates: [{ content: { parts: [{ text: 'resposta' }] } }],
+      usageMetadata: {
+        promptTokenCount: 10,
+        candidatesTokenCount: 5,
+        totalTokenCount: 15,
+      },
+    },
+  } as any);
+}
+
+const send = (service: McpChatService) =>
+  service.sendMessage(1, 1, 'pt-BR', 'olá');
+
+describe('McpChatService — modelo vindo do integration_profile', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('OpenAI', () => {
+    it('sem model no perfil, envia o corpo histórico intacto', async () => {
+      const { service, recordStep } = buildService({
+        providerSlug: 'openai',
+        config: {},
+      });
+      mockOpenAiReply();
+
+      await send(service);
+
+      const [url, body, options] = mockedAxios.post.mock.calls[0];
+      expect(url).toBe('https://api.openai.com/v1/chat/completions');
+      expect(body).toEqual({
+        model: 'gpt-4o-mini',
+        messages: [
+          { role: 'system', content: 'prompt de sistema' },
+        ],
+        tools: undefined,
+        tool_choice: undefined,
+      });
+      expect(options).toEqual({
+        headers: {
+          Authorization: 'Bearer chave-secreta',
+          'Content-Type': 'application/json',
+        },
+      });
+      expect(recordStep).toHaveBeenCalledWith(
+        expect.objectContaining({ provider: 'openai', model: 'gpt-4o-mini' }),
+      );
+    });
+
+    it('usa o model do perfil no corpo e no registro de custo', async () => {
+      const { service, recordStep } = buildService({
+        providerSlug: 'openai',
+        config: { model: 'gpt-4o' },
+      });
+      mockOpenAiReply();
+
+      await send(service);
+
+      expect(mockedAxios.post.mock.calls[0][1]).toEqual(
+        expect.objectContaining({ model: 'gpt-4o' }),
+      );
+      expect(recordStep).toHaveBeenCalledWith(
+        expect.objectContaining({ provider: 'openai', model: 'gpt-4o' }),
+      );
+    });
+  });
+
+  describe('Gemini', () => {
+    it('sem model no perfil, mantém a URL e o custo históricos', async () => {
+      const { service, recordStep } = buildService({
+        providerSlug: 'gemini',
+        config: {},
+      });
+      mockGeminiReply();
+
+      await send(service);
+
+      expect(mockedAxios.post.mock.calls[0][0]).toBe(
+        'https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=chave-secreta',
+      );
+      expect(recordStep).toHaveBeenCalledWith(
+        expect.objectContaining({
+          provider: 'gemini',
+          model: 'gemini-2.0-flash',
+        }),
+      );
+    });
+
+    it('usa o model do perfil na URL e no registro de custo', async () => {
+      const { service, recordStep } = buildService({
+        providerSlug: 'gemini',
+        config: { model: 'gemini-2.5-flash' },
+      });
+      mockGeminiReply();
+
+      await send(service);
+
+      expect(mockedAxios.post.mock.calls[0][0]).toContain(
+        '/models/gemini-2.5-flash:generateContent',
+      );
+      expect(recordStep).toHaveBeenCalledWith(
+        expect.objectContaining({
+          provider: 'gemini',
+          model: 'gemini-2.5-flash',
+        }),
+      );
+    });
+
+    it('aceita o model no formato "models/<id>" sem duplicar o segmento', async () => {
+      const { service, recordStep } = buildService({
+        providerSlug: 'gemini',
+        config: { model: 'models/gemini-2.5-flash' },
+      });
+      mockGeminiReply();
+
+      await send(service);
+
+      const url = mockedAxios.post.mock.calls[0][0];
+      expect(url).toContain('/v1beta/models/gemini-2.5-flash:generateContent');
+      expect(url).not.toContain('models/models/');
+      expect(recordStep).toHaveBeenCalledWith(
+        expect.objectContaining({ model: 'gemini-2.5-flash' }),
+      );
+    });
+  });
+
+  it('fecha a execução quando o caminho OpenAI devolve pedido de esclarecimento', async () => {
+    const { service, finish } = buildService({
+      providerSlug: 'openai',
+      config: {},
+      clarification: 'Qual conta você quer consultar?',
+    });
+
+    await send(service);
+
+    expect(mockedAxios.post).not.toHaveBeenCalled();
+    expect(finish).toHaveBeenCalledWith(7, 'completed');
+  });
+});

package/src/mcp-chat/mcp-chat.service.ts

@@ -12,13 +12,27 @@ import {
 } from '@nestjs/common';
 import axios from 'axios';
 import { AiExecutionService } from '../ai-instruction/ai-execution.service';
+import { FALLBACK_SYSTEM_PROMPT } from '../ai-instruction/ai-instruction.service';
 import { AiPromptBuilderService } from '../ai-instruction/ai-prompt-builder.service';
-import { buildAiConfigFromIntegration } from '../integration-profile/integration-profile.utils';
+import {
+  buildAiConfigFromIntegration,
+  DEEPSEEK_API_BASE_URL,
+  DEEPSEEK_DEFAULT_MODEL,
+} from '../integration-profile/integration-profile.utils';
 import { McpRegistryService, McpToolEntry } from '../mcp/mcp-registry.service';
 import { McpContext } from '../mcp/types/mcp-context.type';
 import { SettingService } from '../setting/setting.service';
 import { CreateConversationDTO } from './dto/create-conversation.dto';
 
+const OPENAI_API_BASE_URL = 'https://api.openai.com/v1';
+/**
+ * Modelos usados quando o perfil de integração não declara `config.model`.
+ * São o comportamento histórico do chat MCP, de quando o modelo era literal:
+ * mudar aqui muda o padrão de toda instalação que ainda não preencheu o campo.
+ */
+const OPENAI_CHAT_MODEL = 'gpt-4o-mini';
+const GEMINI_CHAT_MODEL = 'gemini-2.0-flash';
+
 type OpenAiMessage =
   | { role: 'system'; content: string }
   | { role: 'user'; content: string }
@@ -90,13 +104,6 @@ const FORCE_FINISH_THRESHOLD = 2;
 const MIN_DOMAIN_CONFIDENCE = 2;
 const AMBIGUOUS_DOMAIN_DELTA = 1;
 
-// SYSTEM_PROMPT is now managed via AiInstructionService (slug: system.global).
-// This fallback is used only if the DB is unreachable during startup.
-const SYSTEM_PROMPT_FALLBACK =
-  'You are a helpful assistant with access to tools from the HedHog system. ' +
-  "Use the available tools to answer the user's questions accurately. " +
-  'Always respond in the same language the user writes in.';
-
 const sanitize = (n: string) => n.replace(/\./g, '__');
 const restore = (n: string) => n.replace(/__/g, '.');
 
@@ -300,7 +307,7 @@ export class McpChatService {
 
     await this.assertOwnership(conversationId, userId);
 
-    const { provider, apiKey } = await this.getProviderKey();
+    const { provider, apiKey, baseUrl, model } = await this.getProviderKey();
 
     // Save user message
     await this.prisma.mcp_conversation_message.create({
@@ -331,28 +338,65 @@ export class McpChatService {
 
     try {
       if (provider === 'gemini') {
-        return await this.runGeminiLoop(conversationId, userId, locale, message, apiKey, executionId);
+        return await this.runGeminiLoop(
+          conversationId,
+          userId,
+          locale,
+          message,
+          apiKey,
+          executionId,
+          model,
+        );
       }
-      return await this.runOpenAiLoop(conversationId, userId, locale, message, apiKey, executionId);
+      return await this.runOpenAiLoop(
+        conversationId,
+        userId,
+        locale,
+        message,
+        apiKey,
+        executionId,
+        provider,
+        baseUrl,
+        model,
+      );
     } catch (err) {
       await this.aiExecution.finish(executionId, 'failed', String(err));
       throw err;
     }
   }
 
-  private async getSystemPrompt(locale?: string): Promise<string> {
+  /**
+   * Composes the system prompt from the stored layers.
+   *
+   * `moduleSlug`/`agentSlug` activate the L3/L4 layers; without them the seeded
+   * `module.*` and `agent.*` instructions are never read. `SYSTEM_PROMPT_FALLBACK`
+   * used to be duplicated here — it now comes from `AiInstructionService`, which
+   * already falls back internally, so this only guards against the whole build
+   * throwing.
+   */
+  private async getSystemPrompt(
+    locale?: string,
+    context?: { moduleSlug?: string; agentSlug?: string },
+  ): Promise<string> {
     try {
       const built = await this.promptBuilder.build({
         locale,
+        moduleSlug: context?.moduleSlug,
+        agentSlug: context?.agentSlug,
       });
-      return built.systemPrompt || SYSTEM_PROMPT_FALLBACK;
+      return built.systemPrompt || FALLBACK_SYSTEM_PROMPT;
     } catch {
-      return SYSTEM_PROMPT_FALLBACK;
+      return FALLBACK_SYSTEM_PROMPT;
     }
   }
 
   // ── OpenAI loop ──────────────────────────────────────────────────────────
 
+  /**
+   * Loop de tool calling no formato OpenAI. Serve tanto para a OpenAI quanto
+   * para o DeepSeek, que expõe a mesma API de `/chat/completions` (inclusive
+   * `tools`/`tool_calls`) — muda só a base URL, o modelo e a chave.
+   */
   private async runOpenAiLoop(
     conversationId: number,
     userId: number,
@@ -360,6 +404,9 @@ export class McpChatService {
     message: string,
     apiKey: string,
     executionId: number,
+    provider: 'openai' | 'deepseek' = 'openai',
+    baseUrl = OPENAI_API_BASE_URL,
+    model = OPENAI_CHAT_MODEL,
   ) {
     const systemPrompt = await this.getSystemPrompt(locale);
 
@@ -385,6 +432,9 @@ export class McpChatService {
       history,
     );
     if (toolSelection.clarification) {
+      // Sem o finish a execução fica presa em `running` para sempre — o caminho
+      // Gemini já fechava aqui.
+      await this.aiExecution.finish(executionId, 'completed');
       return this.recordAssistantAndReturnHistory(
         conversationId,
         toolSelection.clarification,
@@ -401,9 +451,9 @@ export class McpChatService {
       const stepStart = Date.now();
       try {
         response = await axios.post(
-          'https://api.openai.com/v1/chat/completions',
+          `${baseUrl}/chat/completions`,
           {
-            model: 'gpt-4o-mini',
+            model,
             messages: openAiMessages,
             tools: !forceFinish && tools.length > 0 ? tools : undefined,
             tool_choice: !forceFinish && tools.length > 0 ? 'auto' : undefined,
@@ -418,17 +468,19 @@ export class McpChatService {
       } catch (err: any) {
         const status = err?.response?.status;
         const errBody = err?.response?.data?.error;
+        const providerName = provider === 'deepseek' ? 'DeepSeek' : 'OpenAI';
         if (status === 429) {
           throw new HttpException(
-            errBody?.message ?? 'OpenAI rate limit exceeded. Please try again later.',
+            errBody?.message ??
+              `${providerName} rate limit exceeded. Please try again later.`,
             HttpStatus.TOO_MANY_REQUESTS,
           );
         }
         if (status === 401) {
-          throw new BadRequestException('Invalid OpenAI API key.');
+          throw new BadRequestException(`Invalid ${providerName} API key.`);
         }
         throw new HttpException(
-          errBody?.message ?? 'OpenAI API error.',
+          errBody?.message ?? `${providerName} API error.`,
           status ?? HttpStatus.BAD_GATEWAY,
         );
       }
@@ -438,8 +490,8 @@ export class McpChatService {
         executionId,
         stepOrder: stepOrder++,
         type: 'prompt',
-        provider: 'openai',
-        model: 'gpt-4o-mini',
+        provider,
+        model,
         durationMs: Date.now() - stepStart,
         usage: usage
           ? { input: usage.prompt_tokens ?? 0, output: usage.completion_tokens ?? 0, total: usage.total_tokens ?? 0 }
@@ -571,7 +623,11 @@ export class McpChatService {
     message: string,
     apiKey: string,
     executionId: number,
+    model = GEMINI_CHAT_MODEL,
   ) {
+    // O perfil pode trazer o nome no formato da API ("models/gemini-2.0-flash");
+    // a URL abaixo já inclui o segmento `/models/`.
+    const modelId = model.replace(/^models\//, '');
     const systemPrompt = await this.getSystemPrompt(locale);
 
     const allHistory = await this.prisma.mcp_conversation_message.findMany({
@@ -608,7 +664,7 @@ export class McpChatService {
       const stepStart = Date.now();
       try {
         response = await axios.post(
-          `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${apiKey}`,
+          `https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(modelId)}:generateContent?key=${apiKey}`,
           {
             systemInstruction: { parts: [{ text: systemPrompt }] },
             contents: geminiContents,
@@ -648,7 +704,7 @@ export class McpChatService {
         stepOrder: stepOrder++,
         type: 'prompt',
         provider: 'gemini',
-        model: 'gemini-2.0-flash',
+        model: modelId,
         durationMs: Date.now() - stepStart,
         usage: geminiUsage
           ? { input: geminiUsage.promptTokenCount ?? 0, output: geminiUsage.candidatesTokenCount ?? 0, total: geminiUsage.totalTokenCount ?? 0 }
@@ -858,7 +914,21 @@ export class McpChatService {
     }
   }
 
-  private async getProviderKey(): Promise<{ provider: 'openai' | 'gemini'; apiKey: string }> {
+  /**
+   * Resolve credenciais e modelo do chat MCP a partir do perfil de integração
+   * apontado pela setting `mcp-ai-profile-id`.
+   *
+   * O `model` segue a mesma precedência do resto do codebase — aqui sem o degrau
+   * de `ai_instruction`, porque este fluxo não tem prompt de task próprio:
+   * `integration_profile.config.model` > constante de default do provider.
+   */
+  private async getProviderKey(): Promise<{
+    provider: 'openai' | 'gemini' | 'deepseek';
+    apiKey: string;
+    /** Base URL só se aplica aos providers no formato OpenAI; o Gemini leva o modelo na URL. */
+    baseUrl: string;
+    model: string;
+  }> {
     const settings = await this.setting.getSettingValues(['mcp-ai-profile-id']);
     const profileSlug = String(settings['mcp-ai-profile-id'] ?? '').trim();
 
@@ -878,13 +948,39 @@ export class McpChatService {
     }
 
     const providerSlug = profile.integration_provider.slug;
-    const { apiKey } = buildAiConfigFromIntegration(providerSlug, profile.config);
+    const { apiKey, model, baseUrl } = buildAiConfigFromIntegration(
+      providerSlug,
+      profile.config,
+    );
 
     if (!apiKey) {
       throw new BadRequestException(`MCP AI profile "${profileSlug}" has no API key configured.`);
     }
 
-    return { provider: providerSlug === 'gemini' ? 'gemini' : 'openai', apiKey };
+    if (providerSlug === 'gemini') {
+      return {
+        provider: 'gemini',
+        apiKey,
+        baseUrl: '',
+        model: model || GEMINI_CHAT_MODEL,
+      };
+    }
+
+    if (providerSlug === 'deepseek') {
+      return {
+        provider: 'deepseek',
+        apiKey,
+        baseUrl: baseUrl || DEEPSEEK_API_BASE_URL,
+        model: model || DEEPSEEK_DEFAULT_MODEL,
+      };
+    }
+
+    return {
+      provider: 'openai',
+      apiKey,
+      baseUrl: OPENAI_API_BASE_URL,
+      model: model || OPENAI_CHAT_MODEL,
+    };
   }
 
   private async buildOpenAiTools(

package/src/oauth/oauth-token-broker.service.spec.ts

@@ -0,0 +1,172 @@
+import { describe, it, expect, beforeEach, jest } from '@jest/globals';
+import { of, throwError } from 'rxjs';
+import { SecurityService } from '../security/security.service';
+import {
+  OAuthTokenBrokerError,
+  OAuthTokenBrokerService,
+} from './oauth-token-broker.service';
+
+const ENCRYPTION_SECRET = 'test-encryption-secret-0123456789';
+
+const makeSecurity = () =>
+  new SecurityService({
+    get: (key: string) =>
+      key === 'ENCRYPTION_SECRET' ? ENCRYPTION_SECRET : undefined,
+  } as any);
+
+const makeDeps = () => {
+  const security = makeSecurity();
+  const http = { post: jest.fn() };
+  const prisma = {
+    integration_profile: { findUnique: jest.fn() },
+    user_account: { findFirst: jest.fn(), update: jest.fn() },
+  };
+  const setting = { getSettingValues: jest.fn() };
+  return { security, http, prisma, setting };
+};
+
+const makeService = (deps = makeDeps()) => ({
+  service: new OAuthTokenBrokerService(
+    deps.http as any,
+    deps.setting as any,
+    deps.prisma as any,
+    deps.security,
+  ),
+  deps,
+});
+
+const PROVIDER = 'microsoft-entra-id';
+
+const primeConfig = (deps: ReturnType<typeof makeDeps>) => {
+  deps.setting.getSettingValues.mockResolvedValue({
+    'oauth-microsoft-entra-id-profile-id': 'ms-profile',
+  } as any);
+  deps.prisma.integration_profile.findUnique.mockResolvedValue({
+    slug: 'ms-profile',
+    config: {
+      client_id: 'CID',
+      client_secret: 'SECRET',
+      tenant_id: 'TENANT',
+    },
+    integration_provider: { slug: 'microsoft-entra-id-oauth' },
+  } as any);
+};
+
+describe('OAuthTokenBrokerService', () => {
+  let deps: ReturnType<typeof makeDeps>;
+  let service: OAuthTokenBrokerService;
+
+  beforeEach(() => {
+    const built = makeService();
+    deps = built.deps;
+    service = built.service;
+    primeConfig(deps);
+  });
+
+  const storedRefreshTokenRow = (security: SecurityService, plain: string) => ({
+    id: 42,
+    refresh_token: Buffer.from(security.encrypt(plain)),
+    scopes: 'openid,offline_access,Calendars.Read',
+    token_expires_at: new Date('2020-01-01T00:00:00Z'),
+  });
+
+  it('decrypts the stored refresh token, exchanges it, and returns an access token', async () => {
+    deps.prisma.user_account.findFirst.mockResolvedValue(
+      storedRefreshTokenRow(deps.security, 'refresh-original') as any,
+    );
+    deps.http.post.mockReturnValue(
+      of({
+        data: {
+          access_token: 'ACCESS-1',
+          refresh_token: 'refresh-rotated',
+          expires_in: 3600,
+        },
+      }) as any,
+    );
+
+    const result = await service.getAccessToken(1, PROVIDER);
+
+    expect(result.accessToken).toBe('ACCESS-1');
+    expect(result.expiresAt.getTime()).toBeGreaterThan(Date.now());
+
+    // The token endpoint received the DECRYPTED refresh token, not the ciphertext.
+    const [, body] = deps.http.post.mock.calls[0] as [string, string, unknown];
+    expect(body).toContain('grant_type=refresh_token');
+    expect(body).toContain('refresh_token=refresh-original');
+  });
+
+  it('persists the rotated refresh token re-encrypted (never in plaintext)', async () => {
+    deps.prisma.user_account.findFirst.mockResolvedValue(
+      storedRefreshTokenRow(deps.security, 'refresh-original') as any,
+    );
+    deps.http.post.mockReturnValue(
+      of({
+        data: {
+          access_token: 'ACCESS-1',
+          refresh_token: 'refresh-rotated',
+          expires_in: 3600,
+        },
+      }) as any,
+    );
+
+    await service.getAccessToken(1, PROVIDER);
+
+    expect(deps.prisma.user_account.update).toHaveBeenCalledTimes(1);
+    const updateArg = deps.prisma.user_account.update.mock.calls[0][0] as any;
+    const storedBuffer = updateArg.data.refresh_token as Buffer;
+    // Round-trips back to the rotated token, and is not the plaintext itself.
+    expect(storedBuffer.toString()).not.toContain('refresh-rotated');
+    expect(deps.security.decrypt(storedBuffer.toString())).toBe('refresh-rotated');
+  });
+
+  it('serves a cached access token without a second token exchange', async () => {
+    deps.prisma.user_account.findFirst.mockResolvedValue(
+      storedRefreshTokenRow(deps.security, 'refresh-original') as any,
+    );
+    deps.http.post.mockReturnValue(
+      of({
+        data: { access_token: 'ACCESS-1', expires_in: 3600 },
+      }) as any,
+    );
+
+    await service.getAccessToken(1, PROVIDER);
+    await service.getAccessToken(1, PROVIDER);
+
+    expect(deps.http.post).toHaveBeenCalledTimes(1);
+  });
+
+  it('throws not_connected when the user has no linked account', async () => {
+    deps.prisma.user_account.findFirst.mockResolvedValue(null as any);
+
+    await expect(service.getAccessToken(1, PROVIDER)).rejects.toMatchObject({
+      reason: 'not_connected',
+    });
+  });
+
+  it('throws refresh_revoked on invalid_grant from the provider', async () => {
+    deps.prisma.user_account.findFirst.mockResolvedValue(
+      storedRefreshTokenRow(deps.security, 'refresh-original') as any,
+    );
+    deps.http.post.mockReturnValue(
+      throwError(() => ({
+        response: { data: { error: 'invalid_grant' }, status: 400 },
+      })) as any,
+    );
+
+    await expect(service.getAccessToken(1, PROVIDER)).rejects.toBeInstanceOf(
+      OAuthTokenBrokerError,
+    );
+    await expect(service.getAccessToken(1, PROVIDER)).rejects.toMatchObject({
+      reason: 'refresh_revoked',
+    });
+  });
+
+  it('parses granted scopes from the stored account', async () => {
+    deps.prisma.user_account.findFirst.mockResolvedValue({
+      scopes: 'openid, Calendars.Read  offline_access',
+    } as any);
+
+    const scopes = await service.getGrantedScopes(1, PROVIDER);
+    expect(scopes).toEqual(['openid', 'Calendars.Read', 'offline_access']);
+  });
+});