@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/utils/vault-api.test.ts

@@ -1,536 +0,0 @@
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-
-vi.mock('../sentry.js', () => ({
-  Sentry: { addBreadcrumb: vi.fn() },
-}));
-
-import { Sentry } from '../sentry.js';
-import { getCompanyUid, getEntityUid, resolveCallerPersonUid, vaultApiFetch } from './vault-api.js';
-import { isAuthError } from './auth-error.js';
-import { isCompanySelectionError } from './company-selection-error.js';
-import { isExpectedUserError } from './expected-cli-error.js';
-import {
-  _resetForTests,
-  emitPlanLimitNag,
-} from '../lib/plan-limit-nag.js';
-
-function tmpNagStatePath(label: string): string {
-  return path.join(
-    os.tmpdir(),
-    `hq-plan-limit-vault-api-${label}-${process.pid}-${Date.now()}.json`,
-  );
-}
-
-const fetchMock = vi.fn();
-const originalFetch = globalThis.fetch;
-
-function mockResponse(status: number, body: unknown): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { 'Content-Type': 'application/json' },
-  });
-}
-
-beforeEach(() => {
-  fetchMock.mockReset();
-  globalThis.fetch = fetchMock as unknown as typeof fetch;
-  _resetForTests();
-});
-
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-  _resetForTests();
-});
-
-describe('resolveCallerPersonUid', () => {
-  it('returns the canonical person uid (oldest createdAt, uid tie-break)', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        entities: [
-          { uid: 'prs_b', type: 'person', createdAt: '2026-01-02T00:00:00Z' },
-          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
-          { uid: 'prs_c', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
-        ],
-      }),
-    );
-
-    const uid = await resolveCallerPersonUid('tok');
-    expect(uid).toBe('prs_a');
-  });
-
-  it('throws when the caller has no person entity', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(200, { entities: [] }));
-    await expect(resolveCallerPersonUid('tok')).rejects.toThrow(
-      /No person entity/,
-    );
-  });
-
-  it('throws when the API returns an error status', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(401, { error: 'unauth' }));
-    await expect(resolveCallerPersonUid('tok')).rejects.toThrow(
-      /Failed to fetch person entity/,
-    );
-  });
-
-  it('filters out non-person entries before sorting', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        entities: [
-          { uid: 'cmp_a', type: 'company', createdAt: '2025-01-01T00:00:00Z' },
-          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
-        ],
-      }),
-    );
-    const uid = await resolveCallerPersonUid('tok');
-    expect(uid).toBe('prs_a');
-  });
-});
-
-describe('getEntityUid', () => {
-  it('routes to person resolution when personal=true', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        entities: [
-          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
-        ],
-      }),
-    );
-    const uid = await getEntityUid('tok', { personal: true });
-    expect(uid).toBe('prs_a');
-    const url = fetchMock.mock.calls[0][0] as string;
-    expect(url).toMatch(/\/entity\/by-type\/person/);
-  });
-
-  it('resolves a slug CALLER-SCOPED — to the caller\'s own company, ignoring a stranger\'s same-slug company (DEV-1742)', async () => {
-    // The slug resolves within the caller's namespace via check-slug/me, which
-    // returns the caller's OWN company. A stranger's same-slug company is
-    // invisible — no by-slug 409, no stranding.
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, { available: false, conflictingCompanyUid: 'cmp_mine' }),
-    );
-    const uid = await getEntityUid('tok', { companySlug: 'acme' });
-    expect(uid).toBe('cmp_mine');
-    const url = fetchMock.mock.calls[0][0] as string;
-    expect(url).toMatch(/\/entity\/check-slug\/me/);
-    // The caller-scoped hit is authoritative — never falls through to by-slug.
-    expect(fetchMock.mock.calls.length).toBe(1);
-  });
-
-  it('falls back to the global by-slug lookup when the slug is not in the caller\'s namespace', async () => {
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(200, { available: true }))
-      .mockResolvedValueOnce(mockResponse(200, { entity: { uid: 'cmp_other' } }));
-    const uid = await getEntityUid('tok', { companySlug: 'other-co' });
-    expect(uid).toBe('cmp_other');
-    expect(fetchMock.mock.calls[0][0]).toMatch(/\/entity\/check-slug\/me/);
-    expect(fetchMock.mock.calls[1][0]).toMatch(/\/entity\/by-slug\/company\/other-co/);
-  });
-
-  it('resolves a cmp_ uid DIRECTLY by uid, never via by-slug (silent escape hatch)', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, { entity: { uid: 'cmp_01ABC' } }),
-    );
-    const uid = await getEntityUid('tok', { companySlug: 'cmp_01ABC' });
-    expect(uid).toBe('cmp_01ABC');
-    const url = fetchMock.mock.calls[0][0] as string;
-    expect(url).toMatch(/\/entity\/cmp_01ABC$/);
-    expect(url).not.toMatch(/by-slug/);
-    expect(url).not.toMatch(/check-slug/);
-  });
-
-  it('surfaces a clean error when a cmp_ uid does not resolve', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(404, { error: 'Entity not found', uid: 'cmp_nope' }),
-    );
-    await expect(
-      getEntityUid('tok', { companySlug: 'cmp_nope' }),
-    ).rejects.toThrow(/Failed to resolve company 'cmp_nope'/);
-  });
-
-  it('falls through to by-slug when the namespace check is unavailable (503)', async () => {
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(503, { error: 'Membership table not configured' }))
-      .mockResolvedValueOnce(mockResponse(200, { entity: { uid: 'cmp_legacy' } }));
-    const uid = await getEntityUid('tok', { companySlug: 'acme' });
-    expect(uid).toBe('cmp_legacy');
-    expect(fetchMock.mock.calls[1][0]).toMatch(/\/entity\/by-slug\/company\/acme/);
-  });
-
-  it('classifies a global by-slug entity miss as an expected user error (HQ-CLI-8)', async () => {
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(200, { available: true }))
-      .mockResolvedValueOnce(mockResponse(404, { error: 'Entity not found' }));
-
-    const err = await getEntityUid('tok', { companySlug: 'missing-co' }).catch(
-      (e: unknown) => e,
-    );
-
-    expect(isExpectedUserError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/Company slug 'missing-co' was not found/);
-  });
-
-  it('on residual global ambiguity (not in namespace) gives actionable --company <uid> guidance', async () => {
-    // Caller belongs to no "acme"; the slug matches multiple strangers'
-    // companies. The server 409s with the colliding uids and the CLI must tell
-    // the user exactly how to disambiguate.
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(200, { available: true }))
-      .mockResolvedValueOnce(
-        mockResponse(409, {
-          error:
-            'Slug "acme" of type "company" matches 2 live entities — caller must disambiguate by uid or ownerUid',
-          type: 'company',
-          slug: 'acme',
-          uids: ['cmp_one', 'cmp_two'],
-        }),
-      );
-    const err = await getEntityUid('tok', { companySlug: 'acme' }).catch(
-      (e: Error) => e,
-    );
-    expect(err).toBeInstanceOf(Error);
-    expect((err as Error).message).toMatch(/matches 2 companies/);
-    expect((err as Error).message).toMatch(/--company cmp_one/);
-    expect((err as Error).message).toMatch(/--company cmp_two/);
-  });
-
-  it('lists candidate companies when membership fallback is ambiguous', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        memberships: [
-          { companyUid: 'cmp_a', role: 'member', status: 'active', membershipKey: 'k1' },
-          { companyUid: 'cmp_b', role: 'owner', status: 'active', membershipKey: 'k2' },
-        ],
-      }),
-    );
-    const err = await getEntityUid('tok', {}).catch((e: Error) => e);
-    expect(err).toBeInstanceOf(Error);
-    expect((err as Error).message).toMatch(/--company cmp_a/);
-    expect((err as Error).message).toMatch(/--company cmp_b/);
-  });
-
-  it('falls back to membership lookup when neither personal nor slug is set', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        memberships: [
-          {
-            companyUid: 'cmp_only',
-            role: 'member',
-            status: 'active',
-            membershipKey: 'k',
-          },
-        ],
-      }),
-    );
-    const uid = await getEntityUid('tok', {});
-    expect(uid).toBe('cmp_only');
-    const url = fetchMock.mock.calls[0][0] as string;
-    expect(url).toMatch(/\/membership\/me/);
-  });
-});
-
-describe('getCompanyUid company-selection classification (HQ-CLI-7)', () => {
-  // The exact production scenario: a user with multiple active memberships runs
-  // a command with no --company. The prompt is expected, user-actionable guidance
-  // — it must be a CompanySelectionError so the top-level handler prints it and
-  // SKIPS Sentry capture, not a plain Error that gets shipped as a fatal.
-  it('throws a CompanySelectionError (not a plain Error) on multiple active memberships', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        memberships: [
-          { companyUid: 'cmp_a', role: 'member', status: 'active', membershipKey: 'k1' },
-          { companyUid: 'cmp_b', role: 'owner', status: 'active', membershipKey: 'k2' },
-          { companyUid: 'cmp_c', role: 'member', status: 'active', membershipKey: 'k3' },
-        ],
-      }),
-    );
-    const err = await getCompanyUid('tok', undefined).catch((e: unknown) => e);
-    expect(isCompanySelectionError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/Multiple active companies found/);
-    expect((err as Error).message).toMatch(/--company cmp_a/);
-  });
-
-  it('throws a CompanySelectionError when the caller has no active memberships', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        memberships: [
-          { companyUid: 'cmp_x', role: 'member', status: 'invited', membershipKey: 'k' },
-        ],
-      }),
-    );
-    const err = await getCompanyUid('tok', undefined).catch((e: unknown) => e);
-    expect(isCompanySelectionError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/No active company memberships/);
-  });
-
-  it('resolves silently to the single active membership (no selection error)', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        memberships: [
-          { companyUid: 'cmp_only', role: 'member', status: 'active', membershipKey: 'k' },
-        ],
-      }),
-    );
-    const uid = await getCompanyUid('tok', undefined);
-    expect(uid).toBe('cmp_only');
-  });
-
-  it('classifies the slug-collision (409, none in namespace) case as a selection error', async () => {
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(200, { available: true }))
-      .mockResolvedValueOnce(
-        mockResponse(409, {
-          error: 'Slug "acme" matches 2 live entities',
-          uids: ['cmp_one', 'cmp_two'],
-        }),
-      );
-    const err = await getCompanyUid('tok', 'acme').catch((e: unknown) => e);
-    expect(isCompanySelectionError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/--company cmp_one/);
-  });
-
-  // A genuine fault must NOT be classified as a selection prompt — it still
-  // reports to Sentry. Guards against over-broadening the carve-out.
-  it('does NOT classify a failed membership fetch as a selection error (still reports)', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(401, { error: 'unauthorized' }));
-    const err = await getCompanyUid('tok', undefined).catch((e: unknown) => e);
-    expect(isCompanySelectionError(err)).toBe(false);
-    expect((err as Error).message).toMatch(/Failed to fetch memberships/);
-  });
-});
-
-describe('resolveCompanyUid 401 → AuthError', () => {
-  it('short-circuits when check-slug/me returns 401 and does not call global by-slug', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(401, { error: 'Unauthorized' }));
-
-    const err = await getEntityUid('tok', { companySlug: 'liverecover' }).catch(
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/hq login/);
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(fetchMock.mock.calls[0][0]).toMatch(/\/entity\/check-slug\/me/);
-  });
-
-  it('classifies a 401 from the global by-slug fallback as an AuthError', async () => {
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(404, { available: true }))
-      .mockResolvedValueOnce(mockResponse(401, { error: 'Unauthorized' }));
-
-    const err = await getCompanyUid('tok', 'liverecover').catch(
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/hq login/);
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-  });
-
-  it('keeps a global 409 slug collision on the CompanySelectionError path', async () => {
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(200, { available: true }))
-      .mockResolvedValueOnce(
-        mockResponse(409, {
-          error: 'Slug "liverecover" matches 2 live entities',
-          uids: ['cmp_one', 'cmp_two'],
-        }),
-      );
-
-    const err = await getCompanyUid('tok', 'liverecover').catch(
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(false);
-    expect(isCompanySelectionError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/--company cmp_one/);
-  });
-
-  it('keeps a global 500 as a plain company-resolution Error', async () => {
-    fetchMock
-      .mockResolvedValueOnce(mockResponse(200, { available: true }))
-      .mockResolvedValueOnce(mockResponse(500, { error: 'Internal Server Error' }));
-
-    const err = await getCompanyUid('tok', 'liverecover').catch(
-      (e: unknown) => e,
-    );
-
-    expect(err).toBeInstanceOf(Error);
-    expect(isAuthError(err)).toBe(false);
-    expect((err as Error).message).toMatch(/Failed to resolve company slug/);
-  });
-});
-
-describe('vaultApiFetch breadcrumb URL sanitization', () => {
-  it('redacts query string in request breadcrumb data.url', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(200, {}));
-    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
-    addBreadcrumbMock.mockClear();
-    await vaultApiFetch({ token: 'tok', path: '/v1/foo', query: { path: 'secrets/my-secret', reveal: 'true' } });
-    const requestCrumb = addBreadcrumbMock.mock.calls[0][0];
-    expect(requestCrumb.data?.url).not.toMatch(/secrets%2F|reveal=true/);
-    expect(requestCrumb.data?.url).toContain('?<redacted>');
-  });
-
-  it('omits query delimiter when there is no query string', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(200, {}));
-    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
-    addBreadcrumbMock.mockClear();
-    await vaultApiFetch({ token: 'tok', path: '/v1/bar' });
-    const requestCrumb = addBreadcrumbMock.mock.calls[0][0];
-    expect(requestCrumb.data?.url).not.toContain('?');
-  });
-
-  it('redacts query string in non-2xx error breadcrumb data.url', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(401, {}));
-    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
-    addBreadcrumbMock.mockClear();
-    await vaultApiFetch({ token: 'tok', path: '/v1/baz', query: { action: 'generate-token' } });
-    const errorCrumb = addBreadcrumbMock.mock.calls[1][0];
-    expect(errorCrumb.data?.url).not.toContain('generate-token');
-    expect(errorCrumb.data?.url).toContain('?<redacted>');
-  });
-});
-
-describe('vaultApiFetch abort signals', () => {
-  it('passes an optional abort signal to fetch', async () => {
-    fetchMock.mockResolvedValueOnce(mockResponse(200, {}));
-    const controller = new AbortController();
-
-    await vaultApiFetch({
-      token: 'tok',
-      path: '/v1/telemetry/events',
-      signal: controller.signal,
-    });
-
-    expect(fetchMock).toHaveBeenCalledWith(
-      expect.any(String),
-      expect.objectContaining({ signal: controller.signal }),
-    );
-  });
-});
-
-describe('vaultApiFetch plan-limit peek (US-016, no-clone body drain)', () => {
-  it('JSON ok response is still fully readable by the caller after peek', async () => {
-    const payload = { ok: true, items: [1, 2, 3], planLimits: undefined };
-    fetchMock.mockResolvedValueOnce(mockResponse(200, payload));
-
-    const res = await vaultApiFetch({ token: 'tok', path: '/v1/items' });
-    expect(res.ok).toBe(true);
-    expect(res.status).toBe(200);
-    const body = await res.json();
-    expect(body).toEqual(payload);
-  });
-
-  it('records planLimits payload (observable via emitPlanLimitNag)', async () => {
-    fetchMock.mockResolvedValueOnce(
-      mockResponse(200, {
-        ok: true,
-        planLimits: {
-          users: { used: 9, limit: 10, over: false },
-        },
-      }),
-    );
-
-    const res = await vaultApiFetch({ token: 'tok', path: '/v1/items' });
-    // Caller can still read the body.
-    await expect(res.json()).resolves.toMatchObject({ ok: true });
-
-    const lines: string[] = [];
-    emitPlanLimitNag({
-      write: (s) => {
-        lines.push(s);
-      },
-      statePath: tmpNagStatePath('recorded'),
-    });
-    expect(lines).toHaveLength(1);
-    expect(lines[0]).toMatch(/HQ free plan/i);
-    expect(lines[0]).toMatch(/users at 9\/10/);
-  });
-
-  it('non-JSON content-type body is not buffered (response returned untouched)', async () => {
-    const original = new Response(new Uint8Array([1, 2, 3, 4]), {
-      status: 200,
-      statusText: 'OK',
-      headers: { 'Content-Type': 'application/octet-stream' },
-    });
-    fetchMock.mockResolvedValueOnce(original);
-
-    const res = await vaultApiFetch({ token: 'tok', path: '/v1/download' });
-    // Same object identity — peek must not re-wrap non-JSON bodies.
-    expect(res).toBe(original);
-    const buf = new Uint8Array(await res.arrayBuffer());
-    expect(Array.from(buf)).toEqual([1, 2, 3, 4]);
-  });
-
-  it('malformed JSON does not throw and body is still readable', async () => {
-    const raw = '{not-valid-json';
-    fetchMock.mockResolvedValueOnce(
-      new Response(raw, {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-
-    let res: Response;
-    await expect(
-      (async () => {
-        res = await vaultApiFetch({ token: 'tok', path: '/v1/broken' });
-        return res;
-      })(),
-    ).resolves.toBeDefined();
-
-    expect(res!.ok).toBe(true);
-    await expect(res!.text()).resolves.toBe(raw);
-
-    // Malformed body must not record plan limits.
-    const lines: string[] = [];
-    emitPlanLimitNag({
-      write: (s) => {
-        lines.push(s);
-      },
-      statePath: tmpNagStatePath('malformed'),
-    });
-    expect(lines).toHaveLength(0);
-  });
-
-  it('non-ok responses are returned untouched', async () => {
-    const original = mockResponse(404, { error: 'not found' });
-    fetchMock.mockResolvedValueOnce(original);
-
-    const res = await vaultApiFetch({ token: 'tok', path: '/v1/missing' });
-    expect(res).toBe(original);
-    expect(res.status).toBe(404);
-    await expect(res.json()).resolves.toEqual({ error: 'not found' });
-  });
-
-  it('accepts application/*+json content-types for peek', async () => {
-    fetchMock.mockResolvedValueOnce(
-      new Response(
-        JSON.stringify({
-          planLimits: { seats: { used: 8, limit: 10, over: false } },
-        }),
-        {
-          status: 200,
-          headers: { 'Content-Type': 'application/vnd.api+json' },
-        },
-      ),
-    );
-
-    const res = await vaultApiFetch({ token: 'tok', path: '/v1/vnd' });
-    await expect(res.json()).resolves.toMatchObject({
-      planLimits: { seats: { used: 8, limit: 10, over: false } },
-    });
-
-    const lines: string[] = [];
-    emitPlanLimitNag({
-      write: (s) => {
-        lines.push(s);
-      },
-      statePath: tmpNagStatePath('vnd'),
-    });
-    expect(lines).toHaveLength(1);
-    expect(lines[0]).toMatch(/seats at 8\/10/);
-  });
-});