@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/commands/integrations.test.ts

@@ -1,633 +0,0 @@
-/**
- * Unit tests for `hq integrations list|tools|call|approve` (integrations.ts).
- *
- * Coverage:
- *   - toolPrefixForProvider — factory-prefix stripping + slug normalization
- *     (must mirror hq-pro's factoryToolPrefix so composed HQ tool names hit
- *     registered gateway tools)
- *   - selectConnection — by id, by provider (factory:-prefixed match),
- *     single-active default, and the guiding errors for none/ambiguous
- *   - unwrapGatewayResult — MCP text-content unwrapping + non-JSON fallback
- *   - queued-outcome detection + the approve hint in `call`
- *   - approve — posts to the confirm route and prints the unwrapped result
- */
-
-import { Command } from "commander";
-import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from "vitest";
-
-vi.mock("../utils/cognito-session.js", async (importOriginal) => {
-  const original =
-    await importOriginal<typeof import("../utils/cognito-session.js")>();
-  return {
-    ...original,
-    ensureCognitoIdToken: vi.fn(async () => "test-id-token"),
-  };
-});
-
-vi.mock("../utils/vault-api.js", async (importOriginal) => {
-  const original = await importOriginal<typeof import("../utils/vault-api.js")>();
-  return {
-    ...original,
-    getCompanyUid: vi.fn(async () => "cmp_acme"),
-    vaultApiFetch: vi.fn(),
-  };
-});
-
-import { vaultApiFetch } from "../utils/vault-api.js";
-import { AuthError, isAuthError } from "../utils/auth-error.js";
-import {
-  IntegrationsCliError,
-  queuedOutcome,
-  registerIntegrationsCommand,
-  selectConnection,
-  toolPrefixForProvider,
-  unwrapGatewayResult,
-} from "./integrations.js";
-
-const vaultApiFetchMock = vi.mocked(vaultApiFetch);
-
-function jsonResponse(body: unknown, status = 200): Response {
-  return {
-    ok: status >= 200 && status < 300,
-    status,
-    json: async () => body,
-  } as unknown as Response;
-}
-
-function connectionsResponse() {
-  return jsonResponse({
-    connections: [
-      {
-        id: "acct_factory_linear",
-        provider: "factory:linear",
-        status: "connected",
-        writePolicy: "confirm",
-        installation: { displayName: "Linear MCP server", status: "installed" },
-      },
-    ],
-  });
-}
-
-function gatewayTextResponse(payload: unknown) {
-  return jsonResponse({
-    jsonrpc: "2.0",
-    id: "x",
-    result: { content: [{ type: "text", text: JSON.stringify(payload) }] },
-  });
-}
-
-async function runCli(argv: string[]): Promise<void> {
-  const program = new Command();
-  program.exitOverride();
-  registerIntegrationsCommand(program);
-  await program.parseAsync(["node", "hq", ...argv]);
-}
-
-let logSpy: MockInstance;
-beforeEach(() => {
-  logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
-});
-afterEach(() => {
-  vi.clearAllMocks();
-  logSpy.mockRestore();
-});
-
-function logged(): string {
-  return logSpy.mock.calls.map((call) => call.join(" ")).join("\n");
-}
-
-describe("toolPrefixForProvider", () => {
-  it("strips the factory: prefix and normalizes to the gateway's tool prefix", () => {
-    expect(toolPrefixForProvider("factory:linear")).toBe("linear");
-    expect(toolPrefixForProvider("factory:google-workspace")).toBe("google.workspace");
-    expect(toolPrefixForProvider("Linear")).toBe("linear");
-  });
-});
-
-describe("selectConnection", () => {
-  const linear = {
-    id: "acct_1",
-    provider: "factory:linear",
-    status: "connected",
-  };
-  const notion = {
-    id: "acct_2",
-    provider: "factory:notion",
-    status: "connected",
-  };
-
-  it("matches --provider against the bare factory slug", () => {
-    expect(selectConnection([linear, notion], { provider: "linear" })).toBe(linear);
-  });
-
-  it("defaults to the single active connection", () => {
-    expect(selectConnection([linear], {})).toBe(linear);
-  });
-
-  it("guides on ambiguity and on unknown providers", () => {
-    expect(() => selectConnection([linear, notion], {})).toThrow(/--provider/);
-    expect(() => selectConnection([linear], { provider: "jira" })).toThrow(
-      /Connected: linear/,
-    );
-    expect(() => selectConnection([], {})).toThrow(/No connected apps yet/);
-  });
-
-  it("resolves an explicit connection id even when revoked", () => {
-    const revoked = { ...linear, status: "revoked" };
-    expect(selectConnection([revoked], { connection: "acct_1" })).toBe(revoked);
-    expect(() => selectConnection([revoked], { connection: "acct_9" })).toThrow(
-      IntegrationsCliError,
-    );
-  });
-});
-
-describe("unwrapGatewayResult + queuedOutcome", () => {
-  it("unwraps MCP text content into the inner JSON payload", () => {
-    expect(
-      unwrapGatewayResult({
-        content: [{ type: "text", text: '{"tools":[{"name":"list_issues"}]}' }],
-      }),
-    ).toEqual({ tools: [{ name: "list_issues" }] });
-  });
-
-  it("falls back to raw text / raw result on non-JSON shapes", () => {
-    expect(
-      unwrapGatewayResult({ content: [{ type: "text", text: "plain" }] }),
-    ).toBe("plain");
-    expect(unwrapGatewayResult({ other: 1 })).toEqual({ other: 1 });
-  });
-
-  it("detects the queued-for-approval outcome", () => {
-    expect(
-      queuedOutcome({ queuedForApproval: true, queueId: "cq_1" }),
-    ).toMatchObject({ queueId: "cq_1" });
-    expect(queuedOutcome({ issues: [] })).toBeNull();
-  });
-});
-
-describe("hq integrations tools", () => {
-  it("composes the read tool name from the connection's provider and lists upstream tools", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        gatewayTextResponse({
-          tools: [{ name: "list_issues", title: "List issues" }],
-        }),
-      );
-
-    await runCli(["integrations", "tools", "--provider", "linear"]);
-
-    const gatewayCall = vaultApiFetchMock.mock.calls[1]![0];
-    expect(gatewayCall).toMatchObject({
-      path: "/v1/integrations/mcp",
-      method: "POST",
-    });
-    expect(gatewayCall.body).toMatchObject({
-      method: "tools/call",
-      params: {
-        companyUid: "cmp_acme",
-        name: "linear.mcp.tools.list",
-        arguments: { companyUid: "cmp_acme", connectionId: "acct_factory_linear" },
-      },
-    });
-    expect(logged()).toContain("list_issues");
-  });
-});
-
-describe("hq integrations call", () => {
-  it("sends the upstream tool + args + idempotency key and prints the result", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(gatewayTextResponse({ issues: [{ id: "DEV-1" }] }));
-
-    await runCli([
-      "integrations",
-      "call",
-      "list_issues",
-      "--provider",
-      "linear",
-      "--args",
-      '{"assignee":"me"}',
-      "--idempotency-key",
-      "stable-key",
-    ]);
-
-    const gatewayCall = vaultApiFetchMock.mock.calls[1]![0];
-    expect(gatewayCall.body).toMatchObject({
-      params: {
-        name: "linear.mcp.tools.call",
-        arguments: {
-          toolName: "list_issues",
-          arguments: { assignee: "me" },
-          idempotencyKey: "stable-key",
-        },
-      },
-    });
-    expect(logged()).toContain("DEV-1");
-  });
-
-  it("surfaces a queued outcome with the exact approve command", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        gatewayTextResponse({
-          queuedForApproval: true,
-          status: "queued",
-          queueId: "cq_123",
-          connectionId: "acct_factory_linear",
-        }),
-      );
-
-    await runCli([
-      "integrations",
-      "call",
-      "save_issue",
-      "--provider",
-      "linear",
-      "--args",
-      "{}",
-    ]);
-
-    const output = logged();
-    expect(output).toContain("Queued for approval");
-    expect(output).toContain("hq integrations approve cq_123 --provider linear");
-  });
-
-  it("rejects non-object --args with a usage hint", async () => {
-    await expect(
-      runCli(["integrations", "call", "t", "--provider", "linear", "--args", "[1]"]),
-    ).rejects.toThrow(/--args must be a JSON object/);
-    expect(vaultApiFetchMock).not.toHaveBeenCalled();
-  });
-
-  it("marks non-object --args as expected", async () => {
-    try {
-      await runCli(["integrations", "call", "t", "--provider", "linear", "--args", "[1]"]);
-      throw new Error("expected runCli to throw");
-    } catch (err) {
-      expect(err).toBeInstanceOf(IntegrationsCliError);
-      expect((err as IntegrationsCliError).expected).toBe(true);
-    }
-  });
-});
-
-describe("hq integrations approve", () => {
-  it("posts the decision to the confirm route and prints the unwrapped result", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        jsonResponse({
-          status: "resumed",
-          result: { content: [{ type: "text", text: '{"issues":[]}' }] },
-        }),
-      );
-
-    await runCli(["integrations", "approve", "cq_123", "--provider", "linear"]);
-
-    const confirmCall = vaultApiFetchMock.mock.calls[1]![0];
-    expect(confirmCall).toMatchObject({
-      path: "/v1/integrations/confirm/cq_123/approve",
-      method: "POST",
-      body: { companyUid: "cmp_acme", connectionId: "acct_factory_linear" },
-    });
-    expect(logged()).toContain("Approved");
-  });
-});
-
-describe("expected integrations errors", () => {
-  const linear = {
-    id: "acct_1",
-    provider: "factory:linear",
-    status: "connected",
-  };
-  const notion = {
-    id: "acct_2",
-    provider: "factory:notion",
-    status: "connected",
-  };
-
-  it("marks a non-owner 403 approve as expected (skips Sentry) and preserves the message", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        jsonResponse(
-          { error: "Only a company owner can approve or reject queued integration writes" },
-          403,
-        ),
-      );
-
-    try {
-      await runCli(["integrations", "approve", "cq_123", "--provider", "linear"]);
-      throw new Error("expected runCli to throw");
-    } catch (err) {
-      expect(err).toBeInstanceOf(IntegrationsCliError);
-      expect((err as IntegrationsCliError).expected).toBe(true);
-      expect((err as Error).message).toContain("Only a company owner");
-    }
-  });
-
-  it("still captures a genuine server 500 on approve (expected === false)", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(jsonResponse({ error: "boom" }, 500));
-
-    try {
-      await runCli(["integrations", "approve", "cq_123", "--provider", "linear"]);
-      throw new Error("expected runCli to throw");
-    } catch (err) {
-      expect(err).toBeInstanceOf(IntegrationsCliError);
-      expect((err as IntegrationsCliError).expected).toBe(false);
-    }
-  });
-
-  it("marks reject 403 as expected too", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        jsonResponse(
-          { error: "Only a company owner can approve or reject queued integration writes" },
-          403,
-        ),
-      );
-
-    try {
-      await runCli(["integrations", "reject", "cq_123", "--provider", "linear"]);
-      throw new Error("expected runCli to throw");
-    } catch (err) {
-      expect(err).toBeInstanceOf(IntegrationsCliError);
-      expect((err as IntegrationsCliError).expected).toBe(true);
-    }
-
-    expect(vaultApiFetchMock.mock.calls[1]![0].path).toBe(
-      "/v1/integrations/confirm/cq_123/reject",
-    );
-  });
-
-  it("marks local connection selection usage errors as expected", () => {
-    for (const fn of [
-      () => selectConnection([], {}),
-      () => selectConnection([linear, notion], {}),
-      () => selectConnection([linear], { provider: "jira" }),
-    ]) {
-      try {
-        fn();
-        throw new Error("expected selectConnection to throw");
-      } catch (err) {
-        expect(err).toBeInstanceOf(IntegrationsCliError);
-        expect((err as IntegrationsCliError).expected).toBe(true);
-      }
-    }
-  });
-});
-
-// HQ-CLI-9: `hq integrations call get_board_info --provider monday …` hit a 401
-// on POST /v1/integrations/mcp while the caller's HQ session was rejected. The
-// old `callGateway` threw a plain, opaque `IntegrationsCliError("Integration
-// gateway request failed (HTTP 401).")` that shipped to Sentry as an
-// unactionable fatal. A gateway 401 is an expired/missing session — the same
-// expected auth state the vault company-resolution paths already raise as
-// `AuthError` (HQ-CLI-8). The fix routes every integration-gateway 401 through
-// that typed AuthError so the user gets one actionable "run `hq login`" message
-// and Sentry is skipped, while genuine 4xx/5xx faults keep their behavior.
-describe("integration gateway 401 → AuthError (HQ-CLI-9)", () => {
-  it("throws an actionable AuthError (not an opaque IntegrationsCliError) when callGateway 401s", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(jsonResponse({ error: "Unauthorized" }, 401));
-
-    const err = await runCli([
-      "integrations",
-      "call",
-      "get_board_info",
-      "--provider",
-      "linear",
-      "--args",
-      "{}",
-    ]).then(
-      () => {
-        throw new Error("expected runCli to throw");
-      },
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(true);
-    expect(err).toBeInstanceOf(AuthError);
-    expect((err as Error).message).toMatch(/hq login/);
-    // The gateway request was actually attempted (connections + gateway call).
-    expect(vaultApiFetchMock.mock.calls[1]![0].path).toBe("/v1/integrations/mcp");
-  });
-
-  it("throws an AuthError when the admin (fetchConnections) call 401s", async () => {
-    vaultApiFetchMock.mockResolvedValueOnce(jsonResponse({ error: "Unauthorized" }, 401));
-
-    const err = await runCli(["integrations", "list"]).then(
-      () => {
-        throw new Error("expected runCli to throw");
-      },
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/hq login/);
-  });
-
-  it("throws an AuthError when an approve confirm call 401s", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(jsonResponse({ error: "Unauthorized" }, 401));
-
-    const err = await runCli([
-      "integrations",
-      "approve",
-      "cq_123",
-      "--provider",
-      "linear",
-    ]).then(
-      () => {
-        throw new Error("expected runCli to throw");
-      },
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(true);
-    expect((err as Error).message).toMatch(/hq login/);
-  });
-
-  // Scope guards: only a 401 becomes an AuthError. A genuine server 500 still
-  // reports (expected === false), and a provider-level JSON-RPC error (HTTP 200
-  // with `message.error`) stays an IntegrationsCliError — so real faults and
-  // upstream tool errors are never misclassified as an auth state.
-  it("keeps a gateway 500 as a reporting IntegrationsCliError (not an AuthError)", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(jsonResponse({ error: "boom" }, 500));
-
-    const err = await runCli([
-      "integrations",
-      "call",
-      "get_board_info",
-      "--provider",
-      "linear",
-      "--args",
-      "{}",
-    ]).then(
-      () => {
-        throw new Error("expected runCli to throw");
-      },
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(false);
-    expect(err).toBeInstanceOf(IntegrationsCliError);
-    expect((err as IntegrationsCliError).expected).toBe(false);
-  });
-
-  it("keeps an upstream provider error (HTTP 200 message.error) as an IntegrationsCliError", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        jsonResponse({
-          jsonrpc: "2.0",
-          id: "x",
-          error: { code: -32050, message: "monday rejected the board id" },
-        }),
-      );
-
-    const err = await runCli([
-      "integrations",
-      "call",
-      "get_board_info",
-      "--provider",
-      "linear",
-      "--args",
-      "{}",
-    ]).then(
-      () => {
-        throw new Error("expected runCli to throw");
-      },
-      (e: unknown) => e,
-    );
-
-    expect(isAuthError(err)).toBe(false);
-    expect(err).toBeInstanceOf(IntegrationsCliError);
-    expect((err as Error).message).toMatch(/monday rejected the board id/);
-  });
-});
-
-// HQ-CLI-B: `hq integrations tools|call … --provider …` against a connection the
-// caller has NOT been granted returned HTTP 200 with a JSON-RPC error
-// { code: -32003, message: "You do not have access to this integration. Ask its
-// owner to share it with you.", data: { code: "IntegrationAccessDenied" } }.
-// `callGateway` threw an IntegrationsCliError WITHOUT `expected`, so it defaulted
-// to `expected === false` and the top-level handler shipped a GOVERNED, correct
-// access denial to Sentry as an error-level fatal — 40 identical, unfixable
-// events for one user. A caller-side JSON-RPC code (UNAUTHORIZED / INVALID_PARAMS)
-// is the analog of a client 4xx and must be printed to the user, not captured;
-// genuine server/provider/protocol faults must still report.
-describe("gateway JSON-RPC error classification (HQ-CLI-B)", () => {
-  function gatewayJsonRpcError(code: number | undefined, message: string, data?: unknown) {
-    return jsonResponse({
-      jsonrpc: "2.0",
-      id: "x",
-      error: { ...(code == null ? {} : { code }), message, ...(data ? { data } : {}) },
-    });
-  }
-
-  async function runGatewayCall(): Promise<unknown> {
-    return runCli([
-      "integrations",
-      "call",
-      "get_board_info",
-      "--provider",
-      "linear",
-      "--args",
-      "{}",
-    ]).then(
-      () => {
-        throw new Error("expected runCli to throw");
-      },
-      (e: unknown) => e,
-    );
-  }
-
-  it("marks the access-denied gateway error (-32003) as expected and preserves its actionable message", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        gatewayJsonRpcError(
-          -32003,
-          "You do not have access to this integration. Ask its owner to share it with you.",
-          { code: "IntegrationAccessDenied" },
-        ),
-      );
-
-    const err = await runGatewayCall();
-
-    expect(err).toBeInstanceOf(IntegrationsCliError);
-    // The regression: this was `false` and flooded Sentry with a governed denial.
-    expect((err as IntegrationsCliError).expected).toBe(true);
-    // A connection-level denial is NOT an expired session — never an AuthError.
-    expect(isAuthError(err)).toBe(false);
-    expect((err as Error).message).toContain("do not have access to this integration");
-  });
-
-  it("also marks access-denied as expected on the `tools` path (same callGateway seam)", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(
-        gatewayJsonRpcError(
-          -32003,
-          "You do not have access to this integration. Ask its owner to share it with you.",
-        ),
-      );
-
-    const err = await runCli(["integrations", "tools", "--provider", "linear"]).then(
-      () => {
-        throw new Error("expected runCli to throw");
-      },
-      (e: unknown) => e,
-    );
-
-    expect(err).toBeInstanceOf(IntegrationsCliError);
-    expect((err as IntegrationsCliError).expected).toBe(true);
-  });
-
-  it("marks an invalid-params gateway error (-32602) as expected", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(gatewayJsonRpcError(-32602, "Unknown integration tool: get_board_info"));
-
-    const err = await runGatewayCall();
-
-    expect(err).toBeInstanceOf(IntegrationsCliError);
-    expect((err as IntegrationsCliError).expected).toBe(true);
-  });
-
-  it("still reports genuine provider/internal/conflict gateway faults (expected === false)", async () => {
-    // -32050 PROVIDER_ERROR, -32603 INTERNAL_ERROR, and -32009 CONFLICT (which the
-    // gateway raises for a confirm queue being unavailable or an owner
-    // notification failing) are real faults that must keep reaching Sentry.
-    for (const code of [-32050, -32603, -32009]) {
-      vaultApiFetchMock
-        .mockResolvedValueOnce(connectionsResponse())
-        .mockResolvedValueOnce(gatewayJsonRpcError(code, "gateway fault"));
-
-      const err = await runGatewayCall();
-
-      expect(err).toBeInstanceOf(IntegrationsCliError);
-      expect((err as IntegrationsCliError).expected).toBe(false);
-      vaultApiFetchMock.mockClear();
-    }
-  });
-
-  it("reports a gateway error with no JSON-RPC code (unclassified → expected === false)", async () => {
-    vaultApiFetchMock
-      .mockResolvedValueOnce(connectionsResponse())
-      .mockResolvedValueOnce(gatewayJsonRpcError(undefined, "codeless failure"));
-
-    const err = await runGatewayCall();
-
-    expect(err).toBeInstanceOf(IntegrationsCliError);
-    expect((err as IntegrationsCliError).expected).toBe(false);
-  });
-});