@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.5

package/packages/identity/src/providers/cloudflare/oauth.js

@@ -1,10 +1,9 @@
 const CLOUDFLARE_AUTH_URL = 'https://dash.cloudflare.com/oauth2/auth';
 const CLOUDFLARE_TOKEN_URL = 'https://dash.cloudflare.com/oauth2/token';
 
-// Identity-only login should not request the full resource-access scope set
-// used elsewhere for the Local Studio Cloudflare *connection* (deploy/d1/r2/etc).
-// account-settings.read is enough to resolve the account for userinfo.
-const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read offline_access';
+// Identity-only login: account identity + user details (email/name via /v4/user).
+// Do NOT request the resource-access scope set used by the Cloudflare *connection* flow.
+const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read user-details.read offline_access';
 
 /** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
 export function getCloudflareAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {

package/packages/identity/src/providers/cloudflare/profile.js

@@ -1,26 +1,61 @@
 const CLOUDFLARE_USERINFO_URL = 'https://dash.cloudflare.com/oauth2/userinfo';
+const CLOUDFLARE_API_USER_URL = 'https://api.cloudflare.com/client/v4/user';
 
 /**
  * Fetch the authenticated Cloudflare user's identity.
- * Response shape not fully verified against a live token yet — this reads
- * defensively (sub/id/user_id, email, name) rather than assuming Cloudflare's
- * exact OIDC field names. Confirm the real shape on first live login and
- * tighten this if fields differ.
+ *
+ * OIDC userinfo (`/oauth2/userinfo`) structurally returns `sub` only.
+ * Email/name require `user-details.read` and a second call to `/client/v4/user`
+ * (`data.result.*`, not top-level fields).
+ *
  * @param {string} accessToken
+ * @param {{ fetchImpl?: typeof fetch }} [opts]
  */
-export async function fetchCloudflareProfile(accessToken) {
+export async function fetchCloudflareProfile(accessToken, opts = {}) {
+  const token = String(accessToken || '').trim();
+  if (!token) return null;
+  const fetchImpl = opts.fetchImpl || fetch;
   try {
-    const res = await fetch(CLOUDFLARE_USERINFO_URL, {
-      headers: { Authorization: `Bearer ${accessToken}` },
+    const userinfoRes = await fetchImpl(CLOUDFLARE_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${token}` },
     });
-    if (!res.ok) return null;
-    const data = await res.json();
-    if (!data) return null;
+    if (!userinfoRes.ok) return null;
+    const userinfo = await userinfoRes.json().catch(() => null);
+    if (!userinfo) return null;
+
+    const sub = userinfo.sub || userinfo.id || userinfo.user_id || null;
+    let email = typeof userinfo.email === 'string' ? userinfo.email : null;
+    let name = typeof userinfo.name === 'string'
+      ? userinfo.name
+      : (typeof userinfo.display_name === 'string' ? userinfo.display_name : null);
+
+    // Cloudflare userinfo does not return email/name — enrich from /v4/user.
+    if (!email || !name) {
+      try {
+        const apiRes = await fetchImpl(CLOUDFLARE_API_USER_URL, {
+          headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+        });
+        if (apiRes.ok) {
+          const body = await apiRes.json().catch(() => null);
+          const result = body?.result && typeof body.result === 'object' ? body.result : null;
+          if (result) {
+            if (!email && typeof result.email === 'string') email = result.email;
+            if (!name && typeof result.first_name === 'string' && typeof result.last_name === 'string') {
+              name = `${result.first_name} ${result.last_name}`.trim() || null;
+            }
+            if (!name && typeof result.name === 'string') name = result.name;
+          }
+        }
+      } catch {
+        // Non-fatal: identity can proceed with sub alone.
+      }
+    }
+
     return {
-      sub: data.sub || data.id || data.user_id || data.account_id || null,
-      email: data.email || null,
-      name: data.name || data.display_name || null,
-      raw: data,
+      sub: sub || null,
+      email,
+      name,
+      raw: userinfo,
     };
   } catch {
     return null;

package/packages/identity/src/providers/iam/index.js

@@ -9,13 +9,16 @@ import {
 } from './oauth.js';
 import { fetchIamProfile } from './profile.js';
 import { normalizeIamIdentity } from './mapper.js';
-import { DEFAULT_IAM_ORIGIN } from '../../contracts/auth-config.js';
+import { resolveIamIssuer } from '../../contracts/auth-config.js';
 
 /**
- * @param {string} [origin]
+ * @param {string} origin Absolute IAM issuer origin (required — no DEFAULT_*).
  */
-export function createIamIdentityProvider(origin = DEFAULT_IAM_ORIGIN) {
-  const resolvedOrigin = String(origin || DEFAULT_IAM_ORIGIN).replace(/\/+$/, '');
+export function createIamIdentityProvider(origin) {
+  const resolvedOrigin = String(origin || '').replace(/\/+$/, '');
+  if (!resolvedOrigin) {
+    throw new Error('IAM_OAUTH_ISSUER is required to create the IAM identity provider');
+  }
   return createIdentityProvider({
     id: 'iam',
     authorizeUrl: (input) => getIamAuthUrl({ ...input, origin: resolvedOrigin }),
@@ -25,7 +28,26 @@ export function createIamIdentityProvider(origin = DEFAULT_IAM_ORIGIN) {
   });
 }
 
-export const IamProvider = createIamIdentityProvider();
+/**
+ * Registry singleton — resolves IAM_OAUTH_ISSUER from env/input at call time.
+ * No baked-in product host.
+ */
+export const IamProvider = createIdentityProvider({
+  id: 'iam',
+  authorizeUrl: (input) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return getIamAuthUrl({ ...input, origin });
+  },
+  exchangeCode: (input) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return exchangeIamCode({ ...input, origin });
+  },
+  getProfile: (accessToken, input = {}) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return fetchIamProfile({ origin, accessToken });
+  },
+  normalizeIdentity: normalizeIamIdentity,
+});
 
 export {
   getIamAuthUrl,

package/packages/identity/src/server/identity-service.js

@@ -61,6 +61,11 @@ export function createIdentityService(config) {
     return match ? decodeURIComponent(match[1]) : null;
   }
 
+  function parseBearerSessionId(authorization) {
+    const match = String(authorization || '').match(/^Bearer\s+([^\s]+)$/i);
+    return match ? match[1] : null;
+  }
+
   return Object.freeze({
     cookieName,
     app,
@@ -108,7 +113,8 @@ export function createIdentityService(config) {
     },
 
     async sessionFromRequest(request) {
-      const sessionId = parseSessionId(request.headers.get('Cookie'));
+      const sessionId = parseBearerSessionId(request.headers.get('Authorization'))
+        || parseSessionId(request.headers.get('Cookie'));
       if (!sessionId) return null;
       const session = await adapter.getSession(sessionId);
       if (!session) return null;
@@ -118,7 +124,8 @@ export function createIdentityService(config) {
     },
 
     async logout(request) {
-      const sessionId = parseSessionId(request.headers.get('Cookie'));
+      const sessionId = parseBearerSessionId(request.headers.get('Authorization'))
+        || parseSessionId(request.headers.get('Cookie'));
       if (sessionId) await adapter.revokeSession(sessionId);
       return { ok: true };
     },
@@ -152,6 +159,28 @@ export function createIdentityService(config) {
       return { ok: true, authUserId: user.id, sessionId: session.id, session };
     },
 
+    isNativeSessionRequest(request) {
+      const marker = String(request?.headers?.get?.('X-AgentSam-Native-Client') || '').toLowerCase();
+      return marker === '1' || marker === 'true' || marker === 'native';
+    },
+
+    buildNativeLoginSuccessResponse(result, nextPath) {
+      const redirect = resolvePostLoginPath(nextPath);
+      return jsonResponse({
+        ok: true,
+        redirect,
+        session_id: result.sessionId,
+        expires_at: result.session?.expires_at ?? null,
+        user: result.user
+          ? {
+              id: result.user.id,
+              email: result.user.email,
+              displayName: result.user.display_name ?? null,
+            }
+          : null,
+      });
+    },
+
     buildLoginSuccessResponse(request, sessionId, nextPath) {
       const redirect = resolvePostLoginPath(nextPath);
       return jsonResponse(

package/packages/identity/src/server/worker-router.js

@@ -12,6 +12,7 @@ import { fetchCloudflareProfile } from '../providers/cloudflare/profile.js';
 import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
 import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { resolveOAuthCredentialLane } from '../oauth/credentials.js';
+import { handleGoogleDesktopExchangeRequest } from '../oauth/google-desktop-exchange.js';
 import { iamPlatformOAuthCallback, iamPlatformOAuthStart } from '../oauth/iam-platform.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from '../oauth/pkce.js';
 
@@ -23,6 +24,10 @@ function escapeHtml(value) {
     .replace(/"/g, '"');
 }
 
+function resolveLoginPath(identity) {
+  return identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN) || '/auth/login';
+}
+
 function resolveKv(env) {
   return env?.SESSION_CACHE || env?.KV || null;
 }
@@ -115,6 +120,9 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     await adapter.logAuthEvent({
       userId: result.user.id, eventType: 'login', status: 'ok', provider: 'email', request,
     });
+    if (identity.isNativeSessionRequest(request)) {
+      return identity.buildNativeLoginSuccessResponse(result, body.next);
+    }
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -128,6 +136,9 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!result.ok) {
       return jsonResponse({ ok: false, error: result.error }, 400);
     }
+    if (identity.isNativeSessionRequest(request)) {
+      return identity.buildNativeLoginSuccessResponse(result, body.next);
+    }
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -218,9 +229,13 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   }
 
   // ── OAuth ────────────────────────────────────────────────────────────────
-  // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_* take the
-  // matching /api/oauth/{provider}/start button when set.
+  // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_*/CLOUDFLARE_*
+  // take the matching /api/oauth/{provider}/start button when set.
+  // Desktop PKCE: GOOGLE_DESKTOP_CLIENT_ID → POST /api/oauth/google/desktop-exchange.
   // Canonical platform id = inneranimalmedia (legacy /api/oauth/iam/* still accepted).
+  if (path === '/api/oauth/google/desktop-exchange') {
+    return handleGoogleDesktopExchangeRequest(request, env);
+  }
   if (path === '/api/oauth/inneranimalmedia/callback' || path === '/api/oauth/iam/callback') {
     if (method === 'GET') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -367,91 +382,106 @@ async function oauthStart(request, env, identity, adapter, provider, creds) {
 
 async function oauthCallback(request, env, identity, adapter, provider, creds) {
   const url = new URL(request.url);
-  const code = url.searchParams.get('code');
-  const state = url.searchParams.get('state');
-  const err = url.searchParams.get('error');
-  if (err || !code || !state) {
-    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
-    return Response.redirect(`${url.origin}${loginPath()}?error=oauth_failed`, 302);
-  }
-  const saved = await adapter.consumeOAuthState(state);
-  if (!saved || saved.provider !== provider) {
-    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
-    return Response.redirect(`${url.origin}${loginPath()}?error=state_mismatch`, 302);
-  }
-  const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
-  let token;
-  let profile;
-  if (provider === 'google') {
-    token = await exchangeGoogleCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
+  const login = resolveLoginPath(identity);
+  try {
+    const code = url.searchParams.get('code');
+    const state = url.searchParams.get('state');
+    const err = url.searchParams.get('error');
+    if (err || !code || !state) {
+      await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
+      return Response.redirect(`${url.origin}${login}?error=oauth_failed`, 302);
     }
-    profile = await fetchGoogleProfile(token.access_token);
-  } else if (provider === 'cloudflare') {
-    token = await exchangeCloudflareCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
+    const saved = await adapter.consumeOAuthState(state);
+    if (!saved || saved.provider !== provider) {
+      await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
+      return Response.redirect(`${url.origin}${login}?error=state_mismatch`, 302);
     }
-    profile = await fetchCloudflareProfile(token.access_token);
-  } else {
-    token = await exchangeGithubCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
+    const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
+    let token;
+    let profile;
+    if (provider === 'google') {
+      token = await exchangeGoogleCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchGoogleProfile(token.access_token);
+    } else if (provider === 'cloudflare') {
+      token = await exchangeCloudflareCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchCloudflareProfile(token.access_token);
+    } else {
+      token = await exchangeGithubCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchGithubProfile(token.access_token);
+    }
+    if (!profile) {
+      return Response.redirect(`${url.origin}${login}?error=userinfo_failed`, 302);
     }
-    profile = await fetchGithubProfile(token.access_token);
-  }
-  if (!profile) {
-    return Response.redirect(`${url.origin}${loginPath()}?error=userinfo_failed`, 302);
-  }
 
-  let normalized;
-  if (provider === 'google') {
-    normalized = { subject: profile.sub, email: profile.email, name: profile.name };
-  } else if (provider === 'cloudflare') {
-    normalized = { subject: String(profile.sub), email: profile.email, name: profile.name || profile.email };
-  } else {
-    normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
-  }
+    let normalized;
+    if (provider === 'google') {
+      normalized = { subject: profile.sub, email: profile.email, name: profile.name };
+    } else if (provider === 'cloudflare') {
+      const subject = profile.sub || profile.email;
+      if (!subject) {
+        return Response.redirect(`${url.origin}${login}?error=userinfo_incomplete`, 302);
+      }
+      normalized = { subject: String(subject), email: profile.email, name: profile.name || profile.email };
+    } else {
+      normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
+    }
 
-  const result = await identity.provisionOAuthUser({
-    provider,
-    providerSubject: normalized.subject,
-    email: normalized.email,
-    displayName: normalized.name,
-  });
-  await adapter.logAuthEvent({
-    userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
-  });
+    const result = await identity.provisionOAuthUser({
+      provider,
+      providerSubject: normalized.subject,
+      email: normalized.email,
+      displayName: normalized.name,
+    });
+    await adapter.logAuthEvent({
+      userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
+    });
 
-  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
-  const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${loginPath()}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: globeUrl,
-      'Set-Cookie': res.headers.get('Set-Cookie') || '',
-    },
-  });
+    const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
+    const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
+    const globeUrl = `${url.origin}${login}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: globeUrl,
+        'Set-Cookie': res.headers.get('Set-Cookie') || '',
+      },
+    });
+  } catch (error) {
+    const message = String(error?.message || error || 'oauth_callback_failed');
+    console.error('oauth_callback_failed', provider, message);
+    const loginUrl = new URL(login, url.origin);
+    loginUrl.searchParams.set('error', 'oauth_callback_failed');
+    loginUrl.searchParams.set('provider', provider);
+    loginUrl.searchParams.set('detail', message.slice(0, 120));
+    return Response.redirect(loginUrl.toString(), 302);
+  }
 }
 
 export { createIdentityService, createCloudflareD1Adapter };

package/packages/identity/tests/auth-config.test.mjs

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import {
   AGENTSAM_AUTH_CONTRACT,
+  PLATFORM_ACCOUNT_ISSUER,
   buildApiAuthorizationHeaders,
   resolveApiKey,
   resolveBridgeKey,
@@ -23,8 +24,8 @@ describe('auth configuration contract', () => {
     assert.equal(resolveIamOrigin({ IAM_ORIGIN: 'https://legacy.example.test/' }), 'https://legacy.example.test');
   });
 
-  it('defaults issuer when neither IAM_OAUTH_ISSUER nor IAM_ORIGIN exists', () => {
-    assert.equal(resolveIamOrigin({}), 'https://inneranimalmedia.com');
+  it('falls back to the canonical platform account issuer when env is unset', () => {
+    assert.equal(resolveIamOrigin({}), PLATFORM_ACCOUNT_ISSUER);
   });
 
   it('resolves only AGENTSAM_API_KEY for delegated account API auth', () => {

package/packages/identity/tests/identity-init-scaffold.test.mjs

@@ -16,7 +16,10 @@ describe('identity init scaffold', () => {
     assert.ok(files['app/frontend/auth/signup.html'].includes('/api/auth/signup'));
     assert.ok(files['backend/src/index.js'].includes('handleIdentityWorkerRequest'));
     assert.ok(files['migrations/0001_identity_core.sql'].includes('CREATE TABLE IF NOT EXISTS company'));
+    assert.ok(files['migrations/0001_identity_core.sql'].includes('CREATE TABLE IF NOT EXISTS accounts'));
     assert.ok(files['migrations/0001_identity_core.sql'].includes('INSERT OR IGNORE INTO company'));
+    assert.ok(files['.env.example'].includes('GOOGLE_DESKTOP_CLIENT_ID'));
+    assert.ok(files['.env.example'].includes('CLOUDFLARE_OAUTH_CLIENT_ID'));
     assert.ok(files['app/frontend/shared/company-branding.js'].includes('/api/company'));
 
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'identity-init-'));

package/packages/identity/tests/identity-service.test.mjs

@@ -128,6 +128,22 @@ describe('identity service', () => {
     });
     assert.equal(login.ok, true);
 
+    const nativeRequest = new Request('https://example.test/api/auth/login', {
+      headers: { 'X-AgentSam-Native-Client': '1' },
+    });
+    assert.equal(identity.isNativeSessionRequest(nativeRequest), true);
+    const nativeResponse = identity.buildNativeLoginSuccessResponse(login, '/agentsam');
+    const nativeBody = await nativeResponse.json();
+    assert.equal(nativeBody.ok, true);
+    assert.equal(nativeBody.session_id, login.sessionId);
+    assert.equal(nativeBody.user.email, 'user@example.com');
+    assert.equal(nativeResponse.headers.get('set-cookie'), null);
+
+    const bearerCtx = await identity.sessionFromRequest(new Request('https://example.test/api/auth/me', {
+      headers: { Authorization: `Bearer ${login.sessionId}` },
+    }));
+    assert.equal(bearerCtx?.user?.email, 'user@example.com');
+
     const bad = await identity.loginWithPassword({
       email: 'user@example.com',
       password: 'wrong',

package/packages/identity/tests/native-session-worker.test.mjs

@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { handleIdentityWorkerRequest } from '../src/server/worker-router.js';
+
+function fakeDb() {
+  return {
+    prepare() {
+      return {
+        bind() {
+          return {
+            async run() { return { success: true }; },
+            async first() { return null; },
+            async all() { return { results: [] }; },
+          };
+        },
+      };
+    },
+  };
+}
+
+test('native login returns bearer session JSON instead of cookie response', async () => {
+  let nativeBranch = false;
+  const identity = {
+    app: { id: 'local-studio' },
+    routeRegistry: { resolve: () => '/agentsam' },
+    async loginWithPassword() {
+      return {
+        ok: true,
+        user: { id: 'au_test', email: 'user@example.com', display_name: 'User' },
+        sessionId: 'sess_native_123',
+        session: { expires_at: 1234567890 },
+      };
+    },
+    isNativeSessionRequest(request) {
+      return request.headers.get('X-AgentSam-Native-Client') === '1';
+    },
+    buildNativeLoginSuccessResponse(result) {
+      nativeBranch = true;
+      return Response.json({ ok: true, session_id: result.sessionId, user: result.user });
+    },
+    buildLoginSuccessResponse() {
+      throw new Error('cookie_login_response_should_not_run');
+    },
+  };
+
+  const response = await handleIdentityWorkerRequest(
+    new Request('https://example.test/api/auth/login', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        'X-AgentSam-Native-Client': '1',
+      },
+      body: JSON.stringify({ email: 'user@example.com', password: 'secret-pass' }),
+    }),
+    { DB: fakeDb() },
+    { identity },
+  );
+
+  assert.equal(response.status, 200);
+  assert.equal(nativeBranch, true);
+  assert.equal(response.headers.get('set-cookie'), null);
+  const body = await response.json();
+  assert.equal(body.session_id, 'sess_native_123');
+});