@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.8

package/packages/identity/tests/chatgpt-provider.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  ChatGptProvider,
+  createChatGptCmsAuthHost,
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  CHATGPT_USER_EMAIL_HEADER,
+  CHATGPT_USER_FULL_NAME_HEADER,
+  CHATGPT_USER_FULL_NAME_ENCODING_HEADER,
+  CHATGPT_PERCENT_ENCODED_UTF8,
+} from '../src/providers/chatgpt/index.js';
+import {
+  listStockSignInOptions,
+  getStockSignInOption,
+  CMS_STOCK_SIGN_IN_IDS,
+} from '../src/contracts/sign-in-options.js';
+import { getIdentityProvider, listIdentityProviders } from '../src/providers/index.js';
+import { IdentityProviders } from '../src/contracts/provider.js';
+
+describe('chatgpt identity provider', () => {
+  it('reads hosted headers without leaking raw oai keys into normalized identity', () => {
+    const user = readChatGptUserFromHeaders({
+      [CHATGPT_USER_EMAIL_HEADER]: 'Sam@Example.com',
+      [CHATGPT_USER_FULL_NAME_HEADER]: 'Sam%20Primeaux',
+      [CHATGPT_USER_FULL_NAME_ENCODING_HEADER]: CHATGPT_PERCENT_ENCODED_UTF8,
+    });
+    assert.equal(user?.email, 'sam@example.com');
+    assert.equal(user?.fullName, 'Sam Primeaux');
+
+    const normalized = normalizeChatGptIdentity({
+      email: user.email,
+      name: user.fullName,
+      sub: user.email,
+    });
+    assert.equal(normalized.provider, 'chatgpt');
+    assert.equal(normalized.subject, 'sam@example.com');
+    assert.equal(normalized.name, 'Sam Primeaux');
+    assert.equal(normalized.raw?.source, 'chatgpt_hosted');
+    assert.ok(!JSON.stringify(normalized).includes('oai-authenticated'));
+  });
+
+  it('registers chatgpt on the identity provider registry', () => {
+    assert.equal(ChatGptProvider.id, 'chatgpt');
+    assert.ok(IdentityProviders.includes('chatgpt'));
+    assert.equal(getIdentityProvider('chatgpt')?.id, 'chatgpt');
+    assert.ok(listIdentityProviders().some((p) => p.id === 'chatgpt'));
+  });
+
+  it('CmsAuthHost allows when headers present and challenges when missing', async () => {
+    const host = createChatGptCmsAuthHost({ cmsBase: '/cms' });
+    const denied = await host.authorizeCmsAccess({ path: '/cms', headers: {} });
+    assert.equal(denied.allowed, false);
+    assert.ok(String(denied.challengeUrl).startsWith('/signin-with-chatgpt'));
+
+    const allowed = await host.authorizeCmsAccess({
+      path: '/cms',
+      headers: { [CHATGPT_USER_EMAIL_HEADER]: 'editor@example.com' },
+    });
+    assert.equal(allowed.allowed, true);
+    assert.equal(allowed.principal?.email, 'editor@example.com');
+    assert.equal(allowed.principal?.provider, 'chatgpt');
+  });
+
+  it('stock sign-in catalog includes cloudflare, google, iam, chatgpt', () => {
+    const ids = listStockSignInOptions().map((o) => o.id);
+    assert.deepEqual(ids, ['cloudflare', 'google', 'inneranimalmedia', 'chatgpt']);
+    assert.deepEqual([...CMS_STOCK_SIGN_IN_IDS], ids);
+    assert.equal(getStockSignInOption('iam')?.id, 'inneranimalmedia');
+    assert.equal(getStockSignInOption('openai')?.id, 'chatgpt');
+    assert.equal(getStockSignInOption('chatgpt')?.kind, 'hosted_headers');
+    assert.ok(chatGPTSignInPath('/cms').includes('return_to='));
+  });
+});

package/packages/identity/tests/google-desktop-identity-login.test.mjs

@@ -0,0 +1,210 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  handleGoogleDesktopLoginExchangeRequest,
+} from '../src/oauth/google-desktop-exchange.js';
+
+const DESKTOP_ID = 'desktop-client.apps.googleusercontent.com';
+
+function request(body) {
+  return new Request('https://agentsam.test/api/oauth/google/desktop-login-exchange', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+}
+
+test('desktop identity handoff requires GOOGLE_DESKTOP_CLIENT_ID, not web client', async () => {
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      access_token: 'access',
+      id_token: 'id-token',
+      client_id: 'web-client.apps.googleusercontent.com',
+    }),
+    {
+      GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID,
+      GOOGLE_CLIENT_ID: 'web-client.apps.googleusercontent.com',
+      GOOGLE_CLIENT_SECRET: 'web-secret',
+    },
+    {
+      identity: {},
+      adapter: {},
+    },
+  );
+  assert.equal(response.status, 403);
+  assert.equal((await response.json()).error, 'google_desktop_client_id_required');
+});
+
+test('desktop identity validates token audience and provisions AgentSam desktop session', async () => {
+  const calls = [];
+  const identity = {
+    async provisionOAuthUser(input) {
+      calls.push(input);
+      return {
+        authUserId: 'au_1',
+        sessionId: 'sess_desktop_1',
+        session: { expires_at: '2026-10-29T00:00:00.000Z' },
+      };
+    },
+  };
+  const adapter = {
+    async findUserById() {
+      return { id: 'au_1', email: 'sam@example.com', display_name: 'Sam' };
+    },
+    async logAuthEvent() {},
+  };
+
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      access_token: 'transient-access-token',
+      id_token: 'transient-id-token',
+      client_id: DESKTOP_ID,
+    }),
+    { GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID },
+    {
+      identity,
+      adapter,
+      fetchImpl: async (url) => {
+        const parsed = new URL(String(url));
+        assert.equal(parsed.hostname, 'oauth2.googleapis.com');
+        assert.equal(parsed.searchParams.get('id_token'), 'transient-id-token');
+        return Response.json({
+          aud: DESKTOP_ID,
+          iss: 'https://accounts.google.com',
+          exp: String(Math.floor(Date.now() / 1000) + 300),
+          sub: 'google-user-1',
+          email: 'sam@example.com',
+          email_verified: 'true',
+        });
+      },
+      fetchProfile: async (accessToken) => {
+        assert.equal(accessToken, 'transient-access-token');
+        return {
+          sub: 'google-user-1',
+          email: 'sam@example.com',
+          name: 'Sam',
+        };
+      },
+    },
+  );
+
+  assert.equal(response.status, 200);
+  const body = await response.json();
+  assert.equal(body.session_id, 'sess_desktop_1');
+  assert.equal(body.authenticated, true);
+  assert.equal(body.exchange_mode, 'desktop_public_pkce_native_exchange');
+  assert.equal(body.user.email, 'sam@example.com');
+  assert.equal('access_token' in body, false);
+  assert.equal('id_token' in body, false);
+  assert.equal('refresh_token' in body, false);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].provider, 'google');
+  assert.equal(calls[0].sessionType, 'desktop');
+});
+
+
+
+test('desktop identity exchanges PKCE code server-side and uses provider-issued installed-app secret when required', async () => {
+  const identity = {
+    async provisionOAuthUser() {
+      return {
+        authUserId: 'au_code',
+        sessionId: 'sess_code',
+        session: { expires_at: '2026-10-29T00:00:00.000Z' },
+      };
+    },
+  };
+  const adapter = {
+    async findUserById() {
+      return { id: 'au_code', email: 'code@example.com', display_name: 'Code User' };
+    },
+    async logAuthEvent() {},
+  };
+
+  let tokenExchangeSeen = false;
+  let tokenInfoSeen = false;
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      code: 'one-time-code',
+      code_verifier: 'v'.repeat(64),
+      redirect_uri: 'http://127.0.0.1:43123/callback',
+      client_id: DESKTOP_ID,
+    }),
+    {
+      GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID,
+      GOOGLE_DESKTOP_CLIENT_SECRET: 'desktop-provider-secret',
+    },
+    {
+      identity,
+      adapter,
+      fetchImpl: async (url, init = {}) => {
+        const parsed = new URL(String(url));
+        if (parsed.pathname === '/token') {
+          tokenExchangeSeen = true;
+          const form = new URLSearchParams(String(init.body || ''));
+          assert.equal(form.get('client_id'), DESKTOP_ID);
+          assert.equal(form.get('client_secret'), 'desktop-provider-secret');
+          assert.equal(form.get('code'), 'one-time-code');
+          assert.equal(form.get('code_verifier'), 'v'.repeat(64));
+          return Response.json({
+            access_token: 'server-exchanged-access',
+            id_token: 'server-exchanged-id',
+          });
+        }
+        if (parsed.pathname === '/tokeninfo') {
+          tokenInfoSeen = true;
+          assert.equal(parsed.searchParams.get('id_token'), 'server-exchanged-id');
+          return Response.json({
+            aud: DESKTOP_ID,
+            iss: 'https://accounts.google.com',
+            exp: String(Math.floor(Date.now() / 1000) + 300),
+            sub: 'google-code-user',
+            email: 'code@example.com',
+            email_verified: 'true',
+          });
+        }
+        throw new Error('unexpected_google_url:' + parsed.toString());
+      },
+      fetchProfile: async (accessToken) => {
+        assert.equal(accessToken, 'server-exchanged-access');
+        return {
+          sub: 'google-code-user',
+          email: 'code@example.com',
+          name: 'Code User',
+        };
+      },
+    },
+  );
+
+  assert.equal(response.status, 200);
+  const body = await response.json();
+  assert.equal(body.authenticated, true);
+  assert.equal(body.session_id, 'sess_code');
+  assert.equal(tokenExchangeSeen, true);
+  assert.equal(tokenInfoSeen, true);
+});
+
+test('desktop identity rejects a Google token minted for another client', async () => {
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      access_token: 'access',
+      id_token: 'id-token',
+      client_id: DESKTOP_ID,
+    }),
+    { GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID },
+    {
+      identity: {},
+      adapter: {},
+      fetchImpl: async () => Response.json({
+        aud: 'another-client.apps.googleusercontent.com',
+        iss: 'https://accounts.google.com',
+        exp: String(Math.floor(Date.now() / 1000) + 300),
+        sub: 'google-user-1',
+        email: 'sam@example.com',
+        email_verified: 'true',
+      }),
+    },
+  );
+  assert.equal(response.status, 401);
+  assert.equal((await response.json()).error, 'google_id_token_audience_mismatch');
+});

package/packages/identity/tests/identity-init-scaffold.test.mjs

@@ -7,7 +7,7 @@ import { buildIdentityAppScaffold } from '../../../src/lib/identity-scaffold.js'
 import { writeFileTree } from '../../../src/lib/scaffold/writer.js';
 
 describe('identity init scaffold', () => {
-  it('writes app/frontend + backend + migrations layout', async () => {
+  it('writes portable identity_* migrations (not IAM-shaped accounts/company)', async () => {
     const files = buildIdentityAppScaffold({
       projectName: 'demo-identity',
       brandName: 'Demo Co',
@@ -15,11 +15,22 @@ describe('identity init scaffold', () => {
     assert.ok(files['app/frontend/auth/login.html'].includes('Demo Co'));
     assert.ok(files['app/frontend/auth/signup.html'].includes('/api/auth/signup'));
     assert.ok(files['backend/src/index.js'].includes('handleIdentityWorkerRequest'));
-    assert.ok(files['migrations/0001_identity_core.sql'].includes('CREATE TABLE IF NOT EXISTS company'));
-    assert.ok(files['migrations/0001_identity_core.sql'].includes('CREATE TABLE IF NOT EXISTS accounts'));
-    assert.ok(files['migrations/0001_identity_core.sql'].includes('INSERT OR IGNORE INTO company'));
+    assert.ok(files['backend/src/index.js'].includes("identityProfile: 'portable'"));
+    assert.ok(files['wrangler.toml'].includes('IDENTITY_ADAPTER_PROFILE = "portable"'));
+
+    const migration = files['migrations/0001_identity_portable.sql'];
+    assert.ok(migration.includes('CREATE TABLE IF NOT EXISTS identity_users'));
+    assert.ok(migration.includes('CREATE TABLE IF NOT EXISTS identity_companies'));
+    assert.ok(migration.includes('CREATE TABLE IF NOT EXISTS identity_oauth_transactions'));
+    assert.ok(migration.includes('app_id TEXT NOT NULL'));
+    assert.ok(migration.includes('INSERT OR IGNORE INTO identity_companies'));
+    assert.equal(migration.includes('CREATE TABLE IF NOT EXISTS accounts'), false);
+    assert.equal(migration.includes('CREATE TABLE IF NOT EXISTS company ('), false);
+    assert.equal(migration.includes('CREATE TABLE IF NOT EXISTS oauth_states'), false);
+
     assert.ok(files['.env.example'].includes('GOOGLE_DESKTOP_CLIENT_ID'));
     assert.ok(files['.env.example'].includes('CLOUDFLARE_OAUTH_CLIENT_ID'));
+    assert.ok(!files['.env.example'].includes('inneranimalmedia.com'));
     assert.ok(files['app/frontend/shared/company-branding.js'].includes('/api/company'));
 
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'identity-init-'));