@jskit-ai/connectors-catalog 0.1.1

package/test/calendly.test.js

@@ -0,0 +1,136 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { calendlyProvider } from "../src/server/calendly.js";
+
+test("Calendly web OAuth uses Basic and PKCE, persists rotating refresh tokens and retains personal-token access", async (t) => {
+  const directory = await mkdtemp(path.join(tmpdir(), "calendly-test-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const callback = "https://example.test/integrations/calendly/callback";
+  const context = { applicationId: "app", subjectId: "owner" };
+  const input = { context, integrationId: "calendar" };
+  let time = Date.now(), exchanges = 0;
+  let tokenScope = "users:read event_types:read", apiStatus = 200;
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(4) }, activeKeyId: "current" });
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { calendar: { source: "own", clientId: "client", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK", tokenEndpointAuthMethod: "client_secret_basic" } }, integrations: {
+      calendar: { provider: "calendly", accountMode: "shared", scopes: ["users:read", "event_types:read"], authentication: { method: "oauth2", registrationRef: "calendar" } },
+      personal: { provider: "calendly", accountMode: "shared", scopes: ["users:read", "event_types:read"], authentication: { method: "api-key", secretRef: "env:TOKEN" } }
+    } }, providers: [calendlyProvider], authorize: async owner => owner,
+    store: createFileConnectionStore({ directory, protection }), now: () => time,
+    resolveReference: async ref => ref === "env:CALLBACK" ? callback : ref === "env:TOKEN" ? "personal" : "secret",
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)), headers = new Headers(init.headers);
+      if (url.origin === "https://auth.calendly.com") {
+        assert.equal(url.pathname, "/oauth/token");
+        assert.equal(headers.get("authorization"), "Basic " + Buffer.from("client:secret").toString("base64"));
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.has("client_secret"), false);
+        if (body.get("grant_type") === "authorization_code") {
+          assert.equal(body.get("redirect_uri"), callback);
+          assert.ok(body.get("code_verifier"));
+        } else assert.equal(body.get("refresh_token"), `refresh-${exchanges}`);
+        exchanges++;
+        return Response.json({ access_token: `access-${exchanges}`, refresh_token: `refresh-${exchanges}`, token_type: "Bearer", expires_in: 60, scope: tokenScope });
+      }
+      assert.equal(url.origin, "https://api.calendly.com");
+      assert.ok([`Bearer access-${exchanges}`, "Bearer personal"].includes(headers.get("authorization")));
+      if (apiStatus !== 200) return Response.json({ message: "private provider detail" }, { status: apiStatus });
+      return Response.json({ resource: { uri: "https://api.calendly.com/users/one", name: "Fixture" } });
+    }
+  };
+  const service = createConnectionService(options);
+  for (const outcome of ["cancel", "denied"]) {
+    const attempt = new URL((await service.beginAuthorization(input)).authorizationUrl);
+    const denied = new URL(callback);
+    denied.searchParams.set("state", attempt.searchParams.get("state"));
+    if (outcome === "cancel") {
+      await service.cancelAuthorization({ ...input, state: attempt.searchParams.get("state") });
+      denied.searchParams.set("code", "unused");
+    } else denied.searchParams.set("error", "access_denied");
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: denied.href }), {
+      code: outcome === "cancel" ? "connector_attempt_invalid" : "connector_consent_denied"
+    });
+  }
+  assert.equal(exchanges, 0);
+  const { authorizationUrl } = await service.beginAuthorization(input);
+  const url = new URL(authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://auth.calendly.com/oauth/authorize");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  const returned = new URL(callback);
+  returned.searchParams.set("code", "code");
+  returned.searchParams.set("state", url.searchParams.get("state"));
+  assert.equal((await service.completeAuthorization({ ...input, callbackUrl: returned.href })).status, "connected");
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: returned.href }), { code: "connector_attempt_invalid" });
+  time += 40_000;
+  await Promise.all([service.invoke({ ...input, operation: "profile.read" }), service.invoke({ ...input, operation: "profile.read" })]);
+  assert.equal(exchanges, 2);
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  time += 40_000;
+  await restarted.invoke({ ...input, operation: "profile.read" });
+  assert.equal(exchanges, 3);
+  assert.equal((await restarted.connectApiKey({ context, integrationId: "personal" })).status, "connected");
+  const reconnect = new URL((await restarted.beginAuthorization(input)).authorizationUrl);
+  returned.searchParams.set("state", reconnect.searchParams.get("state"));
+  tokenScope = "users:read";
+  await restarted.completeAuthorization({ ...input, callbackUrl: returned.href });
+  await assert.rejects(restarted.invoke({ ...input, operation: "eventTypes.list", input: { user: "https://api.calendly.com/users/one" } }), { code: "connector_scope_missing" });
+  apiStatus = 403;
+  await assert.rejects(restarted.invoke({ ...input, operation: "profile.read" }), { code: "connector_permission_denied" });
+  apiStatus = 401;
+  await assert.rejects(restarted.invoke({ ...input, operation: "profile.read" }), { code: "connector_reconnect_required" });
+  await restarted.disconnect(input);
+  assert.equal((await restarted.status(input)).status, "disconnected");
+});
+
+test("Calendly scheduling retains booking details, scopes, pagination and explicit write outcomes", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "calendly-scheduling-")); t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = []; const state = { response: { resource: { uri: "https://api.calendly.com/users/u", name: "Owner" } }, status: 200, fail: false, deny: false };
+  const identity = { context: { applicationId: "booking", subjectId: "owner" }, integrationId: "calendar" };
+  const service = createConnectionService({ configuration: { schemaVersion: 1, registrations: {}, integrations: {
+    calendar: { provider: "calendly", accountMode: "shared", scopes: ["users:read", "event_types:read", "availability:read", "scheduled_events:read", "scheduled_events:write", "scheduling_links:write"], authentication: { method: "api-key", secretRef: "env:CALENDLY_API_KEY" } }
+  } }, providers: [calendlyProvider], authorize: async context => { if (state.deny) throw new Error("denied"); return context; }, resolveReference: async () => "fixture-token",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(6) }, activeKeyId: "current" }) }),
+    fetchImpl: async (url, init) => { requests.push({ url: new URL(url), init }); if (state.fail) throw new Error("uncertain booking");
+      return state.response === null ? new Response(null, { status: 204 }) : Response.json(state.response, { status: state.status }); }
+  });
+  await service.connectApiKey(identity);
+  const invoke = (operation, input = {}) => service.invoke({ ...identity, operation, input });
+  const event_type = "https://api.calendly.com/event_types/type1", event = "https://api.calendly.com/scheduled_events/event1";
+  const invitee = { uri: `${event}/invitees/invitee1`, email: "customer@example.test", status: "active", timezone: "Australia/Perth", reschedule_url: "https://calendly.com/reschedulings/fixture", cancel_url: "https://calendly.com/cancellations/fixture", questions_and_answers: [{ question: "Dog name", answer: "Fido", position: 0 }] };
+  const booking = { event_type, start_time: "2026-10-01T02:00:00Z", invitee: { email: invitee.email, name: "Sam", timezone: invitee.timezone }, questions_and_answers: invitee.questions_and_answers, event_guests: ["partner@example.test"] };
+  for (const [operation, method, endpoint, input, response] of [
+    ["eventTypes.get", "GET", "event_types/type1", { uuid: "type1" }, { resource: { uri: event_type, scheduling_url: "https://calendly.com/owner/groom" } }],
+    ["availability.list", "GET", "event_type_available_times", { event_type, start_time: booking.start_time, end_time: "2026-10-02T02:00:00Z" }, { collection: [{ start_time: booking.start_time, status: "available", invitees_remaining: 1 }] }],
+    ["events.list", "GET", "scheduled_events", { user: "https://api.calendly.com/users/u", count: 1, page_token: "next", status: "active" }, { collection: [{ uri: event, status: "active" }], pagination: { count: 1, next_page_token: "next2" } }],
+    ["events.get", "GET", "scheduled_events/event1", { uuid: "event1" }, { resource: { uri: event, status: "active" } }],
+    ["invitees.list", "GET", "scheduled_events/event1/invitees", { uuid: "event1", count: 1 }, { collection: [invitee], pagination: { count: 1, next_page_token: null } }],
+    ["invitees.get", "GET", "scheduled_events/event1/invitees/invitee1", { uuid: "event1", invitee_uuid: "invitee1" }, { resource: invitee }],
+    ["invitees.create", "POST", "invitees", booking, { resource: invitee }],
+    ["schedulingLinks.create", "POST", "scheduling_links", { owner: event_type, owner_type: "EventType", max_event_count: 1 }, { resource: { owner: event_type, owner_type: "EventType", booking_url: "https://calendly.com/d/fixture" } }],
+    ["events.cancel", "POST", "scheduled_events/event1/cancellation", { uuid: "event1", reason: "Customer requested" }, { resource: { canceled_by: "Owner", created_at: "2026-09-12T00:00:00Z" } }],
+    ["noShows.create", "POST", "invitee_no_shows", { invitee: invitee.uri }, { resource: { uri: "https://api.calendly.com/invitee_no_shows/n1", invitee: invitee.uri } }],
+    ["noShows.get", "GET", "invitee_no_shows/n1", { uuid: "n1" }, { resource: { uri: "https://api.calendly.com/invitee_no_shows/n1", invitee: invitee.uri } }],
+    ["noShows.delete", "DELETE", "invitee_no_shows/n1", { uuid: "n1" }, null]
+  ]) { state.response = response; assert.deepEqual(await invoke(operation, input), response);
+    const request = requests.at(-1); assert.equal(request.url.origin, "https://api.calendly.com"); assert.equal(request.url.pathname, `/${endpoint}`); assert.equal(request.init.method, method);
+    const { uuid, invitee_uuid, ...values } = input;
+    if (method === "POST") assert.deepEqual(JSON.parse(request.init.body), values);
+    if (method === "GET") for (const [key, value] of Object.entries(values)) assert.equal(request.url.searchParams.get(key), String(value));
+    assert.equal(new Headers(request.init.headers).get("authorization"), "Bearer fixture-token"); assert.equal(request.init.redirect, "error");
+  }
+  const before = requests.length;
+  for (const [operation, input] of [["events.list", {}], ["events.get", { uuid: "../users/me" }],
+    ["availability.list", { event_type, start_time: booking.start_time, end_time: "2026-12-01T00:00:00Z" }],
+    ["invitees.create", { ...booking, invitee: { ...booking.invitee, timezone: "Not/AZone" } }],
+    ["schedulingLinks.create", { owner: "https://evil.test/type", max_event_count: 2 }]]) await assert.rejects(invoke(operation, input));
+  state.deny = true; await assert.rejects(invoke("invitees.create", booking)); state.deny = false; assert.equal(requests.length, before);
+  state.response = { resource: { message: "No booking" } }; await assert.rejects(invoke("invitees.create", booking), { code: "connector_response_invalid" });
+  state.status = 403; await assert.rejects(invoke("invitees.create", booking), { code: "connector_permission_denied" });
+  state.status = 429; await assert.rejects(invoke("invitees.create", booking));
+  state.status = 200; state.fail = true; const uncertain = requests.length; await assert.rejects(invoke("invitees.create", booking)); assert.equal(requests.length, uncertain + 1);
+});

package/test/canva.test.js

@@ -0,0 +1,258 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { canvaProvider } from "../src/server/canva.js";
+
+import { createCanvaClientMetadata } from "../src/shared/canva.js";
+
+const context = { applicationId: "assistant-host", subjectId: "account-owner" };
+const input = { context, integrationId: "work" };
+const callback = "http://127.0.0.1:4919/canva/callback";
+const resource = "https://mcp.canva.com";
+const clientId = "https://assistant.example/oauth/canva.json";
+const endpoint = `${resource}/mcp`;
+const tokenEndpoint = "https://mcp.canva.com/token";
+const scopes = ["profile:read", "design:meta:read"];
+const discovery = { tools: [{ name: "get-design", inputSchema: { type: "object", properties: { design_id: { type: "string" } } } }] };
+
+async function fixture(t, selectedScopes = scopes) {
+  const directory = await mkdtemp(path.join(tmpdir(), "canva-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" });
+  const state = { time: Date.now(), scopes: selectedScopes, status: 200, list: discovery, call: { content: [{ type: "text", text: "Project work" }] } };
+  const requests = [];
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { canva: { source: "own", clientId: clientId, tokenEndpointAuthMethod: "none", callbackUrlRef: "env:CANVA_CALLBACK" } }, integrations: {
+      work: { provider: "canva", accountMode: "assistant", scopes: selectedScopes,
+        authentication: { method: "oauth2", registrationRef: "canva" } }
+    } },
+    providers: [canvaProvider], store: createFileConnectionStore({ directory, protection }), now: () => state.time,
+    authorize: async (owner, request) => request.operation === "tools.call" &&
+      (state.authorizeTool ? !state.authorizeTool(request.input) :
+        request.input.name !== "get-design" || request.input.arguments.design_id !== "allowed-design") ? null : owner,
+    resolveReference: async (reference) => { assert.equal(reference, "env:CANVA_CALLBACK"); return callback; },
+    fetchImpl: async (address, init) => {
+      init.signal.throwIfAborted();
+      const url = String(address);
+      requests.push({ url, init, headers: new Headers(init.headers) });
+      if (url === tokenEndpoint) {
+        if (state.tokenError) return Response.json({ error: state.tokenError, error_description: "fixture-client-secret" }, { status: 400 });
+        const refresh = new URLSearchParams(init.body).get("grant_type") === "refresh_token";
+        return Response.json({ token_type: "Bearer", access_token: refresh ? "refreshed-access" : "initial-access",
+          refresh_token: refresh ? "rotated-refresh" : "initial-refresh", expires_in: 60, scope: state.scopes.join(" ") });
+      }
+      assert.equal(url, endpoint);
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      if (state.status !== 200) return new Response("initial-access fixture-client-secret", { status: state.status,
+        headers: { "WWW-Authenticate": 'Bearer resource_metadata="https://unexpected.invalid/auth"' } });
+      const message = JSON.parse(init.body);
+      requests.at(-1).message = message;
+      if (message.id === undefined) return new Response(null, { status: 202 });
+      const result = message.method === "initialize" ? { protocolVersion: message.params.protocolVersion,
+        capabilities: { tools: {} }, serverInfo: { name: "canva-fixture", version: "1" } }
+        : message.method === "tools/list" ? state.list : state.call;
+      if (state.pause && message.method === "tools/call") {
+        state.started();
+        return new Promise((resolve, reject) => init.signal.addEventListener("abort", () => reject(init.signal.reason), { once: true }));
+      }
+      return Response.json({ jsonrpc: "2.0", id: message.id, result }, { headers: { "Mcp-Session-Id": "canva-session" } });
+    }
+  };
+  const service = createConnectionService(options);
+  const complete = async (start, extra = "code=fixture-code") => service.completeAuthorization({ ...input,
+    callbackUrl: `${callback}?state=${new URL(start.authorizationUrl).searchParams.get("state")}&${extra}` });
+  return { service, options, state, requests, directory, protection, complete };
+}
+
+
+test("Canva metadata clients exchange and refresh PKCE grants without client secrets after file restart", async (t) => {
+  const { service, options, requests, state, complete, directory, protection } = await fixture(t);
+  const durations = [];
+  const timeout = AbortSignal.timeout;
+  t.mock.method(AbortSignal, "timeout", (duration) => { durations.push(duration); return timeout(duration); });
+  const start = await service.beginAuthorization(input);
+  const url = new URL(start.authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://mcp.canva.com/authorize");
+  assert.equal(url.searchParams.get("resource"), resource);
+  assert.equal(url.searchParams.get("client_id"), clientId);
+  assert.equal(url.searchParams.get("scope"), scopes.join(" "));
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(requests.length, 0);
+  assert.equal((await complete(start)).status, "connected");
+  const grant = new URLSearchParams(requests.find(({ url }) => url === tokenEndpoint).init.body);
+  assert.equal(grant.get("resource"), resource);
+  assert.equal(grant.get("client_id"), clientId);
+  assert.equal(grant.has("client_secret"), false);
+  assert.equal(requests.find(({ url }) => url === tokenEndpoint).headers.get("authorization"), null);
+  assert.equal(grant.get("redirect_uri"), callback);
+  assert(grant.get("code_verifier"));
+  assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 0);
+  const initialized = requests.find(({ message }) => message?.method === "initialize");
+  assert.deepEqual(initialized.message.params.capabilities, {});
+  for (const request of requests.filter(({ url }) => url === endpoint)) {
+    assert.equal(request.headers.get("authorization"), "Bearer initial-access");
+    assert.equal(request.init.redirect, "error");
+    assert.equal(request.init.credentials, "omit");
+  }
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  state.time += 61_000;
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "tools.list", input: { cursor: "next-page" } }), discovery);
+  assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/list").message.params, { cursor: "next-page" });
+  const refresh = new URLSearchParams(requests.findLast(({ url }) => url === tokenEndpoint).init.body);
+  assert.equal(refresh.get("resource"), resource);
+  assert.equal(refresh.get("refresh_token"), "initial-refresh");
+  assert.equal(refresh.get("client_id"), clientId);
+  assert.equal(refresh.has("client_secret"), false);
+  assert.equal(requests.at(-1).headers.get("authorization"), "Bearer refreshed-access");
+  assert.equal(requests.at(-1).init.method, "DELETE");
+  for (const name of await readdir(directory)) {
+    const stored = await readFile(path.join(directory, name), "utf8");
+    for (const secret of ["initial-access", "refreshed-access", "initial-refresh", "rotated-refresh", "fixture-client-secret", grant.get("code_verifier")]) assert(!stored.includes(secret));
+  }
+  const count = requests.length;
+  await assert.rejects(complete(start), { code: "connector_attempt_invalid" });
+  for (const owner of [{ ...context, applicationId: "another-host" }, { ...context, subjectId: "another-owner" }]) {
+    await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  }
+  assert.equal(requests.length, count);
+  await restarted.disconnect(input);
+  assert.equal((await service.status(input)).status, "disconnected");
+  assert.equal(requests.length, count);
+  assert(durations.includes(60_000));
+  assert(durations.includes(15_000));
+});
+
+test("Canva validates metadata URLs, client type and permissions before reusing a consent attempt", async (t) => {
+  const { options, service, requests } = await fixture(t);
+  const parse = (config) => parseIntegrationConfiguration(JSON.stringify(config), { providers: [canvaProvider] });
+  for (const [field, value] of [["accountMode", "shared"], ["accountMode", "per-user"], ["scopes", ["admin"]], ["scopes", []]]) {
+    const config = structuredClone(options.configuration);
+    config.integrations.work[field] = value;
+    assert.throws(() => parse(config));
+  }
+  const config = structuredClone(options.configuration);
+  config.integrations.work.scopes = canvaProvider.scopes.map(({ value }) => value);
+  assert.deepEqual(parse(config).integrations.work.scopes, config.integrations.work.scopes);
+  assert(canvaProvider.scopes.filter(({ value }) => /:write$/.test(value)).every(({ recommended }) => !recommended));
+  for (const clientId of ["ordinary-client", "https://assistant.example", "http://assistant.example/client.json", "https://user:secret@assistant.example/client.json", "https://assistant.example/client.json?key=secret"]) {
+    const invalid = structuredClone(options.configuration);
+    invalid.registrations.canva.clientId = clientId;
+    assert.throws(() => parse(invalid), (error) => Boolean(error.fieldErrors["registrations.canva.clientId"]));
+  }
+  const invalid = structuredClone(options.configuration);
+  invalid.registrations.canva.clientSecretRef = "env:SHOULD_NOT_BE_USED";
+  assert.throws(() => parse(invalid), (error) => Boolean(error.fieldErrors["registrations.canva.clientSecretRef"]));
+  const start = await service.beginAuthorization(input);
+  const changed = createConnectionService({ ...options, configuration: config });
+  await assert.rejects(changed.completeAuthorization({ ...input, callbackUrl: `${callback}?code=x&state=${new URL(start.authorizationUrl).searchParams.get("state")}` }), { code: "connector_attempt_invalid" });
+  assert.equal(requests.length, 0);
+});
+
+test("Canva authorizes the exact tool and destination design, preserves tool errors and cancels without replay", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await complete(await service.beginAuthorization(input));
+  const count = requests.length;
+  for (const payload of [{ name: "delete-design", arguments: {} }, { name: "get-design", arguments: { design_id: "another-design" } }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload }), { code: "connector_access_denied" });
+  }
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list", input: { url: "https://unexpected.invalid" } }), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  const payload = { name: "get-design", arguments: { design_id: "allowed-design" } };
+  state.call = { content: [{ type: "text", text: "This issue is not accessible" }], isError: true };
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.call", input: payload }), state.call);
+  assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/call").message.params, payload);
+  state.pause = true;
+  const started = new Promise((resolve) => { state.started = resolve; });
+  const controller = new AbortController();
+  const pending = assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload, signal: controller.signal }), { code: "connector_cancelled" });
+  await started;
+  controller.abort();
+  await pending;
+  assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 2);
+  assert.equal(requests.at(-1).init.method, "DELETE");
+});
+
+test("Canva declined consent and malformed discovery do not persist a connection", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await assert.rejects(complete(await service.beginAuthorization(input), "error=access_denied"), { code: "connector_consent_denied" });
+  assert.equal(requests.length, 0);
+  state.list = { wrong: [] };
+  await assert.rejects(complete(await service.beginAuthorization(input)), { code: "connector_provider_failed" });
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("Canva preserves the provider's reduced grant and permits empty discovery without claiming product access", async (t) => {
+  const { service, complete, state, requests } = await fixture(t);
+  state.scopes = ["profile:read"];
+  state.list = { tools: [] };
+  const connected = await complete(await service.beginAuthorization(input));
+  assert.deepEqual(connected.grantedScopes, ["profile:read"]);
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.list" }), { tools: [] });
+  assert(!requests.some(({ message }) => message?.method === "tools/call"));
+});
+
+test("Canva sanitizes HTTP/refresh failures, persists reconnect status and never follows injected auth metadata", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  for (const [status, code] of [[401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    await assert.rejects(complete(await service.beginAuthorization(input)), (error) => {
+      assert.equal(error.code, code);
+      assert(!error.message.includes("fixture-client-secret"));
+      assert.equal(error.cause, undefined);
+      return true;
+    });
+  }
+  assert(requests.every(({ url }) => url === endpoint || url === tokenEndpoint));
+  state.status = 200;
+  await complete(await service.beginAuthorization(input));
+  state.time += 61_000;
+  state.tokenError = "invalid_grant";
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Canva client metadata is a portable secret-free document with an exact identity and callback", () => {
+  const metadata = createCanvaClientMetadata({ clientId, clientName: "My assistant", callbackUrl: callback });
+  assert.deepEqual(metadata, { client_id: clientId, client_name: "My assistant", redirect_uris: [callback],
+    grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], token_endpoint_auth_method: "none" });
+  assert.deepEqual(JSON.parse(JSON.stringify(metadata)), metadata);
+  for (const changes of [{ clientId: "http://example.test/client.json" }, { clientId: "https://example.test/" },
+    { clientId: "https://example.test/client.json#fragment" }, { clientName: "" }, { callbackUrl: "http://remote.example/callback" },
+    { callbackUrl: "https://example.test/callback?secret=1" }, { clientSecret: "raw-secret" }]) {
+    assert.throws(() => createCanvaClientMetadata({ clientId, clientName: "Client", callbackUrl: callback, ...changes }));
+  }
+});
+
+
+test("Canva design creation and editing preserve draft versus committed results and exact host approval", async t => {
+  const { service, complete, state, requests } = await fixture(t, [...scopes, "design:content:write"]);
+  await complete(await service.beginAuthorization(input));
+  const steps = [
+    ["create-design-from-candidate", { job_id: "job-1", candidate_id: "chosen-1" }, { design_summary: { id: "allowed-design", title: "Grooming offer", urls: { edit_url: "https://www.canva.com/d/fixture" } } }],
+    ["start-editing-transaction", { design_id: "allowed-design" }, { transaction: { status: "open", transaction_id: "txn-1" }, richtexts: [{ page_index: 1, element_id: "headline", regions: [{ type: "character", text: "Old headline" }] }] }],
+    ["perform-editing-operations", { transaction_id: "txn-1", page_index: 1, operations: [{ type: "replace_text", element_id: "headline", text: "Spring grooming" }] }, { edit_operation_results: [{ status: "success", operation_info: { type: "replace_text", element_id: "headline" } }] }],
+    ["commit-editing-transaction", { transaction_id: "txn-1" }, { transaction: { id: "txn-1", status: "committed" } }]
+  ];
+  for (const [name, arguments_, result] of steps) {
+    const payload = { name, arguments: arguments_ };
+    state.authorizeTool = candidate => JSON.stringify(candidate) === JSON.stringify(payload);
+    state.call = { content: [{ type: "text", text: JSON.stringify(result) }] };
+    const count = requests.length;
+    await assert.rejects(service.invoke({ ...input, operation: "tools.call", input: { name, arguments: { ...arguments_, design_id: "unapproved-design" } } }), { code: "connector_access_denied" });
+    assert.equal(requests.length, count);
+    const response = await service.invoke({ ...input, operation: "tools.call", input: payload });
+    assert.deepEqual(JSON.parse(response.content[0].text), result);
+    assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/call").message.params, payload);
+  }
+  state.call = { isError: true, content: [{ type: "text", text: "Concurrent edit: cancel and start a fresh transaction" }] };
+  const count = requests.filter(({ message }) => message?.method === "tools/call").length;
+  const failed = await service.invoke({ ...input, operation: "tools.call", input: { name: "commit-editing-transaction", arguments: { transaction_id: "txn-1" } } });
+  assert.equal(failed.isError, true);
+  assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, count + 1);
+});

package/test/chargebee.test.js

@@ -0,0 +1,195 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { chargebeeProvider } from "../src/server/chargebee.js";
+
+const context = { applicationId: "billing-app", subjectId: "finance-team" };
+const input = { context, integrationId: "billing" };
+const customers = { list: [{ customer: { id: "customer-1", object: "customer", first_name: "Alex" } }] };
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "chargebee-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(6) }, activeKeyId: "current" });
+  const requests = [];
+  const state = { key: "test_fixture_key", status: 200, response: customers };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { billing: {
+      provider: "chargebee", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:CHARGEBEE_API_KEY" },
+      settings: { siteName: "acme-test" }, extensions: { fromCli: true }
+    } } },
+    providers: [chargebeeProvider], authorize: async (owner) => state.deny ? null : owner,
+    store: createFileConnectionStore({ directory, protection }),
+    resolveReference: async (ref) => { assert.equal(ref, "env:CHARGEBEE_API_KEY"); return state.key; },
+    fetchImpl: async (address, init) => {
+      requests.push({ url: new URL(String(address)), init, headers: new Headers(init.headers) });
+      if (state.fail) throw new Error("uncertain write");
+      return Response.json(state.response, { status: state.status });
+    }
+  };
+  return { service: createConnectionService(options), options, requests, directory, protection, state };
+}
+
+test("Chargebee verifies a site with Basic API-key authentication and retains file ownership across restart", async (t) => {
+  const { service, options, requests, directory, protection, state } = await fixture(t);
+  const connected = await service.connectApiKey(input);
+  assert.equal(connected.status, "connected");
+  const first = requests[0];
+  assert.equal(first.url.href, "https://acme-test.chargebee.com/api/v2/customers?limit=10&include_deleted=false");
+  assert.equal(first.init.method, "GET");
+  assert.equal(first.init.body, undefined);
+  assert.equal(first.init.redirect, "error");
+  assert.equal(first.headers.get("authorization"), `Basic ${Buffer.from(`${state.key}:`).toString("base64")}`);
+  for (const name of await readdir(directory)) {
+    const stored = await readFile(path.join(directory, name), "utf8");
+    assert.doesNotThrow(() => JSON.parse(stored));
+    assert.equal(stored.includes(state.key), false);
+    assert.equal(stored.includes(first.headers.get("authorization")), false);
+  }
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  assert.deepEqual(await restarted.status(input), connected);
+  state.key = "test_rotated_key";
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "customers.list" }), customers);
+  assert.equal(requests.at(-1).headers.get("authorization"), `Basic ${Buffer.from(`${state.key}:`).toString("base64")}`);
+  for (const owner of [{ ...context, applicationId: "other-app" }, { ...context, subjectId: "other-team" }]) {
+    await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "customers.list" }), { code: "connector_reconnect_required" });
+  }
+  assert.equal(requests.length, 2);
+  await restarted.disconnect(input);
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("Chargebee rejects full URLs and invalid site labels or Basic credential separators before HTTP", async (t) => {
+  const { service, options, requests, state } = await fixture(t);
+  const parse = (configuration) => parseIntegrationConfiguration(JSON.stringify(configuration), { providers: [chargebeeProvider] });
+  for (const siteName of [undefined, "", "https://acme-test.chargebee.com", "acme.chargebee.com", "user@host", "acme/..", "acme?host=other", "acme#fragment", "acme:443", "-acme", "acme-", "a_b", "with space", "a".repeat(64)]) {
+    const configuration = structuredClone(options.configuration);
+    configuration.integrations.billing.settings.siteName = siteName;
+    assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.billing.settings.siteName"]));
+  }
+  const configuration = structuredClone(options.configuration);
+  configuration.integrations.billing.authentication.secretRef = "raw-key";
+  assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.billing.authentication.secretRef"]));
+  for (const key of ["key:password", "key with space", "key\nheader", "key\u0000"]) {
+    state.key = key;
+    await assert.rejects(service.connectApiKey(input), { code: "connector_binding_missing" });
+  }
+  assert.equal(requests.length, 0);
+});
+
+test("Chargebee site changes require verification and never fall back across sites", async (t) => {
+  const { service, options, requests } = await fixture(t);
+  await service.connectApiKey(input);
+  const configuration = structuredClone(options.configuration);
+  configuration.integrations.billing.settings.siteName = "acme-live";
+  const changed = createConnectionService({ ...options, configuration });
+  assert.equal((await changed.status(input)).status, "reconnect-required");
+  await assert.rejects(changed.invoke({ ...input, operation: "customers.list" }), { code: "connector_reconnect_required" });
+  const wrongHost = createConnectionService({ ...options, providers: [{ ...chargebeeProvider, operations: {
+    "customers.list": { scopes: [], request: () => ({ method: "GET", url: "https://acme-live.chargebee.com/api/v2/customers" }) }
+  } }] });
+  await assert.rejects(wrongHost.invoke({ ...input, operation: "customers.list" }), { code: "connector_destination_invalid" });
+  assert.equal(requests.length, 1);
+  await changed.connectApiKey(input);
+  assert.equal(requests.at(-1).url.origin, "https://acme-live.chargebee.com");
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Chargebee preserves opaque customer pagination and opt-in deleted records while rejecting input overrides", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey(input);
+  state.response = { list: [{ customer: { id: "deleted-1", deleted: true } }], next_offset: "next+&=cursor" };
+  assert.deepEqual(await service.invoke({ ...input, operation: "customers.list", input: { limit: 100, offset: "previous+&=cursor", include_deleted: true } }), state.response);
+  assert.deepEqual(Object.fromEntries(requests.at(-1).url.searchParams), { limit: "100", offset: "previous+&=cursor", include_deleted: "true" });
+  for (const invalid of [{ limit: 0 }, { limit: 101 }, { limit: 1.5 }, { offset: "" }, { offset: "x".repeat(1001) }, { include_deleted: "maybe" }, { siteName: "other-site" }, { url: "https://attacker.invalid" }, { api_key: "other-key" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "customers.list", input: invalid }), { code: "connector_input_invalid" });
+  }
+  assert.equal(requests.length, 2);
+  state.response = { list: [] };
+  assert.deepEqual(await service.invoke({ ...input, operation: "customers.list" }), { list: [] });
+});
+
+test("Chargebee failure responses never verify a key or expose provider details and revoked keys require reconnection", async (t) => {
+  const { service, state } = await fixture(t);
+  for (const [status, code] of [[200, "connector_response_invalid"], [401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    state.response = { message: state.key, api_error_code: "provider-fixture-error" };
+    await assert.rejects(service.connectApiKey(input), (error) => {
+      assert.equal(error.code, code);
+      assert.equal(error.message.includes(state.key), false);
+      assert.equal(JSON.stringify(error).includes(state.key), false);
+      return true;
+    });
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+  state.status = 200;
+  state.response = customers;
+  await service.connectApiKey(input);
+  for (const malformed of [{ list: {} }, { list: [{}] }, { list: [{ customer: { id: "" } }] }, { ...customers, next_offset: 2 }, { ...customers, next_offset: "x".repeat(1001) }]) {
+    state.response = malformed;
+    await assert.rejects(service.invoke({ ...input, operation: "customers.list" }), { code: "connector_response_invalid" });
+  }
+  state.status = 401;
+  await assert.rejects(service.invoke({ ...input, operation: "customers.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+
+test("Chargebee app billing uses indexed forms, explicit idempotency and verified checkout state", async t => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey(input);
+  const invoke = (operation, values = {}) => service.invoke({ ...input, operation, input: values });
+  const items = [{ item_price_id: "grooming-USD-monthly", quantity: 1 }];
+  const returns = { redirect_url: "https://app.example/billing/return", cancel_url: "https://app.example/billing/cancel" };
+  const samples = [
+    ["customers.create", "customers", { email: "sam@example.test", first_name: "Sam", id: "customer-1" }, { customer: { id: "customer-1" } }],
+    ["customers.update", "customers/customer-1", { resource: "customer-1", company: "Dog and Groom" }, { customer: { id: "customer-1", company: "Dog and Groom" } }],
+    ["subscriptions.create", "customers/customer-1/subscription_for_items", { resource: "customer-1", subscription_items: items, auto_collection: "off", invoice_immediately: false }, { subscription: { id: "sub-1", status: "active" }, unbilled_charges: [{ id: "charge-1" }] }],
+    ["subscriptions.updateAtTermEnd", "subscriptions/sub-1/update_for_items", { resource: "sub-1", subscription_items: items, replace_items_list: true }, { subscription: { id: "sub-1", has_scheduled_changes: true } }, { end_of_term: "true" }],
+    ["subscriptions.cancelAtTermEnd", "subscriptions/sub-1/cancel_for_items", { resource: "sub-1" }, { subscription: { id: "sub-1", status: "non_renewing" } }, { cancel_option: "end_of_term" }],
+    ["hostedPages.checkoutNew", "hosted_pages/checkout_new_for_items", { subscription_items: items, customer: { id: "customer-1" }, ...returns }, { hosted_page: { id: "page-1", state: "created", url: "https://acme-test.chargebee.com/pages/v3/fixture" } }],
+    ["hostedPages.checkoutExisting", "hosted_pages/checkout_existing_for_items", { subscription_items: items, subscription: { id: "sub-1" }, ...returns }, { hosted_page: { id: "page-2", state: "created" } }],
+    ["portalSessions.create", "portal_sessions", { customer: { id: "customer-1" }, redirect_url: returns.redirect_url }, { portal_session: { id: "portal-1", access_url: "https://acme-test.chargebeeportal.com/fixture" } }],
+    ["invoices.pdf", "invoices/invoice-1/pdf", { resource: "invoice-1", disposition_type: "attachment" }, { download: { download_url: "https://downloads.example/invoice.pdf", valid_till: 1789290000 } }]
+  ];
+  for (const [operation, endpoint, values, response, fixed = {}] of samples) {
+    state.response = response;
+    assert.deepEqual(await invoke(operation, { ...values, idempotencyKey: `intent-${operation.replaceAll(".", "-")}` }), response);
+    const request = requests.at(-1); assert.equal(request.init.method, "POST"); assert.equal(request.url.href, `https://acme-test.chargebee.com/api/v2/${endpoint}`);
+    assert.equal(request.headers.get("content-type"), "application/x-www-form-urlencoded");
+    assert.equal(request.headers.get("chargebee-idempotency-key"), `intent-${operation.replaceAll(".", "-")}`);
+    const body = new URLSearchParams(request.init.body); assert.equal(body.has("idempotencyKey"), false); assert.equal(body.has("resource"), false);
+    for (const [key, value] of Object.entries(fixed)) assert.equal(body.get(key), value);
+    if (values.subscription_items) { assert.equal(body.get("subscription_items[item_price_id][0]"), items[0].item_price_id); assert.equal(body.get("subscription_items[quantity][0]"), "1"); }
+    if (values.customer) assert.equal(body.get("customer[id]"), values.customer.id);
+    if (values.subscription) assert.equal(body.get("subscription[id]"), values.subscription.id);
+    if (values.auto_collection) { assert.equal(body.get("auto_collection"), "off"); assert.equal(body.get("invoice_immediately"), "false"); }
+  }
+  for (const [operation, endpoint, resourceKey] of [["itemFamilies.list", "item_families", "item_family"], ["items.list", "items", "item"], ["itemPrices.list", "item_prices", "item_price"], ["subscriptions.list", "subscriptions", "subscription"], ["invoices.list", "invoices", "invoice"], ["events.list", "events", "event"]]) {
+    state.response = { list: [{ [resourceKey]: { id: "resource-1" } }], next_offset: "opaque+next" };
+    assert.deepEqual(await invoke(operation, { offset: "previous+cursor" }), state.response);
+    assert.equal(requests.at(-1).url.pathname, `/api/v2/${endpoint}`); assert.equal(requests.at(-1).url.searchParams.get("offset"), "previous+cursor");
+  }
+  for (const [operation, endpoint, resourceKey] of [["customers.get", "customers", "customer"], ["items.get", "items", "item"], ["itemPrices.get", "item_prices", "item_price"], ["subscriptions.get", "subscriptions", "subscription"], ["invoices.get", "invoices", "invoice"], ["events.get", "events", "event"], ["hostedPages.get", "hosted_pages", "hosted_page"]]) {
+    state.response = { [resourceKey]: { id: "resource-1", state: "succeeded", content: { subscription: { id: "sub-1", customer_id: "customer-1" }, invoice: { id: "invoice-1", status: "payment_due" } } } };
+    assert.deepEqual(await invoke(operation, { resource: "resource-1" }), state.response);
+    assert.equal(requests.at(-1).url.pathname, `/api/v2/${endpoint}/resource-1`); assert.equal(requests.at(-1).init.method, "GET");
+  }
+  const before = requests.length;
+  for (const [operation, values] of [["customers.create", { email: "sam@example.test" }], ["subscriptions.create", { resource: "c", subscription_items: items, idempotencyKey: "x" }],
+    ["hostedPages.checkoutNew", { subscription_items: [], customer: { id: "c" }, ...returns, idempotencyKey: "x" }],
+    ["subscriptions.cancelAtTermEnd", { resource: "../other", idempotencyKey: "x" }],
+    ["subscriptions.cancelAtTermEnd", { resource: "sub-1", idempotencyKey: "x", cancel_option: "immediately" }]]) await assert.rejects(invoke(operation, values), { code: "connector_input_invalid" });
+  state.deny = true; await assert.rejects(invoke("portalSessions.create", { customer: { id: "customer-1" }, redirect_url: returns.redirect_url, idempotencyKey: "portal" }), { code: "connector_access_denied" }); state.deny = false;
+  assert.equal(requests.length, before);
+  const cancel = { resource: "sub-1", idempotencyKey: "same-intent" };
+  state.response = { subscription: {} }; await assert.rejects(invoke("subscriptions.cancelAtTermEnd", cancel), { code: "connector_response_invalid" });
+  for (const status of [403, 409, 422, 429, 500]) { state.status = status; await assert.rejects(invoke("subscriptions.cancelAtTermEnd", cancel)); }
+  state.status = 200; state.fail = true; const uncertain = requests.length; await assert.rejects(invoke("subscriptions.cancelAtTermEnd", cancel)); assert.equal(requests.length, uncertain + 1);
+});