@jskit-ai/connectors-catalog 0.1.1

package/test/firebase-cloud-messaging.test.js

@@ -0,0 +1,242 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { generateKeyPair, exportPKCS8, jwtVerify } from "jose";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { firebaseCloudMessagingProvider as provider } from "../src/server/firebase-cloud-messaging.js";
+import { firebaseMessagingScope } from "../src/shared/firebase-cloud-messaging.js";
+import { firebaseCloudMessagingWebConfiguration } from "../src/client/firebase-cloud-messaging.js";
+
+const keys = await generateKeyPair("RS256", { extractable: true });
+const account = { type: "service_account", project_id: "sender-project", private_key_id: "a".repeat(40),
+  private_key: await exportPKCS8(keys.privateKey), client_email: "messaging@sender-project.iam.gserviceaccount.com",
+  token_uri: "https://oauth2.googleapis.com/token", universe_domain: "googleapis.com" };
+const web = { clientMode: "web", projectId: "target-project", apiKey: `AIza${"a".repeat(35)}`, appId: "1:123456789012:web:abcdef1234567890", vapidKey: `B${"a".repeat(85)}A` };
+const context = { applicationId: "notifications-app", subjectId: "team" };
+const input = { context, integrationId: "push" };
+const message = { fid: "fixture-installation-id", notification: { title: "Order ready", body: "Your order is ready." }, data: { orderId: "42" } };
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "firebase-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const state = { now: Date.now(), credential: JSON.stringify(account, null, 2), grants: [], requests: [], status: 200, tokenStatus: 200 };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { push: {
+      provider: provider.id, accountMode: "shared", scopes: [firebaseMessagingScope], settings: { projectId: "target-project", clientMode: "server" },
+      authentication: { method: "service-account", secretRef: "env:FIREBASE_SERVICE_ACCOUNT" }, extensions: { cli: true }
+    } }, extensions: { retained: true } },
+    now: () => state.now, providers: [{ ...provider, requestTimeoutMs: 100 }], authorize: async (owner) => owner,
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(7) }, activeKeyId: "current" }) }),
+    resolveReference: async () => state.credential,
+    fetchImpl: async (address, init) => {
+      init.signal.throwIfAborted(); const url = String(address);
+      assert.equal(init.redirect, "error"); assert.equal(init.credentials, "omit");
+      const token = url === account.token_uri;
+      if (token) state.grants.push({ init, parameters: new URLSearchParams(init.body) });
+      else { assert.equal(url, "https://fcm.googleapis.com/v1/projects/target-project/messages:send"); state.requests.push({ init, body: JSON.parse(init.body) }); }
+      if (state.hang === (token ? "token" : "message")) {
+        state.started?.();
+        return new Promise((_, reject) => init.signal.addEventListener("abort", () => reject(init.signal.reason), { once: true }));
+      }
+      if (token && state.rawTokenResponse) return new Response("not-json", { status: 200 });
+      return token ? Response.json(state.tokenResponse ?? { token_type: "Bearer", access_token: `access-${state.grants.length}`, expires_in: 3600 }, { status: state.tokenStatus })
+        : Response.json(state.response ?? { name: "projects/target-project/messages/fixture-receipt" }, { status: state.status });
+    }
+  };
+  return { state, options, directory, service: createConnectionService(options) };
+}
+
+test("Firebase CLI validates both client modes, public fields and indirect credentials without accepting mixed setup", async (t) => {
+  const f = await fixture(t);
+  const parse = (config) => parseIntegrationConfiguration(JSON.stringify(config), { providers: [provider] });
+  assert.deepEqual(parse(f.options.configuration), f.options.configuration);
+  const browser = structuredClone(f.options.configuration); browser.integrations.push.settings = web;
+  assert.deepEqual(parse(browser).integrations.push.settings, web);
+  for (const changes of [{ projectId: "https://target-project" }, { projectId: "123456789012" }, { projectId: "UPPERCASE" }, { projectId: "bad-" }, { clientMode: "unknown" }, { apiKey: web.apiKey }]) {
+    const config = structuredClone(f.options.configuration); Object.assign(config.integrations.push.settings, changes);
+    assert.throws(() => parse(config), { code: "integration_configuration_invalid" });
+  }
+  for (const field of ["apiKey", "appId", "vapidKey"]) {
+    for (const value of [undefined, "", "env:WRONG_KIND", "raw-invalid-value"]) {
+      const config = structuredClone(browser); config.integrations.push.settings[field] = value;
+      assert.throws(() => parse(config), { code: "integration_configuration_invalid" });
+    }
+  }
+  for (const changes of [{ scopes: [] }, { scopes: ["openid"] }, { accountMode: "per-user" },
+    { authentication: { method: "service-account", secretRef: JSON.stringify(account) } },
+    { authentication: { method: "api-key", secretRef: "env:KEY" } },
+    { authentication: { method: "service-account", secretRef: "env:KEY", registrationRef: "google" } }]) {
+    const config = structuredClone(browser); Object.assign(config.integrations.push, changes);
+    assert.throws(() => parse(config), { code: "integration_configuration_invalid" });
+  }
+  assert.equal(f.state.grants.length, 0);
+});
+
+test("the browser helper returns only public Firebase settings and derives the sender ID without numeric rounding", () => {
+  const config = firebaseCloudMessagingWebConfiguration({ ...web, appId: "1:9007199254740993:web:abcdef1234567890" });
+  assert.deepEqual(config, { firebaseConfig: { projectId: web.projectId, apiKey: web.apiKey, appId: "1:9007199254740993:web:abcdef1234567890", messagingSenderId: "9007199254740993" }, vapidKey: web.vapidKey });
+  assert.throws(() => firebaseCloudMessagingWebConfiguration({ projectId: "project-id" }), TypeError);
+  assert.throws(() => firebaseCloudMessagingWebConfiguration({ ...web, private_key: account.private_key }));
+});
+
+test("Firebase signs a bounded RS256 assertion and verifies target-project IAM using only a dry-run message", async (t) => {
+  const f = await fixture(t); const connected = await f.service.connectServiceAccount(input);
+  assert.equal(connected.status, "connected"); assert.equal(f.state.grants.length, 1); assert.equal(f.state.requests.length, 1);
+  const grant = f.state.grants[0]; assert.equal(grant.parameters.get("grant_type"), "urn:ietf:params:oauth:grant-type:jwt-bearer");
+  assert.equal(new Headers(grant.init.headers).get("content-type"), "application/x-www-form-urlencoded");
+  const { payload, protectedHeader } = await jwtVerify(grant.parameters.get("assertion"), keys.publicKey, {
+    algorithms: ["RS256"], issuer: account.client_email, audience: account.token_uri, currentDate: new Date(f.state.now)
+  });
+  assert.deepEqual(protectedHeader, { alg: "RS256", typ: "JWT", kid: account.private_key_id });
+  assert.deepEqual(payload, { scope: firebaseMessagingScope, iss: account.client_email, aud: account.token_uri, iat: Math.floor(f.state.now / 1000), exp: Math.floor(f.state.now / 1000) + 3600 });
+  assert.deepEqual(f.state.requests[0].body, { validate_only: true, message: { topic: "jskit-connection-check", data: { connectionCheck: "true" } } });
+  assert.equal(new Headers(f.state.requests[0].init.headers).get("authorization"), "Bearer access-1");
+  for (const file of await readdir(f.directory)) {
+    const text = await readFile(path.join(f.directory, file), "utf8"); assert(!text.includes("access-1")); assert(!text.includes("PRIVATE KEY"));
+  }
+});
+
+test("explicit validate and send operations support each target and never replay or turn validation into delivery", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input);
+  for (const target of [{ fid: "fixture-fid" }, { token: "fixture-token" }, { topic: "news_updates" }, { condition: "'news' in topics && 'offers' in topics" }]) {
+    for (const operation of ["messages.validate", "messages.send"]) {
+      const value = { ...target, notification: message.notification, data: message.data };
+      const before = f.state.requests.length;
+      await f.service.invoke({ ...input, operation, input: { message: value } });
+      assert.deepEqual(f.state.requests.at(-1).body, { message: value, validate_only: operation === "messages.validate" });
+      assert.equal(f.state.requests.length, before + 1);
+    }
+  }
+  assert.equal(f.state.grants.length, 1);
+});
+
+test("Firebase rejects malformed targets, reserved data and oversized payloads before sending", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input); const before = f.state.requests.length;
+  for (const value of [{}, { ...message, topic: "extra-target" }, { ...message, fid: "white space" },
+    { topic: "/topics/news", data: { value: "x" } }, { fid: "x" }, { fid: "x", notification: {} },
+    { ...message, name: "projects/another/messages/1" }, { ...message, data: { count: 2 } },
+    { ...message, data: { from: "x" } }, { ...message, data: { "google.x": "x" } },
+    { ...message, data: { "gcm.notification.body": "x" } }, { ...message, data: { value: "💌".repeat(1100) } },
+    { topic: "news", data: { value: "x".repeat(2100) } }, { ...message, notification: { image: "http://image.test/x" } }]) {
+    await assert.rejects(f.service.invoke({ ...input, operation: "messages.send", input: { message: value } }), { code: "connector_input_invalid" });
+  }
+  await assert.rejects(f.service.invoke({ ...input, operation: "messages.send", input: { message, validate_only: true } }), { code: "connector_input_invalid" });
+  await assert.rejects(f.service.invoke({ ...input, operation: "messages.delete" }), { code: "connector_operation_unknown" });
+  assert.equal(f.state.requests.length, before);
+});
+
+test("Firebase accepts only explicit service-account keys and never loads another credential or token destination", async (t) => {
+  const f = await fixture(t);
+  for (const changes of [{ type: "external_account" }, { type: "authorized_user" }, { project_id: "../other" }, { private_key: "bad-key" },
+    { private_key_id: "unsafe\nkey" }, { client_email: "not-an-account@example.com" }, { token_uri: "http://169.254.169.254/token" },
+    { token_uri: "https://oauth2.googleapis.com/token?extra=1" }, { universe_domain: "other.googleapis.com" }]) {
+    f.state.credential = JSON.stringify({ ...account, ...changes });
+    await assert.rejects(f.service.connectServiceAccount(input), { code: "connector_binding_missing" });
+  }
+  f.state.credential = "{not-json";
+  await assert.rejects(f.service.connectServiceAccount(input), { code: "connector_binding_missing" });
+  assert.equal(f.state.grants.length, 0); assert.equal(f.state.requests.length, 0);
+});
+
+test("failed or malformed token grants remain disconnected and redact provider diagnostics", async (t) => {
+  const f = await fixture(t);
+  for (const [status, value, code] of [[400, { error: "invalid_grant" }, "connector_reconnect_required"],
+    [403, {}, "connector_permission_denied"], [429, {}, "connector_rate_limited"], [500, {}, "connector_provider_failed"],
+    [200, { access_token: "raw-private-token", token_type: "Bearer" }, "connector_response_invalid"],
+    [302, {}, "connector_response_invalid"]]) {
+    f.state.tokenStatus = status; f.state.tokenResponse = { ...value, error_description: account.private_key };
+    await assert.rejects(f.service.connectServiceAccount(input), (error) => error.code === code && !JSON.stringify(error).includes("PRIVATE KEY"));
+  }
+  f.state.rawTokenResponse = true;
+  await assert.rejects(f.service.connectServiceAccount(input), { code: "connector_response_invalid" });
+  assert.equal((await f.service.status(input)).status, "disconnected"); assert.equal(f.state.requests.length, 0);
+});
+
+test("Firebase cannot claim a connection for denied sends or a malformed or wrong-project receipt", async (t) => {
+  const f = await fixture(t);
+  for (const [status, response, code] of [[401, {}, "connector_reconnect_required"], [403, {}, "connector_permission_denied"],
+    [429, {}, "connector_rate_limited"], [500, {}, "connector_provider_failed"], [200, {}, "connector_response_invalid"],
+    [200, { name: "projects/other-project/messages/1" }, "connector_response_invalid"], [200, { name: "garbage" }, "connector_response_invalid"]]) {
+    f.state.status = status; f.state.response = response;
+    await assert.rejects(f.service.connectServiceAccount(input), { code });
+    assert.equal((await f.service.status(input)).status, "disconnected");
+  }
+});
+
+test("Firebase grants survive file restart, renew with rotated credentials and retain owner and project boundaries", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input);
+  const restarted = createConnectionService(f.options); await restarted.invoke({ ...input, operation: "messages.validate", input: { message } });
+  assert.equal(f.state.grants.length, 1); f.state.now += 3_600_000;
+  await restarted.invoke({ ...input, operation: "messages.validate", input: { message } }); assert.equal(f.state.grants.length, 2);
+  f.state.credential = JSON.stringify({ ...account, private_key_id: "b".repeat(40) });
+  await restarted.invoke({ ...input, operation: "messages.validate", input: { message } }); assert.equal(f.state.grants.length, 3);
+  for (const owner of [{ ...context, applicationId: "other" }, { ...context, subjectId: "other" }]) {
+    await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "messages.send", input: { message } }), { code: "connector_reconnect_required" });
+  }
+  const configuration = structuredClone(f.options.configuration); configuration.integrations.push.settings.projectId = "other-project";
+  const changed = createConnectionService({ ...f.options, configuration }); assert.equal((await changed.status(input)).status, "reconnect-required");
+  await assert.rejects(changed.invoke({ ...input, operation: "messages.send", input: { message } }), { code: "connector_reconnect_required" });
+  await restarted.disconnect(input); assert.equal((await f.service.status(input)).status, "disconnected");
+});
+
+test("sending requires application authorization over the exact audience and payload", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input);
+  let release; const paused = new Promise((resolve) => { release = resolve; }); let started;
+  const authorizing = new Promise((resolve) => { started = resolve; });
+  const service = createConnectionService({ ...f.options, authorize: async (owner, operation) => {
+    if (operation.operation !== "messages.send") return owner;
+    if (operation.input.message.fid !== message.fid) return null;
+    started(); await paused; operation.input.message.fid = "policy-mutation"; return owner;
+  } });
+  await assert.rejects(service.invoke({ ...input, operation: "messages.send", input: { message: { ...message, fid: "not-owned" } } }), { code: "connector_access_denied" });
+  const values = { message: structuredClone(message) };
+  const pending = service.invoke({ ...input, operation: "messages.send", input: values }); await authorizing;
+  values.message.fid = "caller-mutation"; release(); await pending;
+  assert.equal(f.state.requests.at(-1).body.message.fid, message.fid);
+});
+
+test("Firebase cancellation and timeout never retry a token exchange or notification send", async (t) => {
+  const f = await fixture(t);
+  for (const stage of ["token", "message"]) {
+    f.state.hang = stage; const control = new AbortController(); const started = new Promise((resolve) => { f.state.started = resolve; });
+    const pending = f.service.connectServiceAccount({ ...input, signal: control.signal }); await started; control.abort();
+    await assert.rejects(pending, { code: "connector_cancelled" });
+  }
+  f.state.hang = false; await f.service.connectServiceAccount(input);
+  f.state.hang = "message"; const before = f.state.requests.length;
+  const keepAlive = setTimeout(() => {}, 1000);
+  try { await assert.rejects(f.service.invoke({ ...input, operation: "messages.send", input: { message } }), { code: "connector_provider_timeout" }); } finally { clearTimeout(keepAlive); }
+  assert.equal(f.state.requests.length, before + 1); assert.equal((await f.service.status(input)).status, "connected");
+});
+
+test("the published Firebase setup example validates as the same CLI configuration", async () => {
+  const guide = await readFile(new URL("../docs/firebase-cloud-messaging.md", import.meta.url), "utf8");
+  const source = guide.match(/```json\n([\s\S]*?)\n```/u)[1];
+  const config = parseIntegrationConfiguration(source, { providers: [provider] });
+  assert.equal(config.integrations.push.authentication.method, "service-account");
+  assert.equal(config.integrations.push.settings.projectId, "my-notifications-app");
+  assert.deepEqual(config.registrations, {});
+});
+
+
+test("Firebase distinguishes expired recipients from malformed payloads without invalidating the sender grant", async t => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input);
+  f.state.status = 404; f.state.response = { error: { message: "private provider diagnostics", details: [
+    { "@type": "type.googleapis.com/google.firebase.fcm.v1.FcmError", errorCode: "UNREGISTERED" }
+  ] } };
+  for (const target of [{ fid: "old-installation" }, { token: "old-token" }]) {
+    const before = f.state.requests.length;
+    await assert.rejects(f.service.invoke({ ...input, operation: "messages.send", input: { message: { ...target, data: { orderId: "42" } } } }), error => error.code === "connector_recipient_unregistered" && !error.message.includes("private provider"));
+    assert.equal(f.state.requests.length, before + 1);
+    assert.equal((await f.service.status(input)).status, "connected");
+  }
+  f.state.status = 400; f.state.response = { error: { details: [{ "@type": "type.googleapis.com/google.firebase.fcm.v1.FcmError", errorCode: "INVALID_ARGUMENT" }] } };
+  await assert.rejects(f.service.invoke({ ...input, operation: "messages.send", input: { message } }), { code: "connector_message_invalid" });
+  f.state.status = 404; f.state.response = { error: { status: "NOT_FOUND" } };
+  await assert.rejects(f.service.invoke({ ...input, operation: "messages.send", input: { message } }), { code: "connector_provider_failed" });
+  f.state.status = 200; f.state.response = undefined;
+  assert.equal((await f.service.invoke({ ...input, operation: "messages.send", input: { message } })).name, "projects/target-project/messages/fixture-receipt");
+});

package/test/firecrawl.test.js

@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { firecrawlProvider } from "../src/server/firecrawl.js";
+
+test("Firecrawl searches and imports bounded crawl pages without leaking the key or replaying paid work", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "firecrawl-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = []; let status = 200; let fail = false; let malformed = false; let deny = false; let key = "fixture-key";
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { firecrawl: { provider: "firecrawl", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:FIRECRAWL_API_KEY" } } } },
+    providers: [firecrawlProvider], authorize: async owner => { if (deny) throw new Error("denied"); return owner; },
+    resolveReference: async () => key,
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current" }) }),
+    fetchImpl: async (url, init) => {
+      const parsed = new URL(url); requests.push({ url: parsed, init });
+      assert.equal(parsed.origin, "https://api.firecrawl.dev");
+      assert.equal(new Headers(init.headers).get("authorization"), `Bearer ${key}`);
+      assert.equal(init.redirect, "error");
+      if (fail) throw new Error("unknown outcome");
+      if (status !== 200) return Response.json({ success: false }, { status });
+      if (malformed) return Response.json({ success: true });
+      const body = init.body ? JSON.parse(init.body) : {};
+      if (parsed.pathname.endsWith("credit-usage")) return Response.json({ success: true, data: { remainingCredits: 0 } });
+      if (parsed.pathname.endsWith("/search")) return Response.json({ success: true, data: { web: [{ url: "https://example.com", markdown: "Search content" }] } });
+      if (parsed.pathname.endsWith("/map")) return Response.json({ success: true, links: [{ url: "https://example.com/docs" }] });
+      if (parsed.pathname.endsWith("/scrape")) return Response.json({ success: true, data: typeof body.formats[0] === "object" ? { json: { title: "Docs" } } : { markdown: "# Docs" } });
+      if (parsed.pathname.endsWith("/errors")) return Response.json({ errors: [{ url: "https://example.com/missing", error: "404" }], robotsBlocked: [] });
+      if (init.method === "DELETE") return Response.json({ status: "cancelled" });
+      if (init.method === "POST") return Response.json({ success: true, id: "job-one" });
+      return Response.json({ status: "completed", total: 2, completed: 2, data: [{ markdown: parsed.search ? "Page two" : "Page one" }], next: parsed.search ? null : "https://api.firecrawl.dev/v2/crawl/job-one?skip=1" });
+    }
+  });
+  const owner = { context: { applicationId: "docs-app", subjectId: "workspace" }, integrationId: "firecrawl" };
+  const invoke = (operation, input) => service.invoke({ ...owner, operation, input });
+  await service.connectApiKey(owner);
+  assert.equal((await invoke("pages.scrape", { url: "https://example.com" })).data.markdown, "# Docs");
+  assert.equal((await invoke("pages.search", { query: "docs", includeContent: true })).data.web[0].markdown, "Search content");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { query: "docs", limit: 5, sources: ["web"], scrapeOptions: { formats: ["markdown"] } });
+  assert.equal((await invoke("sites.map", { url: "https://example.com", limit: 20 })).links.length, 1);
+  assert.equal((await invoke("pages.extract", { url: "https://example.com", schema: { type: "object", properties: { title: { type: "string" } } } })).data.json.title, "Docs");
+  const job = await invoke("crawls.start", { url: "https://example.com", limit: 20 });
+  assert.equal(job.id, "job-one");
+  assert.equal(JSON.parse(requests.at(-1).init.body).allowExternalLinks, false);
+  const first = await invoke("crawls.get", { id: job.id });
+  const second = await invoke("crawls.get", { id: job.id, next: first.next });
+  assert.equal(second.data[0].markdown, "Page two"); assert.equal(second.next, null);
+  assert.equal((await invoke("crawls.errors", { id: job.id })).errors[0].error, "404");
+  assert.equal((await invoke("crawls.cancel", { id: job.id })).status, "cancelled");
+  const before = requests.length;
+  for (const next of ["https://evil.example/v2/crawl/job-one", "https://api.firecrawl.dev/v2/crawl/another", "https://key@api.firecrawl.dev/v2/crawl/job-one"]) await assert.rejects(invoke("crawls.get", { id: job.id, next }), { code: "connector_input_invalid" });
+  for (const input of [{ url: "https://example.com" }, { url: "file:///secret", limit: 1 }, { url: "https://user:pass@example.com", limit: 1 }, { url: "https://example.com", limit: 1001 }]) await assert.rejects(invoke("crawls.start", input), { code: "connector_input_invalid" });
+  deny = true; await assert.rejects(invoke("pages.search", { query: "docs" })); deny = false;
+  assert.equal(requests.length, before);
+  malformed = true; await assert.rejects(invoke("crawls.get", { id: job.id }), { code: "connector_response_invalid" }); malformed = false;
+  for (const [httpStatus, code] of [[403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) { status = httpStatus; await assert.rejects(invoke("crawls.start", { url: "https://example.com", limit: 1 }), { code }); }
+  status = 200; fail = true; const failedBefore = requests.length; await assert.rejects(invoke("crawls.start", { url: "https://example.com", limit: 1 })); assert.equal(requests.length, failedBefore + 1); fail = false;
+  key = "rotated-key"; await service.connectApiKey(owner);
+  await service.disconnect(owner); const disconnected = requests.length;
+  await assert.rejects(invoke("pages.search", { query: "docs" })); assert.equal(requests.length, disconnected);
+  await service.connectApiKey(owner); assert.equal((await invoke("credits.read")).data.remainingCredits, 0);
+});

package/test/gemini-enterprise.test.js

@@ -0,0 +1,218 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { geminiEnterpriseProvider } from "../src/server/gemini-enterprise.js";
+
+const scope = "https://www.googleapis.com/auth/cloud-platform";
+const context = { applicationId: "app-one", subjectId: "owner-one" };
+const args = { context, integrationId: "enterprise-search" };
+const callback = "https://app.example.test/oauth/gemini-enterprise/callback";
+const searchPage = { results: [{ id: "policy", document: { id: "policy", structData: { title: "Holiday policy" } } }], totalSize: 2, attributionToken: "search-reference", nextPageToken: "next+/=&" };
+
+async function fixture(t, { location = "global", accountMode = "shared" } = {}) {
+  const directory = await mkdtemp(path.join(tmpdir(), "gemini-enterprise-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const configuration = { schemaVersion: 1, registrations: { google: { source: "own", clientId: "fixture-google-client",
+    clientSecretRef: "env:GEMINI_SECRET", callbackUrlRef: "env:GEMINI_CALLBACK" } }, integrations: {
+    "enterprise-search": { provider: "gemini-enterprise", accountMode, settings: { projectId: "my-gcp-project", location, engineId: "company_search-1" },
+      scopes: [scope], authentication: { method: "oauth2", registrationRef: "google" } }
+  } };
+  const engine = { name: `projects/123456789012/locations/${location}/collections/default_collection/engines/company_search-1`, displayName: "Company search" };
+  const state = { time: Date.now(), count: 0, value: undefined, status: 200, tokenPatch: {}, tokenStatus: 200, hang: false };
+  const requests = [];
+  const options = { configuration, providers: [{ ...geminiEnterpriseProvider, requestTimeoutMs: 60 }], authorize: async (owner) => owner,
+    now: () => state.time, resolveReference: async (ref) => {
+      if (ref === "env:GEMINI_SECRET") return "private-client-secret";
+      assert.equal(ref, "env:GEMINI_CALLBACK"); return callback;
+    },
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current" }) }),
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)); requests.push({ url, init });
+      const headers = new Headers(init.headers);
+      if (url.href === "https://oauth2.googleapis.com/token") {
+        assert.equal(init.method, "POST"); const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_id"), "fixture-google-client"); assert.equal(body.get("client_secret"), "private-client-secret");
+        if (body.get("grant_type") === "authorization_code") {
+          assert.equal(body.get("redirect_uri"), callback); assert.equal(body.get("code"), "private-code"); assert.ok(body.get("code_verifier"));
+        } else {
+          assert.equal(body.get("grant_type"), "refresh_token"); assert.equal(body.get("refresh_token"), `private-refresh-${state.count}`);
+        }
+        state.count++;
+        return Response.json(state.tokenStatus === 200 ? { access_token: `private-access-${state.count}`, token_type: "Bearer", expires_in: 120,
+          refresh_token: `private-refresh-${state.count}`, scope, ...state.tokenPatch } : { error: "invalid_grant", message: "private-provider-error" }, { status: state.tokenStatus });
+      }
+      assert.equal(url.origin, `https://${location === "global" ? "" : `${location}-`}discoveryengine.googleapis.com`);
+      const expected = `/v1/projects/my-gcp-project/locations/${location}/collections/default_collection/engines/company_search-1`;
+      assert.equal(url.pathname, init.method === "POST" ? `${expected}/servingConfigs/default_serving_config:search` : expected);
+      assert.equal(init.redirect, "error"); assert.equal(headers.get("authorization"), `Bearer private-access-${state.count}`);
+      assert.equal(init.credentials, "omit"); assert.equal(url.search, "");
+      if (init.method === "POST") assert.ok(headers.get("content-type").includes("application/json")); else assert.equal(init.method, "GET");
+      if (state.hang) return new Promise((_, reject) => {
+        const timer = setTimeout(() => reject(new Error("Missing abort")), 1000);
+        const abort = () => { clearTimeout(timer); reject(init.signal.reason); };
+        if (init.signal.aborted) abort(); else init.signal.addEventListener("abort", abort, { once: true });
+      });
+      if (state.status === 204) return new Response(null, { status: 204 });
+      if (typeof state.value === "string") return new Response(state.value, { status: state.status });
+      return Response.json(state.value === undefined ? init.method === "POST" ? searchPage : engine : state.value, { status: state.status });
+    }
+  };
+  const service = createConnectionService(options);
+  const start = async () => {
+    const { authorizationUrl } = await service.beginAuthorization(args); const url = new URL(authorizationUrl);
+    const returned = new URL(callback); returned.searchParams.set("state", url.searchParams.get("state")); returned.searchParams.set("code", "private-code");
+    return { url, callbackUrl: returned.href };
+  };
+  const connect = async () => service.completeAuthorization({ ...args, callbackUrl: (await start()).callbackUrl });
+  return { directory, options, service, requests, state, engine, start, connect };
+}
+
+test("Gemini Enterprise uses Google PKCE consent and the configured regional engine, with encrypted restartable storage", async (t) => {
+  for (const location of ["global", "us", "eu"]) {
+    const f = await fixture(t, { location, accountMode: location === "eu" ? "assistant" : "shared" }); const start = await f.start();
+    assert.equal(start.url.origin + start.url.pathname, "https://accounts.google.com/o/oauth2/v2/auth");
+    assert.equal(start.url.searchParams.get("scope"), scope); assert.equal(start.url.searchParams.get("access_type"), "offline");
+    assert.equal(start.url.searchParams.get("prompt"), "consent"); assert.equal(start.url.searchParams.get("code_challenge_method"), "S256");
+    assert.equal(start.url.searchParams.has("client_secret"), false);
+    await f.service.completeAuthorization({ ...args, callbackUrl: start.callbackUrl });
+    const restarted = createConnectionService(f.options);
+    assert.equal((await restarted.status(args)).status, "connected");
+    assert.deepEqual(await restarted.invoke({ ...args, operation: "engine.get" }), f.engine);
+    for (const file of await readdir(f.directory)) {
+      const value = await readFile(path.join(f.directory, file), "utf8");
+      for (const secret of ["private-code", "private-client-secret", "private-access-1", "private-refresh-1"]) assert.equal(value.includes(secret), false);
+    }
+  }
+});
+
+test("Gemini Enterprise search sends bounded JSON pages and preserves results, opaque cursors and redirect data", async (t) => {
+  const f = await fixture(t); await f.connect();
+  assert.deepEqual(await f.service.invoke({ ...args, operation: "search", input: { query: "holiday policy & travel" } }), searchPage);
+  assert.deepEqual(JSON.parse(f.requests.at(-1).init.body), { query: "holiday policy & travel", pageSize: 10 });
+  const input = { query: "holiday policy & travel", pageSize: 25, pageToken: "next+/=&" };
+  await f.service.invoke({ ...args, operation: "search", input }); assert.deepEqual(JSON.parse(f.requests.at(-1).init.body), input);
+  for (const value of [{ attributionToken: "empty" }, { results: [], totalSize: 0, attributionToken: "empty", nextPageToken: "" },
+    { attributionToken: "redirect", redirectUri: "https://elsewhere.example.test/result" }]) {
+    f.state.value = value; assert.deepEqual(await f.service.invoke({ ...args, operation: "search", input: { query: "empty" } }), value);
+  }
+  assert.equal(f.requests.length, 7);
+});
+
+test("Gemini Enterprise rejects caller target and identity overrides, invalid page input and unauthorized scopes before transport", async (t) => {
+  const f = await fixture(t); await f.connect(); const count = f.requests.length;
+  for (const input of [{}, { query: "" }, { query: "x".repeat(4097) }, { query: "x", pageSize: 0 }, { query: "x", pageSize: 26 },
+    { query: "x", pageSize: 1.5 }, { query: "x", pageToken: "" }, { query: "x", pageToken: "a".repeat(16001) },
+    { query: "x", projectId: "other-project" }, { query: "x", userInfo: { userId: "someone" } }, { query: "x", servingConfig: "other" }]) {
+    await assert.rejects(f.service.invoke({ ...args, operation: "search", input }));
+  }
+  await assert.rejects(f.service.invoke({ ...args, operation: "engine.get", input: { engineId: "other" } }));
+  const denied = createConnectionService({ ...f.options, authorize: async () => { throw new Error("Denied by host"); } });
+  await assert.rejects(denied.invoke({ ...args, operation: "engine.get" }), /Denied by host/u);
+  assert.equal(f.requests.length, count);
+  const narrowed = await fixture(t); narrowed.state.tokenPatch.scope = "https://www.googleapis.com/auth/other";
+  await assert.rejects(narrowed.connect(), { code: "connector_scope_missing" }); assert.equal(narrowed.requests.length, 1);
+});
+
+test("Gemini Enterprise binds stored grants and pending consent to their application, owner and settings", async (t) => {
+  const f = await fixture(t); await f.connect(); const count = f.requests.length;
+  for (const owner of [{ ...context, applicationId: "other" }, { ...context, subjectId: "other" }]) {
+    await assert.rejects(f.service.invoke({ ...args, context: owner, operation: "engine.get" }), { code: "connector_reconnect_required" });
+  }
+  for (const [key, value] of [["projectId", "another-project"], ["location", "eu"], ["engineId", "another-engine"]]) {
+    const configuration = structuredClone(f.options.configuration); configuration.integrations["enterprise-search"].settings[key] = value;
+    const changed = createConnectionService({ ...f.options, configuration });
+    assert.equal((await changed.status(args)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...args, operation: "engine.get" }), { code: "connector_reconnect_required" });
+    const start = await f.start(); await assert.rejects(changed.completeAuthorization({ ...args, callbackUrl: start.callbackUrl }), { code: "connector_attempt_invalid" });
+  }
+  assert.equal(f.requests.length, count);
+});
+
+test("Gemini Enterprise refreshes rotated grants, keeps Google scopes bounded and reports missing or revoked refresh access", async (t) => {
+  const f = await fixture(t); await f.connect(); f.state.time += 121_000;
+  f.state.tokenPatch.scope = `${scope} https://www.googleapis.com/auth/drive`;
+  await f.service.invoke({ ...args, operation: "engine.get" });
+  assert.deepEqual((await f.service.status(args)).grantedScopes, [scope]);
+  f.state.time += 121_000; f.state.tokenStatus = 400;
+  await assert.rejects(f.service.invoke({ ...args, operation: "engine.get" }), { code: "connector_reconnect_required" });
+  const short = await fixture(t); short.state.tokenPatch.refresh_token = undefined; await short.connect(); short.state.time += 121_000;
+  await assert.rejects(short.service.invoke({ ...args, operation: "engine.get" }), { code: "connector_reconnect_required" }); assert.equal(short.requests.length, 2);
+});
+
+test("Gemini Enterprise consumes denied, cancelled and replayed attempts without destroying earlier access", async (t) => {
+  const f = await fixture(t); await f.connect();
+  const denied = await f.start(); const url = new URL(denied.callbackUrl); url.searchParams.delete("code"); url.searchParams.set("error", "access_denied");
+  await assert.rejects(f.service.completeAuthorization({ ...args, callbackUrl: url.href }), { code: "connector_consent_denied" });
+  await assert.rejects(f.service.completeAuthorization({ ...args, callbackUrl: denied.callbackUrl }), { code: "connector_attempt_invalid" });
+  const cancelled = await f.start(); await f.service.cancelAuthorization({ ...args, state: cancelled.url.searchParams.get("state") });
+  await assert.rejects(f.service.completeAuthorization({ ...args, callbackUrl: cancelled.callbackUrl }), { code: "connector_attempt_invalid" });
+  assert.equal((await f.service.status(args)).status, "connected"); assert.equal(f.requests.length, 2);
+});
+
+test("Gemini Enterprise rejects malformed metadata and result envelopes without treating them as verified access", async (t) => {
+  for (const value of [null, {}, [], { error: { message: "private" } }, { name: "engine", displayName: "Company" }, { name: "projects/123/locations/global/collections/default_collection/engines/engine" }]) {
+    const f = await fixture(t); f.state.value = value;
+    await assert.rejects(f.connect(), { code: "connector_response_invalid" }); assert.equal((await f.service.status(args)).status, "disconnected");
+  }
+  const f = await fixture(t); await f.connect();
+  for (const value of [null, {}, [], { attributionToken: "" }, { attributionToken: "a", results: null }, { attributionToken: "a", results: [{}] },
+    { attributionToken: "a", results: [{ id: "a", document: null }] }, { attributionToken: "a", totalSize: -1 }, { attributionToken: "a", nextPageToken: 1 },
+    { attributionToken: "a", redirectUri: {} }, { attributionToken: "a", error: {} }, { ...searchPage, results: Array(26).fill(searchPage.results[0]) }, "<html>private-error</html>"]) {
+    f.state.value = value; await assert.rejects(f.service.invoke({ ...args, operation: "search", input: { query: "query" } }), { code: "connector_response_invalid" });
+  }
+});
+
+test("Gemini Enterprise sanitizes API failures, aborts pending requests and disconnects locally", async (t) => {
+  const f = await fixture(t); await f.connect();
+  for (const [status, code] of [[403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    f.state.status = status; f.state.value = { error: { message: "private-provider-error" } };
+    await assert.rejects(f.service.invoke({ ...args, operation: "search", input: { query: "query" } }), (error) => error.code === code && !error.message.includes("private"));
+  }
+  f.state.hang = true; const controller = new AbortController();
+  const pending = f.service.invoke({ ...args, operation: "engine.get", signal: controller.signal }); setTimeout(() => controller.abort(), 10);
+  await assert.rejects(pending, { code: "connector_cancelled" });
+  await assert.rejects(f.service.invoke({ ...args, operation: "engine.get" }), { code: "connector_provider_timeout" });
+  f.state.hang = false; f.state.status = 401;
+  await assert.rejects(f.service.invoke({ ...args, operation: "engine.get" }), { code: "connector_reconnect_required" });
+  await f.service.disconnect(args); assert.equal((await f.service.status(args)).status, "disconnected");
+});
+
+test("Gemini Enterprise guide and CLI share identifier, location, permission and reference validation", async () => {
+  const guide = await readFile(new URL("../docs/gemini-enterprise.md", import.meta.url), "utf8");
+  const config = JSON.parse([...guide.matchAll(/```json\n([\s\S]*?)\n```/gu)][0][1]);
+  const parse = (value) => parseIntegrationConfiguration(JSON.stringify(value), { providers: [geminiEnterpriseProvider] });
+  assert.deepEqual(parse(config), config);
+  for (const [key, values] of Object.entries({ projectId: ["", "123456789012", "My-Project", "my-project/other", "my-project ", "a".repeat(31)],
+    engineId: ["", "-bad", "UPPER", "engine/../other", "a".repeat(64)], location: ["", "https://attacker.test", "ca", "US"] })) {
+    for (const value of values) {
+      const invalid = structuredClone(config); invalid.integrations["enterprise-search"].settings[key] = value;
+      assert.throws(() => parse(invalid), (error) => Boolean(error.fieldErrors[`integrations.enterprise-search.settings.${key}`]));
+    }
+  }
+  for (const [key, value] of [["clientSecretRef", "private-secret"], ["callbackUrlRef", callback], ["tokenEndpointAuthMethod", "none"]]) {
+    const invalid = structuredClone(config); invalid.registrations["google-search"][key] = value;
+    assert.throws(() => parse(invalid), (error) => Boolean(error.fieldErrors[`registrations.google-search.${key}`]));
+  }
+  const unsupported = structuredClone(config); unsupported.integrations["enterprise-search"].accountMode = "per-user";
+  assert.throws(() => parse(unsupported));
+});
+
+
+test("Gemini Enterprise returns source snippets and cited provider summaries only when explicitly requested", async t => {
+  const f = await fixture(t); await f.connect();
+  const value = { ...searchPage, results: [{ id: "policy", document: { id: "policy", derivedStructData: { title: "Holiday policy", link: "https://company.example/policy", snippets: [{ snippet: "Request leave a week ahead.", snippet_status: "SUCCESS" }] } } }], summary: { summaryText: "Request leave a week ahead. [1]" } };
+  f.state.value = value;
+  const contentSearchSpec = { snippetSpec: { returnSnippet: true }, summarySpec: { summaryResultCount: 3 } };
+  const result = await f.service.invoke({ ...args, operation: "search", input: { query: "How do I request leave?", contentSearchSpec } });
+  assert.equal(result.summary.summaryText, value.summary.summaryText);
+  assert.equal(result.results[0].document.derivedStructData.snippets[0].snippet, "Request leave a week ahead.");
+  assert.deepEqual(JSON.parse(f.requests.at(-1).init.body).contentSearchSpec.summarySpec, { summaryResultCount: 3, includeCitations: true, ignoreAdversarialQuery: true, ignoreNonSummarySeekingQuery: true, ignoreLowRelevantContent: true });
+  f.state.value = { attributionToken: "none", summary: { summarySkippedReasons: ["NO_RELEVANT_CONTENT"] } };
+  assert.deepEqual((await f.service.invoke({ ...args, operation: "search", input: { query: "unavailable", contentSearchSpec } })).summary.summarySkippedReasons, ["NO_RELEVANT_CONTENT"]);
+  await assert.rejects(f.service.invoke({ ...args, operation: "search", input: { query: "q", contentSearchSpec: { summarySpec: { summaryResultCount: 11 } } } }));
+});