@jskit-ai/connectors-catalog 0.1.1

package/test/github-api.test.js

@@ -0,0 +1,167 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { githubApiProvider } from "../src/server/github-api.js";
+
+for (const perUser of [false, true]) test(`GitHub OAuth ${perUser ? "per-user non-expiring" : "shared rotating"} grants preserve protocol and ownership`, async (t) => {
+  const directory = await mkdtemp(path.join(tmpdir(), "github-oauth-test-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const callback = "https://example.test/integrations/github-api/callback";
+  const context = { applicationId: "app", subjectId: "owner" };
+  const input = { context, integrationId: "github" };
+  let time = Date.now(), exchanges = 0;
+  let tokenScope = "read:user,repo", apiStatus = 200;
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(4) }, activeKeyId: "current" });
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { github: { source: "own", clientId: "client", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK", tokenEndpointAuthMethod: "client_secret_post" } }, integrations: {
+      github: { provider: "github-api", accountMode: perUser ? "per-user" : "shared", scopes: ["read:user", "repo"], authentication: { method: "oauth2", registrationRef: "github" } },
+      personal: { provider: "github-api", accountMode: "shared", scopes: ["read:user", "repo"], authentication: { method: "api-key", secretRef: "env:TOKEN" } }
+    } }, providers: [githubApiProvider], authorize: async owner => owner,
+    store: createFileConnectionStore({ directory, protection }), now: () => time,
+    resolveReference: async ref => ref === "env:CALLBACK" ? callback : ref === "env:TOKEN" ? "personal" : "secret",
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)), headers = new Headers(init.headers);
+      if (url.origin === "https://github.com") {
+        assert.equal(url.pathname, "/login/oauth/access_token");
+        assert.equal(headers.get("accept"), "application/json");
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_secret"), "secret");
+        if (body.get("grant_type") === "authorization_code") {
+          assert.equal(body.get("redirect_uri"), callback);
+          assert.ok(body.get("code_verifier"));
+        } else assert.equal(body.get("refresh_token"), `refresh-${exchanges}`);
+        exchanges++;
+        if (perUser) return Response.json({ access_token: `access-${exchanges}`, token_type: "Bearer", scope: tokenScope });
+        return Response.json({ access_token: `access-${exchanges}`, refresh_token: `refresh-${exchanges}`, token_type: "Bearer", expires_in: 60, scope: tokenScope });
+      }
+      assert.equal(url.origin, "https://api.github.com");
+      assert.ok([`Bearer access-${exchanges}`, "Bearer personal"].includes(headers.get("authorization")));
+      if (apiStatus !== 200) return Response.json({ message: "private provider detail" }, { status: apiStatus });
+      assert.equal(headers.get("x-github-api-version"), "2026-03-10");
+      assert.equal(headers.get("user-agent"), "jskit-connectors");
+      return Response.json({ id: 123, login: "fixture" });
+    }
+  };
+  const service = createConnectionService(options);
+  for (const outcome of ["cancel", "denied"]) {
+    const attempt = new URL((await service.beginAuthorization(input)).authorizationUrl);
+    const denied = new URL(callback);
+    denied.searchParams.set("state", attempt.searchParams.get("state"));
+    if (outcome === "cancel") {
+      await service.cancelAuthorization({ ...input, state: attempt.searchParams.get("state") });
+      denied.searchParams.set("code", "unused");
+    } else denied.searchParams.set("error", "access_denied");
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: denied.href }), {
+      code: outcome === "cancel" ? "connector_attempt_invalid" : "connector_consent_denied"
+    });
+  }
+  assert.equal(exchanges, 0);
+  const { authorizationUrl } = await service.beginAuthorization(input);
+  const url = new URL(authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://github.com/login/oauth/authorize");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  const returned = new URL(callback);
+  returned.searchParams.set("code", "code");
+  returned.searchParams.set("state", url.searchParams.get("state"));
+  assert.equal((await service.completeAuthorization({ ...input, callbackUrl: returned.href })).status, "connected");
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: returned.href }), { code: "connector_attempt_invalid" });
+  time += 40_000;
+  await Promise.all([service.invoke({ ...input, operation: "account.read" }), service.invoke({ ...input, operation: "account.read" })]);
+  assert.equal(exchanges, perUser ? 1 : 2);
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  time += 40_000;
+  await restarted.invoke({ ...input, operation: "account.read" });
+  assert.equal(exchanges, perUser ? 1 : 3);
+  assert.equal((await restarted.connectApiKey({ context, integrationId: "personal" })).status, "connected");
+  const otherApp = { context: { ...context, applicationId: "another-app" }, integrationId: "github" };
+  assert.equal((await restarted.status(otherApp)).status, "disconnected");
+  if (perUser) {
+    const otherUser = { context: { ...context, subjectId: "another-user" }, integrationId: "github" };
+    assert.equal((await restarted.status(otherUser)).status, "disconnected");
+    await assert.rejects(restarted.invoke({ ...otherUser, operation: "account.read" }));
+    assert.equal((await restarted.status(input)).status, "connected");
+  }
+  await restarted.disconnect(input);
+  assert.equal((await restarted.status(input)).status, "disconnected");
+});
+
+test("GitHub token normalization rejects malformed grants and retains OAuth error responses", async () => {
+  for (const scope of [null, ["repo"], "repo,,gist", "repo gist", { repo: true }]) {
+    await assert.rejects(githubApiProvider.normalizeTokenResponse(Response.json({ access_token: "private", token_type: "bearer", scope })), { code: "connector_response_invalid" });
+  }
+  const failure = Response.json({ error: "bad_verification_code" });
+  assert.equal(await githubApiProvider.normalizeTokenResponse(failure), failure);
+  const denied = new Response("denied", { status: 403 });
+  assert.equal(await githubApiProvider.normalizeTokenResponse(denied), denied);
+  for (const scope of ["", "read:user", "read:user,repo"]) {
+    const result = await githubApiProvider.normalizeTokenResponse(Response.json({ access_token: "private", token_type: "bearer", scope }));
+    assert.equal((await result.json()).scope, scope.replaceAll(",", " "));
+  }
+});
+
+test("GitHub repository reads and issue/PR writes preserve paths, pagination and uncertain outcomes", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "github-content-test-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = []; let status = 200, malformed = false, fail = false;
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { github: { provider: "github-api", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:GITHUB_TOKEN" } } } },
+    providers: [githubApiProvider], authorize: async owner => owner, resolveReference: async () => "private-token",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current" }) }),
+    fetchImpl: async (url, init) => {
+      const parsed = new URL(url); requests.push({ url: parsed, init });
+      assert.equal(parsed.origin, "https://api.github.com");
+      assert.equal(new Headers(init.headers).get("authorization"), "Bearer private-token");
+      assert.equal(init.redirect, "error");
+      if (fail) throw new Error("outcome unknown");
+      if (status !== 200) return Response.json({ message: "private provider detail" }, { status });
+      if (malformed) return Response.json({});
+      const route = parsed.pathname;
+      if (route === "/user") return Response.json({ id: 1, login: "owner" });
+      if (route.endsWith("/contents/docs/read%20me.md")) return Response.json({ type: "file", path: "docs/read me.md", encoding: "base64", content: Buffer.from("Useful documentation").toString("base64") });
+      if (route.endsWith("/actions/runs")) return Response.json({ workflow_runs: [{ id: 2, conclusion: "success" }] });
+      if (route === "/repos/owner/project") return Response.json({ id: 1, full_name: "owner/project" });
+      if (init.method === "POST" || init.method === "PATCH") return Response.json({ number: 7, title: "Fix checkout", ...JSON.parse(init.body) });
+      if (/\/(issues|pulls)\/7$/.test(route)) return Response.json({ number: 7, title: "Fix checkout", body: "Customer report" });
+      return Response.json([{ id: 3, name: "main", body: "Review comment", sha: "revision" }]);
+    }
+  });
+  const owner = { context: { applicationId: "repo-app", subjectId: "owner" }, integrationId: "github" };
+  const invoke = (operation, input = {}) => service.invoke({ ...owner, operation, input: { owner: "owner", repo: "project", ...input } });
+  await service.connectApiKey(owner);
+  assert.equal((await invoke("repositories.get")).full_name, "owner/project");
+  const content = await invoke("contents.get", { path: "docs/read me.md", ref: "feature/docs" });
+  assert.equal(Buffer.from(content.content, content.encoding).toString(), "Useful documentation");
+  assert.equal(requests.at(-1).url.searchParams.get("ref"), "feature/docs");
+  for (const operation of ["branches.list", "commits.list", "releases.list", "issues.list", "pulls.list", "issues.comments", "pulls.reviews"]) {
+    const input = operation.endsWith("comments") || operation.endsWith("reviews") ? { number: 7 } : {};
+    assert.equal((await invoke(operation, { ...input, page: 2, per_page: 10 })).length, 1);
+    assert.equal(requests.at(-1).url.searchParams.get("page"), "2");
+  }
+  assert.equal((await invoke("workflows.runs")).workflow_runs[0].conclusion, "success");
+  for (const operation of ["issues.get", "pulls.get"]) assert.equal((await invoke(operation, { number: 7 })).body, "Customer report");
+  await invoke("issues.create", { title: "Fix checkout", body: "Customer report" });
+  assert.equal(requests.at(-1).init.method, "POST");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { title: "Fix checkout", body: "Customer report" });
+  await invoke("pulls.create", { title: "Fix checkout", head: "fix/checkout", base: "main" });
+  assert.equal(JSON.parse(requests.at(-1).init.body).draft, false);
+  for (const operation of ["issues.update", "pulls.update"]) {
+    assert.equal((await invoke(operation, { number: 7, state: "closed" })).state, "closed");
+    assert.equal(requests.at(-1).init.method, "PATCH");
+    assert.deepEqual(JSON.parse(requests.at(-1).init.body), { state: "closed" });
+  }
+  const before = requests.length;
+  for (const [operation, input] of [["contents.get", { path: "../secret" }], ["repositories.get", { owner: "other/owner" }], ["issues.list", { per_page: 101 }], ["issues.update", { number: 7 }], ["pulls.create", { title: "x", head: "x" }]]) await assert.rejects(invoke(operation, input));
+  assert.equal(requests.length, before);
+  malformed = true; await assert.rejects(invoke("issues.create", { title: "x" }), { code: "connector_response_invalid" }); malformed = false;
+  for (const [httpStatus, code] of [[403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) { status = httpStatus; await assert.rejects(invoke("issues.create", { title: "x" }), { code }); }
+  status = 200; fail = true; const failedBefore = requests.length;
+  await assert.rejects(invoke("pulls.create", { title: "x", head: "fix", base: "main" }));
+  assert.equal(requests.length, failedBefore + 1); fail = false;
+  await service.disconnect(owner); const disconnected = requests.length;
+  await assert.rejects(invoke("issues.get", { number: 7 })); assert.equal(requests.length, disconnected);
+  await service.connectApiKey(owner); assert.equal((await invoke("issues.get", { number: 7 })).number, 7);
+});

package/test/gitlab-api.test.js

@@ -0,0 +1,160 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { gitlabApiProvider } from "../src/server/gitlab-api.js";
+
+for (const perUser of [false, true]) test(`GitLab OAuth ${perUser ? "per-user non-expiring" : "shared rotating"} grants preserve protocol and ownership`, async (t) => {
+  const directory = await mkdtemp(path.join(tmpdir(), "gitlab-oauth-test-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const callback = "https://example.test/integrations/gitlab-api/callback";
+  const context = { applicationId: "app", subjectId: "owner" };
+  const input = { context, integrationId: "gitlab" };
+  let time = Date.now(), exchanges = 0;
+  let tokenScope = "read_user read_api", apiStatus = 200;
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(4) }, activeKeyId: "current" });
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { gitlab: { source: "own", clientId: "client", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK", tokenEndpointAuthMethod: "client_secret_post" } }, integrations: {
+      gitlab: { provider: "gitlab-api", settings: { instanceUrl: "https://gitlab.example.test" }, accountMode: perUser ? "per-user" : "shared", scopes: ["read_user", "read_api"], authentication: { method: "oauth2", registrationRef: "gitlab" } },
+      personal: { provider: "gitlab-api", settings: { instanceUrl: "https://gitlab.example.test" }, accountMode: "shared", scopes: ["read_user", "read_api"], authentication: { method: "api-key", secretRef: "env:TOKEN" } }
+    } }, providers: [gitlabApiProvider], authorize: async owner => owner,
+    store: createFileConnectionStore({ directory, protection }), now: () => time,
+    resolveReference: async ref => ref === "env:CALLBACK" ? callback : ref === "env:TOKEN" ? "personal" : "secret",
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)), headers = new Headers(init.headers);
+      assert.equal(url.origin, "https://gitlab.example.test");
+      if (url.pathname === "/oauth/token") {
+        assert.equal(url.pathname, "/oauth/token");
+        assert.equal(headers.get("accept"), "application/json");
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_secret"), "secret");
+        if (body.get("grant_type") === "authorization_code") {
+          assert.equal(body.get("redirect_uri"), callback);
+          assert.ok(body.get("code_verifier"));
+        } else {
+          assert.equal(body.get("refresh_token"), `refresh-${exchanges}`);
+          assert.equal(body.get("redirect_uri"), callback);
+        }
+        exchanges++;
+        if (perUser) return Response.json({ access_token: `access-${exchanges}`, token_type: "Bearer", scope: tokenScope });
+        return Response.json({ access_token: `access-${exchanges}`, refresh_token: `refresh-${exchanges}`, token_type: "Bearer", expires_in: 60, scope: tokenScope });
+      }
+      assert.equal(url.origin, "https://gitlab.example.test");
+      assert.ok(headers.get("authorization") === `Bearer access-${exchanges}` || headers.get("private-token") === "personal");
+      if (apiStatus !== 200) return Response.json({ message: "private provider detail" }, { status: apiStatus });
+      return Response.json({ id: 123, username: "fixture" });
+    }
+  };
+  const service = createConnectionService(options);
+  for (const outcome of ["cancel", "denied"]) {
+    const attempt = new URL((await service.beginAuthorization(input)).authorizationUrl);
+    const denied = new URL(callback);
+    denied.searchParams.set("state", attempt.searchParams.get("state"));
+    if (outcome === "cancel") {
+      await service.cancelAuthorization({ ...input, state: attempt.searchParams.get("state") });
+      denied.searchParams.set("code", "unused");
+    } else denied.searchParams.set("error", "access_denied");
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: denied.href }), {
+      code: outcome === "cancel" ? "connector_attempt_invalid" : "connector_consent_denied"
+    });
+  }
+  assert.equal(exchanges, 0);
+  const { authorizationUrl } = await service.beginAuthorization(input);
+  const url = new URL(authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://gitlab.example.test/oauth/authorize");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  const returned = new URL(callback);
+  returned.searchParams.set("code", "code");
+  returned.searchParams.set("state", url.searchParams.get("state"));
+  assert.equal((await service.completeAuthorization({ ...input, callbackUrl: returned.href })).status, "connected");
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: returned.href }), { code: "connector_attempt_invalid" });
+  time += 40_000;
+  await Promise.all([service.invoke({ ...input, operation: "profile.read" }), service.invoke({ ...input, operation: "profile.read" })]);
+  assert.equal(exchanges, perUser ? 1 : 2);
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  time += 40_000;
+  await restarted.invoke({ ...input, operation: "profile.read" });
+  assert.equal(exchanges, perUser ? 1 : 3);
+  assert.equal((await restarted.connectApiKey({ context, integrationId: "personal" })).status, "connected");
+  const otherApp = { context: { ...context, applicationId: "another-app" }, integrationId: "gitlab" };
+  assert.equal((await restarted.status(otherApp)).status, "disconnected");
+  if (perUser) {
+    const otherUser = { context: { ...context, subjectId: "another-user" }, integrationId: "gitlab" };
+    assert.equal((await restarted.status(otherUser)).status, "disconnected");
+    await assert.rejects(restarted.invoke({ ...otherUser, operation: "profile.read" }));
+    assert.equal((await restarted.status(input)).status, "connected");
+  }
+  const changedConfiguration = structuredClone(options.configuration);
+  changedConfiguration.integrations.gitlab.settings.instanceUrl = "https://another-gitlab.example.test";
+  const changed = createConnectionService({ ...options, configuration: changedConfiguration });
+  assert.equal((await changed.status(input)).status, "reconnect-required");
+  await assert.rejects(changed.invoke({ ...input, operation: "profile.read" }), { code: "connector_reconnect_required" });
+  for (const instanceUrl of ["http://gitlab.example.test", "https://name:secret@gitlab.example.test", "https://gitlab.example.test/subpath", "https://gitlab.example.test/?token=secret", "not-a-url"]) {
+    changedConfiguration.integrations.gitlab.settings.instanceUrl = instanceUrl;
+    assert.throws(() => createConnectionService({ ...options, configuration: changedConfiguration }), { code: "integration_configuration_invalid" });
+  }
+  await restarted.disconnect(input);
+  assert.equal((await restarted.status(input)).status, "disconnected");
+});
+
+
+test("GitLab project paths, content and issue/MR writes use the selected host without replaying writes", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "gitlab-content-test-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = []; let status = 200, fail = false;
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { gitlab: { provider: "gitlab-api", settings: { instanceUrl: "https://code.example.test" }, accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:GITLAB_TOKEN" } } } },
+    providers: [gitlabApiProvider], authorize: async owner => owner, resolveReference: async () => "private-token",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current" }) }),
+    fetchImpl: async (url, init) => {
+      const parsed = new URL(url); requests.push({ url: parsed, init });
+      assert.equal(parsed.origin, "https://code.example.test");
+      assert.equal(new Headers(init.headers).get("private-token"), "private-token");
+      assert.equal(init.redirect, "error");
+      if (fail) throw new Error("outcome unknown");
+      if (status !== 200) return Response.json({ message: "private detail" }, { status });
+      if (parsed.pathname === "/api/v4/user") return Response.json({ id: 1, username: "owner" });
+      assert.ok(parsed.pathname.startsWith("/api/v4/projects/team%2Fsubgroup%2Fproject"));
+      if (parsed.pathname.endsWith("/repository/files/docs%2Fread%20me.md")) return Response.json({ file_path: "docs/read me.md", encoding: "base64", content: Buffer.from("Useful documentation").toString("base64") });
+      if (parsed.pathname.endsWith("team%2Fsubgroup%2Fproject")) return Response.json({ id: 1, path_with_namespace: "team/subgroup/project" });
+      if (init.method !== "GET") return Response.json({ iid: 7, title: "Fix checkout", ...JSON.parse(init.body) });
+      if (/\/(issues|merge_requests)\/7$/.test(parsed.pathname)) return Response.json({ iid: 7, title: "Fix checkout", description: "Customer report" });
+      return Response.json([{ id: 3, body: "Review comment", status: "success" }]);
+    }
+  });
+  const owner = { context: { applicationId: "repo-app", subjectId: "owner" }, integrationId: "gitlab" };
+  const invoke = (operation, input = {}) => service.invoke({ ...owner, operation, input: { project: "team/subgroup/project", ...input } });
+  await service.connectApiKey(owner);
+  assert.equal((await invoke("projects.get")).path_with_namespace, "team/subgroup/project");
+  const file = await invoke("files.get", { filePath: "docs/read me.md", ref: "feature/docs" });
+  assert.equal(Buffer.from(file.content, file.encoding).toString(), "Useful documentation");
+  assert.equal(requests.at(-1).url.searchParams.get("ref"), "feature/docs");
+  for (const operation of ["branches.list", "commits.list", "pipelines.list", "issues.list", "mergeRequests.list", "issues.notes", "mergeRequests.notes"]) {
+    assert.equal((await invoke(operation, { ...(operation.endsWith("notes") ? { iid: 7 } : {}), page: 2, per_page: 10 })).length, 1);
+    assert.equal(requests.at(-1).url.searchParams.get("page"), "2");
+  }
+  for (const operation of ["issues.get", "mergeRequests.get"]) assert.equal((await invoke(operation, { iid: 7 })).description, "Customer report");
+  await invoke("issues.create", { title: "Fix checkout", description: "Customer report" });
+  assert.equal(requests.at(-1).url.pathname, "/api/v4/projects/team%2Fsubgroup%2Fproject/issues");
+  assert.equal(requests.at(-1).init.method, "POST");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { title: "Fix checkout", description: "Customer report" });
+  await invoke("mergeRequests.create", { title: "Fix checkout", source_branch: "fix/checkout", target_branch: "main" });
+  assert.equal(JSON.parse(requests.at(-1).init.body).source_branch, "fix/checkout");
+  for (const operation of ["issues.update", "mergeRequests.update"]) {
+    assert.equal((await invoke(operation, { iid: 7, state_event: "close" })).state_event, "close");
+    assert.equal(requests.at(-1).init.method, "PUT");
+    assert.deepEqual(JSON.parse(requests.at(-1).init.body), { state_event: "close" });
+  }
+  const before = requests.length;
+  for (const [operation, input] of [["files.get", { filePath: "../secret", ref: "main" }], ["projects.get", { project: "team/../another" }], ["issues.list", { per_page: 101 }], ["issues.update", { iid: 7 }], ["mergeRequests.create", { title: "x", source_branch: "fix" }]]) await assert.rejects(invoke(operation, input));
+  assert.equal(requests.length, before);
+  for (const [httpStatus, code] of [[403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) { status = httpStatus; await assert.rejects(invoke("issues.create", { title: "x" }), { code }); }
+  status = 200; fail = true; const failedBefore = requests.length;
+  await assert.rejects(invoke("issues.create", { title: "x" })); assert.equal(requests.length, failedBefore + 1); fail = false;
+  await service.disconnect(owner); const disconnected = requests.length;
+  await assert.rejects(invoke("issues.get", { iid: 7 })); assert.equal(requests.length, disconnected);
+  await service.connectApiKey(owner); assert.equal((await invoke("issues.get", { iid: 7 })).iid, 7);
+});

package/test/gong.test.js

@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { gongProvider } from "../src/server/gong.js";
+
+const context = { applicationId: "sales-app", subjectId: "sales-team" };
+const input = { context, integrationId: "sales" };
+const users = { requestId: "fixture-request", users: [{ id: "123", emailAddress: "user@example.test" }],
+  records: { totalRecords: 1, currentPageSize: 1, currentPageNumber: 0 } };
+
+async function fixture(t, apiBaseUrl = "https://api.gong.io") {
+  const directory = await mkdtemp(path.join(tmpdir(), "gong-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(5) }, activeKeyId: "current" });
+  const requests = [];
+  const state = { secret: "fixture-access-secret", status: 200, response: users };
+  const configuration = { schemaVersion: 1, registrations: {}, integrations: { sales: {
+    provider: "gong", accountMode: "shared", scopes: [],
+    authentication: { method: "api-key", secretRef: "env:GONG_ACCESS_SECRET" },
+    settings: { accessKey: "EXAMPLE_ACCESS_KEY", apiBaseUrl }, extensions: { keep: true }
+  } } };
+  const options = {
+    configuration, providers: [gongProvider], authorize: async (owner) => owner,
+    store: createFileConnectionStore({ directory, protection }),
+    resolveReference: async (reference) => { assert.equal(reference, "env:GONG_ACCESS_SECRET"); return state.secret; },
+    fetchImpl: async (address, init) => {
+      requests.push({ url: new URL(String(address)), init, headers: new Headers(init.headers) });
+      return Response.json(state.response, { status: state.status });
+    }
+  };
+  return { service: createConnectionService(options), options, requests, directory, protection, state };
+}
+
+for (const apiBaseUrl of ["https://api.gong.io", "https://company-17.api.gong.io/"]) {
+  test(`Gong verifies ${apiBaseUrl} and persists ownership across restart and key rotation`, async (t) => {
+    const { service, options, requests, directory, protection, state } = await fixture(t, apiBaseUrl);
+    const connected = await service.connectApiKey(input);
+    assert.equal(connected.status, "connected");
+    assert.equal(requests[0].url.href, `${new URL(apiBaseUrl).origin}/v2/users?includeAvatars=false`);
+    assert.equal(requests[0].init.method, "GET");
+    assert.equal(requests[0].init.redirect, "error");
+    const header = `Basic ${Buffer.from(`EXAMPLE_ACCESS_KEY:${state.secret}`).toString("base64")}`;
+    assert.equal(requests[0].headers.get("authorization"), header);
+    assert.equal(requests[0].url.href.includes(state.secret), false);
+    for (const name of await readdir(directory)) {
+      const stored = await readFile(path.join(directory, name), "utf8");
+      assert.equal(stored.includes(state.secret), false);
+      assert.equal(stored.includes(header), false);
+    }
+    const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+    assert.deepEqual(await restarted.status(input), connected);
+    state.secret = "rotated-fixture-secret";
+    assert.deepEqual(await restarted.invoke({ ...input, operation: "users.list" }), users);
+    assert.equal(requests.at(-1).headers.get("authorization"), `Basic ${Buffer.from(`EXAMPLE_ACCESS_KEY:${state.secret}`).toString("base64")}`);
+    for (const owner of [{ ...context, applicationId: "other-app" }, { ...context, subjectId: "other-team" }]) {
+      await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "users.list" }), { code: "connector_reconnect_required" });
+    }
+    assert.equal(requests.length, 2);
+    await restarted.disconnect(input);
+    assert.equal((await service.status(input)).status, "disconnected");
+  });
+}
+
+test("Gong rejects invalid key identities and untrusted URLs before network or credential access", async (t) => {
+  const { options, requests } = await fixture(t);
+  const parse = (configuration) => parseIntegrationConfiguration(JSON.stringify(configuration), { providers: [gongProvider] });
+  const configuration = structuredClone(options.configuration);
+  delete configuration.integrations.sales.settings.apiBaseUrl;
+  assert.deepEqual(parse(configuration), options.configuration);
+  configuration.integrations.sales.settings.accessKey = " EXAMPLE_ACCESS_KEY ";
+  assert.deepEqual(parse(configuration), options.configuration);
+  const invalidUrls = [
+    "https://api.gong.io.attacker.invalid", "https://api.gong.io@attacker.invalid", "http://api.gong.io",
+    "https://user:password@api.gong.io", "https://api.gong.io:444", "https://api.gong.io/v2",
+    "https://api.gong.io?url=elsewhere", "https://api.gong.io#fragment", "https://127.0.0.1",
+    "https://api.gong.io/../", "https://-bad.api.gong.io", "https://bad-.api.gong.io",
+    `https://${"a".repeat(64)}.api.gong.io`, "https://app.gong.io", "https://api.gong.io\\@attacker.invalid"
+  ];
+  for (const url of invalidUrls) {
+    const changed = structuredClone(options.configuration);
+    changed.integrations.sales.settings.apiBaseUrl = url;
+    assert.throws(() => parse(changed), (error) => Boolean(error.fieldErrors["integrations.sales.settings.apiBaseUrl"]));
+  }
+  for (const accessKey of [undefined, "", "user:password", "key with spaces", "key\nheader", "key\u0000", "x".repeat(513)]) {
+    const changed = structuredClone(options.configuration);
+    changed.integrations.sales.settings.accessKey = accessKey;
+    assert.throws(() => parse(changed), (error) => Boolean(error.fieldErrors["integrations.sales.settings.accessKey"]));
+  }
+  configuration.integrations.sales.authentication.secretRef = "raw-secret";
+  assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.sales.authentication.secretRef"]));
+  assert.equal(requests.length, 0);
+});
+
+test("Gong requires verification after key identity or host changes and never crosses customer origins", async (t) => {
+  const { service, options, requests } = await fixture(t, "https://company-17.api.gong.io");
+  await service.connectApiKey(input);
+  for (const [field, value] of [["accessKey", "OTHER_KEY"], ["apiBaseUrl", "https://company-18.api.gong.io"]]) {
+    const configuration = structuredClone(options.configuration);
+    configuration.integrations.sales.settings[field] = value;
+    const changed = createConnectionService({ ...options, configuration });
+    assert.equal((await changed.status(input)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...input, operation: "users.list" }), { code: "connector_reconnect_required" });
+  }
+  for (const origin of ["https://company-18.api.gong.io", "https://api.gong.io"]) {
+    const wrongHost = createConnectionService({ ...options, providers: [{ ...gongProvider, operations: {
+      "users.list": { scopes: [], request: () => ({ method: "GET", url: `${origin}/v2/users` }) }
+    } }] });
+    await assert.rejects(wrongHost.invoke({ ...input, operation: "users.list" }), { code: "connector_destination_invalid" });
+  }
+  assert.equal(requests.length, 1);
+});
+
+test("Gong preserves paged users and encodes opaque cursors with explicit avatar selection", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey(input);
+  state.response = { ...users, records: { ...users.records, totalRecords: 2, cursor: "next+&=token" } };
+  assert.deepEqual(await service.invoke({ ...input, operation: "users.list", input: { cursor: "next+&=token", includeAvatars: true } }), state.response);
+  assert.deepEqual(Object.fromEntries(requests.at(-1).url.searchParams), { cursor: "next+&=token", includeAvatars: "true" });
+  assert.equal(requests.length, 2);
+  for (const invalid of [{ cursor: "" }, { cursor: "x".repeat(8193) }, { includeAvatars: "perhaps" }, { page: 2 }, { apiBaseUrl: "https://company-18.api.gong.io" }, { url: "https://attacker.invalid" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "users.list", input: invalid }), { code: "connector_input_invalid" });
+  }
+  assert.equal(requests.length, 2);
+  state.response = { users: [], records: { totalRecords: 0, currentPageSize: 0, currentPageNumber: 0 } };
+  assert.deepEqual(await service.invoke({ ...input, operation: "users.list" }), state.response);
+});
+
+test("Gong rejects denied credentials, rate limits and malformed results without leaking provider bodies", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  for (const [status, code] of [[200, "connector_response_invalid"], [401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    state.response = { errors: [state.secret] };
+    await assert.rejects(service.connectApiKey(input), (error) => {
+      assert.equal(error.code, code);
+      assert.equal(error.message.includes(state.secret), false);
+      assert.equal(JSON.stringify(error).includes(state.secret), false);
+      return true;
+    });
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+  assert.equal(requests.length, 5);
+  state.status = 200;
+  state.response = users;
+  await service.connectApiKey(input);
+  for (const malformed of [{ users: [] }, { ...users, users: {} }, { ...users, records: { ...users.records, cursor: {} } }, { ...users, records: { ...users.records, totalRecords: -1 } }]) {
+    state.response = malformed;
+    await assert.rejects(service.invoke({ ...input, operation: "users.list" }), { code: "connector_response_invalid" });
+  }
+  state.status = 401;
+  await assert.rejects(service.invoke({ ...input, operation: "users.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Gong call content preserves speaker, CRM context, statistics and opaque paging without fetching media", async t => {
+  const { service, state, requests } = await fixture(t, "https://company-17.api.gong.io");
+  await service.connectApiKey(input);
+  const callId = "7782342274025937895";
+  state.response = { records: { ...users.records, cursor: " next +/= " }, calls: [{ metaData: { id: callId, title: "Renewal" },
+    parties: [{ speakerId: "22", name: "Customer" }], context: [{ system: "Salesforce", objects: [{ objectType: "Opportunity", objectId: "opp-one" }] }],
+    content: { brief: "Renewal next month" }, interaction: { personInteractionStats: [{ name: "Talk Ratio", value: 0.4 }] } }] };
+  const call = await service.invoke({ ...input, operation: "calls.extensive", input: { callIds: [callId], cursor: " previous +/= " } });
+  assert.equal(call.calls[0].context[0].objects[0].objectId, "opp-one");
+  const body = JSON.parse(requests.at(-1).init.body);
+  assert.deepEqual(body.filter, { callIds: [callId] });
+  assert.equal(body.cursor, " previous +/= ");
+  assert.equal(body.contentSelector.exposedFields.media, false);
+  assert.deepEqual(body.contentSelector.contextTiming, ["Now", "TimeOfCall"]);
+  assert.equal(requests.at(-1).url.origin, "https://company-17.api.gong.io");
+  state.response = { records: users.records, callTranscripts: [{ callId, transcript: [{ speakerId: "22", sentences: [{ start: 1000, end: 2000, text: "Renew next month" }] }] }] };
+  const transcript = await service.invoke({ ...input, operation: "calls.transcripts", input: { callIds: [callId] } });
+  assert.equal(transcript.callTranscripts[0].transcript[0].speakerId, call.calls[0].parties[0].speakerId);
+  assert.equal(transcript.callTranscripts[0].transcript[0].sentences[0].text, "Renew next month");
+  assert.equal(requests.at(-1).url.pathname, "/v2/calls/transcript");
+  state.response = { records: users.records, peopleInteractionStats: [{ userId: "33", personInteractionStats: [{ name: "Interactivity", value: 9.23 }] }] };
+  assert.equal((await service.invoke({ ...input, operation: "stats.interaction", input: { fromDate: "2026-09-01", toDate: "2026-09-03", userIds: ["33"] } })).peopleInteractionStats[0].personInteractionStats[0].value, 9.23);
+  state.response = { records: users.records, calls: [{ metaData: { id: callId }, media: { audioUrl: "https://media.example.test/temporary" } }] };
+  await service.invoke({ ...input, operation: "calls.extensive", input: { fromDateTime: "2026-09-01T00:00:00Z", toDateTime: "2026-09-03T00:00:00Z", includeMedia: true } });
+  assert.equal(JSON.parse(requests.at(-1).init.body).contentSelector.exposedFields.media, true);
+  assert.equal(requests.some(request => request.url.origin === "https://media.example.test"), false);
+  const count = requests.length;
+  for (const [operation, values] of [["calls.extensive", {}], ["calls.transcripts", { callIds: [Number(callId)] }], ["calls.transcripts", { fromDateTime: "2026-09-01T00:00:00Z" }], ["stats.interaction", { fromDate: "2026-02-30", toDate: "2026-03-01" }], ["stats.interaction", { fromDate: "2026-09-03", toDate: "2026-09-01" }]]) await assert.rejects(service.invoke({ ...input, operation, input: values }), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  state.response = { records: { totalRecords: 0, currentPageSize: 0, currentPageNumber: 0 }, callTranscripts: [] };
+  assert.deepEqual((await service.invoke({ ...input, operation: "calls.transcripts", input: { callIds: [callId] } })).callTranscripts, []);
+  state.response = { callTranscripts: [] };
+  await assert.rejects(service.invoke({ ...input, operation: "calls.transcripts", input: { callIds: [callId] } }), { code: "connector_response_invalid" });
+});