@jskit-ai/connectors-catalog 0.1.1

package/test/linear.test.js

@@ -0,0 +1,146 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { linearProvider } from "../src/server/linear.js";
+
+for (const perUser of [false, true]) test(`Linear OAuth ${perUser ? "per-user" : "shared rotating"} grants preserve protocol and ownership`, async (t) => {
+  const directory = await mkdtemp(path.join(tmpdir(), "linear-oauth-test-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const callback = "https://example.test/integrations/linear/callback";
+  const context = { applicationId: "app", subjectId: "owner" };
+  const input = { context, integrationId: "linear" };
+  let time = Date.now(), exchanges = 0;
+  let tokenScope = "read write";
+  const toolCalls = [];
+  // Controlled fixture schemas, not a claim about Linear's current tool names.
+  const tools = ["fixture_create_project", "fixture_save_issue"].map(name => ({ name,
+    inputSchema: { type: "object", properties: { projectId: { type: "string" } }, additionalProperties: true } }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(4) }, activeKeyId: "current" });
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { linear: { source: "own", clientId: "client", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK", tokenEndpointAuthMethod: "client_secret_post" } }, integrations: {
+      linear: { provider: "linear", accountMode: perUser ? "per-user" : "shared", scopes: ["read", "write"], authentication: { method: "oauth2", registrationRef: "linear" } },
+      personal: { provider: "linear", accountMode: "shared", scopes: ["read", "write"], authentication: { method: "api-key", secretRef: "env:TOKEN" } }
+    } }, providers: [linearProvider], authorize: async owner => owner,
+    store: createFileConnectionStore({ directory, protection }), now: () => time,
+    resolveReference: async ref => ref === "env:CALLBACK" ? callback : ref === "env:TOKEN" ? "personal" : "secret",
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)), headers = new Headers(init.headers);
+      if (url.pathname === "/oauth/token") {
+        assert.equal(url.origin, "https://api.linear.app");
+        assert.equal(headers.get("accept"), "application/json");
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_secret"), "secret");
+        if (body.get("grant_type") === "authorization_code") {
+          assert.equal(body.get("redirect_uri"), callback);
+          assert.ok(body.get("code_verifier"));
+        } else {
+          assert.equal(body.get("refresh_token"), `refresh-${exchanges}`);
+          assert.equal(body.has("redirect_uri"), false);
+        }
+        exchanges++;
+        return Response.json({ access_token: `access-${exchanges}`, refresh_token: `refresh-${exchanges}`, token_type: "Bearer", expires_in: 60, scope: tokenScope });
+      }
+      if (url.origin === "https://mcp.linear.app") {
+        assert.equal(url.pathname, "/mcp");
+        assert.ok(headers.get("authorization") === `Bearer access-${exchanges}` || headers.get("authorization") === "Bearer personal");
+        if (init.method === "DELETE") return new Response(null, { status: 204 });
+        if (init.method === "GET") return new Response(null, { status: 405 });
+        const message = JSON.parse(init.body);
+        if (message.id === undefined) return new Response(null, { status: 202 });
+        assert.ok(["initialize", "tools/list", "tools/call"].includes(message.method));
+        const result = message.method === "initialize" ? { protocolVersion: message.params.protocolVersion,
+          capabilities: { tools: {} }, serverInfo: { name: "fixture", version: "1" } } : message.method === "tools/list" ? { tools } : {
+            content: [{ type: "text", text: JSON.stringify({ id: message.params.name === "fixture_create_project" ? "project-1" : "issue-1", ...message.params.arguments }) }],
+            isError: message.params.arguments.fail === true
+          };
+        if (message.method === "tools/call") toolCalls.push(message.params);
+        return Response.json({ jsonrpc: "2.0", id: message.id, result });
+      }
+      assert.equal(url.origin, "https://api.linear.app");
+      assert.equal(url.pathname, "/graphql");
+      assert.ok(headers.get("authorization") === `Bearer access-${exchanges}` || headers.get("authorization") === "personal");
+      return Response.json({ data: { viewer: { id: "123", name: "Fixture" } } });
+    }
+  };
+  const service = createConnectionService(options);
+  for (const outcome of ["cancel", "denied"]) {
+    const attempt = new URL((await service.beginAuthorization(input)).authorizationUrl);
+    const denied = new URL(callback);
+    denied.searchParams.set("state", attempt.searchParams.get("state"));
+    if (outcome === "cancel") {
+      await service.cancelAuthorization({ ...input, state: attempt.searchParams.get("state") });
+      denied.searchParams.set("code", "unused");
+    } else denied.searchParams.set("error", "access_denied");
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: denied.href }), {
+      code: outcome === "cancel" ? "connector_attempt_invalid" : "connector_consent_denied"
+    });
+  }
+  assert.equal(exchanges, 0);
+  const { authorizationUrl } = await service.beginAuthorization(input);
+  const url = new URL(authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://linear.app/oauth/authorize");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(url.searchParams.get("actor"), "user");
+  assert.equal(url.searchParams.get("scope"), "read,write");
+  const returned = new URL(callback);
+  returned.searchParams.set("code", "code");
+  returned.searchParams.set("state", url.searchParams.get("state"));
+  assert.equal((await service.completeAuthorization({ ...input, callbackUrl: returned.href })).status, "connected");
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: returned.href }), { code: "connector_attempt_invalid" });
+  time += 40_000;
+  await Promise.all([service.invoke({ ...input, operation: "profile.read" }), service.invoke({ ...input, operation: "profile.read" })]);
+  assert.equal(exchanges, 2);
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  time += 40_000;
+  await restarted.invoke({ ...input, operation: "profile.read" });
+  assert.equal(exchanges, 3);
+  assert.equal((await restarted.connectApiKey({ context, integrationId: "personal" })).status, "connected");
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "tools.list" }), { tools });
+  assert.deepEqual(await restarted.invoke({ context, integrationId: "personal", operation: "tools.list" }), { tools });
+  for (const integrationId of ["linear", "personal"]) {
+    const call = (name, args) => restarted.invoke({ context, integrationId, operation: "tools.call", input: { name, arguments: args } });
+    const project = await call("fixture_create_project", { name: "Release", teamId: "team-1" });
+    assert.equal(JSON.parse(project.content[0].text).id, "project-1");
+    const issue = await call("fixture_save_issue", { projectId: "project-1", title: "Ship" });
+    assert.equal(JSON.parse(issue.content[0].text).id, "issue-1");
+    await call("fixture_save_issue", { projectId: "project-1", id: "issue-1", title: "Ship today" });
+    assert.deepEqual(toolCalls.at(-1).arguments, { projectId: "project-1", id: "issue-1", title: "Ship today" });
+    assert.equal((await call("fixture_save_issue", { fail: true })).isError, true);
+  }
+  const guarded = createConnectionService({ ...options, authorize: async (owner, request) =>
+    request.operation === "tools.call" && (request.input.name !== "fixture_save_issue" || request.input.arguments.projectId !== "project-1") ? null : owner });
+  const beforeDenied = toolCalls.length;
+  for (const args of [{ name: "fixture_create_project", arguments: {} }, { name: "fixture_save_issue", arguments: { projectId: "foreign" } }]) {
+    await assert.rejects(guarded.invoke({ ...input, operation: "tools.call", input: args }), { code: "connector_access_denied" });
+  }
+  assert.equal(toolCalls.length, beforeDenied);
+  const otherApp = { context: { ...context, applicationId: "another-app" }, integrationId: "linear" };
+  assert.equal((await restarted.status(otherApp)).status, "disconnected");
+  if (perUser) {
+    const otherUser = { context: { ...context, subjectId: "another-user" }, integrationId: "linear" };
+    assert.equal((await restarted.status(otherUser)).status, "disconnected");
+    await assert.rejects(restarted.invoke({ ...otherUser, operation: "profile.read" }));
+    assert.equal((await restarted.status(input)).status, "connected");
+  }
+  tokenScope = "write";
+  time += 40_000;
+  await assert.rejects(restarted.invoke({ ...input, operation: "profile.read" }), { code: "connector_scope_missing" });
+  await restarted.disconnect(input);
+  assert.equal((await restarted.status(input)).status, "disconnected");
+});
+
+test("Linear rejects malformed permission grants and preserves OAuth errors", async () => {
+  for (const scope of [undefined, 42, [42], ["bad scope"], "read,write"]) {
+    await assert.rejects(linearProvider.normalizeTokenResponse(Response.json({ access_token: "secret", scope })), { code: "connector_response_invalid" });
+  }
+  for (const scope of ["read write", ["read", "write"]]) {
+    const response = await linearProvider.normalizeTokenResponse(Response.json({ scope }));
+    assert.equal((await response.json()).scope, "read,write");
+  }
+  const failure = Response.json({ error: "invalid_grant" }, { status: 400 });
+  assert.equal(await linearProvider.normalizeTokenResponse(failure), failure);
+});

package/test/linkedin.test.js

@@ -0,0 +1,243 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { validateIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { linkedinProvider as provider } from "../src/server/linkedin.js";
+
+const context = { applicationId: "linkedin-app", subjectId: "member-one" };
+const input = { context, integrationId: "linkedin" };
+const callback = "https://app.example.test/connections/linkedin/callback";
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "linkedin-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(7) }, activeKeyId: "current" });
+  const configuration = { schemaVersion: 1, integrations: { linkedin: { provider: "linkedin", accountMode: "per-user",
+    scopes: ["openid", "profile", "email"], authentication: { method: "oauth2", registrationRef: "linkedin" } } },
+  registrations: { linkedin: { source: "own", clientId: "fixture-client", clientSecretRef: "env:LINKEDIN_SECRET", callbackUrlRef: "env:LINKEDIN_CALLBACK" } } };
+  const state = { time: Date.now(), calls: [], grants: 0, response: { sub: "member-1", name: "Fixture Member" },
+    scope: "openid profile email", status: 200, tokenStatus: 200, refresh: false, tokenOverrides: {}, deny: false, stall: false };
+  const options = { configuration, providers: [provider], store: createFileConnectionStore({ directory, protection }), now: () => state.time,
+    authorize: async (owner) => { if (state.deny) throw new Error("Host denied"); return owner; },
+    resolveReference: async (ref) => ref === "env:LINKEDIN_CALLBACK" ? callback : "fixture-client-secret",
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)); const headers = new Headers(init.headers);
+      state.calls.push({ url, init, headers });
+      if (state.stall) return new Promise((resolve, reject) => {
+        init.signal.throwIfAborted(); init.signal.addEventListener("abort", () => reject(init.signal.reason), { once: true });
+      });
+      if (url.href === "https://www.linkedin.com/oauth/v2/accessToken") {
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_id"), "fixture-client");
+        assert.equal(body.get("client_secret"), "fixture-client-secret");
+        assert.equal(headers.has("authorization"), false);
+        if (state.tokenStatus !== 200) return Response.json(state.tokenOverrides, { status: state.tokenStatus });
+        if (body.get("grant_type") === "refresh_token") assert.equal(body.get("refresh_token"), `fixture-refresh-${state.grants}`);
+        state.grants += 1;
+        return Response.json({ access_token: `fixture-access-${state.grants}`, expires_in: 120,
+          ...(state.refresh ? { refresh_token: `fixture-refresh-${state.grants}` } : {}),
+          ...(state.scope === undefined ? {} : { scope: state.scope }), ...state.tokenOverrides });
+      }
+      if (url.href === "https://api.linkedin.com/v2/ugcPosts") {
+        assert.equal(init.method, "POST"); assert.equal(init.redirect, "error");
+        assert.equal(headers.get("authorization"), `Bearer fixture-access-${state.grants}`);
+        assert.equal(headers.get("x-restli-protocol-version"), "2.0.0");
+        return new Response(null, { status: state.publishStatus || 201, headers: { "x-restli-id": state.postId ?? "urn:li:share:123" } });
+      }
+      assert.equal(url.href, "https://api.linkedin.com/v2/userinfo");
+      assert.equal(init.method, "GET"); assert.equal(init.redirect, "error");
+      assert.equal(headers.get("authorization"), `Bearer fixture-access-${state.grants}`);
+      assert.equal(String(init.body).includes("fixture-client-secret"), false);
+      return Response.json(state.response, { status: state.status });
+    }
+  };
+  const service = createConnectionService(options);
+  async function start() {
+    const { authorizationUrl } = await service.beginAuthorization(input);
+    const url = new URL(authorizationUrl); const redirect = new URL(callback);
+    redirect.searchParams.set("code", "fixture-code"); redirect.searchParams.set("state", url.searchParams.get("state"));
+    return { url, callbackUrl: redirect.href };
+  }
+  return { service, options, configuration, directory, protection, state, start };
+}
+
+test("LinkedIn configuration requires both identity scopes and confidential registration across account modes", async (t) => {
+  const { configuration } = await fixture(t);
+  for (const accountMode of ["shared", "per-user", "assistant"]) {
+    const config = structuredClone(configuration); config.integrations.linkedin.accountMode = accountMode;
+    assert.equal(validateIntegrationConfiguration(config, { providers: [provider] }).integrations.linkedin.accountMode, accountMode);
+  }
+  for (const scopes of [["profile"], ["openid"], ["email"], ["openid", "profile", "admin"], ["openid", "profile", "profile"]]) {
+    const config = structuredClone(configuration); config.integrations.linkedin.scopes = scopes;
+    assert.throws(() => validateIntegrationConfiguration(config, { providers: [provider] }), { code: "integration_configuration_invalid" });
+  }
+  for (const update of [{ clientSecretRef: "raw-secret" }, { tokenEndpointAuthMethod: "none" }, { grantType: "client_credentials" }]) {
+    const config = structuredClone(configuration); Object.assign(config.registrations.linkedin, update);
+    assert.throws(() => validateIntegrationConfiguration(config, { providers: [provider] }), { code: "integration_configuration_invalid" });
+  }
+});
+
+test("LinkedIn uses confidential Web OAuth, validates userinfo and persists only encrypted access credentials", async (t) => {
+  const { service, options, directory, protection, state, start } = await fixture(t);
+  state.tokenOverrides = { id_token: "unused-identity-token" };
+  const { url, callbackUrl } = await start();
+  assert.equal(url.origin + url.pathname, "https://www.linkedin.com/oauth/v2/authorization");
+  assert.equal(url.searchParams.get("redirect_uri"), callback);
+  assert.equal(url.searchParams.get("scope"), "openid profile email");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(url.searchParams.has("client_secret"), false);
+  const connected = await service.completeAuthorization({ ...input, callbackUrl });
+  assert.equal(connected.status, "connected");
+  const body = new URLSearchParams(state.calls[0].init.body);
+  assert.equal(body.get("grant_type"), "authorization_code"); assert.equal(body.get("redirect_uri"), callback); assert.ok(body.get("code_verifier"));
+  assert.deepEqual(connected.grantedScopes, ["openid", "profile", "email"]);
+  assert.equal(JSON.stringify(connected).includes("fixture-access"), false);
+  for (const name of await readdir(directory)) {
+    const text = await readFile(path.join(directory, name), "utf8");
+    for (const secret of ["fixture-client-secret", "fixture-access-1", "unused-identity-token"]) assert.equal(text.includes(secret), false);
+  }
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "profile.read" }), state.response);
+  state.response = { sub: "member-1", email: "member@example.test", email_verified: false };
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "profile.read" }), state.response);
+  for (const owner of [{ ...context, applicationId: "another-app" }, { ...context, subjectId: "another-user" }]) {
+    await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "profile.read" }), { code: "connector_reconnect_required" });
+  }
+  await restarted.disconnect(input); assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("LinkedIn cancels pending consent, rejects replay and preserves a grant when replacement consent is declined", async (t) => {
+  const { service, state, start } = await fixture(t);
+  const cancelled = await start();
+  await service.cancelAuthorization({ ...input, state: cancelled.url.searchParams.get("state") });
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: cancelled.callbackUrl }), { code: "connector_attempt_invalid" });
+  const first = await start(); const connected = await service.completeAuthorization({ ...input, callbackUrl: first.callbackUrl });
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: first.callbackUrl }), { code: "connector_attempt_invalid" });
+  for (const error of ["user_cancelled_login", "user_cancelled_authorize", "access_denied"]) {
+    const attempt = await start(); const url = new URL(attempt.callbackUrl); url.searchParams.delete("code"); url.searchParams.set("error", error);
+    url.searchParams.set("error_description", "private-provider-detail");
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: url.href }), { code: "connector_consent_denied" });
+    assert.deepEqual(await service.status(input), { ...connected, callbackUrl: callback });
+  }
+  assert.equal(state.grants, 1);
+});
+
+test("LinkedIn does not invent refresh access when ordinary access expires", async (t) => {
+  const { service, state, start } = await fixture(t);
+  state.scope = undefined;
+  await service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl });
+  state.time += 121_000;
+  await assert.rejects(service.invoke({ ...input, operation: "profile.read" }), { code: "connector_reconnect_required" });
+  assert.equal(state.grants, 1); assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("LinkedIn refreshes approved grants once under contention and does not expand permissions", async (t) => {
+  const { service, state, start } = await fixture(t); state.refresh = true; state.scope = "openid profile";
+  await service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl });
+  state.time += 121_000; state.scope = "openid profile email w_member_social";
+  const results = await Promise.all([service.invoke({ ...input, operation: "profile.read" }), service.invoke({ ...input, operation: "profile.read" })]);
+  assert.deepEqual(results, [state.response, state.response]); assert.equal(state.grants, 2);
+  assert.deepEqual((await service.status(input)).grantedScopes, ["openid", "profile"]);
+  state.time += 121_000; state.tokenStatus = 400; state.tokenOverrides = { error: "invalid_request", error_description: "private-refresh-detail" };
+  await assert.rejects(service.invoke({ ...input, operation: "profile.read" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("LinkedIn rejects malformed or insufficient token responses before saving", async (t) => {
+  const { service, state, start } = await fixture(t);
+  for (const update of [{ expires_in: 0 }, { expires_in: null }, { scope: ["openid", "profile"] }, { scope: "" }, { token_type: "mac" }, { token_type: null }, { access_token: "" }]) {
+    state.tokenOverrides = update;
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl }));
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+  for (const scope of ["openid", "profile", "email"]) {
+    state.tokenOverrides = { scope };
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl }), { code: "connector_reconnect_required" });
+  }
+});
+
+test("LinkedIn rejects invalid profiles, arbitrary input and unauthorized publishing without contacting other endpoints", async (t) => {
+  const { service, state, start } = await fixture(t);
+  await service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl });
+  const count = state.calls.length;
+  for (const values of [{ url: "https://attacker.invalid" }, { memberId: "other" }, { fields: "email" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "profile.read", input: values }), { code: "connector_input_invalid" });
+  }
+  await assert.rejects(service.invoke({ ...input, operation: "posts.create", input: { text: "Do not send", visibility: "PUBLIC" } }), { code: "connector_scope_missing" });
+  assert.equal(state.calls.length, count);
+  for (const response of [{}, { sub: "" }, { sub: 3 }, { sub: "one", email: null }, { sub: "one", email_verified: "true" }]) {
+    state.response = response;
+    await assert.rejects(service.invoke({ ...input, operation: "profile.read" }), { code: "connector_response_invalid" });
+  }
+});
+
+test("LinkedIn sanitizes API failures and handles provider cancellation and timeout", async (t) => {
+  const { service, options, state, start } = await fixture(t);
+  await service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl });
+  for (const [status, code] of [[403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status; state.response = { message: "private-provider-detail" };
+    await assert.rejects(service.invoke({ ...input, operation: "profile.read" }), (error) => error.code === code && !error.message.includes("private-provider-detail"));
+  }
+  state.stall = true;
+  const controller = new AbortController(); controller.abort();
+  await assert.rejects(service.invoke({ ...input, operation: "profile.read", signal: controller.signal }), { code: "connector_cancelled" });
+  const timeoutService = createConnectionService({ ...options, providers: [{ ...provider, requestTimeoutMs: 20 }] });
+  const keepAlive = setTimeout(() => {}, 1000);
+  try { await assert.rejects(timeoutService.invoke({ ...input, operation: "profile.read" }), { code: "connector_provider_timeout" }); }
+  finally { clearTimeout(keepAlive); }
+  state.stall = false; state.status = 401;
+  await assert.rejects(service.invoke({ ...input, operation: "profile.read" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("LinkedIn respects host policy, registration identity and unavailable managed assignments", async (t) => {
+  const { service, options, configuration, state, start } = await fixture(t);
+  await service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl });
+  const count = state.calls.length; state.deny = true;
+  await assert.rejects(service.invoke({ ...input, operation: "profile.read" })); assert.equal(state.calls.length, count); state.deny = false;
+  const changed = structuredClone(configuration); changed.registrations.linkedin.clientId = "other-client";
+  await assert.rejects(createConnectionService({ ...options, configuration: changed }).invoke({ ...input, operation: "profile.read" }), { code: "connector_reconnect_required" });
+  changed.registrations.linkedin = { source: "managed", serviceUrlRef: "env:GATEWAY", serviceCredentialRef: "env:GATEWAY_KEY", assignmentRef: "online" };
+  assert.throws(() => createConnectionService({ ...options, configuration: changed }), { code: "integration_configuration_invalid" });
+  assert.equal(state.calls.length, count);
+});
+
+test("LinkedIn's documented portable JSON validates unchanged", async () => {
+  const guide = await readFile(new URL("../docs/linkedin.md", import.meta.url), "utf8");
+  const config = JSON.parse(guide.match(/```json\n([\s\S]*?)\n```/u)[1]);
+  assert.deepEqual(validateIntegrationConfiguration(config, { providers: [provider] }), config);
+});
+
+test("LinkedIn publishes text as the connected member and respects host policy without retries", async (t) => {
+  const f = await fixture(t); f.configuration.integrations.linkedin.scopes.push("w_member_social");
+  f.state.scope += " w_member_social";
+  const service = createConnectionService(f.options);
+  const auth = new URL((await service.beginAuthorization(input)).authorizationUrl);
+  const returned = new URL(callback); returned.searchParams.set("code", "code"); returned.searchParams.set("state", auth.searchParams.get("state"));
+  await service.completeAuthorization({ ...input, callbackUrl: returned.href });
+  const call = values => service.invoke({ ...input, operation: "posts.create", input: values });
+  const post = { text: "Approved announcement", visibility: "CONNECTIONS" };
+  assert.deepEqual(await call(post), { id: "urn:li:share:123" });
+  assert.deepEqual(JSON.parse(f.state.calls.at(-1).init.body), {
+    author: "urn:li:person:member-1", lifecycleState: "PUBLISHED",
+    specificContent: { "com.linkedin.ugc.ShareContent": { shareCommentary: { text: post.text }, shareMediaCategory: "NONE" } },
+    visibility: { "com.linkedin.ugc.MemberNetworkVisibility": "CONNECTIONS" }
+  });
+  let count = f.state.calls.length;
+  for (const bad of [{ ...post, author: "urn:li:person:foreign" }, { ...post, text: " " }, { ...post, visibility: "PRIVATE" }, { text: "missing audience" }])
+    await assert.rejects(call(bad), { code: "connector_input_invalid" });
+  f.state.deny = true; await assert.rejects(call(post)); f.state.deny = false;
+  assert.equal(f.state.calls.length, count);
+  f.state.response = { sub: "bad/person" }; await assert.rejects(call(post), { code: "connector_response_invalid" });
+  assert.equal(f.state.calls.length, count + 1); f.state.response = { sub: "member-1" };
+  for (const status of [403, 429, 500]) {
+    f.state.publishStatus = status; count = f.state.calls.length;
+    await assert.rejects(call(post)); assert.equal(f.state.calls.length, count + 2);
+  }
+  f.state.publishStatus = 201; f.state.postId = "";
+  await assert.rejects(call(post), { code: "connector_response_invalid" });
+});

package/test/logo-dev.test.js

@@ -0,0 +1,79 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFile } from "node:fs/promises";
+import { logoUrlFromConfiguration } from "../patterns/public-image/example/logo-url.js";
+import { createLogoDevImageUrl } from "../src/client/logo-dev.js";
+import { logoDevDefinition } from "../src/shared/logo-dev.js";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+
+test("Logo.dev builds an image URL with explicit public credentials and portable defaults", () => {
+  const original = { publishableKey: "pk_fixture", domain: "EXAMPLE.COM" };
+  assert.equal(createLogoDevImageUrl(original), "https://img.logo.dev/example.com?token=pk_fixture&size=128&format=png&theme=auto&greyscale=false&retina=false&fallback=monogram");
+  assert.deepEqual(original, { publishableKey: "pk_fixture", domain: "EXAMPLE.COM" });
+  const url = new URL(createLogoDevImageUrl({ ...original, size: 800, format: "webp", theme: "dark", greyscale: true, retina: true, fallback: "404" }));
+  assert.equal(url.origin, "https://img.logo.dev");
+  assert.deepEqual(Object.fromEntries(url.searchParams), { token: "pk_fixture", size: "800", format: "webp", theme: "dark", greyscale: "true", retina: "true", fallback: "404" });
+  assert.equal(new URL(createLogoDevImageUrl({ ...original, domain: "xn--bcher-kva.example", format: "svg" })).pathname, "/xn--bcher-kva.example");
+});
+
+test("Logo.dev refuses private keys, path injection and invalid image options without echoing credentials", () => {
+  const input = { publishableKey: "pk_fixture", domain: "example.com" };
+  for (const publishableKey of ["sk_do-not-expose-this", "pk_", "pk_bad&token=other", "pk_bad/key", "env:LOGO_DEV_KEY"]) {
+    assert.throws(() => createLogoDevImageUrl({ ...input, publishableKey }), (error) => {
+      assert.ok(error.fieldErrors.publishableKey);
+      assert.equal(error.message.includes(publishableKey), false);
+      return true;
+    });
+  }
+  for (const domain of ["https://example.com", "example.com/path", "example.com?token=other", "example.com:443", "example.com#x", "user@example.com", "../example.com", "example..com", "127.0.0.1", "-example.com", "example.com\n/", "a".repeat(64) + ".com"]) {
+    assert.throws(() => createLogoDevImageUrl({ ...input, domain }), (error) => Boolean(error.fieldErrors.domain));
+  }
+  for (const changes of [{ size: 0 }, { size: 801 }, { size: 1.5 }, { format: "html" }, { theme: "custom" }, { fallback: "https://attacker.invalid" }, { retina: "maybe" }, { url: "https://attacker.invalid" }]) {
+    assert.throws(() => createLogoDevImageUrl({ ...input, ...changes }), (error) => Boolean(error.fieldErrors));
+  }
+});
+
+test("Logo.dev shares source configuration with the editor and never treats URL construction as a verified connection", async () => {
+  assert.equal(logoDevDefinition.configurationOnly, true);
+  const configuration = { schemaVersion: 1, registrations: {}, integrations: {
+    logos: { provider: "logo-dev", displayName: "Brand logos", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:LOGO_DEV_PUBLISHABLE_KEY" } }
+  }, extensions: { fromCli: true } };
+  const parse = (value) => parseIntegrationConfiguration(JSON.stringify(value), { providers: [logoDevDefinition] });
+  assert.deepEqual(parse(configuration), configuration);
+  const invalid = structuredClone(configuration);
+  invalid.integrations.logos.authentication.secretRef = "pk_should-not-be-in-source";
+  assert.throws(() => parse(invalid), (error) => Boolean(error.fieldErrors["integrations.logos.authentication.secretRef"]));
+  const service = createConnectionService({ configuration, providers: [logoDevDefinition],
+    authorize: async (context) => context,
+    resolveReference: async () => assert.fail("Image URL configuration must not resolve private credentials through server verification."),
+    store: { withConnection: async () => assert.fail("No connection record should be written.") },
+    fetchImpl: async () => assert.fail("No provider verification call exists for this public image flow.")
+  });
+  await assert.rejects(service.connectApiKey({ context: { applicationId: "app", subjectId: "team" }, integrationId: "logos" }), { code: "connector_mode_unavailable" });
+});
+
+
+test("the public-image source pattern resolves only the chosen reference and rejects other provider slots", async () => {
+  const configurationText = await readFile(new URL("../patterns/public-image/example/integrations.json", import.meta.url), "utf8");
+  const resolveReference = async (reference) => {
+    assert.equal(reference, "env:LOGO_DEV_PUBLISHABLE_KEY");
+    return "pk_from_binding";
+  };
+  const options = { configurationText, integrationId: "logos", resolveReference, image: { domain: "example.com", publishableKey: "pk_caller_override" } };
+  assert.equal(new URL(await logoUrlFromConfiguration(options)).searchParams.get("token"), "pk_from_binding");
+  await assert.rejects(logoUrlFromConfiguration({ ...options, integrationId: "missing" }), /Select a configured Logo.dev integration/);
+  const other = JSON.parse(configurationText);
+  other.integrations.logos.provider = "another-provider";
+  await assert.rejects(logoUrlFromConfiguration({ ...options, configurationText: JSON.stringify(other), resolveReference: async () => assert.fail("Do not resolve another provider's credential.") }), /Select a configured Logo.dev integration/);
+});
+
+test("Logo.dev resolves stock tickers and email domains without disclosing the email local part", () => {
+  const key = { publishableKey: "pk_fixture" };
+  assert.equal(new URL(createLogoDevImageUrl({ ...key, ticker: "shel.l" })).pathname, "/ticker/SHEL.L");
+  const url = createLogoDevImageUrl({ ...key, email: "private.person+tag@EXAMPLE.COM" });
+  assert.equal(new URL(url).pathname, "/example.com"); assert.equal(url.includes("private"), false);
+  for (const lookup of [{}, { domain: "example.com", ticker: "AAPL" }, { ticker: "../AAPL" }, { ticker: "AAPL?token=other" }, { email: "user@example.com/path" }, { email: "user@127.0.0.1" }, { email: "a@b@example.com" }])
+    assert.throws(() => createLogoDevImageUrl({ ...key, ...lookup }));
+});

package/test/mailgun.test.js

@@ -0,0 +1,107 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { mailgunProvider } from "../src/server/mailgun.js";
+
+const context = { applicationId: "mail-app", subjectId: "business-mail" };
+const domain = "mail.example.com";
+const message = { domain, from: "Support <support@mail.example.com>", to: ["one@example.com", "two@example.com"],
+  subject: "Your receipt", text: "Receipt\n", html: "<p>Receipt</p>" };
+const dns = { domain: { name: domain, state: "unverified" },
+  sending_dns_records: [{ record_type: "TXT", name: domain, value: "fixture-spf", valid: "unknown" }], receiving_dns_records: [] };
+async function fixture(t, region = "us") {
+  const directory = await mkdtemp(path.join(tmpdir(), "mailgun-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { fail: false, status: 200, malformed: false, deny: false };
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { mail: {
+      provider: "mailgun", accountMode: "shared", scopes: [], settings: { region },
+      authentication: { method: "api-key", secretRef: "env:MAILGUN_KEY" }
+    } } }, providers: [mailgunProvider],
+    authorize: async owner => { if (state.deny) throw new Error("permission denied"); return owner; },
+    resolveReference: async () => "fixture-private-key",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({
+      keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current"
+    }) }),
+    fetchImpl: async (url, init) => {
+      requests.push({ url: String(url), init });
+      if (state.fail) throw new Error("connection lost after request");
+      if (state.status !== 200) return Response.json({ message: "fixture rejection" }, { status: state.status });
+      if (state.malformed) return Response.json({});
+      const pathname = new URL(url).pathname;
+      if (pathname === "/v4/domains" && init.method === "GET") return Response.json({ items: [], total_count: 0 });
+      if (pathname.endsWith("/messages")) return Response.json({ id: "<fixture@mail.example.com>", message: "Queued. Thank you." });
+      if (pathname === "/v1/analytics/logs") return Response.json({ items: [
+        { event: "failed", severity: "permanent", recipient: "one@example.com", "delivery-status": { code: 550 } }
+      ], pagination: { next: "next-fixture-token" } });
+      return Response.json(dns);
+    }
+  });
+  await service.connectApiKey({ context, integrationId: "mail" });
+  const invoke = (operation, input) => service.invoke({ context, integrationId: "mail", operation, input });
+  return { service, requests, state, invoke };
+}
+
+for (const region of ["us", "eu"]) test(`Mailgun ${region}: verify key, send multipart, manage domain DNS, page delivery logs`, async t => {
+  const { requests, invoke } = await fixture(t, region);
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].init.method, "GET");
+  const queued = await invoke("messages.send", message);
+  assert.equal(queued.id, "<fixture@mail.example.com>");
+  const sent = requests.at(-1);
+  assert.equal(sent.url, `https://api${region === "eu" ? ".eu" : ""}.mailgun.net/v3/${domain}/messages`);
+  assert.equal(sent.init.method, "POST");
+  assert.ok(sent.init.body instanceof FormData);
+  assert.deepEqual(sent.init.body.getAll("to"), message.to);
+  assert.equal(sent.init.body.get("text"), message.text);
+  assert.equal(sent.init.body.get("html"), message.html);
+  assert.equal(new Headers(sent.init.headers).get("content-type"), null);
+  assert.equal(new Headers(sent.init.headers).get("authorization"), `Basic ${Buffer.from("api:fixture-private-key").toString("base64")}`);
+  for (const [operation, method, suffix] of [["domains.create", "POST", ""], ["domains.get", "GET", `/${domain}`],
+    ["domains.verify", "PUT", `/${domain}/verify`]]) {
+    assert.deepEqual(await invoke(operation, { domain }), dns);
+    assert.equal(requests.at(-1).init.method, method);
+    assert.equal(new URL(requests.at(-1).url).pathname, `/v4/domains${suffix}`);
+  }
+  const logs = await invoke("logs.list", { domain });
+  assert.equal(logs.items[0].severity, "permanent");
+  await invoke("logs.list", { domain, token: logs.pagination.next });
+  const body = JSON.parse(requests.at(-1).init.body);
+  assert.equal(body.pagination.token, "next-fixture-token");
+  assert.equal(body.filter.AND[0].values[0].value, domain);
+  assert.equal(body.include_subaccounts, false);
+  assert.equal(body.duration, "1d");
+});
+
+test("Mailgun rejects unsafe/incomplete input, unauthorized use and uncertain sends without retry", async t => {
+  const { service, requests, state, invoke } = await fixture(t);
+  for (const bad of [{ ...message, domain: "../keys" }, { ...message, to: [] }, { ...message, to: ["invalid"] },
+    { ...message, subject: "header\r\ninjection" }, { ...message, text: "" }]) {
+    await assert.rejects(invoke("messages.send", bad));
+  }
+  await assert.rejects(service.invoke({ context: { ...context, applicationId: "other" }, integrationId: "mail",
+    operation: "messages.send", input: message }));
+  state.deny = true;
+  await assert.rejects(invoke("domains.create", { domain }));
+  state.deny = false;
+  assert.equal(requests.length, 1);
+  state.fail = true;
+  await assert.rejects(invoke("messages.send", message));
+  assert.equal(requests.length, 2);
+  state.fail = false;
+  for (const status of [429, 401]) {
+    state.status = status;
+    const before = requests.length;
+    await assert.rejects(invoke("messages.send", message));
+    assert.equal(requests.length, before + 1);
+  }
+  state.status = 200;
+  await service.connectApiKey({ context, integrationId: "mail" });
+  state.malformed = true;
+  await assert.rejects(invoke("logs.list", { domain }), { code: "connector_response_invalid" });
+});