@jskit-ai/connectors-catalog 0.1.1

package/test/n8nOAuth.test.js

@@ -0,0 +1,188 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { n8nProvider, discoverN8nOAuth, registerN8nClient } from "../src/server/n8n.js";
+
+function fixture(resource, issuer) {
+  const calls = [];
+  const base = issuer.replace(/\/$/u, "");
+  const metadata = {
+    issuer, authorization_endpoint: `${base}/mcp-oauth/authorize`,
+    token_endpoint: `${base}/mcp-oauth/token`, registration_endpoint: `${base}/mcp-oauth/register`,
+    response_types_supported: ["code"], grant_types_supported: ["authorization_code", "refresh_token"],
+    token_endpoint_auth_methods_supported: ["client_secret_post"], code_challenge_methods_supported: ["S256"],
+    scopes_supported: ["workflow:read", "workflow:execute"]
+  };
+  const protectedResource = { resource, authorization_servers: [issuer], scopes_supported: ["workflow:read"] };
+  return { calls, metadata, protectedResource, fetchImpl: async (address, options) => {
+    calls.push({ address, options });
+    const url = new URL(address);
+    assert.equal(options.method, "GET"); assert.equal(options.redirect, "error"); assert.equal(options.credentials, "omit");
+    assert.equal(new Headers(options.headers).has("authorization"), false);
+    if (url.pathname.startsWith("/.well-known/oauth-protected-resource")) return Response.json(protectedResource);
+    return Response.json(metadata);
+  } };
+}
+
+test("n8n OAuth discovery preserves separate authority and resource hosts and installation paths", async () => {
+  for (const [resource, issuer] of [
+    ["https://automation.example/mcp-server/http", "https://automation.example"],
+    ["https://tools.example:8443/team/mcp-server/http", "https://login.example/n8n"]
+  ]) {
+    const f = fixture(resource, issuer);
+    const result = await discoverN8nOAuth({ serverUrl: resource }, f);
+    assert.equal(result.resource, resource); assert.deepEqual(result.oauth, f.metadata);
+    assert.deepEqual(result.scopes, ["workflow:read"]);
+    assert.equal(f.calls[0].address, `${new URL(resource).origin}/.well-known/oauth-protected-resource${new URL(resource).pathname}`);
+    assert.equal(f.calls[1].address, `${new URL(issuer).origin}/.well-known/oauth-authorization-server${new URL(issuer).pathname === "/" ? "" : new URL(issuer).pathname}`);
+    assert.equal(f.calls.length, 2);
+  }
+});
+
+test("n8n OAuth discovery rejects mismatched resources, authorities, endpoints and unsupported consent contracts", async () => {
+  for (const mutate of [
+    (f) => { f.protectedResource.resource += "/other"; },
+    (f) => { f.protectedResource.authorization_servers.push("https://other.example"); },
+    (f) => { f.protectedResource.authorization_servers = ["http://insecure.example"]; },
+    (f) => { f.metadata.issuer = "https://other.example"; },
+    (f) => { f.metadata.token_endpoint = "https://other.example/steal"; },
+    (f) => { f.metadata.registration_endpoint += "?secret=private"; },
+    (f) => { f.metadata.code_challenge_methods_supported = ["plain"]; },
+    (f) => { f.metadata.token_endpoint_auth_methods_supported = ["none"]; },
+    (f) => { f.protectedResource.scopes_supported = ["invented:scope"]; },
+    (f) => { f.protectedResource.scopes_supported = []; }
+  ]) {
+    const f = fixture("https://tools.example/mcp-server/http", "https://login.example"); mutate(f);
+    await assert.rejects(discoverN8nOAuth({ serverUrl: "https://tools.example/mcp-server/http" }, f), { code: "connector_discovery_failed" });
+    assert.ok(f.calls.length <= 2);
+  }
+});
+
+test("n8n OAuth discovery validates input before transport and sanitizes interruption and server errors", async () => {
+  let calls = 0;
+  const fetchImpl = async () => { calls++; throw new Error("private-server-detail"); };
+  await assert.rejects(discoverN8nOAuth({ serverUrl: "http://bad.example/api" }, { fetchImpl }));
+  assert.equal(calls, 0);
+  await assert.rejects(discoverN8nOAuth({ serverUrl: "https://tools.example/mcp-server/http" }, { fetchImpl }), (e) => e.code === "connector_discovery_failed" && !e.message.includes("private-server-detail"));
+  const controller = new AbortController(); controller.abort();
+  const previous = calls;
+  await assert.rejects(discoverN8nOAuth({ serverUrl: "https://tools.example/mcp-server/http" }, { fetchImpl, signal: controller.signal }), { code: "connector_discovery_interrupted" });
+  assert.equal(calls, previous);
+});
+
+
+test("n8n registers once with discovered authority, exact callback and selected resource scopes", async () => {
+  const f = fixture("https://tools.example/team/mcp-server/http", "https://login.example/n8n");
+  let registrations = 0;
+  const callback = "https://app.example/integrations/n8n/callback";
+  const result = await registerN8nClient({ serverUrl: f.protectedResource.resource, clientName: "App assistant", callbackUrl: callback, scopes: ["workflow:read"] }, {
+    fetchImpl: async (url, options) => {
+      if (options.method !== "POST") return f.fetchImpl(url, options);
+      registrations++;
+      assert.equal(String(url), f.metadata.registration_endpoint);
+      assert.equal(options.redirect, "error"); assert.equal(options.credentials, "omit");
+      const body = JSON.parse(options.body);
+      assert.deepEqual(body.redirect_uris, [callback]);
+      assert.equal(body.scope, "workflow:read"); assert.equal(body.token_endpoint_auth_method, "client_secret_post");
+      return Response.json({ ...body, client_id: "fixture-client", client_secret: "fixture-secret", client_secret_expires_at: 2000000000 });
+    }
+  });
+  assert.equal(registrations, 1); assert.deepEqual(result.requestedScopes, ["workflow:read"]); assert.equal(result.clientId, "fixture-client");
+  assert.equal(result.clientSecret, "fixture-secret"); assert.equal(result.clientSecretExpiresAt, 2000000000);
+  assert.equal(result.resource, f.protectedResource.resource); assert.deepEqual(result.oauth, f.metadata);
+});
+
+test("n8n rejects unsupported registration scopes before POST and never retries an ambiguous registration", async () => {
+  const f = fixture("https://tools.example/mcp-server/http", "https://login.example");
+  const input = { serverUrl: f.protectedResource.resource, clientName: "App", callbackUrl: "https://app.example/callback", scopes: ["workflow:execute"] };
+  let posts = 0;
+  const options = { fetchImpl: async (url, request) => {
+    if (request.method !== "POST") return f.fetchImpl(url, request);
+    posts++; throw new Error("private-instance-error");
+  } };
+  await assert.rejects(registerN8nClient(input, options), { code: "connector_scope_unavailable" });
+  assert.equal(posts, 0);
+  await assert.rejects(registerN8nClient({ ...input, scopes: ["workflow:read"] }, options), (e) => e.code === "connector_registration_failed" && !e.message.includes("private-instance-error"));
+  assert.equal(posts, 1);
+  const previous = f.calls.length;
+  await assert.rejects(registerN8nClient({ ...input, callbackUrl: "https://app.example/callback?secret=value" }, options));
+  assert.equal(f.calls.length, previous); assert.equal(posts, 1);
+});
+
+
+test("n8n saved discovery drives project-owned consent, encrypted grants and refresh without rediscovery", async (t) => {
+  const { mkdtemp, rm } = await import("node:fs/promises");
+  const { tmpdir } = await import("node:os");
+  const { join } = await import("node:path");
+  const { createConnectionService } = await import("../../connectors-core/src/server/index.js");
+  const { createFileConnectionStore, createCredentialProtection } = await import("../../connectors-core/src/server/fileStorage.js");
+  const f = fixture("https://tools.example/team/mcp-server/http", "https://login.example/n8n");
+  const discovery = await discoverN8nOAuth({ serverUrl: f.protectedResource.resource }, f);
+  const directory = await mkdtemp(join(tmpdir(), "n8n-oauth-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" });
+  const callback = "https://app.example/integrations/n8n/callback";
+  const input = { context: { applicationId: "app", subjectId: "owner" }, integrationId: "automation" };
+  const requests = [];
+  let now = Date.now();
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { client: { source: "own", clientId: "fixture-client",
+      clientSecretRef: "env:N8N_CLIENT_SECRET", callbackUrlRef: "env:N8N_CALLBACK_URL" } }, integrations: {
+      automation: { provider: "n8n", accountMode: "assistant", scopes: ["workflow:read"],
+        settings: { serverUrl: discovery.resource, oauthDiscovery: discovery },
+        authentication: { method: "oauth2", registrationRef: "client" } }
+    } }, providers: [n8nProvider], store: createFileConnectionStore({ directory, protection }), now: () => now,
+    authorize: async (owner) => owner,
+    resolveReference: async (ref) => ref === "env:N8N_CLIENT_SECRET" ? "fixture-secret" : callback,
+    fetchImpl: async (address, init) => {
+      requests.push({ address: String(address), init });
+      if (String(address) === discovery.oauth.token_endpoint) {
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("resource"), discovery.resource);
+        assert.equal(body.get("client_secret"), "fixture-secret");
+        const refresh = body.get("grant_type") === "refresh_token";
+        if (refresh) assert.equal(body.get("refresh_token"), "initial-refresh");
+        else { assert.equal(body.get("redirect_uri"), callback); assert.ok(body.get("code_verifier")); }
+        return Response.json({ token_type: "Bearer", access_token: refresh ? "renewed" : "initial", refresh_token: "initial-refresh",
+          expires_in: 60, scope: "workflow:read" });
+      }
+      assert.equal(String(address), discovery.resource);
+      assert.equal(new Headers(init.headers).get("authorization"), now > startedAt ? "Bearer renewed" : "Bearer initial");
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      const message = JSON.parse(init.body);
+      if (message.id === undefined) return new Response(null, { status: 202 });
+      assert.ok(["initialize", "tools/list"].includes(message.method));
+      return Response.json({ jsonrpc: "2.0", id: message.id, result: message.method === "initialize" ? {
+        protocolVersion: message.params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: "n8n", version: "1" }
+      } : { tools: [] } });
+    }
+  };
+  const startedAt = now;
+  const service = createConnectionService(options);
+  const start = await service.beginAuthorization(input);
+  const authorization = new URL(start.authorizationUrl);
+  assert.equal(authorization.origin + authorization.pathname, discovery.oauth.authorization_endpoint);
+  assert.equal(authorization.searchParams.get("resource"), discovery.resource);
+  assert.equal(authorization.searchParams.get("scope"), "workflow:read");
+  assert.equal(authorization.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(requests.length, 0);
+  assert.equal((await service.completeAuthorization({ ...input,
+    callbackUrl: `${callback}?code=fixture&state=${authorization.searchParams.get("state")}&iss=${encodeURIComponent(discovery.oauth.issuer)}` })).status, "connected");
+  now += 61_000;
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "tools.list", input: {} }), { tools: [] });
+  assert.equal(requests.filter((request) => request.address === discovery.oauth.token_endpoint).length, 2);
+  const changed = structuredClone(options.configuration);
+  changed.integrations.automation.settings.serverUrl = "https://other.example/mcp-server/http";
+  const count = requests.length;
+  await assert.rejects(createConnectionService({ ...options, configuration: changed }).beginAuthorization(input), { code: "connector_discovery_required" });
+  assert.equal(requests.length, count);
+  for (const mutation of [
+    (d) => { d.oauth.token_endpoint = "https://other.example/token"; },
+    (d) => { d.scopes = ["unknown:scope"]; },
+    (d) => { d.scopes = ["workflow:read", "workflow:read"]; }
+  ]) {
+    const invalid = structuredClone(options.configuration); mutation(invalid.integrations.automation.settings.oauthDiscovery);
+    assert.throws(() => createConnectionService({ ...options, configuration: invalid }));
+  }
+});

package/test/notionOAuth.test.js

@@ -0,0 +1,183 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { notionProvider, registerNotionMcpClient } from "../src/server/notion.js";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+
+test("Notion exchanges JSON with Basic auth and persists rotated refresh tokens across restart", async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), "notion-oauth-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(9) }, activeKeyId: "current" });
+  const callback = "https://app.example/integrations/notion/callback";
+  const input = { context: { applicationId: "app", subjectId: "alice" }, integrationId: "notes" };
+  let now = Date.now();
+  let tokenRequests = 0;
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { notion: { source: "own", clientId: "client-id",
+      tokenEndpointAuthMethod: "client_secret_basic", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK" } },
+    integrations: { notes: { provider: "notion", accountMode: "per-user", scopes: [],
+      authentication: { method: "oauth2", registrationRef: "notion" } } } },
+    providers: [notionProvider], store: createFileConnectionStore({ directory, protection }), now: () => now,
+    authorize: async (owner) => owner,
+    resolveReference: async (ref) => ref === "env:SECRET" ? "private-secret" : callback,
+    fetchImpl: async (address, init) => {
+      const headers = new Headers(init.headers);
+      if (String(address) === "https://api.notion.com/v1/oauth/token") {
+        assert.equal(init.method, "POST"); assert.equal(init.redirect, "manual");
+        assert.equal(headers.get("content-type"), "application/json");
+        assert.equal(headers.get("authorization"), `Basic ${Buffer.from("client-id:private-secret").toString("base64")}`);
+        assert.ok(init.signal instanceof AbortSignal);
+        const body = JSON.parse(init.body);
+        assert.equal(body.client_secret, undefined); assert.equal(body.code_verifier, undefined);
+        if (tokenRequests === 0) assert.deepEqual(body, { grant_type: "authorization_code", code: "fixture", redirect_uri: callback });
+        else assert.deepEqual(body, { grant_type: "refresh_token", refresh_token: `refresh-${tokenRequests}` });
+        tokenRequests++;
+        return Response.json({ token_type: "bearer", access_token: `access-${tokenRequests}`, refresh_token: `refresh-${tokenRequests}`, expires_in: 60 });
+      }
+      assert.equal(String(address), "https://api.notion.com/v1/search");
+      assert.equal(headers.get("notion-version"), "2026-03-11");
+      assert.equal(headers.get("authorization"), `Bearer access-${tokenRequests}`);
+      return Response.json({ object: "list", results: [], has_more: false });
+    }
+  };
+  const service = createConnectionService(options);
+  const start = await service.beginAuthorization(input);
+  const url = new URL(start.authorizationUrl);
+  assert.equal(url.origin + url.pathname, notionProvider.oauth.authorization_endpoint);
+  assert.equal(url.searchParams.get("owner"), "user");
+  assert.equal(url.searchParams.get("redirect_uri"), callback);
+  assert.equal(url.searchParams.has("code_challenge"), false);
+  assert.equal(tokenRequests, 0);
+  const completion = { ...input, callbackUrl: `${callback}?code=fixture&state=${url.searchParams.get("state")}` };
+  assert.equal((await service.completeAuthorization(completion)).status, "connected");
+  await assert.rejects(service.completeAuthorization(completion));
+  assert.equal(tokenRequests, 1);
+  for (let i = 0; i < 2; i++) {
+    now += 61_000;
+    const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+    assert.deepEqual(await restarted.invoke({ ...input, operation: "content.search", input: {} }), { object: "list", results: [], has_more: false });
+  }
+  assert.equal(tokenRequests, 3);
+  await assert.rejects(service.invoke({ ...input, context: { ...input.context, subjectId: "bob" }, operation: "content.search", input: {} }));
+  assert.equal(tokenRequests, 3);
+});
+
+test("Notion rejects failed or malformed token exchanges without replay or secret disclosure", async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), "notion-oauth-errors-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current" });
+  const callback = "https://app.example/integrations/notion/callback";
+  const input = { context: { applicationId: "app", subjectId: "alice" }, integrationId: "notes" };
+  const configuration = { schemaVersion: 1, registrations: { notion: { source: "own", clientId: "client-id",
+    tokenEndpointAuthMethod: "client_secret_basic", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK" } },
+    integrations: { notes: { provider: "notion", accountMode: "per-user", scopes: [], authentication: { method: "oauth2", registrationRef: "notion" } } } };
+  for (const response of [
+    () => Response.json({ error: "invalid_client", error_description: "private-fixture-secret" }, { status: 401 }),
+    () => Response.json({ token_type: "bearer", refresh_token: "private-fixture-secret" }),
+    () => new Response("private-fixture-secret", { status: 502 }),
+    () => { throw new Error("private-fixture-secret"); }
+  ]) {
+    let requests = 0;
+    const service = createConnectionService({ configuration, providers: [notionProvider],
+      store: createFileConnectionStore({ directory, protection }), authorize: async (owner) => owner,
+      resolveReference: async (ref) => ref === "env:SECRET" ? "private-fixture-secret" : callback,
+      fetchImpl: async () => { requests++; return response(); }
+    });
+    const start = await service.beginAuthorization(input);
+    const state = new URL(start.authorizationUrl).searchParams.get("state");
+    const completion = { ...input, callbackUrl: `${callback}?code=fixture&state=${state}` };
+    await assert.rejects(service.completeAuthorization(completion), (error) => {
+      assert.equal(JSON.stringify(error).includes("private-fixture-secret"), false);
+      assert.equal(error.message.includes("private-fixture-secret"), false);
+      return true;
+    });
+    assert.equal(requests, 1);
+    await assert.rejects(service.completeAuthorization(completion));
+    assert.equal(requests, 1);
+    await assert.rejects(service.invoke({ ...input, operation: "content.search", input: {} }));
+    assert.equal(requests, 1);
+  }
+});
+
+test("Notion hosted MCP uses separate PKCE/form credentials and tool discovery", async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), "notion-mcp-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(4) }, activeKeyId: "current" });
+  const callback = "https://app.example/integrations/notion/callback";
+  const configuration = { schemaVersion: 1, registrations: { client: { source: "own", clientId: "mcp-client",
+    clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK" } }, integrations: {
+    notes: { provider: "notion", accountMode: "assistant", settings: { connectionType: "mcp" }, scopes: ["default"],
+      authentication: { method: "oauth2", registrationRef: "client" } } } };
+  const input = { context: { applicationId: "app", subjectId: "alice" }, integrationId: "notes" };
+  let exchanges = 0;
+  let now = Date.now();
+  const options = { now: () => now, configuration, providers: [notionProvider], authorize: async (owner) => owner,
+    store: createFileConnectionStore({ directory, protection }),
+    resolveReference: async (ref) => ref === "env:SECRET" ? "mcp-secret" : callback,
+    fetchImpl: async (address, init) => {
+      if (String(address) === "https://mcp.notion.com/token") {
+        const body = new URLSearchParams(init.body);
+        if (exchanges === 0) assert.ok(body.get("code_verifier"));
+        else { assert.equal(body.get("grant_type"), "refresh_token"); assert.equal(body.get("refresh_token"), "mcp-refresh"); }
+        assert.equal(body.get("client_secret"), "mcp-secret");
+        assert.equal(new Headers(init.headers).has("authorization"), false);
+        assert.match(new Headers(init.headers).get("content-type"), /application\/x-www-form-urlencoded/u);
+        exchanges++;
+        return Response.json({ token_type: "bearer", access_token: "mcp-access", refresh_token: "mcp-refresh", expires_in: 3600, scope: "default" });
+      }
+      assert.equal(String(address), "https://mcp.notion.com/mcp");
+      assert.equal(new Headers(init.headers).get("authorization"), "Bearer mcp-access");
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      const body = JSON.parse(init.body);
+      if (body.id === undefined) return new Response(null, { status: 202 });
+      assert.ok(["initialize", "tools/list"].includes(body.method));
+      return Response.json({ jsonrpc: "2.0", id: body.id, result: body.method === "initialize" ? {
+        protocolVersion: body.params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: "fixture", version: "1" }
+      } : { tools: [] } });
+    }
+  };
+  const service = createConnectionService(options);
+  const start = await service.beginAuthorization(input);
+  const url = new URL(start.authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://mcp.notion.com/authorize");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(url.searchParams.has("owner"), false);
+  await service.completeAuthorization({ ...input, callbackUrl: `${callback}?code=fixture&state=${url.searchParams.get("state")}` });
+  assert.equal(exchanges, 1);
+  now += 3_601_000;
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "tools.list", input: {} }), { tools: [] });
+  assert.equal(exchanges, 2);
+  await assert.rejects(service.invoke({ ...input, operation: "content.search", input: {} }));
+  const invalid = structuredClone(configuration); invalid.integrations.notes.accountMode = "per-user";
+  assert.throws(() => createConnectionService({ ...options, configuration: invalid }));
+});
+
+
+test("Notion MCP client registration validates callback and never retries an ambiguous failure", async () => {
+  const input = { clientName: "Notes assistant", callbackUrl: "https://app.example/integrations/notion/callback" };
+  let requests = 0;
+  const fetchImpl = async (address, options) => {
+    requests++;
+    assert.equal(String(address), "https://mcp.notion.com/register");
+    assert.equal(options.method, "POST"); assert.equal(options.redirect, "error");
+    assert.equal(options.credentials, "omit");
+    const body = JSON.parse(options.body);
+    assert.equal(body.scope, "default");
+    assert.equal(body.token_endpoint_auth_method, "client_secret_post");
+    assert.deepEqual(body.redirect_uris, [input.callbackUrl]);
+    return Response.json({ ...body, client_id: "mcp-client", client_secret: "private-secret" });
+  };
+  assert.deepEqual(await registerNotionMcpClient(input, { fetchImpl }), { clientId: "mcp-client", clientSecret: "private-secret" });
+  assert.equal(requests, 1);
+  await assert.rejects(registerNotionMcpClient({ ...input, callbackUrl: "https://app.example/callback?secret=bad" }, { fetchImpl }));
+  assert.equal(requests, 1);
+  await assert.rejects(registerNotionMcpClient(input, { fetchImpl: async () => {
+    requests++; throw new Error("private-secret");
+  } }), (error) => error.code === "connector_registration_failed" && !error.message.includes("private-secret"));
+  assert.equal(requests, 2);
+});

package/test/oura.test.js

@@ -0,0 +1,211 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { ouraProvider } from "../src/server/oura.js";
+
+const callback = "https://app.example.test/oura/callback";
+const context = { applicationId: "app-one", subjectId: "user-one" };
+const input = { context, integrationId: "oura" };
+const daily = { data: [{ id: "sleep-1", day: "2026-09-01", score: 82 }], next_token: "next +&2" };
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "oura-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { time: Date.now(), tokenCount: 0, tokenScope: undefined, status: 200, response: daily };
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(6) }, activeKeyId: "current" });
+  const options = {
+    configuration: { schemaVersion: 1, integrations: {
+      oura: { provider: "oura", accountMode: "per-user", scopes: ["daily", "personal", "email"], authentication: { method: "oauth2", registrationRef: "oura" } }
+    }, registrations: { oura: { source: "own", clientId: "fixture-client", clientSecretRef: "env:OURA_SECRET", callbackUrlRef: "env:OURA_CALLBACK" } } },
+    providers: [ouraProvider], authorize: async (owner) => owner, now: () => state.time,
+    resolveReference: async (ref) => ref === "env:OURA_CALLBACK" ? callback : "fixture-client-secret",
+    store: createFileConnectionStore({ directory, protection }),
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address));
+      requests.push({ url, init, headers: new Headers(init.headers) });
+      assert.equal(url.origin, "https://api.ouraring.com");
+      if (url.pathname === "/oauth/token") {
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_id"), "fixture-client");
+        assert.equal(body.get("client_secret"), "fixture-client-secret");
+        if (body.get("grant_type") === "refresh_token") assert.equal(body.get("refresh_token"), `fixture-refresh-${state.tokenCount}`);
+        state.tokenCount += 1;
+        return Response.json({ access_token: `fixture-access-${state.tokenCount}`, refresh_token: `fixture-refresh-${state.tokenCount}`, token_type: "bearer", expires_in: 60,
+          ...(state.tokenScope === undefined ? {} : { scope: state.tokenScope }) });
+      }
+      return Response.json(state.response, { status: state.status });
+    }
+  };
+  const service = createConnectionService(options);
+  async function start(scope = "daily personal") {
+    const { authorizationUrl } = await service.beginAuthorization(input);
+    const url = new URL(authorizationUrl);
+    const redirect = new URL(callback);
+    redirect.searchParams.set("code", "fixture-code");
+    redirect.searchParams.set("state", url.searchParams.get("state"));
+    if (scope !== null) redirect.searchParams.set("scope", scope);
+    return { url, callbackUrl: redirect.href };
+  }
+  return { service, options, protection, directory, requests, state, start };
+}
+
+test("Oura uses code consent, records reduced callback scopes and persists a private per-user grant", async (t) => {
+  const { service, options, protection, directory, requests, state, start } = await fixture(t);
+  const { url, callbackUrl } = await start();
+  assert.equal(url.origin + url.pathname, "https://cloud.ouraring.com/oauth/authorize");
+  assert.equal(url.searchParams.get("response_type"), "code");
+  assert.equal(url.searchParams.get("redirect_uri"), callback);
+  assert.equal(url.searchParams.get("scope"), "daily personal email");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(url.searchParams.has("client_secret"), false);
+  const connected = await service.completeAuthorization({ ...input, callbackUrl });
+  assert.equal(connected.status, "connected");
+  assert.deepEqual(connected.grantedScopes, ["daily", "personal"]);
+  const code = new URLSearchParams(requests[0].init.body);
+  assert.equal(code.get("grant_type"), "authorization_code");
+  assert.equal(code.get("redirect_uri"), callback);
+  assert.ok(code.get("code_verifier"));
+  assert.equal(requests[1].url.pathname, "/v2/usercollection/daily_sleep");
+  assert.equal(requests[1].headers.get("authorization"), "Bearer fixture-access-1");
+  assert.equal(requests[1].init.redirect, "error");
+  for (const name of await readdir(directory)) {
+    const text = await readFile(path.join(directory, name), "utf8");
+    for (const secret of ["fixture-client-secret", "fixture-access-1", "fixture-refresh-1"]) assert.equal(text.includes(secret), false);
+  }
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  assert.deepEqual(await restarted.status(input), { ...connected, callbackUrl: callback });
+  const operation = { ...input, operation: "dailySleep.list", input: { start_date: "2026-09-01", end_date: "2026-09-08", next_token: "next +&2" } };
+  assert.deepEqual(await restarted.invoke(operation), daily);
+  assert.deepEqual(Object.fromEntries(requests.at(-1).url.searchParams), operation.input);
+  state.response = { id: "oura-person", age: null };
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "personalInfo.read" }), state.response);
+  assert.equal(requests.at(-1).url.pathname, "/v2/usercollection/personal_info");
+  for (const owner of [{ ...context, applicationId: "other-app" }, { ...context, subjectId: "other-user" }]) {
+    await assert.rejects(restarted.invoke({ ...operation, context: owner }), { code: "connector_reconnect_required" });
+  }
+  await restarted.disconnect(input);
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("Oura rejects cancelled, denied, missing or ambiguous consent and never restores declined scopes", async (t) => {
+  const { service, requests, start } = await fixture(t);
+  const cancelled = await start();
+  await service.cancelAuthorization({ ...input, state: cancelled.url.searchParams.get("state") });
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: cancelled.callbackUrl }), { code: "connector_attempt_invalid" });
+  for (const kind of ["missing", "duplicate", "denied"]) {
+    const started = await start(kind === "missing" ? null : "daily");
+    const url = new URL(started.callbackUrl);
+    if (kind === "duplicate") url.searchParams.append("scope", "personal");
+    if (kind === "denied") { url.searchParams.delete("code"); url.searchParams.set("error", "access_denied"); }
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: url.href }), {
+      code: kind === "denied" ? "connector_consent_denied" : "connector_response_invalid"
+    });
+  }
+  assert.equal(requests.length, 0);
+  await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: (await start("email")).callbackUrl }), { code: "connector_scope_missing" });
+  assert.equal(requests.length, 1);
+  const connected = await service.completeAuthorization({ ...input, callbackUrl: (await start("daily unexpected")).callbackUrl });
+  assert.deepEqual(connected.grantedScopes, ["daily"]);
+  const count = requests.length;
+  await assert.rejects(service.invoke({ ...input, operation: "personalInfo.read" }), { code: "connector_scope_missing" });
+  assert.equal(requests.length, count);
+});
+
+test("Oura serializes single-use refresh tokens and preserves reduced scopes after restart", async (t) => {
+  const { service, options, state, start } = await fixture(t);
+  await service.completeAuthorization({ ...input, callbackUrl: (await start("daily")).callbackUrl });
+  state.time += 40_000;
+  await Promise.all([service.invoke({ ...input, operation: "dailySleep.list" }), service.invoke({ ...input, operation: "dailySleep.list" })]);
+  assert.equal(state.tokenCount, 2);
+  const restarted = createConnectionService(options);
+  state.time += 40_000;
+  await restarted.invoke({ ...input, operation: "dailySleep.list" });
+  assert.equal(state.tokenCount, 3);
+  assert.deepEqual((await restarted.status(input)).grantedScopes, ["daily"]);
+});
+
+test("Oura provider errors and malformed successes remain disconnected and redact provider messages", async (t) => {
+  const { service, state, start } = await fixture(t);
+  for (const [status, code] of [[200, "connector_response_invalid"], [401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    state.response = { message: "fixture-client-secret" };
+    await assert.rejects(service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl }), (error) => {
+      assert.equal(error.code, code);
+      assert.equal(error.message.includes("fixture-client-secret"), false);
+      assert.equal(JSON.stringify(error).includes("fixture-client-secret"), false);
+      return true;
+    });
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+  state.status = 200;
+  state.response = daily;
+  await service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl });
+  state.status = 401;
+  await assert.rejects(service.invoke({ ...input, operation: "dailySleep.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Oura validates dates and opaque paging inputs before any provider request", async (t) => {
+  const { service, requests, state, start } = await fixture(t);
+  await service.completeAuthorization({ ...input, callbackUrl: (await start()).callbackUrl });
+  const count = requests.length;
+  for (const invalid of [
+    { start_date: "2026-02-29" }, { end_date: "2026-09-31" }, { start_date: "2026-01-01T00:00:00Z" },
+    { next_token: "" }, { next_token: "x".repeat(4097) }, { url: "https://attacker.invalid" }, { limit: 100 }
+  ]) await assert.rejects(service.invoke({ ...input, operation: "dailySleep.list", input: invalid }), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  state.response = { data: [], next_token: null };
+  assert.deepEqual(await service.invoke({ ...input, operation: "dailySleep.list", input: { start_date: "2024-02-29" } }), state.response);
+});
+
+test("Oura prefers token-response permissions when present over the authorization callback fallback", async (t) => {
+  const { service, state, start } = await fixture(t);
+  state.tokenScope = "daily";
+  const connected = await service.completeAuthorization({ ...input, callbackUrl: (await start("daily personal email")).callbackUrl });
+  assert.deepEqual(connected.grantedScopes, ["daily"]);
+  await assert.rejects(service.invoke({ ...input, operation: "personalInfo.read" }), { code: "connector_scope_missing" });
+});
+
+
+test("Oura rejects an empty permission selection before starting broad consent", async (t) => {
+  const { options, requests } = await fixture(t);
+  const configuration = structuredClone(options.configuration);
+  configuration.integrations.oura.scopes = [];
+  assert.throws(() => createConnectionService({ ...options, configuration }));
+  assert.equal(requests.length, 0);
+});
+
+test("Oura reads sleep readiness activity and separately consented heart rate with explicit paging", async t => {
+  const { options, state, requests } = await fixture(t);
+  options.configuration.integrations.oura.scopes.push("heartrate");
+  const expanded = createConnectionService(options);
+  const { authorizationUrl } = await expanded.beginAuthorization(input);
+  const cb = new URL(callback); cb.searchParams.set("state", new URL(authorizationUrl).searchParams.get("state")); cb.searchParams.set("code", "fixture-code"); cb.searchParams.set("scope", "daily heartrate");
+  await expanded.completeAuthorization({ ...input, callbackUrl: cb.href });
+  for (const [op, endpoint] of [["sleep.list", "sleep"], ["dailyReadiness.list", "daily_readiness"], ["dailyActivity.list", "daily_activity"]]) {
+    state.response = { data: [{ id: endpoint, day: "2026-09-01", score: 85 }], next_token: "next+&2" };
+    assert.deepEqual(await expanded.invoke({ ...input, operation: op, input: { start_date: "2026-09-01", end_date: "2026-09-02", next_token: "prior+&1" } }), state.response);
+    assert.equal(requests.at(-1).url.pathname, `/v2/usercollection/${endpoint}`);
+    assert.equal(requests.at(-1).url.searchParams.get("next_token"), "prior+&1");
+  }
+  state.response = { data: [{ bpm: 65, source: "sleep", timestamp: "2026-09-01T00:01:00+08:00" }], next_token: null };
+  const values = { start_datetime: "2026-09-01T00:00:00+08:00", end_datetime: "2026-09-02T00:00:00+08:00" };
+  assert.deepEqual(await expanded.invoke({ ...input, operation: "heartRate.list", input: values }), state.response);
+  assert.equal(requests.at(-1).url.searchParams.get("start_datetime"), values.start_datetime);
+  const count = requests.length;
+  for (const invalid of [{ start_datetime: "2026-02-30T00:00:00Z" }, { start_datetime: "2026-09-01T00:00:00" }, { ...values, end_datetime: "2026-08-01T00:00:00Z" }])
+    await assert.rejects(expanded.invoke({ ...input, operation: "heartRate.list", input: invalid }), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  await expanded.disconnect(input);
+  const next = await expanded.beginAuthorization(input); cb.searchParams.set("state", new URL(next.authorizationUrl).searchParams.get("state")); cb.searchParams.set("scope", "daily");
+  state.response = daily;
+  await expanded.completeAuthorization({ ...input, callbackUrl: cb.href });
+  const before = requests.length;
+  await assert.rejects(expanded.invoke({ ...input, operation: "heartRate.list", input: values }), { code: "connector_scope_missing" });
+  assert.equal(requests.length, before);
+});

package/test/paddleCatalogue.test.js

@@ -0,0 +1,51 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createProductsWithPrices } from "../patterns/paddle-catalogue/example/create-products.js";
+
+const item = () => ({ product: { name: "Example", tax_category: "saas" }, price: {
+  description: "One-time purchase", unit_price: { amount: "1200", currency_code: "USD" }
+} });
+
+test("Paddle batch validates all items before writing and preserves a failed price's product", async () => {
+  const calls = [];
+  const runtime = { async invoke(request) {
+    calls.push(request);
+    if (request.operation === "prices.create") throw new Error("private-provider-error");
+    return { data: { id: `pro_${"a".repeat(26)}` } };
+  } };
+  const options = { runtime, context: { subjectId: "admin", applicationId: "app" }, integrationId: "merchant" };
+  await assert.rejects(createProductsWithPrices({ ...options, items: [item(), { ...item(), price: { description: "invalid" } }] }));
+  assert.equal(calls.length, 0);
+  const result = await createProductsWithPrices({ ...options, items: [item(), item()] });
+  assert.equal(calls.length, 2);
+  assert.deepEqual(result, { completed: [], failed: { index: 0, stage: "price", productId: `pro_${"a".repeat(26)}`, outcome: "requires-review" } });
+  assert.equal(JSON.stringify(result).includes("private-provider-error"), false);
+});
+
+test("Paddle batch passes returned product IDs into prices and returns completed pairs", async () => {
+  const calls = [];
+  const runtime = { async invoke(request) {
+    calls.push(request);
+    return { data: { id: request.operation === "products.create" ? `pro_${"b".repeat(26)}` : `pri_${"c".repeat(26)}` } };
+  } };
+  const result = await createProductsWithPrices({ runtime, context: { subjectId: "admin" }, integrationId: "merchant", items: [item()] });
+  assert.equal(calls[1].input.product_id, `pro_${"b".repeat(26)}`);
+  assert.equal(calls[1].integrationId, "merchant");
+  assert.deepEqual(result, { completed: [{ index: 0, productId: `pro_${"b".repeat(26)}`, priceId: `pri_${"c".repeat(26)}` }], failed: null });
+});
+
+
+test("Paddle batch keeps earlier success when a later product fails and starts no further items", async () => {
+  let calls = 0;
+  const runtime = { async invoke() {
+    calls++;
+    if (calls === 3) throw new Error("network outcome unknown");
+    return { data: { id: calls === 1 ? `pro_${"d".repeat(26)}` : `pri_${"e".repeat(26)}` } };
+  } };
+  const result = await createProductsWithPrices({ runtime, context: {}, integrationId: "merchant", items: [item(), item(), item()] });
+  assert.equal(calls, 3);
+  assert.deepEqual(result, {
+    completed: [{ index: 0, productId: `pro_${"d".repeat(26)}`, priceId: `pri_${"e".repeat(26)}` }],
+    failed: { index: 1, stage: "product", outcome: "requires-review" }
+  });
+});