@jskit-ai/connectors-core 0.1.1

package/test/fileConnectionStore.test.js

@@ -0,0 +1,165 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, readdir, readFile, writeFile, rm, stat, symlink } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createFileConnectionStore, createCredentialProtection } from "../src/server/fileStorage.js";
+
+const identity = { owner: { applicationId: "app", subjectId: "user" }, integrationId: "calendar" };
+const key = new Uint8Array(32).fill(7);
+const protection = () => createCredentialProtection({ keys: { current: key }, activeKeyId: "current" });
+async function fixture(t) {
+  const root = await mkdtemp(path.join(tmpdir(), "connector-files-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const directory = path.join(root, "connections");
+  return { root, directory, store: createFileConnectionStore({ directory, protection: protection() }) };
+}
+
+test("JSON connection records survive restart with encrypted credentials and single-use attempts", async (t) => {
+  const { directory, store } = await fixture(t);
+  const connection = { status: "connected", tokens: { accessToken: "private-access", refreshToken: "private-refresh" } };
+  await store.withConnection(identity, async ({ save, putAttempt }) => {
+    await save(connection);
+    await putAttempt({ state: "one-time-state", codeVerifier: "private-verifier", expiresAt: Date.now() + 60_000 });
+  });
+  const [name] = await readdir(directory);
+  assert.match(name, /^[a-f0-9]{64}\.json$/u);
+  const text = await readFile(path.join(directory, name), "utf8");
+  assert.equal(JSON.parse(text).schemaVersion, 1);
+  assert.equal(/private-|one-time-state/u.test(text), false);
+  assert.equal((await stat(path.join(directory, name))).mode & 0o077, 0);
+  const restarted = createFileConnectionStore({ directory, protection: protection() });
+  await restarted.withConnection(identity, async ({ connection: actual, consumeAttempt }) => {
+    assert.deepEqual(actual, connection);
+    assert.equal((await consumeAttempt("one-time-state")).codeVerifier, "private-verifier");
+  });
+  await store.withConnection(identity, async ({ consumeAttempt }) => assert.equal(await consumeAttempt("one-time-state"), null));
+});
+
+test("failed callbacks and failed writes preserve the prior complete JSON record", async (t) => {
+  const { directory, store } = await fixture(t);
+  await store.withConnection(identity, async ({ save }) => save({ version: 1 }));
+  await assert.rejects(store.withConnection(identity, async ({ save, putAttempt }) => {
+    await save({ version: 2 });
+    await putAttempt({ state: "uncommitted", expiresAt: Date.now() + 60_000 });
+    throw new Error("interrupted operation");
+  }), /interrupted operation/u);
+  const brokenWriter = createFileConnectionStore({ directory, protection: { ...protection(), seal: async () => { throw new Error("vault unavailable"); } } });
+  await assert.rejects(brokenWriter.withConnection(identity, async ({ save }) => save({ version: 3 })), /vault unavailable/u);
+  await store.withConnection(identity, async ({ connection, consumeAttempt }) => {
+    assert.deepEqual(connection, { version: 1 });
+    assert.equal(await consumeAttempt("uncommitted"), null);
+  });
+  assert.equal((await readdir(directory)).length, 1);
+});
+
+test("owner bindings reject copied records and malformed JSON is never replaced", async (t) => {
+  const { directory, store } = await fixture(t);
+  await store.withConnection(identity, async ({ save }) => save({ secret: "first-account" }));
+  const first = (await readdir(directory))[0];
+  const other = { ...identity, owner: { ...identity.owner, subjectId: "other-user" } };
+  await store.withConnection(other, async ({ connection, save }) => {
+    assert.equal(connection, null);
+    await save({ secret: "second-account" });
+  });
+  const second = (await readdir(directory)).find((name) => name !== first);
+  await writeFile(path.join(directory, second), await readFile(path.join(directory, first)));
+  await assert.rejects(store.withConnection(other, () => assert.fail("must not expose copied credentials")), { code: "connector_storage_invalid" });
+  await writeFile(path.join(directory, first), "broken-json");
+  await assert.rejects(store.withConnection(identity, async ({ save }) => save({ replaced: true })), { code: "connector_storage_invalid" });
+  assert.equal(await readFile(path.join(directory, first), "utf8"), "broken-json");
+});
+
+test("disconnect removes pending attempts and expired attempts cannot resume", async (t) => {
+  const { directory } = await fixture(t);
+  let now = 1000;
+  const store = createFileConnectionStore({ directory, protection: protection(), now: () => now });
+  await store.withConnection(identity, async ({ save, putAttempt }) => {
+    await save({ status: "connected" });
+    await putAttempt({ state: "expired", expiresAt: 2000 });
+    await putAttempt({ state: "pending", expiresAt: 9000 });
+  });
+  now = 3000;
+  await store.withConnection(identity, async ({ consumeAttempt, remove }) => {
+    assert.equal(await consumeAttempt("expired"), null);
+    await remove();
+  });
+  await store.withConnection(identity, async ({ connection, consumeAttempt }) => {
+    assert.equal(connection, null);
+    assert.equal(await consumeAttempt("pending"), null);
+  });
+});
+
+test("symlinked files and directories are rejected without modifying their targets", async (t) => {
+  const { root, directory, store } = await fixture(t);
+  await store.withConnection(identity, async ({ save }) => save({ first: true }));
+  const file = path.join(directory, (await readdir(directory))[0]);
+  const external = path.join(root, "outside.json");
+  await writeFile(external, "keep-me");
+  await rm(file);
+  await symlink(external, file);
+  await assert.rejects(store.withConnection(identity, async ({ save }) => save({ overwritten: true })), { code: "connector_storage_invalid" });
+  assert.equal(await readFile(external, "utf8"), "keep-me");
+  const alias = path.join(root, "alias");
+  await symlink(directory, alias);
+  const aliased = createFileConnectionStore({ directory: alias, protection: protection() });
+  await assert.rejects(aliased.withConnection(identity, () => {}), { code: "connector_storage_invalid" });
+});
+
+test("independent processes serialize updates to the same connection", async (t) => {
+  const { directory, store } = await fixture(t);
+  await store.withConnection(identity, async ({ save }) => save({ count: 0 }));
+  const moduleUrl = new URL("../src/server/fileStorage.js", import.meta.url).href;
+  const source = `
+    import { createFileConnectionStore, createCredentialProtection } from ${JSON.stringify(moduleUrl)};
+    import { setTimeout } from 'node:timers/promises';
+    const store = createFileConnectionStore({ directory: process.argv[1], protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(7) }, activeKeyId: 'current' }) });
+    for (let i = 0; i < 3; i++) await store.withConnection(${JSON.stringify(identity)}, async ({ connection, save }) => {
+      await setTimeout(15);
+      await save({ count: connection.count + 1 });
+    });
+  `;
+  await Promise.all([1, 2, 3].map(() => promisify(execFile)(process.execPath, ["--input-type=module", "-e", source, directory])));
+  await store.withConnection(identity, ({ connection }) => assert.equal(connection.count, 9));
+  assert.equal((await readdir(directory)).filter((file) => file.endsWith(".tmp") || file.endsWith(".lock")).length, 0);
+});
+
+
+test("pending OAuth resumes after reopening the app store without exposing private attempt fields", async (t) => {
+  const { directory } = await fixture(t);
+  const { createConnectionService } = await import("../src/server/index.js");
+  const { googleCalendarProvider } = await import("../../connector-google-calendar/src/server/provider.js");
+  let clock = 1000;
+  const configuration = {
+    schemaVersion: 1,
+    integrations: { calendar: { provider: "google-calendar", accountMode: "shared",
+      scopes: ["https://www.googleapis.com/auth/calendar.calendarlist.readonly"],
+      authentication: { method: "oauth2", registrationRef: "google" } } },
+    registrations: { google: { source: "own", clientId: "fixture-client", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK" } }
+  };
+  const makeService = (config = configuration) => createConnectionService({
+    configuration: config, providers: [googleCalendarProvider],
+    store: createFileConnectionStore({ directory, protection: protection(), now: () => clock }),
+    authorize: async (context) => context,
+    resolveReference: async (ref) => ref === "env:CALLBACK" ? "https://app.example/integrations/google/callback" : "fixture-private-secret",
+    now: () => clock, fetchImpl: async () => { throw new Error("Resume must not call provider"); }
+  });
+  const input = { context: identity.owner, integrationId: "calendar" };
+  const first = await makeService().beginAuthorization(input);
+  const restarted = makeService();
+  assert.deepEqual(await restarted.resumeAuthorization(input), first);
+  assert.deepEqual(Object.keys(first).sort(), ["authorizationUrl", "callbackUrl", "expiresAt"]);
+  assert.equal(await restarted.resumeAuthorization({ ...input, context: { ...identity.owner, applicationId: "other-app" } }), null);
+  assert.equal(await restarted.resumeAuthorization({ ...input, context: { ...identity.owner, subjectId: "other-user" } }), null);
+  const changed = structuredClone(configuration);
+  changed.registrations.google.clientId = "different-client";
+  assert.equal(await makeService(changed).resumeAuthorization(input), null);
+  const state = new URL(first.authorizationUrl).searchParams.get("state");
+  await restarted.cancelAuthorization({ ...input, state });
+  assert.equal(await makeService().resumeAuthorization(input), null);
+  await restarted.beginAuthorization(input);
+  clock += 600001;
+  assert.equal(await makeService().resumeAuthorization(input), null);
+});

package/test/knexConnectionStore.test.js

@@ -0,0 +1,178 @@
+import assert from "node:assert/strict";
+import { randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createServer } from "node:net";
+import { once } from "node:events";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import createKnex from "knex";
+import migration from "../migrations/connectors_core_initial.cjs";
+import { createCredentialProtection, createKnexConnectionStore } from "../src/server/storage.js";
+
+test("credential protection binds ciphertext to its record and supports key rotation", async () => {
+  const oldKey = randomBytes(32);
+  const nextKey = randomBytes(32);
+  const old = createCredentialProtection({ keys: { old: oldKey }, activeKeyId: "old" });
+  const current = createCredentialProtection({ keys: { old: oldKey, current: nextKey }, activeKeyId: "current" });
+  const value = { accessToken: "a-secret-access-token", refreshToken: "a-secret-refresh-token" };
+  const ciphertext = await old.seal(value, "account-1");
+  assert.equal(ciphertext.includes(value.accessToken), false);
+  assert.deepEqual(await current.open(ciphertext, "account-1"), value);
+  await assert.rejects(current.open(ciphertext, "account-2"), { code: "connector_credentials_unavailable" });
+  const parts = ciphertext.split(".");
+  parts[3] = `${parts[3][0] === "A" ? "B" : "A"}${parts[3].slice(1)}`;
+  await assert.rejects(current.open(parts.join("."), "account-1"), { code: "connector_credentials_unavailable" });
+  const rotated = await current.seal(value, "account-1");
+  await assert.rejects(old.open(rotated, "account-1"), { code: "connector_credentials_unavailable" });
+  assert.throws(() => createCredentialProtection({ keys: { short: randomBytes(16) }, activeKeyId: "short" }));
+});
+
+const databaseUrl = process.env.CONNECTORS_TEST_DATABASE_URL;
+test("durable connector storage on an isolated SQL database", { skip: !databaseUrl && "Set CONNECTORS_TEST_DATABASE_URL to a disposable connector test database." }, async (t) => {
+  const url = new URL(databaseUrl);
+  assert.match(url.pathname, /^\/jskit_connector_test_[a-z0-9_]+$/u, "Refuse to migrate a non-test database.");
+  const knex = createKnex({ client: url.protocol === "postgres:" ? "pg" : "mysql2", connection: databaseUrl, pool: { min: 0, max: 4 } });
+  const protection = createCredentialProtection({ keys: { test: randomBytes(32) }, activeKeyId: "test" });
+  const store = createKnexConnectionStore({ knex, protection });
+  const owner = { applicationId: "test-application", subjectId: "test-user" };
+  const scope = { owner, integrationId: "calendar" };
+  const connection = { tokens: { accessToken: "private-access", refreshToken: "private-refresh" }, version: 0 };
+  await migration.up(knex);
+  try {
+    await t.test("persists encrypted records and reopens them through another database pool", async () => {
+      await store.withConnection(scope, async ({ save }) => save(connection));
+      const rows = await knex("connector_connections").select();
+      assert.equal(JSON.stringify(rows).includes("private-access"), false);
+      const otherKnex = createKnex({ client: knex.client.config.client, connection: databaseUrl, pool: { min: 0, max: 2 } });
+      try {
+        const reopened = createKnexConnectionStore({ knex: otherKnex, protection });
+        assert.deepEqual(await reopened.withConnection(scope, async ({ connection }) => connection), connection);
+        await Promise.all([store, reopened].map((instance) => instance.withConnection(scope, async ({ connection, save }) => {
+          await save({ ...connection, version: connection.version + 1 });
+        })));
+        assert.equal(await reopened.withConnection(scope, async ({ connection }) => connection.version), 2);
+      } finally { await otherKnex.destroy(); }
+    });
+
+    await t.test("rollback preserves the previous record and owners cannot read each other's credentials", async () => {
+      await assert.rejects(store.withConnection(scope, async ({ save }) => {
+        await save({ version: 999 });
+        throw new Error("rollback");
+      }), /rollback/u);
+      assert.equal(await store.withConnection(scope, async ({ connection }) => connection.version), 2);
+      const otherScope = { ...scope, owner: { ...owner, subjectId: "different-user" } };
+      assert.equal(await store.withConnection(otherScope, async ({ connection }) => connection), null);
+      const rows = await knex("connector_connections").select();
+      const saved = rows.find((row) => row.payload);
+      const empty = rows.find((row) => !row.payload);
+      await knex("connector_connections").where({ connection_key: empty.connection_key }).update({ payload: saved.payload });
+      await assert.rejects(store.withConnection(otherScope, async ({ connection }) => connection), { code: "connector_credentials_unavailable" });
+      await knex("connector_connections").where({ connection_key: empty.connection_key }).update({ payload: null });
+    });
+
+    await t.test("consent is encrypted, scoped, consumed once and invalidated by disconnect", async () => {
+      const attempt = { state: "random-authorization-state", codeVerifier: "private-pkce-verifier", owner, integrationId: "calendar", expiresAt: Date.now() + 60_000 };
+      await store.withConnection(scope, async ({ putAttempt }) => putAttempt(attempt));
+      const rows = await knex("connector_authorization_attempts").select();
+      assert.equal(JSON.stringify(rows).includes(attempt.state), false);
+      assert.equal(JSON.stringify(rows).includes(attempt.codeVerifier), false);
+      const otherScope = { ...scope, owner: { ...owner, applicationId: "different-app" } };
+      assert.equal(await store.withConnection(otherScope, async ({ latestAttempt }) => latestAttempt({ after: Date.now() })), null);
+      assert.deepEqual(await store.withConnection(scope, async ({ latestAttempt }) => latestAttempt({ after: Date.now() })), attempt);
+      assert.equal(await store.withConnection(scope, async ({ latestAttempt }) => latestAttempt({ after: attempt.expiresAt })), null);
+      assert.equal(await store.withConnection(otherScope, async ({ consumeAttempt }) => consumeAttempt(attempt.state)), null);
+      assert.deepEqual(await store.withConnection(scope, async ({ consumeAttempt }) => consumeAttempt(attempt.state)), attempt);
+      assert.equal(await store.withConnection(scope, async ({ consumeAttempt }) => consumeAttempt(attempt.state)), null);
+      await store.withConnection(scope, async ({ putAttempt, remove }) => {
+        await putAttempt(attempt);
+        await remove();
+      });
+      assert.equal(await store.withConnection(scope, async ({ consumeAttempt }) => consumeAttempt(attempt.state)), null);
+      assert.equal(await store.withConnection(scope, async ({ connection }) => connection), null);
+    });
+
+    await t.test("expired attempts can be pruned without deleting a live consent attempt", async () => {
+      const before = Date.now();
+      await store.withConnection(scope, async ({ putAttempt }) => {
+        await putAttempt({ state: "expired", expiresAt: before - 1 });
+        await putAttempt({ state: "live", expiresAt: before + 60_000 });
+      });
+      assert.equal(await store.pruneExpiredAttempts({ before }), 1);
+      assert.equal(await store.withConnection(scope, async ({ consumeAttempt }) => consumeAttempt("expired")), null);
+      assert.equal((await store.withConnection(scope, async ({ consumeAttempt }) => consumeAttempt("live"))).state, "live");
+    });
+
+    await t.test("the actual CLI source connects, survives restart, reads data and disconnects", { timeout: 20_000 }, async () => {
+      const example = new URL("../../connector-google-calendar/patterns/calendar-cli/example/", import.meta.url);
+      const directory = await mkdtemp(join(tmpdir(), "connector-cli-"));
+      const listener = createServer();
+      listener.listen(0, "127.0.0.1");
+      await once(listener, "listening");
+      const port = listener.address().port;
+      await new Promise((resolve) => listener.close(resolve));
+      const env = { ...process.env,
+        DATABASE_URL: databaseUrl,
+        GOOGLE_CLIENT_SECRET: "test-only-client-secret",
+        GOOGLE_CALLBACK_URL: `http://127.0.0.1:${port}/connections/google/callback`,
+        CONNECTOR_STORAGE_KEY: randomBytes(32).toString("base64"),
+        CONNECTOR_APPLICATION_ID: "cli-example", CONNECTOR_SUBJECT_ID: "local-operator"
+      };
+      const mock = join(directory, "provider-response.mjs");
+      await writeFile(mock, `globalThis.fetch = async (url) => {
+        if (String(url) === "https://oauth2.googleapis.com/token") return Response.json({ token_type: "Bearer", access_token: "test-access", refresh_token: "test-refresh", expires_in: 3600 });
+        if (new URL(url).origin !== "https://www.googleapis.com") throw new Error("Unexpected test network request");
+        return Response.json({ kind: String(url).includes("/events") ? "calendar#events" : "calendar#calendarList", items: [{ id: "calendar-item" }] });
+      };`, { mode: 0o600 });
+      await writeFile(join(directory, "integrations.json"), await readFile(new URL("integrations.json", example)));
+      const children = [];
+      function start(command) {
+        const child = spawn(process.execPath, ["--import", mock, fileURLToPath(new URL("scripts/calendar.js", example)), command], { cwd: directory, env });
+        children.push(child);
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (data) => { stdout += data; });
+        child.stderr.on("data", (data) => { stderr += data; });
+        const closed = once(child, "close").then(([code]) => {
+          assert.equal(code, 0, stderr);
+          return stdout;
+        });
+        return { child, closed };
+      }
+      try {
+        assert.match(await start("validate").closed, /configuration is valid/u);
+        const connecting = start("connect");
+        const authorization = new Promise((resolve, reject) => {
+          let output = "";
+          connecting.child.stdout.on("data", (data) => {
+            output += data;
+            const match = output.match(/https:\/\/accounts\.google\.com\/[^\s]+/u);
+            if (match) resolve(new URL(match[0]));
+          });
+          connecting.child.once("error", reject);
+          connecting.child.once("close", () => reject(new Error("CLI exited before authorization started.")));
+        });
+        const url = await authorization;
+        const callback = new URL(env.GOOGLE_CALLBACK_URL);
+        callback.searchParams.set("code", "test-code");
+        callback.searchParams.set("state", url.searchParams.get("state"));
+        assert.equal((await fetch(callback)).status, 200);
+        assert.match(await connecting.closed, /"status": "connected"/u);
+        assert.match(await start("status").closed, /"status": "connected"/u);
+        const events = await start("events").closed;
+        assert.match(events, /calendar-item/u);
+        assert.equal(events.includes("test-access"), false);
+        assert.match(await start("disconnect").closed, /"status": "disconnected"/u);
+        assert.match(await start("status").closed, /"status": "disconnected"/u);
+      } finally {
+        for (const child of children) if (child.exitCode === null) child.kill();
+        await rm(directory, { recursive: true, force: true });
+      }
+    });
+  } finally {
+    await migration.down(knex);
+    await knex.destroy();
+  }
+});

package/test/serviceAccount.test.js

@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createSchema } from "json-rest-schema";
+import { createCapabilityRuntime, defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { createActionProvider } from "@jskit-ai/kernel/server/actions";
+import { createConnectionService, createConnectorsFeature } from "../src/server/index.js";
+import { ConnectorError } from "../src/server/errors.js";
+import { createFileConnectionStore, createCredentialProtection } from "../src/server/fileStorage.js";
+import { validateIntegrationConfiguration } from "../src/shared/configuration.js";
+
+const context = { applicationId: "application", subjectId: "team" };
+const input = { context, integrationId: "notifications" };
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "service-account-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const state = { now: 1_800_000_000_000, credential: '{\n "type": "service_account", "private_key": "fixture-key"\n}',
+    grants: [], requests: [], failGrant: false, status: 200, response: { ok: true }, resolutions: 0 };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { notifications: {
+      provider: "service-fixture", accountMode: "shared", scopes: ["send"],
+      authentication: { method: "service-account", secretRef: "env:SERVICE_ACCOUNT" }, settings: { projectId: "project-1" }
+    } } },
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(5) }, activeKeyId: "current" }) }),
+    now: () => state.now, authorize: async (owner) => owner,
+    resolveReference: async () => { state.resolutions++; return state.credential; },
+    fetchImpl: async (url, init) => {
+      init.signal.throwIfAborted();
+      state.requests.push({ url, init });
+      return Response.json(state.response, { status: state.status });
+    },
+    providers: [{ id: "service-fixture", accountModes: ["shared", "assistant"], authenticationMethods: ["service-account"], scopes: [{ value: "send" }, { value: "read" }],
+      settingsSchema: createSchema({ projectId: { type: "string", required: true } }),
+      apiOrigins: ["https://messages.example"], checkOperation: "check", requestTimeoutMs: 50,
+      operations: { check: { scopes: ["send"], request(values, settings) { return { url: `https://messages.example/${settings.projectId}`, method: "POST", body: values }; }, validateResult: (value) => value?.ok === true } },
+      async serviceAccountGrant(request) {
+        state.grants.push(request);
+        if (state.hang) {
+          state.started?.();
+          await new Promise((_, reject) => request.signal.addEventListener("abort", () => reject(request.signal.reason), { once: true }));
+        }
+        if (state.failGrant) throw new ConnectorError("connector_reconnect_required", "Reconnect this account.", { statusCode: 401 });
+        return state.tokenResponse || { access_token: `fixture-token-${state.grants.length}`, token_type: "Bearer", expires_in: 3600 };
+      }
+    }]
+  };
+  return { state, options, directory, service: createConnectionService(options) };
+}
+
+test("service-account configuration requires an indirect credential, declared mode, scopes and shared ownership", async (t) => {
+  const f = await fixture(t);
+  const validate = (config, providers = f.options.providers) => validateIntegrationConfiguration(config, { providers });
+  assert.deepEqual(validate(f.options.configuration), f.options.configuration);
+  for (const change of [
+    { authentication: { method: "service-account" } },
+    { authentication: { method: "service-account", secretRef: f.state.credential } },
+    { authentication: { method: "service-account", secretRef: "env:KEY", registrationRef: "unused" } },
+    { accountMode: "per-user" }, { scopes: [] }, { scopes: ["admin"] }, { scopes: ["send", "send"] }
+  ]) {
+    const config = structuredClone(f.options.configuration); Object.assign(config.integrations.notifications, change);
+    assert.throws(() => validate(config), { code: "integration_configuration_invalid" });
+  }
+  assert.throws(() => validate(f.options.configuration, [{ ...f.options.providers[0], authenticationMethods: ["api-key"] }]), { code: "integration_configuration_invalid" });
+  // Even a mistaken provider declaration cannot turn service credentials into end-user identity.
+  const personal = structuredClone(f.options.configuration); personal.integrations.notifications.accountMode = "per-user";
+  assert.throws(() => validate(personal, [{ ...f.options.providers[0], accountModes: ["per-user"] }]), { code: "integration_configuration_invalid" });
+  assert.equal(f.state.resolutions, 0);
+});
+
+test("service credentials obtain a verified grant once, persist encrypted tokens and reuse them after restart", async (t) => {
+  const f = await fixture(t);
+  await assert.rejects(f.service.invoke({ ...input, operation: "check" }), { code: "connector_reconnect_required" });
+  const connected = await f.service.connectServiceAccount(input);
+  assert.deepEqual(connected, { provider: "service-fixture", integrationId: "notifications", status: "connected", grantedScopes: ["send"], verifiedAt: f.state.now });
+  assert.equal(f.state.grants.length, 1);
+  const grant = f.state.grants[0];
+  assert.equal(grant.credential, f.state.credential); assert.equal(grant.fetchImpl, f.options.fetchImpl);
+  assert.deepEqual(grant.settings, { projectId: "project-1" }); assert.deepEqual(grant.scopes, ["send"]); assert.equal(grant.now, f.state.now);
+  const restarted = createConnectionService(f.options);
+  assert.deepEqual(await restarted.status(input), connected);
+  await restarted.invoke({ ...input, operation: "check", input: { check: "again" } });
+  assert.equal(f.state.grants.length, 1);
+  assert.equal(new Headers(f.state.requests.at(-1).init.headers).get("authorization"), "Bearer fixture-token-1");
+  for (const file of await readdir(f.directory)) {
+    const text = await readFile(path.join(f.directory, file), "utf8");
+    for (const secret of ["fixture-key", "fixture-token-1", "credentialFingerprint"]) assert(!text.includes(secret));
+  }
+  await f.options.store.withConnection({ owner: context, integrationId: input.integrationId }, async ({ connection }) => {
+    assert.equal(connection.tokens.refreshToken, null); assert.match(connection.credentialFingerprint, /^[a-f0-9]{64}$/u);
+    assert(!JSON.stringify(connection).includes("fixture-key"));
+  });
+  await restarted.disconnect(input); assert.equal((await f.service.status(input)).status, "disconnected");
+});
+
+test("expiry renews once under the file lock across independent service instances", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input);
+  f.state.now += 3_571_000;
+  const second = createConnectionService({ ...f.options, store: createFileConnectionStore({ directory: f.directory,
+    protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(5) }, activeKeyId: "current" }) }) });
+  await Promise.all([f.service, second, f.service].map((service) => service.invoke({ ...input, operation: "check" })));
+  assert.equal(f.state.grants.length, 2);
+  for (const request of f.state.requests.slice(1)) assert.equal(new Headers(request.init.headers).get("authorization"), "Bearer fixture-token-2");
+});
+
+test("rotating the bound credential renews before the next API request and never persists the credential", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input);
+  f.state.credential = '{"private_key":"rotated-fixture-key"}';
+  await f.service.invoke({ ...input, operation: "check" });
+  assert.equal(f.state.grants.length, 2); assert.equal(f.state.grants[1].credential, f.state.credential);
+  await f.service.invoke({ ...input, operation: "check" }); assert.equal(f.state.grants.length, 2);
+  await f.options.store.withConnection({ owner: context, integrationId: input.integrationId }, async ({ connection }) => {
+    assert(!JSON.stringify(connection).includes("rotated-fixture-key"));
+  });
+});
+
+test("ownership and changed reference, project or requested scopes cannot reuse another grant", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input);
+  for (const owner of [{ ...context, applicationId: "other" }, { ...context, subjectId: "other" }]) {
+    await assert.rejects(f.service.invoke({ ...input, context: owner, operation: "check" }), { code: "connector_reconnect_required" });
+  }
+  for (const change of [{ settings: { projectId: "project-2" } }, { scopes: ["send", "read"] }, { authentication: { method: "service-account", secretRef: "env:OTHER" } }]) {
+    const configuration = structuredClone(f.options.configuration); Object.assign(configuration.integrations.notifications, change);
+    const changed = createConnectionService({ ...f.options, configuration });
+    assert.equal((await changed.status(input)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...input, operation: "check" }), { code: "connector_reconnect_required" });
+  }
+  assert.equal(f.state.requests.length, 1); assert.equal(f.state.grants.length, 1);
+});
+
+test("failed verification and reduced provider grants never create a connected record", async (t) => {
+  const f = await fixture(t);
+  f.state.response = { ok: false };
+  await assert.rejects(f.service.connectServiceAccount(input), { code: "connector_response_invalid" });
+  assert.equal((await f.service.status(input)).status, "disconnected");
+  f.state.tokenResponse = { access_token: "token", token_type: "Bearer", expires_in: 3600, scope: "read admin" };
+  await assert.rejects(f.service.connectServiceAccount(input), { code: "connector_scope_missing" });
+  assert.equal(f.state.requests.length, 1); assert.equal((await f.service.status(input)).status, "disconnected");
+});
+
+test("renewed tokens survive a subsequent provider failure and authorization failures require reconnect", async (t) => {
+  const f = await fixture(t); await f.service.connectServiceAccount(input); f.state.now += 3_600_000;
+  f.state.status = 429;
+  await assert.rejects(f.service.invoke({ ...input, operation: "check" }), { code: "connector_rate_limited" });
+  f.state.status = 200;
+  await createConnectionService(f.options).invoke({ ...input, operation: "check" }); assert.equal(f.state.grants.length, 2);
+  f.state.credential = "rotated"; f.state.failGrant = true; const before = f.state.requests.length;
+  await assert.rejects(f.service.invoke({ ...input, operation: "check" }), { code: "connector_reconnect_required" });
+  assert.equal(f.state.requests.length, before); assert.equal((await f.service.status(input)).status, "reconnect-required");
+});
+
+test("malformed token responses and missing bindings do not expose provider values or create connections", async (t) => {
+  const f = await fixture(t);
+  for (const credential of [undefined, {}, "", "\0bad", "x".repeat(65_537)]) {
+    f.state.credential = credential;
+    await assert.rejects(f.service.connectServiceAccount(input), { code: "connector_binding_missing" });
+  }
+  assert.equal(f.state.grants.length, 0); f.state.credential = "fixture-key";
+  const valid = { access_token: "private-token", token_type: "Bearer", expires_in: 3600 };
+  for (const change of [{ access_token: "" }, { access_token: "token\nvalue" }, { token_type: "Basic" }, { token_type: null },
+    { expires_in: "3600" }, { expires_in: 0 }, { expires_in: NaN }, { expires_in: 86_401 }, { refresh_token: "private-refresh" }, { scope: [] }]) {
+    f.state.tokenResponse = { ...valid, ...change };
+    await assert.rejects(f.service.connectServiceAccount(input), (error) => error.code === "connector_response_invalid" && !JSON.stringify(error).includes("private-"));
+  }
+  assert.equal(f.state.requests.length, 0); assert.equal((await f.service.status(input)).status, "disconnected");
+});
+
+test("service grants honor cancellation and deadlines without replay or partial connection state", async (t) => {
+  const f = await fixture(t); f.state.hang = true;
+  const cancelled = new AbortController(); cancelled.abort();
+  await assert.rejects(f.service.connectServiceAccount({ ...input, signal: cancelled.signal }), { code: "connector_cancelled" });
+  assert.equal(f.state.grants.length, 0);
+  const active = new AbortController(); const started = new Promise((resolve) => { f.state.started = resolve; });
+  const pending = f.service.connectServiceAccount({ ...input, signal: active.signal }); await started; active.abort();
+  await assert.rejects(pending, { code: "connector_cancelled" });
+  const keepAlive = setTimeout(() => {}, 1000);
+  try { await assert.rejects(f.service.connectServiceAccount(input), { code: "connector_provider_timeout" }); } finally { clearTimeout(keepAlive); }
+  assert.equal(f.state.grants.length, 2); assert.equal(f.state.requests.length, 0);
+  assert.equal((await f.service.status(input)).status, "disconnected");
+});
+
+test("the service-account Feature action uses the same application policy and verified runtime", async (t) => {
+  const f = await fixture(t); let actions;
+  const runtime = createCapabilityRuntime({ providers: [createActionProvider(), createConnectorsFeature(f.options),
+    defineProvider({ id: "test.service-observer", requires: { catalogue: "runtime.actions" }, setup({ catalogue }) { actions = catalogue; } })] });
+  await runtime.start();
+  try {
+    const result = await actions.execute({ actionId: "connectors.verifyServiceAccount", input: { integrationId: input.integrationId }, context: { ...context, channel: "api", surface: "app" } });
+    assert.equal(result.status, "connected"); assert.equal((await f.service.status(input)).status, "connected");
+  } finally { await runtime.shutdown(); }
+});