@kimchi-dev/kimchictl 0.0.2

package/src/api/workspaces.ts

@@ -0,0 +1,234 @@
+import { checkResponse, fetchWithTimeout, resolveEndpoint } from "./http.js"
+import { verifyApiKey } from "./keys.js"
+import { byteQuantityToBytes, cpuQuantityToMillicores } from "./resources.js"
+import type { ApiOptions } from "./types.js"
+import { RemoteAuthError, RemoteNetworkError } from "./types.js"
+
+/**
+ * Workspace client — mirrors the harness's (kimchi-dev:src/sandbox/cloud)
+ * calls against the same control-plane API, plus kap's server-named create.
+ *
+ * The control plane addresses workspaces by UUID id; users type the alias
+ * (first DNS label of the URI). api/resolver.ts maps between them.
+ */
+
+const HARNESS_CLIENT_TYPE = "harness" // matches kimchi-dev:src/sandbox/constants.ts
+const LIST_WORKSPACES_PAGE_LIMIT = 200
+const LIST_WORKSPACES_PAGE_HARD_CAP = 10
+
+export type WorkspaceStatus = "active" | "initializing" | "suspended" | "deleting" | "idle"
+
+export interface Workspace {
+	/** Server id — also the command-line identifier (`workspace get <id>`, `ssh <id>`). */
+	id: string
+	/** First DNS label of the URI — the user-facing name (NOT the server id). */
+	alias: string
+	description: string
+	status: WorkspaceStatus
+	uri?: string
+	host?: string
+	createdAt: Date
+	cpuMillicores?: number
+	ramBytes?: number
+	pvcSizeBytes?: number
+}
+
+export interface WorkspaceCommandOptions extends ApiOptions {
+	/** Pre-resolved organization id — skips the verifyKey round-trip. */
+	orgId?: string
+}
+
+async function resolveOrgId(apiKey: string, options?: WorkspaceCommandOptions): Promise<string> {
+	return options?.orgId ?? (await verifyApiKey(apiKey, options))
+}
+
+export async function listWorkspaces(apiKey: string, options?: WorkspaceCommandOptions): Promise<Workspace[]> {
+	const fetchImpl = options?.fetch ?? globalThis.fetch
+	const endpoint = resolveEndpoint(options)
+
+	try {
+		const orgId = await resolveOrgId(apiKey, options)
+
+		const results: Workspace[] = []
+		let cursor = ""
+
+		for (let page = 0; page < LIST_WORKSPACES_PAGE_HARD_CAP; page++) {
+			const params = new URLSearchParams()
+			params.set("page.limit", String(LIST_WORKSPACES_PAGE_LIMIT))
+			params.set("clientType", HARNESS_CLIENT_TYPE)
+			if (cursor) params.set("page.cursor", cursor)
+
+			const url = `${endpoint}/ai-optimizer/v1beta/organizations/${encodeURIComponent(orgId)}/workspaces?${params.toString()}`
+			const resp = await fetchWithTimeout(
+				url,
+				{ method: "GET", headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" } },
+				fetchImpl,
+				30_000,
+				options?.signal,
+			)
+
+			await checkResponse(resp, url)
+
+			const data: unknown = await resp.json().catch(() => undefined)
+			if (typeof data !== "object" || data === null) {
+				throw new RemoteNetworkError(`Unexpected response shape from ${endpoint}`)
+			}
+			const items = (data as { items?: unknown }).items
+			if (!Array.isArray(items)) {
+				throw new RemoteNetworkError(`Missing items array in list-workspaces response from ${endpoint}`)
+			}
+
+			for (const item of items) {
+				results.push(mapWorkspace(item, endpoint))
+			}
+
+			const nextCursor = (data as { nextPageCursor?: unknown }).nextPageCursor
+			if (typeof nextCursor !== "string" || nextCursor.length === 0) {
+				return results
+			}
+			cursor = nextCursor
+		}
+
+		return results
+	} catch (err) {
+		if (err instanceof RemoteAuthError || err instanceof RemoteNetworkError) {
+			throw err
+		}
+		throw new RemoteNetworkError(err instanceof Error ? err.message : String(err))
+	}
+}
+
+export async function getWorkspace(apiKey: string, id: string, options?: WorkspaceCommandOptions): Promise<Workspace> {
+	const fetchImpl = options?.fetch ?? globalThis.fetch
+	const endpoint = resolveEndpoint(options)
+	const orgId = await resolveOrgId(apiKey, options)
+
+	const url = `${endpoint}/ai-optimizer/v1beta/organizations/${encodeURIComponent(orgId)}/workspaces/${encodeURIComponent(id)}`
+	const resp = await fetchWithTimeout(
+		url,
+		{ method: "GET", headers: { Authorization: `Bearer ${apiKey}` } },
+		fetchImpl,
+		30_000,
+		options?.signal,
+	)
+	await checkResponse(resp, url)
+
+	const data: unknown = await resp.json().catch(() => undefined)
+	return mapWorkspace(data, endpoint)
+}
+
+/**
+ * Create a workspace. Server generates the alias (like kap) — there is no
+ * client-side name input. Returns the created workspace (status likely
+ * "initializing"; callers may poll getWorkspace until "active").
+ */
+export async function createWorkspace(
+	apiKey: string,
+	options: WorkspaceCommandOptions & { description?: string },
+): Promise<Workspace> {
+	const fetchImpl = options?.fetch ?? globalThis.fetch
+	const endpoint = resolveEndpoint(options)
+	const orgId = await resolveOrgId(apiKey, options)
+
+	const url = `${endpoint}/ai-optimizer/v1beta/organizations/${encodeURIComponent(orgId)}/workspaces`
+	const resp = await fetchWithTimeout(
+		url,
+		{
+			method: "POST",
+			headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+			body: JSON.stringify({
+				...(options.description ? { description: options.description } : {}),
+				clientType: HARNESS_CLIENT_TYPE,
+			}),
+		},
+		fetchImpl,
+		30_000,
+		options?.signal,
+	)
+	await checkResponse(resp, url)
+
+	const data: unknown = await resp.json().catch(() => undefined)
+	return mapWorkspace(data, endpoint)
+}
+
+export async function deleteWorkspace(apiKey: string, id: string, options?: WorkspaceCommandOptions): Promise<void> {
+	const fetchImpl = options?.fetch ?? globalThis.fetch
+	const endpoint = resolveEndpoint(options)
+	const orgId = await resolveOrgId(apiKey, options)
+
+	const url = `${endpoint}/ai-optimizer/v1beta/organizations/${encodeURIComponent(orgId)}/workspaces/${encodeURIComponent(id)}`
+	const resp = await fetchWithTimeout(
+		url,
+		{ method: "DELETE", headers: { Authorization: `Bearer ${apiKey}` } },
+		fetchImpl,
+		30_000,
+		options?.signal,
+	)
+	await checkResponse(resp, url)
+}
+
+export function mapWorkspace(raw: unknown, endpoint: string): Workspace {
+	if (typeof raw !== "object" || raw === null) {
+		throw new RemoteNetworkError(`Invalid workspace entry in response from ${endpoint}`)
+	}
+	const r = raw as Record<string, unknown>
+
+	const id = typeof r.id === "string" && r.id.length > 0 ? r.id : undefined
+	if (!id) {
+		throw new RemoteNetworkError(`Missing workspace id in response from ${endpoint}`)
+	}
+
+	const uri = typeof r.uri === "string" && r.uri.length > 0 ? r.uri : undefined
+	const alias = uri?.split(".")[0] || id
+
+	let createdAt: Date | undefined
+	if (typeof r.createTime === "string") {
+		const parsed = new Date(r.createTime)
+		if (!Number.isNaN(parsed.getTime())) createdAt = parsed
+	}
+
+	let host: string | undefined
+	if (uri) {
+		try {
+			host = new URL(uri.includes("://") ? uri : `wss://${uri}`).hostname
+		} catch {
+			host = undefined // tolerate URIs URL can't parse — host is display-only here
+		}
+	}
+
+	// Provisioned sizes arrive nested under spec.resources as Kubernetes
+	// quantity strings ("200m", "512Mi", "10Gi").
+	const spec = typeof r.spec === "object" && r.spec !== null ? (r.spec as Record<string, unknown>) : undefined
+	const res =
+		spec && typeof spec.resources === "object" && spec.resources !== null
+			? (spec.resources as Record<string, unknown>)
+			: undefined
+
+	return {
+		id,
+		alias,
+		description: typeof r.description === "string" ? r.description : "",
+		status: mapWorkspaceStatus(r.status),
+		uri,
+		host,
+		createdAt: createdAt ?? new Date(0),
+		cpuMillicores: cpuQuantityToMillicores(res?.cpu),
+		ramBytes: byteQuantityToBytes(res?.memory),
+		pvcSizeBytes: byteQuantityToBytes(res?.pvcSize),
+	}
+}
+
+function mapWorkspaceStatus(raw: unknown): WorkspaceStatus {
+	switch (raw) {
+		case "ACTIVE":
+			return "active"
+		case "INITIALIZING":
+			return "initializing"
+		case "SUSPENDED":
+			return "suspended"
+		case "DELETING":
+			return "deleting"
+		default:
+			return "idle"
+	}
+}

package/src/auth/auth-file.test.ts

@@ -0,0 +1,176 @@
+import { readFileSync, statSync, utimesSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import { cleanupTempDirs, makeTempDir } from "../test-support.js"
+import {
+	clearSharedAuth,
+	kimchiProviderIdsFromModelsJson,
+	readAuthJson,
+	readSavedApiKey,
+	syncSharedAuth,
+} from "./auth-file.js"
+
+// These tests mirror the fixtures in kimchi-dev:src/pi-auth.test.ts — the
+// auth.json byte format is a cross-tool contract: the harness must be able to
+// read what kimchictl writes and vice versa.
+
+afterEach(() => {
+	cleanupTempDirs()
+	vi.unstubAllEnvs()
+})
+
+describe("syncSharedAuth", () => {
+	it("creates auth.json on first run with the base provider", async () => {
+		const dir = makeTempDir()
+		const authPath = join(dir, "auth.json")
+
+		await syncSharedAuth(authPath, "kimchi-key", [])
+
+		expect(JSON.parse(readFileSync(authPath, "utf-8"))).toEqual({
+			"kimchi-dev": { type: "api_key", key: "kimchi-key" },
+		})
+	})
+
+	it("stores the key for every supplied Kimchi provider id and preserves other providers", async () => {
+		const dir = makeTempDir()
+		const authPath = join(dir, "auth.json")
+		writeFileSync(
+			authPath,
+			JSON.stringify({
+				anthropic: { type: "api_key", key: "keep-me" },
+				"kimchi-experimental": { type: "api_key", key: "old-kimchi-key" },
+			}),
+		)
+
+		await syncSharedAuth(authPath, "kimchi-key", ["kimchi-dev/openai", "kimchi-experimental"])
+
+		expect(JSON.parse(readFileSync(authPath, "utf-8"))).toEqual({
+			anthropic: { type: "api_key", key: "keep-me" },
+			"kimchi-dev": { type: "api_key", key: "kimchi-key" },
+			"kimchi-dev/openai": { type: "api_key", key: "kimchi-key" },
+			"kimchi-experimental": { type: "api_key", key: "kimchi-key" },
+		})
+		expect(statSync(authPath).mode & 0o777).toBe(0o600)
+	})
+
+	it("ignores non-Kimchi ids in the provider list (defense in depth)", async () => {
+		const dir = makeTempDir()
+		const authPath = join(dir, "auth.json")
+
+		await syncSharedAuth(authPath, "kimchi-key", ["ollama"])
+
+		expect(JSON.parse(readFileSync(authPath, "utf-8"))).toEqual({
+			"kimchi-dev": { type: "api_key", key: "kimchi-key" },
+		})
+	})
+
+	it("removes stale Kimchi credentials when the key is cleared", async () => {
+		const dir = makeTempDir()
+		const authPath = join(dir, "auth.json")
+		writeFileSync(
+			authPath,
+			JSON.stringify({
+				"kimchi-dev": { type: "api_key", key: "old" },
+				"kimchi-experimental": { type: "api_key", key: "old" },
+				ollama: { type: "api_key", key: "keep" },
+			}),
+		)
+
+		await syncSharedAuth(authPath, "", [])
+
+		expect(JSON.parse(readFileSync(authPath, "utf-8"))).toEqual({
+			ollama: { type: "api_key", key: "keep" },
+		})
+	})
+
+	it("does not rewrite unchanged storage (mtime preserved), only re-chmod", async () => {
+		const dir = makeTempDir()
+		const authPath = join(dir, "auth.json")
+		const originalAuth = JSON.stringify({
+			anthropic: { type: "api_key", key: "keep-me" },
+			"kimchi-dev": { type: "api_key", key: "kimchi-key" },
+		})
+		writeFileSync(authPath, originalAuth)
+		const fixedTime = new Date("2000-01-01T00:00:00.000Z")
+		utimesSync(authPath, fixedTime, fixedTime)
+		const originalMtime = statSync(authPath).mtimeMs
+
+		await syncSharedAuth(authPath, "kimchi-key", [])
+
+		expect(readFileSync(authPath, "utf-8")).toBe(originalAuth)
+		expect(statSync(authPath).mtimeMs).toBe(originalMtime)
+		expect(statSync(authPath).mode & 0o777).toBe(0o600)
+	})
+})
+
+describe("clearSharedAuth", () => {
+	it("removes every Kimchi credential, keeps other providers, needs no models.json", async () => {
+		const dir = makeTempDir()
+		const authPath = join(dir, "auth.json")
+		writeFileSync(
+			authPath,
+			JSON.stringify({
+				"kimchi-dev": { type: "api_key", key: "old" },
+				"kimchi-dev/anthropic": { type: "api_key", key: "old" },
+				"kimchi-experimental": { type: "api_key", key: "old" },
+				anthropic: { type: "api_key", key: "keep" },
+			}),
+		)
+
+		await clearSharedAuth(authPath)
+
+		expect(JSON.parse(readFileSync(authPath, "utf-8"))).toEqual({
+			anthropic: { type: "api_key", key: "keep" },
+		})
+	})
+
+	it("is a no-op when auth.json does not exist", async () => {
+		const dir = makeTempDir()
+		await expect(clearSharedAuth(join(dir, "auth.json"))).resolves.toBeUndefined()
+	})
+})
+
+describe("readSavedApiKey / readAuthJson", () => {
+	it("reads the kimchi-dev key", () => {
+		const dir = makeTempDir()
+		const authPath = join(dir, "auth.json")
+		writeFileSync(authPath, JSON.stringify({ "kimchi-dev": { type: "api_key", key: "abc" } }))
+		expect(readSavedApiKey(authPath)).toBe("abc")
+	})
+
+	it("returns undefined for missing file / missing entry / empty key", () => {
+		const dir = makeTempDir()
+		expect(readSavedApiKey(join(dir, "nope.json"))).toBeUndefined()
+		const authPath = join(dir, "auth.json")
+		writeFileSync(authPath, JSON.stringify({ "kimchi-dev": { type: "api_key", key: "" } }))
+		expect(readSavedApiKey(authPath)).toBeUndefined()
+		expect(readAuthJson(join(dir, "nope.json"))).toEqual({})
+	})
+})
+
+describe("kimchiProviderIdsFromModelsJson", () => {
+	it("returns Kimchi provider ids only", () => {
+		const dir = makeTempDir()
+		const modelsPath = join(dir, "models.json")
+		writeFileSync(
+			modelsPath,
+			JSON.stringify({
+				providers: { "kimchi-dev": {}, "kimchi-dev/openai": {}, "kimchi-experimental": {}, ollama: {} },
+			}),
+		)
+		expect(new Set(kimchiProviderIdsFromModelsJson(modelsPath))).toEqual(
+			new Set(["kimchi-dev", "kimchi-dev/openai", "kimchi-experimental"]),
+		)
+	})
+
+	it("tolerates missing/corrupt/unexpected models.json", () => {
+		const dir = makeTempDir()
+		expect(kimchiProviderIdsFromModelsJson(join(dir, "absent.json"))).toEqual([])
+		const corrupt = join(dir, "corrupt.json")
+		writeFileSync(corrupt, "{ not json")
+		expect(kimchiProviderIdsFromModelsJson(corrupt)).toEqual([])
+		const noProviders = join(dir, "empty.json")
+		writeFileSync(noProviders, JSON.stringify({ something: 1 }))
+		expect(kimchiProviderIdsFromModelsJson(noProviders)).toEqual([])
+	})
+})

package/src/auth/auth-file.ts

@@ -0,0 +1,103 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { dirname } from "node:path"
+import { isDeepStrictEqual } from "node:util"
+import { lock } from "proper-lockfile"
+import { isKimchiProvider } from "./provider-ids.js"
+
+/**
+ * Shared auth.json access — a port of the kimchi harness's `syncPiAuth`
+ * (kimchi-dev:src/pi-auth.ts). The file format is the harness's pi auth
+ * storage:
+ *
+ *   { "<providerId>": { "type": "api_key", "key": "…" }, … }
+ *
+ * written pretty-printed (2-space indent, trailing newline), mode 0600, under
+ * a proper-lockfile lock. kimchictl must stay byte-compatible: the harness
+ * reads the entries this writes, and vice versa.
+ *
+ * Difference vs the harness port: the harness derives provider ids from
+ * models.json and throws when it is missing; kimchictl takes the ids as a
+ * parameter (the login command derives them from models.json when present and
+ * from the models metadata API otherwise) so it can run on machines that
+ * have never installed the harness.
+ */
+
+/** Read the raw auth.json map. Returns {} when the file is absent or blank. */
+export function readAuthJson(authPath: string): Record<string, unknown> {
+	if (!existsSync(authPath)) return {}
+	return JSON.parse(readFileSync(authPath, "utf-8") || "{}") as Record<string, unknown>
+}
+
+/** Read the saved Kimchi API key, if the shared auth.json has one. */
+export function readSavedApiKey(authPath: string): string | undefined {
+	const entry = readAuthJson(authPath)["kimchi-dev"]
+	if (entry && typeof entry === "object" && "key" in entry && typeof entry.key === "string" && entry.key.length > 0) {
+		return entry.key
+	}
+	return undefined
+}
+
+/**
+ * Replace all Kimchi-managed entries in auth.json: delete every existing
+ * kimchi provider credential (`kimchi-dev`, `kimchi-dev/*`,
+ * `kimchi-experimental`), then, when apiKey is non-empty, write
+ * `{ type: "api_key", key }` for each id in providerIds (deduped,
+ * "kimchi-dev" always included). Empty apiKey = pure clear.
+ *
+ * Non-Kimchi providers are preserved untouched. Mirrors the harness: no-op
+ * content only re-chmods to 0600 instead of rewriting.
+ */
+export async function syncSharedAuth(authPath: string, apiKey: string, providerIds: readonly string[]): Promise<void> {
+	mkdirSync(dirname(authPath), { recursive: true, mode: 0o700 })
+	const release = await lock(authPath, { realpath: false, retries: 10 })
+	try {
+		const authExists = existsSync(authPath)
+		if (!apiKey && !authExists) return
+
+		const credentials = authExists ? readAuthJson(authPath) : {}
+		const nextCredentials = { ...credentials }
+		for (const providerId of Object.keys(nextCredentials)) {
+			if (isKimchiProvider(providerId)) {
+				delete nextCredentials[providerId]
+			}
+		}
+
+		if (apiKey) {
+			const ids = new Set([...providerIds.filter(isKimchiProvider), "kimchi-dev"])
+			for (const providerId of ids) {
+				nextCredentials[providerId] = { type: "api_key", key: apiKey }
+			}
+		}
+
+		if (authExists && isDeepStrictEqual(credentials, nextCredentials)) {
+			chmodSync(authPath, 0o600)
+			return
+		}
+
+		writeFileSync(authPath, `${JSON.stringify(nextCredentials, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 })
+		chmodSync(authPath, 0o600)
+	} finally {
+		await release()
+	}
+}
+
+/** Remove all Kimchi credentials from auth.json (logout path). No-op when absent. */
+export async function clearSharedAuth(authPath: string): Promise<void> {
+	await syncSharedAuth(authPath, "", [])
+}
+
+/** Kimchi provider ids listed in an existing harness models.json ({} when absent/unreadable). */
+export function kimchiProviderIdsFromModelsJson(modelsPath: string): string[] {
+	let parsed: unknown
+	try {
+		parsed = JSON.parse(readFileSync(modelsPath, "utf-8"))
+	} catch {
+		// models.json is the harness's file; an absent or corrupt one must not
+		// block kimchictl login — the provider-id list falls back to the metadata fetch.
+		return []
+	}
+	if (!parsed || typeof parsed !== "object" || !("providers" in parsed)) return []
+	const providers = (parsed as { providers: unknown }).providers
+	if (!providers || typeof providers !== "object") return []
+	return Object.keys(providers).filter(isKimchiProvider)
+}

package/src/auth/browser-login.test.ts

@@ -0,0 +1,93 @@
+import { afterEach, describe, expect, it, vi } from "vitest"
+import { authenticateViaBrowser, startCallbackServer } from "./browser-login.js"
+
+afterEach(() => {
+	vi.unstubAllEnvs()
+	vi.restoreAllMocks()
+})
+
+describe("startCallbackServer", () => {
+	it("delivers the token on a valid state callback", async () => {
+		const server = await startCallbackServer("state-123")
+		const resp = await fetch(`${server.url}?state=state-123&token=tok-xyz`)
+
+		expect(resp.status).toBe(200)
+		expect(await resp.text()).toContain("Your CLI is now connected")
+		await expect(server.result).resolves.toEqual({ token: "tok-xyz" })
+	})
+
+	it("rejects a wrong state (CSRF) and reports the error", async () => {
+		const server = await startCallbackServer("expected-state")
+		const resp = await fetch(`${server.url}?state=forged&token=abc`)
+
+		expect(resp.status).toBe(400)
+		const result = await server.result
+		expect(result.error).toMatch(/request isn't valid/)
+	})
+
+	it("surfaces the web app's error_description", async () => {
+		const server = await startCallbackServer("s")
+		const resp = await fetch(`${server.url}?state=s&error=access_denied&error_description=User+denied`)
+
+		expect(resp.status).toBe(200)
+		await expect(server.result).resolves.toEqual({ error: "User denied" })
+	})
+
+	it("404s non-callback paths without resolving the result", async () => {
+		const server = await startCallbackServer("s")
+		try {
+			const resp = await fetch(`${server.url.replace("/callback", "/other")}`)
+			expect(resp.status).toBe(404)
+		} finally {
+			server.close()
+		}
+		await expect(server.result).resolves.toEqual({ error: "Login cancelled" })
+	})
+})
+
+describe("authenticateViaBrowser", () => {
+	it("builds the cli-auth URL and completes when the callback delivers a token", async () => {
+		vi.stubEnv("KIMCHI_WEB_APP_URL", "https://app.example.test")
+		const seenUrls: string[] = []
+
+		const authPromise = authenticateViaBrowser({
+			onBrowserUrl: (url) => seenUrls.push(url),
+			open: async (url) => {
+				const parsed = new URL(url)
+				const callback = new URL(decodeURIComponent(parsed.searchParams.get("callback") ?? ""))
+				callback.searchParams.set("state", parsed.searchParams.get("state") ?? "")
+				callback.searchParams.set("token", "browser-token")
+				await fetch(callback)
+			},
+		})
+
+		const { token } = await authPromise
+		expect(token).toBe("browser-token")
+		expect(seenUrls).toHaveLength(1)
+		expect(seenUrls[0]).toMatch(
+			/^https:\/\/app\.example\.test\/cli-auth\?callback=http%3A%2F%2F127\.0\.0\.1%3A\d+%2Fcallback&state=[0-9a-f]{64}$/,
+		)
+	})
+
+	it("rejects when the browser flow errors", async () => {
+		const authPromise = authenticateViaBrowser({
+			open: async (url) => {
+				const parsed = new URL(url)
+				const callback = new URL(decodeURIComponent(parsed.searchParams.get("callback") ?? ""))
+				callback.searchParams.set("state", parsed.searchParams.get("state") ?? "")
+				callback.searchParams.set("error", "access_denied")
+				await fetch(callback)
+			},
+		})
+
+		await expect(authPromise).rejects.toThrow(/access_denied/)
+	})
+
+	it("rejects with 'Login cancelled' when aborted before opening", async () => {
+		const controller = new AbortController()
+		controller.abort()
+		await expect(authenticateViaBrowser({ signal: controller.signal, open: async () => {} })).rejects.toThrow(
+			/Login cancelled/,
+		)
+	})
+})