@knpkv/atlassian-common 1.3.0 → 1.5.0

package/test/OAuthEndpoints.test.ts

@@ -6,6 +6,7 @@ import {
   AUTH_URL,
   buildAuthUrl,
   computeCodeChallenge,
+  CONFLUENCE_FOLDER_SCOPES,
   CONFLUENCE_SCOPES,
   generateCodeVerifier
 } from "../src/auth/OAuthEndpoints.js"
@@ -18,6 +19,28 @@ describe("OAuthEndpoints", () => {
       expect(CONFLUENCE_SCOPES).toContain("read:attachment:confluence")
       expect(CONFLUENCE_SCOPES).toContain("write:attachment:confluence")
     })
+
+    // Control Center feeds this constant straight into its own authorize
+    // request, so folder authority must not leak in here — it would widen every
+    // Control Center sign-in to a scope its documented OAuth app never enables.
+    it("carries no folder or search authority", () => {
+      for (const scope of CONFLUENCE_FOLDER_SCOPES) {
+        expect(CONFLUENCE_SCOPES).not.toContain(scope)
+      }
+    })
+  })
+
+  describe("CONFLUENCE_FOLDER_SCOPES", () => {
+    // Exact strings: Atlassian rejects the whole authorize request for one
+    // unrecognized scope, and a typo surfaces only on a real consent screen.
+    it("names the scopes the folder and CQL-search endpoints require", () => {
+      expect([...CONFLUENCE_FOLDER_SCOPES].sort()).toEqual([
+        "read:content-details:confluence",
+        "read:folder:confluence",
+        "read:hierarchical-content:confluence",
+        "write:folder:confluence"
+      ])
+    })
   })
 
   // ---- PKCE ----

package/test/OAuthOperations.test.ts

@@ -1,9 +1,9 @@
 import { describe, it } from "@effect/vitest"
 import * as Effect from "effect/Effect"
+import type { HttpClientRequest } from "effect/http"
+import { HttpClient, HttpClientResponse } from "effect/http"
 import * as Layer from "effect/Layer"
 import { TestClock } from "effect/testing"
-import type { HttpClientRequest } from "effect/unstable/http"
-import { HttpClient, HttpClientResponse } from "effect/unstable/http"
 import { expect } from "vitest"
 import { OAuthError } from "../src/auth/OAuthErrors.js"
 import {

package/test/ProfileManager.test.ts

@@ -1,6 +1,10 @@
 import { describe, expect, it } from "@effect/vitest"
 import { ConfigProvider, Effect, Layer } from "effect"
+import * as Clock from "effect/Clock"
+import * as Deferred from "effect/Deferred"
+import * as Fiber from "effect/Fiber"
 import * as FileSystem from "effect/FileSystem"
+import { HttpClient, HttpClientResponse } from "effect/http"
 import * as Path from "effect/Path"
 import { SystemError } from "effect/PlatformError"
 import {
@@ -13,6 +17,7 @@ import {
   type OAuthToken,
   ProfileNotFoundError,
   refreshActiveProfiles,
+  saveOAuthConfig,
   saveProfileToken,
   useProfileForAllTools
 } from "../src/config/index.js"
@@ -175,6 +180,62 @@ describe("ProfileManager", () => {
     ).rejects.toBeInstanceOf(ProfileNotFoundError)
   })
 
+  // Atlassian rotates refresh tokens, so the grant consumes the stored one and
+  // the response carries its replacement. If an interrupt can land between the
+  // two, the credential is spent with nothing saved and the profile is silently
+  // logged out — hence the uninterruptible region around grant-and-persist.
+  it("persists the rotated token even when interrupted mid-rotation", async () => {
+    const mock = makeMockFS()
+    const program = Effect.gen(function*() {
+      yield* saveOAuthConfig("tool-a", { clientId: "client-1", clientSecret: "secret-1" })
+      const nowMs = yield* Clock.currentTimeMillis
+      yield* saveProfileToken("tool-a", makeToken(1, "read:me offline_access", nowMs - 1_000))
+
+      const issued = yield* Deferred.make<void>()
+      const release = yield* Deferred.make<void>()
+      const client = Layer.succeed(
+        HttpClient.HttpClient,
+        HttpClient.make((request) =>
+          Effect.gen(function*() {
+            yield* Deferred.succeed(issued, undefined)
+            yield* Deferred.await(release)
+            return HttpClientResponse.fromWeb(
+              request,
+              new Response(
+                JSON.stringify({
+                  access_token: "fresh-access",
+                  refresh_token: "rotated-refresh",
+                  expires_in: 3600,
+                  scope: "read:me offline_access",
+                  token_type: "Bearer"
+                }),
+                { status: 200, headers: { "content-type": "application/json" } }
+              )
+            )
+          })
+        )
+      )
+
+      const fiber = yield* refreshActiveProfiles([tools[0]!]).pipe(
+        Effect.provide(client),
+        Effect.exit,
+        Effect.forkChild({ startImmediately: true })
+      )
+      yield* Deferred.await(issued)
+      const interrupting = yield* Fiber.interrupt(fiber).pipe(Effect.forkChild({ startImmediately: true }))
+      yield* Deferred.succeed(release, undefined)
+      yield* Fiber.join(interrupting)
+    })
+
+    await Effect.runPromise(
+      program.pipe(
+        Effect.provide(Layer.mergeAll(mock.layer, Path.layer, HomeDirectoryLive, ConfigProviderLive))
+      )
+    )
+
+    expect(JSON.stringify(mock.store)).toContain("rotated-refresh")
+  })
+
   it("fails expired-token refresh when OAuth config is missing", async () => {
     await expect(
       run(