@kya-os/mcp-i-core 1.3.0 → 1.3.1

package/src/__tests__/services/provider-resolver-edge-cases.test.ts

@@ -57,12 +57,14 @@ describe("ProviderResolver - Edge Cases", () => {
     const getProviderNamesMock = vi.fn().mockReturnValue([]);
     const loadFromAgentShieldMock = vi.fn().mockResolvedValue(undefined);
     const hasProviderMock = vi.fn().mockReturnValue(false);
+    const getConfiguredProviderMock = vi.fn().mockReturnValue(null);
 
     mockRegistry = {
       hasProvider: hasProviderMock,
       getAllProviders: vi.fn().mockReturnValue([]),
       getProviderNames: getProviderNamesMock,
       loadFromAgentShield: loadFromAgentShieldMock,
+      getConfiguredProvider: getConfiguredProviderMock,
     } as any;
 
     resolver = new ProviderResolver(mockRegistry, mockConfigService);
@@ -154,19 +156,16 @@ describe("ProviderResolver - Edge Cases", () => {
         requiredScopes: [],
       };
 
-      // Should fall through to Priority 3
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      // Should fall through to Priority 3 (configuredProvider)
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const provider = await resolver.resolveProvider(
         toolProtection,
         "test-project"
       );
 
-      // Should use first configured provider (Priority 3)
+      // Should use configured provider (Priority 3)
       expect(provider).toBe("github");
     });
 
@@ -176,19 +175,16 @@ describe("ProviderResolver - Edge Cases", () => {
         requiredScopes: ["github:repo:read", "google:calendar:read"],
       };
 
-      // Ambiguous scopes should fall through to Priority 3
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      // Ambiguous scopes should fall through to Priority 3 (configuredProvider)
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const provider = await resolver.resolveProvider(
         toolProtection,
         "test-project"
       );
 
-      // Should use first configured provider (Priority 3)
+      // Should use configured provider (Priority 3)
       expect(provider).toBe("github");
     });
 
@@ -198,19 +194,16 @@ describe("ProviderResolver - Edge Cases", () => {
         requiredScopes: ["custom:unknown:scope"],
       };
 
-      // Unknown prefix should fall through to Priority 3
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      // Unknown prefix should fall through to Priority 3 (configuredProvider)
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const provider = await resolver.resolveProvider(
         toolProtection,
         "test-project"
       );
 
-      // Should use first configured provider (Priority 3)
+      // Should use configured provider (Priority 3)
       expect(provider).toBe("github");
     });
 
@@ -277,19 +270,16 @@ describe("ProviderResolver - Edge Cases", () => {
         requiredScopes: ["read", "write"], // No colons
       };
 
-      // Should fall through to Priority 3
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      // Should fall through to Priority 3 (configuredProvider)
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const provider = await resolver.resolveProvider(
         toolProtection,
         "test-project"
       );
 
-      // Should use first configured provider (Priority 3)
+      // Should use configured provider (Priority 3)
       expect(provider).toBe("github");
     });
 
@@ -299,90 +289,102 @@ describe("ProviderResolver - Edge Cases", () => {
         requiredScopes: ["github:repo:read"],
       };
 
-      // Inferred provider exists but not in registry
-      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]); // Only google configured
-      (mockRegistry.hasProvider as any).mockReturnValue(false); // github not in registry
-
-      // Should fall through to Priority 3
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "google_client_id" },
-      ]);
+      // Inferred provider (github) exists but not in registry
+      // configuredProvider is google
       (mockRegistry.getProviderNames as any).mockReturnValue(["google"]);
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "google");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("google");
 
       const provider = await resolver.resolveProvider(
         toolProtection,
         "test-project"
       );
 
-      // Should use first configured provider (Priority 3)
+      // Should use configured provider (Priority 3)
       expect(provider).toBe("google");
     });
   });
 
-  describe("Fallback behavior (Priority 3)", () => {
-    it("should log deprecation warning for Phase 1 fallback", async () => {
+  describe("Fallback behavior (Priority 3 - configuredProvider)", () => {
+    it("should log warning when using configuredProvider fallback", async () => {
       const toolProtection: ToolProtection = {
         requiresDelegation: true,
         requiredScopes: ["custom:scope"],
       };
 
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const consoleSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 
       await resolver.resolveProvider(toolProtection, "test-project");
 
       expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining("deprecated")
+        expect.stringContaining("project-configured provider")
       );
       expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining("first configured provider")
+        expect.stringContaining("github")
       );
 
       consoleSpy.mockRestore();
     });
 
-    it("should use first configured provider when oauthProvider not specified", async () => {
+    it("should use configuredProvider when oauthProvider not specified", async () => {
       const toolProtection: ToolProtection = {
         requiresDelegation: true,
         requiredScopes: ["custom:scope"],
       };
 
+      // Multiple providers available, but configuredProvider is google
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => 
+        name === "github" || name === "google"
+      );
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("google");
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Should use configuredProvider, not first alphabetically
+      expect(provider).toBe("google");
+    });
+
+    it("should NOT fall back to first provider alphabetically", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["custom:scope"],
+      };
+
+      // Multiple providers in registry, but NO configuredProvider
       (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
       (mockRegistry.getAllProviders as any).mockReturnValue([
         { clientId: "github_client_id" },
         { clientId: "google_client_id" },
       ]);
       (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
 
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Should use first provider
-      expect(provider).toBe("github");
+      // Should throw error, NOT pick first provider
+      await expect(
+        resolver.resolveProvider(toolProtection, "test-project")
+      ).rejects.toThrow(/no provider is configured/);
     });
   });
 
   describe("Error scenarios (Priority 4)", () => {
-    it("should throw error if no providers configured", async () => {
+    it("should throw error if no provider is configured", async () => {
       const toolProtection: ToolProtection = {
         requiresDelegation: true,
         requiredScopes: [],
       };
 
       (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([]);
-      (mockRegistry.getProviderNames as any).mockReturnValue([]);
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
 
       await expect(
         resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/no provider could be resolved/);
+      ).rejects.toThrow(/no provider is configured/);
     });
 
     it("should include project ID in error message", async () => {
@@ -392,8 +394,7 @@ describe("ProviderResolver - Edge Cases", () => {
       };
 
       (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([]);
-      (mockRegistry.getProviderNames as any).mockReturnValue([]);
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
 
       try {
         await resolver.resolveProvider(toolProtection, "test-project-123");
@@ -409,15 +410,14 @@ describe("ProviderResolver - Edge Cases", () => {
       };
 
       (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([]);
-      (mockRegistry.getProviderNames as any).mockReturnValue([]);
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
 
       try {
         await resolver.resolveProvider(toolProtection, "test-project");
       } catch (error) {
         const message = (error as Error).message;
-        expect(message).toContain("oauthProvider");
-        expect(message).toContain("configure");
+        expect(message).toContain("AgentShield dashboard");
+        expect(message).toContain("Configure");
       }
     });
   });
@@ -483,5 +483,109 @@ describe("ProviderResolver - Edge Cases", () => {
       expect(provider).toBe("github");
     });
   });
+
+  describe("configuredProvider behavior (Priority 3)", () => {
+    it("should use configuredProvider when tool has no oauthProvider", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["greet:execute"], // No scope inference match
+      };
+
+      // configuredProvider is github
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      expect(provider).toBe("github");
+      expect(mockRegistry.getConfiguredProvider).toHaveBeenCalled();
+    });
+
+    it("should throw when configuredProvider is null and tool needs OAuth", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["greet:execute"],
+      };
+
+      // No configuredProvider set
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
+
+      await expect(
+        resolver.resolveProvider(toolProtection, "test-project")
+      ).rejects.toThrow(/no provider is configured/);
+    });
+
+    it("should NOT use unconfigured providers as fallback", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["greet:execute"],
+      };
+
+      // Registry has providers but configuredProvider is null
+      // This simulates AgentShield returning all providers but none configured
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "github_client_id" },
+        { clientId: "google_client_id" },
+        { clientId: "microsoft_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google", "microsoft"]);
+
+      // Should NOT pick "github" alphabetically - should throw
+      await expect(
+        resolver.resolveProvider(toolProtection, "test-project")
+      ).rejects.toThrow(/no provider is configured/);
+    });
+
+    it("should prefer tool-specific oauthProvider over configuredProvider", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: [],
+        oauthProvider: "google", // Tool specifies google
+      };
+
+      // configuredProvider is github, but tool wants google
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => 
+        name === "github" || name === "google"
+      );
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Priority 1 (tool-specific) should win over Priority 3 (configuredProvider)
+      expect(provider).toBe("google");
+    });
+
+    it("should prefer scope-inferred provider over configuredProvider", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["google:calendar:read"], // Infers google
+      };
+
+      // configuredProvider is github, but scopes infer google
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => 
+        name === "github" || name === "google"
+      );
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Priority 2 (scope inference) should win over Priority 3 (configuredProvider)
+      expect(provider).toBe("google");
+    });
+  });
 });
 

package/src/services/__tests__/provider-resolution.integration.test.ts

@@ -37,6 +37,8 @@ describe("Provider Resolution Integration", () => {
         requiresClientSecret: false,
       },
     },
+    // Explicitly configured provider (Priority 3 fallback)
+    configuredProvider: "github",
   };
 
   beforeEach(() => {
@@ -95,7 +97,7 @@ describe("Provider Resolution Integration", () => {
       consoleSpy.mockRestore();
     });
 
-    it("should fall back to first configured provider for Phase 1 compatibility", async () => {
+    it("should fall back to configuredProvider for Phase 1 compatibility", async () => {
       await providerRegistry.loadFromAgentShield("test-project");
 
       const toolProtection: ToolProtection = {
@@ -111,10 +113,10 @@ describe("Provider Resolution Integration", () => {
         "test-project"
       );
 
-      // Should use first configured provider (github)
+      // Should use configuredProvider (github)
       expect(provider).toBe("github");
       expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining("deprecated")
+        expect.stringContaining("project-configured provider")
       );
 
       consoleSpy.mockRestore();
@@ -157,9 +159,11 @@ describe("Provider Resolution Integration", () => {
         "test-project"
       );
 
-      // Should fall back to first provider
+      // Should fall back to configuredProvider
       expect(provider).toBe("github");
-      expect(consoleSpy).toHaveBeenCalled();
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining("project-configured provider")
+      );
 
       consoleSpy.mockRestore();
     });

package/src/services/__tests__/provider-resolver.test.ts

@@ -45,6 +45,7 @@ describe("ProviderResolver", () => {
       getAllProviders: vi.fn().mockReturnValue([]),
       getProviderNames: vi.fn().mockReturnValue([]),
       loadFromAgentShield: vi.fn().mockResolvedValue(undefined),
+      getConfiguredProvider: vi.fn().mockReturnValue(null), // New method for configuredProvider
     } as any;
 
     resolver = new ProviderResolver(mockRegistry, mockConfigService);
@@ -121,42 +122,37 @@ describe("ProviderResolver", () => {
       expect(provider).toBe("google");
     });
 
-    it("should return null for ambiguous scopes", async () => {
+    it("should fall back to configuredProvider for ambiguous scopes", async () => {
       const toolProtection: ToolProtection = {
         requiresDelegation: true,
         requiredScopes: ["github:read", "google:read"],
       };
 
-      (mockRegistry.hasProvider as any).mockReturnValue(true);
-
-      // Should fall through to Priority 3
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      // Ambiguous scopes - both infer different providers
+      // Should fall through to Priority 3 (configuredProvider)
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const provider = await resolver.resolveProvider(
         toolProtection,
         "test-project"
       );
 
-      // Falls back to first configured provider
+      // Falls back to configuredProvider
       expect(provider).toBe("github");
     });
   });
 
-  describe("resolveProvider - Priority 3: First configured provider", () => {
-    it("should use first configured provider as fallback", async () => {
+  describe("resolveProvider - Priority 3: Project-configured provider", () => {
+    it("should use configuredProvider as fallback", async () => {
       const toolProtection: ToolProtection = {
         requiresDelegation: true,
         requiredScopes: ["custom:scope"],
       };
 
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      // configuredProvider is github
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const consoleSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 
@@ -167,30 +163,28 @@ describe("ProviderResolver", () => {
 
       expect(provider).toBe("github");
       expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining("deprecated")
+        expect.stringContaining("project-configured provider")
       );
 
       consoleSpy.mockRestore();
     });
 
-    it("should log deprecation warning when using fallback", async () => {
+    it("should log warning when using configuredProvider fallback", async () => {
       const toolProtection: ToolProtection = {
         requiresDelegation: true,
         requiredScopes: [],
       };
 
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      // configuredProvider is github
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
 
       const consoleSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 
       await resolver.resolveProvider(toolProtection, "test-project");
 
       expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining("deprecated")
+        expect.stringContaining("Consider explicitly setting oauthProvider")
       );
 
       consoleSpy.mockRestore();
@@ -198,19 +192,21 @@ describe("ProviderResolver", () => {
   });
 
   describe("resolveProvider - Priority 4: Error if no provider", () => {
-    it("should throw error if no provider can be resolved", async () => {
+    it("should throw error if no provider is configured", async () => {
       const toolProtection: ToolProtection = {
         requiresDelegation: true,
         requiredScopes: [],
       };
 
+      // No configuredProvider set
       (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
       (mockRegistry.getAllProviders as any).mockReturnValue([]);
       (mockRegistry.getProviderNames as any).mockReturnValue([]);
 
       await expect(
         resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/no provider could be resolved/);
+      ).rejects.toThrow(/no provider is configured/);
     });
   });
 });

package/src/services/oauth-config.service.ts

@@ -99,6 +99,7 @@ export class OAuthConfigService {
         success: boolean;
         data?: {
           providers?: Record<string, unknown>;
+          configuredProvider?: string | null;
         };
       };
 
@@ -116,11 +117,12 @@ export class OAuthConfigService {
       }
 
       // Build OAuthConfig object
-      // Note: API does NOT return defaultProvider field (Phase 1 architecture)
-      // Phase 1 uses configured provider as temporary fallback
-      // Phase 2+ requires tools to explicitly specify oauthProvider
+      // Extract configuredProvider from API response - this indicates which provider
+      // the user has actually configured in AgentShield dashboard
+      const configuredProvider = result.data.configuredProvider || null;
       const config: OAuthConfig = {
         providers: providers as Record<string, OAuthProvider>,
+        configuredProvider,
       };
 
       // Cache config
@@ -130,6 +132,7 @@ export class OAuthConfigService {
         projectId,
         providerCount: Object.keys(providers).length,
         providers: Object.keys(providers),
+        configuredProvider,
         expiresAt: new Date(
           Date.now() + this.config.cacheTtl
         ).toISOString(),

package/src/services/oauth-provider-registry.ts

@@ -19,6 +19,7 @@ import type { ProviderValidator } from "./provider-validator.js";
  */
 export class OAuthProviderRegistry {
   private providers: Map<string, OAuthProvider> = new Map();
+  private _configuredProvider: string | null = null;
 
   constructor(
     private configService: OAuthConfigService,
@@ -30,6 +31,7 @@ export class OAuthProviderRegistry {
    *
    * Fetches OAuth configuration and caches providers in memory.
    * Clears existing providers before loading new ones.
+   * Also stores the configured provider from the API response.
    *
    * @param projectId - Project ID to load providers for
    */
@@ -39,12 +41,28 @@ export class OAuthProviderRegistry {
     // Clear existing providers
     this.providers.clear();
 
+    // Store the configured provider from API response
+    // This is the provider the user has explicitly configured in AgentShield dashboard
+    this._configuredProvider = config.configuredProvider || null;
+
     // Register all providers from config
     for (const [name, providerConfig] of Object.entries(config.providers)) {
       this.providers.set(name, providerConfig);
     }
   }
 
+  /**
+   * Get the explicitly configured provider for this project
+   *
+   * Returns the provider that the user has configured in AgentShield dashboard.
+   * Used by ProviderResolver as fallback when tool doesn't specify oauthProvider.
+   *
+   * @returns Configured provider name, or null if no provider is configured
+   */
+  getConfiguredProvider(): string | null {
+    return this._configuredProvider;
+  }
+
   /**
    * Get provider by name
    *