@salesforce/afv-skills 1.59.0 → 1.61.0

package/skills/agentforce-architecture-analyze/scripts/tests/test_resolve_creds.py

@@ -1,16 +1,15 @@
-"""Tests for ``main._resolve_creds`` — the two-path access-token retrieval
-introduced for forcedotcom/cli#3560 (sf CLI v2 redaction, effective
-2026-05-27).
+"""Tests for ``main._resolve_creds`` fail-fast token retrieval
+(forcedotcom/cli#3560).
 
-Path 1 (primary): ``sf org auth show-access-token --json --no-prompt``
-                  via the ``show_access_token`` recipe.
-Path 2 (fallback): ``sf org display`` payload with
-                   ``SF_TEMP_SHOW_SECRETS=true`` env var.
+The access token must come ONLY from
+``sf org auth show-access-token --json --no-prompt`` via the
+``show_access_token`` recipe. ``sf org display`` supplies instanceUrl
+only; any ``accessToken`` it carries is never used.
 
 We mock ``run_sf`` (not subprocess) since these tests target the
 orchestration logic in ``main.py``, not the recipe loader. The recipe
-loader and subprocess env injection have their own coverage in
-``test_sf_cli.py``.
+loader, subprocess env, and capability preflight have their own
+coverage in ``test_sf_cli.py``.
 """
 from __future__ import annotations
 
@@ -39,7 +38,14 @@ def _show_token_payload(*, access_token="TOKEN_FROM_SHOW"):
 
 
 class ResolveCredsTests(unittest.TestCase):
-    """Cover every branch of the two-path retrieval."""
+    """Cover every branch of fail-fast token retrieval."""
+
+    def setUp(self):
+        patcher = mock.patch.object(
+            main, "assert_show_access_token_capability", return_value=None,
+        )
+        patcher.start()
+        self.addCleanup(patcher.stop)
 
     def _route(self, *, primary_payload=None, primary_exc=None,
                display_payload=None):
@@ -65,56 +71,55 @@ class ResolveCredsTests(unittest.TestCase):
         self.assertEqual(url, "https://example.salesforce.com")
         self.assertEqual(token, "TOKEN_FROM_SHOW")
 
-    def test_primary_unknown_falls_back_to_display(self):
-        """Older sf CLI without the dedicated command surfaces SfCliError;
-        we fall back to the display payload's accessToken."""
+    def test_primary_unknown_raises_authrequired(self):
+        """show-access-token failing is terminal — the display payload's
+        accessToken (non-empty here) must NOT be used as a fallback."""
         with mock.patch.object(
             main, "run_sf",
             side_effect=self._route(
                 primary_exc=SfCliError("sf CLI 'show_access_token' failed"),
             ),
         ):
-            url, token = main._resolve_creds("my-org")
-        self.assertEqual(url, "https://example.salesforce.com")
-        self.assertEqual(token, "TOKEN_FROM_DISPLAY")
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+        self.assertIn("show-access-token", str(ctx.exception))
+        self.assertNotIn("TOKEN_FROM_DISPLAY", str(ctx.exception))
 
-    def test_primary_returns_redacted_token_falls_back(self):
-        """Edge case: dedicated command runs cleanly but returns the
-        placeholder string. Treat as failure and use the display fallback."""
+    def test_primary_auth_required_propagates_as_authrequired(self):
         with mock.patch.object(
             main, "run_sf",
             side_effect=self._route(
-                primary_payload=_show_token_payload(access_token=REDACTED_TOKEN),
+                primary_exc=AuthRequired("NoOrgAuthenticationError"),
             ),
         ):
-            _, token = main._resolve_creds("my-org")
-        self.assertEqual(token, "TOKEN_FROM_DISPLAY")
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+        self.assertIn("show-access-token", str(ctx.exception))
 
-    def test_primary_returns_empty_token_falls_back(self):
-        """Empty string from the dedicated command also triggers fallback."""
+    def test_primary_returns_redacted_token_raises(self):
+        """Dedicated command runs cleanly but returns the placeholder
+        string — fail fast rather than handing it to Tooling/REST callers
+        (which would 401 with INVALID_AUTH_HEADER)."""
         with mock.patch.object(
             main, "run_sf",
             side_effect=self._route(
-                primary_payload=_show_token_payload(access_token=""),
+                primary_payload=_show_token_payload(access_token=REDACTED_TOKEN),
             ),
         ):
-            _, token = main._resolve_creds("my-org")
-        self.assertEqual(token, "TOKEN_FROM_DISPLAY")
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+        self.assertIn("usable access token", str(ctx.exception))
 
-    def test_both_paths_redacted_raises_authrequired(self):
-        """If both paths come back redacted/empty, surface AuthRequired
-        rather than handing the placeholder to downstream Tooling/REST
-        callers (which would 401 with INVALID_AUTH_HEADER)."""
+    def test_primary_returns_empty_token_raises(self):
         with mock.patch.object(
             main, "run_sf",
             side_effect=self._route(
-                primary_payload=_show_token_payload(access_token=REDACTED_TOKEN),
-                display_payload=_display_payload(access_token=REDACTED_TOKEN),
+                primary_payload=_show_token_payload(access_token=""),
             ),
         ):
             with self.assertRaises(AuthRequired) as ctx:
                 main._resolve_creds("my-org")
-        self.assertIn("could not retrieve a usable access token", str(ctx.exception))
+        self.assertIn("usable access token", str(ctx.exception))
 
     def test_missing_instance_url_raises_authrequired(self):
         """display returning empty instanceUrl is a hard failure — no
@@ -132,8 +137,7 @@ class ResolveCredsTests(unittest.TestCase):
     def test_primary_path_recipe_name_is_show_access_token(self):
         """Tripwire — the primary call MUST go through the
         ``show_access_token`` recipe. Without it the patch silently
-        regresses to the env-var-only path on sf CLI versions that
-        already shipped the dedicated command."""
+        regresses to reading a (redacted) token from ``sf org display``."""
         recipes_called: list[str] = []
 
         def fake_run_sf(name, **params):
@@ -152,6 +156,150 @@ class ResolveCredsTests(unittest.TestCase):
         # (We don't capture params here, but the recipe loader enforces
         # required_params at run_sf time — see test_sf_cli.py.)
 
+    def test_capability_preflight_failure_raises_authrequired(self):
+        """Missing ``sf org auth show-access-token`` fails fast with the
+        preflight's upgrade message, before any token call is made."""
+        recipes_called: list[str] = []
+
+        def fake_run_sf(name, **params):
+            recipes_called.append(name)
+            return self._route()(name, **params)
+
+        with mock.patch.object(
+            main, "assert_show_access_token_capability",
+            side_effect=SfCliError(
+                "sf CLI is missing required command "
+                "'sf org auth show-access-token'"
+            ),
+        ), mock.patch.object(main, "run_sf", side_effect=fake_run_sf):
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+        self.assertIn("missing required command", str(ctx.exception))
+        # Preflight runs first: neither `sf org display` nor the token
+        # command may be invoked when it fails.
+        self.assertEqual(recipes_called, [])
+
+    def test_preflight_runs_before_org_display(self):
+        calls: list[str] = []
+
+        def fake_run_sf(name, **params):
+            calls.append(name)
+            return self._route()(name, **params)
+
+        with mock.patch.object(
+            main, "assert_show_access_token_capability",
+            side_effect=lambda: calls.append("preflight"),
+        ), mock.patch.object(main, "run_sf", side_effect=fake_run_sf):
+            main._resolve_creds("my-org")
+        self.assertEqual(calls, ["preflight", "org_display", "show_access_token"])
+
+
+class ResolveCredsPreflightCacheTests(unittest.TestCase):
+    """Exercise the REAL preflight (subprocess mocked) through
+    ``_resolve_creds``: argv order, once-per-process success caching, and
+    no caching of failures."""
+
+    PREFLIGHT_ARGV = ["sf", "org", "auth", "show-access-token", "--help"]
+    REAL_HELP = "USAGE\n  $ sf org auth show-access-token -o <value>\n"
+
+    def setUp(self):
+        import sf_cli  # type: ignore
+        self.sf_cli = sf_cli
+        sf_cli._show_access_token_capability_ok = False
+        self.addCleanup(
+            setattr, sf_cli, "_show_access_token_capability_ok", False,
+        )
+
+    def _patches(self, calls, preflight_effects):
+        """Patch subprocess (preflight) + run_sf (recipes) into one ordered
+        ``calls`` log. ``preflight_effects`` is consumed per preflight spawn."""
+        from types import SimpleNamespace
+        effects = list(preflight_effects)
+
+        def fake_subprocess_run(argv, **kwargs):
+            calls.append(list(argv))
+            effect = effects.pop(0)
+            if isinstance(effect, BaseException):
+                raise effect
+            if effect == "no-signature":
+                # Zero exit but not the command's help (unknown command).
+                return SimpleNamespace(
+                    returncode=0, stdout="USAGE\n  $ sf [COMMAND]\n", stderr="",
+                )
+            return SimpleNamespace(
+                returncode=0, stdout=self.REAL_HELP, stderr="",
+            )
+
+        def fake_run_sf(name, **params):
+            calls.append(name)
+            if name == "org_display":
+                return _display_payload()
+            if name == "show_access_token":
+                return _show_token_payload()
+            raise AssertionError(f"unexpected recipe: {name}")
+
+        return (
+            mock.patch.object(
+                self.sf_cli.subprocess, "run", side_effect=fake_subprocess_run,
+            ),
+            mock.patch.object(main, "run_sf", side_effect=fake_run_sf),
+        )
+
+    def test_preflight_argv_is_first_sf_call(self):
+        calls: list = []
+        p1, p2 = self._patches(calls, ["ok"])
+        with p1, p2:
+            main._resolve_creds("my-org")
+        self.assertEqual(calls[0], self.PREFLIGHT_ARGV)
+        self.assertEqual(calls[1:], ["org_display", "show_access_token"])
+
+    def test_preflight_runs_once_across_two_resolves(self):
+        calls: list = []
+        p1, p2 = self._patches(calls, ["ok"])
+        with p1, p2:
+            main._resolve_creds("my-org")
+            main._resolve_creds("my-org")
+        self.assertEqual(calls.count(self.PREFLIGHT_ARGV), 1)
+        self.assertEqual(calls.count("org_display"), 2)
+
+    def test_missing_sf_fails_preflight_and_skips_display(self):
+        calls: list = []
+        p1, p2 = self._patches(calls, [FileNotFoundError("sf")])
+        with p1, p2:
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+        self.assertIn("not found on PATH", str(ctx.exception))
+        self.assertNotIn("org_display", calls)
+
+    def test_failed_preflight_is_retried_on_next_resolve(self):
+        import subprocess as _subprocess
+        err = _subprocess.CalledProcessError(
+            returncode=1, cmd=self.PREFLIGHT_ARGV,
+            stderr="show-access-token is not a sf command",
+        )
+        calls: list = []
+        p1, p2 = self._patches(calls, [err, "ok"])
+        with p1, p2:
+            with self.assertRaises(AuthRequired):
+                main._resolve_creds("my-org")
+            self.assertNotIn("org_display", calls)
+            url, token = main._resolve_creds("my-org")
+        self.assertEqual(token, "TOKEN_FROM_SHOW")
+        self.assertEqual(calls.count(self.PREFLIGHT_ARGV), 2)
+
+    def test_zero_exit_without_help_signature_fails_and_is_retried(self):
+        calls: list = []
+        p1, p2 = self._patches(calls, ["no-signature", "ok"])
+        with p1, p2:
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+            self.assertIn("missing required command", str(ctx.exception))
+            self.assertNotIn("org_display", calls)
+            self.assertFalse(self.sf_cli._show_access_token_capability_ok)
+            url, token = main._resolve_creds("my-org")
+        self.assertEqual(token, "TOKEN_FROM_SHOW")
+        self.assertEqual(calls.count(self.PREFLIGHT_ARGV), 2)
+
 
 if __name__ == "__main__":
     unittest.main()

package/skills/agentforce-architecture-analyze/scripts/tests/test_rest_client.py

@@ -122,6 +122,23 @@ class RedactErrorTests(unittest.TestCase):
         out = rest_client.redact_error(exc)
         self.assertNotIn("TESTONLY_BEARER_VALUE", out)
 
+    def test_bare_bearer_token_redacted(self):
+        # No `Authorization:` prefix — e.g. curl-style traces or CLI stderr.
+        for raw in (
+            "request failed: Bearer TESTONLY_BARE_VALUE",
+            "headers={'auth': 'bearer TESTONLY_DICT_VALUE'}",
+        ):
+            with self.subTest(raw=raw):
+                out = rest_client.redact_text(raw)
+                self.assertIn("<redacted>", out)
+                self.assertNotIn("TESTONLY_BARE_VALUE", out)
+                self.assertNotIn("TESTONLY_DICT_VALUE", out)
+
+    def test_auth_header_not_double_redacted(self):
+        # The auth-header rule runs first; the bare rule must not double-mangle it.
+        out = rest_client.redact_text("Authorization: Bearer TESTONLY_HDR")
+        self.assertEqual(out, "Authorization: Bearer <redacted>")
+
     def test_access_token_querystring_redacted(self):
         exc = RuntimeError("POST /oauth/token accessToken=TESTONLY_TOKEN&foo=1")
         out = rest_client.redact_error(exc)

package/skills/agentforce-architecture-analyze/scripts/tests/test_sf_cli.py

@@ -211,13 +211,11 @@ class RunSfTests(unittest.TestCase):
                 sf_cli.run_sf("org_display", ORG_ALIAS="my-org")
         self.assertIn("invocation failed", str(ctx.exception))
 
-    def test_passes_show_secrets_env_to_subprocess(self):
-        """Tripwire for the W-22582511 sf-CLI-redaction fix.
+    def test_does_not_inject_show_secrets_env(self):
+        """Tripwire: run_sf must not rely on SF_TEMP_SHOW_SECRETS.
 
-        Without ``SF_TEMP_SHOW_SECRETS=true`` in the subprocess env, sf CLI
-        v2 returns the literal string ``"[REDACTED] Use 'sf org auth
-        show-access-token' to view"`` in place of the bearer token, and
-        every downstream Tooling/REST call returns INVALID_AUTH_HEADER 401.
+        sf CLI removes that env var (forcedotcom/cli#3560); tokens come
+        only from ``sf org auth show-access-token``.
         """
         from unittest import mock
         captured = {}
@@ -232,15 +230,14 @@ class RunSfTests(unittest.TestCase):
         with mock.patch.object(sf_cli.subprocess, "run", side_effect=fake_run):
             sf_cli.run_sf("org_display", ORG_ALIAS="my-org")
 
-        self.assertIsNotNone(captured["env"])
-        self.assertEqual(captured["env"].get("SF_TEMP_SHOW_SECRETS"), "true")
+        env = captured["env"] or {}
+        self.assertNotIn("SF_TEMP_SHOW_SECRETS", env)
 
     def test_org_display_recipe_includes_verbose_flag(self):
         """Tripwire for the W-22582511 ``--verbose`` fix.
 
-        Without ``--verbose``, sf CLI v2 omits ``accessToken`` from the
-        ``--json`` output entirely (regardless of SF_TEMP_SHOW_SECRETS),
-        so the redaction-env workaround is necessary but not sufficient.
+        Without ``--verbose``, some sf CLI builds omit fields that callers
+        expect in ``--json`` output.
         """
         from unittest import mock
         captured = {}
@@ -257,5 +254,162 @@ class RunSfTests(unittest.TestCase):
         self.assertIn("--verbose", captured["argv"])
 
 
+class ShowAccessTokenCapabilityTests(unittest.TestCase):
+    """Preflight for the required ``sf org auth show-access-token`` command."""
+
+    # Shape of real ``--help`` output (sf CLI 2.150.6): the command id is
+    # printed in the USAGE line.
+    REAL_HELP = (
+        "Show an access token for an org.\n\nUSAGE\n"
+        "  $ sf org auth show-access-token -o <value> [--json]\n"
+    )
+
+    def setUp(self):
+        # The preflight caches success process-wide; isolate every test.
+        sf_cli._show_access_token_capability_ok = False
+        self.addCleanup(
+            setattr, sf_cli, "_show_access_token_capability_ok", False,
+        )
+
+    def test_capability_check_passes_when_help_available(self):
+        from types import SimpleNamespace
+        from unittest import mock
+
+        cp = SimpleNamespace(returncode=0, stdout=self.REAL_HELP, stderr="")
+        with mock.patch.object(sf_cli.subprocess, "run", return_value=cp) as run:
+            sf_cli.assert_show_access_token_capability()
+        argv = run.call_args.args[0]
+        self.assertEqual(argv, ["sf", "org", "auth", "show-access-token", "--help"])
+
+    def test_capability_check_raises_clear_error_when_missing(self):
+        import subprocess as _subprocess
+        from unittest import mock
+
+        err = _subprocess.CalledProcessError(
+            returncode=1,
+            cmd=["sf", "org", "auth", "show-access-token", "--help"],
+            stderr="show-access-token is not a sf command",
+        )
+        with mock.patch.object(sf_cli.subprocess, "run", side_effect=err):
+            with self.assertRaises(sf_cli.SfCliError) as ctx:
+                sf_cli.assert_show_access_token_capability()
+        self.assertIn("missing required command", str(ctx.exception))
+        self.assertIn("sf org auth show-access-token", str(ctx.exception))
+
+    def test_capability_check_raises_when_sf_not_on_path(self):
+        from unittest import mock
+
+        with mock.patch.object(
+            sf_cli.subprocess, "run", side_effect=FileNotFoundError("sf"),
+        ):
+            with self.assertRaises(sf_cli.SfCliError) as ctx:
+                sf_cli.assert_show_access_token_capability()
+        self.assertIn("not found on PATH", str(ctx.exception))
+
+    def test_successful_preflight_is_cached_for_process(self):
+        from types import SimpleNamespace
+        from unittest import mock
+
+        cp = SimpleNamespace(returncode=0, stdout=self.REAL_HELP, stderr="")
+        with mock.patch.object(sf_cli.subprocess, "run", return_value=cp) as run:
+            sf_cli.assert_show_access_token_capability()
+            sf_cli.assert_show_access_token_capability()
+        self.assertEqual(run.call_count, 1)
+
+    def test_failed_preflight_is_not_cached(self):
+        import subprocess as _subprocess
+        from types import SimpleNamespace
+        from unittest import mock
+
+        err = _subprocess.CalledProcessError(
+            returncode=1,
+            cmd=["sf", "org", "auth", "show-access-token", "--help"],
+            stderr="show-access-token is not a sf command",
+        )
+        ok = SimpleNamespace(returncode=0, stdout=self.REAL_HELP, stderr="")
+        with mock.patch.object(
+            sf_cli.subprocess, "run", side_effect=[err, ok],
+        ) as run:
+            with self.assertRaises(sf_cli.SfCliError):
+                sf_cli.assert_show_access_token_capability()
+            # Retried (not cached) and now succeeds.
+            sf_cli.assert_show_access_token_capability()
+            # Success is cached — no third spawn.
+            sf_cli.assert_show_access_token_capability()
+        self.assertEqual(run.call_count, 2)
+
+    def test_zero_exit_without_help_signature_fails_and_is_not_cached(self):
+        """A CLI that answers an unknown command with exit 0 (e.g. printing
+        top-level help) must NOT be treated as capable."""
+        from types import SimpleNamespace
+        from unittest import mock
+
+        bogus = SimpleNamespace(
+            returncode=0,
+            stdout="\x1b[1mUSAGE\x1b[22m\n  $ sf [COMMAND]\n\nTOPICS\n  org\n",
+            stderr="Authorization: Bearer SECRET_TOKEN_X",
+        )
+        ok = SimpleNamespace(returncode=0, stdout=self.REAL_HELP, stderr="")
+        with mock.patch.object(
+            sf_cli.subprocess, "run", side_effect=[bogus, ok],
+        ) as run:
+            with self.assertRaises(sf_cli.SfCliError) as ctx:
+                sf_cli.assert_show_access_token_capability()
+            msg = str(ctx.exception)
+            self.assertIn("missing required command", msg)
+            self.assertNotIn("SECRET_TOKEN_X", msg)
+            self.assertFalse(sf_cli._show_access_token_capability_ok)
+            # Next call re-probes and now succeeds.
+            sf_cli.assert_show_access_token_capability()
+        self.assertEqual(run.call_count, 2)
+        self.assertTrue(sf_cli._show_access_token_capability_ok)
+
+    def test_zero_exit_with_empty_output_fails(self):
+        from types import SimpleNamespace
+        from unittest import mock
+
+        cp = SimpleNamespace(returncode=0, stdout="", stderr="")
+        with mock.patch.object(sf_cli.subprocess, "run", return_value=cp):
+            with self.assertRaises(sf_cli.SfCliError) as ctx:
+                sf_cli.assert_show_access_token_capability()
+        self.assertIn("lacked the command signature", str(ctx.exception))
+        self.assertFalse(sf_cli._show_access_token_capability_ok)
+
+    def test_zero_exit_unknown_command_notice_echoing_name_fails(self):
+        """Unknown-command notices contain the bare command name; only the
+        USAGE form (`$ sf org auth show-access-token`) may pass."""
+        from types import SimpleNamespace
+        from unittest import mock
+
+        for out in (
+            "Error: Command org:auth:show-access-token not found.",
+            "Warning: show-access-token is not a sf command.",
+            "Did you mean org auth show-access-token? Run sf help for options.",
+        ):
+            with self.subTest(out=out):
+                sf_cli._show_access_token_capability_ok = False
+                cp = SimpleNamespace(returncode=0, stdout="", stderr=out)
+                with mock.patch.object(sf_cli.subprocess, "run", return_value=cp):
+                    with self.assertRaises(sf_cli.SfCliError) as ctx:
+                        sf_cli.assert_show_access_token_capability()
+                self.assertIn("missing required command", str(ctx.exception))
+                self.assertFalse(sf_cli._show_access_token_capability_ok)
+
+    def test_ansi_colored_real_help_passes(self):
+        """Real help with ANSI styling still matches the signature."""
+        from types import SimpleNamespace
+        from unittest import mock
+
+        cp = SimpleNamespace(
+            returncode=0,
+            stdout="\x1b[1mUSAGE\x1b[22m\n  $ sf org auth "
+                   "show-access-token -o <value>\n",
+            stderr="",
+        )
+        with mock.patch.object(sf_cli.subprocess, "run", return_value=cp):
+            sf_cli.assert_show_access_token_capability()
+        self.assertTrue(sf_cli._show_access_token_capability_ok)
+
+
 if __name__ == "__main__":
     unittest.main()