@shipfox/api-agent-access 20.3.0 → 20.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-agent-access",
   "license": "MIT",
-  "version": "20.3.0",
+  "version": "20.4.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -34,11 +34,11 @@
     "@modelcontextprotocol/sdk": "1.29.0",
     "@shipfox/api-agent-access-dto": "20.3.0",
     "@shipfox/annotations-dto": "20.3.0",
-    "@shipfox/api-auth-context": "20.2.0",
+    "@shipfox/api-auth-context": "20.4.0",
     "@shipfox/api-definitions-dto": "20.3.0",
     "@shipfox/api-projects-dto": "20.0.0",
     "@shipfox/api-triggers-dto": "19.0.0",
-    "@shipfox/api-workflows-dto": "20.3.0",
+    "@shipfox/api-workflows-dto": "20.4.0",
     "@shipfox/inter-module": "0.2.3",
     "@shipfox/node-drizzle": "0.3.5",
     "@shipfox/node-error-monitoring": "0.3.0",

package/src/core/paged-tools.test.ts

@@ -25,7 +25,7 @@ const context: AgentAccessContext = {
   userId: uuid(7),
   workspaceId,
   scopes: ['read'],
-  credential: {kind: 'pat', patId: uuid(8)},
+  credential: {kind: 'oauth_grant', grantId: uuid(8), clientId: 'client-1'},
 };
 
 describe('paged agent-access tools', () => {

package/src/core/rate-limiter.test.ts

@@ -26,14 +26,13 @@ describe('agent-access rate limiter', () => {
     expect(limiter.consume(oauthCredential)).toEqual({allowed: true});
   });
 
-  test('keeps OAuth grants and PATs in separate buckets and prunes expired buckets', () => {
+  test('prunes expired OAuth grant buckets', () => {
     let now = 5_000;
     const limiter = createAgentAccessRateLimiter({now: () => now, limit: 1});
-    const patCredential: AgentAccessCredential = {kind: 'pat', patId: 'pat-1'};
 
     expect(limiter.check(oauthCredential)).toEqual({allowed: true});
     expect(limiter.size()).toBe(0);
-    expect(limiter.consume(patCredential)).toEqual({allowed: true});
+    expect(limiter.consume(oauthCredential)).toEqual({allowed: true});
     expect(limiter.size()).toBe(1);
 
     now += AGENT_ACCESS_TOOL_CALL_WINDOW_MS;

package/src/core/rate-limiter.ts

@@ -89,7 +89,5 @@ export function createAgentAccessRateLimiter(
 }
 
 function credentialKey(credential: AgentAccessCredential): string {
-  return credential.kind === 'oauth_grant'
-    ? `oauth_grant:${credential.grantId}`
-    : `pat:${credential.patId}`;
+  return `oauth_grant:${credential.grantId}`;
 }

package/src/core/tools.test.ts

@@ -6,7 +6,7 @@ const context: AgentAccessContext = {
   userId: 'user-1',
   workspaceId: 'workspace-1',
   scopes: ['read'],
-  credential: {kind: 'pat', patId: 'pat-1'},
+  credential: {kind: 'oauth_grant', grantId: 'grant-1', clientId: 'client-1'},
 };
 
 describe('agent-access fixture tool', () => {

package/src/presentation/audit.test.ts

@@ -5,11 +5,11 @@ const baseContext: AgentAccessContext = {
   userId: 'user-1',
   workspaceId: 'workspace-1',
   scopes: ['read'],
-  credential: {kind: 'pat', patId: 'pat-1'},
+  credential: {kind: 'oauth_grant', grantId: 'grant-1', clientId: 'client-1'},
 };
 
 describe('agent-access tool call audit recorder', () => {
-  test('records bounded identity fields for a PAT without tool arguments', () => {
+  test('records bounded OAuth identity fields without tool arguments', () => {
     const recordMetric = vi.fn();
     const logInfo = vi.fn();
     const recorder = createAgentAccessToolCallRecorder({recordMetric, logInfo});
@@ -32,16 +32,16 @@ describe('agent-access tool call audit recorder', () => {
         errorCode: 'none',
         userId: 'user-1',
         workspaceId: 'workspace-1',
-        credentialKind: 'pat',
-        credentialId: 'pat-1',
-        clientId: null,
+        credentialKind: 'oauth_grant',
+        credentialId: 'grant-1',
+        clientId: 'client-1',
       },
       'agent access tool call audited',
     );
     expect(logInfo.mock.calls[0]?.[0]).not.toHaveProperty('arguments');
   });
 
-  test('includes the OAuth client identifier while keeping the grant identity explicit', () => {
+  test('keeps the OAuth grant identity explicit', () => {
     const logInfo = vi.fn();
     const recorder = createAgentAccessToolCallRecorder({logInfo, recordMetric: vi.fn()});
 
@@ -49,10 +49,7 @@ describe('agent-access tool call audit recorder', () => {
       tool: 'agent_access_fixture',
       outcome: 'tool-error',
       errorCode: 'invalid-request',
-      context: {
-        ...baseContext,
-        credential: {kind: 'oauth_grant', grantId: 'grant-1', clientId: 'client-1'},
-      },
+      context: baseContext,
     });
 
     expect(logInfo).toHaveBeenCalledWith(

package/src/presentation/audit.ts

@@ -39,7 +39,7 @@ function auditLogContext(record: AgentAccessToolCallAuditRecord): Record<string,
     userId: record.context.userId,
     workspaceId: record.context.workspaceId,
     credentialKind: credential.kind,
-    credentialId: credential.kind === 'oauth_grant' ? credential.grantId : credential.patId,
-    clientId: credential.kind === 'oauth_grant' ? credential.clientId : null,
+    credentialId: credential.grantId,
+    clientId: credential.clientId,
   };
 }

package/src/presentation/mcp-server.test.ts

@@ -19,7 +19,7 @@ const context: AgentAccessContext = {
   userId: 'user-1',
   workspaceId: 'workspace-1',
   scopes: ['read'],
-  credential: {kind: 'pat', patId: 'pat-1'},
+  credential: {kind: 'oauth_grant', grantId: 'grant-1', clientId: 'client-1'},
 };
 
 describe('buildAgentAccessMcpServer', () => {