@theia/ai-copilot 1.76.0-next.4 → 1.76.0-next.42

package/lib/node/copilot-auth-service-impl.js

@@ -19,223 +19,107 @@ exports.CopilotAuthServiceImpl = void 0;
 const tslib_1 = require("tslib");
 const inversify_1 = require("@theia/core/shared/inversify");
 const core_1 = require("@theia/core");
-const key_store_1 = require("@theia/core/lib/common/key-store");
-const copilot_oauth_config_1 = require("../common/copilot-oauth-config");
-const COPILOT_SCOPE = 'read:user';
-const COPILOT_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const copilot_cli_auth_provider_1 = require("./copilot-cli-auth-provider");
+const copilot_cli_locator_1 = require("./copilot-cli-locator");
+const copilot_credential_store_1 = require("./copilot-credential-store");
 /**
- * Maximum number of polling attempts for token retrieval.
- * With a default 5-second interval, this allows approximately 5 minutes of polling.
- */
-const MAX_POLLING_ATTEMPTS = 60;
-/**
- * Backend implementation of the GitHub Copilot OAuth Device Flow authentication service.
- * Handles device code generation, token polling, and credential storage.
+ * Backend implementation of the GitHub Copilot authentication service.
+ *
+ * All Copilot requests are served by the official Copilot CLI, which owns its credentials, so this
+ * service only drives the sign-in of the CLI and reports its state, see {@link CopilotCliAuthProvider}.
  */
 let CopilotAuthServiceImpl = class CopilotAuthServiceImpl {
     constructor() {
+        this.migrationRequired = false;
         this.onAuthStateChangedEmitter = new core_1.Emitter();
         this.onAuthStateChanged = this.onAuthStateChangedEmitter.event;
     }
+    init() {
+        // The previous integration signed in with an OAuth application of its own and stored a token
+        // that is of no use here. Remove it instead of leaving it on the machine of the user.
+        this.legacyCleanup = this.credentialStore.deleteLegacy().then(async (removed) => {
+            this.migrationRequired = removed;
+            if (removed) {
+                this.logger.info('Copilot: discarded the sign-in of the previous integration, a new sign-in is required.');
+                this.updateAuthState(await this.computeAuthState());
+            }
+        }, error => this.logger.warn('Copilot: failed to clean up the previous sign-in:', error));
+    }
     setClient(client) {
         this.client = client;
     }
-    getOAuthEndpoints(enterpriseUrl) {
-        if (enterpriseUrl) {
-            const domain = enterpriseUrl
-                .replace(/^https?:\/\//, '')
-                .replace(/\/$/, '');
-            return {
-                deviceCodeUrl: `https://${domain}/login/device/code`,
-                accessTokenUrl: `https://${domain}/login/oauth/access_token`
-            };
-        }
-        return {
-            deviceCodeUrl: 'https://github.com/login/device/code',
-            accessTokenUrl: 'https://github.com/login/oauth/access_token'
-        };
+    async setExecutablePath(path) {
+        this.cliLocator.setConfiguredPath(path);
     }
-    async initiateDeviceFlow(enterpriseUrl) {
-        const endpoints = this.getOAuthEndpoints(enterpriseUrl);
-        const response = await fetch(endpoints.deviceCodeUrl, {
-            method: 'POST',
-            headers: {
-                'Accept': 'application/json',
-                'Content-Type': 'application/json',
-                'User-Agent': this.oauthConfig.userAgent
-            },
-            body: JSON.stringify({
-                client_id: this.oauthConfig.clientId,
-                scope: COPILOT_SCOPE
-            })
-        });
-        if (!response.ok) {
-            const errorText = await response.text();
-            throw new Error(`Failed to initiate device authorization: ${response.status} - ${errorText}`);
-        }
-        const data = await response.json();
-        return data;
+    async startSignIn(enterpriseUrl) {
+        return this.cliAuthProvider.startLogin(enterpriseUrl);
     }
-    async pollForToken(deviceCode, interval, enterpriseUrl) {
-        const endpoints = this.getOAuthEndpoints(enterpriseUrl);
-        let attempts = 0;
-        while (attempts < MAX_POLLING_ATTEMPTS) {
-            await this.delay(interval * 1000);
-            attempts++;
-            const response = await fetch(endpoints.accessTokenUrl, {
-                method: 'POST',
-                headers: {
-                    'Accept': 'application/json',
-                    'Content-Type': 'application/json',
-                    'User-Agent': this.oauthConfig.userAgent
-                },
-                body: JSON.stringify({
-                    client_id: this.oauthConfig.clientId,
-                    device_code: deviceCode,
-                    grant_type: COPILOT_GRANT_TYPE
-                })
-            });
-            if (!response.ok) {
-                this.logger.error(`Token request failed: ${response.status}`);
-                continue;
-            }
-            const data = await response.json();
-            if (data.access_token) {
-                // Get user info for account label
-                const accountLabel = await this.fetchAccountLabel(data.access_token, enterpriseUrl);
-                // Store credentials
-                const credentials = {
-                    accessToken: data.access_token,
-                    accountLabel,
-                    enterpriseUrl
-                };
-                await this.keyStoreService.setPassword(this.oauthConfig.keystoreService, this.oauthConfig.keystoreAccount, JSON.stringify(credentials));
-                // Update cached state and notify
-                const newState = {
-                    isAuthenticated: true,
-                    accountLabel,
-                    enterpriseUrl
-                };
-                this.updateAuthState(newState);
-                return true;
-            }
-            if (data.error === 'authorization_pending') {
-                // User hasn't authorized yet, continue polling
-                continue;
-            }
-            if (data.error === 'slow_down') {
-                // Increase polling interval
-                interval += 5;
-                continue;
-            }
-            if (data.error === 'expired_token' || data.error === 'access_denied') {
-                this.logger.error(`Authorization failed: ${data.error} - ${data.error_description}`);
-                return false;
-            }
-            if (data.error) {
-                this.logger.error(`Unexpected error: ${data.error} - ${data.error_description}`);
-                return false;
-            }
+    async waitForSignIn() {
+        const success = await this.cliAuthProvider.waitForLogin();
+        if (success) {
+            this.cachedState = undefined;
+            this.updateAuthState(await this.cliAuthProvider.getAuthState());
         }
-        return false;
+        return success;
     }
-    async fetchAccountLabel(accessToken, enterpriseUrl) {
-        try {
-            const apiBaseUrl = enterpriseUrl
-                ? `https://${enterpriseUrl.replace(/^https?:\/\//, '').replace(/\/$/, '')}/api/v3`
-                : 'https://api.github.com';
-            const response = await fetch(`${apiBaseUrl}/user`, {
-                headers: {
-                    'Authorization': `Bearer ${accessToken}`,
-                    'User-Agent': this.oauthConfig.userAgent,
-                    'Accept': 'application/vnd.github.v3+json'
-                }
-            });
-            if (response.ok) {
-                const userData = await response.json();
-                return userData.login;
-            }
-        }
-        catch (error) {
-            this.logger.warn('Failed to fetch GitHub user info:', error);
-        }
-        return undefined;
+    async cancelSignIn() {
+        await this.cliAuthProvider.cancelLogin();
+    }
+    async signOut() {
+        await this.cliAuthProvider.signOut();
+        this.cachedState = undefined;
+        this.updateAuthState(await this.getAuthState());
     }
     async getAuthState() {
-        if (this.cachedState) {
-            return this.cachedState;
-        }
-        try {
-            const stored = await this.keyStoreService.getPassword(this.oauthConfig.keystoreService, this.oauthConfig.keystoreAccount);
-            if (stored) {
-                const credentials = JSON.parse(stored);
-                // Tokens from the current OAuth App start with 'gho_'; other prefixes (e.g. 'ghu_') indicate a token from the previous GitHub App (Iv-prefixed client ID).
-                if (!credentials.accessToken.startsWith('gho_')) {
-                    this.logger.info('Copilot: clearing outdated GitHub App token. Please sign in again.');
-                    await this.keyStoreService.deletePassword(this.oauthConfig.keystoreService, this.oauthConfig.keystoreAccount);
-                    this.cachedState = { isAuthenticated: false, migrationRequired: true };
-                    return this.cachedState;
-                }
-                this.cachedState = {
-                    isAuthenticated: true,
-                    accountLabel: credentials.accountLabel,
-                    enterpriseUrl: credentials.enterpriseUrl
-                };
-                return this.cachedState;
-            }
-        }
-        catch (error) {
-            this.logger.warn('Failed to retrieve Copilot credentials:', error);
+        // Awaited so that a state requested early cannot be cached without the migration flag, which
+        // is the only thing that tells the user why they were signed out. The frontend evaluates it
+        // once at startup, so losing it there means losing it altogether.
+        await this.legacyCleanup;
+        if (!this.cachedState) {
+            this.cachedState = await this.computeAuthState();
         }
-        this.cachedState = { isAuthenticated: false };
         return this.cachedState;
     }
-    async getAccessToken() {
-        try {
-            const stored = await this.keyStoreService.getPassword(this.oauthConfig.keystoreService, this.oauthConfig.keystoreAccount);
-            if (stored) {
-                const credentials = JSON.parse(stored);
-                return credentials.accessToken;
-            }
-        }
-        catch (error) {
-            this.logger.warn('Failed to retrieve Copilot access token:', error);
-        }
-        return undefined;
-    }
-    async signOut() {
-        try {
-            await this.keyStoreService.deletePassword(this.oauthConfig.keystoreService, this.oauthConfig.keystoreAccount);
-        }
-        catch (error) {
-            this.logger.warn('Failed to delete Copilot credentials:', error);
-        }
-        const newState = { isAuthenticated: false };
-        this.updateAuthState(newState);
+    /**
+     * The state as it currently is, with the request for a new sign-in attached when the credentials
+     * of the previous integration had to be discarded and none have been established since.
+     *
+     * Does not await the cleanup, so that it can be used from it.
+     */
+    async computeAuthState() {
+        const state = await this.cliAuthProvider.getAuthState();
+        return state.isAuthenticated || !this.migrationRequired ? state : { ...state, migrationRequired: true };
     }
     updateAuthState(state) {
         this.cachedState = state;
         this.onAuthStateChangedEmitter.fire(state);
         this.client?.onAuthStateChanged(state);
     }
-    delay(ms) {
-        return new Promise(resolve => setTimeout(resolve, ms));
-    }
 };
 exports.CopilotAuthServiceImpl = CopilotAuthServiceImpl;
 tslib_1.__decorate([
-    (0, inversify_1.inject)(key_store_1.KeyStoreService),
-    tslib_1.__metadata("design:type", Object)
-], CopilotAuthServiceImpl.prototype, "keyStoreService", void 0);
+    (0, inversify_1.inject)(copilot_cli_auth_provider_1.CopilotCliAuthProvider),
+    tslib_1.__metadata("design:type", copilot_cli_auth_provider_1.CopilotCliAuthProvider)
+], CopilotAuthServiceImpl.prototype, "cliAuthProvider", void 0);
+tslib_1.__decorate([
+    (0, inversify_1.inject)(copilot_credential_store_1.CopilotCredentialStore),
+    tslib_1.__metadata("design:type", copilot_credential_store_1.CopilotCredentialStore)
+], CopilotAuthServiceImpl.prototype, "credentialStore", void 0);
+tslib_1.__decorate([
+    (0, inversify_1.inject)(copilot_cli_locator_1.CopilotCliLocator),
+    tslib_1.__metadata("design:type", copilot_cli_locator_1.CopilotCliLocator)
+], CopilotAuthServiceImpl.prototype, "cliLocator", void 0);
 tslib_1.__decorate([
     (0, inversify_1.inject)(core_1.ILogger),
     (0, inversify_1.named)('ai-copilot:CopilotAuthServiceImpl'),
     tslib_1.__metadata("design:type", Object)
 ], CopilotAuthServiceImpl.prototype, "logger", void 0);
 tslib_1.__decorate([
-    (0, inversify_1.inject)(copilot_oauth_config_1.CopilotOAuthConfig),
-    tslib_1.__metadata("design:type", Object)
-], CopilotAuthServiceImpl.prototype, "oauthConfig", void 0);
+    (0, inversify_1.postConstruct)(),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", void 0)
+], CopilotAuthServiceImpl.prototype, "init", null);
 exports.CopilotAuthServiceImpl = CopilotAuthServiceImpl = tslib_1.__decorate([
     (0, inversify_1.injectable)()
 ], CopilotAuthServiceImpl);

package/lib/node/copilot-auth-service-impl.js.map

@@ -1 +1 @@
-{"version":3,"file":"copilot-auth-service-impl.js","sourceRoot":"","sources":["../../src/node/copilot-auth-service-impl.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,4DAAyE;AACzE,sCAAsD;AACtD,gEAAmE;AAOnE,yEAAoE;AAEpE,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAE1E;;;GAGG;AACH,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAQhC;;;GAGG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAA5B;QAcgB,8BAAyB,GAAG,IAAI,cAAO,EAAoB,CAAC;QACtE,uBAAkB,GAA4B,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;IA6NhG,CAAC;IA3NG,SAAS,CAAC,MAA4C;QAClD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAES,iBAAiB,CAAC,aAAsB;QAC9C,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,aAAa;iBACvB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;iBAC3B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxB,OAAO;gBACH,aAAa,EAAE,WAAW,MAAM,oBAAoB;gBACpD,cAAc,EAAE,WAAW,MAAM,2BAA2B;aAC/D,CAAC;QACN,CAAC;QACD,OAAO;YACH,aAAa,EAAE,sCAAsC;YACrD,cAAc,EAAE,6CAA6C;SAChE,CAAC;IACN,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,aAAsB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;gBACpC,KAAK,EAAE,aAAa;aACvB,CAAC;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;QACzD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,QAAgB,EAAE,aAAsB;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,OAAO,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;YAClC,QAAQ,EAAE,CAAC;YAEX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;iBAC3C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACjB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;oBACpC,WAAW,EAAE,UAAU;oBACvB,UAAU,EAAE,kBAAkB;iBACjC,CAAC;aACL,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9D,SAAS;YACb,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAI/B,CAAC;YAEF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,kCAAkC;gBAClC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;gBAEpF,oBAAoB;gBACpB,MAAM,WAAW,GAAsB;oBACnC,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,YAAY;oBACZ,aAAa;iBAChB,CAAC;gBAEF,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAClC,IAAI,CAAC,WAAW,CAAC,eAAe,EAChC,IAAI,CAAC,WAAW,CAAC,eAAe,EAChC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAC9B,CAAC;gBAEF,iCAAiC;gBACjC,MAAM,QAAQ,GAAqB;oBAC/B,eAAe,EAAE,IAAI;oBACrB,YAAY;oBACZ,aAAa;iBAChB,CAAC;gBACF,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAE/B,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACzC,+CAA+C;gBAC/C,SAAS;YACb,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC7B,4BAA4B;gBAC5B,QAAQ,IAAI,CAAC,CAAC;gBACd,SAAS;YACb,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;gBACrF,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;gBACjF,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,aAAsB;QACzE,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,aAAa;gBAC5B,CAAC,CAAC,WAAW,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS;gBAClF,CAAC,CAAC,wBAAwB,CAAC;YAE/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,OAAO,EAAE;gBAC/C,OAAO,EAAE;oBACL,eAAe,EAAE,UAAU,WAAW,EAAE;oBACxC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;oBACxC,QAAQ,EAAE,gCAAgC;iBAC7C;aACJ,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;gBAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;YAC1B,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,YAAY;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC1H,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,WAAW,GAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1D,2JAA2J;gBAC3J,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;oBACvF,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;oBAC9G,IAAI,CAAC,WAAW,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;oBACvE,OAAO,IAAI,CAAC,WAAW,CAAC;gBAC5B,CAAC;gBACD,IAAI,CAAC,WAAW,GAAG;oBACf,eAAe,EAAE,IAAI;oBACrB,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,aAAa,EAAE,WAAW,CAAC,aAAa;iBAC3C,CAAC;gBACF,OAAO,IAAI,CAAC,WAAW,CAAC;YAC5B,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,cAAc;QAChB,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC1H,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,WAAW,GAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1D,OAAO,WAAW,CAAC,WAAW,CAAC;YACnC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,OAAO;QACT,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAClH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,QAAQ,GAAqB,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9D,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAES,eAAe,CAAC,KAAuB;QAC7C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAES,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CACJ,CAAA;AA5OY,wDAAsB;AAGZ;IADlB,IAAA,kBAAM,EAAC,2BAAe,CAAC;;+DAC4B;AAGjC;IADlB,IAAA,kBAAM,EAAC,cAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,mCAAmC,CAAC;;sDACzB;AAGhB;IADlB,IAAA,kBAAM,EAAC,yCAAkB,CAAC;;2DACwB;iCAT1C,sBAAsB;IADlC,IAAA,sBAAU,GAAE;GACA,sBAAsB,CA4OlC"}
+{"version":3,"file":"copilot-auth-service-impl.js","sourceRoot":"","sources":["../../src/node/copilot-auth-service-impl.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,4DAAwF;AACxF,sCAAsD;AAOtD,2EAAqE;AACrE,+DAA0D;AAC1D,yEAAoE;AAEpE;;;;;GAKG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAA5B;QAgBO,sBAAiB,GAAG,KAAK,CAAC;QAgBjB,8BAAyB,GAAG,IAAI,cAAO,EAAoB,CAAC;QACtE,uBAAkB,GAA4B,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;IA4DhG,CAAC;IAzEa,IAAI;QACV,6FAA6F;QAC7F,sFAAsF;QACtF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;YAC1E,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;gBAC3G,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACxD,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9F,CAAC;IAKD,SAAS,CAAC,MAA4C;QAClD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAwB;QAC5C,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAsB;QACpC,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,aAAa;QACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QAC1D,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QACd,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO;QACT,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,YAAY;QACd,6FAA6F;QAC7F,4FAA4F;QAC5F,kEAAkE;QAClE,MAAM,IAAI,CAAC,aAAa,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC5G,CAAC;IAES,eAAe,CAAC,KAAuB;QAC7C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;CACJ,CAAA;AA7FY,wDAAsB;AAGZ;IADlB,IAAA,kBAAM,EAAC,kDAAsB,CAAC;sCACK,kDAAsB;+DAAC;AAGxC;IADlB,IAAA,kBAAM,EAAC,iDAAsB,CAAC;sCACK,iDAAsB;+DAAC;AAGxC;IADlB,IAAA,kBAAM,EAAC,uCAAiB,CAAC;sCACK,uCAAiB;0DAAC;AAG9B;IADlB,IAAA,kBAAM,EAAC,cAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,mCAAmC,CAAC;;sDACzB;AAQzB;IADT,IAAA,yBAAa,GAAE;;;;kDAWf;iCA9BQ,sBAAsB;IADlC,IAAA,sBAAU,GAAE;GACA,sBAAsB,CA6FlC"}

package/lib/node/copilot-auth-service-impl.spec.js

@@ -1,6 +1,6 @@
 "use strict";
 // *****************************************************************************
-// Copyright (C) 2026 EclipseSource and others.
+// Copyright (C) 2026 EclipseSource GmbH and others.
 //
 // This program and the accompanying materials are made available under the
 // terms of the Eclipse Public License v. 2.0 which is available at
@@ -16,183 +16,119 @@
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
-const sinon = require("sinon");
-const inversify_1 = require("@theia/core/shared/inversify");
-const key_store_1 = require("@theia/core/lib/common/key-store");
-const copilot_oauth_config_1 = require("../common/copilot-oauth-config");
-const copilot_auth_service_impl_1 = require("./copilot-auth-service-impl");
-const logger_1 = require("@theia/core/lib/common/logger");
 const mock_logger_1 = require("@theia/core/lib/common/test/mock-logger");
-describe('CopilotAuthServiceImpl', () => {
-    let authService;
-    let keyStoreService;
-    let getPasswordStub;
-    beforeEach(() => {
-        const container = new inversify_1.Container();
-        getPasswordStub = sinon.stub();
-        keyStoreService = {
-            setPassword: sinon.stub().resolves(),
-            getPassword: getPasswordStub.resolves(undefined),
-            deletePassword: sinon.stub().resolves(true),
-            findPassword: sinon.stub().resolves(undefined),
-            findCredentials: sinon.stub().resolves([]),
-            keys: sinon.stub().resolves([])
+const copilot_auth_service_impl_1 = require("./copilot-auth-service-impl");
+class TestableCopilotAuthServiceImpl extends copilot_auth_service_impl_1.CopilotAuthServiceImpl {
+    constructor() {
+        super();
+        this.stubs = {
+            legacyRemoved: false,
+            legacyDelay: 0,
+            authState: { isAuthenticated: false },
+            authStateCalls: 0,
+            configuredPath: undefined,
+            deleted: 0
         };
-        container.bind(key_store_1.KeyStoreService).toConstantValue(keyStoreService);
-        container.bind(copilot_oauth_config_1.CopilotOAuthConfig).toConstantValue(copilot_oauth_config_1.DEFAULT_COPILOT_OAUTH_CONFIG);
-        container.bind(copilot_auth_service_impl_1.CopilotAuthServiceImpl).toSelf().inSingletonScope();
-        container.bind(logger_1.ILogger).to(mock_logger_1.MockLogger).inSingletonScope();
-        authService = container.get(copilot_auth_service_impl_1.CopilotAuthServiceImpl);
-    });
-    afterEach(() => {
-        sinon.restore();
-    });
-    describe('getAccessToken', () => {
-        it('should return undefined when no credentials are stored', async () => {
-            getPasswordStub.resolves(undefined);
-            const token = await authService.getAccessToken();
-            (0, chai_1.expect)(token).to.be.undefined;
-        });
-        it('should return the stored access token directly', async () => {
-            const oauthToken = 'ghu_test_token';
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: oauthToken,
-                accountLabel: 'testuser'
-            }));
-            const token = await authService.getAccessToken();
-            (0, chai_1.expect)(token).to.equal(oauthToken);
-        });
-        it('should return undefined when stored data is malformed', async () => {
-            getPasswordStub.resolves('not-valid-json');
-            const token = await authService.getAccessToken();
-            (0, chai_1.expect)(token).to.be.undefined;
+        const stubs = this.stubs;
+        Object.assign(this, {
+            logger: new mock_logger_1.MockLogger(),
+            credentialStore: {
+                deleteLegacy: async () => {
+                    await new Promise(resolve => setTimeout(resolve, stubs.legacyDelay));
+                    return stubs.legacyRemoved;
+                }
+            },
+            cliLocator: { setConfiguredPath: (path) => { stubs.configuredPath = path; } },
+            cliAuthProvider: {
+                getAuthState: async () => {
+                    stubs.authStateCalls++;
+                    return stubs.authState;
+                },
+                signOut: async () => {
+                    stubs.deleted++;
+                    stubs.authState = { isAuthenticated: false };
+                },
+                waitForLogin: async () => true
+            }
         });
+    }
+    /** Runs what `@postConstruct` runs in production. */
+    start() {
+        this.init();
+    }
+}
+describe('CopilotAuthServiceImpl - migration of the previous sign-in', () => {
+    it('should report that a new sign-in is required, even when asked before the cleanup finished', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.stubs.legacyRemoved = true;
+        // The frontend evaluates the flag once at startup, so a state cached without it loses it.
+        service.stubs.legacyDelay = 20;
+        service.start();
+        (0, chai_1.expect)(await service.getAuthState()).to.deep.include({ isAuthenticated: false, migrationRequired: true });
     });
-    describe('getAuthState', () => {
-        it('should return not authenticated when no credentials are stored', async () => {
-            getPasswordStub.resolves(undefined);
-            const state = await authService.getAuthState();
-            (0, chai_1.expect)(state.isAuthenticated).to.be.false;
-            (0, chai_1.expect)(state.accountLabel).to.be.undefined;
-        });
-        it('should return authenticated with account label when credentials exist', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser',
-                enterpriseUrl: undefined
-            }));
-            const state = await authService.getAuthState();
-            (0, chai_1.expect)(state.isAuthenticated).to.be.true;
-            (0, chai_1.expect)(state.accountLabel).to.equal('testuser');
-        });
-        it('should return enterprise URL when stored', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser',
-                enterpriseUrl: 'github.mycompany.com'
-            }));
-            const state = await authService.getAuthState();
-            (0, chai_1.expect)(state.isAuthenticated).to.be.true;
-            (0, chai_1.expect)(state.enterpriseUrl).to.equal('github.mycompany.com');
-        });
-        it('should clear outdated non-gho_ token and flag migration', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'ghu_old_token',
-                accountLabel: 'testuser'
-            }));
-            const state = await authService.getAuthState();
-            (0, chai_1.expect)(state.isAuthenticated).to.be.false;
-            (0, chai_1.expect)(state.migrationRequired).to.be.true;
-            (0, chai_1.expect)(keyStoreService.deletePassword.calledOnce).to.be.true;
-        });
-        it('should cache the auth state after first retrieval', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser'
-            }));
-            const state1 = await authService.getAuthState();
-            const state2 = await authService.getAuthState();
-            (0, chai_1.expect)(state1).to.equal(state2);
-            (0, chai_1.expect)(getPasswordStub.calledOnce).to.be.true;
-        });
+    it('should not claim a migration when there was nothing to discard', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        (0, chai_1.expect)(await service.getAuthState()).to.not.have.property('migrationRequired');
     });
-    describe('signOut', () => {
-        it('should clear cached auth state on sign out', async () => {
-            getPasswordStub.resolves(JSON.stringify({
-                accessToken: 'gho_test',
-                accountLabel: 'testuser'
-            }));
-            const stateBefore = await authService.getAuthState();
-            (0, chai_1.expect)(stateBefore.isAuthenticated).to.be.true;
-            await authService.signOut();
-            // After sign out, cached state should be cleared
-            // getAuthState should now return the new state without hitting keystore cache
-            const stateAfter = await authService.getAuthState();
-            (0, chai_1.expect)(stateAfter.isAuthenticated).to.be.false;
-        });
-        it('should fire auth state changed event on sign out', async () => {
-            const stateChanges = [];
-            authService.onAuthStateChanged(state => stateChanges.push(state));
-            await authService.signOut();
-            (0, chai_1.expect)(stateChanges).to.have.lengthOf(1);
-            (0, chai_1.expect)(stateChanges[0].isAuthenticated).to.be.false;
-        });
-        it('should delete credentials from keystore on sign out', async () => {
-            await authService.signOut();
-            (0, chai_1.expect)(keyStoreService.deletePassword.calledOnce).to.be.true;
-        });
-        it('should notify client on sign out', async () => {
-            const client = { onAuthStateChanged: sinon.stub() };
-            authService.setClient(client);
-            await authService.signOut();
-            (0, chai_1.expect)(client.onAuthStateChanged.calledOnce).to.be.true;
-            (0, chai_1.expect)(client.onAuthStateChanged.firstCall.args[0].isAuthenticated).to.be.false;
-        });
+    it('should not claim a migration for a user who is signed in', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.stubs.legacyRemoved = true;
+        service.stubs.authState = { isAuthenticated: true, accountLabel: 'octocat' };
+        service.start();
+        (0, chai_1.expect)(await service.getAuthState()).to.not.have.property('migrationRequired');
+    });
+    it('should survive a keychain that cannot be read', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        Object.assign(service, { credentialStore: { deleteLegacy: async () => { throw new Error('keychain unavailable'); } } });
+        service.start();
+        (0, chai_1.expect)(await service.getAuthState()).to.deep.equal({ isAuthenticated: false });
     });
 });
-describe('CopilotAuthServiceImpl with custom CopilotOAuthConfig', () => {
-    const customConfig = {
-        clientId: 'CustomClientId',
-        userAgent: 'MyApp/1.0.0',
-        keystoreService: 'myapp-copilot',
-        keystoreAccount: 'myapp-github'
-    };
-    let authService;
-    let getPasswordStub;
-    let deletePasswordStub;
-    beforeEach(() => {
-        const container = new inversify_1.Container();
-        container.bind(logger_1.ILogger).to(mock_logger_1.MockLogger).inSingletonScope();
-        getPasswordStub = sinon.stub().resolves(undefined);
-        deletePasswordStub = sinon.stub().resolves(true);
-        const keyStoreService = {
-            setPassword: sinon.stub().resolves(),
-            getPassword: getPasswordStub,
-            deletePassword: deletePasswordStub,
-            findPassword: sinon.stub().resolves(undefined),
-            findCredentials: sinon.stub().resolves([]),
-            keys: sinon.stub().resolves([])
-        };
-        container.bind(key_store_1.KeyStoreService).toConstantValue(keyStoreService);
-        container.bind(copilot_oauth_config_1.CopilotOAuthConfig).toConstantValue(customConfig);
-        container.bind(copilot_auth_service_impl_1.CopilotAuthServiceImpl).toSelf().inSingletonScope();
-        authService = container.get(copilot_auth_service_impl_1.CopilotAuthServiceImpl);
+describe('CopilotAuthServiceImpl - state', () => {
+    it('should ask the provider once and serve the cached state afterwards', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.getAuthState();
+        await service.getAuthState();
+        (0, chai_1.expect)(service.stubs.authStateCalls).to.equal(1);
     });
-    afterEach(() => {
-        sinon.restore();
+    it('should report the new state after a sign-in', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.getAuthState();
+        service.stubs.authState = { isAuthenticated: true, accountLabel: 'octocat' };
+        const reported = [];
+        service.onAuthStateChanged(state => reported.push(state));
+        (0, chai_1.expect)(await service.waitForSignIn()).to.be.true;
+        (0, chai_1.expect)(reported).to.deep.equal([{ isAuthenticated: true, accountLabel: 'octocat' }]);
+        (0, chai_1.expect)(await service.getAuthState()).to.deep.equal({ isAuthenticated: true, accountLabel: 'octocat' });
     });
-    it('should read credentials from the custom keystore service and account', async () => {
-        getPasswordStub.resolves(JSON.stringify({
-            accessToken: 'gho_custom_token',
-            accountLabel: 'customuser'
-        }));
-        const token = await authService.getAccessToken();
-        (0, chai_1.expect)(token).to.equal('gho_custom_token');
-        (0, chai_1.expect)(getPasswordStub.calledOnceWith(customConfig.keystoreService, customConfig.keystoreAccount)).to.be.true;
+    it('should report the new state after signing out', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.stubs.authState = { isAuthenticated: true, accountLabel: 'octocat' };
+        service.start();
+        await service.getAuthState();
+        const reported = [];
+        service.onAuthStateChanged(state => reported.push(state));
+        await service.signOut();
+        (0, chai_1.expect)(service.stubs.deleted).to.equal(1);
+        (0, chai_1.expect)(reported).to.deep.equal([{ isAuthenticated: false }]);
+    });
+});
+describe('CopilotAuthServiceImpl - executable path', () => {
+    it('should hand the configured location to the lookup, which cannot read preferences itself', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.setExecutablePath('/opt/copilot/copilot');
+        (0, chai_1.expect)(service.stubs.configuredPath).to.equal('/opt/copilot/copilot');
     });
-    it('should delete credentials from the custom keystore service and account on sign out', async () => {
-        await authService.signOut();
-        (0, chai_1.expect)(deletePasswordStub.calledOnceWith(customConfig.keystoreService, customConfig.keystoreAccount)).to.be.true;
+    it('should hand on that nothing is configured, so that the CLI is searched for', async () => {
+        const service = new TestableCopilotAuthServiceImpl();
+        service.start();
+        await service.setExecutablePath('/opt/copilot/copilot');
+        await service.setExecutablePath(undefined);
+        (0, chai_1.expect)(service.stubs.configuredPath).to.be.undefined;
     });
 });
 //# sourceMappingURL=copilot-auth-service-impl.spec.js.map