@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/__tests__/oauth-cli.test.ts

@@ -35,25 +35,6 @@ mock.module("../platform/client.js", () => ({
   },
 }));
 
-// Some shared helpers in oauth/shared.ts touch getConfig() — stub it so the
-// import resolves cleanly even though the requirePlatformConnection path
-// never reads service configuration.
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({ services: {} }),
-  getConfigReadOnly: () => ({ services: {} }),
-  loadConfig: () => ({ services: {} }),
-  invalidateConfigCache: () => {},
-  loadRawConfig: () => ({}),
-  saveRawConfig: () => {},
-  applyNestedDefaults: (c: unknown) => c,
-  deepMergeOverwrite: (a: unknown) => a,
-  mergeDefaultWorkspaceConfig: () => {},
-  getNestedValue: () => undefined,
-  setNestedValue: () => {},
-  _writeQuarantineNotice: () => {},
-  API_KEY_PROVIDERS: ["anthropic", "openai", "gemini"],
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () => ({
     info: () => {},

package/src/__tests__/oauth-commands-routes.test.ts

@@ -44,7 +44,6 @@ const baseProvider: MockProviderRow = {
 };
 
 let mockProviders: Record<string, MockProviderRow> = {};
-let mockServiceModes: Record<string, "managed" | "your-own"> = {};
 let mockActiveConnectionsByProvider: Record<string, unknown[]> = {};
 let mockAllConnections: Record<string, unknown[]> = {};
 let mockApps: Record<string, unknown> = {};
@@ -74,7 +73,6 @@ let mockResolveRequests: unknown[] = [];
 let mockSyncManualTokenCalls: string[] = [];
 
 const mockDisconnectOAuthProvider = mock(() => Promise.resolve());
-const mockSaveRawConfig = mock(() => undefined);
 
 mock.module("../oauth/oauth-store.js", () => ({
   disconnectOAuthProvider: mockDisconnectOAuthProvider,
@@ -152,37 +150,7 @@ mock.module("../security/token-manager.js", () => ({
     fn(mockTokenValue),
 }));
 
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({ services: {} }),
-  loadRawConfig: () => ({ services: {} }),
-  saveRawConfig: mockSaveRawConfig,
-  setNestedValue: (
-    obj: Record<string, unknown>,
-    path: string,
-    value: unknown,
-  ) => {
-    const parts = path.split(".");
-    let cur: Record<string, unknown> = obj;
-    for (let i = 0; i < parts.length - 1; i++) {
-      const k = parts[i]!;
-      if (typeof cur[k] !== "object" || cur[k] === null) cur[k] = {};
-      cur = cur[k] as Record<string, unknown>;
-    }
-    cur[parts[parts.length - 1]!] = value;
-  },
-}));
-
-mock.module("../config/schemas/services.js", () => ({
-  getServiceMode: (_services: unknown, key: string) =>
-    mockServiceModes[key] ?? "your-own",
-  ServicesSchema: {
-    shape: {
-      "google-oauth": true,
-      "byo-only": true,
-    },
-  },
-}));
-
+import { loadRawConfig } from "../config/loader.js";
 import {
   BadRequestError,
   InternalError,
@@ -190,6 +158,17 @@ import {
 } from "../runtime/routes/errors.js";
 import { ROUTES } from "../runtime/routes/oauth-commands-routes.js";
 import type { RouteHandlerArgs } from "../runtime/routes/types.js";
+import { setConfig } from "./helpers/set-config.js";
+
+/** Seed `services.<key>.mode` entries into the workspace config for real. */
+function seedServiceModes(modes: Record<string, "managed" | "your-own">): void {
+  setConfig(
+    "services",
+    Object.fromEntries(
+      Object.entries(modes).map(([key, mode]) => [key, { mode }]),
+    ),
+  );
+}
 
 function getRoute(method: string, endpoint: string) {
   const route = ROUTES.find(
@@ -215,7 +194,9 @@ function makeArgs(
 
 beforeEach(() => {
   mockProviders = { google: { ...baseProvider } };
-  mockServiceModes = {};
+  // The real schema default for `services.google-oauth.mode` is "managed";
+  // seed "your-own" so BYO-mode tests keep their baseline.
+  seedServiceModes({ "google-oauth": "your-own" });
   mockActiveConnectionsByProvider = {};
   mockAllConnections = {};
   mockApps = {};
@@ -232,7 +213,6 @@ beforeEach(() => {
   mockResolveRequests = [];
   mockSyncManualTokenCalls = [];
   mockDisconnectOAuthProvider.mockClear();
-  mockSaveRawConfig.mockClear();
 });
 
 // ---------------------------------------------------------------------------
@@ -308,7 +288,7 @@ describe("POST oauth/disconnect", () => {
   });
 
   test("managed mode with no active connections raises NotFound", async () => {
-    mockServiceModes["google-oauth"] = "managed";
+    seedServiceModes({ "google-oauth": "managed" });
     mockFetchImpl = async () => ({
       ok: true,
       status: 200,
@@ -323,7 +303,7 @@ describe("POST oauth/disconnect", () => {
   });
 
   test("managed mode with multiple connections demands disambiguation", async () => {
-    mockServiceModes["google-oauth"] = "managed";
+    seedServiceModes({ "google-oauth": "managed" });
     mockFetchImpl = async () => ({
       ok: true,
       status: 200,
@@ -354,7 +334,7 @@ describe("GET oauth/mode", () => {
   });
 
   test("returns managed-supported provider mode", async () => {
-    mockServiceModes["google-oauth"] = "managed";
+    seedServiceModes({ "google-oauth": "managed" });
     const result = (await getRoute("GET", "oauth/mode").handler(
       makeArgs({ queryParams: { provider: "google" } }),
     )) as { mode: string; managedModeSupported: boolean };
@@ -408,11 +388,13 @@ describe("POST oauth/mode", () => {
       provider: "byo",
       managedServiceConfigKey: null,
     };
+    const rawBefore = JSON.stringify(loadRawConfig());
     const result = (await getRoute("POST", "oauth/mode").handler(
       makeArgs({ body: { provider: "byo", mode: "your-own" } }),
     )) as { changed: boolean };
     expect(result.changed).toBe(false);
-    expect(mockSaveRawConfig).not.toHaveBeenCalled();
+    // The no-op path must not write the config file.
+    expect(JSON.stringify(loadRawConfig())).toBe(rawBefore);
   });
 
   test("requires platform connection when switching to managed", async () => {
@@ -425,12 +407,15 @@ describe("POST oauth/mode", () => {
   });
 
   test("persists mode change when current differs from new", async () => {
-    mockServiceModes["google-oauth"] = "your-own";
+    seedServiceModes({ "google-oauth": "your-own" });
     const result = (await getRoute("POST", "oauth/mode").handler(
       makeArgs({ body: { provider: "google", mode: "managed" } }),
     )) as { changed: boolean };
     expect(result.changed).toBe(true);
-    expect(mockSaveRawConfig).toHaveBeenCalled();
+    const raw = loadRawConfig() as {
+      services?: Record<string, { mode?: string }>;
+    };
+    expect(raw.services?.["google-oauth"]?.mode).toBe("managed");
   });
 });
 
@@ -522,7 +507,7 @@ describe("GET oauth/status", () => {
   });
 
   test("managed mode surfaces platform connections", async () => {
-    mockServiceModes["google-oauth"] = "managed";
+    seedServiceModes({ "google-oauth": "managed" });
     mockFetchImpl = async () => ({
       ok: true,
       status: 200,
@@ -594,7 +579,7 @@ describe("POST oauth/ping", () => {
 
 describe("POST oauth/token", () => {
   test("rejects managed-mode providers", async () => {
-    mockServiceModes["google-oauth"] = "managed";
+    seedServiceModes({ "google-oauth": "managed" });
     await expect(
       getRoute("POST", "oauth/token").handler(
         makeArgs({ body: { provider: "google" } }),

package/src/__tests__/oauth-connect-orchestrator.test.ts

@@ -51,14 +51,6 @@ mock.module("../security/oauth2.js", () => ({
   },
 }));
 
-// Mock logger
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 // Mock identity verifier — returns a stable account identifier
 let mockIdentityResult: string | undefined = "user@example.com";
 
@@ -124,18 +116,11 @@ mock.module("../oauth/oauth-store.js", () => ({
   getProvider: (key: string) => mockProviderStore[key],
 }));
 
-// Config / ingress mocks — for gateway transport validation
-let mockPublicBaseUrl = "";
-
-mock.module("../config/loader.js", () => ({
-  loadConfig: () => ({
-    ingress: { publicBaseUrl: mockPublicBaseUrl },
-  }),
-}));
-
+// Ingress mock — for gateway transport validation. The orchestrator passes
+// the real loaded config (seeded via setConfig below) into getPublicBaseUrl.
 mock.module("../inbound/public-ingress-urls.js", () => ({
   getPublicBaseUrl: (config?: { ingress?: { publicBaseUrl?: string } }) => {
-    const url = config?.ingress?.publicBaseUrl ?? mockPublicBaseUrl;
+    const url = config?.ingress?.publicBaseUrl ?? "";
     if (!url) {
       throw new Error("No public base URL configured.");
     }
@@ -148,6 +133,12 @@ mock.module("../inbound/public-ingress-urls.js", () => ({
 // ---------------------------------------------------------------------------
 
 import { orchestrateOAuthConnect } from "../oauth/connect-orchestrator.js";
+import { setConfig } from "./helpers/set-config.js";
+
+/** Seed `ingress.publicBaseUrl` in the real workspace config. */
+function setPublicBaseUrl(url: string): void {
+  setConfig("ingress", { publicBaseUrl: url });
+}
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -225,7 +216,7 @@ const OUTLOOK_PROVIDER = makeProviderRow({
 beforeEach(() => {
   lastPrepareArgs = null;
   lastStartArgs = null;
-  mockPublicBaseUrl = "";
+  setPublicBaseUrl("");
   mockIdentityResult = "user@example.com";
   mockProviderStore = {};
 
@@ -276,7 +267,7 @@ describe("orchestrateOAuthConnect — transport selection", () => {
 
     test('callbackTransport: "gateway" → passes gateway options to prepareOAuth2Flow', async () => {
       mockProviderStore["google"] = GOOGLE_PROVIDER;
-      mockPublicBaseUrl = "https://gw.example.com";
+      setPublicBaseUrl("https://gw.example.com");
 
       const result = await orchestrateOAuthConnect({
         service: "google",
@@ -318,7 +309,7 @@ describe("orchestrateOAuthConnect — transport selection", () => {
 
     test("gateway without ingress configured → returns error", async () => {
       mockProviderStore["google"] = GOOGLE_PROVIDER;
-      mockPublicBaseUrl = ""; // no ingress
+      setPublicBaseUrl(""); // no ingress
 
       const result = await orchestrateOAuthConnect({
         service: "google",
@@ -334,7 +325,7 @@ describe("orchestrateOAuthConnect — transport selection", () => {
 
     test("loopback without ingress configured → succeeds", async () => {
       mockProviderStore["google"] = GOOGLE_PROVIDER;
-      mockPublicBaseUrl = ""; // no ingress
+      setPublicBaseUrl(""); // no ingress
 
       const result = await orchestrateOAuthConnect({
         service: "google",
@@ -443,7 +434,7 @@ describe("orchestrateOAuthConnect — transport selection", () => {
 
     test("Google + gateway → gateway transport", async () => {
       mockProviderStore["google"] = GOOGLE_PROVIDER;
-      mockPublicBaseUrl = "https://gw.example.com";
+      setPublicBaseUrl("https://gw.example.com");
 
       await orchestrateOAuthConnect({
         service: "google",
@@ -475,7 +466,7 @@ describe("orchestrateOAuthConnect — transport selection", () => {
 
     test("Outlook + gateway → gateway transport", async () => {
       mockProviderStore["outlook"] = OUTLOOK_PROVIDER;
-      mockPublicBaseUrl = "https://gw.example.com";
+      setPublicBaseUrl("https://gw.example.com");
 
       await orchestrateOAuthConnect({
         service: "outlook",
@@ -635,7 +626,7 @@ describe("orchestrateOAuthConnect — transport selection", () => {
   describe("error cases", () => {
     test("gateway without ingress (deferred, Google) → returns error", async () => {
       mockProviderStore["google"] = GOOGLE_PROVIDER;
-      mockPublicBaseUrl = "";
+      setPublicBaseUrl("");
 
       const result = await orchestrateOAuthConnect({
         service: "google",
@@ -653,7 +644,7 @@ describe("orchestrateOAuthConnect — transport selection", () => {
 
     test("gateway without ingress (deferred, Outlook) → returns error", async () => {
       mockProviderStore["outlook"] = OUTLOOK_PROVIDER;
-      mockPublicBaseUrl = "";
+      setPublicBaseUrl("");
 
       const result = await orchestrateOAuthConnect({
         service: "outlook",

package/src/__tests__/oauth-connect-routes.test.ts

@@ -18,7 +18,9 @@ type OrchestrateOptions = {
   }) => void;
 };
 
-let capturedOnDeferredComplete: OrchestrateOptions["onDeferredComplete"] | undefined;
+let capturedOnDeferredComplete:
+  | OrchestrateOptions["onDeferredComplete"]
+  | undefined;
 let mockOrchestrateResult: Record<string, unknown> = {
   success: true,
   deferred: true,
@@ -34,13 +36,6 @@ mock.module("../oauth/connect-orchestrator.js", () => ({
   },
 }));
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 // ── Mock oauth-store so handleOAuthConnectStart can run without a seeded DB ──
 type MockProviderRow = {
   authorizeUrl?: string;
@@ -90,12 +85,10 @@ mock.module("../oauth/oauth-store.js", () => ({
 // ── Import SUT after mocks ─────────────────────────────────────────────────────
 
 const { ROUTES } = await import("../runtime/routes/oauth-connect-routes.js");
-const { BadRequestError, InternalError, NotFoundError } = await import(
-  "../runtime/routes/errors.js"
-);
-const { _clearAllOAuthConnectStates, getOAuthConnectState } = await import(
-  "../oauth/oauth-connect-state.js"
-);
+const { BadRequestError, InternalError, NotFoundError } =
+  await import("../runtime/routes/errors.js");
+const { _clearAllOAuthConnectStates, getOAuthConnectState } =
+  await import("../oauth/oauth-connect-state.js");
 
 // ── Helpers ────────────────────────────────────────────────────────────────────
 
@@ -131,7 +124,8 @@ describe("oauth-connect-routes", () => {
       mockOrchestrateResult = {
         success: true,
         deferred: true,
-        authorizeUrl: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+        authorizeUrl:
+          "https://accounts.google.com/o/oauth2/auth?client_id=test",
         state: "test-state-uuid-abc123",
         service: "google",
       };
@@ -355,7 +349,8 @@ describe("oauth-connect-routes", () => {
       mockOrchestrateResult = {
         success: true,
         deferred: true,
-        authorizeUrl: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+        authorizeUrl:
+          "https://accounts.google.com/o/oauth2/auth?client_id=test",
         state: "test-state-uuid-abc123",
         service: "google",
       };
@@ -443,7 +438,10 @@ describe("oauth-connect-routes", () => {
         success: true,
         service: "google",
         accountInfo: "user@example.com",
-        grantedScopes: ["https://www.googleapis.com/auth/calendar", "https://www.googleapis.com/auth/gmail.readonly"],
+        grantedScopes: [
+          "https://www.googleapis.com/auth/calendar",
+          "https://www.googleapis.com/auth/gmail.readonly",
+        ],
       });
       const result = findRoute("internal_oauth_connect_status").handler({
         pathParams: { state: "test-state-uuid-abc123" },
@@ -452,7 +450,10 @@ describe("oauth-connect-routes", () => {
         status: "complete",
         service: "google",
         account_info: "user@example.com",
-        granted_scopes: ["https://www.googleapis.com/auth/calendar", "https://www.googleapis.com/auth/gmail.readonly"],
+        granted_scopes: [
+          "https://www.googleapis.com/auth/calendar",
+          "https://www.googleapis.com/auth/gmail.readonly",
+        ],
       });
     });
 

package/src/__tests__/oauth-provider-profiles.test.ts

@@ -1,12 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 mock.module("../security/secure-keys.js", () => ({
   deleteSecureKeyAsync: async () => "deleted" as const,
   setSecureKeyAsync: async () => true,
@@ -30,7 +23,7 @@ describe("oauth provider profiles (DB-seeded)", () => {
     );
   });
 
-  test("google provider row contains bearer injection templates for 3 Google API hosts", () => {
+  test("google provider row contains bearer injection templates for 4 Google API hosts", () => {
     const provider = getProvider("google");
 
     expect(provider).toBeDefined();
@@ -43,7 +36,7 @@ describe("oauth provider profiles (DB-seeded)", () => {
       valuePrefix: string;
     }>;
 
-    expect(templates).toHaveLength(3);
+    expect(templates).toHaveLength(4);
 
     const byHost = new Map(templates.map((t) => [t.hostPattern, t]));
 
@@ -51,6 +44,7 @@ describe("oauth provider profiles (DB-seeded)", () => {
       "gmail.googleapis.com",
       "www.googleapis.com",
       "people.googleapis.com",
+      "docs.googleapis.com",
     ]) {
       const tpl = byHost.get(host);
       expect(tpl).toBeDefined();

package/src/__tests__/oauth-provider-visibility.test.ts

@@ -8,13 +8,6 @@ import {
   test,
 } from "bun:test";
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 mock.module("../security/secure-keys.js", () => ({
   deleteSecureKeyAsync: () => Promise.resolve("deleted" as const),
   setSecureKeyAsync: () => Promise.resolve(true),

package/src/__tests__/oauth-store.test.ts

@@ -1,12 +1,5 @@
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 const mockDeleteSecureKeyAsync = mock(
   (): Promise<"deleted" | "not-found" | "error"> =>
     Promise.resolve("deleted" as const),