@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/plugins/defaults/memory/__tests__/fork-message-copy.test.ts

@@ -1,221 +0,0 @@
-import { beforeEach, describe, expect, test } from "bun:test";
-
-import { setConfig } from "../../../../__tests__/helpers/set-config.js";
-
-// Disable memory so `addMessage` does not index into the real memory
-// pipeline (both flags default true under the real loader).
-setConfig("memory", { enabled: false, v2: { enabled: false } });
-
-import {
-  addMessage,
-  createConversation,
-  getMessages,
-} from "../../../../persistence/conversation-crud.js";
-import { getDb, getSqlite } from "../../../../persistence/db-connection.js";
-import { initializeDb } from "../../../../persistence/db-init.js";
-import {
-  buildForkCopyScript,
-  copyForkMessagesViaSubprocess,
-  type ForkIdPair,
-} from "../../../../persistence/fork-message-copy.js";
-import { messages as messagesTable } from "../../../../persistence/schema/index.js";
-
-await initializeDb();
-
-function resetTables(): void {
-  const db = getDb();
-  db.run("DELETE FROM messages");
-  db.run("DELETE FROM conversations");
-}
-
-/** Mirror of the production `cloneForkMessageMetadata` semantics. */
-function expectedClonedMetadata(
-  sourceMetadata: string | null,
-  sourceMessageId: string,
-): unknown {
-  const parsed = sourceMetadata == null ? null : JSON.parse(sourceMetadata);
-  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-    const record = parsed as Record<string, unknown>;
-    const existing = record.forkSourceMessageId;
-    return {
-      ...record,
-      forkSourceMessageId:
-        typeof existing === "string" ? existing : sourceMessageId,
-    };
-  }
-  return { forkSourceMessageId: sourceMessageId };
-}
-
-/** Build an in-JS old→new id map for a source conversation's messages. */
-function idPairsFor(sourceConversationId: string): ForkIdPair[] {
-  return getMessages(sourceConversationId).map((m) => ({
-    oldId: m.id,
-    newId: crypto.randomUUID(),
-  }));
-}
-
-describe("copyForkMessagesViaSubprocess", () => {
-  beforeEach(() => {
-    resetTables();
-  });
-
-  test("copies rows with cloneForkMessageMetadata parity and a fresh id", async () => {
-    const source = createConversation("source");
-    await addMessage(source.id, "user", "draft a plan", {
-      metadata: { branch: 1, source: "user" },
-      skipIndexing: true,
-    });
-    await addMessage(source.id, "assistant", "here is a pass", {
-      metadata: { automated: true },
-      skipIndexing: true,
-    });
-    // Already-stamped metadata must be preserved, not overwritten.
-    await addMessage(source.id, "user", "carry this", {
-      metadata: { forkSourceMessageId: "pre-existing", note: "x" },
-      skipIndexing: true,
-    });
-    // Null metadata must become a fresh provenance-only object.
-    await addMessage(source.id, "user", "no metadata", {
-      skipIndexing: true,
-    });
-
-    const fork = createConversation({
-      title: "fork",
-      conversationType: "background",
-    });
-    const sourceMessages = getMessages(source.id);
-    const idPairs = sourceMessages.map((m) => ({
-      oldId: m.id,
-      newId: crypto.randomUUID(),
-    }));
-
-    const result = await copyForkMessagesViaSubprocess({
-      forkConversationId: fork.id,
-      idPairs,
-      forceInProcess: true,
-    });
-    expect(result.ok).toBe(true);
-
-    const forkMessages = getMessages(fork.id);
-    expect(forkMessages).toHaveLength(sourceMessages.length);
-    expect(forkMessages.map((m) => m.role)).toEqual(
-      sourceMessages.map((m) => m.role),
-    );
-    expect(forkMessages.map((m) => m.content)).toEqual(
-      sourceMessages.map((m) => m.content),
-    );
-    expect(forkMessages.map((m) => m.createdAt)).toEqual(
-      sourceMessages.map((m) => m.createdAt),
-    );
-    expect(
-      forkMessages.map((m) => (m.metadata ? JSON.parse(m.metadata) : null)),
-    ).toEqual(
-      sourceMessages.map((m) => expectedClonedMetadata(m.metadata, m.id)),
-    );
-    // Fresh ids, and assigned exactly per the supplied map.
-    const byOld = new Map(idPairs.map((p) => [p.oldId, p.newId]));
-    for (const src of sourceMessages) {
-      const expectedNewId = byOld.get(src.id);
-      expect(forkMessages.some((f) => f.id === expectedNewId)).toBe(true);
-    }
-  });
-
-  test("does not copy client_message_id onto fork rows", async () => {
-    const source = createConversation("source");
-    const db = getDb();
-    const createdAt = Date.now();
-    db.run(
-      `INSERT INTO messages (id, conversation_id, role, content, created_at, client_message_id)
-       VALUES ('msg-with-client-id', '${source.id}', 'user', 'hi', ${createdAt}, 'client-123')`,
-    );
-
-    const fork = createConversation({
-      title: "fork",
-      conversationType: "background",
-    });
-    await copyForkMessagesViaSubprocess({
-      forkConversationId: fork.id,
-      idPairs: [{ oldId: "msg-with-client-id", newId: crypto.randomUUID() }],
-      forceInProcess: true,
-    });
-
-    const forkRow = db
-      .select()
-      .from(messagesTable)
-      .all()
-      .find((r) => r.conversationId === fork.id);
-    expect(forkRow).toBeDefined();
-    expect(forkRow?.clientMessageId ?? null).toBeNull();
-  });
-
-  test("copies across batch boundaries", async () => {
-    const source = createConversation("source");
-    for (let i = 0; i < 5; i++) {
-      await addMessage(source.id, "user", `m${i}`, { skipIndexing: true });
-    }
-    const fork = createConversation({
-      title: "fork",
-      conversationType: "background",
-    });
-    const idPairs = idPairsFor(source.id);
-
-    const result = await copyForkMessagesViaSubprocess({
-      forkConversationId: fork.id,
-      idPairs,
-      batchSize: 2,
-      forceInProcess: true,
-    });
-    expect(result.ok).toBe(true);
-    expect(getMessages(fork.id)).toHaveLength(5);
-  });
-
-  test("no-op for an empty id map", async () => {
-    const result = await copyForkMessagesViaSubprocess({
-      forkConversationId: crypto.randomUUID(),
-      idPairs: [],
-      forceInProcess: true,
-    });
-    expect(result.ok).toBe(true);
-    expect(result.elapsedMs).toBe(0);
-  });
-
-  test("does not leave the staging temp table on the connection", async () => {
-    const source = createConversation("source");
-    await addMessage(source.id, "user", "hi", { skipIndexing: true });
-    const fork = createConversation({
-      title: "fork",
-      conversationType: "background",
-    });
-    await copyForkMessagesViaSubprocess({
-      forkConversationId: fork.id,
-      idPairs: idPairsFor(source.id),
-      forceInProcess: true,
-    });
-    const tempTable = getSqlite()
-      .query(
-        "SELECT name FROM sqlite_temp_master WHERE type='table' AND name='_fork_id_map'",
-      )
-      .get();
-    expect(tempTable).toBeNull();
-  });
-});
-
-describe("buildForkCopyScript", () => {
-  test("rejects an unsafe fork id", () => {
-    expect(() =>
-      buildForkCopyScript({
-        forkConversationId: "abc'); DROP TABLE messages;--",
-        idPairs: [],
-      }),
-    ).toThrow(/unsafe id/);
-  });
-
-  test("rejects an unsafe message id", () => {
-    expect(() =>
-      buildForkCopyScript({
-        forkConversationId: crypto.randomUUID(),
-        idPairs: [{ oldId: "ok", newId: "bad'id" }],
-      }),
-    ).toThrow(/unsafe id/);
-  });
-});

package/src/security/__tests__/oauth2-device-code.test.ts

@@ -1,431 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-
-// ---------------------------------------------------------------------------
-// Mock logger before importing any code that uses it.
-// ---------------------------------------------------------------------------
-// ---------------------------------------------------------------------------
-// Imports under test
-// ---------------------------------------------------------------------------
-import type { DeviceCodeConfig } from "../oauth2-device-code.js";
-import {
-  DeviceCodeError,
-  OPENAI_DEVICE_CODE_CONFIG,
-  pollForToken,
-  requestDeviceCode,
-  startDeviceCodeFlow,
-} from "../oauth2-device-code.js";
-
-// ---------------------------------------------------------------------------
-// Fetch mock helpers
-// ---------------------------------------------------------------------------
-
-const originalFetch = globalThis.fetch;
-
-function mockFetch(
-  handler: (url: string, init?: RequestInit) => Response | Promise<Response>,
-): void {
-  globalThis.fetch = handler as typeof globalThis.fetch;
-}
-
-function jsonResponse(data: unknown, status = 200): Response {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-const TEST_CONFIG: DeviceCodeConfig = {
-  deviceCodeUrl: "https://auth.example.com/device/code",
-  tokenUrl: "https://auth.example.com/oauth/token",
-  clientId: "test-client-id",
-  scopes: ["openid", "profile"],
-  audience: "https://api.example.com",
-};
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("oauth2-device-code", () => {
-  beforeEach(() => {
-    globalThis.fetch = originalFetch;
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-  });
-
-  describe("OPENAI_DEVICE_CODE_CONFIG", () => {
-    test("has the expected OpenAI Codex values", () => {
-      expect(OPENAI_DEVICE_CODE_CONFIG.deviceCodeUrl).toBe(
-        "https://auth.openai.com/oauth/device/code",
-      );
-      expect(OPENAI_DEVICE_CODE_CONFIG.tokenUrl).toBe(
-        "https://auth.openai.com/oauth/token",
-      );
-      expect(OPENAI_DEVICE_CODE_CONFIG.clientId).toBe(
-        "app_EMoamEEZ73f0CkXaXp7hrann",
-      );
-      expect(OPENAI_DEVICE_CODE_CONFIG.scopes).toEqual([
-        "openid",
-        "profile",
-        "email",
-        "offline_access",
-      ]);
-      expect(OPENAI_DEVICE_CODE_CONFIG.audience).toBe("https://chatgpt.com");
-    });
-  });
-
-  describe("requestDeviceCode", () => {
-    test("sends correct request and parses response", async () => {
-      let capturedUrl = "";
-      let capturedBody = "";
-
-      mockFetch(async (url, init) => {
-        capturedUrl = url;
-        capturedBody = init?.body?.toString() ?? "";
-        return jsonResponse({
-          device_code: "dev-code-123",
-          user_code: "ABCD-1234",
-          verification_uri: "https://auth.example.com/activate",
-          verification_uri_complete:
-            "https://auth.example.com/activate?user_code=ABCD-1234",
-          expires_in: 900,
-          interval: 5,
-        });
-      });
-
-      const result = await requestDeviceCode(TEST_CONFIG);
-
-      expect(capturedUrl).toBe(TEST_CONFIG.deviceCodeUrl);
-      const params = new URLSearchParams(capturedBody);
-      expect(params.get("client_id")).toBe("test-client-id");
-      expect(params.get("scope")).toBe("openid profile");
-      expect(params.get("audience")).toBe("https://api.example.com");
-
-      expect(result.deviceCode).toBe("dev-code-123");
-      expect(result.userCode).toBe("ABCD-1234");
-      expect(result.verificationUri).toBe("https://auth.example.com/activate");
-      expect(result.verificationUriComplete).toBe(
-        "https://auth.example.com/activate?user_code=ABCD-1234",
-      );
-      expect(result.expiresIn).toBe(900);
-      expect(result.interval).toBe(5);
-    });
-
-    test("defaults interval to 5 when not provided", async () => {
-      mockFetch(async () =>
-        jsonResponse({
-          device_code: "dev-code-123",
-          user_code: "ABCD-1234",
-          verification_uri: "https://auth.example.com/activate",
-          expires_in: 900,
-        }),
-      );
-
-      const result = await requestDeviceCode(TEST_CONFIG);
-      expect(result.interval).toBe(5);
-    });
-
-    test("omits audience when not configured", async () => {
-      let capturedBody = "";
-      mockFetch(async (_url, init) => {
-        capturedBody = init?.body?.toString() ?? "";
-        return jsonResponse({
-          device_code: "dev-code-123",
-          user_code: "ABCD-1234",
-          verification_uri: "https://auth.example.com/activate",
-          expires_in: 900,
-          interval: 5,
-        });
-      });
-
-      const configNoAudience: DeviceCodeConfig = {
-        ...TEST_CONFIG,
-        audience: undefined,
-      };
-      await requestDeviceCode(configNoAudience);
-
-      const params = new URLSearchParams(capturedBody);
-      expect(params.has("audience")).toBe(false);
-    });
-
-    test("throws DeviceCodeError on non-OK response", async () => {
-      mockFetch(async () => jsonResponse({ error: "invalid_client" }, 400));
-
-      await expect(requestDeviceCode(TEST_CONFIG)).rejects.toThrow(
-        DeviceCodeError,
-      );
-      try {
-        await requestDeviceCode(TEST_CONFIG);
-      } catch (err) {
-        expect(err).toBeInstanceOf(DeviceCodeError);
-        expect((err as DeviceCodeError).code).toBe("request_failed");
-      }
-    });
-  });
-
-  describe("pollForToken", () => {
-    test("returns tokens on immediate success", async () => {
-      mockFetch(async () =>
-        jsonResponse({
-          access_token: "at-123",
-          refresh_token: "rt-456",
-          expires_in: 3600,
-          token_type: "Bearer",
-          scope: "openid profile",
-        }),
-      );
-
-      const result = await pollForToken(
-        TEST_CONFIG,
-        "dev-code-123",
-        0.01, // near-zero interval for test speed
-        30,
-      );
-
-      expect(result.accessToken).toBe("at-123");
-      expect(result.refreshToken).toBe("rt-456");
-      expect(result.expiresIn).toBe(3600);
-      expect(result.tokenType).toBe("Bearer");
-      expect(result.scope).toBe("openid profile");
-    });
-
-    test("polls through authorization_pending then succeeds", async () => {
-      let callCount = 0;
-
-      mockFetch(async () => {
-        callCount++;
-        if (callCount < 3) {
-          return jsonResponse({ error: "authorization_pending" }, 403);
-        }
-        return jsonResponse({
-          access_token: "at-after-pending",
-          refresh_token: "rt-after-pending",
-          expires_in: 3600,
-        });
-      });
-
-      const result = await pollForToken(TEST_CONFIG, "dev-code-123", 0.01, 30);
-
-      expect(result.accessToken).toBe("at-after-pending");
-      expect(callCount).toBe(3);
-    });
-
-    test("increases interval on slow_down", async () => {
-      let callCount = 0;
-      const sleepDelays: number[] = [];
-
-      const fakeSleep = async (ms: number) => {
-        sleepDelays.push(ms);
-      };
-
-      mockFetch(async () => {
-        callCount++;
-        if (callCount === 1) {
-          return jsonResponse({ error: "slow_down" }, 403);
-        }
-        return jsonResponse({
-          access_token: "at-slow",
-          expires_in: 3600,
-        });
-      });
-
-      const result = await pollForToken(
-        TEST_CONFIG,
-        "dev-code-123",
-        2,
-        60,
-        undefined,
-        fakeSleep,
-      );
-
-      expect(result.accessToken).toBe("at-slow");
-      expect(callCount).toBe(2);
-      // First sleep: initial interval (2s = 2000ms)
-      expect(sleepDelays[0]).toBe(2000);
-      // Second sleep: initial interval + 5s = 7s = 7000ms (per RFC 8628)
-      expect(sleepDelays[1]).toBe(7000);
-    });
-
-    test("throws on expired_token", async () => {
-      mockFetch(async () => jsonResponse({ error: "expired_token" }, 403));
-
-      try {
-        await pollForToken(TEST_CONFIG, "dev-code-123", 0.01, 30);
-        expect(true).toBe(false); // should not reach
-      } catch (err) {
-        expect(err).toBeInstanceOf(DeviceCodeError);
-        expect((err as DeviceCodeError).code).toBe("expired_token");
-        expect((err as DeviceCodeError).message).toContain("expired");
-      }
-    });
-
-    test("throws on access_denied", async () => {
-      mockFetch(async () => jsonResponse({ error: "access_denied" }, 403));
-
-      try {
-        await pollForToken(TEST_CONFIG, "dev-code-123", 0.01, 30);
-        expect(true).toBe(false); // should not reach
-      } catch (err) {
-        expect(err).toBeInstanceOf(DeviceCodeError);
-        expect((err as DeviceCodeError).code).toBe("access_denied");
-        expect((err as DeviceCodeError).message).toContain("denied");
-      }
-    });
-
-    test("throws on abort signal", async () => {
-      const ac = new AbortController();
-      // Abort immediately
-      ac.abort();
-
-      try {
-        await pollForToken(TEST_CONFIG, "dev-code-123", 0.01, 30, ac.signal);
-        expect(true).toBe(false); // should not reach
-      } catch (err) {
-        expect(err).toBeInstanceOf(DeviceCodeError);
-        expect((err as DeviceCodeError).code).toBe("aborted");
-      }
-    });
-
-    test("aborts mid-poll when signal fires", async () => {
-      const ac = new AbortController();
-      let callCount = 0;
-
-      mockFetch(async () => {
-        callCount++;
-        // Abort after first pending response
-        if (callCount === 1) {
-          ac.abort();
-        }
-        return jsonResponse({ error: "authorization_pending" }, 403);
-      });
-
-      try {
-        await pollForToken(TEST_CONFIG, "dev-code-123", 0.01, 30, ac.signal);
-        expect(true).toBe(false); // should not reach
-      } catch (err) {
-        expect(err).toBeInstanceOf(DeviceCodeError);
-        expect((err as DeviceCodeError).code).toBe("aborted");
-      }
-    });
-
-    test("sends correct grant_type and parameters", async () => {
-      let capturedBody = "";
-
-      mockFetch(async (_url, init) => {
-        capturedBody = init?.body?.toString() ?? "";
-        return jsonResponse({
-          access_token: "at-123",
-          expires_in: 3600,
-        });
-      });
-
-      await pollForToken(TEST_CONFIG, "dev-code-xyz", 0.01, 30);
-
-      const params = new URLSearchParams(capturedBody);
-      expect(params.get("grant_type")).toBe(
-        "urn:ietf:params:oauth:grant-type:device_code",
-      );
-      expect(params.get("device_code")).toBe("dev-code-xyz");
-      expect(params.get("client_id")).toBe("test-client-id");
-    });
-
-    test("throws on unexpected error code", async () => {
-      mockFetch(async () => jsonResponse({ error: "server_error" }, 500));
-
-      try {
-        await pollForToken(TEST_CONFIG, "dev-code-123", 0.01, 30);
-        expect(true).toBe(false);
-      } catch (err) {
-        expect(err).toBeInstanceOf(DeviceCodeError);
-        expect((err as DeviceCodeError).code).toBe("request_failed");
-      }
-    });
-
-    test("retries on network error then succeeds", async () => {
-      let callCount = 0;
-
-      mockFetch(async () => {
-        callCount++;
-        if (callCount === 1) {
-          throw new Error("Network error");
-        }
-        return jsonResponse({
-          access_token: "at-retry",
-          expires_in: 3600,
-        });
-      });
-
-      const result = await pollForToken(TEST_CONFIG, "dev-code-123", 0.01, 30);
-
-      expect(result.accessToken).toBe("at-retry");
-      expect(callCount).toBe(2);
-    });
-  });
-
-  describe("startDeviceCodeFlow", () => {
-    test("runs full flow: device code request then token poll", async () => {
-      let callCount = 0;
-
-      mockFetch(async (url) => {
-        callCount++;
-        if (url === TEST_CONFIG.deviceCodeUrl) {
-          return jsonResponse({
-            device_code: "full-flow-dc",
-            user_code: "FULL-1234",
-            verification_uri: "https://auth.example.com/activate",
-            expires_in: 900,
-            interval: 0.01,
-          });
-        }
-        // Token endpoint — succeed on second poll
-        if (callCount === 2) {
-          return jsonResponse({ error: "authorization_pending" }, 403);
-        }
-        return jsonResponse({
-          access_token: "at-full-flow",
-          refresh_token: "rt-full-flow",
-          expires_in: 3600,
-        });
-      });
-
-      const result = await startDeviceCodeFlow(TEST_CONFIG);
-
-      expect(result.init.deviceCode).toBe("full-flow-dc");
-      expect(result.init.userCode).toBe("FULL-1234");
-      expect(result.init.verificationUri).toBe(
-        "https://auth.example.com/activate",
-      );
-      expect(result.tokens.accessToken).toBe("at-full-flow");
-      expect(result.tokens.refreshToken).toBe("rt-full-flow");
-    });
-
-    test("propagates abort signal to poll", async () => {
-      const ac = new AbortController();
-
-      mockFetch(async (url) => {
-        if (url === TEST_CONFIG.deviceCodeUrl) {
-          return jsonResponse({
-            device_code: "abort-dc",
-            user_code: "ABRT-1234",
-            verification_uri: "https://auth.example.com/activate",
-            expires_in: 900,
-            interval: 0.01,
-          });
-        }
-        // Abort before returning token
-        ac.abort();
-        return jsonResponse({ error: "authorization_pending" }, 403);
-      });
-
-      try {
-        await startDeviceCodeFlow(TEST_CONFIG, ac.signal);
-        expect(true).toBe(false);
-      } catch (err) {
-        expect(err).toBeInstanceOf(DeviceCodeError);
-        expect((err as DeviceCodeError).code).toBe("aborted");
-      }
-    });
-  });
-});