@vellumai/assistant 0.4.16 → 0.4.18

package/src/__tests__/credential-broker.test.ts

@@ -1,19 +1,21 @@
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { afterEach,beforeEach, describe, expect, test } from 'bun:test';
-
-import { CredentialBroker } from '../tools/credentials/broker.js';
-import { _setMetadataPath,upsertCredentialMetadata } from '../tools/credentials/metadata-store.js';
-
-describe('CredentialBroker', () => {
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { CredentialBroker } from "../tools/credentials/broker.js";
+import {
+  _setMetadataPath,
+  upsertCredentialMetadata,
+} from "../tools/credentials/metadata-store.js";
+
+describe("CredentialBroker", () => {
   let broker: CredentialBroker;
   let tmpDir: string;
 
   beforeEach(() => {
-    tmpDir = mkdtempSync(join(tmpdir(), 'broker-test-'));
-    _setMetadataPath(join(tmpDir, 'metadata.json'));
+    tmpDir = mkdtempSync(join(tmpdir(), "broker-test-"));
+    _setMetadataPath(join(tmpDir, "metadata.json"));
     broker = new CredentialBroker();
   });
 
@@ -22,70 +24,84 @@ describe('CredentialBroker', () => {
     rmSync(tmpDir, { recursive: true, force: true });
   });
 
-  describe('authorize', () => {
-    test('denies when no credential metadata exists', () => {
+  describe("authorize", () => {
+    test("denies when no credential metadata exists", () => {
       const result = broker.authorize({
-        service: 'github',
-        field: 'token',
-        toolName: 'browser_fill_credential',
+        service: "github",
+        field: "token",
+        toolName: "browser_fill_credential",
       });
       expect(result.authorized).toBe(false);
       if (!result.authorized) {
-        expect(result.reason).toContain('No credential found');
+        expect(result.reason).toContain("No credential found");
       }
     });
 
-    test('authorizes when tool is in allowedTools', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['browser_fill_credential'] });
+    test("authorizes when tool is in allowedTools", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["browser_fill_credential"],
+      });
       const result = broker.authorize({
-        service: 'github',
-        field: 'token',
-        toolName: 'browser_fill_credential',
+        service: "github",
+        field: "token",
+        toolName: "browser_fill_credential",
       });
       expect(result.authorized).toBe(true);
       if (result.authorized) {
-        expect(result.token.service).toBe('github');
-        expect(result.token.field).toBe('token');
-        expect(result.token.toolName).toBe('browser_fill_credential');
+        expect(result.token.service).toBe("github");
+        expect(result.token.field).toBe("token");
+        expect(result.token.toolName).toBe("browser_fill_credential");
         expect(result.token.consumed).toBe(false);
         expect(result.token.tokenId).toBeTruthy();
       }
     });
 
-    test('denies when tool is not in allowedTools', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['other_tool'] });
+    test("denies when tool is not in allowedTools", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["other_tool"],
+      });
       const result = broker.authorize({
-        service: 'github',
-        field: 'token',
-        toolName: 'browser_fill_credential',
+        service: "github",
+        field: "token",
+        toolName: "browser_fill_credential",
       });
       expect(result.authorized).toBe(false);
       if (!result.authorized) {
-        expect(result.reason).toContain('not allowed');
-        expect(result.reason).toContain('browser_fill_credential');
-        expect(result.reason).toContain('Allowed tools: other_tool');
+        expect(result.reason).toContain("not allowed");
+        expect(result.reason).toContain("browser_fill_credential");
+        expect(result.reason).toContain("Allowed tools: other_tool");
       }
     });
 
-    test('denies when allowedTools is empty (fail-closed)', () => {
-      upsertCredentialMetadata('github', 'token');
+    test("denies when allowedTools is empty (fail-closed)", () => {
+      upsertCredentialMetadata("github", "token");
       const result = broker.authorize({
-        service: 'github',
-        field: 'token',
-        toolName: 'browser_fill_credential',
+        service: "github",
+        field: "token",
+        toolName: "browser_fill_credential",
       });
       expect(result.authorized).toBe(false);
       if (!result.authorized) {
-        expect(result.reason).toContain('not allowed');
-        expect(result.reason).toContain('No tools are currently allowed');
-        expect(result.reason).toContain('credential_store');
+        expect(result.reason).toContain("not allowed");
+        expect(result.reason).toContain("No tools are currently allowed");
+        expect(result.reason).toContain("credential_store");
       }
     });
 
-    test('issues unique token IDs', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['tool1', 'tool2'] });
-      const r1 = broker.authorize({ service: 'github', field: 'token', toolName: 'tool1' });
-      const r2 = broker.authorize({ service: 'github', field: 'token', toolName: 'tool2' });
+    test("issues unique token IDs", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["tool1", "tool2"],
+      });
+      const r1 = broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "tool1",
+      });
+      const r2 = broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "tool2",
+      });
       expect(r1.authorized).toBe(true);
       expect(r2.authorized).toBe(true);
       if (r1.authorized && r2.authorized) {
@@ -94,40 +110,58 @@ describe('CredentialBroker', () => {
     });
   });
 
-  describe('consume', () => {
-    test('returns storage key on first consumption', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['browser_fill_credential'] });
-      const auth = broker.authorize({ service: 'github', field: 'token', toolName: 'browser_fill_credential' });
+  describe("consume", () => {
+    test("returns storage key on first consumption", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["browser_fill_credential"],
+      });
+      const auth = broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "browser_fill_credential",
+      });
       expect(auth.authorized).toBe(true);
       if (!auth.authorized) return;
 
       const result = broker.consume(auth.token.tokenId);
       expect(result.success).toBe(true);
-      expect(result.storageKey).toBe('credential:github:token');
+      expect(result.storageKey).toBe("credential:github:token");
     });
 
-    test('rejects double consumption', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['browser_fill_credential'] });
-      const auth = broker.authorize({ service: 'github', field: 'token', toolName: 'browser_fill_credential' });
+    test("rejects double consumption", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["browser_fill_credential"],
+      });
+      const auth = broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "browser_fill_credential",
+      });
       if (!auth.authorized) return;
 
       broker.consume(auth.token.tokenId);
       const result = broker.consume(auth.token.tokenId);
       expect(result.success).toBe(false);
-      expect(result.reason).toContain('already consumed');
+      expect(result.reason).toContain("already consumed");
     });
 
-    test('rejects unknown token ID', () => {
-      const result = broker.consume('nonexistent-token');
+    test("rejects unknown token ID", () => {
+      const result = broker.consume("nonexistent-token");
       expect(result.success).toBe(false);
-      expect(result.reason).toContain('not found');
+      expect(result.reason).toContain("not found");
     });
   });
 
-  describe('revoke', () => {
-    test('revokes existing token', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['browser_fill_credential'] });
-      const auth = broker.authorize({ service: 'github', field: 'token', toolName: 'browser_fill_credential' });
+  describe("revoke", () => {
+    test("revokes existing token", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["browser_fill_credential"],
+      });
+      const auth = broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "browser_fill_credential",
+      });
       if (!auth.authorized) return;
 
       expect(broker.revoke(auth.token.tokenId)).toBe(true);
@@ -136,16 +170,26 @@ describe('CredentialBroker', () => {
       expect(result.success).toBe(false);
     });
 
-    test('returns false for unknown token', () => {
-      expect(broker.revoke('nonexistent')).toBe(false);
+    test("returns false for unknown token", () => {
+      expect(broker.revoke("nonexistent")).toBe(false);
     });
   });
 
-  describe('revokeAll', () => {
-    test('clears all active tokens', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['tool1', 'tool2'] });
-      broker.authorize({ service: 'github', field: 'token', toolName: 'tool1' });
-      broker.authorize({ service: 'github', field: 'token', toolName: 'tool2' });
+  describe("revokeAll", () => {
+    test("clears all active tokens", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["tool1", "tool2"],
+      });
+      broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "tool1",
+      });
+      broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "tool2",
+      });
       expect(broker.activeTokenCount).toBe(2);
 
       broker.revokeAll();
@@ -153,11 +197,21 @@ describe('CredentialBroker', () => {
     });
   });
 
-  describe('activeTokenCount', () => {
-    test('counts only unconsumed tokens', () => {
-      upsertCredentialMetadata('github', 'token', { allowedTools: ['tool1', 'tool2'] });
-      const auth1 = broker.authorize({ service: 'github', field: 'token', toolName: 'tool1' });
-      broker.authorize({ service: 'github', field: 'token', toolName: 'tool2' });
+  describe("activeTokenCount", () => {
+    test("counts only unconsumed tokens", () => {
+      upsertCredentialMetadata("github", "token", {
+        allowedTools: ["tool1", "tool2"],
+      });
+      const auth1 = broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "tool1",
+      });
+      broker.authorize({
+        service: "github",
+        field: "token",
+        toolName: "tool2",
+      });
       expect(broker.activeTokenCount).toBe(2);
 
       if (auth1.authorized) {

package/src/__tests__/credential-host-pattern-match.test.ts

@@ -1,105 +1,125 @@
-import { describe, expect, test } from 'bun:test';
+import { describe, expect, test } from "bun:test";
 
 import {
   compareMatchSpecificity,
   type HostMatchKind,
   matchHostPattern,
-} from '../tools/credentials/host-pattern-match.js';
+} from "../tools/credentials/host-pattern-match.js";
 
-describe('matchHostPattern', () => {
+describe("matchHostPattern", () => {
   // -- Exact matches --------------------------------------------------------
 
   test('exact match returns "exact"', () => {
-    expect(matchHostPattern('api.fal.run', 'api.fal.run')).toBe('exact');
+    expect(matchHostPattern("api.fal.run", "api.fal.run")).toBe("exact");
   });
 
-  test('exact match is case-insensitive', () => {
-    expect(matchHostPattern('API.FAL.RUN', 'api.fal.run')).toBe('exact');
-    expect(matchHostPattern('api.fal.run', 'API.FAL.RUN')).toBe('exact');
+  test("exact match is case-insensitive", () => {
+    expect(matchHostPattern("API.FAL.RUN", "api.fal.run")).toBe("exact");
+    expect(matchHostPattern("api.fal.run", "API.FAL.RUN")).toBe("exact");
   });
 
   // -- Wildcard matches (subdomain) ----------------------------------------
 
-  test('*.fal.run matches api.fal.run', () => {
-    expect(matchHostPattern('api.fal.run', '*.fal.run')).toBe('wildcard');
+  test("*.fal.run matches api.fal.run", () => {
+    expect(matchHostPattern("api.fal.run", "*.fal.run")).toBe("wildcard");
   });
 
-  test('*.fal.run matches deep.sub.fal.run', () => {
-    expect(matchHostPattern('deep.sub.fal.run', '*.fal.run')).toBe('wildcard');
+  test("*.fal.run matches deep.sub.fal.run", () => {
+    expect(matchHostPattern("deep.sub.fal.run", "*.fal.run")).toBe("wildcard");
   });
 
-  test('wildcard match is case-insensitive', () => {
-    expect(matchHostPattern('API.FAL.RUN', '*.fal.run')).toBe('wildcard');
+  test("wildcard match is case-insensitive", () => {
+    expect(matchHostPattern("API.FAL.RUN", "*.fal.run")).toBe("wildcard");
   });
 
   // -- Wildcard does NOT match apex by default ------------------------------
 
-  test('*.fal.run does NOT match fal.run by default', () => {
-    expect(matchHostPattern('fal.run', '*.fal.run')).toBe('none');
+  test("*.fal.run does NOT match fal.run by default", () => {
+    expect(matchHostPattern("fal.run", "*.fal.run")).toBe("none");
   });
 
   // -- Wildcard matches apex when includeApexForWildcard = true -------------
 
-  test('*.fal.run matches fal.run when apex inclusion enabled', () => {
-    expect(matchHostPattern('fal.run', '*.fal.run', { includeApexForWildcard: true })).toBe('wildcard');
+  test("*.fal.run matches fal.run when apex inclusion enabled", () => {
+    expect(
+      matchHostPattern("fal.run", "*.fal.run", {
+        includeApexForWildcard: true,
+      }),
+    ).toBe("wildcard");
   });
 
-  test('apex inclusion is case-insensitive', () => {
-    expect(matchHostPattern('FAL.RUN', '*.fal.run', { includeApexForWildcard: true })).toBe('wildcard');
+  test("apex inclusion is case-insensitive", () => {
+    expect(
+      matchHostPattern("FAL.RUN", "*.fal.run", {
+        includeApexForWildcard: true,
+      }),
+    ).toBe("wildcard");
   });
 
   // -- Security: no partial suffix matches ----------------------------------
 
-  test('*.fal.run does NOT match evil.fal.run.attacker.com', () => {
-    expect(matchHostPattern('evil.fal.run.attacker.com', '*.fal.run')).toBe('none');
+  test("*.fal.run does NOT match evil.fal.run.attacker.com", () => {
+    expect(matchHostPattern("evil.fal.run.attacker.com", "*.fal.run")).toBe(
+      "none",
+    );
   });
 
-  test('*.fal.run does NOT match notfal.run', () => {
-    expect(matchHostPattern('notfal.run', '*.fal.run')).toBe('none');
-    expect(matchHostPattern('notfal.run', '*.fal.run', { includeApexForWildcard: true })).toBe('none');
+  test("*.fal.run does NOT match notfal.run", () => {
+    expect(matchHostPattern("notfal.run", "*.fal.run")).toBe("none");
+    expect(
+      matchHostPattern("notfal.run", "*.fal.run", {
+        includeApexForWildcard: true,
+      }),
+    ).toBe("none");
   });
 
   // -- No match -------------------------------------------------------------
 
   test('returns "none" for completely different hosts', () => {
-    expect(matchHostPattern('api.openai.com', '*.fal.run')).toBe('none');
+    expect(matchHostPattern("api.openai.com", "*.fal.run")).toBe("none");
   });
 
   test('returns "none" for non-wildcard pattern that does not match', () => {
-    expect(matchHostPattern('other.fal.run', 'api.fal.run')).toBe('none');
+    expect(matchHostPattern("other.fal.run", "api.fal.run")).toBe("none");
   });
 });
 
-describe('compareMatchSpecificity', () => {
-  test('exact is more specific than wildcard', () => {
-    expect(compareMatchSpecificity('exact', 'wildcard')).toBeLessThan(0);
+describe("compareMatchSpecificity", () => {
+  test("exact is more specific than wildcard", () => {
+    expect(compareMatchSpecificity("exact", "wildcard")).toBeLessThan(0);
   });
 
-  test('wildcard is more specific than none', () => {
-    expect(compareMatchSpecificity('wildcard', 'none')).toBeLessThan(0);
+  test("wildcard is more specific than none", () => {
+    expect(compareMatchSpecificity("wildcard", "none")).toBeLessThan(0);
   });
 
-  test('exact is more specific than none', () => {
-    expect(compareMatchSpecificity('exact', 'none')).toBeLessThan(0);
+  test("exact is more specific than none", () => {
+    expect(compareMatchSpecificity("exact", "none")).toBeLessThan(0);
   });
 
-  test('same kind returns 0', () => {
-    expect(compareMatchSpecificity('exact', 'exact')).toBe(0);
-    expect(compareMatchSpecificity('wildcard', 'wildcard')).toBe(0);
-    expect(compareMatchSpecificity('none', 'none')).toBe(0);
+  test("same kind returns 0", () => {
+    expect(compareMatchSpecificity("exact", "exact")).toBe(0);
+    expect(compareMatchSpecificity("wildcard", "wildcard")).toBe(0);
+    expect(compareMatchSpecificity("none", "none")).toBe(0);
   });
 
-  test('none is less specific than wildcard', () => {
-    expect(compareMatchSpecificity('none', 'wildcard')).toBeGreaterThan(0);
+  test("none is less specific than wildcard", () => {
+    expect(compareMatchSpecificity("none", "wildcard")).toBeGreaterThan(0);
   });
 
-  test('wildcard is less specific than exact', () => {
-    expect(compareMatchSpecificity('wildcard', 'exact')).toBeGreaterThan(0);
+  test("wildcard is less specific than exact", () => {
+    expect(compareMatchSpecificity("wildcard", "exact")).toBeGreaterThan(0);
   });
 
-  test('can be used to sort matches by specificity (most specific first)', () => {
-    const matches: HostMatchKind[] = ['none', 'exact', 'wildcard', 'none', 'exact'];
+  test("can be used to sort matches by specificity (most specific first)", () => {
+    const matches: HostMatchKind[] = [
+      "none",
+      "exact",
+      "wildcard",
+      "none",
+      "exact",
+    ];
     const sorted = [...matches].sort(compareMatchSpecificity);
-    expect(sorted).toEqual(['exact', 'exact', 'wildcard', 'none', 'none']);
+    expect(sorted).toEqual(["exact", "exact", "wildcard", "none", "none"]);
   });
 });