@vellumai/assistant 0.5.1 → 0.5.3

package/src/oauth/byo-connection.ts

@@ -25,31 +25,25 @@ export interface BYOOAuthConnectionOptions {
   providerKey: string;
   baseUrl: string;
   accountInfo: string | null;
-  grantedScopes: string[];
-  credentialService: string;
 }
 
 export class BYOOAuthConnection implements OAuthConnection {
   readonly id: string;
   readonly providerKey: string;
   readonly accountInfo: string | null;
-  readonly grantedScopes: string[];
 
   private readonly baseUrl: string;
-  private readonly credentialService: string;
 
   constructor(opts: BYOOAuthConnectionOptions) {
     this.id = opts.id;
     this.providerKey = opts.providerKey;
     this.baseUrl = opts.baseUrl;
     this.accountInfo = opts.accountInfo;
-    this.grantedScopes = opts.grantedScopes;
-    this.credentialService = opts.credentialService;
   }
 
   async request(req: OAuthConnectionRequest): Promise<OAuthConnectionResponse> {
     return withValidToken(
-      this.credentialService,
+      this.providerKey,
       async (token) => {
         const effectiveBaseUrl = req.baseUrl ?? this.baseUrl;
         let fullUrl = `${effectiveBaseUrl}${req.path}`;
@@ -106,7 +100,7 @@ export class BYOOAuthConnection implements OAuthConnection {
   }
 
   async withToken<T>(fn: (token: string) => Promise<T>): Promise<T> {
-    return withValidToken(this.credentialService, fn, {
+    return withValidToken(this.providerKey, fn, {
       connectionId: this.id,
     });
   }

package/src/oauth/connect-orchestrator.ts

@@ -252,12 +252,13 @@ export async function orchestrateOAuthConnect(
       prepared.completion
         .then(async (result) => {
           try {
-            let accountInfo: string | undefined;
+            let parsedAccountIdentifier: string | undefined;
 
-            // Run identity verifier if available (code-side behavior)
+            // Parse account identifier from the provider's identity endpoint.
+            // Best-effort — format varies by provider and may fail.
             if (behavior.identityVerifier) {
               try {
-                accountInfo = await behavior.identityVerifier(
+                parsedAccountIdentifier = await behavior.identityVerifier(
                   result.tokens.accessToken,
                 );
               } catch {
@@ -270,19 +271,19 @@ export async function orchestrateOAuthConnect(
               tokens: result.tokens,
               grantedScopes: result.grantedScopes,
               rawTokenResponse: result.rawTokenResponse,
-              identityAccountInfo: accountInfo,
+              parsedAccountIdentifier,
             });
             log.info(
               {
                 service: resolvedService,
-                accountInfo: stored.accountInfo ?? accountInfo,
+                accountInfo: stored.accountInfo ?? parsedAccountIdentifier,
               },
               "Deferred OAuth2 flow completed — tokens stored",
             );
             options.onDeferredComplete?.({
               success: true,
               service: resolvedService,
-              accountInfo: stored.accountInfo ?? accountInfo,
+              accountInfo: stored.accountInfo ?? parsedAccountIdentifier,
             });
           } catch (err) {
             log.error(
@@ -353,11 +354,14 @@ export async function orchestrateOAuthConnect(
           : undefined,
     );
 
-    // Run identity verifier if available (code-side behavior)
-    let verifiedIdentity: string | undefined;
+    // Parse account identifier from the provider's identity endpoint.
+    // Best-effort — format varies by provider and may fail.
+    let parsedAccountIdentifier: string | undefined;
     if (behavior.identityVerifier) {
       try {
-        verifiedIdentity = await behavior.identityVerifier(tokens.accessToken);
+        parsedAccountIdentifier = await behavior.identityVerifier(
+          tokens.accessToken,
+        );
       } catch {
         // Non-fatal
       }
@@ -368,14 +372,14 @@ export async function orchestrateOAuthConnect(
       tokens,
       grantedScopes,
       rawTokenResponse,
-      identityAccountInfo: verifiedIdentity,
+      parsedAccountIdentifier,
     });
 
     return {
       success: true,
       deferred: false,
       grantedScopes,
-      accountInfo: accountInfo ?? verifiedIdentity,
+      accountInfo: accountInfo ?? parsedAccountIdentifier,
     };
   } catch (err: unknown) {
     const message =

package/src/oauth/connection-resolver.test.ts

@@ -0,0 +1,191 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mutable mock state
+// ---------------------------------------------------------------------------
+
+let mockProvider: Record<string, unknown> | undefined;
+let mockConnection: Record<string, unknown> | undefined;
+let mockAccessToken: string | undefined;
+let mockConfig: Record<string, unknown> = {};
+let mockManagedProxyCtx = {
+  enabled: false,
+  platformBaseUrl: "",
+  assistantApiKey: "",
+};
+let mockAssistantId = "";
+
+// ---------------------------------------------------------------------------
+// Module mocks (must precede imports of the module under test)
+// ---------------------------------------------------------------------------
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("./oauth-store.js", () => ({
+  getProvider: () => mockProvider,
+  getActiveConnection: (
+    _pk: string,
+    opts?: { clientId?: string; account?: string },
+  ) => {
+    if (opts?.clientId && mockConnection?.clientId !== opts.clientId)
+      return undefined;
+    if (opts?.account && mockConnection?.accountInfo !== opts.account)
+      return undefined;
+    return mockConnection;
+  },
+}));
+
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async () => mockAccessToken,
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => mockConfig,
+}));
+
+mock.module("../config/env.js", () => ({
+  getPlatformAssistantId: () => mockAssistantId,
+}));
+
+mock.module("../providers/managed-proxy/context.js", () => ({
+  resolveManagedProxyContext: async () => mockManagedProxyCtx,
+}));
+
+// ---------------------------------------------------------------------------
+// Import the module under test (after all mocks are registered)
+// ---------------------------------------------------------------------------
+
+import { BYOOAuthConnection } from "./byo-connection.js";
+import { resolveOAuthConnection } from "./connection-resolver.js";
+import { PlatformOAuthConnection } from "./platform-connection.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function setupDefaults(): void {
+  mockProvider = {
+    providerKey: "integration:google",
+    baseUrl: "https://gmail.googleapis.com/gmail/v1/users/me",
+    managedServiceConfigKey: null,
+  };
+  mockConnection = {
+    id: "conn-1",
+    providerKey: "integration:google",
+    oauthAppId: "app-1",
+    accountInfo: "user@example.com",
+    grantedScopes: JSON.stringify(["scope-a", "scope-b"]),
+    status: "active",
+    clientId: "client-1",
+  };
+  mockAccessToken = "tok-valid";
+  mockConfig = {
+    services: {
+      inference: {
+        mode: "your-own",
+        provider: "anthropic",
+        model: "claude-opus-4-6",
+      },
+      "image-generation": {
+        mode: "your-own",
+        provider: "gemini",
+        model: "gemini-3.1-flash-image-preview",
+      },
+      "web-search": { mode: "your-own", provider: "inference-provider-native" },
+      "google-oauth": { mode: "managed" },
+    },
+  };
+  mockManagedProxyCtx = {
+    enabled: true,
+    platformBaseUrl: "https://platform.example.com",
+    assistantApiKey: "sk-test-key",
+  };
+  mockAssistantId = "asst-123";
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("resolveOAuthConnection", () => {
+  beforeEach(() => {
+    setupDefaults();
+  });
+
+  test("returns BYOOAuthConnection when provider has no managedServiceConfigKey", async () => {
+    const result = await resolveOAuthConnection("integration:google");
+    expect(result).toBeInstanceOf(BYOOAuthConnection);
+    expect(result.id).toBe("conn-1");
+    expect(result.providerKey).toBe("integration:google");
+  });
+
+  test("returns PlatformOAuthConnection when managed mode is active", async () => {
+    mockProvider!.managedServiceConfigKey = "google-oauth";
+
+    const result = await resolveOAuthConnection("integration:google");
+    expect(result).toBeInstanceOf(PlatformOAuthConnection);
+    expect(result.id).toBe("integration:google");
+    expect(result.providerKey).toBe("integration:google");
+    expect(result.accountInfo).toBeNull();
+  });
+
+  test("passes account through to PlatformOAuthConnection", async () => {
+    mockProvider!.managedServiceConfigKey = "google-oauth";
+
+    const result = await resolveOAuthConnection("integration:google", {
+      account: "user@example.com",
+    });
+    expect(result).toBeInstanceOf(PlatformOAuthConnection);
+    expect(result.accountInfo).toBe("user@example.com");
+  });
+
+  test("returns BYOOAuthConnection when service config mode is your-own", async () => {
+    mockProvider!.managedServiceConfigKey = "google-oauth";
+    (mockConfig.services as Record<string, unknown>)["google-oauth"] = {
+      mode: "your-own",
+    };
+
+    const result = await resolveOAuthConnection("integration:google");
+    expect(result).toBeInstanceOf(BYOOAuthConnection);
+    expect(result.id).toBe("conn-1");
+  });
+
+  test("managed path does not require a local connection row", async () => {
+    mockProvider!.managedServiceConfigKey = "google-oauth";
+    mockConnection = undefined;
+    mockAccessToken = undefined;
+
+    const result = await resolveOAuthConnection("integration:google");
+    expect(result).toBeInstanceOf(PlatformOAuthConnection);
+  });
+
+  test("managed path ignores clientId option", async () => {
+    mockProvider!.managedServiceConfigKey = "google-oauth";
+
+    const result = await resolveOAuthConnection("integration:google", {
+      clientId: "some-client-id",
+    });
+    expect(result).toBeInstanceOf(PlatformOAuthConnection);
+  });
+
+  test("BYO path narrows by clientId when provided", async () => {
+    const result = await resolveOAuthConnection("integration:google", {
+      clientId: "client-1",
+    });
+    expect(result).toBeInstanceOf(BYOOAuthConnection);
+    expect(result.id).toBe("conn-1");
+  });
+
+  test("BYO path returns no credential when clientId does not match", async () => {
+    await expect(
+      resolveOAuthConnection("integration:google", {
+        clientId: "wrong-client",
+      }),
+    ).rejects.toThrow(/No active OAuth connection found/);
+  });
+});

package/src/oauth/connection-resolver.ts

@@ -1,72 +1,100 @@
+import { getPlatformAssistantId } from "../config/env.js";
+import { getConfig } from "../config/loader.js";
+import { type Services, ServicesSchema } from "../config/schemas/services.js";
+import { resolveManagedProxyContext } from "../providers/managed-proxy/context.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { BYOOAuthConnection } from "./byo-connection.js";
 import type { OAuthConnection } from "./connection.js";
-import {
-  getApp,
-  getConnectionByProvider,
-  getConnectionByProviderAndAccount,
-  getProvider,
-} from "./oauth-store.js";
+import { getActiveConnection, getProvider } from "./oauth-store.js";
+import { PlatformOAuthConnection } from "./platform-connection.js";
+
+export interface ResolveOAuthConnectionOptions {
+  /** OAuth app client ID — narrows to a specific app when multiple BYO apps
+   *  exist for the same provider. */
+  clientId?: string;
+  /** Account identifier (e.g. email, username) — disambiguates when multiple
+   *  accounts are connected for the same provider. Best-effort: not guaranteed
+   *  to be present on all connections. */
+  account?: string;
+}
 
 /**
- * Resolve an OAuthConnection for a given credential service.
+ * Resolve an OAuthConnection for a given provider.
+ *
+ * Managed providers (where the service config `mode` is `"managed"`) are
+ * routed through the platform proxy with no local state required.
  *
- * When `accountInfo` is provided, resolves the connection for that specific
- * account (e.g. "user@gmail.com"). Otherwise falls back to the most recent
- * active connection.
+ * BYO providers resolve from the local SQLite oauth-store and require an
+ * active connection row and a stored access token.
  *
- * Reads exclusively from the SQLite oauth-store. Throws if no connection
- * exists (authorization required).
+ * @param providerKey - Provider identifier (e.g. "integration:google").
+ *   Maps to the `provider_key` primary key in the `oauth_providers` table.
+ * @param options.clientId - Optional OAuth app client ID. When multiple BYO
+ *   apps exist for the same provider, narrows the connection lookup to the
+ *   app matching this client ID. Ignored for managed providers.
+ * @param options.account - Optional account identifier to disambiguate
+ *   multi-account connections.
  */
 export async function resolveOAuthConnection(
-  credentialService: string,
-  accountInfo?: string,
+  providerKey: string,
+  options?: ResolveOAuthConnectionOptions,
 ): Promise<OAuthConnection> {
-  const conn = accountInfo
-    ? getConnectionByProviderAndAccount(credentialService, accountInfo)
-    : getConnectionByProvider(credentialService);
+  const { clientId, account } = options ?? {};
+  const provider = getProvider(providerKey);
+  const managedKey = provider?.managedServiceConfigKey;
+
+  if (managedKey && managedKey in ServicesSchema.shape) {
+    const services: Services = getConfig().services;
+    if (services[managedKey as keyof Services].mode === "managed") {
+      const ctx = await resolveManagedProxyContext();
+      const assistantId = getPlatformAssistantId();
+      return new PlatformOAuthConnection({
+        id: providerKey,
+        providerKey,
+        externalId: providerKey,
+        accountInfo: account ?? null,
+        assistantId,
+        platformBaseUrl: ctx.platformBaseUrl,
+        apiKey: ctx.assistantApiKey,
+      });
+    }
+  }
+
+  // BYO path — requires a local connection row, access token, and base URL.
+  const conn = getActiveConnection(providerKey, { clientId, account });
   if (!conn) {
+    const filters = [
+      account && `account "${account}"`,
+      clientId && `client ID "${clientId}"`,
+    ].filter(Boolean);
+    const qualifier = filters.length
+      ? ` matching ${filters.join(" and ")}`
+      : "";
     throw new Error(
-      `No credential found for "${credentialService}". Authorization required.`,
+      `No active OAuth connection found for "${providerKey}"${qualifier}. Connect the service first with oauth2_connect.`,
     );
   }
 
   const accessToken = await getSecureKeyAsync(
     `oauth_connection/${conn.id}/access_token`,
   );
-
   if (!accessToken) {
     throw new Error(
-      `No access token found for "${credentialService}". Authorization required.`,
+      `OAuth connection for "${providerKey}" exists but has no access token. Re-authorize with oauth2_connect.`,
     );
   }
 
-  // Look up the provider by credentialService first; fall back to the
-  // connection's app's canonical providerKey so custom credential_service
-  // overrides (e.g. "integration:github-work") still resolve to the well-known
-  // provider's base URL. We traverse conn -> oauthApp -> providerKey because
-  // conn.providerKey equals credentialService (getConnectionByProvider queries
-  // WHERE providerKey = credentialService), whereas the app's providerKey is a
-  // foreign key to the oauthProviders table.
-  const provider =
-    getProvider(credentialService) ??
-    getProvider(getApp(conn.oauthAppId)?.providerKey ?? "");
   const baseUrl = provider?.baseUrl;
-
   if (!baseUrl) {
-    throw new Error(`No base URL configured for "${credentialService}".`);
+    throw new Error(
+      `OAuth provider "${providerKey}" has no base URL configured. Check provider setup.`,
+    );
   }
 
-  const grantedScopes: string[] = conn.grantedScopes
-    ? JSON.parse(conn.grantedScopes)
-    : [];
-
   return new BYOOAuthConnection({
     id: conn.id,
     providerKey: conn.providerKey,
     baseUrl,
     accountInfo: conn.accountInfo,
-    grantedScopes,
-    credentialService,
   });
 }

package/src/oauth/connection.ts

@@ -34,5 +34,4 @@ export interface OAuthConnection {
   readonly id: string;
   readonly providerKey: string;
   readonly accountInfo: string | null;
-  readonly grantedScopes: string[];
 }