@vellumai/assistant 0.6.4 → 0.6.6

package/src/__tests__/oauth-store.test.ts

@@ -61,7 +61,6 @@ function seedTestProvider(provider = "github"): void {
       authorizeUrl: `https://${provider}.example.com/authorize`,
       tokenExchangeUrl: `https://${provider}.example.com/token`,
       defaultScopes: ["read"],
-      scopePolicy: {},
     },
   ]);
 }
@@ -99,14 +98,13 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/login/oauth/authorize",
           tokenExchangeUrl: "https://github.com/login/oauth/access_token",
           defaultScopes: ["repo", "user"],
-          scopePolicy: { required: ["repo"] },
         },
         {
           provider: "google",
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid", "email"],
-          scopePolicy: {},
+
           authorizeParams: { access_type: "offline" },
         },
       ]);
@@ -119,7 +117,6 @@ describe("provider operations", () => {
         "https://github.com/login/oauth/access_token",
       );
       expect(JSON.parse(gh!.defaultScopes)).toEqual(["repo", "user"]);
-      expect(JSON.parse(gh!.scopePolicy)).toEqual({ required: ["repo"] });
 
       const goog = getProvider("google");
       expect(goog).toBeDefined();
@@ -136,7 +133,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/login/oauth/authorize",
           tokenExchangeUrl: "https://github.com/login/oauth/access_token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
+
           baseUrl: "https://api.github.com",
         },
       ]);
@@ -153,7 +150,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/login/oauth/authorize-v2",
           tokenExchangeUrl: "https://github.com/login/oauth/access_token-v2",
           defaultScopes: ["repo", "user"],
-          scopePolicy: { required: ["repo"] },
           baseUrl: "https://api.github.com/v2",
         },
       ]);
@@ -167,11 +163,12 @@ describe("provider operations", () => {
       expect(row!.tokenExchangeUrl).toBe(
         "https://github.com/login/oauth/access_token-v2",
       );
-      // User-customizable fields (baseUrl, defaultScopes, scopePolicy) are
-      // preserved from the original insert — not overwritten on re-seed.
+      // User-customizable fields (baseUrl) are preserved from
+      // the original insert — not overwritten on re-seed.
       expect(row!.baseUrl).toBe("https://api.github.com");
-      expect(JSON.parse(row!.defaultScopes)).toEqual(["repo"]);
-      expect(JSON.parse(row!.scopePolicy)).toEqual({});
+      // defaultScopes ARE overwritten on re-seed so upstream scope additions
+      // propagate to existing installations.
+      expect(JSON.parse(row!.defaultScopes)).toEqual(["repo", "user"]);
       // createdAt should be preserved from the original insert
       expect(row!.createdAt).toBe(originalCreatedAt);
     });
@@ -183,7 +180,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
+
           pingUrl: "https://api.github.com/user",
         },
       ]);
@@ -198,7 +195,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
       const row = getProvider("github");
@@ -214,7 +210,8 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://github.com/token",
           tokenEndpointAuthMethod: "client_secret_post",
           defaultScopes: ["repo"],
-          scopePolicy: { required: ["repo"] },
+          availableScopes:
+            "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps",
           userinfoUrl: "https://api.github.com/user",
           baseUrl: "https://api.github.com",
           authorizeParams: { prompt: "consent" },
@@ -228,10 +225,6 @@ describe("provider operations", () => {
       db.update(oauthProviders)
         .set({
           defaultScopes: JSON.stringify(["repo", "user", "gist"]),
-          scopePolicy: JSON.stringify({
-            required: ["repo"],
-            allowAdditionalScopes: true,
-          }),
           baseUrl: "https://custom.github.com/api",
         })
         .where(eq(oauthProviders.provider, "github"))
@@ -254,7 +247,9 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://github.com/token-v2",
           tokenEndpointAuthMethod: "client_secret_basic",
           defaultScopes: ["repo-only"],
-          scopePolicy: {},
+          availableScopes:
+            "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps-v2",
+
           userinfoUrl: "https://api.github.com/user-v2",
           baseUrl: "https://api.github.com/v2",
           authorizeParams: { prompt: "login" },
@@ -266,12 +261,12 @@ describe("provider operations", () => {
       const row = getProvider("github");
       expect(row).toBeDefined();
 
-      // User-customizable fields should retain their manual values
-      expect(JSON.parse(row!.defaultScopes)).toEqual(["repo", "user", "gist"]);
-      expect(JSON.parse(row!.scopePolicy)).toEqual({
-        required: ["repo"],
-        allowAdditionalScopes: true,
-      });
+      // defaultScopes are overwritten by the seed data
+      expect(JSON.parse(row!.defaultScopes)).toEqual(["repo-only"]);
+      // availableScopes is overwritten on re-seed
+      expect(JSON.parse(row!.availableScopes!)).toBe(
+        "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps-v2",
+      );
       expect(row!.baseUrl).toBe("https://custom.github.com/api");
 
       // Implementation fields should be overwritten from the seed data
@@ -290,7 +285,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: ["read", "write"],
-          scopePolicy: {},
+
           scopeSeparator: ",",
         },
       ]);
@@ -307,7 +302,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -323,7 +317,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
+
           scopeSeparator: " ",
         },
       ]);
@@ -339,7 +333,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
+
           scopeSeparator: ",",
         },
       ]);
@@ -356,7 +350,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           refreshUrl: "https://refresh.example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -372,7 +365,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -389,7 +381,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           refreshUrl: "https://refresh.example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -398,7 +389,7 @@ describe("provider operations", () => {
 
       // Re-seed with a different refreshUrl — it should be overwritten,
       // proving refreshUrl is in the onConflictDoUpdate set clause (not
-      // preserved like defaultScopes).
+      // preserved like baseUrl).
       seedProviders([
         {
           provider: "test-provider",
@@ -406,7 +397,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           refreshUrl: "https://refresh-v2.example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -423,7 +413,6 @@ describe("provider operations", () => {
           revokeUrl: "https://revoke.example.com",
           revokeBodyTemplate: { token: "{access_token}" },
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -442,7 +431,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -459,7 +447,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid"],
-          scopePolicy: {},
+
           logoUrl: "https://cdn.simpleicons.org/google",
         },
       ]);
@@ -476,7 +464,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid"],
-          scopePolicy: {},
+
           logoUrl: "https://cdn.simpleicons.org/google",
         },
       ]);
@@ -494,7 +482,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid"],
-          scopePolicy: {},
+
           logoUrl: "https://cdn.simpleicons.org/google-v2",
         },
       ]);
@@ -511,7 +499,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           revokeUrl: "https://revoke.example.com",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -520,7 +507,7 @@ describe("provider operations", () => {
 
       // Re-seed with a different revokeUrl — it should be overwritten,
       // proving revokeUrl is in the onConflictDoUpdate set clause (not
-      // preserved like defaultScopes).
+      // preserved like baseUrl).
       seedProviders([
         {
           provider: "test-provider",
@@ -528,7 +515,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           revokeUrl: "https://revoke-v2.example.com",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -583,7 +569,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: [],
-          scopePolicy: {},
+
           // Note: tokenEndpointAuthMethod intentionally omitted
         },
       ]);
@@ -599,7 +585,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: [],
-          scopePolicy: {},
+
           // Note: tokenExchangeBodyFormat intentionally omitted
         },
       ]);
@@ -615,7 +601,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: [],
-          scopePolicy: {},
+
           tokenExchangeBodyFormat: "json",
         },
       ]);
@@ -632,8 +618,8 @@ describe("provider operations", () => {
       raw.exec(`
         INSERT INTO oauth_providers (
           provider_key, auth_url, token_url, token_endpoint_auth_method,
-          default_scopes, scope_policy, scope_separator, requires_client_secret,
-          created_at, updated_at
+          default_scopes, scope_policy, available_scopes, scope_separator,
+          requires_client_secret, created_at, updated_at
         ) VALUES (
           'legacy-null-provider',
           'https://example.com/authorize',
@@ -641,6 +627,7 @@ describe("provider operations", () => {
           NULL,
           '[]',
           '{}',
+          NULL,
           ' ',
           1,
           ${Date.now()},
@@ -668,7 +655,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           tokenEndpointAuthMethod: "client_secret_basic",
           defaultScopes: [],
-          scopePolicy: {},
         },
       ]);
 
@@ -689,7 +675,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -710,7 +695,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       expect(row.provider).toBe("linear");
@@ -727,7 +711,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       expect(() =>
@@ -736,7 +719,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         }),
       ).toThrow(/already exists.*linear/);
     });
@@ -747,7 +729,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         scopeSeparator: ";",
       });
 
@@ -762,7 +744,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -777,7 +758,6 @@ describe("provider operations", () => {
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         refreshUrl: "https://api.linear.app/oauth/refresh",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -791,7 +771,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -807,7 +786,6 @@ describe("provider operations", () => {
         revokeUrl: "https://api.linear.app/oauth/revoke",
         revokeBodyTemplate: { token: "{access_token}" },
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -824,7 +802,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         // Note: tokenEndpointAuthMethod intentionally omitted
       });
       expect(row.tokenEndpointAuthMethod).toBe("client_secret_post");
@@ -839,7 +817,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         tokenEndpointAuthMethod: "client_secret_basic",
       });
       expect(row.tokenEndpointAuthMethod).toBe("client_secret_basic");
@@ -851,7 +829,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         // Note: tokenExchangeBodyFormat intentionally omitted
       });
       expect(row.tokenExchangeBodyFormat).toBe("form");
@@ -866,7 +844,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         tokenExchangeBodyFormat: "json",
       });
       expect(row.tokenExchangeBodyFormat).toBe("json");
@@ -878,7 +856,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
         tokenExchangeUrl: "https://api.notion.com/v1/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         logoUrl: "https://cdn.simpleicons.org/notion",
       });
 
@@ -893,7 +871,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -910,7 +887,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -935,7 +911,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
+
           scopeSeparator: ",",
         },
       ]);
@@ -955,7 +931,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -984,7 +959,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://github.com/token",
           refreshUrl: "https://github.com/login/oauth/refresh",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1010,7 +984,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1034,7 +1007,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1069,7 +1041,6 @@ describe("provider operations", () => {
           revokeUrl: "https://github.com/login/oauth/revoke",
           revokeBodyTemplate: { token: "{access_token}" },
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1100,7 +1071,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           tokenEndpointAuthMethod: "client_secret_basic",
           defaultScopes: [],
-          scopePolicy: {},
         },
       ]);
 
@@ -1126,7 +1096,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           tokenExchangeBodyFormat: "json",
           defaultScopes: [],
-          scopePolicy: {},
         },
       ]);
 
@@ -1150,7 +1119,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       expect(getProvider("linear")!.logoUrl).toBeNull();
@@ -1171,7 +1139,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
         tokenExchangeUrl: "https://api.notion.com/v1/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         logoUrl: "https://cdn.simpleicons.org/notion",
       });
 
@@ -1192,7 +1160,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
         tokenExchangeUrl: "https://api.notion.com/v1/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         logoUrl: "https://cdn.simpleicons.org/notion",
       });
 
@@ -1218,7 +1186,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
+
           scopeSeparator: "",
         },
       ]);
@@ -1233,7 +1201,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         scopeSeparator: "",
       });
 
@@ -2045,7 +2013,7 @@ describe("disconnectOAuthProvider", () => {
         authorizeUrl: `https://${provider}.example.com/authorize`,
         tokenExchangeUrl: `https://${provider}.example.com/token`,
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         ...(revokeUrl ? { revokeUrl } : {}),
         ...(revokeBodyTemplate ? { revokeBodyTemplate } : {}),
       },
@@ -2339,7 +2307,7 @@ describe("disconnectOAuthProvider", () => {
         authorizeUrl: "https://google.example.com/authorize",
         tokenExchangeUrl: "https://google.example.com/token",
         defaultScopes: ["email"],
-        scopePolicy: {},
+
         revokeUrl: "https://oauth2.googleapis.com/revoke",
         revokeBodyTemplate: {
           token: "{access_token}",

package/src/__tests__/oauth2-gateway-transport.test.ts

@@ -280,18 +280,23 @@ describe("OAuth2 gateway transport", () => {
     test("uses loopback transport when explicitly specified", async () => {
       mockPublicBaseUrl = "https://gw.example.com";
 
-      let capturedAuthUrl = "";
+      let resolveOpenUrl!: (url: string) => void;
+      const openUrlPromise = new Promise<string>((resolve) => {
+        resolveOpenUrl = resolve;
+      });
       const flowPromise = startOAuth2Flow(
         BASE_OAUTH_CONFIG,
         {
           openUrl: (url) => {
-            capturedAuthUrl = url;
+            resolveOpenUrl(url);
           },
         },
         { callbackTransport: "loopback" },
       );
 
-      await new Promise((r) => setTimeout(r, 50));
+      // Wait for the loopback server to bind and build the auth URL.
+      // Awaiting the openUrl callback instead of a fixed timer avoids CI-load flakes.
+      const capturedAuthUrl = await openUrlPromise;
 
       // Should use loopback redirect even though gateway URL is available
       expect(capturedAuthUrl).toMatch(/localhost|127\.0\.0\.1/);