@vellumai/assistant 0.6.5 → 0.6.6

package/src/__tests__/oauth-cli.test.ts

@@ -178,7 +178,9 @@ mock.module("../oauth/oauth-store.js", () => ({
       userinfoUrl: params.userinfoUrl ?? null,
       baseUrl: params.baseUrl ?? null,
       defaultScopes: JSON.stringify(params.defaultScopes ?? []),
-      scopePolicy: JSON.stringify(params.scopePolicy ?? {}),
+      availableScopes: params.availableScopes
+        ? JSON.stringify(params.availableScopes)
+        : null,
       scopeSeparator: (params.scopeSeparator as string | undefined) ?? " ",
       authorizeParams: params.authorizeParams
         ? JSON.stringify(params.authorizeParams)
@@ -554,7 +556,7 @@ describe("assistant oauth providers list", () => {
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       managedServiceConfigKey: "google-oauth",
       createdAt: "2025-01-01T00:00:00.000Z",
@@ -565,7 +567,7 @@ describe("assistant oauth providers list", () => {
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       managedServiceConfigKey: "google-calendar-oauth",
       createdAt: "2025-01-01T00:00:00.000Z",
@@ -576,7 +578,7 @@ describe("assistant oauth providers list", () => {
       authorizeUrl: "https://slack.com/oauth/v2/authorize",
       tokenExchangeUrl: "https://slack.com/api/oauth.v2.access",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       managedServiceConfigKey: null,
       createdAt: "2025-01-01T00:00:00.000Z",
@@ -587,7 +589,7 @@ describe("assistant oauth providers list", () => {
       authorizeUrl: "https://twitter.com/i/oauth2/authorize",
       tokenExchangeUrl: "https://api.twitter.com/2/oauth2/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       managedServiceConfigKey: null,
       createdAt: "2025-01-01T00:00:00.000Z",
@@ -1006,7 +1008,7 @@ describe("assistant oauth ping <provider-key>", () => {
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       createdAt: Date.now(),
       updatedAt: Date.now(),
@@ -1041,7 +1043,7 @@ describe("assistant oauth ping <provider-key>", () => {
       authorizeUrl: "urn:manual-token",
       tokenExchangeUrl: "urn:manual-token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       createdAt: Date.now(),
       updatedAt: Date.now(),
@@ -1060,7 +1062,7 @@ describe("assistant oauth ping <provider-key>", () => {
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       createdAt: Date.now(),
       updatedAt: Date.now(),
@@ -1086,7 +1088,7 @@ describe("assistant oauth ping <provider-key>", () => {
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       createdAt: Date.now(),
       updatedAt: Date.now(),
@@ -1138,7 +1140,7 @@ describe("assistant oauth connect managed mode — platform 401/403 errors", ()
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       managedServiceConfigKey: "google-oauth",
       createdAt: Date.now(),
@@ -1364,7 +1366,7 @@ describe("assistant oauth mode", () => {
       authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenExchangeUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: "[]",
-      scopePolicy: "{}",
+      availableScopes: null,
       authorizeParams: null,
       managedServiceConfigKey: "google-oauth",
       createdAt: Date.now(),
@@ -1918,7 +1920,7 @@ describe("assistant oauth providers --revoke-url and --revoke-body-template", ()
         userinfoUrl: null,
         baseUrl: null,
         defaultScopes: "[]",
-        scopePolicy: "{}",
+        availableScopes: null,
         scopeSeparator: " ",
         authorizeParams: null,
         pingUrl: null,

package/src/__tests__/oauth-connect-orchestrator.test.ts

@@ -73,16 +73,8 @@ mock.module("../oauth/token-persistence.js", () => ({
   }),
 }));
 
-// Mock scope policy — always approves
-mock.module("../oauth/scope-policy.js", () => ({
-  resolveScopes: (
-    _profile: unknown,
-    requestedScopes: string[] | undefined,
-  ) => ({
-    ok: true,
-    scopes: requestedScopes ?? ["openid", "email"],
-  }),
-}));
+// No scope policy mock needed — scope validation has been removed.
+// The orchestrator uses requestedScopes directly or falls back to defaultScopes.
 
 // Provider store mock — configurable per test
 type ProviderRow = {
@@ -95,7 +87,7 @@ type ProviderRow = {
   userinfoUrl: string | null;
   baseUrl: string | null;
   defaultScopes: string;
-  scopePolicy: string;
+  availableScopes: string | null;
   scopeSeparator: string;
   authorizeParams: string | null;
   pingUrl: string | null;
@@ -174,8 +166,7 @@ function makeProviderRow(
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: '["openid","email"]',
-    scopePolicy:
-      '{"allowAdditionalScopes":false,"allowedOptionalScopes":[],"forbiddenScopes":[]}',
+    availableScopes: null,
     scopeSeparator: " ",
     authorizeParams: null,
     pingUrl: null,

package/src/__tests__/oauth-provider-serializer.test.ts

@@ -19,7 +19,7 @@ function makeRow(overrides: Partial<OAuthProviderRow> = {}): OAuthProviderRow {
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",
-    scopePolicy: "{}",
+    availableScopes: null,
     scopeSeparator: " ",
     authorizeParams: null,
     pingUrl: null,
@@ -29,6 +29,7 @@ function makeRow(overrides: Partial<OAuthProviderRow> = {}): OAuthProviderRow {
     revokeUrl: null,
     revokeBodyTemplate: null,
     managedServiceConfigKey: null,
+    managedServiceIsPaid: false,
     displayLabel: null,
     description: null,
     dashboardUrl: null,
@@ -57,7 +58,7 @@ describe("serializeProvider", () => {
   test("parses JSON fields correctly", () => {
     const row = makeRow({
       defaultScopes: JSON.stringify(["openid", "email"]),
-      scopePolicy: JSON.stringify({ required: ["openid"] }),
+      availableScopes: JSON.stringify("https://example.com/scopes"),
       authorizeParams: JSON.stringify({ access_type: "offline" }),
       pingHeaders: JSON.stringify({ "X-Api-Version": "2" }),
       pingBody: JSON.stringify({ query: "{ me { id } }" }),
@@ -78,7 +79,7 @@ describe("serializeProvider", () => {
     const result = serializeProvider(row)!;
 
     expect(result.defaultScopes).toEqual(["openid", "email"]);
-    expect(result.scopePolicy).toEqual({ required: ["openid"] });
+    expect(result.availableScopes).toBe("https://example.com/scopes");
     expect(result.extraParams).toEqual({ access_type: "offline" });
     expect(result.pingHeaders).toEqual({ "X-Api-Version": "2" });
     expect(result.pingBody).toEqual({ query: "{ me { id } }" });
@@ -101,7 +102,7 @@ describe("serializeProvider", () => {
     const result = serializeProvider(row)!;
 
     expect(result.defaultScopes).toEqual([]);
-    expect(result.scopePolicy).toEqual({});
+    expect(result.availableScopes).toBeNull();
     expect(result.extraParams).toBeNull();
     expect(result.pingHeaders).toBeNull();
     expect(result.pingBody).toBeNull();
@@ -288,6 +289,7 @@ describe("serializeProviderSummary", () => {
       requires_client_secret: true,
       logo_url: null,
       supports_managed_mode: true,
+      managed_service_is_paid: false,
       feature_flag: null,
     });
   });

package/src/__tests__/oauth-provider-visibility.test.ts

@@ -55,7 +55,6 @@ describe("isProviderVisible", () => {
         authorizeUrl: "https://example.com/auth",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       },
     ]);
 
@@ -77,7 +76,7 @@ describe("isProviderVisible", () => {
         authorizeUrl: "https://example.com/auth",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         featureFlag: "test-gate",
       },
     ]);
@@ -100,7 +99,7 @@ describe("isProviderVisible", () => {
         authorizeUrl: "https://example.com/auth",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         featureFlag: "test-gate",
       },
     ]);
@@ -122,14 +121,13 @@ describe("isProviderVisible", () => {
         authorizeUrl: "https://example.com/auth",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       },
       {
         provider: "gated-provider",
         authorizeUrl: "https://gated.example.com/auth",
         tokenExchangeUrl: "https://gated.example.com/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         featureFlag: "test-gate",
       },
     ]);

package/src/__tests__/oauth-providers-routes.test.ts

@@ -18,7 +18,7 @@ const mockListProviders = mock(() => [
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",
-    scopePolicy: "[]",
+    availableScopes: null,
     scopeSeparator: null,
     authorizeParams: null,
 
@@ -60,7 +60,7 @@ const mockListProviders = mock(() => [
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",
-    scopePolicy: "[]",
+    availableScopes: null,
     scopeSeparator: null,
     authorizeParams: null,
 
@@ -163,6 +163,7 @@ describe("GET /v1/oauth/providers", () => {
       "requires_client_secret",
       "logo_url",
       "supports_managed_mode",
+      "managed_service_is_paid",
       "feature_flag",
     ];