@vellumai/assistant 0.6.5 → 0.7.0

package/src/__tests__/oauth-store.test.ts

@@ -23,9 +23,11 @@ mock.module("../security/secure-keys.js", () => ({
 
 import { eq } from "drizzle-orm";
 
-import { getDb, initializeDb, resetDb, resetTestTables } from "../memory/db.js";
+import { getDb, resetDb } from "../memory/db-connection.js";
 import { getSqliteFrom } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import { migrateOAuthProvidersTokenAuthMethodDefault } from "../memory/migrations/216-oauth-providers-token-auth-method.js";
+import { resetTestTables } from "../memory/raw-query.js";
 import { oauthProviders } from "../memory/schema/oauth.js";
 import {
   createConnection,
@@ -61,7 +63,6 @@ function seedTestProvider(provider = "github"): void {
       authorizeUrl: `https://${provider}.example.com/authorize`,
       tokenExchangeUrl: `https://${provider}.example.com/token`,
       defaultScopes: ["read"],
-      scopePolicy: {},
     },
   ]);
 }
@@ -99,14 +100,13 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/login/oauth/authorize",
           tokenExchangeUrl: "https://github.com/login/oauth/access_token",
           defaultScopes: ["repo", "user"],
-          scopePolicy: { required: ["repo"] },
         },
         {
           provider: "google",
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid", "email"],
-          scopePolicy: {},
+
           authorizeParams: { access_type: "offline" },
         },
       ]);
@@ -119,7 +119,6 @@ describe("provider operations", () => {
         "https://github.com/login/oauth/access_token",
       );
       expect(JSON.parse(gh!.defaultScopes)).toEqual(["repo", "user"]);
-      expect(JSON.parse(gh!.scopePolicy)).toEqual({ required: ["repo"] });
 
       const goog = getProvider("google");
       expect(goog).toBeDefined();
@@ -136,7 +135,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/login/oauth/authorize",
           tokenExchangeUrl: "https://github.com/login/oauth/access_token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
+
           baseUrl: "https://api.github.com",
         },
       ]);
@@ -153,7 +152,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/login/oauth/authorize-v2",
           tokenExchangeUrl: "https://github.com/login/oauth/access_token-v2",
           defaultScopes: ["repo", "user"],
-          scopePolicy: { required: ["repo"] },
           baseUrl: "https://api.github.com/v2",
         },
       ]);
@@ -167,10 +165,9 @@ describe("provider operations", () => {
       expect(row!.tokenExchangeUrl).toBe(
         "https://github.com/login/oauth/access_token-v2",
       );
-      // User-customizable fields (baseUrl, scopePolicy) are preserved from
+      // User-customizable fields (baseUrl) are preserved from
       // the original insert — not overwritten on re-seed.
       expect(row!.baseUrl).toBe("https://api.github.com");
-      expect(JSON.parse(row!.scopePolicy)).toEqual({});
       // defaultScopes ARE overwritten on re-seed so upstream scope additions
       // propagate to existing installations.
       expect(JSON.parse(row!.defaultScopes)).toEqual(["repo", "user"]);
@@ -185,7 +182,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
+
           pingUrl: "https://api.github.com/user",
         },
       ]);
@@ -200,7 +197,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
       const row = getProvider("github");
@@ -216,7 +212,8 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://github.com/token",
           tokenEndpointAuthMethod: "client_secret_post",
           defaultScopes: ["repo"],
-          scopePolicy: { required: ["repo"] },
+          availableScopes:
+            "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps",
           userinfoUrl: "https://api.github.com/user",
           baseUrl: "https://api.github.com",
           authorizeParams: { prompt: "consent" },
@@ -230,10 +227,6 @@ describe("provider operations", () => {
       db.update(oauthProviders)
         .set({
           defaultScopes: JSON.stringify(["repo", "user", "gist"]),
-          scopePolicy: JSON.stringify({
-            required: ["repo"],
-            allowAdditionalScopes: true,
-          }),
           baseUrl: "https://custom.github.com/api",
         })
         .where(eq(oauthProviders.provider, "github"))
@@ -256,7 +249,9 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://github.com/token-v2",
           tokenEndpointAuthMethod: "client_secret_basic",
           defaultScopes: ["repo-only"],
-          scopePolicy: {},
+          availableScopes:
+            "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps-v2",
+
           userinfoUrl: "https://api.github.com/user-v2",
           baseUrl: "https://api.github.com/v2",
           authorizeParams: { prompt: "login" },
@@ -268,13 +263,12 @@ describe("provider operations", () => {
       const row = getProvider("github");
       expect(row).toBeDefined();
 
-      // defaultScopes are overwritten by the seed data (not user-customizable)
+      // defaultScopes are overwritten by the seed data
       expect(JSON.parse(row!.defaultScopes)).toEqual(["repo-only"]);
-      // scopePolicy is user-customizable and should retain manual values
-      expect(JSON.parse(row!.scopePolicy)).toEqual({
-        required: ["repo"],
-        allowAdditionalScopes: true,
-      });
+      // availableScopes is overwritten on re-seed
+      expect(JSON.parse(row!.availableScopes!)).toBe(
+        "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps-v2",
+      );
       expect(row!.baseUrl).toBe("https://custom.github.com/api");
 
       // Implementation fields should be overwritten from the seed data
@@ -293,7 +287,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: ["read", "write"],
-          scopePolicy: {},
+
           scopeSeparator: ",",
         },
       ]);
@@ -310,7 +304,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -326,7 +319,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
+
           scopeSeparator: " ",
         },
       ]);
@@ -342,7 +335,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
+
           scopeSeparator: ",",
         },
       ]);
@@ -359,7 +352,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           refreshUrl: "https://refresh.example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -375,7 +367,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -392,7 +383,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           refreshUrl: "https://refresh.example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -401,7 +391,7 @@ describe("provider operations", () => {
 
       // Re-seed with a different refreshUrl — it should be overwritten,
       // proving refreshUrl is in the onConflictDoUpdate set clause (not
-      // preserved like scopePolicy).
+      // preserved like baseUrl).
       seedProviders([
         {
           provider: "test-provider",
@@ -409,7 +399,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           refreshUrl: "https://refresh-v2.example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -426,7 +415,6 @@ describe("provider operations", () => {
           revokeUrl: "https://revoke.example.com",
           revokeBodyTemplate: { token: "{access_token}" },
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -445,7 +433,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -462,7 +449,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid"],
-          scopePolicy: {},
+
           logoUrl: "https://cdn.simpleicons.org/google",
         },
       ]);
@@ -479,7 +466,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid"],
-          scopePolicy: {},
+
           logoUrl: "https://cdn.simpleicons.org/google",
         },
       ]);
@@ -497,7 +484,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
           tokenExchangeUrl: "https://oauth2.googleapis.com/token",
           defaultScopes: ["openid"],
-          scopePolicy: {},
+
           logoUrl: "https://cdn.simpleicons.org/google-v2",
         },
       ]);
@@ -514,7 +501,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           revokeUrl: "https://revoke.example.com",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -523,7 +509,7 @@ describe("provider operations", () => {
 
       // Re-seed with a different revokeUrl — it should be overwritten,
       // proving revokeUrl is in the onConflictDoUpdate set clause (not
-      // preserved like scopePolicy).
+      // preserved like baseUrl).
       seedProviders([
         {
           provider: "test-provider",
@@ -531,7 +517,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           revokeUrl: "https://revoke-v2.example.com",
           defaultScopes: ["read"],
-          scopePolicy: {},
         },
       ]);
 
@@ -586,7 +571,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: [],
-          scopePolicy: {},
+
           // Note: tokenEndpointAuthMethod intentionally omitted
         },
       ]);
@@ -602,7 +587,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: [],
-          scopePolicy: {},
+
           // Note: tokenExchangeBodyFormat intentionally omitted
         },
       ]);
@@ -618,7 +603,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://example.com/authorize",
           tokenExchangeUrl: "https://example.com/token",
           defaultScopes: [],
-          scopePolicy: {},
+
           tokenExchangeBodyFormat: "json",
         },
       ]);
@@ -635,8 +620,8 @@ describe("provider operations", () => {
       raw.exec(`
         INSERT INTO oauth_providers (
           provider_key, auth_url, token_url, token_endpoint_auth_method,
-          default_scopes, scope_policy, scope_separator, requires_client_secret,
-          created_at, updated_at
+          default_scopes, scope_policy, available_scopes, scope_separator,
+          requires_client_secret, created_at, updated_at
         ) VALUES (
           'legacy-null-provider',
           'https://example.com/authorize',
@@ -644,6 +629,7 @@ describe("provider operations", () => {
           NULL,
           '[]',
           '{}',
+          NULL,
           ' ',
           1,
           ${Date.now()},
@@ -671,7 +657,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           tokenEndpointAuthMethod: "client_secret_basic",
           defaultScopes: [],
-          scopePolicy: {},
         },
       ]);
 
@@ -692,7 +677,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -713,7 +697,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       expect(row.provider).toBe("linear");
@@ -730,7 +713,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       expect(() =>
@@ -739,7 +721,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
         }),
       ).toThrow(/already exists.*linear/);
     });
@@ -750,7 +731,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         scopeSeparator: ";",
       });
 
@@ -765,7 +746,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -780,7 +760,6 @@ describe("provider operations", () => {
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         refreshUrl: "https://api.linear.app/oauth/refresh",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -794,7 +773,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -810,7 +788,6 @@ describe("provider operations", () => {
         revokeUrl: "https://api.linear.app/oauth/revoke",
         revokeBodyTemplate: { token: "{access_token}" },
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -827,7 +804,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         // Note: tokenEndpointAuthMethod intentionally omitted
       });
       expect(row.tokenEndpointAuthMethod).toBe("client_secret_post");
@@ -842,7 +819,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         tokenEndpointAuthMethod: "client_secret_basic",
       });
       expect(row.tokenEndpointAuthMethod).toBe("client_secret_basic");
@@ -854,7 +831,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         // Note: tokenExchangeBodyFormat intentionally omitted
       });
       expect(row.tokenExchangeBodyFormat).toBe("form");
@@ -869,7 +846,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://example.com/authorize",
         tokenExchangeUrl: "https://example.com/token",
         defaultScopes: [],
-        scopePolicy: {},
+
         tokenExchangeBodyFormat: "json",
       });
       expect(row.tokenExchangeBodyFormat).toBe("json");
@@ -881,7 +858,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
         tokenExchangeUrl: "https://api.notion.com/v1/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         logoUrl: "https://cdn.simpleicons.org/notion",
       });
 
@@ -896,7 +873,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       const fetched = getProvider("linear");
@@ -913,7 +889,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -938,7 +913,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
+
           scopeSeparator: ",",
         },
       ]);
@@ -958,7 +933,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -987,7 +961,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://github.com/token",
           refreshUrl: "https://github.com/login/oauth/refresh",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1013,7 +986,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1037,7 +1009,6 @@ describe("provider operations", () => {
           authorizeUrl: "https://github.com/authorize",
           tokenExchangeUrl: "https://github.com/token",
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1072,7 +1043,6 @@ describe("provider operations", () => {
           revokeUrl: "https://github.com/login/oauth/revoke",
           revokeBodyTemplate: { token: "{access_token}" },
           defaultScopes: ["repo"],
-          scopePolicy: {},
         },
       ]);
 
@@ -1103,7 +1073,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           tokenEndpointAuthMethod: "client_secret_basic",
           defaultScopes: [],
-          scopePolicy: {},
         },
       ]);
 
@@ -1129,7 +1098,6 @@ describe("provider operations", () => {
           tokenExchangeUrl: "https://example.com/token",
           tokenExchangeBodyFormat: "json",
           defaultScopes: [],
-          scopePolicy: {},
         },
       ]);
 
@@ -1153,7 +1121,6 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
       });
 
       expect(getProvider("linear")!.logoUrl).toBeNull();
@@ -1174,7 +1141,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
         tokenExchangeUrl: "https://api.notion.com/v1/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         logoUrl: "https://cdn.simpleicons.org/notion",
       });
 
@@ -1195,7 +1162,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
         tokenExchangeUrl: "https://api.notion.com/v1/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         logoUrl: "https://cdn.simpleicons.org/notion",
       });
 
@@ -1221,7 +1188,7 @@ describe("provider operations", () => {
           authorizeUrl: "https://linear.app/oauth/authorize",
           tokenExchangeUrl: "https://api.linear.app/oauth/token",
           defaultScopes: ["read"],
-          scopePolicy: {},
+
           scopeSeparator: "",
         },
       ]);
@@ -1236,7 +1203,7 @@ describe("provider operations", () => {
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenExchangeUrl: "https://api.linear.app/oauth/token",
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         scopeSeparator: "",
       });
 
@@ -2048,7 +2015,7 @@ describe("disconnectOAuthProvider", () => {
         authorizeUrl: `https://${provider}.example.com/authorize`,
         tokenExchangeUrl: `https://${provider}.example.com/token`,
         defaultScopes: ["read"],
-        scopePolicy: {},
+
         ...(revokeUrl ? { revokeUrl } : {}),
         ...(revokeBodyTemplate ? { revokeBodyTemplate } : {}),
       },
@@ -2342,7 +2309,7 @@ describe("disconnectOAuthProvider", () => {
         authorizeUrl: "https://google.example.com/authorize",
         tokenExchangeUrl: "https://google.example.com/token",
         defaultScopes: ["email"],
-        scopePolicy: {},
+
         revokeUrl: "https://oauth2.googleapis.com/revoke",
         revokeBodyTemplate: {
           token: "{access_token}",

package/src/__tests__/oauth2-gateway-transport.test.ts

@@ -71,11 +71,14 @@ mock.module("../inbound/public-ingress-urls.js", () => ({
   },
 }));
 
+mock.module("../config/env-registry.js", () => ({
+  getIsPlatform: () => false,
+}));
+
 // Mock platform-callback-registration to avoid cold-start latency from its
-// transitive dependencies (config/env.js, config/env-registry.js) which can
-// cause the 10ms timer in the auto-detection test to fire before openUrl is called.
+// transitive dependencies (config/env.js) which can cause the 10ms timer in
+// the auto-detection test to fire before openUrl is called.
 mock.module("../inbound/platform-callback-registration.js", () => ({
-  shouldUsePlatformCallbacks: () => false,
   registerCallbackRoute: () => Promise.reject(new Error("not containerized")),
   resolveCallbackUrl: (directUrl: () => string) => Promise.resolve(directUrl()),
 }));