@vellumai/assistant 0.7.2 → 0.8.0

package/src/__tests__/oauth-connect-routes.test.ts

@@ -0,0 +1,316 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Module mocks (must precede imports) ───────────────────────────────────────
+
+type OrchestrateOptions = {
+  service: string;
+  clientId: string;
+  clientSecret?: string;
+  callbackTransport?: string;
+  requestedScopes?: string[];
+  isInteractive: boolean;
+  onDeferredComplete?: (r: {
+    success: boolean;
+    service: string;
+    accountInfo?: string;
+    grantedScopes?: string[];
+    error?: string;
+  }) => void;
+};
+
+let capturedOnDeferredComplete: OrchestrateOptions["onDeferredComplete"] | undefined;
+let mockOrchestrateResult: Record<string, unknown> = {
+  success: true,
+  deferred: true,
+  authorizeUrl: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+  state: "test-state-uuid-abc123",
+  service: "google",
+};
+
+mock.module("../oauth/connect-orchestrator.js", () => ({
+  orchestrateOAuthConnect: async (opts: OrchestrateOptions) => {
+    capturedOnDeferredComplete = opts.onDeferredComplete;
+    return mockOrchestrateResult;
+  },
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// NOTE: Do NOT mock oauth-connect-state — use the real module so we can
+// verify state transitions via getOAuthConnectState.
+
+// ── Import SUT after mocks ─────────────────────────────────────────────────────
+
+const { ROUTES } = await import("../runtime/routes/oauth-connect-routes.js");
+const { BadRequestError, InternalError, NotFoundError } = await import(
+  "../runtime/routes/errors.js"
+);
+const { _clearAllOAuthConnectStates, getOAuthConnectState } = await import(
+  "../oauth/oauth-connect-state.js"
+);
+
+// ── Helpers ────────────────────────────────────────────────────────────────────
+
+function findRoute(operationId: string) {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) throw new Error(`Route ${operationId} not found`);
+  return route;
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────────
+
+describe("oauth-connect-routes", () => {
+  describe("POST internal/oauth/connect/start", () => {
+    beforeEach(() => {
+      capturedOnDeferredComplete = undefined;
+      mockOrchestrateResult = {
+        success: true,
+        deferred: true,
+        authorizeUrl: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+        state: "test-state-uuid-abc123",
+        service: "google",
+      };
+      _clearAllOAuthConnectStates();
+    });
+
+    test("happy path returns auth_url and state, sets pending in state map", async () => {
+      const result = await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "google",
+          clientId: "my-client-id",
+          callbackTransport: "gateway",
+        },
+      });
+      expect(result).toEqual({
+        auth_url: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+        state: "test-state-uuid-abc123",
+      });
+      // State map should have pending entry
+      expect(getOAuthConnectState("test-state-uuid-abc123")).toMatchObject({
+        status: "pending",
+        service: "google",
+      });
+    });
+
+    test("invalid callbackTransport throws BadRequestError", async () => {
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "google",
+            clientId: "my-client-id",
+            callbackTransport: "ftp",
+          },
+        }),
+      ).rejects.toBeInstanceOf(BadRequestError);
+    });
+
+    test("missing clientId throws BadRequestError", async () => {
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "google",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(BadRequestError);
+    });
+
+    test("missing service throws BadRequestError", async () => {
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            clientId: "my-client-id",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(BadRequestError);
+    });
+
+    test("orchestrator returns success:false throws InternalError", async () => {
+      mockOrchestrateResult = {
+        success: false,
+        error: "provider configuration error",
+        deferred: false,
+      };
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "google",
+            clientId: "my-client-id",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(InternalError);
+    });
+
+    test("loopback callbackTransport is also accepted", async () => {
+      const result = await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "google",
+          clientId: "my-client-id",
+          callbackTransport: "loopback",
+        },
+      });
+      expect(result).toMatchObject({
+        auth_url: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+        state: "test-state-uuid-abc123",
+      });
+    });
+
+    test("success:true, deferred:false throws InternalError (synchronous completion not supported via daemon route)", async () => {
+      // The daemon-owned route requires a deferred flow so the CLI can poll for status.
+      // When the orchestrator returns { success: true, deferred: false } (e.g., already
+      // authenticated), the handler has no auth_url or state to return and throws an
+      // InternalError rather than silently returning a malformed response.
+      mockOrchestrateResult = {
+        success: true,
+        deferred: false,
+        service: "google",
+        grantedScopes: [],
+      };
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "google",
+            clientId: "my-client-id",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(InternalError);
+    });
+  });
+
+  describe("GET internal/oauth/connect/status/:state", () => {
+    beforeEach(() => {
+      _clearAllOAuthConnectStates();
+      capturedOnDeferredComplete = undefined;
+      mockOrchestrateResult = {
+        success: true,
+        deferred: true,
+        authorizeUrl: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+        state: "test-state-uuid-abc123",
+        service: "google",
+      };
+    });
+
+    test("returns pending after start", async () => {
+      await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "google",
+          clientId: "my-client-id",
+          callbackTransport: "gateway",
+        },
+      });
+      const result = findRoute("internal_oauth_connect_status").handler({
+        pathParams: { state: "test-state-uuid-abc123" },
+      });
+      expect(result).toMatchObject({ status: "pending", service: "google" });
+    });
+
+    test("returns complete after onDeferredComplete fires with success", async () => {
+      await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "google",
+          clientId: "my-client-id",
+          callbackTransport: "gateway",
+        },
+      });
+      // Fire the onDeferredComplete callback manually
+      capturedOnDeferredComplete?.({
+        success: true,
+        service: "google",
+        accountInfo: "user@example.com",
+      });
+      const result = findRoute("internal_oauth_connect_status").handler({
+        pathParams: { state: "test-state-uuid-abc123" },
+      });
+      expect(result).toMatchObject({
+        status: "complete",
+        service: "google",
+        account_info: "user@example.com",
+      });
+    });
+
+    test("returns error after onDeferredComplete fires with failure", async () => {
+      await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "google",
+          clientId: "my-client-id",
+          callbackTransport: "gateway",
+        },
+      });
+      capturedOnDeferredComplete?.({
+        success: false,
+        service: "google",
+        error: "exchange failed",
+      });
+      const result = findRoute("internal_oauth_connect_status").handler({
+        pathParams: { state: "test-state-uuid-abc123" },
+      });
+      expect(result).toMatchObject({
+        status: "error",
+        service: "google",
+        error: "exchange failed",
+      });
+    });
+
+    test("throws NotFoundError for unknown state", () => {
+      expect(() =>
+        findRoute("internal_oauth_connect_status").handler({
+          pathParams: { state: "nonexistent-state" },
+        }),
+      ).toThrow(NotFoundError);
+    });
+
+    test("returns complete with granted_scopes after onDeferredComplete fires with grantedScopes", async () => {
+      await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "google",
+          clientId: "my-client-id",
+          callbackTransport: "gateway",
+        },
+      });
+      // Fire the onDeferredComplete callback with grantedScopes
+      capturedOnDeferredComplete?.({
+        success: true,
+        service: "google",
+        accountInfo: "user@example.com",
+        grantedScopes: ["https://www.googleapis.com/auth/calendar", "https://www.googleapis.com/auth/gmail.readonly"],
+      });
+      const result = findRoute("internal_oauth_connect_status").handler({
+        pathParams: { state: "test-state-uuid-abc123" },
+      }) as Record<string, unknown>;
+      expect(result).toMatchObject({
+        status: "complete",
+        service: "google",
+        account_info: "user@example.com",
+        granted_scopes: ["https://www.googleapis.com/auth/calendar", "https://www.googleapis.com/auth/gmail.readonly"],
+      });
+    });
+
+    test("complete without accountInfo does not include account_info field", async () => {
+      await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "google",
+          clientId: "my-client-id",
+          callbackTransport: "gateway",
+        },
+      });
+      capturedOnDeferredComplete?.({
+        success: true,
+        service: "google",
+        // No accountInfo
+      });
+      const result = findRoute("internal_oauth_connect_status").handler({
+        pathParams: { state: "test-state-uuid-abc123" },
+      }) as Record<string, unknown>;
+      expect(result.status).toBe("complete");
+      expect(result.account_info).toBeUndefined();
+    });
+  });
+});

package/src/__tests__/oauth-provider-seed-logos.test.ts

@@ -2,8 +2,26 @@ import { describe, expect, test } from "bun:test";
 
 import { PROVIDER_SEED_DATA } from "../oauth/seed-providers.js";
 
+/**
+ * Allowed CDN prefixes for ``logoUrl``. Mirrors the source registry in
+ * ``clients/shared/Resources/integration-logos-manifest.json``:
+ *
+ * - Simple Icons (CC0) is the default for most providers.
+ * - thesvg via jsDelivr is the documented fallback for brands Simple Icons
+ *   doesn't host (e.g. Salesforce, which Simple Icons removed for
+ *   trademark reasons). Same source is already used for the bundled PDFs
+ *   of figma/github/gmail/linear/notion/outlook/slack.
+ *
+ * Adding another CDN should be a deliberate choice — extend this list
+ * and update the manifest in tandem.
+ */
+const ALLOWED_LOGO_URL_PREFIXES = [
+  "https://cdn.simpleicons.org/",
+  "https://cdn.jsdelivr.net/gh/glincker/thesvg@",
+];
+
 describe("PROVIDER_SEED_DATA logo URLs", () => {
-  test("every well-known provider has a Simple Icons CDN logoUrl", () => {
+  test("every well-known provider has a recognised CDN logoUrl", () => {
     const missing: string[] = [];
     const invalid: Array<{ provider: string; logoUrl: string }> = [];
 
@@ -12,7 +30,11 @@ describe("PROVIDER_SEED_DATA logo URLs", () => {
         missing.push(key);
         continue;
       }
-      if (!seed.logoUrl.startsWith("https://cdn.simpleicons.org/")) {
+      if (
+        !ALLOWED_LOGO_URL_PREFIXES.some((prefix) =>
+          seed.logoUrl!.startsWith(prefix),
+        )
+      ) {
         invalid.push({ provider: key, logoUrl: seed.logoUrl });
       }
     }

package/src/__tests__/onboarding-persona-write.test.ts

@@ -0,0 +1,308 @@
+/**
+ * Tests for `writeOnboardingSection` in persona-resolver.
+ *
+ * The function writes a managed `## Onboarding Context` section to the
+ * guardian persona file (with a fallback chain). These tests stub
+ * `util/platform.js` and `contacts/contact-store.js` to control the
+ * write target and verify idempotency, fallback, and field omission.
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
+
+// ── Mock state ────────────────────────────────────────────────────
+
+let mockWorkspaceDir: string = "";
+let mockVellumGuardian: {
+  contact: { userFile: string | null };
+  channel: Record<string, unknown>;
+} | null = null;
+
+// ── Mock modules (must precede imports from the module under test) ──
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: (_target, prop) =>
+        prop === "child"
+          ? () =>
+              new Proxy({} as Record<string, unknown>, { get: () => () => {} })
+          : () => {},
+    }),
+  getCliLogger: () => ({}),
+  truncateForLog: (v: string) => v,
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
+}));
+
+mock.module("../util/platform.js", () => ({
+  getWorkspaceDir: () => mockWorkspaceDir,
+  getWorkspacePromptPath: (file: string) => join(mockWorkspaceDir, file),
+}));
+
+mock.module("../contacts/contact-store.js", () => ({
+  findContactByChannelExternalId: () => null,
+  findGuardianForChannel: (channelType: string) =>
+    channelType === "vellum" ? mockVellumGuardian : null,
+  listGuardianChannels: () => null,
+}));
+
+// Import AFTER mocks so the module under test binds to the stubbed
+// implementations.
+import { writeOnboardingSection } from "../prompts/persona-resolver.js";
+
+// ── Temp workspace scaffold ───────────────────────────────────────
+
+let testRoot: string;
+
+function workspacePath(file: string): string {
+  return join(mockWorkspaceDir, file);
+}
+
+beforeAll(() => {
+  testRoot = mkdtempSync(join(tmpdir(), "onboarding-persona-write-test-"));
+});
+
+afterAll(() => {
+  rmSync(testRoot, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  mockWorkspaceDir = mkdtempSync(join(testRoot, "ws-"));
+  mockVellumGuardian = null;
+});
+
+afterEach(() => {
+  rmSync(mockWorkspaceDir, { recursive: true, force: true });
+});
+
+// ── Tests ─────────────────────────────────────────────────────────
+
+describe("writeOnboardingSection", () => {
+  test("writes section to guardian persona file when it exists", () => {
+    mockVellumGuardian = {
+      contact: { userFile: "alice.md" },
+      channel: {},
+    };
+    const guardianPath = workspacePath("users/alice.md");
+    mkdirSync(workspacePath("users"), { recursive: true });
+    writeFileSync(guardianPath, "# User Profile\n\n- **Name:** Alice\n");
+
+    writeOnboardingSection({
+      preferredName: "Alice",
+      commonWork: ["builds code, apps, or tools", "plans and coordinates work"],
+      dailyTools: ["GitHub", "Linear", "Slack"],
+    });
+
+    const content = readFileSync(guardianPath, "utf-8");
+    expect(content).toContain("- **Name:** Alice");
+    expect(content).toContain("## Onboarding Context");
+    expect(content).toContain("- **Preferred name:** Alice");
+    expect(content).toContain(
+      "- **Common work:** builds code, apps, or tools; plans and coordinates work",
+    );
+    expect(content).toContain("- **Daily tools:** GitHub, Linear, Slack");
+  });
+
+  test("falls back to users/default.md when guardian path is null", () => {
+    mockVellumGuardian = null;
+    mkdirSync(workspacePath("users"), { recursive: true });
+    writeFileSync(
+      workspacePath("users/default.md"),
+      "# User Profile\n\n- **Name:** Default User\n",
+    );
+
+    writeOnboardingSection({
+      preferredName: "Alice",
+      commonWork: [],
+      dailyTools: ["Slack"],
+    });
+
+    const content = readFileSync(workspacePath("users/default.md"), "utf-8");
+    expect(content).toContain("- **Name:** Default User");
+    expect(content).toContain("## Onboarding Context");
+    expect(content).toContain("- **Preferred name:** Alice");
+    expect(content).toContain("- **Daily tools:** Slack");
+
+    // USER.md should not be created
+    expect(existsSync(workspacePath("USER.md"))).toBe(false);
+  });
+
+  test("falls back to USER.md when no users/ files exist", () => {
+    mockVellumGuardian = null;
+
+    writeOnboardingSection({
+      preferredName: "Alice",
+      commonWork: [],
+      dailyTools: [],
+    });
+
+    expect(existsSync(workspacePath("USER.md"))).toBe(true);
+    const content = readFileSync(workspacePath("USER.md"), "utf-8");
+    expect(content).toContain("## Onboarding Context");
+    expect(content).toContain("- **Preferred name:** Alice");
+  });
+
+  test("creates file with header + section when target doesn't exist", () => {
+    mockVellumGuardian = null;
+
+    writeOnboardingSection({
+      preferredName: "Alice",
+      commonWork: ["builds code, apps, or tools"],
+      dailyTools: ["GitHub", "Linear", "Slack"],
+    });
+
+    const content = readFileSync(workspacePath("USER.md"), "utf-8");
+    expect(content).toContain("# User Profile");
+    expect(content).toContain("## Onboarding Context");
+    expect(content).toContain("- **Preferred name:** Alice");
+    expect(content).toContain("- **Common work:** builds code, apps, or tools");
+    expect(content).toContain("- **Daily tools:** GitHub, Linear, Slack");
+  });
+
+  test("idempotent: calling twice produces the same file content", () => {
+    mockVellumGuardian = null;
+    const normalized = {
+      preferredName: "Alice",
+      commonWork: ["builds code, apps, or tools"],
+      dailyTools: ["GitHub", "Linear"],
+    };
+
+    writeOnboardingSection(normalized);
+    const first = readFileSync(workspacePath("USER.md"), "utf-8");
+
+    writeOnboardingSection(normalized);
+    const second = readFileSync(workspacePath("USER.md"), "utf-8");
+
+    expect(first).toBe(second);
+  });
+
+  test("replaces existing onboarding section with updated data", () => {
+    mockVellumGuardian = null;
+
+    writeOnboardingSection({
+      preferredName: "Alice",
+      commonWork: ["builds code, apps, or tools"],
+      dailyTools: ["GitHub"],
+    });
+
+    writeOnboardingSection({
+      preferredName: "Bob",
+      commonWork: ["writes docs, emails, or content"],
+      dailyTools: ["Notion", "Slack"],
+    });
+
+    const content = readFileSync(workspacePath("USER.md"), "utf-8");
+    expect(content).toContain("- **Preferred name:** Bob");
+    expect(content).toContain(
+      "- **Common work:** writes docs, emails, or content",
+    );
+    expect(content).toContain("- **Daily tools:** Notion, Slack");
+    // Old values should be gone
+    expect(content).not.toContain("**Preferred name:** Alice");
+    expect(content).not.toContain("GitHub");
+  });
+
+  test("preserves content outside the managed section", () => {
+    mockVellumGuardian = null;
+    writeFileSync(
+      workspacePath("USER.md"),
+      "# User Profile\n\n- **Name:** Alice\n- **Role:** Engineer\n",
+    );
+
+    writeOnboardingSection({
+      preferredName: "Alice",
+      commonWork: [],
+      dailyTools: ["GitHub"],
+    });
+
+    const content = readFileSync(workspacePath("USER.md"), "utf-8");
+    expect(content).toContain("- **Name:** Alice");
+    expect(content).toContain("- **Role:** Engineer");
+    expect(content).toContain("## Onboarding Context");
+    expect(content).toContain("- **Daily tools:** GitHub");
+  });
+
+  test("omits empty fields", () => {
+    mockVellumGuardian = null;
+
+    writeOnboardingSection({
+      commonWork: [],
+      dailyTools: [],
+    });
+
+    const content = readFileSync(workspacePath("USER.md"), "utf-8");
+    expect(content).toContain("## Onboarding Context");
+    expect(content).not.toContain("Preferred name");
+    expect(content).not.toContain("Common work");
+    expect(content).not.toContain("Daily tools");
+  });
+
+  test("omits preferredName when undefined", () => {
+    mockVellumGuardian = null;
+
+    writeOnboardingSection({
+      preferredName: undefined,
+      commonWork: ["builds code, apps, or tools"],
+      dailyTools: ["GitHub"],
+    });
+
+    const content = readFileSync(workspacePath("USER.md"), "utf-8");
+    expect(content).not.toContain("Preferred name");
+    expect(content).toContain("- **Common work:** builds code, apps, or tools");
+    expect(content).toContain("- **Daily tools:** GitHub");
+  });
+
+  test("preserves content after onboarding section when followed by another heading", () => {
+    mockVellumGuardian = null;
+    writeFileSync(
+      workspacePath("USER.md"),
+      [
+        "# User Profile",
+        "",
+        "- **Name:** Alice",
+        "",
+        "## Onboarding Context",
+        "",
+        "- **Preferred name:** Alice",
+        "",
+        "## Preferences",
+        "",
+        "- Likes dark mode",
+        "",
+      ].join("\n"),
+    );
+
+    writeOnboardingSection({
+      preferredName: "Bob",
+      commonWork: [],
+      dailyTools: ["Slack"],
+    });
+
+    const content = readFileSync(workspacePath("USER.md"), "utf-8");
+    expect(content).toContain("- **Preferred name:** Bob");
+    expect(content).toContain("- **Daily tools:** Slack");
+    expect(content).toContain("## Preferences");
+    expect(content).toContain("- Likes dark mode");
+    // Old preferred name should be gone from the onboarding section
+    expect(content).not.toContain("**Preferred name:** Alice");
+  });
+});