@vellumai/assistant 0.7.2 → 0.8.0

package/src/cli/commands/oauth/__tests__/connect.test.ts

@@ -42,6 +42,20 @@ let mockPlatformFetchCallIndex = 0;
 
 let mockIsManagedMode: (key: string) => boolean = () => false;
 
+// Configurable logger mock: by default no-ops; individual tests can override
+// mockLogInfo to write to process.stdout so the JSON-mode suppression guard is
+// exercised (the real CLI logger writes log lines to stdout).
+let mockLogInfo: (msg: string) => void = () => {};
+
+let mockCliIpcCallFn: (
+  method: string,
+  params?: Record<string, unknown>,
+  opts?: { timeoutMs?: number },
+) => Promise<{ ok: boolean; result?: unknown; error?: string; statusCode?: number }> = async () => ({
+  ok: false,
+  error: "IPC unavailable (default mock — forces fallback)",
+});
+
 // ---------------------------------------------------------------------------
 // Mocks
 // ---------------------------------------------------------------------------
@@ -101,7 +115,7 @@ mock.module("../../../../util/logger.js", () => ({
     debug: () => {},
   }),
   getCliLogger: () => ({
-    info: () => {},
+    info: (msg: string) => mockLogInfo(msg),
     warn: () => {},
     error: () => {},
     debug: () => {},
@@ -127,6 +141,14 @@ mock.module("../../../../security/secure-keys.js", () => ({
   _resetBackend: () => {},
 }));
 
+mock.module("../../../../ipc/cli-client.js", () => ({
+  cliIpcCall: (
+    method: string,
+    params?: Record<string, unknown>,
+    opts?: { timeoutMs?: number },
+  ) => mockCliIpcCallFn(method, params, opts),
+}));
+
 mock.module("../../../lib/daemon-credential-client.js", () => ({
   deleteSecureKeyViaDaemon: async () => "not-found" as const,
   setSecureKeyViaDaemon: async () => false,
@@ -254,6 +276,8 @@ describe("assistant oauth connect", () => {
     mockPlatformFetchResults = [];
     mockPlatformFetchCallIndex = 0;
     mockIsManagedMode = () => false;
+    mockCliIpcCallFn = async () => ({ ok: false, error: "IPC unavailable" });
+    mockLogInfo = () => {};
     process.exitCode = 0;
   });
 
@@ -371,106 +395,6 @@ describe("assistant oauth connect", () => {
     );
   });
 
-  // -------------------------------------------------------------------------
-  // BYO mode with --no-browser: prints auth URL (deferred)
-  // -------------------------------------------------------------------------
-
-  test("BYO mode with --no-browser: prints auth URL", async () => {
-    mockGetProvider = () => ({
-      provider: "google",
-      authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-      tokenExchangeUrl: "https://oauth2.googleapis.com/token",
-      tokenExchangeBodyFormat: "form",
-      managedServiceConfigKey: null,
-    });
-    mockIsManagedMode = () => false;
-
-    mockGetMostRecentAppByProvider = () => ({
-      id: "app-1",
-      clientId: "byo-client-id",
-      clientSecretCredentialPath: "oauth_app/app-1/client_secret",
-      provider: "google",
-      createdAt: 0,
-      updatedAt: 0,
-    });
-
-    mockOrchestrateOAuthConnect = async () => ({
-      success: true,
-      deferred: true,
-      authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth?state=abc",
-      state: "abc",
-      service: "google",
-    });
-
-    const { exitCode, stdout } = await runCommand([
-      "connect",
-      "google",
-      "--no-browser",
-      "--json",
-    ]);
-    expect(exitCode).toBe(0);
-    const parsed = JSON.parse(stdout);
-    expect(parsed.ok).toBe(true);
-    expect(parsed.deferred).toBe(true);
-    expect(parsed.authUrl).toBe(
-      "https://accounts.google.com/o/oauth2/v2/auth?state=abc",
-    );
-    expect(parsed.service).toBe("google");
-  });
-
-  // -------------------------------------------------------------------------
-  // BYO mode default: orchestrator called with isInteractive true
-  // -------------------------------------------------------------------------
-
-  test("BYO mode default calls orchestrator with isInteractive: true", async () => {
-    mockGetProvider = () => ({
-      provider: "google",
-      authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-      tokenExchangeUrl: "https://oauth2.googleapis.com/token",
-      tokenExchangeBodyFormat: "form",
-      managedServiceConfigKey: null,
-    });
-    mockIsManagedMode = () => false;
-
-    mockGetAppByProviderAndClientId = () => ({
-      id: "app-1",
-      clientId: "test-id",
-      clientSecretCredentialPath: "oauth_app/app-1/client_secret",
-      provider: "google",
-      createdAt: 0,
-      updatedAt: 0,
-    });
-
-    let capturedOpts: Record<string, unknown> | undefined;
-    mockOrchestrateOAuthConnect = async (opts) => {
-      capturedOpts = opts;
-      return {
-        success: true,
-        deferred: false,
-        grantedScopes: ["email"],
-        accountInfo: "user@example.com",
-      };
-    };
-
-    const { exitCode, stdout } = await runCommand([
-      "connect",
-      "google",
-      "--client-id",
-      "test-id",
-      "--json",
-    ]);
-    expect(exitCode).toBe(0);
-    expect(capturedOpts).toBeDefined();
-    expect(capturedOpts!.isInteractive).toBe(true);
-    // openUrl should be provided by default (browser opens automatically)
-    expect(typeof capturedOpts!.openUrl).toBe("function");
-
-    const parsed = JSON.parse(stdout);
-    expect(parsed.ok).toBe(true);
-    expect(parsed.grantedScopes).toEqual(["email"]);
-    expect(parsed.accountInfo).toBe("user@example.com");
-  });
-
   // -------------------------------------------------------------------------
   // BYO missing app: error with hint
   // -------------------------------------------------------------------------
@@ -566,96 +490,6 @@ describe("assistant oauth connect", () => {
     );
   });
 
-  // -------------------------------------------------------------------------
-  // JSON output format for deferred case (BYO)
-  // -------------------------------------------------------------------------
-
-  test("JSON output for deferred case includes ok, deferred, authUrl, service", async () => {
-    mockGetProvider = () => ({
-      provider: "slack",
-      authorizeUrl: "https://slack.com/oauth/v2/authorize",
-      tokenExchangeUrl: "https://slack.com/api/oauth.v2.access",
-      tokenExchangeBodyFormat: "form",
-      managedServiceConfigKey: null,
-    });
-    mockIsManagedMode = () => false;
-
-    mockGetMostRecentAppByProvider = () => ({
-      id: "app-slack",
-      clientId: "slack-client-id",
-      clientSecretCredentialPath: "oauth_app/app-slack/client_secret",
-      provider: "slack",
-      createdAt: 0,
-      updatedAt: 0,
-    });
-
-    mockOrchestrateOAuthConnect = async () => ({
-      success: true,
-      deferred: true,
-      authorizeUrl: "https://slack.com/oauth/v2/authorize?state=xyz",
-      state: "xyz",
-      service: "slack",
-    });
-
-    const { exitCode, stdout } = await runCommand([
-      "connect",
-      "slack",
-      "--no-browser",
-      "--json",
-    ]);
-    expect(exitCode).toBe(0);
-    const parsed = JSON.parse(stdout);
-    expect(parsed).toHaveProperty("ok", true);
-    expect(parsed).toHaveProperty("deferred", true);
-    expect(parsed).toHaveProperty("authUrl");
-    expect(parsed).toHaveProperty("service", "slack");
-  });
-
-  // -------------------------------------------------------------------------
-  // JSON output format for completed case (BYO)
-  // -------------------------------------------------------------------------
-
-  test("JSON output for completed case includes ok, grantedScopes, accountInfo", async () => {
-    mockGetProvider = () => ({
-      provider: "google",
-      authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-      tokenExchangeUrl: "https://oauth2.googleapis.com/token",
-      tokenExchangeBodyFormat: "form",
-      managedServiceConfigKey: null,
-    });
-    mockIsManagedMode = () => false;
-
-    mockGetMostRecentAppByProvider = () => ({
-      id: "app-1",
-      clientId: "completed-client-id",
-      clientSecretCredentialPath: "oauth_app/app-1/client_secret",
-      provider: "google",
-      createdAt: 0,
-      updatedAt: 0,
-    });
-
-    mockOrchestrateOAuthConnect = async () => ({
-      success: true,
-      deferred: false,
-      grantedScopes: ["email", "profile"],
-      accountInfo: "test@gmail.com",
-    });
-
-    const { exitCode, stdout } = await runCommand([
-      "connect",
-      "google",
-      "--json",
-    ]);
-    expect(exitCode).toBe(0);
-    const parsed = JSON.parse(stdout);
-    expect(parsed).toHaveProperty("ok", true);
-    expect(parsed).toHaveProperty("grantedScopes");
-    expect(parsed.grantedScopes).toEqual(["email", "profile"]);
-    expect(parsed).toHaveProperty("accountInfo", "test@gmail.com");
-    // Should NOT have deferred
-    expect(parsed.deferred).toBeUndefined();
-  });
-
   // -------------------------------------------------------------------------
   // BYO mode: client_secret required but missing
   // -------------------------------------------------------------------------
@@ -725,41 +559,389 @@ describe("assistant oauth connect", () => {
   });
 
   // -------------------------------------------------------------------------
-  // Orchestrator error propagation
+  // IPC-first path (daemon-orchestrated)
   // -------------------------------------------------------------------------
 
-  test("BYO mode: orchestrator error propagates correctly", async () => {
-    mockGetProvider = () => ({
-      provider: "google",
-      authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-      tokenExchangeUrl: "https://oauth2.googleapis.com/token",
-      tokenExchangeBodyFormat: "form",
-      managedServiceConfigKey: null,
+  describe("IPC-first path (BYO mode via daemon)", () => {
+    beforeEach(() => {
+      // Set up a valid BYO provider and app for all IPC tests
+      mockGetProvider = () => ({
+        provider: "google",
+        authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+        tokenExchangeBodyFormat: "form",
+        managedServiceConfigKey: null,
+      });
+      mockIsManagedMode = () => false;
+      mockGetMostRecentAppByProvider = () => ({
+        id: "app-1",
+        clientId: "ipc-client-id",
+        clientSecretCredentialPath: "oauth_app/app-1/client_secret",
+        provider: "google",
+        createdAt: 0,
+        updatedAt: 0,
+      });
     });
-    mockIsManagedMode = () => false;
 
-    mockGetMostRecentAppByProvider = () => ({
-      id: "app-1",
-      clientId: "client-id",
-      clientSecretCredentialPath: "oauth_app/app-1/client_secret",
-      provider: "google",
-      createdAt: 0,
-      updatedAt: 0,
+    test("IPC start succeeds + polling returns complete → exits 0 with success output", async () => {
+      let pollCallCount = 0;
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=ipc-state",
+              state: "ipc-state",
+            },
+          };
+        }
+        if (method === "internal_oauth_connect_status") {
+          pollCallCount++;
+          return {
+            ok: true,
+            result: {
+              status: "complete",
+              service: "google",
+              account_info: "user@example.com",
+            },
+          };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--json",
+      ]);
+      expect(exitCode).toBe(0);
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(true);
+      expect(parsed.accountInfo).toBe("user@example.com");
+      expect(mockOpenInBrowserCalls.length).toBe(1);
+      expect(mockOpenInBrowserCalls[0]).toBe(
+        "https://accounts.google.com/o/oauth2/auth?state=ipc-state",
+      );
+      expect(pollCallCount).toBeGreaterThanOrEqual(1);
     });
 
-    mockOrchestrateOAuthConnect = async () => ({
-      success: false,
-      error: "Token exchange failed: invalid_grant",
+    test("IPC start succeeds + polling returns error → exits 1 with error message", async () => {
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=ipc-state",
+              state: "ipc-state",
+            },
+          };
+        }
+        if (method === "internal_oauth_connect_status") {
+          return {
+            ok: true,
+            result: {
+              status: "error",
+              service: "google",
+              error: "exchange failed",
+            },
+          };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--json",
+      ]);
+      expect(exitCode).toBe(1);
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(false);
+      expect(parsed.error).toBe("exchange failed");
     });
 
-    const { exitCode, stdout } = await runCommand([
-      "connect",
-      "google",
-      "--json",
-    ]);
-    expect(exitCode).toBe(1);
-    const parsed = JSON.parse(stdout);
-    expect(parsed.ok).toBe(false);
-    expect(parsed.error).toBe("Token exchange failed: invalid_grant");
+    test("IPC start + --no-browser + json → returns deferred JSON without polling status", async () => {
+      let statusCallCount = 0;
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=ipc-state",
+              state: "ipc-state",
+            },
+          };
+        }
+        if (method === "internal_oauth_connect_status") {
+          statusCallCount++;
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--no-browser",
+        "--json",
+      ]);
+      expect(exitCode).toBe(0);
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(true);
+      expect(parsed.deferred).toBe(true);
+      expect(parsed.authUrl).toBe("https://accounts.google.com/o/oauth2/auth?state=ipc-state");
+      expect(parsed.state).toBe("ipc-state");
+      expect(parsed.service).toBe("google");
+      // Should NOT poll status when --no-browser is set
+      expect(statusCallCount).toBe(0);
+      // Should NOT open browser
+      expect(mockOpenInBrowserCalls.length).toBe(0);
+    });
+
+    test("IPC start + --no-browser without json → prints URL to stdout", async () => {
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=ipc-state",
+              state: "ipc-state",
+            },
+          };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--no-browser",
+      ]);
+      expect(exitCode).toBe(0);
+      expect(stdout).toContain("https://accounts.google.com/o/oauth2/auth?state=ipc-state");
+      expect(mockOpenInBrowserCalls.length).toBe(0);
+    });
+
+    test("IPC returns ok:false with statusCode → surfaces daemon error, does NOT fall back", async () => {
+      // Daemon was reachable but returned an error (e.g. 500)
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return { ok: false, statusCode: 500, error: "internal server error" };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+      let orchestratorCalled = false;
+      mockOrchestrateOAuthConnect = async () => {
+        orchestratorCalled = true;
+        return { success: true, deferred: false, grantedScopes: [] };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--json",
+      ]);
+      expect(exitCode).toBe(1);
+      // Must NOT fall back to the in-process orchestrator
+      expect(orchestratorCalled).toBe(false);
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(false);
+      expect(parsed.error).toBe("internal server error");
+    });
+
+    test("IPC poll returns ok:false with statusCode → breaks early with error, does NOT wait for timeout", async () => {
+      // Fix 1: daemon was reachable during status poll but errored — should surface the
+      // error immediately instead of waiting out the full 5-minute timeout.
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=poll-err-state",
+              state: "poll-err-state",
+            },
+          };
+        }
+        if (method === "internal_oauth_connect_status") {
+          return { ok: false, statusCode: 500, error: "poll error" };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--json",
+      ]);
+      expect(exitCode).toBe(1);
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(false);
+      // The daemon error should be surfaced, not a timeout sentinel
+      expect(parsed.error).toBe("poll error");
+    });
+
+    test("IPC start returns ok:true with no auth_url → surfaces error, does NOT call in-process orchestrator", async () => {
+      // Fix 2: daemon returns { ok: true } but without an auth_url — malformed response
+      // should be an error, not a silent fallback to in-process (which has heap-split bug).
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return { ok: true, result: {} };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+      let orchestratorCalled = false;
+      mockOrchestrateOAuthConnect = async () => {
+        orchestratorCalled = true;
+        return { success: true, deferred: false, grantedScopes: [] };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--json",
+      ]);
+      expect(exitCode).toBe(1);
+      // Must NOT fall back to the in-process orchestrator
+      expect(orchestratorCalled).toBe(false);
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(false);
+      expect(parsed.error).toContain("assistant returned unexpected response");
+    });
+
+    test("IPC poll: transient ok:false with no statusCode does not abort the flow (continues to next poll)", async () => {
+      // Verifies intentional behavior: a single IPC status call returning { ok: false }
+      // with NO statusCode (socket error / timeout) is treated as a transient failure and
+      // silently retried. Only ok:false WITH a statusCode (i.e., the daemon was reachable
+      // and returned an HTTP error) causes an early abort.
+      let statusCallCount = 0;
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=transient-state",
+              state: "transient-state",
+            },
+          };
+        }
+        if (method === "internal_oauth_connect_status") {
+          statusCallCount++;
+          if (statusCallCount === 1) {
+            // First poll: transient IPC failure (no statusCode — socket error/timeout)
+            return { ok: false };
+          }
+          // Second poll: succeeds
+          return {
+            ok: true,
+            result: {
+              status: "complete",
+              service: "google",
+              account_info: "user@example.com",
+            },
+          };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--json",
+      ]);
+      expect(exitCode).toBe(0);
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(true);
+      expect(parsed.accountInfo).toBe("user@example.com");
+      // Both poll calls were made — the transient failure did not abort the loop
+      expect(statusCallCount).toBeGreaterThanOrEqual(2);
+    });
+
+    test("IPC success path with --json: stdout does NOT contain 'Waiting for authorization' text", async () => {
+      // Regression guard for P1: the browser-wait log.info must be suppressed in JSON mode
+      // so that machine consumers parsing stdout as JSON don't see corrupted non-JSON output.
+      //
+      // We configure the logger mock to write to process.stdout (matching the real CLI logger's
+      // behavior) so this test would FAIL if the `if (!jsonMode)` guard were removed from connect.ts.
+      mockLogInfo = (msg: string) => {
+        process.stdout.write(msg + "\n");
+      };
+
+      mockCliIpcCallFn = async (method) => {
+        if (method === "internal_oauth_connect_start") {
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=json-mode-state",
+              state: "json-mode-state",
+            },
+          };
+        }
+        if (method === "internal_oauth_connect_status") {
+          return {
+            ok: true,
+            result: {
+              status: "complete",
+              service: "google",
+              account_info: "user@example.com",
+            },
+          };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--json",
+      ]);
+      expect(exitCode).toBe(0);
+      // The suppressed log line must not appear anywhere in stdout
+      expect(stdout).not.toContain("Waiting for authorization");
+      // stdout must be valid JSON — no plain-text lines mixed in
+      expect(() => JSON.parse(stdout)).not.toThrow();
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(true);
+    });
+
+    test("IPC start with --callback-transport=gateway passes callbackTransport in body", async () => {
+      let capturedParams: Record<string, unknown> | undefined;
+      mockCliIpcCallFn = async (method, params) => {
+        if (method === "internal_oauth_connect_start") {
+          capturedParams = params;
+          return {
+            ok: true,
+            result: {
+              auth_url: "https://accounts.google.com/o/oauth2/auth?state=gw-state",
+              state: "gw-state",
+            },
+          };
+        }
+        if (method === "internal_oauth_connect_status") {
+          return {
+            ok: true,
+            result: {
+              status: "complete",
+              service: "google",
+              account_info: "gw-user@example.com",
+            },
+          };
+        }
+        return { ok: false, error: "unexpected method" };
+      };
+
+      const { exitCode, stdout } = await runCommand([
+        "connect",
+        "google",
+        "--callback-transport",
+        "gateway",
+        "--json",
+      ]);
+      expect(exitCode).toBe(0);
+      // Verify callbackTransport was forwarded in the IPC body
+      expect(capturedParams).toBeDefined();
+      expect((capturedParams!.body as Record<string, unknown>).callbackTransport).toBe("gateway");
+      const parsed = JSON.parse(stdout);
+      expect(parsed.ok).toBe(true);
+      expect(parsed.accountInfo).toBe("gw-user@example.com");
+    });
   });
 });