agent-messenger 2.0.0 → 2.2.0

package/src/platforms/webex/credential-manager.test.ts

@@ -0,0 +1,314 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { WebexCredentialManager } from './credential-manager'
+
+describe('WebexCredentialManager', () => {
+  let tempDir: string
+  let credManager: WebexCredentialManager
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'webex-cred-test-'))
+    credManager = new WebexCredentialManager(tempDir)
+  })
+
+  afterEach(async () => {
+    await rm(tempDir, { recursive: true, force: true })
+    mock.restore()
+  })
+
+  test('loadConfig returns null when no file exists', async () => {
+    expect(await credManager.loadConfig()).toBeNull()
+  })
+
+  test('saveConfig + loadConfig round trip with OAuth tokens', async () => {
+    const config = {
+      accessToken: 'test-access-token',
+      refreshToken: 'test-refresh-token',
+      expiresAt: Date.now() + 3600000,
+    }
+    await credManager.saveConfig(config)
+    const loaded = await credManager.loadConfig()
+    expect(loaded).toEqual(config)
+  })
+
+  test('getToken returns accessToken when not expired', async () => {
+    await credManager.saveConfig({
+      accessToken: 'valid-token',
+      refreshToken: 'refresh',
+      expiresAt: Date.now() + 3600000, // 1 hour from now
+    })
+    const token = await credManager.getToken()
+    expect(token).toBe('valid-token')
+  })
+
+  test('getToken returns null when expired and no refresh available', async () => {
+    await credManager.saveConfig({
+      accessToken: 'expired-token',
+      refreshToken: 'bad-refresh',
+      expiresAt: Date.now() - 1000, // Already expired
+    })
+    const token = await credManager.getToken()
+    expect(token).toBeNull()
+  })
+
+  test('getToken auto-refreshes expired token', async () => {
+    const originalFetch = globalThis.fetch
+    globalThis.fetch = mock(() =>
+      Promise.resolve(
+        new Response(
+          JSON.stringify({
+            access_token: 'new-access-token',
+            refresh_token: 'new-refresh-token',
+            expires_in: 3600,
+          }),
+          { status: 200 },
+        ),
+      ),
+    ) as typeof fetch
+
+    await credManager.saveConfig({
+      accessToken: 'expired-token',
+      refreshToken: 'valid-refresh',
+      expiresAt: Date.now() - 1000,
+      clientId: 'test-client-id',
+      clientSecret: 'test-client-secret',
+    })
+
+    const token = await credManager.getToken()
+    expect(token).toBe('new-access-token')
+
+    // Verify updated config was saved
+    const config = await credManager.loadConfig()
+    expect(config?.accessToken).toBe('new-access-token')
+    expect(config?.refreshToken).toBe('new-refresh-token')
+
+    globalThis.fetch = originalFetch
+  })
+
+  test('requestDeviceCode calls device authorize endpoint', async () => {
+    const originalFetch = globalThis.fetch
+    globalThis.fetch = mock(() =>
+      Promise.resolve(
+        new Response(
+          JSON.stringify({
+            device_code: 'device-123',
+            user_code: '123456',
+            verification_uri: 'https://login-k.webex.com/verify',
+            verification_uri_complete: 'https://login-k.webex.com/verify?userCode=abc',
+            expires_in: 300,
+            interval: 2,
+          }),
+          { status: 200 },
+        ),
+      ),
+    ) as typeof fetch
+
+    const result = await credManager.requestDeviceCode('test-client-id')
+    expect(result.deviceCode).toBe('device-123')
+    expect(result.userCode).toBe('123456')
+    expect(result.verificationUri).toBe('https://login-k.webex.com/verify')
+    expect(result.interval).toBe(2)
+
+    globalThis.fetch = originalFetch
+  })
+
+  test('requestDeviceCode throws on failure', async () => {
+    const originalFetch = globalThis.fetch
+    globalThis.fetch = mock(() =>
+      Promise.resolve(new Response('{"error":"invalid_client"}', { status: 400 })),
+    ) as typeof fetch
+
+    await expect(credManager.requestDeviceCode('test-client-id')).rejects.toThrow('Device authorization failed')
+
+    globalThis.fetch = originalFetch
+  })
+
+  test('pollDeviceToken polls until authorized', async () => {
+    const originalFetch = globalThis.fetch
+    let callCount = 0
+    globalThis.fetch = mock(() => {
+      callCount++
+      if (callCount <= 2) {
+        return Promise.resolve(new Response('', { status: 428 }))
+      }
+      return Promise.resolve(
+        new Response(
+          JSON.stringify({
+            access_token: 'device-access-token',
+            refresh_token: 'device-refresh-token',
+            expires_in: 3600,
+          }),
+          { status: 200 },
+        ),
+      )
+    }) as typeof fetch
+
+    const config = await credManager.pollDeviceToken('device-123', 0.01, 30, 'test-client-id', 'test-client-secret')
+    expect(config.accessToken).toBe('device-access-token')
+    expect(config.refreshToken).toBe('device-refresh-token')
+
+    globalThis.fetch = originalFetch
+  })
+
+  test('clearCredentials removes the file', async () => {
+    await credManager.saveConfig({
+      accessToken: 'token',
+      refreshToken: 'refresh',
+      expiresAt: Date.now() + 3600000,
+    })
+    await credManager.clearCredentials()
+    expect(await credManager.loadConfig()).toBeNull()
+  })
+
+  test('clearCredentials does nothing when no file', async () => {
+    await credManager.clearCredentials() // Should not throw
+  })
+
+  test('credentials file has 0o600 permissions', async () => {
+    await credManager.saveConfig({
+      accessToken: 'token',
+      refreshToken: 'refresh',
+      expiresAt: Date.now() + 3600000,
+    })
+    const { stat } = await import('node:fs/promises')
+    const credPath = join(tempDir, 'webex-credentials.json')
+    const stats = await stat(credPath)
+    const mode = stats.mode & 0o777
+    expect(mode).toBe(0o600)
+  })
+
+  test('pollDeviceToken with undefined clientSecret uses empty Basic auth', async () => {
+    const originalFetch = globalThis.fetch
+    let capturedAuth: string | null = null
+    globalThis.fetch = mock((url: string, init?: RequestInit) => {
+      capturedAuth = (init?.headers as Record<string, string>)?.Authorization ?? null
+      return Promise.resolve(
+        new Response(
+          JSON.stringify({
+            access_token: 'token',
+            refresh_token: 'refresh',
+            expires_in: 3600,
+          }),
+          { status: 200 },
+        ),
+      )
+    }) as typeof fetch
+
+    await credManager.pollDeviceToken('device-123', 0.01, 30, 'test-client-id')
+    expect(capturedAuth).toBe(`Basic ${btoa('test-client-id:')}`)
+
+    globalThis.fetch = originalFetch
+  })
+
+  test('pollDeviceToken does not auto-save config', async () => {
+    const originalFetch = globalThis.fetch
+    globalThis.fetch = mock(() =>
+      Promise.resolve(
+        new Response(
+          JSON.stringify({
+            access_token: 'token',
+            refresh_token: 'refresh',
+            expires_in: 3600,
+          }),
+          { status: 200 },
+        ),
+      ),
+    ) as typeof fetch
+
+    await credManager.pollDeviceToken('device-123', 0.01, 30, 'test-client-id', 'test-client-secret')
+
+    const loaded = await credManager.loadConfig()
+    expect(loaded).toBeNull()
+
+    globalThis.fetch = originalFetch
+  })
+
+  test('getToken returns null when expired and no client credentials available', async () => {
+    await credManager.saveConfig({
+      accessToken: 'expired-token',
+      refreshToken: 'valid-refresh',
+      expiresAt: Date.now() - 1000,
+    })
+
+    const token = await credManager.getToken()
+    expect(token).toBeNull()
+  })
+
+  test('getToken returns manual token without attempting refresh', async () => {
+    await credManager.saveConfig({
+      accessToken: 'my-bot-token',
+      refreshToken: '',
+      expiresAt: 0,
+      tokenType: 'manual',
+    })
+
+    const token = await credManager.getToken()
+    expect(token).toBe('my-bot-token')
+  })
+
+  test('getToken uses stored clientId/clientSecret for refresh', async () => {
+    const originalFetch = globalThis.fetch
+    globalThis.fetch = mock(() =>
+      Promise.resolve(
+        new Response(
+          JSON.stringify({
+            access_token: 'refreshed-token',
+            refresh_token: 'new-refresh',
+            expires_in: 3600,
+          }),
+          { status: 200 },
+        ),
+      ),
+    ) as typeof fetch
+
+    await credManager.saveConfig({
+      accessToken: 'expired-token',
+      refreshToken: 'valid-refresh',
+      expiresAt: Date.now() - 1000,
+      clientId: 'stored-client-id',
+      clientSecret: 'stored-client-secret',
+    })
+
+    const token = await credManager.getToken()
+    expect(token).toBe('refreshed-token')
+
+    globalThis.fetch = originalFetch
+  })
+
+  test('saveConfig persists clientId and clientSecret', async () => {
+    await credManager.saveConfig({
+      accessToken: 'token',
+      refreshToken: 'refresh',
+      expiresAt: Date.now() + 3600000,
+      clientId: 'my-client-id',
+      clientSecret: 'my-client-secret',
+    })
+
+    const loaded = await credManager.loadConfig()
+    expect(loaded?.clientId).toBe('my-client-id')
+    expect(loaded?.clientSecret).toBe('my-client-secret')
+  })
+
+  test('loadConfig backward compat — old config without clientId/clientSecret', async () => {
+    // Write raw JSON without clientId/clientSecret fields
+    const credPath = join(tempDir, 'webex-credentials.json')
+    await writeFile(
+      credPath,
+      JSON.stringify({
+        accessToken: 'old-token',
+        refreshToken: 'old-refresh',
+        expiresAt: Date.now() + 3600000,
+      }),
+      'utf-8',
+    )
+
+    const loaded = await credManager.loadConfig()
+    expect(loaded).not.toBeNull()
+    expect(loaded?.accessToken).toBe('old-token')
+    expect(loaded?.clientId).toBeUndefined()
+    expect(loaded?.clientSecret).toBeUndefined()
+  })
+})

package/src/platforms/webex/credential-manager.ts

@@ -0,0 +1,197 @@
+import { existsSync } from 'node:fs'
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+import { getWebexAppCredentials } from './app-config'
+import type { WebexConfig } from './types'
+import { WebexConfigSchema } from './types'
+
+const OAUTH_DEVICE_AUTHORIZE_URL = 'https://webexapis.com/v1/device/authorize'
+const OAUTH_DEVICE_TOKEN_URL = 'https://webexapis.com/v1/device/token'
+const OAUTH_TOKEN_URL = 'https://webexapis.com/v1/access_token'
+const OAUTH_SCOPES = 'spark:all'
+
+export { OAUTH_SCOPES }
+
+export class WebexCredentialManager {
+  private configDir: string
+  private credentialsPath: string
+
+  constructor(configDir?: string) {
+    this.configDir = configDir ?? join(homedir(), '.config', 'agent-messenger')
+    this.credentialsPath = join(this.configDir, 'webex-credentials.json')
+  }
+
+  async loadConfig(): Promise<WebexConfig | null> {
+    if (!existsSync(this.credentialsPath)) return null
+    const content = await readFile(this.credentialsPath, 'utf-8')
+    const result = WebexConfigSchema.safeParse(JSON.parse(content))
+    if (!result.success) return null
+    return result.data
+  }
+
+  async saveConfig(config: WebexConfig): Promise<void> {
+    await mkdir(this.configDir, { recursive: true })
+    const tmpPath = `${this.credentialsPath}.tmp`
+    await writeFile(tmpPath, JSON.stringify(config, null, 2), {
+      encoding: 'utf-8',
+      mode: 0o600,
+    })
+    await rename(tmpPath, this.credentialsPath)
+  }
+
+  async getToken(clientId?: string, clientSecret?: string): Promise<string | null> {
+    const config = await this.loadConfig()
+    if (!config) return null
+
+    if (config.tokenType === 'manual' || config.tokenType === 'extracted') {
+      return config.accessToken
+    }
+
+    if (config.expiresAt < Date.now() + 5 * 60 * 1000) {
+      const builtinCreds = getWebexAppCredentials()
+      const resolvedClientId = clientId ?? config.clientId ?? builtinCreds.clientId
+      const resolvedClientSecret = clientSecret ?? config.clientSecret ?? builtinCreds.clientSecret
+      const refreshed = await this.refreshToken(config.refreshToken, resolvedClientId, resolvedClientSecret)
+      if (refreshed) return refreshed.accessToken
+      return null
+    }
+
+    return config.accessToken
+  }
+
+  async refreshToken(refreshToken: string, clientId: string, clientSecret: string): Promise<WebexConfig | null> {
+    try {
+      const response = await fetch(OAUTH_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'refresh_token',
+          client_id: clientId,
+          client_secret: clientSecret,
+          refresh_token: refreshToken,
+        }),
+      })
+
+      if (!response.ok) return null
+
+      const data = (await response.json()) as {
+        access_token: string
+        refresh_token: string
+        expires_in: number
+      }
+
+      const config: WebexConfig = {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt: Date.now() + data.expires_in * 1000,
+      }
+
+      await this.saveConfig(config)
+      return config
+    } catch {
+      return null
+    }
+  }
+
+  async requestDeviceCode(clientId: string, scopes?: string): Promise<{
+    deviceCode: string
+    userCode: string
+    verificationUri: string
+    verificationUriComplete: string
+    expiresIn: number
+    interval: number
+  }> {
+    const response = await fetch(OAUTH_DEVICE_AUTHORIZE_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        client_id: clientId,
+        scope: scopes ?? OAUTH_SCOPES,
+      }),
+    })
+
+    if (!response.ok) {
+      const errorBody = await response.text()
+      throw new Error(`Device authorization failed: ${response.status} ${errorBody}`)
+    }
+
+    const data = (await response.json()) as {
+      device_code: string
+      user_code: string
+      verification_uri: string
+      verification_uri_complete: string
+      expires_in: number
+      interval: number
+    }
+
+    return {
+      deviceCode: data.device_code,
+      userCode: data.user_code,
+      verificationUri: data.verification_uri,
+      verificationUriComplete: data.verification_uri_complete,
+      expiresIn: data.expires_in,
+      interval: data.interval,
+    }
+  }
+
+  async pollDeviceToken(deviceCode: string, interval: number, expiresIn: number, clientId: string, clientSecret?: string): Promise<WebexConfig> {
+    const basicAuth = btoa(`${clientId}:${clientSecret ?? ''}`)
+    const deadline = Date.now() + expiresIn * 1000
+
+    while (Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, interval * 1000))
+
+      const response = await fetch(OAUTH_DEVICE_TOKEN_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Basic ${basicAuth}`,
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: new URLSearchParams({
+          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+          device_code: deviceCode,
+          client_id: clientId,
+        }),
+      })
+
+      if (response.ok) {
+        const data = (await response.json()) as {
+          access_token: string
+          refresh_token: string
+          expires_in: number
+        }
+
+        const config: WebexConfig = {
+          accessToken: data.access_token,
+          refreshToken: data.refresh_token,
+          expiresAt: Date.now() + data.expires_in * 1000,
+        }
+
+        return config
+      }
+
+      if (response.status === 428) continue
+
+      const errorBody = (await response.json().catch(() => null)) as {
+        errors?: Array<{ description: string }>
+      } | null
+      const errorDesc = errorBody?.errors?.[0]?.description ?? ''
+
+      if (errorDesc.includes('authorization_pending') || errorDesc.includes('slow_down')) {
+        continue
+      }
+
+      throw new Error(`Device token exchange failed: ${response.status} ${errorDesc}`)
+    }
+
+    throw new Error('Device authorization timed out')
+  }
+
+  async clearCredentials(): Promise<void> {
+    if (existsSync(this.credentialsPath)) {
+      await rm(this.credentialsPath)
+    }
+  }
+}

package/src/platforms/webex/ensure-auth.test.ts

@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test'
+
+import { WebexClient } from './client'
+import { WebexCredentialManager } from './credential-manager'
+import { ensureWebexAuth } from './ensure-auth'
+import { WebexTokenExtractor } from './token-extractor'
+
+let loadConfigSpy: ReturnType<typeof spyOn>
+let getTokenSpy: ReturnType<typeof spyOn>
+let loginSpy: ReturnType<typeof spyOn>
+let testAuthSpy: ReturnType<typeof spyOn>
+let extractSpy: ReturnType<typeof spyOn>
+
+beforeEach(() => {
+  loadConfigSpy = spyOn(WebexCredentialManager.prototype, 'loadConfig').mockResolvedValue(null)
+  getTokenSpy = spyOn(WebexCredentialManager.prototype, 'getToken').mockResolvedValue(null)
+  loginSpy = spyOn(WebexClient.prototype, 'login').mockResolvedValue({} as WebexClient)
+  testAuthSpy = spyOn(WebexClient.prototype, 'testAuth').mockResolvedValue({
+    id: 'user-123',
+    displayName: 'Test User',
+    emails: ['test@example.com'],
+    type: 'person',
+  })
+  extractSpy = spyOn(WebexTokenExtractor.prototype, 'extract').mockResolvedValue(null)
+})
+
+afterEach(() => {
+  loadConfigSpy?.mockRestore()
+  getTokenSpy?.mockRestore()
+  loginSpy?.mockRestore()
+  testAuthSpy?.mockRestore()
+  extractSpy?.mockRestore()
+})
+
+describe('ensureWebexAuth', () => {
+  test('does nothing when no config stored', async () => {
+    // given
+    loadConfigSpy.mockResolvedValue(null)
+
+    // when
+    await ensureWebexAuth()
+
+    // then
+    expect(getTokenSpy).not.toHaveBeenCalled()
+    expect(testAuthSpy).not.toHaveBeenCalled()
+  })
+
+  test('validates token when stored', async () => {
+    // given
+    loadConfigSpy.mockResolvedValue({
+      accessToken: 'test-webex-token',
+      refreshToken: 'refresh',
+      expiresAt: Date.now() + 3600000,
+      clientId: 'stored-id',
+      clientSecret: 'stored-secret',
+    })
+    getTokenSpy.mockResolvedValue('test-webex-token')
+
+    // when
+    await ensureWebexAuth()
+
+    // then
+    expect(getTokenSpy).toHaveBeenCalledWith('stored-id', 'stored-secret')
+    expect(loginSpy).toHaveBeenCalledWith({ token: 'test-webex-token' })
+    expect(testAuthSpy).toHaveBeenCalled()
+  })
+
+  test('does not throw when token validation fails', async () => {
+    // given
+    loadConfigSpy.mockResolvedValue({
+      accessToken: 'invalid-token',
+      refreshToken: 'refresh',
+      expiresAt: Date.now() + 3600000,
+    })
+    getTokenSpy.mockResolvedValue('invalid-token')
+    testAuthSpy.mockRejectedValue(new Error('401 Unauthorized'))
+
+    // when / then
+    await expect(ensureWebexAuth()).resolves.toBeUndefined()
+  })
+
+  test('does not throw when credential manager fails', async () => {
+    // given
+    getTokenSpy.mockRejectedValue(new Error('Disk read error'))
+
+    // when / then
+    await expect(ensureWebexAuth()).resolves.toBeUndefined()
+  })
+})

package/src/platforms/webex/ensure-auth.ts

@@ -0,0 +1,38 @@
+import { WebexClient } from './client'
+import { WebexCredentialManager } from './credential-manager'
+import { WebexTokenExtractor } from './token-extractor'
+
+export async function ensureWebexAuth(): Promise<void> {
+  try {
+    const credManager = new WebexCredentialManager()
+    const config = await credManager.loadConfig()
+
+    if (config) {
+      const token = await credManager.getToken(config.clientId, config.clientSecret)
+      if (token) {
+        const client = new WebexClient()
+        await client.login({ token })
+        await client.testAuth()
+        return
+      }
+    }
+
+    const extractor = new WebexTokenExtractor()
+    const extracted = await extractor.extract()
+    if (!extracted) return
+
+    const client = new WebexClient()
+    await client.login({ token: extracted.accessToken })
+    await client.testAuth()
+
+    await credManager.saveConfig({
+      accessToken: extracted.accessToken,
+      refreshToken: extracted.refreshToken ?? '',
+      expiresAt: extracted.expiresAt ?? 0,
+      tokenType: 'extracted',
+      deviceUrl: extracted.deviceUrl,
+    })
+  } catch {
+    // Intentionally silent — best-effort preflight that should not block commands
+  }
+}

package/src/platforms/webex/index.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from 'bun:test'
+
+import * as webex from './index'
+
+describe('webex barrel exports', () => {
+  test('exports WebexClient', () => {
+    expect(webex.WebexClient).toBeDefined()
+  })
+
+  test('exports WebexCredentialManager', () => {
+    expect(webex.WebexCredentialManager).toBeDefined()
+  })
+
+  test('exports WebexError', () => {
+    expect(webex.WebexError).toBeDefined()
+  })
+
+  test('exports Zod schemas', () => {
+    expect(webex.WebexSpaceSchema).toBeDefined()
+    expect(webex.WebexMessageSchema).toBeDefined()
+    expect(webex.WebexPersonSchema).toBeDefined()
+    expect(webex.WebexMembershipSchema).toBeDefined()
+    expect(webex.WebexConfigSchema).toBeDefined()
+  })
+})

package/src/platforms/webex/index.ts

@@ -0,0 +1,19 @@
+export { WebexClient } from './client'
+export { WebexCredentialManager } from './credential-manager'
+export { WebexTokenExtractor } from './token-extractor'
+export type { ExtractedWebexToken } from './token-extractor'
+export { WebexError } from './types'
+export type {
+  WebexConfig,
+  WebexMembership,
+  WebexMessage,
+  WebexPerson,
+  WebexSpace,
+} from './types'
+export {
+  WebexConfigSchema,
+  WebexMembershipSchema,
+  WebexMessageSchema,
+  WebexPersonSchema,
+  WebexSpaceSchema,
+} from './types'