claude-multiacc 2.0.46 → 2.0.47

package/tests/test_claude_org_block.py

@@ -0,0 +1,277 @@
+"""Organization refusals stay excluded until a real call proves access is enabled.
+
+The actual shim and account commands run with synthetic OAuth files, a fake CLI,
+and a shared transcript tree. No provider, Keychain, scheduler or real pool is used.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import time
+import unittest
+
+
+REPO = Path(__file__).resolve().parents[1]
+SID = "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee"
+ORG_TEXT = ("Your organization has disabled Claude subscription access for Claude Code · "
+            "Use an Anthropic API key instead, or ask your admin to enable access")
+FAKE_CLI = r'''#!/usr/bin/env python3
+import json, os, pathlib, sys
+args = sys.argv[1:]
+account = pathlib.Path(os.environ.get('CLAUDE_CONFIG_DIR', '/none')).name
+if args == ['--version']:
+    print('2.1.285')
+elif args[:2] == ['auth', 'status']:
+    print(json.dumps({'loggedIn': True, 'email': 'fixture@example.invalid'}))
+elif args == ['-p', '--output-format', 'text', '--max-turns', '1']:
+    text = os.environ.get('ORG_TEST_VERIFY_TEXT') if account == 'acct-01' else None
+    print(text or 'OK')
+    sys.exit(1 if text else 0)
+else:
+    print('CFG=' + account)
+'''
+
+
+class ClaudeOrganizationBlockIntegrationTests(unittest.TestCase):
+    def setUp(self):
+        self.work = tempfile.TemporaryDirectory(prefix="multiacc-org-block-")
+        self.addCleanup(self.work.cleanup)
+        self.home = Path(self.work.name)
+        self.pool, self.fakebin = self.home / "pool", self.home / "fakebin"
+        self.pool.mkdir()
+        self.fakebin.mkdir()
+        self.projects = self.home / "projects"
+        (self.projects / "-fixture").mkdir(parents=True)
+        self.accounts = [self.pool / "acct-01", self.pool / "acct-02"]
+        self.now = int(time.time())
+        creds = {"claudeAiOauth": {"accessToken": "sk-ant-oat01-synthetic", "refreshToken": "synthetic",
+                 "expiresAt": (self.now + 86400) * 1000, "refreshTokenExpiresAt": (self.now + 864000) * 1000,
+                 "scopes": ["user:inference", "user:profile"], "subscriptionType": "max"}}
+        for account, percent in zip(self.accounts, (0, 80)):
+            account.mkdir()
+            (account / "sessions").mkdir()
+            (account / "projects").symlink_to(self.projects, target_is_directory=True)
+            (account / ".credentials.json").write_text(json.dumps(creds))
+            (account / "limits.json").write_text(json.dumps({"fetched_at": self.now, "source": "oauth",
+                "weekly_percent": percent, "session_percent": 0, "max_percent": percent,
+                "weekly_resets_epoch": self.now + 86400, "buckets": []}))
+        (self.pool / "accounts.json").write_text(json.dumps({"version": 1, "threshold": 90, "server": "none",
+            "accounts": [{"id": account.name, "email": account.name + "@example.invalid", "home": "mac"}
+                         for account in self.accounts]}))
+        for name, script in (("claude", FAKE_CLI), ("security", "#!/bin/sh\nexit 44\n")):
+            path = self.fakebin / name
+            path.write_text(script)
+            path.chmod(0o755)
+        self.env = {key: value for key, value in os.environ.items()
+                    if not key.startswith(("CLAUDE_", "ANTHROPIC_")) and key not in ("TMUX", "TMUX_PANE")}
+        self.env.update(HOME=str(self.home), PATH=f"{self.fakebin}:{os.environ['PATH']}",
+            CLAUDE_ACCOUNTS_ROOT=str(self.pool), CODEX_ACCOUNTS_ROOT=str(self.home / "codex-pool"),
+            CLAUDE_MULTIACC_KEYCHAIN="0", CLAUDE_MULTIACC_PATH_PROBE="0", CLAUDE_MULTIACC_MCP="0",
+            CLAUDE_MULTIACC_AUTORESUME="0", CLAUDE_MULTIACC_AUTO_RESET="0", CLAUDE_MULTIACC_HEADROOM_BAND="0",
+            CLAUDE_MULTIACC_CLIENT_SCAN_TTL="0", CLAUDE_MULTIACC_NO_SYNC="1", CLAUDE_MULTIACC_NO_DISTRIBUTE="1",
+            CLAUDE_MULTIACC_USAGE_URL=f"file://{self.home}/missing-usage.json",
+            CLAUDE_MULTIACC_TOKEN_URL=f"file://{self.home}/missing-token.json",
+            CLAUDE_MULTIACC_TOKEN_IDENTITY_URL=f"file://{self.home}/missing-identity.json",
+            PYTHONDONTWRITEBYTECODE="1")
+
+    def run_cli(self, command="claude", *args, **overrides):
+        (self.pool / ".limits-kick").touch()
+        return subprocess.run([str(REPO / "bin" / command), *args], cwd=self.home,
+                              env={**self.env, **overrides}, capture_output=True, text=True,
+                              input="", timeout=30, check=False)
+
+    def transcript(self, *, epoch=None, claim=None, changes=None, reset=True):
+        account = self.accounts[0]
+        if reset:
+            for owner in self.accounts:
+                for name in (".expired", ".sessions-index", ".client-scan", ".client-org-cleared"):
+                    (owner / name).unlink(missing_ok=True)
+                sessions = owner / "sessions"
+                if sessions.is_symlink():
+                    sessions.unlink()
+                    sessions.mkdir()
+        epoch = self.now - 30 if epoch is None else epoch
+        claim = self.now - 60 if claim is None else claim
+        timestamp = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(epoch))
+        record = {"type": "assistant", "isApiErrorMessage": True, "isSidechain": False,
+                  "error": "oauth_org_not_allowed", "apiErrorStatus": 403, "timestamp": timestamp,
+                  "sessionId": SID, "session_id": SID, "version": "2.1.285", "message": {
+                      "role": "assistant", "type": "message", "model": "<synthetic>",
+                      "content": [{"type": "text", "text": ORG_TEXT}]}}
+        record.update(changes or {})
+        path = self.projects / "-fixture" / f"{SID}.jsonl"
+        path.write_text(json.dumps(record) + "\n")
+        claim_text = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(claim))
+        (account / ".sessions-index").write_text(f"{SID} {claim_text}\n")
+        return path
+
+    def test_interactive_refusal_is_excluded_on_later_runs_and_all_limited_fallback(self):
+        path = self.transcript()
+        blocked, healthy = self.accounts
+        auth = json.loads(path.read_text())
+        auth.update(error="authentication_failed",
+                    timestamp=time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(self.now - 10)))
+        auth["message"]["content"][0]["text"] = "Not logged in · Please run /login"
+        with path.open("a") as handle:
+            handle.write(json.dumps(auth) + "\n")
+        newer_sid = "bbbbbbbb-cccc-4ddd-8eee-ffffffffffff"
+        auth.update(sessionId=newer_sid, session_id=newer_sid)
+        (path.parent / f"{newer_sid}.jsonl").write_text(json.dumps(auth) + "\n")
+        newer_claim = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(self.now - 20))
+        with (blocked / ".sessions-index").open("a") as handle:
+            handle.write(f"{newer_sid} {newer_claim}\n")
+        for arguments in ((), ("-p", "hello"), (), ("-p", "hello")):
+            result = self.run_cli("claude", *arguments)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertEqual(result.stdout.strip(), "CFG=acct-02")
+            self.assertIn("reason=org-blocked", (blocked / ".expired").read_text())
+        for verb in ("status", "list"):
+            result = self.run_cli("claude-accounts", verb, "--json")
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            row = next(row for row in json.loads(result.stdout)["accounts"] if row["id"] == "acct-01")
+            self.assertEqual(row["status"], "blocked")
+            self.assertFalse(row["selectable"])
+        for account, duration in ((blocked, 120), (healthy, 3600)):
+            (account / ".limited").write_text(f"{self.now + duration}\n"
+                "bucket=client:five_hour percent=100 reason=client-rate-limit\n")
+        result = self.run_cli()
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertEqual(result.stdout.strip(), "CFG=acct-02")
+
+    def test_legacy_expired_soft_deadline_and_newer_credentials_do_not_lift_org_block(self):
+        blocked = self.accounts[0]
+        (blocked / ".expired").write_text(f"{self.now - 86400}\n"
+            f"reason=org-blocked soft_until={self.now - 60} marked_at=2020-01-01T00:00:00Z detail=fixture\n")
+        (blocked / "server.token").write_text("sk-ant-oat01-synthetic-newer")
+        for name in (".credentials.json", "server.token"):
+            os.utime(blocked / name, (self.now + 5, self.now + 5))
+        for verb in ("list", "status"):
+            result = self.run_cli("claude-accounts", verb, "--json")
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            row = json.loads(result.stdout)["accounts"][0]
+            self.assertEqual(row["status"], "blocked")
+            self.assertFalse(row["selectable"])
+        result = self.run_cli()
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertEqual(result.stdout.strip(), "CFG=acct-02")
+        self.assertTrue((blocked / ".expired").exists())
+
+    def test_verify_pass_or_quota_clears_org_and_does_not_reharvest_old_refusal(self):
+        blocked = self.accounts[0]
+        for refusal in ("", "You've hit your weekly limit · resets 1am (Europe/Istanbul)"):
+            with self.subTest(verification=refusal or "PASS"):
+                self.transcript()
+                parked = self.run_cli()
+                self.assertEqual(parked.stdout.strip(), "CFG=acct-02")
+                result = self.run_cli("claude-accounts", "verify", ORG_TEST_VERIFY_TEXT=refusal)
+                self.assertEqual(result.returncode, 1 if refusal else 0, result.stdout + result.stderr)
+                self.assertIn("usage-limited" if refusal else "PASS", result.stdout)
+                self.assertFalse((blocked / ".expired").exists())
+                watermark = float((blocked / ".client-org-cleared").read_text().strip())
+                self.assertGreaterEqual(watermark, self.now - 30)
+                result = self.run_cli()
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                self.assertEqual(result.stdout.strip(), "CFG=acct-01")
+                self.assertFalse((blocked / ".expired").exists())
+                time.sleep(max(0, int(watermark) + 1.05 - time.time()))
+                self.transcript(epoch=int(time.time()), reset=False)
+                result = self.run_cli()
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                self.assertEqual(result.stdout.strip(), "CFG=acct-02")
+                self.assertIn("reason=org-blocked", (blocked / ".expired").read_text())
+
+    def test_verify_org_refusal_parks_and_server_throttling_does_not_prove_recovery(self):
+        blocked = self.accounts[0]
+        result = self.run_cli("claude-accounts", "verify", ORG_TEST_VERIFY_TEXT=ORG_TEXT)
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("ORG BLOCKED", result.stdout)
+        self.assertIn("reason=org-blocked", (blocked / ".expired").read_text())
+        result = self.run_cli("claude-accounts", "verify",
+            ORG_TEST_VERIFY_TEXT="Server is temporarily limiting requests (not your usage limit)")
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertTrue((blocked / ".expired").exists())
+        self.assertFalse((blocked / ".client-org-cleared").exists())
+        result = self.run_cli()
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertEqual(result.stdout.strip(), "CFG=acct-02")
+
+    def test_autoresume_org_verdict_parks_without_transcript_and_survives_stale_auth_verdict(self):
+        directory = self.pool / "tmp" / "autoresume"
+        directory.mkdir(parents=True)
+        blocked = self.accounts[0]
+        marker = blocked / ".expired"
+        org_marker = ""
+        cases = (("genericblocked01", "blocked", "", "acct-01"),
+                 ("orgblocked00001", "blocked", "oauth_org_not_allowed", "acct-02"),
+                 ("staleauth000001", "auth", "", "acct-02"))
+        for token, verdict, rtype, expected in cases:
+            with self.subTest(verdict=verdict, rtype=rtype):
+                fields = {"v": "1", "provider": "claude", "class": verdict, "acct": "acct-01",
+                          "rtype": rtype, "cwd": str(self.home), "reset": "", "marked": "", "sid": "",
+                          "depth": "0", "avoid": "", "hist": "", "chain": ""}
+                relaunch = directory / f"r-{token}.relaunch"
+                argv = directory / f"r-{token}.argv"
+                relaunch.write_text("".join(f"{key}={value}\n" for key, value in fields.items()))
+                argv.write_bytes(b"-p\0hello\0")
+                self.assertFalse((blocked / ".sessions-index").exists())
+                result = self.run_cli(CLAUDE_MULTIACC_AR=token)
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                self.assertEqual(result.stdout.strip(), f"CFG={expected}")
+                self.assertFalse(relaunch.exists())
+                self.assertFalse(argv.exists())
+                if rtype:
+                    org_marker = marker.read_text()
+                    self.assertIn("reason=org-blocked", org_marker)
+                elif verdict == "auth":
+                    self.assertEqual(marker.read_text(), org_marker)
+                else:
+                    self.assertFalse(marker.exists())
+
+    def test_ambiguous_or_unowned_session_records_do_not_park_any_account(self):
+        blocked, other = self.accounts
+        cases = ("later-claim", "shared-sessions", "shared-index", "unattributed", "missing-claim", "conflict")
+        for case in cases:
+            with self.subTest(ownership=case):
+                self.transcript(claim=self.now if case == "later-claim" else None)
+                index = blocked / ".sessions-index"
+                if case == "shared-sessions":
+                    shutil.rmtree(blocked / "sessions")
+                    (blocked / "sessions").symlink_to(other / "sessions", target_is_directory=True)
+                elif case == "shared-index":
+                    shared = self.home / "shared-index"
+                    shared.write_text(index.read_text())
+                    index.unlink()
+                    index.symlink_to(shared)
+                elif case == "unattributed":
+                    index.unlink()
+                elif case == "missing-claim":
+                    index.write_text(SID + "\n")
+                elif case == "conflict":
+                    (other / ".sessions-index").write_text(index.read_text())
+                result = self.run_cli()
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                self.assertEqual(result.stdout.strip(), "CFG=acct-01")
+                for account in self.accounts:
+                    self.assertFalse((account / ".expired").exists())
+
+    def test_user_text_ordinary_assistant_sidechains_and_unknown_errors_are_not_org_refusals(self):
+        cases = ({"type": "user", "message": {"role": "user", "content": ORG_TEXT}},
+                 {"isApiErrorMessage": False}, {"isSidechain": True}, {"error": "brand_new_error"},
+                 {"error": "model_not_found"}, {"error": "overloaded"})
+        for changes in cases:
+            with self.subTest(record=changes):
+                self.transcript(changes=changes)
+                result = self.run_cli()
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                self.assertEqual(result.stdout.strip(), "CFG=acct-01")
+                for account in self.accounts:
+                    self.assertFalse((account / ".expired").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()