gogcli-mcp 2.19.2 → 2.21.0

package/tests/google-token.test.ts

@@ -0,0 +1,304 @@
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
+import { makeAccessTokenSource, clearAccessTokenCache } from '../src/google-token.js';
+
+/**
+ * Minting a short-lived access token from a long-lived refresh token is what
+ * lets a hosted gog's identity belong to the REGISTRATION instead of to the Fly
+ * box's volume (#241). The access token is what crosses the wire; the refresh
+ * token never leaves this process.
+ *
+ * Two properties carry the whole design, and both are about NOT quietly doing
+ * the wrong thing:
+ *
+ *   1. One caller's token must never be served to another. The cache is keyed
+ *      by the credential, not held as a single "current token" — a Worker
+ *      isolate serves many callers, and a global would hand the first caller's
+ *      identity to everyone after them.
+ *   2. A failure must fail the CALL. Returning nothing would run the command as
+ *      the box's identity, and the caller would read someone else's mailbox
+ *      while everything looked like success.
+ */
+
+const CLIENT = { GOG_CLIENT_ID: 'cid.apps.googleusercontent.com', GOG_CLIENT_SECRET: 'cs' };
+
+function tokenResponse(accessToken: string, expiresIn = 3600) {
+  return new Response(JSON.stringify({ access_token: accessToken, expires_in: expiresIn }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+beforeEach(() => clearAccessTokenCache());
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+
+describe('makeAccessTokenSource', () => {
+  it('is absent when nothing is configured, so the box keeps acting as itself', () => {
+    expect(makeAccessTokenSource({})).toBeUndefined();
+  });
+
+  it('passes through a directly-supplied access token without contacting Google', async () => {
+    // The #230 path. Still supported: a caller who already holds a token should
+    // not need an OAuth client to use it.
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ GOG_ACCESS_TOKEN: 'ya29.direct' })!;
+    expect(await source()).toBe('ya29.direct');
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('mints an access token from the refresh token, then serves it from cache', async () => {
+    const fetchMock = vi.fn(async () => tokenResponse('ya29.minted'));
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+
+    expect(await source()).toBe('ya29.minted');
+    expect(await source()).toBe('ya29.minted');
+    // A token exchange per tool call would be both slow and a good way to get
+    // rate-limited by Google.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+
+    const [url, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    expect(url).toBe('https://oauth2.googleapis.com/token');
+    const sent = new URLSearchParams(init.body as string);
+    expect(sent.get('grant_type')).toBe('refresh_token');
+    expect(sent.get('refresh_token')).toBe('rt-1');
+    expect(sent.get('client_id')).toBe(CLIENT.GOG_CLIENT_ID);
+  });
+
+  it('never serves one credential holder the other one’s token', async () => {
+    // THE one that matters. A module-level "current access token" passes every
+    // other test in this file and fails this one — and on the Worker path,
+    // where a single isolate serves many callers, that is a cross-account leak
+    // rather than a bug.
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(tokenResponse('ya29.alice'))
+      .mockResolvedValueOnce(tokenResponse('ya29.bob'));
+    vi.stubGlobal('fetch', fetchMock);
+
+    const alice = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-alice' })!;
+    const bob = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-bob' })!;
+
+    expect(await alice()).toBe('ya29.alice');
+    expect(await bob()).toBe('ya29.bob');
+    // And each keeps its own on a second read.
+    expect(await alice()).toBe('ya29.alice');
+    expect(await bob()).toBe('ya29.bob');
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('re-mints once the token is close to expiring', async () => {
+    vi.useFakeTimers();
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(tokenResponse('ya29.first', 3600))
+      .mockResolvedValueOnce(tokenResponse('ya29.second', 3600));
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+
+    expect(await source()).toBe('ya29.first');
+    // Just inside the safety margin: a token that expires mid-flight is a
+    // failure the caller cannot do anything about, so it is replaced early.
+    vi.advanceTimersByTime((3600 - 60) * 1000);
+    expect(await source()).toBe('ya29.second');
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('THROWS when the exchange fails, rather than returning nothing', async () => {
+    // Returning undefined here would run the command as the box's identity.
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response(JSON.stringify({ error: 'server_error' }), { status: 500 })),
+    );
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+    await expect(source()).rejects.toThrow(/could not be refreshed|token exchange/i);
+  });
+
+  it('explains an invalid_grant instead of surfacing a bare OAuth error', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(
+        async () =>
+          new Response(JSON.stringify({ error: 'invalid_grant', error_description: 'Token has been expired or revoked.' }), {
+            status: 400,
+          }),
+      ),
+    );
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-dead' })!;
+    await expect(source()).rejects.toThrow(/expired or been revoked|re-?enrol|re-?authoriz/i);
+  });
+
+  it('does not cache a failure, so a transient outage is not sticky', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(new Response('{}', { status: 503 }))
+      .mockResolvedValueOnce(tokenResponse('ya29.recovered'));
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+
+    await expect(source()).rejects.toThrow();
+    expect(await source()).toBe('ya29.recovered');
+  });
+
+  it('fails loudly on a half-configured credential instead of acting as the box', async () => {
+    // A refresh token with no OAuth client cannot mint anything. Treating it as
+    // "unconfigured" would silently fall back to the box's identity, which is
+    // the exact confusion this feature exists to remove — so the source exists
+    // and throws when used, leaving tools/list working and the reason visible.
+    for (const partial of [
+      { GOG_REFRESH_TOKEN: 'rt-1' },
+      { GOG_REFRESH_TOKEN: 'rt-1', GOG_CLIENT_ID: 'cid' },
+      { GOG_REFRESH_TOKEN: 'rt-1', GOG_CLIENT_SECRET: 'cs' },
+    ]) {
+      const source = makeAccessTokenSource(partial);
+      expect(source).toBeTypeOf('function');
+      await expect(source!()).rejects.toThrow(/GOG_CLIENT_ID|GOG_CLIENT_SECRET/);
+    }
+  });
+
+  it('says the exchange was unreachable when the network itself fails', async () => {
+    // Distinct from a rejection BY Google: nothing was evaluated, so the
+    // credential may be perfectly good and the right response is to retry, not
+    // to tell the owner to re-enrol.
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => {
+        throw new TypeError('fetch failed');
+      }),
+    );
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+    await expect(source()).rejects.toThrow(/could not be reached.*fetch failed/i);
+  });
+
+  it('survives a thrown non-Error without masking it with a TypeError', async () => {
+    // `err.message` on a thrown string is undefined, and the template would
+    // then hide the real failure behind a crash inside the error path.
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => {
+        throw 'socket closed';
+      }),
+    );
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+    await expect(source()).rejects.toThrow(/could not be reached.*socket closed/i);
+  });
+
+  it('refuses a 200 that carries no access_token', async () => {
+    // A success status with nothing usable in it would otherwise cache
+    // `undefined` and send no token at all — a silent downgrade to the
+    // backend's identity, wearing a 200.
+    vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ expires_in: 3600 }), { status: 200 })));
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+    await expect(source()).rejects.toThrow(/no access_token/i);
+  });
+
+  it('assumes an hour when Google omits expires_in', async () => {
+    vi.useFakeTimers();
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ access_token: 'ya29.nolife' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+
+    expect(await source()).toBe('ya29.nolife');
+    // Still cached half an hour later — i.e. it did not treat "no expiry" as
+    // "already expired" and re-mint on every single call.
+    vi.advanceTimersByTime(1800 * 1000);
+    expect(await source()).toBe('ya29.nolife');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('reports the status when the body is not JSON at all', async () => {
+    // An edge proxy answering a 502 with an HTML error page is the realistic
+    // case. Parsing that would throw inside the error path and bury the status,
+    // which is the only useful thing such a response carries.
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response('<html>502 Bad Gateway</html>', { status: 502 })),
+    );
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+    await expect(source()).rejects.toThrow(/could not be refreshed \(HTTP 502/);
+  });
+
+  it('coalesces concurrent callers into ONE token exchange', async () => {
+    // The reported bug was several per-service servers flapping into needs-auth
+    // independently. This is the version of that failure that lives in OUR
+    // code: `get` → `await exchange` → `set` has an await between the miss and
+    // the fill, so N calls arriving together all miss and all exchange.
+    //
+    // One process per caller hides it; a Worker isolate serving many callers,
+    // or simply several tool calls in flight at once, turns one refresh into N
+    // simultaneous hits on Google's token endpoint — which is a good way to be
+    // rate-limited into exactly the intermittent auth errors being debugged.
+    let inFlight = 0;
+    let maxConcurrent = 0;
+    const fetchMock = vi.fn(async () => {
+      inFlight += 1;
+      maxConcurrent = Math.max(maxConcurrent, inFlight);
+      await new Promise((r) => setTimeout(r, 5));
+      inFlight -= 1;
+      return tokenResponse('ya29.shared');
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+    const results = await Promise.all(Array.from({ length: 8 }, () => source()));
+
+    expect(results).toEqual(Array(8).fill('ya29.shared'));
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(maxConcurrent).toBe(1);
+  });
+
+  it('lets a later caller retry after a concurrent exchange failed', async () => {
+    // Coalescing must not make one failure permanent for everyone: the shared
+    // attempt is dropped when it settles, so the next call starts a fresh one.
+    // The failure has to take a tick. An exchange that rejects instantly can
+    // finish and clear itself before the second caller even looks, so that
+    // caller correctly starts its own attempt — which would make this test pass
+    // without any sharing having happened. A real exchange is a network round
+    // trip, so the shared-failure case is the one worth pinning.
+    const fetchMock = vi
+      .fn()
+      .mockImplementationOnce(async () => {
+        await new Promise((r) => setTimeout(r, 5));
+        throw new Error('boom');
+      })
+      .mockResolvedValueOnce(tokenResponse('ya29.after'));
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+
+    const settled = await Promise.allSettled([source(), source()]);
+    expect(settled.every((s) => s.status === 'rejected')).toBe(true);
+    // Both shared ONE failed exchange rather than each making their own...
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    // ...and the failure was not cached, so the next caller recovers.
+    expect(await source()).toBe('ya29.after');
+  });
+
+  it('does not let two different credentials share one in-flight exchange', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(tokenResponse('ya29.alice'))
+      .mockResolvedValueOnce(tokenResponse('ya29.bob'));
+    vi.stubGlobal('fetch', fetchMock);
+    const alice = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-alice' })!;
+    const bob = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-bob' })!;
+
+    const [a, b] = await Promise.all([alice(), bob()]);
+    expect(a).toBe('ya29.alice');
+    expect(b).toBe('ya29.bob');
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('never puts the refresh token in the error it throws', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response(JSON.stringify({ error: 'invalid_grant' }), { status: 400 })),
+    );
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-super-secret-value' })!;
+    await expect(source()).rejects.toThrow(
+      expect.not.stringContaining('rt-super-secret-value') as unknown as string,
+    );
+  });
+});

package/tests/remote-runner.test.ts

@@ -101,6 +101,47 @@ describe('useRemoteGogRunner', () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 
+  it('forwards its own GOG_ACCESS_TOKEN so a hosted gog acts as its caller', async () => {
+    // Under mcp-host's perUserChild, THIS PROCESS belongs to one caller and
+    // holds their token (#230). The backend has one Google identity on its
+    // volume, so without forwarding, every caller of a hosted gog acts as
+    // whoever seeded it.
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'ok' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+
+    expect(
+      useRemoteGogRunner({
+        GOG_RUNNER_URL: 'https://r.test',
+        GOG_RUNNER_KEY: 'secret',
+        GOG_ACCESS_TOKEN: 'ya29.the-caller',
+      }),
+    ).toBe(true);
+
+    await runExecutor.exit(() => run(['auth', 'status']));
+    const [, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    expect(JSON.parse(init.body as string).accessToken).toBe('ya29.the-caller');
+  });
+
+  it('sends no token when the caller has not supplied one', async () => {
+    // Absent, not empty: the backend distinguishes "act as this caller" from
+    // "act as the box", and every registration that predates per-caller auth is
+    // the second case.
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({ stdout: 'ok' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetchMock);
+    vi.stubEnv('GOG_PATH', '/nonexistent/gog');
+
+    expect(useRemoteGogRunner({ GOG_RUNNER_URL: 'https://r.test', GOG_RUNNER_KEY: 'secret' })).toBe(true);
+
+    await runExecutor.exit(() => run(['auth', 'status']));
+    const [, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    // The KEY must be absent, not present-and-empty. Asserted on its own rather
+    // than by matching the whole body: `assembleArgs` folds in ambient settings
+    // like GOG_ACCOUNT, so a whole-body match passes or fails depending on the
+    // developer's shell.
+    expect(JSON.parse(init.body as string)).not.toHaveProperty('accessToken');
+  });
+
   it('lets a per-request store beat the process-wide default', async () => {
     // The Worker path scopes every request in `runExecutor.run({ executor })`
     // because one isolate serves many callers (connector-runtime.ts). A

package/tests/sdk-single-copy.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { createRequire } from 'node:module';
+import { realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+// Guards the invariant that broke dependabot #220: the whole monorepo must
+// resolve ONE copy of @modelcontextprotocol/sdk.
+//
+// `McpServer` carries a `private _serverInfo`, so TypeScript compares it
+// NOMINALLY, not structurally. Two installed copies therefore become two
+// mutually-unassignable classes, and every `ToolRegistrar` in server.ts fails
+// with TS2322 — with no API change and no source change anywhere. #220 split
+// the tree exactly that way: `agents` (a root devDependency, the Worker
+// connector's McpAgent) exact-pins the SDK to 1.29.0 and so takes the hoisted
+// root slot that `@chrischall/mcp-utils` resolves its peer from, while the
+// workspaces asking for ^1.30.0 each nested their own copy.
+//
+// This asserts resolution identity rather than a version string: the failure is
+// "two copies", not "the wrong version", and pinning a version here would just
+// have to be edited on every future bump.
+describe('@modelcontextprotocol/sdk is installed exactly once', () => {
+  const here = createRequire(import.meta.url);
+
+  // An exported subpath — the SDK's `exports` map does not expose package.json.
+  const SDK_SUBPATH = '@modelcontextprotocol/sdk/server/mcp.js';
+
+  // `import.meta.resolve`, not `require.resolve`, to reach the dependency's own
+  // entry: these packages are ESM-only, so their `exports` maps carry no
+  // `require` condition and CJS resolution of the bare specifier throws.
+  const resolveFrom = (specifier: string): string =>
+    realpathSync(
+      createRequire(fileURLToPath(import.meta.resolve(specifier))).resolve(SDK_SUBPATH),
+    );
+
+  it('resolves to the same file for this package and for @chrischall/mcp-utils', () => {
+    // mcp-utils declares the SDK as a peer and hands our registrars the
+    // McpServer it built, so its copy is the one they must be typed against.
+    expect(resolveFrom('@chrischall/mcp-utils')).toBe(
+      realpathSync(here.resolve(SDK_SUBPATH)),
+    );
+  });
+
+  it('resolves to the same file for `agents`, which exact-pins the SDK', () => {
+    // The Worker connector builds its McpServer via McpAgent from `agents`.
+    // An exact pin there is what captured the root hoist slot in #220.
+    expect(resolveFrom('agents')).toBe(realpathSync(here.resolve(SDK_SUBPATH)));
+  });
+});

package/tests/tools/auth.test.ts

@@ -25,6 +25,27 @@ describe('gog_auth_list', () => {
     expect(result.content[0].text).toBe('Error: No accounts configured');
   });
 
+  it('does not advertise itself as proof the account still works', async () => {
+    // `gog auth list` reads the keyring. No network, no validation — it lists a
+    // full scope set for an account whose refresh token died days ago.
+    //
+    // This description used to say "check which accounts are configured and
+    // available", and "available" is exactly the wrong word: it was read as a
+    // liveness check while per-service servers were flapping into needs-auth,
+    // which pointed a whole debugging session away from an expired grant.
+    // gog_auth_health is the tool that actually probes Google.
+    const harness = await setupHandlers();
+    const { tools } = await harness.client.listTools();
+    const desc = tools.find((t) => t.name === 'gog_auth_list')!.description!;
+
+    expect(desc).not.toMatch(/\bavailable\b/i);
+    // It must say what it does NOT do, and where to go instead — a reader who
+    // wants liveness has to be sent somewhere, or they will use this anyway.
+    expect(desc).toMatch(/does not|without/i);
+    expect(desc).toContain('gog_auth_health');
+    await harness.close();
+  });
+
   it('handles non-Error rejection', async () => {
     vi.mocked(runner.run).mockRejectedValue('something went wrong');
     const harness = await setupHandlers();

package/tests/tools/utils.test.ts

@@ -190,6 +190,50 @@ describe('runOrDiagnose', () => {
     expect(result.content[0].text).toContain('gog_auth_add');
   });
 
+  it('calls a rate-limited failure transient even though it says "token expired"', async () => {
+    // The reported symptom was servers flapping into a needs-auth state and
+    // then working seconds later. Telling someone to re-authorize an account
+    // whose credential is fine is the expensive kind of wrong: re-auth is
+    // manual, and it does not fix a 429.
+    //
+    // `invalid_grant` is exempt from this and stays auth (below) — it is the
+    // one signal that definitively means the refresh token is dead.
+    vi.mocked(runner.run)
+      .mockRejectedValueOnce(new Error('429 rateLimitExceeded: the access token expired mid-request, retry'))
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['sheets', 'get', 'A1'], {});
+    const text = result.content[0].text as string;
+    expect(text).toContain('often transient');
+    expect(text).not.toContain('gog_auth_add');
+  });
+
+  it('still calls an explicit 401 an auth error even alongside a transient signal', async () => {
+    // The exemption above is for the LOOSE match only. A literal 401 is Google
+    // saying "not authenticated", and downgrading that to "retry" would loop a
+    // caller forever against a request that can never succeed.
+    vi.mocked(runner.run)
+      .mockRejectedValueOnce(new Error('401 unauthorized (quota project unset)'))
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['sheets', 'get', 'A1'], {});
+    expect(result.content[0].text).toContain('gog_auth_add');
+  });
+
+  it('does not read "token" and "expired" as auth when they are unrelated sentences', async () => {
+    // The pattern was /token.*(expired|revoked)/ with a greedy `.*`, so any
+    // message mentioning a token anywhere and an expiry anywhere later — across
+    // whole paragraphs — was reported as an auth failure.
+    vi.mocked(runner.run)
+      // Deliberately ONE line: `.` does not cross newlines, so a multi-line
+      // message would pass this test without the greedy match ever being
+      // exercised — and gog's real errors are frequently one long line.
+      .mockRejectedValueOnce(
+        new Error('page token accepted; the requested export link has expired and must be regenerated'),
+      )
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['drive', 'export', 'abc'], {});
+    expect(result.content[0].text).not.toContain('gog_auth_add');
+  });
+
   it('gives invalid_grant a richer hint than a plain 401: cause + durable fix + both re-auth paths', async () => {
     vi.mocked(runner.run)
       .mockRejectedValueOnce(new Error('oauth2: "invalid_grant" "Token has been expired or revoked."'))