gogcli-mcp 2.21.0 → 2.21.1

package/tests/google-token.test.ts

@@ -129,6 +129,13 @@ describe('makeAccessTokenSource', () => {
     );
     const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-dead' })!;
     await expect(source()).rejects.toThrow(/expired or been revoked|re-?enrol|re-?authoriz/i);
+    // The literal token, not just the prose. tools/utils.ts picks the richer
+    // INVALID_GRANT_HINT (7-day Testing-mode cause + the headless re-auth pair)
+    // by matching `invalid_grant`; a message that only DESCRIBES the failure
+    // earns the generic "authentication may have expired" advice instead, which
+    // is what this mint used to get while the identical failure reported by gog
+    // got the specific guidance.
+    await expect(source()).rejects.toThrow(/invalid_grant/);
   });
 
   it('does not cache a failure, so a transient outage is not sticky', async () => {
@@ -277,10 +284,24 @@ describe('makeAccessTokenSource', () => {
   });
 
   it('does not let two different credentials share one in-flight exchange', async () => {
-    const fetchMock = vi
-      .fn()
-      .mockResolvedValueOnce(tokenResponse('ya29.alice'))
-      .mockResolvedValueOnce(tokenResponse('ya29.bob'));
+    // Answers are keyed off the REQUEST's refresh_token, never off call order.
+    //
+    // `mockResolvedValueOnce` twice would assign alice's token to whichever
+    // exchange reaches fetch first, and that is not the order the sources were
+    // called in: each one awaits `crypto.subtle.digest` (via the cache key)
+    // before it reaches fetch, and two digest promises are not guaranteed to
+    // settle in the order they were started. Measured against this very source,
+    // bob's request went first in 4 of 400 races (~1%), which is exactly the
+    // rate at which an order-keyed mock hands alice bob's token and reddens CI
+    // for a reason that has nothing to do with the behaviour under test.
+    //
+    // Keying off the body also makes the assertion say what it means: the point
+    // is that each credential got ITS OWN token, which is a claim about
+    // pairing, not about sequence.
+    const fetchMock = vi.fn(async (_url: string, init: { body: string }) => {
+      const refreshToken = new URLSearchParams(init.body).get('refresh_token');
+      return tokenResponse(refreshToken === 'rt-alice' ? 'ya29.alice' : 'ya29.bob');
+    });
     vi.stubGlobal('fetch', fetchMock);
     const alice = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-alice' })!;
     const bob = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-bob' })!;
@@ -302,3 +323,103 @@ describe('makeAccessTokenSource', () => {
     );
   });
 });
+
+/**
+ * A token Google has REJECTED must leave the cache.
+ *
+ * The cache's only read guard is time-based (`expiresAt - EXPIRY_MARGIN_MS >
+ * Date.now()`), so before this existed a token Google answered 401 to was
+ * re-served for the rest of its nominal hour — every call in that window failed
+ * identically, retrying changed nothing, and only reconnecting (a fresh isolate
+ * with an empty cache) helped.
+ *
+ * The eviction is deliberately NOT `clearAccessTokenCache()`. That is a test
+ * seam which drops EVERY credential; using it here would mean one caller's dead
+ * token forced a re-mint on every other caller sharing the isolate — a new bug
+ * in the same shape as the ones this module was built to avoid.
+ */
+describe('invalidate', () => {
+  it('evicts the rejected token so the next call mints a fresh one', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(tokenResponse('ya29.first'))
+      .mockResolvedValueOnce(tokenResponse('ya29.second'));
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+
+    expect(await source()).toBe('ya29.first');
+    expect(await source()).toBe('ya29.first');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+
+    // True: something was actually dropped, so a retry has a chance of using a
+    // DIFFERENT token. That answer is what the caller's retry decision hangs on.
+    expect(await source.invalidate('ya29.first')).toBe(true);
+
+    expect(await source()).toBe('ya29.second');
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('evicts only the credential whose token was rejected', async () => {
+    // The multi-tenant property. A Worker isolate serves many callers; one
+    // caller meeting a dead token must not cost everyone else a re-mint.
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(tokenResponse('ya29.alice'))
+      .mockResolvedValueOnce(tokenResponse('ya29.bob'));
+    vi.stubGlobal('fetch', fetchMock);
+    const alice = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-alice' })!;
+    const bob = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-bob' })!;
+
+    expect(await alice()).toBe('ya29.alice');
+    expect(await bob()).toBe('ya29.bob');
+    expect(await alice.invalidate('ya29.alice')).toBe(true);
+
+    // Bob's entry is untouched — still served from cache, no third exchange.
+    expect(await bob()).toBe('ya29.bob');
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('ignores a rejection naming a token that is no longer the cached one', async () => {
+    // The ABA case. Caller A sends token T; while A is in flight, B refreshes
+    // the entry to T2; A comes back with "T was rejected". Dropping T2 there
+    // would make the next call mint a third token for nothing, and two callers
+    // could keep evicting each other's work indefinitely.
+    const fetchMock = vi.fn(async () => tokenResponse('ya29.current'));
+    vi.stubGlobal('fetch', fetchMock);
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+
+    expect(await source()).toBe('ya29.current');
+    expect(await source.invalidate('ya29.superseded')).toBe(false);
+    expect(await source()).toBe('ya29.current');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('reports nothing evicted when the credential has no cached token at all', async () => {
+    vi.stubGlobal('fetch', vi.fn());
+    const source = makeAccessTokenSource({ ...CLIENT, GOG_REFRESH_TOKEN: 'rt-1' })!;
+    expect(await source.invalidate('ya29.never-minted')).toBe(false);
+  });
+
+  it('offers no eviction at all for a directly-supplied token, which cannot be re-minted', async () => {
+    // The #230 path stores an ACCESS token, so there is nothing to mint from:
+    // reading again returns the identical string.
+    //
+    // The ABSENCE of the method is the signal, not a `false` return. A source
+    // that answers false is indistinguishable from a mintable one whose token a
+    // concurrent caller already replaced, and the connector logs those two as
+    // different causes — so a source that attached an always-false `invalidate`
+    // made the auth log blame concurrency for "nothing here can mint a
+    // replacement", which is the one case where re-authorizing IS the repair.
+    const source = makeAccessTokenSource({ GOG_ACCESS_TOKEN: 'ya29.direct' })!;
+    expect(source.invalidate).toBeUndefined();
+    expect(await source()).toBe('ya29.direct');
+  });
+
+  it('offers no eviction for a source that cannot mint at all', async () => {
+    // GOG_REFRESH_TOKEN without an OAuth client: the source exists only to fail
+    // loudly on first use, so there is never a cached token behind it.
+    const source = makeAccessTokenSource({ GOG_REFRESH_TOKEN: 'rt-1', GOG_CLIENT_ID: 'cid' })!;
+    expect(source.invalidate).toBeUndefined();
+    await expect(source()).rejects.toThrow(/GOG_CLIENT_SECRET/);
+  });
+});

package/tests/runner.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi } from 'vitest';
 import { EventEmitter } from 'node:events';
 import { spawn as mockedSpawn } from 'node:child_process';
-import { run, runBinary, runExecutor } from '../src/runner.js';
+import { run, runBinary, runExecutor, RunnerTransportError, isRunnerTransportError } from '../src/runner.js';
 import type { Spawner, GogExecutor } from '../src/runner.js';
 
 // The real spawn is dynamically imported inside runner's default executor.
@@ -763,6 +763,26 @@ describe('run executor seam', () => {
     }
   });
 
+  // run() re-wraps every thrown error to redact secrets from its message. That
+  // rewrap must not cost a RunnerTransportError its TYPE: the type is the only
+  // thing that tells diagnose() the failure was the connector's transport and
+  // not the caller's Google credential, and a bare Error puts it straight back
+  // to guessing from prose.
+  it('preserves a RunnerTransportError through the redacting rewrap', async () => {
+    const executor = vi.fn(async () => {
+      throw new RunnerTransportError('runner key mismatch; saw 1//0eLEAKED-REFRESH end', 'transport-auth', 401);
+    }) as unknown as GogExecutor;
+    const err = await runExecutor
+      .run({ executor }, () => run(['gmail', 'get', 'm1']))
+      .catch((e: unknown) => e);
+    expect(isRunnerTransportError(err)).toBe(true);
+    expect((err as RunnerTransportError).kind).toBe('transport-auth');
+    expect((err as RunnerTransportError).status).toBe(401);
+    // and it is still redacted
+    expect((err as Error).message).not.toContain('1//0eLEAKED-REFRESH');
+    expect((err as Error).message).toContain('[REDACTED]');
+  });
+
   it('options.spawner takes precedence over an injected ALS executor', async () => {
     const spawner = makeSpawner(0, '{"via":"spawner"}');
     const executor = vi.fn(async () => '{"via":"executor"}') as unknown as GogExecutor;

package/tests/tools/auth-401-context.test.ts

@@ -0,0 +1,42 @@
+import { describe, it, expect } from 'vitest';
+import { diagnose } from '../../src/tools/utils.js';
+
+/**
+ * `401` is a status code, but it is also just a number, and gog's output is
+ * full of numbers that are row indices, ranges and counts. The pattern used to
+ * be a bare `\b401\b`, so "row 401 is outside the sheet grid" — a pure Sheets
+ * range error — told the caller to re-authorize a healthy Google account.
+ *
+ * That is the same defect this PR exists to remove, reached from gog's stderr
+ * instead of the runner's status line: a caller is sent to do a manual,
+ * account-wide re-auth that cannot possibly fix their problem.
+ *
+ * So a 401 now has to look like a STATUS, not like an integer.
+ */
+const reauth = async (msg: string) => {
+  const r = await diagnose(new Error(msg));
+  return /Use gog_auth_add to re-authorize the account/i.test(r.content.map((c: any) => c.text).join('\n'));
+};
+
+describe('401 must look like a status, not any integer', () => {
+  it.each([
+    ['row 401 is outside the sheet grid'],
+    ['wrote 401 rows'],
+    ['A401:B401 exceeds grid limits'],
+    ['deleted 401 messages'],
+    ['sheet has 401 columns'],
+  ])('does NOT claim an auth failure for: %s', async (msg) => {
+    expect(await reauth(msg)).toBe(false);
+  });
+
+  it.each([
+    ['googleapi: Error 401: Invalid Credentials, authError'],
+    ['HTTP 401 Unauthorized'],
+    ['request failed with status 401'],
+    ['unexpected status code 401'],
+    ['401 Unauthorized'],
+    ['server responded 401: token rejected'],
+  ])('still DOES claim an auth failure for: %s', async (msg) => {
+    expect(await reauth(msg)).toBe(true);
+  });
+});

package/tests/tools/auth-401-shapes.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest';
+import { diagnose } from '../../src/tools/utils.js';
+
+/**
+ * #246: making 401 "look like a status" (#245 follow-up) required a separator
+ * between the status word and the number. `\s*[:=]?\s*` cannot cross an opening
+ * paren or a JSON quote, so the CANONICAL shape gog emits for a Google auth
+ * failure stopped matching entirely:
+ *
+ *   Google API error (401 authError): Invalid Credentials
+ *
+ * That shape is hard-coded in connector-runtime.ts as /Google API error \(401\b/
+ * and used as the fixture across auth-log and connector-runtime tests. Losing it
+ * is strictly worse than the `row 401` false positive that motivated the change:
+ * a false positive sends someone on a pointless re-auth, but this leaves a REAL
+ * dead credential with no hint at all.
+ */
+const reauth = async (msg: string) => {
+  const r = await diagnose(new Error(msg));
+  return /Use gog_auth_add to re-authorize the account/i.test(r.content.map((c: any) => c.text).join('\n'));
+};
+
+describe('401 shapes that ARE auth failures', () => {
+  it.each([
+    ['Google API error (401 authError): Invalid Credentials'],   // the canonical gog shape
+    ['Google API error (401): Invalid Credentials'],
+    ['{"code": 401, "message": "Invalid Credentials"}'],          // JSON body
+    ['{"status":401}'],
+    ['googleapi: Error 401: Invalid Credentials, authError'],
+    ['HTTP 401 Unauthorized'],
+    ['request failed with status 401'],
+    ['unexpected status code 401'],
+    ['response=401'],
+  ])('claims an auth failure for: %s', async (msg) => {
+    expect(await reauth(msg)).toBe(true);
+  });
+});
+
+describe('401 shapes that are NOT auth failures', () => {
+  it.each([
+    ['row 401 is outside the sheet grid'],
+    ['wrote 401 rows'],
+    ['A401:B401 exceeds grid limits'],
+    ['deleted 401 messages'],
+    ['sheet has 401 columns'],
+    ['error: could not write row 401'],   // status word present, but far from the number
+  ])('stays silent for: %s', async (msg) => {
+    expect(await reauth(msg)).toBe(false);
+  });
+});

package/tests/tools/utils.test.ts

@@ -1,8 +1,17 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import * as runner from '../../src/runner.js';
 import { runOrDiagnose, pushPaginationFlags, formatAccountList, formatAuthHealth } from '../../src/tools/utils.js';
-
-vi.mock('../../src/runner.js');
+import { RunnerTransportError } from '../../src/connector-runtime.js';
+
+// PARTIAL mock: only `run` is stubbed. A full automock would also replace
+// `RunnerTransportError` and `isRunnerTransportError`, and diagnose()'s whole
+// point is that it classifies the REAL class structurally — an automocked
+// brand check answers undefined for everything and the tests below would pass
+// while proving nothing.
+vi.mock('../../src/runner.js', async (importOriginal) => ({
+  ...(await importOriginal<typeof runner>()),
+  run: vi.fn(),
+}));
 
 beforeEach(() => vi.clearAllMocks());
 
@@ -455,3 +464,47 @@ describe('formatAuthHealth', () => {
     expect(formatAuthHealth('{"foo":1}', NOW)).toBe('{"foo":1}');
   });
 });
+
+// The connector's own transport failing is NOT the Google credential failing.
+// diagnose() must recognise that structurally, from the error's type, because
+// the runner's prose ("unauthorized") is indistinguishable from Google's.
+describe('diagnose: runner-authored transport failures', () => {
+  it('blames the runner key, not the Google account, for a transport-auth failure', async () => {
+    vi.mocked(runner.run)
+      .mockRejectedValueOnce(
+        new RunnerTransportError('gog-runner rejected the bearer token; GOG_RUNNER_KEY vs RUNNER_KEY', 'transport-auth', 401),
+      )
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['sheets', 'get', 'A1'], {});
+    const text = result.content[0].text as string;
+    expect(text).not.toContain('gog_auth_add');
+    expect(text).not.toMatch(/re-authorize the account/i);
+    expect(text).toContain('GOG_RUNNER_KEY');
+    expect(text).toContain('RUNNER_KEY');
+  });
+
+  it('lets the TYPE beat the prose: runner words that read like Google words get no re-auth hint', async () => {
+    // The regression this whole change exists to prevent. A runner-authored
+    // failure whose text happens to contain every Google auth signal must still
+    // not produce Google auth advice — the request never reached Google.
+    vi.mocked(runner.run)
+      .mockRejectedValueOnce(
+        new RunnerTransportError('unauthorized: 401 invalid_grant, token has been expired or revoked', 'transport-request', 400),
+      )
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['sheets', 'get', 'A1'], {});
+    const text = result.content[0].text as string;
+    expect(text).not.toContain('gog_auth_add');
+    expect(text).not.toContain('often transient');
+  });
+
+  it('advises a retry for a retryable transport failure', async () => {
+    vi.mocked(runner.run)
+      .mockRejectedValueOnce(new RunnerTransportError('gog-runner is restarting; retry this call.', 'transport-retryable', 503))
+      .mockResolvedValueOnce('user@gmail.com');
+    const result = await runOrDiagnose(['sheets', 'get', 'A1'], {});
+    const text = result.content[0].text as string;
+    expect(text).toContain('often transient');
+    expect(text).not.toContain('gog_auth_add');
+  });
+});