machinaos 0.0.76 → 0.0.78

package/server/tests/credentials/test_auth_service.py

@@ -3,7 +3,9 @@
 Locks in invariants 7 and 8 from docs-internal/credentials_panel.md:
   - store_api_key requires models=[]
   - Memory cache hit path does not query DB on every call
-  - clear_cache wipes _memory_cache, _models_cache, _oauth_cache
+  - clear_cache wipes _api_key_cache, _oauth_cache (one merged cache
+    per RFC 9700 + post-Wave-12 dedup; previously the API-key half was
+    split across _memory_cache + _models_cache).
 """
 
 from __future__ import annotations
@@ -91,8 +93,7 @@ class TestMemoryCache:
         await auth_service.store_api_key("openai", "sk-foo", models=[])
 
         # Wipe memory cache to simulate fresh process
-        auth_service._memory_cache.clear()
-        auth_service._models_cache.clear()
+        auth_service._api_key_cache.clear()
 
         call_count = {"n": 0}
         original = auth_service.credentials_db.get_api_key
@@ -111,19 +112,17 @@ class TestMemoryCache:
         assert await auth_service.get_api_key("openai") == "sk-foo"
         assert call_count["n"] == 1
 
-    async def test_clear_cache_wipes_all_three_caches(self, auth_service):
+    async def test_clear_cache_wipes_both_caches(self, auth_service):
         await auth_service.store_api_key("openai", "sk-foo", models=["gpt-4"])
         await auth_service.store_oauth_tokens("google", "a", "r", email="u@x.com")
 
         # Sanity: caches populated
-        assert auth_service._memory_cache
-        assert auth_service._models_cache
+        assert auth_service._api_key_cache
         assert auth_service._oauth_cache
 
         auth_service.clear_cache()
 
-        assert auth_service._memory_cache == {}
-        assert auth_service._models_cache == {}
+        assert auth_service._api_key_cache == {}
         assert auth_service._oauth_cache == {}
 
     async def test_clear_cache_does_not_delete_db_data(self, auth_service):
@@ -149,10 +148,18 @@ class TestOAuthOps:
         tokens = await auth_service.get_oauth_tokens("google")
         assert tokens is not None
         assert tokens["access_token"] == "access-1"
-        assert tokens["refresh_token"] == "refresh-1"
+        # Per RFC 9700 the refresh token is NOT returned by
+        # get_oauth_tokens — read via get_oauth_refresh_token() instead.
+        assert "refresh_token" not in tokens
         assert tokens["email"] == "u@example.com"
         assert tokens["scopes"] == "openid email"
 
+        # The refresh token is reachable through the dedicated helper
+        # that always reads from the encrypted DB (no in-memory cache).
+        assert (
+            await auth_service.get_oauth_refresh_token("google") == "refresh-1"
+        )
+
     async def test_remove_oauth_tokens(self, auth_service):
         await auth_service.store_oauth_tokens("google", "a", "r")
         ok = await auth_service.remove_oauth_tokens("google")

package/server/tests/credentials/test_credential_broadcasts.py

@@ -0,0 +1,219 @@
+"""Pytest invariant: every credential-mutation handler MUST broadcast.
+
+The frontend's `useCatalogueQuery` cache + `apiKeyStatuses` map both go
+stale unless the backend explicitly invalidates via:
+
+- ``broadcaster.update_api_key_status(...)`` — per-provider validation
+  state change (carries the validation result payload).
+- ``broadcaster.broadcast_credential_event("credential.*", ...)`` —
+  CloudEvents-typed mutation (refetch signal). Wraps ``WorkflowEvent``
+  from ``services.events.envelope``.
+
+Cross-tab visibility breaks the moment a handler omits both. This test
+locks the contract by reading each handler's source via
+``inspect.getsource`` and asserting it contains at least one of the two
+broadcast call patterns. New credential mutations that forget to
+broadcast fail CI before they ship.
+
+Companion: ``test_auth_service.py`` locks the DB-write-then-cache-update
+ordering inside AuthService.
+"""
+
+from __future__ import annotations
+
+import inspect
+import re
+
+import pytest
+
+
+pytestmark = pytest.mark.credentials
+
+
+# Match either:
+#   broadcaster.update_api_key_status(...)
+#   broadcaster.broadcast_credential_event("credential.<anything>", ...)
+# Anchor on `.update_api_key_status(` or `.broadcast_credential_event(`
+# so renames force a test update (intentional).
+_BROADCAST_PATTERN = re.compile(
+    r"\.(?:update_api_key_status|broadcast_credential_event)\s*\("
+)
+
+
+def _handler_source(handler) -> str:
+    """Return the unwrapped source of a handler decorated by `@ws_handler`."""
+    fn = handler
+    while hasattr(fn, "__wrapped__"):
+        fn = fn.__wrapped__
+    return inspect.getsource(fn)
+
+
+class TestCredentialMutationHandlersBroadcast:
+    """Every handler that mutates credential state MUST broadcast.
+
+    Failing this test means a frontend cache will go stale across tabs
+    after the mutation; users will see the wrong stored / connected
+    state until they manually refresh.
+    """
+
+    def test_validate_api_key_broadcasts(self):
+        """Validation broadcasts come from ``Credential.validate`` now.
+
+        ``handle_validate_api_key`` is a pure dispatcher that calls
+        ``CREDENTIAL_REGISTRY[provider].validate(...)``. The broadcast
+        happens inside ``Credential.validate`` (the shared scaffold in
+        ``services/plugin/credential.py``). This test checks the
+        invariant at the point where it actually lives.
+        """
+        from services.plugin.credential import Credential
+
+        src = inspect.getsource(Credential.validate)
+        assert _BROADCAST_PATTERN.search(src), (
+            "Credential.validate must broadcast via update_api_key_status — "
+            "every credential mutation must surface to connected clients."
+        )
+
+    def test_save_api_key_broadcasts(self):
+        from routers import websocket as ws_module
+
+        src = _handler_source(ws_module.handle_save_api_key)
+        assert _BROADCAST_PATTERN.search(src), (
+            "handle_save_api_key must broadcast credential.api_key.saved "
+            "via broadcast_credential_event so the catalogue's stored "
+            "flag flips on every connected client"
+        )
+
+    def test_delete_api_key_broadcasts(self):
+        from routers import websocket as ws_module
+
+        src = _handler_source(ws_module.handle_delete_api_key)
+        # Delete must trigger BOTH broadcasts: api_key_status (clears
+        # apiKeyStatuses) + credential.api_key.deleted (catalogue refetch).
+        matches = _BROADCAST_PATTERN.findall(src)
+        assert len(matches) >= 2, (
+            "handle_delete_api_key must broadcast both update_api_key_status "
+            "(clears apiKeyStatuses[provider]) AND broadcast_credential_event "
+            "('credential.api_key.deleted') (catalogue refetch). "
+            f"Found {len(matches)} broadcast call(s)."
+        )
+
+    def test_twitter_logout_broadcasts(self):
+        # Twitter handler moved to ``nodes/twitter/_handlers.py`` as
+        # part of the plugin-extraction migration. The invariant now
+        # asserts on the plugin-owned source.
+        from nodes.twitter._handlers import handle_twitter_logout
+
+        src = _handler_source(handle_twitter_logout)
+        assert _BROADCAST_PATTERN.search(src), (
+            "handle_twitter_logout must broadcast credential.oauth.disconnected"
+        )
+
+    def test_google_logout_broadcasts(self):
+        from nodes.google._handlers import handle_google_logout
+
+        src = _handler_source(handle_google_logout)
+        assert _BROADCAST_PATTERN.search(src), (
+            "handle_google_logout must broadcast credential.oauth.disconnected"
+        )
+
+
+class TestCredentialEventCloudEventsShape:
+    """The credential broadcast helper wraps `WorkflowEvent` so the
+    on-the-wire body is a CloudEvents v1.0 envelope. Locks the spec
+    fields so future refactors don't quietly drop required keys.
+    """
+
+    @pytest.fixture
+    def envelope(self):
+        from services.events.envelope import WorkflowEvent
+
+        event = WorkflowEvent(
+            source="machinaos://services/credentials",
+            type="credential.api_key.saved",
+            subject="openai",
+            data={"provider": "openai"},
+        )
+        return event.model_dump(mode="json")
+
+    def test_specversion_pinned_to_1(self, envelope):
+        assert envelope["specversion"] == "1.0"
+
+    def test_required_fields_present(self, envelope):
+        # CloudEvents 1.0 mandatory: id, source, specversion, type
+        for field in ("id", "source", "specversion", "type"):
+            assert envelope.get(field), f"missing required field: {field}"
+
+    def test_credential_subject_is_provider(self, envelope):
+        assert envelope["subject"] == "openai"
+
+    def test_event_type_namespaced(self, envelope):
+        # Convention: credential.<area>.<action>
+        assert envelope["type"].startswith("credential."), envelope["type"]
+
+
+class TestAuthServiceDbCanonicalInvariant:
+    """AuthService.store_*/remove_* must do the DB call before touching
+    the in-memory cache. Reverse order leaves a stale-cache window.
+
+    Static-source check; doesn't run the methods.
+    """
+
+    @pytest.fixture
+    def auth_source(self):
+        from services import auth as auth_module
+
+        return inspect.getsource(auth_module.AuthService)
+
+    @pytest.mark.parametrize(
+        "method_name,db_call",
+        [
+            ("store_api_key", "credentials_db.save_api_key"),
+            ("remove_api_key", "credentials_db.delete_api_key"),
+            ("store_oauth_tokens", "credentials_db.save_oauth_tokens"),
+            ("remove_oauth_tokens", "credentials_db.delete_oauth_tokens"),
+        ],
+    )
+    def test_method_calls_db(self, auth_source, method_name, db_call):
+        """Every store_*/remove_* method must call the canonical DB
+        method. Invariant breaks if a refactor accidentally bypasses
+        the DB and only updates the cache."""
+        # Find the method body in the AuthService source. Anchor end on
+        # the next method/class start OR end-of-string (the last method
+        # in the class has no trailing sibling).
+        method_re = re.compile(
+            rf"async def {method_name}\b.*?(?=\n    async def |\n    def |\nclass |\Z)",
+            re.DOTALL,
+        )
+        match = method_re.search(auth_source)
+        assert match, f"AuthService.{method_name} not found in source"
+        body = match.group(0)
+        assert db_call in body, (
+            f"AuthService.{method_name} must call self.{db_call}() "
+            f"before touching the in-memory cache (DB is canonical "
+            f"source of truth)"
+        )
+
+    def test_oauth_cache_does_not_carry_refresh_token(self, auth_source):
+        """Per RFC 9700, refresh tokens must not live in process memory.
+        store_oauth_tokens caches only the access token + display fields.
+        """
+        match = re.search(
+            r"async def store_oauth_tokens\b.*?(?=\n    async def |\n    def |\nclass )",
+            auth_source,
+            re.DOTALL,
+        )
+        assert match, "AuthService.store_oauth_tokens not found"
+        body = match.group(0)
+
+        # Find the cache-write block. It assigns to self._oauth_cache[...].
+        cache_block = re.search(
+            r"self\._oauth_cache\[\w+\]\s*=\s*\{[^}]+\}", body, re.DOTALL
+        )
+        assert cache_block, (
+            "AuthService.store_oauth_tokens must populate _oauth_cache"
+        )
+        assert '"refresh_token"' not in cache_block.group(0), (
+            "RFC 9700 violation: _oauth_cache entry must not carry "
+            "refresh_token. Use get_oauth_refresh_token() helper that "
+            "always reads from the encrypted DB."
+        )

package/server/tests/credentials/test_google_oauth.py

@@ -11,8 +11,8 @@ from urllib.parse import parse_qs, urlparse
 
 import pytest
 
-from services import google_oauth
-from services.google_oauth import GoogleOAuth, get_callback_paths
+from nodes.google import _oauth as google_oauth
+from nodes.google._oauth import GoogleOAuth, get_callback_paths
 
 
 pytestmark = pytest.mark.credentials
@@ -88,18 +88,18 @@ class TestAuthorizationUrl:
 
 
 class TestExchangeCode:
-    def test_unknown_state_fails(self, oauth):
+    async def test_unknown_state_fails(self, oauth):
         # Don't even register a state -- exchange must fail without hitting Google.
-        result = oauth.exchange_code("code", "never-generated-state")
+        result = await oauth.exchange_code("code", "never-generated-state")
         assert result["success"] is False
         assert "state" in result["error"].lower()
 
-    def test_state_consumed_on_failure(self, oauth):
+    async def test_state_consumed_on_failure(self, oauth):
         """Even if the token exchange fails, the state must be popped (single use)."""
         auth = oauth.generate_authorization_url()
         state = auth["state"]
         # Exchange will fail because we haven't mocked Google -- network error
-        oauth.exchange_code("invalid-code", state)
+        await oauth.exchange_code("invalid-code", state)
         # State must be gone regardless of success
         assert state not in google_oauth._oauth_states
 

package/server/tests/credentials/test_oauth_utils.py

@@ -80,7 +80,7 @@ class TestGetRedirectUri:
 
     def test_paths_loaded_from_config_not_hardcoded(self):
         """Smoke test: the real config must expose google + twitter paths."""
-        from services.google_oauth import get_callback_paths
+        from nodes.google._oauth import get_callback_paths
 
         paths = get_callback_paths()
         assert "google" in paths

package/server/tests/credentials/test_twitter_oauth.py

@@ -16,8 +16,8 @@ import httpx
 import pytest
 import respx
 
-from services import twitter_oauth
-from services.twitter_oauth import (
+from nodes.twitter import _oauth as twitter_oauth
+from nodes.twitter._oauth import (
     TwitterOAuth,
     TOKEN_URL,
     REVOKE_URL,

package/server/tests/credentials/test_websocket_handlers.py

@@ -60,6 +60,10 @@ def patched_container(monkeypatch, auth_service):
     # not on services.status_broadcaster (the bound name in the handler module).
     fake_broadcaster = MagicMock()
     fake_broadcaster.update_api_key_status = AsyncMock()
+    # Wave-12 credential broadcast helper used by save / delete /
+    # oauth-logout handlers. Wraps WorkflowEvent (CloudEvents v1.0)
+    # and broadcasts as `credential_catalogue_updated`.
+    fake_broadcaster.broadcast_credential_event = AsyncMock()
     fake_broadcaster.broadcast = AsyncMock()
     fake_broadcaster._status = {}
     monkeypatch.setattr(ws_module, "get_status_broadcaster", lambda: fake_broadcaster)
@@ -110,22 +114,23 @@ class TestValidateApiKey:
         # Broadcaster notified with hasKey + models
         patched_container.broadcaster.update_api_key_status.assert_awaited_once()
 
-    @patch("services.ai.PROVIDER_CONFIGS", {})
-    @patch.object(ws_module, "_SPECIAL_PROVIDER_VALIDATORS", {})
-    async def test_validate_skips_model_fetch_for_non_llm(
+    async def test_validate_unknown_provider_returns_error(
         self, patched_container, fake_ws
     ):
-        # Pick a provider that's neither in PROVIDER_CONFIGS (LLM) nor in
-        # _SPECIAL_PROVIDER_VALIDATORS (Google Maps / Apify probe). The
-        # handler should fall through to the empty-models path.
+        # ``handle_validate_api_key`` dispatches via
+        # ``CREDENTIAL_REGISTRY``; a provider without a registered
+        # ``Credential`` subclass is an explicit error (no fall-through
+        # to the default LLM probe — every supported provider must own
+        # its credential class).
         result = await _call(
             ws_module.handle_validate_api_key,
             {"provider": "anonymous_provider", "api_key": "any-test"},
             fake_ws,
         )
 
-        assert result["valid"] is True
-        assert result["models"] == []
+        assert result["success"] is False
+        assert result["valid"] is False
+        assert "anonymous_provider" in result["error"]
         patched_container.ai.fetch_models.assert_not_called()
 
     async def test_missing_required_fields_returns_error(
@@ -214,14 +219,22 @@ class TestDeleteApiKey:
 
 
 class TestTwitterOAuthHandlers:
+    # Twitter handlers moved to ``nodes/twitter/_handlers.py`` as part
+    # of the plugin-extraction migration. The tests now import
+    # directly from the plugin folder; the dispatch contract via
+    # ``register_ws_handlers`` is exercised by
+    # ``test_plugin_self_containment.py``.
+
     async def test_login_fails_without_client_id(self, patched_container, fake_ws):
-        result = await _call(ws_module.handle_twitter_oauth_login, {}, fake_ws)
+        from nodes.twitter._handlers import handle_twitter_oauth_login
+        result = await _call(handle_twitter_oauth_login, {}, fake_ws)
         assert result["success"] is False
         assert "Client ID" in result["error"]
 
     async def test_login_returns_authorization_url(
         self, patched_container, fake_ws
     ):
+        from nodes.twitter._handlers import handle_twitter_oauth_login
         await patched_container.auth.store_api_key(
             "twitter_client_id", "ci-test", models=[]
         )
@@ -229,41 +242,51 @@ class TestTwitterOAuthHandlers:
             "twitter_client_secret", "cs-test", models=[]
         )
 
-        result = await _call(ws_module.handle_twitter_oauth_login, {}, fake_ws)
+        result = await _call(handle_twitter_oauth_login, {}, fake_ws)
 
         assert result["success"] is True
         assert result["url"].startswith("https://x.com/i/oauth2/authorize")
         assert "state" in result
 
     async def test_status_when_disconnected(self, patched_container, fake_ws):
-        result = await _call(ws_module.handle_twitter_oauth_status, {}, fake_ws)
+        from nodes.twitter._handlers import handle_twitter_oauth_status
+        result = await _call(handle_twitter_oauth_status, {}, fake_ws)
         assert result["connected"] is False
         assert result["username"] is None
 
     async def test_logout_clears_oauth_tokens(self, patched_container, fake_ws):
-        # Pre-populate OAuth tokens
+        from nodes.twitter._handlers import handle_twitter_logout
         await patched_container.auth.store_oauth_tokens(
             "twitter", "access", "refresh"
         )
-        # Mock the revoke calls so we don't hit the network
-        with patch("services.twitter_oauth.TwitterOAuth.revoke_token", new=AsyncMock(return_value={"success": True})):
-            result = await _call(ws_module.handle_twitter_logout, {}, fake_ws)
+        with patch(
+            "nodes.twitter._oauth.TwitterOAuth.revoke_token",
+            new=AsyncMock(return_value={"success": True}),
+        ):
+            result = await _call(handle_twitter_logout, {}, fake_ws)
 
         assert result["success"] is True
         assert await patched_container.auth.get_oauth_tokens("twitter") is None
 
 
 class TestGoogleOAuthHandlers:
+    # Google OAuth handlers moved to ``nodes/google/_handlers.py`` as
+    # part of the plugin-extraction migration. Tests now import from
+    # the plugin folder; the dispatch contract is exercised by
+    # ``test_plugin_self_containment.py``.
+
     async def test_login_fails_without_client_credentials(
         self, patched_container, fake_ws
     ):
-        result = await _call(ws_module.handle_google_oauth_login, {}, fake_ws)
+        from nodes.google._handlers import handle_google_oauth_login
+        result = await _call(handle_google_oauth_login, {}, fake_ws)
         assert result["success"] is False
         assert "Client ID" in result["error"]
 
     async def test_login_returns_authorization_url(
         self, patched_container, fake_ws
     ):
+        from nodes.google._handlers import handle_google_oauth_login
         await patched_container.auth.store_api_key(
             "google_client_id", "ci.apps.googleusercontent.com", models=[]
         )
@@ -271,7 +294,7 @@ class TestGoogleOAuthHandlers:
             "google_client_secret", "cs-test", models=[]
         )
 
-        result = await _call(ws_module.handle_google_oauth_login, {}, fake_ws)
+        result = await _call(handle_google_oauth_login, {}, fake_ws)
 
         assert result["success"] is True
         assert result["url"].startswith("https://accounts.google.com/o/oauth2/auth")
@@ -279,15 +302,16 @@ class TestGoogleOAuthHandlers:
         assert "prompt=consent" in result["url"]
 
     async def test_status_when_disconnected(self, patched_container, fake_ws):
-        result = await _call(ws_module.handle_google_oauth_status, {}, fake_ws)
-        # success may be auto-injected by the decorator; check connected=False
+        from nodes.google._handlers import handle_google_oauth_status
+        result = await _call(handle_google_oauth_status, {}, fake_ws)
         assert result["connected"] is False
         assert result["email"] is None
 
     async def test_logout_removes_oauth_tokens(self, patched_container, fake_ws):
+        from nodes.google._handlers import handle_google_logout
         await patched_container.auth.store_oauth_tokens(
             "google", "access", "refresh", email="user@example.com"
         )
-        result = await _call(ws_module.handle_google_logout, {}, fake_ws)
+        result = await _call(handle_google_logout, {}, fake_ws)
         assert result["success"] is True
         assert await patched_container.auth.get_oauth_tokens("google") is None

package/server/tests/llm/test_factory.py

@@ -11,6 +11,7 @@ def test_native_providers_set():
     assert NATIVE_PROVIDERS == {
         "anthropic", "openai", "gemini", "openrouter", "xai",
         "deepseek", "kimi", "mistral",
+        "ollama", "lmstudio",
     }
 
 

package/server/tests/llm/test_wiring.py

@@ -107,7 +107,11 @@ async def test_fetch_models_uses_native_for_anthropic(ai_service):
         models = await ai_service.fetch_models("anthropic", "sk-ant-test")
 
     assert models == expected_models
-    mock_factory.assert_called_once_with("anthropic", "sk-ant-test")
+    # ai.fetch_models forwards `proxy_url` (defaulting to None) to the native
+    # factory so the Ollama-pattern proxy override path stays uniform with
+    # execute_chat. Asserting the full call signature including the explicit
+    # `None` kwarg ensures the proxy path is not silently dropped.
+    mock_factory.assert_called_once_with("anthropic", "sk-ant-test", proxy_url=None)
 
 
 @pytest.mark.asyncio

package/server/tests/nodes/_compat.py

@@ -91,33 +91,33 @@ async def _execute_current_time(
 
 async def _execute_duckduckgo_search(
     args: Dict[str, Any],
-    node_params: Dict[str, Any] = None,
+    config: Dict[str, Any] = None,
 ) -> Dict[str, Any]:
-    """Shim for deleted services.handlers.tools._execute_duckduckgo_search."""
-    try:
-        # Plugin layout under scaling branch: nodes/search/duckduckgo_search.py
-        from nodes.search.duckduckgo_search import (
-            DuckDuckGoSearchNode,
-            DuckDuckGoSearchParams,
-        )
-    except ImportError:
-        return {"error": "duckduckgo search plugin missing"}
+    """Flat (args, config) -> dict shim for the deleted
+    ``services.handlers.tools._execute_duckduckgo_search``.
 
-    q = str(args.get("query", "")).strip()
-    if not q:
+    Wave 11.I milestone O moved this here from production code -- it
+    only ever served contract tests that patch ``sys.modules['ddgs']``
+    and assert the flat output shape. Production callers go through
+    :class:`nodes.search.duckduckgo_search.DuckDuckGoSearchNode`.
+    """
+    config = config or {}
+    query = str(args.get("query", "")).strip()
+    if not query:
         return {"error": "No search query provided"}
-
-    params = DuckDuckGoSearchParams(
-        query=q,
-        max_results=int(args.get("max_results", args.get("maxResults", 5))),
-    )
-
-    node = DuckDuckGoSearchNode()
-    try:
-        out = await node.search(_DummyContext(), params)
-    except Exception as exc:
-        return {"error": str(exc)}
-    return out.model_dump() if hasattr(out, "model_dump") else dict(out)
+    max_results = int(config.get("max_results", args.get("max_results", 5)))
+    provider = config.get("provider", "duckduckgo")
+    from ddgs import DDGS
+    raw = list(DDGS().text(query, max_results=max_results))
+    results = [
+        {
+            "title": item.get("title", ""),
+            "snippet": item.get("body", ""),
+            "url": item.get("href", ""),
+        }
+        for item in raw
+    ]
+    return {"query": query, "provider": provider, "results": results}
 
 
 async def handle_write_todos(