muonroi-cli 1.2.3 → 1.3.2

package/dist/src/providers/auth/__tests__/gemini-oauth.test.js

@@ -0,0 +1,310 @@
+/**
+ * Tests for src/providers/auth/gemini-oauth.ts
+ *
+ * Login flow (callback server mocked), refresh (expiry pre-emption + mutex),
+ * revoke, authHeaders, loadGeminiTokensWithRefresh.
+ * No live network calls — all HTTP via mockFetch, no real browser opens.
+ */
+import { describe, expect, it, vi } from "vitest";
+import { GeminiOAuthProvider, loadGeminiTokensWithRefresh } from "../gemini-oauth.js";
+import { OAuthLoginError, OAuthRefreshError } from "../types.js";
+function makeMockFetch(responses) {
+    let idx = 0;
+    return vi.fn(async (_url, _init) => {
+        const resp = responses[idx++];
+        const r = typeof resp === "function" ? resp() : (resp ?? { ok: false, status: 500 });
+        return {
+            ok: r.ok,
+            status: r.status ?? (r.ok ? 200 : 400),
+            json: r.json ?? (() => Promise.resolve({})),
+            text: r.text ?? (() => Promise.resolve("")),
+        };
+    });
+}
+// ---------------------------------------------------------------------------
+// Mock callback server factory
+//
+// Immediately resolves with the given code so tests don't wait for a browser.
+// ---------------------------------------------------------------------------
+function makeMockCallbackServer(codeToReturn, delayMs = 0) {
+    return vi.fn((opts) => new Promise((resolve) => {
+        const server = {
+            port: 59999,
+            url: "http://127.0.0.1:59999/callback",
+            close: vi.fn(),
+        };
+        resolve(server);
+        // Fire onCode after server resolves (optionally delayed)
+        setTimeout(() => opts.onCode(codeToReturn, ""), delayMs);
+    }));
+}
+// ---------------------------------------------------------------------------
+// login — happy path
+// ---------------------------------------------------------------------------
+describe("GeminiOAuthProvider.login", () => {
+    it("completes browser-redirect flow and returns tokens with email", async () => {
+        const mockFetch = makeMockFetch([
+            // 1. token exchange
+            {
+                ok: true,
+                json: () => Promise.resolve({
+                    access_token: "fixture-access-tok",
+                    refresh_token: "fixture-refresh-tok",
+                    id_token: "fixture-id-tok",
+                    expires_in: 3600,
+                }),
+            },
+            // 2. userinfo
+            { ok: true, json: () => Promise.resolve({ email: "user@gmail.com", sub: "12345" }) },
+        ]);
+        const callbackServerFn = makeMockCallbackServer("auth-code-xyz");
+        const openBrowserFn = vi.fn();
+        const provider = new GeminiOAuthProvider({
+            clientId: "test-client-id",
+            clientSecret: "test-secret",
+            fetchFn: mockFetch,
+            callbackServerFn,
+            openBrowserFn,
+        });
+        const onUserCodeFn = vi.fn();
+        const tokens = await provider.login({ onUserCode: onUserCodeFn });
+        expect(tokens.accessToken).toBe("fixture-access-tok");
+        expect(tokens.refreshToken).toBe("fixture-refresh-tok");
+        expect(tokens.idToken).toBe("fixture-id-tok");
+        expect(tokens.email).toBe("user@gmail.com");
+        expect(tokens.expiresAt).toBeGreaterThan(Date.now());
+        // openBrowser should have been called
+        expect(openBrowserFn).toHaveBeenCalledOnce();
+        // URL should contain Google auth endpoint
+        const authorizeUrl = openBrowserFn.mock.calls[0][0];
+        expect(authorizeUrl).toContain("accounts.google.com");
+        expect(authorizeUrl).toContain("client_id=test-client-id");
+        expect(authorizeUrl).toContain("code_challenge_method=S256");
+        // onUserCode should have been invoked with the authorize URL
+        expect(onUserCodeFn).toHaveBeenCalledOnce();
+    });
+    it("login still works when userinfo endpoint fails (email is optional)", async () => {
+        const mockFetch = makeMockFetch([
+            // token exchange
+            {
+                ok: true,
+                json: () => Promise.resolve({
+                    access_token: "acc",
+                    refresh_token: "ref",
+                    expires_in: 3600,
+                }),
+            },
+            // userinfo — failure (non-fatal)
+            { ok: false, status: 401 },
+        ]);
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: makeMockCallbackServer("code123"),
+            openBrowserFn: vi.fn(),
+        });
+        const tokens = await provider.login({});
+        expect(tokens.accessToken).toBe("acc");
+        expect(tokens.email).toBeUndefined();
+    });
+    it("throws OAuthLoginError when callback server rejects", async () => {
+        const failingCallbackServer = vi.fn(() => Promise.reject(new Error("port in use")));
+        const provider = new GeminiOAuthProvider({
+            fetchFn: vi.fn(),
+            callbackServerFn: failingCallbackServer,
+            openBrowserFn: vi.fn(),
+        });
+        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
+    });
+    it("throws OAuthLoginError when token exchange fails", async () => {
+        const mockFetch = makeMockFetch([
+            // token exchange fails
+            { ok: false, status: 400, text: () => Promise.resolve('{"error":"invalid_grant"}') },
+        ]);
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: makeMockCallbackServer("some-code"),
+            openBrowserFn: vi.fn(),
+        });
+        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
+    });
+});
+// ---------------------------------------------------------------------------
+// refresh
+// ---------------------------------------------------------------------------
+describe("GeminiOAuthProvider.refresh", () => {
+    const makeExpiredTokens = () => ({
+        accessToken: "old-access",
+        refreshToken: "old-refresh",
+        expiresAt: Date.now() - 1000, // already expired
+        email: "user@gmail.com",
+    });
+    const makeFreshTokens = () => ({
+        accessToken: "fresh-access",
+        refreshToken: "fresh-refresh",
+        expiresAt: Date.now() + 3_600_000, // 1 hour from now
+        email: "user@gmail.com",
+    });
+    it("refreshes expired tokens", async () => {
+        const mockFetch = makeMockFetch([
+            {
+                ok: true,
+                json: () => Promise.resolve({
+                    access_token: "new-access-tok",
+                    refresh_token: "new-refresh-tok",
+                    expires_in: 3600,
+                }),
+            },
+        ]);
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: vi.fn(),
+            openBrowserFn: vi.fn(),
+        });
+        const tokens = await provider.refresh(makeExpiredTokens());
+        expect(tokens.accessToken).toBe("new-access-tok");
+        expect(tokens.refreshToken).toBe("new-refresh-tok");
+        expect(tokens.expiresAt).toBeGreaterThan(Date.now());
+        expect(tokens.email).toBe("user@gmail.com");
+    });
+    it("skips refresh when tokens are still fresh", async () => {
+        const mockFetch = vi.fn();
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: vi.fn(),
+            openBrowserFn: vi.fn(),
+        });
+        const fresh = makeFreshTokens();
+        const result = await provider.refresh(fresh);
+        expect(result).toBe(fresh); // same reference — no refresh
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+    it("throws OAuthRefreshError on HTTP error", async () => {
+        const mockFetch = makeMockFetch([
+            { ok: false, status: 400, text: () => Promise.resolve('{"error":"invalid_grant"}') },
+        ]);
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: vi.fn(),
+            openBrowserFn: vi.fn(),
+        });
+        await expect(provider.refresh(makeExpiredTokens())).rejects.toThrow(OAuthRefreshError);
+    });
+    it("concurrent refresh calls both complete without error", async () => {
+        // Mutex serializes calls but both may hit the network since the token
+        // reference passed in is the same stale object (not mutated in-place).
+        // What matters: both complete without throwing, both return valid tokens.
+        let callCount = 0;
+        const mockFetch = vi.fn(async () => {
+            callCount++;
+            await new Promise((r) => setTimeout(r, 10));
+            return {
+                ok: true,
+                status: 200,
+                json: () => Promise.resolve({
+                    access_token: `access-${callCount}`,
+                    refresh_token: "refreshed",
+                    expires_in: 3600,
+                }),
+                text: () => Promise.resolve(""),
+            };
+        });
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: vi.fn(),
+            openBrowserFn: vi.fn(),
+        });
+        const expired = makeExpiredTokens();
+        const [r1, r2] = await Promise.all([provider.refresh(expired), provider.refresh(expired)]);
+        // Both calls should return valid access tokens
+        expect(r1.accessToken).toMatch(/^access-\d+$/);
+        expect(r2.accessToken).toMatch(/^access-\d+$/);
+        // Mutex serializes: calls complete sequentially
+        expect(callCount).toBeGreaterThanOrEqual(1);
+    });
+});
+// ---------------------------------------------------------------------------
+// revoke
+// ---------------------------------------------------------------------------
+describe("GeminiOAuthProvider.revoke", () => {
+    it("calls revoke endpoint with refresh token", async () => {
+        const mockFetch = makeMockFetch([{ ok: true }]);
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: vi.fn(),
+            openBrowserFn: vi.fn(),
+        });
+        await provider.revoke({
+            accessToken: "acc",
+            refreshToken: "ref-to-revoke",
+            expiresAt: Date.now() + 3600_000,
+        });
+        expect(mockFetch).toHaveBeenCalledOnce();
+        const [url] = mockFetch.mock.calls[0];
+        expect(url).toContain("oauth2.googleapis.com/revoke");
+        expect(url).toContain("token=ref-to-revoke");
+    });
+    it("does not throw when revoke endpoint returns error (best-effort)", async () => {
+        const mockFetch = makeMockFetch([{ ok: false, status: 500 }]);
+        const provider = new GeminiOAuthProvider({
+            fetchFn: mockFetch,
+            callbackServerFn: vi.fn(),
+            openBrowserFn: vi.fn(),
+        });
+        // Should not throw
+        await expect(provider.revoke({ accessToken: "acc", refreshToken: "ref", expiresAt: Date.now() })).resolves.toBeUndefined();
+    });
+});
+// ---------------------------------------------------------------------------
+// authHeaders
+// ---------------------------------------------------------------------------
+describe("GeminiOAuthProvider.authHeaders", () => {
+    it("returns only Authorization header (no extra Google-specific header)", () => {
+        const provider = new GeminiOAuthProvider({ callbackServerFn: vi.fn(), openBrowserFn: vi.fn() });
+        const tok = "fixture-auth-tok";
+        const headers = provider.authHeaders({
+            accessToken: tok,
+            refreshToken: "ref",
+            expiresAt: Date.now() + 3600_000,
+        });
+        // Authorization should carry the access token as a bearer scheme
+        const authValue = headers["Authorization"] ?? "";
+        expect(authValue.startsWith("Bearer ")).toBe(true);
+        expect(authValue.endsWith(tok)).toBe(true);
+        // Confirm no extra keys (Google OAuth needs only Authorization, no account header)
+        expect(Object.keys(headers)).toHaveLength(1);
+    });
+});
+// ---------------------------------------------------------------------------
+// loadGeminiTokensWithRefresh
+// ---------------------------------------------------------------------------
+describe("loadGeminiTokensWithRefresh", () => {
+    it("returns null when no tokens are stored", async () => {
+        vi.doMock("../token-store.js", () => ({
+            loadTokens: vi.fn().mockResolvedValue(null),
+            saveTokens: vi.fn(),
+        }));
+        const result = await loadGeminiTokensWithRefresh();
+        expect(result).toBeNull();
+        vi.doUnmock("../token-store.js");
+    });
+    it("returns tokens directly when not close to expiry", async () => {
+        const stored = {
+            accessToken: "valid-access",
+            refreshToken: "valid-refresh",
+            expiresAt: Date.now() + 3_600_000, // 1 hour from now — not within 60s window
+            email: "user@gmail.com",
+        };
+        vi.doMock("../token-store.js", () => ({
+            loadTokens: vi.fn().mockResolvedValue(stored),
+            saveTokens: vi.fn(),
+        }));
+        const mockProvider = {
+            refresh: vi.fn(),
+        };
+        const result = await loadGeminiTokensWithRefresh(mockProvider);
+        expect(result).toEqual(stored);
+        expect(mockProvider.refresh).not.toHaveBeenCalled();
+        vi.doUnmock("../token-store.js");
+    });
+});
+//# sourceMappingURL=gemini-oauth.test.js.map

package/dist/src/providers/auth/__tests__/gemini-oauth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-oauth.test.js","sourceRoot":"","sources":["../../../../../src/providers/auth/__tests__/gemini-oauth.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAajE,SAAS,aAAa,CAAC,SAAqD;IAC1E,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,KAAmB,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrF,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;SAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAE9E,SAAS,sBAAsB,CAAC,YAAoB,EAAE,OAAO,GAAG,CAAC;IAC/D,OAAO,EAAE,CAAC,EAAE,CACV,CAAC,IAA2E,EAAE,EAAE,CAC9E,IAAI,OAAO,CAAmD,CAAC,OAAO,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iCAAiC;YACtC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;SACf,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,CAAC;QAChB,yDAAyD;QACzD,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,oBAAoB;YACpB;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;oBACd,YAAY,EAAE,oBAAoB;oBAClC,aAAa,EAAE,qBAAqB;oBACpC,QAAQ,EAAE,gBAAgB;oBAC1B,UAAU,EAAE,IAAI;iBACjB,CAAC;aACL;YACD,cAAc;YACd,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE;SACrF,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAE9B,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,QAAQ,EAAE,gBAAgB;YAC1B,YAAY,EAAE,aAAa;YAC3B,OAAO,EAAE,SAA+B;YACxC,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QAElE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAErD,sCAAsC;QACtC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC7C,0CAA0C;QAC1C,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QAC3D,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAE7D,6DAA6D;QAC7D,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,iBAAiB;YACjB;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;oBACd,YAAY,EAAE,KAAK;oBACnB,aAAa,EAAE,KAAK;oBACpB,UAAU,EAAE,IAAI;iBACjB,CAAC;aACL;YACD,iCAAiC;YACjC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,sBAAsB,CAAC,SAAS,CAAC;YACnD,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,qBAAqB,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAwB;YACtC,gBAAgB,EAAE,qBAAqB;YACvC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,uBAAuB;YACvB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE;SACrF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,sBAAsB,CAAC,WAAW,CAAC;YACrD,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,MAAM,iBAAiB,GAAG,GAAgB,EAAE,CAAC,CAAC;QAC5C,WAAW,EAAE,YAAY;QACzB,YAAY,EAAE,aAAa;QAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,kBAAkB;QAChD,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,GAAgB,EAAE,CAAC,CAAC;QAC1C,WAAW,EAAE,cAAc;QAC3B,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,kBAAkB;QACrD,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;oBACd,YAAY,EAAE,gBAAgB;oBAC9B,aAAa,EAAE,iBAAiB;oBAChC,UAAU,EAAE,IAAI;iBACjB,CAAC;aACL;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B;QAC1D,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE;SACrF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;YACjC,SAAS,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;oBACd,YAAY,EAAE,UAAU,SAAS,EAAE;oBACnC,aAAa,EAAE,WAAW;oBAC1B,UAAU,EAAE,IAAI;iBACjB,CAAC;gBACJ,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;aAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAE3F,+CAA+C;QAC/C,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,gDAAgD;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,MAAM,CAAC;YACpB,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;SACjC,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAa,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACvC,OAAO,EAAE,SAA+B;YACxC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;YACzB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;SACvB,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,MAAM,CACV,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CACpF,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC;YACnC,WAAW,EAAE,GAAG;YAChB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;SACjC,CAAC,CAAC;QAEH,iEAAiE;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,mFAAmF;QACnF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;YACpC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAC3C,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;SACpB,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAE1B,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,GAAgB;YAC1B,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,0CAA0C;YAC7E,KAAK,EAAE,gBAAgB;SACxB,CAAC;QAEF,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;YACpC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC7C,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;SACpB,CAAC,CAAC,CAAC;QAEJ,MAAM,YAAY,GAAG;YACnB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;SACiB,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAEpD,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/providers/auth/__tests__/openai-oauth.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Tests for src/providers/auth/openai-oauth.ts
+ *
+ * Authorization Code + PKCE loopback flow. All HTTP + browser + callback
+ * server are mocked.
+ */
+export {};

package/dist/src/providers/auth/__tests__/openai-oauth.test.js

@@ -0,0 +1,309 @@
+/**
+ * Tests for src/providers/auth/openai-oauth.ts
+ *
+ * Authorization Code + PKCE loopback flow. All HTTP + browser + callback
+ * server are mocked.
+ */
+import { describe, expect, it, vi } from "vitest";
+import { OpenAIOAuthProvider } from "../openai-oauth.js";
+import { OAuthLoginError, OAuthRefreshError } from "../types.js";
+function makeMockFetch(responses) {
+    let idx = 0;
+    return vi.fn(async (_url, _init) => {
+        const resp = responses[idx++];
+        const r = typeof resp === "function" ? resp() : resp;
+        return {
+            ok: r.ok,
+            status: r.status ?? (r.ok ? 200 : 400),
+            json: r.json ?? (() => Promise.resolve({})),
+            text: r.text ?? (() => Promise.resolve("")),
+        };
+    });
+}
+/**
+ * Returns a CallbackServerFn that simulates a browser hitting the callback
+ * URL with `?code=<authCode>&state=<state>` shortly after the server binds.
+ * The state echoed back is read from the authorize URL passed to onUserCode
+ * via a captured side-channel.
+ */
+function makeMockCallbackServer(authCode, echoState) {
+    return vi.fn(async (opts) => {
+        const port = opts.port ?? 1455;
+        const path = opts.path ?? "/auth/callback";
+        const url = `http://localhost:${port}${path}`;
+        // Fire the callback asynchronously to simulate the browser round-trip.
+        setTimeout(() => opts.onCode(authCode, echoState()), 1);
+        const server = {
+            port,
+            url,
+            close: vi.fn(),
+        };
+        return server;
+    });
+}
+// ---------------------------------------------------------------------------
+// Happy-path login
+// ---------------------------------------------------------------------------
+describe("OpenAIOAuthProvider.login", () => {
+    it("runs Authorization Code + PKCE loopback flow and returns tokens with email", async () => {
+        const mockFetch = makeMockFetch([
+            // token exchange
+            {
+                ok: true,
+                json: () => Promise.resolve({
+                    access_token: "acc-tok-fixture",
+                    refresh_token: "refresh_abc",
+                    id_token: "mock-id-token",
+                    expires_in: 3600,
+                    account_id: "acc_789",
+                }),
+            },
+            // userinfo
+            { ok: true, json: () => Promise.resolve({ email: "user@example.com", name: "Test User" }) },
+        ]);
+        let capturedAuthorizeUrl = "";
+        const openBrowser = vi.fn((url) => {
+            capturedAuthorizeUrl = url;
+        });
+        const callbackServer = makeMockCallbackServer("auth_code_xyz", () => {
+            const u = new URL(capturedAuthorizeUrl);
+            return u.searchParams.get("state") ?? "";
+        });
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+            callbackServerFn: callbackServer,
+            openBrowserFn: openBrowser,
+        });
+        const userCodeCb = vi.fn();
+        const tokens = await provider.login({ onUserCode: userCodeCb });
+        // onUserCode receives the authorize URL (both args identical).
+        expect(userCodeCb).toHaveBeenCalled();
+        const [arg0, arg1] = userCodeCb.mock.calls[0];
+        expect(arg0).toBe(arg1);
+        expect(arg0).toContain("https://auth.openai.com/oauth/authorize");
+        expect(arg0).toContain("response_type=code");
+        expect(arg0).toContain("code_challenge_method=S256");
+        expect(arg0).toContain("codex_cli_simplified_flow=true");
+        expect(arg0).toContain("originator=codex_cli_rs");
+        expect(arg0).toContain("api.connectors.read");
+        expect(arg0).not.toContain("access_type=offline");
+        expect(arg0).not.toContain("prompt=consent");
+        expect(arg0).toContain("redirect_uri=http%3A%2F%2Flocalhost%3A1455%2Fauth%2Fcallback");
+        expect(openBrowser).toHaveBeenCalled();
+        expect(tokens.accessToken).toBe("acc-tok-fixture");
+        expect(tokens.refreshToken).toBe("refresh_abc");
+        expect(tokens.accountId).toBe("acc_789");
+        expect(tokens.email).toBe("user@example.com");
+        expect(tokens.expiresAt).toBeGreaterThan(Date.now());
+        // Token exchange POST body should carry the auth code + code_verifier.
+        const [tokenUrl, tokenInit] = mockFetch.mock.calls[0];
+        expect(tokenUrl).toBe("https://auth.openai.com/oauth/token");
+        const body = new URLSearchParams(tokenInit.body);
+        expect(body.get("grant_type")).toBe("authorization_code");
+        expect(body.get("code")).toBe("auth_code_xyz");
+        expect(body.get("redirect_uri")).toBe("http://localhost:1455/auth/callback");
+        expect(body.get("code_verifier")).toBeTruthy();
+    });
+    it("throws OAuthLoginError when token exchange fails", async () => {
+        const mockFetch = makeMockFetch([{ ok: false, status: 400, text: () => Promise.resolve("invalid_grant") }]);
+        let capturedAuthorizeUrl = "";
+        const openBrowser = vi.fn((url) => {
+            capturedAuthorizeUrl = url;
+        });
+        const callbackServer = makeMockCallbackServer("bad_code", () => {
+            const u = new URL(capturedAuthorizeUrl);
+            return u.searchParams.get("state") ?? "";
+        });
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+            callbackServerFn: callbackServer,
+            openBrowserFn: openBrowser,
+        });
+        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
+    });
+    it("throws on state mismatch (CSRF guard)", async () => {
+        const mockFetch = makeMockFetch([]);
+        const openBrowser = vi.fn();
+        // Callback returns a state that does NOT match the one in the authorize URL.
+        const callbackServer = makeMockCallbackServer("auth_code_xyz", () => "attacker_state");
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+            callbackServerFn: callbackServer,
+            openBrowserFn: openBrowser,
+        });
+        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
+    });
+    it("falls back to port 1457 when 1455 is occupied", async () => {
+        const mockFetch = makeMockFetch([
+            {
+                ok: true,
+                json: () => Promise.resolve({ access_token: "acc", refresh_token: "r", expires_in: 3600 }),
+            },
+            { ok: true, json: () => Promise.resolve({ email: "u@example.com" }) },
+        ]);
+        let capturedAuthorizeUrl = "";
+        let attempt = 0;
+        const callbackServer = vi.fn(async (opts) => {
+            attempt++;
+            if (attempt === 1) {
+                throw new Error("EADDRINUSE");
+            }
+            const port = opts.port ?? 1457;
+            const url = `http://localhost:${port}${opts.path}`;
+            setTimeout(() => {
+                const u = new URL(capturedAuthorizeUrl);
+                opts.onCode("auth_code", u.searchParams.get("state") ?? "");
+            }, 1);
+            return { port, url, close: vi.fn() };
+        });
+        const openBrowser = vi.fn((url) => {
+            capturedAuthorizeUrl = url;
+        });
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+            callbackServerFn: callbackServer,
+            openBrowserFn: openBrowser,
+        });
+        const tokens = await provider.login({});
+        expect(tokens.accessToken).toBe("acc");
+        expect(attempt).toBe(2);
+        expect(capturedAuthorizeUrl).toContain("redirect_uri=http%3A%2F%2Flocalhost%3A1457%2Fauth%2Fcallback");
+    });
+});
+// ---------------------------------------------------------------------------
+// refresh
+// ---------------------------------------------------------------------------
+describe("OpenAIOAuthProvider.refresh", () => {
+    const expiredTokens = {
+        accessToken: "old-acc-tok",
+        refreshToken: "old-ref-tok",
+        expiresAt: Date.now() - 1,
+        accountId: "acc_789",
+        email: "user@example.com",
+    };
+    it("exchanges refresh token for new tokens", async () => {
+        const mockFetch = makeMockFetch([
+            {
+                ok: true,
+                json: () => Promise.resolve({
+                    access_token: "new-acc-tok",
+                    refresh_token: "new-ref-tok",
+                    expires_in: 3600,
+                }),
+            },
+        ]);
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+        });
+        const refreshed = await provider.refresh(expiredTokens);
+        expect(refreshed.accessToken).toBe("new-acc-tok");
+        expect(refreshed.refreshToken).toBe("new-ref-tok");
+        expect(refreshed.expiresAt).toBeGreaterThan(Date.now());
+        expect(refreshed.email).toBe("user@example.com");
+        expect(refreshed.accountId).toBe("acc_789");
+        const [url, init] = mockFetch.mock.calls[0];
+        expect(url).toBe("https://auth.openai.com/oauth/token");
+        const body = new URLSearchParams(init.body);
+        expect(body.get("grant_type")).toBe("refresh_token");
+        expect(body.get("refresh_token")).toBe("old-ref-tok");
+    });
+    it("throws OAuthRefreshError on 401 (invalid_grant)", async () => {
+        const mockFetch = makeMockFetch([{ ok: false, status: 401, text: () => Promise.resolve("invalid_grant") }]);
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+        });
+        await expect(provider.refresh(expiredTokens)).rejects.toThrow(OAuthRefreshError);
+    });
+    it("returns tokens unchanged when still valid (not within refresh window)", async () => {
+        const validTokens = {
+            accessToken: "valid-acc-tok",
+            refreshToken: "valid-ref-tok",
+            expiresAt: Date.now() + 10 * 60_000,
+        };
+        const mockFetch = vi.fn();
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+        });
+        const result = await provider.refresh(validTokens);
+        expect(result).toBe(validTokens);
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+});
+// ---------------------------------------------------------------------------
+// revoke
+// ---------------------------------------------------------------------------
+describe("OpenAIOAuthProvider.revoke", () => {
+    it("POSTs to /oauth/revoke with the refresh token", async () => {
+        const mockFetch = vi.fn().mockResolvedValue({ ok: true, json: () => Promise.resolve({}) });
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+        });
+        const tokens = {
+            accessToken: "acc",
+            refreshToken: "ref.token.long",
+            expiresAt: Date.now() + 3600_000,
+        };
+        await provider.revoke(tokens);
+        const [url] = mockFetch.mock.calls[0];
+        expect(url).toBe("https://auth.openai.com/oauth/revoke");
+    });
+    it("does not throw when revoke call fails (best-effort)", async () => {
+        const mockFetch = vi.fn().mockRejectedValue(new Error("network error"));
+        const provider = new OpenAIOAuthProvider({
+            issuer: "https://auth.openai.com",
+            clientId: "test_client",
+            fetchFn: mockFetch,
+        });
+        const tokens = {
+            accessToken: "acc",
+            refreshToken: "ref",
+            expiresAt: Date.now(),
+        };
+        await expect(provider.revoke(tokens)).resolves.not.toThrow();
+    });
+});
+// ---------------------------------------------------------------------------
+// authHeaders
+// ---------------------------------------------------------------------------
+describe("OpenAIOAuthProvider.authHeaders", () => {
+    it("returns Authorization + ChatGPT-Account-ID when accountId present", () => {
+        const provider = new OpenAIOAuthProvider();
+        const tokens = {
+            accessToken: "mock-token",
+            refreshToken: "ref",
+            expiresAt: Date.now() + 3600_000,
+            accountId: "acc_123",
+        };
+        const headers = provider.authHeaders(tokens);
+        expect(headers.Authorization).toBe("Bearer mock-token");
+        expect(headers["ChatGPT-Account-ID"]).toBe("acc_123");
+    });
+    it("omits ChatGPT-Account-ID when accountId absent", () => {
+        const provider = new OpenAIOAuthProvider();
+        const tokens = {
+            accessToken: "mock-token",
+            refreshToken: "ref",
+            expiresAt: Date.now() + 3600_000,
+        };
+        const headers = provider.authHeaders(tokens);
+        expect(headers.Authorization).toBe("Bearer mock-token");
+        expect(headers["ChatGPT-Account-ID"]).toBeUndefined();
+    });
+});
+//# sourceMappingURL=openai-oauth.test.js.map