muonroi-cli 1.8.1 → 1.8.3

package/dist/src/providers/auth/__tests__/gemini-oauth.test.js

@@ -1,306 +0,0 @@
-/**
- * Tests for Agy Google OAuth (replaces legacy gemini public client)
- */
-import { describe, expect, it, vi } from "vitest";
-import { GeminiOAuthProvider, loadGeminiTokensWithRefresh } from "../gemini-oauth.js";
-import { OAuthLoginError, OAuthRefreshError } from "../types.js";
-function makeMockFetch(responses) {
-    let idx = 0;
-    return vi.fn(async (_url, _init) => {
-        const resp = responses[idx++];
-        const r = typeof resp === "function" ? resp() : (resp ?? { ok: false, status: 500 });
-        return {
-            ok: r.ok,
-            status: r.status ?? (r.ok ? 200 : 400),
-            json: r.json ?? (() => Promise.resolve({})),
-            text: r.text ?? (() => Promise.resolve("")),
-        };
-    });
-}
-// ---------------------------------------------------------------------------
-// Mock callback server factory
-//
-// Immediately resolves with the given code so tests don't wait for a browser.
-// ---------------------------------------------------------------------------
-function makeMockCallbackServer(codeToReturn, delayMs = 0) {
-    return vi.fn((opts) => new Promise((resolve) => {
-        const server = {
-            port: 59999,
-            url: "http://127.0.0.1:59999/callback",
-            close: vi.fn(),
-        };
-        resolve(server);
-        // Fire onCode after server resolves (optionally delayed)
-        setTimeout(() => opts.onCode(codeToReturn, ""), delayMs);
-    }));
-}
-// ---------------------------------------------------------------------------
-// login — happy path
-// ---------------------------------------------------------------------------
-describe("GeminiOAuthProvider.login", () => {
-    it("completes browser-redirect flow and returns tokens with email", async () => {
-        const mockFetch = makeMockFetch([
-            // 1. token exchange
-            {
-                ok: true,
-                json: () => Promise.resolve({
-                    access_token: "fixture-access-tok",
-                    refresh_token: "fixture-refresh-tok",
-                    id_token: "fixture-id-tok",
-                    expires_in: 3600,
-                }),
-            },
-            // 2. userinfo
-            { ok: true, json: () => Promise.resolve({ email: "user@gmail.com", sub: "12345" }) },
-        ]);
-        const callbackServerFn = makeMockCallbackServer("auth-code-xyz");
-        const openBrowserFn = vi.fn();
-        const provider = new GeminiOAuthProvider({
-            clientId: "test-client-id",
-            clientSecret: "test-secret",
-            fetchFn: mockFetch,
-            callbackServerFn,
-            openBrowserFn,
-        });
-        const onUserCodeFn = vi.fn();
-        const tokens = await provider.login({ onUserCode: onUserCodeFn });
-        expect(tokens.accessToken).toBe("fixture-access-tok");
-        expect(tokens.refreshToken).toBe("fixture-refresh-tok");
-        expect(tokens.idToken).toBe("fixture-id-tok");
-        expect(tokens.email).toBe("user@gmail.com");
-        expect(tokens.expiresAt).toBeGreaterThan(Date.now());
-        // openBrowser should have been called
-        expect(openBrowserFn).toHaveBeenCalledOnce();
-        // URL should contain Google auth endpoint
-        const authorizeUrl = openBrowserFn.mock.calls[0][0];
-        expect(authorizeUrl).toContain("accounts.google.com");
-        expect(authorizeUrl).toContain("client_id=test-client-id");
-        expect(authorizeUrl).toContain("code_challenge_method=S256");
-        // onUserCode should have been invoked with the authorize URL
-        expect(onUserCodeFn).toHaveBeenCalledOnce();
-    });
-    it("login still works when userinfo endpoint fails (email is optional)", async () => {
-        const mockFetch = makeMockFetch([
-            // token exchange
-            {
-                ok: true,
-                json: () => Promise.resolve({
-                    access_token: "acc",
-                    refresh_token: "ref",
-                    expires_in: 3600,
-                }),
-            },
-            // userinfo — failure (non-fatal)
-            { ok: false, status: 401 },
-        ]);
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: makeMockCallbackServer("code123"),
-            openBrowserFn: vi.fn(),
-        });
-        const tokens = await provider.login({});
-        expect(tokens.accessToken).toBe("acc");
-        expect(tokens.email).toBeUndefined();
-    });
-    it("throws OAuthLoginError when callback server rejects", async () => {
-        const failingCallbackServer = vi.fn(() => Promise.reject(new Error("port in use")));
-        const provider = new GeminiOAuthProvider({
-            fetchFn: vi.fn(),
-            callbackServerFn: failingCallbackServer,
-            openBrowserFn: vi.fn(),
-        });
-        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
-    });
-    it("throws OAuthLoginError when token exchange fails", async () => {
-        const mockFetch = makeMockFetch([
-            // token exchange fails
-            { ok: false, status: 400, text: () => Promise.resolve('{"error":"invalid_grant"}') },
-        ]);
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: makeMockCallbackServer("some-code"),
-            openBrowserFn: vi.fn(),
-        });
-        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
-    });
-});
-// ---------------------------------------------------------------------------
-// refresh
-// ---------------------------------------------------------------------------
-describe("GeminiOAuthProvider.refresh", () => {
-    const makeExpiredTokens = () => ({
-        accessToken: "old-access",
-        refreshToken: "old-refresh",
-        expiresAt: Date.now() - 1000, // already expired
-        email: "user@gmail.com",
-    });
-    const makeFreshTokens = () => ({
-        accessToken: "fresh-access",
-        refreshToken: "fresh-refresh",
-        expiresAt: Date.now() + 3_600_000, // 1 hour from now
-        email: "user@gmail.com",
-    });
-    it("refreshes expired tokens", async () => {
-        const mockFetch = makeMockFetch([
-            {
-                ok: true,
-                json: () => Promise.resolve({
-                    access_token: "new-access-tok",
-                    refresh_token: "new-refresh-tok",
-                    expires_in: 3600,
-                }),
-            },
-        ]);
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: vi.fn(),
-            openBrowserFn: vi.fn(),
-        });
-        const tokens = await provider.refresh(makeExpiredTokens());
-        expect(tokens.accessToken).toBe("new-access-tok");
-        expect(tokens.refreshToken).toBe("new-refresh-tok");
-        expect(tokens.expiresAt).toBeGreaterThan(Date.now());
-        expect(tokens.email).toBe("user@gmail.com");
-    });
-    it("skips refresh when tokens are still fresh", async () => {
-        const mockFetch = vi.fn();
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: vi.fn(),
-            openBrowserFn: vi.fn(),
-        });
-        const fresh = makeFreshTokens();
-        const result = await provider.refresh(fresh);
-        expect(result).toBe(fresh); // same reference — no refresh
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-    it("throws OAuthRefreshError on HTTP error", async () => {
-        const mockFetch = makeMockFetch([
-            { ok: false, status: 400, text: () => Promise.resolve('{"error":"invalid_grant"}') },
-        ]);
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: vi.fn(),
-            openBrowserFn: vi.fn(),
-        });
-        await expect(provider.refresh(makeExpiredTokens())).rejects.toThrow(OAuthRefreshError);
-    });
-    it("concurrent refresh calls both complete without error", async () => {
-        // Mutex serializes calls but both may hit the network since the token
-        // reference passed in is the same stale object (not mutated in-place).
-        // What matters: both complete without throwing, both return valid tokens.
-        let callCount = 0;
-        const mockFetch = vi.fn(async () => {
-            callCount++;
-            await new Promise((r) => setTimeout(r, 10));
-            return {
-                ok: true,
-                status: 200,
-                json: () => Promise.resolve({
-                    access_token: `access-${callCount}`,
-                    refresh_token: "refreshed",
-                    expires_in: 3600,
-                }),
-                text: () => Promise.resolve(""),
-            };
-        });
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: vi.fn(),
-            openBrowserFn: vi.fn(),
-        });
-        const expired = makeExpiredTokens();
-        const [r1, r2] = await Promise.all([provider.refresh(expired), provider.refresh(expired)]);
-        // Both calls should return valid access tokens
-        expect(r1.accessToken).toMatch(/^access-\d+$/);
-        expect(r2.accessToken).toMatch(/^access-\d+$/);
-        // Mutex serializes: calls complete sequentially
-        expect(callCount).toBeGreaterThanOrEqual(1);
-    });
-});
-// ---------------------------------------------------------------------------
-// revoke
-// ---------------------------------------------------------------------------
-describe("GeminiOAuthProvider.revoke", () => {
-    it("calls revoke endpoint with refresh token", async () => {
-        const mockFetch = makeMockFetch([{ ok: true }]);
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: vi.fn(),
-            openBrowserFn: vi.fn(),
-        });
-        await provider.revoke({
-            accessToken: "acc",
-            refreshToken: "ref-to-revoke",
-            expiresAt: Date.now() + 3600_000,
-        });
-        expect(mockFetch).toHaveBeenCalledOnce();
-        const [url] = mockFetch.mock.calls[0];
-        expect(url).toContain("oauth2.googleapis.com/revoke");
-        expect(url).toContain("token=ref-to-revoke");
-    });
-    it("does not throw when revoke endpoint returns error (best-effort)", async () => {
-        const mockFetch = makeMockFetch([{ ok: false, status: 500 }]);
-        const provider = new GeminiOAuthProvider({
-            fetchFn: mockFetch,
-            callbackServerFn: vi.fn(),
-            openBrowserFn: vi.fn(),
-        });
-        // Should not throw
-        await expect(provider.revoke({ accessToken: "acc", refreshToken: "ref", expiresAt: Date.now() })).resolves.toBeUndefined();
-    });
-});
-// ---------------------------------------------------------------------------
-// authHeaders
-// ---------------------------------------------------------------------------
-describe("GeminiOAuthProvider.authHeaders", () => {
-    it("returns only Authorization header (no extra Google-specific header)", () => {
-        const provider = new GeminiOAuthProvider({ callbackServerFn: vi.fn(), openBrowserFn: vi.fn() });
-        const tok = "fixture-auth-tok";
-        const headers = provider.authHeaders({
-            accessToken: tok,
-            refreshToken: "ref",
-            expiresAt: Date.now() + 3600_000,
-        });
-        // Authorization should carry the access token as a bearer scheme
-        const authValue = headers.Authorization ?? "";
-        expect(authValue.startsWith("Bearer ")).toBe(true);
-        expect(authValue.endsWith(tok)).toBe(true);
-        // Confirm no extra keys (Google OAuth needs only Authorization, no account header)
-        expect(Object.keys(headers)).toHaveLength(1);
-    });
-});
-// ---------------------------------------------------------------------------
-// loadGeminiTokensWithRefresh
-// ---------------------------------------------------------------------------
-describe("loadGeminiTokensWithRefresh", () => {
-    it("returns null when no tokens are stored", async () => {
-        vi.doMock("../token-store.js", () => ({
-            loadTokens: vi.fn().mockResolvedValue(null),
-            saveTokens: vi.fn(),
-        }));
-        const result = await loadGeminiTokensWithRefresh();
-        expect(result).toBeNull();
-        vi.doUnmock("../token-store.js");
-    });
-    it("returns tokens directly when not close to expiry", async () => {
-        const stored = {
-            accessToken: "valid-access",
-            refreshToken: "valid-refresh",
-            expiresAt: Date.now() + 3_600_000, // 1 hour from now — not within 60s window
-            email: "user@gmail.com",
-        };
-        vi.doMock("../token-store.js", () => ({
-            loadTokens: vi.fn().mockResolvedValue(stored),
-            saveTokens: vi.fn(),
-        }));
-        const mockProvider = {
-            refresh: vi.fn(),
-        };
-        const result = await loadGeminiTokensWithRefresh(mockProvider);
-        expect(result).toEqual(stored);
-        expect(mockProvider.refresh).not.toHaveBeenCalled();
-        vi.doUnmock("../token-store.js");
-    });
-});
-//# sourceMappingURL=gemini-oauth.test.js.map

package/dist/src/providers/auth/__tests__/grok-oauth.test.d.ts

@@ -1,8 +0,0 @@
-/**
- * Tests for src/providers/auth/grok-oauth.ts
- *
- * xAI / Grok subscription OAuth — Authorization Code + PKCE loopback flow
- * (SuperGrok / X Premium+). All HTTP + browser + callback server are mocked,
- * so the nondeterministic live login is not needed to verify the flow logic.
- */
-export {};

package/dist/src/providers/auth/__tests__/grok-oauth.test.js

@@ -1,236 +0,0 @@
-/**
- * Tests for src/providers/auth/grok-oauth.ts
- *
- * xAI / Grok subscription OAuth — Authorization Code + PKCE loopback flow
- * (SuperGrok / X Premium+). All HTTP + browser + callback server are mocked,
- * so the nondeterministic live login is not needed to verify the flow logic.
- */
-import { describe, expect, it, vi } from "vitest";
-import { GrokOAuthProvider } from "../grok-oauth.js";
-import { OAuthLoginError, OAuthRefreshError } from "../types.js";
-function makeMockFetch(responses) {
-    let idx = 0;
-    return vi.fn(async (_url, _init) => {
-        const resp = responses[idx++];
-        const r = typeof resp === "function" ? resp() : resp;
-        return {
-            ok: r.ok,
-            status: r.status ?? (r.ok ? 200 : 400),
-            json: r.json ?? (() => Promise.resolve({})),
-            text: r.text ?? (() => Promise.resolve("")),
-        };
-    });
-}
-/**
- * Returns a CallbackServerFn that simulates the browser hitting the loopback
- * callback with `?code=<authCode>&state=<state>` shortly after the server binds.
- * The echoed state is read back from the authorize URL via a captured closure.
- */
-function makeMockCallbackServer(authCode, echoState) {
-    return vi.fn(async (opts) => {
-        const port = 56121;
-        const url = `http://127.0.0.1:${port}/callback`;
-        setTimeout(() => opts.onCode(authCode, echoState()), 1);
-        const server = { port, url, close: vi.fn() };
-        return server;
-    });
-}
-// ---------------------------------------------------------------------------
-// login
-// ---------------------------------------------------------------------------
-describe("GrokOAuthProvider.login", () => {
-    it("runs Authorization Code + PKCE loopback flow and returns tokens with email", async () => {
-        // id_token carries the email claim (base64url JSON middle segment).
-        const idTokenPayload = Buffer.from(JSON.stringify({ email: "grok@example.com" })).toString("base64url");
-        const idToken = `h.${idTokenPayload}.s`;
-        const mockFetch = makeMockFetch([
-            {
-                ok: true,
-                json: () => Promise.resolve({
-                    access_token: "xai-acc-tok",
-                    refresh_token: "xai-refresh",
-                    id_token: idToken,
-                    expires_in: 3600,
-                }),
-            },
-        ]);
-        let capturedAuthorizeUrl = "";
-        const openBrowser = vi.fn((url) => {
-            capturedAuthorizeUrl = url;
-        });
-        const callbackServer = makeMockCallbackServer("xai_auth_code", () => {
-            const u = new URL(capturedAuthorizeUrl);
-            return u.searchParams.get("state") ?? "";
-        });
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-            callbackServerFn: callbackServer,
-            openBrowserFn: openBrowser,
-        });
-        const userCodeCb = vi.fn();
-        const tokens = await provider.login({ onUserCode: userCodeCb });
-        expect(userCodeCb).toHaveBeenCalled();
-        expect(capturedAuthorizeUrl).toContain("https://auth.x.ai/oauth2/authorize");
-        expect(capturedAuthorizeUrl).toContain("response_type=code");
-        expect(capturedAuthorizeUrl).toContain("code_challenge_method=S256");
-        expect(capturedAuthorizeUrl).toContain("client_id=test_xai_client");
-        // xAI-specific scopes + extras
-        expect(decodeURIComponent(capturedAuthorizeUrl)).toContain("grok-cli:access");
-        expect(decodeURIComponent(capturedAuthorizeUrl)).toContain("offline_access");
-        expect(capturedAuthorizeUrl).toContain("plan=generic");
-        expect(capturedAuthorizeUrl).toContain("nonce=");
-        // Google-only params must NOT leak in (xAI rejects them).
-        expect(capturedAuthorizeUrl).not.toContain("access_type=offline");
-        expect(capturedAuthorizeUrl).not.toContain("prompt=consent");
-        expect(openBrowser).toHaveBeenCalled();
-        expect(tokens.accessToken).toBe("xai-acc-tok");
-        expect(tokens.refreshToken).toBe("xai-refresh");
-        expect(tokens.email).toBe("grok@example.com");
-        expect(tokens.expiresAt).toBeGreaterThan(Date.now());
-        // Token exchange POST body carries auth code + code_verifier.
-        const [tokenUrl, tokenInit] = mockFetch.mock.calls[0];
-        expect(tokenUrl).toBe("https://auth.x.ai/oauth2/token");
-        const body = new URLSearchParams(tokenInit.body);
-        expect(body.get("grant_type")).toBe("authorization_code");
-        expect(body.get("code")).toBe("xai_auth_code");
-        expect(body.get("code_verifier")).toBeTruthy();
-        expect(body.get("redirect_uri")).toBe("http://127.0.0.1:56121/callback");
-    });
-    it("throws OAuthLoginError when token exchange fails", async () => {
-        const mockFetch = makeMockFetch([{ ok: false, status: 400, text: () => Promise.resolve("invalid_grant") }]);
-        let capturedAuthorizeUrl = "";
-        const openBrowser = vi.fn((url) => {
-            capturedAuthorizeUrl = url;
-        });
-        const callbackServer = makeMockCallbackServer("bad_code", () => {
-            const u = new URL(capturedAuthorizeUrl);
-            return u.searchParams.get("state") ?? "";
-        });
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-            callbackServerFn: callbackServer,
-            openBrowserFn: openBrowser,
-        });
-        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
-    });
-    it("throws on state mismatch (CSRF guard)", async () => {
-        const mockFetch = makeMockFetch([]);
-        const openBrowser = vi.fn();
-        const callbackServer = makeMockCallbackServer("xai_auth_code", () => "attacker_state");
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-            callbackServerFn: callbackServer,
-            openBrowserFn: openBrowser,
-        });
-        await expect(provider.login({})).rejects.toThrow(OAuthLoginError);
-    });
-});
-// ---------------------------------------------------------------------------
-// refresh
-// ---------------------------------------------------------------------------
-describe("GrokOAuthProvider.refresh", () => {
-    const expiredTokens = {
-        accessToken: "old-acc",
-        refreshToken: "old-ref",
-        expiresAt: Date.now() - 1,
-        email: "grok@example.com",
-    };
-    it("exchanges refresh token for new tokens", async () => {
-        const mockFetch = makeMockFetch([
-            {
-                ok: true,
-                json: () => Promise.resolve({ access_token: "new-acc", refresh_token: "new-ref", expires_in: 3600 }),
-            },
-        ]);
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-        });
-        const refreshed = await provider.refresh(expiredTokens);
-        expect(refreshed.accessToken).toBe("new-acc");
-        expect(refreshed.refreshToken).toBe("new-ref");
-        expect(refreshed.expiresAt).toBeGreaterThan(Date.now());
-        expect(refreshed.email).toBe("grok@example.com");
-        const [url, init] = mockFetch.mock.calls[0];
-        expect(url).toBe("https://auth.x.ai/oauth2/token");
-        const body = new URLSearchParams(init.body);
-        expect(body.get("grant_type")).toBe("refresh_token");
-        expect(body.get("refresh_token")).toBe("old-ref");
-    });
-    it("keeps the old refresh token when the response omits a new one (non-rotating)", async () => {
-        const mockFetch = makeMockFetch([
-            { ok: true, json: () => Promise.resolve({ access_token: "new-acc", expires_in: 3600 }) },
-        ]);
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-        });
-        const refreshed = await provider.refresh(expiredTokens);
-        expect(refreshed.refreshToken).toBe("old-ref");
-    });
-    it("throws OAuthRefreshError on 401 (invalid_grant)", async () => {
-        const mockFetch = makeMockFetch([{ ok: false, status: 401, text: () => Promise.resolve("invalid_grant") }]);
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-        });
-        await expect(provider.refresh(expiredTokens)).rejects.toThrow(OAuthRefreshError);
-    });
-    it("returns tokens unchanged when still valid (not within refresh window)", async () => {
-        const validTokens = {
-            accessToken: "valid-acc",
-            refreshToken: "valid-ref",
-            expiresAt: Date.now() + 10 * 60_000,
-        };
-        const mockFetch = vi.fn();
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-        });
-        const result = await provider.refresh(validTokens);
-        expect(result).toBe(validTokens);
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-});
-// ---------------------------------------------------------------------------
-// revoke
-// ---------------------------------------------------------------------------
-describe("GrokOAuthProvider.revoke", () => {
-    it("does not throw when revoke call fails (best-effort)", async () => {
-        const mockFetch = vi.fn().mockRejectedValue(new Error("network error"));
-        const provider = new GrokOAuthProvider({
-            issuer: "https://auth.x.ai",
-            clientId: "test_xai_client",
-            fetchFn: mockFetch,
-        });
-        const tokens = { accessToken: "acc", refreshToken: "ref", expiresAt: Date.now() };
-        await expect(provider.revoke(tokens)).resolves.not.toThrow();
-    });
-});
-// ---------------------------------------------------------------------------
-// authHeaders
-// ---------------------------------------------------------------------------
-describe("GrokOAuthProvider.authHeaders", () => {
-    it("returns only a Bearer Authorization header (no account-id header)", () => {
-        const provider = new GrokOAuthProvider();
-        const tokens = {
-            accessToken: "mock-token",
-            refreshToken: "ref",
-            expiresAt: Date.now() + 3600_000,
-        };
-        const headers = provider.authHeaders(tokens);
-        expect(headers.Authorization).toBe("Bearer mock-token");
-        expect(Object.keys(headers)).toEqual(["Authorization"]);
-    });
-});
-//# sourceMappingURL=grok-oauth.test.js.map

package/dist/src/providers/auth/__tests__/openai-oauth.test.d.ts

@@ -1,7 +0,0 @@
-/**
- * Tests for src/providers/auth/openai-oauth.ts
- *
- * Authorization Code + PKCE loopback flow. All HTTP + browser + callback
- * server are mocked.
- */
-export {};