muonroi-cli 1.8.1 → 1.8.4

package/dist/src/providers/auth/__tests__/browser-flow.test.js

@@ -1,186 +0,0 @@
-/**
- * Tests for src/providers/auth/browser-flow.ts
- *
- * buildAuthorizeUrl structure, PKCE roundtrip,
- * exchangeBrowserCode and refreshBrowserTokens mock HTTP.
- * No live network calls.
- */
-import { createHash } from "node:crypto";
-import { describe, expect, it, vi } from "vitest";
-import { buildAuthorizeUrl, exchangeBrowserCode, generatePKCE, refreshBrowserTokens } from "../browser-flow.js";
-function makeMockFetch(responses) {
-    let idx = 0;
-    return vi.fn(async (_url, _init) => {
-        const r = responses[idx++] ?? { ok: false, status: 500 };
-        return {
-            ok: r.ok,
-            status: r.status ?? (r.ok ? 200 : 400),
-            json: r.json ?? (() => Promise.resolve({})),
-            text: r.text ?? (() => Promise.resolve("")),
-        };
-    });
-}
-// ---------------------------------------------------------------------------
-// generatePKCE (re-exported from device-flow)
-// ---------------------------------------------------------------------------
-describe("generatePKCE (re-export)", () => {
-    it("returns verifier and challenge with correct lengths", () => {
-        const { codeVerifier, codeChallenge } = generatePKCE();
-        // base64url(32 bytes) = 43 chars
-        expect(codeVerifier).toHaveLength(43);
-        // sha256(verifier) base64url = 43 chars
-        expect(codeChallenge).toHaveLength(43);
-    });
-    it("challenge is S256 of verifier", () => {
-        const { codeVerifier, codeChallenge } = generatePKCE();
-        const expected = createHash("sha256").update(codeVerifier).digest("base64url");
-        expect(codeChallenge).toBe(expected);
-    });
-    it("each call produces unique verifier", () => {
-        const a = generatePKCE();
-        const b = generatePKCE();
-        expect(a.codeVerifier).not.toBe(b.codeVerifier);
-    });
-});
-// ---------------------------------------------------------------------------
-// buildAuthorizeUrl
-// ---------------------------------------------------------------------------
-describe("buildAuthorizeUrl", () => {
-    it("constructs URL with required OAuth 2.0 params", () => {
-        const url = buildAuthorizeUrl({
-            authEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
-            clientId: "test-client-id",
-            redirectUri: "http://127.0.0.1:9999/callback",
-            scopes: ["openid", "email"],
-            codeChallenge: "test-challenge-abc",
-        });
-        const parsed = new URL(url);
-        expect(parsed.origin + parsed.pathname).toBe("https://accounts.google.com/o/oauth2/v2/auth");
-        expect(parsed.searchParams.get("response_type")).toBe("code");
-        expect(parsed.searchParams.get("client_id")).toBe("test-client-id");
-        expect(parsed.searchParams.get("redirect_uri")).toBe("http://127.0.0.1:9999/callback");
-        expect(parsed.searchParams.get("scope")).toBe("openid email");
-        expect(parsed.searchParams.get("code_challenge")).toBe("test-challenge-abc");
-        expect(parsed.searchParams.get("code_challenge_method")).toBe("S256");
-        expect(parsed.searchParams.get("access_type")).toBe("offline");
-    });
-    it("includes state param when provided", () => {
-        const url = buildAuthorizeUrl({
-            authEndpoint: "https://example.com/auth",
-            clientId: "cid",
-            redirectUri: "http://localhost/cb",
-            scopes: ["openid"],
-            codeChallenge: "chall",
-            state: "random-state-xyz",
-        });
-        expect(new URL(url).searchParams.get("state")).toBe("random-state-xyz");
-    });
-    it("omits state param when not provided", () => {
-        const url = buildAuthorizeUrl({
-            authEndpoint: "https://example.com/auth",
-            clientId: "cid",
-            redirectUri: "http://localhost/cb",
-            scopes: ["openid"],
-            codeChallenge: "chall",
-        });
-        expect(new URL(url).searchParams.has("state")).toBe(false);
-    });
-});
-// ---------------------------------------------------------------------------
-// exchangeBrowserCode
-// ---------------------------------------------------------------------------
-describe("exchangeBrowserCode", () => {
-    it("returns token response on success", async () => {
-        const mockFetch = makeMockFetch([
-            {
-                ok: true,
-                json: () => Promise.resolve({
-                    access_token: "fixture-access-tok",
-                    refresh_token: "fixture-refresh-tok",
-                    id_token: "fixture-id-tok",
-                    expires_in: 3600,
-                    token_type: "Bearer",
-                }),
-            },
-        ]);
-        const result = await exchangeBrowserCode({
-            tokenEndpoint: "https://oauth2.googleapis.com/token",
-            clientId: "test-client",
-            clientSecret: "test-secret",
-            redirectUri: "http://127.0.0.1:9999/callback",
-            code: "auth-code-123",
-            codeVerifier: "verifier-xyz",
-            fetchFn: mockFetch,
-        });
-        expect(result.access_token).toBe("fixture-access-tok");
-        expect(result.refresh_token).toBe("fixture-refresh-tok");
-        expect(result.expires_in).toBe(3600);
-        // Verify the fetch was called with correct args
-        expect(mockFetch).toHaveBeenCalledOnce();
-        const [url, init] = mockFetch.mock.calls[0];
-        expect(url).toBe("https://oauth2.googleapis.com/token");
-        expect(init.method).toBe("POST");
-        const body = new URLSearchParams(init.body);
-        expect(body.get("grant_type")).toBe("authorization_code");
-        expect(body.get("code")).toBe("auth-code-123");
-        expect(body.get("code_verifier")).toBe("verifier-xyz");
-        expect(body.get("client_id")).toBe("test-client");
-        expect(body.get("client_secret")).toBe("test-secret");
-    });
-    it("throws on HTTP error response", async () => {
-        const mockFetch = makeMockFetch([
-            { ok: false, status: 400, text: () => Promise.resolve('{"error":"invalid_grant"}') },
-        ]);
-        await expect(exchangeBrowserCode({
-            tokenEndpoint: "https://oauth2.googleapis.com/token",
-            clientId: "cid",
-            clientSecret: "sec",
-            redirectUri: "http://localhost/cb",
-            code: "bad-code",
-            codeVerifier: "verifier",
-            fetchFn: mockFetch,
-        })).rejects.toThrow("Token exchange failed (400)");
-    });
-});
-// ---------------------------------------------------------------------------
-// refreshBrowserTokens
-// ---------------------------------------------------------------------------
-describe("refreshBrowserTokens", () => {
-    it("returns new tokens on success", async () => {
-        const mockFetch = makeMockFetch([
-            {
-                ok: true,
-                json: () => Promise.resolve({
-                    access_token: "new-access-tok",
-                    expires_in: 3600,
-                }),
-            },
-        ]);
-        const result = await refreshBrowserTokens({
-            tokenEndpoint: "https://oauth2.googleapis.com/token",
-            clientId: "cid",
-            clientSecret: "sec",
-            refreshToken: "old-refresh",
-            fetchFn: mockFetch,
-        });
-        expect(result.access_token).toBe("new-access-tok");
-        const [url, init] = mockFetch.mock.calls[0];
-        expect(url).toBe("https://oauth2.googleapis.com/token");
-        const body = new URLSearchParams(init.body);
-        expect(body.get("grant_type")).toBe("refresh_token");
-        expect(body.get("refresh_token")).toBe("old-refresh");
-    });
-    it("throws on HTTP 401", async () => {
-        const mockFetch = makeMockFetch([
-            { ok: false, status: 401, text: () => Promise.resolve('{"error":"invalid_grant"}') },
-        ]);
-        await expect(refreshBrowserTokens({
-            tokenEndpoint: "https://oauth2.googleapis.com/token",
-            clientId: "cid",
-            clientSecret: "sec",
-            refreshToken: "expired-refresh",
-            fetchFn: mockFetch,
-        })).rejects.toThrow("Token refresh failed (401)");
-    });
-});
-//# sourceMappingURL=browser-flow.test.js.map

package/dist/src/providers/auth/__tests__/device-flow.test.d.ts

@@ -1,6 +0,0 @@
-/**
- * Tests for src/providers/auth/device-flow.ts
- *
- * All HTTP calls go through a mockFetch — no live network calls.
- */
-export {};

package/dist/src/providers/auth/__tests__/device-flow.test.js

@@ -1,219 +0,0 @@
-/**
- * Tests for src/providers/auth/device-flow.ts
- *
- * All HTTP calls go through a mockFetch — no live network calls.
- */
-import { describe, expect, it, vi } from "vitest";
-import { exchangeCodeForTokens, generatePKCE, pollDeviceAuthorization, requestDeviceCode } from "../device-flow.js";
-// ---------------------------------------------------------------------------
-// generatePKCE
-// ---------------------------------------------------------------------------
-describe("generatePKCE", () => {
-    it("returns a code_verifier between 43 and 128 chars (base64url alphabet)", () => {
-        const { codeVerifier } = generatePKCE();
-        expect(codeVerifier.length).toBeGreaterThanOrEqual(43);
-        expect(codeVerifier.length).toBeLessThanOrEqual(128);
-        expect(codeVerifier).toMatch(/^[A-Za-z0-9_-]+$/);
-    });
-    it("returns a code_challenge (base64url, ~43 chars for sha256)", () => {
-        const { codeChallenge } = generatePKCE();
-        expect(codeChallenge).toMatch(/^[A-Za-z0-9_-]+$/);
-        // sha256 base64url of 32 bytes = 43 chars
-        expect(codeChallenge.length).toBe(43);
-    });
-    it("produces unique pairs on each call", () => {
-        const a = generatePKCE();
-        const b = generatePKCE();
-        expect(a.codeVerifier).not.toBe(b.codeVerifier);
-        expect(a.codeChallenge).not.toBe(b.codeChallenge);
-    });
-});
-// ---------------------------------------------------------------------------
-// requestDeviceCode
-// ---------------------------------------------------------------------------
-describe("requestDeviceCode", () => {
-    it("POSTs to /api/accounts/deviceauth/usercode and returns parsed response", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-            ok: true,
-            json: () => Promise.resolve({
-                device_auth_id: "deviceauth_dev_abc",
-                user_code: "ABCD-1234",
-                expires_at: new Date(Date.now() + 300_000).toISOString(),
-                interval: "5",
-            }),
-        });
-        const result = await requestDeviceCode({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            codeChallenge: "test_challenge",
-            fetchFn: mockFetch,
-        });
-        expect(mockFetch).toHaveBeenCalledOnce();
-        const [url, init] = mockFetch.mock.calls[0];
-        expect(url).toBe("https://auth.openai.com/api/accounts/deviceauth/usercode");
-        expect(init.method).toBe("POST");
-        expect(result.device_code).toBe("deviceauth_dev_abc");
-        expect(result.user_code).toBe("ABCD-1234");
-        expect(result.verification_uri).toBe("https://auth.openai.com/device");
-        expect(result.interval).toBe(5);
-    });
-    it("throws on HTTP error", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-            ok: false,
-            status: 400,
-            text: () => Promise.resolve("Bad Request"),
-        });
-        await expect(requestDeviceCode({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            codeChallenge: "test_challenge",
-            fetchFn: mockFetch,
-        })).rejects.toThrow("400");
-    });
-});
-// ---------------------------------------------------------------------------
-// pollDeviceAuthorization
-// ---------------------------------------------------------------------------
-describe("pollDeviceAuthorization", () => {
-    it("polls token endpoint until 200 and returns tokens (RFC 8628)", async () => {
-        const pending = { error: "authorization_pending" };
-        const tokens = { access_token: "acc_tok", refresh_token: "ref_tok", expires_in: 3600 };
-        const responses = [
-            { ok: false, status: 400, json: () => Promise.resolve(pending) },
-            { ok: false, status: 400, json: () => Promise.resolve(pending) },
-            { ok: true, status: 200, json: () => Promise.resolve(tokens) },
-        ];
-        let callCount = 0;
-        const mockFetch = vi.fn().mockImplementation(() => Promise.resolve(responses[callCount++]));
-        const result = await pollDeviceAuthorization({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            deviceCode: "dev_abc",
-            pollIntervalMs: 0, // instant for tests
-            timeoutMs: 10_000,
-            fetchFn: mockFetch,
-        });
-        expect(result.access_token).toBe("acc_tok");
-        expect(result.refresh_token).toBe("ref_tok");
-        expect(mockFetch).toHaveBeenCalledTimes(3);
-        // Verify it POSTs to the token endpoint with the right body
-        const [url, init] = mockFetch.mock.calls[0];
-        expect(url).toBe("https://auth.openai.com/oauth/token");
-        expect(init.method).toBe("POST");
-        const sentBody = JSON.parse(init.body);
-        expect(sentBody.grant_type).toBe("urn:ietf:params:oauth:grant-type:device_code");
-        expect(sentBody.device_code).toBe("dev_abc");
-        expect(sentBody.client_id).toBe("test_client");
-    });
-    it("throws when access_denied", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-            ok: false,
-            status: 400,
-            json: () => Promise.resolve({ error: "access_denied" }),
-        });
-        await expect(pollDeviceAuthorization({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            deviceCode: "dev_abc",
-            pollIntervalMs: 0,
-            timeoutMs: 5_000,
-            fetchFn: mockFetch,
-        })).rejects.toThrow("denied");
-    });
-    it("throws when expired_token", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-            ok: false,
-            status: 400,
-            json: () => Promise.resolve({ error: "expired_token" }),
-        });
-        await expect(pollDeviceAuthorization({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            deviceCode: "dev_abc",
-            pollIntervalMs: 0,
-            timeoutMs: 5_000,
-            fetchFn: mockFetch,
-        })).rejects.toThrow("expired");
-    });
-    it("increases interval on slow_down and eventually succeeds", async () => {
-        // Only one slow_down so the 5s bump is manageable
-        const slow = { error: "slow_down" };
-        const tokens = { access_token: "acc_tok", refresh_token: "ref_tok", expires_in: 3600 };
-        const responses = [
-            { ok: false, status: 400, json: () => Promise.resolve(slow) },
-            { ok: true, status: 200, json: () => Promise.resolve(tokens) },
-        ];
-        let callCount = 0;
-        const mockFetch = vi.fn().mockImplementation(() => Promise.resolve(responses[callCount++]));
-        const result = await pollDeviceAuthorization({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            deviceCode: "dev_abc",
-            pollIntervalMs: 0,
-            timeoutMs: 30_000,
-            fetchFn: mockFetch,
-        });
-        expect(result.access_token).toBe("acc_tok");
-        expect(mockFetch).toHaveBeenCalledTimes(2);
-    });
-    it("throws when timeout exceeded", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-            ok: false,
-            status: 400,
-            json: () => Promise.resolve({ error: "authorization_pending" }),
-        });
-        await expect(pollDeviceAuthorization({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            deviceCode: "dev_abc",
-            pollIntervalMs: 0,
-            timeoutMs: 1, // 1ms — immediately times out
-            fetchFn: mockFetch,
-        })).rejects.toThrow("timed out");
-    });
-});
-// ---------------------------------------------------------------------------
-// exchangeCodeForTokens
-// ---------------------------------------------------------------------------
-describe("exchangeCodeForTokens", () => {
-    it("POSTs to /oauth/token and returns token response", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-            ok: true,
-            json: () => Promise.resolve({
-                access_token: "mock_access_tok",
-                refresh_token: "refresh_xyz",
-                id_token: "mock_id_tok",
-                expires_in: 3600,
-                account_id: "acc_123",
-            }),
-        });
-        const result = await exchangeCodeForTokens({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            authorizationCode: "auth_code_xyz",
-            codeVerifier: "verifier_abc",
-            fetchFn: mockFetch,
-        });
-        const [url, init] = mockFetch.mock.calls[0];
-        expect(url).toBe("https://auth.openai.com/oauth/token");
-        expect(init.method).toBe("POST");
-        expect(result.access_token).toBe("mock_access_tok");
-        expect(result.refresh_token).toBe("refresh_xyz");
-        expect(result.expires_in).toBe(3600);
-    });
-    it("throws on HTTP 400", async () => {
-        const mockFetch = vi.fn().mockResolvedValue({
-            ok: false,
-            status: 400,
-            text: () => Promise.resolve("invalid_grant"),
-        });
-        await expect(exchangeCodeForTokens({
-            issuer: "https://auth.openai.com",
-            clientId: "test_client",
-            authorizationCode: "bad_code",
-            codeVerifier: "verifier",
-            fetchFn: mockFetch,
-        })).rejects.toThrow("400");
-    });
-});
-//# sourceMappingURL=device-flow.test.js.map

package/dist/src/providers/auth/__tests__/gemini-oauth.test.d.ts

@@ -1,4 +0,0 @@
-/**
- * Tests for Agy Google OAuth (replaces legacy gemini public client)
- */
-export {};