offrouter-core 0.2.0 → 0.2.2

package/src/auth/oauth-pkce.test.ts

@@ -1,329 +0,0 @@
-/**
- * Tests for OAuth PKCE flow helpers.
- */
-import { describe, expect, it, vi } from "vitest";
-import {
-  generateCodeVerifier,
-  generateCodeChallenge,
-  PKCE_CONFIGS,
-  createOAuthState,
-  isOAuthProvider,
-  defaultCallbackPort,
-  resolveClientId,
-  runOAuthLogin,
-} from "./oauth-pkce.js";
-import { FileSecretStore } from "../secrets.js";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { mkdtempSync, rmSync } from "node:fs";
-import { getOAuthTokens } from "./keychain.js";
-
-describe("PKCE code verifier and challenge", () => {
-  it("generates a code verifier of correct length", () => {
-    const verifier = generateCodeVerifier();
-    expect(verifier).toBeTruthy();
-    expect(verifier.length).toBeGreaterThanOrEqual(43);
-    expect(verifier.length).toBeLessThanOrEqual(128);
-  });
-
-  it("generates a non-empty code challenge from verifier", async () => {
-    const verifier = generateCodeVerifier();
-    const challenge = await generateCodeChallenge(verifier);
-    expect(challenge).toBeTruthy();
-    expect(typeof challenge).toBe("string");
-  });
-
-  it("generates unique verifiers on each call", () => {
-    const v1 = generateCodeVerifier();
-    const v2 = generateCodeVerifier();
-    expect(v1).not.toBe(v2);
-  });
-});
-
-describe("PKCE_CONFIGS", () => {
-  it("has config for anthropic", () => {
-    const config = PKCE_CONFIGS["anthropic"];
-    expect(config).toBeDefined();
-    expect(config.authorizeUrl).toContain("console.anthropic.com");
-    expect(config.scopes).toContain("offline_access");
-  });
-
-  it("has config for openai", () => {
-    const config = PKCE_CONFIGS["openai"];
-    expect(config).toBeDefined();
-    expect(config.authorizeUrl).toContain("auth.openai.com");
-    expect(config.scopes).toContain("offline_access");
-  });
-
-  it("has no config for gemini", () => {
-    expect(PKCE_CONFIGS["gemini"]).toBeUndefined();
-  });
-
-  it("has no config for xai", () => {
-    expect(PKCE_CONFIGS["xai"]).toBeUndefined();
-  });
-});
-
-describe("createOAuthState", () => {
-  it("creates a state string with metadata", () => {
-    const state = createOAuthState("anthropic");
-    const parsed = JSON.parse(state);
-    expect(parsed.provider).toBe("anthropic");
-    expect(parsed.nonce).toBeTruthy();
-    expect(typeof parsed.nonce).toBe("string");
-  });
-});
-
-describe("isOAuthProvider", () => {
-  it("returns true for anthropic", () => {
-    expect(isOAuthProvider("anthropic")).toBe(true);
-  });
-
-  it("returns true for openai", () => {
-    expect(isOAuthProvider("openai")).toBe(true);
-  });
-
-  it("returns false for gemini", () => {
-    expect(isOAuthProvider("gemini")).toBe(false);
-  });
-
-  it("returns false for xai", () => {
-    expect(isOAuthProvider("xai")).toBe(false);
-  });
-});
-
-describe("startOAuthFlow", () => {
-  it("returns an authorization URL for anthropic", async () => {
-    const { startOAuthFlow } = await import("./oauth-pkce.js");
-    const result = await startOAuthFlow("anthropic", {
-      redirectUri: "http://127.0.0.1:8765/callback",
-      clientId: "test-client-id-anthropic",
-    });
-    expect(result).toBeDefined();
-    expect(result.authorizeUrl).toContain("console.anthropic.com/oauth/authorize");
-    expect(result.authorizeUrl).toContain("response_type=code");
-    expect(result.authorizeUrl).toContain("code_challenge_method=S256");
-    expect(result.state).toBeTruthy();
-  });
-
-  it("returns an authorization URL for openai", async () => {
-    const { startOAuthFlow } = await import("./oauth-pkce.js");
-    const result = await startOAuthFlow("openai", {
-      redirectUri: "http://127.0.0.1:8765/callback",
-      clientId: "test-client-id-openai",
-    });
-    expect(result).toBeDefined();
-    expect(result.authorizeUrl).toContain("auth.openai.com/oauth/authorize");
-    expect(result.authorizeUrl).toContain("response_type=code");
-  });
-
-  it("throws for unsupported provider", async () => {
-    const { startOAuthFlow } = await import("./oauth-pkce.js");
-    await expect(
-      startOAuthFlow("gemini", {
-        redirectUri: "http://127.0.0.1:8765/callback",
-      }),
-    ).rejects.toThrow("OAuth not supported for provider: gemini");
-  });
-});
-
-describe("OAuth session store", () => {
-  it("state string does NOT contain codeVerifier or redirectUri", async () => {
-    const { startOAuthFlow } = await import("./oauth-pkce.js");
-    const result = await startOAuthFlow("anthropic", {
-      redirectUri: "http://127.0.0.1:8765/callback",
-      clientId: "test-client-id-anthropic",
-    });
-    const parsed = JSON.parse(result.state);
-    expect(parsed).not.toHaveProperty("codeVerifier");
-    expect(parsed).not.toHaveProperty("redirectUri");
-    expect(parsed).toHaveProperty("provider", "anthropic");
-    expect(parsed).toHaveProperty("nonce");
-  });
-
-  it("consumeOAuthSession is one-shot: second call returns null", async () => {
-    const { startOAuthFlow, consumeOAuthSession } = await import(
-      "./oauth-pkce.js"
-    );
-    const result = await startOAuthFlow("anthropic", {
-      redirectUri: "http://127.0.0.1:8765/callback",
-      clientId: "test-client-id-anthropic",
-    });
-    const parsed = JSON.parse(result.state);
-
-    const first = consumeOAuthSession(parsed.nonce);
-    expect(first).not.toBeNull();
-    expect(first!.codeVerifier).toBeTruthy();
-    expect(first!.redirectUri).toBe("http://127.0.0.1:8765/callback");
-
-    const second = consumeOAuthSession(parsed.nonce);
-    expect(second).toBeNull();
-  });
-
-  it("cancelOAuthSession removes the session", async () => {
-    const { startOAuthFlow, cancelOAuthSession, consumeOAuthSession } =
-      await import("./oauth-pkce.js");
-    const result = await startOAuthFlow("anthropic", {
-      redirectUri: "http://127.0.0.1:8765/callback",
-      clientId: "test-client-id-anthropic",
-    });
-    const parsed = JSON.parse(result.state);
-
-    cancelOAuthSession(parsed.nonce);
-    const session = consumeOAuthSession(parsed.nonce);
-    expect(session).toBeNull();
-  });
-
-  it("consumeOAuthSession returns null for unknown nonce", async () => {
-    const { consumeOAuthSession } = await import("./oauth-pkce.js");
-    const result = consumeOAuthSession("nonexistent-nonce");
-    expect(result).toBeNull();
-  });
-});
-
-describe("refreshTokens", () => {
-  it("throws when no store is provided", async () => {
-    const { refreshTokens } = await import("./oauth-pkce.js");
-    await expect(
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      refreshTokens("anthropic", "old-refresh-token", undefined as any),
-    ).rejects.toThrow("SecretStore is required");
-  });
-});
-
-describe("defaultCallbackPort", () => {
-  it("returns 1456 for anthropic", () => {
-    expect(defaultCallbackPort("anthropic")).toBe(1456);
-  });
-
-  it("returns 1455 for openai", () => {
-    expect(defaultCallbackPort("openai")).toBe(1455);
-  });
-});
-
-describe("resolveClientId", () => {
-  it("reads from the right env var for anthropic", () => {
-    const id = resolveClientId("anthropic", {
-      OFFROUTER_ANTHROPIC_CLIENT_ID: "ant-id-from-env",
-    } as NodeJS.ProcessEnv);
-    expect(id).toBe("ant-id-from-env");
-  });
-
-  it("reads from the right env var for openai", () => {
-    const id = resolveClientId("openai", {
-      OFFROUTER_OPENAI_CLIENT_ID: "oa-id-from-env",
-    } as NodeJS.ProcessEnv);
-    expect(id).toBe("oa-id-from-env");
-  });
-
-  it("returns undefined when env var is not set", () => {
-    expect(resolveClientId("anthropic", {} as NodeJS.ProcessEnv)).toBeUndefined();
-  });
-});
-
-describe("runOAuthLogin", () => {
-  it("stores structured OAuth tokens in the keychain after the full flow", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-run-oauth-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      const openBrowser = vi.fn();
-      let capturedAuthorizeUrl = "";
-
-      // Mock fetch: return a fake token response on the token exchange.
-      const mockFetch = vi.fn(async (_url: string, init?: RequestInit) => {
-        const body = typeof init?.body === "string" ? init.body : "";
-        if (body.includes("grant_type=authorization_code")) {
-          return new Response(
-            JSON.stringify({
-              access_token: "ant-access-token-mock",
-              refresh_token: "ant-refresh-token-mock",
-              expires_in: 3600,
-              scope: "api offline_access",
-            }),
-            {
-              status: 200,
-              headers: { "content-type": "application/json" },
-            },
-          );
-        }
-        return new Response("ok", { status: 200 });
-      });
-
-      // Start login; it will block on waitForCode.
-      const loginPromise = runOAuthLogin({
-        provider: "anthropic",
-        store,
-        clientId: "test-client-id",
-        port: 0,
-        timeoutMs: 5000,
-        openBrowser,
-        onAuthorizeUrl: (url) => { capturedAuthorizeUrl = url; },
-        fetch: mockFetch as unknown as typeof globalThis.fetch,
-      });
-
-      // Wait until the authorize URL is emitted (server is ready).
-      await vi.waitFor(() => {
-        expect(capturedAuthorizeUrl).toBeTruthy();
-      }, { timeout: 2000, interval: 50 });
-
-      // Parse url to get redirect_uri and state.
-      const parsed = new URL(capturedAuthorizeUrl);
-      const state = parsed.searchParams.get("state");
-      const redirectUri = parsed.searchParams.get("redirect_uri");
-      expect(state).toBeTruthy();
-      expect(redirectUri).toMatch(/^http:\/\/127\.0\.0\.1:\d+\/callback$/);
-
-      // Emulate the provider callback.
-      const cbRes = await fetch(
-        `${redirectUri}?code=TESTCODE&state=${encodeURIComponent(state!)}`,
-        { redirect: "manual" },
-      );
-      expect(cbRes.status).toBe(200);
-      const body = await cbRes.text();
-      expect(body).toMatch(/success|complete|authorized/i);
-
-      // Await the login result.
-      const result = await loginPromise;
-      expect(result.provider).toBe("anthropic");
-      expect(result.redirectUri).toBe(redirectUri);
-      expect(result.expiresAt).toBeGreaterThan(Date.now());
-
-      // Verify tokens stored in keychain.
-      const stored = await getOAuthTokens("anthropic", store);
-      expect(stored).toBeDefined();
-      expect(stored!.accessToken).toBe("ant-access-token-mock");
-      expect(stored!.refreshToken).toBe("ant-refresh-token-mock");
-      expect(stored!.expiresAt).toBeGreaterThan(Date.now());
-      expect(stored!.scope).toBe("api offline_access");
-
-      // Verify openBrowser was called.
-      expect(openBrowser).toHaveBeenCalledWith(capturedAuthorizeUrl);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("throws for unsupported provider", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-oauth-bad-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      await expect(
-        runOAuthLogin({ provider: "gemini", store }),
-      ).rejects.toThrow(/not supported/i);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("throws if client id cannot be resolved", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-oauth-noid-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      await expect(
-        runOAuthLogin({ provider: "anthropic", store, port: 0 }),
-      ).rejects.toThrow(/client id required|client.*id/i);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});