procesio-cli 0.1.1__py3-none-any.whl

procesio_cli/tools/procesio/tests/test_auth.py

@@ -0,0 +1,200 @@
+"""Auth: cookie-session login, header construction, caching, expiry."""
+from __future__ import annotations
+
+import time
+
+import pytest
+
+from tools.procesio import auth, profiles
+from tools.procesio.errors import AuthError, ProcesioAPIError
+from tools.procesio.tests.conftest import FakeResp, FakeSession
+
+_COOKIES = {auth.ACCESS_COOKIE: "AAA", auth.REFRESH_COOKIE: "RRR"}
+
+
+# -- login (form POST + cookies) --------------------------------------------
+
+def test_login_form_post_shape_and_cookies():
+    profile = {"type": "userpass", "username": "u@example.com", "password": "p"}
+    sess = FakeSession(queue=[FakeResp(200, {"message": "Authentication successful"},
+                                       cookies=_COOKIES,
+                                       headers={"x-session-expires-at": "1893456000"})])
+    tok = auth.login(profile, sess)
+    assert tok["cookies"][auth.ACCESS_COOKIE] == "AAA"
+    assert tok["expires_at"] == 1893456000.0
+    call = sess.calls[0]
+    assert call["url"] == "https://webapi.procesio.app/api/authentication"
+    assert call["data"] == {"username": "u@example.com", "password": "p",
+                            "client_id": "procesio-ui"}      # form body, not json
+    assert call["json"] is None
+    assert call["headers"]["x-requested-by"] == "playground-v1"
+    assert call["headers"]["Content-Type"] == "application/x-www-form-urlencoded"
+
+
+def test_login_non_2xx_raises():
+    profile = {"type": "userpass", "username": "u", "password": "p"}
+    sess = FakeSession(queue=[FakeResp(407, {}, "Unauthorized")])
+    with pytest.raises(ProcesioAPIError) as ei:
+        auth.login(profile, sess)
+    assert ei.value.status == 407
+
+
+def test_login_2xx_without_access_cookie_raises():
+    profile = {"type": "userpass", "username": "u", "password": "p"}
+    sess = FakeSession(queue=[FakeResp(200, {"message": "ok"}, cookies={})])
+    with pytest.raises(AuthError):
+        auth.login(profile, sess)
+
+
+def test_parse_expiry_iso_and_epoch():
+    assert auth._parse_expiry("1893456000") == 1893456000.0
+    assert auth._parse_expiry(None) is None
+    iso = auth._parse_expiry("2030-01-01T00:00:00Z")
+    assert iso and iso > time.time()
+
+
+# -- auth_headers: apikey ---------------------------------------------------
+
+def test_apikey_headers_include_workspaceid(store):
+    profiles.save_profile("k", {"type": "apikey", "key": "N", "value": "V",
+                                "workspace_id": "WS"})
+    h = auth.auth_headers("k", profiles.get_profile("k"), FakeSession())
+    assert h == {"key": "N", "value": "V", "workspaceid": "WS"}
+
+
+def test_apikey_headers_without_workspaceid(store):
+    profiles.save_profile("k", {"type": "apikey", "key": "N", "value": "V"})
+    h = auth.auth_headers("k", profiles.get_profile("k"), FakeSession())
+    assert h == {"key": "N", "value": "V"}
+
+
+# -- auth_headers: userpass (cookie) ----------------------------------------
+
+def test_userpass_uses_cached_cookies(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": _COOKIES, "expires_at": time.time() + 9999})
+    sess = FakeSession()  # must NOT be called - session is fresh
+    h = auth.auth_headers("u", profiles.get_profile("u"), sess)
+    assert h["x-requested-by"] == "playground-v1"
+    assert auth.ACCESS_COOKIE in h["Cookie"] and "AAA" in h["Cookie"]
+    assert sess.calls == []
+
+
+def test_userpass_logs_in_when_no_cache(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    sess = FakeSession(queue=[FakeResp(200, {"message": "ok"}, cookies=_COOKIES,
+                                       headers={"x-session-expires-at": "1893456000"})])
+    h = auth.auth_headers("u", profiles.get_profile("u"), sess)
+    assert "AAA" in h["Cookie"]
+    assert profiles.get_token_cache("u")["cookies"][auth.ACCESS_COOKIE] == "AAA"
+
+
+def test_userpass_relogs_in_when_expired(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": {auth.ACCESS_COOKIE: "OLD"},
+                                   "expires_at": time.time() - 10})   # expired
+    sess = FakeSession(queue=[FakeResp(200, {"message": "ok"},
+                                       cookies={auth.ACCESS_COOKIE: "NEW"})])
+    h = auth.auth_headers("u", profiles.get_profile("u"), sess)
+    assert "NEW" in h["Cookie"] and "OLD" not in h["Cookie"]
+
+
+# -- session renewal: refresh before re-sending the password ------------------
+
+def _refresh_resp(access="NEW", refresh="RNEW"):
+    return FakeResp(200, {"message": "Token refreshed successfully"},
+                    cookies={auth.ACCESS_COOKIE: access, auth.REFRESH_COOKIE: refresh})
+
+
+def test_persist_caches_both_cookies(store):
+    """The refresh cookie is the whole point of caching - dropping it forces a
+    full username/password login every ~30 min (the access JWT's lifetime)."""
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    auth._persist_cookies("u", {"cookies": _COOKIES, "expires_at": 123.0})
+    assert profiles.get_token_cache("u")["cookies"][auth.ACCESS_COOKIE] == "AAA"
+    assert profiles.get_refresh_cookie("u") == "RRR"
+
+
+def test_expired_access_refreshes_instead_of_logging_in(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": _COOKIES, "expires_at": time.time() - 10})
+    sess = FakeSession(queue=[_refresh_resp()])
+    h = auth.auth_headers("u", profiles.get_profile("u"), sess)
+    assert "NEW" in h["Cookie"]
+    assert len(sess.calls) == 1
+    assert sess.calls[0]["url"].endswith(auth.REFRESH_PATH)
+    # the password was never sent
+    assert "password" not in (sess.calls[0].get("data") or {})
+    assert sess.calls[0]["data"]["refresh_token"] == "RRR"
+    # and the renewed pair replaced the cache (access + its own refresh entry)
+    assert profiles.get_token_cache("u")["cookies"][auth.ACCESS_COOKIE] == "NEW"
+    assert profiles.get_refresh_cookie("u") == "RNEW"
+
+
+def test_refresh_failure_falls_back_to_full_login(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": _COOKIES, "expires_at": time.time() - 10})
+    sess = FakeSession(queue=[
+        FakeResp(400, {"error": "invalid_grant"}),                        # refresh
+        FakeResp(200, {"message": "ok"}, cookies={auth.ACCESS_COOKIE: "LOGGEDIN"}),
+    ])
+    h = auth.auth_headers("u", profiles.get_profile("u"), sess)
+    assert "LOGGEDIN" in h["Cookie"]
+    assert sess.calls[0]["url"].endswith(auth.REFRESH_PATH)
+    assert sess.calls[1]["url"].endswith(auth.LOGIN_PATH)
+
+
+def test_no_refresh_cookie_goes_straight_to_login(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": {auth.ACCESS_COOKIE: "OLD"},
+                                   "expires_at": time.time() - 10})
+    sess = FakeSession(queue=[FakeResp(200, {"message": "ok"},
+                                       cookies={auth.ACCESS_COOKIE: "NEW"})])
+    h = auth.auth_headers("u", profiles.get_profile("u"), sess)
+    assert "NEW" in h["Cookie"]
+    assert len(sess.calls) == 1 and sess.calls[0]["url"].endswith(auth.LOGIN_PATH)
+
+
+def test_dead_refresh_token_is_not_spent_on_a_round_trip(store):
+    """A refresh JWT that is already past its own exp buys nothing."""
+    dead = auth._usable_refresh_token(
+        "u", {"cookies": {auth.REFRESH_COOKIE: _jwt_with_exp(time.time() - 500)}})
+    assert dead is None
+    live = auth._usable_refresh_token(
+        "u", {"cookies": {auth.REFRESH_COOKIE: _jwt_with_exp(time.time() + 5000)}})
+    assert live is not None
+
+
+def test_refresh_cookie_persists_in_its_own_entry(store):
+    """Credential Manager caps a blob at ~1280 CHARS (2560 bytes UTF-16LE), so the
+    two ~1700-char JWTs cannot share one entry - the refresh cookie gets its own."""
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    auth._persist_cookies("u", {"cookies": _COOKIES, "expires_at": 123.0})
+    assert profiles.get_token_cache("u")["cookies"] == {auth.ACCESS_COOKIE: "AAA"}
+    assert profiles.get_refresh_cookie("u") == "RRR"
+    # and it is reachable when only the persistent store has it
+    auth._MEM_COOKIES.clear()
+    assert auth._usable_refresh_token("u") == "RRR"
+
+
+def test_clearing_a_session_drops_the_refresh_cookie_too(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    auth._persist_cookies("u", {"cookies": _COOKIES, "expires_at": 123.0})
+    auth.clear_cookies("u")
+    assert profiles.get_refresh_cookie("u") is None
+
+
+def test_reauthenticate_prefers_refresh(store):
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": _COOKIES, "expires_at": time.time() + 9999})
+    sess = FakeSession(queue=[_refresh_resp(access="REAUTH")])
+    cookies = auth.reauthenticate("u", profiles.get_profile("u"), sess)
+    assert cookies[auth.ACCESS_COOKIE] == "REAUTH"
+    assert sess.calls[0]["url"].endswith(auth.REFRESH_PATH)
+
+
+def _jwt_with_exp(exp: float) -> str:
+    import base64, json as _json
+    def seg(d):
+        return base64.urlsafe_b64encode(_json.dumps(d).encode()).decode().rstrip("=")
+    return f"{seg({'alg': 'HS256'})}.{seg({'exp': int(exp)})}.sig"

procesio_cli/tools/procesio/tests/test_autogen.py

@@ -0,0 +1,78 @@
+"""Spec-driven actions: naming, full coverage, path/query/body handling, dry-run."""
+from __future__ import annotations
+
+from tools.procesio import autogen, main, swagger
+from tools.procesio.client import ProcesioClient
+from tools.procesio.tests.conftest import FakeResp, FakeSession
+
+
+def _builder(profile, session):
+    return lambda prof: ProcesioClient(profile=profile, name="t", session=session)
+
+
+def test_action_name_mappings():
+    assert autogen.action_name("GET", "/api/Projects") == "get-projects"
+    assert autogen.action_name("POST", "/api/Projects/{id}/run") == "post-projects-by-id-run"
+    assert (autogen.action_name("GET", "/api/Projects/instances/{id}/status")
+            == "get-projects-instances-by-id-status")
+    assert (autogen.action_name("DELETE", "/api/DataTypes/attribute/{rootDataTypeId}/{attributeId}")
+            == "delete-datatypes-attribute-by-rootdatatypeid-by-attributeid")
+
+
+def test_one_action_per_endpoint():
+    gen = autogen.build_actions()
+    assert len(gen) == len(swagger.all_endpoints())
+
+
+def test_every_endpoint_is_reachable():
+    """Each spec endpoint must map to an action in the merged dispatcher."""
+    names = set(main.ACTIONS)
+    missing = [(ep["method"], ep["path"])
+               for ep in swagger.all_endpoints()
+               if autogen.action_name(ep["method"], ep["path"]) not in names]
+    assert not missing, f"endpoints without an action: {missing[:5]}"
+
+
+def test_generated_get_substitutes_path():
+    sess = FakeSession(queue=[FakeResp(200, {"ok": 1})])
+    out = main.dispatch("get-projects-by-id-payload", ["--id", "PID"],
+                        client_builder=_builder({"type": "apikey", "key": "N", "value": "V"}, sess))
+    assert out["result"] == {"ok": 1}
+    assert sess.calls[0]["url"] == "https://webapi.procesio.app/api/Projects/PID/payload"
+
+
+def test_generated_post_passes_query_and_body():
+    sess = FakeSession(queue=[FakeResp(200, {"id": "x"})])
+    main.dispatch(
+        "post-projects-by-id-run",
+        ["--id", "PID", "--runSynchronous", "true",
+         "--body", '{"payload":{},"connectionid":null}'],
+        client_builder=_builder({"type": "apikey", "key": "N", "value": "V"}, sess),
+    )
+    c = sess.calls[0]
+    assert c["url"] == "https://webapi.procesio.app/api/Projects/PID/run"
+    assert c["params"] == {"runSynchronous": "true"}
+    assert c["json"] == {"payload": {}, "connectionid": None}
+
+
+def test_generated_dry_run_does_not_send():
+    sess = FakeSession(queue=[])
+    out = main.dispatch("delete-projects-by-id", ["--id", "PID", "--dry-run"],
+                        client_builder=_builder({"type": "apikey", "key": "N", "value": "V"}, sess))
+    assert out["dry_run"] is True
+    assert out["method"] == "DELETE" and out["path"] == "/api/Projects/PID"
+    assert sess.calls == []
+
+
+def test_path_param_id_not_duplicated_as_query():
+    """/api/Projects/instances/{id}/status lists 'id' among params; it must be a
+    single required path arg, not also a query arg."""
+    gen = autogen.build_actions()
+    defn = gen["get-projects-instances-by-id-status"]
+    import argparse
+    p = argparse.ArgumentParser()
+    defn.add_args(p)
+    opts = [o[2:] for a in p._actions for o in a.option_strings
+            if o.startswith("--") and o != "--help"]
+    assert opts.count("id") == 1
+    assert "flowTemplateId" in opts        # the real query params remain

procesio_cli/tools/procesio/tests/test_builder_attrpath_sqlbind.py

@@ -0,0 +1,180 @@
+"""Two builder gaps that only surface when a process is actually SAVED.
+
+1. **Attribute paths were never resolved.** `{"var": "row", "path": ["ToEmail"]}` is documented and
+   accepted, but `attr_index` was never populated, so the attribute NAME was written straight into
+   `attribute.attributeId` — a field the API parses as a Guid. Every model-typed attribute binding
+   was rejected at save time with `Error converting value "ToEmail" to type 'System.Guid'`.
+
+2. **A SQL node was built without its `Parameters config tab`.** The builder emits only the
+   properties the caller named; the designer renders that property from the TEMPLATE, finds no
+   value, and blocks the save with "Please make sure that the action is defined/configured
+   properly". So no `process-create` config containing an Execute Query / Execute Command could be
+   saved at all, whether or not it bound any parameter.
+"""
+from __future__ import annotations
+
+import pytest
+
+from tools.procesio.dto.process import builder
+from tools.procesio.errors import UsageError
+from tools.procesio.flowmodel import sqlparam
+
+
+MODEL_ID = "11111111-1111-1111-1111-111111111111"
+CHILD_ID = "22222222-2222-2222-2222-222222222222"
+TO_EMAIL_ID = "aaaaaaaa-0000-0000-0000-000000000001"
+CLIENT_ID = "aaaaaaaa-0000-0000-0000-000000000002"
+CITY_ID = "bbbbbbbb-0000-0000-0000-000000000001"
+
+
+def _ctx_with_model() -> dict:
+    """A ctx whose model_attrs is what prepare_ctx builds from GET /api/DataTypes/{id}."""
+    return {
+        "var_ids": {"row": "var-row"},
+        "var_models": {"row": MODEL_ID},
+        "model_attrs": {
+            MODEL_ID: {
+                "toemail": {"id": TO_EMAIL_ID, "name": "ToEmail", "dataTypeId": None},
+                "client": {"id": CLIENT_ID, "name": "Client", "dataTypeId": CHILD_ID},
+            },
+            CHILD_ID: {
+                "city": {"id": CITY_ID, "name": "City", "dataTypeId": None},
+            },
+        },
+    }
+
+
+# ------------------------------------------------------------------ attribute paths
+
+def test_an_attribute_name_resolves_to_its_guid():
+    p = builder._make_parameter("prop-1", {"var": "row", "path": ["ToEmail"]},
+                                _ctx_with_model(), [0])
+    assert p["Variable"][0]["attribute"] == {"attributeId": TO_EMAIL_ID, "nextAttribute": None}
+
+
+def test_attribute_names_are_matched_case_insensitively():
+    p = builder._make_parameter("prop-1", {"var": "row", "path": ["toemail"]},
+                                _ctx_with_model(), [0])
+    assert p["Variable"][0]["attribute"]["attributeId"] == TO_EMAIL_ID
+
+
+def test_a_nested_path_descends_through_the_child_model():
+    p = builder._make_parameter("prop-1", {"var": "row", "path": ["Client", "City"]},
+                                _ctx_with_model(), [0])
+    assert p["Variable"][0]["attribute"] == {
+        "attributeId": CLIENT_ID,
+        "nextAttribute": {"attributeId": CITY_ID, "nextAttribute": None},
+    }
+
+
+def test_a_guid_passed_directly_is_left_alone():
+    """A caller who already knows the attribute id must not need the model resolved."""
+    p = builder._make_parameter("prop-1", {"var": "row", "path": [TO_EMAIL_ID]},
+                                _ctx_with_model(), [0])
+    assert p["Variable"][0]["attribute"]["attributeId"] == TO_EMAIL_ID
+
+
+def test_an_unknown_attribute_fails_loudly_instead_of_writing_a_name_the_api_rejects():
+    with pytest.raises(UsageError) as e:
+        builder._make_parameter("prop-1", {"var": "row", "path": ["Nope"]},
+                                _ctx_with_model(), [0])
+    msg = str(e.value)
+    assert "Nope" in msg
+    assert "ToEmail" in msg, "the error must name the attributes that DO exist"
+
+
+def test_a_template_binding_resolves_attribute_paths_the_same_way():
+    p = builder._make_parameter(
+        "prop-1",
+        {"template": "EXEC p @a='<%0%>', @b='<%1%>'",
+         "vars": [{"var": "row", "path": ["ToEmail"]}, {"var": "row", "path": ["Client", "City"]}]},
+        _ctx_with_model(), [0])
+    assert p["Variable"][0]["attribute"]["attributeId"] == TO_EMAIL_ID
+    assert p["Variable"][1]["attribute"]["nextAttribute"]["attributeId"] == CITY_ID
+
+
+def test_no_path_still_means_no_attribute():
+    p = builder._make_parameter("prop-1", {"var": "row"}, _ctx_with_model(), [0])
+    assert p["Variable"][0]["attribute"] is None
+
+
+def test_a_variable_with_no_known_model_passes_the_path_through_unchanged():
+    """Offline or for an untyped variable, the old pass-through behaviour is the safe fallback."""
+    ctx = {"var_ids": {"row": "var-row"}}
+    p = builder._make_parameter("prop-1", {"var": "row", "path": ["ToEmail"]}, ctx, [0])
+    assert p["Variable"][0]["attribute"]["attributeId"] == "ToEmail"
+
+
+# ------------------------------------------------------------------ SQL bind property
+
+@pytest.mark.parametrize("template_name,bind_pid", [
+    ("Execute Query", sqlparam.PID_BIND),
+    ("Execute Command", sqlparam.EC_PID_BIND),
+])
+def test_a_sql_node_always_carries_its_parameters_config_tab(template_name, bind_pid):
+    params = [{"TabPropertyId": "some-other-prop", "Variable": [], "Value": "x"}]
+    out = builder._ensure_sql_bind_property({"name": template_name}, params)
+    bind = [p for p in out if p["TabPropertyId"] == bind_pid]
+    assert len(bind) == 1
+    assert bind[0]["Value"] == [], "an unbound SQL node still needs the property, just empty"
+
+
+def test_an_existing_binding_is_not_overwritten():
+    existing = [{"TabPropertyId": sqlparam.PID_BIND, "Variable": [], "Value": [{"id": 0}]}]
+    out = builder._ensure_sql_bind_property({"name": "Execute Query"}, existing)
+    assert out == existing
+
+
+def test_a_non_sql_action_is_left_alone():
+    params = [{"TabPropertyId": "p", "Variable": [], "Value": "x"}]
+    assert builder._ensure_sql_bind_property({"name": "Node"}, params) == params
+
+
+def test_the_command_family_gets_its_own_bind_id_not_the_query_one():
+    out = builder._ensure_sql_bind_property({"name": "Execute Command"}, [])
+    pids = {p["TabPropertyId"] for p in out}
+    assert sqlparam.EC_PID_BIND in pids
+    assert sqlparam.PID_BIND not in pids, (
+        "the Query bind id on a Command node leaves every @param unbound at runtime")
+
+
+# ------------------------------------------------------------------ engine-state properties
+
+def _foreach_template() -> dict:
+    """The For Each template as the live catalog serves it: two `ignore` properties carrying the
+    engine's loop state, with their seed values already on the template."""
+    return {"name": "For Each", "configuration": [{"settings": [
+        {"id": "in-list", "label": "In List", "type": "any", "value": None},
+        {"id": "timeout", "label": "Action timeout", "type": "number", "value": None},
+        {"id": "idx", "label": "Zero based list index", "type": "ignore", "value": "-1"},
+        {"id": "started", "label": "Action start time", "type": "ignore",
+         "value": "2010-01-01T00:00:00.0000000Z"},
+        {"id": "item", "label": "For Each Item", "type": "any", "value": None},
+    ]}]}
+
+
+def test_engine_state_properties_are_seeded_from_the_template():
+    """A For Each whose start time is missing times out on its FIRST iteration: the engine compares
+    against a default far in the past, so the elapsed time is always over any cap."""
+    params = [{"TabPropertyId": "in-list", "Variable": [], "Value": "<%0%>"}]
+
+    out = builder._ensure_engine_state_properties(_foreach_template(), params)
+
+    by_pid = {p["TabPropertyId"]: p["Value"] for p in out}
+    assert by_pid["idx"] == "-1"
+    assert by_pid["started"] == "2010-01-01T00:00:00.0000000Z"
+    assert by_pid["in-list"] == "<%0%>", "the caller's own parameters are untouched"
+
+
+def test_a_seeded_state_property_is_not_duplicated():
+    params = [{"TabPropertyId": "idx", "Variable": [], "Value": "7"}]
+    out = builder._ensure_engine_state_properties(_foreach_template(), params)
+    idx = [p for p in out if p["TabPropertyId"] == "idx"]
+    assert len(idx) == 1 and idx[0]["Value"] == "7"
+
+
+def test_an_action_with_no_ignore_properties_is_unchanged():
+    tpl = {"name": "Node", "configuration": [{"settings": [
+        {"id": "code", "label": "Code", "type": "code-editor", "value": None}]}]}
+    params = [{"TabPropertyId": "code", "Variable": [], "Value": "x"}]
+    assert builder._ensure_engine_state_properties(tpl, params) == params

procesio_cli/tools/procesio/tests/test_builder_custom_action_catalog.py

@@ -0,0 +1,72 @@
+"""prepare_ctx must surface a workspace's custom (connector) actions into the
+action catalog GENERICALLY - any installed custom action resolvable by name or
+actionId, with no per-action code - and must do so even when the full live
+catalog fetch (`GET /api/Actions?getFullAction=true`) is slow or fails.
+
+The full-catalog endpoint is occasionally pathologically slow, so the build
+falls back to the bundled, built-in-only catalog. Before the fix that fallback
+silently dropped every connector, so a process that used one failed with
+"unknown action ... not in the action catalog". The fix fetches the workspace's
+custom actions separately via the narrow, fast
+`GET /api/Actions/node?getFullAction=true&isCustom=true` (the same endpoint
+`customaction-list` uses) and merges them in unconditionally.
+"""
+import tools.procesio.dto.process.builder as pb
+
+
+CUSTOM = {
+    "actionId": "517cf512-6a26-4bb7-b0c6-c6f8116e12a4",
+    "name": "HTML to Word (.docx)",
+    "isProcesioAction": False,
+    "configuration": [],
+}
+
+
+class _Client:
+    """Minimal fake: the full-catalog fetch is the failure path, the scoped
+    custom-action fetch is the fast path that carries the connector."""
+
+    def __init__(self, full_fails=True, full_actions=None):
+        self.full_fails = full_fails
+        self.full_actions = full_actions or []
+        self.calls = []
+
+    def get(self, path, params=None, **kw):
+        # accepts read_timeout=/deadline= (the client's real knobs), like ProcesioClient.get
+        self.calls.append((path, params))
+        if path == "/api/Actions":
+            if self.full_fails:
+                raise RuntimeError("full catalog pathologically slow")
+            return {"actions": self.full_actions}
+        if path == "/api/Actions/node":
+            assert params == {"getFullAction": "true", "isCustom": "true"}
+            return {"actions": [CUSTOM]}
+        raise AssertionError(f"unexpected GET {path}")
+
+
+def test_custom_action_resolves_when_full_catalog_fetch_fails():
+    c = _Client(full_fails=True)
+    ctx = pb.prepare_ctx(c, {"title": "t", "variables": [], "actions": []})
+    idx = ctx["catalog"]
+    # resolvable by name (lowercased) AND by actionId
+    assert idx.get("html to word (.docx)") is CUSTOM
+    assert idx.get(CUSTOM["actionId"]) is CUSTOM
+    # and a built-in is still present from the bundled catalog
+    assert idx.get("generate guid"), "bundled built-ins must remain available"
+    # the scoped custom-action endpoint was actually consulted
+    assert any(p == "/api/Actions/node" for p, _ in c.calls)
+
+
+def test_resolve_template_finds_custom_action_by_name_and_id():
+    c = _Client(full_fails=True)
+    ctx = pb.prepare_ctx(c, {"title": "t", "variables": [], "actions": []})
+    assert pb._resolve_template("HTML to Word (.docx)", ctx) is CUSTOM
+    assert pb._resolve_template(CUSTOM["actionId"], ctx) is CUSTOM
+
+
+def test_custom_action_merged_even_when_full_catalog_omits_it():
+    # Full fetch succeeds but returns only built-ins (connectors absent); the
+    # scoped fetch must still add the custom action.
+    c = _Client(full_fails=False, full_actions=[])
+    ctx = pb.prepare_ctx(c, {"title": "t", "variables": [], "actions": []})
+    assert ctx["catalog"].get(CUSTOM["actionId"]) is CUSTOM

procesio_cli/tools/procesio/tests/test_client.py

@@ -0,0 +1,114 @@
+"""ProcesioClient: URL building, header injection, error mapping, 401 retry."""
+from __future__ import annotations
+
+import pytest
+
+from tools.procesio import profiles
+from tools.procesio.client import ProcesioClient
+from tools.procesio.errors import ProcesioAPIError
+from tools.procesio.tests.conftest import FakeResp, FakeSession
+
+
+def _client(profile, session):
+    return ProcesioClient(profile=profile, name="t", session=session)
+
+
+def test_get_builds_url_and_injects_apikey_headers():
+    sess = FakeSession(queue=[FakeResp(200, {"ok": True})])
+    c = _client({"type": "apikey", "key": "N", "value": "V", "workspace_id": "WS"}, sess)
+    out = c.get("/api/Workspaces")
+    assert out == {"ok": True}
+    call = sess.calls[0]
+    assert call["url"] == "https://webapi.procesio.app/api/Workspaces"
+    assert call["headers"]["key"] == "N"
+    assert call["headers"]["value"] == "V"
+    assert call["headers"]["workspaceid"] == "WS"
+
+
+def test_query_drops_none_values():
+    sess = FakeSession(queue=[FakeResp(200, [])])
+    c = _client({"type": "apikey", "key": "N", "value": "V"}, sess)
+    c.get("/api/Projects", {"pageNumber": 1, "searchName": None})
+    assert sess.calls[0]["params"] == {"pageNumber": 1}
+
+
+def test_non_2xx_raises_apierror_with_status():
+    sess = FakeSession(queue=[FakeResp(403, {"message": "nope"})])
+    c = _client({"type": "apikey", "key": "N", "value": "V"}, sess)
+    with pytest.raises(ProcesioAPIError) as ei:
+        c.get("/api/Projects")
+    assert ei.value.status == 403
+    assert ei.value.details["message"] == "nope"
+
+
+def test_userpass_401_triggers_relogin_retry(store):
+    from tools.procesio import auth
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    # Far-future expiry -> treated as fresh and used (an unknown/None expiry is now
+    # distrusted, forcing a pre-emptive re-login). This exercises the 401-retry path:
+    # the cached token IS sent, the GET 401s, then the client re-logins and retries.
+    profiles.set_token_cache("u", {"cookies": {auth.ACCESS_COOKIE: "STALE"},
+                                   "expires_at": 9999999999})
+    # 1st GET -> 401 ; client clears cache, re-logs-in, retries -> 200
+    sess = FakeSession(queue=[
+        FakeResp(401, {"message": "expired"}),                                   # the GET
+        FakeResp(200, {"message": "ok"}, cookies={auth.ACCESS_COOKIE: "FRESH"}),  # re-login
+        FakeResp(200, {"ok": 1}),                                                # retried GET
+    ])
+    c = ProcesioClient(profile=profiles.get_profile("u"), name="u", session=sess)
+    out = c.get("/api/Workspaces")
+    assert out == {"ok": 1}
+    # final retried GET carried the FRESH session cookie
+    assert "FRESH" in sess.calls[-1]["headers"]["Cookie"]
+
+
+def test_post_sets_content_type_and_body():
+    sess = FakeSession(queue=[FakeResp(200, {"id": "x"})])
+    c = _client({"type": "apikey", "key": "N", "value": "V"}, sess)
+    c.post("/api/Projects/abc/run", {"payload": {}, "connectionid": None})
+    call = sess.calls[0]
+    assert call["json"] == {"payload": {}, "connectionid": None}
+    assert call["headers"]["Content-Type"] == "application/json"
+
+
+def test_userpass_403_also_triggers_reauth_retry(store):
+    """A REJECTED session comes back 403, not 401 (measured against the prod
+    gateway). Treating 403 as final surfaced a stale session as an unactionable
+    permission error."""
+    from tools.procesio import auth
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": {auth.ACCESS_COOKIE: "STALE"},
+                                   "expires_at": 9999999999})
+    sess = FakeSession(queue=[
+        FakeResp(403, {"message": "rejected"}),                                   # the GET
+        FakeResp(200, {"message": "ok"}, cookies={auth.ACCESS_COOKIE: "FRESH"}),  # re-login
+        FakeResp(200, {"ok": 1}),                                                 # retried GET
+    ])
+    c = ProcesioClient(profile=profiles.get_profile("u"), name="u", session=sess)
+    assert c.get("/api/Workspaces") == {"ok": 1}
+    assert "FRESH" in sess.calls[-1]["headers"]["Cookie"]
+
+
+def test_reauth_is_one_shot_so_a_real_permission_denial_still_raises(store):
+    from tools.procesio import auth
+    profiles.save_profile("u", {"type": "userpass", "username": "u", "password": "p"})
+    profiles.set_token_cache("u", {"cookies": {auth.ACCESS_COOKIE: "OK"},
+                                   "expires_at": 9999999999})
+    sess = FakeSession(queue=[
+        FakeResp(403, {"message": "denied"}),
+        FakeResp(200, {"message": "ok"}, cookies={auth.ACCESS_COOKIE: "FRESH"}),
+        FakeResp(403, {"message": "denied"}),     # still denied -> genuine
+    ])
+    c = ProcesioClient(profile=profiles.get_profile("u"), name="u", session=sess)
+    with pytest.raises(ProcesioAPIError) as e:
+        c.get("/api/Workspaces")
+    assert e.value.status == 403
+
+
+def test_apikey_403_is_never_retried(store):
+    """Only a userpass SESSION can go stale; an API key that is denied is denied."""
+    sess = FakeSession(queue=[FakeResp(403, {"message": "denied"})])
+    c = _client({"type": "apikey", "key": "N", "value": "V"}, sess)
+    with pytest.raises(ProcesioAPIError):
+        c.get("/api/Workspaces")
+    assert len(sess.calls) == 1