stackos-connectors 0.2.2__tar.gz → 0.2.4__tar.gz

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stackos-connectors
-Version: 0.2.2
+Version: 0.2.4
 Summary: Named provider connectors with plain data and caller-owned authentication.
 License-Expression: MIT
 License-File: LICENSE
@@ -127,11 +127,11 @@ through `CallOptions(provider_context={"mailbox": ...})`. Google Ads/Workspace
 service-account probes only report resolved-token presence and unverified resource
 access; they make no HTTP call or new-grant claim.
 
-Google JWT validation/signing is shared across the five declared service-account
+Google JWT validation/signing is shared across the six declared service-account
 methods. Credentials never come from ambient identity or key-supplied endpoints.
 Provider details live in `connectors/<provider>/docs/auth.md` and the catalog.
-Google Indexing retains its existing resolved-token action/probe contract; this
-release adds no Indexing JWT acquisition method.
+Google Indexing supports explicit `jwt_bearer` acquisition with the fixed Indexing
+scope. Token acquisition does not establish API enablement or site-owner access.
 
 Provider-local pure helpers cover Telegram authorization request/challenge/state
 translation (`connectors.telegram.auth`), Slack v0 HMAC verification
@@ -191,15 +191,32 @@ Python 3.12 or newer is required. Source:
 Published releases can be installed with:
 
 ```bash
-python -m pip install stackos-connectors==0.2.2
+python -m pip install stackos-connectors==0.2.4
 ```
 
-Or add `stackos-connectors==0.2.2` to your Python dependency requirements.
+Or add `stackos-connectors==0.2.4` to your Python dependency requirements.
 
 Install from a local checkout with `pip install /path/to/StackOSConnectors`, or
 build a wheel with `python -m build --wheel` and install that wheel. Runtime use
 needs only the installed package and its declared dependencies.
 
+### 0.2.4 release notes
+
+- Complete QuickBooks setup metadata with method labels and explicit required
+  environment and company realm fields.
+- Add a credential probe through the existing validated CompanyInfo read. It
+  returns bounded company identity and leaves OAuth grant evidence unknown.
+- Preserve the two QuickBooks read actions and Google Indexing authentication
+  support from 0.2.3.
+
+### 0.2.3 release notes
+
+- Restore Google Indexing service-account token acquisition through the canonical
+  `get_auth_contract` and `request_token` APIs. The contract fixes the Google token
+  endpoint and Indexing scope, requires a Bearer response, and rejects delegation.
+- Preserve the QuickBooks Online connector from 0.2.2 and the Search Console scope
+  handling from 0.2.1.
+
 ## Publishing
 
 The manual [publish workflow](.github/workflows/publish.yml) uses PyPI Trusted

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/README.md

@@ -111,11 +111,11 @@ through `CallOptions(provider_context={"mailbox": ...})`. Google Ads/Workspace
 service-account probes only report resolved-token presence and unverified resource
 access; they make no HTTP call or new-grant claim.
 
-Google JWT validation/signing is shared across the five declared service-account
+Google JWT validation/signing is shared across the six declared service-account
 methods. Credentials never come from ambient identity or key-supplied endpoints.
 Provider details live in `connectors/<provider>/docs/auth.md` and the catalog.
-Google Indexing retains its existing resolved-token action/probe contract; this
-release adds no Indexing JWT acquisition method.
+Google Indexing supports explicit `jwt_bearer` acquisition with the fixed Indexing
+scope. Token acquisition does not establish API enablement or site-owner access.
 
 Provider-local pure helpers cover Telegram authorization request/challenge/state
 translation (`connectors.telegram.auth`), Slack v0 HMAC verification
@@ -175,15 +175,32 @@ Python 3.12 or newer is required. Source:
 Published releases can be installed with:
 
 ```bash
-python -m pip install stackos-connectors==0.2.2
+python -m pip install stackos-connectors==0.2.4
 ```
 
-Or add `stackos-connectors==0.2.2` to your Python dependency requirements.
+Or add `stackos-connectors==0.2.4` to your Python dependency requirements.
 
 Install from a local checkout with `pip install /path/to/StackOSConnectors`, or
 build a wheel with `python -m build --wheel` and install that wheel. Runtime use
 needs only the installed package and its declared dependencies.
 
+### 0.2.4 release notes
+
+- Complete QuickBooks setup metadata with method labels and explicit required
+  environment and company realm fields.
+- Add a credential probe through the existing validated CompanyInfo read. It
+  returns bounded company identity and leaves OAuth grant evidence unknown.
+- Preserve the two QuickBooks read actions and Google Indexing authentication
+  support from 0.2.3.
+
+### 0.2.3 release notes
+
+- Restore Google Indexing service-account token acquisition through the canonical
+  `get_auth_contract` and `request_token` APIs. The contract fixes the Google token
+  endpoint and Indexing scope, requires a Bearer response, and rejects delegation.
+- Preserve the QuickBooks Online connector from 0.2.2 and the Search Console scope
+  handling from 0.2.1.
+
 ## Publishing
 
 The manual [publish workflow](.github/workflows/publish.yml) uses PyPI Trusted

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "stackos-connectors"
-version = "0.2.2"
+version = "0.2.4"
 description = "Named provider connectors with plain data and caller-owned authentication."
 readme = "README.md"
 requires-python = ">=3.12"

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/src/stackos_connectors/connectors/google_indexing/catalog.json

@@ -41,7 +41,20 @@
             "type": "secret"
           }
         ],
-        "description": "Use the Google service-account key to acquire an access token outside this library. Execution accepts the resolved access_token; provider resource access must be granted separately."
+        "description": "Use request_token with the Google service-account key to acquire an access token. Execution accepts the resolved access_token; provider resource access must be granted separately. Credential storage and refresh scheduling remain consumer-owned.",
+        "auth_type": "oauth",
+        "interactive": false
+      },
+      "evidence_source": "oauth_response",
+      "protocol": {
+        "grant_types": [
+          "jwt_bearer"
+        ],
+        "flow": "jwt_bearer",
+        "authorization_endpoint": null,
+        "pkce_mode": "unavailable",
+        "authorization_params": [],
+        "required_token_type": "Bearer"
       }
     }
   ],
@@ -221,5 +234,12 @@
     "path": "shared/icons/integration.svg",
     "media_type": "image/svg+xml",
     "kind": "fallback"
+  },
+  "auth_protocol": {
+    "flow": "jwt_bearer",
+    "token_endpoint": "https://oauth2.googleapis.com/token",
+    "scopes": [
+      "https://www.googleapis.com/auth/indexing"
+    ]
   }
 }

stackos_connectors-0.2.4/src/stackos_connectors/connectors/google_indexing/docs/auth.md

@@ -0,0 +1,30 @@
+# Google Indexing authentication
+
+The [bundled catalog](../catalog.json) is the installed contract for method fields,
+scopes, endpoints and supported grants. Read it through `describe`; use
+`get_auth_contract` for immutable protocol facts.
+
+| Saved method | Explicit token grants |
+| --- | --- |
+| `service-account` | `jwt_bearer` |
+
+Call `request_token` with resolved `service_account_json` to sign an RSA JWT and
+exchange it at `https://oauth2.googleapis.com/token`. The signed request uses only
+`https://www.googleapis.com/auth/indexing`. The shared Google key validator rejects
+alternate token endpoints and external credential sources. Delegation is not
+supported. A successful response requires a Bearer token and a positive expiry;
+omitted scope remains omitted provider evidence.
+
+Actions and `probe_credentials` accept the resolved `access_token`. Discovery,
+probes and actions never acquire or refresh credentials implicitly. The consumer
+owns key and token custody, refresh timing, permissions, persistence and audit.
+
+Token acquisition does not verify API enablement or site-owner access. The service
+account needs delegated site-owner access in Search Console. This property role
+is separate from Workspace user impersonation. Existing eligibility, quota and
+notification semantics remain in the [provider notes](google-indexing.md).
+
+Provider references retained from the reviewed catalog:
+
+- [Indexing prerequisites](https://developers.google.com/search/apis/indexing-api/v3/prereqs)
+- [Indexing API usage](https://developers.google.com/search/apis/indexing-api/v3/using-api)

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/src/stackos_connectors/connectors/google_search_console/docs/auth.md

@@ -21,7 +21,7 @@ The full `webmasters` scope also permits read operations. Consumers can use
 without changing stored provider scope evidence. Read-only scope never satisfies
 a sitemap submission requirement. Property permissions remain separate.
 
-Service-account token success does not establish Search Console property access. Inventory probes can succeed with no properties. Google Indexing is a separate resolved-token contract; no new Indexing JWT grant is supplied.
+Service-account token success does not establish Search Console property access. Inventory probes can succeed with no properties. Google Indexing has a separate [service-account authentication contract](../../google_indexing/docs/auth.md) and scope.
 
 `request_token` receives resolved application/key fields and performs only the requested grant. Actions and `probe_credentials` receive resolved execution fields. Discovery, probes and actions never acquire or refresh implicitly. The consumer owns credential/state/PKCE custody, callbacks, refresh timing and concurrency, permissions, persistence and audit. Token results and authorization URLs are sensitive in-process values.
 

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/src/stackos_connectors/connectors/quickbooks_online/catalog.json

@@ -4,6 +4,7 @@
   "name": "QuickBooks Online",
   "description": "Bounded company and invoice reads with explicit caller-owned OAuth.",
   "auth_type": "oauth",
+  "probe_implementation": "stackos_connectors.connectors.quickbooks_online.probe:probe",
   "auth_methods": [
     {
       "key": "oauth2_authorization_code",
@@ -26,6 +27,7 @@
         "type": "object",
         "properties": {
           "environment": {
+            "type": "string",
             "enum": [
               "sandbox",
               "production"
@@ -43,6 +45,7 @@
         "additionalProperties": false
       },
       "setup": {
+        "label": "Connect with QuickBooks",
         "auth_type": "oauth",
         "interactive": true,
         "description": "Register an Intuit app, verify callback state and realmId, and supply its resolved accounting access token.",
@@ -60,6 +63,26 @@
             "type": "secret",
             "secret": true,
             "required": true
+          },
+          {
+            "key": "environment",
+            "label": "Environment",
+            "type": "select",
+            "secret": false,
+            "required": true,
+            "options": [
+              {"value": "sandbox", "label": "Sandbox"},
+              {"value": "production", "label": "Production"}
+            ],
+            "description": "Choose the intended QuickBooks environment explicitly; there is no default."
+          },
+          {
+            "key": "realm_id",
+            "label": "Company realm ID",
+            "type": "text",
+            "secret": false,
+            "required": true,
+            "description": "Numeric company realm ID, 1–32 digits. Bind it to the intended company and verify callback realmId before token exchange."
           }
         ]
       },
@@ -92,6 +115,7 @@
         "type": "object",
         "properties": {
           "environment": {
+            "type": "string",
             "enum": [
               "sandbox",
               "production"
@@ -109,6 +133,7 @@
         "additionalProperties": false
       },
       "setup": {
+        "label": "OAuth2 access token",
         "auth_type": "oauth",
         "interactive": false,
         "description": "Register an Intuit app, verify callback state and realmId, and supply its resolved accounting access token.",
@@ -119,6 +144,26 @@
             "type": "secret",
             "secret": true,
             "required": true
+          },
+          {
+            "key": "environment",
+            "label": "Environment",
+            "type": "select",
+            "secret": false,
+            "required": true,
+            "options": [
+              {"value": "sandbox", "label": "Sandbox"},
+              {"value": "production", "label": "Production"}
+            ],
+            "description": "Choose the intended QuickBooks environment explicitly; there is no default."
+          },
+          {
+            "key": "realm_id",
+            "label": "Company realm ID",
+            "type": "text",
+            "secret": false,
+            "required": true,
+            "description": "Numeric company realm ID, 1–32 digits. Supply the company realm bound to this access token."
           }
         ]
       },

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/src/stackos_connectors/connectors/quickbooks_online/docs/auth.md

@@ -10,4 +10,16 @@ The caller owns application secrets, state verification, callback handling, bind
 
 An omitted token response scope remains unknown; the requested accounting scope is not evidence of an actual grant. An omitted refresh token remains absent in `TokenResult`; the caller decides whether to retain a prior value. Unknown refresh outcomes require caller reconciliation, not automatic replay. `CompanyInfo.Id` is a separate entity identifier and need not equal callback `realmId`.
 
+Both method setup forms require an explicit environment and numeric company realm
+ID of 1–32 digits. Neither field has a default. The caller validates the intended
+realm against the OAuth callback before exchanging a code.
+
+`probe_credentials` reuses `quickbooks-online.company-info.get` with the resolved
+token and configured realm. It returns optional company display name and metadata
+containing provider-returned `company_id`, caller-configured `configured_realm_id`
+and `environment`. `provider_account_id` remains null because the returned entity
+ID is not realm attestation. No grants or scopes are inferred from a successful
+CompanyInfo read. Malformed responses and credential echoes fail through the same
+validator as the action; provider failures expose only safe status/reason facts.
+
 Primary protocol sources: [sandbox discovery](https://developer.intuit.com/.well-known/openid_sandbox_configuration/), [production discovery](https://developer.intuit.com/.well-known/openid_configuration/), [official Python OAuth client](https://github.com/intuit/oauth-pythonclient/blob/master/intuitlib/client.py), and [accounting scope](https://github.com/intuit/oauth-pythonclient/blob/master/intuitlib/enums.py). Local fixture verification does not establish live app consent or sandbox compatibility.

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/src/stackos_connectors/connectors/quickbooks_online/docs/quickbooks-online.md

@@ -19,6 +19,11 @@ A missing `Invoice` array in an otherwise empty `QueryResponse` means an empty p
 
 The consumer owns page traversal, cross-page duplicate detection, aggregate size/count bounds, empty-scan handling, overflow detection, persistence and publication. A short page can terminate a declared traversal, but offset pagination is not a transactionally isolated snapshot. The returned `realm_id` repeats request context, not independent provider attestation. Provider faults return fixed safe error codes and status, never raw response bodies, tokens or transport exception text.
 
+The explicit credential probe calls the existing CompanyInfo action and shares
+its validation, transport, retry bounds and redaction. It reports only safe company
+identity, keeps configured realm context distinct from `CompanyInfo.Id`, and does
+not establish OAuth scope grants. See [authentication](auth.md) for its result.
+
 Run local checks with `.venv/bin/python -B -m pytest tests/quickbooks_online tests/auth tests/catalog tests/packaging -p no:cacheprovider` and `.venv/bin/ruff check src/stackos_connectors/connectors/quickbooks_online tests/quickbooks_online`. The standalone installed-wheel driver in `tests/packaging/installed_auth_consumer.py` uses injected transports with live networking prohibited. Live Intuit consent/provider verification is a separate gate.
 
 References: [Invoice API](https://developer.intuit.com/app/developer/qbo/docs/api/accounting/most-commonly-used/invoice), [limits and throttling](https://static.developer.intuit.com/output_html/qbo/docs/learn/limits-and-throttles.html), [authentication](auth.md).

stackos_connectors-0.2.4/src/stackos_connectors/connectors/quickbooks_online/probe.py

@@ -0,0 +1,62 @@
+"""Company identity probe using the existing validated QuickBooks read action."""
+
+from typing import Any
+
+from stackos_connectors import CallOptions, ConnectorAuth, get_default_client
+from stackos_connectors.errors import ConnectorError, IntegrationDownError, RateLimitedError
+from stackos_connectors.probe import AuthMethodProbeContext
+
+_SAFE_ERROR_REASONS = frozenset(
+    {
+        "invalid_response",
+        "authentication_failed",
+        "permission_denied",
+        "rate_limited",
+        "provider_unavailable",
+        "provider_failure",
+        "network_error",
+    }
+)
+
+
+async def probe(
+    *, auth: ConnectorAuth, options: CallOptions, context: AuthMethodProbeContext
+) -> dict[str, Any]:
+    try:
+        result = await get_default_client().execute(
+            "quickbooks-online", "quickbooks-online.company-info.get", {}, auth, options
+        )
+    except ConnectorError as exc:
+        data: dict[str, Any] = {"stage": "test", "reason_code": "probe_error"}
+        reason = (
+            exc.provider_error.get("reason_code") if isinstance(exc.provider_error, dict) else None
+        )
+        if isinstance(reason, str) and reason in _SAFE_ERROR_REASONS:
+            data["reason_code"] = reason
+        status = exc.provider_status_code
+        if type(status) is int and 100 <= status <= 599:
+            data["status"] = status
+        error_type = RateLimitedError if status == 429 else IntegrationDownError
+        raise error_type("QuickBooks CompanyInfo probe failed.", data=data) from None
+
+    company = result.output_json
+    return {
+        "ok": True,
+        "vendor": "quickbooks-online",
+        "status": "ok",
+        "summary": "QuickBooks CompanyInfo read succeeded for the configured realm.",
+        "metadata": {
+            "evidence": {
+                "account": {
+                    # CompanyInfo.Id is an entity id, not the account's realm id.
+                    "provider_account_id": None,
+                    "display_name": company.get("company_name"),
+                    "metadata": {
+                        "company_id": company["company_id"],
+                        "configured_realm_id": company["realm_id"],
+                        "environment": auth.config["environment"],
+                    },
+                }
+            }
+        },
+    }

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/src/stackos_connectors/shared/google/service_account.py

@@ -19,6 +19,7 @@ JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer"
 GOOGLE_SERVICE_ACCOUNT_PROVIDERS = frozenset(
     {
         "google-search-console",
+        "google-indexing",
         "google-analytics",
         "google-tag-manager",
         "google-ads",

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/tests/auth/test_google_service_account.py

@@ -81,11 +81,12 @@ async def test_explicit_jwt_grant():
         "google-ads",
         "google-workspace",
         "google-search-console",
+        "google-indexing",
         "google-analytics",
         "google-tag-manager",
     ],
 )
-async def test_five_released_jwt_providers(provider):
+async def test_released_jwt_providers(provider):
     from urllib.parse import parse_qs
 
     from stackos_connectors.auth import get_auth_contract
@@ -107,12 +108,44 @@ async def test_five_released_jwt_providers(provider):
         )
 
     async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http:
-        await request_token(
+        result = await request_token(
             provider,
             auth=ConnectorAuth("service-account", {"service_account_json": value}),
             grant_type="jwt_bearer",
             http=http,
         )
+        assert not http.is_closed
+    assert result.access_token == "token"
+    assert result.token_type == "Bearer" and result.expires_in == 3600
+    assert result.scopes is None and not result.scopes_present
+
+
+@pytest.mark.parametrize(
+    "response,invalid_field",
+    [
+        ({"expires_in": 3600}, "token_type"),
+        ({"expires_in": 3600, "token_type": "Basic"}, "token_type"),
+        ({"token_type": "Bearer"}, "expires_in"),
+        ({"expires_in": 0, "token_type": "Bearer"}, "expires_in"),
+        ({"expires_in": 3600, "token_type": "Bearer", "scope": ""}, "scope"),
+    ],
+)
+async def test_google_indexing_rejects_invalid_token_response(response, invalid_field):
+    _, value = make_key()
+    async with httpx.AsyncClient(
+        transport=httpx.MockTransport(
+            lambda r: httpx.Response(200, json={"access_token": "token", **response})
+        )
+    ) as http:
+        with pytest.raises(OAuthTokenError) as caught:
+            await request_token(
+                "google-indexing",
+                auth=ConnectorAuth("service-account", {"service_account_json": value}),
+                grant_type="jwt_bearer",
+                http=http,
+            )
+    assert caught.value.provider_key == "google-indexing"
+    assert invalid_field in caught.value.invalid_fields
 
 
 @pytest.mark.parametrize(

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/tests/auth/test_oauth_contracts.py

@@ -65,7 +65,7 @@ def test_authorization_request_preserves_linear_protocol_and_hides_state():
     [
         ("missing", "oauth2_token"),
         ("pipedrive", "api_token"),
-        ("google-indexing", "service-account"),
+        ("google-indexing", "oauth2_authorization_code"),
         ("linear", "missing"),
     ],
 )
@@ -74,6 +74,34 @@ def test_unsupported_auth_does_not_gain_a_protocol(provider, method):
         get_auth_contract(provider, method=method)
 
 
+def test_google_indexing_contract_has_fixed_jwt_protocol():
+    from stackos_connectors.shared.google.service_account import (
+        GOOGLE_SERVICE_ACCOUNT_PROVIDERS,
+    )
+
+    contract = get_auth_contract(
+        "google-indexing",
+        method="service-account",
+        config={"token_endpoint": "https://untrusted.example/token", "scopes": ["invented"]},
+    )
+    assert "google-indexing" in GOOGLE_SERVICE_ACCOUNT_PROVIDERS
+    assert contract.flow == "jwt_bearer"
+    assert contract.token_endpoint == "https://oauth2.googleapis.com/token"
+    assert contract.scopes == ("https://www.googleapis.com/auth/indexing",)
+    assert contract.grant_types == ("jwt_bearer",)
+    assert contract.required_token_type == "Bearer"
+    assert contract.authorization_endpoint is None
+    assert contract.pkce_mode == "unavailable"
+    assert contract.authorization_params == ()
+    assert contract.delegated_subject is None
+    with pytest.raises(OAuthTokenError, match="only for Google Workspace"):
+        get_auth_contract(
+            "google-indexing",
+            method="service-account",
+            config={"delegated_subject": "user@example.com"},
+        )
+
+
 def test_dynamic_endpoints_and_delegation():
     assert (
         "/organizations/"

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/tests/auth/test_probes.py

@@ -372,7 +372,12 @@ def test_probe_bindings_are_fixed_and_metadata_discovery_does_not_probe(monkeypa
     monkeypatch.setattr("stackos_connectors.probe.probe_credentials", forbidden)
     description = get_default_client().describe("google-indexing")
     assert description["probe_implementation"].startswith("stackos_connectors.")
-    assert "auth_protocol" not in description
+    assert description["auth_protocol"]["flow"] == "jwt_bearer"
+    method = description["auth_methods"][0]
+    assert method["evidence_source"] == "oauth_response"
+    assert method["setup"]["auth_type"] == "oauth"
+    assert not method["setup"]["interactive"]
+    assert method["fields_schema"]["required"] == ["access_token"]
     # Every catalog-local binding is importable from the standalone wheel. Pure
     # config projection must neither construct a provider nor perform a probe.
     bound = {
@@ -380,5 +385,5 @@ def test_probe_bindings_are_fixed_and_metadata_discovery_does_not_probe(monkeypa
         for key, metadata in get_default_client().registry.connector_metadata.items()
         if metadata.get("probe_implementation")
     }
-    assert len(bound) == 37
+    assert len(bound) == 38
     assert all(project_probe_config(key, {}) == {} for key in bound)

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/tests/packaging/installed_auth_consumer.py

@@ -58,6 +58,12 @@ ACCESS = "driver-access-canary"
 
 async def quickbooks_reads(client):
     """Exercise the installed QBO action factory through the public API."""
+    description = client.describe("quickbooks-online")
+    assert len(description["actions"]) == 2
+    for method in description["auth_methods"]:
+        assert method["setup"]["label"]
+        setup_fields = {field["key"]: field for field in method["setup"]["fields"]}
+        assert setup_fields["environment"]["required"] and setup_fields["realm_id"]["required"]
     raw = '{ "Id":"7", "TxnDate":"2026-01-31", "TotalAmt":9007199254740993.0100, "Balance":-0.001 }'
     calls = []
 
@@ -110,8 +116,21 @@ async def quickbooks_reads(client):
         )
         assert page.output_json["invoices"] == [{"native_id": "7", "raw_json": raw}]
         assert page.output_json["count"] == 1
+        probe = await probe_credentials("quickbooks-online", auth=auth, options=options)
+        assert probe["ok"]
+        assert probe["metadata"]["evidence"] == {
+            "account": {
+                "provider_account_id": None,
+                "display_name": "Synthetic",
+                "metadata": {
+                    "company_id": "1",
+                    "configured_realm_id": "123456789",
+                    "environment": "sandbox",
+                },
+            }
+        }
         assert not http.is_closed
-    assert len(calls) == 2
+    assert len(calls) == 3
 
 
 async def main():
@@ -123,7 +142,7 @@ async def main():
         for key, metadata in client.registry.connector_metadata.items()
         if "auth_protocol" in metadata
     }
-    assert len(providers) == 16 and "google-indexing" not in providers
+    assert len(providers) == 17 and "google-indexing" in providers
     methods = 0
     for key, metadata in providers.items():
         assert root.joinpath("connectors", key.replace("-", "_"), "docs", "auth.md").is_file()
@@ -148,6 +167,8 @@ async def main():
 
     grant_calls = []
     for provider in providers:
+        if provider == "google-indexing":
+            continue  # Its only grant is exercised with a generated JSON key below.
         application_only = provider in {"reddit", "taboola"}
         grant = "client_credentials" if application_only else "authorization_code"
         method = "client_credentials" if application_only else "oauth2_authorization_code"
@@ -200,7 +221,6 @@ async def main():
         assert result.access_token == ACCESS and result.scopes_present
         assert ACCESS not in repr(result) and SECRET not in repr(auth)
     assert len(grant_calls) == 17  # Meta explicitly performs its second exchange.
-    await quickbooks_reads(client)
 
     async with httpx.AsyncClient(
         transport=httpx.MockTransport(
@@ -254,6 +274,30 @@ async def main():
             http=http,
         )
     assert signed.access_token == ACCESS and not signed.scopes_present
+
+    def indexing_jwt_edge(request):
+        assert str(request.url) == "https://oauth2.googleapis.com/token"
+        body = parse_qs(request.content.decode())
+        assert body["grant_type"] == ["urn:ietf:params:oauth:grant-type:jwt-bearer"]
+        encoded = body["assertion"][0].split(".")[1]
+        claims = json.loads(base64.urlsafe_b64decode(encoded + "=" * (-len(encoded) % 4)))
+        assert claims["scope"] == "https://www.googleapis.com/auth/indexing"
+        assert claims["aud"] == "https://oauth2.googleapis.com/token"
+        assert "sub" not in claims
+        return httpx.Response(
+            200, json={"access_token": ACCESS, "expires_in": 3600, "token_type": "Bearer"}
+        )
+
+    async with httpx.AsyncClient(transport=httpx.MockTransport(indexing_jwt_edge)) as http:
+        indexing = await request_token(
+            "google-indexing",
+            auth=ConnectorAuth("service-account", {"service_account_json": key_json}),
+            grant_type="jwt_bearer",
+            http=http,
+        )
+        assert not http.is_closed
+    assert indexing.access_token == ACCESS and not indexing.scopes_present
+    assert indexing.token_type == "Bearer" and indexing.expires_in == 3600
     try:
         await request_token(
             "taboola",
@@ -276,6 +320,7 @@ async def main():
 
     auth_api.request_token = implicit_grant
     oauth_protocol.request_token = implicit_grant
+    await quickbooks_reads(client)
     client.describe("google-workspace")
     config = project_probe_config(
         "wordpress", {"site_url": "https://fixture.test", "account_ref": "private"}
@@ -363,12 +408,14 @@ async def main():
                     "refresh",
                     "client_credentials",
                     "delegated_jwt",
+                    "indexing_jwt",
                     "probe",
                     "action",
                     "telegram",
                     "slack_v0",
                     "hubspot_v3",
                     "quickbooks_exact_reads",
+                    "quickbooks_company_probe",
                 ],
                 "network": "blocked; injected edges only",
                 "origins": origins,

{stackos_connectors-0.2.2 → stackos_connectors-0.2.4}/tests/packaging/test_grouped_layout.py

@@ -16,8 +16,8 @@ def test_auth_protocol_resources_have_integration_owners():
         for key, metadata in registry.connector_metadata.items()
         if "auth_protocol" in metadata
     }
-    assert len(protocols) == 16
-    assert "google-indexing" not in protocols
+    assert len(protocols) == 17
+    assert "google-indexing" in protocols
     for key, metadata in protocols.items():
         document = json.loads(
             root.joinpath("connectors", key.replace("-", "_"), "catalog.json").read_text()