ZacharyZhang-NY/AgentCompany
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Q88: a sign-in is saved only if a run can use and renew it

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
ZacharyZhang-NYandClaude Opus 5.5 committed 2026-10-08 15:02:12 -04:00
1 parent 4668396f25
commit 7eef3d459f
38 files changed
+127 -398
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/unit/provider-service.test.ts
+8 -79
View File
@@ -141,7 +141,7 @@ describe("provider service", () => {
let mode: "capable" | "text" | "down" = "capable";
const seen: string[] = [];
const capable: (input: ProviderToolTurnInput) => Promise<AgentTurnResult> = answeringModelCheck(async () => ({ text: "", toolCalls: [], rawResponseJson: "{}" }));
const providers = new ProviderService(connection.db, providerAdapters, testVault, undefined, async (input) => {
const providers = new ProviderService(connection.db, providerAdapters, testVault, async (input) => {
seen.push(`${input.credential.apiKey}:${input.model}`);
if (mode === "down") throw new Error("401 invalid x-api-key");
return mode === "text" ? { text: "I am healthy.", toolCalls: [], rawResponseJson: "{}" } : capable(input);
@@ -173,98 +173,27 @@ describe("provider service", () => {
connection.close();
});
test("audits provider sign-in launches with the employee actor", () => {
test("a sign-in provider saves only a native sign-in, recorded as coming from the OAuth login", () => {
const connection = createConnection();
const organization = new OrganizationService(connection.db);
const snapshot = new SnapshotService(connection.db);
let launched: { providerId: string; label: string; signInUrl: string; partition: string } | null = null;
const providers = new ProviderService(connection.db, providerAdapters, testVault, (input) => { launched = input; });
const providers = new ProviderService(connection.db, providerAdapters, testVault);
let orgId = "";
let employeeId = "";
let copilotProviderId = "";
const signIn = JSON.stringify({ access: "ghu_live_provider", refresh: "ghr_refresh", expires: 1_900_000_000_000 });
connection.transaction(() => {
orgId = createOrganization(organization);
employeeId = (connection.db.prepare("select id from employees where org_id = ?").get(orgId) as { id: string }).id;
copilotProviderId = providerId(connection, orgId, "github-copilot");
});
expect(() => providers.launchSignInWindow({
orgId,
providerId: copilotProviderId,
employeeId: "emp_missing",
})).toThrow("Provider sign-in employee was not found.");
connection.transaction(() => providers.launchSignInWindow({ orgId, providerId: copilotProviderId, employeeId }));
const state = snapshot.load();
expect(launched).toMatchObject({
providerId: copilotProviderId,
label: "GitHub Copilot",
signInUrl: "https://github.com/login/device",
partition: `persist:agentcompany-provider-${copilotProviderId}`,
});
expect(state.providerAuthSessions[0]).toMatchObject({
orgId,
providerId: copilotProviderId,
providerKey: "github-copilot",
employeeId,
partition: `persist:agentcompany-provider-${copilotProviderId}`,
completedAt: null,
});
expect(state.providerAuthSessions[0]?.state).toHaveLength(32);
expect(state.providerAuthSessions[0]?.nonce).toHaveLength(32);
expect(state.providerAuthSessions[0]?.codeVerifierSha256).toHaveLength(64);
expect(state.auditEvents).toContainEqual(expect.objectContaining({
entityType: "provider",
entityId: copilotProviderId,
actorType: "employee",
actorId: employeeId,
action: "sign_in_window_opened",
}));
connection.close();
});
test("binds OAuth credentials to a sign-in session source", () => {
const connection = createConnection();
const organization = new OrganizationService(connection.db);
const snapshot = new SnapshotService(connection.db);
const providers = new ProviderService(connection.db, providerAdapters, testVault, () => {});
let orgId = "";
let employeeId = "";
let copilotProviderId = "";
connection.transaction(() => {
orgId = createOrganization(organization);
employeeId = (connection.db.prepare("select id from employees where org_id = ?").get(orgId) as { id: string }).id;
copilotProviderId = providerId(connection, orgId, "github-copilot");
});
expect(() => connection.transaction(() => providers.saveCredential({
orgId,
providerId: copilotProviderId,
secret: "ghu_live_provider",
model: "claude-opus-4-5",
employeeId,
}))).toThrow("Provider sign-in session is required.");
connection.transaction(() => {
providers.launchSignInWindow({ orgId, providerId: copilotProviderId, employeeId });
providers.saveCredential({
orgId,
providerId: copilotProviderId,
secret: "ghu_live_provider",
model: "claude-opus-4-5",
employeeId,
});
});
expect(() => connection.transaction(() => providers.saveCredential({ orgId, providerId: copilotProviderId, secret: "ghu_live_provider", model: "claude-opus-4-5" })))
.toThrow("Sign in to GitHub Copilot; a pasted token cannot be renewed when it expires.");
connection.transaction(() => providers.saveCredential({ orgId, providerId: copilotProviderId, secret: signIn, model: "claude-opus-4-5" }));
const state = snapshot.load();
const profile = state.providerAuthProfiles.find((item) => item.providerId === copilotProviderId && item.active);
const session = state.providerAuthSessions.find((item) => item.providerId === copilotProviderId);
if (!profile || !session) throw new Error("Provider auth evidence was not created.");
expect(profile).toMatchObject({ sourceType: "provider_sign_in_session", sourceRef: session.id });
expect(session.completedAt).toBeTruthy();
expect(profile).toMatchObject({ sourceType: "provider_oauth_login", sourceRef: null });
expect(state.providers.find((item) => item.id === copilotProviderId)?.enabled).toBe(true);
connection.close();
});