|
| 1 | +/** @vitest-environment node */ |
| 2 | +import { beforeEach, describe, expect, it, vi } from 'vitest' |
| 3 | + |
| 4 | +const mocks = vi.hoisted(() => ({ authorize: vi.fn(), createClient: vi.fn(), prepare: vi.fn(), execute: vi.fn() })) |
| 5 | +vi.mock('@/lib/auth/credential-access', () => ({ authorizeCredentialUseForAuth: mocks.authorize })) |
| 6 | +vi.mock('@/lib/auth/hybrid', () => ({ AuthType: { INTERNAL_JWT: 'internal_jwt' } })) |
| 7 | +vi.mock('@/lib/internal/oci/client.server', () => ({ createOciClient: mocks.createClient })) |
| 8 | +vi.mock('@/lib/internal/oci-queue/endpoints', () => ({ prepareOciQueueClient: mocks.prepare })) |
| 9 | +vi.mock('@/lib/internal/oci-queue/operations', async (importOriginal) => ({ |
| 10 | + ...await importOriginal<typeof import('@/lib/internal/oci-queue/operations')>(), |
| 11 | + executeOciQueueOperation: mocks.execute, |
| 12 | +})) |
| 13 | + |
| 14 | +import { OciClientError } from '@/lib/internal/oci/errors' |
| 15 | +import { executeOciQueueTool } from '@/lib/internal/oci-queue/execute-tool' |
| 16 | +import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types' |
| 17 | + |
| 18 | +const call: InternalToolOperationCall = { |
| 19 | + toolId: 'oci_queue_get_messages', |
| 20 | + input: { oauthCredential: 'supplied-reference', queueId: 'queue', timeoutInSeconds: 0 }, |
| 21 | + headers: new Headers(), |
| 22 | + context: { userId: 'actor', workspaceId: 'workspace', workflowId: 'workflow' }, |
| 23 | + requestId: 'request', |
| 24 | +} |
| 25 | + |
| 26 | +describe('OCI Queue internal adapter', () => { |
| 27 | + beforeEach(() => { |
| 28 | + vi.clearAllMocks() |
| 29 | + mocks.authorize.mockResolvedValue({ ok: true, resolvedCredentialId: 'resolved-id', credentialType: 'service_account', workspaceId: 'workspace' }) |
| 30 | + mocks.createClient.mockResolvedValue('client') |
| 31 | + mocks.prepare.mockResolvedValue('prepared') |
| 32 | + mocks.execute.mockResolvedValue({ status: 200, messages: [] }) |
| 33 | + }) |
| 34 | + |
| 35 | + it('passes the authoritative credential and trusted workspace through normal authorization', async () => { |
| 36 | + const signal = new AbortController().signal |
| 37 | + const response = await executeOciQueueTool({ ...call, signal, input: { ...call.input as object, workspaceId: 'untrusted', accessToken: 'placeholder', endpoint: 'https://attacker.example', region: 'us-phoenix-1' } }) |
| 38 | + expect(response.status).toBe(200) |
| 39 | + expect(await response.json()).toEqual({ success: true, output: { status: 200, messages: [] } }) |
| 40 | + expect(mocks.authorize).toHaveBeenCalledWith( |
| 41 | + { success: true, userId: 'actor', authType: 'internal_jwt' }, |
| 42 | + { credentialId: 'supplied-reference', workspaceId: 'workspace', workflowId: 'workflow', callerUserId: 'actor' } |
| 43 | + ) |
| 44 | + expect(mocks.createClient).toHaveBeenCalledWith({ credentialId: 'resolved-id', workspaceId: 'workspace', serviceId: 'oci-queue', region: 'us-phoenix-1' }) |
| 45 | + expect(mocks.execute).toHaveBeenCalledWith({ operation: 'oci_queue_get_messages', oauthCredential: 'supplied-reference', queueId: 'queue', timeoutInSeconds: 0, region: 'us-phoenix-1' }, 'prepared', signal) |
| 46 | + }) |
| 47 | + |
| 48 | + it.each([ |
| 49 | + { ok: false }, |
| 50 | + { ok: true, credentialType: 'oauth', workspaceId: 'workspace', resolvedCredentialId: 'id' }, |
| 51 | + { ok: true, credentialType: 'service_account', workspaceId: 'other', resolvedCredentialId: 'id' }, |
| 52 | + { ok: true, credentialType: 'service_account', workspaceId: 'workspace' }, |
| 53 | + ])('rejects denied or mismatched authorization: %j', async (access) => { |
| 54 | + mocks.authorize.mockResolvedValue(access) |
| 55 | + expect((await executeOciQueueTool(call)).status).toBe(401) |
| 56 | + expect(mocks.createClient).not.toHaveBeenCalled() |
| 57 | + }) |
| 58 | + |
| 59 | + it('requires trusted actor and workspace context', async () => { |
| 60 | + expect((await executeOciQueueTool({ ...call, context: { workflowId: 'workflow' } })).status).toBe(401) |
| 61 | + expect(mocks.authorize).not.toHaveBeenCalled() |
| 62 | + }) |
| 63 | + |
| 64 | + it('validates the registered operation and input before credential work', async () => { |
| 65 | + expect((await executeOciQueueTool({ ...call, toolId: 'oci_queue_unknown' })).status).toBe(400) |
| 66 | + expect((await executeOciQueueTool({ ...call, input: { ...call.input as object, limit: 21 } })).status).toBe(400) |
| 67 | + expect(mocks.authorize).not.toHaveBeenCalled() |
| 68 | + }) |
| 69 | + |
| 70 | + it('does not let an input operation replace the dispatched tool', async () => { |
| 71 | + await executeOciQueueTool({ ...call, input: { ...call.input as object, operation: 'oci_queue_delete_queue' } }) |
| 72 | + expect(mocks.execute.mock.calls[0][0].operation).toBe('oci_queue_get_messages') |
| 73 | + }) |
| 74 | + |
| 75 | + it('preserves foundation request errors and request IDs without retrying', async () => { |
| 76 | + mocks.execute.mockRejectedValueOnce(new OciClientError('request_failed', { status: 429, opcRequestId: 'oracle-request' })) |
| 77 | + const response = await executeOciQueueTool(call) |
| 78 | + expect(response.status).toBe(429) |
| 79 | + expect(await response.json()).toMatchObject({ success: false, retryable: false, output: { status: 429, requestId: 'oracle-request' } }) |
| 80 | + expect(mocks.execute).toHaveBeenCalledTimes(1) |
| 81 | + }) |
| 82 | + |
| 83 | + it('keeps valid partial batches successful at the tool boundary', async () => { |
| 84 | + mocks.execute.mockResolvedValueOnce({ status: 200, allSucceeded: false, clientFailures: 1, serverFailures: 0, entries: [{ index: 0, success: false, errorCode: 400, errorMessage: 'Expired receipt' }] }) |
| 85 | + const response = await executeOciQueueTool({ ...call, toolId: 'oci_queue_delete_messages', input: { oauthCredential: 'credential', queueId: 'queue', entries: [{ receipt: 'receipt' }] } }) |
| 86 | + expect(response.status).toBe(200) |
| 87 | + expect(await response.json()).toMatchObject({ success: true, output: { allSucceeded: false } }) |
| 88 | + }) |
| 89 | + |
| 90 | + it('forwards cancellation without replacing it with a functional response', async () => { |
| 91 | + const controller = new AbortController() |
| 92 | + mocks.execute.mockImplementationOnce(async () => { controller.abort(); throw controller.signal.reason }) |
| 93 | + await expect(executeOciQueueTool({ ...call, signal: controller.signal })).rejects.toMatchObject({ name: 'AbortError' }) |
| 94 | + expect(mocks.execute).toHaveBeenCalledTimes(1) |
| 95 | + }) |
| 96 | +}) |
0 commit comments