|
| 1 | +import { db } from '@sim/db' |
| 2 | +import { |
| 3 | + account, |
| 4 | + credential, |
| 5 | + credentialGroup, |
| 6 | + credentialGroupEnrollment, |
| 7 | + member, |
| 8 | + organization, |
| 9 | + user, |
| 10 | + workspace, |
| 11 | +} from '@sim/db/schema' |
| 12 | +import { createSessionPrincipal } from '@sim/testing/factories/principal.factory' |
| 13 | +import { generateId } from '@sim/utils/id' |
| 14 | +import { eq, inArray, or } from 'drizzle-orm' |
| 15 | +import { afterEach, beforeEach, describe, expect, it } from 'vitest' |
| 16 | +import { env } from '@/lib/core/config/env' |
| 17 | +import { ensureWorkspaceAccountsGroup } from '@/lib/credential-groups/service' |
| 18 | +import { listOrganizationOAuthCredentials } from '@/lib/credentials/application/organization-credentials' |
| 19 | +import { provisionKnowledgeConnectorMembersBinding } from '@/lib/knowledge/connectors/member-provisioning' |
| 20 | +import { onedriveConnectorMeta } from '@/connectors/onedrive/meta' |
| 21 | + |
| 22 | +/** Real storage and authorization; CI writes the shared INTEGRATION_REPORT_PATH JSON artifact. */ |
| 23 | +describe('personal Microsoft sources', () => { |
| 24 | + let ownerId: string |
| 25 | + let otherId: string |
| 26 | + let organizationId: string |
| 27 | + let foreignOrganizationId: string |
| 28 | + let workspaceId: string |
| 29 | + |
| 30 | + beforeEach(async () => { |
| 31 | + Object.assign(env, { |
| 32 | + MICROSOFT_CLIENT_ID: 'existing-client', |
| 33 | + MICROSOFT_CLIENT_SECRET: 'existing-client-secret', |
| 34 | + MICROSOFT_PERSONAL_CLIENT_ID: 'personal-client', |
| 35 | + MICROSOFT_PERSONAL_CLIENT_SECRET: 'personal-client-secret', |
| 36 | + }) |
| 37 | + ownerId = generateId() |
| 38 | + otherId = generateId() |
| 39 | + organizationId = generateId() |
| 40 | + foreignOrganizationId = generateId() |
| 41 | + workspaceId = generateId() |
| 42 | + await db.insert(user).values( |
| 43 | + [ownerId, otherId].map((id) => ({ |
| 44 | + id, |
| 45 | + name: 'OAuth fixture', |
| 46 | + email: `${id}@fixture.test`, |
| 47 | + emailVerified: true, |
| 48 | + createdAt: new Date(), |
| 49 | + updatedAt: new Date(), |
| 50 | + })) |
| 51 | + ) |
| 52 | + await db.insert(organization).values( |
| 53 | + [organizationId, foreignOrganizationId].map((id) => ({ |
| 54 | + id, |
| 55 | + name: 'OAuth fixture organization', |
| 56 | + slug: id, |
| 57 | + })) |
| 58 | + ) |
| 59 | + await db.insert(member).values({ |
| 60 | + id: generateId(), |
| 61 | + organizationId, |
| 62 | + userId: ownerId, |
| 63 | + role: 'owner', |
| 64 | + }) |
| 65 | + await db.insert(workspace).values({ |
| 66 | + id: workspaceId, |
| 67 | + name: 'OAuth fixture workspace', |
| 68 | + organizationId, |
| 69 | + ownerId, |
| 70 | + billedAccountUserId: ownerId, |
| 71 | + }) |
| 72 | + }) |
| 73 | + |
| 74 | + afterEach(async () => { |
| 75 | + await db |
| 76 | + .delete(credentialGroup) |
| 77 | + .where( |
| 78 | + or( |
| 79 | + eq(credentialGroup.workspaceId, workspaceId), |
| 80 | + inArray(credentialGroup.organizationId, [organizationId, foreignOrganizationId]) |
| 81 | + ) |
| 82 | + ) |
| 83 | + await db.delete(workspace).where(eq(workspace.id, workspaceId)) |
| 84 | + await db |
| 85 | + .delete(organization) |
| 86 | + .where(inArray(organization.id, [organizationId, foreignOrganizationId])) |
| 87 | + await db.delete(user).where(inArray(user.id, [ownerId, otherId])) |
| 88 | + }) |
| 89 | + |
| 90 | + const provision = () => |
| 91 | + provisionKnowledgeConnectorMembersBinding({ |
| 92 | + workspaceId, |
| 93 | + userId: ownerId, |
| 94 | + connectorMeta: onedriveConnectorMeta, |
| 95 | + }) |
| 96 | + |
| 97 | + it.each([false, true])( |
| 98 | + 'keeps the existing personal source binding when the work app is configured: %s', |
| 99 | + async (workAppConfigured) => { |
| 100 | + const group = await ensureWorkspaceAccountsGroup(workspaceId, ownerId, { |
| 101 | + provider: 'onedrive-personal', |
| 102 | + label: 'OneDrive', |
| 103 | + required: false, |
| 104 | + }) |
| 105 | + if (!workAppConfigured) { |
| 106 | + Object.assign(env, { MICROSOFT_CLIENT_ID: undefined, MICROSOFT_CLIENT_SECRET: undefined }) |
| 107 | + } |
| 108 | + expect(await provision()).toEqual({ |
| 109 | + credentialGroupId: group.id, |
| 110 | + credentialGroupOptionId: group.options[0].id, |
| 111 | + }) |
| 112 | + const [stored] = await db |
| 113 | + .select() |
| 114 | + .from(credentialGroup) |
| 115 | + .where(eq(credentialGroup.id, group.id)) |
| 116 | + expect(stored.options.map((option) => option.provider)).toEqual(['onedrive-personal']) |
| 117 | + } |
| 118 | + ) |
| 119 | + |
| 120 | + it('provisions the personal provider when only that app is configured', async () => { |
| 121 | + Object.assign(env, { MICROSOFT_CLIENT_ID: undefined, MICROSOFT_CLIENT_SECRET: undefined }) |
| 122 | + const binding = await provision() |
| 123 | + const [stored] = await db |
| 124 | + .select() |
| 125 | + .from(credentialGroup) |
| 126 | + .where(eq(credentialGroup.id, binding.credentialGroupId)) |
| 127 | + expect(stored.options).toHaveLength(1) |
| 128 | + expect(stored.options[0]).toMatchObject({ |
| 129 | + id: binding.credentialGroupOptionId, |
| 130 | + provider: 'onedrive-personal', |
| 131 | + }) |
| 132 | + }) |
| 133 | + |
| 134 | + it('refuses to guess between two active account types', async () => { |
| 135 | + await ensureWorkspaceAccountsGroup(workspaceId, ownerId, { |
| 136 | + provider: 'onedrive-personal', |
| 137 | + label: 'Personal OneDrive', |
| 138 | + required: false, |
| 139 | + }) |
| 140 | + await ensureWorkspaceAccountsGroup(workspaceId, ownerId, { |
| 141 | + provider: 'onedrive', |
| 142 | + label: 'Work OneDrive', |
| 143 | + required: false, |
| 144 | + }) |
| 145 | + await expect(provision()).rejects.toThrow('member sign-in') |
| 146 | + }) |
| 147 | + |
| 148 | + async function addOAuth(providerId: string, createdBy = ownerId, orgId = organizationId) { |
| 149 | + const accountId = generateId() |
| 150 | + const credentialId = generateId() |
| 151 | + await db.insert(account).values({ |
| 152 | + id: accountId, |
| 153 | + accountId, |
| 154 | + providerId, |
| 155 | + userId: createdBy, |
| 156 | + scope: 'openid Files.Read', |
| 157 | + createdAt: new Date(), |
| 158 | + updatedAt: new Date(), |
| 159 | + }) |
| 160 | + await db.insert(credential).values({ |
| 161 | + id: credentialId, |
| 162 | + organizationId: orgId, |
| 163 | + accountId, |
| 164 | + type: 'oauth', |
| 165 | + displayName: 'Fixture connection', |
| 166 | + providerId, |
| 167 | + createdBy, |
| 168 | + }) |
| 169 | + return credentialId |
| 170 | + } |
| 171 | + |
| 172 | + const list = (providerId: string, purpose?: 'browsing') => |
| 173 | + listOrganizationOAuthCredentials.execute({ |
| 174 | + principal: createSessionPrincipal({ userId: ownerId }), |
| 175 | + input: { organizationId, providerId, purpose }, |
| 176 | + }) |
| 177 | + |
| 178 | + it('lists compatible personal grants without crossing user, organization or service boundaries', async () => { |
| 179 | + const workId = await addOAuth('onedrive') |
| 180 | + const personalId = await addOAuth('onedrive-personal') |
| 181 | + await addOAuth('onedrive-personal', otherId) |
| 182 | + await addOAuth('onedrive-personal', ownerId, foreignOrganizationId) |
| 183 | + await addOAuth('outlook-personal') |
| 184 | + expect((await list('onedrive')).credentials.map(({ id }) => id).sort()).toEqual( |
| 185 | + [workId, personalId].sort() |
| 186 | + ) |
| 187 | + expect((await list('onedrive-personal')).credentials.map(({ id }) => id)).toEqual([personalId]) |
| 188 | + }) |
| 189 | + |
| 190 | + it('includes the caller’s live personal enrollment for browsing, without allowing indexing', async () => { |
| 191 | + const group = await ensureWorkspaceAccountsGroup( |
| 192 | + { kind: 'organization', organizationId }, |
| 193 | + ownerId, |
| 194 | + { provider: 'onedrive-personal', label: 'Personal OneDrive', required: false } |
| 195 | + ) |
| 196 | + const [stored] = await db.select().from(credentialGroup).where(eq(credentialGroup.id, group.id)) |
| 197 | + const option = stored.options[0] |
| 198 | + const enrollmentId = generateId() |
| 199 | + const credentialId = generateId() |
| 200 | + await db.insert(credentialGroupEnrollment).values({ |
| 201 | + id: enrollmentId, |
| 202 | + credentialGroupId: group.id, |
| 203 | + email: `${ownerId}@fixture.test`, |
| 204 | + userId: ownerId, |
| 205 | + status: 'completed', |
| 206 | + invitationTokenHash: 'a'.repeat(64), |
| 207 | + invitationExpiresAt: new Date(Date.now() + 60_000), |
| 208 | + invitedAt: new Date(), |
| 209 | + }) |
| 210 | + await db.insert(credential).values({ |
| 211 | + id: credentialId, |
| 212 | + organizationId, |
| 213 | + type: 'managed_oauth', |
| 214 | + displayName: 'Personal OneDrive', |
| 215 | + providerId: 'onedrive-personal', |
| 216 | + createdBy: ownerId, |
| 217 | + credentialGroupEnrollmentId: enrollmentId, |
| 218 | + credentialGroupOptionId: option.id, |
| 219 | + authorizationAppId: option.authorizationAppId, |
| 220 | + managedOauthScopeVersion: option.scopeVersion, |
| 221 | + providerSubjectId: 'fixture-subject', |
| 222 | + managedOauthStatus: 'active', |
| 223 | + grantedScopes: option.requiredScopes, |
| 224 | + encryptedOauthTokenSet: 'not-read-by-credential-lists', |
| 225 | + grantedAt: new Date(), |
| 226 | + }) |
| 227 | + expect((await list('onedrive', 'browsing')).credentials.map(({ id }) => id)).toEqual([ |
| 228 | + credentialId, |
| 229 | + ]) |
| 230 | + expect((await list('onedrive')).credentials).toEqual([]) |
| 231 | + await db |
| 232 | + .update(credentialGroupEnrollment) |
| 233 | + .set({ status: 'revoked' }) |
| 234 | + .where(eq(credentialGroupEnrollment.id, enrollmentId)) |
| 235 | + expect((await list('onedrive', 'browsing')).credentials).toEqual([]) |
| 236 | + }) |
| 237 | +}) |
0 commit comments