637 lines
18 KiB
TypeScript
637 lines
18 KiB
TypeScript
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import {
|
|
type AuthProfileStore,
|
|
CLAUDE_CLI_PROFILE_ID,
|
|
CODEX_CLI_PROFILE_ID,
|
|
calculateAuthProfileCooldownMs,
|
|
ensureAuthProfileStore,
|
|
resolveAuthProfileOrder,
|
|
} from "./auth-profiles.js";
|
|
|
|
const HOME_ENV_KEYS = ["HOME", "USERPROFILE", "HOMEDRIVE", "HOMEPATH"] as const;
|
|
type HomeEnvSnapshot = Record<
|
|
(typeof HOME_ENV_KEYS)[number],
|
|
string | undefined
|
|
>;
|
|
|
|
const snapshotHomeEnv = (): HomeEnvSnapshot => ({
|
|
HOME: process.env.HOME,
|
|
USERPROFILE: process.env.USERPROFILE,
|
|
HOMEDRIVE: process.env.HOMEDRIVE,
|
|
HOMEPATH: process.env.HOMEPATH,
|
|
});
|
|
|
|
const restoreHomeEnv = (snapshot: HomeEnvSnapshot) => {
|
|
for (const key of HOME_ENV_KEYS) {
|
|
const value = snapshot[key];
|
|
if (value === undefined) {
|
|
delete process.env[key];
|
|
} else {
|
|
process.env[key] = value;
|
|
}
|
|
}
|
|
};
|
|
|
|
const setTempHome = (tempHome: string) => {
|
|
process.env.HOME = tempHome;
|
|
if (process.platform === "win32") {
|
|
process.env.USERPROFILE = tempHome;
|
|
const root = path.parse(tempHome).root;
|
|
process.env.HOMEDRIVE = root.replace(/\\$/, "");
|
|
process.env.HOMEPATH = tempHome.slice(root.length - 1);
|
|
}
|
|
};
|
|
|
|
describe("resolveAuthProfileOrder", () => {
|
|
const store: AuthProfileStore = {
|
|
version: 1,
|
|
profiles: {
|
|
"anthropic:default": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-default",
|
|
},
|
|
"anthropic:work": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-work",
|
|
},
|
|
},
|
|
};
|
|
const cfg = {
|
|
auth: {
|
|
profiles: {
|
|
"anthropic:default": { provider: "anthropic", mode: "api_key" },
|
|
"anthropic:work": { provider: "anthropic", mode: "api_key" },
|
|
},
|
|
},
|
|
};
|
|
|
|
it("uses stored profiles when no config exists", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
store,
|
|
provider: "anthropic",
|
|
});
|
|
expect(order).toEqual(["anthropic:default", "anthropic:work"]);
|
|
});
|
|
|
|
it("prioritizes preferred profiles", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
cfg,
|
|
store,
|
|
provider: "anthropic",
|
|
preferredProfile: "anthropic:work",
|
|
});
|
|
expect(order[0]).toBe("anthropic:work");
|
|
expect(order).toContain("anthropic:default");
|
|
});
|
|
|
|
it("does not prioritize lastGood over round-robin ordering", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
cfg,
|
|
store: {
|
|
...store,
|
|
lastGood: { anthropic: "anthropic:work" },
|
|
usageStats: {
|
|
"anthropic:default": { lastUsed: 100 },
|
|
"anthropic:work": { lastUsed: 200 },
|
|
},
|
|
},
|
|
provider: "anthropic",
|
|
});
|
|
expect(order[0]).toBe("anthropic:default");
|
|
});
|
|
|
|
it("uses explicit profiles when order is missing", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
cfg,
|
|
store,
|
|
provider: "anthropic",
|
|
});
|
|
expect(order).toEqual(["anthropic:default", "anthropic:work"]);
|
|
});
|
|
|
|
it("uses configured order when provided", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
cfg: {
|
|
auth: {
|
|
order: { anthropic: ["anthropic:work", "anthropic:default"] },
|
|
profiles: cfg.auth.profiles,
|
|
},
|
|
},
|
|
store,
|
|
provider: "anthropic",
|
|
});
|
|
expect(order).toEqual(["anthropic:work", "anthropic:default"]);
|
|
});
|
|
|
|
it("normalizes z.ai aliases in auth.order", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
cfg: {
|
|
auth: {
|
|
order: { "z.ai": ["zai:work", "zai:default"] },
|
|
profiles: {
|
|
"zai:default": { provider: "zai", mode: "api_key" },
|
|
"zai:work": { provider: "zai", mode: "api_key" },
|
|
},
|
|
},
|
|
},
|
|
store: {
|
|
version: 1,
|
|
profiles: {
|
|
"zai:default": {
|
|
type: "api_key",
|
|
provider: "zai",
|
|
key: "sk-default",
|
|
},
|
|
"zai:work": {
|
|
type: "api_key",
|
|
provider: "zai",
|
|
key: "sk-work",
|
|
},
|
|
},
|
|
},
|
|
provider: "zai",
|
|
});
|
|
expect(order).toEqual(["zai:work", "zai:default"]);
|
|
});
|
|
|
|
it("normalizes provider casing in auth.order keys", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
cfg: {
|
|
auth: {
|
|
order: { OpenAI: ["openai:work", "openai:default"] },
|
|
profiles: {
|
|
"openai:default": { provider: "openai", mode: "api_key" },
|
|
"openai:work": { provider: "openai", mode: "api_key" },
|
|
},
|
|
},
|
|
},
|
|
store: {
|
|
version: 1,
|
|
profiles: {
|
|
"openai:default": {
|
|
type: "api_key",
|
|
provider: "openai",
|
|
key: "sk-default",
|
|
},
|
|
"openai:work": {
|
|
type: "api_key",
|
|
provider: "openai",
|
|
key: "sk-work",
|
|
},
|
|
},
|
|
},
|
|
provider: "openai",
|
|
});
|
|
expect(order).toEqual(["openai:work", "openai:default"]);
|
|
});
|
|
|
|
it("normalizes z.ai aliases in auth.profiles", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
cfg: {
|
|
auth: {
|
|
profiles: {
|
|
"zai:default": { provider: "z.ai", mode: "api_key" },
|
|
"zai:work": { provider: "Z.AI", mode: "api_key" },
|
|
},
|
|
},
|
|
},
|
|
store: {
|
|
version: 1,
|
|
profiles: {
|
|
"zai:default": {
|
|
type: "api_key",
|
|
provider: "zai",
|
|
key: "sk-default",
|
|
},
|
|
"zai:work": {
|
|
type: "api_key",
|
|
provider: "zai",
|
|
key: "sk-work",
|
|
},
|
|
},
|
|
},
|
|
provider: "zai",
|
|
});
|
|
expect(order).toEqual(["zai:default", "zai:work"]);
|
|
});
|
|
|
|
it("prioritizes oauth profiles when order missing", () => {
|
|
const mixedStore: AuthProfileStore = {
|
|
version: 1,
|
|
profiles: {
|
|
"anthropic:default": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-default",
|
|
},
|
|
"anthropic:oauth": {
|
|
type: "oauth",
|
|
provider: "anthropic",
|
|
access: "access-token",
|
|
refresh: "refresh-token",
|
|
expires: Date.now() + 60_000,
|
|
},
|
|
},
|
|
};
|
|
const order = resolveAuthProfileOrder({
|
|
store: mixedStore,
|
|
provider: "anthropic",
|
|
});
|
|
expect(order).toEqual(["anthropic:oauth", "anthropic:default"]);
|
|
});
|
|
|
|
it("orders by lastUsed when no explicit order exists", () => {
|
|
const order = resolveAuthProfileOrder({
|
|
store: {
|
|
version: 1,
|
|
profiles: {
|
|
"anthropic:a": {
|
|
type: "oauth",
|
|
provider: "anthropic",
|
|
access: "access-token",
|
|
refresh: "refresh-token",
|
|
expires: Date.now() + 60_000,
|
|
},
|
|
"anthropic:b": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-b",
|
|
},
|
|
"anthropic:c": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-c",
|
|
},
|
|
},
|
|
usageStats: {
|
|
"anthropic:a": { lastUsed: 200 },
|
|
"anthropic:b": { lastUsed: 100 },
|
|
"anthropic:c": { lastUsed: 300 },
|
|
},
|
|
},
|
|
provider: "anthropic",
|
|
});
|
|
expect(order).toEqual(["anthropic:a", "anthropic:b", "anthropic:c"]);
|
|
});
|
|
|
|
it("pushes cooldown profiles to the end, ordered by cooldown expiry", () => {
|
|
const now = Date.now();
|
|
const order = resolveAuthProfileOrder({
|
|
store: {
|
|
version: 1,
|
|
profiles: {
|
|
"anthropic:ready": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-ready",
|
|
},
|
|
"anthropic:cool1": {
|
|
type: "oauth",
|
|
provider: "anthropic",
|
|
access: "access-token",
|
|
refresh: "refresh-token",
|
|
expires: now + 60_000,
|
|
},
|
|
"anthropic:cool2": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-cool",
|
|
},
|
|
},
|
|
usageStats: {
|
|
"anthropic:ready": { lastUsed: 50 },
|
|
"anthropic:cool1": { cooldownUntil: now + 5_000 },
|
|
"anthropic:cool2": { cooldownUntil: now + 1_000 },
|
|
},
|
|
},
|
|
provider: "anthropic",
|
|
});
|
|
expect(order).toEqual([
|
|
"anthropic:ready",
|
|
"anthropic:cool2",
|
|
"anthropic:cool1",
|
|
]);
|
|
});
|
|
});
|
|
|
|
describe("ensureAuthProfileStore", () => {
|
|
it("migrates legacy auth.json and deletes it (PR #368)", () => {
|
|
const agentDir = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "clawdbot-auth-profiles-"),
|
|
);
|
|
try {
|
|
const legacyPath = path.join(agentDir, "auth.json");
|
|
fs.writeFileSync(
|
|
legacyPath,
|
|
`${JSON.stringify(
|
|
{
|
|
anthropic: {
|
|
type: "oauth",
|
|
provider: "anthropic",
|
|
access: "access-token",
|
|
refresh: "refresh-token",
|
|
expires: Date.now() + 60_000,
|
|
},
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
"utf8",
|
|
);
|
|
|
|
const store = ensureAuthProfileStore(agentDir);
|
|
expect(store.profiles["anthropic:default"]).toMatchObject({
|
|
type: "oauth",
|
|
provider: "anthropic",
|
|
});
|
|
|
|
const migratedPath = path.join(agentDir, "auth-profiles.json");
|
|
expect(fs.existsSync(migratedPath)).toBe(true);
|
|
expect(fs.existsSync(legacyPath)).toBe(false);
|
|
|
|
// idempotent
|
|
const store2 = ensureAuthProfileStore(agentDir);
|
|
expect(store2.profiles["anthropic:default"]).toBeDefined();
|
|
expect(fs.existsSync(legacyPath)).toBe(false);
|
|
} finally {
|
|
fs.rmSync(agentDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("auth profile cooldowns", () => {
|
|
it("applies exponential backoff with a 1h cap", () => {
|
|
expect(calculateAuthProfileCooldownMs(1)).toBe(60_000);
|
|
expect(calculateAuthProfileCooldownMs(2)).toBe(5 * 60_000);
|
|
expect(calculateAuthProfileCooldownMs(3)).toBe(25 * 60_000);
|
|
expect(calculateAuthProfileCooldownMs(4)).toBe(60 * 60_000);
|
|
expect(calculateAuthProfileCooldownMs(5)).toBe(60 * 60_000);
|
|
});
|
|
});
|
|
|
|
describe("external CLI credential sync", () => {
|
|
it("syncs Claude CLI credentials into anthropic:claude-cli", () => {
|
|
const agentDir = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "clawdbot-cli-sync-"),
|
|
);
|
|
const originalHome = snapshotHomeEnv();
|
|
|
|
try {
|
|
// Create a temp home with Claude CLI credentials
|
|
const tempHome = fs.mkdtempSync(path.join(os.tmpdir(), "clawdbot-home-"));
|
|
setTempHome(tempHome);
|
|
|
|
// Create Claude CLI credentials
|
|
const claudeDir = path.join(tempHome, ".claude");
|
|
fs.mkdirSync(claudeDir, { recursive: true });
|
|
const claudeCreds = {
|
|
claudeAiOauth: {
|
|
accessToken: "fresh-access-token",
|
|
refreshToken: "fresh-refresh-token",
|
|
expiresAt: Date.now() + 60 * 60 * 1000, // 1 hour from now
|
|
},
|
|
};
|
|
fs.writeFileSync(
|
|
path.join(claudeDir, ".credentials.json"),
|
|
JSON.stringify(claudeCreds),
|
|
);
|
|
|
|
// Create empty auth-profiles.json
|
|
const authPath = path.join(agentDir, "auth-profiles.json");
|
|
fs.writeFileSync(
|
|
authPath,
|
|
JSON.stringify({
|
|
version: 1,
|
|
profiles: {
|
|
"anthropic:default": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-default",
|
|
},
|
|
},
|
|
}),
|
|
);
|
|
|
|
// Load the store - should sync from CLI
|
|
const store = ensureAuthProfileStore(agentDir);
|
|
|
|
expect(store.profiles["anthropic:default"]).toBeDefined();
|
|
expect((store.profiles["anthropic:default"] as { key: string }).key).toBe(
|
|
"sk-default",
|
|
);
|
|
expect(store.profiles[CLAUDE_CLI_PROFILE_ID]).toBeDefined();
|
|
expect(
|
|
(store.profiles[CLAUDE_CLI_PROFILE_ID] as { token: string }).token,
|
|
).toBe("fresh-access-token");
|
|
expect(
|
|
(store.profiles[CLAUDE_CLI_PROFILE_ID] as { expires: number }).expires,
|
|
).toBeGreaterThan(Date.now());
|
|
} finally {
|
|
restoreHomeEnv(originalHome);
|
|
fs.rmSync(agentDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("syncs Codex CLI credentials into openai-codex:codex-cli", () => {
|
|
const agentDir = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "clawdbot-codex-sync-"),
|
|
);
|
|
const originalHome = snapshotHomeEnv();
|
|
|
|
try {
|
|
const tempHome = fs.mkdtempSync(path.join(os.tmpdir(), "clawdbot-home-"));
|
|
setTempHome(tempHome);
|
|
|
|
// Create Codex CLI credentials
|
|
const codexDir = path.join(tempHome, ".codex");
|
|
fs.mkdirSync(codexDir, { recursive: true });
|
|
const codexCreds = {
|
|
tokens: {
|
|
access_token: "codex-access-token",
|
|
refresh_token: "codex-refresh-token",
|
|
},
|
|
};
|
|
const codexAuthPath = path.join(codexDir, "auth.json");
|
|
fs.writeFileSync(codexAuthPath, JSON.stringify(codexCreds));
|
|
|
|
// Create empty auth-profiles.json
|
|
const authPath = path.join(agentDir, "auth-profiles.json");
|
|
fs.writeFileSync(
|
|
authPath,
|
|
JSON.stringify({
|
|
version: 1,
|
|
profiles: {},
|
|
}),
|
|
);
|
|
|
|
const store = ensureAuthProfileStore(agentDir);
|
|
|
|
expect(store.profiles[CODEX_CLI_PROFILE_ID]).toBeDefined();
|
|
expect(
|
|
(store.profiles[CODEX_CLI_PROFILE_ID] as { access: string }).access,
|
|
).toBe("codex-access-token");
|
|
} finally {
|
|
restoreHomeEnv(originalHome);
|
|
fs.rmSync(agentDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("does not overwrite API keys when syncing external CLI creds", () => {
|
|
const agentDir = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "clawdbot-no-overwrite-"),
|
|
);
|
|
const originalHome = snapshotHomeEnv();
|
|
|
|
try {
|
|
const tempHome = fs.mkdtempSync(path.join(os.tmpdir(), "clawdbot-home-"));
|
|
setTempHome(tempHome);
|
|
|
|
// Create Claude CLI credentials
|
|
const claudeDir = path.join(tempHome, ".claude");
|
|
fs.mkdirSync(claudeDir, { recursive: true });
|
|
const claudeCreds = {
|
|
claudeAiOauth: {
|
|
accessToken: "cli-access",
|
|
refreshToken: "cli-refresh",
|
|
expiresAt: Date.now() + 30 * 60 * 1000,
|
|
},
|
|
};
|
|
fs.writeFileSync(
|
|
path.join(claudeDir, ".credentials.json"),
|
|
JSON.stringify(claudeCreds),
|
|
);
|
|
|
|
// Create auth-profiles.json with an API key
|
|
const authPath = path.join(agentDir, "auth-profiles.json");
|
|
fs.writeFileSync(
|
|
authPath,
|
|
JSON.stringify({
|
|
version: 1,
|
|
profiles: {
|
|
"anthropic:default": {
|
|
type: "api_key",
|
|
provider: "anthropic",
|
|
key: "sk-store",
|
|
},
|
|
},
|
|
}),
|
|
);
|
|
|
|
const store = ensureAuthProfileStore(agentDir);
|
|
|
|
// Should keep the store's API key and still add the CLI profile.
|
|
expect((store.profiles["anthropic:default"] as { key: string }).key).toBe(
|
|
"sk-store",
|
|
);
|
|
expect(store.profiles[CLAUDE_CLI_PROFILE_ID]).toBeDefined();
|
|
} finally {
|
|
restoreHomeEnv(originalHome);
|
|
fs.rmSync(agentDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("does not overwrite fresher store token with older Claude CLI credentials", () => {
|
|
const agentDir = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "clawdbot-cli-no-downgrade-"),
|
|
);
|
|
const originalHome = snapshotHomeEnv();
|
|
|
|
try {
|
|
const tempHome = fs.mkdtempSync(path.join(os.tmpdir(), "clawdbot-home-"));
|
|
setTempHome(tempHome);
|
|
|
|
const claudeDir = path.join(tempHome, ".claude");
|
|
fs.mkdirSync(claudeDir, { recursive: true });
|
|
fs.writeFileSync(
|
|
path.join(claudeDir, ".credentials.json"),
|
|
JSON.stringify({
|
|
claudeAiOauth: {
|
|
accessToken: "cli-access",
|
|
refreshToken: "cli-refresh",
|
|
expiresAt: Date.now() + 30 * 60 * 1000,
|
|
},
|
|
}),
|
|
);
|
|
|
|
const authPath = path.join(agentDir, "auth-profiles.json");
|
|
fs.writeFileSync(
|
|
authPath,
|
|
JSON.stringify({
|
|
version: 1,
|
|
profiles: {
|
|
[CLAUDE_CLI_PROFILE_ID]: {
|
|
type: "token",
|
|
provider: "anthropic",
|
|
token: "store-access",
|
|
expires: Date.now() + 60 * 60 * 1000,
|
|
},
|
|
},
|
|
}),
|
|
);
|
|
|
|
const store = ensureAuthProfileStore(agentDir);
|
|
expect(
|
|
(store.profiles[CLAUDE_CLI_PROFILE_ID] as { token: string }).token,
|
|
).toBe("store-access");
|
|
} finally {
|
|
restoreHomeEnv(originalHome);
|
|
fs.rmSync(agentDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("updates codex-cli profile when Codex CLI refresh token changes", () => {
|
|
const agentDir = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "clawdbot-codex-refresh-sync-"),
|
|
);
|
|
const originalHome = snapshotHomeEnv();
|
|
|
|
try {
|
|
const tempHome = fs.mkdtempSync(path.join(os.tmpdir(), "clawdbot-home-"));
|
|
setTempHome(tempHome);
|
|
|
|
const codexDir = path.join(tempHome, ".codex");
|
|
fs.mkdirSync(codexDir, { recursive: true });
|
|
const codexAuthPath = path.join(codexDir, "auth.json");
|
|
fs.writeFileSync(
|
|
codexAuthPath,
|
|
JSON.stringify({
|
|
tokens: { access_token: "same-access", refresh_token: "new-refresh" },
|
|
}),
|
|
);
|
|
fs.utimesSync(codexAuthPath, new Date(), new Date());
|
|
|
|
const authPath = path.join(agentDir, "auth-profiles.json");
|
|
fs.writeFileSync(
|
|
authPath,
|
|
JSON.stringify({
|
|
version: 1,
|
|
profiles: {
|
|
[CODEX_CLI_PROFILE_ID]: {
|
|
type: "oauth",
|
|
provider: "openai-codex",
|
|
access: "same-access",
|
|
refresh: "old-refresh",
|
|
expires: Date.now() - 1000,
|
|
},
|
|
},
|
|
}),
|
|
);
|
|
|
|
const store = ensureAuthProfileStore(agentDir);
|
|
expect(
|
|
(store.profiles[CODEX_CLI_PROFILE_ID] as { refresh: string }).refresh,
|
|
).toBe("new-refresh");
|
|
} finally {
|
|
restoreHomeEnv(originalHome);
|
|
fs.rmSync(agentDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|