mirror of
https://github.com/hanzoai/extension.git
synced 2026-10-31 21:57:06 +00:00
zeekay
c1c72dea64
iam.hanzo.ai serves only the IAM web app, so every token exchange, refresh and userinfo aimed there got HTML back. @hanzo/auth took its API host from @hanzo/iam's BRAND_SERVER_URLS.hanzo, which in 0.21.17 still names that host; it now states the gateway, api.hanzo.ai, and keeps taking the paths from @hanzo/iam. office and outlook ride on it. vscode's standalone auth, cli-tools' HanzoAuth and the mcp server default to the gateway too. The mcp iam tool called IAM's verb paths, which answer 410 (get-users, update-role, ...) or 404 (get-tokens, get-sessions, ...). It now uses the resources: GET and POST on /v1/iam/<kind>, GET, PUT and DELETE on /v1/iam/<kind>/<owner>/<name>. update_user nests the row under "user". update_org writes /organizations/profile, since a PUT of the masked row a read returns would store the mask. delete_session takes the full owner/name/application key the session is filed under. dxt's server.js is rebuilt from mcp. The Office manifests drop the iam.hanzo.ai AppDomain. Claude-Session: https://claude.ai/code/session_01Dc8DXc3fEQCRHUa6XWK4Ku
43 lines
2.0 KiB
TypeScript
43 lines
2.0 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { authorizeURL, tokenURL, userinfoURL, CLIENTS } from '../src/config';
|
|
import { authClientFor } from '../src/index';
|
|
|
|
describe('canonical HIP-0111 endpoints — the drift guard', () => {
|
|
it('authorize/token/userinfo ALL carry the /v1/iam prefix', () => {
|
|
// This is the exact bug that shipped in vscode: hanzo.id/oauth/authorize,
|
|
// missing /v1/iam. Pin every path so it can never regress.
|
|
expect(authorizeURL()).toBe('https://hanzo.id/v1/iam/oauth/authorize');
|
|
expect(tokenURL()).toBe('https://api.hanzo.ai/v1/iam/oauth/token');
|
|
expect(userinfoURL()).toBe('https://api.hanzo.ai/v1/iam/oauth/userinfo');
|
|
// The prefix used to be asserted a second time as a bare IAM_API_PATH
|
|
// constant. That constant is gone — the paths come from @hanzo/iam now, so
|
|
// there is nothing local left to drift, and these three URLs already pin
|
|
// the prefix they are actually built from.
|
|
});
|
|
|
|
it('a custom issuer keeps the /v1/iam prefix', () => {
|
|
expect(authorizeURL('https://id.acme.test')).toBe('https://id.acme.test/v1/iam/oauth/authorize');
|
|
expect(tokenURL('https://iam.acme.test/')).toBe('https://iam.acme.test/v1/iam/oauth/token');
|
|
});
|
|
});
|
|
|
|
describe('surface client registry — one client per surface', () => {
|
|
it('every surface has a distinct hanzo-<surface> id', () => {
|
|
expect(CLIENTS.browser.id).toBe('hanzo-browser');
|
|
expect(CLIENTS.office.id).toBe('hanzo-office');
|
|
expect(CLIENTS.vscode.id).toBe('hanzo-vscode');
|
|
expect(CLIENTS.cli.id).toBe('hanzo-cli');
|
|
const ids = Object.values(CLIENTS).map((c) => c.id);
|
|
expect(new Set(ids).size).toBe(ids.length);
|
|
});
|
|
|
|
it('authClientFor resolves id + redirect and honors overrides', () => {
|
|
const c = authClientFor('office');
|
|
expect(c.clientId).toBe('hanzo-office');
|
|
expect(c.redirectUri).toBe('https://office.hanzo.ai/auth-callback.html');
|
|
expect(authClientFor('office', { redirectUri: 'https://localhost:3000/cb' }).redirectUri).toBe(
|
|
'https://localhost:3000/cb',
|
|
);
|
|
});
|
|
});
|