mirror of
https://github.com/hanzoai/extension.git
synced 2026-10-31 19:52:25 +00:00
zooqueenandHanzo Dev
f717dd89ad
28 apps told the user to paste an `hk-` key — input placeholders, settings help text, READMEs, the error thrown when the field is empty — and five of them validated that paste against /^hk-/ before sending it as a bearer. Nothing mints that prefix any more: cloud accepts pk- and sk-, IAM mints sk-. So the guard admitted a credential that authenticates nothing, and the panel failed later at the gateway with nothing on screen to explain it. The three leak detectors keep hk- and gain sk-. Salesforce's source scan and the two Zendesk tests exist to catch a key committed to source or echoed back through a request; retired keys are still in circulation and leak exactly as badly, while a detector that only knew hk- would have gone blind to every key minted from here on. `sk-` used to be the example of the foreign key the guard screened out — an OpenAI key. It cannot mean that now, and shape alone cannot tell one vendor's sk- from another's, so those comments say what the check really proves and point at the /v1/models call that proves the rest. The three tests that pinned "sk- is rejected" now pin "hk- is rejected", which is the invariant that survived. Verified: 2029 tests pass across the 28 packages; typecheck clean on 25 of them (hubspot, jupyter and teams fail identically at HEAD on JSX and ESM type conflicts in files this does not touch); salesforce validate-source green. Co-authored-by: Hanzo Dev <[email protected]>
89 lines
3.2 KiB
TypeScript
89 lines
3.2 KiB
TypeScript
import { describe, it, expect, afterEach } from 'vitest';
|
|
import { promises as fs } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import {
|
|
resolveBearer,
|
|
installKey,
|
|
installKeyFromInstallation,
|
|
HanzoFileInstallationStore,
|
|
} from '../src/install.js';
|
|
import type { Installation } from '@slack/bolt';
|
|
|
|
describe('resolveBearer', () => {
|
|
it('prefers the workspace token over the app default', () => {
|
|
expect(resolveBearer({ token: 'sk-ws' }, 'sk-default')).toBe('sk-ws');
|
|
});
|
|
|
|
it('falls back to the app default when no workspace token', () => {
|
|
expect(resolveBearer(undefined, 'sk-default')).toBe('sk-default');
|
|
expect(resolveBearer({ token: ' ' }, 'sk-default')).toBe('sk-default');
|
|
});
|
|
|
|
it('returns empty (anonymous) when neither is set', () => {
|
|
expect(resolveBearer(undefined, '')).toBe('');
|
|
});
|
|
});
|
|
|
|
describe('installKey', () => {
|
|
it('keys enterprise installs by enterprise id', () => {
|
|
expect(installKey({ isEnterpriseInstall: true, enterpriseId: 'E1', teamId: 'T1' })).toBe('E:E1');
|
|
});
|
|
|
|
it('keys team installs by team id', () => {
|
|
expect(installKey({ isEnterpriseInstall: false, teamId: 'T9' })).toBe('T:T9');
|
|
});
|
|
|
|
it('throws without any id', () => {
|
|
expect(() => installKey({ isEnterpriseInstall: false })).toThrow(/missing/);
|
|
});
|
|
|
|
it('keys a completed installation record', () => {
|
|
const inst = { team: { id: 'T5' }, enterprise: undefined } as unknown as Installation;
|
|
expect(installKeyFromInstallation(inst)).toBe('T:T5');
|
|
});
|
|
});
|
|
|
|
describe('HanzoFileInstallationStore', () => {
|
|
const files: string[] = [];
|
|
afterEach(async () => {
|
|
for (const f of files.splice(0)) await fs.rm(f, { force: true });
|
|
});
|
|
|
|
function newStore(): HanzoFileInstallationStore {
|
|
const path = join(tmpdir(), `hanzo-slack-inst-${Math.random().toString(36).slice(2)}.json`);
|
|
files.push(path);
|
|
return new HanzoFileInstallationStore(path);
|
|
}
|
|
|
|
it('round-trips an installation', async () => {
|
|
const store = newStore();
|
|
const inst = { team: { id: 'T1' } } as unknown as Installation;
|
|
await store.storeInstallation(inst);
|
|
const got = await store.fetchInstallation({ isEnterpriseInstall: false, teamId: 'T1' } as never);
|
|
expect((got as { team?: { id?: string } }).team?.id).toBe('T1');
|
|
});
|
|
|
|
it('throws when an installation is missing', async () => {
|
|
const store = newStore();
|
|
await expect(
|
|
store.fetchInstallation({ isEnterpriseInstall: false, teamId: 'nope' } as never),
|
|
).rejects.toThrow(/not found/);
|
|
});
|
|
|
|
it('binds and reads a per-workspace Hanzo token', async () => {
|
|
const store = newStore();
|
|
await store.setHanzoToken('T1', { token: 'sk-ws', owner: 'acme' });
|
|
expect(await store.getHanzoToken('T1')).toEqual({ token: 'sk-ws', owner: 'acme' });
|
|
expect(await store.getHanzoToken('T2')).toBeUndefined();
|
|
});
|
|
|
|
it('deletes an installation and its Hanzo token', async () => {
|
|
const store = newStore();
|
|
await store.storeInstallation({ team: { id: 'T1' } } as unknown as Installation);
|
|
await store.setHanzoToken('T1', { token: 'sk-ws' });
|
|
await store.deleteInstallation({ isEnterpriseInstall: false, teamId: 'T1' } as never);
|
|
expect(await store.getHanzoToken('T1')).toBeUndefined();
|
|
});
|
|
});
|