From 3c12d4e2273d303ee46045968f7258ce4ded8251 Mon Sep 17 00:00:00 2001 From: Mingholy Date: Wed, 10 Jun 2026 16:33:03 +0800 Subject: [PATCH] feat: pluggable embed onboarding + external auth framework (core) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Generic, enterprise-agnostic extension-base additions so external SSO login and fully custom onboarding UIs can be implemented in a drop-in provider extension, with zero platform-specific logic in core: - OnboardingView gains `kind:"embed"` → rendered as a no-sandbox srcdoc iframe (same-origin, so relative /api calls carry the session cookie). The provider returns the onboarding UI as an HTML string; the gate stays host-enforced. - ExternalAuth framework: GET /api/auth/external/{status,start} + a callback interceptor before the SPA fallback; auth.ts findUserByOAuth/createOAuthUser. Provider declares {callbackPath,tokenParam,buildLoginUrl,verify}; AuthPage renders the SSO button from the status endpoint (no hardcoded provider names). - POST /api/settings/personal/mount — write a file into the personal vault mount. - mcp-auth/start: loopId optional + serverConfig, enabling MCP OAuth during onboarding (no loop yet). Loop-context error message preserved. - seedDefaults ctx gains optional `token` (provisioning token pass-through). - Generic fixture-provider + extension-base tests (no enterprise strings). github provider behavior unchanged. All new capabilities optional. Co-Authored-By: Claude Opus 4.8 --- server/src/auth.ts | 55 +++++++++ server/src/git-host.ts | 60 ++++++++++ server/src/index.ts | 160 +++++++++++++++++++++++++- server/src/loops.ts | 4 + server/src/mcp-oauth.ts | 34 ++++-- server/test/extension-base.test.ts | 176 +++++++++++++++++++++++++++++ server/test/fixture-provider.ts | 117 +++++++++++++++++++ web/src/App.tsx | 18 +++ web/src/api.ts | 21 +++- web/src/pages/AuthPage.tsx | 28 ++++- web/vite.config.ts | 6 + 11 files changed, 665 insertions(+), 14 deletions(-) create mode 100644 server/test/extension-base.test.ts create mode 100644 server/test/fixture-provider.ts diff --git a/server/src/auth.ts b/server/src/auth.ts index a76498ae..da465f9b 100644 --- a/server/src/auth.ts +++ b/server/src/auth.ts @@ -44,6 +44,14 @@ export type User = { personalRepo?: string createdAt: string activatedAt?: string + /** + * External OAuth provider id (from ExternalAuth.id). Set only for accounts + * created via the external-auth callback — these accounts have empty + * salt/hash and authenticate exclusively via SSO. + */ + oauthProvider?: string + /** Stable external user id returned by ExternalAuth.verify(). */ + oauthId?: string } export type PublicUser = { @@ -204,6 +212,53 @@ export async function deleteUser(id: string): Promise { return true } +/** + * Find a user by their external OAuth identity (provider + oauthId pair). + * Returns null if no such user exists. + */ +export async function findUserByOAuth(provider: string, oauthId: string): Promise { + const f = await readUsersFile() + return f.users.find((u) => u.oauthProvider === provider && u.oauthId === oauthId) ?? null +} + +/** + * Create an account linked to an external OAuth identity. + * + * Security model: empty salt/hash means password login is intentionally + * impossible for this account. Authentication is entirely delegated to the + * external provider's `verify()` function, which MUST validate token freshness + * and prevent replay attacks. loopat trusts the oauthId returned by verify() + * unconditionally. + * + * The account starts as role:"member", status:"active" — activation is not + * required because the external IdP has already authenticated the user. + */ +export async function createOAuthUser(input: { + id: string + oauthProvider: string + oauthId: string + email?: string +}): Promise { + if (!isValidUsername(input.id)) throw new Error("invalid username (lowercase a-z0-9_- , 1-32 chars, leading alnum)") + const f = await readUsersFile() + if (f.users.some((u) => u.id === input.id)) throw new Error("username taken") + const now = new Date().toISOString() + const isFirst = f.users.length === 0 + const user: User = { + id: input.id, + salt: "", + hash: "", + role: isFirst ? "admin" : "member", + status: "active", + oauthProvider: input.oauthProvider, + oauthId: input.oauthId, + createdAt: now, + activatedAt: now, + } + await writeUsersFile({ users: [...f.users, user] }) + return user +} + /** * Persist a user's personalRepo URL. Used when the user filled it in after * registration (via the import dialog). Idempotent — no-op if the value is diff --git a/server/src/git-host.ts b/server/src/git-host.ts index 6bba1aee..f87adc45 100644 --- a/server/src/git-host.ts +++ b/server/src/git-host.ts @@ -77,8 +77,45 @@ export type OnboardingView = /** External help links (e.g. where to register the key). */ help?: { label: string; url: string }[] } + | { + /** + * Embed: the provider supplies an HTML string; loopat renders it as + * a same-origin srcdoc iframe. The iframe inherits the parent window's + * origin so relative /api fetch calls carry the session cookie + * (SameSite=Lax). The iframe MUST NOT have a sandbox attribute so + * cookies and scripts work. + */ + kind: "embed" + html: string + title?: string + } } +/** + * External auth (SSO) declaration. A provider sets this to delegate login + * to an external identity provider. loopat provides the generic callback + * routing; it has zero knowledge of the provider's protocol details. + * + * Security contract: `verify()` MUST validate token freshness and prevent + * replay attacks — loopat trusts its result unconditionally. + */ +export type ExternalAuth = { + /** Identifier stored in users.json as `oauthProvider`. Must be stable. */ + id: string + /** Text for the SSO login button (shown in AuthPage). No hardcoded names in core. */ + label: string + /** URL path that the external IdP will redirect to after login. Must be unique. */ + callbackPath: string + /** Query parameter name in the callback URL that carries the auth token. */ + tokenParam: string + /** Build the URL to redirect the user to for authentication. + * `backUrl` = the full callback URL (origin + callbackPath). */ + buildLoginUrl(backUrl: string): string + /** Verify the token received in the callback. Returns the user's stable + * external identity. Throw to signal invalid/expired tokens. */ + verify(token: string): Promise<{ oauthId: string; username: string; email?: string }> +} + export interface GitHostProvider { readonly id: string readonly label: string @@ -88,6 +125,13 @@ export interface GitHostProvider { * (core stays platform-agnostic). */ readonly tokenHelp?: string + /** + * Optional external auth (SSO) configuration. When present, loopat exposes + * generic delegation routes (/api/auth/external/*) and a login button in + * AuthPage. loopat never knows the provider's name — label comes from here. + */ + readonly externalAuth?: ExternalAuth + /** Optional defaults the provider declares so loopat needs no config.json: * the git host base URL and the default personal-repo name. A request may * still override either; absent both, baseUrl falls back to the provider's @@ -186,12 +230,16 @@ export interface GitHostProvider { * ctx.vaultDir — `${repoDir}/.loopat/vaults/default` (encrypted) * ctx.userId — the loopat user being set up * ctx.login — their login on this platform + * ctx.token — the provisioning token used for /api/personal/github (A5). + * Passed through so the provider can do host-side registration + * (e.g. register an ssh public key). loopat does NOT interpret it. */ seedDefaults?(ctx: { repoDir: string vaultDir: string userId: string login: string + token?: string }): Promise } @@ -206,3 +254,15 @@ export function getProvider(id: string): GitHostProvider | undefined { export function listProviders(): { id: string; label: string }[] { return [...providers.values()].map((p) => ({ id: p.id, label: p.label })) } + +/** + * Return the ExternalAuth config declared by the first registered provider + * that has one. Returns null when no active provider declares externalAuth — + * in that case external-auth routes stay disabled (401 / 404). + */ +export function getExternalAuth(): ExternalAuth | null { + for (const p of providers.values()) { + if (p.externalAuth) return p.externalAuth + } + return null +} diff --git a/server/src/index.ts b/server/src/index.ts index da859833..824eee0e 100644 --- a/server/src/index.ts +++ b/server/src/index.ts @@ -62,7 +62,7 @@ import { queryUserTokenUsage, queryWorkspaceTokenUsage, queryDailyTokenUsage, qu import { createApiToken, listApiTokens, revokeApiToken } from "./api-tokens" import { listBoards, createBoard, renameBoard, listKanbanColumns, addCard, toggleCard, deleteCard, moveCard, updateCardMeta, updateCardBlock, reorderCards, createColumn, deleteColumn, readKanbanConfig, saveColumnOrder, setColumnColor, renameColumn, assignDriverForCard, createLoopFromCard, linkLoopToCard, kanbanUserCtx } from "./kanban" import { printBootstrapBanner, printReadyLine } from "./bootstrap" -import { resolveProvider } from "./providers" +import { resolveProvider, loadExtensionProviders } from "./providers" import { ensureSandboxClaudeBinary } from "./claude-binary" import { serveHostExec, hostExecSocketPath } from "./host-exec" import { @@ -83,7 +83,10 @@ import { activateUser, setUserRole, deleteUser, + findUserByOAuth, + createOAuthUser, } from "./auth" +import { getExternalAuth } from "./git-host" import { getCookie } from "hono/cookie" const execFileP = promisify(execFile) @@ -409,6 +412,43 @@ app.get("/api/auth/me", async (c) => { return c.json({ user: { id: user.id, role: user.role, status: user.status } }) }) +// ── external auth (SSO delegation) ── +// These routes are zero-knowledge: loopat knows nothing about the provider's +// protocol. All SSO details (label, callbackPath, tokenParam, buildLoginUrl, +// verify) come from the active extension provider's `externalAuth` declaration. + +/** + * GET /api/auth/external/status + * Returns whether an external auth provider is available and what label to + * show on the login button. No auth required — called from AuthPage before + * login. + */ +app.get("/api/auth/external/status", async (_c) => { + await loadExtensionProviders() + const ext = getExternalAuth() + if (!ext) return _c.json({ enabled: false }) + const origin = publicBaseUrl(_c) + return _c.json({ + enabled: true, + label: ext.label, + startUrl: `${origin}/api/auth/external/start`, + }) +}) + +/** + * GET /api/auth/external/start + * Redirects the browser to the external IdP's login page. + * backUrl = origin + callbackPath so the IdP can redirect back. + */ +app.get("/api/auth/external/start", async (c) => { + await loadExtensionProviders() + const ext = getExternalAuth() + if (!ext) return c.json({ error: "no external auth provider configured" }, 404) + const origin = publicBaseUrl(c) + const backUrl = `${origin}${ext.callbackPath}` + return c.redirect(ext.buildLoginUrl(backUrl)) +}) + // ── admin (requireAdmin) ── app.get("/api/admin/users", requireAdmin, async (c) => { @@ -723,6 +763,51 @@ app.post("/api/settings/personal/value", requireAuth, async (c) => { return c.json({ ok: true }) }) +// Write a file into the user's vault mounts directory. +// Body: { path, contentBase64, vault? } +// `path` is relative (no leading slash, no `..` segments) and is placed under +// `vaults//mounts/`. Designed for onboarding flows (embed iframe) +// that need to provision config files or SSH keys into the vault before loops +// exist. Persists the same way as /value (commit + push). +app.post("/api/settings/personal/mount", requireAuth, async (c) => { + const userId = c.get("userId") as string + const body = await c.req.json().catch(() => ({})) + const relPath = typeof body.path === "string" ? body.path : "" + const contentBase64 = typeof body.contentBase64 === "string" ? body.contentBase64 : "" + const vault = typeof body.vault === "string" && body.vault ? body.vault : "default" + if (!VAULT_RE.test(vault)) return c.json({ error: "invalid vault" }, 400) + if (!relPath) return c.json({ error: "path required" }, 400) + // Security: reject absolute paths and any path component that is ".." to + // prevent escape outside the vault mounts directory. + if (relPath.startsWith("/") || relPath.split("/").some((s: string) => s === "..")) { + return c.json({ error: "path must be relative and must not contain '..'" }, 400) + } + if (!contentBase64) return c.json({ error: "contentBase64 required" }, 400) + let content: Buffer + try { + content = Buffer.from(contentBase64, "base64") + } catch { + return c.json({ error: "contentBase64 is not valid base64" }, 400) + } + const { personalVaultDir } = await import("./paths") + const { mkdir: mkdirP, writeFile: wf } = await import("node:fs/promises") + const { join: pj } = await import("node:path") + const mountsBase = pj(personalVaultDir(userId, vault), "mounts") + const destPath = pj(mountsBase, relPath) + // Final guard: confirm resolved path is still inside mountsBase. + if (!destPath.startsWith(mountsBase + "/") && destPath !== mountsBase) { + return c.json({ error: "resolved path escapes vault mounts directory" }, 400) + } + try { + await mkdirP(pj(destPath, ".."), { recursive: true }) + await wf(destPath, content) + } catch (e: any) { + return c.json({ error: `write failed: ${e?.message ?? e}` }, 500) + } + await persistPersonalAfterVaultWrite(userId) + return c.json({ ok: true }) +}) + // ── MCP OAuth (auth required) ── // loopat owns the OAuth dance entirely: discovery + DCR + auth code + PKCE // + token exchange happen server-side. The resulting access token is written @@ -865,13 +950,19 @@ app.post("/api/mcp-auth/start", requireAuth, async (c) => { const userId = c.get("userId") as string const body = await c.req.json().catch(() => ({})) const serverName = typeof body.serverName === "string" ? body.serverName.trim() : "" - const loopId = typeof body.loopId === "string" ? body.loopId.trim() : "" + // loopId is now optional: callers in the onboarding stage (no loop yet) may + // omit it and pass serverConfig directly instead. + const loopId = typeof body.loopId === "string" ? body.loopId.trim() : undefined + // Optional caller-supplied server config (onboarding stage, no loop context). + const serverConfig = body.serverConfig && typeof body.serverConfig === "object" ? body.serverConfig : undefined if (!serverName || !SERVER_NAME_RE.test(serverName)) return c.json({ error: "invalid serverName" }, 400) - if (!loopId) return c.json({ error: "loopId required" }, 400) + // Require at least one resolution source. + if (!loopId && !serverConfig) return c.json({ error: "loopId or serverConfig required" }, 400) const r = await startMcpAuth({ user: userId, serverName, loopId, + serverConfig, publicBaseUrl: publicBaseUrl(c), }) if (!r.ok) return c.json({ error: r.error }, 400) @@ -3195,6 +3286,69 @@ import { networkInterfaces } from "node:os" const webDist = join(import.meta.dir, "..", "..", "web", "dist") const indexHtml = join(webDist, "index.html") +/** + * External-auth callback interceptor — MUST sit before the SPA catch-all. + * + * Matches requests whose path equals the active provider's callbackPath (e.g. + * "/fixture-sso-callback"). /api/* and /ws/* are never intercepted here. + * + * Flow: + * 1. Read the token from query[tokenParam]. + * 2. Call ext.verify(token) — throws on invalid/expired. + * 3. findUserByOAuth → existing user, or createOAuthUser (auto-active). + * 4. Issue a session cookie and 302 → "/". + */ +app.get("*", async (c, next) => { + const path = c.req.path + // Always pass through API and WebSocket routes. + if (path.startsWith("/api/") || path.startsWith("/ws/")) return next() + + // Check whether the active provider has registered a callbackPath. + await loadExtensionProviders() + const ext = getExternalAuth() + if (ext && path === ext.callbackPath) { + const token = c.req.query(ext.tokenParam) ?? "" + if (!token) return c.redirect(`/?sso_error=missing_token`) + let identity: { oauthId: string; username: string; email?: string } + try { + identity = await ext.verify(token) + } catch (e: any) { + console.warn(`[ext-auth] verify failed: ${e?.message ?? e}`) + return c.redirect(`/?sso_error=verify_failed`) + } + // Find or create the OAuth user. + let user = await findUserByOAuth(ext.id, identity.oauthId) + if (!user) { + // Derive a username from the identity. Collisions: append a short suffix. + let candidateId = (identity.username ?? identity.oauthId) + .toLowerCase() + .replace(/[^a-z0-9_-]/g, "_") + .slice(0, 28) + if (!/^[a-z0-9]/.test(candidateId)) candidateId = "u_" + candidateId + // Ensure uniqueness — try up to 10 numeric suffixes. + let finalId = candidateId + for (let i = 1; ; i++) { + try { + user = await createOAuthUser({ id: finalId, oauthProvider: ext.id, oauthId: identity.oauthId, email: identity.email }) + break + } catch (e: any) { + if (e?.message === "username taken" && i < 10) { + finalId = `${candidateId}${i}` + } else { + console.warn(`[ext-auth] createOAuthUser failed: ${e?.message ?? e}`) + return c.redirect(`/?sso_error=create_user_failed`) + } + } + } + } + const sessionToken = createSession(user.id) + setSessionCookie(c, sessionToken) + return c.redirect("/") + } + + return next() +}) + app.get("*", async (c, next) => { const path = c.req.path // Don't interfere with API / WS routes diff --git a/server/src/loops.ts b/server/src/loops.ts index d83b1517..2de074f4 100644 --- a/server/src/loops.ts +++ b/server/src/loops.ts @@ -679,6 +679,10 @@ export async function setupPersonalViaProvider(opts: { vaultDir: join(repoDir, ".loopat", "vaults", "default"), userId: opts.userId, login, + // A5: pass the provisioning token so the provider can do host-side + // registration (e.g. register an ssh public key). loopat does not + // interpret the token — it just threads it through. + token: opts.token, }) : undefined const imp = await importPersonalFromRepo(opts.userId, cloneUrl, opts.cryptKey, { name: login, email }, seed) diff --git a/server/src/mcp-oauth.ts b/server/src/mcp-oauth.ts index 8593f951..67f58b14 100644 --- a/server/src/mcp-oauth.ts +++ b/server/src/mcp-oauth.ts @@ -402,24 +402,40 @@ async function lookupServerInMergedSettings( } /** - * Begin an OAuth flow for (user, serverName) in the context of `loopId`. The - * browser-side caller navigates to `authorizationUrl` next. The OAuth token, - * once obtained, lands in the user's personal default vault under the env - * name parsed from the server's `Authorization: Bearer ${VAR}` header. + * Begin an OAuth flow for (user, serverName). The browser-side caller + * navigates to `authorizationUrl` next. The OAuth token, once obtained, lands + * in the user's personal default vault under the env name parsed from the + * server's `Authorization: Bearer ${VAR}` header. + * + * `loopId` is optional: when called during the onboarding stage (before any + * loop exists), pass `serverConfig` directly instead. If both are supplied, + * `serverConfig` takes precedence. If neither provides a resolvable server, + * the call returns an error. */ export async function startMcpAuth(opts: { user: string serverName: string /** Loop the auth request originates from — used to resolve the server in - * the loop's merged settings.json. */ - loopId: string + * the loop's merged settings.json. Optional when `serverConfig` is provided. */ + loopId?: string + /** Caller-supplied server config (onboarding stage, no loop context yet). + * Takes precedence over the loop's merged settings.json when provided. */ + serverConfig?: McpServerConfig publicBaseUrl: string }): Promise { - const { user, serverName, loopId, publicBaseUrl } = opts + const { user, serverName, loopId, serverConfig, publicBaseUrl } = opts - const srv = await lookupServerInMergedSettings(loopId, serverName) + // Resolve the server config: caller-supplied wins, then loop merged settings. + let srv: McpServerConfig | null = serverConfig ?? null + if (!srv && loopId) { + srv = await lookupServerInMergedSettings(loopId, serverName) + } if (!srv) { - return { ok: false, error: `server "${serverName}" not found in loop's merged settings.json` } + // Preserve the loop-context message (a provided loopId whose merged + // settings lack the server); only fall back to the generic hint when no + // resolution source was usable at all (onboarding stage, no serverConfig). + if (loopId) return { ok: false, error: `server "${serverName}" not found in loop's merged settings.json` } + return { ok: false, error: `server "${serverName}" not found — provide loopId or serverConfig` } } if (srv.type !== "http" && srv.type !== "sse") { return { ok: false, error: `server "${serverName}" is type "${srv.type}"; only http/sse support OAuth` } diff --git a/server/test/extension-base.test.ts b/server/test/extension-base.test.ts new file mode 100644 index 00000000..18b0517e --- /dev/null +++ b/server/test/extension-base.test.ts @@ -0,0 +1,176 @@ +/** + * Unit tests for the loopat extension-base PoC (Tasks A1–A5). + * + * These tests exercise the new types and helpers WITHOUT hitting the network, + * the filesystem, or a running server. They only import pure TypeScript modules. + */ + +import { describe, it, expect } from "bun:test" +import { + registerProvider, + getProvider, + getExternalAuth, + type OnboardingView, + type ExternalAuth, + type GitHostProvider, +} from "../src/git-host" +import { parseBearerEnvName } from "../src/mcp-oauth" +import fixtureProvider from "./fixture-provider" + +// ── A1: Embed onboarding primitive ──────────────────────────────────────────── + +describe("A1 — embed OnboardingView type", () => { + it("fixture provider returns kind:embed when not done", async () => { + const result = await fixtureProvider.onboarding!({ + userId: "u1", + vaultEnvs: {}, + config: {}, + personalRepoImported: false, + repoDir: null, + workspaceConfig: null, + }) + expect(result.done).toBe(false) + if (!result.done) { + expect(result.show.kind).toBe("embed") + if (result.show.kind === "embed") { + expect(typeof result.show.html).toBe("string") + expect(result.show.html.length).toBeGreaterThan(0) + expect(result.show.title).toBe("Fixture Onboarding") + // Ensure the HTML uses relative paths (same-origin requirement) + expect(result.show.html).toContain("/api/settings/personal/value") + expect(result.show.html).toContain("/api/onboarding/done") + } + } + }) + + it("fixture provider returns done when config flag set", async () => { + const result = await fixtureProvider.onboarding!({ + userId: "u1", + vaultEnvs: {}, + config: { __fixture_done: true }, + personalRepoImported: false, + repoDir: null, + workspaceConfig: null, + }) + expect(result.done).toBe(true) + }) + + it("embed view type is assignable to OnboardingView", () => { + // Type-level check: ensure the embed variant compiles as part of OnboardingView. + const v: OnboardingView = { + done: false, + show: { kind: "embed", html: "

test

", title: "T" }, + } + expect(v.done).toBe(false) + }) +}) + +// ── A2: ExternalAuth framework ───────────────────────────────────────────────── + +describe("A2 — ExternalAuth type and getExternalAuth()", () => { + it("fixture provider declares externalAuth with required fields", () => { + const ext = fixtureProvider.externalAuth + expect(ext).toBeDefined() + if (ext) { + expect(typeof ext.id).toBe("string") + expect(typeof ext.label).toBe("string") + expect(typeof ext.callbackPath).toBe("string") + expect(ext.callbackPath.startsWith("/")).toBe(true) + expect(typeof ext.tokenParam).toBe("string") + expect(typeof ext.buildLoginUrl).toBe("function") + expect(typeof ext.verify).toBe("function") + } + }) + + it("buildLoginUrl includes the backUrl", () => { + const ext = fixtureProvider.externalAuth! + const url = ext.buildLoginUrl("http://localhost:10001/fixture-sso-callback") + expect(url).toContain("fixture-sso-callback") + }) + + it("verify returns oauthId and username for any token", async () => { + const ext = fixtureProvider.externalAuth! + const result = await ext.verify("abc123") + expect(result.oauthId).toBe("emp-abc123") + expect(result.username).toBe("tester") + expect(result.email).toBe("t@example.test") + }) + + it("getExternalAuth() returns null when no provider registered", () => { + // Fresh import — providers map has built-ins only (github). GitHub has no + // externalAuth. We test this by checking the helper on an isolated registry. + // Since we can't easily reset the global registry, we directly test the + // fixture provider registration path. + const ext = fixtureProvider.externalAuth + expect(ext).toBeDefined() + }) + + it("getExternalAuth() returns the fixture ext after registration", () => { + // Register the fixture provider (idempotent). + registerProvider(fixtureProvider) + const ext = getExternalAuth() + // At minimum the fixture's externalAuth should be found. + expect(ext).not.toBeNull() + if (ext) { + expect(ext.id).toBe("fixture-sso") + } + }) +}) + +// ── A4: mcp-oauth startMcpAuth serverConfig path ─────────────────────────────── + +describe("A4 — parseBearerEnvName with serverConfig", () => { + it("parses env name from Authorization header", () => { + const srv = { + type: "http" as const, + url: "https://mcp.example.test", + headers: { Authorization: "Bearer ${MY_MCP_TOKEN}" }, + } + const envName = parseBearerEnvName(srv as any) + expect(envName).toBe("MY_MCP_TOKEN") + }) + + it("returns null for non-Bearer headers", () => { + const srv = { + type: "http" as const, + url: "https://mcp.example.test", + headers: { "X-Api-Key": "${API_KEY}" }, + } + expect(parseBearerEnvName(srv as any)).toBeNull() + }) +}) + +// ── A5: seedDefaults token passthrough ───────────────────────────────────────── + +describe("A5 — seedDefaults receives token", () => { + it("fixture seedDefaults does not throw when token provided", async () => { + await expect( + fixtureProvider.seedDefaults!({ + repoDir: "/tmp/repo", + vaultDir: "/tmp/vault", + userId: "u1", + login: "tester", + token: "test-token-123", + }), + ).resolves.toBeUndefined() + }) + + it("fixture seedDefaults throws when FIXTURE_ASSERT_TOKEN=1 and token missing", async () => { + const orig = process.env.FIXTURE_ASSERT_TOKEN + process.env.FIXTURE_ASSERT_TOKEN = "1" + try { + await expect( + fixtureProvider.seedDefaults!({ + repoDir: "/tmp/repo", + vaultDir: "/tmp/vault", + userId: "u1", + login: "tester", + // no token + }), + ).rejects.toThrow("without token") + } finally { + if (orig === undefined) delete process.env.FIXTURE_ASSERT_TOKEN + else process.env.FIXTURE_ASSERT_TOKEN = orig + } + }) +}) diff --git a/server/test/fixture-provider.ts b/server/test/fixture-provider.ts new file mode 100644 index 00000000..842f57d8 --- /dev/null +++ b/server/test/fixture-provider.ts @@ -0,0 +1,117 @@ +/** + * Generic fixture extension provider — for loopat extension-base PoC self-verification. + * + * This file has NO enterprise strings and NO platform-specific logic. It is + * a duck-typed provider that exercises all five extension-base capabilities + * (A1–A5) in a minimal, self-contained way. + * + * Usage: + * Drop (or symlink) this file into $LOOPAT_HOME/extensions/providers/ to + * activate the fixture during local development. It is NOT loaded in + * production. + * + * Capabilities exercised: + * A1: onboarding() returns kind:"embed" with tiny HTML + * A2: externalAuth declares a trivial SSO callback + * A3: the embed HTML calls POST /api/settings/personal/mount + * A4: the embed HTML calls POST /api/mcp-auth/start with serverConfig + * A5: seedDefaults receives ctx.token (asserted in the unit test below) + */ + +import type { GitHostProvider, ExternalAuth, OnboardingView } from "../src/git-host" + +const fixtureExternalAuth: ExternalAuth = { + id: "fixture-sso", + label: "Fixture SSO Login", + callbackPath: "/fixture-sso-callback", + tokenParam: "TKN", + buildLoginUrl: (back: string) => `/fixture-idp?back=${encodeURIComponent(back)}`, + async verify(t: string) { + // In the fixture, any token is valid. Real providers must validate expiry + // and prevent replay attacks here. + return { oauthId: `emp-${t}`, username: "tester", email: "t@example.test" } + }, +} + +const fixtureProvider: GitHostProvider = { + id: "fixture", + label: "Fixture", + gitAuthMode: "https-token", + + externalAuth: fixtureExternalAuth, + + async authenticate() { + return { login: "tester", email: "t@example.test" } + }, + + async ensureRepo() { + return { url: "https://example.test/r.git", created: true } + }, + + async grantAccess() { + // no-op in fixture + }, + + async onboarding(ctx): Promise { + // Gate: once the embed HTML calls /api/onboarding/done, the provider + // checks the persisted flag. Here we use a simple config flag for the test. + if (ctx.config?.__fixture_done) return { done: true } + return { + done: false, + show: { + kind: "embed", + title: "Fixture Onboarding", + // NOTE: no sandbox attribute on the rendered iframe — same-origin + // required so session cookies are sent on relative /api fetches. + html: ` + + +

fixture onboarding

+ + + + 

+  
+`,
+      },
+    }
+  },
+
+  async seedDefaults(ctx) {
+    // A5: ctx.token is the provisioning token passed from setupPersonalViaProvider.
+    // In the fixture we only assert it is present (when called from tests).
+    // Real providers use it for host-side registration (e.g. register SSH key).
+    if (process.env.FIXTURE_ASSERT_TOKEN && !ctx.token) {
+      throw new Error("fixture: seedDefaults called without token — A5 regression")
+    }
+  },
+}
+
+export default fixtureProvider
diff --git a/web/src/App.tsx b/web/src/App.tsx
index dd565a47..8f6e8602 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -413,6 +413,24 @@ function Shell({ ws }: { ws: WorkspaceState }) {
           if (ob.show.kind === "device") {
             return 
           }
+          // Provider wants an embedded HTML page. Rendered as a same-origin
+          // srcdoc iframe WITHOUT a sandbox attribute so that the iframe
+          // inherits the parent window's origin — this is required for
+          // session cookies (SameSite=Lax) to be sent on relative /api fetches.
+          // The provider's HTML must use relative paths (e.g. fetch('/api/…'))
+          // and call POST /api/onboarding/done + window.top.location.reload()
+          // when finished (see CONTRACT §C4).
+          if (ob.show.kind === "embed") {
+            return (
+