feat(opencode): add external browser OAuth for snowflake cortex provider (#31700)
Co-authored-by: santiago.gonzalezcarvajcentenera <santiago.gonzalezcarvajcentenera@colaborador.elcorteingles.es> Co-authored-by: David Fierro <14184197+davidfierro@users.noreply.github.com> Co-authored-by: Kamesh Sampath <kamesh.sampath@hotmail.com> Co-authored-by: Cortex Code <noreply@snowflake.com>
This commit is contained in:
santigc6
GitHub
parent
fcca731a96
commit
3f174531b9
8 changed files with 975 additions and 92 deletions
276
packages/opencode/test/plugin/snowflake-cortex.test.ts
Normal file
276
packages/opencode/test/plugin/snowflake-cortex.test.ts
Normal file
|
|
@ -0,0 +1,276 @@
|
|||
import { describe, expect, test } from "bun:test"
|
||||
import { OAUTH_DUMMY_KEY } from "../../src/auth"
|
||||
import { oauthScope, SnowflakeCortexAuthPlugin } from "../../src/plugin/snowflake-cortex"
|
||||
|
||||
function makeInput() {
|
||||
let auth: any = {
|
||||
type: "oauth",
|
||||
access: "access-old",
|
||||
refresh: "refresh-old",
|
||||
expires: Date.now() + 3600_000,
|
||||
accountId: "myorg-myaccount",
|
||||
}
|
||||
const setCalls: Array<Record<string, unknown>> = []
|
||||
|
||||
return {
|
||||
getAuth: async () => auth,
|
||||
setAuth: (next: any) => {
|
||||
auth = next
|
||||
},
|
||||
input: {
|
||||
client: {
|
||||
auth: {
|
||||
set: async (request: any) => {
|
||||
setCalls.push(request)
|
||||
auth = request.body
|
||||
},
|
||||
},
|
||||
},
|
||||
} as any,
|
||||
setCalls,
|
||||
}
|
||||
}
|
||||
|
||||
describe("plugin.snowflake-cortex", () => {
|
||||
test("oauthScope uses Snowflake-compatible scope values", () => {
|
||||
expect(oauthScope(undefined)).toBe("refresh_token")
|
||||
expect(oauthScope("PUBLIC")).toBe("refresh_token session:role:PUBLIC")
|
||||
expect(oauthScope("AUTH SNOWFLAKE")).toBe("refresh_token session:role-encoded:AUTH%20SNOWFLAKE")
|
||||
})
|
||||
|
||||
test("loader returns empty options when auth is not oauth", async () => {
|
||||
const hooks = await SnowflakeCortexAuthPlugin({} as any)
|
||||
const options = await hooks.auth!.loader!(async () => ({ type: "api", key: "token" }) as any, {} as any)
|
||||
expect(options).toEqual({})
|
||||
})
|
||||
|
||||
test("loader injects bearer header and preserves custom headers", async () => {
|
||||
const { input, getAuth, setAuth } = makeInput()
|
||||
setAuth({
|
||||
type: "oauth",
|
||||
access: "access-live",
|
||||
refresh: "refresh-live",
|
||||
expires: Date.now() + 60 * 60 * 1000,
|
||||
accountId: "myorg-myaccount",
|
||||
})
|
||||
const hooks = await SnowflakeCortexAuthPlugin(input)
|
||||
const options = await hooks.auth!.loader!(getAuth as any, {} as any)
|
||||
expect(options.apiKey).toBe(OAUTH_DUMMY_KEY)
|
||||
|
||||
const originalFetch = globalThis.fetch
|
||||
const captured: Headers[] = []
|
||||
globalThis.fetch = (async (_request, init) => {
|
||||
captured.push(new Headers(init?.headers))
|
||||
return new Response("{}", { status: 200, headers: { "content-type": "application/json" } })
|
||||
}) as typeof fetch
|
||||
|
||||
try {
|
||||
await options.fetch("https://example.test/v1/chat", {
|
||||
headers: { Authorization: `Bearer ${OAUTH_DUMMY_KEY}`, "x-keep": "yes" },
|
||||
})
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch
|
||||
}
|
||||
|
||||
expect(captured).toHaveLength(1)
|
||||
expect(captured[0].get("authorization")).toBe("Bearer access-live")
|
||||
expect(captured[0].get("x-keep")).toBe("yes")
|
||||
expect(captured[0].get("user-agent")).toMatch(/^opencode\//)
|
||||
})
|
||||
|
||||
test("loader refreshes expired token with single-flight and persists refreshed oauth", async () => {
|
||||
const { input, getAuth, setCalls } = makeInput()
|
||||
let refreshCalls = 0
|
||||
const apiAuthHeaders: string[] = []
|
||||
|
||||
// Must mock fetch before calling loader because startup refresh triggers for expires: 0
|
||||
const originalFetch = globalThis.fetch
|
||||
globalThis.fetch = (async (request, init) => {
|
||||
const url =
|
||||
typeof request === "string" ? request : request instanceof URL ? request.toString() : String(request.url)
|
||||
|
||||
if (url.includes("/oauth/token-request")) {
|
||||
refreshCalls += 1
|
||||
const body = new URLSearchParams(String(init?.body ?? ""))
|
||||
expect(body.get("grant_type")).toBe("refresh_token")
|
||||
expect(body.get("refresh_token")).toBe("refresh-old")
|
||||
expect(new Headers(init?.headers).get("authorization")).toMatch(/^Basic /)
|
||||
await new Promise((resolve) => setTimeout(resolve, 20))
|
||||
return Response.json({ access_token: "access-new", refresh_token: "refresh-new", expires_in: 3600 })
|
||||
}
|
||||
|
||||
apiAuthHeaders.push(new Headers(init?.headers).get("authorization") || "")
|
||||
return new Response("{}", { status: 200, headers: { "content-type": "application/json" } })
|
||||
}) as typeof fetch
|
||||
|
||||
try {
|
||||
const hooks = await SnowflakeCortexAuthPlugin(input)
|
||||
const options = await hooks.auth!.loader!(
|
||||
async () => ({
|
||||
type: "oauth",
|
||||
access: "access-expired",
|
||||
refresh: "refresh-old",
|
||||
expires: 0,
|
||||
accountId: "myorg-myaccount",
|
||||
}) as any,
|
||||
{} as any,
|
||||
)
|
||||
|
||||
await Promise.all([
|
||||
options.fetch("https://example.test/v1/chat", { headers: {} }),
|
||||
options.fetch("https://example.test/v1/chat", { headers: {} }),
|
||||
])
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch
|
||||
}
|
||||
|
||||
expect(refreshCalls).toBe(1)
|
||||
expect(apiAuthHeaders).toEqual(["Bearer access-new", "Bearer access-new"])
|
||||
expect(setCalls).toHaveLength(1)
|
||||
expect((setCalls[0] as any).body).toMatchObject({
|
||||
type: "oauth",
|
||||
access: "access-new",
|
||||
refresh: "refresh-new",
|
||||
accountId: "myorg-myaccount",
|
||||
})
|
||||
})
|
||||
|
||||
test("loader retries once after 401 by refreshing token", async () => {
|
||||
const { input, getAuth, setCalls } = makeInput()
|
||||
const hooks = await SnowflakeCortexAuthPlugin(input)
|
||||
const options = await hooks.auth!.loader!(
|
||||
async () => ({
|
||||
type: "oauth",
|
||||
access: "access-stale",
|
||||
refresh: "refresh-old",
|
||||
expires: Date.now() + 60 * 60 * 1000,
|
||||
accountId: "myorg-myaccount",
|
||||
}) as any,
|
||||
{} as any,
|
||||
)
|
||||
|
||||
let apiCalls = 0
|
||||
const seenAuth: string[] = []
|
||||
const originalFetch = globalThis.fetch
|
||||
globalThis.fetch = (async (request, init) => {
|
||||
const url =
|
||||
typeof request === "string" ? request : request instanceof URL ? request.toString() : String(request.url)
|
||||
|
||||
if (url.includes("/oauth/token-request")) {
|
||||
return Response.json({ access_token: "access-fresh", refresh_token: "refresh-fresh", expires_in: 3600 })
|
||||
}
|
||||
|
||||
apiCalls += 1
|
||||
seenAuth.push(new Headers(init?.headers).get("authorization") || "")
|
||||
if (apiCalls === 1) return new Response("unauthorized", { status: 401 })
|
||||
return new Response("{}", { status: 200, headers: { "content-type": "application/json" } })
|
||||
}) as typeof fetch
|
||||
|
||||
try {
|
||||
const response = await options.fetch("https://example.test/v1/chat", { headers: {} })
|
||||
expect(response.status).toBe(200)
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch
|
||||
}
|
||||
|
||||
expect(apiCalls).toBe(2)
|
||||
expect(seenAuth).toEqual(["Bearer access-stale", "Bearer access-fresh"])
|
||||
expect(setCalls).toHaveLength(1)
|
||||
expect((setCalls[0] as any).body).toMatchObject({
|
||||
type: "oauth",
|
||||
access: "access-fresh",
|
||||
refresh: "refresh-fresh",
|
||||
accountId: "myorg-myaccount",
|
||||
})
|
||||
})
|
||||
|
||||
test("loader converts max_tokens to max_completion_tokens in request body", async () => {
|
||||
const { input, getAuth } = makeInput()
|
||||
const hooks = await SnowflakeCortexAuthPlugin(input)
|
||||
const options = await hooks.auth!.loader!(getAuth as any, {} as any)
|
||||
|
||||
let sentBody: string | undefined
|
||||
const originalFetch = globalThis.fetch
|
||||
globalThis.fetch = (async (request, init) => {
|
||||
sentBody = typeof init?.body === "string" ? init.body : undefined
|
||||
return new Response("{}", { status: 200, headers: { "content-type": "application/json" } })
|
||||
}) as typeof fetch
|
||||
|
||||
try {
|
||||
await options.fetch("https://example.test/v1/chat", {
|
||||
method: "POST",
|
||||
body: JSON.stringify({ model: "claude-sonnet-4-5", max_tokens: 4096, messages: [] }),
|
||||
})
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch
|
||||
}
|
||||
|
||||
expect(sentBody).toBeDefined()
|
||||
const parsed = JSON.parse(sentBody!)
|
||||
expect(parsed.max_completion_tokens).toBe(4096)
|
||||
expect(parsed.max_tokens).toBeUndefined()
|
||||
expect(parsed.model).toBe("claude-sonnet-4-5")
|
||||
})
|
||||
|
||||
test("loader maps 400 'conversation complete' to 200 stop", async () => {
|
||||
const { input, getAuth } = makeInput()
|
||||
const hooks = await SnowflakeCortexAuthPlugin(input)
|
||||
const options = await hooks.auth!.loader!(getAuth as any, {} as any)
|
||||
|
||||
const originalFetch = globalThis.fetch
|
||||
globalThis.fetch = (async () => {
|
||||
return new Response(JSON.stringify({ message: "Conversation complete" }), {
|
||||
status: 400,
|
||||
headers: { "content-type": "application/json" },
|
||||
})
|
||||
}) as unknown as typeof fetch
|
||||
|
||||
try {
|
||||
const response = await options.fetch("https://example.test/v1/chat", {
|
||||
method: "POST",
|
||||
body: JSON.stringify({ model: "test", messages: [] }),
|
||||
})
|
||||
expect(response.status).toBe(200)
|
||||
const body = await response.json()
|
||||
expect(body.choices[0].finish_reason).toBe("stop")
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch
|
||||
}
|
||||
})
|
||||
|
||||
test("loader fixes empty role in SSE stream", async () => {
|
||||
const { input, getAuth } = makeInput()
|
||||
const hooks = await SnowflakeCortexAuthPlugin(input)
|
||||
const options = await hooks.auth!.loader!(getAuth as any, {} as any)
|
||||
|
||||
const originalFetch = globalThis.fetch
|
||||
const sseChunk = `data: {"choices":[{"delta":{"role":"","content":"hello"}}]}\n\n`
|
||||
globalThis.fetch = (async () => {
|
||||
const stream = new ReadableStream({
|
||||
start(ctrl) {
|
||||
ctrl.enqueue(new TextEncoder().encode(sseChunk))
|
||||
ctrl.close()
|
||||
},
|
||||
})
|
||||
return new Response(stream, {
|
||||
status: 200,
|
||||
headers: { "content-type": "text/event-stream" },
|
||||
})
|
||||
}) as unknown as typeof fetch
|
||||
|
||||
try {
|
||||
const response = await options.fetch("https://example.test/v1/chat", {
|
||||
method: "POST",
|
||||
body: JSON.stringify({ model: "test", messages: [], stream: true }),
|
||||
})
|
||||
expect(response.status).toBe(200)
|
||||
const reader = response.body!.getReader()
|
||||
const { value } = await reader.read()
|
||||
const text = new TextDecoder().decode(value)
|
||||
expect(text).not.toContain('"role":""')
|
||||
expect(text).toContain('"role":"assistant"')
|
||||
} finally {
|
||||
globalThis.fetch = originalFetch
|
||||
}
|
||||
})
|
||||
})
|
||||
Loading…
Add table
Add a link
Reference in a new issue