feat(gitlab): encrypt GitLab integration credentials at rest #14644
eshurakovci.yml
on: pull_request
changes
29s
typecheck
3m 27s
lint
1m 19s
format-check
46s
drizzle-check
55s
Matrix: workspace-tests
notify-main-failure
0s
Annotations
10 errors and 1 warning
|
src/gitlab-oauth-credential-refresher.test.ts > GitLabOAuthCredentialRefresher > refreshes encrypted credentials without rewriting plaintext:
services/git-token-service/src/gitlab-oauth-credential-refresher.test.ts#L170
AssertionError: expected { status: 'reconnect_required' } to deeply equal { status: 'available', …(2) }
- Expected
+ Received
{
- "credentialVersion": 2,
- "status": "available",
- "token": "new-access-token",
+ "status": "reconnect_required",
}
❯ src/gitlab-oauth-credential-refresher.test.ts:170:5
|
|
src/gitlab-credential-service.test.ts > GitLabCredentialService > refreshes an expired OAuth credential through the locked refresher:
services/git-token-service/src/gitlab-credential-service.test.ts#L266
AssertionError: expected { status: 'reconnect_required' } to deeply equal { status: 'available', …(7) }
- Expected
+ Received
{
- "credentialId": "oauth-credential-1",
- "credentialVersion": 2,
- "glabIsOAuth2": true,
- "instanceUrl": "https://gitlab.example.com",
- "integrationId": "integration-1",
- "source": {
- "type": "integration",
- },
- "status": "available",
- "token": "refreshed-oauth-secret",
+ "status": "reconnect_required",
}
❯ src/gitlab-credential-service.test.ts:266:5
|
|
src/gitlab-credential-service.test.ts > GitLabCredentialService > resolves a matching encrypted OAuth access token:
services/git-token-service/src/gitlab-credential-service.test.ts#L205
AssertionError: expected { status: 'reconnect_required' } to deeply equal { status: 'available', …(7) }
- Expected
+ Received
{
- "credentialId": "oauth-credential-1",
- "credentialVersion": 1,
- "glabIsOAuth2": true,
- "instanceUrl": "https://gitlab.example.com",
- "integrationId": "integration-1",
- "source": {
- "type": "integration",
- },
- "status": "available",
- "token": "oauth-access-secret",
+ "status": "reconnect_required",
}
❯ src/gitlab-credential-service.test.ts:205:5
|
|
src/bitbucket-authorization-service.test.ts > BitbucketAuthorizationService > marks terminal invalid_grant refresh failures as reconnect required:
services/git-token-service/src/bitbucket-authorization-service.test.ts#L395
AssertionError: expected [] to deep equally contain ObjectContaining{…}
- Expected:
ObjectContaining {
"revocation_reason": "refresh_token_rejected",
}
+ Received:
[]
❯ src/bitbucket-authorization-service.test.ts:395:30
|
|
src/bitbucket-authorization-service.test.ts > BitbucketAuthorizationService > normalizes Atlassian legacy scope aliases during credential refresh:
services/git-token-service/src/bitbucket-authorization-service.test.ts#L376
AssertionError: expected { status: 'reconnect_required' } to match object { status: 'available' }
- Expected
+ Received
{
- "status": "available",
+ "status": "reconnect_required",
}
❯ src/bitbucket-authorization-service.test.ts:376:5
|
|
src/bitbucket-authorization-service.test.ts > BitbucketAuthorizationService > refreshes under a lock and rotates both credential envelopes:
services/git-token-service/src/bitbucket-authorization-service.test.ts#L328
AssertionError: expected { status: 'reconnect_required' } to match object { status: 'available', …(1) }
- Expected
+ Received
{
- "status": "available",
- "token": "next-access-token",
+ "status": "reconnect_required",
}
❯ src/bitbucket-authorization-service.test.ts:328:20
|
|
src/bitbucket-authorization-service.test.ts > BitbucketAuthorizationService > fails closed when organization access disappears before a credential refresh:
services/git-token-service/src/bitbucket-authorization-service.test.ts#L286
AssertionError: expected { status: 'reconnect_required' } to deeply equal { status: 'not_connected' }
- Expected
+ Received
{
- "status": "not_connected",
+ "status": "reconnect_required",
}
❯ src/bitbucket-authorization-service.test.ts:286:5
|
|
src/bitbucket-authorization-service.test.ts > BitbucketAuthorizationService > returns workspace selection state without decrypting credentials:
services/git-token-service/src/bitbucket-authorization-service.test.ts#L267
AssertionError: expected { status: 'reconnect_required' } to deeply equal { Object (status) }
- Expected
+ Received
{
- "status": "workspace_selection_required",
+ "status": "reconnect_required",
}
❯ src/bitbucket-authorization-service.test.ts:267:66
|
|
src/bitbucket-authorization-service.test.ts > BitbucketAuthorizationService > decrypts organization credentials only with organization-bound AAD:
services/git-token-service/src/bitbucket-authorization-service.test.ts#L245
AssertionError: expected { status: 'reconnect_required' } to match object { status: 'available', …(1) }
- Expected
+ Received
{
- "status": "available",
- "token": "access-token",
+ "status": "reconnect_required",
}
❯ src/bitbucket-authorization-service.test.ts:245:75
|
|
src/bitbucket-authorization-service.test.ts > BitbucketAuthorizationService > returns a decrypted token only for an active selected workspace:
services/git-token-service/src/bitbucket-authorization-service.test.ts#L190
AssertionError: expected { status: 'reconnect_required' } to match object { status: 'available', …(3) }
- Expected
+ Received
{
- "integrationId": "integration-1",
- "status": "available",
- "token": "access-token",
- "workspace": {
- "slug": "acme",
- },
+ "status": "reconnect_required",
}
❯ src/bitbucket-authorization-service.test.ts:190:66
|
|
test (cloudflare-git-token-service)
[git-mirror] Skipping cache commit: Found 2 failed/cancelled steps
|