From 0b48bc7ac5d0e95d7689abcd68f02624f4650c29 Mon Sep 17 00:00:00 2001 From: Dotta <34892728+cryppadotta@users.noreply.github.com> Date: Fri, 6 Nov 2026 14:19:17 -0600 Subject: [PATCH] test(connections): isolate scheduled GitHub history scans (#19541) ## Thinking Path > - Paperclip lets people manage AI agents and their service connections. > - Connection identity reads must use the authenticated caller's current account grants. > - This integration suite runs the real HTTP routes and bearer authentication against provider fixtures. > - An earlier GitHub App fixture stays active after its test ends. > - Its history worker can run 60 seconds later against the next test's shared provider handler. > - This pull request keeps that unrelated worker inactive in this suite. > - The identity test keeps its original provider-count and authorization assertions. ## Linked Issues or Issue Description **What happened?** The Anthropic identity integration test reported three provider calls instead of two. The denied request returned `connection_unavailable` correctly. A controlled reproduction traced the third call to GitHub's `/app/hook/config` from an earlier test's webhook recovery worker. **Expected behavior** The suite must measure requests from the operation under test. Foreign-company, unknown-grant, and revoked-grant requests must not contact the identity provider. **Steps to reproduce** Run the GitHub App import fixture before the identity test. Initialize the saved GitHub recovery epoch. Advance only the fixture Date by 60,001 ms, then run the actual current recovery check after the two authorized identity reads. The original final count assertion fails with three calls. The extra call's stack runs through `readGitHubAppWebhookConfig`, `recoverGitHubWebhookEndpoint`, and the recovery schedule's `check`. Related implementation: #17666. No duplicate fixture repair was found. ## What Changed - Keep automatic GitHub webhook history work inactive in this connection-management test suite. - Keep real connection setup, HTTP routes, database state, agent API keys, JWT authentication, and all existing identity assertions. - Leave production registration and the dedicated chat-channel recovery tests unchanged. ## Verification - Exact baseline `5d25117ffad69a93fb92026950b9acd9cec08f69`: the unchanged focused identity test passed. - Controlled red on that baseline: the original final `expect(calls).toBe(2)` failed with three. The third URL was `https://api.github.com/app/hook/config`. The revoked identity response stayed unavailable. - Local provider traffic uses fixture responses. No real provider credentials or requests were used. - Full connection-management suite: **90/90 passed** on the exact release baseline plus this fixture fix (commit `e33c091438`). Command from `server`: `../node_modules/.bin/vitest run --config vitest.config.ts --fsModuleCache src/__tests__/connection-management.integration.test.ts`. - Rebased onto current master. A fresh GitHub-import plus identity pair passed **2/2** on final head `95ed6147920e48128892744e1a4f220373f7da5b` after removal of the added comments required by review. Greptile reviewed that exact head at **5/5**. The addressed comment thread is resolved. Required CI remains pending. Final reviewed head: `95ed6147920e48128892744e1a4f220373f7da5b`. [Required CI](https://github.com/paperclipai/paperclip/actions/runs/42272042111) passed (54 successful checks, three expected skips and the completed neutral Paperclip Review check; none pending or failed). Greptile and Paperclip Review both rated the change 5/5 with no remaining findings. The addressed review thread is resolved. The first attempt's canary runner communication loss and unrelated cold-import timeout are retained as failed evidence; the unchanged cold-import suite passed 4/4 locally, and only failed CI jobs were rerun successfully. ## Risks Low risk. This changes test isolation only. The connection-management suite no longer runs unrelated GitHub history scans. Dedicated chat-channel integration tests still cover those scans. No authorization check, assertion, deadline, or production behavior changes. ## Model Used OpenAI GPT-6 family via Codex, with coding and tool use. The exact model ID and context window are unavailable in this session's metadata. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip --- .../src/__tests__/connection-management.integration.test.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/server/src/__tests__/connection-management.integration.test.ts b/server/src/__tests__/connection-management.integration.test.ts index 44f4b71c2d4..aadbab09c64 100644 --- a/server/src/__tests__/connection-management.integration.test.ts +++ b/server/src/__tests__/connection-management.integration.test.ts @@ -33,6 +33,12 @@ vi.mock("../services/agent-lifecycle-driver.js", () => ({ createLifecycleDriver: () => ({ requiredPluginIds: async () => [], runPlugin: async () => "complete", runHost: async () => "complete" }), })); +vi.mock("../services/chat-channels/github/webhook-recovery-work.js", async importOriginal => { + const original = await importOriginal(); + return { ...original, registerGitHubWebhookRecoveryWork: (...args: Parameters) => + original.registerGitHubWebhookRecoveryWork(args[0], args[1], () => false) }; +}); + // All requests traverse the assembled server and production bearer middleware. // No req.actor injection or special permission grants establish access. describe("connection management with production default agents", () => {