chore: import upstream snapshot with attribution

apps/sim/lib/copilot/tools/server/user/get-credentials.test.ts

@@ -0,0 +1,134 @@
+/**
+ * @vitest-environment node
+ *
+ * Regression test: the credentials response must expose only display metadata,
+ * never the connected account's OAuth access/refresh token.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const SECRET_ACCESS_TOKEN = 'ya29.a0SECRET_GOOGLE_BEARER_TOKEN_DO_NOT_LEAK'
+
+const { selectMock, getAllOAuthServicesMock, getPersonalAndWorkspaceEnvMock, decodeJwtMock } =
+  vi.hoisted(() => ({
+    selectMock: vi.fn(),
+    getAllOAuthServicesMock: vi.fn(),
+    getPersonalAndWorkspaceEnvMock: vi.fn(),
+    decodeJwtMock: vi.fn(),
+  }))
+
+vi.mock('@sim/db', () => ({
+  db: { select: selectMock },
+}))
+
+vi.mock('@/lib/oauth', () => ({
+  getAllOAuthServices: getAllOAuthServicesMock,
+}))
+
+vi.mock('@/lib/environment/utils', () => ({
+  getPersonalAndWorkspaceEnv: getPersonalAndWorkspaceEnvMock,
+}))
+
+vi.mock('jose', () => ({
+  decodeJwt: decodeJwtMock,
+}))
+
+import { getCredentialsServerTool } from './get-credentials'
+
+/**
+ * Wires the two sequential `db.select()` reads the tool performs:
+ * 1. `select().from(account).where()` → account rows (awaited directly)
+ * 2. `select({...}).from(user).where().limit(1)` → user row
+ */
+function wireDb(accountRows: unknown[], userRows: Array<{ email: string }>) {
+  const whereThenable = {
+    then: (resolve: (rows: unknown[]) => unknown) => resolve(accountRows),
+    limit: () => Promise.resolve(userRows),
+  }
+  const builder = { from: () => builder, where: () => whereThenable }
+  selectMock.mockReturnValue(builder)
+}
+
+describe('getCredentialsServerTool', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+
+    wireDb(
+      [
+        {
+          id: 'acct-google-1',
+          providerId: 'google-default',
+          accountId: '1234567890',
+          idToken: 'jwt-token',
+          accessToken: SECRET_ACCESS_TOKEN,
+          refreshToken: 'refresh-secret',
+          updatedAt: new Date('2026-04-17T02:26:05.546Z'),
+        },
+      ],
+      [{ email: 'brent@cellular.so' }]
+    )
+
+    getAllOAuthServicesMock.mockReturnValue([
+      {
+        providerId: 'google-default',
+        name: 'Google',
+        description: 'Google account',
+        baseProvider: 'google',
+      },
+      {
+        providerId: 'slack',
+        name: 'Slack',
+        description: 'Slack workspace',
+        baseProvider: 'slack',
+      },
+    ])
+
+    getPersonalAndWorkspaceEnvMock.mockResolvedValue({
+      personalEncrypted: {},
+      workspaceEncrypted: {},
+      conflicts: [],
+    })
+
+    decodeJwtMock.mockReturnValue({ email: 'brent@cellular.so' })
+  })
+
+  it('never returns access tokens for connected OAuth credentials', async () => {
+    const result = await getCredentialsServerTool.execute({}, { userId: 'user-1' })
+
+    const credentials = result.oauth.connected.credentials
+    expect(credentials).toHaveLength(1)
+
+    for (const credential of credentials) {
+      expect(credential).not.toHaveProperty('accessToken')
+      expect(credential).not.toHaveProperty('refreshToken')
+      expect(credential).not.toHaveProperty('idToken')
+    }
+  })
+
+  it('returns only masked display metadata for each credential', async () => {
+    const result = await getCredentialsServerTool.execute({}, { userId: 'user-1' })
+
+    expect(result.oauth.connected.credentials[0]).toEqual({
+      id: 'acct-google-1',
+      name: 'brent@cellular.so',
+      provider: 'google-default',
+      serviceName: 'Google',
+      lastUsed: '2026-04-17T02:26:05.546Z',
+      isDefault: true,
+    })
+  })
+
+  it('does not leak the token value anywhere in the serialized response', async () => {
+    const result = await getCredentialsServerTool.execute({}, { userId: 'user-1' })
+
+    expect(JSON.stringify(result)).not.toContain(SECRET_ACCESS_TOKEN)
+    expect(JSON.stringify(result)).not.toContain('refresh-secret')
+  })
+
+  it('rejects unauthenticated callers without touching the database', async () => {
+    await expect(getCredentialsServerTool.execute({}, undefined)).rejects.toThrow(
+      'Authentication required'
+    )
+    expect(selectMock).not.toHaveBeenCalled()
+  })
+})