fix: reject required custom auth fields (#44)

Author: TheRealAgentK

.github/workflows/self-test.yml

@@ -54,6 +54,9 @@ jobs:
           fi
           echo "✅ Auto-discovery correctly skips tests/"
 
+      - name: Test validate_integration.py — focused pytest regressions
+        run: pytest tests/test_validate_integration.py
+
       - name: Test check_imports.py — valid imports
         run: |
           python scripts/check_imports.py tests/examples/submodule-imports/valid_submodules.py

scripts/docs/validate_integration.md

@@ -107,7 +107,7 @@ Validates based on `auth.type`:
 | Auth Type | Required Fields | Description |
 |-----------|----------------|-------------|
 | `platform` | `provider`, `scopes` (array) | OAuth2-based authentication |
-| `custom` | `fields.properties` | API key or token-based authentication |
+| `custom` | `fields.properties` | API key or token-based authentication. `auth.fields.required` must be absent or empty; credential presence is handled by the platform connection flow. |
 | _(omitted)_ | — | No authentication (public APIs) |
 
 #### Action Configuration (`_validate_actions_config`)

scripts/validate_integration.py

@@ -121,7 +121,10 @@ def _check_required_files(self):
         # use absolute imports like 'from <integration> import <instance>'.
         has_actions_dir = (self.path / 'actions').is_dir()
         if not (self.path / '__init__.py').exists() and not has_actions_dir:
-            self.add_warning("Missing __init__.py (required for package-style integrations, optional for modular integrations with actions/)")
+            self.add_warning(
+                "Missing __init__.py "
+                "(required for package-style integrations, optional for modular integrations with actions/)"
+            )
 
         # Check for forbidden files
         if (self.path / 'integration.py').exists():
@@ -244,6 +247,14 @@ def _validate_auth_config(self):
                 self.add_error("Custom auth requires 'fields' configuration")
             elif 'properties' not in auth.get('fields', {}):
                 self.add_error("Custom auth fields must have 'properties' defined")
+            else:
+                required_fields = auth['fields'].get('required')
+                if required_fields:
+                    self.add_error(
+                        "Custom auth fields must not define a non-empty auth.fields.required array. "
+                        "Credential collection and presence are handled by the platform connection flow; "
+                        "define auth.fields.properties only."
+                    )
 
         elif auth_type is not None:
             self.add_warning(f"Unknown auth type: '{auth_type}'. Expected 'platform' or 'custom'")

tests/examples/bad-icon/config.json

@@ -15,8 +15,7 @@
           "label": "API Key",
           "help_text": "Enter your API key"
         }
-      },
-      "required": ["api_key"]
+      }
     }
   },
   "actions": {

tests/examples/good-integration/config.json

@@ -15,8 +15,7 @@
           "label": "API Key",
           "help_text": "Enter your API key"
         }
-      },
-      "required": ["api_key"]
+      }
     }
   },
   "actions": {

tests/examples/long-lines-integration/config.json

@@ -15,8 +15,7 @@
           "label": "API Key",
           "help_text": "Enter your API key"
         }
-      },
-      "required": ["api_key"]
+      }
     }
   },
   "actions": {

tests/examples/modular-integration/config.json

@@ -15,8 +15,7 @@
           "label": "API Key",
           "help_text": "Enter your API key"
         }
-      },
-      "required": ["api_key"]
+      }
     }
   },
   "actions": {

tests/sample-api/config.json

@@ -15,8 +15,7 @@
           "label": "API Key",
           "help_text": "Enter your API key from the dashboard"
         }
-      },
-      "required": ["api_key"]
+      }
     }
   },
   "actions": {

tests/test_validate_integration.py

@@ -0,0 +1,78 @@
+import sys
+from pathlib import Path
+
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
+
+from validate_integration import IntegrationValidator  # noqa: E402
+
+
+def _validate_auth(config: dict) -> IntegrationValidator:
+    validator = IntegrationValidator(Path("custom-auth"))
+    validator.config = config
+    validator._validate_auth_config()
+    return validator
+
+
+def test_custom_auth_without_required_is_valid() -> None:
+    validator = _validate_auth(
+        {
+            "auth": {
+                "type": "custom",
+                "fields": {
+                    "type": "object",
+                    "properties": {
+                        "api_key": {"type": "string"},
+                    },
+                },
+            }
+        }
+    )
+
+    assert validator.errors == []
+    assert validator.warnings == []
+
+
+def test_custom_auth_empty_required_array_is_allowed() -> None:
+    validator = _validate_auth(
+        {
+            "auth": {
+                "type": "custom",
+                "fields": {
+                    "type": "object",
+                    "properties": {
+                        "api_key": {"type": "string"},
+                    },
+                    "required": [],
+                },
+            }
+        }
+    )
+
+    assert validator.errors == []
+    assert validator.warnings == []
+
+
+def test_custom_auth_non_empty_required_array_is_rejected() -> None:
+    validator = _validate_auth(
+        {
+            "auth": {
+                "type": "custom",
+                "fields": {
+                    "type": "object",
+                    "properties": {
+                        "api_key": {"type": "string"},
+                    },
+                    "required": ["api_key"],
+                },
+            }
+        }
+    )
+
+    messages = [error.message for error in validator.errors]
+    assert messages == [
+        "Custom auth fields must not define a non-empty auth.fields.required array. "
+        "Credential collection and presence are handled by the platform connection flow; "
+        "define auth.fields.properties only."
+    ]
+    assert validator.warnings == []