Merge branch 'oracle-devrel:main' into main

Author: davidoracle-wq

ai/gen-ai-agents/oci-enterprise-ai-chat/files/eslint.config.mjs

@@ -1,14 +1,27 @@
-import { dirname } from "path";
-import { fileURLToPath } from "url";
-import { FlatCompat } from "@eslint/eslintrc";
+// eslint-config-next v16 ships a native flat config — the old FlatCompat bridge
+// crashes on it (circular structure error). `next lint` itself was removed in
+// Next 16, so `npm run lint` invokes eslint directly against this config.
+import coreWebVitals from "eslint-config-next/core-web-vitals";
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-});
-
-const eslintConfig = [...compat.extends("next/core-web-vitals")];
+const eslintConfig = [
+  { ignores: [".next/**", "node_modules/**", "public/**", "tests/manual/**", ".claude/**"] },
+  ...coreWebVitals,
+  {
+    rules: {
+      // React Compiler advisories introduced with the v16 ruleset. The codebase
+      // predates them (localStorage hydration via setState-in-effect everywhere);
+      // they flag working patterns, not defects. Kept visible as warnings so new
+      // code can avoid them — `rules-of-hooks` stays an error.
+      "react-hooks/set-state-in-effect": "warn",
+      "react-hooks/static-components": "warn",
+      "react-hooks/purity": "warn",
+      "react-hooks/preserve-manual-memoization": "warn",
+      "react-hooks/use-memo": "warn",
+      "react-hooks/refs": "warn",
+      // Cosmetic: unescaped apostrophes/quotes in JSX copy.
+      "react/no-unescaped-entities": "warn",
+    },
+  },
+];
 
 export default eslintConfig;

ai/gen-ai-agents/oci-enterprise-ai-chat/files/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "oci-enterprise-ai-chat",
-  "version": "0.9.9",
+  "version": "0.10.0",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint .",
     "test": "playwright test"
   },
   "dependencies": {
@@ -39,8 +39,10 @@
   "devDependencies": {
     "@eslint/eslintrc": "^3",
     "@iconify/react": "^6.0.2",
+    "@playwright/test": "^1.60.0",
     "eslint": "^9",
     "eslint-config-next": "16.1.3",
-    "playwright": "^1.57.0"
+    "playwright": "^1.57.0",
+    "undici": "^8.4.1"
   }
 }

ai/gen-ai-agents/oci-enterprise-ai-chat/files/package.json

@@ -1,10 +1,17 @@
 import { defineConfig, devices } from '@playwright/test';
+import os from 'node:os';
+import path from 'node:path';
 
 /**
  * @see https://playwright.dev/docs/test-configuration
  */
 export default defineConfig({
   testDir: './tests',
+  /* OUTSIDE the project tree: writing artifacts under ./test-results while the
+     dev server watches the repo triggers turbopack Fast Refresh mid-test, which
+     remounts React and wipes in-flight chat state — flaking every UI spec that
+     runs after the first failure writes its artifacts. */
+  outputDir: path.join(os.tmpdir(), 'oci-enterprise-ai-chat-test-results'),
   /* Run tests in files in parallel */
   fullyParallel: true,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -13,8 +20,9 @@ export default defineConfig({
   retries: process.env.CI ? 2 : 0,
   /* Opt out of parallel tests on CI. */
   workers: process.env.CI ? 1 : undefined,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: 'html',
+  /* `list` keeps `npm test` non-interactive locally (the `html` reporter spawns
+     a blocking server on failures); CI keeps the rich html report. */
+  reporter: process.env.CI ? 'html' : 'list',
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
     /* Base URL to use in actions like `await page.goto('/')`. */
@@ -24,23 +32,14 @@ export default defineConfig({
     trace: 'on-first-retry',
   },
 
-  /* Configure projects for major browsers */
+  /* Chromium only: it's the only browser installed locally and the suite is
+     unit/API-heavy — cross-browser adds runtime without much signal here. */
   projects: [
     {
       name: 'chromium',
       use: { ...devices['Desktop Chrome'] },
     },
 
-    {
-      name: 'firefox',
-      use: { ...devices['Desktop Firefox'] },
-    },
-
-    {
-      name: 'webkit',
-      use: { ...devices['Desktop Safari'] },
-    },
-
     /* Test against mobile viewports. */
     // {
     //   name: 'Mobile Chrome',

ai/gen-ai-agents/oci-enterprise-ai-chat/files/playwright.config.js

@@ -69,17 +69,28 @@ export async function GET(request) {
     log.info('Token exchange successful', { endpoint: pending.endpoint });
 
     // 3. Persist tokens in a signed cookie
+    //
+    // Two storage shapes depending on what the provider issued:
+    // - refresh_token present (IDCS, Google with offline access): store ONLY the
+    //   refresh token. The access JWT (~3KB for IDCS) would push the signed cookie
+    //   past the browser's ~4KB limit and the cookie gets dropped (hasToken=false).
+    //   /api/mcp/oauth/token mints a fresh access token on demand.
+    // - NO refresh_token (GitHub OAuth apps, Slack without rotation): store the
+    //   access token itself — those are small opaque strings, and without it the
+    //   cookie would be unusable (nothing to mint from). When the provider also
+    //   omits expires_in, the token is long-lived; cap it at the cookie's 30 days.
+    const hasRefresh = !!tokenData.refresh_token;
+    const expiresInMs = tokenData.expires_in
+      ? tokenData.expires_in * 1000
+      : (hasRefresh ? 3600 * 1000 : 30 * 24 * 60 * 60 * 1000);
     const tokens = await signPayload({
       endpoint: pending.endpoint,
       clientId: pending.clientId,
       clientSecret: pending.clientSecret,
       tokenEndpoint: pending.tokenEndpoint,
-      // Access JWT (~3KB for IDCS) is NOT stored — it would push the signed cookie
-      // past the browser's ~4KB limit and the cookie gets dropped (hasToken=false).
-      // Store only the small refresh token; /api/mcp/oauth/token mints a fresh
-      // access token on demand. This also fixes access-token expiry.
-      refreshToken: tokenData.refresh_token,
-      expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000,
+      refreshToken: tokenData.refresh_token || null,
+      ...(hasRefresh ? {} : { accessToken: tokenData.access_token }),
+      expiresAt: Date.now() + expiresInMs,
     });
 
     const response = NextResponse.redirect(returnUrl(request, 'success', pending));

ai/gen-ai-agents/oci-enterprise-ai-chat/files/src/app/api/mcp/oauth/callback/route.js

@@ -1,12 +1,14 @@
 import { NextResponse } from 'next/server';
-import { verifyPayload, signPayload, refreshAccessToken, tokenCookieName } from '../../../../lib/mcp-oauth';
+import { verifyPayload, signPayload, mintAccessToken, tokenCookieName } from '../../../../lib/mcp-oauth';
+import { createLogger } from '../../../../lib/logger';
 
 /**
  * GET /api/mcp/oauth/token?endpoint=...
  * Returns the current access token for a given MCP endpoint.
  * Used by the frontend to pass the token to OCI Responses API.
  */
 export async function GET(request) {
+  const log = createLogger('mcp-oauth-token');
   const endpoint = new URL(request.url).searchParams.get('endpoint');
   if (!endpoint) {
     return NextResponse.json({ error: 'endpoint is required' }, { status: 400 });
@@ -16,27 +18,50 @@ export async function GET(request) {
   const tokenCookie = request.cookies.get(cookieName)?.value;
   const tokens = await verifyPayload(tokenCookie);
 
-  if (!tokens || !tokens.refreshToken) {
+  if (!tokens || (!tokens.refreshToken && !tokens.accessToken)) {
+    log.info('No usable token', { endpoint: endpoint.slice(0, 60), hasCookie: !!tokenCookie, verified: !!tokens });
     return NextResponse.json({ hasToken: false });
   }
 
-  // Lightweight presence check (used by Settings to show authorized/needs_auth).
-  // Does NOT consume the refresh token.
+  // Access-token-only cookie: the provider issued no refresh token (GitHub OAuth
+  // apps, Slack without rotation). Serve the stored token while it's valid;
+  // once expired there is nothing to mint from — the user must re-authorize.
+  if (!tokens.refreshToken) {
+    const valid = tokens.expiresAt > Date.now() + 30000;
+    if (new URL(request.url).searchParams.get('probe') === 'true') {
+      return NextResponse.json({ hasToken: valid });
+    }
+    return valid
+      ? NextResponse.json({ hasToken: true, accessToken: tokens.accessToken })
+      : NextResponse.json({ hasToken: false });
+  }
+
+  // Settings status probe. It used to only check that the cookie EXISTS, which
+  // showed "Authorized" while the refresh token was already dead — the user then
+  // hit the auth banner on the very next message. Verify mintability for real;
+  // the shared mint cache makes this one IdP roundtrip per token lifetime.
   if (new URL(request.url).searchParams.get('probe') === 'true') {
-    return NextResponse.json({ hasToken: true });
+    try {
+      await mintAccessToken(tokens.tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret);
+      return NextResponse.json({ hasToken: true });
+    } catch (err) {
+      log.error('Probe mint failed', { endpoint: endpoint.slice(0, 60), error: (err?.message || '').slice(0, 200) });
+      return NextResponse.json({ hasToken: false });
+    }
   }
 
   // The cookie stores ONLY the refresh token (the IDCS access JWT is ~3KB and would
   // blow past the browser's ~4KB cookie limit). Always mint a fresh access token
   // from the refresh token, and persist the (possibly rotated) refresh token.
   try {
-    const refreshed = await refreshAccessToken(
+    const minted = await mintAccessToken(
       tokens.tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret
     );
-    tokens.refreshToken = refreshed.refresh_token || tokens.refreshToken;
-    tokens.expiresAt = Date.now() + (refreshed.expires_in || 3600) * 1000;
+    tokens.refreshToken = minted.refreshToken;
+    tokens.expiresAt = minted.expiresAt;
+    log.info('Access token served', { endpoint: endpoint.slice(0, 60) });
 
-    const response = NextResponse.json({ hasToken: true, accessToken: refreshed.access_token });
+    const response = NextResponse.json({ hasToken: true, accessToken: minted.accessToken });
     const isHttps = (request.headers.get('x-forwarded-proto') || 'http') === 'https';
     response.cookies.set(cookieName, await signPayload(tokens), {
       httpOnly: true,
@@ -46,7 +71,10 @@ export async function GET(request) {
       path: '/',
     });
     return response;
-  } catch {
+  } catch (err) {
+    // Surface the IdP's actual error — a silent hasToken:false here made the
+    // Nl2Sql (Text-to-SQL) tool quietly drop out of requests with no trace of why.
+    log.error('Refresh failed', { endpoint: endpoint.slice(0, 60), error: (err?.message || '').slice(0, 300) });
     return NextResponse.json({ hasToken: false });
   }
 }