@@ -9,11 +9,17 @@ const {
99 mockCreateCopilotManagedOAuthPrincipal,
1010 mockResolveCredentialAccessToken,
1111 mockPersonalCredentialUseCase,
12+ mockOrganizationPersonalToken,
1213} = vi . hoisted ( ( ) => ( {
1314 mockBindExecutorManagedOAuthDelegation : vi . fn ( ) ,
1415 mockCreateCopilotManagedOAuthPrincipal : vi . fn ( ) ,
1516 mockResolveCredentialAccessToken : vi . fn ( ) ,
1617 mockPersonalCredentialUseCase : vi . fn ( ) ,
18+ mockOrganizationPersonalToken : vi . fn ( ) ,
19+ } ) )
20+
21+ vi . mock ( '@/lib/mothership/application/resolve-organization-personal-token' , ( ) => ( {
22+ resolveCopilotOrganizationPersonalToken : mockOrganizationPersonalToken ,
1723} ) )
1824
1925vi . mock ( '@/lib/credentials/application/copilot-managed-oauth-delegation' , ( ) => ( {
@@ -25,7 +31,7 @@ vi.mock('@/lib/mothership/application/execute-credential-use-case', () => ({
2531} ) )
2632vi . mock ( '@/tools/metadata' , ( ) => ( {
2733 getToolMetadata : ( id : string ) =>
28- id === 'gmail_read' ? { oauth : { required : true , provider : 'google-email' } } : undefined ,
34+ id === 'gmail_read' ? { id , oauth : { required : true , provider : 'google-email' } } : undefined ,
2935} ) )
3036
3137vi . mock ( '@/lib/oauth/token-resolution' , ( ) => ( {
@@ -54,6 +60,38 @@ describe('resolveExecutorCredentialToken', () => {
5460 } )
5561 } )
5662
63+ it ( 'uses organization-native personal authority without reaching workspace token resolution' , async ( ) => {
64+ const context = {
65+ userId : 'user-1' ,
66+ organizationId : 'org' ,
67+ chatId : 'chat' ,
68+ toolCallId : 'call' ,
69+ copilotToolExecution : true ,
70+ requestMode : 'assistant' ,
71+ }
72+ mockOrganizationPersonalToken . mockResolvedValue ( {
73+ accessToken : 'own-token' ,
74+ credentialType : 'managed_oauth' ,
75+ } )
76+ const token = await resolveExecutorCredentialToken ( {
77+ requestId : 'req' ,
78+ credentialId : 'own' ,
79+ userId : 'user-1' ,
80+ toolId : 'gmail_read' ,
81+ scopes : [ 'read' ] ,
82+ copilotExecutionContext : context ,
83+ } )
84+ expect ( token . accessToken ) . toBe ( 'own-token' )
85+ expect ( mockOrganizationPersonalToken ) . toHaveBeenCalledWith ( context , {
86+ credentialId : 'own' ,
87+ expectedProviderId : 'google-email' ,
88+ requiredScopes : [ 'read' ] ,
89+ toolId : 'gmail_read' ,
90+ } )
91+ expect ( mockPersonalCredentialUseCase ) . not . toHaveBeenCalled ( )
92+ expect ( mockResolveCredentialAccessToken ) . not . toHaveBeenCalled ( )
93+ } )
94+
5795 it ( 'dispatches with an internal-JWT auth result for the executing user' , async ( ) => {
5896 await resolveExecutorCredentialToken ( {
5997 requestId : 'req-1' ,
0 commit comments