Distillation

Date: Sep 10, 2026

• 🟡 (11:07) packages/cli/test/lib/oauth.test.ts tests resolveOAuthScopeString from packages/cli/src/lib/oauth.ts using Vitest and fast-check; imports SENTRY_SCOPES, ValidationError, OAUTH_SCOPES, and DEFAULT_NUM_RUNS.
• 🔴 (11:07) OAuth scope-selection invariant documented/tested: readOnly never includes write or admin scopes; resolveOAuthScopeString({ readOnly: true }) contains neither ":write" nor ":admin".
• 🟡 (11:07) OAuth scope tests specify: no selection (resolveOAuthScopeString() or {}) returns OAUTH_SCOPES.join(" "); { readOnly: true } returns exactly the OAUTH_SCOPES entries ending in :read; and explicit scopes takes precedence over readOnly (e.g. { readOnly: true, scopes: ["project:write"] } resolves to "project:write").
• 🟡 (11:07) Explicit OAuth scopes are normalized to lowercase, preserve first-seen order, de-duplicate entries, and skip blank entries: ["ORG:READ", "project:read"] → "org:read project:read"; ["org:read", "project:read", "org:read"] → "org:read project:read"; [" ", "org:read", ""] → "org:read".
• 🟡 (11:07) Unknown OAuth scopes such as "not:a:scope" throw ValidationError with field === "scope" and a message containing the invalid scope; empty explicit scope arrays and arrays containing only blank strings also throw ValidationError.
• 🟡 (11:07) Property tests run DEFAULT_NUM_RUNS: every nonempty unique subset of SENTRY_SCOPES round-trips as its lowercased, space-joined form; every individual known scope is accepted.
• 🔴 (11:08) Host-scoping tests assert that a mismatched credential token never hits the wire; requests are inspected through captured fetchCalls containing url, auth, and iap headers.
• 🟡 (11:08) Located AuthConfig and getAuthConfig() in packages/cli/src/lib/db/auth.ts at lines 84 and 158.
• 🔴 (11:09) getRawEnvToken() in packages/cli/src/lib/db/auth.ts:100-110 always returns the env token if set, independent of stored OAuth priority; it trims values and prioritizes SENTRY_AUTH_TOKEN over SENTRY_TOKEN.
• 🟡 (11:09) AuthSource is exactly "env:SENTRY_AUTH_TOKEN" | "env:SENTRY_TOKEN" | "oauth"; AuthConfig has optional token, refreshToken, expiresAt, and issuedAt, plus required source.
• 🟡 (11:09) getEnvToken() is pure/no-DB and prioritizes trimmed SENTRY_AUTH_TOKEN over SENTRY_TOKEN; isEnvTokenActive() returns whether getEnvToken() is defined; getActiveEnvVarName() follows getRawEnvToken() priority and defaults to "SENTRY_AUTH_TOKEN".
• 🟡 (11:09) getAuthConfig() behavior: if SENTRY_FORCE_ENV_TOKEN is set, it returns the environment token first; otherwise stored OAuth takes priority over env tokens to fix issue #646, preventing wizard-generated build tokens from silently overriding interactive login. If no usable stored OAuth exists, it falls back to env credentials.
• 🟡 (11:09) getAuthConfig() ignores expired stored OAuth tokens without refresh_token, but retains expired tokens with a refresh token so OAuth refresh can proceed. Stored credentials return source: "oauth".
• 🟡 (11:09) getStoredAuthHost() lazy-migrates NULL credential hosts from pre-schema-v16 rows to the currently configured host on first access; it returns undefined if no stored token or a DB error, allowing fallback to env-token host scoping/default behavior.
• 🟡 (11:10) Located clearAuth(): Promise<void> in packages/cli/src/lib/db/auth.ts at line 439.
• 🟡 (11:10) Assistant identified a time-of-check/time-of-use gap in redirect handling and an OAuth refresh redirect leak. Proposed fix: pin redirect trust to the credential selected for the original request and refuse OAuth redirects, preventing bearer tokens, refresh request bodies, and proxy headers from crossing an origin.
• 🟡 (11:10) Search for node:http test usage found packages/cli/test/lib/telemetry/zstd-transport.test.ts:16 importing ClientRequest and IncomingHttpHeaders, plus packages/cli/test/lib/telemetry/zstd-transport.e2e.test.ts, which imports/uses createServer, IncomingMessage, and Server.
• 🟡 (11:11) packages/cli/test/lib/telemetry/zstd-transport.e2e.test.ts provides E2E tests for makeCompressedTransport() using a real http.createServer on 127.0.0.1:0; startMockIngest() returns http://127.0.0.1:${addr.port}/api/0/envelope/ and captures each request’s headers and body.
• 🟡 (11:11) Zstd E2E test "sends zstd-encoded envelope; server decompresses back to original" skips if hasZstdSupport() is false; sends a 4096-character "x" message (above the 1 KiB zstd threshold), expects HTTP 200, exactly 1 capture, content-encoding: "zstd", and uses zstdDecompress to verify the decompressed envelope contains the message and "type":"event".
• 🟡 (11:11) Zstd E2E rate-limit test returns HTTP 429 with retry-after: "60" and x-sentry-rate-limits: "60:error:organization"; verifies makeCompressedTransport() returns those exact headers and makes exactly 1 request.
• 🟡 (11:11) Zstd E2E teardown tracks all servers in startedServers: Server[] and closes every server in parallel via startedServers.splice(0) after each test, avoiding the prior risk of a shared let server being overwritten before closure and silently leaking sockets.